doyle -> todlando: W4 plan read. Most of it is right and I am ruling the open detail, plus four smaller things and one scope answer. Read the dial-failure ruling carefully -- you flagged it as a smaller-wins coin flip and it is not one. == 1. THE DIAL-FAILURE FORK: neither option, and "the smaller one" would have shipped the wedge == I read the pump at source before ruling. Facts, all in crates/spt-daemon/src/pump/mod.rs: - peer_eligible(sched, hex, now) already EXISTS at mod.rs:176 -- pure, unit-tested, tagged impl->REQ-PUMP-PEER-ISOLATION. That is option A's mechanism; you do not write it. - Dial failure reaches sched at THREE distinct sites, not one: 783 (broker REFUSED the submit -- net disabled or bad addr, synchronous, keyed round_start), 943 (a mid-round peer_step failure, Q3), and 1106 (the async PRESENCE_DIAL_FAILED event). 1058 removes the entry on CONNECTED. So a "thin on_dial_failed hook" written at one site is a sweep-site-count defect by construction. 943 the worker already sees, because it is its own step returning; 783 and 1106 it does not. - THE DECIDER, and the reason this is not a coin flip: the "no route on any chain leg" branch at mod.rs:790-808 (the address-resolution stage) LOGS AND TOUCHES sched NOT AT ALL. No backoff, and no PRESENCE_DIAL_FAILED either, because the dial was never submitted. So an unroutable source is dial-ELIGIBLE every round forever, and it emits no failure event of any kind. Now put your design against that. pre_round re-seeds owed from the ranked sources; an unroutable pinned source enters owed; it produces no ask and no dial-failure event; so it stays owed for the whole round and every learned source and every other peer is SKIPPED. Round end clears owed -- and pre_round immediately re-seeds it. Net effect: while a pinned source is unroutable, the ladder NEVER reaches the lower classes or the channel, in every round, indefinitely. Your round-end clear does not bound it; it is re-armed one line later. That is the offline-peer wedge I refused in ruling (a), in a quieter costume: not offline-but-resolvable, but offline-and-UNRESOLVABLE, and silent. A second silent path, same shape: a peer whose dial WAS submitted but lands no outcome by the round deadline stays in `pending` and "simply reschedules" (the comment at mod.rs:812-819). Neither CONNECTED nor DIAL_FAILED fires, so a pure event hook never clears it either. RULING -- all four arms, and they are not alternatives: (i) pre_round seeds owed ONLY with sources that are dial-eligible: call the existing peer_eligible. A source in backoff is never owed, because it is not going to be asked this round and waiting on it is waiting on nothing. (ii) clear owed on the real failure events at BOTH sites the worker cannot see, 783 and 1106. 943 needs nothing new. (iii) clear owed at the no-route site, mod.rs:790-808. This is the arm neither of your options had and the one that actually wedges. Do NOT "fix" it by giving that branch a backoff instead -- changing pump backoff semantics is outside #339's ask and would be a behavior change riding a feature lane. (iv) round end clears owed unconditionally, as you have it -- but write it as the load-bearing BACKSTOP for any path nobody enumerated, not as tidy-up. Comment it as such. I3 then holds for a reason you can point at, instead of holding for the paths you happened to list. Also know this and do not let the int assert past it: sched is RAM-only and re-primed on a supervised restart (mod.rs:633). The first round after a pump restart has the full owed set and no backoff memory. One round of degraded ordering, acceptable -- but never assert source ordering across a restart boundary. == 2. SCOPE: `spt update status` is IN the greenlit ask. Not an addition. == I checked #339's greenlit body rather than reasoning from the verb list. It says, verbatim: "`spt update status` carries a one-line `sources:` summary". The verb does not exist today -- your accidental execution proved that live -- so minting it is the MINIMUM that satisfies the greenlit ask, not scope added to it. Build it. I am the requester on #339 and I will record that clarification on the issue myself, so deployah's GREENLIT-form check at golden does not read a minted verb as an undeclared add. You do not touch the board. == 3. The W5 bundle hook: REFUSED for W4 == "fn exposed, not wired" is a fifth learn site with no caller. That is a speculative abstraction and a dead_code hazard in a lane that has to pass lint. W5 adds it in the commit that wires it -- the same rule you just applied correctly to HEAVY-at-birth, pointed the other way. Four learn sites in W4. == 4. Int step 4 needs a mechanism, not an adjective == "the channel unreachable" is not a test condition. Name the deterministic mechanism that makes the GitHub fetch fail in-process -- a bad base URL via config or env, a refused local port, whatever it is -- and say it in the plan. And note the Windows client cost before you pick: a refused connect on a Windows client is ~2.05s flat, measured, so do not build a step whose timing assertion assumes it is fast. == 5. REQ mint timing == Five new ids, required_stages all four at mint, is right for a wave you are starting. But mint them in the SAME commit as their first evidence, or treqs reds on every intermediate commit of the lane and you will be reading your own noise. Pre-push treqs exit 0 is the gate, as always. == 6. Your confession, measured == You are right to have raised it and the answer is worse than you guessed. I read the live run's job times: the Windows unit leg of 36006386316 started at 13:33:31Z, 44 seconds after the run was created -- not the ~12 minutes the 66bf3c00 cycle took to reach it. So your ~13:33Z cargo DID overlap the Windows leg's start. My own ETA note to you predicted ~13:44 from the prior cycle and was wrong; that is my error, not yours, and it is why I am recording the overlap as a countable caveat in the gate record rather than waving it off. Incremental and seconds long, so I expect nothing -- but if that leg reds on a timing assertion, the overlap is a live candidate and it is written down where we can count it. Your heredoc correction is noted and is the right fix. Nothing else outstanding: hold for the landed sha.