#307 W1b — #49/#267 refresh-freeze RCA CANDIDATE
Hertz, 2026-09-16. Evidence-only; no product changes or remedy selected.

SUBJECT AND SEPARATION
main289e3cdfe39a8a4e91f5ea7d4b436f11a50b191e, independently built in .worktrees/hertz-307-evidence/target, jobs2; spt0.70.0 SHA2565c73973baf1eaa16cbd548fe75f553da7a87f98e892d936b7890618c736c93e8. Signer, broker, applying CLI and candidate derive from that same build. Producer receipt: producer.json. Todlando's separate #308 jobs2 lane was authorized CPU contention, never a shared pool.

W1c is NOT a #302 mechanism selection: isolated hfenduleam had no steady-state hitch during its45s baseline; ENLYZEAM0.69.0 returned ordinary status without the four diagnostic gauges, independently confirmed by SSH and ball-b locally. Doyle NQV5WRS2 rules the W1c cadence refresh failure into W1b evidence. The full120s cadence arm and exact byte restoration were completed; the refresh itself confounds any cadence attribution. Keep that experiment distinct from field #302.

OBSERVED FAILURE — TWO REAL REFRESH ARMS
1. W1c, no deliberate reader pause: actual spt rc over a real broker ConPTY, producer timestamps/counters,12/12 baseline child ACKs plus independent state, input RTT7–37ms. Required node refresh then stopped live input acknowledgements. New controller connections70/88/104 seated session1, produced screen snapshots, and each hit the physical15s write bound. Fresh canary0–26ms and active_dial_tasks0 throughout130 samples. Snapshot generation timestamps show the child progressed after refresh; receipt time is not contemporaneous execution evidence.54 post-baseline tags were not acknowledged within the window, not established lost.
2. W1b proper: same shape with sustained output and an explicitly paused rc stdout reader. Pause at1789524291759, real daemon refresh observed at1789524302488, resume at1789524322453. Original session1 controllerconn17 actually closed cause=detach at1789524302485. Replacement37/47/58 each seated and later physically poisoned; their slots closed earlier via cause=send_deadline. After reader resumption, buffered pre-refresh output and post-refresh child progress were both observed; maximum recorded delivery lag30696ms. This is not sustained input recovery: only the4 pre-pause tags gained child ACK+state. The full per-line clocks, counters and raw chunks are retained.

Q1 — OBSERVED, CALLER CAUSES PRESERVED
W1b session1:
 conn17: closed1789524302485, cause=detach; original brain connection.
 conn37: closed1789524310889, cause=send_deadline; physical poison1789524320210.
 conn47: closed1789524329487, cause=send_deadline; physical poison1789524338329.
 conn58: closed1789524345757, cause=send_deadline; physical poison1789524354386.
See w1b-run1/q1-controller-attribution.json for exact attachment lines and matching physical IDs. In W1c the corresponding original17 and replacement70/88/104 closures were cause=detach. Do not rewrite a closure cause to stall_evict merely because BRAIN_SUBSCRIBER_STALL_EVICT is adjacent. The timeout-observability bridge can emit that token without owning slot removal.
These events prove occupied-to-empty controller transitions, not voluntary clean close, exit of a blocked writer at the earlier slot-close instant, or end-to-end rc recovery. In W1b, slot closure precedes physical retirement by8629–9321ms. Those differences are NOT blocked-write-onset measurements. The producer/session, connection ID, attachment generation and supervised brain generation are distinct identities.

Q3 — REAL TRIAL ADMITTED; FALSE-GATE EVENT NOT OBSERVED
A new ephemeral debug key was trusted ONLY in the fresh W1b home. Main-built xtask signed the same immutable spt bytes as debug version1 with brain IPC1/resource ABI1. No synthetic state, debug-mark-applied, signature bypass or broker metadata edits. update apply returned0. The watcher observed the product-written applied-pending record at1789524393282, candidate_started_ms1789524393263, then matching-hash brain55496/generation2 readiness at1789524397720, Applied at1789524397822, and BRAIN_PROMOTED generation2. Candidate/installed hashes remain the pinned SHA.
BRAIN_PROMOTE_GATE_NOT_DRAINED was NOT OBSERVED in this trial/window. Do not translate that into proof all old writes drained. The requested correlation between replacement-controller failure and a not-drained gate was NOT established:
- The same-node rc connections are by=Some(nodehex), despite role=brain. broker.rs2859–2861 excludes them from local_controller_wedged; brainproc.rs734–741 aggregates that narrow predicate. Same machine is not by:None ownership.
- The detach/fresh-attach arm returned a defunct-session refusal before the signed trial. Its generator PID58496 was independently observed alive, still a child of owned broker48212, at02:07:16Z. No successful fresh attachment or live blocked trial-controller is claimed. This contradiction is preserved, not diagnosed here or silently repaired.
The trial proves authentic admission, restart/readiness and promotion. It does NOT exercise a ready-latched false DRAINED read. No claim of a Q3 false-branch success.

