---
name: redispatch-stall-progress
description: "REDISPATCH-STALL wave ledger: triage @7488c1a on main 2026-07-16 (ADR-0038 Amendment + KH 7.43 + 5 REQs), todlando DISPATCHED W1 build/redispatch-stall-w1; counter-63 fast-follow after MESH-RECOVERY 62."
metadata: 
  node_type: memory
  type: project
  originSessionId: 9183c374-ac41-4e0a-b478-a8b19f32f855
---

**REDISPATCH-STALL** — v0.34 field stalls (20-30s PTY/RC freezes, 17-62s DISPATCH tails): W1 claim retries × broad `Err(_)` opener fallback (dispatch.rs:414) manufacture throwaway peek subscribers; `StreamLog::attach` (nethost.rs:322-346) replays the whole ring under the per-stream mutex with `let _ = sub.write()` discarded errors, poisoned subscriber stays installed → serial 15s poison windows (33 observed, all 15,000-15,154ms). Hertz RCA 2026-07-16, doyle seam-verified same day. Supersedes [[redispatch-stall-preview]] (deleted).

**BUILD CHECKPOINT (todlando, in-flight on build/redispatch-stall-w1, 5 REQs FLIPPED):**
- DONE nethost.rs: SubscriberSeat (bounded sync_channel 1024 + writer thread, halt-at-first-write-failure sets poisoned, done flag = fully-gone) replaces raw SharedSend subscriber in StreamLog AND PresenceLog; begin_attach returns replay snapshot, callers (subscribe_stream/subscribe_presence) enqueue OUTSIDE mutex via enqueue_blocking w/ seat.is() recheck per frame; drop_seat on enqueue fail (stream-sub-halt/presence-sub-halt lifecycle events); POISON-class prior seat refuses reinstall (WouldBlock 'subscriber busy'), HEALTHY prior displaced as before (GOTCHA: blanket no-reinstall TIMEOUTed applyhost tests — displacement is a legit brain-swap contract); StreamLease on StreamLog (cancel on poison drop_seat) + send_stream refuses canceled lease ('lease canceled') + NetHost::stream_lease getter for C2. Lib units 522/522 green.
- DONE dispatch.rs: is_unsupported_verb (match 'unknown command kind' = old-broker send_error text) narrows first_line Err(_) arm; classify_failure ('subscriber busy'/'replay halted'/'lease canceled' = SeatBlocked else Transient); CircuitBreaker (base 2s doubling cap 30s, global, claims pause while open, reset on Served); outcome_transition(+breaker_window): SeatBlocked = Retry WITHOUT attempts increment paced by breaker (T5 not-abandonment), Transient keeps x3 budget; MAX_DISPATCH_WORKERS=8 pool (AtomicUsize, break on full = batched cold enumeration); dispatch_event() keyed telemetry (gen/stream/family/attempt/conn/event/detail) + breaker-trip + worker-outcome events; generation = dispatcher start ms.
- DONE since checkpoint 1 (tree COMPILES, spt-daemon lib units 522/522, spt-net 147/147, spt builds; ALL UNCOMMITTED on build/redispatch-stall-w1): (a) WorkerReport{outcome,family,endpoint} + line_endpoint() (attach=endpoint_id, rest/xfer=endpoint, shell-link=owner, wanmsg=target) + keyed worker-outcome event incl endpoint (hertz's load-bearing key); (b) pre-serve terminal exclusion: first_line 'no such stream' → Served("terminal pre-serve: row already gone"); (c) fix 6 GENERATION COMPLETE: AttachRecord::Request +gen (serde default+skip-if-zero, gen_is_zero helper, spt-net attach.rs; client mints now_ms() in spt-daemon attach.rs:~660); SubscribeReq.gen + UnsubscribeReq.gen Option (msg.rs); Brain::subscribe_with/attach_as +gen, detach_session_gen(sid, Some(gen)); broker ControllerSink.attach_gen + resolve_subscribe(+gen) same-identity arm REFUSES gen!=0 && incumbent!=0 && gen<incumbent (BusyControlled — replayed stale Request never displaces newer same-by controller; equal gen = same-Request reconstruction allowed; 0 = local/N-1 legacy) + detach_if_gen (stale gen never clears controller, viewers still ptr-cleaned); serve_attach serve_gen var set on attach, terminal releases via detach_session_gen.
