diff --git a/docs/development/GENESIS_MACOS_PROCESS_GROUP_CLOSURE_V1_DELIVERY.md b/docs/development/GENESIS_MACOS_PROCESS_GROUP_CLOSURE_V1_DELIVERY.md
new file mode 100644
index 00000000..0c8f6370
--- /dev/null
+++ b/docs/development/GENESIS_MACOS_PROCESS_GROUP_CLOSURE_V1_DELIVERY.md
@@ -0,0 +1,127 @@
+# Genesis macOS process-group closure — scoped delivery
+
+Assignment `L2-GENESIS-MACOS-PROCESS-GROUP-CLOSURE-V1-20261019`.
+JOIN `L2-L3-GENESIS-APPLY-HOST-QUALIFICATION-V1-20261019`.
+Same ARCHITECT_2 / LANE_2_WORK and sole EP source writer. Closed predecessor
+source, qualified inspection/progress pins and EP2.3.123 proofs stay unchanged.
+This is a separate nonempty documentary Finalization, NO_BUMP: EP2.3.124,
+CENTRAL77, storage45 and Genesis bootstrap contract1.0 remain unchanged.
+
+## Protected implementation and supported boundary
+
+Implementation [PR363](https://github.com/pcvantol/engineering-platform/pull/363)
+was normally protected-squash merged on 2026-10-19 as
+`3f05424c8ea96ea73c7a33813a0794f3fec3f6f0`, from main
+`4d0c0461d7a5ec7fb7a50aa42f775cc4be09faa5`. Independently approved source
+`7a10a2e1b7e3783b5fa08ade84ac5089ad7062fc` and implementation merge share
+exact tree `ed564965ed9cca413dbfb4506398064c422edc6e`. Original implementation
+branch, intermediate source history, tags and historical evidence are retained.
+
+The original hosted Apple Git shim timed out at GIT_INIT while live bash and
+xcodebuild members remained in the original group. Whole-group refusal was
+correct. Later shim/reversed controls also succeeded: no unique cache/warming
+cause or universal-host support is established. Explicit
+MACOS_OS_SELECTED_PHYSICAL_GIT_V1 selects the physical Git through the root-owned
+OS selector. Operation/host pins, bounded no-follow byte/metadata verification,
+pre/post verification and drift refusal apply. Root-owned writable ancestors
+require Darwin privileged GID0/80; other group/world-write refuses. Trusted
+installation-owner/system-admin mutation remains outside atomic exec guarantees.
+See the [owning host contract](../engineering/GENESIS_MACOS_GIT_RUNTIME_V1.md).
+
+Original five-second Git/30-second step limits, native profile, current effect
+authority, exact37 documents and validation, handshake, durable bounded private
+stdout/stderr and actual whole-group closure before STEP_COMPLETED remain.
+Primary timeout/nonzero/overflow errors survive secondary log-write failure.
+Explicit legacy readiness migration preserves original attempts/completed steps;
+GET never migrates or executes. Empty Git recovery requires the original signed
+literally-empty metadata inode and exact original target/documents, held and
+rechecked after last runtime verification immediately before Git. No foreign
+adoption/deletion/reset, unknown-group signals, timeout or threshold waiver.
+
+## Exact candidate evidence
+
+Canonical candidate ordinary wheel SHA256
+`36f751f00769b18f48ad6b66bc2f97968582b76ac1369e7706c48b68eac9f7de`.
+All214 source/wheel/noneditable installed payloads matched before and after
+actual17-case local native HTTP/recovery matrix and live-surviving-child negative.
+All17 original receipts PASS, cleanup0; a reaped parent with an actually live
+same-birth child remains BOOTSTRAP_HOST_GROUP_ACTIVE_OR_UNCERTAIN, and only
+natural child exit permits ABSENT_ESRCH. Original operations, commit, Git tree
+and one committed B8R attachment remain bound; no submission/run/remote effect.
+
+[Hosted product probe39259505106](https://github.com/pcvantol/engineering-platform/actions/runs/39259505106)
+completed SUCCESS on actual macOS14.8.9 arm64. Actual lost reply, real Server
+crash/restart, nonmutating GET, separately current-authority resume/replay and
+18 original ESRCH observations qualified the small installed chain. Its Linux
+component job discovered83 tests, executed77 with6 explicit Darwin skips; all
+four changed production modules strictly exceed80.2% executable-line coverage.
+Models/portable controller tests do not count as native macOS execution.
