diff --git a/docs/cluster.md b/docs/cluster.md
index f40a47523..a8e6248fd 100644
--- a/docs/cluster.md
+++ b/docs/cluster.md
@@ -299,8 +299,8 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   starts none, and a round whose registry is down fails before it captures.
 - **Restore.** A lost node's replica is adopted like an archive: the first
   `Lookup` that reaches another node after the lease expires takes the row,
-  records the claim as archived on the replica with the adopter pool's
-  retention window, and the next call wakes it
+  records the claim as archived on the replica with the row's retention deadline,
+  or the adopter pool's window when it has none, and the next call wakes it
   through the archive wake, which restores the guest with its memory and
   processes. The claim resumes from its last committed replica: everything
   after it, and the connections open at the time, are lost: up to the longer of
@@ -330,15 +330,18 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   checkpoint behind, the same residue as a node that never returns.
   A restart keeps the node's own live row for a running claim and takes the checkpoint a crashed round left on
   it; a claim whose row another node holds, or whose row a finished adopter
-  consumed, is dropped with its VM. A replica row has no retention deadline: the
-  hourly sweep never purges it, because no round refreshes it while the claim is
-  hibernated, and retention starts when the claim is archived or adopted. The
+  consumed, is dropped with its VM. A live claim's replica row has no retention
+  deadline: the hourly sweep never purges it, because no round refreshes it while
+  the claim is hibernated, and retention starts when the claim is archived or
+  adopted. A row the node holds with no claim, as after reconcile dropped it
+  because the VM record was gone, gains the retention deadline on that sweep: the claim stays adoptable
+  until it passes, and `archive_delete_after_seconds` 0 keeps the row. The
   rows of a node that never returns therefore stay until a client adopts them, a
   bounded residue of one row and up to two checkpoints per claim: the row's, and
   a committed pending replica or a previous replica the node died before
   deleting. Their metas stay live, so offline reclamation keeps them.
   They are archive checkpoints (`"archive": true` in their meta) that no
-  registry row names, which an operator can delete. Apart from that and the
+  registry row names, which an operator can delete. Apart from these and the
   lease rule the sweep is unchanged.
 - **Self-fencing.** A node whose renewal is overdue by 12 seconds (the lease
   length minus a 3 second margin, counted from the start of the last renewal
@@ -373,7 +376,9 @@ checkpoint store and keeps each claim's registry row on the latest snapshot:
   claim's first replica included: the agent relay
   (including parked keep-alive relays, whose later RPCs never pass the
   resolution gate), the exec call, port relays and preview requests. A client
-  retries and meets the 503 until the lease is back or the claim moved.
+  retries and meets the 503 until the lease is back or the claim moved. Neither
+  an API call nor the idle sweep starts a hibernate or a wake of such a claim
+  while the fence is closed, so an idle claim stays billed until the fence lifts.
   Streams of claims that are not replicated stay open.
 - **Availability.** The design chooses consistency over availability for
   replicated claims. A registry outage longer than the fence threshold (12
diff --git a/docs/deploy.md b/docs/deploy.md
index c6c44af5a..ae585a846 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -841,8 +841,10 @@ only; computing durations or prices stays with the consumer.
       vm          text        NOT NULL DEFAULT '',
       key         text        NOT NULL DEFAULT '',
       template    text        NOT NULL DEFAULT '',
+      net         text        NOT NULL DEFAULT '',
       size        text        NOT NULL DEFAULT '',
       tenant      text        NOT NULL DEFAULT '',
+      deadline    timestamptz,
       volumes     text[],
       volumes_rw  text[],
       children    text[],
diff --git a/docs/sandboxd-api.md b/docs/sandboxd-api.md
index 63f1795d3..1962935a8 100644
--- a/docs/sandboxd-api.md
+++ b/docs/sandboxd-api.md
@@ -491,7 +491,8 @@ archives. When to hibernate is the caller's policy — the
 node only provides the transition. 204 on success, 404 unknown id or wrong
 token, 409 on the egress lane or when volumes are attached (neither kind of
 sandbox hibernates; see [egress](egress.md)), 429 while the disk is under
-[`disk_reserve`](deploy.md).
+[`disk_reserve`](deploy.md), 503 `lease lost; retry` for a replicated claim that
+is not archived while its node's lease is overdue, even one already hibernated.
 
 ## POST /v1/sandboxes/{id}/wake
 
@@ -505,7 +506,8 @@ while stored, and waking it starts a fresh lease of the length the claim was gra
 [failed](deploy.md#dead-vmms-and-host-restarts) sandbox is cold-booted from
 its own disk (memory is lost) and its restart budget resets. 204 on
 success, 404 unknown id or wrong token, 409 a failed egress-lane or volume
-sandbox, or one whose VM record is gone, 500 when the cold boot itself fails.
+sandbox, or one whose VM record is gone, 500 when the cold boot itself fails,
+503 `lease lost; retry` for a replicated claim while its node's lease is overdue.
 
 ## POST /v1/sandboxes/{id}/renew
 
@@ -1013,13 +1015,18 @@ truth is the usage journal below.
 
 Always on: every lifecycle transition appends one JSONL event to
 `<data_dir>/usage.jsonl` — `{"t": <RFC3339>, "ev":
-"claim|hibernate|wake|fork|checkpoint|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
-"id": "sb_…", "vm": "sbx-…"}` plus `key` (the pool key's stable hash, claim
-events), `template` and `size` (the claim's template and size tier, claim
-events, so a consumer can price a sandbox by its shape without the claim
-record, which is gone after release), `tenant` (the owning tenant, on every
-event of a tenant's claim), `children` (fork) and `ref` (the promoted
-template / checkpoint id, the egress host, or a `vmm_failed` reason). An egress event that injected credentials names
+"claim|renew|hibernate|wake|fork|checkpoint|adopt|promote|release|reap|archive|unarchive|archive_delete|egress|egress_bytes|vmm_exit|vmm_restart|vmm_failed",
+"id": "sb_…"}` plus `vm` (the VM's name; absent on `renew`, `adopt`, `archive`,
+`unarchive`, `archive_delete`, `egress`, `egress_bytes`, and the `reap` or
+`release` of an archived claim), `key` (the pool key's stable hash, claim
+events), `template`, `net` and `size` (the claim's template, lane and size
+tier, claim events, so a consumer can price a sandbox by its shape without the
+claim record, which is gone after release; `size` sets the CPU and memory,
+and `template` is a label, since promote lets the caller name it), `deadline` (the deadline in force after this event: `claim`,
+`renew`, `wake` and `unarchive` carry the lease, `archive` and `adopt` the retention
+end, or nothing for an archive kept forever, and `reap` the deadline it ended under), `tenant` (the owning tenant, on every event of a
+tenant's claim), `children` (fork) and `ref` (the promoted template / checkpoint
+id, the egress host, a `vmm_failed` reason, or why reconcile ended a claim). An egress event that injected credentials names
 them in `secret` (`gh,claim:<entry>`, never a value). An egress event routed through an
 [upstream proxy](egress.md#upstream-proxies) carries `upstream` (its `host:port`), and with
 `egress_usage_bytes` on, `egress_bytes` events add the connection's payload `tx`/`rx` bytes. A volume claim also carries
@@ -1028,16 +1035,30 @@ the subset of those names claimed `rw`, so billing can discriminate write
 access (mounts and host paths are not billing dimensions). The file rotates at
 64 MiB keeping one `.1` backup, so a tailing collector never loses a window
 silently. A last line a crash cut short is ended with a newline when the node
-reopens the journal, so it never swallows the next event. Folding rules: billable compute seconds per sandbox =
-Σ(claim→release/reap) − Σ(hibernate→wake) − Σ(vmm_exit→vmm_restart/release/reap);
-`vmm_exit` is stamped when the node first finds the VMM gone, so an outage
-before sandboxd runs again (a host that was down) stays billed up to that
-point, and `vmm_failed` is informational; hibernated storage seconds =
-Σ(hibernate→wake) minus the archived span; archived storage seconds =
-Σ(archive→unarchive/archive_delete), a cheaper store tier than a hibernated
-VM's RAM. An interval left open by a crash clamps to the claim's
-deadline; reconcile records nothing for the claims it drops (those whose VM
-record is gone), so a restart leaves those intervals without a terminal event. The `vm` name joins
+reopens the journal, so it never swallows the next event. Folding rules: fold a sandbox's events of all nodes in `t` order.
+An event ends the current span at its `t` and enters a state: `claim`, `wake`,
+`unarchive` and `vmm_restart` enter `running`, `hibernate` enters `hibernated`,
+`archive` enters `archived`, and `vmm_exit`, `archive_delete`, `release` and
+`reap` enter `ended`. Other events, `vmm_failed` included, change no state, and
+`reap`, `adopt` and `archive_delete` have the exceptions below.
+Billable compute, hibernated storage and archived storage seconds are the time
+in `running`, `hibernated` and `archived`, a cheaper store tier than a hibernated
+VM's RAM. `vmm_exit` is stamped when the node first finds the VMM gone, so an
+outage before sandboxd runs again (a host that was down) stays billed up to that
+point. A `reap` instead ends the current span at min(`t`, its `deadline`), or `t`
+with none, because `t` can follow the true end by the reaper's tick, the VM's
+teardown or the node's downtime. Outside `archived`, an `archive_delete` ends the
+current span at min(`t`, the last `deadline`), because a purge can follow a claim
+that has no end event by a whole retention window. An `adopt` names a claim
+a node took over, from a lost node or from its own lost record, with `ref` the
+checkpoint it holds. In `archived` it changes nothing; otherwise it ends the
+current span at min(`t`, the last `deadline` before it) and enters `archived` at
+its `t`. A span is never shorter than zero. A span still open ends at min(now,
+the last `deadline`), and one entered by an `archive` or `adopt` without a
+`deadline` stays open. A claim reconcile drops because its VM record is gone
+ends with a `reap` whose `ref` is `vm_gone`, and one that cannot re-lock its
+egress NIC with `quarantined`; a claim another node holds is dropped with no
+event, and neither has a replicated claim dropped while the registry is down. The `vm` name joins
 cocoon's machine-level metering ledger for audit cross-checks. With
 `meta_store.usage`, the node also lands every line in the cell's
 [shared usage table](deploy.md#shared-usage-table), read through
@@ -1049,12 +1070,14 @@ Auth: root only (tenant tokens get 403). Reads the raw usage events of every
 node of the cell from the [shared usage table](deploy.md#shared-usage-table).
 
