Stack 4/5: Concurrency hardening — prompt cancel, thread-safe limiter, remove/rewire (rounds 11-12)

[codenamev]

Fourth slice (rounds 11-12), stacked on #3. This is the slice that fixes the two defects the round-10 drills caught.

Framework

• Prompt cancel_plan: transitions ALL bookkeeping first, then stops scheduled fibers (never the reactor handle, never the calling fiber); post-acquire guard keeps canceled slot-waiters from running. Before: status flipped instantly while every agent ran and billed. After: 30ms, 2/6 agents
• Fail-fast relation declarations: unknown relations, undeclared fields (fail-open typos), and sum_lte over non-numbers refuse at validator construction instead of crashing mid-validation as raw TypeError
• RateLimit#try_acquire (non-blocking admission for budgets/cron guards); relations over untyped fields stay out of draft-07 keywords (nil-vs-null frontier closed from the projection side)
• Thread-safe windowed limiter: real Mutex around stamp bookkeeping (was coasting on the GVL)
• remove_task / rewire_task: surgical plan refactoring (pending-only, dependents named, targets validated)
• Fixed a genuine load-order bug the threads drill caught: journal used Time#iso8601 without require "time"

Examples & docs

• Second and third persona casts (rounds 11-12): allocation audit, threads drill, capacity planner, plan kata, telemetry bus, tenant shards, API surface census, hostile inputs probe, honest doubles, write path profile…
• The hostile-inputs probe (exit-1-by-design here) documents the torn-tail replay defect fixed in Stack 5/5: Durability & the closing release — tolerant replay, fsync_every, doc referee, suggestions (rounds 13-15) #5

Review focus: cancel_plan ordering, the mutex placement in rate_limit.rb, remove_task/rewire_task guards.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FeZLdZ3M4q4cho4DZPfSkF

---

Generated by Claude Code

[codenamev]

Persona review panel: Charles Nutter, Katrina Owen, Bozhidar Batsov. Verified locally: 591 examples, 0 failures at this cut (including the fix below).

---

Charles Nutter (headius) — This is the slice where the thread-safety claims get real, so I read it with JRuby eyes. The windowed limiter's stamp Mutex is correctly scoped (check-and-stamp atomic, sleep outside the lock). One finding, now fixed in this PR (fix: bring RateLimit's in-flight counters under the window mutex): track mutated @in_flight/@high_water outside the new mutex, so under real threads the high-water mark could misreport — the exact "passes on MRI, lies on JRuby" shape. The fix keeps the yielded work outside the lock, which matters: holding a mutex across user work would serialize everything the limiter exists to parallelize. Also credit where due: the Time#iso8601-without-require "time" load-order bug this slice fixes is the classic works-on-my-boot species my users hit constantly. Approve with the fix in.

Katrina Owen (kytrinyx) — remove_task/rewire_task are the refactoring seam I asked for, and the guards encode the right pedagogy: removal refuses to orphan dependents and names them ("rewire them first" is an instruction, not a scolding), rewiring validates every target before mutating anything, and both are pending-only so a running plan can't be edited out from under itself. The plan kata in this slice refactors in place under green assertions — red, green, refactor, with all three words meaning what they say. The cancel_plan fix's ordering comment (bookkeeping first, because stopping a fiber synchronously admits the next waiter) is exactly the kind of constraint a comment exists for. Approve.

Bozhidar Batsov (bbatsov) — Style and consistency pass: fail-fast relation declarations produce errors that name the rule, the relation, and the offending field (rule :fits (sum_lte) can only sum declared numbers; :b is not) — error messages as documentation, the way I like them. try_acquire's docstring states the budget-vs-queue distinction instead of leaving it to folklore. Everything standardrb-clean. One consistency note, no action: remove_task raises ArgumentError for already-started tasks where a case could be made for a domain error class — but ArgumentError for caller mistakes is a defensible, consistent convention across this API, so keep it uniform. Approve.

---

Panel verdict: approve (as comment; self-approval disallowed). The headius finding was fixed in-slice; the high-water assertion is pinned in the concurrency contract spec in slice #5.

---

Generated by Claude Code