[kriszyp]

⊙ Problem

A successful table.lock() write could lose under last-write-wins when the state it read had a version ahead of this node’s clock, including a future tombstone or a predecessor’s explicit timestamp. Serialization alone did not establish version order (#2540).

🤔 Keep the correctness fix

The owner chose a stamp floor and bounded clock lift. Allocator optimization remains follow-up #3245; this PR does not require another application benchmark budget decision.

💡 Solution

Admission floors put writes above both the reloaded record version and predecessor dependencies. A future floor within storage.maxLockClockSkew (default 5s) receives a unique claimed version. Claims persist coverage before publication; each write reserves a distinct log key. Beyond the skew cap, admission fails with LockUnavailableError (503), including deliberately future-stamped local records.

🤔 Accept the allocator cost as follow-up

Optimization remains #3245. At the earlier d6f79ed head, allocator controls measured baseline-adjusted throughput losses of 15% and 64% for one and four workers; application results were inconclusive. Those measurements predate the durability barrier. Current coverage extensions block on a storage flush, amortized with one-second headroom. They also reserve up to an extra second of restart clock lead. No current application performance result is claimed.

⚖️ Alternatives

The durable issuance ceiling prevents restart from reusing future-issued keys. Its immutable recovery snapshot lives inside the ratchet buffer, so it has the same lifetime; later workers do not consume unused headroom. Returning the same future floor to multiple holders repeats keys. Sleeping holds the lock while waiting for the clock.

🤔 Refuse writes joining an older in-flight commit

The owner chose a 409 before staging when a holder write would join a native commit reserved below its stamp. Unlock, acquire a fresh lock, and retry. Existing limitations remain tracked in #3238 and #3246.

🔧 Changes

Review ordering and recovery together: one admission read, coverage before claim, durable ceiling coverage, and refused sibling cleanup. The native package has no synchronous WAL-sync primitive, so coverage uses flushSync before any claimed key escapes, including when another worker already wrote the ceiling. Observed refusal detaches all unsaved sibling operations on that handle; saved writes remain attached for replay. The atomic initial-ceiling word seeds recovery once per live registry, including a zero seed.

Repeated hold claims can reach coverage even after clock catch-up, and each worker has its own covered-through cache. A refill can therefore synchronously flush memtables on multiple workers. Skipping unnecessary barriers or sharing only a proven durable ceiling remains optimization #3245.

🤔 Preserve collision-safe hold steps

A hold step that could repeat an issued key is claimed again, including after clock catch-up. It can therefore advance beyond a later plain write; plain writes remain ungated. The rebase preserves this existing uniqueness choice. Admission returns the captured image; ungated writes can race it. The Phase 0 tradeoff remains tracked in #3246.

🤔 Preserve frozen and mixed explicit clocks

An explicit transaction that already reserved a log key or staged an unlocked write keeps its existing clock. Lock ordering stays best effort there; admission does not move unrelated writes into the future. This preserves the existing contract. Stronger enforcement remains #2918. A hold saved after that transaction can claim its deferred floor. Inside an open explicit transaction, an unreserved, unmixed snapshot advances to a hold’s floor. A frozen or mixed clock below that floor fails with a 409 without marking the handle refused.

🤔 Preserve source-read availability

When coverage fails, source reads return data uncached. A raw version could repeat an unstaged holder stamp, so the fill neither stores it nor shares it with a caching waiter. The waiter retries with a fresh allocation; a source cannot clear the internal failure guard by changing context options. Repeated failures can repeat coverage attempts and origin fetches; this error-path cost preserves read availability without storing untrusted versions.

