{
  "summary": "## Verdict\n\n`PUMP_IPC_READER: spawned` is emitted at exactly one production source site, `crates/spt-daemon/src/brain.rs:254`. It is a direct `eprintln!`, not a logging facade, and the matching exit diagnostic is at `brain.rs:269`. Each occurrence therefore corresponds to one real `pump-ipc-reader` thread created by `BrainConn::split_with_reader` (`brain.rs:248-275`). There is no duplicate emit path.\n\nA normal initial **plain/bare** `spt rc <id>` attach constructs **two real pump-mode `Brain` IPC clients** in the CLI process:\n\n1. The honest-session preflight probe: `cli.rs:1426-1428` → `rc::run_attach` (`rc.rs:1318-1319`) → `run_attach_inner` (`rc.rs:1340`) → `SessionProbe::connect` (`rc.rs:1388-1391`, constructor at `rc.rs:981-988`) → `Brain::cold_start_pump` (`brain.rs:364-379`) → `BrainConn::split_with_reader` (`brain.rs:368`, emit at `brain.rs:254`). That connection sends only `KIND_SESSIONS` through `SessionProbe::session_truth` (`rc.rs:1022-1045`) and `Brain::sessions` (`brain.rs:1698-1707`). The temporary `SessionProbe` is then dropped at the end of the expression.\n2. The actual viewport establishment client: `run_attach_inner` calls `establish_attach` at `rc.rs:1464`; `establish_attach` starts another `Brain::cold_start_pump` at `rc.rs:1651-1656`, producing the second reader thread and second identical diagnostic. This second `Brain` performs the authoritative local-session re-resolution (`rc.rs:1676-1680`), loopback/remote dial, the sole attach stream open/request (`rc.rs:1743-1768`, `attach.rs:658-686`), stream subscription (`rc.rs:1771-1773`), and is moved into `Established` (`rc.rs:1579-1590`, `1774-1778`) for `attach_viewport`/`pump`.\n\nThus the field symptom is **two actual IPC reader spawns/connections expected by the current probe-then-establish control flow**, but not two attach pumps or two attach streams. The first is a correctness preflight; the second alone establishes the viewport. The separation is unnecessary resource duplication, but it is not an accidental recursive/double establishment and is not duplicate log emission.\n\n## Counts\n\nFor a healthy, retry-free, initial **plain/bare direct `spt rc`** against the current broker:\n\n- CLI/operator process: **2 `Brain::cold_start_pump` constructions**, **2 broker IPC connections**, **2 `pump-ipc-reader` threads**, **2 `PUMP_IPC_READER: spawned` lines**, but **1 attach stream**.\n- Target daemon, causally serving that attach: **3 ordinary `Brain::cold_start` constructions**, none pump-mode and none emitting `PUMP_IPC_READER`:\n  1. Durable opener lookup: `dispatch.rs:851` → `first_line` (`dispatch.rs:722-752`) → `connect` (`dispatch.rs:697-706`) → ordinary `Brain::cold_start`.\n  2. Serve worker connection: `dispatch.rs:896-907` → the same ordinary `connect`; this receives session output and attach records.\n  3. Separate forwarding connection: `dispatch.rs:995-1004` → `serve_attach` (`attach.rs:304-334`) → `Brain::cold_start` at `attach.rs:334`. This intentional two-connection target-side split prevents replay/forward IPC backpressure deadlock; it is unrelated to the duplicate pump diagnostic.\n- End-to-end happy-path causal total: **5 `Brain` constructions**, of which **2 are pump-mode** and **3 are ordinary**. Pre-existing supervised daemon/peer-pump connections are background baseline and are not caused by an rc attach.\n\nVariations:\n\n- Qualified targets skip the plain-target preflight at `rc.rs:1378-1388`, so initial establishment creates **1** operator pump Brain.\n- `run_attach_session_confirmed` (`rc.rs:1333-1337`) skips this in-function preflight, so it creates **1** operator pump Brain inside the attach function. A higher-level caller may already have performed its own probe separately.\n- Offline/zombie/harness-only early refusals may create only the preflight pump and never establish a viewport.\n- Every reconnect attempt that passes the daemon-running check and successfully connects creates one fresh pump Brain: `attach_viewport` re-enters `establish_attach` at `rc.rs:1879`. Failed post-connect resolution attempts also truthfully emit a spawn before dropping that Brain. The tracing-only stream-open retry at `rc.rs:1737-1768` reuses the same Brain and does not spawn another reader.\n- Dispatcher transient retries can add ordinary daemon-side Brains. The current broker's durable-opener happy path uses one opener-query Brain; the N-1 unsupported-verb fallback `peek_first_line` (`dispatch.rs:760-789`) would add another ordinary Brain.\n\n## Behavioral impact\n\n- The duplicate stderr line is accurate telemetry for two live thread constructions, not merely repeated text.\n- The preflight connection performs no dial, stream open, attach request, subscription, resize, or input forwarding. Consequently it cannot double-render output, double-type input, seize a controller lease, or create a second viewport.