Say where a hold and a redispatch can act now that the worker side is gone
#815 removed the dispatcher, connect redispatch and the connector's per-launch hold of connect.json's lock. It left comments in ten files that still describe them as live. This PR changes comments only.
What the comments claimed and what is true
| Comment | Claimed | Now |
|---|---|---|
handoff.go, the post-boost re-check | "A hold can land while the boost is in flight" | None can. connect --hold sets the marker as a run starts, before any part runs (connect_run.go#L331-L339), and shadow promote takes both instance locks (promote.go#L90-L99). |
setup/private.go, the policy lock | Three holders: setup, connect redispatch and the connector's TryLock per launch. LockWait is sized for the connector's hold. | Only connect setup and guided setup hold it. TryLock has no caller. |
ledger_tasks.go, ledger_decisions.go | Dispatcher.launch and connect redispatch's authorizedRedispatch make the served-set checks current | Neither exists. Nothing outside tests calls LaunchTask or Ledger.Redispatch. |
ledger_admission.go | connect redispatch runs beside a live connector | It was removed. The revision guard stays. |
ledger.go, intake.go, admission/verdict.go, admission/matrix.go | "run basecamp connect redispatch <id>" | There is no such command. |
connect_run.go, the served-set reader | "Dispatch treats an error as authorizing nothing" | It is the handoff now, and the window is #952. |
Why this matters more than tidiness
The handoff comment is the one that misled. A TLA+ model built from it found two races in the handoff: a hold landing between the line and the close stops the connector, and a hold plus a redispatch during a boost sends a line under the hold. Both reproduced in Go, and both were fixed, before it turned out that no production actor can interleave a hold with a running handoff. The fix was reverted. If a command ever lets a hold or a redispatch act beside a running connector, the corrected comment says what the handoff would then need.
Not in this PR
Ledger.Redispatch, LaunchTask, DropContent, SetHooks, setup.TryLock and the outbox's remaining functions have no production callers (rg; make deadcode doesn't list the methods). They are candidates for removal, but removing them is a separate call.
bin/ci passes.
Summary by cubic
Corrects comments in ten files left behind by #815, which removed the dispatcher, connect redispatch, and the connector's per-launch hold of connect.json's lock. Comments only; no behavior changes.
The handoff comment is the one that mattered most: it claimed a hold could land while a boost was in flight, which is no longer possible since connect --hold sets the marker before any part runs and shadow promote requires the connector stopped. The corrected comment notes what a hold beside a running handoff would need.
setup/private.gonamed three holders of the policy lock; onlyconnect setupholds it now, andTryLockhas no caller.ledger_tasks.go,ledger_decisions.go, andledger_admission.gonamedDispatcher.launchandconnect redispatchas the callers keeping served-set checks current; neither exists.ledger.go,intake.go,admission/verdict.go, andadmission/matrix.gotold operators to runbasecamp connect redispatch <id>, which no longer exists.