The Work Was Valid. The Final Commit Was Not.

Long-running agent work creates a subtle authority gap. A worker can be completely correct when it starts and completely stale when it finishes. The final external mutation therefore needs its own authority check.

The race

Unsafe · the start proof becomes a stale capability

At logical time 1020, A was current and authorized. Its lease expired at 1060. At 1070, B took over with fence 2 and committed one external effect.

At 1080, the unsafe path let A reuse its valid start proof. The HTTP resource did not enforce fencing and accepted A/fence 1 as a second effect.

Final state: 2 effects / CONFLICT.

Safe · revalidate at the irreversible boundary

Before A could commit, the coordinator was re-read using the exact epoch that authorized the start: owner A, fence 1, lease version 1, and valid lease at commit time.

The current state was B/fence 2/version 2, so A made no external call. Final effect count stayed at 1.

Defense in depth · resource fencing

The next scenario deliberately skipped the coordinator recheck. B had already committed with token 2, so the resource retained highest_fence=2. A's final commit presented token 1.

The old worker finished its work, but its completion could not escape into the protected world.

Control · valid completion still works

A separate control finished at logical time 1050, before expiry at 1060. Start and finish authorization were both true, the fenced HTTP commit returned 200, and the final effect count was one.

Evidence

• GitHub Actions run 31554618911 — success.
• Artifact resonance-midflight-lease-loss-v1.0, ID 9125526467.
• Digest sha256:0dd9aa7c11547a916b75e6c739ba8d009e233de8f5bafbf9e4cb6412cab973c6.
• Unsafe effects: 2. Commit-recheck effects: 1. Resource-fenced effects: 1.

Interpretation boundary

This is a deterministic local protocol benchmark using PostgreSQL coordination and a separate Dockerized HTTP resource. It is not a vulnerability claim, production lease certification, exactly-once guarantee, universal scheduler design or arbitrary agent-safety claim.

Verdict: finishing the work does not preserve the right to commit it.