# REDISPATCH-STALL — v0.34 field-stall RCA summary (hertz 2026-07-16, doyle seam-verified same day)

Repo-side condensation of the hertz RCA delivered 2026-07-16 (full text rode the
doyle sptc-drain spill; fix design 1–9, the seven-test matrix, and the
fast-field-discriminator were accepted as filed and ride
`docs/REDISPATCH-STALL-TRIAGE.md` verbatim).

## Field shape

- Live v0.34 boxes: recurrent 20–30s PTY/RC freezes, observed DISPATCH tails
  17–62s; poison interarrival median 95.5s.
- 33 observed `CONN_WRITE_POISONED` windows, ALL 15,000–15,154 ms exactly —
  the round-4 SharedSend bounded-write deadline (15s) firing back-to-back.
- 4361 `stream-sub-attach` records per brain generation, 584 `PUMP_PEER_FAIL`.
- Per-stream, not broker-wide: unrelated conns progressed mid-poison
  (broker-wide-wedge theory FALSIFIED).

## Mechanism (composition, not one new timer)

REDISPATCH-TRUTH W1's retryable claims (500ms/1s ×3) compose with the broad
`Err(_)` opener fallback (`dispatch.rs:414` — the comment intends
old-broker-only, the arm catches ANY error including transport
timeout/EOF/poison) to repeatedly manufacture throwaway peek subscribers.
Each `StreamLog::attach` (`nethost.rs:322`) synchronously replays the ENTIRE
retained ring under the per-stream mutex; `let _ = sub.write(&frame)` discards
errors, iteration continues past failure, and the poisoned subscriber stays
installed — so one wedged subscriber conn converts replay into serial 15s
poison windows held under the lock. Those windows compose with unbounded
Whole-brain reads + a distinct unbounded wire conn + the NetHost 10s send into
the observed 17–62s DISPATCH tails.

## Companion (control-steal precision)

D1/D1b prove FINISHED rows never serve. The observed steal likely rides
UNFINISHED-stale rows (raw-close no-FIN viewports — the emphasys C2 leak class
feeds this). Discriminating observable on the next live catch: the stolen
row's `finished` + `retired` flags. Fix 6 (ownership/generation validation
before attach/detach) covers both shapes.

## Explicitly NOT this

`update --restart`'s 30s rc reconnect loop is distinct and bounded.

## Live field catch (hertz, 2026-07-16 — post-triage corroboration)

Caught in-flight on webbie/v0.34 (hertz box, `daemon.stderr.log` lines
44707–44769; byte-for-byte snapshot preserved at
`C:\Users\decid\.omp\state\spt-endpoint\webbie-v034-live-stall-daemon.stderr.log.snapshot`,
6,909,235 bytes): stream 7058 — subscriber conn 18248 attach/write
wall=1784249643389 → `CONN_WRITE_POISONED` wall=1784249658401 (**+15.012s
exact** — dead center of the fingerprint) → `DISPATCH:7058 Failed(fill whole
buffer)` +1.046s post-poison → retry subscriber conn 18273 +3.034s
post-poison, clean close in 8ms. `daemon status` answered in 0.39s DURING the
window (net_up=true, heartbeat current) — per-stream transient wedge
CONFIRMED, broker-wide IPC freeze falsified a second time on live data.
Identity caveat: logs do not bind stream 7058's opener to webbie — timing
correlation only; fix 9's endpoint-keyed telemetry closes that gap
(counter-63 catch = bound proof). This trace is the before-baseline for the
field discriminators.

## Where the full design lives

`docs/REDISPATCH-STALL-TRIAGE.md` (fix set 1–9, seven-test matrix, gate
rulings, field discriminators) + ADR-0038 Amendment (2026-07-16) +
KNOWN-HAZARDS 7.43.