## What this is

Two FLAKE-LEDGER rows doyle queued from the W1 #249 kitsubito battery, and the census
behind them. The rows turned out to name a class, not two tests, so the fix is at the
recipe.

**Evidence:** `.spt/preserved/w1-kitsubito-8d980fdf/nextest.raw`, sha256
`9c456e21a6a0f75d8b0375ac648f232dba07f3887ec5e8dc232daef36253b51e`, hash-verified against
the kitsubito original. ONE Summary, `nextest exit 100`,
`2999 tests run: 2997 passed (8 slow, 1 leaky), 2 failed, 1 skipped`, `panicked at` = 2.

## The two reds

Both are a 45 s wait on `brain.ready` that expired, in the same window:
`resident_service_e2e` :453 (53 s) and `resume_no_control_steal_e2e` (46 s).

Rows are keyed on the **message**, not the rendered line. `resume_no_control_steal`'s `:358`
is `teardown_panic`'s funnel `panic!`, shared by every failing arm in the file — a row keyed
there would silently absorb an unrelated future red. The real key is
`the trial candidate never stamped brain.ready` (the `:490` wait).

The `:453` row also corrects its own assert. **"PRECONDITION: the daemon never came up" is
false as rendered:** the panel that assert prints shows `BRAIN_UP`, both `BRAIN_PHASE`s done
in 0–1 ms, `SERVICE_STARTED` for both services, and both reaped with an empty survivor set.
The witness expired; the daemon did not fail. This replaces the corresponding line in the W1
gate checklist.

**Not concluded:** where the 45 s went. Nothing stamps the interval between the daemon
child's spawn and the brain's first log line, so v0.66.0's ~10.1 s exe-hash is a candidate
and can be nothing more. Filed as **IR-77**.

The discriminator that makes this load and not logic is doyle's control leg, which re-ran
both reds isolated in the same pool: exit 0, ONE Summary `2 run: 2 passed`, at 10.47 s and
11.92 s against budgets they had just consumed 46 s and 53 s of.

## The census (the actual finding)

Neither victim had ever been in the HEAVY class. Reading every `crates/spt/tests/*.rs`
against `.config/nextest.toml`'s **own** criterion — an `.args(["daemon", "run"])` spawn, or
a real brain tree via `supervise_brain` / `spt daemon brain` — found **eleven** qualifying
binaries outside the member list:

`activity_link_push_e2e`, `coordinator_image_e2e`, `endpoint_autostart_e2e`,
`idle_edge_drain_e2e`, `idle_edge_seal_e2e`, `n1_compat`, `resident_service_e2e`,
`resume_no_control_steal_e2e`, `trial_drain_drive_e2e`, `twohost_cli`,
`webserve_cross_node_e2e`.

All eleven join both `<HEAVY>` strings, per the HEAVY-AT-BIRTH ruling: nine carry no
sighting and are classified by criterion, because a first flake is not the evidence that
ruling waits for. Corroboration found while censusing, not sought:
`.github/ci/flake-registry.json` already carries `activity_link_push_e2e` as an ACTIVE Linux
flake — a registered flake that had been a light-pool daemon-tree binary the whole time.

**Phase-B growth, the number that gated shipping all eleven:** the nine with no sighting
cost **420.7 s = 7.0 min** of terminal Phase-A time in the preserved raw — an upper bound,
since serialized on a quiet box each runs no slower than it did loaded. Under the ~20 min
respin bound doyle set. My first pass reported 11.0 min and was wrong: it double-counted
each `SLOW [> 60.000s]` warning line against that same cell's terminal `PASS` line. The
figure above counts terminal lines only.

## The gate, so this is not a sweep applied to whoever we looked at

`xtask check` gains `check_heavy_integration_classification`, deriving the qualifying set
from the criterion and failing when a qualifying binary is absent. Four unit tests run its
failure modes forward, including an absent HEAVY line reading as ABSENT rather than as an
empty match that would classify every binary as unlisted.

