{
  "schema": "nutricoach-telegram-checkin-stepper-task-10-debug-r70-startup-registration-v1",
  "task_id": "st_01a05d9d",
  "captured_at_kst": "2026-09-02T00:45:00+09:00",
  "mode": "read_only_emergency_debug_except_required_evidence_file",
  "verdict": "CONFIRMED_WIZARD_DIRECTORY_LINK_COUNT_INVALIDATED_ONE_TIME_CANONICAL_REGISTRATION",
  "done_claim": false,
  "summary": "The configured r70 weekly authority root and its canonical registration file are present, regular, private, non-symlinked, and selected by the unchanged live config. Startup fails because the one registration row binds a CanonicalCheckinCustomerBinding computed when the enabled customer's wizard directory had link count 3. A legitimate views subdirectory was later created at 2026-09-01T09:36:48+09:00, changing the wizard directory link count to 4. The current binding digest therefore differs from the registration row. A read-only in-memory toggle using the installed r70 binding algorithm reproduces the registered digest exactly only when wizard.links is changed from current 4 back to historical 3. Installed startup then finds the row by customer identity but rejects its stale binding at nutrition_weekly_reminder_bootstrap_customers.py:111-114. The registry format stores root/events/sequence/lock identities but omits wizard/plans identities even though both are included in binding_digest, which hid the decisive component from earlier durable checks. No supported installed command or idempotent reconciliation API exists: registration is append-only, customer-unique, and one_time_registration raises already_registered. A sealed successor authority/code-state migration is required; direct repair of the existing row is unsafe and unsupported.",
  "hypotheses": [
    {
      "id": "H1",
      "axis": "missing_file_or_permissions",
      "claim": "The configured weekly canonical registration file is missing, unreadable, symlinked, or has unsafe mode/ownership/link count.",
      "status": "REFUTED",
      "distinguishing_evidence": "The configured root and canonical-authorities-v1.jsonl must fail existence or the installed 0700-directory/0600-regular-file identity contract.",
      "observed": [
        "Live config selects data/weekly-operations-authority-81a7a06ec2e7a159.",
        "The selected root is a non-symlink directory, mode 0700, owned by the effective user, link count 2.",
        "canonical-authorities-v1.jsonl exists as a non-symlink regular file, mode 0600, owned by the effective user, link count 1, with one complete row.",
        "The active authority marker and registration file are readable and have stable observed digests."
      ]
    },
    {
      "id": "H2",
      "axis": "wrong_root_selection",
      "claim": "Startup reads the legacy unsuffixed weekly authority root instead of the r70 candidate-suffixed authority root.",
      "status": "REFUTED_FOR_THIS_STARTUP_FAILURE",
      "distinguishing_evidence": "The active config path consumed by nutrition_weekly_reminder_bootstrap.py:98-103 would differ from the r70 configured root or resolve to the unsuffixed predecessor.",
      "observed": [
        "The live config path ends in the r70 candidate prefix 81a7a06ec2e7a159.",
        "nutrition_weekly_reminder_bootstrap.py opens that relative configured name under the pinned profile descriptor.",
        "The failure occurs after the selected root, marker, sidecar registry, and customer source have opened; it occurs specifically at row lookup/binding comparison.",
        "The separate observer-r70 stale-root defect remains real but is not this startup mechanism."
      ]
    },
    {
      "id": "H3",
      "axis": "stale_digest_or_startup_ordering",
      "claim": "A legitimate post-registration filesystem layout change altered a pin included in the canonical binding, leaving the one-time registration digest stale.",
      "status": "CONFIRMED",
      "distinguishing_evidence": "The current installed binding digest must differ from the row, and changing only the historically altered pin in memory must reproduce the row digest.",
      "observed": [
        "The registration row was created at 2026-08-31T20:49:28+09:00.",
        "wizard/drafts predates registration; wizard/views was created at 2026-09-01T09:36:48+09:00.",
        "The wizard directory currently has link count 4; before views existed it had link count 3.",
        "The installed r70 CanonicalPinSet includes wizard and plans directory identity tuples, including link count, in CanonicalCheckinCustomerBinding.binding_digest.",
        "Current observed binding digest is eb2cfb9340251f2477b7207341bfe0a0bfbfb321d76b5be08429711da0bf7eac; the registration row binding digest is 0ef1462c19bcb6dde3fb53b952e1a45b018f78d693672c7ee62a307b47be7397.",
        "In-memory wizard.links=2 yields a nonmatching digest; wizard.links=3 yields exactly the registration row digest; reverting to current wizard.links=4 yields the current nonmatching digest.",
        "The views creation boundary precedes the first cron canonical-identity error: views birth 09:36:48, canonical update 09:36:59, first cron error 09:37:46."
