From the durable-effect architecture study, 2026-07-24. The correctness half that #538 cannot provide alone.
What
On a durable sweep tick, a marker that is RESERVED but not COMMITTED means an unknown submit outcome. Drive reconcile-or-resubmit against a venue idempotency key rather than treating the marker as terminal.
Why
A reserve marker is left behind by both "accepted, commit write faulted" and "crashed or cancelled mid-submit". The current held attempt (#572) resolves that ambiguity by skipping, which silently and permanently drops an order whose submit was deadline-cancelled by a slow venue. Resolving it by resubmitting instead reintroduces the duplicate. Neither is correct without asking the venue, so the resolution belongs in the sweep, keyed on the reservation, not in a post-submit release call that no crash, trap, or OutOfFuel path ever reaches.
Scope
Read the reserve prefix on each sweep via Journal::pending. For each stranded reservation, query or re-post through the venue idempotency-key contract (#574) and commit or release based on the answer. Expose pending() as an operator enumerate surface too, because a poisoned or quarantined module is dropped from both restart and dispatch and cannot self-reconcile.
Depends on
The reframed #538 (the Journal shape) and the venue idempotency-key contract.
Acceptance criteria
A reservation stranded by a crash, trap, or deadline-cancel is reconciled on a later sweep rather than skipped forever, and no order is silently dropped at the generic keeper that has no venue backstop.
What
On a durable sweep tick, a marker that is
RESERVEDbut notCOMMITTEDmeans an unknown submit outcome. Drive reconcile-or-resubmit against a venue idempotency key rather than treating the marker as terminal.Why
A reserve marker is left behind by both "accepted, commit write faulted" and "crashed or cancelled mid-submit". The current held attempt (#572) resolves that ambiguity by skipping, which silently and permanently drops an order whose submit was deadline-cancelled by a slow venue. Resolving it by resubmitting instead reintroduces the duplicate. Neither is correct without asking the venue, so the resolution belongs in the sweep, keyed on the reservation, not in a post-submit
releasecall that no crash, trap, orOutOfFuelpath ever reaches.Scope
Read the reserve prefix on each sweep via
Journal::pending. For each stranded reservation, query or re-post through the venue idempotency-key contract (#574) and commit or release based on the answer. Exposepending()as an operator enumerate surface too, because a poisoned or quarantined module is dropped from both restart and dispatch and cannot self-reconcile.Depends on
The reframed #538 (the
Journalshape) and the venue idempotency-key contract.Acceptance criteria
A reservation stranded by a crash, trap, or deadline-cancel is reconciled on a later sweep rather than skipped forever, and no order is silently dropped at the generic keeper that has no venue backstop.