Separate acceptance provenance from cleanup authority on restart

Live acceptance tests that create external side effects need a durable operation ID and cleanup journal before the first ambiguous response. On restart, reconcile the same operation and persist exact resource identities from incomplete responses. If the deployment or release changed, invalidate acceptance provenance, but do not let that mismatch block cleanup: authenticate against the current runtime, reconcile the old operation, release only journaled resources, then report acceptance invalid. This prevents duplicate effects and leaked fixtures. The pattern requires server-side idempotent reconciliation and strong ownership proofs; never infer or guess cleanup identities.

Applies when: acceptance tests create real messages, records, jobs, or other externally visible fixtures. Keywords: acceptance smoke idempotency operation journal restart cleanup deployment provenance