\n- It does incur one avoidable local-socket connect/hello, one broker `KIND_SESSIONS` round trip, one OS thread, one channel, and transient reader teardown per ordinary `spt rc` invocation. Since the reader owns the receive half and its join handle is dropped rather than joined, it can briefly overlap the actual viewport reader until transport closure reaches it; the matching `exited` diagnostic at `brain.rs:269` is the intended leak-watch.\n- Establishment deliberately queries `Brain::sessions` again on the second connection (`rc.rs:1676-1678`). Therefore stale persisted endpoint/project status is not treated as broker session truth. `SessionProbe::session_truth` uses the broker session table, and `establish_attach` rechecks the broker table before opening the stream. An `online` projection and a `No live session` result are not logically contradictory: only the broker's hosted-session map is attach authority. [INFERENCE] After a full broker/daemon restart, an online/stale projection can remain while the restarted broker has no hosted PTY session; this code correctly returns the no-session path rather than manufacturing an attach.\n- The two pump connections do not themselves explain a false `No live session`: the first probe result is not used as a session handle, and the second connection independently resolves the current broker table. A session disappearing between the two checks is handled as an honest miss; a session appearing after the probe can still be found by establishment.\n\n## Fix recommendation\n\nPreserve the broker-truth preflight but **reuse its already-connected pump Brain for establishment**:\n\n1. Keep a mutable `SessionProbe` in `run_attach_inner` rather than consuming it inside `.map(...)` at `rc.rs:1388-1391`.\n2. Add a narrow consuming accessor such as `SessionProbe::into_brain(self) -> Brain`, or factor establishment into `establish_attach_on(&mut Brain, ...)` plus a wrapper that creates a fresh Brain when none is supplied.\n3. When the gate proceeds to attach, pass the preconnected Brain into establishment. Continue the existing `resolve_session` query at `rc.rs:1676-1678` on that same connection; this preserves the fresh authoritative recheck and all existing race behavior while removing the second handshake/thread/log.\n4. Reconnects must continue to construct a fresh Brain because the old broker connection is the failed lease. Qualified and externally session-confirmed paths can continue creating one fresh establishment Brain.\n\nDo **not** replace the probe with ordinary `Brain::cold_start`: pump mode is what makes named-pipe/IPC reads deadline-bounded (`brain.rs:1859-1908`), and an ordinary whole-stream session query can wedge. Do **not** merely suppress or deduplicate the diagnostic: that would hide a real extra reader and weaken the KH 7.6 leak-watch without removing any resource cost. If reuse is deferred, the minimum observability improvement is to include a purpose/connection identifier (`probe` versus `viewport`) in the line, but that is inferior to eliminating the redundant construction.\n\n## Focused regression seam\n\nUse the existing real-process test `crates/spt/tests/rc_attach_truth.rs:273-319`, `offline_row_over_live_session_attaches`. It is the exact seam because it forces the preflight to observe `HonestLive` over a deliberately stale `offline` row, then requires the real viewport to stream a harness tick. The helper already captures rc stderr, and the test receives it at `rc_attach_truth.rs:295`.\n\nAfter reusing the probe Brain, add an assertion that `rc_stderr.matches(\"PUMP_IPC_READER: spawned\").count() == 1`, while retaining the existing `saw_tick` assertion. Together they prove both sides of the contract: stale projection remains subordinate to live broker truth, and the same single bounded pump connection transitions from truth query to a functioning attach viewport. The healthy fixture reaches its tick before any reconnect, so an additional spawn cannot be mistaken for expected reconnect behavior. A complementary reconnect test should assert one additional spawn per successful re-establishment, not globally one for the process lifetime.\n\nInvestigation was read-only; no files were changed and no state-changing commands or test runs were performed.",
  "files": [
    {
      "path": "crates/spt-daemon/src/brain.rs",
      "description": "Sole production emit site and construction primitive: `BrainConn::split_with_reader` at lines 248-275 emits spawned at 254 and exited at 269; `Brain::cold_start_pump` at 364-379 invokes it exactly once. `Brain::sessions` at 1698-1707 is the preflight/establishment truth query; `read_frame_until` at 1859-1908 explains why pump mode is required for bounded IPC reads."
