D-012 rev14 correction (reviewer:d012-rev13-verifier HIGH): the rev13 guard (authority exists + live ALLOCATED attempt) was satisfiable by any ordinary allocation, so a caller could allocate once and then directly reserve arbitrary global digests via register_binding — denying later legitimate consumption (replay poison) or leaving orphan reservations after pre-consumption recovery. Per the verifier's correction direction, replay-index insertion is no longer an independently callable operation: the public register_binding method is REMOVED, and the global replay check + binding insertion + CONSUMED transition are ONE atomic unit inside consume (both locks held, final-point authorization already passed). The lock-release invariant is now bidirectional by construction: every _consumed_bindings entry corresponds to an attempt durably in CONSUMED with that digest, and no public call can create one side alone. Standalone-API-absence probe added (live allocation reserves nothing; only consume creates a binding; no orphan via recovery; global replay still enforced) and mutation-checked against a restored rev13-style register_binding. 66/66 tests. master