- DONE (2026-07-16 session 3, ALL UNCOMMITTED): (a) fix 8 — serve() end detach loop broker.rs was the ONLY violation (clone log Arcs then drop sessions lock before detach_if; all other sites already clone-then-drop; detach_if→stamp_viewer_count/lifecycle_event = the I/O); (b) units 19 new: seat halt append+finish sites, begin_attach poison-refuse/healthy-displace/gone-admits (white-box flags), overflow-detach no-lease-cancel + resume-from-cursor, PresenceLog mirrors, send_stream lease refuse, breaker trip/double/cap/reset, classify_failure table, is_unsupported_verb gate, SeatBlocked budget-free transition, dispatch_event keys, line_endpoint per-family, pool_has_room cold-flood, broker stale-gen resolve_subscribe refuse + detach_if_gen stale skip; (c) **LEASE RENEWAL added** (begin_attach renews canceled lease for a NEW subscriber generation; old handle stays canceled) — without it one poison permanently dead-ended a stream (T5 recovery unfalsifiable); (d) ints tests/redispatch_stall.rs 6 tests = T1+T3 combined (real wedged brain-conn subscriber, 400ms deadline knob, producer-flat + gapless recovery), T2 (no-newline opener → exactly 3 bounded Failed then terminal), T4 (forwarder killed by 'lease canceled' + renewal recovery — GOTCHA: recovery subscriber must attach from ring TAIL or it self-wedges replaying 1.5MB unread), T5 (SPT_DISPATCH_INJECT_SEATBLOCKED_ONCE valve → breaker-trip + ≥2s pacing + 1 Failed + recovery), T6 (unfinished-stale via gen1 kill NO detach + newer same-identity attach → no take/clear across 3 rounds), T7 (SPT_TEST_STREAM_OPENER_UNSUPPORTED broker valve = byte-identical N-1 answer → peek serves real PTY traffic first-try); (e) 2 test valves added (dispatch seatblocked-once; broker opener-unsupported); (f) HEAVY ×3 strings += redispatch_stall (ci.yml ×2 + nextest.toml + comment); (g) redispatch 5/5 BINDING green; traceable-reqs check exit 0; new units 19/19 green; redispatch_stall 6/6 green.
- ⚠ FULL-BATTERY VERDICT (2026-07-16): 1882/1884. `xfer push_survives...` = starvation flake (green isolated). `inject_control_wedge wan_arrival_to_idle_spt_hosted...` FAILS ISOLATED **AND on clean HEAD 7488c1a baseline worktree** → PRE-EXISTING box-state red, NOT the wave (mechanism: F029 respool-once on inject commit-deadline miss — outcome=DeliveredInject + pending_spool_rows=1 + payload_reached_pty=false; socket IS home-tagged so no live-daemon collision; 6 leaked target\debug\spt.exe swept, still red). REPORT to doyle in PR; CI boxes arbitrate.
- ✅ **W1 BUILD COMPLETE + PR-READY (2026-07-16): PR #18, commit cb70090 on build/redispatch-stall-w1, doyle pinged SENT live.** Preflight: redispatch 5/5 BINDING, redispatch_stall 6/6, 19 new units, full battery 1882/1884 (both reds dispositioned), clippy workspace all-targets clean (fixed: dup too_many_arguments attr attach.rs, unused name_a), xtask check OK, traceable exit 0. Sibling-test sweeps for new gen params: SubscribeReq literals ×11 (+gen: 0), attach_as calls ×13 (+0 gen arg). NOW: doyle gate (isolated worktree, rulings in triage doc) → deployah counter 63 → hertz field-verify.
- NOTE for doyle (also in PR body): HYGIENE 'lock-discipline seam' unit item = impl tag + T1/T3 producer-flat int, not a dedicated unit. seedmap/xfer reds under one-pool local runs = starvation flake (green isolated). wan_arrival red = box-state (clean-HEAD baseline red), F029 respool-once shape — possibly hertz lane.
