federation_node_tenant_reserve
Reserve a tenant handle in the federation-wide node namespace (CO 501). NODE-SIGNED like report-in: the node signs the canonical envelope and reserves for its AUTHENTICATED id only. One tenant-handle namespace across all nodes: the first node to reserve a handle holds it; re-reserving your own handle succeeds (idempotent); a handle held by another node refuses legibly with handle_reserved + holder_node_id, never a silent second tenant. A node calls this before local tenant creation; the catalog-projection sync re-verifies every handle it carries, which is also how a tenant created while the node was dark gets its reservation — or its refusal — at the next report-in. Returns: { ok: true, handle, node_id } or { ok: false, code: 'handle_reserved', holder_node_id } or { error, code }. Example: call federation_node_tenant_reserve with arguments {}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alg | Yes | Signature algorithm of the bound key. | |
| nonce | Yes | A fresh single-use nonce (part of the signed envelope). | |
| handle | Yes | The tenant handle (routing key) to reserve. | |
| node_id | Yes | The reserving node. | |
| signature | Yes | base64 signature over the canonical envelope, by the node bound key. | |
| timestamp | Yes | ISO timestamp within the skew window (part of the signed envelope). |