Event feed conformance: three corrections to what tier 2 claims (3/3)

[jeremy]

Third of the split. Stacked on #705, which is stacked on #777 — review after
those. Three corrections to the tier-2 conformance family, all of them about the
suite claiming more than it proves.

1. Row 15's kill claim is partial, and the sentinel obligation is withdrawn

The mutation table said fixture 30 kills follow-cross-origin-redirect partly
through "the harness obligation that the fixture's foreign origin is bound to a
sentinel listener whose any-request fails the scenario". Fixture 30's own
description said the same.

No implementation meets that obligation, and meeting it would prove nothing.
At tier 2 the poll lane is a seam: the driver receives the fixture's scripted
302 and hands the connector an already-formed redirect-refused verdict. The Go
driver says so itself — "the driver is the seam, so the foreign origin is
unreachable by construction". The connector never sees a Location header and
never decides whether to follow one, so a silent sentinel is a statement about
the driver, not the connector.

That makes the mutation unreachable at this tier — it lives below the seam.
What fixture 30 does kill is the half above it: mishandling the verdict by
retrying it, misclassifying it, or echoing more of the Location than its
origin. Real zero-egress proof is the Layer-1 adapter's own 302 test, tracked
for G1b.

The fixture's description is amended too. Fixtures are merged contract and are
not edited lightly, but leaving the identical false claim in the file the other
five SDKs read would make this a half-correction. Prose only — no assertion
changed, both pin probes still verify.

This also corrects #705's own kill-matrix, which inherited the claim.

2. An advance that arms a timer is rejected, in every driver

The driver ran advance through the plain clock Advance, with a comment
noting that a fixture wanting a chained firing "would pass AdvanceSettling the
rendezvous". That is an opt-in, and the next fixture author is exactly who would
not take it.

Stress-testing the settle killed it, for reasons that are fundamental rather
than effort:

• Waiting for a firing to be consumed deadlocks. The connector deliberately
  does not consume a staleness firing promptly — a window closing during a
  delivery is latched and observed later, which is what §23 requires. A clock
  that waited would hang against the behavior the spec mandates.
• Waiting for the follow-on arming requires knowing one is coming. Nothing
  distinguishes "has not armed yet" from "will not arm".

So the reentrant clause is not settleable where the connector runs
concurrently, and the divergence is made unscriptable instead: an advance
during which the connector arms anything now fails, naming fireTimer as the
deterministic alternative. Unconditional — a schema field would let an author
take the divergence rather than avoid it.

The family README carries the constraint, because it binds all six SDKs and they
are split across single-threaded and concurrent test clocks.

Self-tested both ways: the mutant (an advance across the handshake deadline,
which arms backoff inside the window) is rejected, and the control (a quiet
window) still passes — without which the guard would be rejecting every advance,
including fixture 05's.

3. Fixture 31 — a straggler below the entry page's served id

Closes the hole where a dedupe ordering live ids against the highest poll-served
id passes the whole suite.

Fixture 20 already proves a post-snapshot straggler is delivered, but its entry
page serves no events, so a highest-served-id implementation passes it too:
with nothing served the mark is unset and every id clears it. Every other
straggler in the suite is buffered pre-cut.

31 serves id 99 on the entry page and pushes 41 afterwards, in the streaming
lane. 41 must be delivered — dedupe tracks actually-delivered ids and 41 was
never served by poll — while a re-push of 99 is still suppressed, which keeps
this a dedupe fixture rather than a no-dedupe one.

The kill was verified, and the first two attempts were wrong in instructive
ways. A mutant in admitLive survived — that is the buffer-admission path, and
a streaming straggler never goes through it. A mutant in the shared deliver()
gate failed six fixtures, so it was broader than the hole and would not have
justified a new fixture. The mutant that matches the claim — the ordering applied
only to the streaming lane — passes all of 01–30 and is killed by 31 alone.

Verification

go build / go vet / go test -race -count=1 pass; 23/23 fixtures green;
5 driver self-test groups pass; make event-feed-fixtures-check clean with both
pin probes verified; make go-lint 0 issues.

