I read this as an independent release-candidate audit - I’ll inspect the sealed artifacts, trace acknowledgment/recovery behavior end to end, and verify the evidence without editing.


I read this as a final release verdict - I conclude the candidate fails one required recovery invariant.

# FAIL

**Blocking defect: a `/status` recovery followed by a same-candidate restart republishes again.**

- `/status` adds `operator_recovery_request` to the durable publication payload at `telegram_nutrition_onboarding_runtime_publication.py:101-106`.
- Normal startup omits that field at `:269-275`.
- Publication deduplication compares the complete payload at `telegram_nutrition_onboarding_runtime_publication_transport.py:20-36`; the mismatch advances the generation and dispatches another card.
- Probe against the installed candidate produced:

```text
startup_generation: 22
status_generation: 23
same_candidate_restart_generation: 24
epoch_unchanged: true
restart_payload_equals_current: false
```

This violates both “same-candidate restart dedupes” and “at most once per exact candidate epoch,” despite the candidate epoch remaining unchanged.

The tests miss this sequence: the same-epoch test compares baseline payload to baseline payload, while the `/status` test mocks `_publish`. All seven focused tests pass, but none exercise `/status -> restart`.

## Other findings

The remaining requested properties are supported:

- Provider `COMMITTED` receipts and human acknowledgements use separate durable ledgers.
- Repeated valid hold acknowledgements are idempotent by `(session_id, attention_identity)`.
- Hold acknowledgement returns without invoking an owner decision, activation, or coaching transition.
- Acknowledged states suppress startup successor recovery; unacknowledged successor epochs advance publication generation.
- `/status` requires the exact sealed owner user/chat/topic.
- Missing or disabled configuration leaves the feature off; enabled operation requires a candidate- and owner-bound receipt from a systemd credential directory or pinned authority directory.
- The seven-file wheel delta contains notification, publication, callback, and ledger behavior only—no new activation or coaching call path.
- Candidate binding recomputed to `102cbbb...4635`; source, both wheels, and both installed copies matched the declared hashes. Installed manual QA passed.

## Recommended correction

1. **Recommended:** keep `/status` request identity outside the semantic publication payload and pass an explicit force-new dispatch/idempotency key to the transport. Startup can then compare the stable candidate-epoch payload and dedupe correctly.
2. **Alternative:** normalize away `operator_recovery_request` when comparing startup payloads. This is smaller but couples transport deduplication to feature-specific payload semantics and is easier to regress.

No files were edited.


I read this as a focused successor re-audit - I’ll verify the payload-equivalence fix, integrated regression, candidate binding, A/B provenance, and release PASS evidence only.


I read this as a focused successor verdict - the blocker is resolved and evidence is consistent.

# PASS

- Equivalence ignores only `operator_recovery_request` while requiring identical attention identity and candidate epoch; successor epochs remain distinct.
- Integrated `/status -> same-candidate restart` test confirms no new publication preparation.
- Focused suite: **8 passed**.
- Installed manual QA A/B: `status_then_restart_deduped=true`, no workflow transition or customer messages.
- Wheel A/B both hash to `71005e...c34d3`; installed fix matches source byte-for-byte.
- Candidate binding validates as `9208d72c...97a555`.
- `golden-path-release/pass.json`: **PASS**.


I read this as the final directional-dedup re-audit - I’ll verify the guard, bidirectional integration test, candidate/wheel binding, QA A/B, and final-release PASS evidence only.


# PASS

- Directional guard correctly allows normal -> `/status` and dedupes `/status` -> same-candidate restart.
- Integrated regression covers both directions; focused suite: **8 passed**.
- QA A/B: PASS with `status_then_restart_deduped=true`.
- Wheel A/B match `ea618e...c1db9`; installed source is byte-identical.
- Candidate binding validates as `e06a4e8a...da2fc6`.
- `golden-path-final-release`: **PASS**.


I read this as the final verdict - PASS.