#314 — OWNED no-refresh confirmation and matched descendant control
Analyst: hertz. Authorization: Doyle OZWRWO7G; ruling comment 5691540025.
Disposition: CONFIRMED core lifecycle-contract defect. No remedy implemented; outside v0.71.0 as ruled.

RESULT
The direct adapter-labeled Python client remained alive but fresh rc refused it beyond the unmodified 30-second grace. The identical client with one live Python descendant attached successfully and accepted input. Neither arm invoked refresh. Both final arms completed clean scoped teardown and native kill-on-close accounting with zero active processes.

FINAL MATCHED PAIR
Root: .spt/preserved/314/
Binary: existing spt 0.70.0 / 289e3cdf evidence build, SHA256
5c73973baf1eaa16cbd548fe75f553da7a87f98e892d936b7890618c736c93e8
No build or cache claim was needed. Each arm copied the same pinned executable into its own fresh observation/bin and used a distinct fresh SPT_HOME and socket namespace.

Leaf: no-refresh-leaf-2/
- Initial fresh-home attach succeeded; baseline input ACK plus independent state ledger completed in 31ms.
- Direct client root PID 33820, FILETIME birth 134340030793852651, image C:\Program Files\Python312\python.exe, parent broker 54588.
- Fresh post-grace rc emitted the real defunct-session refusal.
- Nearest preceding raw KIND_SESSIONS reply: PID 33820, adapter evidencerig, spawned_ms_ago 34081, controller_by null. Reply completed 56.6053ms before refusal output receipt.
- At refusal output receipt the reader immediately began a Toolhelp process snapshot plus pinned-handle birth/image queries. Completed 17.7081ms later: same root birth alive, zero descendants, no probe errors.
- Next raw request began 14.0575ms after refusal output receipt on the concurrent sampler; response age 34154ms, same root/adapter, no controller. Sampling and refusal-triggered census overlap, so these intervals need not serialize.
- All fresh-attach capture rows show the same live root and zero descendants before and after their broker queries.

Live-descendant control: no-refresh-descendant-2/
- Same producer bytes, adapter, binary, default grace and workflow. Sole arm switch LEAF314_CONTROL=descendant spawns a non-interacting Python child, console-detached, sleeping for a bounded 60 seconds.
- Initial attach baseline ACK/state completed in 47ms.
- Root PID 56936, FILETIME birth 134340030838522944, parent broker 57448.
- Child PID 52132; its actual parent is root 56936. Exactly this one live descendant appears in the capture, no conhost descendant.
- Fresh post-grace rc attached and completed an independently ledger-verified input/ACK/state round trip in 31ms.
- Raw reply before attachment: root PID 56936, adapter evidencerig, spawned_ms_ago 34415, controller_by null. Raw reply after observed attachment: age 35033ms with controller_by populated, same root and adapter.
- The same root birth and live descendant are present throughout the fresh-attach capture interval.

RAW EVIDENCE / TIMING LIMIT
Each observation/session-census.jsonl row contains:
- before/after process census timestamps, root existence, descendant PID set, per-process PID/birth/image/parent and explicit errors;
- request/reply timestamps;
- complete length-prefixed broker reply bytes in wire_base64;
- the decoded, unfiltered sessions-reply envelope.
Every retained frame in both final runs was decoded independently during receipt generation; declared wire length and JSON envelope matched exactly.
observation/rc.chunks.jsonl retains actual fresh rc output and timestamps. The leaf reader takes an additional census immediately on recognizing the refusal bytes.
This is a timestamped external observation around the real decision, NOT an atomic in-process snapshot at the classifier instruction. The concrete capture offsets are above; no exact simultaneity claim is needed. It closes the earlier absent-raw-fields/absent-descendant-census gap with stable bracketing observations and a matched behavioral discriminator.

CONTAINMENT AND TEARDOWN
All subjects ran in native Windows jobs with verified JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE (8192). The reused ownership guard checks process birth, executable hash, ancestry, and both isolated pipe servers against the owned broker. Existing SPT processes, launcher ancestors and resident socket names are excluded.
Actual command ledgers contain only fixture adapter add, endpoint create/start, and scoped daemon stop --force; rc invocations are separately recorded. No daemon refresh/update or resident lifecycle command was invoked.
Both final observation/teardown.json files: confirmed_before_job_close true, no survivors/unknowns/job survivors/errors, both isolated named pipes ERROR_FILE_NOT_FOUND.
Both final native.json files: coverage COMPLETE, termination CONFIRMED_GONE, active_processes 0, native_exit 0. The control child expires naturally inside the scoped cleanup bound; outer job containment remains the fail-safe.
No AlreadyLive duplicate-bringup or reap experiment was performed. That hazard remains source-predicted only.

ATTEMPT HISTORY (PRESERVED, NOT HIDDEN)
no-refresh-leaf-1: also reproduced refusal, same pinned binary, clean inner/outer teardown.
no-refresh-descendant-1: attached and delivered ACK/state in 47ms, but harness expected exactly one descendant while CREATE_NO_WINDOW produced Python plus conhost. Its 180-second child outlasted inner cleanup. Marked CLEANUP_FAILED, not counted as a clean control. Native outer job confirmed both gone with active_processes 0.
Original executed fixture bytes retained in confirmation-fixture-v1/. Corrected final fixture uses DETACHED_PROCESS and 60-second child lifetime; both arms rerun with those same final producer bytes. No production workaround was introduced.

REGRESSION-CELL HANDOFF
confirmation-fixture/ contains confirm.py, producer.py and the unchanged proven native launcher/ownership helpers. Final runs retain config.json and args.json; these are the complete launch inputs. Replays MUST use new output/receipt paths: the native launcher and driver refuse existing destinations. Run confirm.py only through launch-v2.ps1, never as an uncontained direct invocation. Current bounds: observation 100s, scoped teardown 60s, native ceiling 180s; actual default grace 30s.
IMPORTANT: diagnostic status CONFIRMED means the current defect prediction held, NOT a green product test. On the remedy lane, the leaf arm's product acceptance must change to successful fresh attach plus timely ACK/state; the descendant control must remain attachable. A fixed leaf already produces DISCONFIRMED here rather than falsely reporting this defect reproduced.
The legitimate orphan-wrapper regression remains required for the remedy lane; these leaf/control captures do not replace it. No permanent product tests or implementation files were changed in this evidence lane.

INDEX / VERIFICATION
Machine-readable comparison and per-artifact hashes: confirmation-comparison.json
SHA256 cb97f304e420019c97bc31eafb2f827170ef693046f0c22d0482ff5064b40d72
Final driver SHA256 d78d25ae0fc565c0808c47b689e06915b0c1c049b3d5bcc07c6ba8ff22e8ad53
Final producer SHA256 282fb9f3d99f485bcd8019e9e7d1d9fcb337ef1edf23568be85c93bef0b8a177
Traceable-reqs check: 923 complete, 0 incomplete, 0 findings (artifact://885).
All evidence retained under .spt/preserved/314/ as requested. No resident or fleet daemon mutation. No owned experiment process remains.