---
name: a-widened-wall-clock-margin-is-a-longer-coin
description: "A cell that races a periodic background sweep and is 'fixed' by widening its margin is not fixed — it flips again on a loaded box, and the giveaway is the test's own comment documenting the earlier, narrower red"
metadata:
  node_type: memory
  type: feedback
---

Measured 2026-09-08, golden r2 attempt 2, `spt::webserve_attachment_e2e`
`an_attachment_is_snapshot_served_fetched_back_and_named_by_its_message`, the ONLY red in
`234 tests run: 233 passed, 1 failed`. Panic at `crates\spt\tests\webserve_attachment_e2e.rs:612:9`:
"the attachment this arm just registered is not in the registry." The send SUCCEEDED — its own
stderr carried `ATTACHED:reap-me.md: ... (27 bytes, ttl 5000ms)` — and the dumped registry held
three siblings, every one `ttl_ms=2592000000`. Only the 5 s entry was missing.

The arm mints an attachment with `--ttl 5s` and asserts it is present, against a reaper that ticks
every 5 s, with a spawned `spt send` child and a prior arm's six child processes ahead of it. Its
own comment documents the SAME failure at `--ttl 1s` ("one red then a pass on re-run, which is the
signature of a race") and widens to 5 s on the reasoning "Five seconds cannot expire before the
capture below". That sentence is the defect: it is an assertion about wall-clock on an unloaded
box, and a golden runner is not one.

**Why:** widening a margin changes the ODDS, not the SHAPE. The cell still decides by whichever of
two unsynchronised clocks wins, so it keeps a failing side that appears only under load — the most
expensive place to find it, and the one where it reads as a product defect on a release gate.
doyle excluded the alternatives at the sha before accepting this (both daemon writers hold
REGISTRY_WRITE, the CLI registers through the daemon socket, save is atomic ⇒ clobber and
torn-read out, race survives by elimination) — a classification, not a shrug.

**How to apply:** treat a comment that narrates an earlier flake and a bumped constant as a
STANDING BUG REPORT, not as reassurance — it names the mechanism and admits the fix was a margin.
Remove the coin instead: take the value from the operation's OWN output (the send already prints
the url and ttl), or force the sweep deterministically (register long, backdate the entry's
`registered_at_ms`, let the next tick reap it). Related: [[flake-timing-bimodality-is-usually-rig-timeout-arithmetic]]
(sum the bounds before theorising), [[mutation-proof-does-not-validate-a-green]] (an incidental
mechanism can green a broken subject).

## 2026-09-09 — the family is WIDER than a margin, and I framed it too narrowly

Golden r2 ran four attempts at ONE sha (25e60015). Each produced a DIFFERENT single Phase B
victim: a2 `webserve_attachment_e2e` (5 s ttl vs 5 s reaper), a3 `mesh_recovery` (15 s
`converge()`), a4 `registry_lifecycle oneway_rounds...` (a COUNT assertion, `held 0 -> 1, seats 1`),
plus a fourth on the other box (`two_host_ladder_role_a`). I predicted a third distinct victim as
the falsifier for "one env cause"; it fired.

**Where my framing was wrong:** I called the class "a fixed wall-clock budget losing under load".
That covered a2 and a3 and NOT a4 — a4's cell failed in 11.594 s where it PASSED in 23.344 s the
attempt before. It did not time out; it sampled an END STATE (the assertion's own comment admits
it cannot see a transient) and a straggler feed landed on the wrong side of the sample.
**Failing FASTER than its own passing run is the tell that a red is not a timeout** — I had the
number in hand an attempt earlier and did not name it.

deployah's mechanism, accepted by doyle, is the one that covers all four: **a rig sample racing an
UNJOINED background actor** (A's pump thread is flag-stopped and never joined, so one straggler
feed can arrive after the "before" sample). Timeouts and count assertions are two faces of it.

**How to apply:** when victims rotate at one sha, do not stop at "one env cause" — that is a
CATEGORY, and the next question is WHICH shared actor every victim samples against. Ask what the
rig starts and never joins. And before classifying any red as a load/timeout casualty, compare its
FAIL duration against its own PASS duration on a green attempt; faster-on-failure refutes the
timeout reading outright. Env corroboration for this arc: Phase A pure-unit climbed monotonically
448.7 -> 495.1 -> 542.6 -> 742.2 s across a1..a4 with cargo/rustc/nextest at 0 (see
[[defender-first-touch-tax-on-fresh-test-binaries]]).