[ancongui]

A current native factory administrator can reserve one final fifth Codex or Claude dispatch after a known, drained fourth-attempt process failure. Reservation spends the allowance immediately and seals it with the linked admission and implementation intent in one WAL transaction. Current source, executable and operator authority remain required; there is no sixth dispatch. Legacy recovery and worker-feedback contracts retain their four-attempt limit, with a separate allowance-bound feedback variant for attempt five.

Studio guides review of the failed attempt, mitigation and final confirmation. It retains the original request before its single POST and supports exact readback after an uncertain response or lost browser storage. The SDK exposes separate candidate, reservation and receipt methods.

Owned source-control writes now preserve their ownership requirement across token preparation and the final authority callback, then revalidate the native PostgreSQL fence before the POST. Releasing the lease, losing its connection or draining the owner stops the write, including when the Engine poller has stopped. Existing unowned manual writes keep their authorization path. PostgreSQL checks and remote provider writes remain separate boundaries.

Validation for 66366f11f96745809933002c6ecfcb62707dc7b5:

• Full public CI passes: 3,675 Python tests, 51 skips and four warnings; 531 Studio unit tests across 64 files; 695 Studio browser tests; 94 documentation browser tests. Container, documentation build and aggregate checks pass.
• Focused local qualification passed 146 host tests and 13 consolidated native PostgreSQL tests. Earlier 33 recovery/worker tests and nine lease-race tests remain separate recorded runs.
• Ruff and formatting pass across 544 files; mypy passes across 222 source modules. The readback browser tests require the unrelated global alert to remain visible while checking the exact reservation-panel denial text.
• All 60 canonical capture producers passed, with 464 current, explicitly labeled fixture captures. Fresh strict documentation and local-link checks pass for 61 pages and 7,780 URLs.
• The exact CI distribution artifact passes source, metadata, optional analytics dependencies, RECORD, licenses and Studio payload checks: 537 wheel entries and 1,911 source-distribution entries. Its downloaded digest matches GitHub metadata.
• The CI wheel is byte-identical to the freshly qualified isolated installation. Base SDK, CLI version, Studio, font and analytics checks pass with the qualified dependency versions; all 222 installed Python modules match the production source.

The administrator's mitigation attestation does not establish that the mitigation fixed the failure or that the generated product passed QA. Live provider recovery and generated-product acceptance require separate execution evidence. Release publication remains pending.