delete_packet_filters Update outcome (#22 Increment 3)

[next-nf]

Stacked on #52 (base async-ue-bearer-22-inc2). Third increment of #22.

Completes the delete_packet_filters procedure Increment 2 started: a delete that leaves the bearer with surviving rules now re-provisions PFCP and emits a PTI-echoing Update Bearer Request carrying the recomputed TFT, instead of the Inc2 assert_bearer_emptied reject. Increment 2 handled the empty case (→ Delete Bearer); this handles the non-empty case (→ Update Bearer).

The first multi-await async_m procedure

ue_delete_filters_proc now parks twice: Gx CCR-U await → PCC remove+install fold → branch → non-empty: detect_modified_bearers (surviving descriptor) → PFCP-modify await → emit the Update Bearer. Almost all reuse — detect_modified_bearers, send_dedicated_bearers_update (PTI rides ExtraIEs, Kind = rule_change), the free ensure_uplink_filter, commit_staged_descriptor on the response, create_new_tft full-replace.

Commits

• 876dd9a — the multi-await procedure: ue_delete_outcome/8 (empty→Delete unchanged / non-empty→Update), await_pfcp_modify/1, emit_ue_update_bearer/7; folds remove and install (closes the Inc2 remove-only TODO(PGW: implement UE-requested bearer resource modification (TAD add/replace/delete) #22)); splits br_err (#ctx_err re-throws → FATAL stop / recoverable → Failure Indication); drops assert_bearer_emptied; renames br_delete_ok→br_ok.
• 4a8a836 — stale-comment fix (br_delete_err→br_err in the Inc2 reject case).

Design decisions

• Multi-await (fully non-blocking, PFCP-before-Update like the RAR path) over deferring PFCP to the response.
• create_new_tft full replace (the M3/M5 convention; inherits the free uplink-filter guarantee) over a true delete_packet_filters TFT delta.
• Reuse Kind = rule_change — handle_update_bearer_failure/4 has no catch-all, so a new Kind would crash on an Update Bearer failure.

Reviews & tests

• Task review: Approved (multi-await mechanics, the exhaustive FATAL/recoverable br_err split, TFT-replace/Kind-reuse all verified).
• Whole-branch cross-cutting review (multi-await/gate lens): READY TO MERGE, zero findings. Confirmed no empty-async_pending window between the two parks (the Gx→PFCP transition is one uninterrupted function invocation), correct composition with delete_packet_filters -> Delete Bearer via async Gx CCR-U (#22 Increment 2) #52's fire-and-forget {'$reply'} postpone clause, working M-2 resume-re-park, and a clean PFCP-FATAL stop (no async error callbacks routing through handle_ctx_error/4 don't drain async_pending -> coarse gate can wedge #51 wedge). The multi-await pattern is validated end-to-end — the foundation's M-2 concern did not materialize.
• pgw_SUITE 130/130 (129 prior + 1 new two-rule Update case), independently re-run. Default compile green.

Out of scope

add_packet_filters / replace_packet_filters (Increment 4); requested-QoS/GBR (Increment 5).

[next-nf]

Superseded by the async-invoke restack. This increment was re-authored onto invoke(pipeline_async) and collapsed into #56 (delete/add/replace together) on the redone #48 foundation. Closing in favor of #56.