# Commune — M11-W5 complete bar the rig leg + doyle's gate stamp

Branch m11-shell-substrate, HEAD 24e2409, PR #16. W5 built + pushed.

## W4 CLOSED (doyle PASS @63a5d3e). See [[m11-w4-progress]].

## W5: T5.1 + T5.2 DONE, pushed. Pre-flight all green.
- T5.2 (0674894): how-to subnet topic + v1-lock bump · ADR-0020 tunnel exemption ·
  four-channels/gates/owner-agnostic docs · manifest fields.
- T5.1 (24e2409): gateway-owner cross-node cmd+drive [twohost] rung ([int->REQ-SHELL-5])
  · cross-node TUNNEL rung DEFERRED (doyle ruling — wire doesn't exist; DEFERRED.md
  entry; REQ-SHELL-4 int stays same-node) · docs overclaim corrected.

## T5.3 GATE (doyle stamps when BOTH land):
(a) normal CI GREEN — DONE ✅ run 27601257276 (test+n1-gate both runners + traceability).
(b) [twohost] rig GREEN — PENDING doyle's GO.

## RIG-FIRE MECHANISM (corrected, important):
[twohost] jobs gate on `head_commit.message` = NULL on pull_request → they DON'T fire
on PR #16 (confirmed: 27601257276 twohost-a/b skipped). Doyle's "nudge on PR #16"
WON'T work. They fire only on PUSH to a push-trigger branch (main/dev-freeform); past
run 7278c95 proves dev-freeform. PROPOSED to doyle (awaiting his GO — shared branch +
live-box rig run he coordinates w/ operator):
  git push origin m11-shell-substrate:dev-freeform
- clean fast-forward (dev-freeform stale 169-behind-main, ancestor of HEAD).
- 24e2409 subject contains "[twohost]" → fires twohost-a (Win role a) + twohost-b
  (Linux role b). Gateway rung + W2 drive-drop rung are INLINE in two_host_ladder_*
  = can't be filtered/skipped.
- no machine-wide reaping (live agents share the boxes; CI-scoped only).

## NEXT: doyle GO → push to dev-freeform → watch twohost-a/b green → send doyle both
run URLs → doyle stamps W5 GATE PASS → M11 milestone release (version bump after W5).
If a rung fails on the rig, fix loud (real cross-node bug) — but cmd/drive cross-node
wire is already proven (rung-10 + W2-drive), so a gateway-rung failure would be a
genuine type-leak to fix, not papered.

## Pre-flight: clippy --workspace --all-targets -D warnings + traceable EXIT0 + xtask
check; CLI add → xtask gen; docs → no milestone codes + xtask site.


## W5 complete bar the rig leg + doyle's stamp

**Gate input (a) GREEN** — normal CI 27601257276 success both runners (test + n1-gate + traceability).

**Gate input (b)** — `[twohost]` rig leg pending doyle's go. Corrected the fire mechanism: it can't run on PR #16 (jobs gate on `head_commit.message`, null on `pull_request` — confirmed skipped). Proposed the clean fast-forward `git push origin m11-shell-substrate:dev-freeform` (24e2409 carries `[twohost]`; both rungs inline → can't skip). Awaiting doyle's go since it advances a shared branch + consumes the live-agent rig boxes (he coordinates with operator).

Everything else landed: T5.1 + T5.2 built, pushed, pre-flight all green, DEFERRED entry + docs-overclaim fix done. Commune refreshed for clean resume.

Holding for doyle's go on the rig fire — his reply will arrive on my listener.


<task-notification>
<task-id>be1did0ug</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/2" id="d4b2c16c" type="msg" from="todlando">GO — operator green-lit the rig fire. Push it:
  git push origin m11-shell-substrate:dev-freeform
Clean fast-forward, no nudge commit (24e2409 subject carries [twohost] → twohost-a/b fire; both rungs inline = can't skip). m11-shell-substrate HEAD stays untouched at 24e2409.

Gate input (a) confirmed G</EVENT-PART>
<EVENT-PART seq="2/2" id="d4b2c16c">REEN (27601257276, both runners). After the push, send me the rig run URL. I stamp T5.3 GATE PASS the moment twohost-a (Win/hfenduleam) + twohost-b (Linux/kitsubito) go green with the gateway-owner rung + W2 drive-drop rung FIRED. No machine-wide reaping — CI-scoped only.</EVENT-PART></event>
</task-notification>


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


doyle + operator GO. Push to dev-freeform (clean FF, fires the rig).


Bash

cd /c/Users/decid/Documents/projects/spt-core
git push origin m11-shell-substrate:dev-freeform 2>&1 | tail -4
echo "=== confirm dev-freeform now at 24e2409 ==="; git ls-remote origin dev-freeform

Fast-forward dev-freeform to fire the rig


To https://github.com/SaberMage/spt-core.git
   0c95435..24e2409  m11-shell-substrate -> dev-freeform
=== confirm dev-freeform now at 24e2409 ===
24e2409de14b0439f608f10426f2d79b64c5e50a	refs/heads/dev-freeform


dev-freeform fast-forwarded (0c95435..24e2409). Find the firing run + confirm twohost jobs present.


sleep 10
echo "=== dev-freeform push run ==="
gh run list --branch dev-freeform --limit 2 --json databaseId,event,status,headSha,createdAt --jq '.[] | "\(.databaseId) \(.event) \(.status) \(.headSha[0:7])"' 2>&1
echo "=== its jobs (twohost present?) ==="
rid=$(gh run list --branch dev-freeform --limit 1 --json databaseId --jq '.[0].databaseId' 2>/dev/null)
echo "run=$rid"
gh run view $rid --json jobs --jq '.jobs[] | "\(.name): \(.status)/\(.conclusion)"' 2>&1

Find dev-freeform run + twohost jobs


=== dev-freeform push run ===
27604406083 push queued 24e2409
27247580888 push completed 0c95435
=== its jobs (twohost present?) ===
run=27604406083
test (self-hosted, Windows, hfenduleam): queued/
n1-gate (self-hosted, Windows, hfenduleam): in_progress/
traceability: completed/success
test (self-hosted, Linux, kitsubito): queued/
n1-gate (self-hosted, Linux, kitsubito): in_progress/


Run **27604406083** firing on dev-freeform (push, 24e2409, `[twohost]`). twohost-a/b have `needs: test` — they start after test passes. Send doyle the URL + arm a watcher.


$OWL send doyle todlando <<'EOF'
RIG FIRED. Pushed dev-freeform 0c95435..24e2409 (clean FF, m11-shell-substrate HEAD untouched at 24e2409).
Run: https://github.com/SaberMage/spt-core/actions/runs/27604406083  (push, dev-freeform, 24e2409, [twohost])
Jobs up: test + n1-gate + traceability (traceability already green). twohost-a (Win/hfenduleam role a) + twohost-b (Linux/kitsubito role b) have `needs: test` → they release after test passes. WAIT_SECS=900/rung.
Watcher armed; I send you the twohost-a/b conclusions the moment they finish. CI-scoped only, no machine-wide reaping.
EOF
echo "rc=$?"

Send doyle rig run URL


➜ SENT:doyle
rc=0


rid=27604406083
for i in $(seq 1 140); do
  done=$(gh run view $rid --json status --jq '.status' 2>/dev/null)
  if [ "$done" = "completed" ]; then
    echo "RUN DONE"
    gh run view $rid --json jobs --jq '.jobs[] | "\(.name): \(.conclusion)"' 2>&1
    exit 0
  fi
  # surface twohost job state as it appears
  th=$(gh run view $rid --json jobs --jq '.jobs[] | select(.name|startswith("twohost")) | "\(.name)=\(.status)/\(.conclusion)"' 2>/dev/null | tr '\n' ' ')
  echo "poll $i: status=$done twohost:[$th]"
  sleep 30
done
echo "TIMEOUT"

Watch dev-freeform rig run until complete


Command running in background with ID: bbz4sok42. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\bbz4sok42.output. You will be notified when it completes. To check interim output, use Read on that file path.


Rig fired — run **27604406083** on dev-freeform. doyle has the URL. Watcher `bbz4sok42` tracking until twohost-a (Win) + twohost-b (Linux) complete.

## State
- **Gate (a)** ✅ normal CI green.
- **Gate (b)** in flight — rig run 27604406083: test/n1-gate/traceability up (traceability green); twohost-a/b release after `test` passes (`needs: test`, WAIT_SECS=900/rung). The gateway-owner rung + W2 drive-drop rung are inline in the ladder → both fire.

On twohost green → send doyle the conclusions → he stamps **T5.3 GATE PASS** → M11 milestone release (version bump). If a rung fails it's a genuine cross-node finding (cmd/drive wire already proven, so a gateway-rung failure = real type-leak to fix loud, not paper over).

Holding for the rig run.


<task-notification>
<task-id>bbz4sok42</task-id>
<tool-use-id>toolu_01A1MmEAz5PZVPwZ1UMMJ8UM</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\bbz4sok42.output</output-file>
<status>completed</status>
<summary>Background command "Watch dev-freeform rig run until complete" completed (exit code 0)</summary>
</task-notification>


Rig watcher done. Read result.


tail -8 "C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\bbz4sok42.output"
echo "=== run 27604406083 final ==="
gh run view 27604406083 --json status,conclusion --jq '"\(.status) \(.conclusion)"' 2>&1
gh run view 27604406083 --json jobs --jq '.jobs[] | "\(.name): \(.conclusion)"' 2>&1

Rig run conclusion + per-job


RUN DONE
test (self-hosted, Windows, hfenduleam): success
n1-gate (self-hosted, Windows, hfenduleam): success
traceability: success
test (self-hosted, Linux, kitsubito): success
n1-gate (self-hosted, Linux, kitsubito): success
twohost-b: failure
twohost-a: failure
=== run 27604406083 final ===
completed failure
test (self-hosted, Windows, hfenduleam): success
n1-gate (self-hosted, Windows, hfenduleam): success
traceability: success
test (self-hosted, Linux, kitsubito): success
n1-gate (self-hosted, Linux, kitsubito): success
twohost-b: failure
twohost-a: failure


Both twohost jobs **failed** (test/n1-gate/traceability green). Must read the actual failure — could be my gateway rung (real bug), an earlier ladder rung, a pairing/connectivity failure, or a known rig flake. Get the logs.


