[marcopiraccini]

Two additions for pods which stop gracefully, both needed by Lavoratore to move the Durable Objects of a Watt instance away before it stops.

Draining: member.setDraining(true) sets a draining field in the record of the pod, which the heartbeats keep and which goes with the record when it expires or the pod deregisters. pickMember skips draining pods, and the resolve script refuses to bind or to reassign a destination to one, atomically with the binding: a pod picked from a list read before it started draining is refused, and the registry picks another. The destinations a draining pod holds keep resolving to it. listLiveMembers() and listPeerLoad() report the flag.

Member index: with memberIndex: true on the Registry and the Member, every binding also records the destination in the set of the pod, <keyPrefix>:owned:<memberId>, in the same script or transaction, and the unbinding removes it: claims, reassignments, the pruning of dead pods, addPodToDestination, deregisterDestination and the destination methods of Member. registry.listOwned(memberId) and member.listOwned() read it, so that the destinations of a pod are listed without a scan. The option is off by default; the README says that every writer must maintain it and that the sets of existing destinations need a backfill.

[mcollina]

lgtm