**It found a drift on its first run.** `twohost_web` entered golden.yml's job-level `HEAVY`
env with W1 `8d980fdf` and never entered `.config/nextest.toml`'s test-group override — so
for one commit golden excluded it from Phase A and then admitted it to Phase B *without* the
`heavy-broker-pty` cap. Repaired here, and the repair rides THIS lane by doyle's ruling: W1 is landed, so it is no
longer todlando's lane to carry, and under ff-only main the first PR to land carries it. The
two strings are byte-equal and stay so by gate.

## The 5474 hygiene sweep

The `:453` panel carries `DOCS_SERVER_BIND_FAIL: port 5474: Address already in use (os error
98)` twice — the rig daemon losing the well-known docs port to kitsubito's resident perch
daemon. `EADDRINUSE` returns immediately and the daemon continues by design, so it is
charged with **neither** red. Fixed as hygiene, at every site rather than the two that
happened to fail: all 37 remaining rig `spt daemon run` spawns across 31 files now set
`SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1`, taking the pattern and its constant from
`engine_room_bringup_e2e`, which already did this. None of the 31 asserts on a docs port.

## Served-URL census (the rig-safety gate on this lane)

todlando found that under `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` the docs LISTENER moves but the
`spt serve` CLI still mints its URL from `DaemonConfig.docs_port` / `SPT_DOCS_PORT`
(`crates/spt/src/serveverb.rs:84`, `resolve_docs_port` — which never sees the flag and never sees
the bound port), so a rig that mints or fetches a served URL under the flag talks to **5474, the
live fleet daemon's listener**. Product defect filed as **releases#282**; not built here.

Censused all `crates/*/tests` for served-URL traffic — `serve` as a CLI arg, `docs url`, an HTTP
request, a `/f/` or `/m/` path, `SPT_DOCS_PORT`, a bound-port read:

- **Of the 31 rigs this lane touches: ZERO have served-URL traffic.** The flag sweep therefore
  makes nothing worse; it moves listeners belonging to rigs that never mint or fetch a URL.
- **Rigs with genuine URL traffic: 4, and all 4 already take their port from the real listener**,
  so **0 need pinning and 0 are left talking to 5474**: `spt/webserve_cross_node_e2e` reads it off
  the daemon's own `DOCS_SERVER_UP:` line (`docs_port()`, :157 — "the rig asks each daemon what it
  is"); `spt-daemon/webserve_e2e` and `spt-daemon/docs_server_e2e` call `start_serving(..., 0)` and
  use the returned port; `spt-daemon/twohost_web` runs on the rig's own explicit port pair plus
  `PORT_OFFSET`. The fourth is doyle's, found spot-checking this census at `ff4b405d`: my tightened
  predicate list had dropped `start_serving` after the first loose pass flagged that file, so my
  own count read 3. The verdict is unchanged — same safe shape — but the number was wrong.
- **Two false positives, named so the next reader does not re-derive them:** `oneliner_e2e`'s
  `curl` is a comment about which shell the curl-pipe target is, and
  `spt-daemon/servicehost_supervision_e2e`'s `"serve"` is a service NAMED serve.

**A correction to the prescribed remedy, from the same measurement.** Pinning one
`SPT_DOCS_PORT` while the flag stays set does NOT make URL and listener one number: the flag wins.
`resolve_daemon_docs_port` returns `0` before the env override is read
(`crates/spt-daemon/src/docshost.rs`), which is exactly what **IR-78** files and exactly what doyle
measured on both boxes — `SPT_DOCS_PORT=5480` set, `DOCS_SERVER_UP` on 55369 and 44015. A pinned
rig under the flag would mint 5493 and listen somewhere else. For a URL-minting rig the two shapes
that work are: drop the flag and pin a non-5474 port so both numbers are 5493, or read the bound
port — and reading the bound port is what all three rigs already do.

## What this does NOT do

- **No deadline is retuned.** A budget raise is the same race with a different number.
- **The autostart path is only half measured.** doyle measured that the Windows WMI rung
  carries the caller's environment (rig daemon pid 50088, `DAEMON_LAUNCH_VIA_WMI`, environ
  carrying `SPT_HOME`/`SPT_DOCS_PORT`/the rig flag, `brain.ready` in the rig home). The
  schtasks at-logon rung and the unix path are **not** measured.
- **No `flake-registry.json` entries.** The harden ships in this same commit, so an entry
  would be born retired — the `servicehost_supervision_e2e` precedent — and the sighting is a
  local builder battery with no CI run id to confirm against.
- **The rows stay OPEN.** The harden is a prediction until these binaries are seen executing
  in Phase B. Pre-registered discriminator: serialized on the quiet box they run one at a
  time, and a red *there* refutes the pool mechanism and re-opens the box/product question.

