HERTZ RCA — `spt daemon refresh` / `spt update` freezes existing remote session PTYs

Verdict: target-brain refresh exposes a production redispatch bug. Hosted PTYs and broker-held QUIC streams survive, but active remote attach handlers are brain-owned and must be reconstructed. The fresh dispatcher indiscriminately replays every historical peer stream still in the broker table—including finished attach streams—and can let stale workers steal and then clear current controllers. A second adjacent defect prevents recovery when an active stream's opener has rolled out of its bounded history.

Causal chain:
1. `spt daemon refresh` raises the supervisor brain-restart signal. Broker and hosted PTY child/master resources remain alive; only the brain process and its dispatcher/serve workers die. `spt update` uses the same brain-cycle path after apply.
2. Every active cross-node `spt rc` has a peer-initiated broker-held net stream. Its target-side `serve_attach` worker owns a broker connection labelled `role=brain stream-subscriber stream=X controller session=Y`; therefore that semantic relay dies with the old brain even though the PTY and QUIC stream remain.
3. The new brain intentionally resumes only hosted session cursors at boot. After net startup it launches a fresh `dispatch::run_dispatch_loop`, whose empty per-process `claimed` set enumerates every broker-held peer stream.
4. Finished streams are never removed from `NetShared.streams`; `StreamLog::finish` only marks them finished. A new dispatcher therefore replays all historical attach streams, not only active streams.
5. Each replay worker reads the old `AttachRecord::Request` and calls `attach_as(Control, same origin)`. Same-identity takeover silently calls `become_controller`, so it can supersede the legitimate newly reconstructed/current worker without a `Displaced` signal. Replayed EOF then calls `detach_session`, clearing the controller the stale worker just stole. The legitimate active serve loop stays open and believes it is Controller, but its sink is no longer selected, so the operator sees a frozen PTY.
6. Detach + `spt rc` creates a fresh stream whose worker runs after the stale replay storm and takes control again, explaining immediate recovery without a PTY restart.
7. Adjacent recovery defect: reconstruction classifies a stream by `peek_first_line(stream_id)` from sequence 0. `StreamLog` is a bounded 4096-transport-chunk ring and does not preserve protocol openers. An older/high-input active attach stream can lose its Request; replay then starts at Input/Resize, mid-record, or a gap/error. `claimed.insert(stream_id)` happens before spawn and is never cleared or retried on `Unknown`/`Failed`, so that active stream is permanently abandoned too.

Why 4/5, not all: the primary outcome depends on each endpoint's historical finished attach streams and worker scheduling; the adjacent outcome depends on retained history/activity. Four endpoints had a stale replay takeover and/or unrecoverable active opener, while the unaffected endpoint had neither winning condition in that refresh. On the later update, lia also hit one of them. Endpoint identity itself is not causal.

Field evidence on HFENDULEAM:
- Brain generations 2 and 3 both log `BRAIN_RESUMED: re-established 7 session cursor(s)` and `BRAIN_NET_CONSUMERS_UP`.
- During those generations the new dispatcher logs failures for persistent and historical streams: `DISPATCH:741:Failed("No process is on the other end of the pipe. (os error 233)")`, `DISPATCH:3:Failed("failed to fill whole buffer")`, `DISPATCH:4496:Failed(...)`, and `DISPATCH:4176:Failed(...)`. The very low and current-looking stream IDs in the same fresh generation are consistent with indiscriminate historical replay; the failures prove one-shot redispatch workers were abandoned. They are supporting evidence, not a one-log-line-per-frozen-endpoint mapping.
- Detach + `spt rc` reattach restores each session without restarting its hosted PTY, proving the PTY itself did not freeze.

Exact code seams:
- `crates/spt-daemon/src/applyhost.rs`: refresh/apply requests the same supervisor brain cycle.
- `crates/spt-daemon/src/dispatch.rs:194-232`: fresh dispatcher; one-shot `claimed` insertion before spawn.
- `dispatch.rs:255-305`: opener replay/classification from seq 0, then fresh family worker.
- `dispatch.rs:335+` → `attach::serve_attach`: target attach reconstruction.
- `crates/spt-daemon/src/nethost.rs`: `DEFAULT_STREAM_RING_CHUNKS = 4096`; bounded `StreamLog` append/eviction.
- `NetShared.streams` has no finished-row removal path; `StreamLog::finish` marks EOF but leaves the row discoverable by every future dispatcher generation.
- Existing `attach_survives_target_brain_restart_exactly_once` manually re-serves a known short stream, so it bypasses production rediscovery/classification and never rolls the opener.

Recommended source fix:
A. Remove/retire finished stream rows from redispatch eligibility while preserving only the lifecycle state genuinely needed after EOF. A fresh dispatcher must never re-serve a terminal Attach request.
B. Make active-stream dispatch identity restart-durable and independent of evictable transport history. Store an immutable bounded opener/classification fact with each broker-held inbound stream (or pin the complete first NDJSON record outside the rolling data ring) until stream close. Recover family + cursor from that metadata, not ring seq 0.
C. Make dispatcher claims retryable: remove/requeue a claim after transient worker setup failure. Do not hot-loop terminal outcomes; explicitly distinguish active/retryable, served, and finished streams.
D. Add production-path regressions:
   1. Create a finished historical Attach plus a current active Attach for the same endpoint/origin, restart only target brain/dispatcher, and prove the historical stream neither takes nor clears the current controller; current input/output remains exactly once without detach.
   2. Push >4096 transport chunks on an active Attach so seq0/opener is evicted, restart dispatcher, and prove durable classification resumes the same operator stream.
   3. Inject one transient worker-start failure and prove claim retry recovers without duplicate controller/output.

This is the source-level RCA. No live refresh/update was rerun during diagnosis; the live incident logs plus code path were used to avoid freezing active sessions again.