I read this as a focused recovery fix in the designated worktree - WORKING: I’ll preserve the accepted RED, trace the publication/receipt flow, implement only within the exclusive scope, then run the required verification and save the 0600 evidence file.


I read this as a scoped implementation task - investigation found the only RED path lies outside the permitted write scope.

Blocked by contradictory constraints:

- `5/6` publication recovery tests pass.
- The sole failure is `TelegramAdapter._render_nutrition_text()` in `gateway/platforms/telegram.py:6527`, which catches the lost edit response and performs a new send.
- No permitted helper is called on that path, so this behavior cannot be changed coherently without editing forbidden `telegram.py`.
- Import-time monkey-patching from an allowed module would be unsafe and production-order-dependent, so I did not implement it.
- No source/test files or green evidence were written.

Required scope exception: allow the minimal edit-retry change in `gateway/platforms/telegram.py`.


I read this as a focused FAILED-to-RECOVERED ingress fix - WORKING: I’ll re-read the updated recovery tests and receipt gate, preserve the current RED, implement exact-evidence-first fail-closed ordering, then verify both suites and write 0600 evidence files.


I read this as implementation after confirmed RED - the exact replay is blocked before candidate matching, so I’m applying an atomic store transition reachable only after the gate matches every registered business-authority field.


I read this as verification and evidence capture - both recovery files are now green; I’m running the final exact commands into private evidence files, then checking modes, diff scope, and the mandatory post-write size/review gates.


I read this as completed recovery implementation - both required suites are green with private evidence saved.

Implemented fail-closed FAILED→RECOVERED ordering:

- Only exact registered actor/route/message/callback/update evidence heals `handler_exception`.
- Provenance is persisted atomically while removing the failure.
- Mismatches remain terminal; offset convergence remains single-shot.

Verification:

- Publication recovery: `6 passed`
- Consent recovery: `6 passed`
- Ruff: passed
- `py_compile`: passed
- Evidence files: mode `0600`

Post-write review: no new type escapes, variant gaps, defensive layers, one-off helpers, parameter bloat, redundant verification, negative naming, or logging changes. The touched file solely owns ingress receipt gating; its pre-existing 698 pure LOC exceeds the size guideline, but splitting it was outside this focused exclusive scope.