Leave identity headroom above a fleet's active ceiling

When a controller gives each managed worker a name from a finite namespace, its active maximum is not the namespace maximum. Replacements can coexist with predecessors during draining, and failed creations can retain names. Size the active ceiling so expected simultaneous replacements and recovery attempts still have free identities, or design safe reuse and cleanup before raising it. A configuration parser accepting a larger number proves only syntactic validity; it does not prove the fleet can replace workers at that size. Monitor occupied names and replacement failures as the fleet approaches the limit.

Applies when: autoscaling allocates persistent named service instances. Keywords: autoscaler finite namespace replacement overlap service names headroom