{
  "summary": "Existing tests cover live-input flood containment, small manual restart replay, durable-opener recovery with an intentionally tiny retained ring, stale-stream fencing, and subscriber poison recovery separately. They do not establish sustained retained-input replay under real refresh. The gated refresh_freeze rig supplies that observable workload; pending-input replay versus outbound forwarding remains for parent measurement. Read-only inspection only; no validation commands or file changes.",
  "files": [
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/input_ack_deadlock.rs:1-55,268-460,666-715",
      "description": "64-record live-controller flood; explicit Unix-red/Windows-positive limitation; directly invokes serve_attach, no dispatcher restart."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/attach.rs:541-670,864-1035,1264-1324",
      "description": "Prepopulated session-output ring containment, two-input manual restart replay, and legitimate same-origin successor behavior."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/redispatch.rs:110-136,209-219,351-366,494-504,571-685",
      "description": "Production dispatch_fixture generations; finished-row retirement, finished request/reply exception, and active opener-eviction recovery."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/redispatch_stall.rs:320-415,478-535,537-607,677-788,808-809",
      "description": "Subscriber isolation/cancellation, tail-only lease recovery, bounded fallback/breaker, and stale unfinished generation protection."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/refresh_freeze.rs:36-88,151-176",
      "description": "Gated real-Windows refresh test and fixed timing/predicate configuration."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/tests/support/refresh_freeze/rig.py:475-548,552-625",
      "description": "One tagged input per second, independent child ledger, actual node refresh, recovery/poison/closure predicates."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:480-515,549-590,686-713,762-817",
      "description": "Actual serve_attach lifecycle: subscribe before seeded request; unconfirmed inputs buffer; live confirmed inputs no-ack; pending flush uses acked send_effect. Parent instrumentation already present in this read."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:2850-2862,13305-13342",
      "description": "Explicit by:Some promotion exclusion and existing local_controller_wedged_scopes_to_the_brains_own_conn unit."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/docs/adr/0038-broker-stream-lifecycle-truth.md:26-70,73-135",
      "description": "Lifecycle-only suppression, durable classification, legitimate successor retake, bounded subscriber/forwarding and ownership amendment."
    },
    {
      "path": ".worktrees/49-267-refresh-discriminator/traceable-reqs.toml:1582-1586,2375-2398,2649-2652,2734-2752,2776-2794",
      "description": "Exact active requirement stages and deferred clean-close seed."
    }
  ],
  "architecture": "Broker retains PTY, effect journal, stream history and immutable opener across brain death. Production dispatch_fixture runs run_dispatch_loop and reconstructs serve_attach workers. serve_attach consumes stream replay and broker role/output events on brain, forwarding output over separate wire connection. Promotion only considers wedged by:None controllers; operator by:Some controller recovery is deliberately a separate contract.",
  "report": "All paths below are relative to .worktrees/49-267-refresh-discriminator. Line numbers reflect the inspected live tree, including parent-owned temporary probes.\n\n## Existing coverage and precise gaps\n\n- `input_flood_through_serve_attach_does_not_deadlock_broker` — tests/input_ack_deadlock.rs:281-460,666-715. Real loopback broker/PTY, direct serve_attach, 64 inputs, pump-drained operator connection. Seeded child stays quiet during flood; assertions cover send completion, broker/session responsiveness and subsequent viewer repaint/live output. Header :38-54 explicitly states 64 inputs is deterministic pre-fix RED on Unix, NOT Windows; larger Windows N confounded the fixed path with loopback send-window throttling. No restart, retained history admission, or assertion that N inputs enter pending_input. [INFERENCE] Some cold-start racing input may enter pending_input, but this test neither measures nor forces a pressure-sized pending batch. Existing passing containment must not be described as falsified by the refresh incident.