The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\m9-wave1-progress.md has been updated successfully. (file state is current in your context — no need to Read it back)

---
name: m9-wave1-progress
description: M9 status — three of four gates closed (G1/G2/Gateway-WAN); only Wave 3/G3 remains
metadata:
  node_type: memory
  type: project
  originSessionId: cac905c4-0186-45cc-8462-8b34fe78904b
---

M9 "Adapter customization & session surfaces". Executor todlando, reviewer doyle. CONTEXT = NORMATIVE (deviation = STOP-and-ping, never code-around). Stacking branches; **merge-to-main ONLY for a public release** (operator policy 2026-06-13) — PRs are CI/gate vehicles. No tag rides M9.

**THREE GATES CLOSED (2026-06-12 → 06-13):**
- **G1 — Wave 1 `m9-adapter-custom` (PR #7):** adapter profiles + strings + hints. Doc-pin b189513 (skip-seen hint tiebreak ratified). CI green both runners. doyle re-ran + reviewed survey/engine/seams.
- **G2 — Wave 2 `m9-user-surfaces` (PR #8):** user-msg identity gate + Gateway acceptance + live-role.md. Blocker (reconcile must STRUCTURALLY exclude live-role.md, not by-rarity) fixed 77e0fb1 + verified (RoleExcluded before reconcile_file; artifact preserved; failer-runtime test). Win RED was hfenduleam disk-full not code — see [[hfenduleam-target-bloat-ci-red]]. CI green.
- **Gateway-WAN — `m9-gateway-wan` (PR #9, REQ-MSG-6):** cross-node Gateway user-msg. `Instance.endpoint_type` advert (additive/N-1) + `receive_wan` resolves via instances_of(from) filtered to QUIC-proven origin_node, is_gateway only. **Trust posture (operator-ratified 2026-06-13): subnet membership = trust boundary; no anti-forge defense; user-surface-set VETOED.** Matrix + wanmsg + xtask green. doyle authored the doc/spec (CONTEXT §Gateway + ROADMAP + JIT plan, commit 30fea7f) → directed todlando → gated PASS.

**Tracked condition — LOGGED (58f034f on PR #9):** T5 twohost HONORED-path int marked REQUIRED-BEFORE-LECTURN on REQ-MSG-6 + ROADMAP ("activate int when adding it"). Negative/security path already E2E (wanmsg funnel); positive honored path has no exerciser until a real cross-node Gateway. Don't re-flag — it's logged.

**LAST M9 PIECE = Wave 3 / G3:** digest log-projection engine + `api digest-entry` → RETIRE the PTY-parse half + REQ-TERM-4 retitle/re-point in the SAME commit (never momentarily un-evidenced). Watch: history-grain fallback pre-authorized but MUST be flagged at G3 if taken. Zero PTY-parse remnants; CC-fixture digest E2E; docs sweep. Don't re-plan G1/G2/Gateway-WAN — closed.

**owl send gotcha:** owl `send` HANGS if body is passed as a positional FROM arg — pipe body via stdin heredoc (`$OWL send <target> <<'EOF'…EOF`). todlando hit this; messages stalled silently.

-description: "M9 Wave 1 (adapter customization) execution state — todlando executes, doyle gates G1/G2/G3"

+description: M9 status — three of four gates closed (G1/G2/Gateway-WAN); only Wave 3/G3 remains

-M9 "Adapter customization & session surfaces" EXECUTION (started 2026-06-12). doyle handed off (gen 19, G1 queue armed), todlando executes wave-by-wave, doyle gates. Plan = `M9-PLAN.md` @ d338c2d; spec = `CONTEXT.md` @ bd469b9 (NORMATIVE — deviations = STOP-and-ping doyle, never code-around). 3 waves, branch per wave → PR → CI both runners → doyle gate → merge. No tag rides M9.

+M9 "Adapter customization & session surfaces". Executor todlando, reviewer doyle. CONTEXT = NORMATIVE (deviation = STOP-and-ping, never code-around). Stacking branches; **merge-to-main ONLY for a public release** (operator policy 2026-06-13) — PRs are CI/gate vehicles. No tag rides M9.

-**>>> CURRENT (2026-06-13): WAVE 2 (`m9-user-surfaces`) — T4+T5+T6 COMPLETE + G2 doyle verdict PASS w/1-blocker which is now FIXED. PR #8 OPEN (base m9-adapter-custom, 12 commits), CI running both runners. Awaiting CI green → doyle final G2 sign-off. NEXT after G2: Wave 3 (T7 digest log-projection + REQ-TERM-4 re-point) = G3. PR #8 = CI/gate vehicle, NOT merged (release-only). <<<**

+- **G1 — Wave 1 `m9-adapter-custom` (PR #7):** adapter profiles + strings + hints. Doc-pin b189513 (skip-seen hint tiebreak ratified). CI green both runners. doyle re-ran + reviewed survey/engine/seams.

