---
name: a-test-that-binds-before-it-parks-its-keeper-races-the-heal-tick
description: An e2e rig whose shell spawn is a noop parks a DEAD pid at relink; if the test then binds (status online) before parking its own keeper pid, the 5 s heal_stale_online_records tick can derive offline inside that window and the cell reds only under load — a pre-existing rig race that reads as the member's regression.
metadata:
  type: feedback
---

2026-09-10 doyle, #287 respin 53f63c3a Windows leg: `spt::attach_link_push_e2e
attachment_frames_reach_a_linked_shell_through_the_real_daemon` FAIL at 51 s inside a 2378-cell run
(panic: no attachment frame within 30 s; daemon stderr carried `SHELL_RECORD_HEALED: online -> offline`),
then PASS 3/3 in isolation on the same rig at the same sha (19 s each) and 3/3 on kitsubito.

**Mechanism (read at BOTH shas, base de5a44bc and the respin):** the test's shell adapter spawn is
`cmd /c exit 0` / `true`, so `spt shell relink` (which spawns at base via `relink_shell_forced_from`)
parks a child that exits at once — a dead nonzero pid in the launch record. Clause 5 then calls
`bind(token_b)` (status → online) BEFORE spawning its keeper and recording it. `heal_stale_online_records`
runs every 5 s reconcile at both shas with identical logic (online + `shell_pid_provably_dead` → write
offline). A tick in the [bind → keeper recorded] window heals offline; nothing flips it back; the
attachment push never reaches the shell — exactly the panic text. The window is the keeper spawn
(`cmd /c pause`): sub-second idle, 1–2 s under a full nextest run with Defender first-touching fresh
exes, which is why isolation cannot reproduce it and a full set can.

**Why it looked like the member's:** the heal line is the member's own path (#287 rewrote shellwake.rs),
and this e2e binary had never gated ANY member this milestone — every Linux leg and both CI gates ran
`kind(lib) + kind(bin)`. A cell with no green anywhere in the arc is not evidence about the sha it first
reds on. deployah's framing: "the suspect's code appears in the trace" is the same shape as reading a
commit subject and concluding what the commit does.

**How to apply:**
- A load-only red whose panic is a bounded-observation budget: re-run isolated N× at the SAME sha
  first (cheap), then find the mechanism in SOURCE AT BOTH SHAS — base and member — before naming
  the member. Say which arm you ruled on (analytic vs the empirical baseline run) rather than blurring
  them.
- Production order is record-then-bind (the shell process publishes itself, then binds); a test that
  binds first is asserting a contract the product never makes. Fix = move the keeper park ahead of
  bind and KEEP the viewer's arrival before bind so the down-then-relink window is still spanned
  (deployah's exercise question: a reorder that removes the asserted condition goes green invisibly).
- Sibling of [[api-listen-once-gives-a-live-message-one-500ms-window]] (rig race, open the assertion)
  and [[defender-first-touch-tax-on-fresh-test-binaries]] (the load class that widens the window).