LeaseLedger v0.1.2 — claim progress and deterministic fault-injection

Reproduced correctness bug

The previous claim path processed up to 100 expired, exhausted leases, then incorrectly returned None even with a lower-priority ready job. Workers configured to stop when empty could exit despite runnable work.

Fix

Commit expired-lease dead-letter cleanup in bounded 100-row write transactions, continuing selection until work is found or the queue is actually empty.

Verified evidence

• Regression creates 121 high-priority expired terminal leases and a ready lower-priority job, proving the old implementation fails and the new one succeeds.
• Independent seeded reference state machine exercises 4 × 160 deterministic operations: enqueue, claim, expiry, stale fencing, retry, heartbeat, manual dead-letter requeue, and event history.
• 32 automated tests pass, plus Ruff lint/format and reproducible benchmark smoke.
• CI verified on Python 3.11, 3.12 and 3.13.

Read docs/notes/expired-lease-cleanup-progress.md for failure analysis and limitations.

Explicit limits

This remains an at-least-once, single-host SQLite queue; there is no exactly-once external guarantee, formal model-checking proof, cloud replication or production throughput promise.

LeaseLedger v0.1.1 — verified online backups and crash recovery

Reliability improvements

• Consistent online SQLite backup using the SQLite backup API; no live .db file copying.
• New leaseledger backup and leaseledger verify CLI operations.
• Snapshot checks page and foreign-key integrity, checkpoints WAL and publishes to a new path atomically without overwriting existing files/symlinks.
• Added explicit backup/recovery operations runbook with at-least-once replay caveats.
• 30 tests (up from 22): added online backup concurrency/error handling and an abrupt OS-process worker-crash recovery test.

Independent verification

CI passed on Python 3.11, 3.12 and 3.13, plus Ruff lint/format and reproducible benchmark smoke.

Scope / guarantees

Single-host SQLite WAL only; at-least-once, not exactly-once external side effects. Backups are manual and not encrypted or replicated. Do not restore over a running database. See docs/backup-and-recovery.md for recovery steps.

LeaseLedger v0.1.0 — durable fenced job processing

What is included

A tested single-host, multi-process durable queue using Python and SQLite WAL:

• Atomic leases with fencing tokens that reject stale acknowledgements
• Idempotent submissions, delayed/prioritized scheduling, worker heartbeat
• Bounded exponential retries, persistent dead-letter jobs and an event journal
• CLI and trusted local Python handler interface
• 22 automated tests, including four separate OS processes claiming 48 jobs
• CI on Python 3.11, 3.12 and 3.13, Ruff lint/format and a measured benchmark smoke job

Reproducible setup

See README for install/CLI demo and docs/notes/why-fencing-tokens.md for the transaction and recovery reasoning.

Guarantees and limits

At-least-once, not exactly-once external effects. SQLite is a local single-host database, not a distributed consensus backend. The handlers run trusted local Python and are not sandboxed. Benchmarks report actual local measurements, not a production performance claim. This is an original engineering portfolio project rather than an existing deployed SaaS.