Changed files and verification surfaces

• DESIGN.md: Index the record-lock admission and issuance design.
• config-root.schema.json: Declare storage.maxLockClockSkew and its default.
• package.json: Register the record-lock admission benchmark while preserving existing benchmarks.
• static/defaultConfig.yaml: Set the default storage.maxLockClockSkew duration to 5s.
• unitTests/resources/issuanceWorkers.test.js: Exercise live native worker opens without consuming disk headroom, and concurrent source readers after real closed-store coverage failure.
• unitTests/resources/fixtures/issuanceWorker.cjs: Open real shared tables on worker threads, issue keys, and restore healthy coverage after a real failure to discriminate unsafe caching.
• unitTests/resources/originClosedFloor.bench.js: Keep the benchmark slot probe aligned with the fifth shared header word; no new performance measurement is claimed.
• unitTests/resources/issuanceDurability.test.js: Use real killed child processes and deliberate WAL loss to verify restart above a published ceiling before clock catch-up.
• unitTests/resources/fixtures/issuanceRecovery.cjs: Open the real audit store in isolated children and exercise issuance or restart recovery without stubs.
• unitTests/resources/updateAttributesLock.test.js: Allow worker startup outside the watchdog while retaining the lock-wait elapsed bound.
• resources/DESIGN.md: Document claimed versions, distinct log keys, durable issuance coverage, and skew refusal.
• resources/DatabaseTransaction.ts: Centralize ownership-aware sibling cleanup at every initial refusal, preserving saved and unrelated writes. Advance committed holder floors on lease-protected writes even without Table.lock(), honor holder floors inside open explicit transactions, preserve applied holder versions across retries, reject lower-key in-flight joins and refused writes before staging, detach failed writes and abort new immediate handles, and cache the unlocked-write scan.
• resources/Table.ts: Read admission state once, carry dependency floors, raise only adoptable transaction clocks, and restore clocks/release locks on reload failure. Route coordinator and source-fill timestamps through the allocator; refuse exact-key mutations before staging and detach all unsaved sibling operations on the refused handle when refusal is observed, preserving saved and unrelated writes.
• resources/auditStore.ts: Persist and flush local issuance coverage before publication, reserve one second of headroom, throttle repeated ceiling write error logs, and install recovery seeding at open.
• resources/originClosedFloor.ts: Cover ratchet-issued keys before use; expose next-representable timestamps, fresh keys, floor claims, and once-per-live-registry restart seeding. An atomic initial-ceiling word shares the ratchet lifetime and preserves an initial zero seed.
• resources/record-locks.md: Explain admission ordering, skew limits, transaction/hold behavior, recovery, and remaining limitations.
• resources/recordLock.ts: Compute admission floors and skew-bounded claimed stamps; separate committed holder floors from prospective step candidates and allocate acquisition and hold versions safely, including failure cleanup.
• resources/recordLockCoordinator.ts: Carry the dependency maximum through admissions, delegation caching, and renewal; mint the read timestamp before registration.
• unitTests/resources/auditRefKinds.test.js: Check distinct minted log keys while preserving record-version identity on retry.
• unitTests/resources/originClosedFloor.test.js: Check claim uniqueness, subsequent issuance, coverage failure, once-only recovery seeding, and full close/reopen above the newer persisted ceiling.
• unitTests/resources/qa5043-explicit-txn-lock-stamp.test.js: Exercise hold-lock version floors across transactions without Table.lock(), subsequent contexts, open explicit transactions, and mid-scope commits.
• unitTests/resources/recordLock-thread.js: Support plain unlocked worker writes alongside locked increments in multi-thread lock tests.
• unitTests/resources/recordLock.test.js: Exercise future versions/tombstones, mixed and explicit clocks, skew refusal, unique versions/log keys, holds, and allocation/refusal recovery, immediate first-refusal cleanup, real closed-store reservation failure, and unlock/relock recovery. Preserve base retry/replay regressions.
• unitTests/resources/recordLockAdmission.bench.js: Measure ordinary writes and lock admission around a future-clock claim with mapped remote origins and source-module imports.
• unitTests/resources/recordLockCluster.test.js: Check future stored versions and ahead-of-clock release/recovery dependencies.
• unitTests/resources/recordLockCoordinator.test.js: Check that dependency maxima reach every admission path.
• unitTests/validation/configValidator.test.js: Validate configured skew durations and rejected values.
• utility/common_utils.ts: Export duration parsing for the admission skew setting.
• utility/hdbTerms.ts: Register the storage.maxLockClockSkew configuration key.
• validation/configValidator.ts: Reject invalid, negative, non-finite, and overflowing skew durations.

