The Principia Machina/TPS/5.7 The lock

Instruction artifact, machine-optimized text: TPS, section 5.7 The lock. Part of TPS and the TPM hub. Human-only edit (TPS 5.13). TPS 0.1.0 was declared final at revision 4 on 2026-09-22, a version declaration recorded in the foundations record; the chain begins at TPX's first landing (TPS 5.6.7). TPS 0.1.1, which changed only the status lines, was declared final on 2026-09-26, TPS 0.3.0, revision 6, on 2026-09-28, and TPS 0.4.0, revision 7, on 2026-09-30. This page is revision 8 of the tree, declared final as TPS 0.5.0 by H-DECL on 2026-10-03 (naming TPS_0.5.0.txt by its file digest and its D(TPS)); revision 7 is carried whole, and revision 5, proposed as 0.2.0, stays undeclared. The text below is this section of the TPS artifact at 0.5.0, verbatim; the whole artifact and its file digest are on The Principia Machina/TPS. Human readers: the contents page is the map.

TPS 5.7  THE LOCK
purpose: the lock page; acquisition by base-revision edit and its
         written fields; the save hook; the grant number as fencing
         token; heartbeat; one lock, never nested
governs: 5.7 | version: 0.5.0 (proposed) | class: instruction artifact
audience: operator, agent

5.7.1  TPX owns the mutex. One lock page per container, on the wiki,
       acquired by base-revision edit, so acquisition and its history
       rest on the platform's own conflict detection and page history;
       a TPX save hook refuses an acquisition out of queue order or
       before expiry; the grant number is a fencing token checked by
       TPX's landing API; heartbeat extends a lock to at most 24 h;
       petitions queue in revision order; identifier ranges are leased;
       one lock at a time, never nested (D14, D32). The mutex holder is
       the sole allocation authority for the container's identifier
       mark; holding the grant authorizes a CA-GTP to request register
       writes of TPX, not to make them (see 5.4, 6.4). [I-081] [I-137]
       [D48]
5.7.2  Acquire by an edit carrying the base revision ID that writes
       holder account, grant number (previous plus one), grant time, and
       expiry, all in server time; a failed edit means another holder.
       [B-12]
5.7.3  A heartbeat extends expiry, never past 24 hours from grant and only as
       the NO-PROGRESS rule allows (5.7.8); it is kept in TPX's table, and the
       lock page is written at acquisition, at release and at each EXPIRY STEP
       (5.7.9). [B-12] [D136.1] [D141.1]
5.7.4  Handover: an ordered petition queue on the collaboration page,
       ordered by the wiki's revision order of the petition edits; on
       release the head of the queue acquires; the others wait on the one
       ahead; if the head has not acquired within the ACQUISITION WINDOW,
       the next waiter may (see 5.8, 7.2). [B-12] [I-132]
5.7.5  Coworkers receive a leased identifier range per assignment. A
       release is valid only after a final push, in that order (see
       5.10). TPX's RESERVED RANGE (D111.1): one range per register,
       {prefix, low, high, next}, held by TPX, fixed at instantiation,
       identifiers "<prefix>-<n>", disjoint from every coworker lease by
       construction, TPX leasing to coworkers only below low; the
       leased-range form with TPX as the lessee, from which TPX
       allocates HOLD, RELEASE and the corroboration it writes on a
       ledger MATCH while another account may hold the mutex (3.1.11).
       The range's size and position are TPX build values. [B-12]
       [I-084] [D111.1] [D119.1]
5.7.6  The lock page is written by AI-LEAD, by AI-CO when head and in the
       window, and cleared by H-OP with an audit line (see 5.13). [I-102]
5.7.7  Under a CLOSED access policy TPX refuses a queue-head acquisition
       from an account not on the UWC's access list (see 5.16). [I-153]
       [D52]
5.7.8  THE NO-PROGRESS RULE (D136.1). A heartbeat extends a lock only while
       its holder has pushed or returned within the NO-PROGRESS LIMIT, a
       tuning option, 6 hours by default and never above the 24-hour ceiling
       (7.2.24); past it TPX refuses the next extension with its reason and
       the lock ends at its expiry. [D136.1]
5.7.9  EXPIRY STEPS (D141.1). Heartbeats live in TPX's table. The lock page
       and the badge's EXPIRY (5.10.5) are written at acquisition, at release
       and at each EXPIRY STEP, a tuning option (30 minutes), both carrying
       exactly the expiry TPX enforces. [D141.1]
5.7.10 AGENT STOP AND THE LOCK (D136.1). H-OP's AGENT STOP refuses HEARTBEAT
       (5.3.38); when the stop is lifted, TPX extends every held lock's
       expiry, and the queue head's ACQUISITION WINDOW, by the stop's length,
       writing each lock page and badge once; the stop's length counts toward
       neither the 24-hour ceiling nor the NO-PROGRESS LIMIT. The queue head's
       acquisition inside its window is lane 2 and never refused on budget; a
       CONTAINED queue head is passed over as if its window had closed.
       [D136.1]
5.7.11 LEASES OF WHOLE VOLUMES (D140.1). Every lease, TPX's reserved range
       included, is a whole number of volumes from a volume boundary, at most
       1,000 identifiers, with VOID lines as 3.1.13 states; 5.7.5's "TPX
       leasing to coworkers only below low" reads as whole volumes below the
       reserved range's first volume. [D140.1]