Joseph Ferano
0c9f043bb1
The snapshot made the listing stand still; it did not make the handoff safe. A choice is validated against the snapshot on top when the request lands and resolved against the snapshot on top when the game thread next looks, and between those the loop runs evaluations — one that errors pushes a break of its own, whose loop reaches the flag first and takes its own index 2 for the one somebody picked off the outer list. That is the failure this change exists to end, arriving by a different door. So each snapshot carries a generation, a choice carries the generation it was validated against, and a loop claims only what is addressed to it. A mismatch is left set rather than dropped: the listener already answered ok, so the break it was meant for must still be able to take it. Depth could not do this — an outer break resuming and a new one starting reuses the number. The snapshot is also popped before the depth comes down now, so the two never describe different breaks. The client's own new path gets tested too: the candidate table is pure, so the shapes a real daemon will not easily produce are checked directly, and the break-and-resume test now goes through restart-at rather than by name. flan-dev-unreachable-restarts was dead on arrival — flan-break reads :unreachable off its own reply — and is gone.