echo "=== twohost-a (role a, Win) failed step log tail ==="
gh run view 27604406083 --log-failed --job=$(gh run view 27604406083 --json jobs --jq '.jobs[] | select(.name=="twohost-a") | .databaseId' 2>/dev/null) 2>&1 | grep -iE "TWOHOST|panic|assert|FAILED|error|never converged|TWOHOST OK|gateway" | tail -40

twohost-a failure log


=== twohost-a (role a, Win) failed step log tail ===
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:46.4668535Z    Compiling spt-net v0.7.3 (C:\actions-runner\_work\spt-core\spt-core\crates\spt-net)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:47.7833932Z    Compiling spt-daemon v0.7.3 (C:\actions-runner\_work\spt-core\spt-core\crates\spt-daemon)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9392247Z     Finished `test` profile [unoptimized + debuginfo] target(s) in 41.01s
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9643535Z      Running tests\twohost.rs (target\debug\deps\twohost-9f39f099c9408f92.exe)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9942537Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9942767Z running 2 tests
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9945284Z test two_host_ladder_role_b ... ok
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:58.9955372Z TWOHOST role A: node bcead52b862344aef51998ca5d8f15dce1e38e6cee3795b219a5849f6ad4b41a
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:59.1441934Z TWOHOST OK: pairing (initiator, product surface) — joined subnet 'twohost'
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:59.6684663Z PUMP_IPC_READER: spawned
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:59.9187034Z TWOHOST OK: register: B's perch row replicated to A
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:59.9452082Z TWOHOST OK: message sent (B asserts the spool)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:33:59.9647388Z TWOHOST OK: file fetch (sid 1)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.0236851Z TWOHOST OK: remote-drive (attach echo)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.0568533Z TWOHOST OK: sync: A pulled B's mind
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.0723521Z PAIR_MEET_UP:twohost step=59386628 id=9c86872a2182b1e80eb3d32a4437d4d4eca81510b0a9ec054332d982154d638c addr=EndpointAddr { id: PublicKey(9c86872a2182b1e80eb3d32a4437d4d4eca81510b0a9ec054332d982154d638c), addrs: {Ip(100.68.35.65:62704), Ip(192.168.1.81:62704)} }
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.4441305Z UPDATE_STAGED:6:BrainOnly (from 9bbcee970607c7454b0baf8b38b032ccdf1a36de7ef04d614158fecd1f08b612)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.5578215Z TWOHOST OK: update: B's v6 staged at A through the verify gate
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.5579283Z TWOHOST OK: update: consent notif surfaced at A
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.5579637Z TWOHOST OK: notif: B's dismissal replicated to A
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:00.8677875Z TWOHOST OK: rest: B's row advertises Suspended at A
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:01.1723901Z TWOHOST OK: rest: B's row advertises Active again at A (with a presence stamp)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:01.1724225Z TWOHOST OK: remote suspend/wake round trip
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.6781363Z TWOHOST OK: presence: B's surface marks replicated back to A
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.7580291Z TWOHOST OK: cross-node shell relink + drive (B asserts the render)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8067638Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8068042Z thread 'two_host_ladder_role_a' (132332) panicked at crates\spt-daemon\tests\twohost.rs:1249:60:
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8068533Z cross-node drive of an offline persistent shell DROPS, never wakes: drove notify-0 type=stick (live slot, latest-wins)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8069799Z note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240079Z test two_host_ladder_role_a ... FAILED
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240236Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240291Z failures:
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240385Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240462Z failures:
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240620Z     two_host_ladder_role_a
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240733Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8240992Z test result: FAILED. 1 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.83s
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8241210Z
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8343955Z error: test failed, to rerun pass `-p spt-daemon --test twohost`
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T08:34:02.8970780Z ##[error]Process completed with exit code 1.


**Key finding — it's NOT my gateway rung.** The failure is the **pre-existing W2 drive-drop rung** (notify-0): on the real rig, `SPT_TWO_HOST_NOTIFY_BIN` is set so the notify binary is **resident → notify-0 ONLINE** → the cross-node drive **delivers to the live slot** instead of dropping. The rung's "shell is offline" assumption holds only in fallback (noop) mode. Production drive logic is correct (online→deliver, offline→drop) — it's a test-harness assumption bug. My gateway rung never ran (panic was earlier). Confirm role-B failed consequentially (waiting on A's done-file).


echo "=== twohost-b failure tail ==="
gh run view 27604406083 --log-failed --job=$(gh run view 27604406083 --json jobs --jq '.jobs[] | select(.name=="twohost-b") | .databaseId' 2>/dev/null) 2>&1 | grep -iE "TWOHOST|panic|assert|never converged|done-file|FAILED|gateway" | tail -15

twohost-b failure cause


=== twohost-b failure tail ===
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1835300Z
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1836021Z thread 'two_host_ladder_role_b' (406064) panicked at crates/spt-daemon/tests/twohost.rs:267:5:
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1836742Z never converged on the rig: gateway: A's cross-node cmd spooled under the gateway-typed owner at B
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1837324Z note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1881679Z test two_host_ladder_role_b ... FAILED
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882020Z
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882174Z failures:
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882330Z
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882427Z failures:
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882679Z     two_host_ladder_role_b
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1882846Z
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1883198Z test result: FAILED. 1 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 933.39s
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1883691Z
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.1921570Z error: test failed, to rerun pass `-p spt-daemon --test twohost`
twohost-b	Two-host ladder — role B (seed-holder/server)	2026-06-16T08:49:03.2041591Z ##[error]Process completed with exit code 101.


Both failures trace to **one root cause**: role A panicked at the **W2 drive-drop rung** (notify-0 ONLINE in real-rig mode → drive delivered, not dropped), which aborted A before my gateway rung ran — so role B timed out (933s) waiting on the gateway cmd that A never sent. **My gateway rung is unproven** (never executed); the W2 rung has a real harness-assumption bug. Surface to doyle with the precise diagnosis + proposed fix.


$OWL send doyle todlando <<'EOF'
RIG RED — ONE root cause, surfaced loud (not papered). Run 27604406083: test/n1-gate/traceability green BOTH runners; twohost-a + twohost-b RED.

ROOT CAUSE = your W2 drive-drop rung, NOT my gateway rung:
- role A panic @twohost.rs:1249 (the W2 rung): "cross-node drive of an offline persistent shell DROPS, never wakes: drove notify-0 type=stick (live slot, latest-wins)". I.e. notify-0 was ONLINE → the cross-node drive DELIVERED to the live slot (latest-wins) instead of dropping.
- WHY: on the REAL rig SPT_TWO_HOST_NOTIFY_BIN is set, so the notify-shell binary is RESIDENT → notify-0 ONLINE. The W2 rung's comment assumes "the echo-mode binary exited without binding" = FALLBACK (noop) mode where notify-0 is offline. W5 is the FIRST real-rig fire of this rung (it was [twohost]-gated, never run before) — so the assumption only now gets tested, and it's false in real mode.
- This is a TEST-HARNESS assumption bug, NOT a production bug: drive logic is correct (online→deliver-live-slot, offline→drop). The rung just drove an ONLINE shell while asserting offline-drop.
- CONSEQUENCE: A panicked at the W2 rung BEFORE reaching my gateway rung → A never sent the gateway cmd → role B timed out 900s on "gateway: A's cross-node cmd spooled" (@:267). So twohost-b RED is consequential; MY GATEWAY RUNG IS UNPROVEN (never executed).

PROPOSED FIX (test-only): the drop-not-wake proof needs a DETERMINISTICALLY-offline shell, not the mode-dependent resident notify-0. Add an offline noop persistent shell ("offdrive": noop spawn, persistent, [shell.drive].stick + a press cap) minted at B under BOTH ID_B (for the W2 agent-owner drive-drop) and GW_OWNER (for my gateway rung's cmd+drive). Retarget the W2 drive rung at ID_B/offdrive (offline → drops); my gateway rung targets GW_OWNER/offdrive. gwshell folds into offdrive. notify-0 stays the M5 rungs' resident shell. Deterministic regardless of real/fallback notify mode.

This honors your "W2 must fire green" intent correctly (real offline shell) + finally exercises my gateway rung. I can implement now; it's a clean test fix. Bless the approach (or prefer assert-deliver-for-online + a separate offline shell?), and I'll implement + line up the next rig fire with operator. Holding for your call.
EOF
echo "rc=$?"

Surface rig root cause + proposed fix to doyle


Diagnosis + fix proposal sent. Blocked on doyle's call. Persist the reusable rig finding to memory + refresh commune while waiting.


Write

---
name: twohost-rig-real-notify-mode
description: The [twohost] rig runs the notify shell in REAL mode (resident → notify-0 ONLINE) — a drive-drop rung asserting offline against notify-0 fails on the rig
metadata:
  type: project
---

The `[twohost]` CI rig (twohost-a/twohost-b in ci.yml) sets
`SPT_TWO_HOST_NOTIFY_BIN`, so `seed_notify_shell` runs in **real mode**: the
notify-shell binary is **resident** and BINDS → `notify-0` is **ONLINE** on the
rig. In **fallback** mode (no NOTIFY_BIN, local dev) the spawn is a noop that
never binds → `notify-0` OFFLINE. So a rung's behavior against notify-0 DIVERGES
by mode.

This bit M11-W5 (run 27604406083): the W2 cross-node drive **drop-not-wake** rung
(landed at W2, `[twohost]`-gated so NEVER run on the rig until W5's first fire)
drove `notify-0` asserting `dropped`+`offline` — but on the real rig notify-0 is
ONLINE, so the drive **delivered to the live slot (latest-wins)** and the assert
panicked: "drove notify-0 type=stick (live slot, latest-wins)". Production drive
logic is correct (online→deliver, offline→drop); the rung's "offline" assumption
was a fallback-mode artifact. Role A panicking there also aborted it before the
gateway rung → role B timed out (consequential).

**Rule:** for a drive-DROP / offline-shell proof on the rig, use a
**deterministically-offline noop shell** (own adapter, noop spawn, never binds) —
NOT the mode-dependent resident notify shell. Anything asserting offline behavior
against notify-0 will be wrong on the real rig.

**Lesson:** a `[twohost]`-gated rung that has never actually fired on the rig is
UNPROVEN regardless of how green normal CI is — its assumptions meet reality only
on the first real fire. Fire `[twohost]`-gated rungs before trusting them.
Related: [[m11-w4-progress]], [[no-machinewide-killon-shared-runner]].


File created successfully at: C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\twohost-rig-real-notify-mode.md (file state is current in your context — no need to Read it back)

---
name: twohost-rig-real-notify-mode
description: "The [twohost] rig runs the notify shell in REAL mode (resident → notify-0 ONLINE) — a drive-drop rung asserting offline against notify-0 fails on the rig"
metadata:
  node_type: memory
  type: project
  originSessionId: 5b0a69e3-d6a3-47f7-8152-ee14e5b4ff5c
---

The `[twohost]` CI rig (twohost-a/twohost-b in ci.yml) sets
`SPT_TWO_HOST_NOTIFY_BIN`, so `seed_notify_shell` runs in **real mode**: the
notify-shell binary is **resident** and BINDS → `notify-0` is **ONLINE** on the
rig. In **fallback** mode (no NOTIFY_BIN, local dev) the spawn is a noop that
never binds → `notify-0` OFFLINE. So a rung's behavior against notify-0 DIVERGES
by mode.

This bit M11-W5 (run 27604406083): the W2 cross-node drive **drop-not-wake** rung
(landed at W2, `[twohost]`-gated so NEVER run on the rig until W5's first fire)
drove `notify-0` asserting `dropped`+`offline` — but on the real rig notify-0 is
ONLINE, so the drive **delivered to the live slot (latest-wins)** and the assert
panicked: "drove notify-0 type=stick (live slot, latest-wins)". Production drive
logic is correct (online→deliver, offline→drop); the rung's "offline" assumption
was a fallback-mode artifact. Role A panicking there also aborted it before the
gateway rung → role B timed out (consequential).

**Rule:** for a drive-DROP / offline-shell proof on the rig, use a
**deterministically-offline noop shell** (own adapter, noop spawn, never binds) —
NOT the mode-dependent resident notify shell. Anything asserting offline behavior
against notify-0 will be wrong on the real rig.

**Lesson:** a `[twohost]`-gated rung that has never actually fired on the rig is
UNPROVEN regardless of how green normal CI is — its assumptions meet reality only
on the first real fire. Fire `[twohost]`-gated rungs before trusting them.
Related: [[m11-w4-progress]], [[no-machinewide-killon-shared-runner]].


