[kriszyp]

⊙ Problem

After a record-lock home map moves to a new generation, a home keeps its grants from the old one. If that delegate was stopped for good, the home answers "contended" for the key for about 365 s. harper-pro's fenced transition (harper-pro#973) hits this on every key the stopped node held from a surviving home.

🤔 Should core change, rather than harper-pro waiting the lease out?

Yes: without it, a fenced transition activates in seconds but serves those keys six minutes later. The maintainer approved this core scope. Only grants the drain already ruled on are retired, so reverting restores today's wait.

💡 Solution

• A home serves the keys a stopped node held at once after a fenced activation. It retires only older grants the stage drain reported outstanding on a node the new ring drops.
• Every other older grant keeps its lease, as the backstop against an early activation.
• A drain no longer reports "complete" while authority is still live (harper-pro#1061).

⚖️ Alternatives

• Expire every older grant — loses the lease backstop for delegates still in the ring.
• Infer "the drain ruled" from recall history — a contention recall looks the same.
• Also retire recall-confirmed grants — a recall can confirm while a renewal's admission still runs.

🤔 May core retire a dropped node's drain-marked grant without knowing it was fenced?

Yes, by design. harper-pro activates past an unconfirmed recall only on a stop attestation or after the lease wait. Activating early is the same operator error as fencing a running node. Passing fences into core would be a new interface.

🔧 Changes

• resources/recordLockCoordinator.ts:
  • quiesce marks each grant it leaves outstanding.
  • #retireOlderGrants runs from a grant request past the quarantine, once per generation and again after a later drain marks more. It applies the retire rule and raises the generation floor when it retires anything. A renewal drops the stale mark.
  • quiesceDelegations re-reads coordinators, after waiting on in-flight surrenders, until none is new. Each object is counted once.
  • A handed-off coordinator answers for a cold-closed successor's ownership.
  • A recall that matches an in-flight surrender waits for its fence.
• resources/record-locks.md: the home-side half of "a delegation is authority within one generation", and an external fence defined as stopped, never isolated.

✅ Verification

• npx mocha unitTests/resources/recordLock*.test.js: 326 passing, with new tests in unitTests/resources/recordLockCoordinator.test.js under "a home across a generation change" and quiesceDelegations.
• Removing any one of these fails its new test: the retire rule, the re-arm, the re-read loop, the surrender join, or the cold-close ownership check.
• End to end: the harper-pro PR's recordLockApplyFenced.test.mjs kills a node and fences it. It then re-locks that node's exact keys at once; without this change, those re-locks fail.

New tests

Under "a home across a generation change":

• dropped and drained;
• unchanged generation;
• in ring;
• recall-confirmed in ring;
• recall still in flight at the drain deadline;
• never drained after a failed contention recall;
• a recall during an in-flight surrender;
• a later drain re-arming the sweep;
• a coordinator rebuilt while the drain waits, then cold-closed;
• a late release that must not clear its successor.

Under quiesceDelegations: a coordinator rebuilt mid-sweep.

_{🤖 Generated by Claude Code (Claude Opus); posted via @kriszyp.}

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kcpk75VwseBHAGwqT6mQvP

Release target: v5.4 — the core half of a new harper-pro feature (harper-pro#973), shipping with v5.4; no backport
Related PRs: #3248 overlaps (same coordinator test file; successors on the recovery path now take no lineage), #3259 independent (this branch is based on it)
Complexity: complicated

Deferred findings

• 5f78fffa79c8bea3 minor concurrency — resources/recordLockCoordinator.ts — mismatched-token recall confirms while the older-token delegation admits; drain counts it recalled — NOT FILED
• 401782fcd8a36fd7 minor reliability — resources/recordLockCoordinator.ts — drain in recall backoff marks the grant outstanding without sending a recall — NOT FILED

_{Review-Coverage: authored=claude; ran=gemini,muse,codex; adjudicated=domain; declined=cursor-grok,cursor-composer,cursor-kimi,cursor-muse; rounds=13; full=7 @ afc0cd7}

_{Review-Attention: deep ~25m (critical: recordLockCoordinator.ts; decisions: retire-on-inferred-fence, handed-off-ownership-reports-zero, do-less-alternative) @ afc0cd7}