you must /send to doyle


Full file mapped. All 6 doyle line numbers confirmed exact (73ff016 = my branch):
- `:574` + `:1875` drivers (identical lines → replace_all)
- `:633` + `:1932` attachers (identical lines, but need different eprintln prefixes JRNL_/PASTE_ → target separately)
- `:1516` viewer (`controller_by_of`)
- `:1912` keystroke op

W2 helpers `:912/:951/:1081` use same 2s pump-connect but NOT in doyle's explicit 6-site list — leaving them, flagging to doyle. Making edits.


Edit

fn attach_gate_watchdog() -> Duration {
    match std::env::var("SPT_ATTACH_GATE_WATCHDOG_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(30)),
        Err(_) => Duration::from_secs(30),
    }
}

fn attach_gate_watchdog() -> Duration {
    match std::env::var("SPT_ATTACH_GATE_WATCHDOG_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(30)),
        Err(_) => Duration::from_secs(30),
    }
}

/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect
/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke
/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`
/// inside the deadline and the `subscribed` assert catches it. CI exports
/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,
/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO
/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's
/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is
/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight
/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob
/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /
/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it
/// never relaxes the `subscribed` / `got_output` assertions.
fn attach_connect_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}


The file C:/Users/decid/Documents/projects/spt-core-delivery/crates/spt-daemon/tests/inject_control_wedge.rs has been updated successfully. (file state is current in your context — no need to Read it back)

fn attach_gate_watchdog() -> Duration {
    match std::env::var("SPT_ATTACH_GATE_WATCHDOG_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(30)),
        Err(_) => Duration::from_secs(30),
    }
}

/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect
/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke
/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`
/// inside the deadline and the `subscribed` assert catches it. CI exports
/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,
/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO
/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's
/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is
/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight
/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob
/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /
/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it
/// never relaxes the `subscribed` / `got_output` assertions.
fn attach_connect_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}

+/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect

+/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke

+/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`

+/// inside the deadline and the `subscribed` assert catches it. CI exports

+/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,

+/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO

+/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's

+/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is

+/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight

+/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob

+/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /

+/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it

+/// never relaxes the `subscribed` / `got_output` assertions.

+fn attach_connect_deadline() -> Duration {

+    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {

+            .map(Duration::from_millis)

+            .unwrap_or(Duration::from_secs(2)),

+        Err(_) => Duration::from_secs(2),

let _ = std::process::Command::new("taskkill")


let mut w = match Brain::cold_start_pump(&driver_name, 1, Duration::from_secs(2)) {

let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_connect_deadline()) {


The file C:/Users/decid/Documents/projects/spt-core-delivery/crates/spt-daemon/tests/inject_control_wedge.rs has been updated. All occurrences were successfully replaced. (file state is current in your context — no need to Read it back)

// deadlock send_effect on a plain Whole conn (observed: it stalled after a

// few ops). The pump keeps the driver's socket healthy so it can keep a

// journaled write in-flight without ever wedging the CLIENT.

-        let mut w = match Brain::cold_start_pump(&driver_name, 1, Duration::from_secs(2)) {

+        let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_connect_deadline()) {

let driver_pumped = Arc::clone(&pumped);


Now viewer `:1516` and keystroke `:1912`:


    let mut b = Brain::cold_start_pump(name, 1, Duration::from_secs(2)).ok()?;
    let reply = b.sessions().ok()?;

    let mut b = Brain::cold_start_pump(name, 1, attach_connect_deadline()).ok()?;
    let reply = b.sessions().ok()?;


    let mut b = Brain::cold_start_pump(name, 1, Duration::from_secs(2)).ok()?;
    let reply = b.sessions().ok()?;

    let mut b = Brain::cold_start_pump(name, 1, attach_connect_deadline()).ok()?;
    let reply = b.sessions().ok()?;

/// reconcile self-heal consumes EXACTLY this read, so this is the field-under-test

/// observed through the real reply path.

fn controller_by_of(name: &str, sid: u64) -> Option<Option<String>> {

-    let mut b = Brain::cold_start_pump(name, 1, Duration::from_secs(2)).ok()?;

+    let mut b = Brain::cold_start_pump(name, 1, attach_connect_deadline()).ok()?;


        let mut op = match Brain::cold_start_pump(&name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => Brain::cold_start(&name, 1).expect("operator connect"),
        };

        let mut op = match Brain::cold_start_pump(&name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => Brain::cold_start(&name, 1).expect("operator connect"),
        };


        let mut op = match Brain::cold_start_pump(&name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => Brain::cold_start(&name, 1).expect("operator connect"),
        };

        let mut op = match Brain::cold_start_pump(&name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => Brain::cold_start(&name, 1).expect("operator connect"),
        };

//    path ACCEPTS + returns, never blocks). Pre-fix this wedged on the parked

-        let mut op = match Brain::cold_start_pump(&name, 1, Duration::from_secs(2)) {

+        let mut op = match Brain::cold_start_pump(&name, 1, attach_connect_deadline()) {


Now the two attachers `:633` (JRNL_FLAKE) and `:1932` (PASTE_FLAKE) — helper + connect_t0 + eprintln attribution:


        // mode makes the slices real, so the gate reports the TRUE signal.
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // mode makes the slices real, so the gate reports the TRUE signal.
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): on a serialized shared-box run this connect
                // timed out at ~2.0s (source=channel) — print the elapsed so the next
                // triage reads the connect-timeout directly instead of reverse-engineering
                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {


        // mode makes the slices real, so the gate reports the TRUE signal.
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // mode makes the slices real, so the gate reports the TRUE signal.
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): on a serialized shared-box run this connect
                // timed out at ~2.0s (source=channel) — print the elapsed so the next
                // triage reads the connect-timeout directly instead of reverse-engineering
                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

// ARTIFACT, not a subscribe failure (the broker registers the subscribe fast,

// lock-free; gdb showed the attacher parked PAST net_stream_subscribe). Pump

-        let mut operator = match Brain::cold_start_pump(&attach_name, 1, Duration::from_secs(2)) {

+        let connect_t0 = Instant::now();

+        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {

+                // CHEAP attribution (doyle): on a serialized shared-box run this connect

+                // timed out at ~2.0s (source=channel) — print the elapsed so the next

+                // triage reads the connect-timeout directly instead of reverse-engineering

+                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.

+                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \

+                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",

+                    connect_t0.elapsed()


        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s
                // (source=channel) on the serialized shared-box rerun — print the elapsed
                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.
                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {


        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, Duration::from_secs(2)) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s
                // (source=channel) on the serialized shared-box rerun — print the elapsed
                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.
                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

// forever when no NetStreamData lands) — making `subscribed=false` a

// measurement artifact rather than a real subscribe failure. Pump honors the

+                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s

+                // (source=channel) on the serialized shared-box rerun — print the elapsed

+                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.

+                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.

+                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \


Code edits done. Verify the swaps + find CI watchdog export site.


109:fn attach_connect_deadline() -> Duration {
597:        let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_connect_deadline()) {
657:        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
945:    let mut viewer = match Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {
984:    let mut op = match Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {
1114:            if let Ok(c) = Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {
1549:    let mut b = Brain::cold_start_pump(name, 1, attach_connect_deadline()).ok()?;
1908:        let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_connect_deadline()) {
1945:        let mut op = match Brain::cold_start_pump(&name, 1, attach_connect_deadline()) {
1966:        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {


C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-37-      # noise). A real paste-wedge blocks FOREVER and still trips this, so the headroom
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-38-      # drops only starvation noise, never wedge detection; local keeps the tight 30s
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-39-      # default. Mirrors the SPT_REGISTRY_BUSY_TIMEOUT_MS env-knob precedent.
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml:40:      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-41-    # A wedged test must not block the single self-hosted runner slot (the
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-42-    # 2026-06-03 handoff.rs ConPTY stall burned 22 hosted minutes unbounded).
C:\Users\decid\Documents\projects\spt-core-delivery\.github\workflows\ci.yml-43-    # 50 (was 25): the slow Linux runner (kitsubito) needs more than 25min for a


6 sites converted (597, 657, 1549, 1908, 1945, 1966); 3 W2 helpers (945/984/1114) intentionally untouched. Now CI env block:


28	      matrix:
29	        runner: [[self-hosted, Linux, kitsubito], [self-hosted, Windows, hfenduleam]]
30	    runs-on: ${{ matrix.runner }}
31	    env:
32	      # Concurrent-attach gate watchdog headroom (a_journaled / p0_paste). Those
33	      # gates' SOLE elastic bound is request_attach's journaled net_open_stream ack,
34	      # which under cross-run scheduler starvation on the shared self-hosted boxes can
35	      # exceed the 30s LOCAL default WITHOUT a product wedge (serviced-but-late; the
36	      # ack is <=3.8s even under pegged CPU — the 30–120s band is pure starvation
37	      # noise). A real paste-wedge blocks FOREVER and still trips this, so the headroom
38	      # drops only starvation noise, never wedge detection; local keeps the tight 30s
39	      # default. Mirrors the SPT_REGISTRY_BUSY_TIMEOUT_MS env-knob precedent.
40	      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
41	    # A wedged test must not block the single self-hosted runner slot (the
42	    # 2026-06-03 handoff.rs ConPTY stall burned 22 hosted minutes unbounded).
43	    # 50 (was 25): the slow Linux runner (kitsubito) needs more than 25min for a
44	    # full build + the whole suite (the int tests carry fixed wall-clock sleeps);
45	    # a version-bump full rebuild pushed v0.7.0 over. The real fix is the build
46	    # speedup (mold/nextest — ci-kitsubito-speedup-plan); this keeps the wedge
47	    # guard generous, not unbounded.