✅ Verification

Rebased onto 9487552e4 (main). Build, repository lint, changed-file formatting, design-note budgets and unit partition pass. 525 passing, one pending across the focused compiled suites (originClosedFloor.test.js, qa5043-explicit-txn-lock-stamp.test.js, recordLock.test.js, issuanceDurability.test.js, issuanceWorkers.test.js, recordLockCluster.test.js, recordLockCoordinator.test.js, updateAttributesLock.test.js, auditRefKinds.test.js, cacheFillClose.test.js, and configValidator.test.js); seven passing targeted regressions under type stripping. New regressions fail before their fixes; verification covers the durability barrier, live worker opens, concurrent source readers, hold-lock version floors across transactions, and caught refusals with sibling operations.

Broader verification and limits

Earlier local LMDB resources: 4,241 passing, 1,176 pending. Fulltext: 346 passing, six pending after refreshing stale native dependencies. The first broad RocksDB resources run failed against stale fulltext dependencies and a worker watchdog; focused reruns passed after correction. The 30-minute core run timed out without a summary; six previously failing tests passed in focused reruns. These are not complete current-head full-gate passes. The pushed-head CI matrix is the full unit/platform/integration route; its results are recorded below.

The new POSIX recovery regression kills the issuer and drops its disposable database’s WAL, then reopens before clock catch-up. It is a WAL-loss recovery proxy, not a physical power-cut or Pro transport test. Refusal containment uses real records, a pending blob commit and an explicit transaction. Live-worker and concurrent source-reader tests use real modules and a closed audit store, with no method stubs. A broader lock/cache selection had 443 passing, one pending and two blob-reclamation failures; the isolated five-test blob group passed. That combined run is not counted as a pass.

Current-head (ac849f267) CI passed: unit/resource and platform matrices, Node/Bun/uWS integration shards, packaging, and consumer installs.

Docs: existing companion documentation#749 covers native concurrency controls; the current core note states the issuance barrier and one-second recovery reserve.

PR QA: Do simultaneous future-floor admissions survive worker restart without losing successful writes? — queued @ b4a23e6, qa-pr-harper-3248-b4a23e6

Earlier QA evidence

Earlier PR QA qa-pr-harper-3248-cc1d217 passed a four-worker future-version workload, process kill/restart before clock catch-up, and a fails-on-base control. This predates the current rebase; it is not a new-head QA claim.

Framing-Verdict: chosen-approach-sound

Refs #2540

_{🤖 Generated by OpenAI Codex; posted via @kriszyp.}

Release target: main — new storage.maxLockClockSkew setting and lock stamping behavior; no backport requested.

Related PRs: #2918 overlaps, #3490 overlaps, #3504 overlaps, #3527 overlaps, #3229 overlaps, #3356 overlaps, #3309 overlaps, #3266 overlaps, #2498 overlaps, #3539 overlaps, #3635 overlaps, #3655 overlaps, #3649 overlaps, #3572 overlaps, #3615 overlaps, #3610 overlaps, #3629 overlaps, #3685 overlaps, #3680 overlaps, #3605 overlaps, 23 others independent

