[mremond]

Why

A program could hang when its initial process returned with links while a message or exit signal reached its inbox.

What changed

• The initial process handles inbox work queued during its final running slice instead of leaving it stranded.
• Exit signals carry their classification with their payload, preserving fatal exits even if the sender pauses before waking the process.
• Deterministic runtime regressions cover both deliveries, a paused sender, both inbox drains and the unchanged empty-inbox wait.

Before and after

Before: Both final-slice delivery regressions stranded inbox work; a paused sender could also make a fatal exit complete normally.

After: All six affected runtime tests pass ten consecutive runs each, and 120 native/BEAM comparison runs complete with the expected outcomes.

This changes runtime scheduling and signal delivery, not a visible interface.

Checked

Live validation: Demonstrated for this version. 4 of 4 scenarios driven live in the product.

Scenario	Result	Evidence
Messages and exit signals queued during the initial process's final running slice still wake it.	✅ Passed live	The actual worker-loop message, exit and empty-inbox cases passed ten consecutive runs each; the original delivery ordering failed.
A paused sender cannot separate a fatal exit's payload from its signal classification.	✅ Passed live	The paused-sender, single/batch drain and stale linked-exit cases passed ten consecutive runs each; the split-publication defect reproduced before repair.
Linked initial entries complete normally or retain fatal-exit outcomes consistently with an explicitly waiting BEAM caller.	✅ Passed live	All 120 real program runs passed across native default schedulers, native one scheduler and OTP 29.1.2.
The complete project gate and applicable runtime probes pass.	✅ Passed live	Builds, strict lint, 2,182 Rust tests, 492 native tests, allocator/stacktrace checks, six runtime contracts and ten shutdown cases passed.

• Independent review: The corrected code and complete kept validation proof passed independent review with no remaining material findings.

How it was checked

cargo build --release --locked -p nera-runtime; cargo build --release --locked -p nera; cargo build --release --locked

cargo clippy --workspace --all-targets --locked -- -D warnings; cargo test --workspace --locked --no-fail-fast

python3 scripts/test-allocator-config.py; ./target/release/nera test -j 1 --timeout 30; python3 scripts/test-stacktrace-order.py

python3 scripts/test-runtime-contracts.py with the complete corpus; python3 scripts/test-native-shutdown.py with all prescribed cases

Ten consecutive runs each: initial_return_with_links_observes_final_slice_message, initial_return_with_links_observes_final_slice_exit, initial_return_with_links_observes_exit_before_sender_wake, initial_return_with_links_without_delivery_stays_waiting, inbox_drain_keeps_exit_classification_with_its_payload, linked_exit_releases_runnable_slot_once

The workspace retains one existing ignored test; the native suite retains two expected skips.

The BEAM comparison explicitly retains its caller after entry return; plain Erlang startup has different initial-process lifetime semantics.

Independent review found the split EXIT-publication race; the corrected envelope and both drain paths passed re-review.

All ten shutdown cases passed, with median final-output-to-exit gaps from 0.25 to 1.57 ms.

Risk

Risk above low: Blast radius, high — Shared inbox classification serves every Erlang process.; Novelty, medium — Adds a typed EXIT envelope beside existing message fragments.

Full risk assessment

Dimension	Level	Why
Blast radius	high	Shared inbox classification serves every Erlang process.
Behavior	low	Corrects missed wakes and fatal-exit classification without changing link semantics.
Undo	low	A revert restores the previous implementation; no data migration.
Evidence	low	Deterministic worker regressions and native/BEAM completion checks passed.
Sensitivity	low	No sign-ins, credentials, persistent settings or external data changed.
Novelty	medium	Adds a typed EXIT envelope beside existing message fragments.
Dependencies	low	No dependencies added or updated.

Not done

Local validation covers macOS arm64; it does not establish Windows or target-native cross-platform behavior.

Pipeline

Updates from git push no-mistakes

Infinitary checked this version: an independent review that also judged the documents, and live validation the review accepted.