# FAST-FOLLOW — refresh freezes (#49/#267) and console hitches (#302)

**Draft milestone body; operator relocation decision pending.** v0.70.0 ships diagnostics, not remedies. No execution or board changes authorized; release-build tree `c9663459` remains untouched.

## #49/#267 — observe the instrumented refresh/update path

1. **Bind and isolate.** Pin doyle/hertz's final v0.70.0 source SHA, executable path/hash/version/target and signed-set identity; rehash before running. Start the daemon with `SPT_PUMP_TRACE=1` in a new `SPT_HOME`; capture stderr from startup. Explicitly target that home on every invocation. Before refresh/apply/stop, verify home, socket and run-owned PID/ancestry exclude the resident fleet.
2. **Trigger the real transition.** Establish a disposable brain-owned controller/PTY with sustained, counter-and-generation-timestamped output and controlled reader backpressure; retain observer receipt timestamps and the outgoing connection/session mapping. Exercise a planned brain restart via an admitted refresh/update sequence. **Q3 requires a real `AppliedPending` update trial, readiness latched, and old-generation state still not drained: refresh alone does not establish a trial.** Admit a compatible brain-only signed update/reapply and verify it actually enters that state; without that prerequisite, report Q3 blocked rather than fabricate pending state. Capture `BRAIN_UPDATE_RESTART`, controller closure/eviction, trial generation and promotion/rollback outcome. Neither new event is guaranteed merely by issuing refresh.
3. **Answer the narrow questions.** **Q1:** `CONTROLLER_SLOT_CLOSED`, mapped to the outgoing `conn`/session, proves the occupied controller slot actually became empty. Preserve caller-supplied `cause=send_deadline|stall_evict|detach`; it does not prove a blocked writer exited or adjudicate clean-close causation. **Q3:** `BRAIN_PROMOTE_GATE_NOT_DRAINED` proves the promotion gate read not-drained after readiness, once per trial generation. It identifies neither the blocking session nor completion of the heartbeat's drain-driving call. Missing events mean “not observed,” not established absence.
4. **Return evidence.** Correlate output generation/receipt lag, tagged input acknowledgements/resulting state and one detach/reattach arm. Preserve transcripts, identities and Q1/Q3 verdicts. Bound observation to 300 s plus 120 s isolated teardown; label truncation and retain artifacts. An isolated negative does not clear the field reports.

## #302 — discriminate on the operator's box, then remedy

1. **Measure the affected runtime.** Once the operator's actual broker supports the v0.70.0 probe, use its explicit home and a second terminal during healthy/frozen/recovery intervals: `cmd /d /c "set SPT_RC_HITCH_DIAG=1&& spt node status --json"`. Preserve `net_canary_age_ms`, `active_dial_tasks`, `sampled_at_ms`, `query_elapsed_ms`, and timestamped real local/remote PTY echo/output. The fresh IPC probe is bounded at 2 s; unsupported, null or timed-out readings are inconclusive, not healthy. If admitted, use the preserved five-line cadence experiment: back up config, set all three periods to 600000 ms, `node refresh`, let priming settle, observe ~2 minutes, restore exact bytes and refresh. Disappearance plus return supports pump-round attribution, not #1 versus #2; wake rounds remain possible.
2. **Choose conditionally.** Seconds-stale canary plus hitch-correlated active dials supports **#1 (runtime starvation)**: pursue **seam B**, quarantining both `dial` and `submit_dial` behind `NetHost`, retaining the shared 24-permit cap, errors and cancellation. Hand successful connections to the serving executor **before registration**; keep acceptors/readers, endpoint I/O and canary protected. Fresh canary instead directs investigation toward **#2 (synchronous broker/stream wait)**: establish its rc dependency before remedy. Cadence evidence alone does not select B.
3. **Prove with unchanged gauges.** Repeat the local/remote workload with comparable active dials. For B/#1 require fresh serving canary, prompt PTY traffic without burst-drain and bounded ordinary dial errors; retain before/after timestamps and targeted dial/replay/restart/EOF guards. Disabling dials or moving the canary is not proof. Keep the two investigations separate absent measured linkage.

Execution references: prior `docs/49-267-REFRESH-OBSERVATION-PLAN.md` (measurement/teardown rules only; old admission and byte pin superseded), `.spt/preserved/302/RUNBOOK-five-lines.txt`, and `.spt/preserved/302/REMEDY-DESIGN.md` (conditional seam hazards and named guards).