Complexity: complicated

Tracked review deferrals

Deferred findings

• 5b4f188d4d0353ef major performance — resources/recordLock.ts — Upgrade claims an unused deferred floor — filed Measure the per-write cost of strict ratchet mode after a record-lock claim #3245
• bafb653dd4cca780 major concurrency — resources/Table.ts — Captured lock image can miss ungated writes — filed Record-lock admission stamp follow-ups: past-cap explicit holders, hold steps after a lead, cap 0 test, no-audit-store cover #3246
• 54dd6c0505bee6e9 major reliability — resources/originClosedFloor.ts — Post-claim worker-local coverage can still refuse issuance — filed Measure the per-write cost of strict ratchet mode after a record-lock claim #3245
• 06d7d29c6b3cf1b9 major performance — resources/recordLock.ts — Caught-up holder saves request synchronous issuance coverage — filed Measure the per-write cost of strict ratchet mode after a record-lock claim #3245
• 3ef7da9737e68aeb major performance — resources/originClosedFloor.ts — Strict issuance latch: CAS plus sync ceiling flush on every local key after one claim — filed Measure the per-write cost of strict ratchet mode after a record-lock claim #3245
• 1d6523614540a0b3 major performance — resources/auditStore.ts — sync flushSync on each new issuance ceiling during a clock lead stalls writers — NOT FILED
• 003711e2035cb380 minor test-coverage — unitTests/resources/recordLockCoordinator.test.js — Pro relay serialization of dependencyFloor remains unverified — filed Record-lock admission stamp follow-ups: past-cap explicit holders, hold steps after a lead, cap 0 test, no-audit-store cover #3246
• 193317a8c06ec2f5 minor concurrency — resources/Table.ts — Final lock reload can return a hold after transaction abort — filed Record-lock admission stamp follow-ups: past-cap explicit holders, hold steps after a lead, cap 0 test, no-audit-store cover #3246
• e4a9c590539233f9 minor test-coverage — resources/recordLockCoordinator.ts — dependencyFloor relay survives only if harper-pro transport forwards the round whole — filed Record-lock admission stamp follow-ups: past-cap explicit holders, hold steps after a lead, cap 0 test, no-audit-store cover #3246
• fb195ec4beede0f1 minor data-integrity — resources/Table.ts — Admission raises caller historical txn timestamp; later unlocked writes overwrite newer records — filed Record-lock admission stamp follow-ups: past-cap explicit holders, hold steps after a lead, cap 0 test, no-audit-store cover #3246
• +6 more in the review receipt

🤔 defer this PR's major performance finding 5b4f188d4d0353ef (Upgrade claims an unused deferred floor) to #3245 instead of fixing it here?

🤔 defer this PR's major concurrency finding bafb653dd4cca780 (Captured lock image can miss ungated writes) to #3246 instead of fixing it here?

🤔 defer this PR's major reliability finding 54dd6c0505bee6e9 (Post-claim worker-local coverage can still refuse issuance) to #3245 instead of fixing it here?

🤔 defer this PR's major performance finding 06d7d29c6b3cf1b9 (Caught-up holder saves request synchronous issuance coverage) to #3245 instead of fixing it here?

🤔 defer this PR's major performance finding 3ef7da9737e68aeb (Strict issuance latch: CAS plus sync ceiling flush on every local key after one claim) to #3245 instead of fixing it here?

🤔 defer this PR's major performance finding 1d6523614540a0b3 (sync flushSync on each new issuance ceiling during a clock lead stalls writers) to a separate issue instead of fixing it here?

Retained review snapshots below refer to their named earlier commits.

