docs(e2): record takeover timing and refresh owner coverage evidence

[mirror29]

Record a same-business-image two-application isolation probe: pause the old Evolver process, observe natural lease expiry using the database clock, allow a second application to claim a new lease, then resume the old process and release the offline provider fixture. Unknown reserves, zero stored responses and zero proposals remain unchanged for 20 seconds. Preserve the earlier untimed observation and the failed timing fixture setup.

This is partial fencing evidence with fixture peripheral services. Successful SDK receipt or an attempted stale complete() call was not directly observed; heartbeat cancellation and write fencing cannot be separated. No production service was restarted.

Refresh the normal-owner free coverage matrix at one sampling point: BTC 3/8, ETH 0/8, SOL 0/8. All remain blocked, without fees, approval or search. Window movement is not a causal data regression.

Validation: isolated probe passed with explicit expiry/claim time anchors; both owned containers exited 0 and were removed, audit databases retained; consistency 19 passed / 0 failed / 12 existing warnings; diff whitespace check passed. Normal owner Chrome UI verified the free matrix, and the task-created tab was closed.

[cloudflare-workers-and-pages]

Deploying inalpha-web with    Cloudflare Pages

Latest commit:	4077cc0
Status:	✅  Deploy successful!
Preview URL:	https://bf9373a7.inalpha-web.pages.dev
Branch Preview URL:	https://codex-e2-paused-worker-fenci.inalpha-web.pages.dev

View logs

[github-actions]

Reviewed PR head: 4077cc02ee11

🤖 DeepSeek Code Review

Docs-only change recording a refreshed 2026-10-14 07:55 owner free-matrix sample (SOL 1/8 -> 0/8, new followup receipt) and adding a paused-worker lease-takeover validation receipt, with current-state wording updated to match both.

Critical	Major	Medium
0	0	0

Findings

No medium-or-higher issues found in the supplied diff.

Review scope and limitations

Reviewed the supplied diff and project rules. No tests were executed by this reviewer.

• Cannot verify the pre-existing receipts still referenced by the doc (validation/e2-owner-post-confirmation-2026-10-14.json, same-image receipts) since they are unchanged in this diff.
• The 07:55 numbers and the takeover timeline are self-reported by the new JSON files; the probe harness, hashes and observation procedure cannot be independently validated from the diff.
• No code, config or schema changes were included, so no runtime/behavioral paths could be reviewed.

[mirror29]

Addressed in d4eba4c by rerunning the isolated probe rather than inventing timestamps for the earlier observation.

The new receipt records SIGSTOP completion, the PostgreSQL-clock observation of the expired old lease, second application startup, and the new lease token/claim updated_at. The recorded claim is after the expired lease: 08:02:00.464845Z > 08:01:40.500046Z. A brief proposal-response-table lock in the isolated database made the claimed state observable before the unknown-response failure; the lock was released before resuming the old process. This fixture intervention and the earlier authorization-table-lock setup timeout are both disclosed. The successful probe still does not directly prove SDK receipt or a stale complete() invocation.

The PR also records a fresh normal-owner free matrix at a single sampling point: BTC 3/8, ETH 0/8, SOL 0/8, with no model calls or approvals. Natural partition movement is explicitly distinguished from same-window regression.

[mirror29]

Addressed both latest MEDIUM findings. The retained 04:05 quality observation now links directly to its own original receipt. The takeover receipt now has overall result=partially_passed, keeps the original harness assertion result separately, changes its purpose to the observed 20-second invariance, and lists SDK receipt, stale complete() rejection and mechanism separation as not demonstrated. It cannot be cited as full write-fencing acceptance.