A registry every node shares, backed by the store's ReservationStore counter — the
multi-node accept screen. Fail-closed by construction: an unreachable counter throws out of
add, and record refuses the movement rather than accepting blind.
Crash accounting: a dead node's journaled reservations release precisely when the orphan
sweep settles its sessions (release is journal-derived). Movements accepted but not yet
flushed die with the process while their reservations remain — a leak bounded by maxBatch
per crashed session that only ever refuses movements (conservative), never accepts wrongly;
reconcileReservations (src/worker/orphans.ts) is the quiesced-maintenance repair.
A registry every node shares, backed by the store's
ReservationStorecounter — the multi-node accept screen. Fail-closed by construction: an unreachable counter throws out ofadd, andrecordrefuses the movement rather than accepting blind.Crash accounting: a dead node's journaled reservations release precisely when the orphan sweep settles its sessions (release is journal-derived). Movements accepted but not yet flushed die with the process while their reservations remain — a leak bounded by
maxBatchper crashed session that only ever refuses movements (conservative), never accepts wrongly;reconcileReservations(src/worker/orphans.ts) is the quiesced-maintenance repair.