<task-notification>
<task-id>baikiumtt</task-id>
<tool-use-id>toolu_01DSyv1Um8jvS5eViCutNbyY</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\22d5a4f6-16ae-4552-82b1-0f69cfb556b0\tasks\baikiumtt.output</output-file>
<status>completed</status>
<summary>Background command "Run daemon lib unit tests" completed (exit code 0)</summary>
</task-notification>


TaskStop killed cargo but orphaned the hung seedmap test-binary processes, which still lock the exe. Scoped kill of that specific test binary (in my target dir only — per [[no-machinewide-killon-shared-runner]], never machine-wide):


PowerShell

Get-CimInstance Win32_Process -Filter "name='spt_daemon-ed074c08fe01e245.exe'" | Select-Object ProcessId, @{n='Path';e={$_.ExecutablePath}} | Format-Table -Auto; $p = Get-CimInstance Win32_Process -Filter "name='spt_daemon-ed074c08fe01e245.exe'"; if ($p) { $p | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }; "Killed $($p.Count) orphaned test-binary process(es)" } else { "none running" }

Kill orphaned hung test binary by exact name


ProcessId Path
--------- ----
   188448 C:\Users\decid\Documents\projects\spt-core\target\debug\deps\spt_daemon-ed074c08fe01e245.exe

Killed 1 orphaned test-binary process(es)


Prompt:
<task-notification>
<task-id>baikiumtt</task-id>
<tool-use-id>toolu_01DSyv1Um8jvS5eViCutNbyY</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\22d5a4f6-16ae-4552-82b1-0f69cfb556b0\tasks\baikiumtt.output</output-file>
<status>completed</status>
<summary>Background command "Run daemon lib unit tests" completed (exit code 0)</summary>
</task-notification>


Orphaned hung process killed (confirmed in my target/deps path — scoped). Run the msg unit:


Bash

cargo test -p spt-daemon --lib endpoint_injected_envelope_carries_delivered_both_ways 2>&1 | tail -8

Run new msg delivered unit


    Finished `test` profile [unoptimized + debuginfo] target(s) in 5.46s
     Running unittests src\lib.rs (target\debug\deps\spt_daemon-ed074c08fe01e245.exe)

running 1 test
test msg::tests::endpoint_injected_envelope_carries_delivered_both_ways ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 377 filtered out; finished in 0.00s


msg unit green. Re-run traceable to confirm the new REQ resolves all four stages:


traceable-reqs check > /tmp/trace3.txt 2>&1; echo "EXIT=$?"; grep -iE "MISSING|FAIL|ERROR|invalid|untagged|not found" /tmp/trace3.txt | head; echo "--- new REQ + amended row ---"; grep -E "REQ-HAZARD-IDLE-SILENT-NONDELIVERY|REQ-MSG-IDLE-TRANSLATION-BINARY" /tmp/trace3.txt | grep -E "\[OK\]|\[X\]|stages"

Verify new REQ resolves all stages


EXIT=0
       An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004): for an endpoint with a running RESIDENT adapter binary (today the `[message-idle-translation-binary]`), the CLI keeps fetch+verify and hands the APPLY to the daemon over IPC, which per affected endpoint (1) STOPS the resident binary -> releases the OS file lock (fixes the Windows 'Access denied (os error 5)' overwrite failure), (2) swaps on disk ONLY files whose CRC differs from the staged archive (unchanged files + their still-running binaries untouched), (3) RE-CLONES the new on-disk manifest into the running `BrainLifecycle` (the in-memory manifest is cached at bringup and otherwise goes stale -> binaries+manifest back on the same page), (4) RESTARTS the resident binary from the new files. An endpoint NOT running -> CLI swaps directly (no lock, no cache). Only the resident class is cycled; ephemeral adapter binaries (Psyche loop, `[digest]` extractor, `[session.*]` runners, hooks) self-heal on next spawn and are excluded. The daemon keeps a per-endpoint registry of resident adapter children. (ADR-0025, v0.13.2)
       A `.spt` adapter archive may pack multiple platforms in one signed asset: shared `manifest.toml` + `strings/` at the root, role binaries under per-Rust-target-triple subdirectories (ADR-0016 triple vocabulary, e.g. `x86_64-pc-windows-msvc/`); install/update extracts the shared root plus ONLY `current_platform()`'s triple subdir, flattened into `install_dir` so flat `<install_dir>/<program>` resolution (REQ-INSTALL-11) is unchanged. Name stays `adapter.spt` (plain-tar or gzip, `--asset` optional default); one whole-archive Ed25519 signature over the fat archive (REQ-UPD-9 single-artifact verify). A legacy flat archive (no triple subdirs) extracts as today (free back-compat); a multi-platform archive sets `min_spt_core_version >= 0.13.2` (forward-compat gate, readable before extract); a multi-platform archive missing the recipient's triple -> typed `NoArtifactForPlatform`, never a silent no-op. Large adapters may still split per-platform (single-triple archives via `--asset`, or ADR-0016 update-set machinery). (ADR-0024, v0.13.2)
       `spt adapter translate-proof <adapter> --event <envelope> [--session <id>]` — the author-time EMIT-half proof tool for `[message-idle-translation-binary]` (ADR-0022), symmetric to `spt adapter digest-proof` (REQ-TERM-5). It spawns and feeds the adapter's declared translation binary EXACTLY as the daemon does at idle-delivery — running the REAL `spt_daemon::translation` driver VERBATIM (no protocol reimplementation): `TranslationChild::spawn` the binary, send the `{type:"init",endpoint_id,node}` line then the `{type:"event",envelope}` line, and read back the emitted `{key}`/`{text}`/`{delay_ms}`/`{commit}` keystroke-command stream — then prints it author-readable (each Key with its `key_to_bytes` rendering, Text quoted, Delay in ms, Commit marker) with counts. It fills the SAME `{id}`→option and `{session_id}`→(--session, else a placeholder) keys into the `--event` envelope the daemon fills at runtime, so an envelope that proofs here feeds faithfully live. EMIT-half ONLY: it proves the binary's spawn+feed+emit contract; it does NOT exercise the daemon's atomic PTY apply / controller-buffering (that stays covered by the W2 inject_control_wedge int gate) — `--help` says so. Exit codes mirror digest-proof: 0 ok, 1 on spawn-fail / zero commands / no-commit-or-output / unparseable, 2 when the adapter declares no `[message-idle-translation-binary]` section. The `TranslationChild` Drop does the bounded no-zombie reap. (v0.13.x)
       `spt adapter version <name>` prints a registered adapter's declared version — the EXISTING mandatory `[adapter].version` manifest field (manifest.rs already requires it; NOT a `[strings].version`, NOT `get-string`, no second version source). A new `AdapterCmd::Version{option}` resolves the option's merged view via `registry::resolve_option` like the sibling adapter subcommands and prints `manifest.adapter.version`; an unresolvable option errors (exit 1) the same way. (v0.13.2 W6)
       Peer address seeding, both cold starts: durable peer-addrs.json (identity dir) maps peer pubkey → last-known dialable address; the pump's resolver consults it FIRST with id-only discovery fallback on miss or dial failure (a stale addr never strands a peer); written by the pairing ceremony (both sides, from the live connection) and by the pump on successful connect; post-join first sync and post-restart resync converge in seconds, not ~1 min (M8 decisions 14, 20)
       Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed — e.g. the systemd unit autostarted before the network/DNS stack was ready, `Failed to create an address lookup service`) must SELF-HEAL — retry the net bring-up in the background with capped backoff and, on success, attach net to the broker + spawn the dispatcher/peer-pump (which today are gated on `net_up` at boot and so never start, leaving the node silently unreachable until a manual restart — kitsubito 2026-06-08). Status surfaces the net-less state honestly (a net-less broker renders as 'no connection', not only a pump-STALLED line with a bogus pre-boot heartbeat age). The installer's autostart unit waits for the network (`Wants=/After=network-online.target`) as belt-and-suspenders.
       Public CLI --help (the clap `///` doc-comments) and the generated `docs-site/src/cli/reference.md` MUST NOT contain internal tracker/decision codes — `REQ-*`, `F-###`, `M#-W#`, `ADR-####`. They are meaningless to an end user reading --help and ship to GH-Pages. A CI-gated scan (the `xtask check` docs gate) fails on any such token in the GENERATED reference.md (which by construction contains only clap help, so rustdoc `///` on fns/structs is OUT of scope and keeps its REQ/ADR cross-refs). Substance is kept; codes are rewritten to plain language. (v0.13.2 W6)
       A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the broker for all other clients. ROOT (v0.12.0 real-harness defect): loopback attach output is a blocking write_all into a bounded 64KB tokio duplex (nethost.rs:1040,1090); when the operator's rc pump stops draining (tab closed) the buffer fills and write_all blocks forever (the 'loopback never hangs' assumption at nethost.rs:1103 is false), parking a worker in the 2-worker net runtime (nethost.rs:640); a couple of these saturate BOTH workers → every new attach / `endpoint run` stalls right after 'PUMP_IPC_READER: spawned' → 30s FIRST_EVENT_GRACE → 'no output / dead or wedged'; `daemon stop` cannot join the stuck workers. DISTINCT from the removed B1 path-(c) mutex deadlock. DISPOSITION = PROVE-DON'T-CHANGE (doyle GATE-PASS @e883f45, 2026-06-18): this ROOT is the SUPERSEDED v0.12.0 hypothesis — the post-L0 code ALREADY prevents the wedge, so NO fail-fast / worker-count code was added. serve_attach forwards fire-and-forget (net_stream_send op_id=None) and the broker-side send_stream is already BROKER-QUIC-DEADLINE-bounded (bounded_block_on, 10s); the loopback duplex is drained broker-INTERNALLY by the operator row's own read pump (RecvHalf::Loopback, retentive_cap==0 → evict-not-park) so a dead rc (a dropped IPC subscriber) never backs peer_w up; bounded_block_on parks the BROKER DISPATCH thread, not a net worker → no worker-pool exhaustion (full mechanism in the required_stages comment). Folds the status=online sub-check: a dead spt-hosted endpoint is marked OFFLINE within one reconcile tick on abrupt child death (broker exit-waiter reaps the session → B2 sees it absent) — PROVEN, no change. (v0.12.1)
       A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint — no duplicate. On an abrupt brain death stop_host never runs (the LiveSet + owned child handles die with the brain) and Breap's job/group only reaps at DAEMON stop, so the PRIOR brain's Psyche stays ALIVE; the respawned brain's reconcile re-hosts a SECOND Psyche and overwrites the `{id}-psyche` perch pid, leaving the old one untracked + alive = a duplicate that lingers until daemon-stop (the operator's 'brain kill+restart wedged everything'). FIX: at brain start, BEFORE the first reconcile re-hosts, reap any pre-existing `{id}-psyche` orphan — ID-SPECIFICALLY (recycle-safe on the shared box, where sibling agents share the `claude` basename): scoped-kill the recorded pid ONLY IF it is alive AND its exe basename == the adapter's psyche program (normalize_basename) AND its COMMAND LINE contains the full psyche id `<id>-psyche` (baked via {id}); a sibling never carries THIS id, and any unreadable signal FAILS SAFE (decline to reap — a missed dup is bounded by Breap, a wrong-kill is catastrophic). CAVEAT: the cmdline carries `<id>-psyche` only when the adapter's psyche_init.command uses {id} (the norm); a non-{id} adapter safely MISSES the reap (today's behavior, Breap bounds it) — never a wrong-kill. (v0.12.0)
       The broker bounds every brain-waiting QUIC op (dial / open_stream / send_stream) so a black-holed or dead peer fails PROMPTLY with an ORDINARY error the broker REPLIES, never an unbounded await. The bound (< the brain's 30s PUMP_PEER_IO_TIMEOUT so the BROKER fires first) surfaces to the pump as a normal broker error reply → peer_outcome's non-TimedOut arm → drop conn + redial next tick, the round CONTINUES and the heartbeat keeps advancing — it must NEVER manifest as the brain's own read-deadline (the A-half poison → supervised-restart path REQ-HAZARD-PUMP-IPC-DEADLINE guards). Exactly-once is preserved: a timed-out journaled op fails INSIDE its apply_once closure so no phantom conn_id/stream_id is recorded and a fresh tick re-dials cleanly. The happy path is unchanged (a live peer completes with zero added latency; the bound only bites a non-responsive peer). This is the ROOT-cause cure for the 2.2h hfenduleam pump wedge — a dead roster peer whose QUIC path the broker awaited unbounded — recurring on hfenduleam 2026-06-16.
--- new REQ + amended row ---
  [OK] REQ-HAZARD-IDLE-SILENT-NONDELIVERY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int
  [OK] REQ-MSG-IDLE-TRANSLATION-BINARY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int