      matrix:
        runner: [[self-hosted, Linux, kitsubito], [self-hosted, Windows, hfenduleam]]
    runs-on: ${{ matrix.runner }}
    env:
      # Concurrent-attach gate watchdog headroom (a_journaled / p0_paste). Those
      # gates' SOLE elastic bound is request_attach's journaled net_open_stream ack,
      # which under cross-run scheduler starvation on the shared self-hosted boxes can
      # exceed the 30s LOCAL default WITHOUT a product wedge (serviced-but-late; the
      # ack is <=3.8s even under pegged CPU — the 30–120s band is pure starvation
      # noise). A real paste-wedge blocks FOREVER and still trips this, so the headroom
      # drops only starvation noise, never wedge detection; local keeps the tight 30s
      # default. Mirrors the SPT_REGISTRY_BUSY_TIMEOUT_MS env-knob precedent.
      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
    # A wedged test must not block the single self-hosted runner slot (the
    # 2026-06-03 handoff.rs ConPTY stall burned 22 hosted minutes unbounded).
    # 50 (was 25): the slow Linux runner (kitsubito) needs more than 25min for a
    # full build + the whole suite (the int tests carry fixed wall-clock sleeps);
    # a version-bump full rebuild pushed v0.7.0 over. The real fix is the build
    # speedup (mold/nextest — ci-kitsubito-speedup-plan); this keeps the wedge
    # guard generous, not unbounded.


      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
    # A wedged test must not block the single self-hosted runner slot (the

      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,
      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's
      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;
      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED
      # connect past 2s with NO product wedge, and the attacher then bails (false,false)
      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:
      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the
      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and
      # still trips this; local keeps the tight 2s default. Same env-knob precedent.
      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"
    # A wedged test must not block the single self-hosted runner slot (the


The file C:/Users/decid/Documents/projects/spt-core-delivery/.github/workflows/ci.yml has been updated successfully. (file state is current in your context — no need to Read it back)

      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
    # A wedged test must not block the single self-hosted runner slot (the

      SPT_ATTACH_GATE_WATCHDOG_MS: "120000"
      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,
      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's
      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;
      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED
      # connect past 2s with NO product wedge, and the attacher then bails (false,false)
      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:
      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the
      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and
      # still trips this; local keeps the tight 2s default. Same env-knob precedent.
      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"
    # A wedged test must not block the single self-hosted runner slot (the

# drops only starvation noise, never wedge detection; local keeps the tight 30s

# default. Mirrors the SPT_REGISTRY_BUSY_TIMEOUT_MS env-knob precedent.

+      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,

+      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's

+      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;

+      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED

+      # connect past 2s with NO product wedge, and the attacher then bails (false,false)

+      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:

+      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the

+      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and

+      # still trips this; local keeps the tight 2s default. Same env-knob precedent.

+      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"

# 2026-06-03 handoff.rs ConPTY stall burned 22 hosted minutes unbounded).

# 50 (was 25): the slow Linux runner (kitsubito) needs more than 25min for a


All edits complete: helper + 6 sites + 2 attacher eprintlns + CI export. Now doyle's step-7 verification. clippy first (long build → background):


Bash

cd /c/Users/decid/Documents/projects/spt-core-delivery && cargo clippy -p spt-daemon --all-targets -- -D warnings 2>&1 | tail -40

clippy spt-daemon all-targets -D warnings


Command running in background with ID: b2bqsgo33. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b2bqsgo33.output. You will be notified when it completes. To check interim output, use Read on that file path.


cd /c/Users/decid/Documents/projects/spt-core-delivery && cargo nextest --version 2>&1 | head -2; echo "exit=$?"

Check nextest availability


cargo-nextest 0.9.137 (75ddba7e9 2026-05-26)
release: 0.9.137
exit=0
Shell cwd was reset to C:\Users\decid\Documents\projects\spt-core


nextest 0.9.137 present. Waiting on clippy before the two verification passes (=1 fail-fast-with-print, default pass).


<system-reminder>Warning: the file exists but is shorter than the provided offset (1). The file has 1 lines.</system-reminder>


clippy compiling (cold build, several min on Windows). Will continue when it completes — background notify.

Status so far:
- ✅ Helper `attach_connect_deadline()` added (model: `attach_gate_watchdog`)
- ✅ 6 result-gating connects wired (drivers 597/1908, attachers 657/1966, viewer 1549, keystroke 1945)
- ✅ Both attacher connect-Err paths: `JRNL_FLAKE`/`PASTE_FLAKE: operator connect TIMED OUT after {elapsed}` eprintln
- ✅ CI: `SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"` beside watchdog
- ⏳ clippy running → then `=1` fail-fast-with-print + default pass → commit → push → ping doyle

W2 helpers (945/984/1114) same 2s class but outside doyle's explicit 6 — left as-is, will flag.


<task-notification>
<task-id>b2bqsgo33</task-id>
<tool-use-id>toolu_01R6ri1JjwE1jtvWsDWU91nd</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b2bqsgo33.output</output-file>
<status>completed</status>
<summary>Background command "clippy spt-daemon all-targets -D warnings" completed (exit code 0)</summary>
</task-notification>


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


clippy exit 0. Verify tail, then run wiring check.


Tail clippy output


    Checking spt-live v0.12.1 (C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-live)
    Checking hyper-rustls v0.27.9
    Checking igd-next v0.17.1
    Checking reqwest v0.13.4
    Checking portmapper v0.16.0
    Checking spt-net v0.12.1 (C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-net)
    Checking spt-daemon v0.12.1 (C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 36.27s


Clean. Now wiring check: `SPT_ATTACH_CONNECT_DEADLINE_MS=1` → both tests must fail fast WITH connect-timeout print.


cd /c/Users/decid/Documents/projects/spt-core-delivery && SPT_ATTACH_CONNECT_DEADLINE_MS=1 cargo nextest run --test inject_control_wedge --no-capture p0_paste_wedge a_journaled_input_wedge 2>&1 | grep -iE "FLAKE: operator connect|FAIL|PASS|subscribed|SUMMARY|Starting|Summary|error\[" | head -40

Wiring verify: deadline=1ms fails fast with print


Command running in background with ID: b3ye2nhzr. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b3ye2nhzr.output. You will be notified when it completes. To check interim output, use Read on that file path.


Awaiting wiring-check result (=1ms). Will run default-pass next.


<task-notification>
<task-id>b3ye2nhzr</task-id>
<tool-use-id>toolu_01D4LEUmFingZvGuiGHzCmgD</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b3ye2nhzr.output</output-file>
<status>completed</status>
<summary>Background command "Wiring verify: deadline=1ms fails fast with print" completed (exit code 0)</summary>
</task-notification>


1	    Starting 2 tests across 1 binary (8 tests skipped)
2	=== W1b JOURNAL-WEDGE GATE: journaled_ops_pumped=2833 concurrent_attach_subscribed=false attach_received_pty_output=false (fixed = both true; pre-fix on Unix: subscribed=false — attach wedged on the held journal lock) ===
3	test a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach ... FAILED
4	failures:
5	failures:
6	test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 9 filtered out; finished in 2.98s
7	        FAIL [   3.004s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
8	  Cancelling due to test failure:
9	     Summary [   3.004s] 1/2 tests run: 0 passed, 1 failed, 8 skipped
10	        FAIL [   3.004s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
11	warning: 1/2 tests were not run due to test failure (run with --no-fail-fast to run all tests, or run with --max-fail)
12	error: test run failed
13

    Starting 2 tests across 1 binary (8 tests skipped)
=== W1b JOURNAL-WEDGE GATE: journaled_ops_pumped=2833 concurrent_attach_subscribed=false attach_received_pty_output=false (fixed = both true; pre-fix on Unix: subscribed=false — attach wedged on the held journal lock) ===
test a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach ... FAILED
failures:
failures:
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 9 filtered out; finished in 2.98s
        FAIL [   3.004s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
  Cancelling due to test failure:
     Summary [   3.004s] 1/2 tests run: 0 passed, 1 failed, 8 skipped
        FAIL [   3.004s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
warning: 1/2 tests were not run due to test failure (run with --no-fail-fast to run all tests, or run with --max-fail)
error: test run failed


Unexpected: at 1ms the driver still pumped 2833 ops (connected) and NO connect-timeout print fired — `subscribed=false` came from a *later* failure, not the connect-Err path. Need to verify what `cold_start_pump`'s Duration actually bounds. Read full output + the impl.


