Take over an alarm another operator is working

Claim-lock step 3a, ONE HOLDER PER ALARM. The holder works the alarm: a close (POST /eval/operator/{id} 409 claim_held, a per-item 423 in the bulk close) and the operator-started Voice down, AI voice announcement, call to the owner, dispatch call and event-scoped Live Talk are refused 409 claim_held while ANOTHER operator holds a live claim; anyone else uses this first. Open to every central-staff operator (owners included); not a priority tier. Body {expected_holder_id, expected_claimed_at} is the claim the console showed (echo operator_id and claimed_at from it). Under the event row lock, if that is still the live claim the claim moves to the caller (200 with the new claim, consoles are nudged so the displaced holder learns at once); otherwise nothing moves: 409 claim_changed with the CURRENT claim (or null when nobody holds it now), and the console reconfirms. Never retry a claim_changed automatically. Two operators taking over at once: exactly one wins. A closed, expired or non-queued alarm is a plain 409. Taking over a claim the caller already holds is 200 and writes nothing. Take over transfers no draft: the displaced operator's notes stay on their own screen. Reserved shape (Focus, expected_focus_id with no expected_claimed_at): a live claim appearing meanwhile is 409 claim_changed with that claim, a reservation that is gone or changed is 409 claim_changed with claim null (and the current reservation, if any), and Focus being off is 404 (after the scope and staff checks below); a body that names neither expected_claimed_at nor expected_focus_id is 422 (as is any schema-invalid body), except that with Focus on an alarm reserved for another operator's focus with no live claim answers 409 claim_changed with the current reservation. Requires claim participation (review_label_alarms, or, for central staff, any of escalate_voice_down, escalate_dispatch, notify_property_owner: whoever the claim refusal can refuse) and tenant scope (out of scope is 403, unknown or malformed id is 404); non-staff callers get 403. 404 while CLAIM_REFUSAL_ENABLED is off (or the api predates this): read claim_refusal_enabled on GET /auth/me first.