From 18593a04afec3ef36a5bb9991796d93b4408670e Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 12:56:06 +0800
Subject: [PATCH 1/7] usage: state the deadline, the net lane and the end of a
 dropped claim

A consumer could not bound an interval a crash left open: the folding rule clamps to the claim's deadline, but no event carried it, renew recorded nothing, and reconcile ended claims silently. Events that move the deadline now state it, renew records an event, and reconcile records a reap with the reason for a claim it drops or quarantines. Claim events also carry the net lane, so all three pool key axes read without the hash.
---
 docs/deploy.md                  |   2 +
 docs/sandboxd-api.md            |  31 +++++----
 sandboxd/pool/archive.go        |   7 ++-
 sandboxd/pool/claim.go          |  21 +++++--
 sandboxd/pool/egress_test.go    |   3 +
 sandboxd/pool/hibernate.go      |   2 +-
 sandboxd/pool/reconcile.go      |  23 ++++++-
 sandboxd/pool/telemetry.go      |   1 +
 sandboxd/pool/telemetry_test.go | 108 +++++++++++++++++++++++++++++++-
 sandboxd/server/usage_test.go   |   4 +-
 sandboxd/usage/pg/pg.go         |  14 +++--
 sandboxd/usage/pg/pg_test.go    |   6 +-
 sandboxd/usage/pg/schema.sql    |   2 +
 sandboxd/usage/usage.go         |   2 +
 14 files changed, 192 insertions(+), 34 deletions(-)

diff --git a/docs/deploy.md b/docs/deploy.md
index c6c44af5a..ae585a846 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -841,8 +841,10 @@ only; computing durations or prices stays with the consumer.
       vm          text        NOT NULL DEFAULT '',
       key         text        NOT NULL DEFAULT '',
       template    text        NOT NULL DEFAULT '',
+      net         text        NOT NULL DEFAULT '',
       size        text        NOT NULL DEFAULT '',
       tenant      text        NOT NULL DEFAULT '',
+      deadline    timestamptz,
       volumes     text[],
       volumes_rw  text[],
       children    text[],
diff --git a/docs/sandboxd-api.md b/docs/sandboxd-api.md
index 63f1795d3..15e531e46 100644
--- a/docs/sandboxd-api.md
+++ b/docs/sandboxd-api.md
@@ -1013,13 +1013,17 @@ truth is the usage journal below.
 
 Always on: every lifecycle transition appends one JSONL event to
 `<data_dir>/usage.jsonl` — `{"t": <RFC3339>, "ev":
-"claim|hibernate|wake|fork|checkpoint|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
+"claim|renew|hibernate|wake|fork|checkpoint|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
 "id": "sb_…", "vm": "sbx-…"}` plus `key` (the pool key's stable hash, claim
-events), `template` and `size` (the claim's template and size tier, claim
-events, so a consumer can price a sandbox by its shape without the claim
-record, which is gone after release), `tenant` (the owning tenant, on every
-event of a tenant's claim), `children` (fork) and `ref` (the promoted
-template / checkpoint id, the egress host, or a `vmm_failed` reason). An egress event that injected credentials names
+events), `template`, `net` and `size` (the claim's template, lane and size
+tier, claim events, so a consumer can price a sandbox by its shape without the
+claim record, which is gone after release; `size` sets the CPU and memory,
+while `template` is only a label, because a promoted template's name is the
+caller's choice), `deadline` (the deadline in force after this event: `claim`,
+`renew`, `wake` and `unarchive` carry the lease, `archive` the retention end, or
+nothing for an archive kept forever), `tenant` (the owning tenant, on every event of a
+tenant's claim), `children` (fork) and `ref` (the promoted template / checkpoint
+id, the egress host, a `vmm_failed` reason, or why reconcile ended a claim). An egress event that injected credentials names
 them in `secret` (`gh,claim:<entry>`, never a value). An egress event routed through an
 [upstream proxy](egress.md#upstream-proxies) carries `upstream` (its `host:port`), and with
 `egress_usage_bytes` on, `egress_bytes` events add the connection's payload `tx`/`rx` bytes. A volume claim also carries
@@ -1035,9 +1039,11 @@ before sandboxd runs again (a host that was down) stays billed up to that
 point, and `vmm_failed` is informational; hibernated storage seconds =
 Σ(hibernate→wake) minus the archived span; archived storage seconds =
 Σ(archive→unarchive/archive_delete), a cheaper store tier than a hibernated
-VM's RAM. An interval left open by a crash clamps to the claim's
-deadline; reconcile records nothing for the claims it drops (those whose VM
-record is gone), so a restart leaves those intervals without a terminal event. The `vm` name joins
+VM's RAM. An interval left open by a crash, or by a node that never returns,
+clamps to the last `deadline` among the claim's events. Reconcile ends a claim
+it drops with a `reap`: `ref` is `vm_gone` when the VM record is gone and
+`quarantined` when it cannot re-lock the egress NIC. Its `t` is the node's
+return, so clamp it the same way. The `vm` name joins
 cocoon's machine-level metering ledger for audit cross-checks. With
 `meta_store.usage`, the node also lands every line in the cell's
 [shared usage table](deploy.md#shared-usage-table), read through
@@ -1049,12 +1055,13 @@ Auth: root only (tenant tokens get 403). Reads the raw usage events of every
 node of the cell from the [shared usage table](deploy.md#shared-usage-table).
 
 - `GET /v1/usage?tenant=<name>&since=<time>&until=<time>&after=<cursor>&limit=<n>` →
-  `{"events": [{"cursor": 41, "node": "n1", "t": "2026-10-30T08:00:00.123456Z", "ev": "claim", "id": "sb_…", "vm": "sbx-…", "key": "…", "template": "…", "size": "large", "tenant": "acme"}], "next": 41}`.
+  `{"events": [{"cursor": 41, "node": "n1", "t": "2026-10-30T08:00:00.123456Z", "ev": "claim", "id": "sb_…", "vm": "sbx-…", "key": "…", "template": "…", "net": "none", "size": "large", "tenant": "acme", "deadline": "2026-10-30T09:00:00.123456Z"}], "next": 41}`.
 - **Events:** each is one journal line with its keys as in
   [usage.jsonl](#usage-journal-usagejsonl), `t` in UTC to the microsecond, plus
   `cursor` (its place in the table; one node's events follow its journal
-  order) and `node` (the node that recorded it). A `claim` line written by
-  v0.1.20 or earlier has no `template` or `size`.
+  order) and `node` (the node that recorded it). A journal written by
+  v0.1.20 or earlier has no `renew` events and no `deadline`, and its `claim`
+  lines have no `template`, `net` or `size`.
 - **Filters:** `tenant` keeps one tenant's events; `since` (inclusive) and
   `until` (exclusive) are RFC 3339 times compared with `t`. Each is optional.
   A journal written by v0.1.20 or earlier stamps `tenant` only on `claim`,
diff --git a/sandboxd/pool/archive.go b/sandboxd/pool/archive.go
index 2b379f680..0af6eaaa4 100644
--- a/sandboxd/pool/archive.go
+++ b/sandboxd/pool/archive.go
@@ -146,7 +146,8 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	snap, vmName, sock, prevDeadline, prevPending, replica := sb.HibernateSnap, sb.VMName, sb.VsockSocket, sb.Deadline, sb.ArchivePending, sb.ReplicaCk
 	sb.ArchiveCk, sb.ArchiveEpoch, sb.ArchivePending, sb.ReplicaCk = ck.ID, epoch, "", ""
 	sb.HibernateSnap, sb.VsockSocket, sb.VMName = "", "", ""
-	sb.Deadline = m.retentionDeadline(sb.Key)
+	retention := m.retentionDeadline(sb.Key)
+	sb.Deadline = retention
 	js := m.store.set(sb)
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
@@ -176,7 +177,7 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 		m.deleteOrphanArchiveCk(ctx, replica)
 	}
 	m.counters.archives.Add(1)
-	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant})
+	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant, Deadline: retention})
 	return nil
 }
 
@@ -245,7 +246,7 @@ func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string,
 		return "", ErrUnknownSandbox
 	}
 	m.counters.unarchives.Add(1)
-	m.recordUsage(ctx, usage.Event{Event: "unarchive", ID: sb.ID, Reference: ck, Tenant: sb.Tenant})
+	m.recordUsage(ctx, usage.Event{Event: "unarchive", ID: sb.ID, Reference: ck, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
 	return built.VsockSocket, nil
 }
 
diff --git a/sandboxd/pool/claim.go b/sandboxd/pool/claim.go
index 0f9e4c12b..607a3606a 100644
--- a/sandboxd/pool/claim.go
+++ b/sandboxd/pool/claim.go
@@ -198,6 +198,7 @@ func (m *Manager) Renew(ctx context.Context, id string, cred Cred, ttl time.Dura
 		return time.Time{}, fmt.Errorf("renew %s: persist claims: %w", id, err)
 	}
 	sb.Touch()
+	m.recordUsage(ctx, usage.Event{Event: "renew", ID: id, Tenant: sb.Tenant, Deadline: deadline})
 	return deadline, nil
 }
 
@@ -458,8 +459,11 @@ func (m *Manager) finalize(ctx context.Context, sb *types.Sandbox, ttl time.Dura
 // finalizeBatch persists the batch as one write, all-or-nothing; one tenant per batch.
 func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl time.Duration, claimRefPrefix string, inherited bool) error {
 	now := time.Now()
-	for _, sb := range sbs {
+	// A renew can move the deadline once the claim is visible
+	deadlines := make([]time.Time, len(sbs))
+	for i, sb := range sbs {
 		stampIdentity(sb, clampTTL(ttl))
+		deadlines[i] = sb.Deadline
 		if claimRefPrefix != "" {
 			sb.ClaimRef = claimRefPrefix + sb.ID
 		}
@@ -502,17 +506,24 @@ func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl t
 		}
 	}
 	// usage lands only after the batch armed, so a rollback leaves no unterminated claim event
-	for _, sb := range sbs {
+	for i, sb := range sbs {
 		m.recordUsage(ctx, usage.Event{
 			Event: "claim",
 			ID:    sb.ID, VMName: sb.VMName,
-			KeyHash: sb.Key.Hash(), Template: sb.Key.Template, Size: string(sb.Key.Size), Tenant: sb.Tenant,
+			KeyHash: sb.Key.Hash(), Template: sb.Key.Template, Net: string(sb.Key.Net), Size: string(sb.Key.Size),
+			Tenant: sb.Tenant, Deadline: deadlines[i],
 			Volumes: types.VolumeNames(sb.Volumes), VolumesRW: types.VolumeRWNames(sb.Volumes),
 		})
 	}
 	return nil
 }
 
+func (m *Manager) deadlineOf(sb *types.Sandbox) time.Time {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return sb.Deadline
+}
+
 // rollbackClaim unwinds a claim batch: a NIC that cannot be locked is never handed out.
 func (m *Manager) rollbackClaim(ctx context.Context, sbs []*types.Sandbox) {
 	m.mu.Lock()
@@ -660,7 +671,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.purgeArchiveCk(ctx, v.id, v.ck, v.tenant)
 			m.untrack(m.pendingCks, v.ck)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: "reap", ID: v.id, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, Tenant: v.tenant})
 			logger.Infof(ctx, "purged archived sandbox %s", v.id)
 		case reapArchive:
 			logSweepResult(ctx, logger, m.archive(ctx, v.sb), "archived expired sandbox "+v.id, "archive expired sandbox "+v.id)
@@ -672,7 +683,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.out.Disarm(v.id, m.removeOrRetry(ctx, v.vmName, v.id, td))
 			m.dropSnap(ctx, v.snap)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: "reap", ID: v.id, VMName: v.vmName, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, VMName: v.vmName, Tenant: v.tenant})
 			logger.Infof(ctx, "reaped expired sandbox %s (%s)", v.id, v.vmName)
 		}
 	})
diff --git a/sandboxd/pool/egress_test.go b/sandboxd/pool/egress_test.go
index 12f05bf23..cc9cbf59a 100644
--- a/sandboxd/pool/egress_test.go
+++ b/sandboxd/pool/egress_test.go
@@ -321,6 +321,9 @@ func TestQuarantineFailedRemoveStaysUnswept(t *testing.T) {
 	if !gotKeep["tap-q1"] {
 		t.Error("failed-remove VM's journal tap not kept; the sweep would unlock a running guest")
 	}
+	if evs := usageJournal(t, m); len(evs) != 1 || evs[0].ID != sb.ID || evs[0].Event != "reap" || evs[0].Reference != endQuarantined {
+		t.Errorf("usage events of a quarantined claim: %+v, want one reap naming the quarantine", evs)
+	}
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if _, ok := m.claimed["sb_q1"]; ok {
diff --git a/sandboxd/pool/hibernate.go b/sandboxd/pool/hibernate.go
index 9e91ddef3..614d7cefe 100644
--- a/sandboxd/pool/hibernate.go
+++ b/sandboxd/pool/hibernate.go
@@ -208,7 +208,7 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 	}
 	m.counters.wakes.Add(1)
 	m.counters.wakeNanos.Add(uint64(time.Since(wakeStart))) //nolint:gosec // durations are positive
-	m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant})
+	m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
 	if proxyErr := m.out.ArmProxy(ctx, sb); proxyErr != nil {
 		log.WithFunc("pool.wakeOrRead").Errorf(ctx, proxyErr, "arm egress proxy %s", sb.ID)
 	}
diff --git a/sandboxd/pool/reconcile.go b/sandboxd/pool/reconcile.go
index a116b5800..7339a2d6c 100644
--- a/sandboxd/pool/reconcile.go
+++ b/sandboxd/pool/reconcile.go
@@ -15,9 +15,15 @@ import (
 	"github.com/cocoonstack/sandbox/sandboxd/archives"
 	"github.com/cocoonstack/sandbox/sandboxd/engine"
 	"github.com/cocoonstack/sandbox/sandboxd/types"
+	"github.com/cocoonstack/sandbox/sandboxd/usage"
 	"github.com/cocoonstack/sandbox/sandboxd/utils"
 )
 
