[beinan]

A stalled IndexId, Compact or Repair can retain the table lock needed by WAL merging indefinitely, even when WAL merge recovery is enabled. Give local maintenance on explicitly owned targets bounded execution and the same durable admission/version fence as WAL merges, so a lost master or ambiguous storage write is reconciled before another writer takes over.

• Share the exclusive reconciler lease across all table writers. Keep unresolved ownership after task failure; scan durable executions for recovery even without a failure ledger or stats sweep.
• Cancel preparation on total/no-progress deadlines, drain manifest commits, and fence uncertain writes before handoff. Keep unfinished leaves supervised when storage recovery fails.
• Preserve per-kind retry budgets and backoff through task recreation. Bind only ephemeral maintenance handles to their execution; cached worker handles keep using the current scope.
• Keep serial worker fan-out and memory/concurrency budgets. Legacy targets retain their current path; old readers cannot mutate the new local execution records.

Defaults: 3600 s total, 600 s without observed completion, 30 s commit drain grace. Long index/compaction steps may have no intermediate progress signal; configure deadlines using actual large-table timings. Existing unfenced writers still require the existing protocol drain before owned activation. No production activation is included.

Validation of the combined tree with #294, #295 and #275: all 97 master, 92 worker, 15 coordinator, 20 registry, 2 commit-guard and 4 write-scope tests passed, including ignored etcd fault tests; all-target Clippy passed. Staging validation used an isolated etcd 3.5.16 Pod and the combined Rust test binaries with temporary local Lance datasets. All 27 selected tests passed: stalled maintenance/worker cancellation while other tables progress, lost-master takeover with a real Lance manifest barrier, unavailable storage retaining ownership, persistent backoff, demand retention, and stale admission rejection. This is staging-backed integration/fault coverage, not a deployed-service soak or a large-table Azure storage benchmark. All 10 GitHub CI checks and their workflow runs passed before merging the reviewed head.

Self-review also caught and fixed the interaction with automatic missing-fragment repair: only a committed repair clears the corresponding missing-file failure, allowing the dependent task to resume. Fresh tasks, no-op repairs and unrelated failures retain their budget; regression tests cover both immediate resumption and unrelated budget preservation. Reviewed claim/CAS exclusion, ambiguous admission and finish, expired leases, commit drain/fence ordering, delayed child commits, old-reader compatibility, and recovery inventory pagination. See docs/owned-maintenance-recovery.md for behavior and limitations.