I read this as a read-only live-rehearsal feasibility audit - I’ll trace the authoritative runbooks, immutable candidate/runtime loading path, archived receipts and indexes, then inspect only local config, process, systemd, and Telegram topology state to return a bounded PASS/FAIL decision.


The authoritative archive binding confirms Tasks 22-25 are historical-only for this successor, so they cannot supply intended-DM proof. I’m now narrowing whether the installed normal lifecycle supports a genuinely fresh customer/profile without restoring or retargeting that archive, and whether systemd can load the sealed wheel bytes directly.


The live baseline is empty and clean, but it contains exactly three expired, unclaimed customer bootstrap sessions and no current customer to reactivate. The service is also bound to an older installed wheel, not the immutable candidate. I’m checking the candidate’s actual ingress and administrative surfaces for any tokenless fresh-registration or supported reactivation route before declaring the single necessary boundary.


The candidate has no tokenless customer ingress: only `/start rc1_<22-char token>` is routed to customer registration, and registration explicitly requires a live `PREPARED` invite claim. Expired sessions are terminal and there is no customer reactivation command. I’m completing the immutable verifier and byte-stability check, then I’ll return the boundary decision.


I read this as a decision-complete read-only preflight - the result is FAIL because every supported fresh-customer path requires another canonical invite.

## Verdict: FAIL

No bounded normal path exists under all stated boundaries.

### Decisive blocker

The single minimal boundary requiring explicit user authorization is:

> Permit exactly one additional fresh canonical customer bootstrap invite.

This would be the fourth invite issued for this rehearsal lineage. It should target a genuinely fresh disposable Telegram customer identity, not reconnect `8527916639` merely to validate its historical binding.

### Why no existing path works

- Current registry: `ordinary_v1`, zero customers.
- Current service-state map: zero customers.
- Customer bootstrap ledger: exactly three sessions, all `EXPIRED`, with zero claims.
- Expired tokens are rejected as unavailable.
- Candidate ingress accepts only `/start rc1_<token>`.
- Registration requires a live `PREPARED` invite claimed from a private customer DM.
- The candidate exposes no tokenless registration or customer-reactivation command.
- Restoring the Task25 archive or directly inserting a customer would violate explicit boundaries.
- A fresh disposable profile still requires issuing a new canonical invite; changing profiles does not avoid the fourth-invite boundary.
- Tasks 22-25 are explicitly classified as historical compatibility/provenance only and cannot prove execution against candidate `2e0894...`.
- Task22 expressly records `global_no_recovery_shortcut_criterion: not_claimed`; therefore historical evidence cannot satisfy the requested no-shortcut proof.

### Candidate/runtime finding

The candidate itself is intact and executable without mutating it:

- Full candidate verifier: `PASS`
- Full digest: `2e0894eac92bc396cc4723bf1f18ebc653b95018dd41574df435941c235da925`
- Wheel SHA-256: `af4a9d0a1ffffb6eb7551c1d6dc2b32853ca6d024332a4f8f5702bbf992f141b`
- Candidate wheel successfully zip-imported its `hermes_cli`, bootstrap, controller, and admin modules.
- Both candidate CLI help surfaces executed directly from the sealed wheel.
- Pre/post hashes, modes, timestamps, and cache-leaf scan remained unchanged.

However, the current systemd runtime is **not** deployed from this candidate:

- Service: `inactive/dead`, `MainPID=0`; no matching process.
- Unit points to the repository `.venv`.
- Installed distribution points to predecessor wheel SHA-256 `6a3f5f...`.
- Installed payload differs from the current candidate.
- Exact-candidate live rehearsal would therefore also require an ordinary controlled wheel deployment/service rebind before startup. That does not mutate the immutable candidate, but it does not solve the missing customer authority without the additional invite.

No service, profile, Telegram/provider, archive, credential, network-send, Git, or durable-state action was performed.