todlando — EXECUTION END 2026-09-11T09:20:2xZ, one attempt, no retry. hertz: box free. doyle: push can lift. RESULT IS RED AGAIN AND MY FIX IS REFUTED — outcome 3 in the prediction file, classification returns to OPEN.

FIXED RUN: 1 test, 0 passed, 1 FAILED, 0.456 s, exit 100. Admission 09:19:50Z FREE=192,469,774,336, builders 0, test binaries 0.
  ARM_OPEN  arm=n-1-control                  viewport_stream=2 serve_stream=1 conn=1
  ARM_DONE  arm=n-1-control                  policies=-1                                  <- PASSED
  ARM_OPEN  arm=n-1-control-second-position  viewport_stream=2 serve_stream=1 conn=1
  FAIL      [n-1-control-second-position] operator broker error: BROKEN PIPE
  STREAM_CONNBOUND_RETIRE:2: opener conn exited — FIN + terminal retire

THE ERROR CHANGED, AND THAT IS THE INFORMATION. It was "no such stream 2"; with one shared operator conn it is now "broken pipe" on that same shared conn. So the second arm does not fail for want of a stream row — it fails because THE OPERATOR'S OWN CONN IS DEAD BY THEN. The retire still fires, so a conn still exits between arms, and with the per-arm operator removed the only thing left that ends at an arm boundary is MY DETACH: the helper closes an arm with net_stream_send(stream_b, &[], None, true), the FIN, exactly as attach_drive_detach does.
NEW LEADING CANDIDATE, stated as a candidate: on this loopback pair a FIN on the viewport row does not merely end that row, it takes the conn with it. The existing passing helper cannot see this because it attaches ONCE and never uses its operator again afterwards — nobody has ever looked at that conn after the detach. That would also explain why probe (a) is green and always will be.
STILL UNEXPLAINED, unchanged and not quietly dropped: run 1's position-1 failure, identity declared, with no prior arm and no prior detach. Nothing I have measured yet touches that case.
ALSO NOTE, against my own fix: ARM_OPEN prints viewport_stream=2 for BOTH arms on ONE shared conn. Under doyle's monotonic-per-NetHost read a second open on a live conn should not hand back the id the first one used, so either the id is per-conn-and-freed on retire or the second open is not happening where I think. I am not building a third mechanism on top of that observation; it goes in the register as an anomaly to read.

WHAT I AM DOING NEXT, and it is deliberately the boring option rather than a third clever one: split the four arms into four INDEPENDENT cells, each with its own broker, its own session and its own operator, so no arm can inherit another's conn state at all. That removes the whole cross-arm lifecycle class instead of patching one path through it, and it costs four brokers instead of one. If a single-arm cell with a declared identity still reds on a fresh broker, then the ClientPolicy push is the product defect with nothing else left standing — and that is the shape of test I should have written first.
REQ-ATTACH-CLIENT-STALE int stays MEASURED RED. doc/impl/unit unchanged and green, and the #300 substrate rows are untouched by any of this. Test changes remain uncommitted. Evidence: run-fixed.{stdout,stderr} and fixed-run-prediction.txt under .spt/preserved/remote-friction-304/todlando-product-build/.