exec(unified): drive loop §7 — PINK _handle_expired_working ported + audit build items

drive_loop.py transcribes pink_direct.py:1089 (the 10-step expiry sequence) warts-and-all
against injected ports (ExecPort seam: clock+kernel+venue), so no ambient state (C1). Carries
the scar tissue: pump-before-cancel, re-classify-after-cancel (fill races cancel), EXIT never
strands→MARKET, slot-busy double-entry guard, fail-safe venue-truth requote gate. SEAM
learnings preserved as referenced comments (zero-silent-suppression rule). Decimal sizes (H1).

- working.py: WorkingRegistry + WorkingOrder, injected clock, rejected→expire_now (one shared
  path). contract.py: client_order_id_core(attempt) — unique per attempt (audit H4/FIX).
- _constants.py: REQUOTE_HOT_WINDOW_S=5.0 (prov: 2026-06-10 double-entry).
- inventory §6: audit build items BI-1..5 folded in.
- test_drive_loop.py: 15 scar-tissue tests. Mutation-verified RED under exit-no-escalate
  (kills 3) and no-hot-window (kills double-entry guard). Full exec_unified suite: 77 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

prod/exec_unified/contract.py

@@ -129,10 +129,17 @@ class ExecutionRequest:
         if self.reduce_only and self.urgency is UrgencyClass.ACQUIRE:
             raise ValueError("ACQUIRE (entry) cannot be reduce_only")
 
-    @property
-    def client_order_id_seed(self) -> str:
-        """Deterministic seed for the venue clientOrderId (promise #4: never lose an order).
+    def client_order_id_core(self, attempt: int = 0) -> str:
+        """Venue-clientOrderId core, UNIQUE PER ATTEMPT (audit H4 / FIX ClOrdID law).
 
-        Prefix discipline lives in the dialect layer (u-/m-); this is the stable core.
+        A retry after an INDETERMINATE submit MUST carry a *fresh* venue id — exchanges
+        reject a duplicate clientOrderId (idempotency-key rule) — while staying linkable to
+        the parent request (FIX ``OrigClOrdID``). The attempt counter provides exactly that:
+        attempt 0 is the original, 1+ are retries; the parent is recoverable by stripping
+        the trailing ``-<n>``. The dialect layer (§11) prepends the venue prefix (``u-``/
+        ``m-``) and enforces the venue's charset + length cap (BingX caps clientOrderId
+        length) — that layer owns venue legality, this owns per-attempt uniqueness.
         """
-        return self.request_id
+        if attempt < 0:
+            raise ValueError(f"attempt cannot be negative, got {attempt}")
+        return f"{self.request_id}-{attempt}"