{"entries":[{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T09:54:11.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T09:54:11.000000-07:00"},"hash":"0fe7a6765833acf2ab4bfe0e395967eb7c1a5557","message":"Phase 7: multi-operator hardening (#15)\n\n* Phase 7: multi-operator hardening\n\nOpen (unassigned) requests become real, which makes claims and leases real, and\ngives every convergence guarantee the index has been asserting since Phase 1 a\nsecond observer that can disagree with it.\n\ncore — the index is sacred:\n- Datetime comparison is instant-based, not lexical. RFC-3339 allows optional\n fractional seconds, so one instant has several legal spellings and\n \"…:01.000Z\" sorted before \"…:01Z\". Every record this repo writes carries\n milliseconds, so nothing diverged in practice — but a second operator writing\n second-precision timestamps would have split the claim tie-break, the one rule\n the design promises is deterministic. compareInstant now backs the fold's\n ordering, the lease-expiry test, the timeline and the turn bundle.\n- indexDigest: a canonical, order-independent fingerprint of what the fold\n decided, with per-section digests so a mismatch names the sync gap. Pure JS\n (128-bit FNV-1a) so the browser computes the same number.\n- The golden scenario grows four competing claims on one open request — a\n cross-precision tie, a twice-renewed lease, a removed member's earlier claim,\n and a lapsed one — so all 200 arrival permutations cover the tie-break.\n\ndaemon — claim, confirm, then work:\n- ClaimLedger (its own SQLite file) and ClaimManager, shaped like auto-review: a\n pure selection function plus a fire-and-forget pump. A claim is written at a\n deterministic rkey, confirmed only after a full ingestion cycle shows it\n winning, renewed by moving expiresAt and nothing else, and settled or lost.\n- The dispatch gate for unassigned requests is now the fold's winningClaims plus\n this daemon's own confirmation; the \"lowest capable DID\" branch, which made two\n daemons both dispatch, is gone. Assigned requests are untouched and gain no\n latency, asserted in dispatch.test.mjs.\n- TurnDispatcher.abandon kills the container of a claim lost mid-turn, once.\n- run.claims timing block, validated at parse time and against --interval at\n startup; radiald claim reset; radiald index --digest.\n\ningest — Jetstream, opt-in:\n- Dependency-free client over the platform WebSocket, isomorphic, with cursor\n replay, jittered reconnect, degraded mode, and a DID-filter refresh. Polling\n stays the authority and the backfill; deletes are counted and never applied;\n the stream's true commit rev improves provenance through the existing\n keep-the-earliest-revision rule.\n\nDrills and release:\n- packages/daemon/test/multi-operator.test.mjs runs the design §12 drills on two\n independently-configured daemon stacks over one fake network, offline and on a\n fake clock: crash mid-turn, competing claims (with the one-ingestion-cycle\n bound asserted numerically), non-member injection, removed-member-mid-claim,\n and divergence detection.\n- docs/operators.md, CHANGELOG.md, a release procedure, version 0.1.0 across the\n workspace, and @radial/lexicons made publishable as the wire contract.\n\nStill outstanding: the claim timings are tuned against the drills' fake clock,\nnot yet against two live PDSes (docs/operators.md §6 records the procedure).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Phase 7 review fixes: space-scoped claims, code-point ordering, socket leak\n\nAddresses the four findings on the Phase 7 implementation review.\n\n- Claim rows now carry the space they were claimed in. `ClaimManager.pump`\n runs once per space over one daemon-wide ledger, so its reconcile loop was\n judging every row against every index: a row from space B failed the\n open-request check during space A's pump and was settled, then churned\n between `claiming` and `confirming` forever without reaching `held`, so\n neither space ever dispatched an open request. `claims_ledger` gains\n `space_uri` (migrated in place; a row that predates it is adopted by the\n space whose index knows its request), the reconcile loop filters on it, and\n `maxOutstanding` is counted per space to match the confirm-cycle clock.\n Covered by a two-space drill and a ledger unit test.\n- `JetstreamSubscription.