**REQ-HAZARD-IDLE-SILENT-NONDELIVERY: [OK] +doc +impl +unit +int** — all four stages. traceable EXIT=0. Now re-run clippy (added test code since last run) + xtask docs-drift check:


cargo clippy --workspace --all-targets 2>&1 | tail -4; echo "CLIPPY_EXIT=${PIPESTATUS[0]}"; echo "=== xtask check (docs drift) ==="; cargo run -p xtask -- check 2>&1 | tail -8; echo "XTASK_EXIT=${PIPESTATUS[0]}"

Re-run clippy + xtask docs-drift check


    Checking spt-daemon v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
    Checking spt v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\spt)
    Checking xtask v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\xtask)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.10s
CLIPPY_EXIT=0
=== xtask check (docs drift) ===
   Compiling spt-net v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\spt-net)
   Compiling spt-daemon v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
   Compiling xtask v0.14.2 (C:\Users\decid\Documents\projects\spt-core\crates\xtask)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 14.12s
     Running `target\debug\xtask.exe check`
xtask check: OK
XTASK_EXIT=0


clippy EXIT=0, xtask check OK (no docs drift). Final belt-and-suspenders: re-run the flipped/new int gates after the tag recompile:


cargo test -p spt-daemon --test broker endpoint_keyed_inject_without_binary_spools_not_pty 2>&1 | tail -5; echo "=== inject_control_wedge spool + g2 ==="; cargo test -p spt-daemon --test inject_control_wedge -- --test-threads=1 large_endpoint_inject g2_no_commit 2>&1 | tail -8

Re-run flipped int gates after retag


running 1 test
test endpoint_keyed_inject_without_binary_spools_not_pty ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 7 filtered out; finished in 0.02s

=== inject_control_wedge spool + g2 ===
     Running tests\inject_control_wedge.rs (target\debug\deps\inject_control_wedge-71a4df7bfa1b0c15.exe)

running 2 tests
test g2_no_commit_deadline_faults_binary_and_does_not_wedge_controller_input ... ok
test large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 8 filtered out; finished in 4.32s


All gates green:
- **clippy** --workspace --all-targets EXIT0 · **xtask check** OK (no drift) · **traceable** EXIT0
- **int**: g1(delivered=true)/g2(spool flip)/large_endpoint(spool)/broker endpoint — all green
- **unit**: msg delivered-both-ways, translation, resolve, schema drift — green
- New **REQ-HAZARD-IDLE-SILENT-NONDELIVERY** +doc+impl+unit+int

Commit on the feature branch (doyle gates off the SHA; not pushing — deployah cuts after GATE-PASS). Review what's staged:


cd "C:\Users\decid\Documents\projects\spt-core" && git add -A && git status --short && echo "=== branch ===" && git rev-parse --abbrev-ref HEAD

Stage all + show status and branch


warning: in the working copy of 'crates/spt-runtime/manifest.schema.json', LF will be replaced by CRLF the next time Git touches it
M  crates/spt-daemon/src/bin/xlate_choreo_fixture.rs
M  crates/spt-daemon/src/broker.rs
M  crates/spt-daemon/src/harnesshost.rs
M  crates/spt-daemon/src/msg.rs
M  crates/spt-daemon/src/translation.rs
M  crates/spt-daemon/tests/broker.rs
M  crates/spt-daemon/tests/inject_control_wedge.rs
M  crates/spt-runtime/manifest.schema.json
M  crates/spt-runtime/src/manifest.rs
M  docs/KNOWN-HAZARDS.md
M  traceable-reqs.toml
=== branch ===
fix/v0143-raw-inject-removal


11 files, all expected. Commit (co-author trailer `todlando` per CLAUDE.md + harness trailers):


cd "C:\Users\decid\Documents\projects\spt-core" && git commit -q -F - <<'EOF'
feat(broker): idle delivery spools when no working translation binary (v0.14.3)

Remove the raw-inject fallback from spt-hosted idle message delivery
(ADR-0022 amendment, operator-ruled). Idle delivery is now
translation-binary-ONLY: a binary that is absent, spawn-failed, FAULTED,
or whose inject-worker channel is gone -> the inbound message SPOOLS
(delivered=false, poll-fed, never lost), LOUDLY, never a raw `payload+\r`
PTY write. A bare `payload+\r` does not submit on a modern TUI (Claude
Code) -- it was a non-delivering pseudo-write that MASKED F-019 through a
multi-hour black-box hunt.

Spine: dispatch_endpoint_input with no working binary replies
endpoint_injected_envelope(ep, delivered=false); the input writer is no
longer resolved from the sessions table. try_broker_inject/cmd_send
(CHANGE-5) already fall through to deliver::send (spool) on delivered=false
-> honest QUEUED, never "SENT online" -- verified a NO-OP. build_translation
/ fault_translation logs+docs reworded (None/fault now MEAN spool); raw-inject
framing swept across broker.rs/translation.rs/harnesshost.rs/msg.rs/manifest.rs;
manifest.schema.json re-blessed.

Tests (behavior change): broker endpoint test ->
endpoint_keyed_inject_without_binary_spools_not_pty (delivered=false +
nothing on PTY); inject_control_wedge g2 post-fault inbound spools (was
raw_fallback); the large-payload park-(b) probe repurposed to
large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging
(operator park-(b) stays in p0_paste_wedge). New unit
endpoint_injected_envelope_carries_delivered_both_ways.

Traceability: mint REQ-HAZARD-IDLE-SILENT-NONDELIVERY (KNOWN-HAZARDS 7.22,
doc/impl/unit/int); amend REQ-MSG-IDLE-TRANSLATION-BINARY title (the
"raw inject is the degenerate case" line is superseded). Backlog auto-redrive
on binary-up is OUT OF SCOPE (follow-up).

Gates: clippy --workspace --all-targets EXIT0; xtask check OK; traceable
EXIT0; inject_control_wedge 9/9 int; broker endpoint + msg unit + runtime
resolve + schema drift all green.

Co-authored by: todlando
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RD7PufV5znKJ56rqgXdL1M
EOF
echo "=== committed ==="; git log -1 --format='%H %s'

Commit the v0.14.3 build on the feature branch


=== committed ===
aadafe12327b5fd27d149d83857741d14138ff0b feat(broker): idle delivery spools when no working translation binary (v0.14.3)


Committed **@aadafe12**. Update memory with the SHA + gate results, and try doyle once more:


Edit

description: "v0.14.3 raw-inject REMOVAL build (ADR-0022 amendment) — assigned todlando 2026-06-23; doyle scope, drive-to-release in progress"

description: "v0.14.3 raw-inject REMOVAL — BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c). All local gates GREEN. Awaiting doyle GATE-PASS → deployah cut counter 33."


The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\v0143-raw-inject-removal.md has been updated successfully. (file state is current in your context — no need to Read it back)

---
name: v0143-raw-inject-removal
description: "v0.14.3 raw-inject REMOVAL build (ADR-0022 amendment) — assigned todlando 2026-06-23; doyle scope, drive-to-release in progress"
metadata:
  node_type: memory
  type: project
  originSessionId: 77a745a3-d838-40e7-9522-5dca2858907d
---

v0.14.3 = raw-inject REMOVAL, the ADR-0022 amendment @1eaeef1 follow-up to F-019 ([[v0142-published]]). Operator GO 2026-06-23. doyle scoped → todlando builds → doyle gates → deployah cuts (bump-in-PR, counter 33). Branch off main @365fb0c (v0.14.2).

CONTRACT: spt-hosted idle delivery = translation-binary-ONLY. Binary absent/spawn-failed/faulted/worker-gone → message SPOOLED (not lost), NEVER raw PTY inject. Loud. Raw `payload+\r` was a non-submitting pseudo-delivery on modern TUI = the silent degrade that MASKED F-019.

SCOPE BOUNDED (doyle grounded the seam): the spool machinery ALREADY EXISTS. broker `dispatch_endpoint_input` replies `endpoint_injected_envelope(ep, delivered:bool)` → `inject_endpoint` → `try_broker_inject` (cli.rs:3510) → false = caller SPOOLS ("never lost"). Today no-working-binary RAW-INJECTS (input.enqueue ~broker.rs:1922) + delivered=TRUE. FIX = flip that case to delivered=FALSE (spool). Working-binary path (translation Some + !faulted + event_tx.send ok) UNCHANGED.

KEY SITES (broker.rs): dispatch_endpoint_input ~1875-1932 (remove input.enqueue raw-inject, reply false); fault_translation ~1172 + build_translation ~1077 (logs: no longer "revert to raw inject" → "spool"); reword degenerate-fallback comments ~154/829/837/848/872/1027/1037/1170/1882-1916; translation.rs spawn doc ~238. cli.rs try_broker_inject: verify honest spooled report (not "Sent online").

TESTS ([[behavior-change-grep-tests-not-comments]] BINDING): inject_control_wedge.rs g2 (no-commit FAULT asserts raw-inject fallback) — SEPARATE the InjectFloor operator-keystroke flush (STAYS) from the inbound MESSAGE (now spools, not raw-inject). +broker/msg units (delivered=false). +NEW int gate: hosted session, NO binary → spt send → SPOOLED + PTY got NO raw bytes + delivered=false + loud log. Run int on Win box (green-units≠green-int).

TRACEABLE: update REQ-MSG-IDLE-TRANSLATION-BINARY title (line 1242 — its "v0.11.0 raw inject is the degenerate case" line is SUPERSEDED). MINT new REQ-HAZARD-IDLE-SILENT-NONDELIVERY (silent non-delivery = KNOWN-HAZARD class, rule 4): absent/failed binary never raw-injects a pseudo-delivery reported delivered; spools loud + delivered=false. Activate stages this wave. doyle ratifies id/title at gate.

OUT OF SCOPE (doyle ruling): backlog-drain-on-binary-up (auto-redeliver already-spooled the instant a live-update binary spawns) — poll substrate + subsequent sends cover re-delivery; broker-backlog auto-drain = separate change w/ ordering/exactly-once hazards. Follow-up note only.

GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0. STATUS: assigned, awaiting todlando commit SHA + gate output.

-description: "v0.14.3 raw-inject REMOVAL build (ADR-0022 amendment) — assigned todlando 2026-06-23; doyle scope, drive-to-release in progress"

+description: "v0.14.3 raw-inject REMOVAL — BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c). All local gates GREEN. Awaiting doyle GATE-PASS → deployah cut counter 33."


GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0. STATUS: assigned, awaiting todlando commit SHA + gate output.

GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0.

**BUILT @aadafe12 (2026-06-23, todlando) — branch fix/v0143-raw-inject-removal off main @365fb0c. ALL LOCAL GATES GREEN. 11 files.** Matches doyle's full contract (recovered the truncated parts 9-17 from the prior-session capture of THIS file — doyle's assignment msg truncated at part 8, doyle NO_PERCH all session):
- SPINE: dispatch_endpoint_input no-working-binary → endpoint_injected_envelope(ep,FALSE) + loud log `"<ep>: no working translation binary (absent/faulted/worker-gone) -> SPOOLED, not injected"`; removed input.enqueue raw-inject; **`input` Arc no longer resolved** from sessions table (clippy-clean). Worker-dropped + post-fault paths → spool too.
- CHANGE-5 = NO-OP (verified): try_broker_inject returns inject_endpoint bool; delivered=false already → deliver::send spool → honest QUEUED. No cli.rs edit.
- Logs/docs/comments: build_translation + fault_translation (None/fault MEAN spool); raw-inject→spool sweep broker.rs(11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; manifest.schema.json RE-BLESSED (schemars embeds doc, `SPT_BLESS=1 cargo test -p spt-runtime checked_in_schema_is_current`).
- TESTS FLIPPED: broker.rs endpoint test → `endpoint_keyed_inject_without_binary_spools_not_pty` (delivered=false + nothing on PTY). inject_control_wedge g2 post-fault → delivered2=false + marker NOT on PTY (op-keystroke floor-flush UNCHANGED). vacuous park-(b) probe repurposed → `large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging` (4 MiB spools prompt, never write_input; operator park-(b) stays in p0_paste). NEW unit `endpoint_injected_envelope_carries_delivered_both_ways`. xlate_choreo_fixture raw_fallback comments reworded (XON/XOFF restore UNTOUCHED).
- **TRACEABILITY: MINTED `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per doyle's line-20 instruction — doyle ratifies id/title at gate. AMENDED REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE (follow-up note in REQ title).
- GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY +doc+impl+unit+int, REQ-MSG-IDLE-TRANSLATION-BINARY +all, REQ-SEND-SPT-HOSTED +impl+unit+int, REQ-HAZARD-INJECT-CONTROL-COEXIST +impl+unit+int all [OK]); inject_control_wedge 9/9 int; broker endpoint test; msg unit; runtime resolve 3/3; translation+read_translation+harnesshost units; schema drift.
- ⚠ NOT run: full `spt-daemon --lib` (377) — HUNG on `seedmap::tests::request_stop_barrier_holds_until_no_listener` + `stop_op_acks_then_serve_returns` (UNRELATED to this change; pre-existing env hang holding the test-exe lock — had to scoped-kill the orphaned spt_daemon-<hash>.exe by path in target/debug/deps). Every module THIS change touches was targeted-verified green. CI runs full --lib on the runners.