 - `GET /v1/usage?tenant=<name>&since=<time>&until=<time>&after=<cursor>&limit=<n>` →
-  `{"events": [{"cursor": 41, "node": "n1", "t": "2026-10-30T08:00:00.123456Z", "ev": "claim", "id": "sb_…", "vm": "sbx-…", "key": "…", "template": "…", "size": "large", "tenant": "acme"}], "next": 41}`.
+  `{"events": [{"cursor": 41, "node": "n1", "t": "2026-10-30T08:00:00.123456Z", "ev": "claim", "id": "sb_…", "vm": "sbx-…", "key": "…", "template": "…", "net": "none", "size": "large", "tenant": "acme", "deadline": "2026-10-30T09:00:00.123456Z"}], "next": 41}`.
 - **Events:** each is one journal line with its keys as in
   [usage.jsonl](#usage-journal-usagejsonl), `t` in UTC to the microsecond, plus
   `cursor` (its place in the table; one node's events follow its journal
-  order) and `node` (the node that recorded it). A `claim` line written by
-  v0.1.20 or earlier has no `template` or `size`.
+  order) and `node` (the node that recorded it). A journal written by
+  v0.1.20 or earlier has no `renew` or `adopt` events and no `deadline`, a claim
+  reconcile dropped has no end event, and its `claim` lines have no `template`,
+  `net` or `size`.
 - **Filters:** `tenant` keeps one tenant's events; `since` (inclusive) and
   `until` (exclusive) are RFC 3339 times compared with `t`. Each is optional.
   A journal written by v0.1.20 or earlier stamps `tenant` only on `claim`,
diff --git a/sandboxd/pool/archive.go b/sandboxd/pool/archive.go
index 2b379f680..603b60015 100644
--- a/sandboxd/pool/archive.go
+++ b/sandboxd/pool/archive.go
@@ -150,7 +150,6 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	js := m.store.set(sb)
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
-		// roll back so memory matches the still-durable hibernated record
 		m.mu.Lock()
 		var rb claimSnapshot
 		// a Release that landed meanwhile already deleted the claim; re-setting it would resurrect it
@@ -166,6 +165,8 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 		m.abandonArchive(ctx, sb, epoch, ck.ID)
 		return fmt.Errorf("archive %s: persist claims: %w", sb.ID, saveErr)
 	}
+	m.counters.archives.Add(1)
+	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant, Deadline: sb.Deadline})
 	// disarm under Transition so a wake right after the release is not clobbered by a late disarm
 	m.out.Disarm(sb.ID, true)
 	sb.Transition.Unlock()
@@ -175,12 +176,10 @@ func (m *Manager) archive(ctx context.Context, sb *types.Sandbox) error {
 	if replica != "" {
 		m.deleteOrphanArchiveCk(ctx, replica)
 	}
-	m.counters.archives.Add(1)
-	m.recordUsage(ctx, usage.Event{Event: "archive", ID: sb.ID, Reference: ck.ID, Tenant: sb.Tenant})
 	return nil
 }
 
-// wakeArchived restores an archived claim into a fresh local VM; caller holds Transition.
+// Caller holds Transition.
 func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string, error) {
 	// egress never archives; a corrupt archived egress claim must fail closed.
 	if sb.Key.Net == types.NetEgress {
@@ -221,7 +220,7 @@ func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string,
 	}
 	live, saved := m.commitWake(ctx, sb, built.VMName, built.VsockSocket)
 	if !live || !saved {
-		m.destroy(ctx, built.VMName) // released, or persist rolled back to archived
+		m.destroy(ctx, built.VMName)
 		if !live {
 			return "", ErrUnknownSandbox
 		}
@@ -245,11 +244,10 @@ func (m *Manager) wakeArchived(ctx context.Context, sb *types.Sandbox) (string,
 		return "", ErrUnknownSandbox
 	}
 	m.counters.unarchives.Add(1)
-	m.recordUsage(ctx, usage.Event{Event: "unarchive", ID: sb.ID, Reference: ck, Tenant: sb.Tenant})
+	m.recordUsage(ctx, usage.Event{Event: "unarchive", ID: sb.ID, Reference: ck, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
 	return built.VsockSocket, nil
 }
 
-// commitWake swaps an archived record back to a live VM if the claim is still live.
 func (m *Manager) commitWake(ctx context.Context, sb *types.Sandbox, vmName, sock string) (live, saved bool) {
 	m.mu.Lock()
 	live = m.claimed[sb.ID] == sb
diff --git a/sandboxd/pool/claim.go b/sandboxd/pool/claim.go
index 0f9e4c12b..75e48fff9 100644
--- a/sandboxd/pool/claim.go
+++ b/sandboxd/pool/claim.go
@@ -40,7 +40,6 @@ type ClaimOptions struct {
 	EgressClass string
 }
 
-// apply stamps the options a claim carries for its life.
 func (o ClaimOptions) apply(sb *types.Sandbox) {
 	sb.Tenant, sb.ClaimRef, sb.Metadata, sb.OnExpire, sb.NoEgress = o.Tenant, o.ClaimRef, o.Metadata, o.OnExpire.Or(""), o.NoEgress
 	sb.EgressClass = o.EgressClass
@@ -198,6 +197,7 @@ func (m *Manager) Renew(ctx context.Context, id string, cred Cred, ttl time.Dura
 		return time.Time{}, fmt.Errorf("renew %s: persist claims: %w", id, err)
 	}
 	sb.Touch()
+	m.recordUsage(ctx, usage.Event{Event: "renew", ID: id, Tenant: sb.Tenant, Deadline: deadline})
 	return deadline, nil
 }
 
