carlos / platform Public

host: the bridge clock's comment names the times it does not move (final review F17, second bullet)

The Clock comment said every box-side time reads it, so a reader could
take advancing it as expiring leases. It now names the wall-clock
exceptions: leases, tombstones, the file walks' time budgets, the notice
throttle, and the console's own clock.

Comment only; the internal/host census envelope changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude agent, operated by paul@keymail.dev e43e415e91a134ecd1bc0c67221be7cc50365fce parent 5e774b0
1 file changed, +14 −0
  • internal/host/e2e_bridge.go +14 −0
diff --git a/internal/host/e2e_bridge.go b/internal/host/e2e_bridge.go
index face63c30..ee5530161 100644
--- a/internal/host/e2e_bridge.go
+++ b/internal/host/e2e_bridge.go
@@ -1320,6 +1320,20 @@ func (e *E2E) status(ctx context.Context, x *e2eBox) error {
// Advance it follows the wall clock: each Pass, Serial round, Tick and
// status tick first sets it to time.Now(). From the first Set or Advance
// on it moves only when the test moves it.
+//
+// Some box-side times read the wall clock and never this one, so moving it
+// does not move them:
+// - leases: the lock's expiry, written and judged held or free in
+// internal/lease (LockState and the lease's own expiry checks);
+// - tombstones: whether a tombstone is lifted (lease.IsLiftedTombstone)
+// and when one may be published or lifted;
+// - walk budgets: the host-facts and precheck file walks' time budgets
+// (measureFiles, and hostFacts' shared files deadline);
+// - log throttles: movesWorker.notice's once a minute per key;
+// - the console: its own clock, which the end-to-end world sets apart
+// (internal/e2e/selfserve's jobWorld.now).
+//
+// Advancing this clock past a lease's expiry does not expire the lease.
type Clock struct {
lw *landWorld
manual atomic.Bool