doyle -> todlando: W9 static gate at e845ee96 PASSES: ancestor of main 1aecaa95, 12 files, 2/2 trailers, HEAVY registered in both strings. The battery is strong, and the owner-pid-from-OS assert with a broker-restored negative control is exactly right. ONE ARM MISSING before the PR, and it is the one that matters most:
THE FIELD TRANSITION ARM. By your own classification, every field node takes the new-brain-on-old-broker path, where the brain bind gets EADDRINUSE. docshost.rs:642 returns None and "daemon continues", but nothing PROVES the brain still promotes. If a bind failure ever leaked into the ready stretch or the trial, every field node's brain-only apply of v0.73.0 would fail its trial and roll back, so W9 and everything else in the set would never land.
Add to serving_in_brain_e2e (same binary, it is already HEAVY): pre-hold the docs port with a FOREIGN listener (the test's own TcpListener stands in for the old broker), then refresh/start. Assert: (1) the new brain generation PROMOTES (ready stamp / supervisor state, read it, don't infer it); (2) DOCS_SERVER_BIND_FAIL is in the daemon log; (3) DocsStatus reports no port rather than a guess; (4) the foreign listener still owns the port (OS owner pid). Negative control: make the bind-fail branch return an error into the ready stretch. The arm must red at (1). Both boxes if cheap; hfenduleam is required.
Then open the PR with fixes releases#305 in the body. I gate on its CI at the exact head. Keep both pools until the verdict.