**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.


GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0.

**BUILT @aadafe12 (2026-06-23, todlando) — branch fix/v0143-raw-inject-removal off main @365fb0c. ALL LOCAL GATES GREEN. 11 files.** Matches doyle's full contract (recovered the truncated parts 9-17 from the prior-session capture of THIS file — doyle's assignment msg truncated at part 8, doyle NO_PERCH all session):
- SPINE: dispatch_endpoint_input no-working-binary → endpoint_injected_envelope(ep,FALSE) + loud log `"<ep>: no working translation binary (absent/faulted/worker-gone) -> SPOOLED, not injected"`; removed input.enqueue raw-inject; **`input` Arc no longer resolved** from sessions table (clippy-clean). Worker-dropped + post-fault paths → spool too.
- CHANGE-5 = NO-OP (verified): try_broker_inject returns inject_endpoint bool; delivered=false already → deliver::send spool → honest QUEUED. No cli.rs edit.
- Logs/docs/comments: build_translation + fault_translation (None/fault MEAN spool); raw-inject→spool sweep broker.rs(11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; manifest.schema.json RE-BLESSED (schemars embeds doc, `SPT_BLESS=1 cargo test -p spt-runtime checked_in_schema_is_current`).
- TESTS FLIPPED: broker.rs endpoint test → `endpoint_keyed_inject_without_binary_spools_not_pty` (delivered=false + nothing on PTY). inject_control_wedge g2 post-fault → delivered2=false + marker NOT on PTY (op-keystroke floor-flush UNCHANGED). vacuous park-(b) probe repurposed → `large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging` (4 MiB spools prompt, never write_input; operator park-(b) stays in p0_paste). NEW unit `endpoint_injected_envelope_carries_delivered_both_ways`. xlate_choreo_fixture raw_fallback comments reworded (XON/XOFF restore UNTOUCHED).
- **TRACEABILITY: MINTED `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per doyle's line-20 instruction — doyle ratifies id/title at gate. AMENDED REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE (follow-up note in REQ title).
- GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY +doc+impl+unit+int, REQ-MSG-IDLE-TRANSLATION-BINARY +all, REQ-SEND-SPT-HOSTED +impl+unit+int, REQ-HAZARD-INJECT-CONTROL-COEXIST +impl+unit+int all [OK]); inject_control_wedge 9/9 int; broker endpoint test; msg unit; runtime resolve 3/3; translation+read_translation+harnesshost units; schema drift.
- ⚠ NOT run: full `spt-daemon --lib` (377) — HUNG on `seedmap::tests::request_stop_barrier_holds_until_no_listener` + `stop_op_acks_then_serve_returns` (UNRELATED to this change; pre-existing env hang holding the test-exe lock — had to scoped-kill the orphaned spt_daemon-<hash>.exe by path in target/debug/deps). Every module THIS change touches was targeted-verified green. CI runs full --lib on the runners.

**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.

---
name: v0143-raw-inject-removal
description: "v0.14.3 raw-inject REMOVAL — BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c). All local gates GREEN. Awaiting doyle GATE-PASS → deployah cut counter 33."
metadata:
  node_type: memory
  type: project
  originSessionId: 77a745a3-d838-40e7-9522-5dca2858907d
---

v0.14.3 = raw-inject REMOVAL, the ADR-0022 amendment @1eaeef1 follow-up to F-019 ([[v0142-published]]). Operator GO 2026-06-23. doyle scoped → todlando builds → doyle gates → deployah cuts (bump-in-PR, counter 33). Branch off main @365fb0c (v0.14.2).

CONTRACT: spt-hosted idle delivery = translation-binary-ONLY. Binary absent/spawn-failed/faulted/worker-gone → message SPOOLED (not lost), NEVER raw PTY inject. Loud. Raw `payload+\r` was a non-submitting pseudo-delivery on modern TUI = the silent degrade that MASKED F-019.

SCOPE BOUNDED (doyle grounded the seam): the spool machinery ALREADY EXISTS. broker `dispatch_endpoint_input` replies `endpoint_injected_envelope(ep, delivered:bool)` → `inject_endpoint` → `try_broker_inject` (cli.rs:3510) → false = caller SPOOLS ("never lost"). Today no-working-binary RAW-INJECTS (input.enqueue ~broker.rs:1922) + delivered=TRUE. FIX = flip that case to delivered=FALSE (spool). Working-binary path (translation Some + !faulted + event_tx.send ok) UNCHANGED.

KEY SITES (broker.rs): dispatch_endpoint_input ~1875-1932 (remove input.enqueue raw-inject, reply false); fault_translation ~1172 + build_translation ~1077 (logs: no longer "revert to raw inject" → "spool"); reword degenerate-fallback comments ~154/829/837/848/872/1027/1037/1170/1882-1916; translation.rs spawn doc ~238. cli.rs try_broker_inject: verify honest spooled report (not "Sent online").

TESTS ([[behavior-change-grep-tests-not-comments]] BINDING): inject_control_wedge.rs g2 (no-commit FAULT asserts raw-inject fallback) — SEPARATE the InjectFloor operator-keystroke flush (STAYS) from the inbound MESSAGE (now spools, not raw-inject). +broker/msg units (delivered=false). +NEW int gate: hosted session, NO binary → spt send → SPOOLED + PTY got NO raw bytes + delivered=false + loud log. Run int on Win box (green-units≠green-int).

TRACEABLE: update REQ-MSG-IDLE-TRANSLATION-BINARY title (line 1242 — its "v0.11.0 raw inject is the degenerate case" line is SUPERSEDED). MINT new REQ-HAZARD-IDLE-SILENT-NONDELIVERY (silent non-delivery = KNOWN-HAZARD class, rule 4): absent/failed binary never raw-injects a pseudo-delivery reported delivered; spools loud + delivered=false. Activate stages this wave. doyle ratifies id/title at gate.

OUT OF SCOPE (doyle ruling): backlog-drain-on-binary-up (auto-redeliver already-spooled the instant a live-update binary spawns) — poll substrate + subsequent sends cover re-delivery; broker-backlog auto-drain = separate change w/ ordering/exactly-once hazards. Follow-up note only.

GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0. STATUS: assigned, awaiting todlando commit SHA + gate output.

-GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0. STATUS: assigned, awaiting todlando commit SHA + gate output.

+GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0.

+**BUILT @aadafe12 (2026-06-23, todlando) — branch fix/v0143-raw-inject-removal off main @365fb0c. ALL LOCAL GATES GREEN. 11 files.** Matches doyle's full contract (recovered the truncated parts 9-17 from the prior-session capture of THIS file — doyle's assignment msg truncated at part 8, doyle NO_PERCH all session):

+- SPINE: dispatch_endpoint_input no-working-binary → endpoint_injected_envelope(ep,FALSE) + loud log `"<ep>: no working translation binary (absent/faulted/worker-gone) -> SPOOLED, not injected"`; removed input.enqueue raw-inject; **`input` Arc no longer resolved** from sessions table (clippy-clean). Worker-dropped + post-fault paths → spool too.

+- CHANGE-5 = NO-OP (verified): try_broker_inject returns inject_endpoint bool; delivered=false already → deliver::send spool → honest QUEUED. No cli.rs edit.

+- Logs/docs/comments: build_translation + fault_translation (None/fault MEAN spool); raw-inject→spool sweep broker.rs(11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; manifest.schema.json RE-BLESSED (schemars embeds doc, `SPT_BLESS=1 cargo test -p spt-runtime checked_in_schema_is_current`).

+- TESTS FLIPPED: broker.rs endpoint test → `endpoint_keyed_inject_without_binary_spools_not_pty` (delivered=false + nothing on PTY). inject_control_wedge g2 post-fault → delivered2=false + marker NOT on PTY (op-keystroke floor-flush UNCHANGED). vacuous park-(b) probe repurposed → `large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging` (4 MiB spools prompt, never write_input; operator park-(b) stays in p0_paste). NEW unit `endpoint_injected_envelope_carries_delivered_both_ways`. xlate_choreo_fixture raw_fallback comments reworded (XON/XOFF restore UNTOUCHED).

+- **TRACEABILITY: MINTED `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per doyle's line-20 instruction — doyle ratifies id/title at gate. AMENDED REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE (follow-up note in REQ title).

+- GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY +doc+impl+unit+int, REQ-MSG-IDLE-TRANSLATION-BINARY +all, REQ-SEND-SPT-HOSTED +impl+unit+int, REQ-HAZARD-INJECT-CONTROL-COEXIST +impl+unit+int all [OK]); inject_control_wedge 9/9 int; broker endpoint test; msg unit; runtime resolve 3/3; translation+read_translation+harnesshost units; schema drift.

+- ⚠ NOT run: full `spt-daemon --lib` (377) — HUNG on `seedmap::tests::request_stop_barrier_holds_until_no_listener` + `stop_op_acks_then_serve_returns` (UNRELATED to this change; pre-existing env hang holding the test-exe lock — had to scoped-kill the orphaned spt_daemon-<hash>.exe by path in target/debug/deps). Every module THIS change touches was targeted-verified green. CI runs full --lib on the runners.

+**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.


Update the MEMORY.md index pointer + ping doyle with the GATE-ready report:


Bash

cd "C:\Users\decid\Documents\projects\spt-core"; grep -n "v0143\|raw-inject-removal" "C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\MEMORY.md" | head

Check MEMORY.md for v0143 pointer


4:- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). doyle scoped, todlando building (off main @365fb0c), counter 33. Bounded: flip no-working-binary case to delivered=false (spool machinery exists). New REQ-HAZARD-IDLE-SILENT-NONDELIVERY. Backlog-drain-on-binary-up OUT of scope


printf '%s' "GATE-READY: v0.14.3 raw-inject REMOVAL BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c, NOT pushed). I recovered your full contract from the prior-session memory capture (your assignment msg truncated at part 8/17; you were NO_PERCH all session). Built to ALL of it:
- SPINE: dispatch_endpoint_input no-working-binary -> endpoint_injected_envelope(ep,FALSE)+loud log, removed input.enqueue, input Arc no longer resolved. worker-dropped + post-fault -> spool.
- CHANGE-5 = NO-OP verified (try_broker_inject returns the bool; delivered=false already -> deliver::send spool -> honest QUEUED).
- log/doc/comment sweep raw-inject->spool (broker.rs x11, translation.rs, harnesshost.rs, msg.rs, manifest.rs); manifest.schema.json re-blessed.
- TESTS: broker endpoint_keyed_inject_without_binary_spools_not_pty (delivered=false+nothing on PTY); g2 post-fault delivered2=false+marker NOT on PTY (op floor-flush UNCHANGED); repurposed the vacuous park-b probe -> large_endpoint_inject_..._spools_promptly_without_wedging (operator park-b stays in p0_paste); +unit endpoint_injected_envelope_carries_delivered_both_ways.
- TRACEABILITY: MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per your line-20; amended REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE follow-up. RATIFY the REQ id/title at gate.
GATES GREEN: clippy --workspace --all-targets EXIT0; xtask check OK; traceable EXIT0 (4 REQs incl the new hazard all [OK]); inject_control_wedge 9/9 int; broker endpoint + msg unit + runtime resolve 3/3 + schema drift.
CAVEAT: full spt-daemon --lib (377) HUNG on seedmap::request_stop_barrier/stop_op_acks (UNRELATED, pre-existing env hang holding the test-exe lock; scoped-killed the orphaned binary by path). Every module this change touches = targeted-verified green; CI runs full --lib on the runners.
Branch ready for your gate. Holding for GATE-PASS -> deployah cut counter 33." | spt send doyle 2>&1

