LeaseLedger v0.1.2 — claim progress and deterministic fault-injection

Reproduced correctness bug

The previous claim path processed up to 100 expired, exhausted leases, then incorrectly returned None even with a lower-priority ready job. Workers configured to stop when empty could exit despite runnable work.

Fix

Commit expired-lease dead-letter cleanup in bounded 100-row write transactions, continuing selection until work is found or the queue is actually empty.

Verified evidence

• Regression creates 121 high-priority expired terminal leases and a ready lower-priority job, proving the old implementation fails and the new one succeeds.
• Independent seeded reference state machine exercises 4 × 160 deterministic operations: enqueue, claim, expiry, stale fencing, retry, heartbeat, manual dead-letter requeue, and event history.
• 32 automated tests pass, plus Ruff lint/format and reproducible benchmark smoke.
• CI verified on Python 3.11, 3.12 and 3.13.

Read docs/notes/expired-lease-cleanup-progress.md for failure analysis and limitations.

Explicit limits

This remains an at-least-once, single-host SQLite queue; there is no exactly-once external guarantee, formal model-checking proof, cloud replication or production throughput promise.