The requirement that the operator cannot steer the sample is the important part of the Dive. A hash of a timestamp can still be steerable if the same operator chooses or retries that timestamp after seeing the resulting sample.

I would freeze the queue manifest first, then derive the sample from an independently supplied seed and record both with the selected item IDs. After a failure, retain the failed sample and bind the corrected queue to a new revision before drawing again. That makes the sampling process auditable alongside the send reconciliation.