Send GATE-ready report to doyle


Error: Exit code 1
NO_PERCH:doyle is not listening


doyle unreachable (NO_PERCH — hard reject). The MEMORY.md pointer exists but says "building" — update it to BUILT:


Edit

- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). doyle scoped, todlando building (off main @365fb0c), counter 33. Bounded: flip no-working-binary case to delivered=false (spool machinery exists). New REQ-HAZARD-IDLE-SILENT-NONDELIVERY. Backlog-drain-on-binary-up OUT of scope

- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). **BUILT @aadafe12 (todlando, off main @365fb0c, NOT pushed) — ALL LOCAL GATES GREEN** (clippy --workspace EXIT0, xtask check OK, traceable EXIT0, inject_control_wedge 9/9 int, msg unit, schema drift). Spine = flip no-working-binary case to endpoint_injected_envelope FALSE (spool); input Arc no longer resolved. CHANGE-5 = NO-OP verified. **MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (KH 7.22, doc/impl/unit/int)** + amended REQ-MSG-IDLE title; doyle ratifies id/title at gate. Tests flipped: endpoint_keyed_inject_without_binary_spools_not_pty + g2 post-fault spool + repurposed large_endpoint_inject spool probe. Backlog-drain-on-binary-up OUT of scope. CAVEAT: full daemon --lib hung on UNRELATED seedmap stop-barrier tests (pre-existing env, targeted-verified touched modules). NEXT: doyle GATE off @aadafe12 → deployah cut counter 33. Recovered doyle's truncated parts 9-17 from prior-session memory (assignment msg cut at part 8; doyle NO_PERCH all session)


<tool_use_error>File has been modified since read, either by the user or by a linter. Read it again before attempting to write it.</tool_use_error>

Error: File has been modified since read, either by the user or by a linter. Read it again before attempting to write it.


4	- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). doyle scoped, todlando building (off main @365fb0c), counter 33. Bounded: flip no-working-binary case to delivered=false (spool machinery exists). New REQ-HAZARD-IDLE-SILENT-NONDELIVERY. Backlog-drain-on-binary-up OUT of scope


- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). doyle scoped, todlando building (off main @365fb0c), counter 33. Bounded: flip no-working-binary case to delivered=false (spool machinery exists). New REQ-HAZARD-IDLE-SILENT-NONDELIVERY. Backlog-drain-on-binary-up OUT of scope

- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). **BUILT @aadafe12 (todlando, off main @365fb0c, NOT pushed) — ALL LOCAL GATES GREEN** (clippy --workspace EXIT0, xtask check OK, traceable EXIT0, inject_control_wedge 9/9 int, msg unit, schema drift). Spine = flip no-working-binary case to endpoint_injected_envelope FALSE (spool); input Arc no longer resolved. CHANGE-5 = NO-OP verified. **MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (KH 7.22, doc/impl/unit/int)** + amended REQ-MSG-IDLE title; doyle ratifies id/title at gate. Tests flipped: endpoint_keyed_inject_without_binary_spools_not_pty + g2 post-fault spool + repurposed large_endpoint_inject probe. Backlog-drain-on-binary-up OUT of scope. CAVEAT: full daemon --lib hung on UNRELATED seedmap stop-barrier tests (pre-existing env); targeted-verified touched modules. NEXT: doyle GATE off @aadafe12 → deployah cut counter 33. Recovered doyle's truncated parts 9-17 from prior-session memory (assignment cut at part 8; doyle NO_PERCH all session)


The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\MEMORY.md has been updated successfully. (file state is current in your context — no need to Read it back)

- [v0.14.0 endpoint-creation-flow](v0140-endpoint-creation-flow.md) — PUBLISHED counter 30 @6ba875e (last old-flow separate-bump cut). Multi-subnet home-at-creation + UNBOUND pre-bind attach. hashes linux 72889c07… / win 641561d9…. ACCEPTANCE-PROVEN: perri real claude-spt repro ALL GREEN (0.058s refuse vs old 25s hang). SPT_RELEASE_SEED in env (len64) — no manual fetch

- [v0.14.1 builds (F-018+picker-home+label+netstream)](f018-adapter-add-nondestructive.md) — PUBLISHED counter 31 @46289ab (1st bump-in-PR cut, PR#34). F-018 adapter-add non-destructive (REQ-INSTALL-13), picker home-subnet (REQ-RUN-PICKER-HOME), installed-vs-pending labels, #4 netstream flake FIX (root=StreamLog.next_seq counts transport read_chunks not logical chunks; QUIC Win-coalesce → eof 19v20; test-only byte-based fix, SUPERSEDES [[win-netstream-redrive-flake]]). hashes 1e64d63a… / 2fbbfe03…. GOTCHA: `spt` NO lib target → `--bin spt` (spt-daemon HAS lib)

- [F-019 translation install_dir resolve](f019-translation-install-dir-resolve.md) — PUBLISHED v0.14.2 counter 32 @365fb0c (2nd bump-in-PR, PR#35). THE #1 CC-on-Windows blocker: idle msgs typed-not-SUBMITTED — `[message-idle-translation-binary]` bare path Command::new'd w/o install_dir resolve → fail → silent raw-inject fallback. Fix=resolve_program_in_dir at 4 sites (translation initial+W3d-respawn, notif×2). hashes 98714384… / 08e8a267…. CHANGELOG=1 Fixed bullet (ADR/design/notif×2 OMITTED, doyle-ratified). NEXT: todlando raw-inject-REMOVAL (spool+poll, ADR-0022 amendment) operator-timed; perri 3-step real-CC validation pending (doyle-released)

-- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). doyle scoped, todlando building (off main @365fb0c), counter 33. Bounded: flip no-working-binary case to delivered=false (spool machinery exists). New REQ-HAZARD-IDLE-SILENT-NONDELIVERY. Backlog-drain-on-binary-up OUT of scope

+- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). **BUILT @aadafe12 (todlando, off main @365fb0c, NOT pushed) — ALL LOCAL GATES GREEN** (clippy --workspace EXIT0, xtask check OK, traceable EXIT0, inject_control_wedge 9/9 int, msg unit, schema drift). Spine = flip no-working-binary case to endpoint_injected_envelope FALSE (spool); input Arc no longer resolved. CHANGE-5 = NO-OP verified. **MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (KH 7.22, doc/impl/unit/int)** + amended REQ-MSG-IDLE title; doyle ratifies id/title at gate. Tests flipped: endpoint_keyed_inject_without_binary_spools_not_pty + g2 post-fault spool + repurposed large_endpoint_inject probe. Backlog-drain-on-binary-up OUT of scope. CAVEAT: full daemon --lib hung on UNRELATED seedmap stop-barrier tests (pre-existing env); targeted-verified touched modules. NEXT: doyle GATE off @aadafe12 → deployah cut counter 33. Recovered doyle's truncated parts 9-17 from prior-session memory (assignment cut at part 8; doyle NO_PERCH all session)

- [stale-broker attach wedge](stale-broker-attach-wedge.md) — attach "brain IPC read deadline" while list/dial work = stale daemon broker from old rev; fix = full daemon restart. Confirmed 2026-06-23

- [Win netstream redrive flake](win-netstream-redrive-flake.md) — FIXED in v0.14.1 (#4, see [[f018-adapter-add-nondestructive]]): was Win-only CI flake (netstream.rs:99 chunk-gap 19v20, Linux-green-same-code, clear on rerun); root=StreamLog seq counts transport read_chunks. Historic; verify-per-attempt lesson stands. Kin [[v013-forkpty-groundtruth]]

- [release standard: bump-in-PR](release-standard-bump-in-pr.md) — v0.14.1 ONWARD: bump rides IN release PR (Cargo ver+lock first-party+CHANGELOG+xtask gen) → PR CI validates tagged commit → tag on merge → push:[main] CI = non-blocking backstop. Kills serial 2nd-CI wait


**v0.14.3 raw-inject removal — BUILT @aadafe12, all local gates green.**

Branch `fix/v0143-raw-inject-removal` (off main @365fb0c, not pushed).

**What shipped (matches doyle's full contract):**
- **Spine** — `dispatch_endpoint_input`: no working translation binary → `endpoint_injected_envelope(ep, FALSE)` + loud log → caller spools. Removed `input.enqueue` raw-inject; `input` Arc no longer resolved. Worker-dropped + post-fault paths spool too.
- **CHANGE-5** (cli.rs honest report) = NO-OP, verified — `delivered=false` already falls through to `deliver::send` → honest QUEUED.
- **Sweep** — build/fault_translation logs+docs, raw-inject→spool comments across broker.rs(×11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; `manifest.schema.json` re-blessed.
- **Tests flipped** — `endpoint_keyed_inject_without_binary_spools_not_pty`; g2 post-fault spools (op floor-flush unchanged); vacuous park-(b) probe repurposed → `large_endpoint_inject_..._spools_promptly`; new `endpoint_injected_envelope_carries_delivered_both_ways` unit.
- **Traceability** — **minted `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (KNOWN-HAZARDS 7.22, doc/impl/unit/int); amended REQ-MSG-IDLE title. Backlog auto-redrive = out-of-scope follow-up.

**Gates:** clippy --workspace EXIT0 · xtask check OK · traceable EXIT0 (4 REQs [OK]) · inject_control_wedge 9/9 int · broker endpoint + msg unit + runtime resolve + schema drift green.

**Two notes:**
1. **Recovered doyle's truncated contract** — assignment msg cut at part 8/17; a prior-session memory capture had parts 9-17 (the new-REQ-mint + test contract). doyle NO_PERCH all session — couldn't reach to confirm; built to the recovered spec, doyle ratifies the minted REQ id/title at gate.
2. **Full `spt-daemon --lib` (377) hung** on `seedmap` stop-barrier tests — **unrelated** to this change (pre-existing env hang; had to scoped-kill the orphaned test binary by path). Every touched module targeted-verified green; CI runs full --lib on the runners.

**Holding for doyle GATE-PASS → deployah cut counter 33.** Memory updated.


doyle is available. everyone's on legacy spt: `$OWL send`


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


Check Doyle availability and legacy SPT send


Right — legacy `$OWL send`, not `spt send` ([[owl-send-not-legacy-spt-send]]). Sending GATE-ready report to doyle:


Bash

echo "OWL=$OWL"; printf '%s' "GATE-READY: v0.14.3 raw-inject REMOVAL BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c, NOT pushed). Recovered your full contract from prior-session memory (your assignment msg truncated at part 8/17). Built to all of it:
SPINE: dispatch_endpoint_input no-working-binary -> endpoint_injected_envelope(ep,FALSE)+loud log; removed input.enqueue; input Arc no longer resolved from sessions table. worker-dropped + post-fault paths -> spool.
CHANGE-5 = NO-OP verified (try_broker_inject returns inject_endpoint bool; delivered=false already -> deliver::send spool -> honest QUEUED, never SENT). No cli.rs edit.
SWEEP: build_translation/fault_translation logs+docs (None/fault MEAN spool); raw-inject->spool comments broker.rs x11 + translation.rs + harnesshost.rs + msg.rs + manifest.rs; manifest.schema.json RE-BLESSED.
TESTS: broker endpoint_keyed_inject_without_binary_spools_not_pty (delivered=false + nothing on PTY); inject_control_wedge g2 post-fault delivered2=false + marker NOT on PTY (operator floor-flush UNCHANGED); repurposed vacuous park-b probe -> large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging (operator park-b stays in p0_paste); +unit endpoint_injected_envelope_carries_delivered_both_ways.
TRACEABILITY: MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per your line-20; amended REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE follow-up. PLEASE RATIFY the minted REQ id/title.
GATES GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY + REQ-MSG-IDLE-TRANSLATION-BINARY + REQ-SEND-SPT-HOSTED + REQ-HAZARD-INJECT-CONTROL-COEXIST all [OK]); inject_control_wedge 9/9 int; broker endpoint + msg unit + runtime resolve 3/3 + schema drift.
CAVEAT: full spt-daemon --lib (377) HUNG on seedmap::request_stop_barrier_holds_until_no_listener + stop_op_acks_then_serve_returns (UNRELATED to this change; pre-existing env hang holding the test-exe lock; scoped-killed the orphaned spt_daemon-<hash>.exe by path). Every module this change touches = targeted-verified green; CI runs full --lib on the runners.
Branch ready for your gate. Holding for GATE-PASS -> deployah bump-in-PR cut counter 33." | "$OWL" send doyle; echo "OWL_SEND_RC=${PIPESTATUS[1]}"

Send GATE-ready report to doyle via legacy OWL


OWL=C:/Users/decid/.claude/plugins/cache/cplugs/spt/1.11.25/owl.exe
➜ SENT:doyle
OWL_SEND_RC=0


`SENT:doyle` (RC=0). GATE-ready report delivered via legacy OWL.

