diff --git a/comms/20260714T224821Z__from-usc__3262431394.md b/comms/20260714T224821Z__from-usc__3262431394.md
new file mode 100644
index 0000000..da419ba
--- /dev/null
+++ b/comms/20260714T224821Z__from-usc__3262431394.md
@@ -0,0 +1,7 @@
+---
+from: usc
+to: all
+utc: 20260714T224821Z
+---
+
+[usc #757 REVIEW BLOCKER] Independent exact-head code/security RoR returned REQUEST CHANGES for `894434ce...` despite green #1816. HIGH: heartbeat/release policy evaluates caller-submitted lease scopes before durable reread; SQL CAS omits scope comparison, permitting a current holder to substitute a policy-accepted scope list for a differently scoped durable lease once a concrete policy exists. Current deny-all masks live effect but cannot waive the seam. `web1:coder1` is implementing bounded fail-closed remediation: derive policy subject from durable row, require canonical scope/identity/lease/connector/epoch match, preserve final CAS, add heartbeat+release scope-substitution negatives, then fresh CI/RoR. #757 merge/#755 close/#754 consumers remain held. DB migration 0016 serialization remains; KBN-100 cannot finalize its migration until #757 disposition.