@@ -0,0 +1,41 @@
+#!/bin/sh

@@ -0,0 +67,4 @@
+  end
+  -- now >= expires_at: the lease is logically expired. Reclaim it. This covers
+  -- PTTL == 0 (rounding) and PTTL > 0 with past expires_at (TTL inconsistency).
+  redis.call('DEL', KEYS[1])

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +1,889 @@
+(in-package :star-server-tests)

@@ -0,0 +1,41 @@
+#!/bin/sh

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +67,4 @@
+  end
+  -- now >= expires_at: the lease is logically expired. Reclaim it. This covers
+  -- PTTL == 0 (rounding) and PTTL > 0 with past expires_at (TTL inconsistency).
+  redis.call('DEL', KEYS[1])

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +1,889 @@
+(in-package :star-server-tests)

@@ -0,0 +24,4 @@
+#   Direct adapter commands: AUTH, PING, EVAL, SCAN, GET (list/inspect helpers).
+#   Lua script commands:      GET, SET, DEL, INCR, PTTL, TIME.
+# Administrative, dangerous, pub/sub, and unrelated-key access stays denied.
+printf 'user default on #%s ~starintel:target-lease:v1:* -@all +auth +ping +eval +get +set +del +incr +pttl +time +scan\n' \

@@ -0,0 +42,4 @@
+      end
+    end
+  end
+  return {saved.code, saved.record or '', tostring(redis.call('PTTL', KEYS[1]))}

@@ -0,0 +131,4 @@
+  redis.call('SET', KEYS[2], cjson.encode({digest=ARGV[1], code='expired', record=encoded}), 'PX', ARGV[2])
+  return {'expired', encoded}
+end
+local expires = math.min(now + tonumber(ARGV[8]), tonumber(record.acquired_at) + tonumber(record.maximum_lifetime_ms))

@@ -0,0 +67,4 @@
+  end
+  -- now >= expires_at: the lease is logically expired. Reclaim it. This covers
+  -- PTTL == 0 (rounding) and PTTL > 0 with past expires_at (TTL inconsistency).
+  redis.call('DEL', KEYS[1])

@@ -0,0 +42,4 @@
+      end
+    end
+  end
+  return {saved.code, saved.record or '', tostring(redis.call('PTTL', KEYS[1]))}

@@ -0,0 +131,4 @@
+  redis.call('SET', KEYS[2], cjson.encode({digest=ARGV[1], code='expired', record=encoded}), 'PX', ARGV[2])
+  return {'expired', encoded}
+end
+local expires = math.min(now + tonumber(ARGV[8]), tonumber(record.acquired_at) + tonumber(record.maximum_lifetime_ms))

@@ -0,0 +67,4 @@
+  end
+  -- now >= expires_at: the lease is logically expired. Reclaim it. This covers
+  -- PTTL == 0 (rounding) and PTTL > 0 with past expires_at (TTL inconsistency).
+  redis.call('DEL', KEYS[1])

@@ -0,0 +24,4 @@
+#   Direct adapter commands: AUTH, PING, EVAL, SCAN, GET (list/inspect helpers).
+#   Lua script commands:      GET, SET, DEL, INCR, PTTL, TIME.
+# Administrative, dangerous, pub/sub, and unrelated-key access stays denied.
+printf 'user default on #%s ~starintel:target-lease:v1:* -@all +auth +ping +eval +get +set +del +incr +pttl +time +scan\n' \

@@ -0,0 +42,4 @@
+      end
+    end
+  end
+  return {saved.code, saved.record or '', tostring(redis.call('PTTL', KEYS[1]))}

@@ -0,0 +131,4 @@
+  redis.call('SET', KEYS[2], cjson.encode({digest=ARGV[1], code='expired', record=encoded}), 'PX', ARGV[2])
+  return {'expired', encoded}
+end
+local expires = math.min(now + tonumber(ARGV[8]), tonumber(record.acquired_at) + tonumber(record.maximum_lifetime_ms))

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +24,4 @@
+#   Direct adapter commands: AUTH, PING, EVAL, SCAN, GET (list/inspect helpers).
+#   Lua script commands:      GET, SET, DEL, INCR, PTTL, TIME.
+# Administrative, dangerous, pub/sub, and unrelated-key access stays denied.
+printf 'user default on #%s ~starintel:target-lease:v1:* -@all +auth +ping +eval +get +set +del +incr +pttl +time +scan\n' \

@@ -128,0 +185,4 @@
+      (and (consp metadata) (eq (car metadata) :obj))))
+
+(defun valid-lease-metadata-p (metadata)
+  "Metadata must be a bounded JSON object: object shape, bounded key count,

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -128,0 +185,4 @@
+      (and (consp metadata) (eq (car metadata) :obj))))
+
+(defun valid-lease-metadata-p (metadata)
+  "Metadata must be a bounded JSON object: object shape, bounded key count,

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +444,4 @@
+         (record
+           (when has-encoded
+             (handler-case
+                 (deserialize-lease-record encoded)

@@ -0,0 +1,755 @@
+(in-package :star.leases)

@@ -0,0 +444,4 @@
+         (record
+           (when has-encoded
+             (handler-case
+                 (deserialize-lease-record encoded)

@@ -0,0 +661,4 @@
+                                (valkey-test-command
+                                 store deadline "TIME")))
+                          (when (and (integerp ttl)
+                                     (/= ttl -1)

@@ -0,0 +504,4 @@
+      (is (eq :acquired (star.leases:lease-outcome-code first)))
+      ;; Tamper: replace the stored lock_key so the record's canonical identity
+      ;; no longer matches. The JSON is syntactically valid but contract-invalid.
+      (let ((tampered (jsown:parse original-json)))