# NutriCoach v1.4.0 Todo 3 option-B consolidation

## Current boundary

- Todo remains `Implement append-only day-status sidecar` in progress.
- Product edits are paused after three non-confirmed reviews of the selected
  profile-owned authority architecture.
- No commit, push, PR, merge, tag, release, live config/service/provider,
  customer, or network action occurred.

## Confirmed behavior

- Customer paths are not storage authority.
- Raw customer identity is absent from durable paths and bytes.
- Caller-held binding seals root, marker, fixed topology, modes, owner, links,
  schema, layout, and canonical digests.
- Flat opaque-customer files preserve directory link counts.
- Every normal authority use globally validates every customer history.
- Customer rename races, symlink/hardlink/type/mode/owner substitutions,
  canonical reversal, forged logical keys, hash corruption, concurrency,
  restart, torn tails, and canonical-reader coexistence are covered.
- Focused suite: 77 passed.
- Canonical regressions: 49 passed.
- LSP, ruff, ty, basedpyright, compileall, no-excuse, and LOC pass.

## Three option-B review rounds

### B1 - privacy and marker identity

- Raw identity appeared in JSONL.
- Byte-identical marker replacement was accepted.
- Repaired with opaque durable identity and caller-held authority binding.

### B2 - topology identity

- Root link count was not sealed; an extra child directory was accepted.
- Repaired with fixed root inventory, `customers-v1`, flat files, and complete
  topology binding.

### B3 - initialization and repair authority

- Two synchronized initializers can race; one returned binding does not reopen,
  and one staging directory remains.
- Stage-name substitution before rename can return a binding for an empty
  destination with mismatched inode.
- Repair authority accepts a healthy history as a zero-byte repair.
- Selecting an absent history returns a zero-byte repair and creates a lock.

## Minimum remaining repair

1. Serialize initialization under a stable parent capability lock.
2. Retain and verify stage inode identity through publication and reconcile the
   published destination identity before returning.
3. One concurrent initializer succeeds; every other initializer returns a
   typed already-initialized result with no staging residue.
4. Cleanup removes only verified initializer-owned stage inodes.
5. Issue repair authority only for one existing file with a proven incomplete
   final fragment, bound to file identity and exact durable offset.
6. Reject healthy, absent, zero-byte, changed-identity, or changed-offset
   repairs without creating lock/data files.

No architecture change beyond the approved option B is proposed.