buzz/beehive/ADMISSION_LATENCY_0BEA.md

# Admission latency reconciliation — 0bea2de8

## Status: original latency cause unresolved; no production correction justified

The failed executable candidate is `dd97d91405dcbe85f45c12d0ca17271875088110`.
Verified diff to published `f8556d157cde259fc016f6c063dd8f4e43b9cef5` contains
only CHECKPOINT/README additions, so there is no executable attribution difference.
Original final gate remains **105/106, 161.721s**, wrong-authority control elapsed
2572ms against unchanged `<2500ms`. Earlier historical admission/broker/tool
observations remain separately unclassified. This investigation does not close them.

## What the failed assertion actually measured

`test/admission-cancel.test.ts:69–140` runs its relay, host and UI in the SAME Node
test process; the lifecycle runner/supervisor are external children. For the first
control it terminates the host socket, starts the timer, signs/sends Start and a
Stop addressed to a fresh unknown agent, then:

1. Waits for BOTH the accepted Start and not-authority receipts.
2. Asserts the legitimate journal is running/revision 1.
3. Sends another, valid Stop at revision 1 and waits for its accepted receipt.
4. Asserts stopped/null actual/revision 2, then checks total elapsed `<2500ms`.

Thus 2572ms is NOT a measured wrong-agent rejection delay, nor a four-second ACP
probe timeout. The legitimate fixture Start and real owned teardown are intentionally
inside this control's timer. All the above semantic assertions passed before the
latency assertion failed; later loop controls were not reached.

The host's connection-level router (`src/host.ts:564–571` on the failed candidate)
publishes unknown-agent not-authority directly. It does not enqueue that request
behind the legitimate slot's Start, nor write a rejection to that slot journal.
The unknown-agent rejection has relay durability, not a per-slot host outbox entry.
Same-slot invalid-body/conflicting-ID/revision controls have different natural
owners and must not be conflated with this first control.

Actual failed durable order:

- inventory r0; legitimate Start r0; unknown-agent Stop r0; inventory r0;
- not-authority receipt r0; accepted Start receipt r1; inventory r1;
- valid Stop r1; inventory r1; accepted Stop receipt r2; inventory r2.

Receipt operations are respectively `30cb5ca9-6bfb-449f-b998-cfafddce1ca2`,
`28ef3c13-0e84-4712-927a-258d1319ff26`, and
`c69099ed-dd6d-4f57-a0ca-eb294a8c469a`. Durable order proves rejection precedes
Start receipt publication, not how many milliseconds either took.

## Original timestamp limits

Seven relay snapshots have callback entry timestamps (Unix milliseconds):

| Batch ordinal (not event association) | Before write | Before rename | Before directory sync |
|---|---:|---:|---:|
| 1 | 1789028830899 | 1789028830926 | 1789028830948 |
| 2 | 1789028830973 | 1789028830992 | 1789028831099 |
| 3 | 1789028831423 | 1789028831434 | 1789028831474 |
| 4 | 1789028831592 | 1789028831622 | 1789028832304 |
| 5 | 1789028832391 | 1789028832411 | 1789028832432 |
| 6 | 1789028832923 | 1789028832943 | 1789028832995 |
| 7 | 1789028833346 | 1789028833374 | 1789028833438 |

`src/relay-storage.ts` calls each hook BEFORE its named operation. The largest
adjacent gap, **682ms** from rename entry to directory-sync entry, covers rename,
directory open and JS/libuv scheduling. It is NOT measured directory-fsync latency.
Hooks lack batch signatures, completion timestamps, timer boundaries, send/sign,
host authorization/journal, receipt publication and client polling timestamps.
They include setup before the timer. No valid decomposition of the original
2572ms into these owners is recoverable. In particular, neither “disk contention”
nor “fixture race” follows from these records.

## One isolated diagnostic capture

Exported the immutable failed package using `git archive`; left the branch's
executable source untouched. Standalone frozen-lock install with scripts/workspace
disabled used the approved mirror. Actual Node **24.15.0**, pnpm **11.4.0**.
No second test runner, repeat-to-fail, focused rerun, final unchanged rerun, serial
mode, altered deadline/assertion or forced exit was used.

Instrumentation is isolated to the export, gated by `BEEHIVE_LATENCY_TRACE` AND
explicit admission-control activation. It buffers at most 50,000 metadata rows per
control in memory, records wall/monotonic clocks, writes once after owned fixture
cleanup, and uses an unref'ed 25ms event-loop lateness probe. No message body,
credential, env value, private journal content or filesystem path is traced.
It distinguishes seal/send, relay enqueue/batch/durable/broadcast, async IO entry
and completion, decoded receipt, host routing/slot handling, synchronous private
journal fsync spans, Stop ownership span and test polling. No extra async await
is added to the writer. Instrumentation still perturbs execution and cannot turn
a non-recurrence into a historical diagnosis.

