There are still several paths where a node can leak. One area is in the time between successful provision point but before the new node is fully added to Jenkins. In that time there aren't hooks for removing such a from Jenkins.

I think we can implement an async periodic worker which periodically obtain the full list of nodes from Foreman which are reserved for the particular Jenkins instance. Next it tries to find their workload or it has to verify if they are still in the provision phase. All other nodes can be taken as leaked and should be removed/terminated immediately. We should be careful here to not drop a necessary/used node, but I think this approach can help much.