#connect()` now disarms the pending reconnect and\n closes the socket it replaces, so a membership change inside a backoff window\n can no longer leave a live socket that every listener ignores and `stop()`\n cannot reach.\n- New `compareCodePoints` in `@radial/core`: `localeCompare` is ICU\n collation, not the byte order \"lowest record URI\" implies. It now backs the\n claim tie-break's second comparator, every uri/cid/did/rev comparator in the\n fold, the canonical JSON that decides whether a rewrite is an edit, and the\n daemon's deterministic selections. `compareInstant` moves beside it in a\n new leaf module, `core/src/order.ts`.\n- Docs: the tie-break rule is spelled out as instant-then-code-point in\n design §6 and `docs/operators.md`; per-space claim counting is documented;\n CHANGELOG records all three fixes.\n\nChecks: pnpm codegen (clean), typecheck, lint, test (684 node:test + 289\nvitest, 0 failures), build.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"69fa8f1887e06fc03fbad9b189398cbeb6ad9585"},"mode":"0100644","name":"index.ts","size":113},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"},"mode":"0100644","name":"jetstream.ts","size":15161},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-19T10:22:31.000000-07:00"},"committer":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-19T10:22:31.000000-07:00"},"hash":"085379bfb81bb80c01eb08416a9e182319967d0c","message":"drop pds\n","tree":"c8299b7db760cf0e4e7b6250943bd464d42d1714"},"mode":"0100644","name":"node-shims.d.ts","size":1455},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T09:54:11.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T09:54:11.000000-07:00"},"hash":"0fe7a6765833acf2ab4bfe0e395967eb7c1a5557","message":"Phase 7: multi-operator hardening (#15)\n\n* Phase 7: multi-operator hardening\n\nOpen (unassigned) requests become real, which makes claims and leases real, and\ngives every convergence guarantee the index has been asserting since Phase 1 a\nsecond observer that can disagree with it.\n\ncore — the index is sacred:\n- Datetime comparison is instant-based, not lexical. RFC-3339 allows optional\n fractional seconds, so one instant has several legal spellings and\n \"…:01.000Z\" sorted before \"…:01Z\". Every record this repo writes carries\n milliseconds, so nothing diverged in practice — but a second operator writing\n second-precision timestamps would have split the claim tie-break, the one rule\n the design promises is deterministic. compareInstant now backs the fold's\n ordering, the lease-expiry test, the timeline and the turn bundle.\n- indexDigest: a canonical, order-independent fingerprint of what the fold\n decided, with per-section digests so a mismatch names the sync gap. Pure JS\n (128-bit FNV-1a) so the browser computes the same number.\n- The golden scenario grows four competing claims on one open request — a\n cross-precision tie, a twice-renewed lease, a removed member's earlier claim,\n and a lapsed one — so all 200 arrival permutations cover the tie-break.\n\ndaemon — claim, confirm, then work:\n- ClaimLedger (its own SQLite file) and ClaimManager, shaped like auto-review: a\n pure selection function plus a fire-and-forget pump. A claim is written at a\n deterministic rkey, confirmed only after a full ingestion cycle shows it\n winning, renewed by moving expiresAt and nothing else, and settled or lost.\n- The dispatch gate for unassigned requests is now the fold's winningClaims plus\n this daemon's own confirmation; the \"lowest capable DID\" branch, which made two\n daemons both dispatch, is gone. Assigned requests are untouched and gain no\n latency, asserted in dispatch.test.mjs.\n- TurnDispatcher.abandon kills the container of a claim lost mid-turn, once.\n- run.claims timing block, validated at parse time and against --interval at\n startup; radiald claim reset; radiald index --digest.\n\ningest — Jetstream, opt-in:\n- Dependency-free client over the platform WebSocket, isomorphic, with cursor\n replay, jittered reconnect, degraded mode, and a DID-filter refresh. Polling\n stays the authority and the backfill; deletes are counted and never applied;\n the stream's true commit rev improves provenance through the existing\n keep-the-earliest-revision rule.\n\nDrills and release:\n- packages/daemon/test/multi-operator.test.mjs runs the design §12 drills on two\n independently-configured daemon stacks over one fake network, offline and on a\n fake clock: crash mid-turn, competing claims (with the one-ingestion-cycle\n bound asserted numerically), non-member injection, removed-member-mid-claim,\n and divergence detection.