# NutriCoach v1.4.0 Todo 4 consolidation checkpoint

## Current boundary

- Todo remains `Correlate NutriCoach check-in correction lineages` in progress.
- Product edits are paused after three non-confirmed independent reviews.
- No commit, push, PR, merge, tag, release, live config/service/provider,
  customer, or network action occurred.

## Confirmed behavior

- Accepted terminal `NUTRITION_CHECKIN` and legacy `MORNING_CHECKIN` resolve.
- Active immutable correction lineage advances source pins without changing
  submitted/late timeliness.
- Same event ID with different bytes/digest fails closed.
- Cross-customer canonical roots/corrections fail closed when an expected
  binding is supplied.
- Descriptor-bound event/sequence/lock snapshots defeat name swap/restore.
- Exact 22:59:59/23:00:00 and both cutoff/check-in barrier orderings pass.
- Todo 4 tests: 39 passed.
- Todo 3 tests: 142 passed.
- Canonical/reporting tests: 124 passed.
- LSP, ruff, ty, basedpyright, compileall, no-excuse, and LOC pass.

## Three review rounds

### Round 1

- Same event ID with changed canonical bytes replayed.
- Canonical tree was not bound to the sidecar customer.
- Direct LSP diagnostics were nonzero.

### Round 2

- Restart/root replacement, lock-path substitution, and event/sequence
  swap-and-restore could redirect the canonical snapshot.
- An ignored executor-created `.venv` remained.

### Round 3

- A restart API that omits the expected binding can accept a replaced
  customer root and append a rogue correction.
- FIFO event, sequence, and lock children block inside `os.open` instead of
  typed-failing.
- `.ruff_cache` remains.
- The prior global package-inventory digest claim lacks retained canonical
  inventory bytes and is not independently reproducible.

## Minimum remaining repair

1. Remove binding-less restart/open. Every existing canonical authority open
   requires the caller-held expected binding; only the explicit one-time
   registration path may issue the first binding.
2. Open child names with `O_NONBLOCK|O_NOFOLLOW`, verify regular file identity,
   and typed-fail FIFO/nonregular entries without blocking.
3. Remove only task-generated `.ruff_cache` residue.
4. Append an evidence erratum for the unsupported historical global-package
   digest claim and retain canonical current inventory bytes for reproducible
   before/after checks in the next run.

No broader architecture change is proposed.