From 6b8a91cc835cfdab046471dd05f9aefbe0cbcc5e Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 22 Oct 2026 09:52:01 -0400 Subject: [PATCH] docs(plans): correct the adversarial-catch descriptions in the remediation record --- docs/plans/2026-10-21-system-review-remediation.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/plans/2026-10-21-system-review-remediation.md b/docs/plans/2026-10-21-system-review-remediation.md index aaf5f4e5..1d6cf0ad 100644 --- a/docs/plans/2026-10-21-system-review-remediation.md +++ b/docs/plans/2026-10-21-system-review-remediation.md @@ -35,10 +35,10 @@ Decision and execution record. Source: eight read-only parallel slice reviews of ## Adversarial-review catches (fixed before merge) -- **C reconnect race:** the first generation bump left a window where a stale prior-session subscribe completion could still land; the bump now happens when the reconnect attempt is issued. -- **H central-fault refusals:** a central-side transient fault was being counted as a permanent refusal toward push abandonment; only row-intrinsic SQL errors are rejected now, and the served high-water is persisted so a prune cannot skip rows. +- **C reconnect race:** the first fix advanced the session generation when the reconnect *result* was applied, so a new session dying before the actor processed that result had its `Disconnected` (stamped with the old generation) dropped as stale — leaving the actor Connected on a dead session with frozen tags. The generation now advances when the reconnect attempt is issued. +- **H central-fault refusals:** central answers DB faults with an empty/partial ack, which the new refusal counting treated as per-row refusals (a SQL maintenance window would mark rows `Rejected`). Central now names only row-intrinsic SQL failures in `IngestAck.rejected_event_ids`; the served high-water mark is persisted so owed rows retire after a site restart; transient faults never count toward reconciliation abandonment. - **A data-connection actor names:** the actor-name gate covered instances/scripts/alarms but not DCL connection actors; names are sanitised and collisions rejected at deploy. -- **I outbox double-send:** a single claim over mixed Pending/Retrying rows could re-deliver a row mid-sweep; the claim is split by status and bounded by `DispatchSweepBudget`. +- **I outbox double-send:** the new Pending/Retrying split claim back-filled Pending with an offset (`Skip(n)`); an operator Retry flipping a Parked row to Pending mid-claim shifted the offset so one notification was claimed twice and delivered twice. The back-fill is now a keyset continuation plus a distinct-id guard. - Also: failback probe sentinel changed to an illegal actor name; alarm aggregator reconcile no longer reopens during a pending backoff reconnect (double subscribe); `RoleMappingCache` invalidation after commit (lane K review M1). ## Deferred to the register