# #302 — pump-round class: conditional remedy design

**Read-only, at `86696e17`; field reading pending. No remedy selected, code changed, build, or test run for this page.** `N` below is `crates/spt-daemon/src/nethost.rs`; `B` is `crates/spt-daemon/src/broker.rs`; test paths are under `crates/spt-daemon/tests/`.

## Two seams and relative fit

| Seam | Scope and hazards |
|---|---|
| **A — rc streams off the dial runtime** | Give rc receive pumps, writes, opens, and their deadlines an independently scheduled serving path. Moving only `serve_attach` is insufficient: the byte producer is already inside `register_stream` (`N:1100–1164`). An rc-only split needs classification before protection; today's dispatcher recognizes Attach from its first received line (`dispatch.rs:238–240`), so that first read cannot depend on the runtime being avoided. Moving **all established-stream work** instead avoids new rc-specific routing but widens the change. The QUIC endpoint is itself bound on the original runtime (`N:1286–1303`); moving application read tasks alone does not establish remote transport independence. Local loopback success would not prove remote rc fixed. |
| **B — dials off the rc-serving runtime** | Quarantine outgoing connect/prove work behind the existing `NetHost` interface, covering both `dial` and `submit_dial`, their shared 24-permit cap, errors, and cancellation. Keep endpoint/established-stream serving and the existing canary on the protected runtime. **Do not just move `submit_dial`'s spawn:** `DialPlan::connect` calls `register_conn`, whose ambient `tokio::spawn` creates close watchers and inbound acceptors; those in turn spawn stream readers (`N:975–1003,1050–1091,1138`). Explicitly hand successful connections to the serving executor before registration, or the streams follow the dials into quarantine. |

**[INFERENCE] B has better locality if candidate #1 is observed:** two outgoing entry points share one `DialPlan`; no rc-only stream interface is needed. Preserve `bounded_block_on` for protected stream operations rather than globally redirecting it. Its timeout/error classification is already centralized (`N:1469–1483`), and the canary can retain its meaning. A second executor must remain bounded; neither an unbounded blocking pool nor more workers is evidence of isolation.

**Candidate #2 is not automatically fixed by either runtime split.** `open_bi`, the send mutex, and `write_all` may legitimately wait on established-peer flow control (`N:1801–1815,1912–1918`). Broker open/send dispatch remains synchronous (`B:9719–9819`). Tokio 1.52.3 `Handle::block_on` polls the root future on the **calling thread**; spawned tasks/timers use its runtime (`tokio/src/runtime/handle.rs:244–246`). Changing the executor does not remove a caller's wait or a same-connection FIFO dependency. A fresh canary requires demonstrating the actual dependency from that parked broker connection to rc before choosing a remedy. Cooperative timeouts also cannot preempt arbitrary non-yielding code.

## Blast radius and existing guards

- **A:** stream creation, read/write ordering, FIN/EOF, replay, leases, and retentive backpressure. Shared consumers include attach, registry/notif/sync/update, WAN messages, presence, shell/tunnel, web, and other request/reply families (`dispatch.rs:214–232`; `N:1126–1164`). Existing guards: `attach.rs::{local_attach_via_loopback_conn_rides_the_same_pump, remote_attach_drives_a_real_pty_cross_daemon, attach_survives_target_brain_restart_exactly_once}`; `netstream.rs::{receiver_brain_restart_is_gapless_and_exactly_once, sender_brain_restart_redrive_is_exactly_once}`; `transport_death_eof.rs::transport_death_without_a_fin_surfaces_eof_to_the_serving_worker`.
- **B:** every outbound dial source, membership proof/roster exchange, presence ordering, journal replay, and connection retirement. Runtime ownership also serves inbound handshakes/pairing, pairing join/meet, endpoint I/O, and all stream readers (`N:1280–1396,1490–1515`); leave those ownership choices explicit. Existing guards: `netbroker.rs::{replayed_dial_op_is_deduped_across_brain_restart, dial_to_a_black_holing_peer_fails_with_a_bounded_ordinary_error}`; `pump.rs::{pump_survives_a_black_holing_peer_heartbeat_advances_no_restart, pump_w2_live_peer_advertised_amid_dead_peers_no_restart}`; `N:2673`'s bounded-operation ordinary-error test.
- **Important negative evidence:** both `net_worker_starve.rs` burst cells actually assert canary age **<300 ms** (`:170–175,222–227`), despite introductory diagnostic wording. They guard yielding under two dead-peer shapes; they are not evidence that the current field hitch is reproduced. None of the named guards alone proves simultaneous local/remote rc latency under the field workload.

## Proof using the same gauges

First retain the field baseline and reversible 600000-ms cadence/restoration reading; startup priming and wake edges remain distinct. For a subsequent admitted fix, keep comparable outstanding dial load and sample `net_canary_age_ms`, `active_dial_tasks`, broker timestamps, and query elapsed time alongside timestamped **actual PTY echo/output** in local and remote rc. For B/#1, require fresh serving canary while dials remain active, prompt rc traffic without burst-drain, and bounded ordinary dial failures—not a green result obtained by disabling dials. For A, the original canary may remain stale: unchanged load plus responsive rc proves isolation; the gauges alone cannot. Do not relocate the canary merely to manufacture green. For #2, fresh canary before and after is expected; prove the correlated broker wait no longer stalls rc while preserving FIFO/exactly-once/EOF behavior. **No further action until the operator's reading.**