[jrzmurray]

Summary

• Track and cancel pending goal reviewer tasks during abort and session deletion.
• Serialize reviewer and goal-driver registration with the session deletion fence.
• Bound the pending reviewer registry at 128 entries and defer wakes at capacity.
• Add deletion-race and capacity regression tests; update the specs and traceability matrix.

Dependency

This is stacked on PR #41, which adds the shared session delete fence and drain cancellation. Please review this after #41; the first commit in this branch is the #41 change.

Validation

• cargo fmt --all -- --check — passed
• cargo clippy --workspace -- -D warnings — passed
• Goal deletion unit tests — 2 passed
• goal_e2e — 13 passed
• scripts/check-guards.sh — passed
• scripts/check-matrix.sh — passed
• cargo test --workspace — 88 passed, 8 failed, 1 ignored. The failures are existing host assumptions for Linux cgroups and /proc that are unavailable in this macOS environment (uid-unknown, RSS probe); focused goal tests pass.

[alderpath]

Thanks — the delete/review race is real and the fence is the right mechanism. Approved the workflows and pushed two commits onto your branch; I can split them into a separate PR if you prefer.

The two things I changed

1. The admission check ran SQLite under the drain-registry mutex. spawn_wake_public held st.v2_drain_tasks.lock() and then called check_v1_session_admission → session_exists (an open_reader + SELECT count(*)). That is a synchronous store call on an async worker and blocking IO under a lock — both banned separately, and the exact class the repo fixed once before. It is now an in-memory session_is_deleting check only. The durable goal row already implies the session exists; a session deleted in the gap is caught by the turn, which 404s.

2. A deferred review was dropped, not deferred. At 128 pending reviews you logged and returned false, and the only other trigger is the next session turn. For an overnight goal that is a silent stop until a human speaks — the failure mode the goal feature exists to avoid. There is now one retry owner: 2 s doubling to a 60 s cap, 6 attempts, review_deferred counted, and if capacity never frees the goal is paused with a visible reason instead of hanging. All three post-turn call sites route through it, so a deferral anywhere behaves the same.

3. goal_is_active reads the goal row, so it also moved to run_blocking.

Evidence

goal_e2e::deferred_review_is_retried_without_another_user_turn saturates the 128-entry registry, arms a goal, waits for the review_deferred metric (so the test cannot pass without exercising the retry), frees exactly one slot, and asserts the goal reaches complete with no further turn. Negative control: return after the first failed attempt and the goal stays active at rounds: 0 until the 90 s timeout.

932 workspace tests, clippy -D under deny-warnings, guards and matrix green.

One note on scope: your MAX_PENDING_GOAL_REVIEWS is fine as a count; I made it pub only so the test can saturate it.