      ],
      "toggle_proof": {
        "scope": "Read-only in-memory recomputation with installed r70 classes; no live descriptor, file, row, config, service, or authority mutation.",
        "historical_value": "wizard directory links=3 -> computed binding equals registration row -> startup row comparison would admit it.",
        "current_value": "wizard directory links=4 -> computed binding differs from registration row -> exact startup branch raises canonical registration unavailable.",
        "repeatability": "The current binding mismatch was independently observed by direct installed-class recomputation and by the identical exception in all 27 fresh startup attempts."
      }
    },
    {
      "id": "H4",
      "axis": "immutable_package_mismatch",
      "claim": "The running installed source differs from the immutable r70 candidate or mixes wheels from another release.",
      "status": "REFUTED",
      "distinguishing_evidence": "Installed bootstrap/registry source hashes or candidate wheel identities would differ from the immutable r70 snapshot/qualification.",
      "observed": [
        "Six decisive installed modules match the immutable r70 snapshot byte-for-byte, including bootstrap_customers, bootstrap, bootstrap_config, canonical_registry, canonical_registry_history, and weekly_reminder_authority.",
        "Both reproducible r70 checkin wheel builds have SHA-256 c5c011b7c1a43405680a57407eef8c59ec03dc3284db0757432eca1efb6e291e.",
        "Both reproducible r70 Hermes wheel builds have SHA-256 e65133f0d52ff71b5df97f45fba9150dca32a4e9625b1732b73cb619fbc65241.",
        "Those wheel identities match the r70 authority-verification receipt."
      ]
    },
    {
      "id": "H5",
      "axis": "activation_or_runtime_authority_receipt",
      "claim": "A missing/stale activation, candidate, runtime authority receipt, or config registry receipt causes startup to select no customer registration.",
      "status": "REFUTED_AS_THE_THROWN_BRANCH",
      "distinguishing_evidence": "Receipt parsing or pinned registry identity verification would fail before canonical row lookup, producing a startup-config, registry-authority, or generic startup-authority incident instead.",
      "observed": [
        "The runtime candidate digest and authority pin files exist as mode 0400, owner-only, single-link regular files under the r70 runtime authority root.",
        "Operator-notification recovery and owner-risk receipts also exist with mode 0400 under the same runtime authority root.",
        "The activation journal exists as mode 0600 and is unchanged from its earlier authority boundary.",
        "Live config and registry SHA-256 values equal the pre-restart 00:30 hard-gate snapshot and earlier no-send baseline.",
        "The traceback reaches construct_owned_customers after receipt identity, configured registry, sidecar root, parent marker, authority root, registration history, and enabled registry ordering checks."
      ]
    }
  ],
  "exact_traceback_call_path": [
    "python -m hermes_cli.main",
    "hermes_cli/main.py:12649 <module> -> main",
    "hermes_cli/main.py:12643 main -> args.func",
    "hermes_cli/main.py:2348 cmd_gateway -> gateway_command",
    "hermes_cli/gateway.py:6461 gateway_command -> _gateway_command_inner",
    "hermes_cli/gateway.py:6605 _gateway_command_inner -> run_gateway",
    "hermes_cli/gateway.py:4182 run_gateway -> asyncio.run(start_gateway)",
    "gateway/run.py:17562 start_gateway -> runner.start",
    "gateway/run.py:5524 GatewayRunner.start -> _create_adapter",
    "gateway/run.py:7074 _create_adapter -> TelegramAdapter(config)",
    "gateway/platforms/telegram.py:704 TelegramAdapter.__init__ -> _open_weekly_capabilities",
    "gateway/platforms/telegram_weekly_host_capabilities.py:116 _open_weekly_capabilities -> open_telegram_weekly_capabilities",
    "gateway/platforms/telegram_weekly_host_capabilities.py:71 open_telegram_weekly_capabilities -> load_registered_weekly_reminder_customers",
    "gateway/platforms/nutrition_weekly_reminder_bootstrap.py:166 load_registered_weekly_reminder_customers -> _load_enabled",
    "gateway/platforms/nutrition_weekly_reminder_bootstrap.py:118 _load_enabled -> construct_owned_customers",
    "gateway/platforms/nutrition_weekly_reminder_bootstrap_customers.py:87-90 acquire_unregistered_authority_owned builds current six-pin binding",
    "gateway/platforms/nutrition_weekly_reminder_bootstrap_customers.py:94-95 row lookup by customer identity",
    "gateway/platforms/nutrition_weekly_reminder_bootstrap_customers.py:111-114 row missing-or-binding-mismatch branch -> WeeklyReminderStartupAuthorityIncident('weekly reminder canonical registration is unavailable')"
  ],
  "bounded_journal": {
    "window": "2026-09-02T00:31:20+09:00 through 2026-09-02T00:34:08+09:00",
