[CMGS]

Follow-up to #409. A consumer could not bound a billed interval from the usage stream alone: the fold clamped open intervals to the claim's deadline, but no event carried it, Renew moved it silently, reconcile ended claims silently, and a node's loss billed compute with no VM. This makes the stream self-sufficient and rewrites the fold as a state table.

Events

• claim, wake and unarchive carry deadline, the lease in force. archive and adopt carry the retention end, or nothing for an archive kept forever. Renew records renew. reap carries the deadline it ended under. Claim events carry net, so all three pool key axes read without the hash.
• adopt (new): a node took over a claim. A replica is taken of a running claim, so after node loss the stream showed compute until the adopter's release or reap, up to the retention end.
• Reconcile records a reap with ref: vm_gone or quarantined, and the wake a crash lost. With the registry down it records no vm_gone for a replicated claim, which may be running elsewhere. A failed claims save records nothing, and the next boot does.
• archive lands under Transition right after the commit. It used to follow the teardown, so a wake during teardown journaled unarchive before archive, and the archived span never closed.

Fold

A state table replaces the formula plus exceptions, which read two ways. reap settles at min(t, its deadline), release at its t, so the teardown of an expired claim is not billed. adopt outside archived ends the span at min(t, last deadline) and enters archived at its t. Outside archived, archive_delete ends the span at min(t, last deadline). template is documented as a label, because promote lets the caller name it: price compute by size. Disk stays out: nothing bills by disk size today.

Fence

A fenced node no longer hibernates or wakes a replicated claim: it answers ErrLeaseLost (503), as the data plane does, through the API and the idle sweep. Renew stays open on purpose, since refusing it during a registry outage expires leases and widens the outage. An idle replicated claim therefore stays billed until the fence lifts, bounded by the outage.

Replica row of a dropped claim

A vm_gone claim stays adoptable through its replica row. The row had no deadline, so it and its checkpoint stayed forever if the client never returned. The hourly sweep now gives a row this node holds with no claim the pool's retention deadline, and the existing purge reclaims it. archive_delete_after_seconds: 0 keeps it. The checkpoint held during retention is not billed.

Hot-path cost: the claim path gains two fields on the existing journal line, with no new lock or syscall. Renew gains one journal append per call (123 bytes), so frequent renews shorten the 64 MiB rotation and the outage the journal can ride out. wake, unarchive and adopt take m.mu once more, off the claim path.

Upgrade note: sandboxd_usage is only created when missing, so a table made by a pre-release build needs the columns before this runs. Until then landing fails and GET /v1/usage answers 503. The journal catches up after the ALTER, for lines still in usage.jsonl and its .1 backup. No released version has this table.

ALTER TABLE sandboxd_usage
    ADD COLUMN IF NOT EXISTS template text NOT NULL DEFAULT '',
    ADD COLUMN IF NOT EXISTS net      text NOT NULL DEFAULT '',
    ADD COLUMN IF NOT EXISTS size     text NOT NULL DEFAULT '',
    ADD COLUMN IF NOT EXISTS deadline timestamptz;

Accepted, no code

• Two concurrent renews of one sandbox can journal in reverse. The next renew or wake corrects it, and a reap no longer depends on it.
• An unarchive could precede its adopt, but a wake must fetch and boot within the adopter's one commit.
• A stale node can still journal vmm_exit/vmm_restart if a VMM dies during a partition after adoption. A guard would delay the real vmm_exit of a claim never adopted.

Verification at the final commit: make go-lint on a cold GOLANGCI_LINT_CACHE 10 × 0 issues. (5 modules × 2 GOOS, pinned v2.13.2, fmt --diff included); asl -forwarder=false clean on linux and darwin; go test -race ./... in sandboxd with SANDBOXD_TEST_PG_URL set against postgres:17-alpine; the fold text run through an interpreter on 13 sequences, each with one reading. Mutants over every new field, event, gate, tag and order are killed, except a log-only branch that changes no behaviour.

Hardware, two bare-metal nodes in one cell with shared PostgreSQL and S3, on the real engine and guest image:

• Fields and an expiry reap: reap carries the lease, and its t was 0.97 s past it, unbilled.
• Archive: claim,hibernate,archive,unarchive,release.
• Fence, database stopped: hibernate and wake 503 and journal nothing, renew 200, and both work after the lift.
• Node loss (SIGKILL of sandboxd on a replicated claim): adoption 13.8 s after the kill, claim,adopt,unarchive,release across both nodes, with a file written before the kill read back after the wake. Fold 42.7 s of compute, 21.8 s archived.
• Node loss, never woken: claim,adopt,archive_delete,reap, purged at the 120 s retention.
• VM record gone: claim,reap(vm_gone),adopt,unarchive,release with the file read back, and an unclaimed row purged at retention, claim,reap,archive_delete. This leg ran the final commit with the hourly store sweep shortened to 60 s, and nothing else changed.
• Journal lines equal table rows on both nodes, no duplicates.
• Interleaved pr,main,main,pr, n=8 per arm, large tier, at the commit before the last amend (its later changes are off these paths): claim 1.1/1.0/1.1/1.1 ms, renew 0.5/0.4/0.4/0.5, hibernate 2373/2424/2363/2232, wake 152/156/161/164, release 186/186/184/194.

Not run on hardware: the quarantined reap (no egress bridge), the wake a crash lost, reconcile with the registry down, the idle sweep under a fence, a keep-forever pool and real host power loss. Unit tests cover the first five.