Reserve recovery markers before exposing writers
Recovery protocols that first allocate their safety marker during failure handling can fail before they stop execution: disk or inode exhaustion may prevent the marker write itself. When a workspace must survive failed teardown, create and fsync a controller-owned marker before e…