# releases#199 — the instrument lane (todlando, PORTER wave 2) STATUS 2026-08-21: BUILT, GREEN, COMMITTED, UNPUSHED, GATE FIXUP APPLIED. doyle read the diff, found ONE defect, ruled a thin fixup, and gates on the tip. Lane `.worktrees/fix-199`, branch `fix/199-er-bringup-launch-bound`, base `b88fab2a`, three commits: - `fa6cbd7b` registry mint (INACTIVE) - `a26fdeb4` the instrument, REQ activated at impl+int - `fd84e160` the gate fixup (tip -- gate on this sha) THE FIXUP, because it is the lesson: the `row_removed` stamp defaulted BOTH its fields when `remove(&id)` returned None, so a row another path had already de-tabled published as an empty endpoint that lived `0ms`. I had built #201 to doyle's ruling that an absent exit code is NAMED and never rendered 0, and I had just authored the REQ sentence AN ABSENCE IS NEVER A VERDICT -- and then defaulted an absence to zero inside the one witness whose whole job is to stop that. A rule you wrote does not defend the code that states it. Now a match: the present arm prints endpoint + measured lifetime, the absent arm prints `entry=absent` and says no lifetime is known. Classifier untouched and CHECKED rather than assumed -- D-detection keys on the `row_removed` phase token, which both arms emit. The 24-run population arm was NOT re-run after the fixup, on doyle's instruction and for a stated reason: the fixup touches only the None arm of a diagnostic at the exit waiter, a path no green bring-up enters (a green run's removal always returns Some). Re-burning 25 minutes would measure the same code. Wave 2 is now COMPLETE as far as I can take it: #187 closed, #201 gated PASS and held, #199 instrument delivered under doyle's pre-ruling case (2). ## What #199's second face is, and why no fix landed Face: `the code was accepted, but the engine room's harness did not come up within 30s`. The bring-up handler waits on ONE fact — a row in the broker's own sessions table — and the launch that produces it runs on a DETACHED THREAD which said nothing unless it returned `Err`. Four mechanisms produce that sentence identically, and the poll cannot tell them apart BY CONSTRUCTION (it reads a row; all four are a missing row): - **A** — launch returned Err (`ENGINE_ROOM_SPAWN_FAIL`), loud but in a channel nobody read against the timeout. - **B** — the launch path's reply wait is UNBOUNDED (`Brain::cold_start` carries `io_timeout: None`), so any stall in the broker answering `KIND_SPAWN` surfaces only as the poll expiring. - **C** — the ConPTY create overran the bound. - **D (NEW, mine)** — the harness SPAWNED AND DIED, so the row existed and then did not. Same class as a rest-state stamp any death satisfies. `row_removed` is the only witness; the filed A/B/C set had none. doyle's pre-ruling: no fix on an unreproduced mechanism. A bound chosen without a measured stall is a number pulled from air, and its false-timeout face is a NEW bug. The residual follows #187's pattern — ACCEPTED WITH ITS NUMBER, instrument as the tripwire. ## The instrument (what shipped) Both sides stamp into the PERSISTED daemon stderr sink (REQ-DAEMON-STDERR-PERSIST) — the inherited stderr file stops being the daemon's a few statements into `daemon run`, so it is the only channel a rig can read back: - launch thread: `enter prepared connecting connected requested spawned` + `prepare_failed / connect_failed / spawn_failed` - spawn choke: `received gate_claimed pty_creating pty_created input_writer log_ready drain_armed waiter_armed translation_ready row_inserted` - exit waiter: `row_removed` with `lived_ms` - ready-wait: `ER_BRINGUP_WAIT_START` / `ER_BRINGUP_WAIT_EXPIRED` All spans monotonic off ONE `Instant` per side (`elapsed`) — never a difference between two clocks (IR-53 underflow class). Rig side, in `crates/spt/tests/engine_room_bringup_e2e.rs` (inserted ABOVE line 1460 so it cannot collide with fix-204's append at assembly): `instrument_ladder` / `phase_of` / `instrument_verdict`, the int cell `er_bringup_launch_phases_reach_the_sink`, and 6 classifier pins. ## Measurements (all at b88fab2a, this box, 16 cores) - **Non-vacuity control PASSED**: 13/13 rungs render end-to-end through the gated `daemon_diagnostics` panel. This is what licenses reading silence as a fact about the launch rather than about the sink. - **610 bring-ups, 0 reds.** 490 through the light instrument cell (1 quiet + 20 quiet + 80 at 4-way + 150 at 10-way + 240 at 12-way) and 120 through the POPULATION-MATCHED arm (24 full-binary runs, 52-58s each vs doyle's 61.6s, at 4-way load, 5 bring-ups per run). - **Arithmetic (doyle's, on the matched arm):** at the filed 1/20, P(0 reds in 120) = (19/20)^120 ~= 0.2%. All-green is therefore NOT bad luck — it is measured evidence the rate at b88fab2a is far below the filed rate. - **RATE PROVENANCE, load-bearing:** the filed 1/20 was measured at `bd942f6` and `4ba27d3`, both BEFORE the in-flight-ledger fix `8437b26` (#199's FIRST face) landed in this base. The second face's rate AT b88fab2a had never been measured. This is the first measurement of it. - **The contention knob is not vacuous** — ConPTY create scales with it: quiet 9-16ms, 4-way tail 42ms, 10-way tail 117ms, 12-way tail 294-326ms. A 20-30x stretch, still ~100x short of the 30s bound. Everything after the PTY exists runs in ~1ms. - **ONE OUTLIER, unreproduced:** at 10-way, one run put 1427ms between `pty_created` (14ms) and `row_inserted` (1441ms) — the child ALREADY RUNNING while the row the poll reads did not exist. That is this issue's face in miniature. I subdivided that span into five stamps and re-ran 240 observations at 12-way: it did NOT recur. One sample, no candidate claimed from it. doyle: if the face ever fires, THAT span is the first read — it is the broker insert path, NOT the launch thread's Brain calls. - **Per-arm mutation proof of the classifier:** two arms disabled in one build (the unreadable arm, and the row_removed witness) reddened EXACTLY their two pins, 4 others stayed green. Restored and re-greened 11/11. ## Lane slate On the fixup tip `fd84e160`: engine_room_bringup_e2e 11/11 (52.686s, 5 e2e + 6 classifier pins) · clippy --workspace --all-targets 0 warnings, exit 0 · traceable-reqs check exit 0 with the new REQ `[OK] +impl +int` · xtask check OK. ## What is owed 1. ~~Report to doyle~~ SENT, interim and final both accepted; fixup sha reported. 2. ~~Board comment on releases#199~~ POSTED (comment 5368579653): rate-provenance first, the 120-bring-up arithmetic, face ACCEPTED WITH ITS NUMBER, instrument as tripwire, issue left OPEN. 3. doyle's gate on `fd84e160` — rig warm, takeover ready. Nothing owed from me unless he comes back. 4. Pool release when the lane is picked at assembly. DO NOT rebase or push. ## Do not touch #201 (`.worktrees/fix-201` @ `e3e4524f`, GATED PASS, held for assembly), #204 (`.worktrees/fix-204` @ `f1bd2679`, gate-passed, parked), #187 (closed DONE), doyle's gate rig `.worktrees/gate-d5351e66`.