LEADING RCA CANDIDATE [INFERENCE]
Refresh reconstructs the held attach stream and its retained input history. A synchronous operation in the replacement worker's sole consumer thread stops it draining the shared stream/controller IPC carrier. Physical connection poisoning correctly contains that incident, but retries recreate the same consumer conditions three times and then terminalize the claim for that dispatcher generation. This explains how all the containment fixes can work while the viewport stays frozen; it is not yet an identified blocked instruction.

Most specific remaining suspect: the buffered pre-Subscribed input flush in attach.rs754–755 calls Brain::send_effect (ack=true), whereas the established controller path at674–677 deliberately uses send_effect_no_ack to avoid input-ack backpressure. LSP resolves the former to brain.rs921–922; send_effect_inner943–955 performs a synchronous request write. Broker8898–8936 deduplicates the effect but still sends Applied for requested acknowledgements. A write-only replay batch can recreate the already-documented return-direction cycle while the same receiver carries stream and controller output.
IMPORTANT: send_effect does not itself wait for Applied. The candidate is generated reply traffic plus synchronous writes without receiving, not an imaginary acknowledgement-wait API. Pending batch length, pipe occupancy and worker stack were not captured; these observations do not prove the batch is sufficient to fill the pipe.

Competing candidate: synchronous output forwarding on the separate wire Brain blocks the sole serve thread. attach.rs899 -> brain.rs2108–2120 -> broker.rs9832–9835 -> nethost.rs1912–1921. The two-connection split removes one shared-handler coupling but does not make the serving thread asynchronous. Fresh canary permits a yielding per-stream wait. Ordinary send_stream is bounded10s; an unbounded QUIC await is not established.

Lower-ranked explanations:
- A pure cursor/reset bug should show continued reads/discards or explicit gap failures; it does not alone explain a non-draining carrier reaching15s.
- A parser-only rig failure cannot explain the stopped independent child-input ledger or the daemon's own repeated physical write failures. All raw output is retained, no reader errors occurred, and W1c had no deliberate pause.

WHY PRIOR FIXES DID NOT CLOSE THIS OBSERVED CLASS
- Physical BrokerConn poison/cancel/sever prevents immortal Windows writes. We observe different physical IDs, writer exits and transport closes: do not call that containment mechanism broken merely because recovery fails.
- Cursor-only brain resume and heartbeat reap prevent old undrained local subscriptions. BRAIN_RESUMED proves cursor establishment, not a functioning rc stream.
- Stream subscriber replay is off the log lock; fresh leases isolate predecessor failure; duplicate same-connection establish is idempotent. The logs reach decision=idempotent and stream-sub-writer-poison says LIVE write failed, meaning the subscriber writer completed its initial replay iteration. Do not claim the old replay-under-lock mechanism is reproduced.
- Those fixes leave the pending-input acked flush and synchronous work in the sole consumer thread unchanged.
- Observed os233 failures are ordinary Transient, not SeatBlocked: dispatch.rs373–383 only recognizes subscriber busy/replay halted/lease canceled for that class. Attempts0/1/2 match the three-attempt terminalization in343,503–545. The seat-blocked breaker is not the observed recovery path. A fresh brain generation recreates claims and can repeat the failure.
- The promote gate excludes by:Some rc controllers; a successfully promoted update does not certify viewport progress.

WHAT WOULD DISCRIMINATE THE CANDIDATE — NOT EXECUTED HERE
Capture the replacement serve worker's blocked call and pending-input/read progress during the15s window. Leading candidate predicts write_frame reached from the acked pending_input flush, with nonempty pending input and a blocked reply path. Empty pending input on all attempts or a stack in outbound wire forwarding falsifies that specific candidate. A controlled same-output comparison with versus without pre-refresh input history separates history-dependent reconstruction from generic egress backpressure. Preserve existing gauges and real failure condition; do not choose a remedy solely from agreement with this narrative.
Existing tests are narrower: manually orchestrated two-input restart, fresh prepopulated PTY ring, or production redispatch after deliberately rolling the stream ring to8 chunks. They do not by themselves establish production pinned-opener plus retained-original-opener/input-history recovery under this real rc workload.

BOUNDS, RETENTION, SAFETY AND VERIFICATION
Fresh explicit homes and production-library-derived socket names; native named-pipe server PID, retained owned broker handle, birth/image/ancestry and resident/ancestor exclusion gates before every rig mutation. Resident fleet untouched. Read-only ENLYZEAM version/status only; no config change/refresh/restart there. All field findings cite box and route; no roster/subnet body redistributed.
W1c observed235.39s plus bounded teardown, native total253.252s; ordinary stop refused the disposable live session, then the owned native job confirmed all processes gone. W1b observed201.531s, native total204.157s; guarded isolated stop --force returned0, no survivor/unknown, sockets absent before job close; native job active_processes0. Both remain within300s observation +120s teardown, no phase truncation. Homes, logs, binaries, signed set, output/input transcripts, original/restored config bytes and native receipts retained. W1c cadence-written bytes are explicitly labeled a deterministic reconstruction, not an independent runtime file snapshot.
Native main build0. traceable-reqs0.4.1:922 complete,0 incomplete,0 findings, exit0 (artifact://804). No product changes, new permanent tests, resident lifecycle mutation, pool sharing, or fabricated trial state.