Diagnostic strict TypeScript PASS. Exactly one FULL DEFAULT concurrent installed
capture completed naturally: **106/106, zero skips/failures/cancellations,
160932.313291ms**. Original wrong-authority failure did not recur: 1744ms;
conflicting-ID 1702ms, invalid-body 1733ms, stop-first 461ms, duplicate-replay
1821ms. All five traces retained without dropped rows. This is diagnostic
non-recurrence, NOT a final unchanged-suite retry or closure of the original gate.
The launch chain and export-scoped subprocesses were absent after natural
completion; no signals or historical PID cleanup were used.

Wrong-authority diagnostic timeline (relative monotonic ms; original failure is a
DIFFERENT execution):

| Owner boundary | ms |
|---|---:|
| Start sent / wrong-agent Stop sent | 2.004 / 3.484 |
| Host routes Start / unknown agent | 211.241 / 212.501 |
| Rejection seal begins / sent | 212.523 / 214.085 |
| Legitimate Start slot handle begins | 214.106 |
| Accepted Start receipt sent | 676.836 |
| UI decodes rejection / Start receipt | 765.323 / 766.503 |
| Test observes both | 784.294 |
| Valid Stop sent / host slot begins | 786.326 / 901.988 |
| Owned Stop begins / finishes | 1069.672 / 1600.470 |
| Accepted Stop receipt sent / UI decodes | 1662.758 / 1733.665 |
| Test observes Stop / timer ends | 1743.993 / 1744.394 |

This directly shows prompt unknown-agent routing (0.022ms to rejection sealing),
but delayed observation of that receipt in the shared test process. Synchronous
Start journal writes at 214.126–308.807 and 441.908–534.691ms overlap a relay
mkdir entry-to-JS-completion span of 207.007–536.653ms. A 25ms loop tick is
303.671ms late. These intervals prove that the pending async operation's elapsed
span is not pure filesystem service time. Additional synchronous prerequisite
work is inside slot handling; this probe does not break down all of it.

Owned Stop spans **530.798ms**. Its natural owner (`src/supervisor.ts:8–15`)
retains the group anchor through TERM and schedules group KILL at 500ms. This is
safety containment, not a wrong-authority request waiting behind Start, and must
not be shortened or skipped to meet the aggregate timer. Host accepted receipts
are sent only after synchronous journal persistence; relay visibility follows
file AND directory durability. A relay echo is not host completion.

## Decision and next discriminator

**Classification: original failure unresolved.** The non-failing capture identifies
shared fixture event-loop blocking and required durability/containment time in
its own execution; it does not prove which one caused the failed 2572ms outcome.
No demonstrated source-level erroneous queue/serialization, durability algorithm
bug or fixture-premise race warrants a production/test correction. No authority,
fingerprint, revision, operation-ID, cancellation, reconnect or persistence rule
was changed. No claim of full gate acceptance follows from a diagnostic pass.

The useful next discriminator is event-associated timing **at the failure**, not
another uninstrumented suite: distinguish the interval from unknown-agent host
routing to signed rejection send, send to relay durable batch, durable broadcast
to UI decode, and UI decode to test observation; separately attribute legitimate
Start's synchronous journal/prerequisite spans and valid Stop's owned exit. The
retained patch now captures those major boundaries. To distinguish an async IO
span's worker-queue/syscall time from JS callback scheduling requires additional
worker/kernel-level timing; JS await endpoints alone cannot establish that.
No further capture is performed within this bounded assignment, and no new human
input is needed to recognize this evidence limit. Do not stress/retry until failure
or change deadlines to manufacture closure.

## Surviving evidence and identities

Workspace `WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/ADMISSION_0BEA/` retains the early
checkpoint, immutable `candidate.tar`, base/diagnostic source manifests, standalone
install/strict/full logs, five raw control traces, derived `trace-summary.txt`,
analysis script, process provenance/cleanup record and complete patch. Original
`RECOVERY_FCD9/full-default.log` and RESULT remain untouched.

- Immutable archive SHA256:
  `7c2f8dfdd27ff21328f334f2e97a8aaf2bab809d81ae5d0947c4481f99aeb80a`.
- Complete instrumentation patch SHA256:
  `37de1d9fd5110017a8be3caf739a5b3a4cf56ee5e512b77ea1d7619580f84129`.
  Use `instrumentation-complete.patch`, not the retained initial generator/diff;
  it includes the new utility and final writer probes, applied at export root.
- Installed read-only `/Applications/Buzz.app/Contents/MacOS/buzz-acp`:
  `10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea`.
- Installed read-only sibling `buzz`:
  `147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5`.

Installed binaries are separately pinned artifacts, not built from this source.
No provider login/inference, owner stores, production/current-kind40002, native/Rust
or existing-client changes, repository CI, merge, release or full-product claim.
Publication for this reconciliation is documentation only; exact head is recorded
in the workspace RESULT and terminal report. Logan Johnson author/committer + DCO
are verified before publication; no signing/configuration edits.