+const (
+	endVMGone      = "vm_gone"
+	endQuarantined = "quarantined"
+)
+
 // Reconcile aligns claims and VMs after a restart; it runs before the server because it swaps in fresh records that would bypass in-flight Transition locks.
 func (m *Manager) Reconcile(ctx context.Context) error {
 	claims, err := m.store.load()
@@ -38,7 +44,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 
 	owned := map[string]bool{}
 	referenced := map[string]bool{}
-	var adopted []*types.Sandbox
+	var adopted, dropped []*types.Sandbox
 	m.mu.Lock()
 	for _, sb := range claims {
 		sb.SetEnv(sb.Env)
@@ -63,6 +69,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 			// the VMM died with the host or on its own; the liveness pass restarts or fails it
 			sb.PendingSnap = ""
 		default:
+			dropped = append(dropped, sb)
 			continue
 		}
 		m.addClaimLocked(sb)
@@ -80,6 +87,12 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 	for _, sb := range adopted {
 		m.recordHibernate(ctx, sb)
 	}
+	// A failed save keeps the record, so the next boot drops it and records its end
+	if saveErr == nil {
+		for _, sb := range dropped {
+			m.recordEnd(ctx, sb, endVMGone)
+		}
+	}
 	logger := log.WithFunc("pool.Reconcile")
 	if err := m.ckpts.SweepStaging(); err != nil {
 		logger.Error(ctx, err, "sweep checkpoint staging")
@@ -261,10 +274,16 @@ func (m *Manager) resyncEgress(ctx context.Context, live map[string]types.VMReco
 func (m *Manager) quarantineClaim(ctx context.Context, sb *types.Sandbox) bool {
 	td := m.quiesceVolumes(ctx, sb)
 	gone := m.removeOrRetry(ctx, sb.VMName, sb.ID, td)
-	m.forgetClaim(ctx, sb)
+	if _, ok := m.forgetClaim(ctx, sb); ok {
+		m.recordEnd(ctx, sb, endQuarantined)
+	}
 	return gone
 }
 
+func (m *Manager) recordEnd(ctx context.Context, sb *types.Sandbox, reason string) {
+	m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Reference: reason})
+}
+
 // readoptEgressTap records and returns a live egress claim's tap, "" when there is none.
 func (m *Manager) readoptEgressTap(sb *types.Sandbox, live map[string]types.VMRecord) string {
 	rec, ok := live[sb.VMName]
diff --git a/sandboxd/pool/telemetry.go b/sandboxd/pool/telemetry.go
index 5ba945c45..94f3d0da5 100644
--- a/sandboxd/pool/telemetry.go
+++ b/sandboxd/pool/telemetry.go
@@ -20,6 +20,7 @@ const (
 	AuditLineCap = 4096
 
 	egressEvent = "egress"
+	reapEvent   = "reap"
 )
 
 // Counters is a monotonic snapshot for /metrics; gauges come from Info.
diff --git a/sandboxd/pool/telemetry_test.go b/sandboxd/pool/telemetry_test.go
index 1849ab83a..25199a37f 100644
--- a/sandboxd/pool/telemetry_test.go
+++ b/sandboxd/pool/telemetry_test.go
@@ -146,8 +146,11 @@ func TestTenantStampedInJournals(t *testing.T) {
 			if ev.Tenant != "acme" {
 				t.Errorf("claim event tenant %q, want acme", ev.Tenant)
 			}
-			if ev.Template != testKey.Template || ev.Size != string(testKey.Size) {
-				t.Errorf("claim event template %q size %q, want %q %q", ev.Template, ev.Size, testKey.Template, testKey.Size)
+			if ev.Template != testKey.Template || ev.Net != string(testKey.Net) || ev.Size != string(testKey.Size) {
+				t.Errorf("claim event template %q net %q size %q, want the key %+v", ev.Template, ev.Net, ev.Size, testKey)
+			}
+			if !ev.Deadline.Equal(sb.Deadline) {
+				t.Errorf("claim event deadline %v, want %v", ev.Deadline, sb.Deadline)
 			}
 		}
 	}
@@ -167,6 +170,9 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 		t.Fatalf("claim: %v", err)
 	}
 	cred := Cred{Token: sb.Token}
+	if _, err = m.Renew(ctx, sb.ID, cred, time.Hour, ""); err != nil {
+		t.Fatalf("renew: %v", err)
+	}
 	if err = m.Hibernate(ctx, sb.ID, cred); err != nil {
 		t.Fatalf("hibernate: %v", err)
 	}
@@ -197,13 +203,109 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 			t.Errorf("%s event of %s carries tenant %q, want acme", ev.Event, ev.ID, ev.Tenant)
 		}
 	}
-	for _, kind := range []string{"claim", "hibernate", "wake", "fork", "checkpoint", "promote", "release", "reap"} {
+	for _, kind := range []string{"claim", "renew", "hibernate", "wake", "fork", "checkpoint", "promote", "release", "reap"} {
 		if !kinds[kind] {
 			t.Errorf("no %s event in the journal", kind)
 		}
 	}
 }
 
+func TestEveryEventThatMovesTheDeadlineStatesIt(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(3600))
+	ctx := t.Context()
+	sb := mustClaim(t, m, testKey)
+	cred := Cred{Token: sb.Token}
+	assertDeadline := func(kind string) {
+		t.Helper()
+		evs := usageJournal(t, m)
+		last := evs[len(evs)-1]
+		if want := m.deadlineOf(sb); last.Event != kind || want.IsZero() || !last.Deadline.Equal(want) {
+			t.Errorf("last event %s deadline %v, want %s deadline %v", last.Event, last.Deadline, kind, want)
+		}
+	}
+	assertDeadline("claim")
+	if _, err := m.Renew(ctx, sb.ID, cred, 2*time.Hour, ""); err != nil {
+		t.Fatalf("renew: %v", err)
+	}
+	assertDeadline("renew")
+	if err := m.Hibernate(ctx, sb.ID, cred); err != nil {
+		t.Fatalf("hibernate: %v", err)
+	}
+	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake: %v", err)
+	}
+	assertDeadline("wake")
+	mustArchive(t, m, sb)
+	assertDeadline("archive")
+	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake archived: %v", err)
+	}
+	assertDeadline("unarchive")
+}
+
+func TestAnArchiveKeptForeverStatesNoDeadline(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(0))
+	sb := mustClaim(t, m, testKey)
+	mustArchive(t, m, sb)
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; last.Event != "archive" || !last.Deadline.IsZero() {
+		t.Errorf("last event %s deadline %v, want an archive without one", last.Event, last.Deadline)
+	}
+}
+
+func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	lost, err := m.ClaimProvision(t.Context(), testKey, ClaimOptions{TTL: time.Hour, Tenant: "acme"})
+	if err != nil {
+		t.Fatalf("claim: %v", err)
+	}
+	kept := mustClaim(t, m, testKey)
+	delete(eng.vms, lost.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	if err = m2.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m2, lost.ID), "claim,reap"; got != want {
+		t.Errorf("events of the dropped claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, m2, kept.ID), "claim"; got != want {
+		t.Errorf("events of the kept claim %s, want %s", got, want)
+	}
+	evs := usageJournal(t, m2)
+	if last := evs[len(evs)-1]; last.Reference != endVMGone || last.Tenant != "acme" || last.VMName != lost.VMName {
+		t.Errorf("reap of the dropped claim %+v, want vm_gone of %s under acme", last, lost.VMName)
+	}
+}
+
+func TestReconcileRecordsTheEndOnceTheDropIsDurable(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	sb := mustClaim(t, m, testKey)
+	delete(eng.vms, sb.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	restore := breakClaimStore(t, m2)
+	if err := m2.Reconcile(t.Context()); err == nil {
+		t.Fatal("Reconcile with claims.json unwritable succeeded")
+	}
+	if got, want := usageEventsOf(t, m2, sb.ID), "claim"; got != want {
+		t.Errorf("events after a failed save %s, want %s", got, want)
+	}
+	restore()
+
+	m3 := newTestManagerAt(t, eng, dir)
+	if err := m3.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m3, sb.ID), "claim,reap"; got != want {
+		t.Errorf("events after the next boot %s, want %s", got, want)
+	}
+}
+
 func TestSandboxesIndexOmitsTokens(t *testing.T) {
 	eng := newFakeEngine()
 	m := newTestManager(t, eng)
diff --git a/sandboxd/server/usage_test.go b/sandboxd/server/usage_test.go
index cda35815c..0dc09e50c 100644
--- a/sandboxd/server/usage_test.go
+++ b/sandboxd/server/usage_test.go
@@ -32,14 +32,14 @@ func TestUsageIsRootOnlyAndNamesAMissingStore(t *testing.T) {
 func TestUsagePassesTheQueryAndPages(t *testing.T) {
 	t0 := time.Date(2026, 10, 30, 1, 2, 3, 400000000, time.UTC)
 	reader := &fakeUsage{recs: []usage.Record{
-		{Cursor: 7, Node: "n1", Digest: [32]byte{1}, Event: usage.Event{Time: t0, Event: "claim", ID: "sb_1", Template: "rt:24.04", Size: "xlarge", Tenant: "acme"}},
+		{Cursor: 7, Node: "n1", Digest: [32]byte{1}, Event: usage.Event{Time: t0, Event: "claim", ID: "sb_1", Template: "rt:24.04", Net: "egress", Size: "xlarge", Tenant: "acme", Deadline: t0}},
 		{Cursor: 9, Node: "n2", Event: usage.Event{Time: t0, Event: "release", ID: "sb_1"}},
 	}}
 	ts := usageTestServer(t, reader)
 	resp := doReq(t, http.MethodGet, ts.URL+"/v1/usage?tenant=acme&since=2026-10-30T00:00:00Z&until=2026-10-31T00:00:00.5%2B08:00&after=5&limit=2", "root", "")
 	body, _ := io.ReadAll(resp.Body)
 	_ = resp.Body.Close()
-	want := `{"events":[{"cursor":7,"node":"n1","t":"2026-10-30T01:02:03.4Z","ev":"claim","id":"sb_1","template":"rt:24.04","size":"xlarge","tenant":"acme"},` +
+	want := `{"events":[{"cursor":7,"node":"n1","t":"2026-10-30T01:02:03.4Z","ev":"claim","id":"sb_1","template":"rt:24.04","net":"egress","size":"xlarge","tenant":"acme","deadline":"2026-10-30T01:02:03.4Z"},` +
 		`{"cursor":9,"node":"n2","t":"2026-10-30T01:02:03.4Z","ev":"release","id":"sb_1"}],"next":9}`
 	if resp.StatusCode != http.StatusOK || string(body) != want {
 		t.Errorf("full page: %d %s, want %s", resp.StatusCode, body, want)
diff --git a/sandboxd/usage/pg/pg.go b/sandboxd/usage/pg/pg.go
index cd7c7aa5a..0f1d3869c 100644
--- a/sandboxd/usage/pg/pg.go
+++ b/sandboxd/usage/pg/pg.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/cocoonstack/sandbox/sandboxd/metastore"
@@ -22,11 +23,11 @@ const (
 	// cellLock serializes a cell's lands, so cursors commit in order and a reader paging by cursor never skips a row.
 	cellLock = `SELECT pg_advisory_xact_lock(hashtextextended('sandboxd_usage/' || $1, 0))`
 
-	insertRow = `INSERT INTO sandboxd_usage (cell, node, line_sha256, t, ev, id, vm, key, template, size, tenant, volumes, volumes_rw, children, ref, upstream, secret, tx, rx)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+	insertRow = `INSERT INTO sandboxd_usage (cell, node, line_sha256, t, ev, id, vm, key, template, net, size, tenant, deadline, volumes, volumes_rw, children, ref, upstream, secret, tx, rx)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21)
 		ON CONFLICT (cell, node, line_sha256) DO NOTHING`
 
-	listColumns = `cursor, node, t, ev, id, vm, key, template, size, tenant, volumes, volumes_rw, children, ref, upstream, secret, tx, rx`
+	listColumns = `cursor, node, t, ev, id, vm, key, template, net, size, tenant, deadline, volumes, volumes_rw, children, ref, upstream, secret, tx, rx`
 )
 