**Status: v0.14.3 BUILT @aadafe12, all local gates green, report in doyle's hands.**

Asked doyle to ratify the minted `REQ-HAZARD-IDLE-SILENT-NONDELIVERY` id/title. Holding for doyle's gate verdict (arrives on my event stream) → deployah bump-in-PR cut counter 33.


<task-notification>
<task-id>br1kp3y1l</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/3" id="a77bc210" type="msg" from="doyle">ACK GATE-READY — gating now. Reviewing the REAL commit @aadafe1 myself (diff matches the contract: spine = no-working-binary → endpoint_injected_envelope FALSE + input Arc no longer resolved; CHANGE-5 NO-OP; test flips; sweep). Re-running clippy --workspace + inject_control_wedge int + traceable on my side per gate </EVENT-PART>
<EVENT-PART seq="2/3" id="a77bc210">discipline (not trusting the green report — standard, no slight). REQ ratification verdict comes with the GATE-PASS. Hold — verdict shortly.

Note your CAVEAT (full spt-daemon --lib hung on seedmap::request_stop_barrier / stop_op_acks_then_serve): acknowledged as the pre-existing env hang (orphaned test-exe lock), UNRELATED to this c</EVENT-PART>
<EVENT-PART seq="3/3" id="a77bc210">hange — CI runs full --lib on the runners. Not a gate blocker.</EVENT-PART></event>
</task-notification>


doyle ACK — gating now (re-running clippy + inject_control_wedge int + traceable per gate discipline; CAVEAT acknowledged as unrelated, not a blocker). REQ ratification comes with GATE-PASS. Brief ack, then hold:


printf '%s' "Holding. Branch @aadafe12 stable, not pushed. Standing by for your GATE-PASS + REQ-HAZARD-IDLE-SILENT-NONDELIVERY ratification verdict. If you want the OUT-OF-SCOPE backlog-auto-redrive as the next assignment after this cut, say the word." | "$OWL" send doyle; echo "RC=${PIPESTATUS[1]}"

Ack doyle, confirm holding


➜ SENT:doyle
RC=0


Ack sent. Holding for doyle's GATE-PASS + REQ ratification verdict — arrives on my event stream.

**v0.14.3 state:** BUILT @aadafe12, all local gates green, doyle gating now.


<task-notification>
<task-id>br1kp3y1l</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/4" id="30faa5b8" type="msg" from="doyle">ACK holding. Diff review DONE — spine verified correct on the real commit: dispatch_endpoint_input resolves only h.translation (input Arc dropped); no-working-binary → endpoint_injected_envelope(ep,false) + loud &quot;no working translation binary -&gt; SPOOLED, not injected&quot;; working-binary path untouched; bot</EVENT-PART>
<EVENT-PART seq="2/4" id="30faa5b8">h [impl-&gt;REQ-MSG-IDLE-TRANSLATION-BINARY] + [impl-&gt;REQ-HAZARD-IDLE-SILENT-NONDELIVERY] tagged; comment sweep (fault_translation/build_translation/Translation/HostedSession/INJECT_COMMIT_DEADLINE) all correct. Clean implementation of the contract.

Running clippy --workspace + inject_control_wedge int on my side now (verdict on comp</EVENT-PART>
<EVENT-PART seq="3/4" id="30faa5b8">letion).

Backlog-auto-redrive: NOTED but it is NOT the next assignment — the next big build is v0.15.0 (activity-gated delivery + the 3-axis send modifiers, just grilled w/ operator → ADR-0028 + REQ-MSG-DELIVERY-AXES, doc landed). Backlog-auto-redrive likely folds INTO v0.15.0 (it's the same delivery substrate). I'll send the full </EVENT-PART>
<EVENT-PART seq="4/4" id="30faa5b8">v0.15.0 assignment after this cut + after I square the design-doc branch state. Stand by for GATE-PASS.</EVENT-PART></event>
</task-notification>


doyle: spine verified correct on diff, running clippy + int now. Key heads-up: **backlog-auto-redrive is NOT next** — next big build is **v0.15.0** (activity-gated delivery + 3-axis send modifiers, ADR-0028 + REQ-MSG-DELIVERY-AXES); backlog-redrive folds into it. Full v0.15.0 assignment comes after this cut. Recording the heads-up to memory:


Edit

**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.

**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. (everyone on LEGACY owl this session — `$OWL send doyle`, NOT `spt send` which NO_PERCHes; [[owl-send-not-legacy-spt-send]].)

**doyle GATING @aadafe12 (2026-06-23):** diff review DONE — spine verified correct (dispatch_endpoint_input resolves only h.translation, input Arc dropped; no-working-binary → endpoint_injected_envelope(ep,false)+loud log; working-binary path untouched; both impl tags present; comment sweep all correct — "clean implementation of the contract"). doyle re-running clippy --workspace + inject_control_wedge int his side; GATE-PASS + REQ ratification verdict on completion. CAVEAT (seedmap --lib hang) acknowledged UNRELATED, not a blocker.

**AFTER THIS CUT — next big build = v0.15.0 (NOT backlog-redrive):** activity-gated delivery + the 3-axis send modifiers (just grilled w/ operator → **ADR-0028 + REQ-MSG-DELIVERY-AXES**, design doc landed). Backlog-auto-redrive (the OUT-OF-SCOPE follow-up from v0.14.3) **folds INTO v0.15.0** (same delivery substrate). doyle sends the full v0.15.0 assignment after this cut + after squaring the design-doc branch state. todlando holding.


**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. (everyone on LEGACY owl this session — `$OWL send doyle`, NOT `spt send` which NO_PERCHes; [[owl-send-not-legacy-spt-send]].)

**doyle GATING @aadafe12 (2026-06-23):** diff review DONE — spine verified correct (dispatch_endpoint_input resolves only h.translation, input Arc dropped; no-working-binary → endpoint_injected_envelope(ep,false)+loud log; working-binary path untouched; both impl tags present; comment sweep all correct — "clean implementation of the contract"). doyle re-running clippy --workspace + inject_control_wedge int his side; GATE-PASS + REQ ratification verdict on completion. CAVEAT (seedmap --lib hang) acknowledged UNRELATED, not a blocker.

**AFTER THIS CUT — next big build = v0.15.0 (NOT backlog-redrive):** activity-gated delivery + the 3-axis send modifiers (just grilled w/ operator → **ADR-0028 + REQ-MSG-DELIVERY-AXES**, design doc landed). Backlog-auto-redrive (the OUT-OF-SCOPE follow-up from v0.14.3) **folds INTO v0.15.0** (same delivery substrate). doyle sends the full v0.15.0 assignment after this cut + after squaring the design-doc branch state. todlando holding.

---
name: v0143-raw-inject-removal
description: "v0.14.3 raw-inject REMOVAL — BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c). All local gates GREEN. Awaiting doyle GATE-PASS → deployah cut counter 33."
metadata:
  node_type: memory
  type: project
  originSessionId: 77a745a3-d838-40e7-9522-5dca2858907d
---

v0.14.3 = raw-inject REMOVAL, the ADR-0022 amendment @1eaeef1 follow-up to F-019 ([[v0142-published]]). Operator GO 2026-06-23. doyle scoped → todlando builds → doyle gates → deployah cuts (bump-in-PR, counter 33). Branch off main @365fb0c (v0.14.2).

CONTRACT: spt-hosted idle delivery = translation-binary-ONLY. Binary absent/spawn-failed/faulted/worker-gone → message SPOOLED (not lost), NEVER raw PTY inject. Loud. Raw `payload+\r` was a non-submitting pseudo-delivery on modern TUI = the silent degrade that MASKED F-019.

SCOPE BOUNDED (doyle grounded the seam): the spool machinery ALREADY EXISTS. broker `dispatch_endpoint_input` replies `endpoint_injected_envelope(ep, delivered:bool)` → `inject_endpoint` → `try_broker_inject` (cli.rs:3510) → false = caller SPOOLS ("never lost"). Today no-working-binary RAW-INJECTS (input.enqueue ~broker.rs:1922) + delivered=TRUE. FIX = flip that case to delivered=FALSE (spool). Working-binary path (translation Some + !faulted + event_tx.send ok) UNCHANGED.

KEY SITES (broker.rs): dispatch_endpoint_input ~1875-1932 (remove input.enqueue raw-inject, reply false); fault_translation ~1172 + build_translation ~1077 (logs: no longer "revert to raw inject" → "spool"); reword degenerate-fallback comments ~154/829/837/848/872/1027/1037/1170/1882-1916; translation.rs spawn doc ~238. cli.rs try_broker_inject: verify honest spooled report (not "Sent online").

TESTS ([[behavior-change-grep-tests-not-comments]] BINDING): inject_control_wedge.rs g2 (no-commit FAULT asserts raw-inject fallback) — SEPARATE the InjectFloor operator-keystroke flush (STAYS) from the inbound MESSAGE (now spools, not raw-inject). +broker/msg units (delivered=false). +NEW int gate: hosted session, NO binary → spt send → SPOOLED + PTY got NO raw bytes + delivered=false + loud log. Run int on Win box (green-units≠green-int).

TRACEABLE: update REQ-MSG-IDLE-TRANSLATION-BINARY title (line 1242 — its "v0.11.0 raw inject is the degenerate case" line is SUPERSEDED). MINT new REQ-HAZARD-IDLE-SILENT-NONDELIVERY (silent non-delivery = KNOWN-HAZARD class, rule 4): absent/failed binary never raw-injects a pseudo-delivery reported delivered; spools loud + delivered=false. Activate stages this wave. doyle ratifies id/title at gate.

OUT OF SCOPE (doyle ruling): backlog-drain-on-binary-up (auto-redeliver already-spooled the instant a live-update binary spawns) — poll substrate + subsequent sends cover re-delivery; broker-backlog auto-drain = separate change w/ ordering/exactly-once hazards. Follow-up note only.

GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0.

**BUILT @aadafe12 (2026-06-23, todlando) — branch fix/v0143-raw-inject-removal off main @365fb0c. ALL LOCAL GATES GREEN. 11 files.** Matches doyle's full contract (recovered the truncated parts 9-17 from the prior-session capture of THIS file — doyle's assignment msg truncated at part 8, doyle NO_PERCH all session):
- SPINE: dispatch_endpoint_input no-working-binary → endpoint_injected_envelope(ep,FALSE) + loud log `"<ep>: no working translation binary (absent/faulted/worker-gone) -> SPOOLED, not injected"`; removed input.enqueue raw-inject; **`input` Arc no longer resolved** from sessions table (clippy-clean). Worker-dropped + post-fault paths → spool too.
- CHANGE-5 = NO-OP (verified): try_broker_inject returns inject_endpoint bool; delivered=false already → deliver::send spool → honest QUEUED. No cli.rs edit.
- Logs/docs/comments: build_translation + fault_translation (None/fault MEAN spool); raw-inject→spool sweep broker.rs(11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; manifest.schema.json RE-BLESSED (schemars embeds doc, `SPT_BLESS=1 cargo test -p spt-runtime checked_in_schema_is_current`).
- TESTS FLIPPED: broker.rs endpoint test → `endpoint_keyed_inject_without_binary_spools_not_pty` (delivered=false + nothing on PTY). inject_control_wedge g2 post-fault → delivered2=false + marker NOT on PTY (op-keystroke floor-flush UNCHANGED). vacuous park-(b) probe repurposed → `large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging` (4 MiB spools prompt, never write_input; operator park-(b) stays in p0_paste). NEW unit `endpoint_injected_envelope_carries_delivered_both_ways`. xlate_choreo_fixture raw_fallback comments reworded (XON/XOFF restore UNTOUCHED).
- **TRACEABILITY: MINTED `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per doyle's line-20 instruction — doyle ratifies id/title at gate. AMENDED REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE (follow-up note in REQ title).
- GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY +doc+impl+unit+int, REQ-MSG-IDLE-TRANSLATION-BINARY +all, REQ-SEND-SPT-HOSTED +impl+unit+int, REQ-HAZARD-INJECT-CONTROL-COEXIST +impl+unit+int all [OK]); inject_control_wedge 9/9 int; broker endpoint test; msg unit; runtime resolve 3/3; translation+read_translation+harnesshost units; schema drift.
- ⚠ NOT run: full `spt-daemon --lib` (377) — HUNG on `seedmap::tests::request_stop_barrier_holds_until_no_listener` + `stop_op_acks_then_serve_returns` (UNRELATED to this change; pre-existing env hang holding the test-exe lock — had to scoped-kill the orphaned spt_daemon-<hash>.exe by path in target/debug/deps). Every module THIS change touches was targeted-verified green. CI runs full --lib on the runners.