---

Summary by cubic

Aligns tier‑2 conformance to what the suite actually proves and removes unscriptable timing. Clarifies fixture 30’s scope, enforces deterministic virtual time, plugs a dedupe hole, corrects the memory ceiling, and adds a CI gate for prose tracking promises.

• Redirects (fixture 30): Tier‑2 now pins only above‑seam behavior. A validated same‑origin next that answers 302 with a cross‑origin Location must end Terminal(invalid_continuation), with no retry and no further poll. Zero‑egress and redaction are not tier‑2 claims; both move to Layer 1. Kill matrix marks row 15 (“follow‑cross‑origin‑redirect”) as not killed at tier 2. README, schema.json, SPEC.md, and fixture 30’s prose updated.
• Virtual time: Drivers must reject any advance whose window would fire a timer, decided from the clock’s state before time moves; name fireTimer as the deterministic alternative. schema.json/SPEC.md codify this; the Go driver implements the pre‑advance “would fire” check with self‑tests.
• Dedupe (fixture 31): Adds a post‑snapshot straggler below a served id. Entry serves id 99; live 41 below 99 must deliver; a re‑push of 99 is suppressed. Adds kill‑matrix row 16 for a streaming‑lane bug that ordered live ids against the highest poll‑served id.
• Memory bound: Ceiling corrected to (pump depth + 2 + live buffer capacity) × MAX_FRAME_BYTES, naming the pump’s in‑flight frame and the deferred socket outcome retained concurrently. SPEC.md and code comments updated.
• Gate: scripts/check-known-defect-issues-open now also verifies prose “Tracked in #N” claims registered in spec/tracking-issues.yml, requires the registry file, validates rows, and fails closed. Self‑tests updated.

Migration

• Replace any scripted chained advance with fireTimer. Update drivers to reject an advance that would fire timers using a pre‑advance due‑timers check.
• Harnesses: assert zero‑foreign‑egress only where the connector holds the continuation URL (fixtures 26/27); do not bind a sentinel for fixture 30.
• CI: add and maintain spec/tracking-issues.yml for any prose “Tracked in #N” references.

^{Written for commit 805e074. Summary will update on new commits.}

[Copilot]

Pull request overview

Tightens tier-2 event-feed conformance claims and closes a streaming deduplication coverage gap.

Changes:

• Clarifies redirect coverage at the poll seam.
• Rejects scheduling-dependent virtual-time advances.
• Adds fixture 31 for lower-ID live stragglers.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
go/pkg/basecamp/eventfeed/scenario_selftest_test.go	Tests the new advance guard.
go/pkg/basecamp/eventfeed/scenario_conformance_test.go	Implements guarded virtual-time advancement.
conformance/event-feed/README.md	Revises tier-2 guarantees and fixture matrix.
conformance/event-feed/fixtures/31-post-snapshot-straggler-below-served-id.json	Adds streaming dedupe coverage.
conformance/event-feed/fixtures/30-continuation-redirect-cross-origin.json	Corrects the redirect fixture description.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (3)

go/pkg/basecamp/eventfeed/scenario_conformance_test.go:494

• This observes only the net counts per timer name, not whether NewTimer ran. A timer can fire and be rearmed under the same name before settle samples it (the connector does same-name rearming, e.g. repair-poll at catchup.go:852), leaving the map equal to before and allowing the scheduling-dependent advance. Conversely, removal alone is labeled as an arm. Track a monotonic timer-arm/firing generation in feedtest.Clock and add a same-name-rearm self-test so this guard detects activity independently of the snapshot schedule.

	before := timerCounts(d.h.clock)
	armed := false
	d.h.clock.AdvanceSettling(millis(step.Ms), func() {
		if !maps.Equal(timerCounts(d.h.clock), before) {
			armed = true

conformance/event-feed/README.md:360

• The sentinel obligation is still present verbatim in the shared schema (schema.json:906), and the fixture inventory at README line 239 still presents “zero foreign egress” without the seam qualification. As a result, the merged contract continues to make the exact tier-2 claim this PR says is withdrawn. Remove the sentinel requirement and qualify the inventory/schema text as driver construction rather than connector proof.

