{
  "root_mechanism": "A controller subscription installs a dedicated `controller_writer` with a clone of that brain connection’s `SharedSend = Arc<Mutex<SendHalf>>` (`.worktrees/rca-capture/crates/spt-daemon/src/broker.rs:73-77, 1048-1108`). For both initial replay and live output, the writer marks itself blocked, acquires the per-connection mutex, and calls `write_frame(&mut *s, ...)` while the `MutexGuard<SendHalf>` remains in scope (`broker.rs:1664-1716`, especially 1681-1696; `broker.rs:1718-1760`, especially 1732-1742). If the peer remains connected but stops draining, that one writer can remain inside the framed pipe write indefinitely while monopolizing every outbound write on the same connection. The separate 15-second detector can remove the controller from `OutputLog`, but it does not interrupt that Rust thread, release its guard, close its still-owned `SendHalf`, or cancel the pending Windows I/O.",
  "exact_call_chain": [
    "`spt rc ... --take` maps to `AttachIntent::Take` in `.worktrees/rca-capture/crates/spt/src/cli.rs:1345-1353, 1618-1629`; `run_attach_inner` establishes the attach in `crates/spt/src/rc.rs:1075-1084, 1160-1224`.",
    "The operator opens/subscribes the attach stream in `crates/spt/src/rc.rs:1389-1500`. The target dispatcher creates a fresh ordinary `Brain::cold_start` worker connection and routes the attach family to `serve_attach` in `crates/spt-daemon/src/dispatch.rs:283-302, 335-395`; ordinary cold start is `BrainConn::Whole` with `io_timeout: None` in `crates/spt-daemon/src/brain.rs:309-327`.",
    "`serve_attach` receives the request and calls `brain.attach_as(..., req_intent, Some(origin_node))` in `crates/spt-daemon/src/attach.rs:326-380`. `Brain::subscribe_with` emits `KIND_SUBSCRIBE` in `crates/spt-daemon/src/brain.rs:1469-1507`.",
    "The broker splits the accepted local socket and wraps its send half as one `SharedSend` in `crates/spt-daemon/src/broker.rs:3102-3109`; `handle_conn` routes `KIND_SUBSCRIBE` at `broker.rs:3151-3158`; `dispatch_subscribe` calls `resolve_subscribe(Arc::clone(send), ...)` at `broker.rs:3601-3644`. `resolve_subscribe` installs/replaces the controller via `become_controller` at `broker.rs:1323-1355, 1364-1396`.",
    "`become_controller` owns the initial replay, creates the bounded live channel, clones the same connection `SharedSend`, and spawns `controller_writer` at `broker.rs:1062-1108`. The initial and live writer paths both hold `send.lock()` across `write_frame` at `broker.rs:1664-1716, 1718-1760`.",
    "The frame codec serializes, then synchronously calls `write_all` for the 4-byte length and JSON body in `crates/spt-daemon/src/codec.rs:21-35`. The marker covers both writes, so the capture does not distinguish whether the pending Windows operation is the prefix write or body write.",
    "The worktree pins `interprocess 2.4.2` at `Cargo.lock:1898-1903`. Its Windows chain is `local_socket/stream/enum.rs:39-64,167-181` (dispatch `SendHalf::write`) -> `os/windows/named_pipe/local_socket/stream.rs:160-188` -> `os/windows/named_pipe/stream/impl/send.rs:3-10,56-66` -> `os/windows/c_wrappers.rs:144-149` (`WriteFileEx`). `exsync_op` then loops on `wait_apc(None)` until the completion callback changes the result (`os/windows/c_wrappers.rs:91-112`); `None` becomes `u32::MAX`, and `wait_apc` calls alertable `SleepEx(INFINITE, ...)` (`os/windows/c_wrappers.rs:156-165`)."
  ],
  "deadline_and_nonblocking_semantics": [
    "`write_frame` accepts no deadline and the broker never configures this `SendHalf` nonblocking or calls a shutdown/cancellation API on the controller-write path. `interprocess`’s Windows local-socket `SendHalf::set_timeout` always returns `Unsupported` (`interprocess-2.4.2/.../os/windows/named_pipe/local_socket/stream.rs:184-188`); the whole-stream send/receive timeout methods likewise return `Unsupported` at lines 47-55. The local-socket `flush` is a no-op (`interprocess-2.4.2/.../local_socket/stream/enum.rs:39-64`), so this path waits in a write completion, not `FlushFileBuffers`.",
    "The project itself records why its Windows pump does not use `PIPE_NOWAIT`: `set_recv_timeout` is unavailable and interprocess nonblocking maps to deprecated `PIPE_NOWAIT`, which can corrupt a mid-frame stream (`crates/spt-daemon/src/brain.rs:184-201`). The controller writer does not use the pump’s reader-thread/channel deadline mechanism.",
    "`CONTROLLER_WRITE_DEADLINE = 5s` is only an output-driven bounded-channel-full decision, not a socket-write timeout (`broker.rs:262-280, 952-1002`). The drain performs `try_send`; it can evict only after that live queue is full. A writer stuck on its first owned replay frame need not fill that queue, and an idle session produces no `append` calls.",
    "`BRAIN_WRITE_DEADLINE = 15s` is also not an I/O deadline. It is an age predicate over `write_blocked_since` (`broker.rs:282-314, 1193-1206`). It is sampled only when a Control/Take subscribe runs `resolve_subscribe` (`broker.rs:1323-1332`) or a client asks for `KIND_SESSIONS`, whose snapshot invokes `reap_dead_controller` (`broker.rs:3230-3269`). Thus 15 seconds is a minimum age at observation, not an interrupt at exactly 15 seconds and not a guaranteed upper bound if no such observer runs.",
    "`mark_blocked(true)` is set before `send.lock()` (`broker.rs:1676-1682, 1731-1737`), so the predicate alone includes mutex wait plus OS write time. The capture instrumentation separates those states: `CTRL_WRITE_LOCKED` is emitted only after the guard is acquired (`broker.rs:101-208`). In this capture every affected write reports `wait_us=0`, establishing that the stall is after lock acquisition, inside `write_frame`, rather than mutex contention."