Late Grok findings

16 surviving (highest major) — Grok reviewed 36644bc, ruled against 28ba8c4

• major — resources/originClosedFloor.ts:212 — A peer-ahead claim permanently enables shared CAS; caught-up hold saves and scoped upgrades can still perform synchronous coverage
• major — resources/originClosedFloor.ts:218 — During worker A’s covered lead, worker B’s failing coverage repeatedly rejects its allocations
• major — resources/Table.ts:11587 — Failed allocation falls back to a raw version that can repeat an issued version and lose a write
• major — resources/auditStore.ts:1025 — Power loss before WAL synchronization can discard a ceiling already used for issuance, allowing reissuance after restart
• major — resources/Table.ts:4235 — After one refusal poisons a handle, another deferred save throws before detaching its operation
• major — resources/recordLock.ts:231 — A deliberate local timestamp 60 seconds ahead makes subsequent lock admission fail until within the cap
• minor — resources/recordLockCoordinator.ts:1657 — A Pro serializer dropping dependencyFloor would silently weaken relayed admission; that serializer remains unverified
• minor — resources/record-locks.md:230 — Documentation still describes replica version clamping despite distinct-version apply
• minor — unitTests/resources/recordLock.test.js:55 — An unmapped peer fixture follows local-origin routing, hiding the remote audit path
• minor — unitTests/resources/nativeFullTextSchemaUpgrade.test.js:250 — A valid pre-header 503 now fails a fixture requiring stream destruction
• nit — unitTests/resources/recordLock.test.js:1686 — Runtime configuration and zero-cap admission remain unverified
• nit — utility/common_utils.ts:903 — A unitless 5000 configures 83 minutes rather than five seconds
• nit — unitTests/resources/recordLockAdmission.bench.js:3 — Instructions name an absent wrapper; its compiled import prevents direct TypeStrip execution
• nit — resources/Table.ts:11586 — Misleading tie wording and added setup narration remain after the clock explanations were corrected
• nit — resources/recordLock.ts:213 — A test-only parser alias unnecessarily expands this module’s exports
• major — resources/Table.ts:11583 — Coverage failure falls back to a potentially reused raw source-fill version (raised by the CLI: unmeasured hot path)

Not standing: none. Grok ran 24m (24m from launch to report); the fold adjudication (cursor-grok@36644bcba8da-88016bbd, codex) took 6m.

Late Grok findings

14 surviving (highest major) — Grok reviewed 7549dc4

• major — resources/originClosedFloor.ts:212 — One future admission permanently enables shared CAS; caught-up holder saves keep requesting synchronous coverage
• major — resources/originClosedFloor.ts:227 — Worker-local coverage failure rejects keys another worker already durably covered
• major — resources/recordLock.ts:513 — Scoped-to-hold upgrade claims a deferred floor before any write
• major — resources/recordLock.ts:228 — Locking a deliberately future-stamped local record returns 503 until clock catch-up
• major — resources/Table.ts:11839 — Raw fallback can duplicate an unstaged holder version, causing its later write to deduplicate
• major — resources/Table.ts:4268 — Two updates after refusal leave the earlier operation queued; commit aborts unrelated writes despite a caught 409
• minor — resources/originClosedFloor.ts:413 — Opening another live worker promotes unused persisted headroom into the issuance ratchet
• minor — resources/Table.ts:5234 — An ungated plain write can land after the captured image; an older-stamped put can be overwritten by computed holder data
• minor — resources/recordLockCoordinator.ts:1657 — Pro relay preservation of dependencyFloor remains unverified; retain its existing follow-up
• nit — utility/common_utils.ts:903 — Unitless 5000 means 83 minutes rather than five seconds
• nit — unitTests/resources/recordLockAdmission.bench.js:3 — Instructions still require an unspecified environment wrapper
• nit — resources/recordLock.ts:213 — Parser alias adds a production export solely for tests
• nit — resources/recordLock.ts:201 — Direct runtime-configuration and zero-cap coverage remain absent; no malfunction demonstrated
• nit — resources/DESIGN.md:212 — Conflicting ceiling durations, misleading clock explanations, and setup narration remain

Not standing: 9 merged, 1 separate-issue, 1 resolved. Grok ran 26m (26m from launch to report); the fold adjudication (cursor-grok@7549dc445fbd-ddf7345b, codex) took 4m.