+
+[Complete normal CI39260558592](https://github.com/pcvantol/engineering-platform/actions/runs/39260558592)
+actually completed SUCCESS, including validate and the last trusted-evidence
+job. CI executed synthetic merge `025cf86b6c3671488c5fdb49769c0ba355d26d8a`,
+with the exact candidate tree. Its separately built wheel SHA256
+`5999b41ab72ea7e0eb1ca82a264accbb0b56961ff57939955da31984879fe442`
+is not relabeled as the local wheel.
+
+- Complete installed coverage:2783 discovered/2773 executed/10 explicit skips,
+  181 measured production modules all meet unchanged combined>=80.20%,
+  minimum80.32%, aggregate85.01%. Changed module combined figures:
+  runtime95.56%, service84.17%, worker82.97%, version87.72%; strict executable-line
+  qualification is separately retained, not inferred from combined coverage.
+- Broad behavior:2801 discovered/2791 executed/10 skips. Native admission,
+  coupled recovery102 tests and restored fault controls, transport3x2,
+  PA-EQ16, repository authority8, deterministic Genesis/Managed/recovery and
+  HTTP/OpenAPI/Postman all succeed.
+- Four original browser screenshot parts:530 mandatory PASS, retry0,
+  exactly4 existing baseline skips. Exact-asset executable-line coverage:
+  dashboard86.845573%, locales99.653274%, run evidence98.4%.
+- Canonical version, static security, CodeQL, Golden Smoke and Trusted Delivery
+  succeeded. Golden Regression is event-condition SKIPPED, not fresh PASS.
+  Normal exact-head OwnerAuthorization39260655446 PASS. Independent final
+  Quality/Security and final-gate addenda approved exact source before merge.
+
+## Preserved failures and limits
+
+Earlier candidates, controlled faults, original failures and archives retain
+original pins. Old candidate full CI39252047755 remains CANCELLED. Legacy
+old-to-new WRITE_FILES recovery and exact empty-inode recovery after a MODELED
+Git-call fault are not reconstructed historical hosted failures. The first
+empty-inode fixture HTTP-envelope KeyError remains FAIL; only the same original
+operation/grant later recovered. Current causal guard RED/GREEN remains distinct
+from host proof. Temporary GitHub502/404/readback gaps and initial observer
+count/shape assumptions are preserved and are not product PASS or lost-log claims.
+
+TDE observe39260558312 workflow SUCCESS is separately **policy FAIL,
+qualification FAILED**, coverage UNAVAILABLE. Its unchanged setup did not install
+EP or provide PYTHONPATH before discovery:264 tests,181 ModuleNotFoundError
+engineering_platform errors,1 skip. Normal installed coverage does not turn
+this into TDE PASS. Existing complexity debt remains observable under unchanged
+observe policy; no concrete remaining behavior/security blocker was found.
+No collector/policy fix, suppression or broad refactor is selected here.
+
+## Own Finalization and exact-final-main obligation
+
+This documentation requires its own independent reviews, ordinary configured
+checks and protected exact-head merge; it cannot self-reference its eventual
+commit. After that merge, build a NEW ordinary wheel from actual exact final-main,
+verify actual child interpreter/import and every package payload, and run NEW
+isolated noneditable installed native/group/Git/B8R/real-Server-restart/lost-reply,
+nonmutating GET/current-authority resume and live-group negative evidence.
+Candidate evidence cannot be relabeled exact-final-main. The append-only terminal
+register and JOIN handoff record those actual final source/tree/wheel/receipt
+facts after they exist. Automatic main workflow outcomes are read separately.
+
+Owning Genesis routes remain POST /v1/bootstrap/genesis/operations,
+GET /v1/bootstrap/genesis/operations/{operation_id}, and POST of that exact
+operation's /resume, with Bearer and exact EP-Bootstrap-Contract, EP-Instance-ID,
+EP-Host-ID, EP-Consumer-ID, EP-Principal and EP-Audience. Request/receipt schemas,
+R50 bundle and external validator pins remain unchanged. Only finite independent
+EP-owner-granted CREATE_GENESIS_LOCAL effects on the original absent disposable
+target are selected; COMPLETE is not Forge Mission acceptance.
+
+Preserve unique raw evidence, hashes, private logs and encrypted archives before
+safe cleanup of ended own resources. No public package release, installer/signing,
+user installation/repository change or automatic successor. Qualified producer
+handoff to #207 is separate from Forge R57 acceptance. R57 PR298, consumer writer,
+paused timer and all existing budgets remain unchanged; L4/L1 are unaffected.