_drain_l3_control_queues runs validate-candidates -> admit -> reserve in one tick.
_cp_l3_admit_reload pops the inflight key and mark_object_committed()s the l3rl
object (which stays live in the allocator) while inserting the reloaded node. A
second same-suffix candidate, validated against the pre-admit tree, then reaches
_cp_l3_reserve_reloads with its dedup guard missing (inflight key gone) and calls
allocator.reserve() on the still-live object -> ValueError: duplicate live
reservation for object 'l3rl:<hash>' payload 'target_kv' -> scheduler crash.
Re-validate _cp_l3_reload_attach_ok in _cp_l3_reserve_reloads after the piggyback
check (honoring its documented 'checked at reserve AND at admission' contract,
which the original code never enforced). If a same-tick admit inserted the suffix,
the candidate is dropped; the un-held request re-matches and hits the just-inserted
L2 node. Rank-uniform: attach_ok reads only the replicated radix and admit is
rank-uniform, so every CP rank drops the same candidate. The reserve() duplicate
raise is kept as a fail-loud backstop for true invariant violations.
Confirmed by independent root-cause + adversarial fix review (CLEAN-SHIP): the
split-retained-key path that looks residual is provably unreachable via the radix
content-path / match_prefix invariant.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
leavelet
8cd46c18b3