# DualCoach Task 11 Evidence

## Verdict

PASS — operator cards now project durable generation/review state asynchronously,
callbacks ACK before work, stale cards fail closed, publication claims recover after
restart, and callback identities remain server-validated and Telegram-bounded.

## Reused behavior and exact gap

Reused:

- Task 7 durable generation/card projection and render identity;
- Task 8 atomic pending generation enqueue;
- Task 9 background worker/card callback;
- existing Telegram operator console and approval/send boundaries.

Confirmed gaps:

- check-in completion did not immediately publish a durable pending card;
- card callbacks lacked one compact action/revision/generation/render binding;
- adaptive review ACK occurred after reservation/edit;
- failed publication could strand `publish_claimed`;
- queued state could suppress a current completed draft's second render;
- new onboarding runtime authority contracts were not represented by realistic test
  doubles.

Rejected extras:

- Task 12/13 approval or delivery behavior;
- new customer-facing UX;
- generic card framework, content-derived cache, speculative abstraction, future
  scaffolding, broad refactoring, suppressions, and fixed sleeps.

## Implementation and failing-first evidence

- Immediate card: `Check-in saved` / `Draft generation pending`.
- Durable state/button projection:
  - `generation_failed`: retry;
  - `draft_created`: edit, regenerate, approve, hold;
  - `approved`: send, revoke;
  - `sent_audited`: no active buttons.
- Compact `n3` callback binds action, revision identity, card generation, and render
  identity within 64 UTF-8 bytes.
- ACK occurs before reservation, publication, edit, or background scheduling.
- Stale revision/generation/render identity returns a refresh response and mutates
  nothing.
- Publication claims have bounded leases; failure releases to retryable pending and
  expiry/restart publishes once.
- Current queued projection consults authoritative durable state so a completed current
  draft edits the existing card once; stale queued results remain fail-closed.

Failing-first receipts included:

- adaptive edit occurred before ACK;
- failed publication remained `publish_claimed`;
- facts/deltas/warnings/controls second render never edited;
- reconciliation runtime fixtures lacked `list_sessions` and `profile_root`;
- four changed-line fixture typing diagnostics.

All were closed without adding product fallbacks or weakening assertions.

## Acceptance and real-surface evidence

Independent manual QA `st_019fe281` exercised actual card/projection/callback surfaces
with fake Telegram:

- current second render edited once with facts, deltas, warnings, and four controls;
- stale replay answered and refreshed with zero coordinator mutation;
- callback payloads were 28 bytes in the observed matrix; worst-case automated bound was
  63 bytes;
- `sent_audited` rendered zero buttons;
- ACK preceded queued/background mutation;
- failed adaptive publication recovered once after lease expiry/restart;
- completed generation remained `draft_created` when later card publication failed;
- provider, network, Telegram, customer-action, and customer-delivery counts: zero.

## Adversarial verification

Reviewer `st_019fe282`: CONFIRMED.

- original ACK/publication P2 is closed;
- concurrent and restarted publishers remain one-shot;
- n3 stale/render/revision/generation CAS remains fail-closed;
- authority requires the registry runtime `.spec`, exactly one matching customer, and
  `BootstrapState.AWAITING_ACTIVATION`;
- cross-customer, malformed registry, wrong role, and enum confusion fail closed;
- no Task 12/13 mutation, content-cache workaround, or type lie.

## Automated verification

- Reconciliation file: 21 passed.
- Telegram nutrition onboarding: 44 passed.
- Focused card/authority matrix: 13 passed.
- Earlier final matrices: 161 adaptive, 96 group-gating, 174 generation, and 44
  onboarding tests passed.
- Terminal async delivery test passes with `RuntimeWarning` promoted to error.
- Reconciliation test `ty`: zero diagnostics.
- Final Task 11 product-symbol type intersections: zero.
- Ruff: PASS.
- `compileall`: PASS.
- `git diff --check`: PASS.
- Isolated wheel build: PASS.

The local typed canonical-digest test seam was independently compared with the actual
runtime contract across ordered, Unicode, nested, spacing, malformed, and exact-schema
cases. It preserves production parser behavior and does not replace the authority layer.

Workspace import/plugin failures for unavailable `checkin_cli` onboarding modules remain
documented environment debt; isolated supported-path suites pass and these failures do
not intersect Task 11 product behavior.

## Candidate identity

- 67-path candidate digest:
  `c03ceab287c445cb7c068eed109b8e925375bfbd9d55f0e58659dfba2fa02d43`
- JSON manifest SHA-256:
  `522e89a003a2e6934a08441e920c99f8659c2684395e36e7629cb8b4235182b3`
- Markdown manifest SHA-256:
  `063b6880a43b625ff4156b30cf3515f6e3ae377ad0a05c9344f419f4aec821ca`
- `gateway/platforms/telegram.py`:
  `e7b816a64fbed7c1fec0e5b4ee0f47eb659b9b75662e2fd5b796b085d8130a85`
- `gateway/platforms/telegram_nutrition_onboarding_runtime_authority.py`:
  `6ae42a1107c5c74bfdfd709e72a35159fb3642b879388a1e7888c484662d3ada`
- `tests/gateway/test_telegram_nutrition_onboarding.py`:
  `b0bc20ebb009dab4a1369cc32d123506d7f35934099ab09db1af3c68064476e0`
- `tests/gateway/test_nutrition_onboarding_reconciliation.py`:
  `48d92dc947790ccee74ffa70e40b303c06997d0c5b8cf05016502417ff0ad96c`

JSON, Markdown, and independently recomputed raw-byte digest agree.

## Cleanup and non-touch

- Fake Telegram/provider surfaces only.
- Temporary QA roots and build artifacts removed.
- No real network, provider, Telegram, activation, customer action, or delivery.
- No commit, push, reset, stash, or clean.
- Unrelated dirty-worktree changes preserved.