{
  "dispatch": "PU5JXWGG",
  "candidate": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
  "scope": "Read-only source, git-object and completed-log analysis. No build, test, cohort, target inspection, producer control, or source edit. Arm6 final verdict remains Doyle-owned.",
  "conclusion": "The observed sample never exhausted the two-respawn budget. The test sent eight events with fixed600ms sleeps, but seven were accepted into the initial worker before its first fault; the eighth caused only respawn1/2. The test then stopped driving and tore down the PTY. This definitively invalidates its fixed-sleep assumption that every iteration advances a fault/respawn generation. It does not demonstrate unbounded respawn or failure of the exhausted-budget give-up branch. The golden30s IPC timeout does not govern these eight probes.",
  "evidence": {
    "log_and_source_proof": "c1-strike-arm6-proof.json",
    "running_log_snapshot": "c1-strike-arm6-running-log-snapshot.log",
    "source_root": ".worktrees/hertz-304-phase-b",
    "observed": {
      "runner_seconds": 5.297,
      "prior_pass_seconds": 3.028,
      "spawn_row_inserted_ms": 40,
      "injections_before_first_fault": 7,
      "total_accepted_injections": 8,
      "translation_faults_logged": 2,
      "respawns_logged": 1,
      "respawn_log": "attempt 1/2",
      "inits_logged": 2,
      "attempts": 8,
      "saw_spool": false,
      "row_removed_lived_ms": 5195
    },
    "sequence": "Snapshot738-745: seven ENDPOINT_INJECT acknowledgements precede the first COMMIT_MISS/FAULT at746-747. Respawn1/2 at748, eighth inject749, second miss/fault751-752, row_removed753, then final gate754. No respawn2/2 or GIVEUP line. The prior PASS is attempt1-phase-b.log:215. Snapshot/proof files retain exact bytes and lines."
  },
  "test_vs_product_boundary": [
    "inject_control_wedge.rs:2033-2038 configures nocommit,300ms commit deadline, strike budget1, respawn budget2. init_wedge_home:550-556 sets settle80ms. These are independent of the golden attach knobs.",
    "The loop at2051-2062 assumes600ms after an acknowledged event means that worker has faulted. It sends at most8 events and exits early only when its bool helper returnsfalse. saw_spool=false and attempts=8 therefore prove all8 returnedtrue, and all8 sleeps ran, including the last.",
    "broker.rs:9183-9203 acknowledges delivered=true immediately after event_tx.send succeeds. That is queue acceptance, not worker completion, commit, fault, or durable spool. The worker executes asynchronously and serially; multiple accepted events can belong to one still-unfaulted generation.",
    "broker.rs:9173-9182 respawns only when a NEW inbound request observes an already-faulted translation. respawn_faulted_translation:8980-9001 gives up only after the shared counter reaches budget2; successful rebuild increments that counter. One logged respawn plus two Init lines is initial binary plus one replacement, not exhaustion.",
    "The second fault after the eighth request needs another inbound request to trigger respawn2/2. That replacement must then fault and a later inbound request must observe exhaustion before the give-up reply can occur. The test sends no requests after iteration8. Absence of2/2 is expected for the actual drive sequence, not evidence of a broken budget.",
    "Test lines2075-2079 snapshot Init count, then explicitly kill the session PID before printing the gate and asserting. row_removed before the gate is consistent with this fixture teardown. It is not evidence that a long probe continued after a spontaneously dead session. Exact process-exit cause is not separately captured; no live process was inspected."
  ],
  "golden_knob_question": {
    "answer": "No direct30s read-timeout effect on the eight delivery probes; the proposed2s-error-versus30s-block explanation does not fit this call path or observed result.",
    "setup_only": "spawn_xlate_session:1299-1317 constructs Brain::cold_start_pump with attach_ipc_deadline and uses it for spawn_session. The returned controller is retained but this cell never calls a result-gating read through it afterwards. Setup succeeded at row_inserted40ms, far inside either2s or30s.",
    "actual_probe": "deliver_endpoint_event:1146-1194 opens a fresh raw LocalSocketTransport, sends Brain hello and KIND_ENDPOINT_INPUT, reads frames on a helper thread, and returns rx.recv_timeout(deadline).unwrap_or(false). Caller2055 passes fixed Duration::from_secs(3). It does not call attach_ipc_deadline, cold_start_pump, Brain::read_event_until, or attach_gate_watchdog.",
    "false_direction": "Connect/hello/read errors and the fixed3s outer timeout returnfalse;2056-2058 sets saw_spool=true and BREAKS. They do not let the eight-iteration loop advance. Such errors can produce a false-positive give-up observation, not this saw_spool=false red. All8true means every probe received an explicit delivered=true reply within its3s outer bound.",
    "time_accounting": "8 successful iterations entail8x600ms=4800ms nominal sleeps. The5.297s whole run leaves497ms for setup, probe exchanges, checks, teardown and runner overhead beyond those sleeps. This is an arithmetic remainder, not measured per-call latency, but it excludes a multi-second/30s blocked probe in this sample. The worker runs concurrently with those sleeps.",
    "limits": "The environment differs globally between arms, and co-load/scheduling can differ; source analysis does not prove every indirect process-timing effect impossible. It does exclude these deadline knobs as the configured timeout of this cell's eight probes."
  },
  "why_600ms_is_not_a_bound": {
    "source": "broker.rs:5087 onward receives an event and may settle before calling drive_one_sequence. drive_one_sequence:4969-4974 opens a mutex-protected floor and performs child.send BEFORE starting the300ms commit deadline. After the timed command wait, floor flush occurs; miss handling then re-spools and stamps the perch before faulted=true (5213-5246,5299-5318). Thread scheduling, lock acquisition, synchronous write, spool/stamp I/O and post-timeout scheduling are not bounded by that300ms command-read budget.",
    "observed_vs_unknown": "Seven queue accepts before the first fault show the test advanced multiple iterations while the first generation had not completed the relevant transition. The artifact does not timestamp worker scheduling, child.send, deadline start/end, respooling, or fault stamping. The exact delayed operation is unmeasured; do not relabel it a proven scheduler stall, syscall stall, or30s IPC wait.",
    "classification": "A pre-existing test-observation/drive defect is established: fixed sleeps plus attempt count stand in for generation transitions. An underlying worker-latency problem is not independently excluded, but this red does not exercise exhausted-budget behavior and cannot establish a product infinite-respawn bug."
  },
  "preexisting": {
    "proof": "The inject_control_wedge.rs git blob is identical at527cd8e8 and7890ead3; exact ids in c1-strike-arm6-proof.json. broker.rs identity across those commits was independently proved in er-briefing-source-and-sequence-proof.json. The fixed600ms/eight-attempt mechanism is not introduced by bootstrap_firewall fix2.",
    "prior_green": "Attempt1 PASS3.028s confirms an earlier observed success, not immunity to this asynchronous timing gap; its internal generation timings were not emitted."
  },
  "recommended_fix_after_GO": [
    "Drive actual bounded fault/respawn generations under an explicit overall wall-clock bound: observe a generation's completed fault transition before the next inbound that is intended to trigger its replacement; verify exactly the allowed replacement generations; then send the final probe and require the explicit exhausted-budget delivered=false acknowledgement. Keep PTY/controller alive until those observations finish.",
    "Do not use only the existing translation_fault stamp as a completion barrier without addressing ordering: fault_translation_stamped writes that stamp before faulted.store(true). A generation-specific completed-fault observation must be downstream of the actual flag/transition, not another nearly-adjacent early signal.",
    "Preserve the negative-case checks for missing stamp, never-respawn and excess respawn. Do not merely raise8, lengthen600ms, or weaken the give-up assertion; those retain the timing assumption.",
    "Separate transport failure/timeout from an explicit delivered=false broker reply. The current bool helper conflates them and can falsely pass the give-up check. The broker's false reply tells its caller to spool; this raw helper itself does not write a fallback spool row, so do not claim a durable fallback write from that bool alone.",
    "Under a later authorized reproduction, delay or otherwise control worker progress between queue acknowledgement and completed fault, and prove the revised observer still drives to bounded give-up. No tests or edits are authorized now."
  ]
}