Escape money-moves are journal-sourced (forced-freeze-cage-e2e)

2026-07-30 · plan closed (Phases 1–6, 16/16 trajectory rows) · PRs #177 #181 #183 #184 #185 #187

A lease-lost, rake-having table now self-disposes cleanly on staging: frozen → escape → custody → closed with conservation delta 0, no human in the loop — proven by a fresh live smoke (FF7T2K) and by reconciling all three stuck specimens (C2UFJ4/ZDA9W3/K9P6HN) to zero frozen tables. Every leg of the escape is journal-authoritative:

• D1 — custody entry-id allocation is chain-reconciled (ensureEntryIdFloor + submitEntryWithAllocRetry); the boot-reset counter collision class is closed.
• D2 — a frozen table's funded rows zero only with a value-bearing custody journal entry (the frozenDestructiveWriteAllowed chokepoint; refusals span participant.frozen_write_refused).
• D3 — a divergent escape moves the players' journal share (pool − unreconciled rake), never the whole vault; the rake stays collectable.
• D4 — the playSKPK v2 cutover had left the play-custody vault bound to v1 ("vaults bind one mint for life"): a fresh v2-bound custody deployment (7xBsye3q…) + the house destination's v2 ATA restored every play custody handoff (escape / idle_kick / bust / forced-withdraw).
• D4a/D4d — hold rows memorialize what landed (id + amount trued-up on re-runs), and rake "collected" means the collect landed (unlandedRakeChips in @numero/db — one boundary, read by both the escape and the custody-invariant freeze trigger; 123 dead-lettered reconciliations had been read as "collected").
• Falsification (5 fixes) — partial clean-escape re-runs are idempotent (deterministic per-(table,user) entry ids + an owner16-verified exclusion/heal pass — no double-pay, orphans heal); the frozen-write guard's predicate compares current values and requires value-bearing journal entries; a reconciled hold is superseded by its claims in both identity readers; the reconcile refuses hold_entry_mismatch instead of blind-splitting a foreign entry.
• Cleanup — the 794-line custody route composite split into escape / reconcile / claims modules; holdOwner16 centralized in the identity lib.

Unblocked: table-ownership-lease U1 (the enforcement-flip smoke completed here — the owned_elsewhere refuse-to-host guard proven live). Deferred, tracked: mainnet remediation of the same two cutover gaps (fresh mainnet custody deployment + house v2 ATA + compensating two landed claims that orphan on the flip) — rides the next release train; and EVM escape parity (EVM is off the deploy lists; the weekly-thesis-audit ✗-list carries it).

Current-state pages: escape-divergence · table-frozen-recovery (now with the D1–D4d worked example) · custody-reconcile-held-table. Full history: .indusk/planning/archive/forced-freeze-cage-e2e/.