- ✅ **PR #18 MERGED @8d5dcab (doyle heavy leg PASSED, 2026-07-16).** Doyle RCA'd the wan_arrival red: ENV pollution (live-agent shells export SPT_INJECT_VERIFY_ECHO → test broker inherits → echo-verify force-on → mock PTY no echo → respool-once); arbitration closed, not box-state. I took the offered rider: init_wedge_home scrubs INJECT_ECHO_ENV_VARS (opt-in test sets after init, unaffected); 19/19 in polluted shell.
- ✅ **RULED (doyle 2026-07-16): 0c70253 RETRO-GATED IN PLACE, stands, no revert** — verified verbatim-prescription, test-only; fault SHARED (doyle's merge flow ran git ops from bad cwd and switched the checkout); rule going forward: test-only+prescribed may retro-gate, PRODUCT code always takes the PR lane regardless of size. Main-push CI running on 0c70253; doyle holds deployah counter-63 GO until green. My lane CLEAR unless CI reds.
- (superseded by ruling above) PROCESS FAULT (2026-07-16): rider commit 0c70253 landed DIRECT ON MAIN + pushed — the shared checkout was switched to main by the #18 merge flow between my round-1 push and the rider commit; I didn't re-check the branch. Confessed to doyle immediately (QUEUED), offered (a) retro-gate in place (it's doyle's own prescription verbatim) or (b) revert main to 8d5dcab + re-land via PR; NOT touching main until they rule. LESSON: `git branch --show-current` before EVERY commit on this shared checkout — the merge flow moves it under you.
- ✅ GATE ROUND 1 CLOSED my side (2026-07-16): sha 73b29b8 pushed, doyle replied SENT. 3 must-fix done: (1) read_controller_event_resuming +gen param, resume carries serve_gen (broker unit gap_resume_resubscribe_preserves... pins attach_gen preserved + stale refused + terminal detach clears, red-on-revert both ways); (2) gen_is_zero moved off AttachRecord's doc block; (3) fix-9 trim (gauges/high-water/cursor → DAEMON-LIFECYCLE) recorded in REQ stage comment. Q2 taken as code: breaker reset gated off 'terminal pre-serve' Served (row-gone isn't progress; reset also zeroes the doubling ladder). Q1 answered: old-worker lease window harmless (poisoned seat = worker's serve conn; gen validation caps damage; C2 worker-held Arcs close it — renewal keeps old Arc canceled by design). Preflight round 2: 26/26 (stall 6 + redispatch 5 BINDING + attach 15) + new units + clippy + traceable green. Doyle heavy leg runs on 73b29b8.
- ⚠ INCIDENT NOTE (operator 2026-07-16): live daemon on THIS box STOPPED during hertz's tests (MESH-RECOVERY v0.35 field-verify) — NOT investigated by me (hertz/doyle lane); possible kin of this wave's stall class. Expect messages on wake.
- TODO: (a) worker returns (outcome, family, endpoint) for telemetry — endpoint key LOAD-BEARING (hertz live catch: stream 7058 identity unprovable; doyle: keep endpoint in key set); line_endpoint(family,&line) helper (attach endpoint_id, rest endpoint, shell-link owner). (b) pre-serve terminal exclusion: first_line 'no such stream' error → Served("terminal pre-serve") not 3x retry. (c) fix 6 broker generation: SessionLog.controller_gen bump on become_controller; Subscribed reply carries gen; UnsubscribeReq +gen Option (None=N-1 legacy ptr behavior); detach refuses stale gen; serve_attach terminal paths skip feed_rest(Detach) when stale (needs acked detach reply or gen compare). (d) fix 8: sessions clone-then-drop audit broker.rs (serve() end detach loop + info.json writes). (e) units: seat halt/remove per site, overflow-detach cursor, breaker trip/gate/reset, is_unsupported_verb, classify_failure, dispatch_event key completeness, gen refuse-stale. (f) ints tests/redispatch_stall.rs T1-T7 (T7 mixed-image REAL traffic; rigs: pump.rs/mesh_recovery.rs pattern + wedged-conn shape from conn_blackhole/netbroker 'proving()' blackhole trick). (g) HEAVY x3 strings add redispatch_stall. (h) doc tags: ADR-0038 Amendment already tagged by doyle (doc-> lines present); traceable stage comments done at flip. (i) preflight + D1/D1b binding + PR + ping doyle.