Bash

cd "/c/Users/decid/.ccs/instances/bigscreen/projects/C--Users-decid-Documents-projects-spt-core/memory"
# append pointer to MEMORY.md after the unmergeable-pr line
grep -q "twohost-rig-real-notify-mode" MEMORY.md || true
echo "pointer-check done"

Check MEMORY.md pointer


pointer-check done
Shell cwd was reset to C:\Users\decid\Documents\projects\spt-core


Edit

- [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md) —

- [twohost rig runs notify REAL mode](twohost-rig-real-notify-mode.md) — the [twohost] rig sets SPT_TWO_HOST_NOTIFY_BIN → notify-shell resident → notify-0 ONLINE (fallback/local = noop offline). M11-W5 first-fire: the W2 drive-DROP rung asserted offline against notify-0 → it was ONLINE → drive DELIVERED (live slot) not dropped → RED. Use a deterministically-offline noop shell for drop proofs. A [twohost]-gated rung never fired = UNPROVEN regardless of green normal CI
- [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md) —


The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\MEMORY.md has been updated successfully. (file state is current in your context — no need to Read it back)

- [twohost rig runs notify REAL mode](twohost-rig-real-notify-mode.md) — the [twohost] rig sets SPT_TWO_HOST_NOTIFY_BIN → notify-shell resident → notify-0 ONLINE (fallback/local = noop offline). M11-W5 first-fire: the W2 drive-DROP rung asserted offline against notify-0 → it was ONLINE → drive DELIVERED (live slot) not dropped → RED. Use a deterministically-offline noop shell for drop proofs. A [twohost]-gated rung never fired = UNPROVEN regardless of green normal CI
- [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md) —

- [adapter tips → published docs](adapter-tips-published-docs.md) — synthesized perri's SPT_HARNESS_ADAPTER_TIPS.md into a NEW harness-agnostic docs-site page harness-contract/patterns.md ("Adapter patterns & pitfalls"); generalized all [CC] specifics, zero leakage; published live to GH-Pages via `gh workflow run docs-publish.yml --ref main` (fires on tags/dispatch only, NOT main push). Pre-flight: xtask check + xtask site

- [how-to subnet → W5 scope](howto-subnet-w5-scope.md) — perri found `spt how-to subnet` dead-ends (NO_SUCH_TOPIC); HOW_TO_TOPICS locked to ready/send (v1, M7 decision 12). Genuine REQ-DOCS-6 content gap. doyle ACCEPTED → scheduled M11-W5 docs wave (HOW_TO_SUBNET text + registry + bump v1-lock test). Confirm landed at W5 gate

- [M11-W4 progress](m11-w4-progress.md) — Gateway-owner shell capstone (REQ-SHELL-5, proof-not-change, ZERO prod diff): built (int gateway_owner_shell_e2e + linkhost unit, same-type-diff-id negative), doyle code-read PASS + tree-identity = PRE-CLEARED, only CI green left. CI saga: branch unmergeable vs advanced main → 0 pull_request runs → merged main in (HEAD 63a5d3e, v0.7.3). Supersedes W3

+- [twohost rig runs notify REAL mode](twohost-rig-real-notify-mode.md) — the [twohost] rig sets SPT_TWO_HOST_NOTIFY_BIN → notify-shell resident → notify-0 ONLINE (fallback/local = noop offline). M11-W5 first-fire: the W2 drive-DROP rung asserted offline against notify-0 → it was ONLINE → drive DELIVERED (live slot) not dropped → RED. Use a deterministically-offline noop shell for drop proofs. A [twohost]-gated rung never fired = UNPROVEN regardless of green normal CI

- [unmergeable PR blocks CI](unmergeable-pr-blocks-ci.md) — push yields NO pull_request run + 0 checks + runners idle = UNMERGEABLE PR (GitHub can't compute merge ref), NOT a webhook drop. Diagnose: `gh pr view --json mergeable` + `git rev-list --count HEAD..origin/main`. Fix: merge main in (union append-docs, regen derived). Empty-commit/reopen nudges DON'T fix it. Check mergeability FIRST

- [M11-W3 progress](m11-w3-progress.md) — shell TUNNEL (REQ-SHELL-4): doyle design-gate GO; manifest opt-in + broker TunnelHub registry + close-hook LANDED on branch; NEXT = open-hook + the QUIC-stream↔`api tunnel` bridge (dispatch first-record demux + serve_tunnel relay loop), then T3.3 same-node mock E2E. Full next-step detail in the file

- [M11-W2 progress](m11-w2-progress.md) — drive channel (REQ-SHELL-3): ALL 4 tasks DONE + PUSHED to PR #16 (T2.1 b919dfd / T2.2 0557bc6 / T2.3 d200524 / T2.4 13fa53e + drift-fix 9d5fb63). REQ-SHELL-3 activated [impl,unit,int]. CI re-running post-drift-fix (run 27590716942); on green → submit W2 to doyle. Full detail in Psyche commune


Refresh commune with the rig-RED diagnosis + pending fix, then hold for doyle's call.


Write

# Commune — M11-W5 rig RED (W2 rung harness bug), fix proposed, awaiting doyle

Branch m11-shell-substrate HEAD 24e2409, PR #16. dev-freeform = 24e2409 (rig branch).

## W4 CLOSED. W5: code built + pushed; normal CI GREEN (27601257276). Rig RED.

## RIG RESULT (run 27604406083, dev-freeform [twohost]):
test/n1-gate/traceability GREEN both runners. twohost-a + twohost-b RED — ONE root cause:
- role A panic @twohost.rs:1249 = the **W2 drive-drop rung** (NOT my gateway rung):
  "drove notify-0 type=stick (live slot, latest-wins)" → notify-0 was ONLINE → drive
  DELIVERED not dropped. WHY: rig sets SPT_TWO_HOST_NOTIFY_BIN → notify-shell RESIDENT
  → notify-0 ONLINE. W2 rung assumed FALLBACK noop (offline). W5 = first real-rig fire
  of that [twohost]-gated rung → assumption meets reality, false. TEST-harness bug,
  production drive logic correct. See [[twohost-rig-real-notify-mode]].
- role B RED = consequential: A aborted before the gateway rung → never sent gateway
  cmd → B timed out 900s @:267 ("gateway: A's cross-node cmd spooled").
- MY GATEWAY RUNG UNPROVEN (never executed).

## PROPOSED FIX (sent doyle, awaiting nod): add an offline noop persistent "offdrive"
shell (noop spawn, persistent, [shell.drive].stick + press cap) minted at B under BOTH
ID_B (W2 agent-owner drive-drop) and GW_OWNER (gateway rung cmd+drive). Retarget the
W2 drive rung → ID_B/offdrive (deterministically offline → drops); gateway rung →
GW_OWNER/offdrive; gwshell folds into offdrive; B gateway assert perch → offdrive-0.
notify-0 stays the M5 rungs' resident shell. Honors "W2 must fire green" correctly +
finally exercises the gateway rung. Test-only.

## NEXT: doyle blesses fix approach → implement (test-only, twohost.rs) → preflight
(compiles + no-op runs) → push to m11-shell-substrate (normal CI) + FF dev-freeform
(re-fire rig, operator-coordinated) → twohost-a/b green → doyle stamps W5 GATE PASS →
M11 release. Each rig fire = live boxes, operator-coordinated, no machine-wide reaping.

## Pre-flight: clippy --workspace --all-targets -D warnings + traceable EXIT0 + xtask check.


<owl_messages>
<owl_message from="todlando" priority="high">BLESS option (A) — the deterministically-offline "offdrive" shell. Excellent real-rig catch; the bug is MINE (the W2 rung's "echo binary exited without binding = offline" assumption only holds in fallback noop mode, false when SPT_TWO_HOST_NOTIFY_BIN makes notify-0 resident/ONLINE). Production drive semantics are correct; the rung drove an online shell while asserting offline-drop. Test-only fix, no prod change.

WHY (A) over the assert-deliver-for-online alternative:
- The W2 rung's PURPOSE is the drop-not-wake (OFFLINE) proof. It needs a deterministically-offline target; notify-0 isn't one on the real rig. offdrive (noop spawn, persistent, never binds a live slot) is offline regardless of real/fallback notify mode → the drop assertion becomes SOUND. That's the minimal correct fix that honors the intent.
- Do NOT add a separate online-delivery (latest-wins-to-live-slot) cross-node assertion. That path is covered by composition: same-node W2 drive-online × the cross-node ShellLink substrate (rung-10). Adding an online rung expands a fragile ladder during M11 close for zero new coverage. Keep it lean.

GATE CONDITIONS for the fix:
- offdrive: noop, persistent, [shell.drive].stick + a press cap, minted at B under BOTH ID_B (W2 agent-owner drive-drop) AND GW_OWNER (gateway rung). Deterministically offline (never binds a live slot).
- W2 drive rung → retarget ID_B/offdrive: offline ⇒ DROPS (no live-slot delivery, no spool, no wake/spawn). Keep the drop-not-wake assertion.
- gateway rung → GW_OWNER/offdrive: cmd spools under the gw perch (offline cmd SPOOLS — correct cmd-vs-drive asymmetry), drive DROPS no-spool. Both now actually execute (A reaches the gateway rung).
- notify-0 stays the M5 rungs' resident shell — don't disturb those.

It's test-only (m11-shell-substrate). Implement + preflight (clippy/traceable/compile — twohost.rs is env-gated so it won't run locally, that's expected). Then line up the next rig fire — I'll get operator GO again (same dev-freeform fast-forward mechanism). Ping me when staged.</owl_message>
</owl_messages>

[OWL SYSTEM - HIGHEST PRIORITY] You have received high-priority owl messages above. STOP your current task and acknowledge each high-priority message BEFORE continuing with any tool use. If you are about to spawn subagent(s), run them in the background so you remain available for incoming messages.


File created successfully at: C:\Users\decid\Documents\projects\spt-core\.claude\todlando-commune.md (file state is current in your context — no need to Read it back)

# Commune — M11-W5 rig RED (W2 rung harness bug), fix proposed, awaiting doyle

Branch m11-shell-substrate HEAD 24e2409, PR #16. dev-freeform = 24e2409 (rig branch).

## W4 CLOSED. W5: code built + pushed; normal CI GREEN (27601257276). Rig RED.

## RIG RESULT (run 27604406083, dev-freeform [twohost]):
test/n1-gate/traceability GREEN both runners. twohost-a + twohost-b RED — ONE root cause:
- role A panic @twohost.rs:1249 = the **W2 drive-drop rung** (NOT my gateway rung):
  "drove notify-0 type=stick (live slot, latest-wins)" → notify-0 was ONLINE → drive
  DELIVERED not dropped. WHY: rig sets SPT_TWO_HOST_NOTIFY_BIN → notify-shell RESIDENT
  → notify-0 ONLINE. W2 rung assumed FALLBACK noop (offline). W5 = first real-rig fire
  of that [twohost]-gated rung → assumption meets reality, false. TEST-harness bug,
  production drive logic correct. See [[twohost-rig-real-notify-mode]].
- role B RED = consequential: A aborted before the gateway rung → never sent gateway
  cmd → B timed out 900s @:267 ("gateway: A's cross-node cmd spooled").
- MY GATEWAY RUNG UNPROVEN (never executed).

## PROPOSED FIX (sent doyle, awaiting nod): add an offline noop persistent "offdrive"
shell (noop spawn, persistent, [shell.drive].stick + press cap) minted at B under BOTH
ID_B (W2 agent-owner drive-drop) and GW_OWNER (gateway rung cmd+drive). Retarget the
W2 drive rung → ID_B/offdrive (deterministically offline → drops); gateway rung →
GW_OWNER/offdrive; gwshell folds into offdrive; B gateway assert perch → offdrive-0.
notify-0 stays the M5 rungs' resident shell. Honors "W2 must fire green" correctly +
finally exercises the gateway rung. Test-only.

## NEXT: doyle blesses fix approach → implement (test-only, twohost.rs) → preflight
(compiles + no-op runs) → push to m11-shell-substrate (normal CI) + FF dev-freeform
(re-fire rig, operator-coordinated) → twohost-a/b green → doyle stamps W5 GATE PASS →
M11 release. Each rig fire = live boxes, operator-coordinated, no machine-wide reaping.

## Pre-flight: clippy --workspace --all-targets -D warnings + traceable EXIT0 + xtask check.


doyle blessed option (A). Ack, then implement.


Bash

$OWL send doyle todlando <<'EOF'
ACK — option (A) offdrive, locked. No online-delivery rung (covered by composition). notify-0 untouched. Implementing now (test-only, twohost.rs): offdrive adapter (noop/persistent/[shell.drive].stick + press cap) minted under ID_B + GW_OWNER; W2 drive rung → ID_B/offdrive (drops); gateway rung → GW_OWNER/offdrive (cmd spools, drive drops). Preflight clippy/traceable/compile + no-op run, push m11-shell-substrate, ping you staged for the dev-freeform re-fire (you line up operator GO).
EOF
echo "rc=$?"

