The boundary is a declaration — the lease-boundary family enters the lab mainline

Sources cited in this piece · the text the vectors are anchored to, quoted sentence by sentence: draft-li-rttp-iqa-addressing-02 (full text) · series page and revision history: datatracker · the family page, sealed: iqa.org/conformance/aicent-lease-boundary/ (four files, per-file SHA-256) · canonical source: Aicent-Stack/conformance · candidates/aicent-lease-boundary · merged into the lab mainline: Agent-Authority-Conformance lab, PR #212 (merged 3 November 2026) · the sibling record: lab PR #210 · the wall-side narrative: No. 24, the edge of the lease · the mid-task halts record: No. 18, what happens mid-task · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

Thirty-three minutes after its sibling, aicent-lease-boundary merged into the Agent-Authority-Conformance laboratory's mainline on the evening of 3 November — PR #212, merge commit 29423aa, rebased onto the sibling's merge so that two independent records entered one clean index. The wall-side story — how the lease instant settled at-or-past, and why a declared-convention clause predicted the shape of that settlement — is on record in No. 24. This piece records the artifact: fifteen cases that turn the boundary from a convention into a test, and the seam where this family deliberately stops and hands a question to its sibling.

The premise, briefly

One paragraph is enough, because No. 24 holds the full record. The draft's §6.1 does not pick a side at the lease instant: whether the instant counts as fresh or as expired is a deployment convention, declared per implementation — the clause makes the question answerable without pretending one answer is more correct. The walls settled their family of documents on at-or-past the same week, exactly the shape the clause anticipated: a common reading for those who want one, legible declarations for those that differ. The premise this family was built on survived contact with the argument: the floor held.

The declared boundary, all five cases

R-DECLARED tests the convention itself, and its five cases walk the whole space. LB-D01: a permit at the instant under a declared inclusive boundary — conformant. LB-D02: an expired refusal at the instant under a declared exclusive boundary — also conformant, and this is the design showing: both readings are conformant when declared, because the clause licenses both. LB-D03: a declaration that contradicts use — nonconformant, on a strict reading the CANDIDATE discloses rather than hides, because a declaration that does not state the boundary used defeats the function the clause gives declarations. LB-D04: no declaration at all — ambiguous by design, scored in named parts, because a clause that licenses both readings and asks for a missing declaration cannot be settled either way. LB-D05 is the layer split: a frame accepted at the instant under the verification procedure of §7.2 does not decide the reliance convention — frame validity and reliance are different layers, and the case fails any reading that fuses them.

What an expired lease still owes

R-NOEXTEND holds the line past the edge, and it is three cases of pure discipline. LB-E01: an answer read past its expiry is answered as expired — conformant, the whole obligation in one move. LB-E02: replaying the original observation as if it were fresh — nonconformant. LB-E03: reinterpreting the lease inside a locally added grace period — nonconformant, because a grace period is not a declaration the source knows about; it is a repair, and repairs are exactly what the vocabulary refuses to launder. R-WINDOW completes the picture on the other side: the window length is an operator choice, so an answer whose stated lease has not expired is not refused (LB-W01) — and refusing it by assuming the 120-second deployment default instead of checking the stated expiry is nonconformant (LB-W02). The figure is an observation in the source, never a conformance target; the stated expiry is what the wire carries, and the stated expiry is what gets checked.

The modes, when the organ is unreachable

R-MODE is where the family earns its independence from the sibling. The declared answer mode decides what an unreachable organ costs. In live mode the call is refused regardless of the age of any cached answer (LB-M01) — and a fresh cache does not rescue it (LB-M02): the mode was declared, and the declaration is what the cases enforce. In cached-lease mode the policy splits: a policy demanding a current observation refuses with authority_not_determined (LB-M03), a policy accepting lease-fresh evidence may admit the call (LB-M04) — both conformant, because the mode exists precisely so that deployments can make this choice legibly. An expired cache is refused as evidence_expired, the first applicable value in the vocabulary's order (LB-M05). And the seam holds: that an unreachable source ends in authority_not_determined, never read as assent, is the sibling family's case, taken here as a given — what these cases test is the mode-conditional refusal and the policy split, nothing twice.

How the two records entered the mainline

The merge mechanics are worth recording because they are the lab's rhythm working as designed. PR #210 merged first, at 17:47 UTC. PR #212 followed thirty-three minutes later — but between the two merges, the shared docs/CANDIDATES.md index had picked up the sibling's entry, so #212 arrived with a conflict and sat DIRTY while its six CI gates stayed green. The fix was the lab's own convention: the later merger rebases. #212 rebased onto 0da1e29, came back CLEAN, and merged as 29423aa. Two records, one index, no rebase-forcing, no history rewritten — the same append-only discipline the families apply to their own sources, applied by the laboratory to its mainline. Both family pages were sealed the next morning with per-file SHA-256, four files each, downloadable without contacting anyone.

What the family does not claim

The CANDIDATE discloses its edges, and three of them are judgment calls a reader can dispute with the sentence in hand. LB-D03 rests on a strict reading — the clause says implementations should declare their boundary and attaches no explicit consequence to a contradicting declaration; the family treats it as nonconformant because a declaration that defeats its own function is worse than silence, but the disagreement would be legitimate. Mid-task halting and the calling layer's enforcement are out of scope: only the answer the verification owes is tested. And LB-D01 to LB-D05 take at_boundary as a given input — the family tests how an implementation handles the boundary, not whether it correctly computes the boundary from the observation time and the lease expiry. The checker encodes one reading of the source; a correction in a later revision overrides it. What remains claimed is the part that matters: the edge is now a test.

What a deployer can do tonight

Four files, a Python 3 interpreter, and a declaration. A deployment states which boundary convention it uses and which answer mode it runs, hands its implementation the fifteen cases, and knows within minutes whether the code behaves the way the declaration says — the expired read answered as expired, the cache never laundering a repair, the stated expiry checked instead of the default assumed. As of this week that behavior is also the way the walls have settled the edge, and the family that tests it sits in a public mainline with a merge commit anyone can cite. The vocabulary side of the evening — the five values, the order, the null rule, the receipt — is the sibling record.

One line: the boundary is a declaration, the declaration is now a test, and the test merged into the lab mainline as 29423aa — fifteen cases that leave a deployment exactly two honest moves past the edge and one honest check before it.