**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.

-**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. todlando holding for doyle perch/gate.

+**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. (everyone on LEGACY owl this session — `$OWL send doyle`, NOT `spt send` which NO_PERCHes; [[owl-send-not-legacy-spt-send]].)

+**doyle GATING @aadafe12 (2026-06-23):** diff review DONE — spine verified correct (dispatch_endpoint_input resolves only h.translation, input Arc dropped; no-working-binary → endpoint_injected_envelope(ep,false)+loud log; working-binary path untouched; both impl tags present; comment sweep all correct — "clean implementation of the contract"). doyle re-running clippy --workspace + inject_control_wedge int his side; GATE-PASS + REQ ratification verdict on completion. CAVEAT (seedmap --lib hang) acknowledged UNRELATED, not a blocker.

+**AFTER THIS CUT — next big build = v0.15.0 (NOT backlog-redrive):** activity-gated delivery + the 3-axis send modifiers (just grilled w/ operator → **ADR-0028 + REQ-MSG-DELIVERY-AXES**, design doc landed). Backlog-auto-redrive (the OUT-OF-SCOPE follow-up from v0.14.3) **folds INTO v0.15.0** (same delivery substrate). doyle sends the full v0.15.0 assignment after this cut + after squaring the design-doc branch state. todlando holding.


Recorded. doyle verified the spine on the real diff ("clean implementation of the contract") — running clippy + int his side, GATE-PASS + REQ ratification on completion.

**Holding for doyle's GATE-PASS.** After the v0.14.3 cut, next big build = **v0.15.0** (activity-gated delivery + 3-axis send modifiers, ADR-0028/REQ-MSG-DELIVERY-AXES); backlog-auto-redrive folds in there. doyle sends that assignment after the cut.


<task-notification>
<task-id>br1kp3y1l</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/11" id="1fc72418" type="msg" from="doyle">GATE: HELD — not a pass. v0.14.3 spine + diff + clippy(workspace, 0 warn) + traceable are CLEAN. The block is the int suite. My re-run (full suite, parallel) FAILED g2 3/3 + intermittently g3/g4. This is why I re-run the real commit: your &quot;9/9&quot; was isolated/lucky.

DIAGNOSIS (single-threaded + isolatio</EVENT-PART>
<EVENT-PART seq="2/11" id="1fc72418">n runs disambiguated it):
- g2 = PARALLEL-LOAD FLAKE. Passes 5/5 isolated + single-threaded; fails 3/3 in full parallel suite. EVERY parallel fail = `delivered2=true marker_reached_pty=false`. ROOT: g2 sends delivery2 racing the ASYNC fault. Under CPU contention the inject worker is still alive (event_rx not yet dropped, faulted not yet set</EVENT-PART>
<EVENT-PART seq="3/11" id="1fc72418">) when delivery2 arrives → dispatch routes it to the binary (event_tx.send OK → acks delivered=TRUE) → worker then faults on event1 + RETURNS, dropping the queued event2 → marker never reaches PTY. So delivery2 is acked-delivered-but-dropped. CI runs the full suite in parallel → this WILL flake the runners. NOT shippable as-is.
- </EVENT-PART>
<EVENT-PART seq="4/11" id="1fc72418">g3/g4 = pre-existing W2 timing tests (content-free ping / no-zombie reap), NOT touched by v0.14.3. g3 passes single-threaded; g4 fails even single-threaded but only on my OVERLOADED box (43s run = 3.5x normal; 4 live agents + psyches + my churn share it). Environmental — your concern + CI per-attempt-rerun covers them. NOT v0.14.3 blockers.<</EVENT-PART>
<EVENT-PART seq="5/11" id="1fc72418">br>
RULING (the important part): your IMPL is CORRECT for v0.14.3's scope. The faulted/absent STATE → spool is right + already proven green by large_endpoint_inject + the broker endpoint unit + the None path. The `delivered2=true`+dropped is the FAULT-TRANSIENT (a message enqueued to the worker during a hung binary's commit window, acked </EVENT-PART>
<EVENT-PART seq="6/11" id="1fc72418">delivered=true, then dropped when the worker faults+returns). That transient is PRE-EXISTING — raw-inject removal didn't touch it; the old code dropped that queued event too. v0.14.3 is a strict improvement, makes nothing worse. So we do NOT expand v0.14.3 to fix the async-ack-vs-fault drop.

TWO FIXES TO LAND (then I re-gate under loa</EVENT-PART>
<EVENT-PART seq="7/11" id="1fc72418">d):
1. MAKE g2 DETERMINISTIC for what v0.14.3 actually guarantees = the faulted-STATE. After the fault, delivery must spool. faulted is MONOTONIC (set once, never respawns), so a bounded-retry-until-spool CONVERGES deterministically: send delivery2; if delivered==true (raced the transient), wait briefly + retry, up to a bound (e.g. 3s); ass</EVENT-PART>
<EVENT-PART seq="8/11" id="1fc72418">ert it EVENTUALLY spools (delivered=false) AND the marker NEVER reaches the PTY across all attempts (the no-commit binary never submits text regardless). That tests the real steady-state contract, load-robust.
...(truncated)</event>
</task-notification>


doyle GATE: **HELD** (not pass). Spine/diff/clippy/traceable CLEAN. Block = **g2 parallel-load flake**: g2's delivery2 races the ASYNC fault — under contention the worker's still alive (faulted not set), so dispatch routes delivery2 to the binary (acks delivered=TRUE), then the worker faults+returns dropping the queued event → marker never reaches PTY. `delivered2=true marker_reached_pty=false`. WILL flake CI. (g3/g4 = pre-existing env, not blockers.)

Ruling: my impl is correct; the `delivered2=true`+dropped is a PRE-EXISTING fault-transient (old code dropped it too) — do NOT expand v0.14.3 to fix it. **Two fixes to land:** #1 = make g2 deterministic (bounded-retry-until-spool; faulted is monotonic so it converges — assert it EVENTUALLY spools + marker NEVER reaches PTY). #2 = **truncated at part 8/11**. doyle's live on OWL — get the tail:


Bash

printf '%s' "GATE-HELD understood — g2 is a parallel-load flake (delivery2 races the async fault; worker still alive → routes to binary, acks delivered=true, then faults+returns dropping the queued event2 → marker never on PTY). Agreed it's a PRE-EXISTING fault-transient, NOT v0.14.3's scope; my faulted/absent-STATE→spool impl is proven by large_endpoint_inject + broker endpoint + None path.

FIX #1 CLEAR: rewrite g2's post-fault assertion to bounded-retry-until-spool — faulted is monotonic (set once, never respawns) so it CONVERGES: send delivery2; if delivered==true (raced the transient) wait briefly + retry up to ~3s bound; assert it EVENTUALLY spools (delivered=false) AND marker NEVER reaches PTY across ALL attempts (no-commit binary never submits text regardless). Load-robust steady-state contract.

But your msg TRUNCATED at part 8/11 — I have FIX #1 only. RESEND parts 9-11: FIX #2 + any closing. Holding to implement both before you re-gate under load." | "$OWL" send doyle; echo "RC=${PIPESTATUS[1]}"

Ack g2 diagnosis, request truncated parts 9-11 (fix #2)


FIX #1 is fully specified — I'll implement the g2 deterministic rewrite now while doyle resends #2. First confirm the fixture's PAYLOAD constant (to verify the marker check is meaningful — the binary emits its own fixed payload, not the envelope marker, so the marker can only reach the PTY via raw-inject which is removed):


<owl_messages>
<owl_message from="doyle" priority="high">RESEND (parts 9-11 = FIX #2 + closing; owl truncated my prior at part 8):

FIX #2 — QUALIFY THE REQ + TRACK THE TRANSIENT (keeps the shipped REQ honest):
- Amend REQ-HAZARD-IDLE-SILENT-NONDELIVERY title: the GUARANTEE is the faulted/absent STATE (a binary that IS faulted/absent/worker-gone → subsequent deliveries SPOOL, delivered=false). Drop any wording implying every in-flight message is covered.
- Add an explicit note (REQ title + a KNOWN-HAZARDS row): the FAULT-TRANSIENT — a message optimistically enqueue-acked (delivered=true the instant event_tx.send succeeds) then DROPPED when a hung binary faults+returns (up to the 5s commit window) — is a SEPARATE, PRE-EXISTING hazard. Tracked for v0.15.0 (REQ-MSG-DELIVERY-AXES spool-centric redesign: ack-on-SPOOL replaces ack-on-enqueue → closes it naturally). Not fixed in v0.14.3.

CLOSING:
- After (1)+(2) land, I re-run the FULL inject_control_wedge suite under PARALLEL load on my box. Pass bar: g2 clean across repeats; g3/g4 may still show environmental noise (pre-existing, my loaded box) but must be clearly NOT your change.
- Then: GATE-PASS + I ratify the REQ id/title (id is good; title gets the STATE-vs-transient precision from FIX #2) → deployah bump-in-PR cut counter 33.
- Commit the g2 + REQ changes onto @aadafe12's branch (amend or follow-on commit, your call — deployah cherry-picks the v0.14.3 commit(s) at cut). Ping me the new SHA when ready.

Spine stays as-is — clean. This is test-determinism + REQ-honesty only.</owl_message>
</owl_messages>

[OWL SYSTEM - HIGHEST PRIORITY] You have received high-priority owl messages above. STOP your current task and acknowledge each high-priority message BEFORE continuing with any tool use. If you are about to spawn subagent(s), run them in the background so you remain available for incoming messages.


