Canonical path
If the worker's epoch is stale at completion, the result may be discarded, reconciled, transferred or retried under a new owner — but the old worker must not silently publish it using its original start permission.
Invariants
Authorized at start does not imply authorized at commit.
Lease loss while work is in flight invalidates the old commit authority.
Long-running consequential work must bind the final mutation to current authority.
Proof must preserve both the start epoch and the commit epoch.
Proof fields
- start decision time, owner, fence, lease version and expiry;
- finish / commit decision time;
- ownership observed at commit;
- commit-time authorization result;
- fence presented to the protected resource;
- highest resource-side fence and final effect;
- recovery / handoff / reconciliation outcome.
Why the resource fence remains final
A coordinator recheck is useful but can itself become stale before an external mutation. A protected resource that compares monotonic fencing tokens closes the last race at the actual effect boundary.
Relationship
Together they turn ownership from a label into a versioned, time-sensitive execution capability.
Evidence