HERTZ -> DOYLE RCA: emphasys false ONLINE+CONTROLLED after daemon restart, /exit, and raw PTY close (2026-07-16) Executive verdict - `emphasys` is not restored as a live broker session after a cold daemon restart. Its current presentation is stale durable metadata. - Current durable row: state=ready_agent, controllable=false, status=online, controlled=true, driven_by=, viewer/session metadata retained, pid=31352 dead. Registry address 127.0.0.1:61088 refuses TCP. Cold-start logs contain no emph spawn/attach/resume/reconcile event. - The false ONLINE state is the exact realized form of the previously latent gateway-RCA Defect B: `cmd_listen` stamps status=online from adapter manifest capability (`psyche_init`) rather than actual post-bind endpoint state/hosting authority. - Restart persistence is a second reconciliation hole: livehost skips non-live_agent rows before cleanup, then additionally gates cleanup on controllable=true. `emphasys` is excluded by both predicates. - Raw terminal/window/PTY close without Ctrl-B,D is a separate transport-lifetime defect: the opener Brain connection dies, but its attach net stream is deliberately restart-durable and is not FINished. Target `serve_attach` never receives NetStreamEof, never detaches, and the broker controller slot remains live. - This is NOT caused by stale rest_state carry (prior Issue A) and NOT by endpoint-create/effective-rest NoOp. Those can create resume contenders but do not own status, broker controller slots, or the three control stamps. Observed evidence 1. `owlery/emphasys/info.json`: state ready_agent; adapter omp-spt; controllable false; status online; rest_state active; controlled true; driven_by local node; pid 31352. 2. PID 31352 is dead. TCP probe to persisted registry address 127.0.0.1:61088 failed. 3. Current cold daemon creates a fresh broker session HashMap. Current/prior cold-start logs sweep other sessionless live agents but contain no emphasys restore or reconciliation event. 4. `sessions.log` contains historical boot/resume ledger rows only; it is not broker session truth. 5. `spt-store::liveness::is_perch_alive` and registry liveness trust status=online and therefore intentionally skip dead-PID rejection. Once the wrong status is written, every reader faithfully resurrects it. Causal chains A. Cold restart false ONLINE+CONTROLLED 1. Harness relay bind persists ready_agent + controllable=false + listener PID. 2. `startup.rs::cmd_listen` sees manifest `session.psyche_init`, calls that `live_capable`, and stamps status=online without checking persisted endpoint state/hosting mode. 3. Listener/harness disappears. Dead PID cannot make the row offline because explicit status is now authoritative. 4. New broker starts with no emph session. 5. `livehost::reconcile_hosted_liveness` skips state!=live_agent; its no-session control cleanup is also inside controllable==Some(true). 6. Durable status/control/ready/address survive and endpoint readers report ONLINE+CONTROLLED. B. `/exit` - Correctly classified spt-hosted live_agent/controllable=true child exit already has broker reap plus livehost reconciliation: exit waiter clears driven_by/controlled/viewer_count; absent-session reconcile marks status offline. Existing B3 integration coverage proves this nominal path. - `emphasys` is not on that path because its persisted hybrid is ready_agent/false. Therefore its `/exit` non-offline symptom is primarily the same wrong type/hosting classification plus skipped reconciliation, not a new correctly typed PTY-reap defect. - Important teardown distinction: do NOT globally make `api session-end` mark offline; that API also represents `/clear`/soft session boundaries and must preserve a live listener. Terminal signoff/owner-loss teardown, however, must atomically make an authoritative online row offline and clean ready/address ownership. Current signoff/orphan cleanup removes ready but can leave status authoritative. - Residual race: KIND_SESSIONS poll snapshots controller truth under the session lock, then writes stamps after unlocking. Exit waiter can remove/reap and clear stamps between snapshot and write; the old poll can relatch controlled=true. Fix with session/generation validation or serialized per-endpoint stamp transitions, not filesystem I/O under global locks. C. Abrupt operator PTY/window close 1. `spt rc` opens attach stream; target `serve_attach` acquires controller/viewer role and stamps metadata. 2. Operator terminal/rc Brain dies without FIN. 3. Broker removes connection-owned subscriptions but intentionally retains streams opened by that Brain for restart durability. 4. Target stream remains unfinished; `serve_attach` never receives NetStreamEof and never calls detach_session. 5. Controller slot remains, so KIND_SESSIONS convergence continues asserting CONTROLLED. Child may legitimately remain ONLINE. 