 //go:embed schema.sql
@@ -71,7 +72,8 @@ func (s *Store) Land(ctx context.Context, recs []usage.Record) error {
 		}
 		var batch pgx.Batch
 		for _, r := range recs {
-			batch.Queue(insertRow, s.cell, r.Node, r.Digest[:], r.Time, r.Event.Event, r.ID, r.VMName, r.KeyHash, r.Template, r.Size, r.Tenant, r.Volumes, r.VolumesRW, r.Children,
+			batch.Queue(insertRow, s.cell, r.Node, r.Digest[:], r.Time, r.Event.Event, r.ID, r.VMName, r.KeyHash, r.Template, r.Net, r.Size, r.Tenant,
+				pgtype.Timestamptz{Time: r.Deadline, Valid: !r.Deadline.IsZero()}, r.Volumes, r.VolumesRW, r.Children,
 				strings.ReplaceAll(r.Reference, "\x00", "\uFFFD"), r.Upstream, r.Secret, r.Sent, r.Received)
 		}
 		return tx.SendBatch(qctx, &batch).Close()
@@ -112,11 +114,13 @@ func (s *Store) Close() {
 
 func scan(row pgx.CollectableRow) (usage.Record, error) {
 	var rec usage.Record
-	err := row.Scan(&rec.Cursor, &rec.Node, &rec.Time, &rec.Event.Event, &rec.ID, &rec.VMName, &rec.KeyHash, &rec.Template, &rec.Size, &rec.Tenant,
+	var deadline pgtype.Timestamptz
+	err := row.Scan(&rec.Cursor, &rec.Node, &rec.Time, &rec.Event.Event, &rec.ID, &rec.VMName, &rec.KeyHash, &rec.Template, &rec.Net, &rec.Size, &rec.Tenant, &deadline,
 		&rec.Volumes, &rec.VolumesRW, &rec.Children, &rec.Reference, &rec.Upstream, &rec.Secret, &rec.Sent, &rec.Received)
 	if err != nil {
 		return usage.Record{}, fmt.Errorf("scan usage row: %w", err)
 	}
 	rec.Time = rec.Time.UTC()
+	rec.Deadline = deadline.Time.UTC()
 	return rec, nil
 }
diff --git a/sandboxd/usage/pg/pg_test.go b/sandboxd/usage/pg/pg_test.go
index 773a6f35b..1924a797a 100644
--- a/sandboxd/usage/pg/pg_test.go
+++ b/sandboxd/usage/pg/pg_test.go
@@ -25,7 +25,7 @@ func TestLandListsInCursorOrderAndResumesFromTheMark(t *testing.T) {
 	}
 	t0 := time.Date(2026, 10, 30, 0, 0, 0, 0, time.UTC)
 	full := usage.Event{
-		Time: t0.Add(time.Microsecond), Event: "claim", ID: "sb_1", VMName: "sbx-1", KeyHash: "k", Template: "rt:24.04", Size: "xlarge", Tenant: "acme",
+		Time: t0.Add(time.Microsecond), Event: "claim", ID: "sb_1", VMName: "sbx-1", KeyHash: "k", Template: "rt:24.04", Net: "egress", Size: "xlarge", Tenant: "acme", Deadline: t0.Add(time.Hour),
 		Volumes: []string{"data", "ro"}, VolumesRW: []string{"data"}, Reference: "ref", Upstream: "up:1", Secret: "gh", Sent: 7, Received: 9,
 	}
 	land(t, s, record("n1", 1, full), record("n2", 1, usage.Event{Time: t0, Event: "claim", ID: "sb_2"}))
@@ -38,6 +38,10 @@ func TestLandListsInCursorOrderAndResumesFromTheMark(t *testing.T) {
 	if got := recs[0]; got.Node != "n1" || !equalEvents(got.Event, full) {
 		t.Errorf("first record %+v, want n1 %+v", got, full)
 	}
+	var nulls int
+	if err := s.pool.QueryRow(ctx, `SELECT count(*) FROM sandboxd_usage WHERE id = 'sb_2' AND deadline IS NULL`).Scan(&nulls); err != nil || nulls != 1 || !recs[1].Deadline.IsZero() {
+		t.Errorf("a line without a deadline: %d NULL rows, %v, reads back %v", nulls, err, recs[1].Deadline)
+	}
 	if !slices.IsSortedFunc(recs, func(a, b usage.Record) int { return cmp.Compare(a.Cursor, b.Cursor) }) || recs[2].Children[0] != "sb_3" {
 		t.Errorf("records out of cursor order or lost children: %+v", recs)
 	}
diff --git a/sandboxd/usage/pg/schema.sql b/sandboxd/usage/pg/schema.sql
index 6fc7cf813..92e58309e 100644
--- a/sandboxd/usage/pg/schema.sql
+++ b/sandboxd/usage/pg/schema.sql
@@ -9,8 +9,10 @@ CREATE TABLE IF NOT EXISTS sandboxd_usage (
     vm          text        NOT NULL DEFAULT '',
     key         text        NOT NULL DEFAULT '',
     template    text        NOT NULL DEFAULT '',
+    net         text        NOT NULL DEFAULT '',
     size        text        NOT NULL DEFAULT '',
     tenant      text        NOT NULL DEFAULT '',
+    deadline    timestamptz,
     volumes     text[],
     volumes_rw  text[],
     children    text[],
diff --git a/sandboxd/usage/usage.go b/sandboxd/usage/usage.go
index 09ba5f8ab..729178618 100644
--- a/sandboxd/usage/usage.go
+++ b/sandboxd/usage/usage.go
@@ -17,8 +17,10 @@ type Event struct {
 	VMName    string    `json:"vm,omitempty"`
 	KeyHash   string    `json:"key,omitempty"`
 	Template  string    `json:"template,omitempty"`
+	Net       string    `json:"net,omitempty"`
 	Size      string    `json:"size,omitempty"`
 	Tenant    string    `json:"tenant,omitempty"`
+	Deadline  time.Time `json:"deadline,omitzero"`
 	Volumes   []string  `json:"volumes,omitempty"`
 	VolumesRW []string  `json:"volumes_rw,omitempty"`
 	Children  []string  `json:"children,omitempty"`

From 7fbcd86e3b5f32754eb3395515f3f30eaa7faedd Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 13:09:34 +0800
Subject: [PATCH 2/7] usage: derive the claim deadline and inline the reap
 reasons

ClaimedAt plus the clamped lease is the stamped deadline and nothing moves ClaimedAt, so the claim path needs no captured slice. The reap reasons each have one call site, and quarantineClaim runs only inside Reconcile, before anything can race its forget. The docs state that an archive without a deadline leaves its span unbounded.
---
 docs/sandboxd-api.md            |  6 +++---
 sandboxd/pool/claim.go          |  9 +++------
 sandboxd/pool/egress_test.go    |  2 +-
 sandboxd/pool/reconcile.go      | 12 +++---------
 sandboxd/pool/telemetry_test.go |  2 +-
 5 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/docs/sandboxd-api.md b/docs/sandboxd-api.md
index 15e531e46..fff1ebd5a 100644
--- a/docs/sandboxd-api.md
+++ b/docs/sandboxd-api.md
@@ -1018,8 +1018,7 @@ Always on: every lifecycle transition appends one JSONL event to
 events), `template`, `net` and `size` (the claim's template, lane and size
 tier, claim events, so a consumer can price a sandbox by its shape without the
 claim record, which is gone after release; `size` sets the CPU and memory,
-while `template` is only a label, because a promoted template's name is the
-caller's choice), `deadline` (the deadline in force after this event: `claim`,
+and `template` is a label, since promote lets the caller name it), `deadline` (the deadline in force after this event: `claim`,
 `renew`, `wake` and `unarchive` carry the lease, `archive` the retention end, or
 nothing for an archive kept forever), `tenant` (the owning tenant, on every event of a
 tenant's claim), `children` (fork) and `ref` (the promoted template / checkpoint
@@ -1040,7 +1039,8 @@ point, and `vmm_failed` is informational; hibernated storage seconds =
 Σ(hibernate→wake) minus the archived span; archived storage seconds =
 Σ(archive→unarchive/archive_delete), a cheaper store tier than a hibernated
 VM's RAM. An interval left open by a crash, or by a node that never returns,
-clamps to the last `deadline` among the claim's events. Reconcile ends a claim
+clamps to the last `deadline` among the claim's events; an `archive` without
+one leaves its span unbounded. Reconcile ends a claim
 it drops with a `reap`: `ref` is `vm_gone` when the VM record is gone and
 `quarantined` when it cannot re-lock the egress NIC. Its `t` is the node's
 return, so clamp it the same way. The `vm` name joins
diff --git a/sandboxd/pool/claim.go b/sandboxd/pool/claim.go
index 607a3606a..80125f950 100644
--- a/sandboxd/pool/claim.go
+++ b/sandboxd/pool/claim.go
@@ -459,11 +459,8 @@ func (m *Manager) finalize(ctx context.Context, sb *types.Sandbox, ttl time.Dura
 // finalizeBatch persists the batch as one write, all-or-nothing; one tenant per batch.
 func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl time.Duration, claimRefPrefix string, inherited bool) error {
 	now := time.Now()
-	// A renew can move the deadline once the claim is visible
-	deadlines := make([]time.Time, len(sbs))
-	for i, sb := range sbs {
+	for _, sb := range sbs {
 		stampIdentity(sb, clampTTL(ttl))
-		deadlines[i] = sb.Deadline
 		if claimRefPrefix != "" {
 			sb.ClaimRef = claimRefPrefix + sb.ID
 		}
@@ -506,12 +503,12 @@ func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl t
 		}
 	}
 	// usage lands only after the batch armed, so a rollback leaves no unterminated claim event
-	for i, sb := range sbs {
+	for _, sb := range sbs {
 		m.recordUsage(ctx, usage.Event{
 			Event: "claim",
 			ID:    sb.ID, VMName: sb.VMName,
 			KeyHash: sb.Key.Hash(), Template: sb.Key.Template, Net: string(sb.Key.Net), Size: string(sb.Key.Size),
-			Tenant: sb.Tenant, Deadline: deadlines[i],
+			Tenant: sb.Tenant, Deadline: sb.ClaimedAt.Add(clampTTL(ttl)),
 			Volumes: types.VolumeNames(sb.Volumes), VolumesRW: types.VolumeRWNames(sb.Volumes),
 		})
 	}
diff --git a/sandboxd/pool/egress_test.go b/sandboxd/pool/egress_test.go
index cc9cbf59a..0b6ec37a2 100644
--- a/sandboxd/pool/egress_test.go
+++ b/sandboxd/pool/egress_test.go
@@ -321,7 +321,7 @@ func TestQuarantineFailedRemoveStaysUnswept(t *testing.T) {
 	if !gotKeep["tap-q1"] {
 		t.Error("failed-remove VM's journal tap not kept; the sweep would unlock a running guest")
 	}
-	if evs := usageJournal(t, m); len(evs) != 1 || evs[0].ID != sb.ID || evs[0].Event != "reap" || evs[0].Reference != endQuarantined {
+	if evs := usageJournal(t, m); len(evs) != 1 || evs[0].ID != sb.ID || evs[0].Event != "reap" || evs[0].Reference != "quarantined" {
 		t.Errorf("usage events of a quarantined claim: %+v, want one reap naming the quarantine", evs)
 	}
 	m.mu.Lock()
diff --git a/sandboxd/pool/reconcile.go b/sandboxd/pool/reconcile.go
index 7339a2d6c..3787789db 100644
--- a/sandboxd/pool/reconcile.go
+++ b/sandboxd/pool/reconcile.go
@@ -19,11 +19,6 @@ import (
 	"github.com/cocoonstack/sandbox/sandboxd/utils"
 )
 
-const (
-	endVMGone      = "vm_gone"
-	endQuarantined = "quarantined"
-)
-
 // Reconcile aligns claims and VMs after a restart; it runs before the server because it swaps in fresh records that would bypass in-flight Transition locks.
 func (m *Manager) Reconcile(ctx context.Context) error {
 	claims, err := m.store.load()
@@ -90,7 +85,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 	// A failed save keeps the record, so the next boot drops it and records its end
 	if saveErr == nil {
 		for _, sb := range dropped {
-			m.recordEnd(ctx, sb, endVMGone)
+			m.recordEnd(ctx, sb, "vm_gone")
 		}
 	}
 	logger := log.WithFunc("pool.Reconcile")
@@ -274,9 +269,8 @@ func (m *Manager) resyncEgress(ctx context.Context, live map[string]types.VMReco
 func (m *Manager) quarantineClaim(ctx context.Context, sb *types.Sandbox) bool {
 	td := m.quiesceVolumes(ctx, sb)
 	gone := m.removeOrRetry(ctx, sb.VMName, sb.ID, td)
-	if _, ok := m.forgetClaim(ctx, sb); ok {
-		m.recordEnd(ctx, sb, endQuarantined)
-	}
+	m.forgetClaim(ctx, sb)
+	m.recordEnd(ctx, sb, "quarantined")
 	return gone
 }
 
diff --git a/sandboxd/pool/telemetry_test.go b/sandboxd/pool/telemetry_test.go
index 25199a37f..7f580dd13 100644
--- a/sandboxd/pool/telemetry_test.go
+++ b/sandboxd/pool/telemetry_test.go
@@ -275,7 +275,7 @@ func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
 		t.Errorf("events of the kept claim %s, want %s", got, want)
 	}
 	evs := usageJournal(t, m2)
-	if last := evs[len(evs)-1]; last.Reference != endVMGone || last.Tenant != "acme" || last.VMName != lost.VMName {
+	if last := evs[len(evs)-1]; last.Reference != "vm_gone" || last.Tenant != "acme" || last.VMName != lost.VMName {
 		t.Errorf("reap of the dropped claim %+v, want vm_gone of %s under acme", last, lost.VMName)
 	}
 }

From 2e8a0a54c7e3f8f16d62d6f47307dc4ea487704d Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 13:17:13 +0800
Subject: [PATCH 3/7] usage: record the archive event before the wake can run

The archive event followed the teardown, outside Transition, so a wake during teardown journaled unarchive before archive: the archived span never closed and the retention end overrode the new lease. The event now lands under Transition right after the commit, which orders it against unarchive and survives a crash during teardown.
---
 sandboxd/pool/archive.go        |  7 +++----
 sandboxd/pool/telemetry_test.go | 27 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/sandboxd/pool/archive.go b/sandboxd/pool/archive.go
index 0af6eaaa4..4d433ff38 100644
--- a/sandboxd/pool/archive.go
+++ b/sandboxd/pool/archive.go
@@ -146,8 +146,7 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	snap, vmName, sock, prevDeadline, prevPending, replica := sb.HibernateSnap, sb.VMName, sb.VsockSocket, sb.Deadline, sb.ArchivePending, sb.ReplicaCk
 	sb.ArchiveCk, sb.ArchiveEpoch, sb.ArchivePending, sb.ReplicaCk = ck.ID, epoch, "", ""
 	sb.HibernateSnap, sb.VsockSocket, sb.VMName = "", "", ""
-	retention := m.retentionDeadline(sb.Key)
-	sb.Deadline = retention
+	sb.Deadline = m.retentionDeadline(sb.Key)
 	js := m.store.set(sb)
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
@@ -167,6 +166,8 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 		m.abandonArchive(ctx, sb, epoch, ck.ID)
 		return fmt.Errorf("archive %s: persist claims: %w", sb.ID, saveErr)
 	}
+	m.counters.archives.Add(1)
+	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant, Deadline: sb.Deadline})
 	// disarm under Transition so a wake right after the release is not clobbered by a late disarm
 	m.out.Disarm(sb.ID, true)
 	sb.Transition.Unlock()
@@ -176,8 +177,6 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	if replica != "" {
 		m.deleteOrphanArchiveCk(ctx, replica)
 	}
-	m.counters.archives.Add(1)
-	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant, Deadline: retention})
 	return nil
 }
 
diff --git a/sandboxd/pool/telemetry_test.go b/sandboxd/pool/telemetry_test.go
index 7f580dd13..82f6c3352 100644
--- a/sandboxd/pool/telemetry_test.go
+++ b/sandboxd/pool/telemetry_test.go
@@ -253,6 +253,33 @@ func TestAnArchiveKeptForeverStatesNoDeadline(t *testing.T) {
 	}
 }
 
