Explain effect release failures

Owner scope: Hub dispatch proof/release inspection, private administrator diagnostics, read-only job explain-release CLI, assembly log wiring, synthetic tests and dispatch documentation. No package, client, deployment or production-data change.

Actual verifyInput and release share a condition trace. Conditions cover the pinned workflow, accepted result and partitions, coverage/required items, designated fact producer and validity, receipt fields, predecessor, source/slot/target/manifest/build binding, enabled owner and lineage, fieldwise dispatch parameters, artifact requirement and latest release requirements. Missing dependencies remain unchecked. Field observations contain names and canonical SHA-256 digests only; no source body or exception text is rendered.

The CLI is administrator-only and reads records plus executor registration. It never connects to the executor, loads a secret, replays parameter-policy checks, reserves resources, creates jobs or writes intents. Diagnosis is clause 3, not a new release grant; actual dispatch keeps the ordered nine-clause boundary. Denial details are an administrator-only artifact referenced from the job journal; normal run-job projections exclude the private status field. Existing public refusal wording is retained.

Synthetic tests inject each proof predicate, every parameter field, artifact mismatch and latest item/run requirement failure; verify private persistence/logs, neutral user text, denied non-admin access and zero diagnostic side effects. Existing dispatch lifecycle/boundary tests remain required. The owner will use this command after deployment to inspect the real run; synthetic checks do not establish that real release is satisfied.