Found during the adversarial review of #2840 (property2 fix).
sigkill_test.go:110-118 + assertSigkillIsGapFree:195 runs killAfterReads=95, paceMS=15, total=400 — no cap, no watermark gate. Identical parameters to property2's pre-fix mid-position-write, which #2836's stall injection made fail.
It has not flaked only because its verdict is stable (no stale assertion, so a blown-through kill lands in a different window rather than failing). Under the same stall the case silently stops testing the window it claims. #2840's own rationale — an uncapped child that finishes its run would fail the kill — applies verbatim.
Fix shape: the #2840 pattern — production cap (holdAt) + kill gated on the durable committed watermark, lower bound observed, upper bound structural.
Filed from review; not blocking #2840.
Found during the adversarial review of #2840 (property2 fix).
sigkill_test.go:110-118 + assertSigkillIsGapFree:195 runs killAfterReads=95, paceMS=15, total=400 — no cap, no watermark gate. Identical parameters to property2's pre-fix mid-position-write, which #2836's stall injection made fail.
It has not flaked only because its verdict is stable (no stale assertion, so a blown-through kill lands in a different window rather than failing). Under the same stall the case silently stops testing the window it claims. #2840's own rationale — an uncapped child that finishes its run would fail the kill — applies verbatim.
Fix shape: the #2840 pattern — production cap (holdAt) + kill gated on the durable committed watermark, lower bound observed, upper bound structural.
Filed from review; not blocking #2840.