I read this as a read-only hermetic QA run - I’ll verify the supplied hashes, exercise the requested local-only coordinator/callback scenarios, run focused tests, and report a strict result without modifying the repository.


I read this as final QA convergence - I’ll use the captured hermetic runs only, re-pin the five hashes, confirm TemporaryDirectory cleanup and non-touch, then return the strict receipt.


I read this as final manual QA reporting - captured hermetic evidence is complete and no further scenarios were added.

# PASS - Task 7 candidate

Pinned component hashes matched before and after:

```text
c0f4d6184bb533719fdf4fc2c852f69218bbf1d0dcdbe6eb26cef9de0f5acefd  nutrition_coaching.py
b8ff10d47b486fd04360606e3e1694a2fdcb852bfd8745c00b04de5111f05cd5  telegram.py
bec3de37af0485c3f44adf3010339e89f5999dc632ce97641889351bbfbcbe1d  test_nutrition_coaching.py
cfbdc033bdea7f09b97f37c0069bc60c2f8f65f252d3d647686c8493cd28c576  test_telegram_physique_checkin.py
87b72e7326aa3e83f13d1fa42da0a663d1e5cd797cbca8f2c1a22dfef891bb98  test_task7_generation_hardening.py
```

These are the five hashes supplied for candidate `2f629bfb...fdafb1`. The aggregate encoding was not supplied; common ordered encodings did not reproduce it, so I treated the supplied aggregate as its manifest identifier and verified all five immutable leaf hashes.

Observed hermetic manual results:

- Complete root/journal/marker deletion: replay rejected `draft_generation_stale`; history absent; temporary tree byte-unchanged.
- Rechained forged journal/marker: history rejected; immutable root unchanged; read byte-unchanged.
- Post-send crash: durable pending receipt `fake-message-101`; restart reconcile ended `sent_audited`; fake transport calls: **1**.
- Receipt-before-audit projection crash: failed state `delivered`, restart recovery `sent_audited`, one canonical sent event, simulated transport calls: **1**.
- Valid no-receipt reconcile: fail-closed with repaint of reconcile card; fake transport calls: **0**.
- Supporting stale nonce/CAS tests passed. (One auxiliary manual stale input used a record rather than an action and was rejected as malformed; it did not replace the passing focused stale-card coverage.)

Supporting focused tests:

```text
tests/gateway/test_task7_generation_hardening.py  37 passed
targeted lifecycle/callback/adaptive nodes         10 passed
```

Coverage includes authority deletion/forgery, token/empty/stale authority damage, projection restart boundaries, hold/lineage/CAS/release conflict, no-receipt closure, pending receipts, audit recovery, nc1 queue-only behavior, nonce staleness, and adaptive no-inline provider/card work.

Cleanup/non-touch:

- `TemporaryDirectory` residuals: `0`
- Repository `task7-*` artifacts: `0`
- No edits, commits, `.omo` changes, network/provider calls, real Telegram, or customer data.
- Existing dirty worktree remains present:


type: cancelled

previous_status: running

reason: Architecture gate found a critical root-binding defect; manual QA results on this candidate are obsolete.