- LIVE CORROBORATION (hertz, mid-build): stream 7058 poison +15.012s → Failed(fill whole buffer) +1.046s → RETRY SECOND SUBSCRIBER +3.034s post-poison — exactly the breaker's kill target; per-stream confirmed broker-wide falsified on live data (daemon status 0.39s during window).

**FIX WAVE (post-merge main-CI red, 2026-07-16/17):**
- Main CI on 0c70253 RED: xfer push_survives = REAL W1 BUG (my 'starvation flake' disposition was WRONG; doyle logged the twin lesson: flake-disposition inside a changed seam needs mechanism, never 'green isolated' alone). RCA: fix-3's caller-side replay enqueue outside the mutex let a concurrent producer append slot a live frame into the replay ('got seq 134 want 6'). Doyle HELD deployah counter-63.
- ✅ FIX PR #20 (fix/redispatch-stall-w1-replay-order, fc25799, doyle pinged SENT): replay handed to SubscriberSeat::install under the mutex, WRITER drains replay-then-live (order structural, I/O outside); caller loops + enqueue_blocking deleted; begin_attach returns count. RIDER the fix surfaced (T4 red under load): mid-replay poison on traffic-quiet stream never cancelled the lease (drop_seat needs producer enqueue) → writer holds its generation's lease Arc, cancels AT the failed write; superseded writer's late cancel hits only its replaced Arc (renewal moved above install). 'replay halted' string no longer emitted (writer-side now; classify table keeps it harmlessly). New lifecycle event stream-sub-writer-poison. Deterministic interleave unit (pin gate across attach+appends, dense 0..10).
- Evidence: baseline 0c70253 xfer x10 under load = 1/10 RED (+CI red = red-on-revert); fix x10 green + FULL battery 1886/1886; resume x3 green (kitsubito resume_mode_brain_spawning kin re-check post-merge, doyle's item); T1-T7 + D1/D1b green; clippy/traceable/xtask clean.
- GOTCHAS this leg: (a) foreground `cd` into a worktree STICKS in the session shell — one suite run silently executed in the baseline worktree (19-unit count was the tell); always pwd-check after any worktree work; (b) two more leaked target\debug\spt.exe sweeps needed (EPERM on rebuild + xtask) — sweep before xtask/battery on this box.
- ✅ PR #20 gate round 1 (doyle catch, 2026-07-17): renewal-on-canceled was WRONG on HEALTHY displacement — displaced writer + successor SHARED one lease Arc; old writer's queued-frame death canceled the successor's lease (spurious serve-kill per displaced stream on every daemon refresh). Fixed @f4727cd: begin_attach mints a FRESH lease Arc at EVERY install (mint IS the T5 recovery; superseded writers cancel only their own generation by construction) + unit displaced_writer_failure_never_cancels_the_successor_lease (park queued write on pinned gate, healthy displace, kill old conn → old Arc cancels, successor's live). 21/21 units, stall 6/6, D1/D1b 5/5, clippy/traceable clean. Doyle pinged SENT.
- LANE NOTE (doyle): PR #20 becomes THE release PR (carries the version bump, v0.30.3 precedent); PR #19 closes.
- ✅ **PR #20 GATE CLOSED + MERGED @fa3e474 (2026-07-17); PR #19 closed superseded; deployah GO SENT for counter 63.** Doyle tallies: units 687/687, heavy ints 59/59, xfer ×10/10, resume ×5/5 — both post-merge reds dead under one mechanism. **MY BUILD LANE COMPLETE**: W1 (fixes 1-9, T1-T7) + two real post-merge bugs found-and-killed pre-release (replay interleave + displacement lease sharing); hold system worked as designed. Local main synced @fa3e474, wave branches pruned. NOW (other lanes): deployah counter-63 publish → hertz field-verify (poison-window fingerprint gone; stream-sub-attach O(active); stream→endpoint provable) → milestone close. My next dispatch: DAEMON-LIFECYCLE cluster (next-ranked in [[spt-core-findings-backlog]]).