C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs:285:    pub fn cold_start(name: &str, now_ms: u64) -> io::Result<Self> {
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-286-        let mut conn = LocalSocketTransport::connect(name)?;
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-287-        send_hello(&mut conn, Role::Brain)?;
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-288-        Ok(Brain {
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-289-            conn: BrainConn::Whole(conn),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-290-            generation: 0,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-291-            gen_start_ms: now_ms,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-292-            session_id: None,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-293-            next_seq: 0,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-294-            net_cursors: std::collections::HashMap::new(),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-295-            presence_cursor: None,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-296-            session_cursors: std::collections::HashMap::new(),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-297-            io_timeout: None,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-298-        })
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-299-    }
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-300-
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-301-    /// Cold start in **PUMP mode**: connect, handshake, then SPLIT the stream
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-302-    /// into the reader-thread carrier ([`BrainConn::Split`]) and arm a per-IPC-
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-303-    /// call deadline of `io_timeout`. This is the peer pump's dedicated client —
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-304-    /// every reply read is bounded ([`Brain::read_event_until`] via
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-305-    /// [`Brain::call_deadline`]) so a black-holed peer can never wedge the
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-306-    /// single-threaded pump. The split is done at CONSTRUCTION (not flipped on a
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-307-    /// live `Whole` after the fact — moving the `Stream` out by value to split it
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-308-    /// is impossible behind `&mut self`), so a pump brain is split-and-bounded
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-309-    /// for its whole life and a non-pump brain never pays the reader thread.
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-310-    // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs:311:    pub fn cold_start_pump(name: &str, now_ms: u64, io_timeout: Duration) -> io::Result<Self> {
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-312-        let mut stream = LocalSocketTransport::connect(name)?;
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-313-        send_hello(&mut stream, Role::Brain)?;
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-314-        Ok(Brain {
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-315-            conn: BrainConn::split_with_reader(stream),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-316-            generation: 0,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-317-            gen_start_ms: now_ms,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-318-            session_id: None,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-319-            next_seq: 0,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-320-            net_cursors: std::collections::HashMap::new(),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-321-            presence_cursor: None,
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-322-            session_cursors: std::collections::HashMap::new(),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-323-            io_timeout: Some(io_timeout),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-324-        })
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-325-    }
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-326-
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-327-    /// Handoff: connect, handshake, rehydrate the resume cursor + generation
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-328-    /// from `prior`, but stamp `gen_start = now()` (NOT `prior.gen_start_ms` —
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-329-    /// the 2.4 invariant), and re-subscribe to the session from the cursor for a
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-330-    /// gapless resume.
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-331-    ///
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-332-    /// The eager `subscribe` IS the resume mechanism — every standalone handoff
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-333-    /// caller (the brain-only update engine, `idempotent`/`daemon_e2e`/`handoff`
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-334-    /// integration tests) replays output through it with no later `attach`. So it
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-335-    /// stays. The P1c controller-writer reorder (a `serve_attach` re-serve that
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-336-    /// ALSO subscribes from 0 over this same socket → two racing
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-337-    /// `controller_writer`s) is fixed in the BROKER, not by dropping this
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-338-    /// subscribe: the epoch gate ([`OutputLog::become_controller`]) guarantees a
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-339-    /// single live writer per connection, and the seeded `session_cursors` below
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-340-    /// routes the consumer through the dedup-below + snap-above path so any
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-341-    /// at-least-once boundary re-send is tolerated, never a fatal reject-gap
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-342-    /// ([`REQ-HAZARD-CONTROLLER-WRITER-REORDER`]).
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-343-    ///
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-344-    /// **Test-only (restoration D4-3).** The production resume path is
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-345-    /// [`Brain::cold_start`] + [`Brain::resume_sessions`] (broker cursor-of-record),
C:\Users\decid\Documents\projects\spt-core-delivery\crates\spt-daemon\src\brain.rs-346-    /// never this brain→brain frame; `handoff` survives only for the integration


Critical finding. `cold_start_pump` (brain.rs:311-325): the `Duration` arg is **`io_timeout`** — the per-IPC-**call read deadline** (`call_deadline`/`read_event_until`). The actual socket `connect` (line 312) is **unbounded**. doyle's "corrected root" (connect timed out, first op, no fallback) is *also* a misread — cold_start_pump never times out at 2s; it Errs only on a real socket failure.

The =1 run confirms it: `subscribed=false`, FAILED in 3s, but **no** "operator connect TIMED OUT" print → the connect didn't Err; a *bounded read* did. The real flake = `net_stream_subscribe`'s ack read hitting the 2s `io_timeout` under load. Let me verify the read-bound path before going back to doyle.


Grep

fn net_stream_subscribe|fn call_deadline|fn read_event_until|io_timeout


278:    io_timeout: Option<Duration>,
279-}
280-
281-impl Brain {
282-    \ Cold start: connect, handshake, fresh generation 0, `gen_start = now`.
283-    \ The ordinary blocking carrier ([`BrainConn::Whole`]) — every client
284-    \ except the peer pump, which uses [`Brain::cold_start_pump`].
285-    pub fn cold_start(name: &str, now_ms: u64) -> io::Result<Self> {
286-        let mut conn = LocalSocketTransport::connect(name)?;
287-        send_hello(&mut conn, Role::Brain)?;
288-        Ok(Brain {
289-            conn: BrainConn::Whole(conn),
290-            generation: 0,
291-            gen_start_ms: now_ms,
292-            session_id: None,
--
297:            io_timeout: None,
298-        })
299-    }
300-
301-    \ Cold start in **PUMP mode**: connect, handshake, then SPLIT the stream
302-    \ into the reader-thread carrier ([`BrainConn::Split`]) and arm a per-IPC-
303:    /// call deadline of `io_timeout`. This is the peer pump's dedicated client —
304-    \ every reply read is bounded ([`Brain::read_event_until`] via
305-    \ [`Brain::call_deadline`]) so a black-holed peer can never wedge the
306-    /// single-threaded pump. The split is done at CONSTRUCTION (not flipped on a
307-    /// live `Whole` after the fact — moving the `Stream` out by value to split it
308-    /// is impossible behind `&mut self`), so a pump brain is split-and-bounded
309-    /// for its whole life and a non-pump brain never pays the reader thread.
310-    // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]
311:    pub fn cold_start_pump(name: &str, now_ms: u64, io_timeout: Duration) -> io::Result<Self> {
312-        let mut stream = LocalSocketTransport::connect(name)?;
313-        send_hello(&mut stream, Role::Brain)?;
314-        Ok(Brain {
315-            conn: BrainConn::split_with_reader(stream),
316-            generation: 0,
317-            gen_start_ms: now_ms,
318-            session_id: None,
319-            next_seq: 0,
320-            net_cursors: std::collections::HashMap::new(),
321-            presence_cursor: None,
322-            session_cursors: std::collections::HashMap::new(),
323:            io_timeout: Some(io_timeout),
324-        })
325-    }
326-
327-    \ Handoff: connect, handshake, rehydrate the resume cursor + generation
328-    /// from `prior`, but stamp `gen_start = now()` (NOT `prior.gen_start_ms` —
329-    /// the 2.4 invariant), and re-subscribe to the session from the cursor for a
330-    /// gapless resume.
331-    ///
332-    /// The eager `subscribe` IS the resume mechanism — every standalone handoff
333-    /// caller (the brain-only update engine, `idempotent`/`daemon_e2e`/`handoff`
334-    /// integration tests) replays output through it with no later `attach`. So it
335-    /// stays. The P1c controller-writer reorder (a `serve_attach` re-serve that
336-    /// ALSO subscribes from 0 over this same socket → two racing
337-    /// `controller_writer`s) is fixed in the BROKER, not by dropping this
--
367:            io_timeout: None,
368-        };
369-        brain.subscribe(prior.session_id, prior.next_seq)?;
370-        Ok(brain)
371-    }
372-
373-    /// The wall-clock generation start (epoch ms) — always this generation's own
374-    /// start time, never a rehydrated value.
375-    pub fn gen_start_ms(&self) -> u64 {
376-        self.gen_start_ms
377-    }
378-
379-    /// The generation counter (0 on cold start, +1 per handoff).
380-    pub fn generation(&self) -> u64 {
381-        self.generation
--
564:    /// The deadline for ONE IPC call: `now + io_timeout`, computed at call
565-    /// entry (a whole `loop { read_event }` shares it, so unrelated events
566-    /// dripping in cannot reset it — the total-wait bound). `None` when not in
567-    /// pump mode (blocking, unbounded).
568-    // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]
569:    pub fn call_deadline(&self) -> Option<Instant> {
570:        self.io_timeout.map(|d| Instant::now() + d)
571-    }
572-
573-    pub fn read_event(&mut self) -> io::Result<BrokerEvent> {
574-        self.read_event_until(None)
575-    }
576-
577-    \ Like [`Brain::read_event`] but each frame read is bounded by an optional
578-    /// wall-clock `deadline` (pump mode passes one; everyone else passes
579-    /// `None`). A frame that does not arrive before `deadline` surfaces
580-    \ [`io::ErrorKind::TimedOut`] — the pump escalates that to a SUPERVISED
581-    /// RESTART (a timed-out IPC read may have desynced the stream; the client
582-    /// is poisoned, never retried per-peer).
583-    // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]
584:    pub fn read_event_until(&mut self, deadline: Option<Instant>) -> io::Result<BrokerEvent> {
585-        loop {
586-            let env = self.read_frame_until(deadline)?;
587-            match env.kind.as_str() {
588-                KIND_OUTPUT => {
589-                    let ev: OutputEvent = serde_json::from_value(env.payload)
590-                        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
591-                    // A **resume-mode** brain (the per-session map is populated by
592-                    // `resume_sessions`) routes EVERY session through the map —
593-                    // including a freshly-spawned or first-seen one, which seeds
594-                    // itself at its first `seq` via `entry().or_insert` (D4-2b,
595-                    \ doyle amendment 5: this closes the mixed-mode gap where N≥2
596-                    // fresh spawns would otherwise share the single `next_seq` and
597-                    // silently drop the later sessions' seq-0 output). The broker's
598-                    // `Mutex<OutputLog>`-held wire order guarantees first-sight of a
--
1200:    pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {
1201-        self.net_cursors.insert(stream_id, from_seq);
1202-        self.send(
1203-            KIND_NET_STREAM_SUBSCRIBE,
1204-            serde_json::to_value(NetStreamSubscribeReq {
1205-                stream_id,
1206-                from_seq,
1207-            })
1208-            .expect("NetStreamSubscribeReq serializes"),
1209-        )
1210-    }
1211-
1212-    /// The next stream-read sequence still needed for `stream_id` (the durable
1213-    /// state a handed-off brain carries to resubscribe gaplessly).
1214-    pub fn net_cursor(&self, stream_id: u64) -> Option<u64> {
--
1311:    ///   `io_timeout`, so callers always pass `None` here).
1312-    \ - [`BrainConn::Split`] — the pump carrier: the reader thread already owns
1313-    \   the blocking read, so a bounded read is just [`Receiver::recv_timeout`]
1314-    \   on the remaining budget. A `Timeout` surfaces [`io::ErrorKind::TimedOut`]
1315-    ///   — the poison signal the pump escalates to a supervised restart (NEVER a
1316-    ///   per-peer retry). A `Disconnected` channel means the reader thread exited
1317-    ///   (the conn hung up); surface it as `UnexpectedEof`.
1318-    // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]
1319-    fn read_frame_until(&mut self, deadline: Option<Instant>) -> io::Result<Envelope> {
1320-        match &mut self.conn {
1321-            BrainConn::Whole(stream) => read_frame(stream),
1322-            BrainConn::Split { frames, .. } => match deadline {
1323-                Some(dl) => {
1324-                    \ Total-wait bound: each recv is the REMAINING budget to the
1325-                    // call's entry deadline, so unrelated frames dripping in


