[echoomegaprime]

Purpose (independent CertForge release-gate review)

Stacked on draft PR #64 at exact parent e6b51c683c0027cab3ed446a26fdd614476a32c6; this is a minimal follow-up for historical-orphan recovery scope discovered in the independent #50/#49 review. It does not alter Swarm PR #16, the deployed CertForge service, production SQLite or enrolled runners.

Safety changes

• Compensation for FAILED dispatch / BOUND reservation / QUEUED run now requires exhausted attempts (d.attempts >= self.policy.max_dispatch_attempts), known pre-execution failure code (subscriber_worker_claim_denied or dispatch_attempts_exhausted), and a 24-hour stable-age cutoff.
• Explicit deterministic ordering and a 4-run maximum per recovery transaction prevent unbounded historical sweeps. Subsequent invocations reconcile the next safe batch. The prior execution/consumption/lease/owner evidence exclusions remain intact.
• Unknown failures, recent failures and non-exhausted dispatches are held without compensation for independent review.

Verification (disposable FORGE checkout; no production changes)

• Parent: e6b51c683c0027cab3ed446a26fdd614476a32c6; tested initial tree 03980ad24ebdd00985b1a60d555fdd6abf17e975; final tree 346c295485ed9b08458d25c946b6b75a2b671d95.
• 43 focused tests passed in 54.03 seconds on the final tested source across test_dispatch_orphaned_runs.py, test_subscriber_migration_rollback.py, test_dispatch_orphan_audit_redaction.py, and test_dispatch_orphan_batch_recovery.py.
• New negative regressions check non-exhausted, unknown and recently updated orphans; synthetic 5-orphan test establishes 4 then 1 bounded reconciliations without changing live data.
• Git diff whitespace check passed. Both initial GitHub published blob hashes matched the tested FORGE checkout exactly: e0839e98bdd20bb6ae80c842cad50573efe04437 and 883e20ed87d5781e158bfd317be4f735f49f724f.
• GitHub hosted exact-head CI, GHAS security, independent reviews and a CertForge certification on this new head are still required. Prior tests do not certify promotion.

Outstanding release gates

Parent PR #64 had passing hosted CI and CodeQL workflow job, but a failing GitHub Advanced Security CodeQL alert and misleading deployed Release Sentinel success. Security adjudication, deployed Sentinel fail-closed remediation, independent protected review, reconciled ancestry, authorized reversible two-phase admission and authentic enrolled-runner heartbeats are blocking. The Swarm target f65935510f35b035536e08b6ae292cd821f02327 is NOT_READY, lacking independently signed HAMMER production evidence and authentic distinct 40/40 participation.

Do not merge or deploy on this PR alone; do not manually mutate historical reservations or billing rows. Tracking: CertForge #50, #51, PR #49, PR #52, PR #64, Sentinel PR #4.

Exact-head follow-up (2026-11-13)

Initial head 3fccacd327e060388478c63214ee15691db3ca37 ran hosted CI: 736 passed / 3 failed. The failures were older audit/batch tests expecting unsafe automatic compensation of unknown failures or all five rows in a single transaction. That is an intentional policy behavior change, not evidence for weakening the guard. The tests were updated to assert unknown errors are held without compensation, no untrusted text reaches immutable audit, and cross-tenant orphan recovery is bounded 4 + 1 with exactly-once billing. Final draft head: 1d15bdf4cb5db6ec120f2b8c05928f29361d8593, final tree 346c295485ed9b08458d25c946b6b75a2b671d95, matching disposable FORGE checkout byte-for-byte. All 43 targeted regression tests passed at this final tree; the latest GitHub hosted CI and GHAS checks must be freshly evaluated on the final exact commit before review. No protected branch, live database or production service was changed.