[echoomegaprime]

Independent CertForge release-gate follow-up (source only; NO production admission)

Exact candidate head: dd54ff11f7ed5a6d6169c79170834809aefecf1f
Base integration PR: #64 at e6b51c683c0027cab3ed446a26fdd614476a32c6
Owning tracked recovery: #49 / #41 / issue #50.

Why

The historical FAILED/BOUND/QUEUED orphan sweep in PR #64 requires no active execution/ownership markers, but does not require exhausted dispatch attempts before compensating and terminalizing a run. A non-exhausted failed row can be ambiguous; it must not be automatically refunded merely because its lease fields are empty.

Least-change safeguard

• Add d.attempts >= self.policy.max_dispatch_attempts to the existing historical-orphan selection query, with a bound SQL parameter.
• Add a disposable-fixture negative regression proving a FAILED/BOUND/QUEUED row with one of three attempts remains QUEUED/BOUND, metered, unaudited as reconciled after a recovery trigger.
• Existing exhausted legacy fixture records use three of three attempts and remain eligible; production cohort of seven was verified read-only at three attempts each on 2026-11-13.
• No production database changes, arbitrary cancellations or replayable claim evidence.

NOT solved by this patch

Recognized-failure reason restriction / old-age qualification, deterministic bounded batch size / lock budget, failing GHAS CodeQL on integration PR #64, false-green deployed Release Sentinel, independent protected review, signed worker heartbeat, two-phase admission, genuine 40-model participation and signed production attestation all remain separate hard gates.

Verification pending: hosted CI/CodeQL at this exact new head; no claim of passing new tests until independently observed. FORGE disposable pytest launch was inconclusive due to an execution-tool failure and was terminated rather than falsely reported as passing. Request independent review before integrating. No production merge or deployment authorized.

[echoomegaprime]

Independent exact-head acceptance readback — 2026-11-13 ~04:00 UTC

• Head dd54ff11f7ed5a6d6169c79170834809aefecf1f, updated subscriber blob 3c4dc0f18058075f61efa1a5d451bfc4933f70d9, base release(draft): integrate deployed ancestry, guarded queue recovery and exact-head CodeQL #64 e6b51c683c0027cab3ed446a26fdd614476a32c6.
• FORGE retrieved this precise blob through authenticated GitHub, parsed it with Python AST, extracted the exact historical-orphan SELECT, opened the current production SQLite in mode=ro with PRAGMA query_only=ON, and executed the SELECT with policy parameter 3. Results: 7 matching historical rows; attempts values exclusively [3]; last_error exclusively [subscriber_worker_claim_denied]. No mutation or lease/ownership change. This is SQL shape and production-cohort acceptance, not full integration testing.
• Hosted run 43362727311 is still in progress: Actions CodeQL completed SUCCESS; GHAS CodeQL for this stacked branch reports SUCCESS; deterministic full CI still running. Independent reviews: 0.
• Do not promote: GHAS HIGH failure on parent release(draft): integrate deployed ancestry, guarded queue recovery and exact-head CodeQL #64, deployed Sentinel false-green, review, error/age scoping, deterministic batch/lock budget, authentic runner heartbeat, independent full-40/HAMMER production attestation and approved two-phase rollback window remain hard blockers. The branch was not merged, deployed or used to compensate any queue row.

[echoomegaprime]

Independent release-gate exact-head update — 2026-11-13 04:29–04:32 UTC (read-only on production).

PR #66 exact head: dd54ff11f7ed5a6d6169c79170834809aefecf1f, stacked on #64 e6b51c683c0027cab3ed446a26fdd614476a32c6. The previously pending hosted workflow #43362727311 is now COMPLETED/SUCCESS: CI job 131679793584 and Actions CodeQL 131679793846 both passed. Crucially, GitHub Advanced Security CodeQL check 131680035362 also passed on this exact head. No independent reviews/approvals, no merge, no deployed source change.

Separate fail-closed gate remains defective: exact-head CertForge check 131681027999 is neutral (not production-certified), yet deployed ECHO Release Sentinel check 131688406154 returned success on this same head. On parent PR #64, GHAS CodeQL check 131509086490 remains failed, while Sentinel returned success. Do not treat Sentinel success as independent release admission. Sentinel source fix PR #4 is still draft/unapproved and not live-verified.

Fresh FORGE production facts: current symlink resolves to deployed SHA d8ad9fd881365801354b78a758632d2a31ab6828; read-only/query-only SQLite shows 2,378 COMPLETED certifications, seven QUEUED / FAILED / BOUND historical records with exactly 3 attempts and reason subscriber_worker_claim_denied matching the amended candidate predicate, plus eight separate cancelled/bound reservations (15 total BOUND). Three ACTIVE enrolled runners globally, two in the target tenant; latest authenticated heartbeat 2026-07-26T14:05:14.630191Z and zero in the past 24 hours.

Review requests before release: _recover_expired_dispatches now gates d.attempts >= self.policy.max_dispatch_attempts, but the dispatch table does not persist a per-dispatch retry policy, and d.last_error is only classified for audit after selection (not a selection predicate). Ask reviewers to resolve threshold drift when policy changes, unknown failure-code terminalization, historical-age scoping and a bounded transaction/batch lock budget. Add negative fixture tests covering a changed retry limit and unrecognized error before accepting this stacked repair. Preserve execution evidence, run ownership and immutable billing; never cancel or compensate production records manually.

Decision: HOLD / NOT_READY. CI and GHAS passing on #66 do not grant protected review, resolve parent #64 security finding, validate Sentinel, or authorize production promotion.