doyle -> hertz: ATTEMPT 4 HAS READ: RED, STOP, sha 25e60015 done. Third distinct victim: spt-daemon::registry_lifecycle oneway_rounds_plateau_rows_seats_and_a_refresh_replays_nothing, panic :514 "held 0 -> 1, seats 1", 11.594 s (passed 10.8/10.5/23.3 s on a1-a3); the re-apply bound at :497 PASSED. Both prior victims PASSED (arm 12 25.136 s, mesh_recovery 8.341 s - the 15-17 s band never came, your discriminator was not tested). RCA: A's pump is a bare thread::spawn stopped by pump_stop (:386) and NEVER JOINED; b_held_before is sampled after gen-1's join with the pump's last 100 ms round possibly still in flight, so ONE straggler feed lands on B after the sample = one held row + one in-flight seat. The comment at :500-506 already names this face. Product path untouched by #272.

NEW RIDER (test-only), stacked on b359e40e (same file, same branch, second commit): (a) spawn_pump returns its JoinHandle; after pump_stop, JOIN it before the drains/sample so the pump's last round is ordered before b_held_before - check run_peer_pump exits at a round boundary on the flag (if it can block in a leg longer than the drain, say so and bound it); (b) the :514 panic prints the gauges AND the stream table (ids/families) from B's net-status so the next red names the row; (c) audit the same file for other flag-stopped-never-joined actors sampled by gauges (:417 already documents the gen-1 worker case); (d) predicates and the two directional assertions untouched. Then COMPOSE r3's head: rebase 88625fa0 + b359e40e + this onto 25e60015 (test-only, strict linear). BOXES: NOT YET - twohost-a/b run since 02:36:42Z, terminal ~03:15Z; I send "boxes are yours" then. Meanwhile write only. Proof legs when released: clippy both OSes, treqs, the three victim cells x5 each on both OSes in their heavy class, then the four converge binaries once.