Late Grok findings

6 surviving (highest major) — Grok reviewed 9e7356b

• major — resources/DatabaseTransaction.ts:2345 — First refusal detaches only its operation; an untouched same-handle sibling can still reject the unrelated commit
• major — resources/recordLock.ts:229 — A locally written now+60s version makes subsequent locks fail with 503 until its lead falls within the cap
• minor — resources/Table.ts:5220 — Abort between registration and final reload can still return a hold; retained under follow-up lock-reload-after-abort
• nit — utility/common_utils.ts:902 — An operator interpreting unitless string 500 as milliseconds instead configures a 500-second skew cap
• nit — resources/recordLock.ts:213 — A test-only alias adds a redundant exported parser name
• nit — unitTests/resources/recordLock.test.js:1913 — Added comments narrate fixture setup; aggregate also includes unitTests/resources/recordLock.test.js:1671-1675 and unitTests/resources/recordLock.test.js:2009

Not standing: 1 resolved, 1 dropped-factually-wrong, 1 separate-issue. Grok ran 25m (25m from launch to report); the fold adjudication (cursor-grok@9e7356be459d-7721b719, codex) took 5m.

Late Grok findings

5 surviving (highest major) — Grok reviewed b4a23e6

• major — resources/recordLock.ts:229 — A deliberately local write stamped 60 seconds ahead prevents subsequent lock admission under the default cap until clock catch-up
• nit — resources/recordLock.ts:213 — Parser refactors must preserve a redundant production alias used only by tests
• nit — resources/recordLock.ts:201 — Parser and schema tests can pass while configured or zero-cap runtime admission remains unverified
• nit — utility/common_utils.ts:902 — Configuring unitless 500 intending milliseconds permits 500 seconds of skew
• nit — resources/Table.ts:5037 — Added setup narration and duplicated clock explanations remain across source, tests, and design prose

Not standing: none. Grok ran 14m (14m from launch to report); the fold adjudication (cursor-grok@b4a23e642f2e-0f737888, codex) took 3m.

Late Grok findings

5 surviving (highest major) — Grok reviewed d262d9d

• major — resources/Table.ts:5164 — An explicit transaction({ timestamp }) with a caller-supplied historical timestamp below a locked record's version is raised to admitted.stamp. For a floor at or behind the clock, admissionStamp returns acquiredAt (resources/recordLock.ts:230), which is wall time, not just above the floor.
• minor — resources/DatabaseTransaction.ts:2397 — The fixed-clock 409 tells the caller to save the held record first or in its own transaction. The catch at :2414 calls refuseLockWrites, which sets writeRefused on the handle, so that recovery also gets a 409. The hold accepts writes again only after unlock() and a new lock()
• minor — resources/Table.ts:11841 — When the issuance-ceiling write fails inside freshLocalKey, getFromSource catches it with an empty catch. It only sets issuanceFailed and logs nothing, so a durable coverage failure looks like a quiet cache miss on every fill. On lock() admission the same failure is rethrown raw at :5144
• major — resources/originClosedFloor.ts:213 — One in-cap claim ahead of the clock latches WORD_STRICT for the rest of the process. After that, every local key on every thread does a compare-and-swap on the shared ratchet word, plus a synchronous flushSync for ceiling coverage. No benchmark numbers are in the PR. Deferred as `strict-issuance
• minor — resources/recordLockCoordinator.ts:1653 — dependencyFloor survives the relay only if harper-pro's transport forwards the whole round. The in-repo test passes the object back in-process, so a reply that dropped the field would still pass. Deferred as relay-dependency-floor-wire-unverified

Not standing: 3 merged, 2 separate-issue. Grok ran 15m (16m from launch to report); the fold adjudication (cursor-grok@d262d9d5874a-309178da, claude) took 1m.

