# DualCoach Task22 incident-recovery successor

This seal supersedes the trainer-removal readiness successor only for the one
post-exchange PREPARED incident. It has no generic rollback, prepare, or
trainer-removal execution path.

## Outcome

- The provisional `st_019ff2a2` recovery module is pinned at
  `4a2005c8f4faddc177cdd17940db5b1c0dd2780212ed03d01e248e51e2c25b6f`.
- The forward-only CLI is pinned at
  `37450829b21f33b339eb804ee4ab5bb3aab16d3c9bd612b3f40f44b1ec62d292`.
- It recognizes only transaction
  `86d979a1d83dab0eab6ff71c0688d5c84cccfdd51b2843663c79c30fc4876eff` and
  authenticates the read-only incident index
  `c0662f154a54aa0aaa05afa45eaca32ebdc99226eaf68d39fb23bf89d345a4af`.
- The sealed module closure is exactly recovery, predecessor removal,
  protected inventory, callback classifier, and onboarding publication outbox.
  Other application modules are denied.
- The sole guarded live diagnostic exited before COMMITTED after 598868050 ns; its
  denied `mkdir(data, exist_ok=True)` preserved the 3,020-record live profile
  snapshot at `72b94606e599aeaeb13a4b6377785331201ca5fc94bddab02f8f5a3c56cd9278`.
  It ended before the requested 8-second capture and was not retried.
- Verify-only recomputes gateway leaves and their exact Git patch provenance;
  it never opens the live profile root. The profile package is bound through
  the independently reproduced offline wheel attestation.

## Verification

- Focused Task22 trainer-authority-removal causal-fix regression: **74 passed**; the prior 144-test successor receipt is retained as historical provenance.
- Sealed launcher, closure, lifecycle, pidfd, and identity suite: **70 passed**
  with warnings as errors, including an audit-hook assertion that verify-only
  never opens `/home/cube/.hermes/profiles/dualcoachtest`.
- Profile package suite: **720 passed** with warnings as errors using its
  existing isolated venv.
- Gateway wheel:
  `fc4ca963176010769bb2bbd4aa2a22565a1c3234775aa97924b6f12916a7f59e`,
  993 members, reproduced twice from fixed-epoch isolated copies with fixed
  ZIP timestamps and a disposable offline no-dependency wheel import check.
- Profile wheel:
  `104cfdda58eeb3487a075426598a3548fbb7a7d16f50eb81cd8a47e0fc090347`,
  50 members, retained unchanged from its prior offline attestation.
- Each protected-session scan shares a 10-second monotonic authority-command
  budget; deterministic tests cover clamping, pre-spawn exhaustion, and
  subprocess timeout fail-closed behavior.
- Disposable `compileall` passed. Canonical verify-only passed. Invalid or
  non-forward recovery commands fail before importing the recovery module.
- The broad `tests/gateway` run is not a release proof: **8296 passed,
  231 failed, 59 skipped, 12 errors** under `-W error`, in unrelated API,
  Slack, WhatsApp, Matrix, and other platform tests with pre-existing
  unawaited-coroutine/resource-warning failures. No unrelated source was
  changed to suppress them.

## Pins

- candidate: `18a54bfebc9e81c70da8c1a4829a84892ad93e0e346378685f5f21ad6b89685b`
- manifest: `9b52c89bd483d64dc48f83dd5cd3d61f99c2bedc47f57f905508779e29de14f1`
- freeze receipt: `9f7b80eced374146a5c8a18fa96cb0964a299404aabbeae23b0d8e7297bce81f`
- candidate diff: `65af83353627a492f2d5b4fcd813bc764ff963fb7f0ea5b66a155f866f3dd1e6`
- gateway candidate projection: `97d32e87cf59f294664e6e322a29137fbc1cc0701305e64610b4e926ed1d2fd9`
- gateway diff projection: `7de5650ba581bdf90397f65167ce29028e0d060a7f6644903ee64dba8e67a687`
- gateway status: `030af7db98cf9011370cb81071a9aec91562ecbca20efc806575a6206a86aef7`
- gateway wheel: `fc4ca963176010769bb2bbd4aa2a22565a1c3234775aa97924b6f12916a7f59e`
- profile wheel: `104cfdda58eeb3487a075426598a3548fbb7a7d16f50eb81cd8a47e0fc090347`

## Authorized resume

Do not run this as part of verification. The sole safe forward-only command is:

```sh
/home/cube/projects/richard/hermes-agent/.venv/bin/python -I -B \
  /home/cube/projects/richard/hermes-agent/scripts/task22-trainer-authority-recovery \
  --resume-transaction 86d979a1d83dab0eab6ff71c0688d5c84cccfdd51b2843663c79c30fc4876eff \
  --forward-only
```

No service, live profile data, Telegram, plan, ledger, todo, commit, push, or
release was mutated by this seal.