{
  "dispatch": "M73OZSOV",
  "candidate": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
  "scope": "Read-only source, git-object/history and completed-failure-log analysis. No build, test, cohort, target inspection, producer control, or source modification. Arm6 final verdict remains Doyle-owned.",
  "conclusion": "The new row was composed successfully but this presentation worker returned BEFORE native drain: its independent 10-second eligibility poll never observed an eligible endpoint. Strongest source/log explanation is a pre-existing spawn-publication versus liveness-reconciliation race: the harness can bind before the broker publishes its HostedSession; livehost discards bringing_up and terminal-normalizes that bound endpoint as dead. The exact successful offline write and per-poll predicate values were not captured, so incident attribution to that race remains a strong inference, not a fully instrumented proof. This is not established as a test defect.",
  "evidence_files": {
    "log_snapshot": "er-briefing-arm6-running-log-snapshot.log",
    "snapshot_provenance": "er-briefing-log-snapshot-receipt.json",
    "source_identity_and_sequence": "er-briefing-source-and-sequence-proof.json",
    "timing_research": "agent://BriefingTiming",
    "history_research": "agent://BriefingHistory"
  },
  "source_root": ".worktrees/hertz-304-phase-b",
  "question_1_current_mechanism": {
    "proven_failure_boundary": [
      "Test er_briefing_presented_e2e.rs:656-674 waits for a NEW row with delivered=true, not for disappearance of the old row. Reaching panic782 means repoint succeeded, controllable was Some(true), retained id was absent, and ENGINE_ROOM_BRIEFING_SWEPT was present (758-780). Final row2 exists, pending=1, delivered=false, all taker columns None, idle=false. Composition/supersession succeeded; delivery did not.",
      "Use the actual NEW broker generation at snapshot325 (pid24920), brain49188 at330. The re-offer section includes an appended copy of the earlier generation; its UNPRESENTED at320 belongs to arm4. The new-generation UNPRESENTED at390 is the relevant arm5 event. The panic repeats the same logs, not additional attempts.",
      "broker.rs:2226-2289 starts one detached worker. It polls inject::is_spt_hosted_no_relay for10s every200ms. The exact diagnostic at snapshot390 is emitted only by the !eligible branch at2273-2280, which RETURNS before drain_spool_native at2282. It is neither the NO-perch branch nor the translation-drain-failed branch. Thus this worker did not attempt native injection, and an IPC/translation write stall cannot explain its recorded exit.",
      "inject.rs:37-50 requires online AND no registered relay AND controllable=true. deliver.rs:86-91 requires ready-marker presence and liveness::is_perch_alive; liveness.rs:136-148 treats a present status field as authoritative: only online is alive. A final controllable=true reading does not prove online=true or complete eligibility during any earlier sample."
    ],
    "strongest_root_cause": {
      "name": "Bound-before-HostedSession-publication endpoint falsely terminal-normalized by livehost",
      "observed_order": [
        "snapshot351-352: PTY created and input writer at t_ms229, real childpid55640.",
        "snapshot361-363: log_ready/drain_armed/waiter_armed at t_ms3286: a3057ms input-writer-to-log-ready interval.",
        "snapshot364-368: session query, CONTROL_REAP_NO_SESSION, LIVENESS_RECONCILE_OFFLINE, then translation_ready/row_inserted at t_ms3366. These are recorded merged-log ordering facts; the two reconcile diagnostics lack individual timestamps.",
        "snapshot371-380: bring-up succeeds; controller seats; old briefing is loudly swept; current row2 is composed.",
        "snapshot381-389: later wake-resume requests a launch but SPAWN_DEDUP returns existing session1/pid55640. Its 'online at bind' sentence is a future expectation, not a measured status restoration.",
        "snapshot390: current presentation worker exhausts eligibility; final test sample still sees row2 untaken."
      ],
      "source_chain": [
        "adapters/mock/src/main.rs:195-235: dummy harness invokes real api bind once, then only prints heartbeat; it does not repeatedly bind or declare idle. api/startup.rs:1184-1204 clears resume custody and earns online from persisted controllable=true.",
        "broker.rs:8683-8728: translation startup occurs before sessions.insert; row publication comes after the harness already runs. A bring-up ledger exists and is cleared at publication. KIND_SESSIONS includes a separate bringing_up field (6354-6374).",
        "livehost.rs:1010-1045 maps ONLY reply.sessions into its endpoint set. reply.bringing_up is discarded. reconcile_hosted_liveness reads each info record afterwards and uses only membership in that set (792-799).",
        "livehost.rs:818-826 clears controller stamps for an absent session;913-972 then treats no published session as death unless resume custody or a relay protects it. Bring-up ledger state is not consulted. The bind itself has already cleared resume custody; the bring-up ledger and resume custody are distinct mechanisms.",
        "lifecycle.rs:956-957 calls info::terminal_normalize. info.rs:578-595 CAS-checks the observed session id, then writes status=offline, rest_state=suspended and clears dormant_since_ms. If reconciliation reads the newly bound session id before its broker row exists, the CAS matches that SAME session; it is not protection against this gap. It leaves controllable untouched, exactly allowing offline plus controllable=true.",
        "livehost.rs:883-887 skips already-offline records. Later session publication does not itself stamp online. launch_ledger_resume:461-477 mints custody and clears host_error but explicitly NEVER stamps status. A dedup acknowledgement spawns no new harness, so the existing dummy does not perform another bind to repair the offline stamp."
      ],
      "limits": "The log proves the reconcile path ran in the recorded pre-publication sequence and proves the presentation eligibility timeout. It does NOT capture final status/rest_state/ready/address, bind completion time, every predicate evaluation, or whether terminal_normalize successfully applied: mark_offline ignores its result and the reconcile diagnostic is unconditional. Therefore the false-offline mechanism is source-established and fits this occurrence strongly, while its successful state mutation in this exact run remains inferred. No live temp-home or process inspection was performed."
    },
    "ranked_alternatives": [
      {
        "rank": 1,
        "hypothesis": "False-offline race described above",
        "prediction": "A permitted reproduction that holds spawn before session publication after real bind, then drives real reconciliation, should show online becoming offline/suspended while the harness remains alive; preventing that false death should preserve eligibility and native delivery. Capture before/after info plus the broker's session and bringing_up truth."
      },
      {
        "rank": 2,
        "hypothesis": "Genuinely late bind/readiness crosses the one-shot10s presentation window without a successful offline write",
        "prediction": "Bind/readiness timestamps would show complete eligibility first becoming true after the worker exited; no successful pre-publication terminal normalization. Final controllable=true alone cannot exclude this."
      },
      {
        "rank": 3,
        "hypothesis": "A different eligibility leg stays false: ready-marker/record readability or unexpected relay registration",
        "prediction": "Captured per-leg results would show online/ready/read failure or resolve_address=Some while controllable is true. No such evidence is present; the explicit reconcile-offline sequence gives rank1 substantially stronger support."
      }
    ],
    "earlier_seam_and_landing": {
      "identified_hertz_fix": "1648b103039d4b33428b3b285d51bb97b128359f (Aug23), test(er): repin briefing session boundary. Same-session re-offer retains ID; a NEW session sweeps the old row and delivers a fresh one. Already an ancestor of S2 527cd8e8, not an unlanded fix. This is NOT the current failure: supersession checks passed; fresh delivery failed.",
      "other_landed_fixes": [
        "133e2d66fe65388ec151ab494b301445197d2afd (Aug19): present briefing natively before first idle, rather than only spool. Original root had a fully eligible endpoint; current worker never observed eligibility. Already in S2.",
        "6c3efe935d329595d53a85ec6301196901d783ea: sweep undelivered older-session briefings at new session. Already in S2; current sweep succeeded."
      ],
      "attribution_correction": "Doyle ORGGJBBT withdraws the earlier-today attribution: it came from his older standing monic, whose 'today' was its writing date, almost certainly the Aug23 correction1648b103. There is no missing current RCA to substitute. The independent source/log diagnosis stands; no repair of the current spawn/reconcile gap is present in the inspected candidate."
    }
  },
  "question_2_preexisting_or_diff": {
    "answer": "Pre-existing source mechanism; not introduced by the S2-to-fix2 source delta.",
    "proof": "Read-only git rev-parse compared S2 and7890ead3 blob ids for the ER test, broker, livehost, inject, info, liveness, deliver, api/startup and mock/main: all9 pairs identical. Exact identities retained in er-briefing-source-and-sequence-proof.json. 7890ead3 has sole parent527cd8e8.",
    "s2_own_changes": "527cd8e8 changes only crates/spt-daemon/tests/restart_replay_lifetime.rs and crates/spt/tests/rc_attach_truth.rs. It is not an ER repair.",
    "fix2_exhaustive_files": ["CHANGELOG.md", "crates/spt-daemon/src/bootstrap_firewall/windows.rs", "docs-site/src/changelog.md", "docs/297-ENFORCEMENT-CODES-DIAGNOSIS.md", "docs/adr/0059-lan-exposure-only-for-the-bootstrap-surface.md", "traceable-reqs.toml"],
    "qualification": "Identical source does not prove an unrelated timing change could never expose an existing race. The prior green attempts do not disprove an intermittent product defect. Doyle's measured knob-reader restriction is accepted; no direct path makes those two inject_control_wedge-only deadline knobs this ER cell's delta."
  },
  "question_3_duration": {
    "answer": "Yes, the source and diagnostic prove expired waits; no, expiration versus race is not an either/or. A race can invalidate eligibility, terminate the one-shot presentation worker, and make the outer test wait its full deadline.",
    "bounds": [
      "Arm4 intentional miss: measured unpresented_after12.9071048s; its45s observation barrier did NOT expire. This includes cold bring-up plus its expected10s product poll.",
      "Arm5 product presentation: independent10s/200ms eligibility poll expired; worker returned. Its deadline starts inside the detached worker, not at the test's rc spawn.",
      "Arm5 test:45s/150ms wait for new delivered row expired. It only observes the spool; it does not retry or extend product presentation. Final resnapshot still has row2 undelivered.",
      "Whole test FAIL79.834s versus prior PASS38.159s: delta41.675s. Paying the full45s instead of an early successful wait explains the shape, not an exactly measured extra45s stall. Other startup and teardown costs vary."
    ],
    "accounting": "45s nominal arm5 bound plus measured12.9071048s arm4 observation totals57.9071048s; about21.927s remains for all earlier arms, fixed3s quiet arm, ceremony/readiness, restart, sampling/overshoot, cleanup and runner overhead. This remainder is arithmetic, not a measured phase. Panic occurs only AFTER rc5/tree cleanup, so79.834s is not a product timer.",
    "noncausal_diagnostic": "PERCH_CENSUS_SKIPPED is report-only and the cited occurrence belongs to the older broker. The actual arm5 broker pid24920 reports one occupied perch at snapshot326. Neither census line is the briefing eligibility predicate or a delivery attempt."
  },
  "recommended_disposition": {
    "classification": "Keep the fourth full-load red as a product-eligibility/lifecycle investigation, not a proven test defect or fixed timeout-headroom issue. Preserve clause4 assertions and original results. Current strongest repair target is the spawn/reconcile authority boundary, outside bootstrap_firewall fix2.",
    "repair_direction_after_GO": "Reconciliation must distinguish a legitimately starting session from definitive absence using coherent broker-owned lifecycle truth. A bring-up-in-flight guard is relevant, but blindly merging bringing_up into live sessions would misstate control/liveness and is not a complete proof: KIND_SESSIONS snapshots session rows before reading bringing_up, so publication/ledger-clear between those reads can produce another gap. Define coherent live/starting/absent observation and protect false-death mutations, including control cleanup, rather than increasing the briefing wait or weakening its assertions.",
    "verification_after_GO": "Use the real broker/bind/reconcile chain with controlled pre-publication scheduling and assert the live bound endpoint remains eligible and its new briefing is taken by native-inject. The current diagnostic lacks per-predicate/terminal-normalize result evidence; add or capture that at the correct seam only under authorization. No cohort until arm6 END and Doyle ruling."
  }
}