[Danceiny]

Refs #674

A graceful handoff could lose a write it had acknowledged. An independent, read-only review of the A1 state layer (run from the A2 session on the cumulative tip) found it, with six smaller findings next to it. I did not take the report on trust: I wrote a failing check for each finding from its description, saw it fail on the unfixed code, then fixed it. All of them reproduced.

Base is feat/aaas-a2-identity-seam, the cumulative tip, so this lands with the stack from the top like #683. It changes tenant-router.ts and epoch-copies.ts (A1) and nothing in the kernel (kernel-manifest-gate: zero diff), adds no dependency, and touches no WriteGate or M5 behavior.

What was wrong, and what changed

Finding	Severity	Fix	Pinned by
A write made through handle.ledger after the final image was taken was acknowledged, then lost: the drain only blocked run and runAsync, and the view checked the lease alone	blocker	The view closes the moment the drain is over and the image is about to be taken: every call gets the typed TenantDrainingError until the tenant is closed, or serving again if the flush fails	H1, H2
handoff() stopped renewing the lease at its start, so a drain or an upload longer than the lease failed FENCED or flushed into a prefix no successor reads	blocker	Only the periodic snapshots stop; renewals continue through the drain and the upload	H4 (real timers)
A flush that landed after the lease lapsed was reported as flushed (also when a successor took over mid-upload and pinned a base below it)	blocker	publishSnapshot checks the lease once the upload landed; a late image is a failed snapshot and handoff() rejects instead of claiming flushed	H3, H3b
exec(), defaultSafeIntegers() and the other methods that return the database itself handed out the raw one, behind no gate	major	The guarded database returns itself	V1
forget() with an upload in flight left the tenant's image in the store, where nothing would look for it	major	forget waits for the upload under way, then deletes; a snapshot queued behind it refuses to start	F1, F2
A replica kept the full local ledger after a handoff that had flushed everything	major	A flushed handoff removes the ledger files. An abandoned or lost tenure keeps its file on purpose: it may hold the only copy of unflushed writes	L1
An onEvent observer that threw inside openTenant left the lease held and unrenewed for the TTL	minor	The router's observer calls are contained	O1

Two more checks guard the fix itself: a handoff that fails and resumes service does not start a second renewal chain (H5), and a handoff overtaken by an abandon stays abandoned instead of bringing the handle back (H6).

Public-contract check

I found nothing that needed the founder before coding, and say so here so you can overrule it:

• booking.surface schema, event kinds and the error-code list: unchanged. TenantHandle's shape is unchanged.
• Behavior that a caller can see: during the final flush a call through handle.ledger gets TenantDrainingError (a tenant fault: the A2 surface already turns that into a cut connection or a typed 503, never an acknowledgement), and handoff() can now reject where it used to resolve, when the lease lapsed during the upload. router.close() already reports a failed flush as unflushed.
• Severity today: the router is not wired into any runtime path on main, and the A2 tenancy is not mounted (A3 composes it), so landing feat(aaas): epoch-scoped durable copies — publish, lineage restore, verify, forget (A1.2) #679 before this fix exposes nothing in production. The guarantee has to hold before A3 composes it, and the docs claimed it did.

Evidence

Local Node v26.9.0, macOS arm64. SHA 835dc3336880e6df4c20bd45ff98019a0c4ab35f.

• Failing first: on the unfixed tip H1, H2, H3, H4, V1, F1, O1 and L1 failed, each for the reason in the table (H5 and F2 passed there and stay as guards; H3b and H6 were added with the fix).
• npx tsc --noEmit clean; kernel-manifest-gate OK (zero diff); node scripts/check-docs-i18n.mjs (94 pairs) and check-doc-readability.mjs OK.
• Full regression on this SHA, clean tree: NPM_CONFIG_USERCONFIG=/dev/null NPM_CONFIG_REGISTRY=https://registry.npmjs.org/ npm_config_registry=https://registry.npmjs.org/ bash scripts/run-all-tests.sh -> ALL SUITES GREEN, exit 0, no ENOSPC (the public registry is used because the internal mirror is unreachable from this machine). CI runs it again on Node 22 and 24.
• New: run-all §101 tenant-state-handoff-tests.ts, 12 checks. The existing state-layer suites pass unchanged: §89 28 checks, §90 27, §91 21, the §92 real-process drill (kills, a pause past the lease, a graceful handoff), and the A2 adversarial suite §94 (34).
• Mutations (cd ts && npx tsx scripts/mutation-check.ts scripts/tenant-state-handoff-mutations.json): 13 killed, 0 survived. They break, one at a time: the view staying open, its closed-state check, renewals stopping at handoff, the raw database escaping, forget not waiting, a snapshot starting on a closed handle, a flushed handoff leaving its file, an abandoned file being deleted, a second renewal chain, a throwing observer, a handoff overtaken by an abandon, a closed handle coming back, and the missing post-upload lease check.

Docs

RFC §4.2 item 6 describes the handoff as it now behaves; the evidence cells of S-6 and S-12 say what is proven and what an operator still has to sweep; a code map row; run-all §101. Both languages.

Not in this PR, and limits

• Durability is still D-a: a crash loses the writes after the last snapshot (RPO above zero). Only the graceful path claims no loss.
• A replica that crashed or lost its lease keeps its local ledger file. Sweeping those is an operator step (A3).
• H4 and H5 use real timers (about 1.5 s each); the rest run on fake clocks.

Review asks

1. The view is closed to reads as well as writes once the final image is being taken. A writes-only gate is not possible at the database level, because the ledger's methods use their own closed-over handle; the A2 surface reads nothing through the ledger after its decision bracket, and all A2 suites pass.
2. Deleting the local ledger files after a flushed handoff, while keeping them after an abandon or a lost lease.
3. forget waiting for an upload under way instead of cancelling it.