\n\n- `attach_survives_target_brain_restart_exactly_once` — tests/attach.rs:864-1035. Life 1 is manually stepped (:908-948), then snapshot/drop; only MARKER_ONE (op 10) and dead-window MARKER_TWO (op 11) are replayed. Life 2 directly calls serve_attach with no durable seed (:958-981), bypassing production rediscovery. Asserts resulting screen contains both markers and agrees with authoritative screen. It exercises small replay/idempotency, not a pressure-sized retained history or actual refresh trial. A screen oracle can also conceal repeated same-looking effects; a producer ledger is stronger for exact application count.\n\n- `loopback_attach_to_a_prepopulated_ring_delivers_without_deadlock` — tests/attach.rs:541-670. Child emits TICK0..39; spawn connection drains then drops; direct serve_attach must forward through TICK39. This is retained SESSION OUTPUT, not retained operator-input history. It defends the two-connection replay-versus-forward split, not pending-input ACK traffic.\n\n- `finished_historical_attach_neither_takes_nor_clears_current_controller` — tests/redispatch.rs:209-350; `finished_unretired_attach_is_skipped_and_drained_not_replayed` — :351-492. Production dispatcher generations defend terminal exclusion including kill-mid-serve followed by FIN. `finished_pending_sync_request_still_serves_across_generation_start` — :494-569 guards the family exception: finished request/reply work must still answer. These are lifecycle eligibility boundaries, not a claim that every eligible active replay drains.\n\n- `opener_evicted_active_stream_resumes_after_dispatcher_restart` — tests/redispatch.rs:571-685. Best existing production seam: Generation (:110-136) launches actual run_dispatch_loop in dispatch_fixture; kill/restart reconstructs the SAME operator stream. Critically sets SPT_STREAM_RING_CHUNKS=8, sends 40 spaced inputs, proves floor_seq>0 and opener remains pinned, then verifies MARK-B after generation restart. This deliberately removes most history to exercise durable classification. Transport chunks are not equal to Input records, so do not claim exactly eight input records remain. It neither admits a retained-opener/full-history case nor measures replay pressure.\n\n- `transient_worker_start_failure_recovers_via_claim_retry` — tests/redispatch.rs:689 onward; fallback/breaker tests `opener_transient_is_bounded_requeue_never_a_peek_subscriber` and `seat_blocked_failure_trips_the_breaker_and_the_stream_recovers` — redispatch_stall.rs:546,607. Defend classified setup failure/recovery rather than an established serving worker's input-history drain.\n\n- `wedged_subscriber_never_stalls_the_producer_and_recovery_replays_gapless` — redispatch_stall.rs:320-404. Genuine broker subscribe/ring poison isolation, not attach-role input replay. `poisoned_subscriber_cancels_the_paired_forwarding_leg_then_recovery_serves` — :406-535 uses generic hello/tick traffic and acked net_stream_send. Its recovery explicitly subscribes at TAIL, with empty replay (:485-509), isolating lease renewal; it intentionally does not test recovery replay pressure. `stale_unfinished_attach_replay_neither_takes_nor_clears_the_replacement_controller` — :677-788 retains one S1-MARK input, kills gen1 without FIN, creates newer s2 and drives three markers. Defends stale ownership fencing, not large legitimate same-stream replay. `old_broker_unknown_verb_answer_falls_back_to_the_peek_and_serves_real_traffic` — :809 onward preserves N-1 fallback only.\n\n- `refresh_resumes_bounded_input_ack_without_replacement_poison` — refresh_freeze.rs:39-176 is the already-reproducing real Windows surface, not a result to reconfirm. Config :78-87: baseline 30s, post-refresh 25s, ACK bound 2s, recovery bound 15s. rig.py:531-548 sends one unique tag per second; :557-579 invokes real `node refresh` and verifies replacement brain identity. :600-625 requires bounded recovery, sustained timely ACK+state, accounting for every post tag, zero replacement write poison, detach-only controller closures, healthy reader. Independent producer ledger avoids PTY echo as child-input proof. Keep rig unchanged during discrimination.\n\n## Falsifiable source observations; not an RCA verdict\n\nsrc/attach.rs:480 subscribes to retained stream before seed processing (:549-590); role remains None until Subscribed. Input records accepted while role=None go into pending_input (:686-713). Confirmed live inputs call send_effect_no_ack (:704-707); confirmed-role pending drain calls send_effect (:789-800). src/brain.rs:921-935 maps these to ack=true versus false. Thus two semantically related input paths currently request different ACK behavior. This is a source fact, NOT proof the measured stall sits in that drain.\n\nParent probes distinguish: pressure-sized pending_flush with unmatched pending_send_effect boundary supports the pending replay hypothesis; pending flush completed/empty with an unmatched wire forward boundary supports outbound forwarding instead. Reader state and stream/connection attribution must establish the actually blocked pair. Promotion completion alone cannot select either hypothesis. No product remedy is proposed from this observation.