# RCA — golden 35299506382 (f348ed0c) Windows Phase B red: refresh_freeze::refresh_resumes_bounded_input_ack_without_replacement_poison
doyle, 2026-09-18 04:20Z. Sources: deployah-refresh-receipt.json (decoded from the job log), job-105459081284.log, rig.py predicate code (lines 505-625), retained receipts of the 4 prior PASS runs and 5 negative controls, gh job/step timing.

## Verdict: TEST-CEILING red (rig predicate vs box ambient jitter), NOT a product regression. No same-sha rerun; repin the rig (hertz), then a new golden on the successor.

## What the receipt says
- Phase A 3471/3471; Phase B 241/242; sole failure this cell, 80.8 s. Interpreter precheck passed (Python312). Cleanup pass=true, 0 survivors.
- Checks true: real_refresh, baseline_12_timely_tags (28/28 timely), ack_recovered_within_bound, zero_replacement_write_poison, controller_closures_detach_only (2 closures, both detach), reader_healthy.
- Checks false: sustained_timely_ack_and_state, all_post_tags_accounted_within_bound.
- Post-refresh: 23/23 tags COMPLETE (ledger 1, ack 1, state 1 each). Untimely = 2: tag 000 rtt 2765 ms (first tag after the replacement brain; inside the 15 s recovery window, so allowed) and tag 014 rtt 2016 ms (sent +17.5 s, completed +19.6 s: 16 ms over the 2000 ms bound and past the 15 s recovery deadline).
- Predicate mechanics (rig.py:605-617): `sustained` needs a timely candidate inside the recovery window with EVERY later post tag timely; `bounded` needs every post tag timely OR completed inside the recovery window. One untimely tag after +15 s falsifies BOTH. The baseline predicate, by contrast, needs only 12 of 28 timely.

## Discriminators
1. Same signature in every prior PASS (all on this box, HFENDULEAM): gate-228 rig-1/rig-2 on 39241675: first post tag 2906 / 2547 ms, 2 tags >1 s each, 1 untimely each; 49-267 candidate-1/2 on c180eb16: first 2500 / 2750 ms, 3 tags >1 s each, 1 untimely each. Golden f348ed0c: first 2765 ms, 4 tags >1 s (1203, 1922, 1828, 1344 at +4..+9 s), 2 untimely. The product signature (bring-up cost of the replacement brain ~2.5-2.9 s, then recovery, zero poison, detach-only closures) is identical; the delta is ONE extra tag 16 ms over the bound.
2. Box ambient jitter exists WITHOUT a refresh: pre-fix negative controls on 289e3cdf show BASELINE-phase hitches of 2640 ms (negative-2: 6 tags >1 s, 3 untimely in baseline), 1860 ms (negative-3), 1375 ms (discriminator-1); golden's own baseline has 1843 ms (baseline-021), 671, 437. The fix's regression shape is unmistakable by contrast: 23/23 untimely, recovery None, poison present (every negative control).
3. No CI co-tenant: n1-gate Windows ended 02:36:57Z; twohost-a/b started 03:44:19Z; Phase B (03:11:53-03:40:27Z) ran alone under Runner.Worker, serialized (heavy-broker-pty). Ambient = the live fleet (22 FOREIGN spt.exe in the census) + operator apps. deployah reports no local cargo during the run.
4. Product delta since the last PASS sha (39241675 -> 712c987f) touches livehost (eed9ff36), nethost/pairhost/endpoint (#302). Neither changes the ACK path; #302 REMOVES a periodic broker stall. Nothing in the receipt distinguishes the head from 39241675.

## Ruling
- Classification: rig ceiling. A 2000 ms per-tag bound with a zero-tolerance sustained predicate on a box whose measured ambient jitter reaches 2.6 s. Intermittent by construction (4 PASS / 1 FAIL on identical signatures).
- Route: hertz (test/CI rework per the dispatch split). Do NOT weaken ack_bound_ms/recovery_bound_ms (rig.py:739 forbids it and the contract is the freeze, not jitter). Repin `sustained`/`bounded` to the contract they exist to prove (REQ-HAZARD-INPUT-ACK-BACKPRESSURE / REQ-DAEMON-REFRESH: refresh RESUMES bounded ACK, no poison, detach-only closures): after recovery, tolerate isolated untimely tags the way baseline does (>= N of M timely AND no run of >= 3 consecutive untimely AND all complete), keeping the negative controls RED (they are 23/23 untimely). hertz proves it: deterministic replay of the golden receipt = PASS, replay of every negative-control receipt = still REGRESSION, replay of the 4 PASS receipts = PASS, then one live Windows run.
- Same-sha rerun: REFUSED. A green would be the intermittent green (zero information); the ceiling must move first. deployah reshapes v0.71.0 on the successor that carries hertz's repin (thin PR, ff-only), then golden again.