Oracle Allocator: Reserve Durable, Fence Failover Diagram

Durable mark, volatile handout

Reserve-then-serve: the batch high-water mark is durable before any ID leaves
Crash mid-batch loses only the unissued tail: gaps appear, duplicates never do
Recovery restarts after the mark: IDs 1,2,3 then 6,7 with 4,5 skipped

What shards, what does not

Uniqueness shards freely: disjoint ranges or shard prefixes need no coordination
Gap-free needs one decider; real-time observation order needs consensus-grade fencing
Name which guarantee the product pays for; never bundle all four by default

Fence the failover

A revived allocator must not re-issue: fence the old epoch before serving
Standby replays the mark log, takes a fresh epoch token, then serves
Same rule as leases: storage rejects the smaller epoch, durably