Start with the run. Then inspect every claim.

One PostgreSQL DROP COLUMN committed exactly once. The replacement Spark workload kept the same 128-row output digest, and replay was refused.

Fresh DataHub evidence discovered a late Spark consumer. The lease became INVALIDATED, zero destructive statements committed, and the legacy column remained present.

The point-in-time approval stayed green, the column was dropped, and the legacy Spark workload failed with SQLSTATE 42703.

The reviewable one-file patch that moves the authorized consumer from legacy_status to order_status.

The accepted target, source version, plan binding, and dbt parse, seed, build, and test result.

A public-safe stage-by-stage record of the Codex run, including the external authorization pause and the later reversal.

The exact generated dbt change as a reviewable GitHub pull request with the semantic-dbt check attached to its head commit.

Repository inspection found one consumer. Fully paged DataHub lineage returned 31 across seven pages—a minimum expansion of 30 consumers.

The digest-bound run joining Codex, DataHub discovery, one exact PR, native validation, publication read-back, lease issuance, and late-consumer invalidation.

Our upstream DataHub MCP contribution fixes a GraphQL pagination boundary that could silently hide later consumers.

A second upstream contribution corrects diagnostics that could misstate the DataHub MCP deployment gate.

Twenty-four frozen cases: 4 READY, 6 BLOCKED, 10 UNSAFE, and 4 REVIEW. All matched, with zero false readiness and zero unexpected closure.

Two clean Spark/JDBC sequences prove the consequence of deleting too early: legacy_status disappears and the workload exits 42 with SQLSTATE 42703.

Across 135 attempts, DataHub context improved fault coverage but nested Gemini failed the value threshold. We removed the extra model layer.

The project skill and MCP improved completion and reduced calls and retries. Shell exposure remained, so capability containment is explicitly unclaimed.

The honest counterfactual: competent fresh CI matched the frozen safety properties. Retirement Conductor's narrower value is the joined workflow and durable authority protocol.