## Two meter errors caught in this lane, recorded because they were mine

Neither reached a verdict, both were caught by re-reading rather than by a red, and both are the
same shape as the defect this PR fixes — an instrument that reports the state you were thinking
about while you wrote it.

1. **A two-arm completion poll fails OPEN.** My watcher broke on `[ "$r" != "0" ]`, so an `ssh`
   that returned nothing satisfied it: it printed `BATTERY DONE at iteration 1` while the clippy
   leg was still mid-flight. This is IR-76's own ruling — an empty `gh run list` is the same bytes
   for CLEAR and for a broken meter — applied to a poll instead of a gate, and I had that ruling in
   hand when I wrote the two-arm version. Re-armed with three arms (`DONE` / `RUNNING` /
   `METER BROKEN`), where the third does not stop the poll, and every claim here is taken from the
   per-leg exit FILE rather than from the watcher or from the harness's "task completed".
2. **A `pool-release` through a non-login `ssh` had no `cargo` on PATH** (the kitsubito trap), and
   the `release_exit=0` I nearly reported was the trailing `echo`'s exit, not cargo's. Re-run under
   `bash -lc` with the exit captured to a file: `REAL_EXIT=0`, `pool released (still owned by
   /home/reavus/spt-hertz-rigports)`.

A third reading was suspicious rather than wrong and is recorded for the same reason: `clippy
--workspace --all-targets` finishing in 40.6 s looked impossible for a cold pool, so I went looking
for a redirected `CARGO_TARGET_DIR` or an `RUSTC_WRAPPER` before believing it. Neither exists on
that box; every artifact mtime in the pool starts at the battery's start second.

## Register

**IR-77** — no breadcrumb between daemon-child spawn and the brain's first log line.
**IR-78** — the rig port flag silently overrides a set `SPT_DOCS_PORT` (doyle measured
`DOCS_SERVER_UP` on 55369 Windows / 44015 Linux while `SPT_DOCS_PORT=5480` was ignored
without a word).

## Battery

`traceable-reqs check` exit 0 (hfenduleam; NOT run on kitsubito — IR-75, not installed
there, it would exit 127 vacuous).

**kitsubito** (own clone `~/spt-hertz-rigports`, own pool claimed as `rigports`, detached under
flock, `procs-before: 0`, 407 GB free, HEAD `ff4b405d`, tracked-dirty 0). Exit FILES read per leg,
not the harness notification:

| leg | exit | note |
|---|---|---|
| `pool-claim` | 0 | |
| `cargo build -p spt --bins` | 0 | 119 units, 52.1 s |
| `cargo clippy --workspace --all-targets -- -D warnings` | 0 | 334 check units, 40.6 s |
| `cargo run -p xtask -- check` | 0 | the new census gate passing against this repo |
| `cargo nextest run --no-fail-fast -E binary(resident_service_e2e) + binary(resume_no_control_steal_e2e) + package(xtask)` | 0 | ONE Summary, `100 tests run: 100 passed, 0 skipped`, `panicked at` = 0 |

Both former victims PASS on the quiet box: `resident_service_e2e` 11.479 s and
`resume_no_control_steal_e2e` 11.916 s, against the 46 s and 53 s they consumed under the loaded
Phase-A pool — the same under-budget/at-budget split doyle's control leg measured (10.47 s /
11.92 s). All four new `heavy_integration_tests` cells pass.

**The 31 edited files are proven, not assumed:** the nextest leg builds every workspace test
target (the `-E` filter selects what RUNS, not what is BUILT), and all 31 edited binaries were
found freshly linked in `target/debug/deps` after it — 31 of 31, none missing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01WAw9XAcTR8oSwzYPsqZoY2