Interface StartReservationRequest

unknown rather than string, the same posture (and for the same reason) as ExecutionFenceTransition.proofKey: every caller is a route holding a parsed JSON body, assertKey already validates this against PATH_SAFE_ID_PATTERN and throws on anything else, and typing it string only made callers write body.idempotencyKey as string — an assertion that is false exactly when the caller sent the wrong thing, so the one input this field exists to police would arrive pre-blessed at the type level.

The host's own run-id mint — context.newRunId() on the run router, the thread topology's minted id on the agent surface. Run ids are server-minted and this store never generates one; it only ever stores what it is handed.

A THUNK rather than a value so the store, not the caller, decides when an id is needed: the caller that loses the insert never uses its candidate, and a host whose mint is expensive or audited should not pay for one it throws away. (The mints in this package are pure crypto.randomUUID() derivations, so a discarded candidate costs nothing and leaks nothing.)

Required for targetKind: 'agent', rejected for 'workflow'.