An earlier revision of this row claimed a harness obligation to "bind the
foreign origin to a sentinel listener whose any-request fails the scenario".
That is withdrawn. No implementation met it, and meeting it would prove
nothing: the foreign origin is unreachable **by construction of the harness**,

conformance/event-feed/README.md:131

• The shared schema still defines advance as firing timers armed inside the window (schema.json:1208) and does not mention this mandatory rejection. Drivers generated from or validated against that contract are therefore still instructed to implement the behavior this paragraph makes unscriptable. Update the schema description alongside the README so the cross-language contract is consistent.

Every driver must therefore FAIL an `advance` during which the connector arms
anything, naming `fireTimer` as the deterministic alternative — it fires one
named timer without moving the clock, so no re-selection is involved. This is

[jeremy]

Round summary — 3 findings, 3 fixed, 0 open

Swept all three surfaces. Both review threads answered and resolved; all three suppressed comments from the round on head are addressed, since two of them carried findings no thread did.

#	Source	Finding	Outcome
1	thread + suppressed scenario_conformance_test.go:494	the advance guard measured firings, not arming	fixed ab41f581a
2	thread + suppressed README.md:360	the sentinel obligation was withdrawn in prose only	fixed be5a1c7e0
3	suppressed README.md:131	schema.json's advance still instructs drivers to implement the unscriptable clause	fixed be5a1c7e0

The one that mattered

Finding 1 was a test that could not fail, and the review's sharper half was in the suppressed block rather than the thread. Clock.advance removes a fired timer from the registry before any observer runs, so comparing Outstanding() snapshots reports an ordinary expiry as an arm — and, symmetrically, cannot see a same-name rearm at all, which is exactly what the connector does with repair-poll/poll-retry.

Proven by mutation rather than argued: with the connector's backoff arming deleted, the old self-test still passed (REAL_EXIT=0); with the fix in place the same mutation fails (REAL_EXIT=1). The test had been passing on the handshake deadline's own removal. The guard now reads feedtest.Clock.ArmCount(), the monotonic timer-creation count the clock already maintained for tie-breaking.

Findings 2 and 3 are one mechanism — a correction that reached the README but not schema.json, which the README names as the contract. I swept the family for the whole class rather than patching the two that were reported; it closes at exactly three sites, all fixed.

Not absorbed here: #789 (arrival-strict matching)

#789 is the same class as finding 1 — "the driver cannot fail the contract it enforces" — and it is now the third known instance. I am deliberately not fixing it in this PR, and the reason is mechanism, not appetite.

Finding 1's remedy is a per-step verdict read from an instrument the clock already had: additive, locally provable, no new concurrency. #789's remedy is a harness-wide state machine — an active-step tracked under h.mu and consulted by recorders running on other goroutines, with atomic handoff between adjacent steps. Its naive spelling has a failure direction worse than the bug it fixes: a set/clear leaves a window between adjacent steps matching no expectation, which turns a correct connector red on a scheduling accident. That needs its own design, its own per-class red-proof matrix, and a positive argument that no conforming connector can be reddened — none of which belongs inside a PR titled "three corrections to what tier 2 claims" without changing what this PR is.

So it should land as its own change on top of this stack. #705 made the same call for the same reason, which is why it recorded rather than patched.

One piece of design input I do owe #789, posted there: this PR's finding is evidence about the shape of the remedy. Outstanding() failed because a reconstructable snapshot collapses distinct histories onto one value. deliveredAt is the same kind of witness and collapses the same way — which is why it orders saves against deliveries and nothing else. Count the event, don't reconstruct it from state.

Stack / rebase

Rebased twice — event-feed-go-connector moved under me mid-session (3eaf48a39 → cf1d06b96). Now on the settled head, and GitHub's computed diff agrees with the local one at 460 additions / 8 files (it was 20,936 / 62 against the stale base, over Copilot's 20,000-line review limit).

cf1d06b96 landed in my file territory (scenario_conformance_test.go, scenario_selftest_test.go); its terminal-contract guards and this PR's advance guard are disjoint and the full suite is green on the merged result.

