[DanielNetzer]

Implements issue #264.

Molecule: mol-264-06efb917549ed956d0e6308b
Formula: forgecell-github-issue
Base: 6bd19d73efc11cac4400d97256a320aecaacae0b
Delivery: b44e5c2e7b6177df4dedcc7bec936e6d57c431c8

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Adversarial review: remaining LOW findings (not fixed in this slice)

1. The persistence flag can read true by mistake. When a ledger write fails only inside the concurrent protected view, RequiredChecksPassed can still read true while Protected == nil. Delivery still refuses, so this fails safe. Attach the preserved result and clear the flag.
2. The candidate stream excerpt is misleading. A truncated candidate -json stream with declared deltas keeps a raw 256 KB prefix as its excerpt, so the real tail is lost. Summarise it with the parser, as the protected view does.
3. The slot queue isn't first come, first served. It polls every 2 s with no ordering, and "position N of M" is only a snapshot.
4. Mixed binaries can overlap: an old binary on the single lock file plus a new binary with 2 slots can verify at the same time. Document this.
5. Resource admission is a point-in-time sample. Two Molecules can both pass the memory check at the same moment; the Monitor hard floor still catches real exhaustion.

No HIGH findings. Fixed in this slice:

• declaring expected failures works when a covered check exists;
• the watchdog never kills a quiet but working check;
• covered-by never applies across nested Go modules;
• pruning never removes the live per-view GOTMPDIR.