I read this as a read-only security and authority review - I’ll inspect only the uncommitted feature brief and diff, verify each required invariant against installed PTB, and report blockers or PASS.


I read this as a read-only security and authority review - I inspected the feature brief and full uncommitted diff, compared installed PTB, and found blockers.

## BLOCKERS

1. **Critical - config alone activates the capability; no receipt, seal, or bot-right verification exists.**
   Evidence: the brief forbids config-only activation at `.omo/feature-briefs/nutricoach-channel-inbox-v1.5.0.md:27-29,43-52`, but the config accepts any 64-char hex digest at `gateway/platforms/telegram_channel_inbox_config.py:68-76,109-113`; ingress and outbound activation then depend only on `config.enabled` at `telegram_channel_inbox.py:129` and `telegram.py:908-920`.
   The repository has no feature-path check of `can_manage_direct_messages`; PTB 22.6 exposes that required admin right at `.../telegram/_chatmember.py:256`. A controlled check confirmed an arbitrary `"a"*64` activates direct-routing metadata.
   **Minimal fix:** keep this capability hard-disabled until a verifier validates a one-use sealed receipt bound to the candidate/config digest, exact channel and bot identity, `can_manage_direct_messages is True`, and the canonical registry mutation.

2. **High - channel-DM commands bypass reservation and reach the generic agent.**
   Text/media/location/contact/edit are guarded, e.g. `gateway/platforms/telegram.py:14229,14239,14270,14479,14668`; `_handle_command` at `:14418-14472` has no channel-inbox guard before generic `handle_message`.
   A controlled valid-but-unregistered channel-DM `/unknown` reached `handle_message` once. This also bypasses admin-sender rejection for commands.
   **Minimal fix:** reserve all configured channel-DM commands before rehearsal, operator, and generic-command paths; explicitly route only permitted registered customer commands to Nutrition or consume them.

3. **High - scheduled direct-topic sends always fail at the strict transport boundary.**
   The new path prepares `direct_messages_topic_id` with `message_thread_id=None` at `gateway/platforms/telegram.py:1023-1029` and `nutrition_coaching.py:21338-21355`. But `_send_message_strict_topic` rejects every request lacking `message_thread_id` at `telegram.py:4139-4145`.
   Controlled execution produced `strict topic delivery requires message_thread_id`. PTB 22.6 supports `direct_messages_topic_id` on `Bot.send_message` at `.../telegram/_bot.py:1000-1015`.
   **Minimal fix:** make the strict sender require exactly one non-null routing field, accepting either `message_thread_id` or `direct_messages_topic_id`; add an integration test asserting the fake PTB bot receives only the direct-topic field.

4. **High - live Nutrition replies use the wrong topic parameter for Channel Direct Messages.**
   The changed address resolution (`gateway/platforms/telegram.py:5740-5746`) sends channel-DM customers into `_render_nutrition_text`, which calls `_send_nutrition_topic` at `:6613-6630`. That helper constructs only `message_thread_id` at `:6176-6191`, never `direct_messages_topic_id`.
   Controlled execution sent `{'message_thread_id': 9, 'direct_messages_topic_id': None}`. This does not meet the exact direct-topic contract.
   **Minimal fix:** make `_send_nutrition_topic` select the direct-topic metadata for a receipt-validated channel-DM route and use the corrected strict sender.

5. **High - disabling the capability does not provide the promised bot-DM rollback.**
   With `enabled=False`, direct metadata is omitted (`gateway/platforms/telegram.py:908-920`), but scheduled transport still starts with `{"thread_id": topic_id}` (`nutrition_coaching.py:21338`) and falls through to `message_thread_id` (`telegram.py:1029`). A controlled disabled-capability send targeted the channel with `message_thread_id=9`, not the archived bot-DM route.
   This contradicts the brief’s fallback and rollback guarantees at `.omo/feature-briefs/nutricoach-channel-inbox-v1.5.0.md:80-82,100-102`.
   **Minimal fix:** when channel authority is invalid or disabled, resolve and require the archived canonical bot-DM route; if unavailable, fail closed rather than send to the channel.

6. **Medium - ordinary channel posts are not channel-inbox-reserved before adaptive handling.**
   `_handle_channel_post` at `gateway/platforms/telegram.py:14245-14251` invokes adaptive reservation without `_channel_inbox_reserves_ingress`; the edited equivalent has the guard at `:14253-14259`.
   **Minimal fix:** add the same first guard to `_handle_channel_post`.

## Verified controls

- Default absent configuration is OFF: `telegram_channel_inbox_config.py:60-62`; ingress requires enabled config at `telegram_channel_inbox.py:129`.
- PTB 22.6 `DirectMessagesTopic` is correctly modeled as `topic_id` plus optional `user`, with at most 52 significant topic bits: `.../telegram/_directmessagestopic.py:42-56,66-74`. The inbound parser checks direct chat, exact chat ID, topic bounds, topic user, and sender equality at `telegram_channel_inbox.py:138-161`.
- Registry routes are exact tuple matches and uniqueness is enforced by the existing registry boundary: `nutrition_coaching.py:3154-3157`; `dualcoach/profile/checkin_cli/customer_coaching.py:1026-1033`.
- Scheduled transport remains canonical-route bound at `nutrition_coaching.py:2657-2663,21315-21320`.
- New feature logs contain only adapter name and typed reason code, not raw IDs or message bodies: `telegram.py:862-866,881-885`.
- The direct metadata branch avoids a non-null routing-field mix: `telegram.py:1023-1029`.

Verification: `pytest tests/gateway/test_telegram_channel_inbox.py -q` passed (`12 passed`). Those tests do not cover the blockers above. No files were edited.