doyle → todlando. G2 ROOT GATE — your trace REFUTES root #2 and narrows to a root-#1 variant. Hard data from forkpty (run d45d771, Linux kitsubito):

DEFINITIVE:
- G2_READER_TRACE[OPERATOR_KEYS_FLUSHED]: FIRST event = Subscribed{outcome:Controller}; then TIMEOUT, acc_len=0. SAME for RAW_FALLBACK_MARKER. So the reader gets ZERO Output — NOT an "output gap" reject. ROOT #2 (reader reject-gap) is REFUTED. The reader isn't gapping, it's receiving NOTHING. (My reader-gap lean was wrong — good thing we repro'd first.)
- acc_len=0 on a from_seq=0 attach = the REPLAY delivered nothing = the RING IS EMPTY = no output was ever echoed to the ring. The keystrokes never reached the PTY.
- TRANSLATION_FAULT: "no {commit} within INJECT_COMMIT_DEADLINE — terminating binary, reverting to raw inject" DID fire.
- PROBLEM: your floor trace (flush_inject_floor / write_input / FLOOR OPEN) appeared ZERO times in the ENTIRE Linux log — not even in the SPT_WEDGE_TRACE=1 diagnostic step. So I can't see whether the flush fired. Either the env didn't reach your trace, or the trace sits on a path that didn't execute, or the flush genuinely didn't happen.

NARROWED HYPOTHESIS (root #1 variant, you confirm): the deadline-FAULT → revert-to-raw-inject path does NOT flush the buffered floor keystrokes to the PTY on Linux (it works on Windows). g2 is the NO-COMMIT FAULT case: keystrokes typed during the floor-hold are BUFFERED; the binary faults; on revert-to-raw the buffered floor must flush. If the FAULT-revert path skips the floor flush (vs the normal release path), → no echo → empty ring → reader acc_len=0. The reader-zero-output is the SYMPTOM; the missing flush is the cause.

ALSO NEW: output_contains_within attaches as a CONTROLLER (brain.attach=Control intent), not a Viewer — it displaces the test's real controller. Probably incidental (the replay should still deliver), but note it.

NEXT (you, repro-first round 2): 
1. FIX your floor trace so it actually FIRES on Linux — make it an UNCONDITIONAL eprintln (not env-gated) at: (a) the floor-flush callsite, (b) the deadline-FAULT revert-to-raw path, (c) write_input entry with byte count. Confirm whether the FAULT-revert flushes the buffered floor on Linux.
2. Trace whether the g2 SESSION produces ANY output to the ring on Linux (the child echo) — acc_len=0 says no; confirm the ring is empty.
Push, I re-run forkpty, gate the confirmed root, THEN you cut the fix (likely: flush the buffered floor on the FAULT-revert path). Don't fix yet — confirm the flush-on-fault gap first.