[robzolkos]

#815 removed the dispatcher, connect redispatch and the connector's per-launch hold of connect.json's lock. It left comments in ten files that still describe them as live. This PR changes comments only.

What the comments claimed and what is true

Comment	Claimed	Now
handoff.go, the post-boost re-check	"A hold can land while the boost is in flight"	None can. connect --hold sets the marker as a run starts, before any part runs (connect_run.go#L331-L339), and shadow promote takes both instance locks (promote.go#L90-L99).
setup/private.go, the policy lock	Three holders: setup, connect redispatch and the connector's TryLock per launch. LockWait is sized for the connector's hold.	Only connect setup and guided setup hold it. TryLock has no caller.
ledger_tasks.go, ledger_decisions.go	Dispatcher.launch and connect redispatch's authorizedRedispatch make the served-set checks current	Neither exists. Nothing outside tests calls LaunchTask or Ledger.Redispatch.
ledger_admission.go	connect redispatch runs beside a live connector	It was removed. The revision guard stays.
ledger.go, intake.go, admission/verdict.go, admission/matrix.go	"run basecamp connect redispatch <id>"	There is no such command.
connect_run.go, the served-set reader	"Dispatch treats an error as authorizing nothing"	It is the handoff now, and the window is #952.

Why this matters more than tidiness

The handoff comment is the one that misled. A TLA+ model built from it found two races in the handoff: a hold landing between the line and the close stops the connector, and a hold plus a redispatch during a boost sends a line under the hold. Both reproduced in Go, and both were fixed, before it turned out that no production actor can interleave a hold with a running handoff. The fix was reverted. If a command ever lets a hold or a redispatch act beside a running connector, the corrected comment says what the handoff would then need.

Not in this PR

Ledger.Redispatch, LaunchTask, DropContent, SetHooks, setup.TryLock and the outbox's remaining functions have no production callers (rg; make deadcode doesn't list the methods). They are candidates for removal, but removing them is a separate call.

bin/ci passes.

---

Summary by cubic

Corrects comments in ten files left behind by #815, which removed the dispatcher, connect redispatch, and the connector's per-launch hold of connect.json's lock. Comments only; no behavior changes.

The handoff comment is the one that mattered most: it claimed a hold could land while a boost was in flight, which is no longer possible since connect --hold sets the marker before any part runs and shadow promote requires the connector stopped. The corrected comment notes what a hold beside a running handoff would need.

• setup/private.go named three holders of the policy lock; only connect setup holds it now, and TryLock has no caller.
• ledger_tasks.go, ledger_decisions.go, and ledger_admission.go named Dispatcher.launch and connect redispatch as the callers keeping served-set checks current; neither exists.
• ledger.go, intake.go, admission/verdict.go, and admission/matrix.go told operators to run basecamp connect redispatch <id>, which no longer exists.

^{Written for commit a9f2bf2. Summary will update on new commits.}

[Copilot]

🟢 Approved

The changes are limited to comments, align with current behavior, and have no unresolved review findings.

No open issues 🎉

What changed in this PR

Updates comments left stale by #815’s removal of the connector’s worker side. The changes clarify current handoff and locking behavior without changing runtime behavior.

Changes:

• Clarifies when holds can act and which setup flows hold the policy lock.
• Removes instructions to use the deleted connect redispatch command and identifies former callers.
• Documents the handoff’s existing served-set window tracked in #952.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
internal/​connector/​setup/​private.go	Corrects lock-holder and wait-policy comments.
internal/​connector/​ledger.go	Removes obsolete manual retry instructions.
internal/​connector/​ledger_tasks.go	Clarifies the former launch caller’s locking responsibility.
internal/​connector/​ledger_decisions.go	Identifies redispatch’s former caller and locking contract.
internal/​connector/​ledger_admission.go	Updates the revision guard’s rationale.
internal/​connector/​intake.go	Clarifies reliance on automatic blocked-record retries.
internal/​connector/​handoff.go	Corrects hold timing assumptions and explains future concurrency requirements.
internal/​connector/​admission/​verdict.go	Removes obsolete redispatch guidance for configuration recovery.
internal/​connector/​admission/​matrix.go	Removes the deleted immediate-retry command reference.
internal/​commands/​connect_run.go	Describes the handoff’s unlocked served-set read and known window.

_{Review effort: Balanced}