+func TestArchiveEventPrecedesAWakeDuringItsTeardown(t *testing.T) {
+	eng := newFakeEngine()
+	m := newTestManager(t, eng, archivePool(3600))
+	ctx := t.Context()
+	sb := mustClaim(t, m, testKey)
+	if err := m.Hibernate(ctx, sb.ID, Cred{Token: sb.Token}); err != nil {
+		t.Fatalf("hibernate: %v", err)
+	}
+	stall := make(chan struct{})
+	eng.mu.Lock()
+	eng.removeStall = stall
+	eng.mu.Unlock()
+	archived := make(chan error, 1)
+	go func() { archived <- m.archive(ctx, sb) }()
+	waitFor(t, func() bool { return archivedCount(m) == 1 })
+	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake: %v", err)
+	}
+	close(stall)
+	if err := <-archived; err != nil {
+		t.Fatalf("archive: %v", err)
+	}
+	if got, want := usageEventsOf(t, m, sb.ID), "claim,hibernate,archive,unarchive"; got != want {
+		t.Errorf("events %s, want %s", got, want)
+	}
+}
+
 func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
 	eng := newFakeEngine()
 	dir := t.TempDir()

From 664e120372ee72142ce05e4cebfd3efa2bbf71aa Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 13:46:00 +0800
Subject: [PATCH 4/7] usage: record adoption and settle every reap at the last
 deadline

A replica is taken of a running claim, so after node loss the stream showed compute until the adopter's release or reap, up to the retention end if never woken. An adopt event ends that span and opens the archived one. The fold now closes every reap at min(t, last deadline), since t can follow the true end by the teardown, the downtime or the retention, and unarchive closes open hibernate and vmm_exit spans, which the rule had left out.
---
 docs/sandboxd-api.md          | 29 +++++++++++++++++++----------
 sandboxd/pool/failover.go     |  1 +
 sandboxd/pool/replica_test.go | 24 ++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 10 deletions(-)

diff --git a/docs/sandboxd-api.md b/docs/sandboxd-api.md
index fff1ebd5a..35850efb1 100644
--- a/docs/sandboxd-api.md
+++ b/docs/sandboxd-api.md
@@ -1013,14 +1013,14 @@ truth is the usage journal below.
 
 Always on: every lifecycle transition appends one JSONL event to
 `<data_dir>/usage.jsonl` — `{"t": <RFC3339>, "ev":
-"claim|renew|hibernate|wake|fork|checkpoint|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
+"claim|renew|hibernate|wake|fork|checkpoint|adopt|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
 "id": "sb_…", "vm": "sbx-…"}` plus `key` (the pool key's stable hash, claim
 events), `template`, `net` and `size` (the claim's template, lane and size
 tier, claim events, so a consumer can price a sandbox by its shape without the
 claim record, which is gone after release; `size` sets the CPU and memory,
 and `template` is a label, since promote lets the caller name it), `deadline` (the deadline in force after this event: `claim`,
-`renew`, `wake` and `unarchive` carry the lease, `archive` the retention end, or
-nothing for an archive kept forever), `tenant` (the owning tenant, on every event of a
+`renew`, `wake` and `unarchive` carry the lease, `archive` and `adopt` the retention
+end, or nothing for an archive kept forever), `tenant` (the owning tenant, on every event of a
 tenant's claim), `children` (fork) and `ref` (the promoted template / checkpoint
 id, the egress host, a `vmm_failed` reason, or why reconcile ended a claim). An egress event that injected credentials names
 them in `secret` (`gh,claim:<entry>`, never a value). An egress event routed through an
@@ -1031,19 +1031,28 @@ the subset of those names claimed `rw`, so billing can discriminate write
 access (mounts and host paths are not billing dimensions). The file rotates at
 64 MiB keeping one `.1` backup, so a tailing collector never loses a window
 silently. A last line a crash cut short is ended with a newline when the node
-reopens the journal, so it never swallows the next event. Folding rules: billable compute seconds per sandbox =
-Σ(claim→release/reap) − Σ(hibernate→wake) − Σ(vmm_exit→vmm_restart/release/reap);
+reopens the journal, so it never swallows the next event. Folding rules, in `t` order: billable compute seconds per sandbox =
+Σ(claim→release/reap) − Σ(hibernate→wake/unarchive) − Σ(vmm_exit→vmm_restart/unarchive/release/reap);
 `vmm_exit` is stamped when the node first finds the VMM gone, so an outage
 before sandboxd runs again (a host that was down) stays billed up to that
 point, and `vmm_failed` is informational; hibernated storage seconds =
-Σ(hibernate→wake) minus the archived span; archived storage seconds =
+Σ(hibernate→wake/unarchive/archive_delete) minus the archived span; archived storage seconds =
 Σ(archive→unarchive/archive_delete), a cheaper store tier than a hibernated
 VM's RAM. An interval left open by a crash, or by a node that never returns,
 clamps to the last `deadline` among the claim's events; an `archive` without
-one leaves its span unbounded. Reconcile ends a claim
+one leaves its span unbounded. Every `reap` closes compute at min(`t`, the last
+`deadline` among the claim's events), whatever its `ref`, because `t` can follow
+the true end by the reaper's tick, the VM's teardown, the node's downtime or an
+archive's retention; `release` closes at its `t`. A `hibernate` or `vmm_exit`
+span still open closes at the same instant, and a span is clipped to that close.
+A claim whose events carry no `deadline` closes at `t`. Reconcile ends a claim
 it drops with a `reap`: `ref` is `vm_gone` when the VM record is gone and
-`quarantined` when it cannot re-lock the egress NIC. Its `t` is the node's
-return, so clamp it the same way. The `vm` name joins
+`quarantined` when it cannot re-lock the egress NIC. An `adopt` names a claim
+another node took over after its node was lost, with `ref` the checkpoint it
+holds. With no `archive` open, it ends the claim's compute or hibernated span at
+min(`t`, the last `deadline` before it) and opens the archived span, and an
+`unarchive` then reopens compute, also after a `reap`; with an `archive` open it
+changes nothing. The `vm` name joins
 cocoon's machine-level metering ledger for audit cross-checks. With
 `meta_store.usage`, the node also lands every line in the cell's
 [shared usage table](deploy.md#shared-usage-table), read through
@@ -1060,7 +1069,7 @@ node of the cell from the [shared usage table](deploy.md#shared-usage-table).
   [usage.jsonl](#usage-journal-usagejsonl), `t` in UTC to the microsecond, plus
   `cursor` (its place in the table; one node's events follow its journal
   order) and `node` (the node that recorded it). A journal written by
-  v0.1.20 or earlier has no `renew` events and no `deadline`, and its `claim`
+  v0.1.20 or earlier has no `renew` or `adopt` events and no `deadline`, and its `claim`
   lines have no `template`, `net` or `size`.
 - **Filters:** `tenant` keeps one tenant's events; `since` (inclusive) and
   `until` (exclusive) are RFC 3339 times compared with `t`. Each is optional.
diff --git a/sandboxd/pool/failover.go b/sandboxd/pool/failover.go
index 432c26327..6c57a1ab4 100644
--- a/sandboxd/pool/failover.go
+++ b/sandboxd/pool/failover.go
@@ -72,6 +72,7 @@ func (m *Manager) adoptArchived(ctx context.Context, id, token string) (bool, er
 		m.forgetClaim(ctx, sb)
 		return false, fmt.Errorf("adopt %s: persist claims: %w", id, err)
 	}
+	m.recordUsage(ctx, usage.Event{Event: "adopt", ID: id, Reference: rec.Checkpoint, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
 	log.WithFunc("pool.AdoptArchived").Infof(ctx, "adopted archived sandbox %s from %s", id, rec.Owner)
 	return true, nil
 }
diff --git a/sandboxd/pool/replica_test.go b/sandboxd/pool/replica_test.go
index 0a157b61b..baf314cb8 100644
--- a/sandboxd/pool/replica_test.go
+++ b/sandboxd/pool/replica_test.go
@@ -777,6 +777,30 @@ func TestReplicaRestartAdoptsTheRowsCheckpointOfAnInterruptedRound(t *testing.T)
 	}
 }
 
+func TestAdoptingAReplicaRecordsItsCheckpointAndRetention(t *testing.T) {
+	c := newReplicaCluster(t)
+	a, b := c.node(t, "a", t.TempDir(), keepAnHour), c.node(t, "b", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	ck := a.replicaOf(sb)
+	c.expire("a")
+	if adopted, err := b.AdoptArchived(t.Context(), sb.ID, sb.Token); err != nil || !adopted {
+		t.Fatalf("adopt: %v %v", adopted, err)
+	}
+	moved, _ := b.byID(sb.ID)
+	evs := usageJournal(t, b)
+	last := evs[len(evs)-1]
+	if want := b.deadlineOf(moved); last.Event != "adopt" || last.ID != sb.ID || last.Reference != ck || want.IsZero() || !last.Deadline.Equal(want) {
+		t.Errorf("last event %+v, want an adopt of %s naming %s with deadline %v", last, sb.ID, ck, want)
+	}
+	if _, _, _, err := b.WakeAgentSocket(t.Context(), sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake: %v", err)
+	}
+	if got, want := usageEventsOf(t, b, sb.ID), "adopt,unarchive"; got != want {
+		t.Errorf("events on the adopter %s, want %s", got, want)
+	}
+}
+
 func TestReplicaRestartDropsAClaimAdoptedElsewhere(t *testing.T) {
 	c := newReplicaCluster(t)
 	dirA := t.TempDir()

From efb59a8aacf2ab81d5ad486a2d369f88d7e5b347 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 13:55:23 +0800
Subject: [PATCH 5/7] pool: do not hibernate a replicated claim while fenced

A fenced node may have lost the claim to an adopter, yet the idle sweep and the hibernate API still snapshotted its VM and journaled hibernate, which split billing between the adopter's compute and hibernated storage. Hibernate now answers ErrLeaseLost under the same gate the data plane uses; the idle sweep retries once the fence lifts.
---
 docs/cluster.md               |  4 +++-
 sandboxd/pool/hibernate.go    |  3 +++
 sandboxd/pool/pool.go         |  2 +-
 sandboxd/pool/replica_test.go | 14 ++++++++++++++
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/docs/cluster.md b/docs/cluster.md
index f40a47523..fea44433d 100644
--- a/docs/cluster.md
+++ b/docs/cluster.md
@@ -373,7 +373,9 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   claim's first replica included: the agent relay
   (including parked keep-alive relays, whose later RPCs never pass the
   resolution gate), the exec call, port relays and preview requests. A client
-  retries and meets the 503 until the lease is back or the claim moved.
+  retries and meets the 503 until the lease is back or the claim moved. Neither
+  an API call nor the idle sweep hibernates such a claim while the fence is
+  closed, so the node journals no `hibernate` for a claim another node may hold.
   Streams of claims that are not replicated stay open.
 - **Availability.** The design chooses consistency over availability for
   replicated claims. A registry outage longer than the fence threshold (12
diff --git a/sandboxd/pool/hibernate.go b/sandboxd/pool/hibernate.go
index 614d7cefe..60aa61e06 100644
--- a/sandboxd/pool/hibernate.go
+++ b/sandboxd/pool/hibernate.go
@@ -63,6 +63,9 @@ func (m *Manager) hibernateLocked(ctx context.Context, sb *types.Sandbox) error
 	if sb.ArchiveCk != "" {
 		return nil // already off the node
 	}
+	if _, err := m.fenceWatch(sb); err != nil {
+		return err
+	}
 	if sb.Failed != "" {
 		return ErrFailed
 	}
diff --git a/sandboxd/pool/pool.go b/sandboxd/pool/pool.go
index cd14662e2..f0d0cb238 100644
--- a/sandboxd/pool/pool.go
+++ b/sandboxd/pool/pool.go
@@ -801,7 +801,7 @@ func logSweepResult(ctx context.Context, logger *log.Fields, err error, okMsg, f
 
 func benignSweepErr(err error) bool {
 	return errors.Is(err, ErrUnknownSandbox) || errors.Is(err, errWokeMeanwhile) ||
-		errors.Is(err, ErrNoEgressHibernate) || errors.Is(err, ErrQuota)
+		errors.Is(err, ErrNoEgressHibernate) || errors.Is(err, ErrQuota) || errors.Is(err, ErrLeaseLost)
 }
 
 func vmName(key types.PoolKey) string {
diff --git a/sandboxd/pool/replica_test.go b/sandboxd/pool/replica_test.go
index baf314cb8..569908fff 100644
--- a/sandboxd/pool/replica_test.go
+++ b/sandboxd/pool/replica_test.go
@@ -588,6 +588,20 @@ func TestReplicaPassSnapshotsOnlyDueRunningClaims(t *testing.T) {
 	})
 }
 
+func TestAFencedNodeDoesNotHibernateAReplicatedClaim(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	replicated := mustClaim(t, a, testKey)
+	replicateNow(t, a, replicated)
+	a.tripFence()
+	if err := a.Hibernate(t.Context(), replicated.ID, Cred{Token: replicated.Token}); !errors.Is(err, ErrLeaseLost) {
+		t.Errorf("hibernate of a replicated claim while fenced: %v, want ErrLeaseLost", err)
+	}
+	if got, want := usageEventsOf(t, a, replicated.ID), "claim"; got != want {
+		t.Errorf("events of the replicated claim %s, want %s", got, want)
+	}
+}
+
 func TestReplicaPassSkipsWhileFenced(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		c := newReplicaCluster(t)

From a2e50438a401973eab2ca8fde0b0069ea422c779 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 14:03:37 +0800
Subject: [PATCH 6/7] pool: start retention on a replica row left with no claim

