Repository navigation
id: world lifecycle and migration — tombstone, verified export/import as new world (from #3397 Phase 4) #3899
Description
World-specific implementation follow-on from the #3397 design (doc/2026-11-01_design_id3397.md, PR #3853), Phase 4 of its phased plan.
Scope: world lifecycle operations inside one partition and across partitions by lifecycle move only — durable idempotent tombstone/delete (fence world, revoke memberships/invites, remove name resolution; blob bytes reclaimed only by reference-safe partition-local GC); world migration as export under source authorization → import and verify as a new world with a new ID in the target partition → reissue memberships/invitations under target policy → switch explicit discovery → tombstone source. No live move, no dual-homing; source stays authoritative until verification succeeds; cleanup is a separate retention/reference step.
Not this issue: #3402 is verified account-store (user-store) transfer and cleanup — it does not implement world migration (per the #3397 doc, Phase 4/6 notes). Account migration's per-world guest/exit treatment is #3402/#3404 territory; this issue owns the world side.
Authority boundary: #3397 is design-only and is not an implementation authorization. Implementation ordering follows the doc: this phase depends on Phases 1–3 (#3399, the world routing/admission follow-on, and partition-local world blobs building on #3401).
Acceptance: negative tests from the #3397 doc's matrix pass for this slice — migration interrupted before verification leaves source authoritative, target non-serving, retry idempotent; stale writers fenced; deletion racing a live reference/import preserves the reference; name reuse after tombstone does not resurrect old IDs, memberships, invites, or blob references.
Acceptance criteria
- Migration interrupted before verification leaves the source authoritative, the target non-serving, and a retry idempotent.
- Stale writers are fenced after tombstone/move; a deletion racing a live reference or import preserves the reference.
- Name reuse after tombstone does not resurrect old IDs, memberships, invites, or blob references.
- World migration is export → import-and-verify as a NEW world with a NEW ID → reissued memberships/invitations under target policy → discovery switch → source tombstone; no live move, no dual-homing.
- Dependencies hold: Phases 1–3 (code issues id: add immutable jurisdiction and migration metadata to hosted directory #3399, id: partition-scoped world routing, names, and admission (from #3397 Phase 2) #3898, and partition-local world blobs on id: isolate hosted blobs by jurisdiction and minimize shared directory #3401) have landed.
Activity
dezren39 commentedon Nov 1, 2026
Intake review
Related: design code issue #3397 (PR #3853) Phase 4; depends on #3399 (Phase 1), the Phase 2 world routing/admission follow-on (code issue #3898), and partition-local world blobs building on #3401. Not #3402 — that is account/user-store transfer, a different layer.
Notes: The issue body already carries this slice's acceptance in prose (the #3397 doc's negative-test matrix); the appended section restates it as the canonical checklist. The guest/exit treatment of accounts during a world migration is explicitly #3402/#3404 territory — keep it out of this slice.
Risks: Migration is the highest-risk slice of the #3397 set: a verification or fencing bug can resurrect tombstoned worlds or strand references. The source-authoritative-until-verified ordering is the invariant every test hangs off.
Suggested approach: Build only after Phases 1–3 land; start from the doc's interruption/race matrix as the test list, and treat export/import as new-world creation (new ID) rather than any form of live move.
— fleet monitor intake enrichment, 2026-11-01 run (protocol §5). Acceptance criteria appended to the body where missing; labels normalized.
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 3, 2026
🤖 Agent note · triaged — still live, dependency-blocked
(all three verified OPEN 2026-11-03T19:40Z; id: implement verified resumable user-store migration and safe cleanup #3402/id: implement fenced jurisdiction migration control plane #3404 account-side migration likewise open.)
pkgs/id/src/world/on main contains actor/clock/core/handle/metrics/replica/replication/signed only — no tombstone/lifecycle, export/import-as-new-world, or migration module; the onlytombstonehits in the tree are the id: design: jurisdiction-partitioned hosted worlds and world blobs #3397 design docs and unrelated board/reference code. Nothing to close as done.triaged.