  ],
  "client_drain_path": "The serving side’s only controller drain is the single `serve_attach` loop: it calls `brain.read_event`/`read_controller_event_resuming` (`crates/spt-daemon/src/attach.rs:286-323`) and forwards each `BrokerEvent::Output` as an attach-stream record with `wire.net_stream_send` (`attach.rs:513-522`). The operator side creates a split pump connection (`crates/spt/src/rc.rs:1403-1413`; reader thread in `crates/spt-daemon/src/brain.rs:218-252`), polls broker events, decodes `AttachRecord::Output`, and writes plus flushes stdout (`crates/spt/src/rc.rs:1809-1822, 1914-1965`). The intervening broker net-stream read pump live-sends to its subscriber synchronously through another `SharedSend` (`crates/spt-daemon/src/nethost.rs:197-215, 529-566`). Therefore a consumer that ceases to run/read eventually stops the serving attach worker’s progress through this delivery chain; that worker then stops calling `brain.read_event`, leaving its controller broker pipe undrained.",
  "why_detach_cannot_cancel": [
    "Normal viewport detach propagates as attach-stream EOF (`crates/spt/src/rc.rs:1841-1846`), which `serve_attach` handles by best-effort `brain.detach_session` (`crates/spt-daemon/src/attach.rs:494-510`); that emits `KIND_UNSUBSCRIBE` (`brain.rs:1457-1467`), and the broker calls `detach_if` (`broker.rs:3647-3667`). Connection EOF cleanup calls the same logical detach (`broker.rs:3326-3349`).",
    "`detach_if`/`clear_controller` only removes the `ControllerSink` from `OutputLog` and updates stamps (`broker.rs:1127-1136, 1435-1457`). The 15-second path likewise assigns `self.controller = None` or calls `clear_controller` (`broker.rs:1223-1256`). None of these paths joins/interrupts the writer, closes the OS handle, invokes `CancelIo(Ex)`, invokes `shutdown`, or reaches into the in-flight frame operation.",
    "Dropping the sink drops the channel sender and its stored `SharedSend` clone, but the writer function already owns another `SharedSend` clone and, in the observed state, a live `MutexGuard<SendHalf>` on its stack. Dropping `JoinHandle` merely detaches the still-running thread. Channel disconnect can affect only the next `rx.recv()` after the current write returns; it cannot cancel the current call. The initial replay loop does not inspect the channel at all, and its epoch check also occurs only after it next acquires the same mutex (`broker.rs:1664-1696`)."
  ],
  "capture_evidence": [
    "The deliberate capture launcher invokes `spt.exe rc $Endpoint --take` (`C:/Users/decid/AppData/Local/spt-core/rca-active-20260709-222659/keep-rc.ps1:6-11`). The daemon trace independently records four wire-level remote Take subscriptions: connections 227/230/229/228 install sessions 4/2/1/3, then immediately emit `CTRL_WRITE_LOCKED ... wait_us=0` with no corresponding completion (`daemon.stderr.active.log:8158-8178`).",
    "For session 4, connection 227 locks at elapsed 183.339250s (`daemon.stderr.active.log:8162-8164`). A later query connection opens at 201.797011s and the broker immediately emits all four `BRAIN_SUBSCRIBER_STALL_EVICT` records (`daemon.stderr.active.log:8233-8237`), about 18.46 seconds after lock acquisition. This matches opportunistic observation after the 15-second threshold, not a timer firing at 15.000 seconds.",
    "Logical eviction did not finish the writes. At the planned brain restart, the relevant connections finally EOF and the four old writers report `result=error` with approximately 127.953 seconds spent in `write_frame` (`daemon.stderr.active.log:8522-8582`; session 4 specifically line 8565, `write_us=127953934`). For session 4 that is roughly 109.5 seconds after its logical stall eviction. This is direct evidence that clearing the controller role did not cancel the Windows write; peer/connection teardown later made it return."
  ],
  "identity_boundary": "The current controlled capture proves `source=subscribe intent=take by=remote` and includes a deliberate `rc --take` launcher. It does not establish the identity of the historical field consumer, its operator, or its exact process. The source-level root applies to any connected peer that stops draining this framed broker connection; the root-cause document should identify the historical peer only as a non-draining controller/serving-attach subscriber unless separate process evidence exists."
}