ADR-0009 names one bounded gap: reactions enqueue asynchronously (so enforcement never waits), and a crash in the window between a stop and the reaction's durable Create loses that one reaction (RunStopped is live-only, so it does not re-fire). Close it with an optional boot-time sweep: scan the governance ledger for stop/warn records with no matching reaction run and enqueue them, idempotent via the event-id key. Deferred until the window is shown to matter.
ADR-0009 names one bounded gap: reactions enqueue asynchronously (so enforcement never waits), and a crash in the window between a stop and the reaction's durable Create loses that one reaction (RunStopped is live-only, so it does not re-fire). Close it with an optional boot-time sweep: scan the governance ledger for stop/warn records with no matching reaction run and enqueue them, idempotent via the event-id key. Deferred until the window is shown to matter.