Retract every guard for a stage being exited by deleting it, but
only once the instance has genuinely moved off that stage — or was aborted
on it: an aborted instance keeps its currentStage (no stage move), so the
abortedAt stamp is what licenses retracting the stage it still occupies. The
gate is abortedAt, not completedAt — normal completion parks the
instance on a structurally terminal stage whose guards must stay live.
Skip if it is still live on the stage (a concurrent loop-back re-entered
the stage and must keep its lock) or gone (leave the lock as the orphan
seam rather than silently unlocking a vanished instance — the same
over-lock direction as deploy).
Guard revisions are observed before the live-stage gate, then only those
revisions are deleted: a deploy landing in between changes the revision,
so the delete's revision fence fails instead of deleting the active guard.
Retract every guard for a stage being exited by deleting it, but only once the instance has genuinely moved off that stage — or was aborted on it: an aborted instance keeps its
currentStage(no stage move), so theabortedAtstamp is what licenses retracting the stage it still occupies. The gate isabortedAt, notcompletedAt— normal completion parks the instance on a structurally terminal stage whose guards must stay live. Skip if it is still live on the stage (a concurrent loop-back re-entered the stage and must keep its lock) or gone (leave the lock as the orphan seam rather than silently unlocking a vanished instance — the same over-lock direction as deploy).Guard revisions are observed before the live-stage gate, then only those revisions are deleted: a deploy landing in between changes the revision, so the delete's revision fence fails instead of deleting the active guard.