# Golden 34946493637 (S4 `35d6f7a3`) — Windows `test` job 104307076933 red — RCA + referral (doyle, 2026-09-15 09:35Z)

## What failed
- Phase A: 3463 run / 3463 passed / 1 skipped (green). Phase B: 239 run / 238 passed / **1 failed**. FLOOR_DOCS 99.6 GB, FLOOR_END 95.6 GB — both PASS (not a resource red).
- The one cell: `spt::live_adapt_translation_swap_e2e adapter_apply_for_foreign_adapter_leaves_live_endpoint_untouched` (43.05 s; normal 5–12 s).
- Panic: `crates/spt/tests/live_adapt_translation_swap_e2e.rs:1037:5` — `PRECONDITION: the cc endpoint must bind ONLINE before the foreign apply.` The cell's own summary line: `run_ok=true online=false harness_pid=Some(18832) apply_ok=true cc_untouched=true other_swapped=true harness_alive_after=true still_online=false`, cc hash unchanged before/after, other adapter swapped. Every product assertion the cell exists for held; the PRECONDITION (endpoint status reaching `ONLINE` within a 25 s poll of `read_info(self_perch).status`) did not.

## Mechanism — instrumented in the broker stderr the cell captured (order as printed)
1. `SPAWN_PHASE:ccX phase=pty_created t_ms=497 pid=Some(18832)` — harness up.
2. `CONN_LIFECYCLE ... event=controller-attach session=1 ... mono_ms=3875` — local controller bound.
3. `SPAWN_PHASE:ccX phase=waiter_armed t_ms=3618`
4. **`CONTROL_REAP_NO_SESSION:ccX: cleared stale controlled/driven_by/viewer_count (no broker session)`**
5. **`LIVENESS_RECONCILE_OFFLINE:ccX: no live broker session (dead harness)`** — `livehost.rs:991`, preceded by `BrainLifecycle::mark_offline(&perch, ...)` (the OFFLINE write, CAS-guarded on the session the reconcile observed = none).
6. `SPAWN_PHASE:ccX phase=translation_ready t_ms=4332` / **`phase=row_inserted t_ms=4332 session=1`** — the broker publishes the session row AFTER the reconcile already normalized the endpoint offline.
7. `CONN_LIFECYCLE ... event=writer-exit reason=channel-closed mono_ms=7709` then `session-detach session=1 was_controller=true` — the `spt endpoint run` CLI's local controller connection ends (run_ok=true), nothing re-marks ONLINE; the poll expires at 25 s.

This is the mechanism the #309 RCA (hertz, `er-briefing-arm6-rca.json`, sha 3fc7ea65…) named as a "strong inference, not instrumented proof": *a pre-existing spawn-publication vs liveness-reconciliation race — the harness can bind before the broker publishes its HostedSession; livehost discards `bringing_up` and terminal-normalizes the bound endpoint as dead.* Here the offline write and its ordering ARE captured. Same mechanism, second signature.

## Not introduced by the candidate
- S3 → S4 changed two changelog blobs. S3 changed one daemon test body + a fixture bin. Fix-2 changed `bootstrap_firewall` only. `livehost.rs`, `info`, `liveness`, broker, and this test file are unchanged since S2 (the #309 RCA's 9-blob proof covers them; this cell's file was not in any #304 diff).
- History of this exact cell: PASS in every consumer leg on 7890ead3 and S3 (Windows attempts, Linux legs; 5–12 s) and PASS 10.1 s in golden 34474627303 (09-10). Golden 34481993681 (09-10) had an unrelated phase-A red. One red sample here; rate unmeasured (cohort rig being prepared by hertz, runs after the twohost jobs leave the box).

## Protocol position
- Ruling A + A' (Reavo, 2026-09-15) + deployah DT5AOKTE: only the CLASSIFIED #308 (`:568`, registry lost-update) / #309 (`:782`, ER briefing liveness) signatures qualify for the one same-sha rerun; anything else ⇒ stop-and-refer.
- This red is the **#309 MECHANISM on a NEW SIGNATURE** (`live_adapt_translation_swap_e2e:1037`). By the letter it is unclassified ⇒ referred. Whether the #309 classification extends to this signature is the operator's decision, not the gater's.

## Options for the operator
- **A (extend #309 to this signature):** record on #304 that #309's mechanism has a second, now-instrumented face; deployah reruns the Windows test job ONCE by id (with the traceability + Linux test reruns, both rig-fixed); a second red of any kind ⇒ stop. Originals retained. Ships on record with #309's scope widened to two signatures.
- **B (hold for a cohort):** hertz's cohort (serialized x10 with green-output capture + one full phase-B arm) measures the rate and confirms the ordering on green runs; ruling after the numbers (adds ~1 h on hfenduleam after twohost finishes).
- **C (hold #304):** no rerun; #309 fix lands first. (Not recommended: the ruling already accepted shipping with #309 on record; this is more evidence of the same defect, not a new one.)

Gater's measurement, not direction: A is consistent with the ruling's intent (ship on record with #309 named); B costs an hour and turns "strong inference" into a rate; C changes the ruling.