`net_stream_subscribe` (:1200) is **fire-and-forget send** (no ack read) — and `call_deadline = now + io_timeout` (:569) bounds every *read*. So the `(false,false)` at 2.016s isn't connect and isn't subscribe — it's an io_timeout-bounded **read** in an earlier op. doyle's "elastic bound" is `request_attach`'s journaled `net_open_stream` ack. Confirm request_attach reads under call_deadline:


pub fn request_attach|call_deadline|read_event_until|fn net_dial_loopback


505:pub fn request_attach(
506-    brain: &mut Brain,
507-    conn_id: u64,
508-    session_id: u64,
509-    from_seq: u64,
510-    open_op: u64,
511-    intent: AttachIntent,


505	pub fn request_attach(
506	    brain: &mut Brain,
507	    conn_id: u64,
508	    session_id: u64,
509	    from_seq: u64,
510	    open_op: u64,
511	    intent: AttachIntent,
512	) -> io::Result<u64> {
513	    let opened = brain.net_open_stream(conn_id, Some(open_op))?;
514	    let line = ndjson::encode_line(&AttachRecord::Request {
515	        session_id,
516	        from_seq,
517	        intent,
518	    });
519	    brain.net_stream_send(opened.stream_id, &line, None, false)?;
520	    Ok(opened.stream_id)
521	}
522
523	/// Operator-side (CONTROLLER): send a resize record onto an attach stream —
524	/// the controller's viewport size, forwarded into the target PTY (REQ-RCVIEW-1,
525	/// controller-exclusive: the broker rejects a resize from a viewer's stream).
526	/// Sent on attach (initial size) and on every window-change. Unjournaled (a
527	/// stale resize is harmless — the next one corrects it).
528	// [impl->REQ-RCVIEW-1]
529	pub fn send_attach_resize(
530	    brain: &mut Brain,
531	    stream_id: u64,
532	    rows: u16,
533	    cols: u16,
534	) -> io::Result<()> {
535	    let line = ndjson::encode_line(&AttachRecord::Resize { rows, cols });
536	    brain.net_stream_send(stream_id, &line, None, false)?;
537	    Ok(())
538	}
539
540	/// Operator-side: send one input record (the keystrokes) onto an attach
541	/// stream. `wire_op` is the operator-minted durable id the TARGET journals the
542	/// PTY write under — exactly-once at the keys, however often the record
543	/// crosses the wire. The send itself is unjournaled (see module docs).
544	// [impl->REQ-INST-8]
545	pub fn send_attach_input(
546	    brain: &mut Brain,
547	    stream_id: u64,
548	    bytes: &[u8],
549	    wire_op: u64,
550	) -> io::Result<()> {
551	    let line = ndjson::encode_line(&AttachRecord::Input {
552	        data_b64: encode_bytes(bytes),
553	        op_id: wire_op,
554	    });
555	    brain.net_stream_send(stream_id, &line, None, false)?;
556	    Ok(())
557	}
558

pub fn request_attach(
    brain: &mut Brain,
    conn_id: u64,
    session_id: u64,
    from_seq: u64,
    open_op: u64,
    intent: AttachIntent,
) -> io::Result<u64> {
    let opened = brain.net_open_stream(conn_id, Some(open_op))?;
    let line = ndjson::encode_line(&AttachRecord::Request {
        session_id,
        from_seq,
        intent,
    });
    brain.net_stream_send(opened.stream_id, &line, None, false)?;
    Ok(opened.stream_id)
}

/// Operator-side (CONTROLLER): send a resize record onto an attach stream —
/// the controller's viewport size, forwarded into the target PTY (REQ-RCVIEW-1,
/// controller-exclusive: the broker rejects a resize from a viewer's stream).
/// Sent on attach (initial size) and on every window-change. Unjournaled (a
/// stale resize is harmless — the next one corrects it).
// [impl->REQ-RCVIEW-1]
pub fn send_attach_resize(
    brain: &mut Brain,
    stream_id: u64,
    rows: u16,
    cols: u16,
) -> io::Result<()> {
    let line = ndjson::encode_line(&AttachRecord::Resize { rows, cols });
    brain.net_stream_send(stream_id, &line, None, false)?;
    Ok(())
}

/// Operator-side: send one input record (the keystrokes) onto an attach
/// stream. `wire_op` is the operator-minted durable id the TARGET journals the
/// PTY write under — exactly-once at the keys, however often the record
/// crosses the wire. The send itself is unjournaled (see module docs).
// [impl->REQ-INST-8]
pub fn send_attach_input(
    brain: &mut Brain,
    stream_id: u64,
    bytes: &[u8],
    wire_op: u64,
) -> io::Result<()> {
    let line = ndjson::encode_line(&AttachRecord::Input {
        data_b64: encode_bytes(bytes),
        op_id: wire_op,
    });
    brain.net_stream_send(stream_id, &line, None, false)?;
    Ok(())
}


`request_attach` (:513) → `brain.net_open_stream(conn_id, ...)?` — the journaled-ack op doyle himself named the "sole elastic bound." Confirm it reads the ack under `call_deadline`:


1056:    pub fn net_open_stream(
1057-        &mut self,
1058-        conn_id: u64,
1059-        op_id: Option<u64>,
1060-    ) -> io::Result<NetStreamOpened> {
1061-        self.send(
1062-            KIND_NET_STREAM_OPEN,
1063-            serde_json::to_value(NetStreamOpenReq { conn_id, op_id })
1064-                .expect("NetStreamOpenReq serializes"),
1065-        )?;
1066-        let deadline = self.call_deadline();
1067-        loop {
1068-            match self.read_event_until(deadline)? {
1069-                BrokerEvent::NetStreamOpened(ev) => return Ok(ev),
1070-                BrokerEvent::Error { message } => return Err(io::Error::other(message)),
1071-                _ => continue,
1072-            }
1073-        }
1074-    }
1075-
1076-    /// Write bytes to a held stream over the broker (D4b). With `op_id` the
1077-    /// write is exactly-once and this blocks for the `net-sent` ack (returned);
1078-    /// without one it is a direct fire-and-forget write (`None` returned).


