I read this as an implementation and recovery fix - I’ll trace the failing onboarding flow, make the smallest fail-closed production change within the exclusive scope, and verify every required gate. WORKING.


I read this as the same implementation task - the accepted RED confirms three independent seams: resolver ordering, durable consent provenance/replay, and exact receipt healing; I’m now tracing the existing contracts before editing.


I read this as implementation now - I’ll add a side-effect-free sealed package resolver, persist an exact consent handoff in the bootstrap ledger, and serialize restart recovery so profile creation, publication, and ingress reconciliation replay once.


I read this as verification of the scoped implementation - consent restart recovery and fail-before-mutation now pass; I’m checking the full criterion and adjacent profile contracts, with one known receipt-ordering seam explicitly outside the permitted files.


I read this as an implementation task with strict scope - Lane A is implemented, but the full-file gate is blocked by an explicitly excluded polling-receipt defect.

Implemented:

- Fail-closed profile package resolver before filesystem mutation.
- Sealed, digest-bound consent provenance persisted in bootstrap state.
- Missing-session reconstruction from authenticated Telegram evidence.
- Concurrent replay serialization and one-time business reconciliation.
- Legacy sessions without provenance fail closed.
- Registration now uses the shared resolver.

Verification:

- Consent criterion: `1 passed`
- Resolver/recovery focused tests: `2 passed`
- Bootstrap/publication tests: `8 passed`
- Ruff: passed
- `py_compile`: passed
- Profile onboarding: `125 passed, 2 pre-existing failures` due missing `nutrition-restriction-kb-template-v1.json`
- Evidence: `.omo/evidence/v1.1.1-stability/green-consent-recovery.txt`, mode `0600`

Full recovery file: `5 passed, 1 failed`. The remaining test directly exercises `telegram_polling_receipts.py`: `begin()` returns on persisted failure before checking exact registered recovery evidence. Fixing it requires reordering that branch, but polling receipts are explicitly outside this task’s write scope.

Changed production files:

- `gateway/platforms/dualcoach_profile_package.py`
- `gateway/platforms/telegram_customer_bootstrap.py`
- `gateway/platforms/telegram_customer_bootstrap_registration.py`
- `gateway/platforms/telegram_nutrition_onboarding_runtime.py`

The accepted test file was not weakened or edited. No commit or production environment mutation was performed. Other concurrent worktree changes were left untouched.

Interface assumptions:

- `DUALCOACH_PROFILE_PACKAGE` contains a real `checkin_cli` package.
- Consent callback data is `nutrition-consent:grant:g{generation}`.
- Telegram ingress context is established before consent handling.
- `_reconcile_telegram_business_commit` is synchronous and accepts the tested provenance fields.

Review: new resolver has one responsibility; persisted input is strictly parsed and digest-verified; no new suppression or logging; replay is lock-serialized. Existing oversized modules remain inherited and cannot be split within the exclusive scope.