# Counterfactual

Use this to avoid patching symptoms. The output must separate the
**minimal correct algorithm** from the **current algorithm**, then name
the smallest intervention that moves current toward correct.

## Output shape

Use exactly these sections:

1. **Goal:** one sentence stating the invariant we need.
2. **Minimal algorithm:** pseudocode or numbered steps for the ideal
   implementation. No library constraints yet.
3. **Current algorithm:** what the code actually does today, including
   ownership, blocking points, and cleanup boundaries.
4. **Gap:** the first point where current diverges from minimal.
5. **Smallest fix:** one intervention. Preserve working invariants.
6. **Falsifier:** the test or measurement that proves the fix wrong.

## Rules

- Do not start with a proposed patch. Start with the invariant.
- Do not compare against a strawman. Read the code and name exact
  functions, fields, and blocking calls.
- Preserve constraints that are already correct. If a prior commit fixed
  a deadlock, do not revert it to fix a leak.
- Prefer ownership/cancellation changes over retries, sleeps, or cleanup
  after the fact.
- A good fix reduces the gap; a great fix removes an entire class of
  impossible states.

## Checklist

- Where is ownership supposed to live?
- What wakes every blocking syscall?
- Who joins or intentionally detaches each thread?
- Which fd owner closes each fd?
- What happens if the happy-path event never occurs?
- What is the failure mode under load?

## Example

Goal: Dropping a per-machine vhost-user server must not block the
registry actor and must not leak fds when no VM ever connects.

Minimal algorithm: bind listener; spawn accept loop cancellable by a
shutdown token; Drop fires token, wakes listener, signals workers, joins
threads with a bound, and closes all owned fds.

Current algorithm: `start()` moves `VhostUserDaemon` into an accept
thread and calls `daemon.start(&mut listener)`. Drop removes the socket
path, then tries to take the daemon from `Arc<Mutex<Option<_>>>`. If the
thread is blocked in `accept()`, the option is `None`, so cleanup is
skipped.

Gap: unlinking a Unix socket path does not wake a blocked `accept()`,
so the daemon owner never returns to Drop.

Smallest fix: keep Drop nonblocking, but spawn a bounded reaper that
self-connects to wake `accept()`, waits for daemon handoff, signals
workers, and joins the protocol thread off the actor thread.

Falsifier: create and drop N servers without clients, then assert the
fd delta over a control arm stays below the regression threshold. If fd
count grows linearly with N, the fix is wrong.