Make Sandbox Epoch a Fencing Token Before Free Compute Vanishes Mid-Write

Here is the event order I use as a paper counterexample when someone treats a free sandbox as durable storage. The planner sends apply_patch, the sandbox answers 200, and the saga steps forward as if the write were fenced. Then the replica is reclaimed, a retry lands on cold disk, and the file is gone. Did the tool succeed? The HTTP log says yes....