I read this as a code-quality audit of the full V13 delta - I’ll compare it with the supplied V12/candidate references, inspect code and tests, and run only non-live verification.


I read this as a completed V13 code-quality audit - findings and non-live verification follow.

1. **CRITICAL - V13 live migration cannot import `checkin_cli`.**
   `scripts/nutricoach_v150_controller_worker.py:9` adds only the repository root, while new `weekly_authority.py:14-24` imports `checkin_cli`, located under `dualcoach/profile/`. Bubblewrap clears the environment, and no production path adds that directory. The V13 tests hide this by injecting it in `tests/nutricoach_v150_transaction_support.py:11` / `test_nutricoach_v150_weekly_authority.py:15`. A clean-environment static import confirmed `checkin_cli` is undiscoverable. This fails after reservation and service stop, consuming the one-use authorization.

2. **HIGH - rollback can permanently leak created paths while marking itself complete.**
   `RollbackGuard.rollback()` records `created_remove` failures but writes `ROLLED_BACK` unless snapshot restore or protected verification failed (`sealed_controller.py:98-122`). Therefore `_recover_pending()` will not retry cleanup. Hermetic reproduction produced:
   `{"authority_exists": true, "successor_exists": true, "phase": "ROLLED_BACK", "recovery_required": false}`
   after forcing `remove_created()` to fail.

3. **HIGH - claimed controller closure is incomplete for V13 behavior.**
   The V13 source manifest does not seal the newly executed canonical `checkin_cli` and weekly gateway modules. `verify_closure()` therefore cannot detect their drift. Runtime installation also passes wheel paths directly to `uv` without checking the sealed wheel hashes; the sealed target's `wheels` data is not consumed by execution.

4. **LOW - 250-LOC ceiling exceeded in V13-modified tests.**
   `tests/test_nutricoach_v150_sealed_controller.py` is 287 LOC and `tests/test_nutricoach_v150_v3_hardening.py` is 302 LOC.

Verification: V13 read-only verifier passed; all `tests/test_nutricoach_v150_*.py` passed (79); focused V13 tests passed (54); basedpyright and LSP diagnostics were clean. A two-customer hermetic migration/bootstrap also succeeded. No edits, live execution, network, provider, or Telegram operations were performed.

<verdict>FAIL</verdict>


I read this as an investigation of the disabled-customer V13 failure and its root-cause surface - I’ll trace the builder, bootstrap, owner, and sealed live registry paths without changing them.


I read this as an investigation of the disabled-customer weekly-authority failure - I’ll validate the current enabled-only path and isolate remaining contract gaps without modifying registry data.


I read this as an investigation of the disabled-customer weekly-authority failure - I validated the enabled-only flow and identified remaining release and multi-customer defects.

<verdict>FAIL</verdict>

1. **CRITICAL - the correct builder fix is unsealed.**
   `scripts/nutricoach_v150_weekly_authority.py` now correctly derives the receipt and registrations from enabled customers only, and `tests/test_nutricoach_v150_weekly_authority.py` adds the needed disabled-history regression. But both differ from the V13 closure manifest. `verify_nutricoach_v150_preseal_v13.py --verify` fails with `BootstrapDenied: closure_drift`. The corrected code cannot be used by the sealed live upgrade until V13 is re-derived, re-sealed, and re-verified.

2. **HIGH - capacity five is incompatible with independently recorded customer consent.**
   The receipt schema has one `consent_digest`, and the builder rejects enabled customers whose consent records differ (`weekly_authority:consent_binding`). I reproduced this offline with two enabled valid customers differing only in `recorded_on`. A per-customer consent-digest map is required if the advertised five enabled customers are meant to work independently.

3. **MEDIUM - the two-customer cleanup test no longer tests the claimed branch.**
   `tests/gateway/_nutrition_weekly_reminder_support.py` makes `client_002` disabled, yet registers it and places it in `enabled_customer_keys`. `test_second_customer_failure_closes_every_partial_capability` therefore fails at enabled-set validation before opening the second customer; chmodding its events file is irrelevant. Use two enabled fixture customers for the partial-second-capability cleanup case, and retain a separate disabled-customer exclusion test.

4. **LOW - the owner factory accepts surplus registered capabilities.**
   `build_weekly_reminder_authority_owner()` checks `receipt_keys <= registered_keys`, rather than exact equality. Production bootstrap currently supplies the exact set, but the factory boundary should enforce equality, and `WeeklyReminderAuthorityOwner` should preserve that invariant.

The correct root fix does **not** delete or alter the disabled registry row, drafts, or history:
- build the receipt and sidecar registrations from the enabled projection;
- bootstrap against the enabled projection;
- verify retained owner capabilities against the enabled projection.

Those bootstrap and owner projection changes are present. The full raw-registry digest remains in each enabled runtime binding, so edits to disabled historical rows still invalidate retained bindings.

Verification: disabled-history migration test passes; ownership plus weekly-authority focused tests pass (11 tests) with `PYTHONPATH=dualcoach/profile`. Production-file diagnostics are clean. The V13 preseal verifier currently fails due to the unsealed builder/test changes.