    },
    {
      "path": "crates/spt/src/cli.rs",
      "description": "Direct CLI call root: `Cmd::Rc` at lines 1426-1434 calls `rc::run_attach` once. There is no duplicated CLI dispatch."
    },
    {
      "path": "crates/spt/src/rc.rs",
      "description": "Root of the two operator pump constructions. `SessionProbe::connect` 981-988 and `session_truth` 1022-1045 create/use the first; `run_attach_inner` 1340 onward invokes the probe at 1388-1391 and establishment at 1464; `establish_attach` 1632-1778 creates the second at 1651-1656 and alone dials/opens/subscribes. `attach_viewport` 1798-1910 creates one fresh pump per reconnect attempt through the call at 1879."
    },
    {
      "path": "crates/spt-daemon/src/attach.rs",
      "description": "Operator stream opener `request_attach_endpoint` at 658-686 proves only the establishment Brain opens the attach stream. Target-side `serve_attach` at 304 onward intentionally creates an ordinary second forwarding Brain at line 334 to avoid replay/forward deadlock; it emits no pump-reader diagnostic."
    },
    {
      "path": "crates/spt-daemon/src/dispatch.rs",
      "description": "Target-side causal ordinary-Brain graph: opener classification at 851 through `first_line` 722-752 and `connect` 697-706; worker Brain at 896; call to `serve_attach` at 995. These explain daemon-side Brain count without contributing to rc stderr's pump diagnostic."
    },
    {
      "path": "crates/spt/tests/rc_attach_truth.rs",
      "description": "Best regression seam: `offline_row_over_live_session_attaches` at 273 onward forces stale offline projection plus honest live broker session, captures rc stderr at 295, and already proves viewport output. Add exact one-spawn count after connection reuse."
    },
    {
      "path": "crates/spt/tests/dummy_harness_e2e.rs",
      "description": "Existing lines 246-299 treat presence of `PUMP_IPC_READER` only as a coarse connection proxy and do not assert a count; this is why the double construction currently passes."
    },
    {
      "path": "crates/spt/tests/multi_subnet_bringup_e2e.rs",
      "description": "Existing lines 423-440 similarly check only that the diagnostic is present and `RC_FAIL` absent, leaving duplicate reader construction unguarded."
    }
  ],
  "architecture": "```text\nspt CLI process\n  cli::Cmd::Rc                               cli.rs:1426\n    -> rc::run_attach                        rc.rs:1318\n      -> run_attach_inner                    rc.rs:1340\n         |\n         |  plain-target truth gate\n         +-> SessionProbe::connect           rc.rs:1388, 981\n         |    -> Brain::cold_start_pump      brain.rs:364\n         |       -> split_with_reader        brain.rs:248\n         |          -> reader thread\n         |             -> EMIT #1            brain.rs:254\n         |    -> session_truth               rc.rs:1022\n         |       -> Brain::sessions          brain.rs:1698\n         |    -> temporary probe drops\n         |\n         +-> establish_attach                rc.rs:1464, 1632\n              -> Brain::cold_start_pump      rc.rs:1651\n                 -> split_with_reader\n                    -> reader thread\n                       -> EMIT #2             brain.rs:254\n              -> resolve_session             rc.rs:1676\n                 -> Brain::sessions\n              -> loopback/remote dial\n              -> request_attach_endpoint     rc.rs:1765 / attach.rs:658\n                 -> exactly one attach stream open + Request\n              -> net_stream_subscribe        rc.rs:1772\n              -> Established { brain, ... }\n              -> attach_viewport/pump\n                   -> on sever: establish_attach again at rc.rs:1879\n                      -> one new pump reader per connected retry\n\nTarget daemon for the one attach stream (ordinary Brains only)\n  dispatcher worker\n    -> first_line/opening query Brain         dispatch.rs:722, 851\n    -> serving/receive Brain                  dispatch.rs:896\n    -> serve_attach                           dispatch.rs:995 / attach.rs:304\n       -> separate wire-forward Brain         attach.rs:334\n\nCurrent healthy initial plain attach:\n  operator pump Brains/readers = 2\n  target ordinary Brains       = 3\n  attach streams               = 1\n  spawned diagnostics          = 2\n```\n\nThe architectural distinction is load-bearing: the **operator-side preflight and viewport Brains are separable but need not be separate connections**, whereas the **target-side receive and wire-forward Brains are intentionally separate** to prevent broker IPC backpressure deadlock. A fix should merge only the former pair."
}