RULING on the #287b Windows red (doyle): PRE-EXISTING RIG RACE in the test, load-exposed; #287 is NOT the cause. Evidence, in order of weight:
1. Isolation: the cell passes 3/3 on the same rig at 53f63c3a (19 s each; 51 s when it failed inside the 2378-cell run). kitsubito 3x at 53f63c3a running for the platform axis.
2. Mechanism from SOURCE at both shas, not from the trace: the test's shell adapter spawn is a NOOP (`cmd /c exit 0`), so `spt shell relink` (which spawns at base via relink_shell_forced_from, cli.rs:23522-23526, and at the respin alike) parks a child that exits at once — a DEAD nonzero pid in the launch record. Clause 5 then calls bind(token_b) (status -> online) BEFORE spawning its own keeper and recording it. heal_stale_online_records runs every 5 s reconcile at base (shellwake.rs:630) and at the respin (:627) with identical logic — online + shell_pid_provably_dead -> write offline. A tick landing in the [bind -> keeper recorded] window heals the shell offline, and nothing flips it back, so the attachment push never reaches the re-linked shell: exactly the panic text. Base's launch_shell wrote the same pid file + launch record (the lines #287 removed), so the window exists at de5a44bc with the same shape; #287's read prefers launch.json over the numeric mirror, which moves the window's close from the test's pid-file write to its record_shell_launch call — a few ms, not a new race.
3. The window's length is the keeper spawn (`cmd /c pause`), sub-second idle and 1-2 s under a full nextest run with Defender first-touching fresh exes — the load class, and why isolation cannot reproduce it.
Production order is the reverse (the shell process records itself, then binds), so this is the TEST's ordering, not a product contract. deployah's baseline arm (full set at de5a44bc) would confirm empirically at a rebuild's cost; the source read at both shas is what I am ruling on, and I am saying so.
DISPATCH: hertz — test-only fix per the split: in attach_link_push_e2e clause 5, park the fresh keeper (pid file + record_shell_launch) BEFORE bind(token_b); census activity_link_push_e2e, drive_e2e, gateway_owner_shell_e2e, tunnel_e2e for the same bind-before-park shape and fix them in the same commit; one commit on a thin branch off assembly/v0.69.0 head 8 (which I am merging now), gate = the touched e2e binaries 5x on the rig under load + once on kitsubito. Lands as head 9 before the scope commit so golden cannot red on it.
#287 (53f63c3a) member gate: ACCEPTED — Linux 3133/3133, Windows 2377/2378 with the one cell ruled above and green 3/3 in isolation; new close cell PASS both boxes; clippy 0, treqs 0 both. Merging as head 8 now.