Claim at source expiry boundary

source is usable iff database time is strictly before source_expires_at


Claim at source expiry boundary


heartbeat grace not elapsed

reclaim requires lease expiry plus heartbeat grace, confirmed termination, usable source, and remaining attempt budget


termination unconfirmed


attempt budget exhausted


all reclaim predicates true


Stale complete is fenced

stale lease cannot publish state, output, failure, or compensation


Stale fail is fenced


Terminal compare-and-set race

duplicate or losing finalizer has zero effect


Terminal compare-and-set race


Acceptance transaction rolls back completely

injected commit failure leaves no debit, cycle, conversion, or runnable job


Same-key concurrent replay has one acceptance

one owner-scoped idempotency record and one conversion


Idempotency key is owner scoped

same key in distinct owner scopes does not replay another owner's result

each conversion independently opens customer-debit cycle ordinal 1


Concurrent retry commands open one goodwill cycle

one retry attempt and one goodwill cycle; no new debit


Goodwill retry succeeds without reversing prior compensation

earlier customer cycle remains compensated

successful cycle receives no compensation


True queued cancellation closes without a worker lease

queued -> cancellation_pending -> cancelled

one linked compensation after cleanup acknowledgement


Processing cancellation empties descendant cgroup

entire cgroup empty before cancelled commit


Packaging cancellation removes partial output

partial package absent before cancelled commit


Sequential and concurrent same-key cancellation

one cancellation request identity, cleanup action, and compensation


Cancellation is owner scoped

foreign, anonymous, and unauthorized-admin requests cause zero mutation


Complete wins cancellation race

complete commit wins; no cancellation compensation


Cancellation wins timeout race

cancelled is sole terminal state; timeout finalizer has zero effect


Failure wins cancellation race

failure is sole terminal state and compensation occurs once


Cancellation after terminal state has no effect

terminal state, object, cleanup, and ledger remain unchanged


Cancellation remains pending until cleanup acknowledgement

API and Library project Cancelling, never Cancelled, before cleanup acknowledgement


Queued request remains cancellation pending

one request timestamp; no terminal state or compensation before acknowledgement


Worker acknowledgement commits cancellation

cgroup and workdir empty before atomic cancelled plus compensation


Concurrent cancellation converges once

same conversion has one cancel timestamp, cleanup, terminal write, and compensation


Ownership CSRF and terminal denials mutate nothing

ownership-safe denial and zero state, ledger, or process mutation


Worker crash before acknowledgement is reclaimed

lease-expiry recovery performs cleanup then converges once


Cleanup failure stays nonterminal

readiness and alert fail; state remains reclaimable; no premature compensation


Crash after cleanup retries atomic commit

retry creates one atomic terminal plus compensation effect


Private source copy is materialized before source expiry

expected snapshot regenerated exclusively from ordered replay oracle


Source deletion preserves an already materialized private copy


Claim succeeds from private copy after source object deletion


Claim at exact source expiry terminalizes as source expired


Completion creates ZIP with exact forty-eight-hour expiry


Artifact publication binds the completed ZIP


Artifact expiration at exact ZIP deadline terminalizes once


Account operation terminalizer records authoritative terminal state


Artifact publish and ZIP delete are event-derived

source is usable iff database time is strictly before source_expires_at