Single-use handle for reserved pre-trade state.

lock() and accountAdjustments() may be read while the reservation is live. commit() and rollback() each consume the handle; calling either a second time (or after the other) throws LifecycleError.

A mutation finalizer - a Mutation commit or rollback callback - has no right to fail: the decision is already made and the state it finalizes was applied eagerly. One that throws anyway never stops the batch, and it is reported on two independent channels. The throw reaches this caller as PolicyCallbackError once every remaining callback has run. Separately the engine arms its kill switch, because its own bookkeeping is now in an unknown state; every Mutation registered from JavaScript belongs to a custom policy whose state reach the engine cannot bound, so every account is blocked, not only this order's. That block is not reported here: it surfaces when the next pre-trade call is rejected with SystemUnavailable, and an operator clears it with engine.accounts().unblockAll().