\n- docs/operators.md, CHANGELOG.md, a release procedure, version 0.1.0 across the\n workspace, and @radial/lexicons made publishable as the wire contract.\n\nStill outstanding: the claim timings are tuned against the drills' fake clock,\nnot yet against two live PDSes (docs/operators.md §6 records the procedure).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Phase 7 review fixes: space-scoped claims, code-point ordering, socket leak\n\nAddresses the four findings on the Phase 7 implementation review.\n\n- Claim rows now carry the space they were claimed in. `ClaimManager.pump`\n runs once per space over one daemon-wide ledger, so its reconcile loop was\n judging every row against every index: a row from space B failed the\n open-request check during space A's pump and was settled, then churned\n between `claiming` and `confirming` forever without reaching `held`, so\n neither space ever dispatched an open request. `claims_ledger` gains\n `space_uri` (migrated in place; a row that predates it is adopted by the\n space whose index knows its request), the reconcile loop filters on it, and\n `maxOutstanding` is counted per space to match the confirm-cycle clock.\n Covered by a two-space drill and a ledger unit test.\n- `JetstreamSubscription.#connect()` now disarms the pending reconnect and\n closes the socket it replaces, so a membership change inside a backoff window\n can no longer leave a live socket that every listener ignores and `stop()`\n cannot reach.\n- New `compareCodePoints` in `@radial/core`: `localeCompare` is ICU\n collation, not the byte order \"lowest record URI\" implies. It now backs the\n claim tie-break's second comparator, every uri/cid/did/rev comparator in the\n fold, the canonical JSON that decides whether a rewrite is an edit, and the\n daemon's deterministic selections. `compareInstant` moves beside it in a\n new leaf module, `core/src/order.ts`.\n- Docs: the tie-break rule is spelled out as instant-then-code-point in\n design §6 and `docs/operators.md`; per-space claim counting is documented;\n CHANGELOG records all three fixes.\n\nChecks: pnpm codegen (clean), typecheck, lint, test (684 node:test + 289\nvitest, 0 failures), build.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"69fa8f1887e06fc03fbad9b189398cbeb6ad9585"},"mode":"0100644","name":"node.ts","size":3526},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"},"mode":"0100644","name":"poller.ts","size":5347},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T09:54:11.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T09:54:11.000000-07:00"},"hash":"0fe7a6765833acf2ab4bfe0e395967eb7c1a5557","message":"Phase 7: multi-operator hardening (#15)\n\n* Phase 7: multi-operator hardening\n\nOpen (unassigned) requests become real, which makes claims and leases real, and\ngives every convergence guarantee the index has been asserting since Phase 1 a\nsecond observer that can disagree with it.\n\ncore — the index is sacred:\n- Datetime comparison is instant-based, not lexical. RFC-3339 allows optional\n fractional seconds, so one instant has several legal spellings and\n \"…:01.000Z\" sorted before \"…:01Z\". Every record this repo writes carries\n milliseconds, so nothing diverged in practice — but a second operator writing\n second-precision timestamps would have split the claim tie-break, the one rule\n the design promises is deterministic. compareInstant now backs the fold's\n ordering, the lease-expiry test, the timeline and the turn bundle.\n- indexDigest: a canonical, order-independent fingerprint of what the fold\n decided, with per-section digests so a mismatch names the sync gap. Pure JS\n (128-bit FNV-1a) so the browser computes the same number.\n- The golden scenario grows four competing claims on one open request — a\n cross-precision tie, a twice-renewed lease, a removed member's earlier claim,\n and a lapsed one — so all 200 arrival permutations cover the tie-break.\n\ndaemon — claim, confirm, then work:\n- ClaimLedger (its own SQLite file) and ClaimManager, shaped like auto-review: a\n pure selection function plus a fire-and-forget pump. A claim is written at a\n deterministic rkey, confirmed only after a full ingestion cycle shows it\n winning, renewed by moving expiresAt and nothing else, and settled or lost.