Ack doyle option A


➜ SENT:doyle
rc=0


Implement offdrive. Read the current helper + the W2/gateway rung sites (lines shifted from earlier edits).


Locate all edit sites


93:const DRIVE_MARKER: &str = "twohost-drive";
102:const GW_OWNER: &str = "gate-twohost-b";
103:const GW_ALIAS: &str = "Pad";
501:fn seed_gateway_shell() {
502:    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
504:    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
511:    let src = perch::spt_home().join("srcs").join("gwshell");
512:    std::fs::create_dir_all(&src).expect("gwshell src");
516:            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\
523:    .expect("write gwshell manifest");
525:        .expect("register gwshell");
527:        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))
529:    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");
584:    seed_gateway_shell();
755:    let shell_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), ID_B, "notify-0");
804:    let gw_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), GW_OWNER, "gwshell-0");
1194:        SHELL_ALIAS,
1214:        SHELL_ALIAS,
1241:        SHELL_ALIAS,
1242:        spt_net::net::shelllink::SHELL_LINK_DRIVE,
1243:        &["stick".to_string(), "x=0.7".to_string()],
1244:        "twohost-drive",
1268:        GW_OWNER,
1269:        GW_ALIAS,
1283:        GW_OWNER,
1284:        GW_ALIAS,
1298:        GW_OWNER,
1299:        GW_ALIAS,
1300:        spt_net::net::shelllink::SHELL_LINK_DRIVE,
1301:        &["stick".to_string(), "x=0.5".to_string()],


Read the W2 drive rung block (role A) to retarget precisely:


1228	    // ephemeral control channel of its persistent shell living at B. The shell
1229	    // is OFFLINE at B (the echo-mode binary exited without binding), so the
1230	    // cross-node drive DROPS — and crucially does NOT wake the persistent
1231	    // instance (the load-bearing divergence from cmd, which relaunches; D1). The
1232	    // reply is `ok` with the drop detail, and B's durable spool stays untouched
1233	    // (drive never spools — D3). The no-replay-across-relink token-stamp is a
1234	    // shell-LOCAL poll property (the same-node E2E + the drivehub unit), since a
1235	    // drive-poll always runs where the shell lives.
1236	    // [int->REQ-SHELL-3]
1237	    let out = spt_daemon::request_shell_link(
1238	        &mut a,
1239	        conn.conn_id,
1240	        ID_B,
1241	        SHELL_ALIAS,
1242	        spt_net::net::shelllink::SHELL_LINK_DRIVE,
1243	        &["stick".to_string(), "x=0.7".to_string()],
1244	        "twohost-drive",
1245	        op(),
1246	    )
1247	    .expect("cross-node drive round trip");
1248	    match &out {
1249	        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
1250	            detail.contains("dropped") && detail.contains("offline"),
1251	            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
1252	        ),
1253	        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
1254	    }
1255	    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");
1256
1257	    // ── M11-W5 rung — GATEWAY-OWNED cross-node shell (REQ-SHELL-5): the owner is

    // ephemeral control channel of its persistent shell living at B. The shell
    // is OFFLINE at B (the echo-mode binary exited without binding), so the
    // cross-node drive DROPS — and crucially does NOT wake the persistent
    // instance (the load-bearing divergence from cmd, which relaunches; D1). The
    // reply is `ok` with the drop detail, and B's durable spool stays untouched
    // (drive never spools — D3). The no-replay-across-relink token-stamp is a
    // shell-LOCAL poll property (the same-node E2E + the drivehub unit), since a
    // drive-poll always runs where the shell lives.
    // [int->REQ-SHELL-3]
    let out = spt_daemon::request_shell_link(
        &mut a,
        conn.conn_id,
        ID_B,
        SHELL_ALIAS,
        spt_net::net::shelllink::SHELL_LINK_DRIVE,
        &["stick".to_string(), "x=0.7".to_string()],
        "twohost-drive",
        op(),
    )
    .expect("cross-node drive round trip");
    match &out {
        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
            detail.contains("dropped") && detail.contains("offline"),
            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
        ),
        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
    }
    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");

    // ── M11-W5 rung — GATEWAY-OWNED cross-node shell (REQ-SHELL-5): the owner is


Make the edits. First the alias constant:


Edit

const GW_OWNER: &str = "gate-twohost-b";
const GW_ALIAS: &str = "Pad";

const GW_OWNER: &str = "gate-twohost-b";
const GW_ALIAS: &str = "Pad";
// The W2 cross-node drive drop-not-wake proof needs a DETERMINISTICALLY-offline
// shell: notify-0 is RESIDENT/ONLINE on the real rig (SPT_TWO_HOST_NOTIFY_BIN), so
// driving it delivers to the live slot, not drops. `offdrive` is a noop-spawn shell
// that never binds (offline in both real + fallback modes). Minted under ID_B (the
// agent-owner drive-drop) and GW_OWNER (the gateway rung).
const DRIVE_TGT_ALIAS: &str = "DriveTgt";


The file C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon\tests\twohost.rs has been updated successfully. (file state is current in your context — no need to Read it back)

const GW_OWNER: &str = "gate-twohost-b";
const GW_ALIAS: &str = "Pad";
// The W2 cross-node drive drop-not-wake proof needs a DETERMINISTICALLY-offline
// shell: notify-0 is RESIDENT/ONLINE on the real rig (SPT_TWO_HOST_NOTIFY_BIN), so
// driving it delivers to the live slot, not drops. `offdrive` is a noop-spawn shell
// that never binds (offline in both real + fallback modes). Minted under ID_B (the
// agent-owner drive-drop) and GW_OWNER (the gateway rung).
const DRIVE_TGT_ALIAS: &str = "DriveTgt";

// agnostic (REQ-SHELL-5): the owner travels as an opaque string over the link.

+// The W2 cross-node drive drop-not-wake proof needs a DETERMINISTICALLY-offline

+// shell: notify-0 is RESIDENT/ONLINE on the real rig (SPT_TWO_HOST_NOTIFY_BIN), so

+// driving it delivers to the live slot, not drops. `offdrive` is a noop-spawn shell

+// that never binds (offline in both real + fallback modes). Minted under ID_B (the

+// agent-owner drive-drop) and GW_OWNER (the gateway rung).

+const DRIVE_TGT_ALIAS: &str = "DriveTgt";

/// The rig's static configuration, fully determined by env (no runtime


Now read + replace the helper:


500
501	/// M11-W5: seed a **GATEWAY-typed** owner at B (`state="gateway"`, not an agent)
502	/// and mint its persistent shell — a noop-spawn instance that never binds, so it
503	/// stays offline (a cmd spools durably; a drive deterministically drops). One
504	/// `press` command verb + one `stick` drive type. Proves shell ownership is
505	/// owner-type-agnostic across a real link: A drives this gateway-owned shell
506	/// cross-node exactly as it drives an agent-owned one (REQ-SHELL-5).
507	fn seed_gateway_shell() {
508	    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
509	    std::fs::create_dir_all(&perch_path).expect("gateway owner perch");
510	    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
511	    info::write_info(&perch_path, &rec).expect("gateway info.json");
512
513	    #[cfg(windows)]
514	    let spawn = "cmd /C exit 0 {link_token} {id}";
515	    #[cfg(unix)]
516	    let spawn = "true {link_token} {id}";
517	    let src = perch::spt_home().join("srcs").join("gwshell");
518	    std::fs::create_dir_all(&src).expect("gwshell src");
519	    std::fs::write(
520	        src.join("manifest.toml"),
521	        format!(
522	            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\
523	             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
524	             broadcast = \"same-node\"\npersistent = true\n\n\
525	             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
526	             [shell.drive]\ntypes = [\"stick\"]\n"
527	        ),
528	    )
529	    .expect("write gwshell manifest");
530	    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
531	        .expect("register gwshell");
532	    let id =
533	        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))
534	            .expect("mint gateway-owned shell");
535	    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");
536	}
537
538	/// The deterministically-signed v6 release both sides agree on (B stages it,
539	/// A's pump pulls + verifies + stages it under the derived trusted key).
540	fn signed_release(rig: &Rig) -> SignedRelease {
541	    let meta = ReleaseMetadata {

/// M11-W5: seed a **GATEWAY-typed** owner at B (`state="gateway"`, not an agent)
/// and mint its persistent shell — a noop-spawn instance that never binds, so it
/// stays offline (a cmd spools durably; a drive deterministically drops). One
/// `press` command verb + one `stick` drive type. Proves shell ownership is
/// owner-type-agnostic across a real link: A drives this gateway-owned shell
/// cross-node exactly as it drives an agent-owned one (REQ-SHELL-5).
fn seed_gateway_shell() {
    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
    std::fs::create_dir_all(&perch_path).expect("gateway owner perch");
    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
    info::write_info(&perch_path, &rec).expect("gateway info.json");

    #[cfg(windows)]
    let spawn = "cmd /C exit 0 {link_token} {id}";
    #[cfg(unix)]
    let spawn = "true {link_token} {id}";
    let src = perch::spt_home().join("srcs").join("gwshell");
    std::fs::create_dir_all(&src).expect("gwshell src");
    std::fs::write(
        src.join("manifest.toml"),
        format!(
            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\
             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
             broadcast = \"same-node\"\npersistent = true\n\n\
             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
             [shell.drive]\ntypes = [\"stick\"]\n"
        ),
    )
    .expect("write gwshell manifest");
    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
        .expect("register gwshell");
    let id =
        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))
            .expect("mint gateway-owned shell");
    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");
}

/// The deterministically-signed v6 release both sides agree on (B stages it,
/// A's pump pulls + verifies + stages it under the derived trusted key).
fn signed_release(rig: &Rig) -> SignedRelease {
    let meta = ReleaseMetadata {


/// M11-W5: seed a **GATEWAY-typed** owner at B (`state="gateway"`, not an agent)
/// and mint its persistent shell — a noop-spawn instance that never binds, so it
/// stays offline (a cmd spools durably; a drive deterministically drops). One
/// `press` command verb + one `stick` drive type. Proves shell ownership is
/// owner-type-agnostic across a real link: A drives this gateway-owned shell
/// cross-node exactly as it drives an agent-owned one (REQ-SHELL-5).
fn seed_gateway_shell() {
    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
    std::fs::create_dir_all(&perch_path).expect("gateway owner perch");
    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
    info::write_info(&perch_path, &rec).expect("gateway info.json");

    #[cfg(windows)]
    let spawn = "cmd /C exit 0 {link_token} {id}";
    #[cfg(unix)]
    let spawn = "true {link_token} {id}";
    let src = perch::spt_home().join("srcs").join("gwshell");
    std::fs::create_dir_all(&src).expect("gwshell src");
    std::fs::write(
        src.join("manifest.toml"),
        format!(
            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\
             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
             broadcast = \"same-node\"\npersistent = true\n\n\
             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
             [shell.drive]\ntypes = [\"stick\"]\n"
        ),
    )
    .expect("write gwshell manifest");
    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
        .expect("register gwshell");
    let id =
        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))
            .expect("mint gateway-owned shell");
    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");
}

/// M11-W5: register a DETERMINISTICALLY-offline `offdrive` shell (a noop spawn
/// that never binds → no live slot, offline in BOTH real + fallback notify modes)
/// and mint it at B under two owners:
/// - **ID_B** (an agent owner) — the W2 cross-node drive **drop-not-wake** target
///   (notify-0 is resident/ONLINE on the real rig, so it can't prove the drop;
///   offdrive can).
/// - **GW_OWNER** (a `state="gateway"` owner, seeded here) — the gateway rung's
///   target: proves shell ownership is owner-type-agnostic across a real link
///   (REQ-SHELL-5) — A cmds + drives a gateway-owned shell exactly as an agent's.
///
/// One `press` command verb (cmd spools durably) + one `stick` drive type (drive
/// drops when offline). notify-0 stays the M5 rungs' resident shell, untouched.
fn seed_offline_drive_shells() {
    // The gateway owner: a bound Self perch tagged state="gateway" (not an agent).
    let gw_perch = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
    std::fs::create_dir_all(&gw_perch).expect("gateway owner perch");
    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
    info::write_info(&gw_perch, &rec).expect("gateway info.json");