@@ -320,7 +320,7 @@ func (m *Manager) releaseResolved(ctx context.Context, id string, sb *types.Sand
 	m.mu.Unlock()
 	if saveErr := m.store.commit(js); saveErr != nil {
 		m.mu.Lock()
-		m.addClaimLocked(sb) // roll back so memory matches the still-durable claim
+		m.addClaimLocked(sb)
 		m.restoreVolumeHolds(sb, volumeHolds)
 		delete(m.pendingCks, ck)
 		rb := m.store.set(sb)
@@ -382,7 +382,6 @@ func (m *Manager) admitVolumes(tenant string, volumes []resolvedVolume) ([]types
 	return applied, nil
 }
 
-// admitClaim refuses a busy or retired volume or an over-quota tenant before any VM is built.
 func (m *Manager) admitClaim(tenant string, volumes []resolvedVolume, applied []types.Volume) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -506,7 +505,8 @@ func (m *Manager) finalizeBatch(ctx context.Context, sbs []*types.Sandbox, ttl t
 		m.recordUsage(ctx, usage.Event{
 			Event: "claim",
 			ID:    sb.ID, VMName: sb.VMName,
-			KeyHash: sb.Key.Hash(), Template: sb.Key.Template, Size: string(sb.Key.Size), Tenant: sb.Tenant,
+			KeyHash: sb.Key.Hash(), Template: sb.Key.Template, Net: string(sb.Key.Net), Size: string(sb.Key.Size),
+			Tenant: sb.Tenant, Deadline: sb.ClaimedAt.Add(clampTTL(ttl)),
 			Volumes: types.VolumeNames(sb.Volumes), VolumesRW: types.VolumeRWNames(sb.Volumes),
 		})
 	}
@@ -544,6 +544,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 	type victim struct {
 		action                       reapAction
 		id, vmName, snap, ck, tenant string
+		deadline                     time.Time
 		sb                           *types.Sandbox
 		holds                        []types.Volume
 	}
@@ -563,7 +564,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 				unrows = append(unrows, sb)
 			}
 		case sb.ArchiveCk != "":
-			expired = append(expired, victim{action: reapPurge, id: id, ck: sb.ArchiveCk, tenant: sb.Tenant, sb: sb})
+			expired = append(expired, victim{action: reapPurge, id: id, ck: sb.ArchiveCk, tenant: sb.Tenant, deadline: sb.Deadline, sb: sb})
 			purges = append(purges, sb.ArchiveCk)
 		case m.archivesAtDeadline(sb):
 			// archive instead of destroy, kept in m.claimed for archive() to move
@@ -577,7 +578,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			}
 			expired = append(expired, victim{action: action, id: id, sb: sb})
 		default:
-			expired = append(expired, victim{action: reapDestroy, id: id, vmName: sb.VMName, snap: sb.HibernateSnap, tenant: sb.Tenant, sb: sb, holds: m.cancelVolumeRun(sb)})
+			expired = append(expired, victim{action: reapDestroy, id: id, vmName: sb.VMName, snap: sb.HibernateSnap, tenant: sb.Tenant, deadline: sb.Deadline, sb: sb, holds: m.cancelVolumeRun(sb)})
 			m.dropClaimLocked(sb)
 			dropped = append(dropped, id)
 		}
@@ -634,7 +635,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			if v.action == reapArchive || v.action == reapPause {
 				delete(m.archiving, v.id) // never removed from m.claimed
 			} else {
-				m.addClaimLocked(v.sb) // roll back so memory matches the still-durable claim
+				m.addClaimLocked(v.sb)
 				m.restoreVolumeHolds(v.sb, v.holds)
 				delete(m.pendingCks, v.ck)
 				restored = append(restored, v.sb)
@@ -660,7 +661,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.purgeArchiveCk(ctx, v.id, v.ck, v.tenant)
 			m.untrack(m.pendingCks, v.ck)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: "reap", ID: v.id, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, Tenant: v.tenant, Deadline: v.deadline})
 			logger.Infof(ctx, "purged archived sandbox %s", v.id)
 		case reapArchive:
 			logSweepResult(ctx, logger, m.archive(ctx, v.sb), "archived expired sandbox "+v.id, "archive expired sandbox "+v.id)
@@ -672,7 +673,7 @@ func (m *Manager) reapOnce(ctx context.Context) {
 			m.out.Disarm(v.id, m.removeOrRetry(ctx, v.vmName, v.id, td))
 			m.dropSnap(ctx, v.snap)
 			m.counters.reaps.Add(1)
-			m.recordUsage(ctx, usage.Event{Event: "reap", ID: v.id, VMName: v.vmName, Tenant: v.tenant})
+			m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: v.id, VMName: v.vmName, Tenant: v.tenant, Deadline: v.deadline})
 			logger.Infof(ctx, "reaped expired sandbox %s (%s)", v.id, v.vmName)
 		}
 	})
@@ -736,7 +737,13 @@ func (m *Manager) claim(id, token string) (*types.Sandbox, bool) {
 	return m.authed(id, token)
 }
 
-// authed looks up a claim by id and token; callers hold m.mu.
+func (m *Manager) deadlineOf(sb *types.Sandbox) time.Time {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return sb.Deadline
+}
+
+// Callers hold m.mu.
 func (m *Manager) authed(id, token string) (*types.Sandbox, bool) {
 	sb := m.claimed[id]
 	if sb == nil || subtle.ConstantTimeCompare([]byte(sb.Token), []byte(token)) != 1 {
diff --git a/sandboxd/pool/egress_test.go b/sandboxd/pool/egress_test.go
index 12f05bf23..0b6ec37a2 100644
--- a/sandboxd/pool/egress_test.go
+++ b/sandboxd/pool/egress_test.go
@@ -321,6 +321,9 @@ func TestQuarantineFailedRemoveStaysUnswept(t *testing.T) {
 	if !gotKeep["tap-q1"] {
 		t.Error("failed-remove VM's journal tap not kept; the sweep would unlock a running guest")
 	}
+	if evs := usageJournal(t, m); len(evs) != 1 || evs[0].ID != sb.ID || evs[0].Event != "reap" || evs[0].Reference != "quarantined" {
+		t.Errorf("usage events of a quarantined claim: %+v, want one reap naming the quarantine", evs)
+	}
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	if _, ok := m.claimed["sb_q1"]; ok {
diff --git a/sandboxd/pool/failover.go b/sandboxd/pool/failover.go
index 432c26327..6389590a7 100644
--- a/sandboxd/pool/failover.go
+++ b/sandboxd/pool/failover.go
@@ -72,7 +72,8 @@ func (m *Manager) adoptArchived(ctx context.Context, id, token string) (bool, er
 		m.forgetClaim(ctx, sb)
 		return false, fmt.Errorf("adopt %s: persist claims: %w", id, err)
 	}
-	log.WithFunc("pool.AdoptArchived").Infof(ctx, "adopted archived sandbox %s from %s", id, rec.Owner)
+	m.recordUsage(ctx, usage.Event{Event: "adopt", ID: id, Reference: rec.Checkpoint, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
+	log.WithFunc("pool.adoptArchived").Infof(ctx, "adopted archived sandbox %s from %s", id, rec.Owner)
 	return true, nil
 }
 
@@ -456,8 +457,13 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 	sb := m.claimed[rec.ID]
 	m.mu.Unlock()
 	if sb == nil {
-		if rec.Consumed || !rec.Deadline.IsZero() && now.After(rec.Deadline) {
+		switch {
+		case rec.Consumed || !rec.Deadline.IsZero() && now.After(rec.Deadline):
 			m.purgeArchiveRow(ctx, rec)
+		case rec.Deadline.IsZero():
+			if err := m.startRowRetention(ctx, rec.ID, rec.Epoch); err != nil && !errors.Is(err, archives.ErrLost) {
+				log.WithFunc("pool.reconcileOwnRow").Warnf(ctx, "start retention of archive row %s: %v", rec.ID, err)
+			}
 		}
 		return
 	}
@@ -478,6 +484,25 @@ func (m *Manager) reconcileOwnRow(ctx context.Context, rec archives.Record, now
 	}
 }
 