    "first_fresh_failure": {
      "timestamp": "2026-09-02T00:31:24.506602+09:00",
      "pid": 3358966,
      "exception": "WeeklyReminderStartupAuthorityIncident: weekly reminder canonical registration is unavailable"
    },
    "latest_failure": {
      "timestamp": "2026-09-02T00:34:07.046352+09:00",
      "pid": 3360228,
      "exception": "WeeklyReminderStartupAuthorityIncident: weekly reminder canonical registration is unavailable"
    },
    "identical_incident_count": 27,
    "automatic_restart_count": 26,
    "protective_stop_observed": "2026-09-02T00:34:07+09:00",
    "service_state_after_stop": "inactive/dead, MainPID=0, Result=exit-code"
  },
  "unit_and_runtime_origins": {
    "scope": "systemd user unit",
    "fragment": "/home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service",
    "dropin": "/home/cube/.config/systemd/user/hermes-gateway-dualcoachtest.service.d/task26-authority.conf",
    "launcher": "/home/cube/.hermes/profiles/dualcoachtest/.strict-runtime/81a7a06e-v150/venv/bin/python -m hermes_cli.main --profile dualcoachtest gateway run",
    "working_directory": "/home/cube/.hermes/profiles/dualcoachtest",
    "python": "CPython 3.12 via the r70 strict runtime",
    "restart_policy": "always with RestartSec=5",
    "unit_file_state": "enabled",
    "credential_origin": "task26 authority pin, candidate digest, operator notification recovery, and owner-risk acceptance are loaded from the r70 runtime-authority directory by the drop-in"
  },
  "canonical_registration_state": {
    "configured_authority_root": "data/weekly-operations-authority-81a7a06ec2e7a159",
    "root": {
      "present": true,
      "symlink": false,
      "mode": "0700",
      "owner_matches_effective_user": true,
      "link_count": 2,
      "inode": 45242251
    },
    "registration_file": {
      "name": "canonical-authorities-v1.jsonl",
      "present": true,
      "symlink": false,
      "mode": "0600",
      "owner_matches_effective_user": true,
      "link_count": 1,
      "inode": 45242252,
      "sha256": "542555cf4068012028711441ed220e6c80ab182462bbfd6eff95856bb0ba472f",
      "row_count": 1,
      "registration_epoch": 1,
      "occurred_at_utc": "2026-08-31T11:49:28.846106Z"
    },
    "authority_marker": {
      "mode": "0600",
      "inode": 45242253,
      "sha256": "39d786bef523af384252b1be17ae929b26435b70b759746eb3704072a9f11a8f"
    },
    "recorded_four_pin_comparison": {
      "root": "MATCH",
      "events": "MATCH",
      "sequence": "MATCH",
      "lock": "MATCH"
    },
    "unrecorded_but_digest_bound_pins": {
      "wizard": {
        "current_inode": 45481985,
        "current_mode": "0700",
        "current_links": 4,
        "registration_time_links_recovered_by_digest_toggle": 3,
        "cause_of_increment": "wizard/views directory created after registration"
      },
      "nutrition_plans": {
        "current_inode": 44849745,
        "current_mode": "0700",
        "current_links": 2,
        "evidence_of_change": false
      }
    },
    "binding_digests": {
      "registration_row": "0ef1462c19bcb6dde3fb53b952e1a45b018f78d693672c7ee62a307b47be7397",
      "current_installed_recomputation": "eb2cfb9340251f2477b7207341bfe0a0bfbfb321d76b5be08429711da0bf7eac",
      "historical_wizard_links_3_recomputation": "0ef1462c19bcb6dde3fb53b952e1a45b018f78d693672c7ee62a307b47be7397"
    }
  },
  "root_cause": {
    "status": "CONFIRMED_WITH_READ_ONLY_TOGGLE",
    "mechanism": "r70 registered the enabled customer's canonical authority before the wizard/views directory existed. CanonicalCheckinCustomerBinding hashes all six pins, including wizard directory st_nlink. Creating views increased wizard st_nlink from 3 to 4 without changing the four pin tuples persisted separately in the registration row. The append-only row therefore still looks current under the durable four-pin comparison but its binding_digest no longer equals a freshly acquired source binding. Fresh startup finds the customer row and rejects it at the exact binding comparison. The old long-running process retained the pre-change pin and began reporting canonical identity drift after the same layout/update boundary; restarting could not heal it because startup requires the stale one-time registration row to match the freshly acquired binding.",
    "design_contributors": [
      "Startup registration occurred before all legitimate wizard subdirectories were materialized.",
      "A mutable parent-directory link count is included in the canonical binding.",
      "The registration row persists only root/events/sequence/lock tuples, omitting wizard/plans tuples that are nevertheless included in binding_digest.",
      "The registration store permits only one customer row and exposes no successor/reconciliation transition for legitimate pin evolution."