Gates

go test ./pkg/basecamp/eventfeed/... REAL_EXIT=0 · gofmt 0 · go vet 0 · golangci-lint 0 issues · make doc-constants-check REAL_EXIT=0 — all under LC_ALL=C. make event-feed-fixtures-check REAL_EXIT=0 under LC_ALL=C.UTF-8, stated explicitly because make conformance is broken under LC_ALL=C (#774).

No finding in this round argued from bc3 server behaviour. I re-checked anyway, since the pins moved today: between 8be5c67de5 and 6adb6050cd the only change on the event-feed contract surface is a 12-line authorization-scope addition to stream_tickets_controller.rb (read-scoped tokens may now mint). events_channel.rb, event/feed.rb, event/feed/position.rb and doc/api/sections/event_feed.md are untouched, so the poll envelope, the absent-next predicate and the disconnect reasons this PR pins have not moved. The README's verified at bc3 8be5c67de5 header is an as-of fact and correctly does not advance; PR-T's true-up remains the place that re-verifies.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

go/pkg/basecamp/eventfeed/scenario_selftest_test.go:365

• This control makes the new guard timing-dependent. After Advance delivers the due timer, the connector handles it on another goroutine; the driver only polls ArmCount until scenarioWatchdog expires (scenario_conformance_test.go:508-519). If that goroutine is delayed past the watchdog, the scenario passes and can arm a timer after advance returns—the exact cross-language divergence this rule is meant to eliminate. A timeout cannot prove that no arm is coming; either reject every advance that fires a timer (while still allowing truly quiet windows), or add an explicit synchronous completion protocol.

			{"expectConnect":{"url":"{{CABLE_URL:2}}"}}],
			"finally":{"state":"awaiting_welcome"}}`

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

conformance/event-feed/README.md:356

• Adding row 16 leaves the matrix summary inaccurate in two ways: the heading still says “fifteen,” and the introductory sentence says every listed mutation is killed even though row 15 is now explicitly only partial/below-seam. Update the heading and introduction so this conformance document does not continue overstating the suite’s proof.

| 15 | `follow-cross-origin-redirect` (follows a 302 to a foreign Location) | 30 — **partially**, and the boundary is below the seam. See the note under this table. |
| 16 | `discard-live-id-at-or-below-served-id` (streaming lane orders live ids against the highest poll-served id) | 31 — and 31 alone: verified to pass all of 01–30, because every other straggler either arrives with nothing yet served (20) or is buffered pre-cut (01, 12, 19) |

[jeremy]

Stopping on the advance guard — third round, one class

The suppressed comment on the latest review (scenario_selftest_test.go:365, against cfd9b3d4e) is correct, and it is the third round on this guard. Per AGENTS.md that is a signal about the instrument, not a queue, so I am naming the pattern and the real question rather than writing the third patch.

The three rounds

1. 1de86dfe7 — the guard is introduced, comparing snapshots of Outstanding().
2. This round — the snapshot is the wrong instrument. A firing removes its timer before any observer runs (so an expiry reads as an arm) and a same-name rearm leaves the set identical (so repair-poll rearms are invisible). Fixed in 28d03cc18 by counting timer creations.
3. This round, suppressed — a timeout cannot prove that no arm is coming. If the connector's goroutine is starved past scenarioWatchdog, the guard passes and the arm lands afterwards.

Rounds 2 and 3 are not the same bug, but they are the same class: the driver cannot observe the quantity the rule names. Round 2 observed the wrong quantity; round 3 cannot observe the right one at all. A fourth selector on the same wait would be the treadmill.

The real question

The rule says: reject an advance during which the connector arms a timer. That predicate is decidable in a single-threaded driver and undecidable in a concurrent one — you can only ever conclude "nothing armed within N seconds".

Which means the current rule has the disease it was written to cure. A rule that TypeScript decides exactly and Go decides by waiting is itself a cross-language divergence: the same fixture can be admitted in one language and rejected in another. So the question is not "how long should the wait be" — it is "what predicate can every driver decide identically and synchronously?"

The candidate answer, and the measurement that makes it actionable

Copilot's first alternative is the sound one: key the rule on FIRING, not arming. Every driver decides "did this advance fire a timer" synchronously, inside its own advance, on its own thread, with no waiting and no observation of the connector at all.

