complete

Complete reservation id, charging actualCost service (0 ≤ actualCost ≤ the reserved maximum) against the path captured at reserve and releasing the earmark. Idempotent by local single-writer discipline (design §4.4): the first call charges once and removes the reservation; any later call for the same id finds nothing and is a no-op, so delivering a completion N times raises history exactly once. An unknown id is silently ignored.

Ordering is deliberate (design §4.4 — a validation failure must not corrupt state): the actualCost bound is checked before the reservation is removed or the earmark decremented, and the earmark/reservation are cleared only after the charge lands. The charge uses the captured path, so it succeeds even if the leaf was concurrently reparented, quarantined, or gained a child; a swallowed positive charge would silently lose service, so a null result fails loud rather than being dropped.

The one exception to "charge the captured path": a quiesced edge (issue #1693; heddle-design.md §10 invariant 4 as weakened by §4.4). If the captured path names an edge this peer has applied a Quiesce for, the charge re-homes to that edge's child's live inbound generation. That is not a rewrite of history — a quiesced edge is drained by construction, so re-homing the completion is the same conserving move the recovery performs, taken at charge time. Charging the dead edge instead is exactly the straggler that would leave a permanently unclearable per-edge-safety violation on it. If no live inbound exists yet, the charge is buffered and flushed when one activates (bufferedCharges).

Throws