\n- The dispatch gate for unassigned requests is now the fold's winningClaims plus\n this daemon's own confirmation; the \"lowest capable DID\" branch, which made two\n daemons both dispatch, is gone. Assigned requests are untouched and gain no\n latency, asserted in dispatch.test.mjs.\n- TurnDispatcher.abandon kills the container of a claim lost mid-turn, once.\n- run.claims timing block, validated at parse time and against --interval at\n startup; radiald claim reset; radiald index --digest.\n\ningest — Jetstream, opt-in:\n- Dependency-free client over the platform WebSocket, isomorphic, with cursor\n replay, jittered reconnect, degraded mode, and a DID-filter refresh. Polling\n stays the authority and the backfill; deletes are counted and never applied;\n the stream's true commit rev improves provenance through the existing\n keep-the-earliest-revision rule.\n\nDrills and release:\n- packages/daemon/test/multi-operator.test.mjs runs the design §12 drills on two\n independently-configured daemon stacks over one fake network, offline and on a\n fake clock: crash mid-turn, competing claims (with the one-ingestion-cycle\n bound asserted numerically), non-member injection, removed-member-mid-claim,\n and divergence detection.\n- docs/operators.md, CHANGELOG.md, a release procedure, version 0.1.0 across the\n workspace, and @radial/lexicons made publishable as the wire contract.\n\nStill outstanding: the claim timings are tuned against the drills' fake clock,\nnot yet against two live PDSes (docs/operators.md §6 records the procedure).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Phase 7 review fixes: space-scoped claims, code-point ordering, socket leak\n\nAddresses the four findings on the Phase 7 implementation review.\n\n- Claim rows now carry the space they were claimed in. `ClaimManager.pump`\n runs once per space over one daemon-wide ledger, so its reconcile loop was\n judging every row against every index: a row from space B failed the\n open-request check during space A's pump and was settled, then churned\n between `claiming` and `confirming` forever without reaching `held`, so\n neither space ever dispatched an open request. `claims_ledger` gains\n `space_uri` (migrated in place; a row that predates it is adopted by the\n space whose index knows its request), the reconcile loop filters on it, and\n `maxOutstanding` is counted per space to match the confirm-cycle clock.\n Covered by a two-space drill and a ledger unit test.\n- `JetstreamSubscription.#connect()` now disarms the pending reconnect and\n closes the socket it replaces, so a membership change inside a backoff window\n can no longer leave a live socket that every listener ignores and `stop()`\n cannot reach.\n- New `compareCodePoints` in `@radial/core`: `localeCompare` is ICU\n collation, not the byte order \"lowest record URI\" implies. It now backs the\n claim tie-break's second comparator, every uri/cid/did/rev comparator in the\n fold, the canonical JSON that decides whether a rewrite is an edit, and the\n daemon's deterministic selections. `compareInstant` moves beside it in a\n new leaf module, `core/src/order.ts`.\n- Docs: the tie-break rule is spelled out as instant-then-code-point in\n design §6 and `docs/operators.md`; per-space claim counting is documented;\n CHANGELOG records all three fixes.\n\nChecks: pnpm codegen (clean), typecheck, lint, test (684 node:test + 289\nvitest, 0 failures), build.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"69fa8f1887e06fc03fbad9b189398cbeb6ad9585"},"mode":"0100644","name":"space.ts","size":1956},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T09:54:11.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T09:54:11.000000-07:00"},"hash":"0fe7a6765833acf2ab4bfe0e395967eb7c1a5557","message":"Phase 7: multi-operator hardening (#15)\n\n* Phase 7: multi-operator hardening\n\nOpen (unassigned) requests become real, which makes claims and leases real, and\ngives every convergence guarantee the index has been asserting since Phase 1 a\nsecond observer that can disagree with it.\n\ncore — the index is sacred:\n- Datetime comparison is instant-based, not lexical. RFC-3339 allows optional\n fractional seconds, so one instant has several legal spellings and\n \"…:01.000Z\" sorted before \"…:01Z\". Every record this repo writes carries\n milliseconds, so nothing diverged in practice — but a second operator writing\n second-precision timestamps would have split the claim tie-break, the one rule\n the design promises is deterministic. compareInstant now backs the fold's\n ordering, the lease-expiry test, the timeline and the turn bundle.