    ],
    "not_root_causes": [
      "missing registration file",
      "legacy unsuffixed root selection",
      "config or customer registry drift at restart",
      "permissions, ownership, hard links, or symlinks on the selected authority and canonical files",
      "installed-versus-immutable r70 package mismatch",
      "cron scheduler ordering after startup"
    ]
  },
  "registration_reconciliation_surface": {
    "supported_installed_cli": "NONE",
    "dualcoach_admin_help": "Only provider-auth and customer command groups; no weekly canonical registration or reconciliation command.",
    "hermes_gateway_startup_behavior": "Read-only consumption only; startup never mutates or repairs registration.",
    "available_library_api": "checkin_cli.weekly_operations_registration_handoff.begin_canonical_authority_registration",
    "api_semantics": "One-time append with same-thread acknowledgement; one_time_registration rejects any existing customer row with CanonicalAuthorityAlreadyRegistered('already_registered').",
    "idempotent_for_existing_stale_row": false,
    "provider_or_customer_action": false,
    "safe_to_call_live_now": false,
    "reason": "Calling it against the occupied root cannot reconcile and would fail; deleting, replacing, or editing the append-only row would violate its hash chain and authority binding.",
    "sealed_migration_primitive": "scripts/nutricoach_v150_weekly_authority.py can create and register a newly selected authority root while building a config postimage, but it is an internal sealed migration primitive, not an installed idempotent maintenance command, and it performs authority/config state changes.",
    "disposition": "CODE_AND_STATE_MIGRATION_REQUIRED"
  },
  "cron_state": {
    "job_count": 1,
    "dispatcher_enabled": true,
    "dispatcher_state": "scheduled",
    "last_status": "error",
    "last_error_class": "weekly operations failed: canonical authority identity drift",
    "jobs_file": {
      "mode": "0600",
      "inode": 44852434,
      "sha256": "b99ed9afbc0e35f6eefccbda5924cf2b90c56384d41ac20864baafcc8d213411",
      "mtime": "2026-09-02T00:30:51.181297654+09:00"
    },
    "host_process": "absent because the gateway is stopped",
    "manual_cron_actions_by_task": 0
  },
  "immutable_r70_comparison": {
    "candidate_digest": "81a7a06ec2e7a1595784c92ab61df0df7e138d13a2620d9a917e94999e7f7a04",
    "qualification": "QUALIFIED_PENDING_LIVE_AUTHORIZATION",
    "selected_decisive_source_files_equal_installed": 6,
    "selected_decisive_source_files_checked": 6,
    "checkin_wheel_reproducible": true,
    "hermes_wheel_reproducible": true,
    "package_mismatch": false
  },
  "safe_no_send_restore_sequence": {
    "status": "REQUIRES_SEPARATE_AUTHORIZED_SEALED_REPAIR; DO_NOT_EXECUTE FROM THIS RECEIPT",
    "steps": [
      "Keep hermes-gateway-dualcoachtest.service inactive. Do not start, restart, enable, or invoke the gateway entry point from the current r70 state.",
      "Under separate operator authority, pause the sole NutriCoach cron job using the supported Hermes cron pause command before any future service start. Pausing alone does not repair last_status and is only a transport-exposure fence.",
      "Build a failing-first copied-profile regression that creates registration while wizard link count is 3, then creates views so it becomes 4, and proves current startup raises canonical registration unavailable with zero provider calls.",
      "Ship a sealed successor package/state transition that materializes every canonical wizard layout directory before registration and creates a new candidate-suffixed weekly authority root with a fresh registration. Do not delete, truncate, append a duplicate customer to, chmod, symlink, or rewrite the existing r70 canonical-authorities-v1.jsonl.",
      "The package must either persist and report all six digest-bound pin tuples or introduce an explicit authenticated successor-registration transition; it must not silently weaken owner, mode, regular-file, no-follow, inode, or append-only checks.",