A replica row has no deadline, and the sweep purges an own row with no claim only past one. A claim reconcile dropped because its VM record was gone therefore kept its row and checkpoint forever if the client never came back. The hourly sweep now gives that row the pool's retention deadline: the claim stays adoptable until then, and the existing purge reclaims it. A compare-and-set on the epoch keeps this safe against an adoption, and a failed write retries on the next sweep. A keep-forever pool keeps the row.
---
 docs/cluster.md               |  5 ++-
 sandboxd/pool/failover.go     | 31 ++++++++++++-
 sandboxd/pool/replica_test.go | 84 +++++++++++++++++++++++++++++++++++
 3 files changed, 118 insertions(+), 2 deletions(-)

diff --git a/docs/cluster.md b/docs/cluster.md
index fea44433d..9acee5a72 100644
--- a/docs/cluster.md
+++ b/docs/cluster.md
@@ -332,7 +332,10 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   it; a claim whose row another node holds, or whose row a finished adopter
   consumed, is dropped with its VM. A replica row has no retention deadline: the
   hourly sweep never purges it, because no round refreshes it while the claim is
-  hibernated, and retention starts when the claim is archived or adopted. The
+  hibernated, and retention starts when the claim is archived or adopted. A row
+  the node still holds after reconcile dropped its claim, because the VM record
+  was gone, gains the retention deadline on that sweep: the claim stays adoptable
+  until it passes, and `archive_delete_after_seconds` 0 keeps the row. The
   rows of a node that never returns therefore stay until a client adopts them, a
   bounded residue of one row and up to two checkpoints per claim: the row's, and
   a committed pending replica or a previous replica the node died before
diff --git a/sandboxd/pool/failover.go b/sandboxd/pool/failover.go
index 6c57a1ab4..de1e55173 100644
--- a/sandboxd/pool/failover.go
+++ b/sandboxd/pool/failover.go
@@ -457,8 +457,11 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 	sb := m.claimed[rec.ID]
 	m.mu.Unlock()
 	if sb == nil {
-		if rec.Consumed || !rec.Deadline.IsZero() && now.After(rec.Deadline) {
+		switch {
+		case rec.Consumed || !rec.Deadline.IsZero() && now.After(rec.Deadline):
 			m.purgeArchiveRow(ctx, rec)
+		case rec.Deadline.IsZero():
+			m.startRowRetention(ctx, rec.ID, rec.Epoch)
 		}
 		return
 	}
@@ -479,6 +482,32 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 	}
 }
 
+func (m *Manager) startRowRetention(ctx context.Context, id string, epoch int64) {
+	logger := log.WithFunc("pool.startRowRetention")
+	rec, ok, err := m.archives.Get(ctx, id)
+	if err != nil {
+		logger.Warnf(ctx, "read archive row %s: %v", id, err)
+		return
+	}
+	if !ok || rec.Epoch != epoch {
+		return
+	}
+	sb := &types.Sandbox{}
+	if err = json.Unmarshal(rec.Claim, sb); err != nil {
+		logger.Warnf(ctx, "decode archive row %s: %v", id, err)
+		return
+	}
+	m.mu.Lock()
+	rec.Deadline = m.retentionDeadline(sb.Key)
+	m.mu.Unlock()
+	if rec.Deadline.IsZero() {
+		return
+	}
+	if _, err = m.archives.Replace(ctx, rec, epoch); err != nil && !errors.Is(err, archives.ErrLost) {
+		logger.Warnf(ctx, "start retention of archive row %s: %v", id, err)
+	}
+}
+
 func (m *Manager) dropStaleRow(ctx context.Context, sb *types.Sandbox, rec archives.Record) {
 	if !m.archiveCkPinned(rec.Checkpoint) {
 		m.abandonArchive(ctx, sb, rec.Epoch, rec.Checkpoint)
diff --git a/sandboxd/pool/replica_test.go b/sandboxd/pool/replica_test.go
index 569908fff..4af4f6e0c 100644
--- a/sandboxd/pool/replica_test.go
+++ b/sandboxd/pool/replica_test.go
@@ -815,6 +815,90 @@ func TestAdoptingAReplicaRecordsItsCheckpointAndRetention(t *testing.T) {
 	}
 }
 
+func TestAReplicaRowWithNoClaimLeftGainsRetentionAndIsPurged(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	lost, kept := mustClaim(t, a, testKey), mustClaim(t, a, testKey)
+	replicateNow(t, a, lost)
+	replicateNow(t, a, kept)
+	ck := a.replicaOf(lost)
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	delete(a.eng.(*fakeEngine).vms, lost.VMName)
+	restarted := c.restart(t, a)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+
+	restarted.sweepOrphanArchives(t.Context())
+	rec, ok, err := c.reg.Get(t.Context(), lost.ID)
+	if err != nil || !ok || rec.Deadline.IsZero() || !ckExists(t, restarted, ck) {
+		t.Fatalf("row of the dropped claim after a sweep: %+v %t %v, want it kept with a deadline", rec, ok, err)
+	}
+	liveRow, _, err := c.reg.Get(t.Context(), kept.ID)
+	if err != nil || !liveRow.Deadline.IsZero() {
+		t.Errorf("row of the live claim: %+v %v, want no deadline", liveRow, err)
+	}
+
+	rec.Deadline = time.Now().Add(-time.Second)
+	if _, err = c.reg.Replace(t.Context(), rec, rec.Epoch); err != nil {
+		t.Fatalf("age the row: %v", err)
+	}
+	restarted.sweepOrphanArchives(t.Context())
+	if _, ok, err = c.reg.Get(t.Context(), lost.ID); err != nil || ok || ckExists(t, restarted, ck) {
+		t.Errorf("row %t %v after retention, want the row and its checkpoint gone", ok, err)
+	}
+	if got, want := usageEventsOf(t, restarted, lost.ID), "claim,reap,archive_delete"; got != want {
+		t.Errorf("events %s, want %s", got, want)
+	}
+}
+
+func TestAReplicaRowWithNoClaimLeftStaysAdoptable(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	delete(a.eng.(*fakeEngine).vms, sb.VMName)
+	restarted := c.restart(t, a)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	restarted.sweepOrphanArchives(t.Context())
+	if adopted, err := restarted.AdoptArchived(t.Context(), sb.ID, sb.Token); err != nil || !adopted {
+		t.Errorf("adopt inside retention: %t %v", adopted, err)
+	}
+}
+
+func TestAReplicaRowOfAKeepForeverPoolKeepsNoDeadline(t *testing.T) {
+	c := newReplicaCluster(t)
+	dir := t.TempDir()
+	a := c.node(t, "a", dir, keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	eng := a.eng.(*fakeEngine)
+	delete(eng.vms, sb.VMName)
+	restarted := c.nodeOn(t, eng, "a", dir, 0)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	before, _, err := c.reg.Get(t.Context(), sb.ID)
+	if err != nil {
+		t.Fatalf("read row: %v", err)
+	}
+	restarted.sweepOrphanArchives(t.Context())
+	rec, ok, err := c.reg.Get(t.Context(), sb.ID)
+	if err != nil || !ok || !rec.Deadline.IsZero() || rec.Epoch != before.Epoch {
+		t.Errorf("row %+v %t %v, want it untouched at epoch %d", rec, ok, err, before.Epoch)
+	}
+}
+
 func TestReplicaRestartDropsAClaimAdoptedElsewhere(t *testing.T) {
 	c := newReplicaCluster(t)
 	dirA := t.TempDir()

From 6bebe8b6a11d1adc022d8207b9b3c8117a6ffa83 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Mon, 2 Nov 2026 15:16:42 +0800
Subject: [PATCH 7/7] usage: settle reaps on their own deadline and close the
 fence gaps

Review round. A fenced node refused hibernate but still woke a replicated claim, which restored its VM and journaled a wake a stale fold counted as compute; Wake now answers ErrLeaseLost. Renew stays open, since refusing it during a registry outage expires leases and widens the outage.

A reap now carries the deadline it ended under, so it settles without searching the stream and a lost renew line cannot shorten it. Reconcile records no vm_gone for a replicated claim when the registry did not answer, since it may be running elsewhere, and records the wake a crash lost, which left compute unbilled. The fold is a state table: the formula plus exceptions read two ways, and read literally billed compute across an adoption.

Cleanups: startRowRetention returns its error, the ticker and egress frame take the modern forms, tests share a restart helper, and comments that restate code go.
---
 docs/cluster.md                 |  20 ++--
 docs/sandboxd-api.md            |  63 ++++++------
 sandboxd/pool/archive.go        |   6 +-
 sandboxd/pool/claim.go          |  29 +++---
 sandboxd/pool/failover.go       |  27 +++--
 sandboxd/pool/hibernate.go      |   6 +-
 sandboxd/pool/operator.go       |   3 +
 sandboxd/pool/pool.go           |  25 ++---
 sandboxd/pool/reconcile.go      |  24 +++--
 sandboxd/pool/replica_test.go   | 169 +++++++++++++++++++-------------
 sandboxd/pool/telemetry.go      |   5 +-
 sandboxd/pool/telemetry_test.go |  96 +++++++++++++-----
 12 files changed, 278 insertions(+), 195 deletions(-)

diff --git a/docs/cluster.md b/docs/cluster.md
index 9acee5a72..a8e6248fd 100644
--- a/docs/cluster.md
+++ b/docs/cluster.md
@@ -299,8 +299,8 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   starts none, and a round whose registry is down fails before it captures.
 - **Restore.** A lost node's replica is adopted like an archive: the first
   `Lookup` that reaches another node after the lease expires takes the row,
-  records the claim as archived on the replica with the adopter pool's
-  retention window, and the next call wakes it
+  records the claim as archived on the replica with the row's retention deadline,
+  or the adopter pool's window when it has none, and the next call wakes it
   through the archive wake, which restores the guest with its memory and
   processes. The claim resumes from its last committed replica: everything
   after it, and the connections open at the time, are lost: up to the longer of
@@ -330,18 +330,18 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   checkpoint behind, the same residue as a node that never returns.
   A restart keeps the node's own live row for a running claim and takes the checkpoint a crashed round left on
   it; a claim whose row another node holds, or whose row a finished adopter
-  consumed, is dropped with its VM. A replica row has no retention deadline: the
-  hourly sweep never purges it, because no round refreshes it while the claim is
-  hibernated, and retention starts when the claim is archived or adopted. A row
-  the node still holds after reconcile dropped its claim, because the VM record
-  was gone, gains the retention deadline on that sweep: the claim stays adoptable
+  consumed, is dropped with its VM. A live claim's replica row has no retention
+  deadline: the hourly sweep never purges it, because no round refreshes it while
+  the claim is hibernated, and retention starts when the claim is archived or
+  adopted. A row the node holds with no claim, as after reconcile dropped it
+  because the VM record was gone, gains the retention deadline on that sweep: the claim stays adoptable
   until it passes, and `archive_delete_after_seconds` 0 keeps the row. The
   rows of a node that never returns therefore stay until a client adopts them, a
   bounded residue of one row and up to two checkpoints per claim: the row's, and
   a committed pending replica or a previous replica the node died before
   deleting. Their metas stay live, so offline reclamation keeps them.
   They are archive checkpoints (`"archive": true` in their meta) that no
-  registry row names, which an operator can delete. Apart from that and the
+  registry row names, which an operator can delete. Apart from these and the
   lease rule the sweep is unchanged.
 - **Self-fencing.** A node whose renewal is overdue by 12 seconds (the lease
   length minus a 3 second margin, counted from the start of the last renewal
@@ -377,8 +377,8 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   (including parked keep-alive relays, whose later RPCs never pass the
   resolution gate), the exec call, port relays and preview requests. A client
   retries and meets the 503 until the lease is back or the claim moved. Neither
-  an API call nor the idle sweep hibernates such a claim while the fence is
-  closed, so the node journals no `hibernate` for a claim another node may hold.
+  an API call nor the idle sweep starts a hibernate or a wake of such a claim
+  while the fence is closed, so an idle claim stays billed until the fence lifts.
   Streams of claims that are not replicated stay open.
 - **Availability.** The design chooses consistency over availability for
   replicated claims. A registry outage longer than the fence threshold (12
diff --git a/docs/sandboxd-api.md b/docs/sandboxd-api.md
index 35850efb1..1962935a8 100644
--- a/docs/sandboxd-api.md
+++ b/docs/sandboxd-api.md
@@ -491,7 +491,8 @@ archives. When to hibernate is the caller's policy — the
 node only provides the transition. 204 on success, 404 unknown id or wrong
 token, 409 on the egress lane or when volumes are attached (neither kind of
 sandbox hibernates; see [egress](egress.md)), 429 while the disk is under
-[`disk_reserve`](deploy.md).
+[`disk_reserve`](deploy.md), 503 `lease lost; retry` for a replicated claim that
+is not archived while its node's lease is overdue, even one already hibernated.
 
 ## POST /v1/sandboxes/{id}/wake
 
@@ -505,7 +506,8 @@ while stored, and waking it starts a fresh lease of the length the claim was gra
 [failed](deploy.md#dead-vmms-and-host-restarts) sandbox is cold-booted from
 its own disk (memory is lost) and its restart budget resets. 204 on
 success, 404 unknown id or wrong token, 409 a failed egress-lane or volume
-sandbox, or one whose VM record is gone, 500 when the cold boot itself fails.
+sandbox, or one whose VM record is gone, 500 when the cold boot itself fails,
+503 `lease lost; retry` for a replicated claim while its node's lease is overdue.
 
