Chapter 13 - Worked Answers

1. Retry scope

Registration and heartbeat use the generic retry helper. reportTaskStatus makes one client call; it does not invoke that helper. Recovery can still occur through a later reconciliation pass: an already-running suitable container can be observed and its running state reported again. This depends on retained identities and ownership metadata, not on pretending the first report succeeded. A passing re-report test is narrower than a retry guarantee for every operation or every permanent authentication error.

2. Accepted report with a lost response

The server may already hold running while the agent sees a transport error. The next pass uses the same node ID, task ID and suitable managed container identity to observe the existing process and report again. Server lifecycle and ownership checks decide whether the duplicate is acceptable. Preserve those identities in the experiment and assert no extra container was created. This is protocol recovery while the server retains its state; the default MemoryService does not make those identities durable across a new server process.

3. Logical guards versus physical fencing

Rejecting an old running report prevents the accepted control-plane task record from moving backward or being resurrected after removal. Marking a node offline permits a policy response to missed heartbeats. Neither action proves the partitioned node’s process stopped or lost access to external resources. Physical fencing requires a mechanism that actually revokes execution or resource authority and an experiment showing stale ownership cannot continue its side effects. Do not promote a state-machine test into that stronger distributed-system guarantee.

4. Cancellation has multiple observables

Cancel Runner.Run while a fake client request and runtime log operation are deliberately blocked. Assert the runner returns, the client request context is canceled, runtime channels close and owned listener/connection resources stop. Include time-bounded failure assertions so a leaked activity is visible. Separately test shutdown notification’s fresh bounded context, because an already-canceled run context cannot deliver it. A cooperative fake demonstrates the injected contract; testing a real Engine blocked reader requires its own bounded local experiment and cannot be inferred solely from runner return.

These answers distinguish source reasoning from the scoped execution records linked in chapter 13. Proposed changes require separate implementation and validation.