Really good catch — you are right that a hard claimed state can turn a crash into a silently lost event. Treating claimed as a lease with claimed_at, and letting a retry take over when it is stale, is the cleaner fix. Same for failed if the run dies before it can write that status. A small scheduled sweep of claims older than the lease is a great operational safety net. I will fold that into a follow-up. Thanks for writing this up so clearly.