FLT 75 REVIEW ROUND3

The tests pass, but requester profiles are not wired into the identity used by the hardened flow, and standby hosts continue running intake listeners outside the leader lease. These break two core trust guarantees introduced by the patch.

Full review comments:

• [P1] Use the resolved profile ID as the canonical identity — C:\Users\fives\source\repos\founder-intake-wt-c456\FounderIntake.Host\Adapters.cs:27-30 When the directory resolves or explicitly links a requester profile, this method still returns map.StableId; consequently RequestEnvelope.RequesterProfileId, confirmation identity checks, and ticket idempotency never use the directory's ProfileId. Cross-surface links therefore have no effect, while identical configured stable IDs can silently merge identities outside the directory's verification flow. Return the resolved profile ID as the stable identity.

• [P1] Keep transport listeners behind the leader lease — C:\Users\fives\source\repos\founder-intake-wt-c456\FounderIntake.Host\Program.cs:114-117 On a multi-host deployment, every host still starts all three intake listeners because only the outbox pump and responder are created by IntakeLeaderCoordinator. Standby hosts can therefore poll or consume inbound transport events and write intake state concurrently, defeating the new single-writer lease and potentially duplicating transport-side processing even where database event deduplication suppresses a second reply.