17 · Capacity exhaustion and break-before-make fallback

Starting state

A desired replacement passes identity/path/freshness checks but platform-reported available NDPs cannot accommodate active plus candidate.

Ordered events

1. Engine → Engine

   Validate desired route and compare available paths with reservations

2. Engine → Aware

   Release only active-parent ownership with handoff_capacity reason

3. Aware → Android

   Unregister matching outgoing request

4. Aware → Candidate

   Create replacement request and normal authenticated activation

Fields and messages

availablePaths,pendingReservations,total dataPaths; exact request/session/incarnation; current attempt and resourceExhausted evidence if actually known.

Authorization and invariants

A resource hint never skips TLS/hello/probe/path validation. Generic Android onUnavailable carries no cause and is not converted into explicit resource exhaustion.

Timers

25-s setup and bounded retry; continuity gap is accepted only for the no-spare fallback.

Resource lifetime

Old parent request changes; shared responder, children, source key/replay and preferences persist.

What the rider sees

Handoff diagnostic reason no_spare_capacity distinguishes fallback from normal overlap.

Failure branches

Stale setup failure cannot abort new attempt; genuine setup failure with spare capacity keeps old parent; fallback failure uses ordinary partition/repair.

Resulting state

Exact old parent request is released to free a slot; candidate setup proceeds; unrelated children and ride/source state remain.

Evidence boundary

Native fallback test and JVM parent-request retention policy. Reported-versus-working physical capacity remains unqualified.