[Bug] An `all-for-one` restart resumes a sibling that is already terminating, leaving a running actor whose child set can never finalise

[pathosDev]

Problem

An AllForOneStrategy restart snapshots every child regardless of state, including a sibling that is already terminating. That sibling is then handed a recreate, and onRecreate unconditionally resumes its mailbox and sets its state back to running — after its own children have already been sent terminate.

The result is an actor that is running again but whose onChildTerminated will now bail, because the guard there expects state terminating. It has a child set it can never finalise, so it can never terminate.

Evidence

The snapshot takes every child, unfiltered:

src/internal/ActorCell.ts:1143-1145
    const affected = strategy.scope === 'all-for-one'
      ? Array.from(this._children.values())
      : [child];

onRecreate then resumes and re-runs it, with no check on the prior state:

src/internal/ActorCell.ts:942-946
      this.behaviorStack = [(m: TMessage) => next.onReceive(m)];
      await next.postRestart(cause);
      this.mailbox.resume();
      this.state = 'running';

and onChildTerminated (src/internal/ActorCell.ts:1195) returns early when the state is no longer terminating, so the pending child terminations never complete the parent's own teardown.

Proposal

Filter the all-for-one snapshot to children in a restartable state (running / suspended), and make onRecreate refuse to resume a cell that is terminating or terminated — a restart directive arriving for an actor that is already on its way out should be dropped, not honoured.

Acceptance sketch

• An all-for-one restart does not send recreate to a terminating sibling.
• onRecreate on a terminating cell is a no-op rather than a resume.
• A test covers "one child fails while another is stopping" under AllForOneStrategy — AllForOneStrategy currently has no behavioural test at all (see the sibling test-coverage issue in this batch).

Verification status

Found in the ten-lens production-readiness review of 2026-08-05 (v0.13.0) and re-verified before filing: confirmed by reading the three cited sites. Not reproduced at runtime — constructing the interleaving reliably needs a deterministic scheduler, which is itself one of the gaps this batch records.

Part of the production-readiness review batch — tracked in #913.

[pathosDev]

Correction: partly superseded. The evidence was read against a tree that predates 37 commits now on develop.

Filed from a worktree branched at 45b33d24; develop is now at 30e6a3a5. 1ece6191 (feat(supervision)!: a restart stops the actor's children) rewrote the restart path, which changes one of the three claims.

What still stands.

• The all-for-one snapshot is still unfiltered — src/internal/ActorCell.ts:1198-1200, unchanged. A sibling that is already terminating is still handed a recreate.
• onRecreate still has no state check. Its only guard is if (!this.actor) return; (src/internal/ActorCell.ts:949), and the resume is still unconditional — 1ece6191 moved those four lines into a new second half, completeRecreate (src/internal/ActorCell.ts:997-1000), but did not add a terminating / terminated test on either side.

What no longer holds. The stated consequence — "onChildTerminated will now bail, because the guard there expects state terminating … It has a child set it can never finalise" — is wrong on develop. 1ece6191 inserted a parked-restart branch at src/internal/ActorCell.ts:1250-1259, deliberately before the if (this.state !== 'terminating') return; guard (now :1261). A terminating sibling handed a recreate now re-sends terminate to its children, parks the restart in _pendingRecreate, and resumes through completeRecreate once the last child is gone. The children do drain.

The residual defect, restated for the current tree. The sibling is revived rather than stuck: its terminate is swallowed, finalizeTermination never runs, its watchers never receive Terminated, it stays in its parent's _children map, and it comes back running with a fresh instance after having been ordered to stop. Both fix bullets are unmet as written — an all-for-one restart still sends recreate to a terminating sibling, and onRecreate on a terminating cell is still a resume rather than a no-op — so the proposal is unchanged. The acceptance sketch needs its third consequence reworded from "can never finalise its children" to "silently survives the stop it was given".

Corrected citations: 1143-1145 → 1198-1200; 942-946 → 997-1000 (now inside completeRecreate); :1195 → :1261.