From d2672fc02263dddfbc378f5063c60db3399c3aed Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Thu, 10 Sep 2026 13:25:47 +0000 Subject: [PATCH] docs: HQ dispute lock and purge contract --- CLAUDE.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index b482154..329de15 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -999,6 +999,15 @@ plane, each of which this codebase enforces: - **`FREE_INSTANCE_REAP_AFTER` must match admin's value.** Admin names the date in its warning emails; this side performs the delete, because it is the only service that knows which collections carry `instance_id`. +- **Disputes lock and purge instances.** HQ writes `instances.locked_at` when + an account is disputed and `instances.purge_after` only once the dispute + fails. `services.InstanceLocked` (60s cache) refuses sessions, API tokens + and agents on a locked instance, and `GetInstanceBySlug` hides it from the + host resolver. The check in `auth.Middleware` is explicit because the host + guard only runs when a host resolves. `ReapTerminatedInstances` purges once + both fields are present and `purge_after` has passed, independent of + `FREE_INSTANCE_REAP_AFTER`, and `ReapFreeInstances` skips locked instances + so a restore finds them intact. ## MongoDB Collections