6. A full broker restart erases the in-memory controller, but hybrid boot cleanup skips the durable stamps, so the false CONTROLLED presentation survives restart. Relation to prior hazards - KH 7.27 / CONTROL-STAMP-LIFETIME: partially related. It fixed genuine child-reap cleanup; it does not cover operator transport loss while child/session survives, nor poll-vs-reap relatch. - KH 7.29 / CONTROL-STAMP-CONVERGENCE: opposite-polarity late-bind repair. Its off-lock convergence enables the residual relatch race. - Gateway liveness Defect B: directly causal. Manifest-only ONLINE stamping created the hybrid authoritative row. - Rest-state/create defects: independent family. Do not merge their fixes with this report. Accepted minimal fix set 1. Fix creator in `crates/spt/src/api/startup.rs`: - Gate daemon-authoritative status=online on actual persisted endpoint state and hosting authority, not manifest capability alone. - A harness-hosted ready_agent relay stays PID-authoritative even if its adapter also declares psyche_init. - If a real live harness bind is intended to promote a legacy skeleton, perform an explicit, tested state promotion rather than leaving ready_agent+online. 2. Add legacy self-heal in `crates/spt-daemon/src/livehost.rs`: - After a SUCCESSFUL broker-session query, repair existing hybrid rows such as emph. - A dead PID-owned non-live relay carrying status=online must become offline and lose stale ready/address ownership without deleting spool/history/digest/session ledger. - Never interpret broker-query failure as an empty set. 3. Split control cleanup from presence/offline classification: - For every endpoint absent from reachable broker session truth, clear controlled=false, driven_by=None, viewer_count=0 regardless of state and controllable. - Keep live_agent && controllable=true only around daemon-hosted OFFLINE transitions. A healthy harness relay legitimately has no broker PTY. 4. Repair terminal owner teardown: - Graceful signoff/orphan owner loss must session/CAS-guard an atomic soft cleanup: status offline + ready/address removal, preserving durable content. - Do not overload soft `api session-end` used by `/clear`. 5. Make interactive viewport streams connection-bound: - Add explicit stream lifetime/lease classification. RC attach/view streams are ConnectionBound; existing durable inter-brain streams remain restart-durable. - On opener connection EOF/error, FIN only its connection-bound streams. Existing peer NetStreamEof path then runs detach. - Never globally retire all streams on Brain disconnect; that would break brain restart/durable replay. - Preserve detach_if identity checks so a late close from controller A cannot evict newer controller B. 6. Close convergence/reap ordering race: - Associate convergence snapshots with broker session identity/generation and revalidate at/after the write, or serialize per-endpoint stamp transitions. - Do not hold session/log mutexes across info.json I/O (KH 7.12). - Clear all three fields, including viewer_count, in every no-session path. Focused regression coverage 1. Startup classification: live-capable adapter bound as ready_agent never gains daemon-authoritative status; dead PID makes it offline and registry address expires. 2. Exact legacy emph matrix: ready_agent/false/online/dead PID/ready/address/control stamps + reachable empty broker -> offline, no ready/address, all three stamps clear, durable data preserved, no PTY resumed. 3. No-session cleanup matrix: live/non-live states x controllable true/false/None; all clear three control fields, only daemon-authoritative live_agent/true is offlined solely from session absence. 4. Correct `/exit`: real hosted child exits -> broker session absent, status offline, all three stamps clear. Retain existing KH 7.27 arm. 5. Deterministic poll/reap race: old positive snapshot released after reap cannot relatch; replacement-session arm converges to new session truth. 6. Signoff owner teardown: terminal listener end marks authoritative row offline and cleans ready/address; `/clear` soft session-end leaves active listener online. 7. Abrupt controller opener death: kill client without FIN/Ctrl-B,D; child/session stays online and attachable, controller_by clears, controlled/driven_by clear. 8. Abrupt viewer opener death: session stays alive; viewer_count returns to zero. 9. Replacement-controller race: A dies, B takes control before A cleanup; late A cleanup cannot clear B. 10. Full broker restart: stale control metadata heals; valid daemon-hosted live-agent restart survival remains intact; valid live PID-owned relay is not falsely offlined. Priority/risk - P0 compatibility repair: creator gate + legacy hybrid boot self-heal + control cleanup predicate split. This removes false resurrection across restarts. - P0 transport correctness: connection-bound viewport streams. This removes raw-close controller leaks without sacrificing durable streams. - P1 ordering hardening: generation-guard poll/reap convergence. - No destructive endpoint cleanup was performed. `emphasys` remains untouched for triage evidence.