**Status 2026-07-16:**
- ✅ TRIAGE @7488c1a on main: docs/REDISPATCH-STALL-TRIAGE.md (seam census verified @7f5ead8 + fix set 1-9 + seven-test matrix T1-T7 + gate rulings 1-9 pre-made + field discriminators) + ADR-0038 **Amendment** (narrowed fallback / subscriber write discipline / circuit breaker / ownership-generation validation / hygiene+telemetry; rejections: retry revert, deadline widening, tear-down-all-on-poison) + KH 7.43 + 5 REQs registry-first (required_stages=[], flip at build): REQ-HAZARD-REDISPATCH-STALL (doc+int), REQ-DISPATCH-FALLBACK-CIRCUIT (fixes 1+5), REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE (fixes 2+3+4 incl. PresenceLog mirrors), REQ-SERVE-OWNERSHIP-GENERATION (fix 6, unfinished-stale steal shape), REQ-DISPATCH-HYGIENE-TELEMETRY (fixes 7+8+9). RCA condensation local `.claude/reports/2026-07-16-redispatch-stall/rca-summary.md` (reports dir is repo-local, NOT committed — gitignored, same as all prior reports).
- ✅ todlando DISPATCHED (SENT live 2026-07-16): branch build/redispatch-stall-w1, single wave, all 5 REQs.
- ✅ **LIVE FIELD CATCH (hertz 2026-07-16, post-triage):** stream 7058 on webbie/v0.34 — attach → +15.012s CONN_WRITE_POISONED → Failed(fill whole buffer) +1.046s → retry subscriber +3.034s; daemon status 0.39s DURING window. Per-stream wedge CONFIRMED live, broker-wide freeze falsified 2nd time. Evidence PRESERVED byte-for-byte: hertz box `C:\Users\decid\.omp\state\spt-endpoint\webbie-v034-live-stall-daemon.stderr.log.snapshot` (6.9MB, baseline lines 44707-44769); hertz watcher rearmed bg_4, passive until 63. Identity caveat: stream→webbie = timing correlation only — fix 9 endpoint-keyed telemetry closes it (endpoint key = LOAD-BEARING, told todlando). Pinned in local rca-summary.md.
- ✅ **PR #18 READY @cb70090 (todlando):** fixes 1-9, 19 units, T1-T7 (6 tests, HEAVY ×3), D1/D1b 5/5, battery 1882/1884. Deviations disclosed: lease RENEWAL added (correct — one-way cancel = abandonment), hygiene lock unit via impl+T1/T3, 2 env valves.
- ⚠ **DOYLE GATE ROUND 1 (2026-07-17, issuecomment-4998403999): source review PASSED, 3 must-fix:** (1) read_controller_event_resuming re-subscribes gen=0 mid-serve (attach.rs:185, called :393) — resets incumbent attach_gen (re-arms stale-replay steal) + worker's own detach_session_gen(Some(serve_gen)) then mismatches (can't clear own slot); plumb serve_gen through + cover evict→resume→stale-replay. (2) gen_is_zero helper displaced AttachRecord's enum doc comment (spt-net attach.rs). (3) fix-9 gauges/PTY-high-water/RC-cursor NOT built (pre-existing high_water/DialGauge only) — trim ACCEPTED by ruling (folds into DAEMON-LIFECYCLE observability leg) but must be RECORDED in REQ stage comment. Answer-only Qs: old-worker lease window post-renewal (my read: harmless, poisoned brain conn + gen guard); breaker.reset() fires on row-gone pre-serve Served (non-progress reset, defense-in-depth only, todlando's call).
- ⚠ **NON-WAVE RED (watch):** inject_control_wedge wan_arrival_to_idle_spt_hosted red on CLEAN HEAD 7488c1a on HFENDULEAM (F029 respool-once shape: DeliveredInject + 1 spool row + payload never on PTY). Provisionally box-state (standing wan_arrival class + hertz's induced daemon suspension same day); CI runners arbitrate; if a RUNNER reds it → stop and look; else hertz correlation seed. Also xfer::push_survives red in one-pool full battery = documented starvation mode, green isolated.
- ⏳ PENDING: todlando round-1 push (one commit) → doyle heavy leg on that sha (isolated worktree, fresh target, D1/D1b + seam sweep) + CI both runners → merge → deployah counter 63 → hertz field-verify (poison fingerprint gone; stream-sub-attach/gen → O(active); stream→endpoint binding provable).

