[echoomegaprime]

Independent release-gate safety follow-up (draft)

Stacked on #62 (exact parent 9417dc5a06159291384d11f569a2ffdb5b15c108) and #61. This is a narrowly scoped custody fix, not an authorization to deploy or recover production queue records.

When an expired CLAIMED dispatch has contradictory worker-execution or consumption evidence, its mutable claim token, dispatcher owner and lease expiry are cleared to prevent replay. This change records the prior lease owner, expiry and SHA-256 digest only of the high-entropy claim token in the existing append-only, tenant-chained audit event. It does not store the replayable token or change state machine, accounting, permissions, or live services.

Independent tests

• On FORGE isolated exact-parent checkout, focused tests/test_dispatch_orphaned_runs.py: 32 passed in 32.83 s.
• python3 -m compileall and git diff --check passed.
• Tested file blobs match this PR exactly: subscriber a6f0de931b81b1714d161bede82c2bea0eb127bd, tests 388687ab93b1cc2a707543954d34ff4db11c3c45.
• Includes negative conflict case: preserves reservation/meter, terminal dispatch marked FAILED, clears replayable claim, verifies immutable audit chain and non-secret prior-claim correlation. Includes positive unstarted final-attempt control.

Required release gates

Independent review, exact-head hosted CI and CodeQL, production SHA reconciliation (#60), formal two-phase policy decision (#52), genuine signed-runner capacity, evidence custody and exact-target cert. Never treat 2/40 as full-40. No production promotion, restart, manual SQLite update or signer operation is authorized here.

See #49, #50, #51 and Swarm #16 for separately owned release gating.

[echoomegaprime]

Exact-head hosted closure (2026-11-12 ~19:40 UTC): Actions run #43291530983 completed SUCCESS at a0515d875c2a384965229eb5716331a776ab8190. Both jobs passed: CodeQL #131438729744 and full deterministic CI #131438730356 (including P1/P6/P7). The branch contains only two changed files against #62; GitHub readback of both content blobs matches the 32/32 independently tested FORGE checkout. No independent approvals, deployment/release certification or HAMMER production attestation; remains DRAFT/NOT_READY. Disposable local checkout was removed after readback; production services and SQLite were not modified.

[echoomegaprime]

Correction to prior #63 hosted-closure note: at exact a0515d875c2a384965229eb5716331a776ab8190, GitHub Actions CI and CodeQL workflow jobs passed, but the separate GitHub Advanced Security CodeQL check FAILED with one high alert. ECHO Release Sentinel nevertheless reported SUCCESS at that head. Please do not interpret earlier “CodeQL passed” as successful independent security analysis or authorization to release.

Current integrated candidate is draft CertForge #64 at e6b51c683c0027cab3ed446a26fdd614476a32c6, still GHAS-FAILED. Independent source-only fail-closed Sentinel correction is draft Sentinel #4 at 633e2fba35288d2f55158ed5dfeb82354ec0ef77. Independent security review, exact-head approvals, production evidence and signed-runner recovery remain required. No production operations performed.