    #[cfg(windows)]
    let spawn = "cmd /C exit 0 {link_token} {id}";
    #[cfg(unix)]
    let spawn = "true {link_token} {id}";
    let src = perch::spt_home().join("srcs").join("offdrive");
    std::fs::create_dir_all(&src).expect("offdrive src");
    std::fs::write(
        src.join("manifest.toml"),
        format!(
            "[adapter]\nname = \"offdrive\"\nkind = \"shell\"\nversion = \"1\"\n\
             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
             broadcast = \"same-node\"\npersistent = true\n\n\
             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
             [shell.drive]\ntypes = [\"stick\"]\n"
        ),
    )
    .expect("write offdrive manifest");
    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
        .expect("register offdrive");
    // The agent-owner instance (W2 drive-drop target) + the gateway-owner instance.
    let a = spt_store::shellinfo::spawn_record(
        &perch::owlery_dir(),
        ID_B,
        "offdrive",
        Some(DRIVE_TGT_ALIAS),
    )
    .expect("mint agent-owned offdrive");
    let g =
        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "offdrive", Some(GW_ALIAS))
            .expect("mint gateway-owned offdrive");
    println!("TWOHOST role B: offline drive shells minted — {ID_B}/{a}, {GW_OWNER}/{g}");
}


/// M11-W5: seed a **GATEWAY-typed** owner at B (`state="gateway"`, not an agent)
/// and mint its persistent shell — a noop-spawn instance that never binds, so it
/// stays offline (a cmd spools durably; a drive deterministically drops). One
/// `press` command verb + one `stick` drive type. Proves shell ownership is
/// owner-type-agnostic across a real link: A drives this gateway-owned shell
/// cross-node exactly as it drives an agent-owned one (REQ-SHELL-5).
fn seed_gateway_shell() {
    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
    std::fs::create_dir_all(&perch_path).expect("gateway owner perch");
    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
    info::write_info(&perch_path, &rec).expect("gateway info.json");

    #[cfg(windows)]
    let spawn = "cmd /C exit 0 {link_token} {id}";
    #[cfg(unix)]
    let spawn = "true {link_token} {id}";
    let src = perch::spt_home().join("srcs").join("gwshell");
    std::fs::create_dir_all(&src).expect("gwshell src");
    std::fs::write(
        src.join("manifest.toml"),
        format!(
            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\
             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
             broadcast = \"same-node\"\npersistent = true\n\n\
             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
             [shell.drive]\ntypes = [\"stick\"]\n"
        ),
    )
    .expect("write gwshell manifest");
    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
        .expect("register gwshell");
    let id =
        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))
            .expect("mint gateway-owned shell");
    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");
}

/// M11-W5: register a DETERMINISTICALLY-offline `offdrive` shell (a noop spawn
/// that never binds → no live slot, offline in BOTH real + fallback notify modes)
/// and mint it at B under two owners:
/// - **ID_B** (an agent owner) — the W2 cross-node drive **drop-not-wake** target
///   (notify-0 is resident/ONLINE on the real rig, so it can't prove the drop;
///   offdrive can).
/// - **GW_OWNER** (a `state="gateway"` owner, seeded here) — the gateway rung's
///   target: proves shell ownership is owner-type-agnostic across a real link
///   (REQ-SHELL-5) — A cmds + drives a gateway-owned shell exactly as an agent's.
///
/// One `press` command verb (cmd spools durably) + one `stick` drive type (drive
/// drops when offline). notify-0 stays the M5 rungs' resident shell, untouched.
fn seed_offline_drive_shells() {
    // The gateway owner: a bound Self perch tagged state="gateway" (not an agent).
    let gw_perch = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);
    std::fs::create_dir_all(&gw_perch).expect("gateway owner perch");
    let rec = InfoJson::new(GW_OWNER, "now", std::process::id(), "twohost-gw", "gateway");
    info::write_info(&gw_perch, &rec).expect("gateway info.json");

    #[cfg(windows)]
    let spawn = "cmd /C exit 0 {link_token} {id}";
    #[cfg(unix)]
    let spawn = "true {link_token} {id}";
    let src = perch::spt_home().join("srcs").join("offdrive");
    std::fs::create_dir_all(&src).expect("offdrive src");
    std::fs::write(
        src.join("manifest.toml"),
        format!(
            "[adapter]\nname = \"offdrive\"\nkind = \"shell\"\nversion = \"1\"\n\
             min_spt_core_version = \"0\"\n\n[shell]\nspawn = '{spawn}'\n\
             broadcast = \"same-node\"\npersistent = true\n\n\
             [shell.capabilities.press]\nargs = [\"button\"]\n\n\
             [shell.drive]\ntypes = [\"stick\"]\n"
        ),
    )
    .expect("write offdrive manifest");
    spt_runtime::registry::register(&perch::adapters_dir(), &src, now_ms())
        .expect("register offdrive");
    // The agent-owner instance (W2 drive-drop target) + the gateway-owner instance.
    let a = spt_store::shellinfo::spawn_record(
        &perch::owlery_dir(),
        ID_B,
        "offdrive",
        Some(DRIVE_TGT_ALIAS),
    )
    .expect("mint agent-owned offdrive");
    let g =
        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "offdrive", Some(GW_ALIAS))
            .expect("mint gateway-owned offdrive");
    println!("TWOHOST role B: offline drive shells minted — {ID_B}/{a}, {GW_OWNER}/{g}");
}

-/// M11-W5: seed a **GATEWAY-typed** owner at B (`state="gateway"`, not an agent)

-/// and mint its persistent shell — a noop-spawn instance that never binds, so it

-/// stays offline (a cmd spools durably; a drive deterministically drops). One

-/// `press` command verb + one `stick` drive type. Proves shell ownership is

-/// owner-type-agnostic across a real link: A drives this gateway-owned shell

-/// cross-node exactly as it drives an agent-owned one (REQ-SHELL-5).

-    let perch_path = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);

-    std::fs::create_dir_all(&perch_path).expect("gateway owner perch");

+/// M11-W5: register a DETERMINISTICALLY-offline `offdrive` shell (a noop spawn

+/// that never binds → no live slot, offline in BOTH real + fallback notify modes)

+/// - **ID_B** (an agent owner) — the W2 cross-node drive **drop-not-wake** target

+///   (notify-0 is resident/ONLINE on the real rig, so it can't prove the drop;

+/// - **GW_OWNER** (a `state="gateway"` owner, seeded here) — the gateway rung's

+///   target: proves shell ownership is owner-type-agnostic across a real link

+///   (REQ-SHELL-5) — A cmds + drives a gateway-owned shell exactly as an agent's.

+/// One `press` command verb (cmd spools durably) + one `stick` drive type (drive

+/// drops when offline). notify-0 stays the M5 rungs' resident shell, untouched.

+    // The gateway owner: a bound Self perch tagged state="gateway" (not an agent).

+    let gw_perch = perch::resolve_perch_path(GW_OWNER, ParentHint::Infer);

+    std::fs::create_dir_all(&gw_perch).expect("gateway owner perch");

-    info::write_info(&perch_path, &rec).expect("gateway info.json");

+    info::write_info(&gw_perch, &rec).expect("gateway info.json");

-    let src = perch::spt_home().join("srcs").join("gwshell");

-    std::fs::create_dir_all(&src).expect("gwshell src");

+    let src = perch::spt_home().join("srcs").join("offdrive");

+    std::fs::create_dir_all(&src).expect("offdrive src");

-            "[adapter]\nname = \"gwshell\"\nkind = \"shell\"\nversion = \"1\"\n\

+            "[adapter]\nname = \"offdrive\"\nkind = \"shell\"\nversion = \"1\"\n\

+    .expect("write offdrive manifest");

-        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "gwshell", Some(GW_ALIAS))

-            .expect("mint gateway-owned shell");

-    println!("TWOHOST role B: gateway-owned shell {id} minted under {GW_OWNER}");

+    // The agent-owner instance (W2 drive-drop target) + the gateway-owner instance.

+    let a = spt_store::shellinfo::spawn_record(

+    .expect("mint agent-owned offdrive");

+        spt_store::shellinfo::spawn_record(&perch::owlery_dir(), GW_OWNER, "offdrive", Some(GW_ALIAS))

+            .expect("mint gateway-owned offdrive");

+    println!("TWOHOST role B: offline drive shells minted — {ID_B}/{a}, {GW_OWNER}/{g}");

/// The deterministically-signed v6 release both sides agree on (B stages it,


Update the call site + B-side gateway assert perch:


    // M11-W5: a GATEWAY-typed owner's shell, also resident before the loops serve.
    seed_gateway_shell();

    // M11-W5: deterministically-offline drive shells (agent + gateway owned),
    // resident before the loops serve — the W2 drop-not-wake + gateway targets.
    seed_offline_drive_shells();


    // M11-W5: a GATEWAY-typed owner's shell, also resident before the loops serve.
    seed_gateway_shell();

    // M11-W5: deterministically-offline drive shells (agent + gateway owned),
    // resident before the loops serve — the W2 drop-not-wake + gateway targets.
    seed_offline_drive_shells();

// M5 rungs 10/11 (D9a): the notify shell adapter + the owner's instance

// exist before the loops serve anything.

let (render_file, real_mode) = seed_notify_shell(scratch.path());

-    // M11-W5: a GATEWAY-typed owner's shell, also resident before the loops serve.

+    // M11-W5: deterministically-offline drive shells (agent + gateway owned),

+    // resident before the loops serve — the W2 drop-not-wake + gateway targets.

// M5 rung 9 (presence): the user is most-recently-active HERE — the

// fresh stamp rides B's advertisement rows (REQ-PRES-1).

info::set_last_active(&perch_b, now_ms()).expect("stamp B's recency");


let gw_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), GW_OWNER, "gwshell-0");

let gw_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), GW_OWNER, "offdrive-0");


// the gateway owner's perch; the drive DROPPED (offline) and never spooled

// (drop-not-wake holds for a gateway owner too).

