---
name: cold-start-pump-iotimeout-not-connect
description: "Brain::cold_start_pump's 3rd Duration arg is io_timeout (per-IPC-call read deadline), NOT a connect bound — the inject-wedge gate flake bites at request_attach's net_open_stream ack"
metadata: 
  node_type: memory
  type: reference
  originSessionId: 3d725ad6-3a8a-44b3-aad2-0e65f49b6165
---

`Brain::cold_start_pump(name, now_ms, dur)` (crates/spt-daemon/src/brain.rs:311-323): the `dur` is stored as `io_timeout` and applied as `call_deadline = now + io_timeout` (:569) to every bounded read (`read_event_until`). The socket connect (`LocalSocketTransport::connect`, :312) is **UNBOUNDED**. So cold_start_pump never "times out at 2s" — it Errs only on a real socket failure.

In `inject_control_wedge.rs` (a_journaled / p0_paste gates) the `(false,false)@~2.0s, source=channel, subscribed=false` flake on the shared Windows box (hfenduleam) is **request_attach → net_open_stream reading the journaled NetStreamOpened ack under that io_timeout** (attach.rs:513, brain.rs:1066-1068). Co-tenant scheduler starvation pushes the serviced ack past the local-tight 2s → read Errs → request_attach Err → attacher's request_attach arm sends the false, a full ~2s BEFORE the `attach_gate_watchdog` (30s) is reached. `net_stream_subscribe` (:1200) is fire-and-forget (no ack read) — never the false.

This root was misread 3× (connect-timeout, watchdog-default, connect again). Fix shipped v0.13.0-delivery-control @ 45cc479: `attach_ipc_deadline()` ← `SPT_ATTACH_IPC_DEADLINE_MS` (default 2s, CI=30000), distinct from the watchdog knob — two bounds, two knobs. Wiring probe `SPT_ATTACH_IPC_DEADLINE_MS=1` is borderline-racy (loopback ack occasionally lands <1ms → false pass); the real 2s bound has no such race. Related: [[v013-rc-attach-flood-wedge]].