+func (m *Manager) startRowRetention(ctx context.Context, id string, epoch int64) error {
+	rec, ok, err := m.archives.Get(ctx, id)
+	if err != nil || !ok {
+		return err
+	}
+	sb := &types.Sandbox{}
+	if err = json.Unmarshal(rec.Claim, sb); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	rec.Deadline = m.retentionDeadline(sb.Key)
+	m.mu.Unlock()
+	if rec.Deadline.IsZero() {
+		return nil
+	}
+	_, err = m.archives.Replace(ctx, rec, epoch)
+	return err
+}
+
 func (m *Manager) dropStaleRow(ctx context.Context, sb *types.Sandbox, rec archives.Record) {
 	if !m.archiveCkPinned(rec.Checkpoint) {
 		m.abandonArchive(ctx, sb, rec.Epoch, rec.Checkpoint)
diff --git a/sandboxd/pool/hibernate.go b/sandboxd/pool/hibernate.go
index 9e91ddef3..f983f1765 100644
--- a/sandboxd/pool/hibernate.go
+++ b/sandboxd/pool/hibernate.go
@@ -63,6 +63,9 @@ func (m *Manager) hibernateLocked(ctx context.Context, sb *types.Sandbox) error
 	if sb.ArchiveCk != "" {
 		return nil // already off the node
 	}
+	if _, err := m.fenceWatch(sb); err != nil {
+		return err
+	}
 	if sb.Failed != "" {
 		return ErrFailed
 	}
@@ -161,7 +164,6 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 	if sb.Failed != "" {
 		return "", fmt.Errorf("%w: %s", ErrFailed, sb.Failed)
 	}
-	// settle a dangling intent before choosing running vs hibernated
 	if _, err := m.settlePendingSnap(ctx, sb); err != nil {
 		return "", fmt.Errorf("wake %s: %w", sb.ID, err)
 	}
@@ -208,7 +210,7 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 	}
 	m.counters.wakes.Add(1)
 	m.counters.wakeNanos.Add(uint64(time.Since(wakeStart))) //nolint:gosec // durations are positive
-	m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant})
+	m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: m.deadlineOf(sb)})
 	if proxyErr := m.out.ArmProxy(ctx, sb); proxyErr != nil {
 		log.WithFunc("pool.wakeOrRead").Errorf(ctx, proxyErr, "arm egress proxy %s", sb.ID)
 	}
@@ -225,7 +227,7 @@ func (m *Manager) wakeOrRead(ctx context.Context, sb *types.Sandbox, readerOK bo
 		return "", fmt.Errorf("wake %s: persist claims: %w", sb.ID, err)
 	}
 	m.dropStale(ctx, sb)
-	// the resume consumed the memory image; reclaim its disk off the wake-return path (the randHex suffix keeps a re-hibernate from reusing the name)
+	// The randHex suffix keeps a re-hibernate from reusing the name
 	go m.dropSnap(ctx, snap)
 	return sock, nil
 }
@@ -277,7 +279,6 @@ func (m *Manager) idleOnce(ctx context.Context) {
 	}()
 }
 
-// idleHibernate re-validates a sweep victim under the Transition lock.
 func (m *Manager) idleHibernate(ctx context.Context, id, token string, sweepStart time.Time) error {
 	sb, ok := m.claim(id, token)
 	if !ok {
@@ -294,7 +295,6 @@ func (m *Manager) idleHibernate(ctx context.Context, id, token string, sweepStar
 	return m.hibernateLocked(ctx, sb)
 }
 
-// commitTransition publishes a hibernate/wake result only if the claim is still live.
 func (m *Manager) commitTransition(ctx context.Context, sb *types.Sandbox, snap, sock string) (live bool, err error) {
 	return m.commitIfLive(ctx, sb, func() {
 		sb.HibernateSnap = snap
@@ -334,7 +334,6 @@ func (m *Manager) settlePendingSnap(ctx context.Context, sb *types.Sandbox) (ado
 	return adopted, err
 }
 
-// resolvePendingSnap settles an unconfirmed hibernate intent against the engine's snapshot list.
 func (m *Manager) resolvePendingSnap(ctx context.Context, sb *types.Sandbox) (adopted bool, err error) {
 	if sb.PendingSnap == "" {
 		return false, nil
diff --git a/sandboxd/pool/operator.go b/sandboxd/pool/operator.go
index 45e7d7812..83fab9187 100644
--- a/sandboxd/pool/operator.go
+++ b/sandboxd/pool/operator.go
@@ -32,6 +32,9 @@ func (m *Manager) Wake(ctx context.Context, id string, cred Cred) error {
 	if !ok {
 		return ErrUnknownSandbox
 	}
+	if _, err := m.fenceWatch(sb); err != nil {
+		return err
+	}
 	if err := m.restartFailed(ctx, sb); err != nil {
 		return err
 	}
diff --git a/sandboxd/pool/pool.go b/sandboxd/pool/pool.go
index cd14662e2..115b8009a 100644
--- a/sandboxd/pool/pool.go
+++ b/sandboxd/pool/pool.go
@@ -568,17 +568,12 @@ func (m *Manager) ClusterDigest() string {
 
 // Run drives the refill and reap loops until ctx is canceled.
 func (m *Manager) Run(ctx context.Context) {
-	refill := time.NewTicker(refillInterval)
-	defer refill.Stop()
-	reap := time.NewTicker(reapInterval)
-	defer reap.Stop()
-	liveness := time.NewTicker(livenessInterval)
-	defer liveness.Stop()
-	images := time.NewTicker(imageInterval)
-	defer images.Stop()
+	refill := time.Tick(refillInterval)
+	reap := time.Tick(reapInterval)
+	liveness := time.Tick(livenessInterval)
+	images := time.Tick(imageInterval)
 	// Store retention is hourly: each sweep is cluster-visible I/O on a shared root
-	storeSweep := time.NewTicker(time.Hour)
-	defer storeSweep.Stop()
+	storeSweep := time.Tick(time.Hour)
 	go m.sweepExpiredCheckpoints(ctx)
 	if m.cocoondSocket != "" {
 		go m.watchVMMs(ctx)
@@ -596,7 +591,7 @@ func (m *Manager) Run(ctx context.Context) {
 		select {
 		case <-ctx.Done():
 			return
-		case <-refill.C:
+		case <-refill:
 			if m.view.Load().out.Guarded() {
 				m.out.RefreshSelf()
 			}
@@ -604,7 +599,7 @@ func (m *Manager) Run(ctx context.Context) {
 			m.refillOnce(ctx)
 		case <-m.refillKick:
 			m.refillOnce(ctx)
-		case <-reap.C:
+		case <-reap:
 			m.retryRemovals(ctx)
 			m.reapOnce(ctx)
 			m.idleOnce(ctx)
@@ -612,11 +607,11 @@ func (m *Manager) Run(ctx context.Context) {
 			m.replicateOnce(ctx)
 			m.shrinkOnce(ctx)
 			go m.retryArchiveDeletes(ctx)
-		case <-liveness.C:
+		case <-liveness:
 			m.livenessOnce(ctx)
-		case <-images.C:
+		case <-images:
 			go m.checkImagesOnce(ctx)
-		case <-storeSweep.C:
+		case <-storeSweep:
 			go m.sweepStoreGenerations(ctx)
 			go m.sweepExpiredCheckpoints(ctx)
 			if m.archives != nil {
@@ -801,7 +796,7 @@ func logSweepResult(ctx context.Context, logger *log.Fields, err error, okMsg, f
 
 func benignSweepErr(err error) bool {
 	return errors.Is(err, ErrUnknownSandbox) || errors.Is(err, errWokeMeanwhile) ||
-		errors.Is(err, ErrNoEgressHibernate) || errors.Is(err, ErrQuota)
+		errors.Is(err, ErrNoEgressHibernate) || errors.Is(err, ErrQuota) || errors.Is(err, ErrLeaseLost)
 }
 
 func vmName(key types.PoolKey) string {
diff --git a/sandboxd/pool/reconcile.go b/sandboxd/pool/reconcile.go
index a116b5800..b53f9bb34 100644
--- a/sandboxd/pool/reconcile.go
+++ b/sandboxd/pool/reconcile.go
@@ -15,6 +15,7 @@ import (
 	"github.com/cocoonstack/sandbox/sandboxd/archives"
 	"github.com/cocoonstack/sandbox/sandboxd/engine"
 	"github.com/cocoonstack/sandbox/sandboxd/types"
+	"github.com/cocoonstack/sandbox/sandboxd/usage"
 	"github.com/cocoonstack/sandbox/sandboxd/utils"
 )
 