-    let gw_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), GW_OWNER, "gwshell-0");

+    let gw_perch = perch::resolve_shell_perch_path_in(&perch::owlery_dir(), GW_OWNER, "offdrive-0");

"gateway: A's cross-node cmd spooled under the gateway-typed owner at B",


Now retarget the W2 drive rung (role A) from notify-0 to the offline offdrive, and fix its comment:


    // ephemeral control channel of its persistent shell living at B. The shell
    // is OFFLINE at B (the echo-mode binary exited without binding), so the
    // cross-node drive DROPS — and crucially does NOT wake the persistent
    // instance (the load-bearing divergence from cmd, which relaunches; D1). The
    // reply is `ok` with the drop detail, and B's durable spool stays untouched
    // (drive never spools — D3). The no-replay-across-relink token-stamp is a
    // shell-LOCAL poll property (the same-node E2E + the drivehub unit), since a
    // drive-poll always runs where the shell lives.
    // [int->REQ-SHELL-3]
    let out = spt_daemon::request_shell_link(
        &mut a,
        conn.conn_id,
        ID_B,
        SHELL_ALIAS,
        spt_net::net::shelllink::SHELL_LINK_DRIVE,
        &["stick".to_string(), "x=0.7".to_string()],
        "twohost-drive",
        op(),
    )
    .expect("cross-node drive round trip");
    match &out {
        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
            detail.contains("dropped") && detail.contains("offline"),
            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
        ),
        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
    }
    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");

    // ephemeral control channel of a persistent shell living at B. The target is
    // the `offdrive` shell — a noop spawn that never binds, so it is
    // DETERMINISTICALLY OFFLINE on the real rig (notify-0 is resident/ONLINE when
    // SPT_TWO_HOST_NOTIFY_BIN is set, so driving it would deliver to the live slot,
    // not drop). Offline ⇒ the cross-node drive DROPS — and crucially does NOT wake
    // the persistent instance (the load-bearing divergence from cmd, which
    // relaunches; D1). The reply is `ok` with the drop detail, and B's durable spool
    // stays untouched (drive never spools — D3). The no-replay-across-relink
    // token-stamp is a shell-LOCAL poll property (the same-node E2E + the drivehub
    // unit), since a drive-poll always runs where the shell lives.
    // [int->REQ-SHELL-3]
    let out = spt_daemon::request_shell_link(
        &mut a,
        conn.conn_id,
        ID_B,
        DRIVE_TGT_ALIAS,
        spt_net::net::shelllink::SHELL_LINK_DRIVE,
        &["stick".to_string(), "x=0.7".to_string()],
        "twohost-drive",
        op(),
    )
    .expect("cross-node drive round trip");
    match &out {
        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
            detail.contains("dropped") && detail.contains("offline"),
            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
        ),
        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
    }
    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");


    // ephemeral control channel of its persistent shell living at B. The shell
    // is OFFLINE at B (the echo-mode binary exited without binding), so the
    // cross-node drive DROPS — and crucially does NOT wake the persistent
    // instance (the load-bearing divergence from cmd, which relaunches; D1). The
    // reply is `ok` with the drop detail, and B's durable spool stays untouched
    // (drive never spools — D3). The no-replay-across-relink token-stamp is a
    // shell-LOCAL poll property (the same-node E2E + the drivehub unit), since a
    // drive-poll always runs where the shell lives.
    // [int->REQ-SHELL-3]
    let out = spt_daemon::request_shell_link(
        &mut a,
        conn.conn_id,
        ID_B,
        SHELL_ALIAS,
        spt_net::net::shelllink::SHELL_LINK_DRIVE,
        &["stick".to_string(), "x=0.7".to_string()],
        "twohost-drive",
        op(),
    )
    .expect("cross-node drive round trip");
    match &out {
        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
            detail.contains("dropped") && detail.contains("offline"),
            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
        ),
        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
    }
    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");

    // ephemeral control channel of a persistent shell living at B. The target is
    // the `offdrive` shell — a noop spawn that never binds, so it is
    // DETERMINISTICALLY OFFLINE on the real rig (notify-0 is resident/ONLINE when
    // SPT_TWO_HOST_NOTIFY_BIN is set, so driving it would deliver to the live slot,
    // not drop). Offline ⇒ the cross-node drive DROPS — and crucially does NOT wake
    // the persistent instance (the load-bearing divergence from cmd, which
    // relaunches; D1). The reply is `ok` with the drop detail, and B's durable spool
    // stays untouched (drive never spools — D3). The no-replay-across-relink
    // token-stamp is a shell-LOCAL poll property (the same-node E2E + the drivehub
    // unit), since a drive-poll always runs where the shell lives.
    // [int->REQ-SHELL-3]
    let out = spt_daemon::request_shell_link(
        &mut a,
        conn.conn_id,
        ID_B,
        DRIVE_TGT_ALIAS,
        spt_net::net::shelllink::SHELL_LINK_DRIVE,
        &["stick".to_string(), "x=0.7".to_string()],
        "twohost-drive",
        op(),
    )
    .expect("cross-node drive round trip");
    match &out {
        spt_daemon::ShellLinkRequestOutcome::Ok(detail) => assert!(
            detail.contains("dropped") && detail.contains("offline"),
            "cross-node drive of an offline persistent shell DROPS, never wakes: {detail}"
        ),
        other => panic!("cross-node drive must round-trip ok (a defined drop): {other:?}"),
    }
    println!("TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)");

println!("TWOHOST OK: cross-node shell relink + drive (B asserts the render)");

// ── M11-W2 rung — cross-node DRIVE (REQ-SHELL-3): the owner at A drives the

-    // ephemeral control channel of its persistent shell living at B. The shell

-    // is OFFLINE at B (the echo-mode binary exited without binding), so the

-    // cross-node drive DROPS — and crucially does NOT wake the persistent

-    // instance (the load-bearing divergence from cmd, which relaunches; D1). The

-    // reply is `ok` with the drop detail, and B's durable spool stays untouched

-    // (drive never spools — D3). The no-replay-across-relink token-stamp is a

-    // shell-LOCAL poll property (the same-node E2E + the drivehub unit), since a

-    // drive-poll always runs where the shell lives.

+    // ephemeral control channel of a persistent shell living at B. The target is

+    // the `offdrive` shell — a noop spawn that never binds, so it is

+    // DETERMINISTICALLY OFFLINE on the real rig (notify-0 is resident/ONLINE when

+    // SPT_TWO_HOST_NOTIFY_BIN is set, so driving it would deliver to the live slot,

+    // not drop). Offline ⇒ the cross-node drive DROPS — and crucially does NOT wake

+    // the persistent instance (the load-bearing divergence from cmd, which

+    // relaunches; D1). The reply is `ok` with the drop detail, and B's durable spool

+    // stays untouched (drive never spools — D3). The no-replay-across-relink

+    // token-stamp is a shell-LOCAL poll property (the same-node E2E + the drivehub

+    // unit), since a drive-poll always runs where the shell lives.


Gateway rung uses GW_OWNER/GW_ALIAS → now resolves to offdrive-0 (no call change needed). Verify no stale `gwshell` references remain + compile-check:


Bash

echo "=== stale gwshell refs ==="; grep -n "gwshell" crates/spt-daemon/tests/twohost.rs; echo "(empty=clean)"
echo "=== compile twohost test ==="
cargo test -p spt-daemon --test twohost --no-run 2>&1 | Select-Object -Last 6 2>/dev/null || cargo test -p spt-daemon --test twohost --no-run 2>&1 | tail -6

Check stale refs + compile


=== stale gwshell refs ===
(empty=clean)
=== compile twohost test ===
   Compiling spt-daemon v0.7.3 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 9.04s
  Executable tests\twohost.rs (target\debug\deps\twohost-9f39f099c9408f92.exe)


Clean + compiles. No-op run + workspace clippy:


PowerShell

cargo test -p spt-daemon --test twohost 2>&1 | Select-Object -Last 4
"=== clippy ==="
cargo clippy --workspace --all-targets -- -D warnings 2>&1 | Select-Object -Last 2; "CLIPPY=$LASTEXITCODE"

No-op run + clippy


test two_host_ladder_role_b ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

=== clippy ===
    Checking spt-daemon v0.7.3 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.97s
CLIPPY=0


No-op clean, clippy 0. Commit the fix (subject carries `[twohost]` so the dev-freeform FF will fire the rig) + push m11-shell-substrate:


Bash

cd /c/Users/decid/Documents/projects/spt-core
git add -A && git status --short
git commit -q -m "$(cat <<'EOF'
M11-W5 T5.1 fix: deterministically-offline offdrive shell for the rig drive-drop [twohost]

First real-rig fire (run 27604406083) surfaced that the W2 cross-node drive
drop-not-wake rung drove notify-0 — which is RESIDENT/ONLINE on the rig
(SPT_TWO_HOST_NOTIFY_BIN set) — so the drive DELIVERED to the live slot instead of
dropping. The rung's "offline" assumption only held in fallback (noop) mode; W5 is
the first time it ran on the real rig. Test-harness bug, production drive logic
correct (online→deliver, offline→drop).

Fix (test-only, doyle option A): a noop `offdrive` shell that never binds —
deterministically offline in both real + fallback modes — minted at B under ID_B
(the W2 agent-owner drive-drop target) and GW_OWNER (the gateway rung). The W2
drive rung retargets to ID_B/offdrive (drops); the gateway rung targets
GW_OWNER/offdrive (cmd spools, drive drops). notify-0 stays the M5 rungs' resident
shell. gwshell folded into offdrive. Also fixes role A aborting before the gateway
rung (so the gateway rung now actually executes) and role B's consequential timeout.

Co-authored by: todlando
EOF
)" && git log --oneline -1 && git push origin m11-shell-substrate 2>&1 | tail -2

Commit fix + push m11-shell-substrate


M  crates/spt-daemon/tests/twohost.rs
c5887db M11-W5 T5.1 fix: deterministically-offline offdrive shell for the rig drive-drop [twohost]
To https://github.com/SaberMage/spt-core.git
   24e2409..c5887db  m11-shell-substrate -> m11-shell-substrate


Fix pushed (c5887db, normal CI fires). Ping doyle it's staged for the rig re-fire + confirm normal CI on the fixed commit.


$OWL send doyle todlando <<'EOF'
FIX STAGED — c5887db pushed to m11-shell-substrate. Option (A) implemented test-only:
- offdrive shell (noop/persistent/[shell.drive].stick + press cap), never binds → deterministically OFFLINE in real + fallback modes. Minted at B under ID_B + GW_OWNER.
- W2 drive rung → ID_B/offdrive (offline ⇒ drops; assertion now sound).
- gateway rung → GW_OWNER/offdrive (cmd spools under gw perch, drive drops no-spool). Now actually executes (A reaches it).
- notify-0 untouched (M5 rungs). gwshell folded into offdrive.
Compiles + no-op path green; clippy --workspace --all-targets -D warnings=0. Subject carries [twohost] so the dev-freeform FF will fire the rig.

Normal CI re-running on c5887db (confirming gate input a holds on the fixed commit). READY for the rig re-fire: on your operator-GO I run `git push origin m11-shell-substrate:dev-freeform` (FF 24e2409..c5887db) to fire twohost-a/b. Say go.
EOF
echo "rc=$?"
echo "=== normal CI for c5887db ==="; sleep 8
gh api "repos/SaberMage/spt-core/actions/runs?head_sha=$(git rev-parse HEAD)" --jq '.workflow_runs[] | "\(.id) \(.status) \(.event) \(.name)"' 2>&1; echo "(empty=lag)"

Ping doyle staged + check normal CI


➜ SENT:doyle
rc=0
=== normal CI for c5887db ===
27606204239 queued pull_request ci
(empty=lag)


Normal CI **27606204239** queued for c5887db. doyle pinged (awaiting operator-GO for the rig re-fire). Arm a watcher on normal CI to confirm gate (a) holds on the fixed commit.


sha=$(git rev-parse HEAD)
for i in $(seq 1 120); do
  line=$(gh api "repos/SaberMage/spt-core/actions/runs?head_sha=$sha" \
         --jq '.workflow_runs[] | select(.name=="ci") | "\(.id) \(.status) \(.conclusion)"' 2>/dev/null)
  if [ -n "$line" ]; then
    st=$(echo "$line" | awk '{print $2}')
    [ "$st" = "completed" ] && { echo "NORMAL CI DONE: $line"; exit 0; }
    echo "poll $i: ci $st"
  else
    echo "poll $i: no run yet"
  fi
  sleep 25
done
echo "TIMEOUT"

Watch normal CI for c5887db


Command running in background with ID: b7i1nal0t. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b7i1nal0t.output. You will be notified when it completes. To check interim output, use Read on that file path.


Fix staged + pushed (c5887db). Watcher `b7i1nal0t` on normal CI.

## State
- **Root cause fixed** (doyle option A): the W2 drive-drop rung drove `notify-0`, which is **resident/ONLINE on the real rig** → drive delivered, not dropped. Added a deterministically-offline `offdrive` shell (never binds); retargeted the W2 rung (ID_B/offdrive → drops) and the gateway rung (GW_OWNER/offdrive). Test-only; production logic untouched. My gateway rung now actually executes.
- Compiles + no-op clean + clippy 0; pushed c5887db (subject carries `[twohost]` for the FF re-fire).
- **Normal CI** re-running (gate input a, watcher armed).
- **Rig re-fire** (gate input b): staged, awaiting doyle's operator-GO → then `git push origin m11-shell-substrate:dev-freeform` (FF 24e2409..c5887db) fires twohost-a/b.