 ## POST /v1/sandboxes/{id}/renew
 
@@ -1014,13 +1016,15 @@ truth is the usage journal below.
 Always on: every lifecycle transition appends one JSONL event to
 `<data_dir>/usage.jsonl` — `{"t": <RFC3339>, "ev":
 "claim|renew|hibernate|wake|fork|checkpoint|adopt|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
-"id": "sb_…", "vm": "sbx-…"}` plus `key` (the pool key's stable hash, claim
+"id": "sb_…"}` plus `vm` (the VM's name; absent on `renew`, `adopt`, `archive`,
+`unarchive`, `archive_delete`, `egress`, `egress_bytes`, and the `reap` or
+`release` of an archived claim), `key` (the pool key's stable hash, claim
 events), `template`, `net` and `size` (the claim's template, lane and size
 tier, claim events, so a consumer can price a sandbox by its shape without the
 claim record, which is gone after release; `size` sets the CPU and memory,
 and `template` is a label, since promote lets the caller name it), `deadline` (the deadline in force after this event: `claim`,
 `renew`, `wake` and `unarchive` carry the lease, `archive` and `adopt` the retention
-end, or nothing for an archive kept forever), `tenant` (the owning tenant, on every event of a
+end, or nothing for an archive kept forever, and `reap` the deadline it ended under), `tenant` (the owning tenant, on every event of a
 tenant's claim), `children` (fork) and `ref` (the promoted template / checkpoint
 id, the egress host, a `vmm_failed` reason, or why reconcile ended a claim). An egress event that injected credentials names
 them in `secret` (`gh,claim:<entry>`, never a value). An egress event routed through an
@@ -1031,28 +1035,30 @@ the subset of those names claimed `rw`, so billing can discriminate write
 access (mounts and host paths are not billing dimensions). The file rotates at
 64 MiB keeping one `.1` backup, so a tailing collector never loses a window
 silently. A last line a crash cut short is ended with a newline when the node
-reopens the journal, so it never swallows the next event. Folding rules, in `t` order: billable compute seconds per sandbox =
-Σ(claim→release/reap) − Σ(hibernate→wake/unarchive) − Σ(vmm_exit→vmm_restart/unarchive/release/reap);
-`vmm_exit` is stamped when the node first finds the VMM gone, so an outage
-before sandboxd runs again (a host that was down) stays billed up to that
-point, and `vmm_failed` is informational; hibernated storage seconds =
-Σ(hibernate→wake/unarchive/archive_delete) minus the archived span; archived storage seconds =
-Σ(archive→unarchive/archive_delete), a cheaper store tier than a hibernated
-VM's RAM. An interval left open by a crash, or by a node that never returns,
-clamps to the last `deadline` among the claim's events; an `archive` without
-one leaves its span unbounded. Every `reap` closes compute at min(`t`, the last
-`deadline` among the claim's events), whatever its `ref`, because `t` can follow
-the true end by the reaper's tick, the VM's teardown, the node's downtime or an
-archive's retention; `release` closes at its `t`. A `hibernate` or `vmm_exit`
-span still open closes at the same instant, and a span is clipped to that close.
-A claim whose events carry no `deadline` closes at `t`. Reconcile ends a claim
-it drops with a `reap`: `ref` is `vm_gone` when the VM record is gone and
-`quarantined` when it cannot re-lock the egress NIC. An `adopt` names a claim
-another node took over after its node was lost, with `ref` the checkpoint it
-holds. With no `archive` open, it ends the claim's compute or hibernated span at
-min(`t`, the last `deadline` before it) and opens the archived span, and an
-`unarchive` then reopens compute, also after a `reap`; with an `archive` open it
-changes nothing. The `vm` name joins
+reopens the journal, so it never swallows the next event. Folding rules: fold a sandbox's events of all nodes in `t` order.
+An event ends the current span at its `t` and enters a state: `claim`, `wake`,
+`unarchive` and `vmm_restart` enter `running`, `hibernate` enters `hibernated`,
+`archive` enters `archived`, and `vmm_exit`, `archive_delete`, `release` and
+`reap` enter `ended`. Other events, `vmm_failed` included, change no state, and
+`reap`, `adopt` and `archive_delete` have the exceptions below.
+Billable compute, hibernated storage and archived storage seconds are the time
+in `running`, `hibernated` and `archived`, a cheaper store tier than a hibernated
+VM's RAM. `vmm_exit` is stamped when the node first finds the VMM gone, so an
+outage before sandboxd runs again (a host that was down) stays billed up to that
+point. A `reap` instead ends the current span at min(`t`, its `deadline`), or `t`
+with none, because `t` can follow the true end by the reaper's tick, the VM's
+teardown or the node's downtime. Outside `archived`, an `archive_delete` ends the
+current span at min(`t`, the last `deadline`), because a purge can follow a claim
+that has no end event by a whole retention window. An `adopt` names a claim
+a node took over, from a lost node or from its own lost record, with `ref` the
+checkpoint it holds. In `archived` it changes nothing; otherwise it ends the
+current span at min(`t`, the last `deadline` before it) and enters `archived` at
+its `t`. A span is never shorter than zero. A span still open ends at min(now,
+the last `deadline`), and one entered by an `archive` or `adopt` without a
+`deadline` stays open. A claim reconcile drops because its VM record is gone
+ends with a `reap` whose `ref` is `vm_gone`, and one that cannot re-lock its
+egress NIC with `quarantined`; a claim another node holds is dropped with no
+event, and neither has a replicated claim dropped while the registry is down. The `vm` name joins
 cocoon's machine-level metering ledger for audit cross-checks. With
 `meta_store.usage`, the node also lands every line in the cell's
 [shared usage table](deploy.md#shared-usage-table), read through
@@ -1069,8 +1075,9 @@ node of the cell from the [shared usage table](deploy.md#shared-usage-table).
   [usage.jsonl](#usage-journal-usagejsonl), `t` in UTC to the microsecond, plus
   `cursor` (its place in the table; one node's events follow its journal
   order) and `node` (the node that recorded it). A journal written by
-  v0.1.20 or earlier has no `renew` or `adopt` events and no `deadline`, and its `claim`
-  lines have no `template`, `net` or `size`.
+  v0.1.20 or earlier has no `renew` or `adopt` events and no `deadline`, a claim
+  reconcile dropped has no end event, and its `claim` lines have no `template`,
+  `net` or `size`.
 - **Filters:** `tenant` keeps one tenant's events; `since` (inclusive) and
   `until` (exclusive) are RFC 3339 times compared with `t`. Each is optional.
   A journal written by v0.1.20 or earlier stamps `tenant` only on `claim`,
diff --git a/sandboxd/pool/archive.go b/sandboxd/pool/archive.go
index 4d433ff38..603b60015 100644
--- a/sandboxd/pool/archive.go
+++ b/sandboxd/pool/archive.go
@@ -150,7 +150,6 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	js := m.store.set(sb)
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
-		// roll back so memory matches the still-durable hibernated record
 		m.mu.Lock()
 		var rb claimSnapshot
 		// a Release that landed meanwhile already deleted the claim; re-setting it would resurrect it
@@ -180,7 +179,7 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	return nil
 }
 
-// wakeArchived restores an archived claim into a fresh local VM; caller holds Transition.
+// Caller holds Transition.
 func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string, error) {
 	// egress never archives; a corrupt archived egress claim must fail closed.
 	if sb.Key.Net == types.NetEgress {
@@ -221,7 +220,7 @@ func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string,
 	}
 	live, saved := m.commitWake(ctx, sb, built.VMName, built.VsockSocket)
 	if !live || !saved {
-		m.destroy(ctx, built.VMName) // released, or persist rolled back to archived
+		m.destroy(ctx, built.VMName)
 		if !live {
 			return "", ErrUnknownSandbox
 		}
@@ -249,7 +248,6 @@ func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string,
 	return built.VsockSocket, nil
 }
 
-// commitWake swaps an archived record back to a live VM if the claim is still live.
 func (m *Manager) commitWake(ctx context.Context, sb *types.Sandbox, vmName, sock string) (live, saved bool) {
 	m.mu.Lock()
 	live = m.claimed[sb.ID] == sb
diff --git a/sandboxd/pool/claim.go b/sandboxd/pool/claim.go
index 80125f950..75e48fff9 100644
--- a/sandboxd/pool/claim.go
+++ b/sandboxd/pool/claim.go
@@ -40,7 +40,6 @@ type ClaimOptions struct {
 	EgressClass string
 }
 
-// apply stamps the options a claim carries for its life.
 func (o ClaimOptions) apply(sb *types.Sandbox) {
 	sb.Tenant, sb.ClaimRef, sb.Metadata, sb.OnExpire, sb.NoEgress = o.Tenant, o.ClaimRef, o.Metadata, o.OnExpire.Or(""), o.NoEgress
 	sb.EgressClass = o.EgressClass
@@ -321,7 +320,7 @@ func (m *Manager) releaseResolved(ctx context.Context, id string, sb *types.Sand
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
 		m.mu.Lock()
-		m.addClaimLocked(sb) // roll back so memory matches the still-durable claim
+		m.addClaimLocked(sb)
 		m.restoreVolumeHolds(sb, volumeHolds)
 		delete(m.pendingCks, ck)
 		rb := m.store.set(sb)
@@ -383,7 +382,6 @@ func (m *Manager) admitVolumes(tenant string, volumes []resolvedVolume) ([]types
 	return applied, nil
 }
 
-// admitClaim refuses a busy or retired volume or an over-quota tenant before any VM is built.
 func (m *Manager) admitClaim(tenant string, volumes []resolvedVolume, applied []types.Volume) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -515,12 +513,6 @@ func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl t
 	return nil
 }
 
-func (m *Manager) deadlineOf(sb *types.Sandbox) time.Time {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return sb.Deadline
-}
-
 // rollbackClaim unwinds a claim batch: a NIC that cannot be locked is never handed out.
 func (m *Manager) rollbackClaim(ctx context.Context, sbs []*types.Sandbox) {
 	m.mu.Lock()
@@ -552,6 +544,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 	type victim struct {
 		action                       reapAction
 		id, vmName, snap, ck, tenant string
+		deadline                     time.Time
 		sb                           *types.Sandbox
 		holds                        []types.Volume
 	}
@@ -571,7 +564,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 				unrows = append(unrows, sb)
 			}
 		case sb.ArchiveCk != "":
-			expired = append(expired, victim{action: reapPurge, id: id, ck: sb.ArchiveCk, tenant: sb.Tenant, sb: sb})
+			expired = append(expired, victim{action: reapPurge, id: id, ck: sb.ArchiveCk, tenant: sb.Tenant, deadline: sb.Deadline, sb: sb})
 			purges = append(purges, sb.ArchiveCk)
 		case m.archivesAtDeadline(sb):
 			// archive instead of destroy, kept in m.claimed for archive() to move
@@ -585,7 +578,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			}
 			expired = append(expired, victim{action: action, id: id, sb: sb})
 		default:
-			expired = append(expired, victim{action: reapDestroy, id: id, vmName: sb.VMName, snap: sb.HibernateSnap, tenant: sb.Tenant, sb: sb, holds: m.cancelVolumeRun(sb)})
+			expired = append(expired, victim{action: reapDestroy, id: id, vmName: sb.VMName, snap: sb.HibernateSnap, tenant: sb.Tenant, deadline: sb.Deadline, sb: sb, holds: m.cancelVolumeRun(sb)})
 			m.dropClaimLocked(sb)
 			dropped = append(dropped, id)
 		}
@@ -642,7 +635,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			if v.action == reapArchive || v.action == reapPause {
 				delete(m.archiving, v.id) // never removed from m.claimed
 			} else {
-				m.addClaimLocked(v.sb) // roll back so memory matches the still-durable claim
+				m.addClaimLocked(v.sb)
 				m.restoreVolumeHolds(v.sb, v.holds)
 				delete(m.pendingCks, v.ck)
 				restored = append(restored, v.sb)
@@ -668,7 +661,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.purgeArchiveCk(ctx, v.id, v.ck, v.tenant)
 			m.untrack(m.pendingCks, v.ck)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, Tenant: v.tenant, Deadline: v.deadline})
 			logger.Infof(ctx, "purged archived sandbox %s", v.id)
 		case reapArchive:
 			logSweepResult(ctx, logger, m.archive(ctx, v.sb), "archived expired sandbox "+v.id, "archive expired sandbox "+v.id)
@@ -680,7 +673,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.out.Disarm(v.id, m.removeOrRetry(ctx, v.vmName, v.id, td))
 			m.dropSnap(ctx, v.snap)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, VMName: v.vmName, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, VMName: v.vmName, Tenant: v.tenant, Deadline: v.deadline})
 			logger.Infof(ctx, "reaped expired sandbox %s (%s)", v.id, v.vmName)
 		}
 	})
@@ -744,7 +737,13 @@ func (m *Manager) claim(id, token string) (*types.Sandbox, bool) {
 	return m.authed(id, token)
 }
 
-// authed looks up a claim by id and token; callers hold m.mu.
+func (m *Manager) deadlineOf(sb *types.Sandbox) time.Time {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return sb.Deadline
+}
+
+// Callers hold m.mu.
 func (m *Manager) authed(id, token string) (*types.Sandbox, bool) {
 	sb := m.claimed[id]
 	if sb == nil || subtle.ConstantTimeCompare([]byte(sb.Token), []byte(token)) != 1 {
diff --git a/sandboxd/pool/failover.go b/sandboxd/pool/failover.go
index de1e55173..6389590a7 100644
--- a/sandboxd/pool/failover.go
+++ b/sandboxd/pool/failover.go
@@ -73,7 +73,7 @@ func (m *Manager) adoptArchived(ctx context.Context, id, token string) (bool, er
 		return false, fmt.Errorf("adopt %s: persist claims: %w", id, err)
 	}
 	m.recordUsage(ctx, usage.Event{Event: "adopt", ID: id, Reference: rec.Checkpoint, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
-	log.WithFunc("pool.AdoptArchived").Infof(ctx, "adopted archived sandbox %s from %s", id, rec.Owner)
+	log.WithFunc("pool.adoptArchived").Infof(ctx, "adopted archived sandbox %s from %s", id, rec.Owner)
 	return true, nil
 }
 
@@ -461,7 +461,9 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 		case rec.Consumed || !rec.Deadline.IsZero() && now.After(rec.Deadline):
 			m.purgeArchiveRow(ctx, rec)
 		case rec.Deadline.IsZero():
-			m.startRowRetention(ctx, rec.ID, rec.Epoch)
+			if err := m.startRowRetention(ctx, rec.ID, rec.Epoch); err != nil && !errors.Is(err, archives.ErrLost) {
+				log.WithFunc("pool.reconcileOwnRow").Warnf(ctx, "start retention of archive row %s: %v", rec.ID, err)
+			}
 		}
 		return
 	}
@@ -482,30 +484,23 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 	}
 }
 