@@ -38,7 +39,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 
 	owned := map[string]bool{}
 	referenced := map[string]bool{}
-	var adopted []*types.Sandbox
+	var adopted, dropped, resumed []*types.Sandbox
 	m.mu.Lock()
 	for _, sb := range claims {
 		sb.SetEnv(sb.Env)
@@ -51,6 +52,9 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 		case ok && rec.State == vmStateRunning:
 			sb.VsockSocket = rec.VsockSocket
 			// running with either flag set means a crashed wake or an intent the engine never saw
+			if sb.HibernateSnap != "" {
+				resumed = append(resumed, sb)
+			}
 			sb.HibernateSnap, sb.PendingSnap = "", ""
 		case ok && sb.HibernateSnap != "":
 			// hibernated: the VM is stopped by design and wakes on demand.
@@ -63,6 +67,7 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 			// the VMM died with the host or on its own; the liveness pass restarts or fails it
 			sb.PendingSnap = ""
 		default:
+			dropped = append(dropped, sb)
 			continue
 		}
 		m.addClaimLocked(sb)
@@ -80,6 +85,10 @@ func (m *Manager) Reconcile(ctx context.Context) error {
 	for _, sb := range adopted {
 		m.recordHibernate(ctx, sb)
 	}
+	// A failed save keeps the records, so the next boot records them
+	if saveErr == nil {
+		m.recordReconciled(ctx, resumed, dropped, fenced)
+	}
 	logger := log.WithFunc("pool.Reconcile")
 	if err := m.ckpts.SweepStaging(); err != nil {
 		logger.Error(ctx, err, "sweep checkpoint staging")
@@ -262,9 +271,25 @@ func (m *Manager) quarantineClaim(ctx context.Context, sb *types.Sandbox) bool {
 	td := m.quiesceVolumes(ctx, sb)
 	gone := m.removeOrRetry(ctx, sb.VMName, sb.ID, td)
 	m.forgetClaim(ctx, sb)
+	m.recordEnd(ctx, sb, "quarantined")
 	return gone
 }
 
+func (m *Manager) recordReconciled(ctx context.Context, resumed, dropped []*types.Sandbox, answered bool) {
+	for _, sb := range resumed {
+		m.recordUsage(ctx, usage.Event{Event: "wake", ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: sb.Deadline})
+	}
+	for _, sb := range dropped {
+		if answered || !sb.HasReplica() {
+			m.recordEnd(ctx, sb, "vm_gone")
+		}
+	}
+}
+
+func (m *Manager) recordEnd(ctx context.Context, sb *types.Sandbox, reason string) {
+	m.recordUsage(ctx, usage.Event{Event: reapEvent, ID: sb.ID, VMName: sb.VMName, Tenant: sb.Tenant, Deadline: sb.Deadline, Reference: reason})
+}
+
 // readoptEgressTap records and returns a live egress claim's tap, "" when there is none.
 func (m *Manager) readoptEgressTap(sb *types.Sandbox, live map[string]types.VMRecord) string {
 	rec, ok := live[sb.VMName]
diff --git a/sandboxd/pool/replica_test.go b/sandboxd/pool/replica_test.go
index 0a157b61b..4d0cb57e2 100644
--- a/sandboxd/pool/replica_test.go
+++ b/sandboxd/pool/replica_test.go
@@ -588,6 +588,58 @@ func TestReplicaPassSnapshotsOnlyDueRunningClaims(t *testing.T) {
 	})
 }
 
+func TestAFencedNodeNeitherHibernatesNorWakesAReplicatedClaim(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb, asleep := mustClaim(t, a, testKey), mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	if err := a.Hibernate(t.Context(), asleep.ID, Cred{Token: asleep.Token}); err != nil {
+		t.Fatalf("hibernate before the fence: %v", err)
+	}
+	a.tripFence()
+	if err := a.Hibernate(t.Context(), sb.ID, Cred{Token: sb.Token}); !errors.Is(err, ErrLeaseLost) {
+		t.Errorf("hibernate while fenced: %v, want ErrLeaseLost", err)
+	}
+	if err := a.Wake(t.Context(), asleep.ID, Cred{Token: asleep.Token}); !errors.Is(err, ErrLeaseLost) {
+		t.Errorf("wake while fenced: %v, want ErrLeaseLost", err)
+	}
+	if got, want := usageEventsOf(t, a, sb.ID), "claim"; got != want {
+		t.Errorf("events of the running claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, a, asleep.ID), "claim,hibernate"; got != want {
+		t.Errorf("events of the hibernated claim %s, want %s", got, want)
+	}
+}
+
+func TestTheSweepsLeaveAReplicatedClaimAloneWhileFenced(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	backdate(a, sb, time.Hour)
+	a.tripFence()
+	sweepIdle(t, a)
+	if hibernated(a) != 0 {
+		t.Error("the idle sweep hibernated a replicated claim while fenced")
+	}
+	a.mu.Lock()
+	a.archiving[sb.ID] = struct{}{}
+	a.mu.Unlock()
+	if err := a.pauseExpired(t.Context(), sb); !errors.Is(err, ErrLeaseLost) || !benignSweepErr(err) {
+		t.Errorf("pause of an expired claim while fenced: %v, want a benign ErrLeaseLost", err)
+	}
+	a.mu.Lock()
+	_, tracked := a.archiving[sb.ID]
+	a.mu.Unlock()
+	if tracked {
+		t.Error("the refused pause left the claim marked as archiving")
+	}
+	a.liftFence()
+	sweepIdle(t, a)
+	if hibernated(a) != 1 {
+		t.Error("the idle sweep did not hibernate the claim once the fence lifted")
+	}
+}
+
 func TestReplicaPassSkipsWhileFenced(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		c := newReplicaCluster(t)
@@ -777,6 +829,87 @@ func TestReplicaRestartAdoptsTheRowsCheckpointOfAnInterruptedRound(t *testing.T)
 	}
 }
 
+func TestAReplicaRowWithNoClaimLeftGainsRetentionAndIsPurged(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	ck := a.replicaOf(sb)
+	restarted := restartWithoutVM(t, c, a, sb, keepAnHour)
+
+	restarted.sweepOrphanArchives(t.Context())
+	rec, ok, err := c.reg.Get(t.Context(), sb.ID)
+	if err != nil || !ok || rec.Deadline.IsZero() || !ckExists(t, restarted, ck) {
+		t.Fatalf("row of the dropped claim after a sweep: %+v %t %v, want it kept with a deadline", rec, ok, err)
+	}
+
+	rec.Deadline = time.Now().Add(-time.Second)
+	if _, err = c.reg.Replace(t.Context(), rec, rec.Epoch); err != nil {
+		t.Fatalf("age the row: %v", err)
+	}
+	restarted.sweepOrphanArchives(t.Context())
+	if _, ok, err = c.reg.Get(t.Context(), sb.ID); err != nil || ok || ckExists(t, restarted, ck) {
+		t.Errorf("row %t %v after retention, want the row and its checkpoint gone", ok, err)
+	}
+	if got, want := usageEventsOf(t, restarted, sb.ID), "claim,reap,archive_delete"; got != want {
+		t.Errorf("events %s, want %s", got, want)
+	}
+}
+
+func TestAReplicaRowWithNoClaimLeftStaysAdoptable(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	restarted := restartWithoutVM(t, c, a, sb, keepAnHour)
+	restarted.sweepOrphanArchives(t.Context())
+	if adopted, err := restarted.AdoptArchived(t.Context(), sb.ID, sb.Token); err != nil || !adopted {
+		t.Errorf("adopt inside retention: %t %v", adopted, err)
+	}
+}
+
+func TestAReplicaRowOfAKeepForeverPoolKeepsNoDeadline(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	sb := mustClaim(t, a, testKey)
+	replicateNow(t, a, sb)
+	restarted := restartWithoutVM(t, c, a, sb, 0)
+	before, _, err := c.reg.Get(t.Context(), sb.ID)
+	if err != nil {
+		t.Fatalf("read row: %v", err)
+	}
+	restarted.sweepOrphanArchives(t.Context())
+	rec, ok, err := c.reg.Get(t.Context(), sb.ID)
+	if err != nil || !ok || !rec.Deadline.IsZero() || rec.Epoch != before.Epoch {
+		t.Errorf("row %+v %t %v, want it untouched at epoch %d", rec, ok, err, before.Epoch)
+	}
+}
+
+func TestReconcileWithTheRegistryDownRecordsOnlyTheEndNoOtherNodeCanHold(t *testing.T) {
+	c := newReplicaCluster(t)
+	a := c.node(t, "a", t.TempDir(), keepAnHour)
+	replicated, plain := mustClaim(t, a, testKey), mustClaim(t, a, plainKey)
+	replicateNow(t, a, replicated)
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	eng := a.eng.(*fakeEngine)
+	delete(eng.vms, replicated.VMName)
+	delete(eng.vms, plain.VMName)
+	c.reg.SetDown(true)
+	restarted := c.restart(t, a)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	c.reg.SetDown(false)
+	if got, want := usageEventsOf(t, restarted, replicated.ID), "claim"; got != want {
+		t.Errorf("events of the replicated claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, restarted, plain.ID), "claim,reap"; got != want {
+		t.Errorf("events of the unreplicated claim %s, want %s", got, want)
+	}
+}
+
 func TestReplicaRestartDropsAClaimAdoptedElsewhere(t *testing.T) {
 	c := newReplicaCluster(t)
 	dirA := t.TempDir()
@@ -991,9 +1124,17 @@ func TestReplicaAdoptionWakesTheClaimFromTheLastReplica(t *testing.T) {
 	if moved.ArchiveCk != ck {
 		t.Fatalf("adopted claim names %q, want the replica %q", moved.ArchiveCk, ck)
 	}
+	evs := usageJournal(t, b)
+	last := evs[len(evs)-1]
+	if want := b.deadlineOf(moved); last.Event != "adopt" || last.ID != sb.ID || last.Reference != ck || want.IsZero() || !last.Deadline.Equal(want) {
+		t.Errorf("last event %+v, want an adopt of %s naming %s with deadline %v", last, sb.ID, ck, want)
+	}
 	if _, _, _, err := b.WakeAgentSocket(t.Context(), sb.ID, sb.Token); err != nil {
 		t.Fatalf("adopter's wake: %v", err)
 	}
+	if got, want := usageEventsOf(t, b, sb.ID), "adopt,unarchive"; got != want {
+		t.Errorf("events on the adopter %s, want %s", got, want)
+	}
 	if got := b.eng.(*fakeEngine).cloneCount(); got != 1 {
 		t.Errorf("the wake cloned %d VMs, want the one restored from the replica", got)
 	}
@@ -1002,6 +1143,20 @@ func TestReplicaAdoptionWakesTheClaimFromTheLastReplica(t *testing.T) {
 	}
 }
 
+func restartWithoutVM(t *testing.T, c *failoverCluster, a *Manager, sb *types.Sandbox, deleteAfter int) *Manager {
+	t.Helper()
+	if err := a.FlushClaims(); err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+	eng := a.eng.(*fakeEngine)
+	delete(eng.vms, sb.VMName)
+	restarted := c.nodeOn(t, eng, a.nodeID, a.dataDir, deleteAfter)
+	if err := restarted.Reconcile(t.Context()); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+	return restarted
+}
+
 func newReplicaCluster(t *testing.T) *failoverCluster {
 	t.Helper()
 	c := newFailoverCluster(t)
diff --git a/sandboxd/pool/telemetry.go b/sandboxd/pool/telemetry.go
index 5ba945c45..3031199e7 100644
--- a/sandboxd/pool/telemetry.go
+++ b/sandboxd/pool/telemetry.go
@@ -20,6 +20,7 @@ const (
 	AuditLineCap = 4096
 
 	egressEvent = "egress"
+	reapEvent   = "reap"
 )
 
 // Counters is a monotonic snapshot for /metrics; gauges come from Info.
@@ -167,10 +168,11 @@ func (m *Manager) recordEgress(ctx context.Context, id, tenant string, ev egress
 			Time time.Time `json:"t"`
 			ID   string    `json:"id"`
 			egressFrame
-		}{time.Now(), id, egressFrame{
+		}{
+			Time: time.Now(), ID: id,
 			Op: egressEvent, Dest: ev.Host, Method: ev.Method, Port: ev.Port, Decision: decision, Secret: ev.Injected, Upstream: ev.Upstream,
 			Tenant: tenant, Src: ev.Local, Dst: ev.Remote,
-		}})
+		})
 	}
 	m.recordUsage(ctx, usage.Event{Event: egressEvent, ID: id, Tenant: tenant, Reference: ev.Host, Upstream: ev.Upstream, Secret: ev.Injected})
 }
diff --git a/sandboxd/pool/telemetry_test.go b/sandboxd/pool/telemetry_test.go
index 1849ab83a..219de923e 100644
--- a/sandboxd/pool/telemetry_test.go
+++ b/sandboxd/pool/telemetry_test.go
@@ -11,6 +11,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/cocoonstack/sandbox/sandboxd/config"
@@ -146,8 +147,11 @@ func TestTenantStampedInJournals(t *testing.T) {
 			if ev.Tenant != "acme" {
 				t.Errorf("claim event tenant %q, want acme", ev.Tenant)
 			}
-			if ev.Template != testKey.Template || ev.Size != string(testKey.Size) {
-				t.Errorf("claim event template %q size %q, want %q %q", ev.Template, ev.Size, testKey.Template, testKey.Size)
+			if ev.Template != testKey.Template || ev.Net != string(testKey.Net) || ev.Size != string(testKey.Size) {
+				t.Errorf("claim event template %q net %q size %q, want the key %+v", ev.Template, ev.Net, ev.Size, testKey)
+			}
+			if !ev.Deadline.Equal(sb.Deadline) {
+				t.Errorf("claim event deadline %v, want %v", ev.Deadline, sb.Deadline)
 			}
 		}
 	}
@@ -167,6 +171,9 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 		t.Fatalf("claim: %v", err)
 	}
 	cred := Cred{Token: sb.Token}
+	if _, err = m.Renew(ctx, sb.ID, cred, time.Hour, ""); err != nil {
+		t.Fatalf("renew: %v", err)
+	}
 	if err = m.Hibernate(ctx, sb.ID, cred); err != nil {
 		t.Fatalf("hibernate: %v", err)
 	}
@@ -189,6 +196,10 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 	expire(m, children[0])
 	m.reapOnce(ctx)
 	waitFor(t, func() bool { return strings.HasSuffix(usageEventsOf(t, m, children[0].ID), ",reap") })
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; last.ID != children[0].ID || !last.Deadline.Equal(children[0].Deadline) {
+		t.Errorf("reap %+v, want the deadline it ended under, %v", last, children[0].Deadline)
+	}
 
 	kinds := map[string]bool{}
 	for _, ev := range usageJournal(t, m) {
@@ -197,13 +208,175 @@ func TestEveryClaimScopedUsageEventCarriesTheTenant(t *testing.T) {
 			t.Errorf("%s event of %s carries tenant %q, want acme", ev.Event, ev.ID, ev.Tenant)
 		}
 	}
-	for _, kind := range []string{"claim", "hibernate", "wake", "fork", "checkpoint", "promote", "release", "reap"} {
+	for _, kind := range []string{"claim", "renew", "hibernate", "wake", "fork", "checkpoint", "promote", "release", "reap"} {
 		if !kinds[kind] {
 			t.Errorf("no %s event in the journal", kind)
 		}
 	}
 }
 
