[cadence e45fc8d204be1643] The lease callback is only a point-in-time check, not a fence over activation; an attempt can lose its claim after the callback and still activate successfully. #241

Raised at crates/baley/src/update/deliver.rs:246 as high by openai, ruled downgraded.

Claim. The lease callback is only a point-in-time check, not a fence over activation; an attempt can lose its claim after the callback and still activate successfully.

Failure scenario. A stages v0.2 and passes before_step(Activation), then its process is suspended before apply_activation. Its lease expires and B takes ownership through reconciliation, observing the unchanged v0.1 stable link while fetching v0.3. A resumes and exchanges in v0.2. Since the displaced link still matches A's start observation, activation succeeds despite A no longer owning the claim. Even if A's heartbeat records the loss on resumption, apply_activation never consults that failure. B can subsequently fail activation because A changed its observed link.

Filed by Cadence. Fingerprint e45fc8d204be1643 over (file, claim).