It is sound as a conservative over-approximation because the reentrant divergence requires a firing to trigger it: no firing in the window ⇒ nothing can be armed in response ⇒ no divergence, provably, with no wait. It is strictly coarser than the true predicate, and the coarseness is the price of decidability.

Its cost is that it forbids a shape currently legal — an advance whose window expires a timer that is not replaced. I measured that cost against the merged suite and it is zero. Fixture 05 is the only advance in all 31 fixtures, and its window fires nothing:

PROBE advance 121000ms: outstanding before=[staleness repair-poll] after=[staleness repair-poll] armCount 6->6

Both timers sit beyond the window, exactly as the fixture intends. fireTimer already covers the "make this timer fire" need deterministically, so the coarser rule costs authors nothing they cannot express.

Why I am not making the change here

It rewrites the normative rule in README.md and schema.json for all six SDKs, forbidding a fixture shape that is legal today, and it inverts a self-test I added this round. That is a contract decision, not a driver fix, and it is the third round on one class — so it wants a decision rather than my patch.

What is shipping meanwhile, stated plainly

The guard as it stands is conservative in the safe direction. ArmCount is monotonic and rises only on a real NewTimer, so the guard cannot reject a well-formed script; its only defect is the missed detection round 3 names, under a starvation longer than the watchdog. It is strictly better than what it replaced, which was reporting expiries as arms and missing rearms entirely. So this PR is not shipping a wrong-direction failure — it is shipping a detector that is sound but not complete, with the completeness question written down here rather than left in a suppressed block.

Related: #789 is the same family — "the tier-2 driver cannot fail the contract it enforces" — and this is a further instance of its root shape, a predicate the driver cannot actually observe. If the firing-based rule is accepted, it should land with #789's work rather than as a fourth pass here.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (5)

conformance/event-feed/README.md:358

• Calling this a “partial kill” contradicts the next sentence, which says the redirect-follow mutation lives below the seam and no tier-2 harness can reach it. Describe it as unreachable/not killed so the explanatory note agrees with the mutation matrix.

**Row 15 is the family's one partial kill, and the reason is structural.** In

conformance/event-feed/README.md:355

• The table still says fixture 30 partially kills follow-cross-origin-redirect, but the note below and the PR description establish that this mutation is below the poll seam and cannot be reached at tier 2. In a mutation kill matrix, an unreachable mutant is not partially killed; fixture 30 instead covers separate verdict-handling failures above the seam. Mark this row as not killed at tier 2.

This issue also appears on line 358 of the same file.

| 15 | `follow-cross-origin-redirect` (follows a 302 to a foreign Location) | 30 — **partially**, and the boundary is below the seam. See the note under this table. |

conformance/event-feed/README.md:366

• Fixture 30 cannot detect Location over-echoing. The driver reduces the scripted Location to CanonicalOrigin and supplies a generic safe cause (scenario_conformance_test.go:1065-1081), while this fixture asserts only the terminal reason. A connector that echoed all data it received would therefore still pass. Remove this kill claim; the separate hostile-cause unit test owns the redaction proof.

and no tier-2 harness can reach it. What fixture 30 does kill is the half above
the seam: a connector that mishandles the verdict — retrying it, classifying it
as anything but Terminal(`invalid_continuation`), or echoing more of the
`Location` than its origin — diverges on `finally` and fails.

conformance/event-feed/fixtures/30-continuation-redirect-cross-origin.json:3

• The fixture description claims it kills Location over-echoing, but the driver strips the Location to its origin before constructing PollError and the fixture asserts only the terminal reason. Thus an implementation that unsafely preserves its entire seam input still passes this scenario. Remove the redaction claim or extend the contract and driver with an assertion that exposes a secret-bearing cause.