\n- indexDigest: a canonical, order-independent fingerprint of what the fold\n decided, with per-section digests so a mismatch names the sync gap. Pure JS\n (128-bit FNV-1a) so the browser computes the same number.\n- The golden scenario grows four competing claims on one open request — a\n cross-precision tie, a twice-renewed lease, a removed member's earlier claim,\n and a lapsed one — so all 200 arrival permutations cover the tie-break.\n\ndaemon — claim, confirm, then work:\n- ClaimLedger (its own SQLite file) and ClaimManager, shaped like auto-review: a\n pure selection function plus a fire-and-forget pump. A claim is written at a\n deterministic rkey, confirmed only after a full ingestion cycle shows it\n winning, renewed by moving expiresAt and nothing else, and settled or lost.\n- The dispatch gate for unassigned requests is now the fold's winningClaims plus\n this daemon's own confirmation; the \"lowest capable DID\" branch, which made two\n daemons both dispatch, is gone. Assigned requests are untouched and gain no\n latency, asserted in dispatch.test.mjs.\n- TurnDispatcher.abandon kills the container of a claim lost mid-turn, once.\n- run.claims timing block, validated at parse time and against --interval at\n startup; radiald claim reset; radiald index --digest.\n\ningest — Jetstream, opt-in:\n- Dependency-free client over the platform WebSocket, isomorphic, with cursor\n replay, jittered reconnect, degraded mode, and a DID-filter refresh. Polling\n stays the authority and the backfill; deletes are counted and never applied;\n the stream's true commit rev improves provenance through the existing\n keep-the-earliest-revision rule.\n\nDrills and release:\n- packages/daemon/test/multi-operator.test.mjs runs the design §12 drills on two\n independently-configured daemon stacks over one fake network, offline and on a\n fake clock: crash mid-turn, competing claims (with the one-ingestion-cycle\n bound asserted numerically), non-member injection, removed-member-mid-claim,\n and divergence detection.\n- docs/operators.md, CHANGELOG.md, a release procedure, version 0.1.0 across the\n workspace, and @radial/lexicons made publishable as the wire contract.\n\nStill outstanding: the claim timings are tuned against the drills' fake clock,\nnot yet against two live PDSes (docs/operators.md §6 records the procedure).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Phase 7 review fixes: space-scoped claims, code-point ordering, socket leak\n\nAddresses the four findings on the Phase 7 implementation review.\n\n- Claim rows now carry the space they were claimed in. `ClaimManager.pump`\n runs once per space over one daemon-wide ledger, so its reconcile loop was\n judging every row against every index: a row from space B failed the\n open-request check during space A's pump and was settled, then churned\n between `claiming` and `confirming` forever without reaching `held`, so\n neither space ever dispatched an open request. `claims_ledger` gains\n `space_uri` (migrated in place; a row that predates it is adopted by the\n space whose index knows its request), the reconcile loop filters on it, and\n `maxOutstanding` is counted per space to match the confirm-cycle clock.\n Covered by a two-space drill and a ledger unit test.\n- `JetstreamSubscription.#connect()` now disarms the pending reconnect and\n closes the socket it replaces, so a membership change inside a backoff window\n can no longer leave a live socket that every listener ignores and `stop()`\n cannot reach.\n- New `compareCodePoints` in `@radial/core`: `localeCompare` is ICU\n collation, not the byte order \"lowest record URI\" implies. It now backs the\n claim tie-break's second comparator, every uri/cid/did/rev comparator in the\n fold, the canonical JSON that decides whether a rewrite is an edit, and the\n daemon's deterministic selections. `compareInstant` moves beside it in a\n new leaf module, `core/src/order.ts`.\n- Docs: the tie-break rule is spelled out as instant-then-code-point in\n design §6 and `docs/operators.md`; per-space claim counting is documented;\n CHANGELOG records all three fixes.\n\nChecks: pnpm codegen (clean), typecheck, lint, test (684 node:test + 289\nvitest, 0 failures), build.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"69fa8f1887e06fc03fbad9b189398cbeb6ad9585"},"mode":"0100644","name":"state.ts","size":1735}],"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"}}