\n\n## Coverage to defend a measured remedy\n\n1. Reuse redispatch.rs Generation + real broker/PTY/operator path. Admit an ACTIVE unfinished stream whose opener remains in the ring and whose retained input history is large enough to exercise the measured condition; restart only production dispatcher generation, retaining broker and same operator stream. Unlike D2, do not shrink/roll history away. Require post-restart unique child ACK/state progress within a bound, exact-once child effects for already-applied retained ops, and delivery of dead-window/new input. Exercise retained-opener and existing evicted-opener cases as distinct boundary conditions, not interchangeable tests.\n2. Force/observe the measured pre-role buffering condition at the real serving seam rather than merely injecting a batch and assuming scheduling. If measurement instead identifies wire-forward blocking, target that pairing and cancellation/replacement transition; do not rename an input-only test as its defense.\n3. Unit coverage should defend a real lifecycle transition introduced/changed by the measured remedy: unconfirmed input never applied before grant, Controller/TookControl permits it exactly once, Viewer/Busy cannot leak it, stale completion cannot clear replacement. Avoid call-count/wiring tests or a new abstraction just to unit-test a branchless call change. Existing protocol units (`msg.rs:2262,2294`) cover ACK compatibility, not pending-role lifecycle. Existing broker real-surface `ack_false_input_suppresses_applied_frame` (tests/broker.rs:759-872) covers ACK emission, and no-ack dedup helper (:875-924) covers repeated durable keys; neither invokes pending_input.\n4. Preserve real refresh_freeze acceptance unchanged after the eventual measured fix. Dispatcher-only tests cannot prove process supervision, promotion or Windows ConPTY/rc continuity.\n\n## Exact requirements/stages and documentation\n\nStages below are manifest requirements, NOT a claim that coverage has just been executed.\n\n- `REQ-DAEMON-REFRESH`: doc, impl, unit, int — traceable-reqs.toml:2649-2652. Canonical recovery definition CONTEXT.md:690; brain cycle without swap/broker/PTy loss. ADR-0018 Decision Q3/Q6/Q7 (:24-28) gives cycle, continuity/idempotency and readiness/rollback foundations.\n- `REQ-HAZARD-INPUT-ACK-BACKPRESSURE`: doc, impl, unit, int — manifest:1582-1586. KNOWN-HAZARDS §7.19 (:606-611) describes opt-in applied ACK, no-ack fire-and-forward path, retained exactly-once, and broker-resident/N-1 caveat. No separate pending_input-specific REQ was identified; this is the existing matching input-pressure contract.\n- `REQ-HAZARD-REDISPATCH-CONTROL-STEAL`: doc, int — :2734-2737; KNOWN-HAZARDS §7.41 (:789-793).\n- `REQ-REDISPATCH-FINISHED-RETIRE`: doc, impl, unit, int — :2739-2742. ADR-0038 Decision 1 (:31-40): retirement is enumeration exclusion, NOT transport teardown.\n- `REQ-STREAM-OPENER-DURABLE`: impl, unit, int — :2744-2747. ADR-0038 Decision 2 (:41-45); existing units named `opener_pins_first_line_across_full_ring_roll`, `opener_capture_gives_up_bounded_on_a_newline_less_stream` in manifest evidence.\n- `REQ-DISPATCH-CLAIM-RETRY`: impl, unit, int — :2749-2752. ADR-0038 Decision 3 (:46-49).\n- `REQ-HAZARD-REDISPATCH-STALL`: doc, int — :2776-2779; KNOWN-HAZARDS §7.43 (:808-812).\n- `REQ-DISPATCH-FALLBACK-CIRCUIT`, `REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE`, `REQ-SERVE-OWNERSHIP-GENERATION`: each doc, impl, unit, int — :2781-2794. ADR-0038 Amendment (:73-135), especially bounded/cancelable forwarding, no replacement until predecessor gone, and generation validation. Amendment explicitly says prior D1/D1b were field-correct on their own terms (:84-93), not failed containment.\n- `REQ-UPDATE-PROMOTE-DRAINED`: impl, unit, int — :2375-2378; CONTEXT.md:701, W3-WAVE-GATE-REPORT.md:34-56 and W3-GATE-VERDICT.md:40-43. by:Some exclusion is explicit and must remain. Source predicate src/broker.rs:2850-2862 only considers by.is_none(); unit `local_controller_wedged_scopes_to_the_brains_own_conn` (:13305-13342) checks wedged local=true, identically wedged remote=false, idle local=false. docs/49-267-REFRESH-OBSERVATION-PLAN.md:219-221 correctly warns exclusion does not rule out indirect viewport effects.\n- `REQ-UPDATE-TRIAL-DRAIN-DRIVE`: doc, impl, int — :2380-2383; heartbeat drives reap; unit deliberately omitted for branchless call. `REQ-BRAIN-RESUME-NO-CONTROL-STEAL`: doc, impl, int — :2395-2398; CONTEXT.md:703, viewer-only resume for non-driven sessions.\n- `REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE`: required_stages=[] — :2385-2388, explicitly deferred seed. Do not treat a clean-close implementation as currently mandated or infer it is the remedy.\n\nNo edits, tests, builds, formatters, linters, or reproduction runs performed."
}