  "description": "A VALIDATED same-origin `next` answers 302 with a cross-origin Location: the poll seam suppresses automatic redirect-following, and the foreign Location is Terminal(invalid_continuation) with zero egress to the foreign origin. {{NEXT:1}} substitutes same-origin, so the pre-poll validation PASSES and the second poll seam call is made (contrast fixture 26, where no request reaches the URL at all) — the redirect answer is where the per-hop rule bites. The Location host is literal, never substituted, and never served. NOTE: at tier 2 the poll lane is a seam, so the driver forms the redirect-refused verdict and the connector never sees a Location header \u2014 this fixture kills the half above the seam (mishandling the verdict: retrying it, misclassifying it, or echoing more of the Location than its origin), not follow-cross-origin-redirect itself, which lives below the seam and is proven by the Layer-1 adapter's own 302 test. See the row-15 note in README.md.",

conformance/event-feed/schema.json:906

• This contract description still overclaims redaction coverage. The tier-2 driver passes the connector only the canonical origin plus errors.New("poll refused a redirect"), and fixture 30 checks only invalid_continuation; no path/query text reaches the connector for the fixture to prove it is not echoed. Remove that item from the pinned behaviors.

          "description": "Redirect on a continuation (fixture 30): the seam suppresses automatic following; a cross-origin/downgraded Location is Terminal(invalid_continuation). At tier 2 the poll lane is a SEAM, so the driver forms the redirect-refused verdict and the connector never sees a Location header: this pins the half above the seam (mishandling the verdict — retrying it, misclassifying it, or echoing more of the Location than its origin), not redirect-following itself, which lives below the seam and is proven by the Layer-1 adapter's own 302 test. No sentinel-listener obligation is imposed on the harness: the foreign origin is unreachable by construction of the harness, so a silent sentinel would be a statement about the driver rather than about the connector. See the row-15 note in README.md.",

[jeremy]

Round 3's second suppressed finding — fixed in 961143eee

The suppressed comment on README.md:356 is right, and it is the sharper kind of finding for this PR specifically: the correction landed and its own summary was left behind.

Adding row 16 left the heading reading fifteen against sixteen rows, and withdrawing row 15's whole-kill claim left the introduction still saying every mutation is shown red against at least one fixture before it counts. So a document whose entire job is to state precisely what tier 2 proves was overstating the suite in two places at once — including in the first line a reader sees.

Both now say so, with the exception stated at the top rather than left to be discovered in row 15:

One row is an exception, and it is the reason this heading is worth reading twice. Row 15's mutation lives BELOW the tier-2 seam, so this suite kills only the half above it […] A matrix that counted the partial row as a kill would be making exactly the class of claim this family exists to check.

I swept the family for the rest of the class before fixing, as with the schema corrections: these two lines are the only places the matrix's size or completeness is asserted anywhere under conformance/event-feed/.

The count is now checked mechanically rather than by eye — the sixteen rows are contiguous 1..16 and the heading agrees. Gates re-run green: make event-feed-fixtures-check REAL_EXIT=0 (LC_ALL=C.UTF-8, per #774), make doc-constants-check REAL_EXIT=0 (LC_ALL=C).

This one is a plain fix, not an escalation — it is a different mechanism from the advance-guard class in the comment above, which stays stopped pending a decision on the predicate.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (2)

spec/tracking-issues.yml:26

• The registry is not exhaustive, so the new gate still silently skips existing ownership promises. Current examples include Makefile:183 (#589), SPEC.md:640 and typescript/tests/retry-after.test.ts:285 (#775), and the Python/Ruby #578 comments; the Ruby/Python #576 wording is also still present even though #576 is closed. Because the checker only reads this file and deliberately does not scan prose, none of those claims is queried. Register every live claim and rewrite/remove the stale #576 wording so the gate actually covers the repository it claims to cover.

prose_tracking_issues:
  - issue: 792
    site: "conformance/event-feed/README.md — the Go driver's arrival-strict gap"
  - issue: 758
    site: "go/pkg/basecamp/eventfeed/catchup.go awaitSupersededPoll — the superseded-poll bound's overshoot"

SPEC.md:3237

• Removing reentrant scheduling from this required checklist leaves the two normative documents inconsistent: conformance/event-feed/README.md:140-142 still requires every test clock's shared checklist to cover “reentrant scheduling within an advance,” while the next paragraph here says that clause remains normative (only fixture dependence is forbidden). Align the checklist requirement in both documents so other SDK drivers know whether that clock self-test is still mandatory.

asserted without a cross-language RNG seam. Each language's test clock passes a shared
semantics checklist (deadline order, creation-order tie-break) before its tier-2 results
count.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

