I read this as a full r44 goal-and-constraint audit - I’ll trace the installed source/runtime end to end, execute only disposable local fixtures, and report each requirement with evidence plus at least five restart/failure paths.


Source and runtime surfaces are identified. I’m now narrowing to the customer bootstrap/onboarding/activation/check-in modules, their focused tests, and the runtime’s provenance so the final verdict distinguishes source capability from what r44 actually has installed.


The installed gateway is confirmed to be the r44 wheel and its critical files byte-match the reviewed source. I’m moving to executable proof: focused no-network tests, disposable end-to-end fixtures, and explicit restart/fault cases; the live profile will remain read-only.


Core disposable suites pass (41 gateway/bootstrap tests and 188 domain/activation/check-in tests). One broad async module cannot run under this checkout’s incomplete test environment because `pytest-asyncio` is absent; its 49 synchronous cases pass, and I’m treating the 41 collection/runtime-plugin errors as verification-environment failures, not product failures. I’m checking live r44 health and remaining cross-step seams before assigning the verdict.


I read this as a full r44 goal-and-constraint audit - I traced source, installed runtime, live configuration, focused tests, and restart/failure behavior without modifying production.

# Verdict

**FAIL**

- **confidence:** 0.97
- **blocker_count:** 2
- **production runtime:** r44 candidate `62f33e7d4bff114082c4b7be8f3f5e9c9b0a29c2ae4e181a5387105693338d38`
- **live service:** active and connected since `2026-08-31 01:53:51`
- **edits/commits/network/customer writes:** none

## Blocking issues

1. **Ambiguous consent-card delivery permanently wedges bootstrap.**
   A timeout/network error leaves `recovery_attempts` populated because only definite no-side-effect errors clear it (`telegram.py:12145-12159`). Both normal publication and restart recovery refuse sessions with any recovery attempt (`telegram.py:5795-5796`, `12102-12103`). `RoomBootstrapStore.unresolved_attempts()` exposes the condition, but it has no production caller (`telegram_customer_bootstrap.py:793-802`). An operator must inspect/reconcile the Telegram side effect manually, violating “without operator repeatedly fixing blockers.”

2. **There is no complete disposable proof of the requested chain.**
   Tests separately prove issuance/TTL, onboarding, activation domain behavior, membership evidence, and check-in saving, but no test traverses:
   `invite CLI -> Telegram /start handler -> disabled registration -> consent callback -> 22 questions/navigation -> owner callback -> membership preflight -> activation cutover -> registered customer Telegram check-in save`.
   In particular, there is no focused test invoking `TelegramCustomerBootstrapRegistration.handoff_rehearsal_customer()` or `activate_customer_cutover()`. The claim therefore cannot be proven to the requested standard despite most constituent behavior being present.