-func (m *Manager) startRowRetention(ctx context.Context, id string, epoch int64) {
-	logger := log.WithFunc("pool.startRowRetention")
+func (m *Manager) startRowRetention(ctx context.Context, id string, epoch int64) error {
 	rec, ok, err := m.archives.Get(ctx, id)
-	if err != nil {
-		logger.Warnf(ctx, "read archive row %s: %v", id, err)
-		return
-	}
-	if !ok || rec.Epoch != epoch {
-		return
+	if err != nil || !ok {
+		return err
 	}
 	sb := &types.Sandbox{}
 	if err = json.Unmarshal(rec.Claim, sb); err != nil {
-		logger.Warnf(ctx, "decode archive row %s: %v", id, err)
-		return
+		return err
 	}
 	m.mu.Lock()
 	rec.Deadline = m.retentionDeadline(sb.Key)
 	m.mu.Unlock()
 	if rec.Deadline.IsZero() {
-		return
-	}
-	if _, err = m.archives.Replace(ctx, rec, epoch); err != nil && !errors.Is(err, archives.ErrLost) {
-		logger.Warnf(ctx, "start retention of archive row %s: %v", id, err)
+		return nil
 	}
+	_, err = m.archives.Replace(ctx, rec, epoch)
+	return err
 }
 
 func (m *Manager) dropStaleRow(ctx context.Context, sb *types.Sandbox, rec archives.Record) {
diff --git a/sandboxd/pool/hibernate.go b/sandboxd/pool/hibernate.go
index 60aa61e06..f983f1765 100644
--- a/sandboxd/pool/hibernate.go
+++ b/sandboxd/pool/hibernate.go
@@ -164,7 +164,6 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 	if sb.Failed != "" {
 		return "", fmt.Errorf("%w: %s", ErrFailed, sb.Failed)
 	}
-	// settle a dangling intent before choosing running vs hibernated
 	if _, err := m.settlePendingSnap(ctx, sb); err != nil {
 		return "", fmt.Errorf("wake %s: %w", sb.ID, err)
 	}
@@ -228,7 +227,7 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 		return "", fmt.Errorf("wake %s: persist claims: %w", sb.ID, err)
 	}
 	m.dropStale(ctx, sb)
-	// the resume consumed the memory image; reclaim its disk off the wake-return path (the randHex suffix keeps a re-hibernate from reusing the name)
+	// The randHex suffix keeps a re-hibernate from reusing the name
 	go m.dropSnap(ctx, snap)
 	return sock, nil
 }
@@ -280,7 +279,6 @@ func (m *Manager) idleOnce(ctx context.Context) {
 	}()
 }
 
-// idleHibernate re-validates a sweep victim under the Transition lock.
 func (m *Manager) idleHibernate(ctx context.Context, id, token string, sweepStart time.Time) error {
 	sb, ok := m.claim(id, token)
 	if !ok {
@@ -297,7 +295,6 @@ func (m *Manager) idleHibernate(ctx context.Context, id, token string, sweepStar
 	return m.hibernateLocked(ctx, sb)
 }
 
-// commitTransition publishes a hibernate/wake result only if the claim is still live.
 func (m *Manager) commitTransition(ctx context.Context, sb *types.Sandbox, snap, sock string) (live bool, err error) {
 	return m.commitIfLive(ctx, sb, func() {
 		sb.HibernateSnap = snap
@@ -337,7 +334,6 @@ func (m *Manager) settlePendingSnap(ctx context.Context, sb *types.Sandbox) (ado
 	return adopted, err
 }
 
-// resolvePendingSnap settles an unconfirmed hibernate intent against the engine's snapshot list.
 func (m *Manager) resolvePendingSnap(ctx context.Context, sb *types.Sandbox) (adopted bool, err error) {
 	if sb.PendingSnap == "" {
 		return false, nil
diff --git a/sandboxd/pool/operator.go b/sandboxd/pool/operator.go
index 45e7d7812..83fab9187 100644
--- a/sandboxd/pool/operator.go
+++ b/sandboxd/pool/operator.go
@@ -32,6 +32,9 @@ func (m *Manager) Wake(ctx context.Context, id string, cred Cred) error {
 	if !ok {
 		return ErrUnknownSandbox
 	}
+	if _, err := m.fenceWatch(sb); err != nil {
+		return err
+	}
 	if err := m.restartFailed(ctx, sb); err != nil {
 		return err
 	}
diff --git a/sandboxd/pool/pool.go b/sandboxd/pool/pool.go
index f0d0cb238..115b8009a 100644
--- a/sandboxd/pool/pool.go
+++ b/sandboxd/pool/pool.go
@@ -568,17 +568,12 @@ func (m *Manager) ClusterDigest() string {
 
 // Run drives the refill and reap loops until ctx is canceled.
 func (m *Manager) Run(ctx context.Context) {
-	refill := time.NewTicker(refillInterval)
-	defer refill.Stop()
-	reap := time.NewTicker(reapInterval)
-	defer reap.Stop()
-	liveness := time.NewTicker(livenessInterval)
-	defer liveness.Stop()
-	images := time.NewTicker(imageInterval)
-	defer images.Stop()
+	refill := time.Tick(refillInterval)
+	reap := time.Tick(reapInterval)
+	liveness := time.Tick(livenessInterval)
+	images := time.Tick(imageInterval)
 	// Store retention is hourly: each sweep is cluster-visible I/O on a shared root
-	storeSweep := time.NewTicker(time.Hour)
-	defer storeSweep.Stop()
+	storeSweep := time.Tick(time.Hour)
 	go m.sweepExpiredCheckpoints(ctx)
 	if m.cocoondSocket != "" {
 		go m.watchVMMs(ctx)
@@ -596,7 +591,7 @@ func (m *Manager) Run(ctx context.Context) {
 		select {
 		case <-ctx.Done():
 			return
-		case <-refill.C:
+		case <-refill:
 			if m.view.Load().out.Guarded() {
 				m.out.RefreshSelf()
 			}
@@ -604,7 +599,7 @@ func (m *Manager) Run(ctx context.Context) {
 			m.refillOnce(ctx)
 		case <-m.refillKick:
 			m.refillOnce(ctx)
-		case <-reap.C:
+		case <-reap:
 			m.retryRemovals(ctx)
 			m.reapOnce(ctx)
 			m.idleOnce(ctx)
@@ -612,11 +607,11 @@ func (m *Manager) Run(ctx context.Context) {
 			m.replicateOnce(ctx)
 			m.shrinkOnce(ctx)
 			go m.retryArchiveDeletes(ctx)
-		case <-liveness.C:
+		case <-liveness:
 			m.livenessOnce(ctx)
-		case <-images.C:
+		case <-images:
 			go m.checkImagesOnce(ctx)
-		case <-storeSweep.C:
+		case <-storeSweep:
 			go m.sweepStoreGenerations(ctx)
 			go m.sweepExpiredCheckpoints(ctx)
 			if m.archives != nil {
diff --git a/sandboxd/pool/reconcile.go b/sandboxd/pool/reconcile.go
index 3787789db..b53f9bb34 100644
--- a/sandboxd/pool/reconcile.go
+++ b/sandboxd/pool/reconcile.go
@@ -39,7 +39,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 
 	owned := map[string]bool{}
 	referenced := map[string]bool{}
-	var adopted, dropped []*types.Sandbox
+	var adopted, dropped, resumed []*types.Sandbox
 	m.mu.Lock()
 	for _, sb := range claims {
 		sb.SetEnv(sb.Env)
@@ -52,6 +52,9 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 		case ok && rec.State == vmStateRunning:
 			sb.VsockSocket = rec.VsockSocket
 			// running with either flag set means a crashed wake or an intent the engine never saw
+			if sb.HibernateSnap != "" {
+				resumed = append(resumed, sb)
+			}
 			sb.HibernateSnap, sb.PendingSnap = "", ""
 		case ok && sb.HibernateSnap != "":
 			// hibernated: the VM is stopped by design and wakes on demand.
@@ -82,11 +85,9 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 	for _, sb := range adopted {
 		m.recordHibernate(ctx, sb)
 	}
-	// A failed save keeps the record, so the next boot drops it and records its end
+	// A failed save keeps the records, so the next boot records them
 	if saveErr == nil {
-		for _, sb := range dropped {
-			m.recordEnd(ctx, sb, "vm_gone")
-		}
+		m.recordReconciled(ctx, resumed, dropped, fenced)
 	}
 	logger := log.WithFunc("pool.Reconcile")
 	if err := m.ckpts.SweepStaging(); err != nil {
@@ -274,8 +275,19 @@ func (m *Manager) quarantineClaim(ctx context.Context, sb *types.Sandbox) bool {
 	return gone
 }
 
+func (m *Manager) recordReconciled(ctx context.Context, resumed, dropped []*types.Sandbox, answered bool) {
+	for _, sb := range resumed {
+		m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: sb.Deadline})
+	}
+	for _, sb := range dropped {
+		if answered || !sb.HasReplica() {
+			m.recordEnd(ctx, sb, "vm_gone")
+		}
+	}
+}
+
 func (m *Manager) recordEnd(ctx context.Context, sb *types.Sandbox, reason string) {
-	m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Reference: reason})
+	m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: sb.Deadline, Reference: reason})
 }
 
 // readoptEgressTap records and returns a live egress claim's tap, "" when there is none.
diff --git a/sandboxd/pool/replica_test.go b/sandboxd/pool/replica_test.go
index 4af4f6e0c..4d0cb57e2 100644
--- a/sandboxd/pool/replica_test.go
+++ b/sandboxd/pool/replica_test.go
@@ -588,17 +588,55 @@ func TestReplicaPassSnapshotsOnlyDueRunningClaims(t *testing.T) {
 	})
 }
 
-func TestAFencedNodeDoesNotHibernateAReplicatedClaim(t *testing.T) {
+func TestAFencedNodeNeitherHibernatesNorWakesAReplicatedClaim(t *testing.T) {
 	c := newReplicaCluster(t)
 	a := c.node(t, "a", t.TempDir(), keepAnHour)
-	replicated := mustClaim(t, a, testKey)
-	replicateNow(t, a, replicated)
+	sb, asleep := mustClaim(t, a, testKey), mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	if err := a.Hibernate(t.Context(), asleep.ID, Cred{Token: asleep.Token}); err != nil {
+		t.Fatalf("hibernate before the fence: %v", err)
+	}
 	a.tripFence()
-	if err := a.Hibernate(t.Context(), replicated.ID, Cred{Token: replicated.Token}); !errors.Is(err, ErrLeaseLost) {
-		t.Errorf("hibernate of a replicated claim while fenced: %v, want ErrLeaseLost", err)
+	if err := a.Hibernate(t.Context(), sb.ID, Cred{Token: sb.Token}); !errors.Is(err, ErrLeaseLost) {
+		t.Errorf("hibernate while fenced: %v, want ErrLeaseLost", err)
 	}
-	if got, want := usageEventsOf(t, a, replicated.ID), "claim"; got != want {
-		t.Errorf("events of the replicated claim %s, want %s", got, want)
+	if err := a.Wake(t.Context(), asleep.ID, Cred{Token: asleep.Token}); !errors.Is(err, ErrLeaseLost) {
+		t.Errorf("wake while fenced: %v, want ErrLeaseLost", err)
+	}
+	if got, want := usageEventsOf(t, a, sb.ID), "claim"; got != want {
+		t.Errorf("events of the running claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, a, asleep.ID), "claim,hibernate"; got != want {
+		t.Errorf("events of the hibernated claim %s, want %s", got, want)
+	}
+}
+
+func TestTheSweepsLeaveAReplicatedClaimAloneWhileFenced(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	backdate(a, sb, time.Hour)
+	a.tripFence()
+	sweepIdle(t, a)
+	if hibernated(a) != 0 {
+		t.Error("the idle sweep hibernated a replicated claim while fenced")
+	}
+	a.mu.Lock()
+	a.archiving[sb.ID] = struct{}{}
+	a.mu.Unlock()
+	if err := a.pauseExpired(t.Context(), sb); !errors.Is(err, ErrLeaseLost) || !benignSweepErr(err) {
+		t.Errorf("pause of an expired claim while fenced: %v, want a benign ErrLeaseLost", err)
+	}
+	a.mu.Lock()
+	_, tracked := a.archiving[sb.ID]
+	a.mu.Unlock()
+	if tracked {
+		t.Error("the refused pause left the claim marked as archiving")
+	}
+	a.liftFence()
+	sweepIdle(t, a)
+	if hibernated(a) != 1 {
+		t.Error("the idle sweep did not hibernate the claim once the fence lifted")
 	}
 }
 
@@ -791,65 +829,29 @@ func TestReplicaRestartAdoptsTheRowsCheckpointOfAnInterruptedRound(t *testing.T)
 	}
 }
 
