Leases, renewal, and nothing expiring silently

Walrus storage is leased. A lease is paid through an epoch and then it is over. Nothing in the substrate renews it on your behalf, and nothing announces the day it lapses.

That silence is what makes a lapsed lease the worst failure a store can have. Nothing errors. The write succeeded, the receipt is on chain, the listing looked right yesterday, and the first symptom is a read that does not answer — at the moment someone needed the bytes, which is the only moment anyone looks.

So the instance treats a lease as state it owns.

Four rules

The end is recorded at write time. Every object’s lease end goes into the storage layer’s own row as part of the write, taken from the store response. It is not inferred afterwards from something else.

An unknown end is a flag, not a pass. Some store responses do not carry an end, and some rows predate the column that holds it. Those rows record the end as unknown, and the check treats unknown as something to look at. The failure being designed out is a check that passes vacuously on the rows it knows least about.

The check flags leases approaching their end, measured against a deliberately high-side estimate of the current epoch. An early flag costs a re-store; a late one is an outage.

The sweep re-stores before the end arrives, at a wider threshold than the alarm, so a routine run refreshes an asset before anything fires. The same bytes re-register storage under the same blob id, so nothing a receipt points at moves, and the row learns its new end from the store response.

The check and the sweep share one implementation of “near expiry”, under its own test. Two copies of that predicate would eventually disagree, and the disagreement would be invisible until the day it mattered.

What the sweep never does

It does not delete a blob, a row, or a receipt. A blob whose storage has already been reclaimed is recorded as lost and left alone. Recovery from that state is a fresh store from the source — a different operation, with a different name and a different record, so nobody can mistake one for the other after the fact.

What the badge on this page means

The mechanism is shipped: the end is recorded on every write, the check runs alongside the instance’s other health checks, and the sweep is a script an operator runs. It has not yet run against a stored asset on the hosted instance, which is exactly what unexercised says — the same gap is listed under what is not proven on the testnet instance.

Where to go next

• A storage receipt is not a provenance receipt — why a lapsed lease does not touch the receipt.
• What survives Permafrost, and what does not — what a holder keeps when a lease does lapse.