LeaseStore

Partition ownership within a subscription group, the deployment unit whose nodes share the partitions of a log (documentation/designs/04-subscriptions.md §1, 02-write-path.md §3). Leases live in storage: no ZooKeeper, consumer group or registry.

A lease is live while the store's clock is before its expiry. At most one node holds a live lease of a partition; an expired or released one can be acquired by any node. Each operation is atomic, so concurrent acquisitions of a free partition have exactly one winner.

Membership is separate from ownership because rebalancing needs it: a node that just joined holds no lease, so the owners would never learn they must give partitions up. Membership is recorded per service and ownership per lease group: each node heartbeats one record for its service, listing the lease groups it takes part in, and reads the service's live members once for all its groups; the runtime derives a node's fair share of a group from the members that list it, releases surplus leases and acquires free ones. The store operations of the control plane so grow with the groups only for the leases (renewals and owner reads), not for the membership.

The store's clock decides liveness. A backend that takes the time from each node, not from the database, relies on the nodes' clock skew being small against the TTL. Since Wow does not fence, a short overlap of two owners during a handover is only duplicate work, never a wrong result.