#49 / #267 -- DISCRIMINATOR REVISED. Two of my four questions do not survive contact with the
emission sites, and the source contains a docstring that reframes the whole thing. Nothing run.

== 0. THE IDENTICAL-PATHS CLAIM: RIGHT ANSWER, WRONG TEST. NOW TESTED PROPERLY ==

You are right that main...3e7eaf67 compares from the merge base. Re-verified by ENDPOINT BLOB
EQUALITY:

  brainproc.rs   main a327d0f4 == lane a327d0f4   IDENTICAL
  broker.rs      main 4c58d297 == lane 4c58d297   IDENTICAL
  applyhost.rs   main 09b7bb98 == lane 09b7bb98   IDENTICAL
  rc.rs          main 20d7227f != lane 00da28a0   DIFFER

Merge base is f020c4c7, and main has gained NOTHING on those four files since it. So the conclusion
stands, but it stands on blob identity now rather than on a diff that could not have shown me main's
own drift.

== 1. Q1 IS DEAD. THE TOKEN I PROPOSED CANNOT ANSWER THE QUESTION ==

BRAIN_CONN_RETIRED has exactly ONE emission site in the tree:

  livehost.rs:1042   "BRAIN_CONN_RETIRED: caller=livehost-session-query reason=query-error ..."

That is a session-query error path. It is not a brain-cycle conn-close path and would not fire on a
refresh whatever the outgoing conn did. So its absence around a refresh would have proved NOTHING,
and I would have read a clean zero from a predicate that cannot express the hunt. Your point 1 is
right and the situation is worse than "not observed": the predicate was never alive for this
question. Q1 is WITHDRAWN, not weakened.

I found no existing token that observes the outgoing generation's conn closing. Recording Q1 as
UNRESOLVED FROM EXISTING INSTRUMENTS rather than substituting a proxy.

== 2. Q3 IS UNRESOLVED. NOTHING EMITS THE GATE'S VERDICT ==

The DRAINED gate is a PURE PREDICATE with no emission: `local_controller_wedged` (broker.rs:2815)
returns a bool and logs nothing, and a grep for any emitted promote/drain verdict returns empty. So
promotion-after-eviction would have been ordering and nothing more, exactly as you said. There is no
existing gate-state observation, so per your instruction Q3 IS MARKED UNRESOLVED.

== 3. THE SOURCE ITSELF STATES THE MECHANISM -- AND EXCLUDES THE USER'S CONNECTION FROM IT ==

broker.rs:2806-2812, the docstring over that gate, is the most load-bearing thing I have read in this
whole archaeology:

  "Whether this session's controller is the brain's OWN LOCAL conn (`by: None`) AND wedged past
   `deadline` -- the brain-generation promotion DRAINED gate reads it (REQ-UPDATE-PROMOTE-DRAINED).
   A killed OLD brain generation whose local controller conn is black-holed reads wedged here until
   the W2 stall-evict releases it (or the conn EOFs); a cleanly-closed conn is simply absent. A
   REMOTE operator's wedged conn (`by: Some`) is the W2 stall-evict concern, NOT an old-gen brain
   conn, so it is EXCLUDED -- a stuck remote viewer must never gate a brain promotion."

Three things follow, and the third cuts against my own hypothesis:

  (a) The code states the killed-generation black-hole mechanism in its own voice, and names the
      clean-close contrast the deferred seed was minted to build. That is corroboration of the
      MECHANISM'S EXISTENCE, still not of its occurrence in the field.
  (b) "or the conn EOFs" -- the source contemplates EOF as a release path. My withdrawn "no EOF"
      claim was not just unestablished, it was contradicted by the code.
  (c) THE GATE EXCLUDES `by: Some` CONNS BY DESIGN. The user's rc viewport is a remote/operator
      conn. So the promotion DRAINED gate and the freeze an rc user sees are DIFFERENT OBJECTS: the
      gate concerns the old brain's own local conn, while a user's wedged viewport is the W2
      stall-evict concern. A version of my hypothesis that routes the user's freeze through the
      promotion gate is wrong on the code's own terms. What the two share is the 15 s deadline, not
      the gate.

== 4. THE REVISED DISCRIMINATOR ==

Surviving question, with real emission and real attribution:

  Q2  DOES A BLOCKED SINK REACH EVICTION, AND FOR WHICH SESSION AND CONN?
      BRAIN_SUBSCRIBER_STALL_EVICT, two sites: broker.rs:2842 and :3787. Both carry `conn={conn}`
      and a session id, so every event is attributable to a connection and a session rather than
      counted in aggregate. Presence tells us the blocked-write path ran for that conn; absence,
      given the sites are on the controller-writer path, is meaningful but still bounded by whether
      the capture was complete.
      NOT A DEADLINE MEASUREMENT: evict-minus-t0 is the interval from the restart signal, and the
      sink deadline is measured from BLOCKED-WRITE ONSET, which nothing emits. Those differ by
      however long the conn kept moving after t0. So Q2 yields ordering and attribution, NOT a
      confirmation of the 15 s figure.

  Q4  WHAT SURVIVES REATTACH? rc-side observable after a detach and fresh attach. Noting your
      earlier correction: reattach recreates server-side attach state as well as client-side, so a
      recovery here localizes nothing on its own.

  FREEZE DURATION, framed as you required: a finite observation can show RECOVERY AFTER A MEASURED
  INTERVAL, or NO RECOVERY WITHIN THE OBSERVED INTERVAL. It cannot show an unbounded freeze, and I
  will not write one down.

  t0 = BRAIN_UPDATE_RESTART (brainproc.rs:1081). Generation attribution is available on
  BRAIN_PROMOTED, which carries `generation {generation}`; I have NOT verified that every other
  token on this path carries a generation, so cross-generation attribution is itself a gap.

== 5. THE BOUNDED EXPERIMENT, PREPARED NOT REQUESTED ==

  ISOLATION, and this is the non-negotiable part: an ISOLATED daemon under its own SPT_HOME with its
  own broker socket, and a DISPOSABLE attached session created for the run. THE RESIDENT FLEET
  DAEMON IS NEVER REFRESHED -- 18 spt.exe processes on this box authenticate to the resident daemon
  at pid 4732, including agent perches and this session's own, and refreshing it would cycle the
  fleet's brain to answer a question about a test session.
  SHAPE: isolated home absent beforehand and created for the run; one disposable PTY session; one
  attached rc; daemon stderr captured to a file for the whole window; exactly one `daemon refresh`;
  observation continues for a stated fixed interval after t0; then detach and one fresh attach for
  Q4.
  CLEANUP CONDITIONS: stop the isolated daemon, confirm its brain and broker are gone by pid and by
  socket, remove the isolated home only after the captured log is copied out, and verify no process
  from the run survives by ancestry rather than by name. Nothing in the resident fleet is touched at
  any point; if the isolated daemon cannot be brought up cleanly, the run does not start.

  REMAINING OBSERVATION GAPS, stated up front so a green read is not over-claimed:
   - no observable for the outgoing conn's close (Q1 withdrawn)
   - no observable for the DRAINED gate's verdict (Q3 unresolved)
   - no observable for blocked-write onset, so the sink deadline is not measurable
   - generation attribution unverified on tokens other than BRAIN_PROMOTED
   - one isolated daemon with one session is not the field's condition, and a negative result there
     would not clear the field path

No execution requested, no instrumentation proposed. W2 holds the window.