The pair acquisition's ledger rest does not outlast the ledger writer's poll interval it was chosen to outlast. WithLedgerThenMintLock's comment says fsutil's lock-poll backoff tops out at 100ms and pairLedgerRest is 150ms to exceed it, but acquireFlock doubles the backoff after the sleep while it is below 100ms, so 80ms becomes 160ms and the real poll ceiling is 160ms: a ledger writer sleeping 160ms can miss the whole 150ms window the pair leaves the ledger free. No test pins the ceiling or the rest, so either can move and break the guarantee silently.

The pair acquisition's ledger rest does not outlast the ledger writer's poll interval it was chosen to outlast. WithLedgerThenMintLock's comment says fsutil's lock-poll backoff tops out at 100ms and pairLedgerRest is 150ms to exceed it, but acquireFlock doubles the backoff after the sleep while it is below 100ms, so 80ms becomes 160ms and the real poll ceiling is 160ms: a ledger writer sleeping 160ms can miss the whole 150ms window the pair leaves the ledger free. No test pins the ceiling or the rest, so either can move and break the guarantee silently.

Grounds

• pursued: a ledger writer polling through the pair's wait always wakes inside the window the pair leaves the ledger free; TestTheLockPollNeverSleepsPastItsCeiling or TestThePairRestOutlastsTheLedgerPoll failing would show it wrong