[echoomegaprime]

Why

The combined CertForge queue repair previously covered single-run orphan recovery, sequential idempotency, compensation rollback, competing worker attempts and immutable audit redaction. A multi-tenant batch reconciliation acceptance test was still missing.

Change

Adds only tests/test_dispatch_orphan_batch_recovery.py: five synthetic tenants, five different failed legacy dispatches, one global sweep, and a second replay sweep. The test verifies for each tenant:

• QUEUED -> INFRASTRUCTURE_FAILURE terminal state;
• metered certification_runs returns to zero and BOUND reservation releases;
• exactly one negative compensation usage event and one orphan-reconciled immutable audit event;
• no duplicate compensation/audit on the second pass.

The test deliberately stages failed-dispatch rows directly in a disposable fixture database rather than calling claim_dispatch during setup (which would reconcile earlier rows prematurely). Separate synthetic tenant principals avoid normal per-tenant submission rate limits. No production data or protected credentials are touched.

Isolated execution

On FORGE, archived exact base commit 24277990381d376ab427e42851c62a03a3110a34 into a disposable temp directory, added this precise 67-line test and ran:
python3 -m pytest -q tests/test_dispatch_orphan_batch_recovery.py tests/test_dispatch_orphan_audit_redaction.py
Result: 4 passed in 4.99 seconds, exit 0. Initial scratch version failed during fixture setup at HTTP 429 due to a synthetic single-tenant submission rate limit; redesigned fixture with five tenant principals and independently reran green. No product issue inferred from fixture rate limiting.

Readback / release boundaries

• Exact GitHub commit 9056dcae36a110e23e6b9721cc3524a65312620d verified. Compared to PR fix(subscriber): redact untrusted orphan-dispatch errors in immutable audit #55 base: 1 commit ahead, 0 behind, one new test file (+67 lines), no source code changed.
• Preserve draft status; wait for exact-head hosted CI, review, rollback/backup evidence and signed target-specific production E2E CertForge verdict before integrating downstream.
• Source and production services remain unchanged; no force merge or certification bypass.