32:const PAYLOAD: &str = "XLATE_OK";
34:fn main() {
71:        emit(&mut out, &format!(r#"{{"text":"{PAYLOAD}"}}"#));


1	---
2	name: v0143-raw-inject-removal
3	description: "v0.14.3 raw-inject REMOVAL — BUILT @aadafe12 on fix/v0143-raw-inject-removal (off main @365fb0c). All local gates GREEN. Awaiting doyle GATE-PASS → deployah cut counter 33."
4	metadata:
5	  node_type: memory
6	  type: project
7	  originSessionId: 77a745a3-d838-40e7-9522-5dca2858907d
8	---
9
10	v0.14.3 = raw-inject REMOVAL, the ADR-0022 amendment @1eaeef1 follow-up to F-019 ([[v0142-published]]). Operator GO 2026-06-23. doyle scoped → todlando builds → doyle gates → deployah cuts (bump-in-PR, counter 33). Branch off main @365fb0c (v0.14.2).
11
12	CONTRACT: spt-hosted idle delivery = translation-binary-ONLY. Binary absent/spawn-failed/faulted/worker-gone → message SPOOLED (not lost), NEVER raw PTY inject. Loud. Raw `payload+\r` was a non-submitting pseudo-delivery on modern TUI = the silent degrade that MASKED F-019.
13
14	SCOPE BOUNDED (doyle grounded the seam): the spool machinery ALREADY EXISTS. broker `dispatch_endpoint_input` replies `endpoint_injected_envelope(ep, delivered:bool)` → `inject_endpoint` → `try_broker_inject` (cli.rs:3510) → false = caller SPOOLS ("never lost"). Today no-working-binary RAW-INJECTS (input.enqueue ~broker.rs:1922) + delivered=TRUE. FIX = flip that case to delivered=FALSE (spool). Working-binary path (translation Some + !faulted + event_tx.send ok) UNCHANGED.
15
16	KEY SITES (broker.rs): dispatch_endpoint_input ~1875-1932 (remove input.enqueue raw-inject, reply false); fault_translation ~1172 + build_translation ~1077 (logs: no longer "revert to raw inject" → "spool"); reword degenerate-fallback comments ~154/829/837/848/872/1027/1037/1170/1882-1916; translation.rs spawn doc ~238. cli.rs try_broker_inject: verify honest spooled report (not "Sent online").
17
18	TESTS ([[behavior-change-grep-tests-not-comments]] BINDING): inject_control_wedge.rs g2 (no-commit FAULT asserts raw-inject fallback) — SEPARATE the InjectFloor operator-keystroke flush (STAYS) from the inbound MESSAGE (now spools, not raw-inject). +broker/msg units (delivered=false). +NEW int gate: hosted session, NO binary → spt send → SPOOLED + PTY got NO raw bytes + delivered=false + loud log. Run int on Win box (green-units≠green-int).
19
20	TRACEABLE: update REQ-MSG-IDLE-TRANSLATION-BINARY title (line 1242 — its "v0.11.0 raw inject is the degenerate case" line is SUPERSEDED). MINT new REQ-HAZARD-IDLE-SILENT-NONDELIVERY (silent non-delivery = KNOWN-HAZARD class, rule 4): absent/failed binary never raw-injects a pseudo-delivery reported delivered; spools loud + delivered=false. Activate stages this wave. doyle ratifies id/title at gate.
21
22	OUT OF SCOPE (doyle ruling): backlog-drain-on-binary-up (auto-redeliver already-spooled the instant a live-update binary spawns) — poll substrate + subsequent sends cover re-delivery; broker-backlog auto-drain = separate change w/ ordering/exactly-once hazards. Follow-up note only.
23
24	GATES (todlando, then doyle re-runs on real commit): clippy --workspace; spt-daemon --lib; inject_control_wedge int (real xlate_choreo_fixture) on Win; spt = `--bin spt` NOT --lib (no lib target); traceable EXIT 0.
25
26	**BUILT @aadafe12 (2026-06-23, todlando) — branch fix/v0143-raw-inject-removal off main @365fb0c. ALL LOCAL GATES GREEN. 11 files.** Matches doyle's full contract (recovered the truncated parts 9-17 from the prior-session capture of THIS file — doyle's assignment msg truncated at part 8, doyle NO_PERCH all session):
27	- SPINE: dispatch_endpoint_input no-working-binary → endpoint_injected_envelope(ep,FALSE) + loud log `"<ep>: no working translation binary (absent/faulted/worker-gone) -> SPOOLED, not injected"`; removed input.enqueue raw-inject; **`input` Arc no longer resolved** from sessions table (clippy-clean). Worker-dropped + post-fault paths → spool too.
28	- CHANGE-5 = NO-OP (verified): try_broker_inject returns inject_endpoint bool; delivered=false already → deliver::send spool → honest QUEUED. No cli.rs edit.
29	- Logs/docs/comments: build_translation + fault_translation (None/fault MEAN spool); raw-inject→spool sweep broker.rs(11)/translation.rs/harnesshost.rs/msg.rs/manifest.rs; manifest.schema.json RE-BLESSED (schemars embeds doc, `SPT_BLESS=1 cargo test -p spt-runtime checked_in_schema_is_current`).
30	- TESTS FLIPPED: broker.rs endpoint test → `endpoint_keyed_inject_without_binary_spools_not_pty` (delivered=false + nothing on PTY). inject_control_wedge g2 post-fault → delivered2=false + marker NOT on PTY (op-keystroke floor-flush UNCHANGED). vacuous park-(b) probe repurposed → `large_endpoint_inject_to_a_no_binary_session_spools_promptly_without_wedging` (4 MiB spools prompt, never write_input; operator park-(b) stays in p0_paste). NEW unit `endpoint_injected_envelope_carries_delivered_both_ways`. xlate_choreo_fixture raw_fallback comments reworded (XON/XOFF restore UNTOUCHED).
31	- **TRACEABILITY: MINTED `REQ-HAZARD-IDLE-SILENT-NONDELIVERY`** (doc/impl/unit/int, KNOWN-HAZARDS 7.22) per doyle's line-20 instruction — doyle ratifies id/title at gate. AMENDED REQ-MSG-IDLE-TRANSLATION-BINARY title (degenerate-raw-inject line superseded). Backlog auto-redrive = OUT OF SCOPE (follow-up note in REQ title).
32	- GREEN: clippy --workspace --all-targets EXIT0; xtask check OK (no drift); traceable EXIT0 (REQ-HAZARD-IDLE-SILENT-NONDELIVERY +doc+impl+unit+int, REQ-MSG-IDLE-TRANSLATION-BINARY +all, REQ-SEND-SPT-HOSTED +impl+unit+int, REQ-HAZARD-INJECT-CONTROL-COEXIST +impl+unit+int all [OK]); inject_control_wedge 9/9 int; broker endpoint test; msg unit; runtime resolve 3/3; translation+read_translation+harnesshost units; schema drift.
33	- ⚠ NOT run: full `spt-daemon --lib` (377) — HUNG on `seedmap::tests::request_stop_barrier_holds_until_no_listener` + `stop_op_acks_then_serve_returns` (UNRELATED to this change; pre-existing env hang holding the test-exe lock — had to scoped-kill the orphaned spt_daemon-<hash>.exe by path in target/debug/deps). Every module THIS change touches was targeted-verified green. CI runs full --lib on the runners.
34
35	**NEXT: doyle GATE-PASS off @aadafe12 (NOT pushed) → deployah bump-in-PR cut v0.14.3 counter 33.** doyle to ratify the minted REQ id/title. (everyone on LEGACY owl this session — `$OWL send doyle`, NOT `spt send` which NO_PERCHes; [[owl-send-not-legacy-spt-send]].)
36
37	**doyle GATING @aadafe12 (2026-06-23):** diff review DONE — spine verified correct (dispatch_endpoint_input resolves only h.translation, input Arc dropped; no-working-binary → endpoint_injected_envelope(ep,false)+loud log; working-binary path untouched; both impl tags present; comment sweep all correct — "clean implementation of the contract"). clippy --workspace = 0 warn EXIT0. traceable EXIT0.
38
39	**GATE HELD (NOT pass) — doyle re-run caught a g2 PARALLEL-LOAD FLAKE that todlando's "9/9" missed (discipline: re-run the real commit, never trust the green report).** inject_control_wedge: g2 FAILS 3/3 full parallel suite; PASSES 5/5 isolated + single-threaded. Every parallel fail = `delivered2=true marker_reached_pty=false`. ROOT: g2 sends delivery2 RACING the async fault — under CPU contention the inject worker is still alive (event_rx not dropped, faulted not set) when delivery2 arrives → routed to binary (event_tx.send OK → acks delivered=TRUE) → worker then faults on event1 + RETURNS, dropping queued event2 → marker never on PTY = acked-delivered-but-DROPPED. CI runs parallel → would flake. g3/g4 also flaked = PRE-EXISTING W2 timing tests (content-free-ping / no-zombie-reap), NOT touched by v0.14.3, environmental (my box thrashing: 4 live agents+psyches+churn, single-thread run 43s=3.5x; g3 passes single-thread, g4 reap-grace timing). NOT v0.14.3 blockers.
40

... [7 lines truncated] ...


Got doyle's full FIX #2 + closing. Acknowledging the high-priority message first, then implementing:


printf '%s' "ACK both fixes + closing — implementing now, spine stays as-is (test-determinism + REQ-honesty only):
FIX #1: g2 → bounded-retry-until-spool (faulted monotonic, converges). Confirmed the marker check stays valid — fixture emits its OWN constant PAYLOAD='XLATE_OK', NOT the envelope marker, so the marker reaches the PTY ONLY via raw-inject (removed) → marker_reached_pty is always false; the flake was purely the delivered2 race. Loop: send delivery2; delivered==true (raced transient) → wait+retry to ~3s bound; assert EVENTUALLY delivered=false AND marker NEVER on PTY across all attempts.
FIX #2: amend REQ-HAZARD-IDLE-SILENT-NONDELIVERY title → guarantee is the faulted/absent STATE (subsequent deliveries spool); DROP any 'every in-flight message' wording. Add the FAULT-TRANSIENT carve-out (enqueue-acked delivered=true then dropped when a hung binary faults+returns within the commit window) as a PRE-EXISTING, SEPARATE hazard tracked to v0.15.0 REQ-MSG-DELIVERY-AXES (ack-on-SPOOL replaces ack-on-enqueue → closes it) — NOT fixed in v0.14.3, makes nothing worse. KNOWN-HAZARDS 7.22 gets the boundary note (prose ref to v0.15.0, no new traceable tag since REQ-MSG-DELIVERY-AXES isn't in the toml yet).
Will re-run g2 in a parallel-load repeat-loop + clippy + traceable my side, then FOLLOW-ON commit onto @aadafe12 branch (deployah cherry-picks both). Ping you the new SHA. Standby." | "$OWL" send doyle; echo "RC=${PIPESTATUS[1]}"