+func TestEveryEventThatMovesTheDeadlineStatesIt(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(3600))
+	ctx := t.Context()
+	sb := mustClaim(t, m, testKey)
+	cred := Cred{Token: sb.Token}
+	assertDeadline := func(kind string) {
+		t.Helper()
+		evs := usageJournal(t, m)
+		last := evs[len(evs)-1]
+		if want := m.deadlineOf(sb); last.Event != kind || want.IsZero() || !last.Deadline.Equal(want) {
+			t.Errorf("last event %s deadline %v, want %s deadline %v", last.Event, last.Deadline, kind, want)
+		}
+	}
+	assertDeadline("claim")
+	if _, err := m.Renew(ctx, sb.ID, cred, 2*time.Hour, ""); err != nil {
+		t.Fatalf("renew: %v", err)
+	}
+	assertDeadline("renew")
+	if err := m.Hibernate(ctx, sb.ID, cred); err != nil {
+		t.Fatalf("hibernate: %v", err)
+	}
+	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake: %v", err)
+	}
+	assertDeadline("wake")
+	mustArchive(t, m, sb)
+	assertDeadline("archive")
+	if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+		t.Fatalf("wake archived: %v", err)
+	}
+	assertDeadline("unarchive")
+}
+
+func TestAPurgeReapStatesTheRetentionEnd(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(3600))
+	sb := mustClaim(t, m, testKey)
+	mustArchive(t, m, sb)
+	expire(m, sb)
+	want := m.deadlineOf(sb)
+	m.reapOnce(t.Context())
+	waitFor(t, func() bool { return strings.HasSuffix(usageEventsOf(t, m, sb.ID), ",reap") })
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; !last.Deadline.Equal(want) {
+		t.Errorf("purge reap deadline %v, want %v", last.Deadline, want)
+	}
+}
+
+func TestAnArchiveKeptForeverStatesNoDeadline(t *testing.T) {
+	m := newTestManager(t, newFakeEngine(), archivePool(0))
+	sb := mustClaim(t, m, testKey)
+	mustArchive(t, m, sb)
+	evs := usageJournal(t, m)
+	if last := evs[len(evs)-1]; last.Event != "archive" || !last.Deadline.IsZero() {
+		t.Errorf("last event %s deadline %v, want an archive without one", last.Event, last.Deadline)
+	}
+}
+
+func TestArchiveEventPrecedesAWakeDuringItsTeardown(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		eng := newFakeEngine()
+		m := newTestManager(t, eng, archivePool(3600))
+		ctx := t.Context()
+		sb := mustClaim(t, m, testKey)
+		if err := m.Hibernate(ctx, sb.ID, Cred{Token: sb.Token}); err != nil {
+			t.Fatalf("hibernate: %v", err)
+		}
+		stall := make(chan struct{})
+		eng.mu.Lock()
+		eng.removeStall = stall
+		eng.mu.Unlock()
+		archived := make(chan error, 1)
+		go func() { archived <- m.archive(ctx, sb) }()
+		synctest.Wait()
+		if _, _, _, err := m.WakeAgentSocket(ctx, sb.ID, sb.Token); err != nil {
+			t.Fatalf("wake: %v", err)
+		}
+		close(stall)
+		if err := <-archived; err != nil {
+			t.Fatalf("archive: %v", err)
+		}
+		if got, want := usageEventsOf(t, m, sb.ID), "claim,hibernate,archive,unarchive"; got != want {
+			t.Errorf("events %s, want %s", got, want)
+		}
+	})
+}
+
+func TestReconcileRecordsTheEndOfTheClaimsItDrops(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	lost, err := m.ClaimProvision(t.Context(), testKey, ClaimOptions{TTL: time.Hour, Tenant: "acme"})
+	if err != nil {
+		t.Fatalf("claim: %v", err)
+	}
+	kept := mustClaim(t, m, testKey)
+	delete(eng.vms, lost.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	if err = m2.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m2, lost.ID), "claim,reap"; got != want {
+		t.Errorf("events of the dropped claim %s, want %s", got, want)
+	}
+	if got, want := usageEventsOf(t, m2, kept.ID), "claim"; got != want {
+		t.Errorf("events of the kept claim %s, want %s", got, want)
+	}
+	evs := usageJournal(t, m2)
+	if last := evs[len(evs)-1]; last.Reference != "vm_gone" || last.Tenant != "acme" || last.VMName != lost.VMName || !last.Deadline.Equal(lost.Deadline) {
+		t.Errorf("reap of the dropped claim %+v, want vm_gone of %s under acme with deadline %v", last, lost.VMName, lost.Deadline)
+	}
+}
+
+func TestReconcileRecordsTheWakeACrashLost(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	sb := mustClaim(t, m, testKey)
+	if err := m.Hibernate(t.Context(), sb.ID, Cred{Token: sb.Token}); err != nil {
+		t.Fatalf("hibernate: %v", err)
+	}
+	delete(eng.stopped, sb.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	if err := m2.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m2, sb.ID), "claim,hibernate,wake"; got != want {
+		t.Errorf("events %s, want %s", got, want)
+	}
+	evs := usageJournal(t, m2)
+	if last := evs[len(evs)-1]; !last.Deadline.Equal(sb.Deadline) {
+		t.Errorf("wake deadline %v, want %v", last.Deadline, sb.Deadline)
+	}
+}
+
+func TestReconcileRecordsTheEndOnceTheDropIsDurable(t *testing.T) {
+	eng := newFakeEngine()
+	dir := t.TempDir()
+	m := newTestManagerAt(t, eng, dir)
+	sb := mustClaim(t, m, testKey)
+	delete(eng.vms, sb.VMName)
+
+	m2 := newTestManagerAt(t, eng, dir)
+	restore := breakClaimStore(t, m2)
+	if err := m2.Reconcile(t.Context()); err == nil {
+		t.Fatal("Reconcile with claims.json unwritable succeeded")
+	}
+	if got, want := usageEventsOf(t, m2, sb.ID), "claim"; got != want {
+		t.Errorf("events after a failed save %s, want %s", got, want)
+	}
+	restore()
+
+	m3 := newTestManagerAt(t, eng, dir)
+	if err := m3.Reconcile(t.Context()); err != nil {
+		t.Fatalf("Reconcile: %v", err)
+	}
+	if got, want := usageEventsOf(t, m3, sb.ID), "claim,reap"; got != want {
+		t.Errorf("events after the next boot %s, want %s", got, want)
+	}
+}
+
 func TestSandboxesIndexOmitsTokens(t *testing.T) {
 	eng := newFakeEngine()
 	m := newTestManager(t, eng)
diff --git a/sandboxd/server/usage_test.go b/sandboxd/server/usage_test.go
index cda35815c..0dc09e50c 100644
--- a/sandboxd/server/usage_test.go
+++ b/sandboxd/server/usage_test.go
@@ -32,14 +32,14 @@ func TestUsageIsRootOnlyAndNamesAMissingStore(t *testing.T) {
 func TestUsagePassesTheQueryAndPages(t *testing.T) {
 	t0 := time.Date(2026, 10, 30, 1, 2, 3, 400000000, time.UTC)
 	reader := &fakeUsage{recs: []usage.Record{
-		{Cursor: 7, Node: "n1", Digest: [32]byte{1}, Event: usage.Event{Time: t0, Event: "claim", ID: "sb_1", Template: "rt:24.04", Size: "xlarge", Tenant: "acme"}},
+		{Cursor: 7, Node: "n1", Digest: [32]byte{1}, Event: usage.Event{Time: t0, Event: "claim", ID: "sb_1", Template: "rt:24.04", Net: "egress", Size: "xlarge", Tenant: "acme", Deadline: t0}},
 		{Cursor: 9, Node: "n2", Event: usage.Event{Time: t0, Event: "release", ID: "sb_1"}},
 	}}
 	ts := usageTestServer(t, reader)
 	resp := doReq(t, http.MethodGet, ts.URL+"/v1/usage?tenant=acme&since=2026-10-30T00:00:00Z&until=2026-10-31T00:00:00.5%2B08:00&after=5&limit=2", "root", "")
 	body, _ := io.ReadAll(resp.Body)
 	_ = resp.Body.Close()
-	want := `{"events":[{"cursor":7,"node":"n1","t":"2026-10-30T01:02:03.4Z","ev":"claim","id":"sb_1","template":"rt:24.04","size":"xlarge","tenant":"acme"},` +
+	want := `{"events":[{"cursor":7,"node":"n1","t":"2026-10-30T01:02:03.4Z","ev":"claim","id":"sb_1","template":"rt:24.04","net":"egress","size":"xlarge","tenant":"acme","deadline":"2026-10-30T01:02:03.4Z"},` +
 		`{"cursor":9,"node":"n2","t":"2026-10-30T01:02:03.4Z","ev":"release","id":"sb_1"}],"next":9}`
 	if resp.StatusCode != http.StatusOK || string(body) != want {
 		t.Errorf("full page: %d %s, want %s", resp.StatusCode, body, want)
diff --git a/sandboxd/usage/pg/pg.go b/sandboxd/usage/pg/pg.go
index cd7c7aa5a..0f1d3869c 100644
--- a/sandboxd/usage/pg/pg.go
+++ b/sandboxd/usage/pg/pg.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/cocoonstack/sandbox/sandboxd/metastore"
@@ -22,11 +23,11 @@ const (
 	// cellLock serializes a cell's lands, so cursors commit in order and a reader paging by cursor never skips a row.
 	cellLock = `SELECT pg_advisory_xact_lock(hashtextextended('sandboxd_usage/' || $1, 0))`
 
