todlando — TRACE PRODUCER END 2026-09-11T10:24Z. Open 10:23Z -> 10:24Z against a 300 s cap. One attempt. Box FREE — hertz's 600 s window for producer 3 at 28d4eb68 is unblocked. EXIT 0, PASS, same blob 0845e68d. GREEN FOR THE RIGHT REASON: all four checks CONFIRMED, pasted from the trace, not from memory.

(1) FIVE ARM_OPEN / ARM_DONE PAIRS, ALL MATCHED — 10 lines, every arm named:
  ARM_OPEN arm=n-1-control                  op_seq=2 viewport_stream=2  serve_stream=1 conn=1
  ARM_DONE arm=n-1-control                  policies=-1
  ARM_OPEN arm=n-1-control-second-position  op_seq=3 viewport_stream=4  serve_stream=3 conn=1
  ARM_DONE arm=n-1-control-second-position  policies=-1
  ARM_OPEN arm=stale-windows-controller     op_seq=4 viewport_stream=6  serve_stream=5 conn=1
  ARM_DONE arm=stale-windows-controller     policies=2
  ARM_OPEN arm=stale-windows-viewer         op_seq=5 viewport_stream=8  serve_stream=7 conn=1
  ARM_DONE arm=stale-windows-viewer         policies=0
  ARM_OPEN arm=this-build-controller        op_seq=6 viewport_stream=10 serve_stream=9 conn=1
  ARM_DONE arm=this-build-controller        policies=0
(2) SERVE_STREAMS ALL DISTINCT: 1, 3, 5, 7, 9. Viewports too: 2, 4, 6, 8, 10. The replay that handed every arm arm-1's stream is gone, and it is gone by measurement rather than by my reading of the helper.
(3) GENS ALL DISTINCT: 1789122213222 / 235 / 246 / 261 / 270. The coarse-clock collision I withdrew stays withdrawn — five Requests, five generations, no two alike, on the same box that produced two identical ones when they were one Request replayed.
(4) NO DETACH BETWEEN TWO LIVE ARMS. Every session-detach sits strictly INSIDE its own arm's OPEN..DONE bracket; the ordered interleaving is five clean [OPEN → controller-attach → session-detach → DONE] blocks. The viewer arm is correctly the odd one: was_controller=FALSE, viewers_dropped=1, and no controller-attach at all, because it never took controls. The REFUSED outcome from my first prediction file — green with a retire landing between live arms — did not occur.

WHAT THE POLICY COUNTS SAY, which is the requirement's actual content and is now on the record as numbers:
  identity-free, first position  -> policies=-1 (None)        never advised
  identity-free, second position -> policies=-1 (None)        position changes nothing
  stale Windows CONTROLLER       -> policies=2 (non-empty)    told about the demonstrated defect, both entries applicable, one naming releases#223
  stale Windows VIEWER           -> policies=0 (Some empty)   reached by the same transport, told nothing applies to its ROLE
  this build's own controller    -> policies=0 (Some empty)   never advised against itself
That last pair is the discrimination the requirement exists for, and until this run neither had ever executed.

REQ-ATTACH-CLIENT-STALE int: GREEN at 0845e68d, five arms, mechanism confirmed. Nothing about the seat, the lease or the generation is in question — every failure in this cell's history was a rig re-entering a retired or deduped identifier, four times, three of them mine.

Moving to the producer-5 rider now, in the order you set: register REQ-WEB-PROXY-LOCATION-NAMESPACE in traceable-reqs.toml FIRST, then build in my own pool. NO execution of its unit until you name the box free after hertz's window and your post-merge run. The relay fix goes in docshost.rs on the response path; hertz's :592 stays untouched and the int tag is his to add after mine lands.