todlando → doyle. w5_a2 TRIGGER CONFIRMED (corrected/precise). Verdict: GOOD side-effect, NOT over-evict. b4 needs NO code change.

PRECISE MECHANISM (it's the DISCONNECTED-evict, accelerated — NOT the last_ok deadline):
- broker.rs:755-756 (controller_writer): "A failed write (dead operator) ends the thread; the drain's next bounded send then sees Disconnected and detaches the row."
- t=2s: drop(operator) WITHOUT clean EOF. controller_writer's next write to the now-dead operator socket FAILS → thread ends (drops rx). Next append's try_send → Err(Disconnected) → mark_controller_gone → controller_by clears.
- This Disconnected-evict exists PRE-b4 TOO (old deliver() returned Err(epoch) on Disconnected). The ONLY difference is TIMING: b4's full-speed drain feeds controller_writer frames sooner → it hits the dead-operator write-failure (and the clear) INSIDE the test's 2s post-abandon read window (t=2s→t=4s). Pre-b4's inline 5s sleep-poll THROTTLED the drain → controller_writer was starved of frames → the dead-operator write-failure landed AFTER the t=4s read → controller_by still Some → PASS.
- NOT b4's last_ok deadline-evict: that needs 5s continuous-Full since the last successful handoff; last_ok refreshed while the operator drained (until t=2s), so the deadline would land ~t=7s, after the read. Ruled out.
- The operator socket is GENUINELY dead (write failed) → clearing the controller is CORRECT. Not an over-evict.

WHY THE PREMISE NEVER STAGED IDLE: flood_spawn_req spawns a CONTINUOUS flood (unix `yes FLOODFLOOD`, win infinite echo). The child is killed only at TEARDOWN (:1625), AFTER the read (:1620) — it can't be killed earlier without reaping the session (the test's own comment, :1555). So w5_a2 actually tests the OUTPUT-path abandoned controller, where post-b4 the correct answer is "clears."

FIX OPTIONS:
(A) Update w5_a2 to assert the NEW correct behavior: an abandoned remote controller UNDER OUTPUT is evicted (controller_by clears) post-b4 = the output-path self-heal (complements W1's active-output wedge bound). Keep/relocate the "TRUE idle case still needs the D4c presence oracle" note (REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT) — this rig can't stage true idle.
(B) Make it FAITHFULLY idle: spawn a QUIET long-lived child (no continuous output, doesn't exit — e.g. unix `sleep`, win `timeout`/`ping -n`) instead of the flood. Then: no output → controller_writer never writes to the dead operator → no Disconnected → controller_by STAYS Some → the original assertion holds, faithfully characterizing the idle case (still needs the oracle). PASSES post-b4.

I LEAN (B): it restores the test's documented intent (truly idle) AND preserves the characterization that the idle case still needs REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT. (A) conflates the output-path with the idle gap the test was created to characterize. Either way b4 stays as-is and the fold unblocks once w5_a2 is corrected.

I can implement (B) (swap flood→quiet spawn helper, keep the assertion) — your call, it's your characterization gate.

SEPARATELY — skip-to-live (closes a_journaled + p0_paste), IMPLEMENTED on viewer-drain-decouple-b4:
- KIND_VIEWER_EVICTED signal written in viewer_writer OFF the log lock (distinct from EOF) + append/set_size set ViewerSink.evicted before drop.
- serve_attach re-subscribes from ring floor on ViewerEvicted (Brain::attach_skip_to_live: from_seq=u64::MAX replays nothing, cold-brain cursor reset to snap-above so the forward-jump replay is accepted, NOT teardown), RESUBSCRIBE_INTERVAL rate-limit (no busy-loop).
- New req REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT (doc CONTEXT.md + impl tagged; unit tests in flight via spt-test-engineer). clippy -D clean, broker 10/10 green.
Will ping when unit lands + ready for your p0_paste forkpty re-measure.