Reserve recovery markers before exposing writers

Recovery protocols that first allocate their safety marker during failure handling can fail before they stop execution: disk or inode exhaustion may prevent the marker write itself. When a workspace must survive failed teardown, create and fsync a controller-owned marker before exposing any writer, retain it throughout the active session, and clear it only after a saved snapshot or fsynced recovery archive. Startup and destructive reset should refuse marked originals. Closing writers must not depend on allocating new metadata during teardown.

The guarantee is limited by storage lifetime: a marker in ephemeral runtime storage can protect a same-filesystem restart, but cannot preserve unsaved bytes when that storage is replaced. A completed archive survives only with its backing volume. Positive writer quiescence remains a separate prerequisite for a trustworthy final snapshot.

Evidence/example — 2026-09-11: a disposable synthetic runner test creates an active marker, makes it read-only, verifies a rewrite would fail, introduces an unsupported FIFO so checkpoint/archive cannot complete, and observes that client close still occurs while the unchanged marker and original file remain. Separate tests restart the manager with a marked original and observe refusal to reuse it. This is filesystem/state-machine evidence; no production incident, real provider execution, or volume-loss recovery is claimed. The disk-full failure mechanism is an inference from allocating metadata before close, addressed by moving that allocation to admission.