diff --git a/openspec/changes/add-otlp-business-event-logs/acceptance.md b/openspec/changes/add-otlp-business-event-logs/acceptance.md
index e87eba0f5..38d6806c3 100644
--- a/openspec/changes/add-otlp-business-event-logs/acceptance.md
+++ b/openspec/changes/add-otlp-business-event-logs/acceptance.md
@@ -150,3 +150,22 @@ A real demo stop/start initially failed because the file exporter truncates its
 Contract checks are separate: the fake-Docker lifecycle script covers default off, existing receiver, optional Collector, repeated up, updates, stop/start, disable, permissions, secret retention, flat OSS paths, and both Make modes. Python deployment checks pass 6 cases, including rendered private-network/volume/metrics settings. Helm configuration contracts and strict lint pass; the supplied minimal Helm image command required adding Python 3 for the chart's pre-existing Python contract checks. Bash 3's pre-existing empty-array issue in the storage selector test was avoided by running that test in a Linux Bash container. No production data or credentials were used.
 
 `npm ci`, the VitePress build, weekly site generation/validation and `git diff --check` pass. No full backend rerun, browser/CLI E2E, production TLS/mTLS, live Helm install/upgrade, real external Java agent or durable downstream storage validation is claimed. Host dev verification intentionally used only PostgreSQL/Redis and PRIVATE admin publications rather than the full scanner/frontend stack. Versioned/flat retrieval was exercised through the same download function with a local file root because these new files are not published yet; OSS/release upload and PR publication remain with the owner. No push or PR mutation was performed.
+
+## Repair 4a (independent review)
+
+Starting tree: `c327ea2e`. Evidence filenames below are relative to the worker's `evidence-r4/repair-a/` directory. Each new regression was run RED before its implementation/documentation fix, then GREEN. The fake-Docker suite is registered in script CI; the Helm access case is a documentation contract, not a live Kubernetes test.
+
+| Finding | Fix and executed regression | RED → GREEN evidence |
+| --- | --- | --- |
+| B1: image version changed file ref | Remove the global fallback; restore the entire lifecycle-argument function exactly to `2a64d152`. An existing analytics overlay plus `ps --version v0.2.25` records raw URLs under `main`, or `x` with `SKILLHUB_REF=x`. An env ref equal to the image version is retained in generated lifecycle commands. Guide and zh/en site explicitly pin `--ref <tag> --version <tag>` together | `b1-red.log`: both refs incorrectly use `v0.2.25`, lifecycle omits ref, exit 1. `b1-green.log`: correct main/x URLs and lifecycle ref, exit 0 |
+| B2: disable discarded attachment intent | Disable changes collection only, retaining the private-network flag. Private-receiver and optional-Collector enable → disable → enable both recreate server with the network overlay and retain the saved endpoint/network. Public HTTPS works without a private network | `b2-red.log`: private and Collector attachment failures, exit 1. `b2-green.log`: all three cases pass, exit 0 |
+| N1: first Collector network option ignored | Seed the independent env from `--logs-network` only at first creation. A later conflicting CLI network leaves the existing env byte-for-byte unchanged and uses its saved network | `n1-red.log`: default network instead of supplied name, exit 1. `n1-green.log`: supplied network plus unchanged existing env, exit 0 |
+| N2: Helm metrics access | Document server-Service port-forward, then admin login and metrics queries on that forwarded origin; the shared query preserves the selected BASE. No ingress changes | `n2-red.log`: missing Service port-forward, exit 1. `n2-green.log`: same-origin documentation contract passes, exit 0 |
+
+Real Docker used the authorized isolated `release-test` context and a fresh `server/Dockerfile` image build. Actual admin PRIVATE publication/download requests returned 200 in enabled, disabled and re-enabled states. The plain private receiver had 2 records after enable, still 2 after disable, and 4 after enable without repeating network/endpoint flags. Inspect confirmed that the disabled server remained attached with collection false; both disabled business facts were absent and the receiver request count did not change. The optional Collector path was also run: first-creation CLI network seeded, existing env preserved, downstream record counts 6 → 6 → 8 across enable → disable → enable. Each enabled assertion matched publication/download for that newly created skill, not an old record. Evidence: `real-lifecycle.log`, the scenario `*-received.json` files, `docker-build.log`, `image-inspect.log`.
+
+Real `ps --version trial` without `--ref` succeeded against the `file://` source with an existing analytics overlay, both with the default ref and `SKILLHUB_REF=x`. The URL-recording fake-fetch regression separately proves ref selection without a raw-base override. New remote tag/OSS availability is still not claimed.
+
+All four `scripts/tests/runtime-*.sh` suites passed. The requested Python deployment command passed 6 cases without skips. Helm contracts (with `apk add -q bash python3`) and strict lint passed, with 1 chart and 0 failures. Release validation and workflow-security suites, VitePress build, weekly site generation/validation, shell syntax, exact-function comparison, privacy scan and range diff checks passed. Logs: `runtime-*-final.log`, `python-contracts.log`, `helm-contracts.log`, `validate-release-config.log`, `workflow-security.log`, `docs-build.log`, `docs-weekly.log`, `source-audit.log`.
+
+Cleanup read-back confirmed owned containers removed, the isolated daemon's image/volume/network sets equal to their pre-run baselines, the local relay closed, and `release-test-dind` exited (`cleanup.log`, `cleanup-summary.json`). Shared builder cache was not pruned. No backend source changed, so Maven test suites were not rerun; the Dockerfile's normal packaging build skipped tests. No live Kubernetes/port-forward execution, new browser/CLI E2E, production TLS/authenticated storage, public release upload, push or PR mutation is claimed. Earlier broad-suite limits remain historical and unchanged.
diff --git a/openspec/changes/add-otlp-business-event-logs/tasks.md b/openspec/changes/add-otlp-business-event-logs/tasks.md
index b6bf4afea..36047298a 100644
--- a/openspec/changes/add-otlp-business-event-logs/tasks.md
+++ b/openspec/changes/add-otlp-business-event-logs/tasks.md
@@ -61,3 +61,11 @@ Repair 2 exact commands/counts/evidence and proposed fixup are appended to the w
 - [x] Verify real clean retains deployment files byte-for-byte at mode 600; remove the identified test containers, project volumes/networks and test images, preserve pre-existing images, stop the authorized dind and local relay, and verify owned ports are closed.
 
 Repair 4 real runs, template-only checks, intermediate fixture failures and remaining deployment limits are recorded in acceptance.md and the worker report. Commits remain local; publication is left to the owner.
+
+## Repair 4a (independent review)
+
+- [x] Add and execute RED/GREEN regressions for independent file-ref selection with an existing analytics overlay, remembered private/Collector attachment across disable/enable, first-created Collector network seeding without rewriting an existing env, and the Helm same-origin metrics access documentation contract.
+- [x] Remove version-to-ref fallback; restore the base lifecycle function; preserve attachment intent independently of collection; seed only a newly created independent env; document both pinned arguments and Helm Service port-forward without ingress changes.
+- [x] Rerun every runtime shell suite, six Python deployment cases, Helm contracts/strict lint with Python installed, release validation, workflow-security, docs/weekly builds, source/privacy checks and range whitespace checks.
+- [x] Build the server image and run real private-receiver and optional-Collector disable/enable cycles, verify new publication/download facts and disabled zero-export behavior while attached, and exercise real ps with version but no ref against the file source.
+- [x] Remove this round's Docker resources, verify baseline image/volume/network sets, close the relay and stop the isolated daemon; record unchanged backend/Kubernetes/remote-publication limits in acceptance and the worker report.