Reusable rig lesson saved to memory. Commune refreshed. Holding for doyle's GO + normal CI.


<task-notification>
<task-id>b7i1nal0t</task-id>
<tool-use-id>toolu_01JMNTCn1WuvJptvNfy4QivP</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b7i1nal0t.output</output-file>
<status>completed</status>
<summary>Background command "Watch normal CI for c5887db" completed (exit code 0)</summary>
</task-notification>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


Normal CI watcher done. Read result.


tail -2 "C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b7i1nal0t.output"
echo "=== run jobs ==="
rid=$(gh api "repos/SaberMage/spt-core/actions/runs?head_sha=$(git rev-parse HEAD)" --jq '.workflow_runs[] | select(.name=="ci") | .id' 2>/dev/null | head -1)
gh run view $rid --json conclusion --jq '.conclusion' 2>&1
gh run view $rid --json jobs --jq '.jobs[] | "\(.name): \(.conclusion)"' 2>&1

Normal CI conclusion for c5887db


poll 16: ci in_progress
NORMAL CI DONE: 27606204239 completed success
=== run jobs ===
success
n1-gate (self-hosted, Windows, hfenduleam): success
test (self-hosted, Linux, kitsubito): success
n1-gate (self-hosted, Linux, kitsubito): success
test (self-hosted, Windows, hfenduleam): success
traceability: success
twohost-b: skipped
twohost-a: skipped


Gate (a) green on the fixed commit (27606204239 success both runners; twohost skipped on PR). Notify doyle + stand by for rig GO.


$OWL send doyle todlando <<'EOF'
Gate (a) re-confirmed GREEN on the fix: normal CI 27606204239 = success both runners (test+n1-gate+traceability), twohost skipped on PR as expected.
Standing by for your operator-GO on the rig re-fire → `git push origin m11-shell-substrate:dev-freeform` (FF 24e2409..c5887db). On twohost-a/b green I send you the conclusions for the W5 GATE PASS stamp.
EOF
echo "rc=$?"

Notify doyle gate-a green, await rig GO


➜ SENT:doyle
rc=0


Gate (a) green on the fix confirmed to doyle. Holding for his operator-GO on the rig re-fire.

## Recap
- **W5 fix complete + verified**: offdrive shell fixes the W2 drive-drop rung's real-rig assumption bug; normal CI green on c5887db.
- **Gate (a)** ✅ normal CI green both runners.
- **Gate (b)** pending: rig re-fire staged — on doyle's operator-GO, `git push origin m11-shell-substrate:dev-freeform` fires twohost-a/b with both rungs now correct (W2 drive-drop against an offline shell + the gateway rung executing).

doyle's GO arrives on my listener. Holding.


<task-notification>
<task-id>be1did0ug</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/2" id="26bddd10" type="msg" from="todlando">GO — operator green-lit the rig re-fire. Push it:
  git push origin m11-shell-substrate:dev-freeform   (FF 24e2409..c5887db)
offdrive fix matches the blessed spec (deterministically-offline under ID_B + GW_OWNER; W2 rung retargeted; gateway rung now reachable; notify-0 untouched). Gate (a) re-confirmed green </EVENT-PART>
<EVENT-PART seq="2/2" id="26bddd10">on c5887db noted. After the push, send me the rig run URL; I stamp W5 GATE PASS the moment twohost-a (Win) + twohost-b (Linux) go green with the W2 drop-not-wake rung + the gateway rung BOTH fired. No machine-wide reaping — CI-scoped.</EVENT-PART></event>
</task-notification>


doyle + operator GO. Re-fire the rig (FF dev-freeform to c5887db).


cd /c/Users/decid/Documents/projects/spt-core
git push origin m11-shell-substrate:dev-freeform 2>&1 | tail -3
echo "=== confirm dev-freeform ==="; git ls-remote origin dev-freeform
echo "=== find run ==="; sleep 10
gh run list --branch dev-freeform --limit 1 --json databaseId,event,status,headSha --jq '.[] | "\(.databaseId) \(.event) \(.status) \(.headSha[0:7])"' 2>&1

FF dev-freeform to c5887db + find rig run


To https://github.com/SaberMage/spt-core.git
   24e2409..c5887db  m11-shell-substrate -> dev-freeform
=== confirm dev-freeform ===
c5887db27f6c8576decec071c073e76c5144ba66	refs/heads/dev-freeform
=== find run ===
27608026651 push queued c5887db


Rig re-fired — run **27608026651** (dev-freeform, c5887db, push). Send doyle the URL + arm the rig watcher.


$OWL send doyle todlando <<'EOF'
RIG RE-FIRED. dev-freeform 24e2409..c5887db (clean FF). m11-shell-substrate HEAD untouched at c5887db.
Run: https://github.com/SaberMage/spt-core/actions/runs/27608026651  (push, dev-freeform, c5887db, [twohost])
Watching twohost-a (Win/hfenduleam) + twohost-b (Linux/kitsubito). Send you conclusions the moment both finish. CI-scoped only.
EOF
echo "rc=$?"

Send doyle re-fire URL


rid=27608026651
for i in $(seq 1 150); do
  done=$(gh run view $rid --json status --jq '.status' 2>/dev/null)
  if [ "$done" = "completed" ]; then
    echo "RUN DONE"
    gh run view $rid --json jobs --jq '.jobs[] | "\(.name): \(.conclusion)"' 2>&1
    exit 0
  fi
  th=$(gh run view $rid --json jobs --jq '.jobs[] | select(.name|startswith("twohost")) | "\(.name)=\(.status)/\(.conclusion)"' 2>/dev/null | tr '\n' ' ')
  echo "poll $i: status=$done twohost:[$th]"
  sleep 30
done
echo "TIMEOUT"

Watch rig re-fire until complete


Command running in background with ID: b67yx3ptj. Output is being written to: C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b67yx3ptj.output. You will be notified when it completes. To check interim output, use Read on that file path.


Rig re-fired — run **27608026651** on dev-freeform (c5887db). doyle has the URL. Watcher `b67yx3ptj` tracking twohost-a/b to completion (~15min, WAIT_SECS=900/rung).

On green → send doyle the conclusions → he stamps **W5 GATE PASS** → M11 milestone release. If still red, read logs and diagnose (the offdrive fix targets the exact failure, so I expect green; the gateway rung now executes for the first time). Holding for the rig run.


<task-notification>
<task-id>b67yx3ptj</task-id>
<tool-use-id>toolu_01P4PLQMJG6YnycUC6h4j2Dm</tool-use-id>
<output-file>C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b67yx3ptj.output</output-file>
<status>completed</status>
<summary>Background command "Watch rig re-fire until complete" completed (exit code 0)</summary>
</task-notification>


Rig watcher done. Read result.


tail -4 "C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\30df62c3-0b22-4b14-88de-fef422a5554f\tasks\b67yx3ptj.output"
echo "=== run 27608026651 ==="
gh run view 27608026651 --json status,conclusion --jq '"\(.status) \(.conclusion)"' 2>&1
gh run view 27608026651 --json jobs --jq '.jobs[] | "\(.name): \(.conclusion)"' 2>&1

Rig re-fire conclusion


n1-gate (self-hosted, Linux, kitsubito): success
n1-gate (self-hosted, Windows, hfenduleam): success
twohost-b: success
twohost-a: success
=== run 27608026651 ===
completed success
test (self-hosted, Linux, kitsubito): success
traceability: success
test (self-hosted, Windows, hfenduleam): success
n1-gate (self-hosted, Linux, kitsubito): success
n1-gate (self-hosted, Windows, hfenduleam): success
twohost-b: success
twohost-a: success


**RIG GREEN** — twohost-a + twohost-b both success. Confirm both rungs actually FIRED (doyle's condition) from the role-A log, then report.


aid=$(gh run view 27608026651 --json jobs --jq '.jobs[] | select(.name=="twohost-a") | .databaseId' 2>/dev/null)
gh run view 27608026651 --log --job=$aid 2>&1 | grep -iE "TWOHOST OK: cross-node drive drops|TWOHOST OK: gateway" | tail -6

Confirm both rungs fired green in role-a log


twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T09:39:09.9109908Z TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)
twohost-a	Two-host ladder — role A (joiner/driver)	2026-06-16T09:39:10.0641891Z TWOHOST OK: gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)


Both rungs **fired green**: W2 drop-not-wake + the gateway-owner rung (executed for the first time). Both gate inputs met. Report to doyle for the W5 GATE PASS stamp.


$OWL send doyle todlando <<'EOF'
🟢 RIG GREEN — W5 T5.3 BOTH gate inputs met. Run 27608026651 (dev-freeform, c5887db) = success ALL jobs:
  test (hfenduleam + kitsubito) ✅ · n1-gate (both) ✅ · traceability ✅ · twohost-a ✅ · twohost-b ✅

BOTH rungs FIRED green (role-a log, verbatim):
- "TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)"  ← W2 drop-not-wake, now against the offline offdrive shell (the fix)
- "TWOHOST OK: gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)"  ← the gateway rung, executed for the FIRST time + green (role-b confirmed the gateway cmd spooled under the gw perch + drive dropped no-spool)

Gate (a) normal CI green on c5887db (27606204239) + gate (b) [twohost] rig green with both rungs fired. W5 is GREEN end-to-end.

W5 summary for the stamp: T5.2 docs (how-to subnet + v1-lock, ADR-0020 tunnel carve-out, four-channels/gates/owner-agnostic, manifest fields) + T5.1 (gateway-owner cross-node rung [int->REQ-SHELL-5], cross-node tunnel DEFERRED w/ DEFERRED.md entry + corrected docs, offdrive fix). traceable EXIT0 (REQ-SHELL-4/5 + REQ-DOCS-6 +int). PR #16 HEAD c5887db (stays unmerged until the M11 release per your call). Ready for your W5 GATE PASS stamp → then M11 milestone release.
EOF
echo "rc=$?"

Report W5 rig green to doyle for gate stamp


W5 green end-to-end, reported to doyle. Refresh commune for clean resume, then hold for the stamp.


Write

# Commune — M11-W5 GREEN end-to-end, awaiting doyle's GATE PASS stamp

Branch m11-shell-substrate HEAD c5887db, PR #16 (unmerged until M11 release).
dev-freeform = c5887db (rig branch).

## W4 CLOSED (doyle PASS @63a5d3e). See [[m11-w4-progress]].

## W5 = last M11 wave — GREEN, awaiting stamp.
Gate (a) normal CI GREEN on c5887db (27606204239, both runners).
Gate (b) [twohost] rig GREEN (27608026651, dev-freeform): test+n1-gate+traceability+
twohost-a+twohost-b ALL success. BOTH rungs FIRED green:
- "cross-node drive drops an offline persistent shell (no wake, no spool)" (W2 drop-
  not-wake, now vs the offline offdrive shell — the fix)
- "gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)"
  (the gateway rung, executed first time + green)

### Commits:
- 0674894 T5.2 docs (how-to subnet + v1-lock, ADR-0020 carve-out, four-channels/gates/
  owner-agnostic, manifest fields)
- 24e2409 T5.1 (gateway rung [int->REQ-SHELL-5] + cross-node tunnel DEFERRED + docs fix)
- c5887db T5.1 fix (offdrive deterministically-offline shell — fixes the first-rig-fire
  W2 drive-drop bug: notify-0 resident/ONLINE on real rig; see [[twohost-rig-real-notify-mode]])

traceable EXIT0 (REQ-SHELL-4/5 + REQ-DOCS-6 all +doc+impl+unit+int). clippy/xtask/site green.
Cross-node tunnel = future wave when a consumer (usbip) lands ([[unmergeable-pr-blocks-ci]]
is a separate CI lesson).

## NEXT: doyle stamps W5 GATE PASS → M11 milestone RELEASE (version bump from 0.7.3 →
next, merge PR #16 to main, tag, deployah signs+publishes). M11 = consent(W1)+drive(W2)
+tunnel-same-node(W3)+gateway-capstone(W4)+rig/docs(W5). PR #16 stays unmerged until
that release (doyle's call). After stamp, coordinate the release with doyle/deployah.

