## Verdict
**ITERATE**

## Claim Checks

- The immutable target was read in full. Its RALPLAN index entry records revision stage 33 with SHA-256 `1953a998a46428e8bedb211be135f2d9a0f77b6c7cf33feea5b16e77de112607`, matching the assignment.
- The recovery finding is closed executably. Revision 33 gives each public recovery API exactly one owner lock, routes already-locked callers through identity-token private methods, rejects cross-domain targets, and names public/already-locked/deadlock tests. This directly matches current `AdaptiveEventStore.append`, `_append_journal_row`, and `append_source_day_mapping`, which otherwise call `recover()` while already holding `.adaptive.lock`, and current generic `recover()` can reach canonical and overlay paths.
- The canonical transaction internals are substantially actionable. `CanonicalEventTransaction` has a no-override lock derived from `events_path.parent`, fixed authoritative sequence sidecar, public one-lock methods, token-gated private methods, batch prevalidation, legacy-prefix fail-closed behavior, and concurrency/recovery/no-nested-flock tests. This is a coherent replacement for current `EventStore._record_lock` plus `CanonicalSequenceJournal.append()`, whose current `append()` calls `recover()` and then acquires the same journal lock again.
- The canonical construction boundary is not fully closed. Current production gateway construction creates `WizardService(wizard_root)`, and `WizardService.__init__` creates bare `EventStore(home)`; the addendum says a bare store “may not be used” for adaptive canonical events but does not define the typed factory/constructor or rejection that makes this enforceable. The phrase “all callsites derive it from the typed customer runtime/data-root contract” leaves executors to choose the public API and does not say how a registered customer's wizard finalization fails when the transaction is omitted.
- The immutable-transport goal is correct and addresses the current mutable surfaces: both `NutritionCoachingCoordinator.set_customer_transport()` and `AdaptiveNutritionCoordinator.set_customer_transport()` can replace transports, and delivery rereads `self.customer_transport`. Freezing one instance, passing it explicitly, holding `_admission_lock` through terminal persistence, and testing setter races would close that race.
- The production transport construction/digest contract is contradictory with retained topology. Current `TelegramCustomerTransport.__init__` requires a live `NutritionCoachingCoordinator`, while retained Revision 28 requires the dormant `DiagnosticControlService`/host to exist without that coordinator and says the isolated adapter has no ordinary coordinator. Revision 33 now requires `DiagnosticHost.__init__` to receive the exact transport before activation, but supplies no alternate diagnostic constructor/factory or immutable authority inputs for `send_diagnostic_customer` to validate reservation, destination, and session pins.
- “The instance is captured in the active session/spec digest” is not implementable literally. The retained closed spec and `spec_digest` are durable canonical JSON established before a Python transport object exists; process-local object identity cannot be serialized into that digest or survive restart. Object identity can be checked only in memory. A separate stable transport-binding digest and restart rebinding rule are required.

Representative simulation:
1. Refactoring `AdaptiveEventStore.recover()` and its `recover=True` readers follows the stated owner-lock/token split without design guesses; overlay and canonical recovery dispatch are explicit.
2. Refactoring `EventStore`/`CanonicalSequenceJournal` can implement one wizard-lock transaction, but wiring the real customer path stops at `NutritionCoachingCoordinator._configure_registry -> WizardService(wizard_root) -> EventStore(home)` because no binding API or absence rejection is selected.
3. Constructing the dormant host stops earlier: the only concrete trusted transport currently requires the coordinator that the dormant topology intentionally does not create, and neither the transport's stable digest preimage nor its session-verification dependency is specified.

## Missing Evidence

Definitely missing:

1. An exact dormant-start construction path for the one production `TelegramCustomerTransport`, including which immutable objects it receives before activation, how its adapter/bot/destination/session authority is validated, and how this avoids requiring an ordinary or not-yet-created child coordinator.
2. A serializable transport-binding digest preimage and restart rule. The plan must distinguish durable stable identity from process-local `is` checks; a Python instance itself cannot be part of `spec_digest`.
3. The exact typed injection/factory and enforcement path that gives registered-customer `WizardService`/`EventStore` the authoritative `CanonicalEventTransaction` and rejects adaptive finalization when it is absent.

Verified and not missing: the referenced `store.py`, `wizard.py`, `adaptive_nutrition.py`, `customer_admin.py`, `customer_schedule.py`, `nutrition_coaching.py`, `telegram.py`, `nutrition_coaching_config.py`, `pyproject.toml`, and named existing test files exist. The planned `diagnostic_isolation.py`, policy package/resource, and diagnostic tests are correctly new files.

## Approval Boundary

The Stage-28 topology, read-only lock domains, installed-wheel policy proof, provider/detach admission lock, exact recovery ownership, and internal canonical transaction mechanics may be retained. Do not approve full execution of the registered-customer transaction wiring or diagnostic provider path until the three missing contracts above are binding. No live Telegram, credentials, manual P2–P6, or deployment is approved.

## Summary

- **Clarity:** High for recovery and transaction internals; insufficient at the two construction boundaries.
- **Verifiability:** Strong race/recovery tests; missing tests tied to a selected production construction API and durable transport binding.
- **Completeness:** Stage-32 recovery is closed; canonical injection and transport lifecycle/digest are not.
- **Big Picture:** The single-inode transaction and frozen deadline-aware transport fit isolation, but the frozen object must be constructible in the dormant topology.
- **Principle/Option Consistency:** Lock ownership is consistent. Process-local object identity inside a durable spec digest is not.
- **Alternatives Depth:** Earlier topology/locking/timeout alternatives remain adequate; no new broad option analysis is needed.
- **Risk/Verification Rigor:** Good concurrency and fail-closed coverage once the missing constructor and digest contracts are specified.

## Required Changes

1. Select and specify the exact dormant transport construction API. For example, define a diagnostic-only `TelegramCustomerTransport` factory/constructor that takes the dormant adapter, verified spec/bot identity, immutable destination binding, and a named session/reservation verifier before `DiagnosticHost` is built; or revise host creation ordering while preserving the coordinator-free dormant control route. State the exact validation owner used by `send_diagnostic_customer`.
2. Replace “instance captured in the active session/spec digest” with a closed, serializable `diagnostic_transport_binding_digest` preimage (at minimum contract version, exact adapter kind, verified test-bot digest, destination digest, timeout bound, and sealed method identity/version), name every capability/session row that carries it, and define restart comparison. Keep `transport is frozen_transport` as an additional in-memory check only.
3. Define one public typed transaction-construction path from `CustomerRuntime.data_root`, name the changes to `WizardService` and `NutritionCoachingCoordinator._configure_registry` (plus reconciliation/admin callsites), and require registered/adaptive wizard finalization to reject before append when the transaction is absent. Add a test that a bare production-customer wizard/store cannot append an unpaired canonical event, while ordinary standalone `EventStore` behavior remains unchanged.