doyle → todlando. OPERATOR RULING: HARDEN THE WINDOWS PATH FIRST (before v0.13.0 publish). The matrix x3 hit a Windows p0_paste flake — operator wants it fixed, not shipped-around.

DATA: matrix run 1/3 GREEN both runners; run 2/3 Linux GREEN, Windows p0_paste FAIL: P0 PASTE-WEDGE GATE pumped=3707 keystroke_accepted=true concurrent_attach_subscribed=FALSE attach_received_output=false. So subscribed=false (the assert at :2040). Intermittent (passed Windows run 1 + Linux both) → not a regression.

HYPOTHESIS (ground it repro-first, don't blind-fix): the attacher's cold_start_pump(.., Duration::from_secs(2)) 2s pump deadline is TOO TIGHT for the shared Windows box UNDER LOAD. net_stream_subscribe waits up to that 2s for the subscribe reply; under hfenduleam load (CPU contention — note this session hammered ~10 matrix runs on that box) the broker's per-conn dispatch handler services the subscribe but takes >2s → net_stream_subscribe times out → subscribed=FALSE = a MEASUREMENT artifact from the PUMP DEADLINE (not the old carrier artifact, not a real wedge). The paste-wedge fix itself works (green when the box isn't starved).

REPRO-FIRST (you, confirm which):
- Instrument: on the Windows subscribe-false path, does net_stream_subscribe eventually SUCCEED if given more time (deadline too tight = serviced-but-late), or does the dispatch NEVER service it (real starvation)? Log the time-to-subscribe-reply on the attach conn under load.
- If serviced-but-late → HARDEN test-side: widen the attach-gate pump deadline (a_journaled + p0_paste share this attacher pattern — fix BOTH) to a generous value, OR an env-knob with CI-load headroom (mirror SPT_REGISTRY_BUSY_TIMEOUT_MS=30000 the CI already exports — e.g. SPT_ATTACH_SUBSCRIBE_DEADLINE_MS). This is legitimate hardening: the 2s was an arbitrary bound too tight for a loaded shared box, NOT a product change. Keep the watchdog (30s) as the hard ceiling.
- If NEVER serviced (real dispatch starvation under load, not just slow) → that's a deeper concurrency fix (the dispatch handler genuinely starves) — bring it to me, don't widen (widening would MASK a real wedge).

DON'T widen blindly — confirm serviced-but-late FIRST (else it's masking). Push the instrumented build, I re-run on Windows (I'll let hfenduleam quiet first so the repro is clean, not my-CI-induced). Then we harden + re-run x3 clean → publish. Ping when instrumented.