Suppressed comments (4)

go/pkg/basecamp/eventfeed/scenario_conformance_test.go:611

• DueWithin and Advance are separate lock acquisitions. The connector can call NewTimer after this check releases c.mu but before line 618 reacquires it; if that timer is due inside the window, Advance fires it even though the driver accepted the forbidden directive. This makes the new guard scheduling-dependent again. Combine the check and no-firing advance in one clock operation that holds the advance/clock locks throughout.

	if due := d.h.clock.DueWithin(millis(step.Ms)); len(due) > 0 {

SPEC.md:3281

• This removes reentrant scheduling from the required clock checklist, but the clause is still normative immediately below, conformance/event-feed/README.md:143-145 still requires it in that checklist, and the Go clock still tests it directly. Fixture scripts must not depend on concurrent connector reentrancy, but clocks still need to prove the normative algorithm; keep the checklist consistent across both contract copies.

semantics checklist (deadline order, creation-order tie-break) before its tier-2 results
count.

spec/tracking-issues.yml:22

• The registry is empty even though the repository already contains present-tense tracking promises, including SPEC.md:640 for #775 and ruby/lib/basecamp/services/todolists_extensions.rb:184 for #576. #576 is already closed, so the new gate currently reports “no tracking issues referenced” and misses exactly the stale-prose case it claims to catch. Classify and register the existing promises, and update/remove any that already point to closed issues.

prose_tracking_issues: []

.triage.md:1

• This is a transient review ledger for PR #705, with point-in-time thread counts and unresolved-review status, rather than part of the event-feed conformance contract or implementation. It is already unrelated to this PR's stated changes and will become stale as those threads evolve; remove .triage.md from the committed SDK sources.

# PR #705 — review triage (workstream A)

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Suppressed comments (4)

go/pkg/basecamp/eventfeed/scenario_conformance_test.go:611

• DueWithin and Advance are separate critical sections. After DueWithin returns empty, the connector goroutine can arm a timer inside this window before Advance reacquires the clock lock; Advance then fires that timer even though the directive was accepted. A concurrent stop can produce the inverse false rejection. Make the due check and quiet-window advance one atomic clock operation so the new MUST is deterministic.

	if due := d.h.clock.DueWithin(millis(step.Ms)); len(due) > 0 {

SPEC.md:3231

• This statement withdraws tier-2 zero-egress coverage for all three preceding hostile-URL cases, but the PR and family README retain that obligation for connector-visible next/resume targets (fixtures 26/27). Only fixture 30's redirect Location is hidden below the poll seam. Scope the Layer-1-only statement to the redirect and retain zero foreign poll calls for fixtures 26/27.

**Zero egress to the foreign origin is a Layer-1 obligation, not tier-2 coverage**, and
this paragraph used to require it here. Tier 2 cannot deliver it: the poll lane IS the

SPEC.md:3281

• The family README still requires the shared clock checklist to cover “reentrant scheduling within an advance,” and the Go clock retains a direct AdvanceSettling test for it. The following paragraph also says the clause remains normative; only fixture dependence is forbidden. Removing it from this checklist creates conflicting six-SDK conformance requirements, so keep the direct clock semantic in the checklist.

semantics checklist (deadline order, creation-order tie-break) before its tier-2 results
count.

SPEC.md:2856

• The + 2 ceiling still misses one simultaneously retained raw frame. fatalScan deliberately continues when l.deferred is occupied; when it dequeues from a full channel, the blocked pump refills that slot and can read/hold its next frame while the scan still holds the dequeued item. The peak is therefore full queue + deferred + scan-local item + pump-held frame (pump depth + 3), alongside the live buffer. Either prevent the pump from reading again during that scan or update the bound and all mirrored comments/tests.

  (pump depth + 2 + `EVENT_FEED_LIVE_BUFFER_CAPACITY`) × `EVENT_FEED_MAX_FRAME_BYTES`
  (≈ 10 GiB at the defaults' extreme, reached only if every slot holds a maximum-size
  frame) — even under a slow consumer. The **+ 2** is two raw frames the queue's depth does
  not count, and they are retained by different parties at the same time: