# DualCoach Task 13 Evidence

## Verdict

PASS — the delivery outbox permits at most one provider dispatch while an outcome is
unresolved, survives restart, and requires exact reconciliation evidence before an
unknown outcome can become sent or safely retryable.

## Honest guarantee

Telegram does not provide a provider idempotency key or authoritative general receipt
lookup. The implemented and verified guarantee is therefore:

- one durable dispatch claim;
- no blind retry after a possibly accepted provider call;
- fail-closed `unknown_provider_outcome` until exact evidence resolves acceptance or
  nonacceptance;
- no duplicate provider message under supported duplicate/restart/crash paths.

## Reused behavior and exact gap

Reused:

- Task 7-12 delivery intent, reservation, authority, prepared route/text, receipt, audit,
  callback CAS, and restart reconciliation.

Confirmed gap:

- outbox states did not explicitly distinguish pending, ambiguous provider outcome,
  sent, and audited;
- dispatch claim was not the single atomic gate for every send path;
- timeout/post-provider receipt failure could be retried without evidence;
- reconciliation evidence and final audit pins were incomplete.

Rejected extras:

- impossible provider-level exactly-once claims;
- automatic retry of unknown outcomes;
- Task 14 callback-ACK changes;
- new UX/framework, speculative abstraction, future scaffolding, broad refactor,
  compatibility shims, manual receipt deletion, suppressions, and fixed sleeps.

## Implementation and failing-first evidence

- Deterministic idempotency key:
  `customer_key + checkin_revision + approved_draft_revision`.
- Explicit lifecycle:
  `pending -> unknown_provider_outcome -> sent -> sent_audited`.
- Atomic dispatch CAS has one winner across duplicate/concurrent callbacks.
- Route, chat/topic-or-DM, approved revision, payload digest, provider message ID,
  receipt, and audit pins are durable.
- Restart before provider call resumes one pending entry.
- Timeout, exception, or provider success followed by local receipt failure remains
  unknown and never automatically resends.
- Exact positive evidence resolves unknown to sent/audited without transport.
- Exact negative nonacceptance evidence is the only path that can make the entry safely
  retryable.
- Malformed, forged, partial, contradictory, stale-route, or stale-payload evidence
  fails closed.

Failing-first outbox crash-matrix receipt: 3 failed before implementation, all passing
afterwards.

## Acceptance evidence

- Eight-way dispatch race: one winner.
- Duplicate buttons: one outbox entry and one provider attempt.
- Restart before send: one pending entry resumes.
- Crash before provider: no duplicate entry.
- Provider accepted then receipt write failed: unknown, one provider call.
- Provider timeout/exception: unknown, no restart resend.
- Positive evidence: sent and one audited event without transport.
- Forged evidence: rejected without mutation.
- Negative evidence: retryable pending only after exact nonacceptance proof.
- Sent/audited replay: no send or duplicate audit.
- Revoke, inactive customer, wrong role/route, changed revision/payload, stale card, and
  corrupt ledger: fail closed.

`sent_audited` contains provider route, topic-or-DM, message ID, approved revision, and
canonical payload digest.

## Independent verification

Manual verifier `st_019fe348`: CONFIRMED.

- concurrent winners: 1 true, 7 false;
- one provider call;
- unknown survived restart without resend;
- exact reconciliation reached `sent_audited`;
- no real network/provider/Telegram/customer delivery.

Adversarial reviewer `st_019fe349`: CONFIRMED.

- all provider I/O passes the real dispatch CAS;
- unknown is terminal without exact evidence;
- fake provider/failpoints preserve the post-send/pre-receipt boundary;
- no Task 14 expansion or manual receipt deletion.

## Automated and quality verification

- Nutrition coaching: 150 passed.
- Telegram physique: 120 passed.
- Adaptive delivery/transport subset: 42 passed.
- Full repaired Task 7 hardening: 37 passed.
- Outbox/unknown/reconciliation focused suite: PASS with warnings as errors.
- Ruff: 67/67 candidate paths PASS.
- Compileall: 67/67 candidate paths PASS.
- `git diff --check`: PASS.
- Task 13 changed-symbol/test type audit: zero diagnostics.
- Task 13 introduced zero `Any`, casts, suppressions, ignores, or fixed sleeps.

Two Task 7 regression tests were repaired to remove permissive
`validate_delivery_transport = lambda: True` overrides. They now use real reservation
and dispatch CAS, assert `unknown_provider_outcome`, reject forged evidence, accept exact
typed reconciliation evidence, and prove one send/one audit across replay. The file is
untracked and outside the authoritative 67-path candidate but remains part of the
verified regression suite.

Stock pytest failures caused by repository-wide Telegram `MagicMock` injection are
harness artifacts; the project test runner and concrete callback test doubles pass the
same production paths.

## Candidate identity

- 67-path candidate digest:
  `8bb01091b49aef469bd3ba191186d826f9d3ce66923f216ace550dc0ca5db3fa`
- JSON manifest SHA-256:
  `fe4fb9258cf5d32374da280452b6704a6a1aedd2b4ec8c3e87620d5abd30e85c`
- Markdown manifest SHA-256:
  `3ac0d8a91878aba999cf68144c487e2c460c24b3b5cd7f8d57ff251af1dcfcae`
- `gateway/platforms/nutrition_coaching.py`:
  `5d8b7c70dccc3306496905a647dfe0db601c4281270a1cff3300bfa37ccd8ac2`
- `gateway/platforms/telegram.py`:
  `0c1316c942f618761d7fea60845658e0946d15573e52e2c15297b10b2adc40f8`
- `tests/gateway/test_nutrition_coaching.py`:
  `bc9a0716462e8d702b34070e1a6044f90c6c628b0e140f5ab5629cace40ddc93`
- External Task 7 regression file:
  `b6c90c3784be7cd729ea4717087d5371c187df2374e277b608a62bf09565a447`

JSON, Markdown, and independently recomputed raw-byte digest agree.

## Cleanup and non-touch

- Fake provider/Telegram surfaces only.
- Temporary drivers, plugins, logs, caches, and pytest roots removed.
- No real network, provider, Telegram, activation, customer action, or delivery.
- No commit, push, reset, stash, clean, or manual receipt deletion.
- Unrelated dirty-worktree bytes preserved.