[DanielNetzer]

Implements issue #232.

Molecule: mol-232-d42f4f580ca2b98e13a9e2ea
Formula: forgecell-github-issue
Base: adac1501b54132bd42b373fe568612e230fa024c
Delivery: 51b4fcde2d463d74a6244a3b0f74231434ff243d

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Delivered through Forgecell end to end: Molecule mol-232-d42f4f580ca2b98e13a9e2ea, preview digest dbc792a9 bound to tree 84feaf1. Every required check passed on the candidate tree and the protected regression.

Review: one adversarial pass, then a verification pass. Fixed in the slice through a reviewed amend (plan revision 3):

• MEDIUM: the slot was held through the adversarial review harness. It's now released (sync.OnceFunc) right after the checks are recorded and before runReviewAtom, with the defer kept as a backstop. TestVerificationSlotFreeDuringReview proves a second Molecule gets the slot while the first is still in review.
• The queued reason now keeps activeReason's forgecell recover hint, so a queued ledger whose process died isn't reported only as "waiting for the slot".

Verified sound in review:

• Descriptors: the slot reuses flockLedgerFile unchanged (O_CLOEXEC, O_NOFOLLOW, under ForkLock, explicit LOCK_UN), so a check's child process can't keep the slot.
• Lab isolation: one constant lock file per Lab, so different Labs are independent.
• Queue time: the slot is acquired before the check monitor context, so waiting never eats timeoutMs.
• Cancel while queued: the Molecule ends interrupted and amendable, with no checks run.
• Ledgers: the new events keep the check-pending phase, and older readers ignore them.
• Tests: the only sleep is in a helper subprocess that the test kills.

The new behaviour takes effect after the Lab is rebound to a build that includes this PR.

🤖 Generated with Claude Code