carlos / platform Public

Found while planning instance lifetimes (plan 1 of self-serve moves, rev 19/20). Two pre-existing exposures on main that the lifetimes plan does not widen but also cannot close:

1. A claims-off box with an older binary that starts or returns after the fleet has moved on (a rollback, a cloned image, a box that was down) runs whatever that binary does: today's unconditional app purge in domains.Reconcile 1d, and retention's DeleteVersion. Claims-off startup bypasses the joining gate (internal/host/joining.go), so nothing refuses it.

1. Retention selects a version to prune, pauses, the app is trashed and purged, a new app of the same name ships the same version, retention resumes and deletes the successor's release (internal/host/retention.go → release.DeleteVersion in prune.go). Two uncoordinated deleters of app objects; a pre-delete check cannot close it.

What plan 1 does instead: claims-off boxes stop auto-purging from this release on (the console's expiry pass sweeps trash); boxes publish a lifetimes-1 capability in their edges file and the cutover door refuses while any file lacks it; a file that later loses it pages. That covers the rolled fleet, not an old binary arriving later.

Proposal for a separate piece of work: an enforced floor for claims-off boxes (a joining gate that reads the deployment's minimum build from the bucket and refuses to run the agent below it), and retention made conditional on the app lifetime (plan 1's apps.lifetime) or moved into the console's serialised app workflow. Neither blocks the lifetimes plan; both need a ruling on scope.