-	insertRow = `INSERT INTO sandboxd_usage (cell, node, line_sha256, t, ev, id, vm, key, template, size, tenant, volumes, volumes_rw, children, ref, upstream, secret, tx, rx)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+	insertRow = `INSERT INTO sandboxd_usage (cell, node, line_sha256, t, ev, id, vm, key, template, net, size, tenant, deadline, volumes, volumes_rw, children, ref, upstream, secret, tx, rx)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21)
 		ON CONFLICT (cell, node, line_sha256) DO NOTHING`
 
-	listColumns = `cursor, node, t, ev, id, vm, key, template, size, tenant, volumes, volumes_rw, children, ref, upstream, secret, tx, rx`
+	listColumns = `cursor, node, t, ev, id, vm, key, template, net, size, tenant, deadline, volumes, volumes_rw, children, ref, upstream, secret, tx, rx`
 )
 
 //go:embed schema.sql
@@ -71,7 +72,8 @@ func (s *Store) Land(ctx context.Context, recs []usage.Record) error {
 		}
 		var batch pgx.Batch
 		for _, r := range recs {
-			batch.Queue(insertRow, s.cell, r.Node, r.Digest[:], r.Time, r.Event.Event, r.ID, r.VMName, r.KeyHash, r.Template, r.Size, r.Tenant, r.Volumes, r.VolumesRW, r.Children,
+			batch.Queue(insertRow, s.cell, r.Node, r.Digest[:], r.Time, r.Event.Event, r.ID, r.VMName, r.KeyHash, r.Template, r.Net, r.Size, r.Tenant,
+				pgtype.Timestamptz{Time: r.Deadline, Valid: !r.Deadline.IsZero()}, r.Volumes, r.VolumesRW, r.Children,
 				strings.ReplaceAll(r.Reference, "\x00", "\uFFFD"), r.Upstream, r.Secret, r.Sent, r.Received)
 		}
 		return tx.SendBatch(qctx, &batch).Close()
@@ -112,11 +114,13 @@ func (s *Store) Close() {
 
 func scan(row pgx.CollectableRow) (usage.Record, error) {
 	var rec usage.Record
-	err := row.Scan(&rec.Cursor, &rec.Node, &rec.Time, &rec.Event.Event, &rec.ID, &rec.VMName, &rec.KeyHash, &rec.Template, &rec.Size, &rec.Tenant,
+	var deadline pgtype.Timestamptz
+	err := row.Scan(&rec.Cursor, &rec.Node, &rec.Time, &rec.Event.Event, &rec.ID, &rec.VMName, &rec.KeyHash, &rec.Template, &rec.Net, &rec.Size, &rec.Tenant, &deadline,
 		&rec.Volumes, &rec.VolumesRW, &rec.Children, &rec.Reference, &rec.Upstream, &rec.Secret, &rec.Sent, &rec.Received)
 	if err != nil {
 		return usage.Record{}, fmt.Errorf("scan usage row: %w", err)
 	}
 	rec.Time = rec.Time.UTC()
+	rec.Deadline = deadline.Time.UTC()
 	return rec, nil
 }
diff --git a/sandboxd/usage/pg/pg_test.go b/sandboxd/usage/pg/pg_test.go
index 773a6f35b..1924a797a 100644
--- a/sandboxd/usage/pg/pg_test.go
+++ b/sandboxd/usage/pg/pg_test.go
@@ -25,7 +25,7 @@ func TestLandListsInCursorOrderAndResumesFromTheMark(t *testing.T) {
 	}
 	t0 := time.Date(2026, 10, 30, 0, 0, 0, 0, time.UTC)
 	full := usage.Event{
-		Time: t0.Add(time.Microsecond), Event: "claim", ID: "sb_1", VMName: "sbx-1", KeyHash: "k", Template: "rt:24.04", Size: "xlarge", Tenant: "acme",
+		Time: t0.Add(time.Microsecond), Event: "claim", ID: "sb_1", VMName: "sbx-1", KeyHash: "k", Template: "rt:24.04", Net: "egress", Size: "xlarge", Tenant: "acme", Deadline: t0.Add(time.Hour),
 		Volumes: []string{"data", "ro"}, VolumesRW: []string{"data"}, Reference: "ref", Upstream: "up:1", Secret: "gh", Sent: 7, Received: 9,
 	}
 	land(t, s, record("n1", 1, full), record("n2", 1, usage.Event{Time: t0, Event: "claim", ID: "sb_2"}))
@@ -38,6 +38,10 @@ func TestLandListsInCursorOrderAndResumesFromTheMark(t *testing.T) {
 	if got := recs[0]; got.Node != "n1" || !equalEvents(got.Event, full) {
 		t.Errorf("first record %+v, want n1 %+v", got, full)
 	}
+	var nulls int
+	if err := s.pool.QueryRow(ctx, `SELECT count(*) FROM sandboxd_usage WHERE id = 'sb_2' AND deadline IS NULL`).Scan(&nulls); err != nil || nulls != 1 || !recs[1].Deadline.IsZero() {
+		t.Errorf("a line without a deadline: %d NULL rows, %v, reads back %v", nulls, err, recs[1].Deadline)
+	}
 	if !slices.IsSortedFunc(recs, func(a, b usage.Record) int { return cmp.Compare(a.Cursor, b.Cursor) }) || recs[2].Children[0] != "sb_3" {
 		t.Errorf("records out of cursor order or lost children: %+v", recs)
 	}
diff --git a/sandboxd/usage/pg/schema.sql b/sandboxd/usage/pg/schema.sql
index 6fc7cf813..92e58309e 100644
--- a/sandboxd/usage/pg/schema.sql
+++ b/sandboxd/usage/pg/schema.sql
@@ -9,8 +9,10 @@ CREATE TABLE IF NOT EXISTS sandboxd_usage (
     vm          text        NOT NULL DEFAULT '',
     key         text        NOT NULL DEFAULT '',
     template    text        NOT NULL DEFAULT '',
+    net         text        NOT NULL DEFAULT '',
     size        text        NOT NULL DEFAULT '',
     tenant      text        NOT NULL DEFAULT '',
+    deadline    timestamptz,
     volumes     text[],
     volumes_rw  text[],
     children    text[],
diff --git a/sandboxd/usage/usage.go b/sandboxd/usage/usage.go
index 09ba5f8ab..729178618 100644
--- a/sandboxd/usage/usage.go
+++ b/sandboxd/usage/usage.go
@@ -17,8 +17,10 @@ type Event struct {
 	VMName    string    `json:"vm,omitempty"`
 	KeyHash   string    `json:"key,omitempty"`
 	Template  string    `json:"template,omitempty"`
+	Net       string    `json:"net,omitempty"`
 	Size      string    `json:"size,omitempty"`
 	Tenant    string    `json:"tenant,omitempty"`
+	Deadline  time.Time `json:"deadline,omitzero"`
 	Volumes   []string  `json:"volumes,omitempty"`
 	VolumesRW []string  `json:"volumes_rw,omitempty"`
 	Children  []string  `json:"children,omitempty"`