# DualCoach Task 7 Evidence

## Verdict

PASS — the generation/review state machine and typed records reject invalid, skipped,
stale, forged, deleted-authority, and cross-revision transitions. The final Task 7
candidate is independently verified.

## Reused implementation and exact delta

The existing candidate already contained the durable journal, authority root and marker,
CAS pins, lineage checks, generation-only child blocking, retry/claim semantics,
generation and delivery contracts, transport receipts, restart reconciliation, and
callback separation.

The final delta changed only `gateway/platforms/telegram.py` typing seams:

- accurate callback and room-bootstrap transport protocols;
- Optional Bot and identifier narrowing;
- explicit topic/non-topic owner-review sends;
- payload and onboarding-markup narrowing;
- deferred `CallbackQuery` annotation with a type-only import.

No customer-facing capability, speculative abstraction, convenience feature, or future
scaffolding was added.

## Candidate identity

Five-file digest algorithm: SHA-256 of ordered UTF-8 records
`path + NUL + lowercase file SHA-256 + LF`.

Candidate digest:

`216000505adcd309ac4dfe1a18fd33c669eb997e57fdc6105bafe9fefb7cb69f`

Files:

- `gateway/platforms/nutrition_coaching.py`
  `e5f92fb574800ebe0847a81e68e6fca4ce5cce75b49ef9d53f3f35cd1b4755dd`
- `gateway/platforms/telegram.py`
  `e79329ff69e7cdfde5beaad2587ac6a5cab3581559aaea542b7a18c48ea28496`
- `tests/gateway/test_nutrition_coaching.py`
  `bec3de37af0485c3f44adf3010339e89f5999dc632ce97641889351bbfbcbe1d`
- `tests/gateway/test_telegram_physique_checkin.py`
  `cfbdc033bdea7f09b97f37c0069bc60c2f8f65f252d3d647686c8493cd28c576`
- `tests/gateway/test_task7_generation_hardening.py`
  `6f3c064a07418b4b4290f91abe3093d7636601cfad2a6342efe61cc8e962c51f`

## Failing-first and repair evidence

- Initial type-delta verifier `st_019fe1cf`: FAIL, 11 grouped Task 7
  intersections from 1,114 unsuppressed whole-file diagnostics.
- Three orchestration-only repair attempts were cancelled without changing candidate
  bytes: `st_019fe1d4`, `st_019fe1d7`, `st_019fe1da`.
- Executor `st_019fe1e6` eliminated the owned intersections and then repaired the sole
  independent-review finding: a missing type-only `CallbackQuery` import.
- Final whole-file `ty` result contains 1,073 unrelated baseline diagnostics and zero
  diagnostics intersecting the executor-owned Task 7 ranges.

## Automated verification

- Focused cache-disabled matrix: 268 passed, 0 failed.
- Additional hermetic bootstrap/operator review matrix: 145 passed.
- Ruff: PASS.
- `py_compile`: PASS.
- `git diff --check`: PASS.
- No new `Any`, cast, ignore, suppression, protocol lie, or compatibility shim in the
  final repair delta.

## Real-surface manual QA

Independent QA `st_019fe1ee` imported and exercised the actual runtime surfaces with
fakes and no network:

- missing Bot made no reservation;
- topic and non-topic owner-review sends bound receipts;
- stale receipt and restart paths did not republish;
- malformed `rb1` and `trb1` callbacks were rejected before membership lookup;
- valid current callback route succeeded and answered once;
- onboarding markup reached a real `reply_text`-like fake;
- `nc1` queued durable work only and unauthorized `nc1` queued nothing;
- network/provider/Telegram calls: `0 / 0 / 0`;
- customer deliveries: `0`;
- unresolved recovery claims: `0`.

The final type-only import is annotation-only and does not invalidate this runtime
evidence.

## Adversarial verification

Final reviewer `st_019fe1ef`: CONFIRMED.

- exact final candidate hash and digest reproduced;
- the previous unresolved-reference finding is closed;
- zero `ty` diagnostics intersect all executor type-fix ranges;
- runtime import and deferred annotation probe passed;
- stale state, malformed input, restart, authority/CAS, privacy routing, and
  exactly-once recovery invariants remain intact.

The earlier automated verifier's 140-intersection result was rejected because it treated
all historical dirty-worktree additions as Task 7-owned ranges. The final verifier used
the exact executor delta and found zero intersections.

## Cleanup and residuals

- No commit, push, reset, stash, clean, release activation, provider call, Telegram call,
  customer activation, or customer delivery.
- Temporary helpers, drivers, logs, and manifests were removed.
- Unrelated dirty-worktree changes and ignored caches were preserved.
- Residual whole-file type debt: 1,073 unrelated diagnostics; no suppression added.
- Telegram Bot API still lacks provider idempotency and authoritative receipt lookup.
  Production semantics remain at-most-once dispatch with durable reconciliation and
  terminal unknown outcomes; this remains a release-review consideration.