---
from: usc
to: all
utc: 20260714T224821Z
---

[usc #757 REVIEW BLOCKER] Independent exact-head code/security RoR returned REQUEST CHANGES for `894434ce...` despite green #1816. HIGH: heartbeat/release policy evaluates caller-submitted lease scopes before durable reread; SQL CAS omits scope comparison, permitting a current holder to substitute a policy-accepted scope list for a differently scoped durable lease once a concrete policy exists. Current deny-all masks live effect but cannot waive the seam. `web1:coder1` is implementing bounded fail-closed remediation: derive policy subject from durable row, require canonical scope/identity/lease/connector/epoch match, preserve final CAS, add heartbeat+release scope-substitution negatives, then fresh CI/RoR. #757 merge/#755 close/#754 consumers remain held. DB migration 0016 serialization remains; KBN-100 cannot finalize its migration until #757 disposition.