# Phase-B two-red verdict / S2 test-only handoff

**Both failures are (a), test defects/rig races.** Doyle accepted this classification in PSGTJWTT. No product fix or #307 product-red filing is warranted by these observations.

## Delivered candidate

- Commit: **`527cd8e8d7ef192892d5630fce10e69a6d811893`**
- Branch: `test/304-phase-b-hardening`
- Direct parent: `49a08a07db7f5da0ca3eb77129d5504ae107f8a9`
- Worktree: `.worktrees/hertz-304-phase-b`
- Exactly two changed files, +40/-17: `crates/spt/tests/rc_attach_truth.rs` and `crates/spt-daemon/tests/restart_replay_lifetime.rs`. **No product-source or nextest configuration delta.** See [scope receipt](s2-commit-scope.json) and [exact patch](s2-test-only.patch).

**Windows acceptance: each changed cell passed 10/10 on this exact commit.** Profile `ci-windows`, retries zero, original fixture mode, child `SPT_*`/`OWL_*` scrubbed, ambient `RUSTFLAGS` removed, private `CARGO_TARGET_DIR`. The runner uses contained Windows process trees; these are targeted repetitions, not a rerun of the full phase-B suite. Under PSGTJWTT, the 49a08a07 receipts carry forward across this test-only delta.

- [Final receipt](s2-final-receipt.json), [ten-run cohort](s2-hardened-cohort.json).
- Individual commands, environments, native receipts and logs: `s2-hardened-01/` through `s2-hardened-10/`.
- Traceability CLI 0.4.1: **918 complete, 0 incomplete, 0 findings**, [JSON](s2-traceability.json).

## 1. Remote harness-only refusal: fixture loses its input

`harness_only_refuses_truthfully_pre_stream` writes a synthetic foreign registry row while a real daemon is starting. `brain.ready` does not imply registry hydration has finished. If the host hydrates this row, its peer pump correctly evicts the unheard foreign node and publishes an empty snapshot. The CLI then truthfully says “No live session,” rather than seeing the intended harness-only fixture.

Direct capture: [parent-observe-02/stderr.log](parent-observe-02/stderr.log), line 19. `before_rc` contains hh2; `after_rc` is empty. The same capture contains `REGISTRY_SNAPSHOT_HYDRATE ... subnets=1 rows=1` and `REGISTRY_EVICT:solo: 1 row(s) from silent node(s)`. Run 07 independently captures the same failing schedule. Merely seeding before daemon startup does not fix this: an unheard row remains eviction input.

Hardening uses the existing hermetic fixture configuration, `relay=disabled, peer_pump=false`, before daemon startup. It preserves the real CLI and broker, both local/remote assertions, and the original late-seed flow. No retry or timing sleep substitutes for stable input.

## 2. Replay resurrection: old level mistaken for a new edge

`a_raw_dead_connection_bound_opener_is_not_re_served_by_the_next_generation` waited for opener retirement but not the separate old serve-connection cleanup. That cleanup clears `driven_by` and `controlled` in separate writes. The old oracle accepted any true/nonempty level as a *new* control acquisition without first observing an unseated baseline.

The original failing [consumer log](../consumer-windows-49a08a07/attempt1-phase-b.log), lines 249–270, distinguishes these events. Using the common `178937595` wall-ms prefix:

- Old controller conn5 is closing at suffix 1255–1257; detach completes at 1267.
- Fresh-sibling conn7 first writes at 1262. Test ordering puts this connection **after** the failed watch, so the watch had already ended while old cleanup was still in flight.
- The only subsequent controller acquisition is conn12 at 1318, for the **fresh sibling**, generation 1271. Gen2's recorded attach intents also name that fresh generation, not the dead opener's generation 1187.

This ordering, not isolated greens or the old `replayed=false` diagnostic, supports the classification. A missing `DISPATCH:<id>` line is not successful-serve evidence: that log reports anomalies.

Hardening requires both stamps clear **before gen2 is created**, with a bounded 20-second failure naming old cleanup rather than replay. The existing ten-second resurrection watch and mandatory fresh-sibling proof remain. The patch captures the table/log before the sibling, removes the invalid log-based assertion, and uses `Drop` to kill/wait generation children even on assertion failure.

## Measured rates

Counts below are failures / executions; parent is `b848244577d398600b59c7829fef9edbdb6315fa`. Each cohort JSON links its individual log directories.

| Cohort | Harness refusal | Replay oracle |
|---|---:|---:|
| [Unmodified parent](parent-original-cohort.json) | 1/5 | 0/5 |
| [Diagnostic original schedule, v1](parent-observe-cohort.json) | 2/10 | 0/10 |
| [Prehydrated fixture, pump on](parent-prehydrate-cohort.json) | 2/3 | — |
| [Same prehydrated fixture, pump off](parent-stable-cohort.json) | 0/3 | — |
| [Gen2 absent during watch, v2](parent-no-generation-cohort.json) | — | 0/5 |
| [Cleared baseline before gen2, v2](parent-clear-baseline-cohort.json) | — | 0/5 |
| [Committed S2 hardening](s2-hardened-cohort.json) | **0/10** | **0/10** |

V1 added info reads that could mask the replay race; v2 removed those unconditional reads. Neither replay diagnostic green cohort is offered as a reproduced false-positive or as acceptance by non-reproduction. The registry paired results include the actual retained/evicted inputs in [registry-control-observations.json](registry-control-observations.json).

## Closure and next step

All **45 native jobs** (four builds, 41 cohort executions) ended `COMPLETE / CONFIRMED_GONE / active_processes=0`. Target-image census had a live positive control of two matching processes, then zero at 10:29:33Z. This path census does not claim visibility into every system process; containment is established by the native job receipts. Cargo/rustc/nextest census was zero at 10:30:47Z. The private pool is released; its source tree and evidence remain preserved.

No product docs/changelog or extra files were committed; diagnostic variants remain only in this evidence directory. The formatter's recursive/unrelated changes were discarded before the minimal commit.

**Ready for Doyle's S2 fast-forward and todlando's cold build.** The r10 amendment remains frozen pending the cold S2 executable/xtask pins and the combined field binding. No sixth field window was executed here.