Airtight: `net_open_stream` (:1066-1068) reads the `NetStreamOpened` ack in a loop bounded by `call_deadline` (= now + io_timeout). At 2s io_timeout, a load-starved journaled ack → `read_event_until` TimedOut → `request_attach` Err → attacher's request_attach arm sends `(false,false)`, source=channel, ~2.0s. **That's** the flake — not connect.

doyle's *fix* is right (env-tunable that Duration), but his root narrative, the knob name, and the print path are all wrong. Shipping that = misread #3. I must correct doyle before finalizing — he drives x3 and owns the spec. Reaching him (live agent → `$OWL send`):


Bash

echo "OWL=$OWL"; command -v "$OWL" 2>/dev/null; ls "$OWL" 2>/dev/null; echo "---which owl---"; command -v owl 2>/dev/null

Locate OWL binary


Error: Exit code 1
OWL=C:/Users/decid/.claude/plugins/cache/cplugs/spt/1.11.25/owl.exe
C:/Users/decid/.claude/plugins/cache/cplugs/spt/1.11.25/owl.exe
C:/Users/decid/.claude/plugins/cache/cplugs/spt/1.11.25/owl.exe
---which owl---


cat <<'EOF' | "$OWL" send doyle 2>&1
x3 finding BEFORE I finalize — your corrected root is still a misread; I won't ship a 3rd one without flagging. The FIX is right; the mechanism / knob-name / print-path are wrong. Evidence (73ff016):

1. cold_start_pump(name, now_ms, Duration): the Duration is `io_timeout` — the per-IPC-CALL READ deadline (brain.rs:311-323; :569 call_deadline = now+io_timeout). The socket connect (brain.rs:312 LocalSocketTransport::connect) is UNBOUNDED. cold_start_pump NEVER times out at 2s; it Errs only on a real socket failure. So "the attacher's connect timed out / FIRST op is cold_start_pump / no fallback" is not the mechanism.

2. What actually bites at 2.016s: request_attach (attach.rs:513) -> brain.net_open_stream -> reads the NetStreamOpened ack in a loop bounded by call_deadline (brain.rs:1066-1068). Under co-tenant load the journaled net_open_stream ack — YOUR named "sole elastic bound" — is starved past the 2s io_timeout -> read_event_until TimedOut -> net_open_stream Err -> request_attach Err -> the attacher's request_attach match arm sends (false,false). source=channel, ~2.0s, subscribed=false. Same elastic ack your WATCHDOG note names, just bitten 2s earlier by the per-CALL deadline before the 30s watchdog is ever reached. (net_stream_subscribe :1200 is fire-and-forget send, no ack read — can't be the false.)

3. PROOF: I ran SPT_ATTACH_CONNECT_DEADLINE_MS=1 over a_journaled+p0_paste — both FAIL fast (subscribed=false, 3.0s) but the connect-Err eprintln you specified NEVER printed. The connect didn't Err; request_attach's bounded ack read did. Your "operator connect TIMED OUT" print on the cold_start_pump Err arm will never fire for this flake.

Your FIX still works: env-tunable that Duration -> net_open_stream's ack gets 30s headroom; default 2s keeps local tight; a real wedge blocks forever and still trips. Already wired to all 6 sites + CI=30000, clippy clean. Before I push I want correct attribution, not misread #3. Proposed (your call, you drive x3):
  A. Rename SPT_ATTACH_CONNECT_DEADLINE_MS -> SPT_ATTACH_IPC_DEADLINE_MS, helper attach_connect_deadline() -> attach_ipc_deadline(). It's the pump per-IPC-call read deadline (io_timeout), not a connect.
  B. Relocate the attribution print from the cold_start_pump Err arm to the request_attach Err arm: "PASTE_FLAKE/JRNL_FLAKE: request_attach net_open_stream ack TIMED OUT after {elapsed} (io_timeout bound, source=channel)" — THAT path fires on the real flake.
Also FYI: 3 W2 helper connects (output_contains_within :912, observe_with_xon :951, spawn_xlate_session :1081) use the same 2s pump io_timeout but are outside your explicit 6-site list — left as-is; say if you want the helper there too.

Confirm A+B (or "keep my names") and I finalize + push for your gate-read. Not pushing until you rule.
EOF

Send root-cause correction to doyle


➜ SENT:doyle


SENT to doyle. Holding push until he rules on A (rename) + B (print relocation). Meanwhile, validate the core fix is sound regardless of naming — default-2s run must PASS (happy path intact):


cd /c/Users/decid/Documents/projects/spt-core-delivery && cargo nextest run --test inject_control_wedge p0_paste_wedge a_journaled_input_wedge 2>&1 | tail -20

Default-2s pass check (happy path intact)


Command running in background with ID: b0l135ljn. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b0l135ljn.output. You will be notified when it completes. To check interim output, use Read on that file path.


<task-notification>
<task-id>b0l135ljn</task-id>
<tool-use-id>toolu_014o5tvo5d1K543q3tQdDrzS</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\2730b458-50d2-48aa-b752-3ad22fefaa0b\tasks\b0l135ljn.output</output-file>
<status>completed</status>
<summary>Background command "Default-2s pass check (happy path intact)" completed (exit code 0)</summary>
</task-notification>


Default-2s pass running (background). Awaiting both: doyle's ruling on rename/print + the pass result.

**Where things stand:**

doyle reopened the v0.13.0 gate ×3 RED with a fix ruling. I implemented the mechanical fix (env-tunable connect/IPC deadline, 6 sites + CI export, clippy clean) — but verifying the wiring exposed that **doyle's corrected root is itself a misread**:

- The `Duration` arg to `cold_start_pump` is `io_timeout` (per-IPC-call *read* deadline), NOT a connect deadline. The socket connect is unbounded.
- The 2.016s flake = `request_attach` → `net_open_stream`'s journaled-ack read hitting the 2s `io_timeout` under co-tenant load. Confirmed at brain.rs:312/569/1066 + attach.rs:513.
- Proof: my `=1ms` run failed both tests fast with `subscribed=false` but the connect-Err print doyle specified **never fired** — because the connect didn't err; the bounded ack read did.

doyle's *fix* (raise that Duration) is correct, but the knob name (`CONNECT`), root narrative, and print path are wrong. Sent doyle the evidence + proposed accurate rename (`SPT_ATTACH_IPC_DEADLINE_MS`) + print relocation to the `request_attach` Err arm. **Not pushing until doyle rules** — he drives the ×3 and owns the gate spec. Shipping his ruling verbatim would be misread #3.


1	    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.50s
2	────────────
3	 Nextest run ID b1e1011d-7d05-4d17-a839-5ed10b37e33b with nextest profile: default
4	    Starting 2 tests across 1 binary (8 tests skipped)
5	        PASS [   3.015s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
6	        PASS [   3.032s] (2/2) spt-daemon::inject_control_wedge p0_paste_wedge_parked_write_does_not_starve_attach_or_wedge_broker
7	────────────
8	     Summary [   6.047s] 2 tests run: 2 passed, 8 skipped
9

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.50s
────────────
 Nextest run ID b1e1011d-7d05-4d17-a839-5ed10b37e33b with nextest profile: default
    Starting 2 tests across 1 binary (8 tests skipped)
        PASS [   3.015s] (1/2) spt-daemon::inject_control_wedge a_journaled_input_wedge_does_not_starve_a_concurrent_rc_attach
        PASS [   3.032s] (2/2) spt-daemon::inject_control_wedge p0_paste_wedge_parked_write_does_not_starve_attach_or_wedge_broker
────────────
     Summary [   6.047s] 2 tests run: 2 passed, 8 skipped


Default-2s: **both PASS** (3.0s each). Wiring evidence complete:
- `=1ms` → both FAIL fast (`subscribed=false`) — bounded read trips
- default 2s → both PASS — happy path intact, non-vacuous

Core fix sound regardless of naming. Now blocked on doyle's ruling (A rename + B print relocation). Holding push. Will apply his verdict, re-verify, commit with co-author trailer, push to delivery-control worktree, then ping for his ×3 gate-read.


<task-notification>
<task-id>bsp4y8a8u</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/8" id="49c515e4" type="msg" from="doyle">ACCEPTED — A + B both. Good catch; you prevented misread #3, and the empirical proof (DEADLINE_MS=1 fails but the cold_start_pump connect-Err print never fires) is exactly the right way to settle it. That's the executor behavior I want — refuse to ship a wrong attribution even when the fix is right.

