[beinan]

Summary

Coordinate materializer processes with bounded etcd claims and durable WAL publisher epochs. A worker reads the WAL epoch before validating its claim, so an expired owner cannot steal a successor's newer epoch. Prepared Lance files survive ownership changes and can be reused exactly.

Workers share memory and WAL client pools, bound concurrent tables and publication rounds, and join admitted file work and lease renewal on shutdown. Busy-table probes use a local, keys-only hint before attempting a lease, avoiding quorum barriers and replicated grant/revoke writes on occupied-table polls. Ownership still requires the linearizable create-if-absent transaction, and claim validation remains linearizable. Managed readers can open the selected Lance version without acquiring publisher ownership.

Assignments are an application-authorized fixed set. Dynamic namespace discovery, application process startup, and sustained throughput qualification are follow-up work.

Refs #378. Built on merged #453. The feature diff is unchanged when moved to main; all final-commit CI checks must pass before merging.

Testing

• The complete repository CI-equivalent script passed: Rust, Python (229 passed, 2 skipped, 1 xfailed), formatting, Clippy, Ruff and Pyright.
• The final busy-claim optimization was qualified separately with real etcd tests and worker-only / worker plus HTTP-client feature Clippy checks.
• Revoke a claim after real Lance preparation, acquire a successor epoch, reject the old claimant, reuse the exact prepared result, and publish through two competing automatic workers with full-column readback.
• Abandon a claim and require actual TTL expiry before takeover; all RPC and expiration deadlines remain enforced.

These are correctness checks. They do not establish process-kill recovery or sustained throughput for the application.

CI runs the existing workspace, WAL, Lance, and etcd suites in separate jobs so cold feature builds do not exhaust one shared 60-minute timeout. Every original check command and the coverage jobs are preserved. Checkpoint reopen cases are serialized around subprocess creation to prevent inherited file locks; corruption cases must report the expected validation error. Minimal-feature and all-feature checkpoint tests and Clippy pass; the workflow passes actionlint. Final-commit CI is required before merging.

Independent Raft-log recovery cases exclude sibling subprocess-creation windows, preventing inherited file locks from racing immediate reopen. The two-group concurrent-write case and real SIGKILL, rotation, and write-error assertions remain unchanged. All nine Raft-log cases pass with minimal and all features, and Clippy passes. This adjustment changes only test scheduling.

TLS process startup failures include the child stdout/stderr and identify peer/image listener binding errors. The unchanged quorum, snapshot-interruption, SIGKILL and full-restart assertions pass in five complete peer-transport library runs (126 tests per run), plus six process tests and feature Clippy. The intermittent CI startup failure has not been reproduced locally; these diagnostics do not establish its root cause. Final-head CI remains required.