> once celld has confirmed they're no longer needed

Isn't that the same check then act race in a new spot, and is it covered by an invariant?