SandboxAuthority
Who may dispatch a provider operation.
owner: the owning branch's current lease holder at epoch (fence checks the writer lease). cleanup: gc, which holds no branch lease and keeps working after the owning branch is deleted; fence checks that the resources row (tenant-scoped) still carries this claim and is still collectable: releasing, release_failed, or live past its provider expiry. A later claim supersedes an earlier one, so of two concurrent gc runs only the latest claim holder dispatches.
A union discriminated by kind.
owner
kind"owner"required"owner": the owning branch's lease holder dispatches this operation.
branch_idBranchIdrequiredThe branch that owns the resource (its resource-ledger owner).
epochnumberrequiredThe owner's lease epoch this operation is dispatched under.
cleanup
kind"cleanup"required"cleanup": gc dispatches this operation under a cleanup claim, with no branch lease.
resource_idstringrequiredThe id of the resource ledger row gc is cleaning up.
claimstringrequiredThe cleanup claim token gc wrote on the resources row (cleanup_claim) by compare-and-set.