-func TestAdoptingAReplicaRecordsItsCheckpointAndRetention(t *testing.T) {
+func TestAReplicaRowWithNoClaimLeftGainsRetentionAndIsPurged(t *testing.T) {
 	c := newReplicaCluster(t)
-	a, b := c.node(t, "a", t.TempDir(), keepAnHour), c.node(t, "b", t.TempDir(), keepAnHour)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
 	sb := mustClaim(t, a, testKey)
 	replicateNow(t, a, sb)
 	ck := a.replicaOf(sb)
-	c.expire("a")
-	if adopted, err := b.AdoptArchived(t.Context(), sb.ID, sb.Token); err != nil || !adopted {
-		t.Fatalf("adopt: %v %v", adopted, err)
-	}
-	moved, _ := b.byID(sb.ID)
-	evs := usageJournal(t, b)
-	last := evs[len(evs)-1]
-	if want := b.deadlineOf(moved); last.Event != "adopt" || last.ID != sb.ID || last.Reference != ck || want.IsZero() || !last.Deadline.Equal(want) {
-		t.Errorf("last event %+v, want an adopt of %s naming %s with deadline %v", last, sb.ID, ck, want)
-	}
-	if _, _, _, err := b.WakeAgentSocket(t.Context(), sb.ID, sb.Token); err != nil {
-		t.Fatalf("wake: %v", err)
-	}
-	if got, want := usageEventsOf(t, b, sb.ID), "adopt,unarchive"; got != want {
-		t.Errorf("events on the adopter %s, want %s", got, want)
-	}
-}
-
-func TestAReplicaRowWithNoClaimLeftGainsRetentionAndIsPurged(t *testing.T) {
-	c := newReplicaCluster(t)
-	a := c.node(t, "a", t.TempDir(), keepAnHour)
-	lost, kept := mustClaim(t, a, testKey), mustClaim(t, a, testKey)
-	replicateNow(t, a, lost)
-	replicateNow(t, a, kept)
-	ck := a.replicaOf(lost)
-	if err := a.FlushClaims(); err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-	delete(a.eng.(*fakeEngine).vms, lost.VMName)
-	restarted := c.restart(t, a)
-	if err := restarted.Reconcile(t.Context()); err != nil {
-		t.Fatalf("reconcile: %v", err)
-	}
+	restarted := restartWithoutVM(t, c, a, sb, keepAnHour)
 
 	restarted.sweepOrphanArchives(t.Context())
-	rec, ok, err := c.reg.Get(t.Context(), lost.ID)
+	rec, ok, err := c.reg.Get(t.Context(), sb.ID)
 	if err != nil || !ok || rec.Deadline.IsZero() || !ckExists(t, restarted, ck) {
 		t.Fatalf("row of the dropped claim after a sweep: %+v %t %v, want it kept with a deadline", rec, ok, err)
 	}
-	liveRow, _, err := c.reg.Get(t.Context(), kept.ID)
-	if err != nil || !liveRow.Deadline.IsZero() {
-		t.Errorf("row of the live claim: %+v %v, want no deadline", liveRow, err)
-	}
 
 	rec.Deadline = time.Now().Add(-time.Second)
 	if _, err = c.reg.Replace(t.Context(), rec, rec.Epoch); err != nil {
 		t.Fatalf("age the row: %v", err)
 	}
 	restarted.sweepOrphanArchives(t.Context())
-	if _, ok, err = c.reg.Get(t.Context(), lost.ID); err != nil || ok || ckExists(t, restarted, ck) {
+	if _, ok, err = c.reg.Get(t.Context(), sb.ID); err != nil || ok || ckExists(t, restarted, ck) {
 		t.Errorf("row %t %v after retention, want the row and its checkpoint gone", ok, err)
 	}
-	if got, want := usageEventsOf(t, restarted, lost.ID), "claim,reap,archive_delete"; got != want {
+	if got, want := usageEventsOf(t, restarted, sb.ID), "claim,reap,archive_delete"; got != want {
 		t.Errorf("events %s, want %s", got, want)
 	}
 }
@@ -859,14 +861,7 @@ func TestAReplicaRowWithNoClaimLeftStaysAdoptable(t *testing.T) {
 	a := c.node(t, "a", t.TempDir(), keepAnHour)
 	sb := mustClaim(t, a, testKey)
 	replicateNow(t, a, sb)
-	if err := a.FlushClaims(); err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-	delete(a.eng.(*fakeEngine).vms, sb.VMName)
-	restarted := c.restart(t, a)
-	if err := restarted.Reconcile(t.Context()); err != nil {
-		t.Fatalf("reconcile: %v", err)
-	}
+	restarted := restartWithoutVM(t, c, a, sb, keepAnHour)
 	restarted.sweepOrphanArchives(t.Context())
 	if adopted, err := restarted.AdoptArchived(t.Context(), sb.ID, sb.Token); err != nil || !adopted {
 		t.Errorf("adopt inside retention: %t %v", adopted, err)
@@ -875,19 +870,10 @@ func TestAReplicaRowWithNoClaimLeftStaysAdoptable(t *testing.T) {
 
 func TestAReplicaRowOfAKeepForeverPoolKeepsNoDeadline(t *testing.T) {
 	c := newReplicaCluster(t)
-	dir := t.TempDir()
-	a := c.node(t, "a", dir, keepAnHour)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
 	sb := mustClaim(t, a, testKey)
 	replicateNow(t, a, sb)
-	if err := a.FlushClaims(); err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-	eng := a.eng.(*fakeEngine)
-	delete(eng.vms, sb.VMName)
-	restarted := c.nodeOn(t, eng, "a", dir, 0)
-	if err := restarted.Reconcile(t.Context()); err != nil {
-		t.Fatalf("reconcile: %v", err)
-	}
+	restarted := restartWithoutVM(t, c, a, sb, 0)
 	before, _, err := c.reg.Get(t.Context(), sb.ID)
 	if err != nil {
 		t.Fatalf("read row: %v", err)
@@ -899,6 +885,31 @@ func TestAReplicaRowOfAKeepForeverPoolKeepsNoDeadline(t *testing.T) {
 	}
 }
 
+func TestReconcileWithTheRegistryDownRecordsOnlyTheEndNoOtherNodeCanHold(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	replicated, plain := mustClaim(t, a, testKey), mustClaim(t, a, plainKey)
+	replicateNow(t, a, replicated)
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	eng := a.eng.(*fakeEngine)
+	delete(eng.vms, replicated.VMName)
+	delete(eng.vms, plain.VMName)
+	c.reg.SetDown(true)
+	restarted := c.restart(t, a)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	c.reg.SetDown(false)
+	if got, want := usageEventsOf(t, restarted, replicated.ID), "claim"; got != want {
+		t.Errorf("events of the replicated claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, restarted, plain.ID), "claim,reap"; got != want {
+		t.Errorf("events of the unreplicated claim %s, want %s", got, want)
+	}
+}
+
 func TestReplicaRestartDropsAClaimAdoptedElsewhere(t *testing.T) {
 	c := newReplicaCluster(t)
 	dirA := t.TempDir()
@@ -1113,9 +1124,17 @@ func TestReplicaAdoptionWakesTheClaimFromTheLastReplica(t *testing.T) {
 	if moved.ArchiveCk != ck {
 		t.Fatalf("adopted claim names %q, want the replica %q", moved.ArchiveCk, ck)
 	}
+	evs := usageJournal(t, b)
+	last := evs[len(evs)-1]
+	if want := b.deadlineOf(moved); last.Event != "adopt" || last.ID != sb.ID || last.Reference != ck || want.IsZero() || !last.Deadline.Equal(want) {
+		t.Errorf("last event %+v, want an adopt of %s naming %s with deadline %v", last, sb.ID, ck, want)
+	}
 	if _, _, _, err := b.WakeAgentSocket(t.Context(), sb.ID, sb.Token); err != nil {
 		t.Fatalf("adopter's wake: %v", err)
 	}
+	if got, want := usageEventsOf(t, b, sb.ID), "adopt,unarchive"; got != want {
+		t.Errorf("events on the adopter %s, want %s", got, want)
+	}
 	if got := b.eng.(*fakeEngine).cloneCount(); got != 1 {
 		t.Errorf("the wake cloned %d VMs, want the one restored from the replica", got)
 	}
@@ -1124,6 +1143,20 @@ func TestReplicaAdoptionWakesTheClaimFromTheLastReplica(t *testing.T) {
 	}
 }
 
+func restartWithoutVM(t *testing.T, c *failoverCluster, a *Manager, sb *types.Sandbox, deleteAfter int) *Manager {
+	t.Helper()
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	eng := a.eng.(*fakeEngine)
+	delete(eng.vms, sb.VMName)
+	restarted := c.nodeOn(t, eng, a.nodeID, a.dataDir, deleteAfter)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	return restarted
+}
+
 func newReplicaCluster(t *testing.T) *failoverCluster {
 	t.Helper()
 	c := newFailoverCluster(t)
diff --git a/sandboxd/pool/telemetry.go b/sandboxd/pool/telemetry.go
index 94f3d0da5..3031199e7 100644
--- a/sandboxd/pool/telemetry.go
+++ b/sandboxd/pool/telemetry.go
@@ -168,10 +168,11 @@ func (m *Manager) recordEgress(ctx context.Context, id, tenant string, ev egress
 			Time time.Time `json:"t"`
 			ID   string    `json:"id"`
 			egressFrame
-		}{time.Now(), id, egressFrame{
+		}{
+			Time: time.Now(), ID: id,
 			Op: egressEvent, Dest: ev.Host, Method: ev.Method, Port: ev.Port, Decision: decision, Secret: ev.Injected, Upstream: ev.Upstream,
 			Tenant: tenant, Src: ev.Local, Dst: ev.Remote,
-		}})
+		})
 	}
 	m.recordUsage(ctx, usage.Event{Event: egressEvent, ID: id, Tenant: tenant, Reference: ev.Host, Upstream: ev.Upstream, Secret: ev.Injected})
 }
diff --git a/sandboxd/pool/telemetry_test.go b/sandboxd/pool/telemetry_test.go
index 82f6c3352..219de923e 100644
--- a/sandboxd/pool/telemetry_test.go
+++ b/sandboxd/pool/telemetry_test.go
@@ -11,6 +11,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/cocoonstack/sandbox/sandboxd/config"
@@ -195,6 +196,10 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 	expire(m, children[0])
 	m.reapOnce(ctx)
 	waitFor(t, func() bool { return strings.HasSuffix(usageEventsOf(t, m, children[0].ID), ",reap") })
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; last.ID != children[0].ID || !last.Deadline.Equal(children[0].Deadline) {
+		t.Errorf("reap %+v, want the deadline it ended under, %v", last, children[0].Deadline)
+	}
 
 	kinds := map[string]bool{}
 	for _, ev := range usageJournal(t, m) {
@@ -243,6 +248,20 @@ func TestEveryEventThatMovesTheDeadlineStatesIt(t *testing.T) {
 	assertDeadline("unarchive")
 }
 
+func TestAPurgeReapStatesTheRetentionEnd(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(3600))
+	sb := mustClaim(t, m, testKey)
+	mustArchive(t, m, sb)
+	expire(m, sb)
+	want := m.deadlineOf(sb)
+	m.reapOnce(t.Context())
+	waitFor(t, func() bool { return strings.HasSuffix(usageEventsOf(t, m, sb.ID), ",reap") })
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; !last.Deadline.Equal(want) {
+		t.Errorf("purge reap deadline %v, want %v", last.Deadline, want)
+	}
+}
+
 func TestAnArchiveKeptForeverStatesNoDeadline(t *testing.T) {
 	m := newTestManager(t, newFakeEngine(), archivePool(0))
 	sb := mustClaim(t, m, testKey)
@@ -254,30 +273,32 @@ func TestAnArchiveKeptForeverStatesNoDeadline(t *testing.T) {
 }
 
 func TestArchiveEventPrecedesAWakeDuringItsTeardown(t *testing.T) {
-	eng := newFakeEngine()
-	m := newTestManager(t, eng, archivePool(3600))
-	ctx := t.Context()
-	sb := mustClaim(t, m, testKey)
-	if err := m.Hibernate(ctx, sb.ID, Cred{Token: sb.Token}); err != nil {
-		t.Fatalf("hibernate: %v", err)
-	}
-	stall := make(chan struct{})
-	eng.mu.Lock()
-	eng.removeStall = stall
-	eng.mu.Unlock()
-	archived := make(chan error, 1)
-	go func() { archived <- m.archive(ctx, sb) }()
-	waitFor(t, func() bool { return archivedCount(m) == 1 })
-	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
-		t.Fatalf("wake: %v", err)
-	}
-	close(stall)
-	if err := <-archived; err != nil {
-		t.Fatalf("archive: %v", err)
-	}
-	if got, want := usageEventsOf(t, m, sb.ID), "claim,hibernate,archive,unarchive"; got != want {
-		t.Errorf("events %s, want %s", got, want)
-	}
+	synctest.Test(t, func(t *testing.T) {
+		eng := newFakeEngine()
+		m := newTestManager(t, eng, archivePool(3600))
+		ctx := t.Context()
+		sb := mustClaim(t, m, testKey)
+		if err := m.Hibernate(ctx, sb.ID, Cred{Token: sb.Token}); err != nil {
+			t.Fatalf("hibernate: %v", err)
+		}
+		stall := make(chan struct{})
+		eng.mu.Lock()
+		eng.removeStall = stall
+		eng.mu.Unlock()
+		archived := make(chan error, 1)
+		go func() { archived <- m.archive(ctx, sb) }()
+		synctest.Wait()
+		if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+			t.Fatalf("wake: %v", err)
+		}
+		close(stall)
+		if err := <-archived; err != nil {
+			t.Fatalf("archive: %v", err)
+		}
+		if got, want := usageEventsOf(t, m, sb.ID), "claim,hibernate,archive,unarchive"; got != want {
+			t.Errorf("events %s, want %s", got, want)
+		}
+	})
 }
 
 func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
@@ -302,8 +323,31 @@ func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
 		t.Errorf("events of the kept claim %s, want %s", got, want)
 	}
 	evs := usageJournal(t, m2)
-	if last := evs[len(evs)-1]; last.Reference != "vm_gone" || last.Tenant != "acme" || last.VMName != lost.VMName {
-		t.Errorf("reap of the dropped claim %+v, want vm_gone of %s under acme", last, lost.VMName)
+	if last := evs[len(evs)-1]; last.Reference != "vm_gone" || last.Tenant != "acme" || last.VMName != lost.VMName || !last.Deadline.Equal(lost.Deadline) {
+		t.Errorf("reap of the dropped claim %+v, want vm_gone of %s under acme with deadline %v", last, lost.VMName, lost.Deadline)
+	}
+}
+
+func TestReconcileRecordsTheWakeACrashLost(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	sb := mustClaim(t, m, testKey)
+	if err := m.Hibernate(t.Context(), sb.ID, Cred{Token: sb.Token}); err != nil {
+		t.Fatalf("hibernate: %v", err)
+	}
+	delete(eng.stopped, sb.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	if err := m2.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m2, sb.ID), "claim,hibernate,wake"; got != want {
+		t.Errorf("events %s, want %s", got, want)
+	}
+	evs := usageJournal(t, m2)
+	if last := evs[len(evs)-1]; !last.Deadline.Equal(sb.Deadline) {
+		t.Errorf("wake deadline %v, want %v", last.Deadline, sb.Deadline)
 	}
 }