[plancherb1]

Evidence

The authorized manual rehearsal run 39069235921 built all four wheels successfully but skipped the testpypi job. The tag-only receipt job was intentionally skipped; GitHub propagated that skipped ancestor through the dependency chain under the implicit success condition. No package was uploaded. All four wheels and the sdist were retained and their SHA256 manifests checked.

Fix

Give testpypi an explicit non-cancelled status condition AND require needs.build.result to equal success. Failed/cancelled builds cannot upload, the protected testpypi reviewer gate remains intact, and production remains tag-only.

Validation

• Three workflow regression tests passed.
• Existing full primary receipt verifies under release policy on this clean descendant.
• No numerical code, policies, package contents or receipt changes.

Use a merge commit to preserve receipt ancestry. A fresh manual rehearsal after merge will validate that the human approval gate is reached; do not treat the earlier build-only run as an upload.