[0xcadams]

What

Give guest demos 20 cumulative minutes of ready authority across restarts, including idle time. Control persists one hard deadline; publisher and ingress policy guards enforce it locally even when control is unavailable.

This is the guest-authority layer of the coordinated public-ingress/native-peer rewrite. It follows #469 and will sit below the final integration gate in #470.

Why

The existing 15-minute/5-MiB trial depends on hosted usage reports and reconstructs its deadline from timestamps. Removing that accounting must preserve a durable time budget and prevent a restarted demo from reclaiming authority that an offline process can still use.

Changes

• Persist a fixed ready deadline and the latest issued serving horizon. Settle each interval once, retain the outstanding lease tail, and fence replacement demos until that authority expires.
• Cap publisher leases, ingress projections, signed guest share permissions, and both serving policy leases at the guest deadline. A short remaining budget also caps preparation-time policy.
• Remove guest byte totals, transfer exhaustion, and usage-report dependencies. Apply server-owned concurrency and byte-rate limits, qualified with the actual demo page, fonts, and ping.
• Cover restart settlement, delayed recovery, immutable deadlines, and an open visitor connection during a control outage with PostgreSQL/race/runtime checks.
• Keep schema version 1 and all API/protocol/package versions unchanged; update the coordinated fresh-database baseline identity and cutover guidance.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:03:28.198985Z	ce46b89	New commits
🔒 Security Review	✅ Completed 2026-10-26T22:07:57.199487Z	ce46b89	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[0xcadams]

Local checks passed on aac7353:

• mise exec -- task generate-check
• mise exec -- task format-check
• mise exec -- task go:test
• mise exec -- task go:lint
• focused guest/traffic/policy/output race checks
• PostgreSQL race checks for guest lifecycle, current source/identity, and baseline rejection
• TestIntegrationGuestDemoPublishesWithoutSignIn and TestIntegrationGuestDemoDeadlineClosesConnectionsWithoutControl, using the actual demo page/fonts/ping and an idle open visitor TLS connection during a control outage.

The website documentation/source-pin PR is being prepared. The lease tail is deliberately charged and fenced until expiry; a control-side close is not proof that an offline owner stopped.

[0xcadams]

Matching website docs and source pin: https://github.com/tnldotdev/tnl.dev/pull/190. #470 is restacked above this layer as a72c800; the native stack is now #475.

Fresh CI currently reports a failure in Clients (management, 1/1). I am investigating that failure before starting the next layer.