      "Include an authenticated expiring no-send maintenance suppression checked before Topic59PublicationLedger.claim, or retain an equivalent proven socket/provider guard. Existing r70 has no truthful no-send success path after fresh pin acquisition.",
      "In a relocated copied profile, run the installed successor startup and two exact scheduled ticks with fake transport plus outbound socket guard. Require startup success, cron success, sends=0, updates=0, network attempts=0, unchanged delivery/customer ledgers, and a fresh registration binding equal to current six-pin acquisition.",
      "Deploy only through the sealed authority/config transaction, with cron still paused and the no-send guard active. Start the service once under bounded event subscriptions; abort and stop immediately on any startup exception or unexpected restart.",
      "Verify active/running, MainPID nonzero, no automatic restart, exact configured successor root, canonical registration binding match, no provider socket, and unchanged protected ledgers/drafts before considering cron resume.",
      "Resume cron only after the successor package's authenticated maintenance suppression can produce a truthful no-provider successful tick and after the separate observer-r70 configured-root fix is admitted. Remove the maintenance hold only under explicit provider/customer-action authority."
    ],
    "explicitly_unsafe": [
      "Bare restart of r70",
      "Direct row edit, deletion, truncation, duplicate append, copy from another authority root, or inode replacement",
      "Changing wizard directory link count by deleting views",
      "Disabling weekly config and claiming health from a disabled process",
      "Manual cron run/tick against live state",
      "Fabricating sent_audited, delivered, day-status, provider receipt, or customer data",
      "Invoking r71 or r71b launchers from this debug receipt"
    ]
  },
  "protected_state_final": {
    "gateway": {
      "active_state": "inactive",
      "sub_state": "dead",
      "main_pid": 0,
      "nrestarts": 26,
      "result": "exit-code",
      "not_restarting": true
    },
    "ledgers_and_customer_state": {
      "topic59_sha256": "92ef87536865b4d74c50f9715601de7870c5c3893839f2862dbaf62024e51af5",
      "scheduled_deliveries_sha256": "1000b155ccb56aa318ac098613f5808d2cb9633fc1178a0b49f280c3a23f72a1",
      "scheduled_deliveries_fence_sha256": "e647bdcdd1505e3d978c73d69934c9f04c20159bad4e12ac9d0c93b202442555",
      "draft_hash_set": [
        "69f6510e555b47984c6462b12da569b5bb67c051b1592ddb2ffb93898564b9c1",
        "d717125902230dc362c3e951ef0d6f656d0919dd0665f449f7056158b031dfab"
      ],
      "telegram_binding_sha256": "318d62644dc480dbe2be54b402f19eb0af41dc35928206d19357a9d6f9053713",
      "canonical_events_sha256": "4a718b95dc35f7219be2f0c5c1b7ce1d67690489086b117fb82c898564010155",
      "unchanged_from_pre_restart_evidence": true
    },
    "observer_r70": {
      "row_count": 95,
      "rows_appended_by_task": 0,
      "checksum_manifest_sha256": "7fc243d93f88e632e61b0415ad4d516e4dbea0a2079709e8df5aca6be2526e73"
    },
    "r71_action_roots": {
      "authorization": "ABSENT",
      "execution": "ABSENT",
      "successor_runtime": "ABSENT",
      "observer": "ABSENT"
    }
  },
  "no_effects": {
    "git_commands": 0,
    "git_or_github_actions": 0,
    "source_edits": 0,
    "live_config_or_state_edits": 0,
    "service_start_restart_enable_actions": 0,
    "cron_actions": 0,
    "network_customer_provider_actions": 0,
    "authority_actions": 0,
    "observer_actions": 0,
    "r71_launcher_actions": 0,
    "customer_values_exposed": false,
    "temporary_debug_artifacts_remaining": 0,
    "only_persistent_artifact": "/home/cube/projects/richard/traning coach/.omo/evidence/nutricoach-telegram-checkin-stepper/task-10-debug-r70-startup-registration.json"
  }
}