## Rig-fire mechanism (reusable): [twohost] jobs fire only on PUSH to dev-freeform/main
(head_commit.message gate, null on PR). FF dev-freeform to the branch HEAD (subject must
carry [twohost]); operator-GO each fire (shared live boxes, no machine-wide reaping).

## Pre-flight: clippy --workspace --all-targets -D warnings + traceable EXIT0 + xtask check.


File created successfully at: C:\Users\decid\Documents\projects\spt-core\.claude\todlando-commune.md (file state is current in your context — no need to Read it back)

# Commune — M11-W5 GREEN end-to-end, awaiting doyle's GATE PASS stamp

Branch m11-shell-substrate HEAD c5887db, PR #16 (unmerged until M11 release).
dev-freeform = c5887db (rig branch).

## W4 CLOSED (doyle PASS @63a5d3e). See [[m11-w4-progress]].

## W5 = last M11 wave — GREEN, awaiting stamp.
Gate (a) normal CI GREEN on c5887db (27606204239, both runners).
Gate (b) [twohost] rig GREEN (27608026651, dev-freeform): test+n1-gate+traceability+
twohost-a+twohost-b ALL success. BOTH rungs FIRED green:
- "cross-node drive drops an offline persistent shell (no wake, no spool)" (W2 drop-
  not-wake, now vs the offline offdrive shell — the fix)
- "gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)"
  (the gateway rung, executed first time + green)

### Commits:
- 0674894 T5.2 docs (how-to subnet + v1-lock, ADR-0020 carve-out, four-channels/gates/
  owner-agnostic, manifest fields)
- 24e2409 T5.1 (gateway rung [int->REQ-SHELL-5] + cross-node tunnel DEFERRED + docs fix)
- c5887db T5.1 fix (offdrive deterministically-offline shell — fixes the first-rig-fire
  W2 drive-drop bug: notify-0 resident/ONLINE on real rig; see [[twohost-rig-real-notify-mode]])

traceable EXIT0 (REQ-SHELL-4/5 + REQ-DOCS-6 all +doc+impl+unit+int). clippy/xtask/site green.
Cross-node tunnel = future wave when a consumer (usbip) lands ([[unmergeable-pr-blocks-ci]]
is a separate CI lesson).

## NEXT: doyle stamps W5 GATE PASS → M11 milestone RELEASE (version bump from 0.7.3 →
next, merge PR #16 to main, tag, deployah signs+publishes). M11 = consent(W1)+drive(W2)
+tunnel-same-node(W3)+gateway-capstone(W4)+rig/docs(W5). PR #16 stays unmerged until
that release (doyle's call). After stamp, coordinate the release with doyle/deployah.

## Rig-fire mechanism (reusable): [twohost] jobs fire only on PUSH to dev-freeform/main
(head_commit.message gate, null on PR). FF dev-freeform to the branch HEAD (subject must
carry [twohost]); operator-GO each fire (shared live boxes, no machine-wide reaping).

## Pre-flight: clippy --workspace --all-targets -D warnings + traceable EXIT0 + xtask check.


## 🟢 M11-W5 GREEN end-to-end

**Rig run 27608026651** (dev-freeform, c5887db): all jobs success — test + n1-gate (both runners) + traceability + **twohost-a + twohost-b**.

**Both rungs fired green:**
- `cross-node drive drops an offline persistent shell (no wake, no spool)` — the W2 drop-not-wake rung, now correct against the offline `offdrive` shell.
- `gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)` — the gateway rung, executed for the first time and green.

**Gate inputs both met:** (a) normal CI green on c5887db, (b) `[twohost]` rig green with both rungs fired. Reported to doyle for the W5 GATE PASS stamp.

The first rig fire earned its keep — it caught a real harness-assumption bug (notify-0 is resident/ONLINE on the real rig) that green normal-CI never would have. Fixed test-only, re-fired, green.

Holding for doyle's **W5 GATE PASS** → then the **M11 milestone release** (version bump, merge PR #16, tag, publish — coordinated with doyle/deployah). Commune + memory updated for clean resume.


<task-notification>
<task-id>be1did0ug</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/6" id="1314509c" type="msg" from="todlando">🟢 W5 GATE PASS — STAMPED. Independently verified run 27608026651 (c5887db): conclusion=success, all 7 jobs green (test+n1-gate ×both runners, traceability, twohost-a, twohost-b). Both rungs FIRED green:
- &quot;TWOHOST OK: cross-node drive drops an offline persistent shell (no wake, no spool)&quot; — W2 dr</EVENT-PART>
<EVENT-PART seq="2/6" id="1314509c">op-not-wake, now sound against the deterministically-offline offdrive (your fix). The assumption bug is closed; the rung proves the real behavior.
- &quot;TWOHOST OK: gateway-typed owner cross-node cmd+drive (owner-type-agnostic across a real link)&quot; — the gateway rung, executed for the FIRST time + green; role-b confirmed cmd spooled</EVENT-PART>
<EVENT-PART seq="3/6" id="1314509c"> under the gw perch + drive dropped no-spool. The owner-opacity carries across a real Iroh link concretely.

All T5.3 conditions met: traceable EXIT0 (REQ-SHELL-4/5 + REQ-DOCS-6 +int) + full suite both runners + the [twohost] ladder green with BOTH target rungs FIRED (not skipped). T5.2 docs (how-to subnet + v1-lock, ADR-0020 tunnel carv</EVENT-PART>
<EVENT-PART seq="4/6" id="1314509c">e-out, four-channels/gates/owner-agnostic, manifest fields) + the tunnel-cross-node DEFERRAL (DEFERRED.md entry + corrected no-overclaim docs) all land per the rulings.

**M11 is COMPLETE end-to-end** (W1..W5, capstone + rig-proven). Excellent close — and great real-rig discipline this wave (you caught the Q2 false premise, the rig-fir</EVENT-PART>
<EVENT-PART seq="5/6" id="1314509c">e mechanism, and your own W2-assumption bug, all loud not papered).

NEXT = M11 milestone release (operator-gated, separate from the v0.7.4/counter-16 leg I'm finishing). PR #16 stays unmerged until then. I'll line up operator GO for the M11 release (merge PR #16 + tag) — hold there. Stand by; I'll ping when the operator green-lights i</EVENT-PART>
<EVENT-PART seq="6/6" id="1314509c">t.</EVENT-PART></event>
</task-notification>


W5 GATE PASS stamped — **M11 COMPLETE end-to-end** (W1..W5). Ack doyle + hold for the operator-gated M11 release.


Bash

$OWL send doyle todlando <<'EOF'
ACK — W5 GATE PASS received, M11 COMPLETE. Thank you. Holding for the M11 milestone release: PR #16 (HEAD c5887db) stays unmerged until your operator-GO ping, then merge PR #16 to main + version bump + tag (M11 release leg, separate from your v0.7.4/counter-16). I will NOT touch the merge/release until you ping operator-GO. Standing by. Good wave — the real-rig discipline paid off (Q2 false premise, fire mechanism, the W2 assumption bug all surfaced loud).
EOF
echo "rc=$?"

Ack W5 gate pass + M11 complete


➜ SENT:doyle
rc=0


Acked. Persist M11-complete status to memory.


Write

---
name: m11-complete
description: M11 shell-substrate milestone COMPLETE end-to-end (W1..W5, doyle-gated); awaiting operator-gated M11 release
metadata:
  type: project
---

**M11 (shell substrate) COMPLETE end-to-end** — all waves doyle GATE PASS:
- W1 consent (REQ-CONSENT-3 per-capability act-gates)
- W2 drive channel (REQ-SHELL-3, latest-wins ephemeral)
- W3 tunnel SAME-NODE (REQ-SHELL-4, opaque byte stream; cross-node DEFERRED)
- W4 gateway-owner capstone (REQ-SHELL-5, owner-type-agnostic, proof-not-change)
- W5 rig + docs: gateway cross-node [twohost] rung + how-to subnet topic + ADR-0020
  tunnel carve-out + four-channel/gates/owner-agnostic docs. W5 GATE PASS @c5887db
  (rig run 27608026651 all 7 jobs green, both rungs FIRED).

Branch m11-shell-substrate HEAD c5887db, PR #16 — STAYS UNMERGED until the M11
milestone release (doyle's call). traceable EXIT0 (REQ-SHELL-3/4/5 + REQ-CONSENT-3
+ REQ-DOCS-6 all evidenced).

## DEFERRED (tracked, DEFERRED.md): cross-node tunnel relay — build as its own impl
wave WHEN a cross-node tunnel consumer (usbip URB) lands. REQ-SHELL-4 int satisfied
same-node. See [[twohost-rig-real-notify-mode]] (rig real-mode notify lesson) +
[[unmergeable-pr-blocks-ci]] (CI lesson from the W4 push).

## NEXT (HOLDING): M11 milestone RELEASE — operator-gated. doyle lines up operator GO,
then I merge PR #16 → main + version bump (0.7.3 → next) + tag; deployah signs+publishes.
Separate from doyle's in-flight v0.7.4/counter-16 leg. Do NOT touch merge/release until
doyle pings operator-GO. Supersedes [[m11-w4-progress]].


File created successfully at: C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\m11-complete.md (file state is current in your context — no need to Read it back)

---
name: m11-complete
description: "M11 shell-substrate milestone COMPLETE end-to-end (W1..W5, doyle-gated); awaiting operator-gated M11 release"
metadata:
  node_type: memory
  type: project
  originSessionId: 5b0a69e3-d6a3-47f7-8152-ee14e5b4ff5c
---

**M11 (shell substrate) COMPLETE end-to-end** — all waves doyle GATE PASS:
- W1 consent (REQ-CONSENT-3 per-capability act-gates)
- W2 drive channel (REQ-SHELL-3, latest-wins ephemeral)
- W3 tunnel SAME-NODE (REQ-SHELL-4, opaque byte stream; cross-node DEFERRED)
- W4 gateway-owner capstone (REQ-SHELL-5, owner-type-agnostic, proof-not-change)
- W5 rig + docs: gateway cross-node [twohost] rung + how-to subnet topic + ADR-0020
  tunnel carve-out + four-channel/gates/owner-agnostic docs. W5 GATE PASS @c5887db
  (rig run 27608026651 all 7 jobs green, both rungs FIRED).

Branch m11-shell-substrate HEAD c5887db, PR #16 — STAYS UNMERGED until the M11
milestone release (doyle's call). traceable EXIT0 (REQ-SHELL-3/4/5 + REQ-CONSENT-3
+ REQ-DOCS-6 all evidenced).

## DEFERRED (tracked, DEFERRED.md): cross-node tunnel relay — build as its own impl
wave WHEN a cross-node tunnel consumer (usbip URB) lands. REQ-SHELL-4 int satisfied
same-node. See [[twohost-rig-real-notify-mode]] (rig real-mode notify lesson) +
[[unmergeable-pr-blocks-ci]] (CI lesson from the W4 push).

## NEXT (HOLDING): M11 milestone RELEASE — operator-gated. doyle lines up operator GO,
then I merge PR #16 → main + version bump (0.7.3 → next) + tag; deployah signs+publishes.
Separate from doyle's in-flight v0.7.4/counter-16 leg. Do NOT touch merge/release until
doyle pings operator-GO. Supersedes [[m11-w4-progress]].


Edit

- [M11-W4 progress](m11-w4-progress.md) —

- [M11 COMPLETE](m11-complete.md) — shell-substrate milestone done end-to-end (W1 consent · W2 drive · W3 tunnel-same-node · W4 gateway capstone · W5 rig+docs), all doyle GATE PASS. PR #16 @c5887db UNMERGED until the operator-gated M11 release (merge+bump+tag, doyle lines up GO). Cross-node tunnel DEFERRED. HOLDING for release ping
- [M11-W4 progress](m11-w4-progress.md) —