Lease Expiry Sweep¶
Time-bounded policy — instantiates Reachability-Guided Resource Reclamation
Grants each resource a time-limited lease that its holder must renew, and reclaims whatever lease lapses — treating renewal as a liveness signal.
Lease Expiry Sweep replaces the hard problem of proving unreachability with a cheaper proxy: keep a resource only as long as someone keeps asking for it. Every allocation comes with a time-limited lease; the holder must renew before it expires, and a sweeper periodically reclaims any resource whose lease has lapsed. The bet is that a holder who still needs a resource will bother to renew, and one that has crashed, disconnected, or moved on will not — so elapsed time without renewal stands in for "no longer reachable." This makes reclamation self-healing against holders that vanish without releasing anything, and it needs no reference graph at all. The trade is that a lease measures attention, not reachability, and the two can diverge.
Example¶
On a busy conference Wi-Fi network, a DHCP server hands out IP addresses from a limited pool. Each address is issued not permanently but as a lease — say, for two hours. A laptop that stays connected renews its lease at the halfway mark and keeps its address; a laptop whose owner packs up and leaves simply stops renewing. When that lease's clock runs out with no renewal, the server marks the address free and returns it to the pool for the next arrival. The server never tries to discover whether the departed laptop is "reachable"; it infers the laptop is gone from the fact that nobody renewed. Across a day of people coming and going, the pool stays usable purely because unrenewed leases expire and get swept, with no explicit release required from anyone.
How it works¶
A resource is granted with a time-to-live. The holder renews before expiry, which resets the clock; each grant-and-renewal cycle is an epoch fenced so that a late or duplicate renewal cannot be mistaken for a current one. A sweeper runs on an interval, finds leases whose deadline has passed without renewal, and reclaims those resources. Optionally a short grace period past the nominal deadline tolerates clock skew and network delay. Reachability is never computed; the liveness signal is entirely temporal — renewed means keep, lapsed means reclaim.
Tuning parameters¶
- Lease duration (TTL) — short leases reclaim abandoned resources quickly but flood the system with renewal traffic and risk cutting off a slow-but-live holder; long leases are quiet but let dead holders squat resources longer.
- Renewal fraction — how early in the term a holder is expected to renew. Renewing earlier buys safety margin against delay; renewing later cuts chatter.
- Grace period — slack past the deadline before reclaiming, tolerating clock skew at the cost of holding lapsed resources a little longer.
- Sweep interval — how often the reclaimer scans for expired leases, trading reclamation latency against scanning overhead.
When it helps, and when it misleads¶
Its strength is robustness without global knowledge: it never computes a reference graph, needs no explicit release, and self-heals against holders that crash or disappear — ideal when holders are remote, numerous, or untrusted. Its failure mode is the proxy itself. A TTL measures whether someone renewed, not whether the resource is truly needed: set it too short and you reclaim from a live holder that was merely slow, causing spurious loss; set it too long and dead holders leak capacity. Worse, a holder whose lease expired might resume — after a pause or a network partition — and act on a resource that has already been reassigned, unless it is fenced.[n1] The classic misuse is treating a live lease as proof of reachability and building correctness on it. The guarding discipline is to fence every lease with a monotonic token and to size the TTL to the holder's real renewal cadence.
How it implements the components¶
reclamation_policy— reclaim any resource whose lease has lapsed without renewal; expiry is the policy, with no further test applied.synchronization_and_epoch_rule— the lease term and its fencing token order grant, renewal, expiry, and reclamation so that stale renewals and resumed holders cannot corrupt the outcome.leak_and_retention_monitor— it watches for leases that renew forever (zombie holders quietly squatting) or churn abnormally, surfacing over-retention the TTL alone would hide.
It computes no reference_and_dependency_graph, reachable_closure_record, or graph-derived candidate_reclamation_set — lease expiry never establishes true reachability; those graph-based verdicts belong to reference_counting and tracing_mark_sweep_cycle — and it holds no pending_finalizer_and_inflight_protection for an already-decided deletion, which is tombstone_then_delete's.
Against its nearest twin tombstone_then_delete: this mechanism decides reclamation from elapsed time without renewal, a liveness proxy standing in for reachability; that one executes an already-decided deletion and merely defers physical removal for convergence.
Related¶
- Instantiates: Reachability-Guided Resource Reclamation — supplies a time-based liveness proxy when computing true reachability is impractical.
- Sibling mechanisms: reference_counting · tracing_mark_sweep_cycle · generational_collection · concurrent_collection_barrier · cycle_detection_pass · dry_run_reclamation_report · reachability_graph_visualization · tombstone_then_delete · weak_reference_registry
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Lease Expiry Sweep operates as a live operational control that automatically routes, enforces, adapts, or responds during execution because it grants each resource a time-limited lease that its holder must renew, and reclaims whatever lease lapses — treating renewal as a liveness signal
Independent corroboration: The frozen evidence defines Lease Expiry Sweep as 'Grants each resource a time-limited lease that its holder must renew, and reclaims whatever lease lapses — treating renewal as a liveness signal', so its operative form is Control, Automation & Runtime.
Nearest alternative: Rule, Policy & Commitment — A running sweeper automatically expires and reclaims lapsed leases, so live control dominates the time-bounded policy.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Single lineage
Present-day reach: Specialized
Rationale: Distributed resource-management systems developed expiry scans that reclaim objects whose time-bounded leases were not renewed.
Review resolution: Both independent reviews place the primary lineage in computer_science. The queued differences (encyclopedia_synthesis_disagreement) concern secondary metadata rather than primary provenance. The final retains no alternate origin domains only where a reviewer supplied a formative-lineage rationale; downstream application by itself is not treated as origin. origin_mode=single_lineage records the relationship among origin traditions, while domain_reach=specialized records application breadth separately. encyclopedia_synthesis=true reflects whether either reviewer identified a corpus-specific synthesis, and confidence=high preserves the more cautious evidence assessment.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The lease is only ever an approximation of reachability — its whole premise is that renewal correlates with need. Where that correlation is weak (holders that need a resource but cannot renew, or renew out of habit past real need), the mechanism should be backed by a genuine reachability check rather than trusted on its own.
[n1] A fencing token — a monotonically increasing token issued with each lease so the underlying resource can reject any holder that presents a stale token after its lease expired, preventing a paused-then-resumed holder from acting on a resource already reclaimed and reassigned. ↩