From the adversarial review of #854.
terminated claims the node ids the operation PROVED terminated, and the docstring at coordination-driver.ts:511 calls them 'the descendants a cancelled lead's cascading abort took down'. The fill (terminatedDescendants, coordination-driver.ts:516-543) selects every subtree terminal journal record with at >= requestedAt. Two fidelity gaps:
-
FALSE ATTRIBUTION. requestedAt is minted by the CLIENT's clock when the request is appended. The abort is issued later — at the next acknowledger pass, which can lag by one full await_event ceiling or more. A descendant that dies of its OWN cause (its deadline, its error) inside that window carries a terminal record at >= requestedAt and is named as terminated by the cancellation. Cross-process clock skew widens or flips the window. Tightening the window to the abort-issue instant (the observedAt of the cancel_requested write, runtime clock) removes the pre-abort slice; causation after the abort remains an approximation and the docstring should say so.
-
FROZEN SET. reconcile runs only while the record reads cancel_requested (coordination-driver.ts:502) and writes cancelled with the descendants visible at that pass. The claim that nested trees journal their terminal records before the lead settles (coordination-driver.ts:368-371) holds for a descendant that rejects promptly on abort (what the tests use), but a descendant with a slow executor teardown can journal its terminal record after the lead's settlement is observed — and is then permanently missing from terminated. Either re-open the set until the run ends, or document the set as 'proven at acknowledgement time'.
From the adversarial review of #854.
terminatedclaims the node ids the operation PROVED terminated, and the docstring atcoordination-driver.ts:511calls them 'the descendants a cancelled lead's cascading abort took down'. The fill (terminatedDescendants,coordination-driver.ts:516-543) selects every subtree terminal journal record withat >= requestedAt. Two fidelity gaps:FALSE ATTRIBUTION.
requestedAtis minted by the CLIENT's clock when the request is appended. The abort is issued later — at the next acknowledger pass, which can lag by one fullawait_eventceiling or more. A descendant that dies of its OWN cause (its deadline, its error) inside that window carries a terminal recordat >= requestedAtand is named as terminated by the cancellation. Cross-process clock skew widens or flips the window. Tightening the window to the abort-issue instant (theobservedAtof thecancel_requestedwrite, runtime clock) removes the pre-abort slice; causation after the abort remains an approximation and the docstring should say so.FROZEN SET.
reconcileruns only while the record readscancel_requested(coordination-driver.ts:502) and writescancelledwith the descendants visible at that pass. The claim that nested trees journal their terminal records before the lead settles (coordination-driver.ts:368-371) holds for a descendant that rejects promptly on abort (what the tests use), but a descendant with a slow executor teardown can journal its terminal record after the lead's settlement is observed — and is then permanently missing fromterminated. Either re-open the set until the run ends, or document the set as 'proven at acknowledgement time'.