Quiesced-maintenance repair for the shared reservation counter: recomputes every account's
journal-derived pending (the sum over unsettled sessions' accepted movements) and adjusts each
counter row to match. This erases the conservative leaks a crash can leave (unflushed
acceptances, a release interrupted mid-run).
Must run with the tier quiesced — no node accepting movements — because live sessions'
in-flight reservations are indistinguishable from leaks here; running it live would erase
them and reopen the cross-node overdraft window. That makes this an operator action, never a
scheduled sweep.
Quiesced-maintenance repair for the shared reservation counter: recomputes every account's journal-derived pending (the sum over unsettled sessions' accepted movements) and adjusts each counter row to match. This erases the conservative leaks a crash can leave (unflushed acceptances, a release interrupted mid-run).
Must run with the tier quiesced — no node accepting movements — because live sessions' in-flight reservations are indistinguishable from leaks here; running it live would erase them and reopen the cross-node overdraft window. That makes this an operator action, never a scheduled sweep.