# UPDATE-WEDGE-2-SME — Round-3 RCA + Ruling

## Two-Failure Model

**Failure A (controller-steal)** — FIXED, commit fb499db/7782bda (`brain.rs:963`, `AttachIntent::Viewer`).
Field-confirmed: gen-1 brain resumed 4 sessions [1,2,4,3] all as Viewer, zero controller-steal.

**Failure B (IPC saturation on respawn)** — NOT fixed. This is what actually wedged HFENDULEAM on v0.30.4.

On brain swap, the single brain↔broker IPC connection was saturated by concurrent:
- 4-session Viewer resume-replay drain
- `BRAIN_NET_CONSUMERS_UP` net-consumer restart
- peer-dial fan-out (peers `ecb39e40`, `cfd9fc55`, each burning the full 10s submit-dial bound — 20s total on the boot path)

Result: blew the read budget → `PEER_PUMP_FAIL: brain IPC read deadline elapsed` + broker `STALL_EVICT:3` (controller writer for session 3 blocked >15s on saturated conn). Same symptom as the prior 0.30.3 wedge.

Box itself recovers clean (0.30.4 cold state healthy) — the defect is specifically in the respawn/resume path under live multi-session + real peer load.

## Why the gate missed it

Gate rig: single fast local broker, tiny replay, no real peer dials, no net-consumer restart. Never exercised the saturation path. This is a **gate rig blind spot**, not just a code gap — tracked as its own REQ below.

## Ruling — Round-3 scope

1. **REQUIRED, root cause**: make peer-dial fully async/deferred off the boot critical path. The 10s submit-dial bound × 2 dead peers = 20s on the boot path alone is the single biggest lever. If peer-dial isn't synchronous on respawn, the saturation window collapses regardless of the other legs.
2. **REQUIRED, defense in depth**: sequence net-consumer restart + peer-dial fan-out to run only after resume-replay settles. Don't let two concurrent bursts share the one brain↔broker conn during the fragile respawn window.
3. **REQUIRED**: bound/stream the resume viewer-replay (cap the initial ring batch) so N-session resume can't monopolize the conn read budget in one burst. Closes the gap for N>4 resumes not yet field-tested.
4. **DEFERRED (belt, not root)**: grace-window the stall-evict across `BRAIN_RESUMED`→ready+margin. Only pull this in if items 1–3 don't fully clear the wedge in field-verify.
5. **REQ (gate hardening)**: gate suite must gain a real peer-dial + net-consumer-restart-under-resume-replay case. Round-4 repeats this miss otherwise.

## Release note

v0.30.4 remains published + Latest, but fetch→apply wedges under live multi-session + peer-dial load. Operator still deciding Latest-tag handling pending round-3 fix landing.

## Dispatch

todlando: build items 1–3 above under a single REQ (mint on this doc), item 4 tracked separately as deferred, item 5 as a parallel gate-hardening REQ. Do not GO release until backpressure/async-dial fix is gated AND field-verified under real multi-session + peer-dial load — the gate rig alone will not catch a regression here again.

deployah: continue HOLD on round-3 ledger until field-verify (not just gate pass) clears, per the report-before-fix lesson from the round-2 miss.