[CMGS]

A lost create reply could leave a process or VM on the node after Core discarded its name-only recovery intent. A committed metadata delete whose reply was lost could similarly discard the removal intent before calling the engine. Replacement recovery also lost the node needed to clean up the old engine workload once its metadata disappeared.

Reserve the engine ID before the existing create journal write, pass it through creation, and use it for rollback and replay. Containerd keeps name-as-ID; process and Cocoon keep their existing random ID format. Cocoon removal now works before its Eru metadata record exists; a failed vm rm on a VM that vm inspect still reports stays an error.

Commit removal intents only when deletion or restoration has settled. Read back an uncertain store deletion and restore metadata when needed. Record the node in the existing replacement intent so replay can finish old-engine cleanup even if both workload records are gone; retain the old workload when its metadata still exists and the replacement is absent.

Origin and recovery gaps

• fix: journal a create by name before the engine creates it #666 introduced name-only create recovery; the random IDs introduced by process feat: process engine, build node filter, registry config #667 and Cocoon feat: cocoon engine over SSH, virt engine removed #672 no longer satisfied that contract. Node resource repair and agent reporting cannot recover an unknown engine identity, and normal Created VMs are not stale-create garbage.
• fix: close the write-ahead log's coverage gaps #665 added removal and replacement journals. Removal assumed every returned error meant metadata was restored; replacement stored only the two workload IDs. fix: close whole-repo recovery gaps #677 introduced transaction settlement without closing these deletion cases.

Validation

• Full go test -race -count=1 -timeout 180s ./...: 667 top-level tests plus 418 subtests passed, 38 test packages; 28 packages have no tests.
• Linux and Darwin: make lint, make fmt-check, make vet, and asl ./... passed with the repository's pinned tools.
• Regression coverage includes reserved-ID journaling/replay, actual Redis-store deletion followed by injected reply loss, failed read-back/restoration, replacement cleanup with/without a surviving new workload, and real shell fixtures for removing a VM before its Eru record exists.
• The Redis tests were also run independently under the race detector after fixing their engine-cache fixture initialization.
• After review the typed stale-create reconciliation and the engines' empty-ID fallbacks were cut. The final head passed go test -race on ./cluster/calcium/... and ./engine/..., lint, fmt-check and asl locally, and all seven CI checks.
• These are isolated local tests; live SSH/KVM/systemd failure injection was not run.

Cost and compatibility

Successful create/remove/replace paths add no network requests, journal writes, scans, or locks. ID generation happens once, earlier; existing WAL payloads gain the ID or node. Failed store deletion adds read-back and optional restoration.

Legacy WAL entries remain readable, but this change cannot identify already orphaned random-ID workloads or missing-node replacement records from older versions. No automatic scan or migration is added.

All seven CI checks now pass. The first pull-request test run failed in the unchanged store/etcdv3.TestNodeStatusStream, whose fixed three-second cancellation can precede asynchronous lease-expiry delivery; the same commit's push test passed. One rerun of that failed job passed without code changes.