docs(plans): correct the adversarial-catch descriptions in the remediation record

2026-10-22 09:52:01 -04:00
parent 2acd14f276
commit 6b8a91cc83
1 changed files with 3 additions and 3 deletions
@@ -35,10 +35,10 @@ Decision and execution record. Source: eight read-only parallel slice reviews of

 ## Adversarial-review catches (fixed before merge)

- **C reconnect race:** the first generation bump left a window where a stale prior-session subscribe completion could still land; the bump now happens when the reconnect attempt is issued.
- **H central-fault refusals:** a central-side transient fault was being counted as a permanent refusal toward push abandonment; only row-intrinsic SQL errors are rejected now, and the served high-water is persisted so a prune cannot skip rows.
+- **C reconnect race:** the first fix advanced the session generation when the reconnect *result* was applied, so a new session dying before the actor processed that result had its `Disconnected` (stamped with the old generation) dropped as stale — leaving the actor Connected on a dead session with frozen tags. The generation now advances when the reconnect attempt is issued.
+- **H central-fault refusals:** central answers DB faults with an empty/partial ack, which the new refusal counting treated as per-row refusals (a SQL maintenance window would mark rows `Rejected`). Central now names only row-intrinsic SQL failures in `IngestAck.rejected_event_ids`; the served high-water mark is persisted so owed rows retire after a site restart; transient faults never count toward reconciliation abandonment.
 - **A data-connection actor names:** the actor-name gate covered instances/scripts/alarms but not DCL connection actors; names are sanitised and collisions rejected at deploy.
- **I outbox double-send:** a single claim over mixed Pending/Retrying rows could re-deliver a row mid-sweep; the claim is split by status and bounded by `DispatchSweepBudget`.
+- **I outbox double-send:** the new Pending/Retrying split claim back-filled Pending with an offset (`Skip(n)`); an operator Retry flipping a Parked row to Pending mid-claim shifted the offset so one notification was claimed twice and delivered twice. The back-fill is now a keyset continuation plus a distinct-id guard.
 - Also: failback probe sentinel changed to an illegal actor name; alarm aggregator reconcile no longer reopens during a pending backoff reconnect (double subscribe); `RoleMappingCache` invalidation after commit (lane K review M1).

 ## Deferred to the register