Rupture

A durable lease and result journal for idempotent workload recovery. Shatter uses it to recover abandoned tasks on another authorized node. Every claim rotates a random fencing token; only the current node/token can publish a result before lease expiry. Attempts persist across supervisor restarts and are bounded.

Open requires an absolute path in a private, existing operator-owned directory. Each mutation writes a private temporary file, syncs it, atomically renames it, and syncs the parent directory before returning success. One supervisor process must exclusively own each path; this adapter does not provide cross-process locking or shared-store transactions. Stop that supervisor on any journal I/O error, including errors after rename, then reopen from disk before resuming.

Execution is at least once. Fencing rejects stale results; it cannot stop an isolated worker from finishing or undo external effects. Workloads must be idempotent. The journal retains payloads/results until operator archival; it is not encrypted storage, a backup service, an HA database, or a heartbeat daemon.

Tests exercise restart persistence, lease exclusivity, stale-result rejection, expiry and bounded attempts. No live process-kill or power-loss test is claimed.