# GATE VERDICT — inject settle-gate RE-ARM (post-0.29.0 field fix)

**Verdict: PASS** (doyle, 2026-07-08). Branch `fix/inject-settle-rearm` @ddf7f8e (off main), single build commit (todlando) + this verdict.

## Scope
Post-0.29.0 field bug: PTY inject HEAD-TRUNCATION recurred on 0.29.0 — a checkpoint-wake payload injected right after `/clear` lost its head (perri screenshot `WindowsTerminal_6iSjya8pMt.png`). doyle root-cause + design ruling; todlando build.

**Root:** `run_inject_worker` gated the W5-A Layer-1 settle-gate behind a worker-local ONE-SHOT (`settled_once`) on a FALSE premise (head-swallow race is startup-only). A mid-session `/clear` re-enters the harness raw-mode input reader → re-creates the pre-settle window, but the one-shot already fired at spawn → `settle_before_inject` skipped → head eaten again; echo-verify (Layer 2) default-OFF for that session → silent + unrecoverable.

**Fix:** `settled_once` one-shot → `probe_unobservable` latch + pure `should_settle(attempt, probe_unobservable) = attempt>1 || !probe_unobservable`. Re-settle before EVERY delivery on an OBSERVABLE (echoing/interactive) PTY (bug-prone class, cheap); latch-skip the steady-state settle ONLY where the probe is UNOBSERVABLE (non-echoing ConPTY — no reattach race, full-deadline cost). The settle's own bool return discriminates the class, latched on attempt 1; a re-drive always settles. Mints REQ-HAZARD-INJECT-SETTLE-REARM (KNOWN-HAZARDS 7.37).

## Diff review — FAITHFUL
Matches the design ruling exactly: latch semantics, pure gate, first-attempt-only latch update, re-drive-always-settles. KH 7.37 + traceable REQ minted with all three stages (`doc`/`impl`/`unit`) tagged on real evidence. RED-first unit `should_settle_rearms_on_observable_pty` present and correct. No int edit — safety-checked: `inject_control_wedge` mocks (`findstr`/`cat`) never answer the DSR probe → settle times out → `probe_unobservable` latches true after delivery 1 → identical to the old one-shot for non-echoing mocks.

## Both legs GREEN
- **Windows (ConPTY, isolated worktree + fresh target):** clippy `--workspace --all-targets -D warnings` = 0; `traceable-reqs check --json` = 0; nextest `--workspace` = **1707/1707** (9 leaky, 1 skip), exit 0. `should_settle_rearms_on_observable_pty` PASS.
- **Linux (kitsubito/forkpty, bundle-deploy @ddf7f8e):** clippy = 0; nextest `--workspace` = **1695/1695** (2 leaky, 1 skip), exit 0. `should_settle_rearms_on_observable_pty` PASS.

## GATE-HOLD investigated → CLEARED (env contamination, not code)
First Windows full-suite run REDed on `inject_control_wedge::wan_arrival_to_idle_spt_hosted_injects_with_no_hook_poll` (`pending_spool_rows: left=1 right=0`, `INJECT_HEAD_LOSS_SPOOL` fired). Discriminated:
- Deterministic 5/5 isolated FAIL → not a flake.
- Root: `SPT_INJECT_VERIFY_ECHO=1` was exported in the gater's interactive live-agent shell (the live box arms Layer-2 echo-verify), inherited by the gate script → `echo_capable=true` → on Windows ConPTY the choreo child puts a headless line on the ring → Layer-2 false-positive head-loss → respool → `pending=1`.
- Proven env-driven: same test PASSES with `SPT_INJECT_VERIFY_ECHO` unset (deterministic both ways). Linux passed because its ssh env is clean.
- **CI-safe:** the var is **Process-scope only** (User/Machine scope empty) — the GitHub Actions runner service (hfenduleam, separate process tree) does NOT inherit it → PR CI runs clean. The clean-env full re-run (1707/1707) = CI's actual condition.
- The fix touches only Layer-1 settle; Layer-2 echo-verify is untouched W5-A code. The failure is orthogonal to the change.

## Follow-up SEED (non-blocking; filed to todlando)
`init_wedge_home` (`inject_control_wedge.rs`) sets `SPT_INJECT_SETTLE_MS` for hermeticity but does NOT neutralize `SPT_INJECT_VERIFY_ECHO` / `SPT_INJECT_FORCE_ECHO_MISS`. On any live-spt box that exports those (this box does, process-scope), the WAN idle-inject test false-REDs locally. Harden: `remove_var` both in `init_wedge_home` (mirrors the existing `set_var` there), so the suite is robust to the box's declared-capability env. Test-only; does not block this fix (CI clean, product correct).

## Disposition
PASS. Land path: PR `fix/inject-settle-rearm` → main → CI → merge; ships in the next release cut (deployah, operator-gated counter). todlando BLESSED.