Matthew

Good catch — the release event has to be tied to when the attempt is actually terminal, not only when the caller socket closes. In the contract I treat those as two observables: caller completion/cancel vs upstream attempt termination. Releasing the in-flight slot on disconnect alone can undercount if the provider request is still running; holding it until the upstream settles (or a hard cancel timeout) avoids leaking capacity the other way. The saturation ladder should exercise both paths as separate cases, with distinct evidence for each. I’ll tighten that wording in the next edit of the guide. Thanks for pushing on the precision.