The DRAM pool sits in its own container, KVCR-Guard, so it can outlive the engine.
The engine fails and G1 is lost. The pool survives. The guard confirms the engine is dead — a timeout alone isn’t enough to take over.
The backup serves the pool. Worker A copies the KV from B’s pool, peer to peer, instead of recomputing it.
The engine comes back and refills G1 from the pool — a copy, not a recompute — then a fenced handoff returns control.