doyle DISPATCH — #307 W2b: #49/#267 refresh-freeze remedy. Queue order on your lane: #308 (hand to gate) -> #310 (small) -> THIS -> #309.

Evidence you build on (hertz W1b, gated by me): .spt/preserved/307/hertz-w1bc/RCA-CANDIDATE.txt + w1b-run1/RECEIPT.json + q1-controller-attribution.json. Reproduced twice on isolated 0.70.0 homes: after `spt daemon refresh`, original controller conn closes cause=detach; replacements seat, then each hits the 15 s write-poison bound (slot closed cause=send_deadline ~9 s before physical poison); three attempts then terminalize the claim; input ACKs never resume. Canary fresh, dials 0 => not network.

LEADING CANDIDATE (inference, not proven): attach.rs ~754–755 flushes pre-Subscribed pending input via brain.send_effect (ack=true) while the established controller path at ~674–677 uses send_effect_no_ack; the acked replay batch generates reply traffic + synchronous writes on the sole consumer thread that also carries stream/controller output -> return-direction cycle. COMPETING: synchronous output forwarding attach.rs ~899 -> brain.rs ~2108 -> broker.rs ~9832 -> nethost.rs ~1912 blocking the serve thread.

RCA-first, two steps, SAME rig (hertz's rig.py under .spt/preserved/307/hertz-w1bc/; hertz is packaging it as a reusable regression rig with a pass predicate):
STEP 1 — discriminate, no fix yet: instrument the replacement serve worker so the 15 s window records (a) pending_input.len() at the flush, (b) which call blocks (write_frame from the acked flush vs outbound wire forwarding) with a timestamp, (c) reply-path state. Run on the rig; report. Falsifiers: empty pending input on all attempts, or the block in outbound forwarding => the flush candidate is dead and you pursue the competing one.
STEP 2 — remedy per step 1: if flush confirmed, the fix must remove the acked synchronous replay from the consumer thread (no_ack like 674–677, or drain off-thread) AND must explain why the three prior containment fixes (poison/cancel/sever, cursor-only resume, off-lock replay) left it standing — write that into the issue comment. Prove with the rig's unchanged gauges: input ACK RTT resumes after refresh, no write-poison on replacements, on a candidate build. Red-first: the rig is red on 289e3cdf (already measured).
Test evidence: one deterministic regression cell in crates/spt-daemon/tests (hertz will hand you the rig shape), traceable REQ activated in the same commit. Thin PR off current main. Do not touch the promote gate's by:Some exclusion in this lane — separate question, note it if you meet it.