Converged</EVENT-PART>
<EVENT-PART seq="2/8" id="49c515e4"> mechanism (correct, final): the Duration passed to cold_start_pump is io_timeout = the per-IPC-call READ deadline (brain.rs:311-323, call_deadline=now+io_timeout); the socket connect is unbounded. request_attach -&gt; net_open_stream reads the journaled NetStreamOpened ack bounded by call_deadline; under co-tenant starvation that ack outruns </EVENT-PART>
<EVENT-PART seq="3/8" id="49c515e4">the 2s io_timeout -&gt; net_open_stream Err -&gt; request_attach Err -&gt; the attacher's request_attach match arm sends (false,false) at ~2.0s via channel, 2s BEFORE the 30s watchdog. net_stream_subscribe is fire-and-forget (no ack read) — never the false. Your original &quot;sole elastic bound = net_open_stream ack&quot; was right all alon</EVENT-PART>
<EVENT-PART seq="4/8" id="49c515e4">g; the only wrong part was pinning the false to the 30s watchdog. My connect-timeout correction was wrong too. Now correct.

RULING (final cut):
1. A: rename knob SPT_ATTACH_CONNECT_DEADLINE_MS -&gt; SPT_ATTACH_IPC_DEADLINE_MS; helper -&gt; attach_ipc_deadline(). Doc it as the pump per-IPC-call read deadline (io_timeout), NOT a connec</EVENT-PART>
<EVENT-PART seq="5/8" id="49c515e4">t.
2. B: attribution print on the request_attach Err arm (both gates): &quot;PASTE_FLAKE/JRNL_FLAKE: request_attach net_open_stream ack TIMED OUT after {elapsed} (io_timeout bound, source=channel)&quot;. Drop the cold_start_pump-arm print (never fires for this flake).
3. Default stays 2s; CI exports SPT_ATTACH_IPC_DEADLINE_MS=30000 job-l</EVENT-PART>
<EVENT-PART seq="6/8" id="49c515e4">evel. Real wedge -&gt; ack never lands -&gt; Err at io_timeout -&gt; false -&gt; assert still catches (and total &lt; the 120s watchdog).
4. KEEP the watchdog knob as the outer ceiling (harmless + correct; catches a true forever-wedge as a clean fail). Two distinct bounds, two knobs.
5. Non-vacuous unchanged. clippy clean. Re-verify: DEA</EVENT-PART>
<EVENT-PART seq="7/8" id="49c515e4">DLINE_MS=1 -&gt; both gates fail fast WITH the new request_attach-ack print; default 2s -&gt; pass.

The truncated tail of your msg (&quot;Also FYI: 3 W2 helper connects (outpu...&quot;) cut off — resend it. Ruling in advance: any helper whose connect/ack gates a RESULT (output_contains_within :912, deliver helpers :951/:1081, wait_for</EVENT-PART>
<EVENT-PART seq="8/8" id="49c515e4">_stream viewer :1516) should use the SAME attach_ipc_deadline() knob; leave non-result-gating ones at the 2s literal. One knob only.

Push when correct. I gate-read the diff, then I drive x3 serialized
...(truncated)</event>
</task-notification>


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


doyle ACCEPTED A+B and ruled the W2 helpers (`:912/:951/:1081`) onto the same knob (one knob, result-gating only). Final mechanism converged. Applying:
- A: `attach_connect_deadline`→`attach_ipc_deadline`, `SPT_ATTACH_CONNECT_DEADLINE_MS`→`SPT_ATTACH_IPC_DEADLINE_MS`, doc as pump per-IPC-call read deadline
- B: drop cold_start_pump-arm print, add print on `request_attach` Err arm
- Extend knob to W2 helpers; keep watchdog knob

Helper rewrite first:


Edit

/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect
/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke
/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`
/// inside the deadline and the `subscribed` assert catches it. CI exports
/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,
/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO
/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's
/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is
/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight
/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob
/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /
/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it
/// never relaxes the `subscribed` / `got_output` assertions.
fn attach_connect_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}

/// The pump per-IPC-call READ deadline (`io_timeout`) for every result-gating
/// `cold_start_pump` brain in this file — both attachers, both drivers, the
/// controller_by viewer, the keystroke op, AND the W2 result-gating helpers
/// (`output_contains_within` / `observe_with_xon` / `spawn_xlate_session`). NOT a
/// connect deadline: `cold_start_pump`'s socket connect is UNBOUNDED — the `Duration`
/// arg is stored as `io_timeout` and applied as `call_deadline = now + io_timeout` to
/// every bounded read (`read_event_until`), never to `LocalSocketTransport::connect`
/// (brain.rs:311-323, :569). DEFAULT 2s — tight locally, so a REAL wedge (an ack that
/// never lands) still Errs at the deadline and the `subscribed` assert catches it. CI
/// exports `SPT_ATTACH_IPC_DEADLINE_MS=30000` ONLY on the shared self-hosted boxes,
/// where co-tenant scheduler starvation can push the journaled `net_open_stream` ack —
/// read inside `request_attach` (the gate's SOLE elastic bound) under `call_deadline`
/// (brain.rs:1066-1068) — past 2s with NO product wedge: that bounded read then Errs →
/// `request_attach` Err → the attacher sends `(false,false)` via channel at ~2.0s, a
/// full 2s BEFORE the 30s `attach_gate_watchdog` is ever reached (doyle's SERIALIZED
/// repro: 2.016s, `source=channel` — NOT a wedge, NOT a connect). DISTINCT bound from
/// `attach_gate_watchdog` (the outer `result_rx` recv ceiling): the per-call io_timeout
/// bites FIRST, so the watchdog knob alone cannot grant this headroom — two bounds, two
/// knobs. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` / `SPT_REGISTRY_BUSY_TIMEOUT_MS`
/// env-knob precedent. Grants IPC-read wall-clock ONLY; never relaxes the `subscribed`
/// / `got_output` assertions.
fn attach_ipc_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_IPC_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}


The file C:/Users/decid/Documents/projects/spt-core-delivery/crates/spt-daemon/tests/inject_control_wedge.rs has been updated successfully. (file state is current in your context — no need to Read it back)

/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect
/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke
/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`
/// inside the deadline and the `subscribed` assert catches it. CI exports
/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,
/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO
/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's
/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is
/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight
/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob
/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /
/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it
/// never relaxes the `subscribed` / `got_output` assertions.
fn attach_connect_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}

/// The pump per-IPC-call READ deadline (`io_timeout`) for every result-gating
/// `cold_start_pump` brain in this file — both attachers, both drivers, the
/// controller_by viewer, the keystroke op, AND the W2 result-gating helpers
/// (`output_contains_within` / `observe_with_xon` / `spawn_xlate_session`). NOT a
/// connect deadline: `cold_start_pump`'s socket connect is UNBOUNDED — the `Duration`
/// arg is stored as `io_timeout` and applied as `call_deadline = now + io_timeout` to
/// every bounded read (`read_event_until`), never to `LocalSocketTransport::connect`
/// (brain.rs:311-323, :569). DEFAULT 2s — tight locally, so a REAL wedge (an ack that
/// never lands) still Errs at the deadline and the `subscribed` assert catches it. CI
/// exports `SPT_ATTACH_IPC_DEADLINE_MS=30000` ONLY on the shared self-hosted boxes,
/// where co-tenant scheduler starvation can push the journaled `net_open_stream` ack —
/// read inside `request_attach` (the gate's SOLE elastic bound) under `call_deadline`
/// (brain.rs:1066-1068) — past 2s with NO product wedge: that bounded read then Errs →
/// `request_attach` Err → the attacher sends `(false,false)` via channel at ~2.0s, a
/// full 2s BEFORE the 30s `attach_gate_watchdog` is ever reached (doyle's SERIALIZED
/// repro: 2.016s, `source=channel` — NOT a wedge, NOT a connect). DISTINCT bound from
/// `attach_gate_watchdog` (the outer `result_rx` recv ceiling): the per-call io_timeout
/// bites FIRST, so the watchdog knob alone cannot grant this headroom — two bounds, two
/// knobs. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` / `SPT_REGISTRY_BUSY_TIMEOUT_MS`
/// env-knob precedent. Grants IPC-read wall-clock ONLY; never relaxes the `subscribed`
/// / `got_output` assertions.
fn attach_ipc_deadline() -> Duration {
    match std::env::var("SPT_ATTACH_IPC_DEADLINE_MS") {
        Ok(ms) => ms
            .parse::<u64>()
            .map(Duration::from_millis)
            .unwrap_or(Duration::from_secs(2)),
        Err(_) => Duration::from_secs(2),
    }
}

-/// The operator-IPC CONNECT deadline for every result-gating `cold_start_pump` connect

-/// in this file (both attachers, both drivers, the controller_by viewer, the keystroke

-/// op). DEFAULT 2s — tight locally, so a REAL connect-wedge still bails `(false,false)`

-/// inside the deadline and the `subscribed` assert catches it. CI exports

-/// `SPT_ATTACH_CONNECT_DEADLINE_MS=30000` ONLY on the shared self-hosted Windows box,

-/// where a co-tenant load spike can push a SERVICED operator connect past 2s with NO

-/// product wedge — the cross-run starvation flake doyle caught SERIALIZED (p0_paste's

-/// attacher timed its connect out at 2.016s, `source=channel`, NOT a wedge). This is

-/// ORTHOGONAL to `attach_gate_watchdog` (the result_rx recv ceiling): on a too-tight

-/// connect the attacher bails BEFORE the watchdog is ever reached, so the watchdog knob

-/// alone cannot grant this headroom. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` /

-/// `SPT_REGISTRY_BUSY_TIMEOUT_MS` env-knob precedent. Grants connect wall-clock ONLY; it

-/// never relaxes the `subscribed` / `got_output` assertions.

