The dead shard's will.
Shards in Hyperscale are mortal: they split, they merge, and when they do, a chain reaches its final block and ceases to exist. So what becomes of a transaction caught halfway through — money committed on a chain that is about to be gone? You settle it the way the living have always settled with the dead: not by asking around, but by reading the will.
Caught in the doorway
A cross-shard transaction normally finishes in a handshake of proofs: shard P and shard Q each run it, each produce a quorum-signed certificate over the result, and the transaction finalizes when the matching certificates assemble (the generals). Now let P be a shard that's terminating — its wing of the library is being handed to successors, its chain approaching a fixed final block. A transaction is mid-flight between P and Q: committed on both, locks held on Q, P's certificate… somewhere. Two nightmares open up, and both were live incidents on the road to this design:
The estate never answers
P dies without delivering its certificate. Q waits forever, holding locks on accounts that can never be released. A frozen inheritance nobody can touch.
A signature from beyond the grave
Worse: P's certificate is assemblable after death. Signature shares collected before the end can be combined into a valid-looking certificate at any later time — and Q could finalize a result that P's chain never actually applied. A one-sided commit: money real on one side, nonexistent on the other.
Let the heirs finish the job
Have P's successor shards adopt and complete the in-flight work? Rejected — and the reason is the whole lesson: whether a certificate "exists" depends on who heard what, when. Different observers can legitimately disagree. Any rule keyed on it turns atomicity into a race.
The design principle that survived: nothing that depends on message timing may decide a straddler. The only admissible inputs are frozen chain content — what P provably committed before it died.
How the living settle with the dead
Humanity has run this exact protocol for millennia. When someone dies, we do not settle their estate by canvassing acquaintances for what the deceased might have promised. We open the will — a record frozen at death — and an executor honors exactly the claims it supports. A creditor may arrive after the funeral waving a paper with a genuine-looking signature; if the estate's frozen records don't support the claim, it is refused. Not because the signature is fake, but because the record is closed. The dead can no longer be asked, so only the record speaks — and everyone reads the same record.
Hyperscale's will is the settled set: the exact list of cross-shard work P finalized on its own chain at or before the terminal block, over the window in which straddlers could exist. Three properties make it a will rather than a rumor:
It's a pure function of the frozen chain. Each of P's blocks enumerates what it finalized; anyone holding the chain computes the same set. No memory, no testimony.
It's notarized before it's read. P's final-epoch block headers carry the set's merkle root, and the beacon records that root into P's terminal record. A survivor learns the fingerprint from its own copy of the beacon chain — before it fetches a single byte from anyone.
It's fetched with the fingerprint in hand. A survivor that needs the actual list requests it from P's final committee, checks it against the notarized root, and rotates to another peer on any mismatch. Nobody can serve a doctored inventory.
The probate court's one rule
With the will in hand, survivors enforce a single consensus rule — the fence — applied wherever a straddler could finalize: a result naming a shard that is terminated or scheduled to terminate may finalize if and only if its transaction is in that shard's settled set. Every verdict, laid out:
Three subtleties carry the safety:
The fence goes up early. It engages the moment P's termination is admitted — not only after P is gone. Otherwise a survivor could finalize a straddler in the in-between window that P, on the far side of a network partition, never settles before its cut. Scheduled-to-die is already fenced.
Waiting ends on evidence, never on a timer. A deferred verdict resolves when the will arrives, or the termination lapses, or the retention horizon passes — all facts every replica sees identically. A timeout abort would gamble against a settlement P might have committed; a local clock is exactly the message-timing dependence this design exists to exclude.
Honest nodes obey their own fence. The same checks gate a replica's own finalization path, so no honest node ever produces a result the fence would refuse from others.
Locks released, claims swept
The fence decides; two deterministic sweeps then tidy up, no consensus required. On the survivor: once the will is ingested, any transaction naming P that still lacks P's half can never gain it — every certificate the world could still produce is fenced — so its locks release and it aborts, cleanly. This closes the beyond-the-grave case for good: the late certificate is refused at the gate, and the refusal itself feeds the sweep. On P's own replicas at termination: everything committed but unfinalized aborts locally — pure cleanup, identical everywhere.
One courtesy softens the whole affair: a shard approaching its cut quiesces — its proposers stop taking on new cross-shard work in the final stretch, so few transactions are ever caught in the doorway at all. But it is a courtesy, not a load-bearing wall. The tests deliberately set the margin to zero and shove straddlers through the fence on purpose (the crash lab); safety never depends on the traffic having thinned.
The net guarantee: a transaction caught in the boundary finalizes on the surviving shard if and only if the dead shard settled it on-chain before the end. Both verdicts are computed from the same frozen record — so no straddler can ever commit on one side and abort on the other.
The probate lesson, restated for distributed systems: the dead can't be asked, so nothing the dead didn't write down may count — and then everyone must read the same writing. Frozen chain content is the only witness that never changes its story.