update

proto/control_plane.proto

@@ -55,16 +55,28 @@ message ClosingNotice {
 }
 
 // OwnershipAnnounce broadcasts first-touch ownership claims for cart IDs.
-// First claim wins; receivers SHOULD NOT overwrite an existing different owner.
+// Receivers arbitrate concurrent cold-cache first-touch claims using
+// last_changes: the pod whose local grain has the earliest lastChange
+// wins; ties resolve to the lexicographically smaller hostname.
 message OwnershipAnnounce {
-  string host = 1;               // announcing host
-  repeated uint64 ids = 2;   // newly claimed cart ids
+  string host = 1;                       // announcing host
+  repeated uint64 ids = 2;               // newly claimed cart ids
+  // last_changes is the per-id UnixNano timestamp of the announcing
+  // pod's local grain's lastChange at the moment of broadcast. -1
+  // means the announcer didn't have a local grain for this id (legacy
+  // path / TakeOwnership without prior load); receivers treat -1 as
+  // "no arbitration done" and accept the remote claim as before. The
+  // slice is aligned 1:1 with ids.
+  repeated int64 last_changes = 3;
 }
 
 // ExpiryAnnounce broadcasts that a host evicted the provided cart IDs.
+// last_changes is carried for wire-shape symmetry with OwnershipAnnounce
+// and is informational here (expiry is unilateral).
 message ExpiryAnnounce {
   string host = 1;
   repeated uint64 ids = 2;
+  repeated int64 last_changes = 3;
 }
 
 message ApplyRequest {