Late Grok findings

7 surviving (highest major) — Grok reviewed 8c912c0

• major — resources/Table.ts:5164 — An explicit transaction({ timestamp: historical }) that locks a record whose stored version is older than the clock has its whole clock raised to acquiredAt (about now), not just above the floor. Every unlocked write staged after the lock then commits at about now and silently overwrites newer v
• major — resources/originClosedFloor.ts:213 — One in-cap admission ahead of the clock sets WORD_STRICT for the rest of the process. After that, every local key does a CAS (compare-and-swap) on the shared ratchet word, plus a synchronous flushSync coverage write per thread as keys pass the headroom. No benchmark numbers are recorded.
• minor — resources/DatabaseTransaction.ts:2388 — A hold save inside an explicit transaction uses the native handle's read-snapshot time as the "effective clock". If that time is above the ratchet, it can lag wall time. The save then sets the transaction clock to an unclaimed #stepPast step behind the wall clock, and later writes in the transacti
• minor — resources/DatabaseTransaction.ts:2396 — The 409 refusal now detaches only the current operation. Earlier deferred writes of the same hold, linked through pendingPriorWrite, stay attached. If the caller catches the 409 and commits, they are committed.
• minor — resources/Table.ts:11841 — An issuance-ceiling write failure in getFromSource is swallowed with nothing logged. The same failure during lock() admission is rethrown raw at resources/Table.ts:5142-5144 and reaches the client as an untyped 500.
• minor — config-root.schema.json:719 — storage.maxLockClockSkew, the 503 returned past the cap, and the hold-save 409 have no user-facing docs and no static/defaultConfig.yaml entry. They are documented only in internal resources/record-locks.md.
• nit — resources/recordLock.ts:348 — Past the cap, #stepPast returns a far-future step without claiming it.

Not standing: 3 merged, 2 separate-issue. Grok ran 15m (16m from launch to report); the fold adjudication (cursor-grok@8c912c0f72b8-c2c38386, claude) took 1m.

Late Grok findings

2 surviving (highest minor) — Grok reviewed 89c9888

• minor — resources/auditStore.ts:1031 — coverLocalIssuance logs through warnContained (resources/auditStore.ts:208-212), which has no rate limit. If the ceiling write or flushSync keeps failing (disk full, store closed) after a lock claim has moved the ratchet ahead of the clock, every local key minted in that lead window logs one
• nit — resources/indexes/DESIGN.md:683 — wording change to the streaming-errors note in a record-lock PR. Not verified as unrelated: this pass had no diff tool.

Not standing: 3 accepted-known. Grok ran 21m (21m from launch to report); the fold adjudication (cursor-grok@89c98883448f-89f218c0, claude) took 1m.

Late Grok findings

none surviving — Grok reviewed ffaba1e

No finding survived adjudication.

Not standing: none. Grok ran 7m (7m from launch to report); the fold adjudication (cursor-grok@ffaba1e9f1d5-d8a6eddd, claude) took 1m.

_{Review-Coverage: authored=gemini; ran=cursor-composer,codex,muse,claude,cursor-muse,cursor-grok; late=cursor-grok:adjudicated; adjudicated=domain; declined=cursor-kimi; rounds=31; full=13 @ ac849f2}

_{Review-Attention: deep ~65m (critical: DatabaseTransaction.ts, Table.ts +3; decisions: stamp-floor-over-fencing, skew-cap-503, durable-issuance-ceiling-1s-headroom, caller-timestamp-raise, do-less-alternative, release-target-unclear, deferred-5b4f188d, deferred-bafb653d, deferred-54dd6c05, deferred-06d7d29c, deferred-3ef7da97, deferred-1d652361) @ ac849f2}

[gemini-code-assist]

Code Review

This pull request implements record lock admission floor stamping (harper#2540) to ensure lock holder writes outrank predecessor states, introducing configuration for maximum lock clock skew and local issuance ceiling persistence. The code review identified several key issues: a potential TypeError in highestPosition when dependencies is null, a potential lock leak in acquireRecordKey if handle creation fails, incorrect handling of numeric clock skew configurations, and comparison bugs involving undefined values in lockStampCeiling and Table.ts clock-lifting logic.