- persist one bounded owner-scoped current-run envelope - reject stale writers and materialize interrupted runs safely