ClosureViolation

A Lifecycle.RETIRED edge across which entitlement nonetheless still stands — outstanding(e) != 0 (design §5.1, §10.10). EntitlementLedger.retire refuses to retire an edge until it has fully drained, so on a causally-complete state this means a late delegation crossed a generation the cluster had already retired: a replica acting on stale Lifecycle.ACTIVE state delegated down an edge another replica had already close-drained-retired. The max-register makes RETIRED dominate the merge (closure dominance); this report surfaces the late crossing rather than resolving it by arrival order, and the stranded entitlement is reconciled by the control plane.

It can also fire transiently on a lagging observer — one holding the {delegate, close, retire} patches but not yet the draining release/spend — for which issued > returned + spent against RETIRED. The EntitlementLedger.retire patch carries a drain witness (the edge's counter slots) specifically to minimize this transient for honest single-hop delivery; like every validate conflict, this is a diagnostic, not a safety gate, and a lagging false-positive self-heals on anti-entropy.