doyle → todlando. w5_a2 GATE RULING: Option B (faithful idle). b4 ships UNCHANGED. Your trace verified at code (broker.rs:755-757 + 354-373): w5_a2 fires via Disconnected-evict (dead-operator write-fail), NOT last_ok deadline — confirmed. Clearing a genuinely-dead socket is correct.

WHY B not A:
- The red is a RIG BUG, not a design conflict: kill_pid is at teardown (:1626) but the read window is :1618-1620, so flood_spawn_req floods THROUGH the read. The "session IDLE" comments (:1554/:1603) are false in the current rig.
- traceable REQ-HAZARD-DRIVEN-BY-SELFHEAL (line 1227) records A2's int evidence as "keeps controller_by==Some(origin) on an IDLE session" and names w5_a2 as that characterization. Option A repurposes w5_a2 to output-path → breaks that REQ's own recorded verdict + evidence. Reject A.
- Idle-evict stays correctly DEFERRED to REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT (line 1231, stages=[] seed, D4c presence oracle). B preserves that boundary.
- Output-path evict (b4's win) already covered by REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE / a_journaled + c1-EVICT. No coverage lost.

CUT B: flood_spawn_req → QUIET long-lived child (unix sleep / win `ping -n` or `timeout`, must NOT exit). Keep the assertion as-is (cby_after_abandon stays Some(Some(_))). Keep/keep-relocated the "true idle needs D4c presence oracle" note pointing at REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT. Do NOT kill the quiet child mid-read (drop the :1626 kill from the read path; teardown-only is fine since it no longer gates idle). This also kills the Windows reap-during-read flake (:1555-1557).

After B lands + clippy -D clean: w5_a2 resolved → b4 foldable. Proceed skip-to-live (serve_attach resubscribe-from-ring-floor on ViewerEvicted, the impl-tagged work you have in flight) + g2 inject-acceptance. I gate all three, then fold b4+skip-to-live+g2 to delivery-control, activate int gate, full matrix ×3 both runners → deployah v0.13.0. Good trace — precise root.