[NeilJo-GY]

Participants could withdraw after submitting work, reopening a funded seat while Labs still counted the delivery as an outstanding obligation. A replacement could consume the same funded share. Review also found the reverse race: an unconditional late submission could overwrite an already-cancelled participation.

Restrict withdrawals to active/applied records without a submission. Both submission saves and cancellations now compare the observed state atomically. PostgreSQL uses a row lock and Redis uses Lua; losing either race returns HTTP 409 instead of reviving or cancelling delivered work. Existing callers of save_participation retain the default unconditional behavior; the task submit path opts into the conditional save.

Validation:

• 41 targeted tests passed, including 3 real PostgreSQL tests with private schemas and 2 real Redis Lua tests using isolated keys.
• PostgreSQL tests hold a transaction open to prove that the opposing update waits for the row lock, then rejects the stale state in both orders.
• Ruff passed and mypy passed across all 157 source files.
• Follow-up CI run 40672240590 passed for Python 3.11/3.12, lint/type checks, SDK/CLI and Docker Build. CI logs confirm all five new real PostgreSQL/Redis tests executed and passed in the core Python job.

This prevents new invalid withdrawals and stale submissions. Existing cancelled delivery records need a separate read-only audit before any cleanup. No production data migration is included.