fix: renew cleanup ownership and fence late completion writes

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Harold KimandPaperclip committed 2026-09-11 22:58:28 +00:00
1 parent e3b11ec91e
commit 74ec4f685b
5 files changed
+74 -4

No files matched your search

+2
View File
@@ -970,3 +970,5 @@ in-flight deadline. It retries after restart, waits at least 30 seconds between
failed attempts, and slows to 30 minutes after five failures. It reports that
operator attention is needed at that threshold, while automatic cleanup continues.
Provider outages never convert a live sandbox into an abandoned manual task.
A live cleanup attempt renews its durable claim every 30 seconds. Another sweep in the same controller cannot overlap it, even if the deadline passes. Completion writes require the current attempt identity. After controller loss, cleanup can repeat destruction of the exact quarantined provider resource; providers must make that operation idempotent. A timeout or claim expiry does not prove termination.