-fn attach_connect_deadline() -> Duration {

-    match std::env::var("SPT_ATTACH_CONNECT_DEADLINE_MS") {

+/// The pump per-IPC-call READ deadline (`io_timeout`) for every result-gating

+/// `cold_start_pump` brain in this file — both attachers, both drivers, the

+/// controller_by viewer, the keystroke op, AND the W2 result-gating helpers

+/// (`output_contains_within` / `observe_with_xon` / `spawn_xlate_session`). NOT a

+/// connect deadline: `cold_start_pump`'s socket connect is UNBOUNDED — the `Duration`

+/// arg is stored as `io_timeout` and applied as `call_deadline = now + io_timeout` to

+/// every bounded read (`read_event_until`), never to `LocalSocketTransport::connect`

+/// (brain.rs:311-323, :569). DEFAULT 2s — tight locally, so a REAL wedge (an ack that

+/// never lands) still Errs at the deadline and the `subscribed` assert catches it. CI

+/// exports `SPT_ATTACH_IPC_DEADLINE_MS=30000` ONLY on the shared self-hosted boxes,

+/// where co-tenant scheduler starvation can push the journaled `net_open_stream` ack —

+/// read inside `request_attach` (the gate's SOLE elastic bound) under `call_deadline`

+/// (brain.rs:1066-1068) — past 2s with NO product wedge: that bounded read then Errs →

+/// `request_attach` Err → the attacher sends `(false,false)` via channel at ~2.0s, a

+/// full 2s BEFORE the 30s `attach_gate_watchdog` is ever reached (doyle's SERIALIZED

+/// repro: 2.016s, `source=channel` — NOT a wedge, NOT a connect). DISTINCT bound from

+/// `attach_gate_watchdog` (the outer `result_rx` recv ceiling): the per-call io_timeout

+/// bites FIRST, so the watchdog knob alone cannot grant this headroom — two bounds, two

+/// knobs. Mirrors the `SPT_ATTACH_GATE_WATCHDOG_MS` / `SPT_REGISTRY_BUSY_TIMEOUT_MS`

+/// env-knob precedent. Grants IPC-read wall-clock ONLY; never relaxes the `subscribed`

+    match std::env::var("SPT_ATTACH_IPC_DEADLINE_MS") {


Now the a_journaled attacher: strip cold_start_pump-arm print + rename t0, then add print on request_attach arm:


        // mode makes the slices real, so the gate reports the TRUE signal.
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): on a serialized shared-box run this connect
                // timed out at ~2.0s (source=channel) — print the elapsed so the next
                // triage reads the connect-timeout directly instead of reverse-engineering
                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // mode makes the slices real, so the gate reports the TRUE signal.
        let attach_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {


        // mode makes the slices real, so the gate reports the TRUE signal.
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): on a serialized shared-box run this connect
                // timed out at ~2.0s (source=channel) — print the elapsed so the next
                // triage reads the connect-timeout directly instead of reverse-engineering
                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // mode makes the slices real, so the gate reports the TRUE signal.
        let attach_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

// ARTIFACT, not a subscribe failure (the broker registers the subscribe fast,

// lock-free; gdb showed the attacher parked PAST net_stream_subscribe). Pump

-        let connect_t0 = Instant::now();

-        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {

+        let attach_t0 = Instant::now();

+        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {

-                // CHEAP attribution (doyle): on a serialized shared-box run this connect

-                // timed out at ~2.0s (source=channel) — print the elapsed so the next

-                // triage reads the connect-timeout directly instead of reverse-engineering

-                // it from 2.0s. Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.

-                    "JRNL_FLAKE: operator connect TIMED OUT after {:?} \

-                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",

-                    connect_t0.elapsed()


            AttachIntent::Viewer, // a read-only rc --view: receives output, no journaled input
        ) {
            Ok(s) => s,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };

            AttachIntent::Viewer, // a read-only rc --view: receives output, no journaled input
        ) {
            Ok(s) => s,
            Err(_) => {
                // Attribution (doyle B): the journaled net_open_stream ack inside
                // request_attach is read under the pump io_timeout (attach_ipc_deadline);
                // under co-tenant starvation it outruns the 2s deadline and Errs HERE —
                // the REAL source of the (false,false)@~2.0s flake (source=channel), a
                // full 2s before attach_gate_watchdog. Print the elapsed so the next
                // triage reads the ack-timeout directly, not reverse-engineered from 2.0s.
                eprintln!(
                    "JRNL_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \
                     (io_timeout bound, source=channel)",
                    attach_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };


            AttachIntent::Viewer, // a read-only rc --view: receives output, no journaled input
        ) {
            Ok(s) => s,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };

            AttachIntent::Viewer, // a read-only rc --view: receives output, no journaled input
        ) {
            Ok(s) => s,
            Err(_) => {
                // Attribution (doyle B): the journaled net_open_stream ack inside
                // request_attach is read under the pump io_timeout (attach_ipc_deadline);
                // under co-tenant starvation it outruns the 2s deadline and Errs HERE —
                // the REAL source of the (false,false)@~2.0s flake (source=channel), a
                // full 2s before attach_gate_watchdog. Print the elapsed so the next
                // triage reads the ack-timeout directly, not reverse-engineered from 2.0s.
                eprintln!(
                    "JRNL_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \
                     (io_timeout bound, source=channel)",
                    attach_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };

+                // Attribution (doyle B): the journaled net_open_stream ack inside

+                // request_attach is read under the pump io_timeout (attach_ipc_deadline);

+                // under co-tenant starvation it outruns the 2s deadline and Errs HERE —

+                // the REAL source of the (false,false)@~2.0s flake (source=channel), a

+                // full 2s before attach_gate_watchdog. Print the elapsed so the next

+                // triage reads the ack-timeout directly, not reverse-engineered from 2.0s.

+                    "JRNL_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \

+                     (io_timeout bound, source=channel)",

+                    attach_t0.elapsed()


Now p0_paste attacher — same two edits (PASTE_FLAKE):


        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s
                // (source=channel) on the serialized shared-box rerun — print the elapsed
                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.
                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let attach_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {


        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let connect_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {
            Ok(b) => b,
            Err(_) => {
                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s
                // (source=channel) on the serialized shared-box rerun — print the elapsed
                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.
                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.
                eprintln!(
                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \
                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",
                    connect_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

        // slices so the gate reports the true signal (same fix as the a_journaled gate).
        let attach_t0 = Instant::now();
        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {
            Ok(b) => b,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let dialed = match operator.net_dial_loopback() {

// forever when no NetStreamData lands) — making `subscribed=false` a

// measurement artifact rather than a real subscribe failure. Pump honors the

-        let connect_t0 = Instant::now();

-        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_connect_deadline()) {

+        let attach_t0 = Instant::now();

+        let mut operator = match Brain::cold_start_pump(&attach_name, 1, attach_ipc_deadline()) {

-                // CHEAP attribution (doyle): this is the connect that timed out at 2.016s

-                // (source=channel) on the serialized shared-box rerun — print the elapsed

-                // so the connect-timeout is read directly, not reverse-engineered from 2.0s.

-                // Default 2s; CI grants SPT_ATTACH_CONNECT_DEADLINE_MS.

-                    "PASTE_FLAKE: operator connect TIMED OUT after {:?} \

-                     (SPT_ATTACH_CONNECT_DEADLINE_MS connect bound)",

-                    connect_t0.elapsed()


            AttachIntent::Viewer,
        ) {
            Ok(s) => s,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let subscribed = operator.net_stream_subscribe(stream_b, 0).is_ok();

        let mut target = connect_retry(&attach_name);

            AttachIntent::Viewer,
        ) {
            Ok(s) => s,
            Err(_) => {
                // Attribution (doyle B): same bound as the a_journaled gate — the
                // journaled net_open_stream ack inside request_attach is read under the
                // pump io_timeout (attach_ipc_deadline); co-tenant starvation pushes it
                // past 2s → Err HERE, the REAL (false,false)@~2.0s flake (source=channel),
                // 2s before attach_gate_watchdog. Print the elapsed for direct triage.
                eprintln!(
                    "PASTE_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \
                     (io_timeout bound, source=channel)",
                    attach_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let subscribed = operator.net_stream_subscribe(stream_b, 0).is_ok();

        let mut target = connect_retry(&attach_name);


            AttachIntent::Viewer,
        ) {
            Ok(s) => s,
            Err(_) => {
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let subscribed = operator.net_stream_subscribe(stream_b, 0).is_ok();

        let mut target = connect_retry(&attach_name);

            AttachIntent::Viewer,
        ) {
            Ok(s) => s,
            Err(_) => {
                // Attribution (doyle B): same bound as the a_journaled gate — the
                // journaled net_open_stream ack inside request_attach is read under the
                // pump io_timeout (attach_ipc_deadline); co-tenant starvation pushes it
                // past 2s → Err HERE, the REAL (false,false)@~2.0s flake (source=channel),
                // 2s before attach_gate_watchdog. Print the elapsed for direct triage.
                eprintln!(
                    "PASTE_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \
                     (io_timeout bound, source=channel)",
                    attach_t0.elapsed()
                );
                let _ = result_tx.send((false, false));
                return;
            }
        };
        let subscribed = operator.net_stream_subscribe(stream_b, 0).is_ok();

        let mut target = connect_retry(&attach_name);

+                // Attribution (doyle B): same bound as the a_journaled gate — the

+                // journaled net_open_stream ack inside request_attach is read under the

+                // pump io_timeout (attach_ipc_deadline); co-tenant starvation pushes it

+                // past 2s → Err HERE, the REAL (false,false)@~2.0s flake (source=channel),

+                // 2s before attach_gate_watchdog. Print the elapsed for direct triage.