Ack doyle's fix #1 + #2 + closing


1	- [v0.14.0 endpoint-creation-flow](v0140-endpoint-creation-flow.md) — PUBLISHED counter 30 @6ba875e (last old-flow separate-bump cut). Multi-subnet home-at-creation + UNBOUND pre-bind attach. hashes linux 72889c07… / win 641561d9…. ACCEPTANCE-PROVEN: perri real claude-spt repro ALL GREEN (0.058s refuse vs old 25s hang). SPT_RELEASE_SEED in env (len64) — no manual fetch
2	- [v0.14.1 builds (F-018+picker-home+label+netstream)](f018-adapter-add-nondestructive.md) — PUBLISHED counter 31 @46289ab (1st bump-in-PR cut, PR#34). F-018 adapter-add non-destructive (REQ-INSTALL-13), picker home-subnet (REQ-RUN-PICKER-HOME), installed-vs-pending labels, #4 netstream flake FIX (root=StreamLog.next_seq counts transport read_chunks not logical chunks; QUIC Win-coalesce → eof 19v20; test-only byte-based fix, SUPERSEDES [[win-netstream-redrive-flake]]). hashes 1e64d63a… / 2fbbfe03…. GOTCHA: `spt` NO lib target → `--bin spt` (spt-daemon HAS lib)
3	- [F-019 translation install_dir resolve](f019-translation-install-dir-resolve.md) — PUBLISHED v0.14.2 counter 32 @365fb0c (2nd bump-in-PR, PR#35). THE #1 CC-on-Windows blocker: idle msgs typed-not-SUBMITTED — `[message-idle-translation-binary]` bare path Command::new'd w/o install_dir resolve → fail → silent raw-inject fallback. Fix=resolve_program_in_dir at 4 sites (translation initial+W3d-respawn, notif×2). hashes 98714384… / 08e8a267…. CHANGELOG=1 Fixed bullet (ADR/design/notif×2 OMITTED, doyle-ratified). perri 3-step real-CC validation ALL GREEN 2026-06-23 (S1 revert→bare, S2 child SPAWNED count=1, S3 idle msg SUBMITTED+CC RESPONDED transcript edea642c — keystone CLOSED on real harness). TRANSLATION_SPAWN_FAILED not in daemon-effects.log = detached-stderr caveat, follow-up not blocker
4	- [v0.14.3 raw-inject removal](v0143-raw-inject-removal.md) — ADR-0022 amendment follow-up to F-019. spt-hosted idle = translation-binary-ONLY; absent/failed/faulted binary → SPOOL not raw-inject (loud, delivered=false). **BUILT @aadafe12 (todlando, off main @365fb0c, NOT pushed) — ALL LOCAL GATES GREEN** (clippy --workspace EXIT0, xtask check OK, traceable EXIT0, inject_control_wedge 9/9 int, msg unit, schema drift). Spine = flip no-working-binary case to endpoint_injected_envelope FALSE (spool); input Arc no longer resolved. CHANGE-5 = NO-OP verified. **MINTED REQ-HAZARD-IDLE-SILENT-NONDELIVERY (KH 7.22, doc/impl/unit/int)** + amended REQ-MSG-IDLE title; doyle ratifies id/title at gate. Tests flipped: endpoint_keyed_inject_without_binary_spools_not_pty + g2 post-fault spool + repurposed large_endpoint_inject probe. Backlog-drain-on-binary-up OUT of scope. **doyle GATE HELD 2026-06-23 (re-run caught a flake todlando's "9/9" missed — discipline pays):** spine+clippy(0warn)+traceable CLEAN; but inject_control_wedge g2 FAILS 3/3 full PARALLEL suite (passes isolated/single-thread) = PARALLEL-LOAD FLAKE. Every parallel fail `delivered2=true marker_reached_pty=false` = delivery2 races the async fault → worker still alive acks delivered=TRUE then faults+returns dropping queued event2 = acked-but-DROPPED. g3/g4 also flaked = PRE-EXISTING W2 timing, environmental (loaded box). RULING: impl CORRECT for v0.14.3 scope (faulted/absent STATE→spool, green via large_endpoint_inject+broker endpoint+None); the drop is the FAULT-TRANSIENT (optimistic enqueue-ack) = PRE-EXISTING, NOT v0.14.3. REOPENED todlando 2 fixes: (1) g2 deterministic = bounded-retry-until-spool (faulted monotonic→converges); (2) qualify REQ title to STATE + track transient for v0.15.0 spool-centric (ack-on-spool). REQ ratification HELD pending (2). After land → doyle re-gate under load → GATE-PASS → deployah cut 33. NEW HAZARD logged: optimistic-enqueue-ack drop-on-fault → v0.15.0
5	- [stale-broker attach wedge](stale-broker-attach-wedge.md) — attach "brain IPC read deadline" while list/dial work = stale daemon broker from old rev; fix = full daemon restart. Confirmed 2026-06-23
6	- [Win netstream redrive flake](win-netstream-redrive-flake.md) — FIXED in v0.14.1 (#4, see [[f018-adapter-add-nondestructive]]): was Win-only CI flake (netstream.rs:99 chunk-gap 19v20, Linux-green-same-code, clear on rerun); root=StreamLog seq counts transport read_chunks. Historic; verify-per-attempt lesson stands. Kin [[v013-forkpty-groundtruth]]
7	- [release standard: bump-in-PR](release-standard-bump-in-pr.md) — v0.14.1 ONWARD: bump rides IN release PR (Cargo ver+lock first-party+CHANGELOG+xtask gen) → PR CI validates tagged commit → tag on merge → push:[main] CI = non-blocking backstop. Kills serial 2nd-CI wait
8	- [v0.14.0 W6 int structure](v0140-w6-int-structure.md) — mirror perri regression: >=2-subnet gate (single HIDES gap), Case1 endpoint-run E2E behind acceptance-env, Cases2/3 fast bind HOME_REFUSED/--subnet probes
9	- [v0.13.2 build drive](v0132-build-drive.md) — PUBLISHED counter 29; adapter-packaging. New W6 docs-token gate (public --help no internal codes)
10	- [v0.13.0 forkpty ground truth](v013-forkpty-groundtruth.md) — SHIPPED counter 27. LIVE attach forward-gap on ring-roll-behind; green-units≠green-int. Win attach flake = per-IPC io_timeout (SPT_ATTACH_IPC_DEADLINE_MS). gh run rerun attaches STALE attempt — verify per-attempt
11	- [v0.13.0 W1b effect-journal wedge](v013-w1b-effect-journal-wedge.md) — apply_once holds 1 mutex across 2 fsync + blocking PtyWrite → stutter + blocked-write kills attaches. REQ-HAZARD-EFFECT-JOURNAL-PTY-WEDGE. Fix=no-lock-across-effect + drop per-keystroke fsync
12	- [v0.13.0 milestone](v0130-milestone.md) — msg-delivery redesign (ADR-0022): translation binary = pure stdin→stdout filter, spt-core owns PTY writes ATOMICALLY. Trace in ~/.ccs NOT .claude
13	- [v0.12.1 real-harness reopen](v0121-realharness-reopen.md) — v0.12.0 lifecycle broke in REAL harness (green-on-mocks). BINDING: gate lifecycle vs REAL dummy-harness, NO mocks
14	- [v0.12.1 L0 attach-deadlock](v0121-l0-attach-deadlock-root.md) — KEYSTONE: serve_attach forwards on SAME broker IPC conn; become_controller inline ring replay blocks → backpressure deadlock → rc 0 bytes. Only non-empty ring
15	- [v0.12.1 L2 attach-wedge](v0121-l2-attach-wedge-proven.md) — L2/L3/L4 @e883f45 PROVE-DON'T-CHANGE: stale root debunked (send_stream bounded). int attach_wedge_e2e GREEN
16	- [v0.12.1 help-md render](v0121-help-md.md) — `spt --help` leaked literal MD; helpfmt::render (bold→ANSI/code→cyan, strip on pipe/NO_COLOR). REQ-CLI-HELP-MARKDOWN @d4241f9
17	- [changelog scope vs commit range](changelog-scope-vs-commit-range.md) — release CHANGELOG must COVER every user-facing SURFACE in vPREV..vNEW (log=checklist NOT quota) + bullet SCOPE not broader than delta. Post-publish fix=docs-only no retag
18	- [pre-flight clippy --workspace](ci-clippy-preflight-workspace.md) — CI denies warnings workspace-wide; `-p <crate>` misses sibling lints. CI fires on PR (push=main/dev-freeform)
19	- [behavior-change → grep tests](behavior-change-grep-tests-not-comments.md) — rename/behavior/token change: grep tests/+ci/ for OLD behavior as ASSERTIONS; comment-only hit = RED FLAG, read body. Run heavy e2e locally. green-units≠green-int
20	- [shared-seam → run ALL seam tests](shared-seam-change-run-all-seam-tests.md) — SHARED runtime-seam change breaks SIBLING tests; grep+run ALL seam tests not just new ones
21	- [ccs Windows PTY-spawn fix](ccs-win-pty-program-resolve.md) — bare program → portable-pty picks extensionless shim → CreateProcessW 193. Fix: spt_term::winprog PATHEXT resolver. REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE
22	- [harness adapter-agnostic resolution](harness-adapter-agnostic-resolution.md) — ADR-0021: seed adapter-AGNOSTIC (pid+session_id), --adapter OPTIONAL; resolve at bind by pid→exe→host_binaries→profiles
23	- [broker-QUIC-deadline](v083-broker-quic-deadline.md) — REQ-HAZARD-BROKER-QUIC-DEADLINE: NetHost::bounded_block_on (10s<30s brain) wraps dial/open/send → dead peer = ORDINARY error, pump redials
24	- [peer-pump stall = deferred B-half](peer-pump-stall-bhalf-confirmed.md) — pump STALL = broker-side unbounded QUIC op to DEAD roster peer. Interim=restart daemon; real fix=broker-side QUIC bound

... [57 lines truncated] ...


Acked. Now implement. **FIX #1** — rewrite g2's post-fault block to bounded-retry-until-spool. Read the current block:


1299	    // After the binary faulted, a SUBSEQUENT inbound delivery has NO working
1300	    // translation binary → it SPOOLS: the broker acks delivered=false and writes
1301	    // NOTHING to the PTY (ADR-0022 amendment — raw inject was REMOVED as a delivery
1302	    // path; a faulted binary no longer degrades to a raw `payload+\r` pseudo-write
1303	    // that does not submit on a modern TUI). The marker must therefore NOT appear on
1304	    // the ring. The envelope ends in `\r` only to match the old shape; nothing is
1305	    // written so the echo child never sees it.
1306	    let raw_envelope = b"<EVENT>SPOOL_NOT_INJECTED_MARKER</EVENT>\r";
1307	    let delivered2 = deliver_endpoint_event(&name, endpoint, raw_envelope, Duration::from_secs(5));
1308	    let marker_reached_pty =
1309	        output_contains_within(&name, sid, b"SPOOL_NOT_INJECTED_MARKER", Duration::from_secs(3));
1310
1311	    if let Some(pid) = broker.session_pid(sid) {
1312	        kill_pid(pid);
1313	    }
1314
1315	    eprintln!(
1316	        "=== W2 G2 NO-COMMIT FAULT GATE: delivered={delivered} op_flushed={op_flushed} \
1317	         sessions_answered={sessions_answered} delivered2={delivered2} \
1318	         marker_reached_pty={marker_reached_pty} \
1319	         (op_flushed=true → controller input never wedged; delivered2=false + \
1320	         !marker_reached_pty → faulted binary spools, never raw-injects) ==="
1321	    );
1322
1323	    // [int->REQ-MSG-IDLE-TRANSLATION-BINARY]
1324	    // [int->REQ-HAZARD-IDLE-SILENT-NONDELIVERY]
1325	    assert!(delivered, "the no-commit event must still be accepted by the broker");
1326	    assert!(
1327	        op_flushed,
1328	        "after the commit deadline the floor must RELEASE and buffered operator \
1329	         keystrokes must flush to the PTY — the controller's input must NOT wedge \
1330	         (the mandatory bounded-buffer guard; doyle non-negotiable = never park forever)"
1331	    );
1332	    assert!(
1333	        sessions_answered,
1334	        "the session must stay serviceable after the binary faults"
1335	    );
1336	    assert!(
1337	        !delivered2,
1338	        "after the FAULT a subsequent inbound delivery must SPOOL (delivered=false), \
1339	         not raw-inject — idle delivery is translation-binary-only (ADR-0022 amendment)"
1340	    );
1341	    assert!(
1342	        !marker_reached_pty,
1343	        "a faulted binary no longer raw-injects: the raw `<EVENT>` envelope must NOT \
1344	         land on the PTY (it spools, poll-fed, never a non-submitting PTY pseudo-write)"

    // After the binary faulted, a SUBSEQUENT inbound delivery has NO working
    // translation binary → it SPOOLS: the broker acks delivered=false and writes
    // NOTHING to the PTY (ADR-0022 amendment — raw inject was REMOVED as a delivery
    // path; a faulted binary no longer degrades to a raw `payload+\r` pseudo-write
    // that does not submit on a modern TUI). The marker must therefore NOT appear on
    // the ring. The envelope ends in `\r` only to match the old shape; nothing is
    // written so the echo child never sees it.
    let raw_envelope = b"<EVENT>SPOOL_NOT_INJECTED_MARKER</EVENT>\r";
    let delivered2 = deliver_endpoint_event(&name, endpoint, raw_envelope, Duration::from_secs(5));
    let marker_reached_pty =
        output_contains_within(&name, sid, b"SPOOL_NOT_INJECTED_MARKER", Duration::from_secs(3));

    if let Some(pid) = broker.session_pid(sid) {
        kill_pid(pid);
    }

    eprintln!(
        "=== W2 G2 NO-COMMIT FAULT GATE: delivered={delivered} op_flushed={op_flushed} \
         sessions_answered={sessions_answered} delivered2={delivered2} \
         marker_reached_pty={marker_reached_pty} \
         (op_flushed=true → controller input never wedged; delivered2=false + \
         !marker_reached_pty → faulted binary spools, never raw-injects) ==="
    );

    // [int->REQ-MSG-IDLE-TRANSLATION-BINARY]
    // [int->REQ-HAZARD-IDLE-SILENT-NONDELIVERY]
    assert!(delivered, "the no-commit event must still be accepted by the broker");
    assert!(
        op_flushed,
        "after the commit deadline the floor must RELEASE and buffered operator \
         keystrokes must flush to the PTY — the controller's input must NOT wedge \
         (the mandatory bounded-buffer guard; doyle non-negotiable = never park forever)"
    );
    assert!(
        sessions_answered,
        "the session must stay serviceable after the binary faults"
    );
    assert!(
        !delivered2,
        "after the FAULT a subsequent inbound delivery must SPOOL (delivered=false), \
         not raw-inject — idle delivery is translation-binary-only (ADR-0022 amendment)"
    );
    assert!(
        !marker_reached_pty,
        "a faulted binary no longer raw-injects: the raw `<EVENT>` envelope must NOT \
         land on the PTY (it spools, poll-fed, never a non-submitting PTY pseudo-write)"


1344	         land on the PTY (it spools, poll-fed, never a non-submitting PTY pseudo-write)"
1345	    );
1346	}
1347
1348	#[test]

         land on the PTY (it spools, poll-fed, never a non-submitting PTY pseudo-write)"
    );
}

#[test]


Rewrite g2's post-fault block — bounded-retry-until-spool (monotonic `faulted` converges), assert eventual spool + marker never on PTY across all attempts: