# W2 — broker viewer/brain decouple: gate verdict (doyle, 2026-07-07)

Gate of wave head `fbf8ab7` per `docs/W2-BUILT-REPORT.md` @bc05bc8, against ruling
`docs/W2-DESIGN-RULING.md` @60ec0ed.

## Verdict: PASS — with one doc-truth amendment (rider, non-blocking, same wave)

Evidence:
- Isolated worktree @fbf8ab7, fresh `CARGO_TARGET_DIR`: clippy `--workspace
  --all-targets` clean; nextest `--workspace` 1667/1668 + the one trip isolated
  5/5 green (flake ledger below); `traceable-reqs check` exit 0
  (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE `+doc +impl +unit +int`).
- Linux leg (kitsubito, /tmp/w2-gate @fbf8ab7): `brain_decouple` +
  `inject_control_wedge` + `driven_by_selfheal` 19/19; spt-daemon lib 451/451.

FLAKE LEDGER (gate, 2026-07-07 — both load-class on the shared box, live daemon +
ongoing work concurrent; neither in a W2-touched crate; remote-truth #13 precedent):
- run 1: `spt::bin/spt api::reporting::tests::boundary_resurfaces_undismissed_notifs`
  tripped under full parallel, isolated 1/1 green.
- run 2 (`--no-fail-fast`): `spt-store atomic::tests::concurrent_writers_never_collide_on_tmp`
  — os error 5 (Access denied) on concurrent tmp renames = Windows AV/indexer hold
  under load, the SAME transient-deny class W1 just added the bounded commune-drop
  retry for. Isolated 5/5 green. Seed candidate: extend the denied-only bounded
  retry to `atomic_write` tmp renames (W5-adjacent hardening, not this wave).
- Diff review: c9346c0 (early-skimmed at slice time, ruling-compliant), 0b0af33
  (KH 7.36 — ruling-faithful incl. deferred-scope + observability), fbf8ab7 (rig).
- Gate conditions: (1) lock-scope proof comments present at every new blocking
  site; (2) int rig RED-first proven (resolve_subscribe evict removed →
  `BusyControlled` + `evicts=0`); (3) seam sweep green; (4) per-wave activation
  in the work-start range. All satisfied.

## Ruling on open question 1 — mechanic (d) promotion gate: MOVES TO W3 (binding)

The stall-evict bounds the false-promote window from unbounded to
`BRAIN_WRITE_DEADLINE` (15 s) — it does NOT close it: `brain.ready` can still
arrive inside the window while blocked writes pend on the old-gen conn. That
residual is real but belongs with the promotion/apply machinery (ADR-0018
brain-trial), which is the SUBJECT of W3 update-finish-truth and is not exercised
by the suspend rig. Conditions:
1. W3 activation MUST carry the explicit drained-condition requirement (promote
   only when the old generation's subscriber conn is CLOSED or evicted) and a
   false-promote rig that exercises the promotion path itself.
2. KH 7.36 already records `brain.ready ≠ subscribers drained`; the 15 s residual
   window is documented there via this verdict — the hazard is NOT closed by W2,
   only bounded. W3's gate re-checks it.

## Ruling on open question 2 — dispatch-side premise refinement: ACCEPTED

Local rc reaches the broker via `cold_start_pump`, so the dispatch-side
`send_frame` legs were never the local-control wedge; the idle-session
blocked-controller gap is the root, and it is fixed + rig-proven. No scope
change: the wholesale verb migration stays deferred (the rig — the arbiter the
ruling named — is green without it), and any残 leg that still transits a brain
inherits the bounded-loud requirement if evidence ever shows it wedging.

## Doc-truth amendment (rider — land in this wave, no re-gate needed)

The delivered int rig is the socket-stall ANALOG (a remote controller that stops
reading parks the broker writer in `write_frame` — the same primitive a suspended
brain produces). It asserts: viewer ticks during wedge, take completes via
stall-evict, prompt resolution, tally observable. It does NOT assert
resume + cursor-replay byte identity, and no NtSuspendProcess/SIGSTOP twin runs
in CI. Two texts overclaim this:
- `docs/KNOWN-HAZARDS.md` 7.36 "spt-core mapping" int sentence — describes the
  NtSuspendProcess rig with cursor-replay byte-identity as the int evidence.
- `tests/brain_decouple.rs` header line "the newcomer receives replayed output
  from its cursor (resume loses nothing)" — not asserted.

Amend both to state what IS proven (analog + four asserts; replay integrity
covered by the pre-existing ring/cursor units — `apply_once…dedups_replay`,
cursor no-rewind CAS, clean-repaint attach — which W2's delta does not touch),
and note the live NtSuspendProcess run remains the manual field rig from the
incident night. The hazard registry is a conformance checklist; its evidence
lines must match delivered tests exactly.

Co-authored by: doyle