Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/delivery/inflight.go

@@ -6,10 +6,10 @@ import "sync"
 //
 // A delivery is owned from the moment a task for it is handed to a
 // channel or to a retry timer until the engine has no further plan for
-// it in memory. Restart recovery and both arms of the periodic sweep
-// re-dispatch only deliveries the set does not hold, which is what
-// makes them exact rather than a guess about how long a row has sat at
-// pending.
+// it in memory. The recovery routine, at start and on every tick of the
+// sweep, re-dispatches only deliveries the set does not hold, which is
+// what makes it exact rather than a guess about how long a row has sat
+// at pending.
 //
 // This replaces reasoning from timestamps. A delivery's row says
 // pending from creation until its outcome is written, which covers
@@ -25,8 +25,8 @@ import "sync"
 // In-memory state is sufficient because a data directory admits one
 // process: internal/datadir takes an flock on it at startup and a
 // second instance refuses to run. Deliveries owned by a process that
-// died are not in any successor's set, and restart recovery is what
-// picks those up.
+// died are not in any successor's set, and the recovery routine's run
+// at start is what picks those up.
 //
 // References are counted rather than held as a plain set because
 // ownership outlives the worker that took it. A target that schedules
@@ -61,9 +61,9 @@ func (s *inflightSet) retain(deliveryID string) {
 
 // retainIdle takes the first reference on a delivery, and reports
 // whether it got it. It fails when the engine already owns the
-// delivery, which is what makes two claimants — restart recovery and
-// the sweep run concurrently, or two sweep arms — mutually exclusive
-// rather than merely atomic.
+// delivery, which is what makes two claimants — notify and the
+// recovery routine, say — mutually exclusive rather than merely
+// atomic.
 func (s *inflightSet) retainIdle(deliveryID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()