**GATE CLOSED, PR #18 MERGED @8d5dcab (doyle 2026-07-17):**
- Round 2 on 73b29b8: fixes verified (gen plumb + red-on-revert unit; doc reattached; trim recorded; Q2-as-code breaker gate — todlando's ladder-reset insight). CI green BOTH runners; wan_arrival PASSED both (arbitration).
- Heavy leg isolated worktree fresh target: clippy clean, traceable 0, units 930/930, heavy ints 78/79.
- **wan_arrival red RCA PINNED = ENV-STATE not box-state:** broker.rs:2318 echo_capable reads SPT_INJECT_VERIFY_ECHO; live-agent dev shells export it → test brokers inherit → echo-verify miss → respool-once. PROOF: env -u → PASS. Seeded backlog w/ gate lesson (dev-red+CI-green+clean-HEAD-red ⇒ suspect SESSION ENV first, env -u = 30s discriminator).
- **Rider 0c70253 RETRO-GATED IN PLACE (ruling a):** todlando's env-scrub rider landed as DIRECT main commit (process fault, self-flagged; shared checkout switched under them by MY merge flow — fault shared, check-branch rule minted). Verified verbatim-my-prescription, test-only 13 insertions, 19/19 polluted shell; main-push CI on 0c70253 = the GO condition. Rule: test-only+own-prescription = retro-gate OK; product code ALWAYS PR lane.
- **MERGE-FLOW GOTCHA ×4 (mechanism finally pinned):** my gh pr merge ran with Bash cwd INSIDE the gate worktree (cd persisted from a foreground test run) → git ops walked up/behaved oddly, shared checkout ended on the PR branch, worktree removal self-blocked by own cwd. RULE: cd back to project root BEFORE merge sequence; never merge from inside a worktree. gate-73b29b8 dir deregistered but deletion pinned by transient handle — retry at wave close. NEVER touch AppData spt.exe processes (live infra).
- 🛑 **COUNTER 63 HELD (doyle 2026-07-17) — REAL WAVE BUG post-merge, todlando self-caught via main CI red on 0c70253:** Amendment fix 3's outside-mutex replay enqueue lost the replay-then-live ORDERING — concurrent producer append() interleaves a live frame mid-replay → seq gap (got 134 want 6) → brain strict gap check kills the serve. xfer push_survives red was THE BUG all along (NOT starvation — todlando's earlier disposition + my acceptance both corrected); deployah's kitsubito resume red on PR #19 = SUSPECT-KIN (re-attach + concurrent producer window), my flake-likely adjudication WITHDRAWN. Windows-timing-dependent (Linux green).
- ⏳ FIX IN FLIGHT (PR lane, branch fix/redispatch-stall-w1-replay-order): replay snapshot handed to SubscriberSeat::install UNDER the mutex (memory move, no I/O), WRITER THREAD drains replay before live queue = ordering by construction; caller enqueue loop deleted; halt/overflow/lease semantics unchanged. GATE ADDS pre-announced: interleave unit red-on-revert vs 0c70253; xfer push_survives BINDING + repeat-run N≈10; resume suite repeat-run (kin check — if still red post-fix, own item, don't force-fit); T1/T3/T4 green. Then NEW release base → deployah GO (PR #19 stays open, retargets).
- **GATE LESSON (doyle, logged):** flake-disposition of a test INSIDE the wave's changed seam requires MECHANISM or repeat-proof — 'green isolated' alone is insufficient (xfer = stream re-serve seam = this wave's seam; the race needed a concurrent producer beat, so isolation was exactly the condition that hid it). Generalizes [[gate-clean-target-not-incremental]] + the v0.30.5 incident-box lesson.
- ⚠ **PR #20 ROUND 1 (doyle 2026-07-17, issuecomment-4998943855): fix shape ACCEPTED (writer-drains-replay-first structural, deterministic pin-gate interleave unit, enqueue_blocking deleted), ONE must-fix:** T4 rider's lease shared across HEALTHY displacement — renewal gated on is_canceled(), so at brain-swap the displaced writer + successor share the Arc; old writer's dying-conn failure cancels the SUCCESSOR's lease → spurious serve-kill + breaker trip per stream on the post-refresh path (KH 7.43's own manufacture-victims words). Fix: FRESH lease Arc at every seat install; unit = displacement + old-writer failure → successor lease alive; T4 stays green. LANE: PR #20 carries deployah's b677030 bump (branch cut from release branch) → after fix, #20 merges as THE release PR (v0.30.3 precedent), #19 closes unmerged; deployah told, aligned.
