I read this as a narrow advisory hotfix review - I’ll trace the scoped recovery path and verify the candidate evidence against the no-mutation/no-customer-output invariant, then return PASS/FAIL with at most one blocker.


I read this as a narrow advisory hotfix review - I traced the recovery branch and validated it against the candidate-bound evidence.

## PASS — blocker: none

- `recover_waiting_session()` gates missing-handoff recovery on the capability, reads durable status, permits only `owner_review`/`safety_hold`, publishes, then returns (`runtime.py:276-299`).
- The return prevents reaching consent persistence, `start_or_resume`, finalization, reconciliation, or activation logic beginning at line 300.
- The scoped test exercises `consent_handoff=None` with a deliberately minimal runtime and confirms receipt recovery plus publication (`test_telegram_operator_notification_recovery.py:371-407`).
- Both permitted states were additionally exercised successfully; scoped suite: **9 passed**.
- Candidate binding matches `dbb79fe...e66e5c`; the runtime source is byte-identical to the bound wheel member (`d9db56...95227`).
- Candidate restart evidence `fake-api-calls.jsonl:192-213` shows only operator-chat edits (`-100700` at sequences 196 and 209), with no customer-chat `200` output. Publication evidence records one operator delivery and zero duplicates.

Architecture judgment: retain the current inline, capability-gated status-only branch. A separate recovery service could make side-effect boundaries more explicit, but would add cross-file coupling and migration risk without improving this narrow hotfix.