# Requirement matrix

| Subrequirement | Status | Source evidence | Test/runtime evidence |
|---|---|---|---|
| One invite issuance | **ACHIEVED** | `dualcoach_customer_invite.py:137-161`; CLI route `dualcoach_admin.py:1003-1008,1049-1063` | `test_dualcoach_admin_customer_invite.py:67-97`; 41-test gateway set passed |
| Telegram deep link | **ACHIEVED** | `telegram_customer_bootstrap.py:329-360` | Link shape asserted at `test_dualcoach_admin_customer_invite.py:91-95` |
| Private-DM-only claim | **ACHIEVED** | `telegram.py:12005-12017`; store requires `user == chat`, `telegram_customer_bootstrap.py:388-402` | Single-use claim test at `test_telegram_customer_bootstrap_invite_ttl.py:54-83` |
| Disabled registration after claim | **PARTIAL** | Exact DM identity and disabled row: `telegram_customer_bootstrap_registration.py:107-185,267-319` | No direct registration-handler test |
| Consent card and authenticated claim | **ACHIEVED** | Card `nutrition_coaching.py:3533-3575`; current-card check and callback `telegram.py:6695-6780`; handoff binding `telegram_customer_bootstrap.py:712-755` | Consent authority/domain tests included in 188 passing profile tests |
| 22-question onboarding | **ACHIEVED** | Exact 22 fields `nutrition_onboarding_contract.py:13-36`; ordered collection `nutrition_onboarding.py:189-215` | `test_nutrition_onboarding.py:210-240,384-431`; 188 passed |
| Pause / resume | **PARTIAL** | Runtime actions `telegram_nutrition_onboarding_runtime_callback.py:336-357`; durable status recovery `runtime.py:288-358` | Navigation rendering tested, but no full pause/restart/resume integration |
| Back | **ACHIEVED** | Rewind truncates later answers: `runtime.py:669-730`; callback `runtime_callback.py:324-334` | Navigation controls `test_customer_nutrition_ux.py:112-138`; restart cursor test `test_nutrition_onboarding.py:183-207` |
| Skip | **ACHIEVED** | Optional-only skip `runtime_callback.py:358-368`; text equivalent `runtime_collection.py:244-252` | Optional navigation exposed at `test_customer_nutrition_ux.py:112-138` |
| Revise | **ACHIEVED** | Customer revise `runtime_callback.py:370-379`; owner digest-bound revise `runtime_callback.py:457-526` | `test_nutrition_onboarding.py:278-328,438-507` |
| Customer attestation | **ACHIEVED** | `nutrition_onboarding.py:217-276`; callback `runtime_callback.py:381-387` | `test_nutrition_onboarding.py:210-240` |
| Owner review | **ACHIEVED** | Route/member/current-card guards `runtime_callback.py:143-297`; decision handling `457-539` | Owner preflight/recovery tests passed in 41-test gateway set |
| Ready artifact finalization | **ACHIEVED** | `nutrition_onboarding_finalize_service.py:17-59`; runtime finalization `runtime.py:270-286` | Finalization fixture in `test_nutrition_onboarding.py:593+`; 188 passed |
| Staff membership evidence | **PARTIAL** | Fresh absence query `telegram_staff_membership_gate.py:277-363`; evidence and five-minute TTL `499-572,575-673` | Faults fail before mutation: `test_staff_membership_activation_gate.py:29-63`; no cutover-wrapper integration |
| Activation | **PARTIAL** | Membership-before-write and committed bootstrap transition `dualcoach_activation_cutover.py:146-220,309-442`; direct enable forbidden `customer_admin.py:740-754` | Activation domain/restart tests included in 188 passed; no `activate_customer_cutover()` end-to-end test |
| First daily check-in save | **ACHIEVED** | Enabled registry creates customer-bound bridge `nutrition_coaching.py:2360-2382`; launcher/save `3827-3848,3976-4050`; canonical event save `wizard.py:867-1001` | `test_customer_nutrition_wizard.py:9-51`; UX completion `test_customer_nutrition_ux.py:267-312` |
| Capacity five | **ACHIEVED** | Invite checks current enabled count `dualcoach_customer_invite.py:118-133`; activation validates bounded capacity `customer_admin.py:1046-1055` | Five accepted at `test_multi_customer_registry.py:76-98`; production registry says capacity 5, one enabled |
| One-use invite | **ACHIEVED** | Claimed token leaves `PREPARED`, making reuse unavailable: `telegram_customer_bootstrap.py:365-414` | `test_telegram_customer_bootstrap_invite_ttl.py:54-83` |
| 24-hour TTL | **ACHIEVED** | `_INVITE_TTL`, `telegram_customer_bootstrap.py:26,343` | Exact boundary test `test_telegram_customer_bootstrap_invite_ttl.py:30-51` |
| Strict route/auth boundaries | **ACHIEVED** | Private DM, actor, route, generation, publication and membership checks above | Wrong route/order tests `test_nutrition_onboarding.py:157-180`; staff evidence faults; authority probe succeeded |
| No guard bypass | **ACHIEVED** | Activation CLI requires external Task26 pin/candidate `dualcoach_admin.py:1021-1031,1064-1109`; direct enable rejected | Installed authority successfully authorized exact r44 candidate with event count 20 |
| Production is r44 | **ACHIEVED** | Running process uses `62f33e7d-v150`; wheel `direct_url.json` points to `task-v15r44-candidate` | Nine critical installed files byte-match source; systemd environment pins that runtime |
| No customer/network writes during review | **ACHIEVED** | Live profile only read | All behavioral execution used pytest `tmp_path`; no Telegram/API calls |

# Failure and restart traces

1. **Expired invite:** at exactly 24 hours it transitions to `EXPIRED`; claim rejected.
   Evidence: `test_telegram_customer_bootstrap_invite_ttl.py:30-51`.

2. **Invite replay:** second claim after successful DM claim is rejected.
   Evidence: `test_telegram_customer_bootstrap_invite_ttl.py:54-83`.

3. **Gateway restart during registration/consent:** `REGISTERING` is re-handed off and `AWAITING_CONSENT` is republished when no unresolved provider attempt exists.
   Evidence: `telegram.py:5755-5823`.

4. **Restart during question collection:** answers and cursor survive; status exposes no answer values.
   Evidence: `test_nutrition_onboarding.py:183-207`.

5. **Duplicate Telegram update:** consumed-update replay returns durable status instead of reapplying business state.
   Evidence: `runtime.py:641-667`, `runtime_collection.py:133-167`.

6. **Onboarding publication restart:** receipted outbox entries reconcile to committed publication without another send.
   Evidence: `runtime_publication_transport.py:67-119,332-387`.

7. **Activation crash/restart:** prepared activation journal is reconciled; rollback failures retain explicit recovery state.
   Evidence: `test_customer_admin.py:1407-1535`.

8. **Check-in restart:** active draft rehydrates and resumes; completed same-day check-in reopens without duplicate event.
   Evidence: `test_telegram_physique_checkin.py:435-455`; `test_customer_nutrition_wizard.py:54-73`.

9. **Blocking consent-send ambiguity:** timeout may have delivered, but unresolved attempt prevents automatic retry and restart recovery.
   Evidence: `telegram.py:12145-12159`, `5795-5796`, `12102-12103`.

# Verification executed

- Gateway/bootstrap/onboarding recovery: **41 passed**
- Domain onboarding/activation/membership/check-in: **188 passed**
- Check-in synchronous gateway cases: **49 passed**
- Installed r44 authority probe: **AUTHORIZED**, event count 20
- Installed/source critical-file comparison: **9/9 byte-identical**
- Broad `test_telegram_physique_checkin.py`: 49 synchronous tests pass; 41 async cases could not execute because this checkout lacks `pytest-asyncio`. This is a verification-environment gap, not counted as a product failure.