- ✅ **PR #20 GATE CLOSED + MERGED @fa3e474 (doyle 2026-07-17); PR #19 closed superseded; deployah GO SENT for counter 63 base fa3e474.** Round-1 fix @f4727cd verified: FRESH lease Arc at EVERY install (mint subsumes T5 renewal, conditional deleted; superseded writer — poisoned OR displaced — cancels only its own generation by construction) + displacement unit verbatim. CI green both runners; heavy leg isolated worktree: clippy 0, traceable 0, units 687/687, heavy ints 59/59, **xfer push_survives ×10/10** (1/10 red on broken shape = red-on-revert), **resume ×5/5** (kitsubito kin CLEARED — same race, one mechanism killed both prior reds). Two post-merge bugs total this wave (replay interleave + displacement lease sharing), both caught pre-release; hold system worked. Gate worktrees gate-73b29b8 + gate-f4727cd deregistered but dirs handle-pinned (inert skeletons) — sweep next session.
- ⏳ PENDING: deployah publish confirm (v0.36.0 counter 63) → hertz field-verify GO (discriminators: 15,000-15,154ms CONN_WRITE_POISONED fingerprint gone; stream-sub-attach/gen → O(active streams); DISPATCH_EV endpoint key binds stream→endpoint; next steal catch = stolen row finished+retired flags) → close milestone on hertz pass. Next-ranked after: DAEMON-LIFECYCLE cluster.

**Binding gate legs:** D1/D1b green EVERY leg; T7 mixed-image = REAL traffic-carrying streams; HEAVY at birth ×3 strings; fix 4 coordinates with DAEMON-LIFECYCLE C2 leases (build once).

**Out of scope:** update --restart 30s rc loop (distinct+bounded); DAEMON-LIFECYCLE C1/C3; deeper Whole-brain read reshaping beyond fixes 3/4.

**Parallel lane:** MESH-RECOVERY close-out still open — deployah counter-62 publish ping expected, then hertz MESH field-verify GO (triple in [[mesh-recovery-progress]]).

**✅ MILESTONE CLOSED 2026-07-17 — hertz field-verify PASS 4/4 on v0.36 counter 63 (both incident nodes), doyle-adjudicated same day:**
1. Poison census: 0 CONN_WRITE_POISONED / 0 poisoned-close / 0 timed-out-close across cold gen + refresh gen (both brain-cycle paths exercised: update --restart AND daemon refresh) vs 33-at-~15,000ms v0.34 baseline. Fingerprint DEAD.
2. Attach census: refresh gen first-second = exactly 5 stream-sub-attach = the live set (4 controllers + 1 held viewer), each session+endpoint-bound, vs ~4361/gen baseline. O(active) proven.
3. Identity binding: DISPATCH_EV key set focused-test-proven on the tag tree; NATURAL-failure production sampling absent (healthy window) — qualification ACCEPTED AS FILED (refusing to manufacture a production stall = correct; verification must not create the incident class it verifies). PASSIVE RESIDUAL (hertz, no deadline): first natural v0.36 worker failure → one-liner confirm endpoint key present.
4. Post-refresh calm (headline): 0.63s refresh, held viewer PTY alive+producing across the swap (6,620→18,764 bytes, auto-reattach gen-1 stream 36), all 5 pre-existing PTYs unfrozen, zero breaker trips, stall_evict 0. The original 4/5-endpoints-frozen-per-cycle symptom is DEAD on the incident boxes.

Artifacts: v0.34 baseline snapshot keep INDEFINITELY (canonical before); v036-webbie-rc-refresh.typescript until next milestone. Hertz watcher → passive.
Next-ranked: DAEMON-LIFECYCLE cluster (3-report hertz set: A rest-normalize + B spawn-fresh + C1-C3 emphasys triple; C2 leases COORDINATE w/ this wave's StreamLease/NetHost::stream_lease — built to be consumed). Awaiting operator call.