+                    "PASTE_FLAKE: request_attach net_open_stream ack TIMED OUT after {:?} \

+                     (io_timeout bound, source=channel)",

+                    attach_t0.elapsed()


Now replace remaining `attach_connect_deadline()` calls (drivers/viewer/keystroke) + extend knob to the 3 W2 helpers:


The file C:/Users/decid/Documents/projects/spt-core-delivery/crates/spt-daemon/tests/inject_control_wedge.rs has been updated. All occurrences were successfully replaced. (file state is current in your context — no need to Read it back)

// deadlock send_effect on a plain Whole conn (observed: it stalled after a

// few ops). The pump keeps the driver's socket healthy so it can keep a

// journaled write in-flight without ever wedging the CLIENT.

-        let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_connect_deadline()) {

+        let mut w = match Brain::cold_start_pump(&driver_name, 1, attach_ipc_deadline()) {

/// reconcile self-heal consumes EXACTLY this read, so this is the field-under-test

/// observed through the real reply path.

fn controller_by_of(name: &str, sid: u64) -> Option<Option<String>> {

-    let mut b = Brain::cold_start_pump(name, 1, attach_connect_deadline()).ok()?;

+    let mut b = Brain::cold_start_pump(name, 1, attach_ipc_deadline()).ok()?;

let driver_pumped = Arc::clone(&pumped);

//    path ACCEPTS + returns, never blocks). Pre-fix this wedged on the parked

-        let mut op = match Brain::cold_start_pump(&name, 1, attach_connect_deadline()) {

+        let mut op = match Brain::cold_start_pump(&name, 1, attach_ipc_deadline()) {

Err(_) => Brain::cold_start(&name, 1).expect("operator connect"),


// PUMP mode (Split) so `read_event_until` actually HONORS the deadline — a

// plain `Whole` cold_start ignores it (read_frame blocks), which would hang

// forever if the PTY produced no output (e.g. an XOFF-stalled terminal).

-    let mut viewer = match Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {

+    let mut viewer = match Brain::cold_start_pump(name, 1, attach_ipc_deadline()) {

-    let mut op = match Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {

+    let mut op = match Brain::cold_start_pump(name, 1, attach_ipc_deadline()) {

-            if let Ok(c) = Brain::cold_start_pump(name, 1, Duration::from_secs(2)) {

+            if let Ok(c) = Brain::cold_start_pump(name, 1, attach_ipc_deadline()) {


Now CI yml rename + comment fix:


      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,
      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's
      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;
      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED
      # connect past 2s with NO product wedge, and the attacher then bails (false,false)
      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:
      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the
      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and
      # still trips this; local keeps the tight 2s default. Same env-knob precedent.
      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"

      # Concurrent-attach per-IPC-call READ-deadline headroom (the result-gating
      # cold_start_pump brains: a_journaled / p0_paste attachers, drivers, viewer,
      # keystroke op + the W2 helpers). DISTINCT from the watchdog above: the Duration
      # passed to cold_start_pump is io_timeout (call_deadline = now + io_timeout) — NOT
      # a connect bound (the socket connect is unbounded). request_attach reads the
      # journaled net_open_stream ack under that deadline; on the shared self-hosted
      # boxes co-tenant scheduler starvation pushes that SERVICED ack past the LOCAL-tight
      # 2s, so the read Errs -> request_attach Err -> the attacher bails (false,false)
      # ~2s BEFORE the result_rx watchdog is ever reached (doyle's serialized repro:
      # 2.016s, source=channel — NOT a wedge, NOT a connect). A real wedge: the ack never
      # lands -> Err at io_timeout -> assert still catches (total < the 120s watchdog).
      # Local keeps the tight 2s default. Same env-knob precedent; two bounds, two knobs.
      SPT_ATTACH_IPC_DEADLINE_MS: "30000"


The file C:/Users/decid/Documents/projects/spt-core-delivery/.github/workflows/ci.yml has been updated successfully. (file state is current in your context — no need to Read it back)

      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,
      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's
      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;
      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED
      # connect past 2s with NO product wedge, and the attacher then bails (false,false)
      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:
      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the
      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and
      # still trips this; local keeps the tight 2s default. Same env-knob precedent.
      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"

      # Concurrent-attach per-IPC-call READ-deadline headroom (the result-gating
      # cold_start_pump brains: a_journaled / p0_paste attachers, drivers, viewer,
      # keystroke op + the W2 helpers). DISTINCT from the watchdog above: the Duration
      # passed to cold_start_pump is io_timeout (call_deadline = now + io_timeout) — NOT
      # a connect bound (the socket connect is unbounded). request_attach reads the
      # journaled net_open_stream ack under that deadline; on the shared self-hosted
      # boxes co-tenant scheduler starvation pushes that SERVICED ack past the LOCAL-tight
      # 2s, so the read Errs -> request_attach Err -> the attacher bails (false,false)
      # ~2s BEFORE the result_rx watchdog is ever reached (doyle's serialized repro:
      # 2.016s, source=channel — NOT a wedge, NOT a connect). A real wedge: the ack never
      # lands -> Err at io_timeout -> assert still catches (total < the 120s watchdog).
      # Local keeps the tight 2s default. Same env-knob precedent; two bounds, two knobs.
      SPT_ATTACH_IPC_DEADLINE_MS: "30000"

# drops only starvation noise, never wedge detection; local keeps the tight 30s

# default. Mirrors the SPT_REGISTRY_BUSY_TIMEOUT_MS env-knob precedent.

-      # Concurrent-attach CONNECT-deadline headroom (a_journaled / p0_paste attachers,

-      # drivers, viewer, keystroke op). ORTHOGONAL to the watchdog above: the attacher's

-      # FIRST op is a cold_start_pump operator-IPC connect bounded at a LOCAL-tight 2s;

-      # on the shared self-hosted boxes a co-tenant load spike can push that SERVICED

-      # connect past 2s with NO product wedge, and the attacher then bails (false,false)

-      # BEFORE the result_rx watchdog is ever reached (doyle's serialized reproduction:

-      # connect timed out at 2.016s, source=channel — the cross-run starvation flake the

-      # watchdog knob alone could not cover). A real connect-wedge blocks FOREVER and

-      # still trips this; local keeps the tight 2s default. Same env-knob precedent.

-      SPT_ATTACH_CONNECT_DEADLINE_MS: "30000"

+      # Concurrent-attach per-IPC-call READ-deadline headroom (the result-gating

+      # cold_start_pump brains: a_journaled / p0_paste attachers, drivers, viewer,

+      # keystroke op + the W2 helpers). DISTINCT from the watchdog above: the Duration

+      # passed to cold_start_pump is io_timeout (call_deadline = now + io_timeout) — NOT

+      # a connect bound (the socket connect is unbounded). request_attach reads the

+      # journaled net_open_stream ack under that deadline; on the shared self-hosted

+      # boxes co-tenant scheduler starvation pushes that SERVICED ack past the LOCAL-tight

+      # 2s, so the read Errs -> request_attach Err -> the attacher bails (false,false)

+      # ~2s BEFORE the result_rx watchdog is ever reached (doyle's serialized repro:

+      # 2.016s, source=channel — NOT a wedge, NOT a connect). A real wedge: the ack never

+      # lands -> Err at io_timeout -> assert still catches (total < the 120s watchdog).

+      # Local keeps the tight 2s default. Same env-knob precedent; two bounds, two knobs.

+      SPT_ATTACH_IPC_DEADLINE_MS: "30000"

# A wedged test must not block the single self-hosted runner slot (the

# 2026-06-03 handoff.rs ConPTY stall burned 22 hosted minutes unbounded).

# 50 (was 25): the slow Linux runner (kitsubito) needs more than 25min for a


All edits applied. Verify no stale names + correct wiring:


Grep

attach_connect_deadline|SPT_ATTACH_CONNECT_DEADLINE_MS|attach_ipc_deadline|SPT_ATTACH_IPC_DEADLINE_MS|operator connect TIMED OUT|net_open_stream ack TIMED OUT|cold_start_pump\([^)]*Duration::from_secs\(2\)