runtime: cross-instance coalescing for queue/debounce supersession (ADR 0012 wait/coalesce State extension)

[ThomasK33]

Queue supersession (shipped) and debounce/burst coalescing (#38) are per runtime instance: the pending-waiter registry and burst windows live in process memory. When multiple runtime instances share a production State (Redis/Postgres/NATS), same-scope events delivered to different instances are not superseded across instances — each instance dispatches its own most-recent/final event, and the Thread Lock only serializes them. Per-instance behavior is documented on ConcurrencyQueue-adjacent GoDoc in #38, but the upstream semantic is global newest-wins.

ADR 0012 anticipated this cost: "queue/debounce/burst need wait/coalesce coordination" on the Runtime State contract — the coordination piece was deliberately not shipped with either the queue slice or #38. Doing it properly needs a distributed newest-wins registration (per-scope CAS or fenced write with TTL) as a new State capability (presumably optional, like LockForcer, with per-instance fallback), implemented across memory/redis/postgres/NATS plus the conformance suite.

Raised by the round-4 Codex review on #38 (thread: #38 (comment)).

---

Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh

[ThomasK33]

Extending scope again per the round-6 Codex security review on #38 (thread: #38 (comment)): the fenced State-contract extension should also carry holder identity so a force release can be bound to the lease observed at conflict time (compare-and-invalidate), eliminating the bounded spurious-successor-preemption residual that key-only ForceReleaseLock accepts. Interim mitigation shipped in #38: universal lease-loss cancellation stops any displaced holder within one refresh interval.

[ThomasK33]

Triage: accepted — design-track (ready-for-human), paired with #44.

Verified against the shipped queue supersession and the #38 debounce work: pending-waiter registries and coalescing windows are per-instance process memory, so multi-instance deployments sharing a production State get per-instance supersession only — correct per-instance, weaker cross-instance, currently documented honestly as such.

Decision: this and #44 (admission bound) form one runtime-coordination design track. Both need State-backed semantics decisions (fencing, waiter leases, backpressure) that must be designed together — piecemeal patches here produce exactly the review churn that split #38. Draft PR #53 (burst + preemption) stays parked on this track's outcome. An ADR proposal covering #44+#50 is the next runtime milestone after the reduced #38 merges.

---

Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh

[ThomasK33]

Closing: rejected for now, per merged ADR 0015 (#54, merge 984d094).

Per-instance supersession remains the documented, honest v0.x semantic. The design track that produced ADR 0015 attempted a prose specification of cross-instance coalescing and accumulated dozens of P1 protocol holes across ~15 review rounds — strong evidence this protocol class cannot be trusted from prose review.

Reopening bar (recorded in the ADR): a formally modeled design (model checking against explicit invariants) or a proven external primitive, plus demonstrated user demand. If you hit this limitation in production, comment here with the deployment shape — demand is half the bar.

---

Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh