{
  "dispatch": "NO4JJOEL",
  "candidate_commit": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
  "status": "SOURCE_PROVEN_SYNCHRONIZATION_GAP; INCIDENT_INTERLEAVING_INFERRED; COHORT_PENDING",
  "observed_failure": {
    "test": "spt::webserve_attachment_e2e::an_attachment_is_snapshot_served_fetched_back_and_named_by_its_message",
    "location": "crates/spt/tests/webserve_attachment_e2e.rs:568",
    "listed_names": ["report.md", "report~1.md", "beta.md"],
    "missing_name": "alpha.md",
    "earlier_assertions_passed": "The two-attachment send succeeded, emitted two ATTACHED URLs, and the URLs differed.",
    "source_log": ".spt/preserved/304-handoff/consumer-windows-7890ead3/attempt1-phase-b.log:82-143",
    "log_is_not_final": true
  },
  "source_proven_mechanism": {
    "mutex": "servehost.rs:20 defines static REGISTRY_WRITE: std::sync::Mutex<()>; it coordinates threads within one process only.",
    "broker_writer": "servehost.rs:158-235: apply_at locks, loads whole registry, snapshots source, appends attachment, saves, THEN acknowledges Attached. seedmap.rs:182-183 dispatches this in broker seed-control threads; daemon.rs:461-482 starts the separate brain and runs seed-control in the broker.",
    "brain_writer": "livehost.rs:1281-1336: TTL reaper uses with_registry_write, loads whole registry, reaps expired entries, unlinks their snapshots, and saves retained whole snapshot. It runs in the brain's livehost pulse (brainproc.rs:358; livehost.rs:1415-1428). Its Mutex is a DIFFERENT process-local instance.",
    "reader": "servehost.rs:171-181,275-277: List reloads persisted registry and returns entries unfiltered. No stale in-memory list cache or TTL/name filtering explains the missing row.",
    "registration_order": "attach.rs:72-116 sends and awaits one Attach at a time. The test supplies alpha before beta at webserve_attachment_e2e.rs:535-546.",
    "publication": "ServingRegistry saves a complete serialized snapshot via durable atomic replacement. Atomic publication prevents torn reads; it does not make cross-process read-modify-write transactions serializable."
  },
  "matching_interleaving": [
    "[INFERENCE] Brain reaper loads report.md, report~1.md and expired ephemeral.md before alpha is registered.",
    "[INFERENCE] Broker registers alpha and durably saves it, then returns Attached.",
    "[INFERENCE] Brain removes ephemeral.md from its stale snapshot and publishes that snapshot, erasing alpha's registration without ever observing alpha.",
    "[INFERENCE] Broker loads that published state for beta, adds beta, saves and returns Attached.",
    "List then contains report.md, report~1.md and beta.md, exactly the observed name set."
  ],
  "ranked_hypotheses": [
    {
      "rank": 1,
      "name": "Cross-process stale TTL-reaper publication",
      "prediction": "A successful reap overlaps registration; ARM10 supplies an expired entry so the reaper reaches save. Alpha's snapshot may remain orphaned, and alpha's name history may disappear with its entry.",
      "limitation": "Current failure output does not retain writer PIDs/load-save ID sets or daemon SERVE_REAP timing. Source proves the gap, not this exact schedule. A green ten-run cohort cannot disprove the race."
    },
    {
      "rank": 2,
      "name": "Legitimate alpha expiration or clock discontinuity",
      "prediction": "Alpha's TTL must expire before a publishing reap. Both files receive one send's common TTL; this send omits --ttl and beta shows 2592000000ms (30 days), making ordinary seconds-scale expiry inconsistent. A large clock jump would need separate evidence."
    },
    {
      "rank": 3,
      "name": "Another out-of-process registry rewrite or home mismatch",
      "prediction": "A separate writer or different SPT_HOME would need evidence. The test pins the same home for every command, preserved report identities and beta argue against a wrong-home read, and the normal broker/brain pair already provides a sufficient race."
    }
  ],
  "test_boundary": {
    "old_flake": "The c4919243 comment documents a before/after COUNT changing when an expired entry was reaped. Current ARM11 asserts the identities it created and is not fooled by that count change.",
    "current_assertion": "A just-successfully registered, default-30-day alpha entry must be enumerable. Its disappearance violates ADR-0057/0058; weakening or delaying this assertion could hide a product defect.",
    "coverage_gap": "servehost.rs:703-754 tests a reap-shaped pass against a concurrent add in two THREADS of ONE process, where the static Mutex really is shared. It cannot cover the production broker/brain process boundary."
  },
  "scope_and_decision": {
    "outside_fix2_diff": "Doyle NO4JJOEL reports the S2-to-fix2 relevant tests/web paths unchanged; that source-delta fact is accepted, not re-run.",
    "recommendation_pending_cohort": "Treat as a candidate pre-existing product concurrency defect outside the firewall diff, not the old count-only test intermittency. Do not harden the test by suppressing the missing-name contract.",
    "real_fix_options": ["Route TTL reaping through the broker-owned registry writer, maintaining one actual writer process.", "Use a real cross-process transaction guard covering every load/change/publish writer, with coverage at the broker/brain seam."],
    "cost": "Any test-only hardening or product fix creates a new commit SHA and requires cold rebuild, consumer evidence and packet rebind. Doyle decides; no source/test edit authorized or made."
  },
  "cohort": "Ten sequential executions of this exact cell, exact7890ead3, ci-windows, retries0, scrubbed environment and own private target; blocked until explicit Doyle Windows END."
}