Coordination

Durable storage remains one committed image plus snapshot readers. The Node store can add a local writer lease. The lease is recorded beside the image in the existing .lock path. A second writer is rejected while the lease is live. Renewal is fenced to the owning process, so a stale owner cannot overwrite a successor after explicit recovery.

Expiry is not permission to delete a lock. The host opts into recovery with recoverStale: true or recoverStaleWriterLeaseV5 after its own stale-writer policy has confirmed expiry. Malformed records and live leases remain errors.

The lease is not a distributed consensus protocol and it is not an authority credential. See Storage and snapshots for the open call.

Authorized operations

executeKnowledgeAuthorizedOperationV5 is one gate for commit, merge, policy, authority, and sync. It records the allow or deny event and runs the supplied mutation only after approval. The read-only Studio service does not gain a write route from this gate.

What this is not

This is not multi-writer replication, not a hosted control plane, and not production orchestration you can turn on by deploying @knolo/core. The host still owns scheduling, credentials, and the choice to apply a verified image.