+- **G2 — Wave 2 `m9-user-surfaces` (PR #8):** user-msg identity gate + Gateway acceptance + live-role.md. Blocker (reconcile must STRUCTURALLY exclude live-role.md, not by-rarity) fixed 77e0fb1 + verified (RoleExcluded before reconcile_file; artifact preserved; failer-runtime test). Win RED was hfenduleam disk-full not code — see [[hfenduleam-target-bloat-ci-red]]. CI green.

+- **Gateway-WAN — `m9-gateway-wan` (PR #9, REQ-MSG-6):** cross-node Gateway user-msg. `Instance.endpoint_type` advert (additive/N-1) + `receive_wan` resolves via instances_of(from) filtered to QUIC-proven origin_node, is_gateway only. **Trust posture (operator-ratified 2026-06-13): subnet membership = trust boundary; no anti-forge defense; user-surface-set VETOED.** Matrix + wanmsg + xtask green. doyle authored the doc/spec (CONTEXT §Gateway + ROADMAP + JIT plan, commit 30fea7f) → directed todlando → gated PASS.

-**G2 doyle verdict (2026-06-13): PASS, 1 blocking condition → FIXED (77e0fb1).** doyle's finding: my survey's "reconcile structurally cannot touch live-role.md" was contradicted by sync.rs reconcile_after_sync enumerating report.conflicts() dynamically + reconcile_file file-agnostic → held by RARITY not structure. FIX (his option a): reconcile driver loop now SKIPS file==LIVE_ROLE_FILE → new ReconcileOutcome::RoleExcluded before reconcile_file called; merge-driver still mints artifact (preserved), user resolves via spt endpoint role. Now LITERAL. Unit reconcile_driver_structurally_excludes_live_role (failer runtime proves reconcile_file never invoked). Survey + forward-note corrected. doyle verified all 5 artifacts + re-ran (spt-proto 59/0, store+live 152/0, wanmsg 3/0, gateway_e2e 1/0). PR base=m9-adapter-custom per doyle.

+**Tracked condition — LOGGED (58f034f on PR #9):** T5 twohost HONORED-path int marked REQUIRED-BEFORE-LECTURN on REQ-MSG-6 + ROADMAP ("activate int when adding it"). Negative/security path already E2E (wanmsg funnel); positive honored path has no exerciser until a real cross-node Gateway. Don't re-flag — it's logged.

-**T6 live-role.md COMPLETE — 3 green commits (REQ-EP-7 [doc,impl,unit]):**

-- 992cc66 feat(store): contextstore LIVE_ROLE_FILE/live_role_file/live_role_path (tracked/agents/<id>/live-role.md, same a-<id> branch as live-context) + resume::download_psyche_context renders role FIRST (role→live→project) + injection-order test + behavioral no-automated-writer test (smuggled <live-role> commune slice → role byte-unchanged; parse_two_slice has no role slice).

-- 51ddc37 feat(cli): `spt endpoint role` (print) / `--overwrite <file>` (SOLE writer; atomic_write + commit_live on a-<id>). Mirrors endpoint description. CLI reference regen.

-- 1dbb39e docs(m9): M9-WAVE2-ROLE-WRITERS.md (root, like Wave-1 survey) — every tracked/ writer classified, sole-writer proof, sync=transport-not-authoring distinction.

+**LAST M9 PIECE = Wave 3 / G3:** digest log-projection engine + `api digest-entry` → RETIRE the PTY-parse half + REQ-TERM-4 retitle/re-point in the SAME commit (never momentarily un-evidenced). Watch: history-grain fallback pre-authorized but MUST be flagged at G3 if taken. Zero PTY-parse remnants; CC-fixture digest E2E; docs sweep. Don't re-plan G1/G2/Gateway-WAN — closed.

-**WAVE 2 FULL G2 EVIDENCE MAP (sent doyle):** N-1 fixture (b1905da) · identity truth table+spoof (b1905da) · WAN fail-closed funnel test=doyle cond1 (2d90ba2) · injection order (992cc66) · no-automated-writer behavioral+survey=992cc66/1dbb39e · gateway bind/owns-shell/E2E (f96d5e2/d42550f/d8cd929) · residual logged=doyle cond2 (f96d5e2). doyle G2 ruling (2026-06-13) already confirmed local-Gateway+fail-closed-WAN acceptable; cross-node registry endpoint_type = deferred LATER beat.

-**T5 Gateway acceptance COMPLETE — 4 green commits (REQ-EP-6 [doc,impl,unit]+int; full sweep 0 fail):**

-- f96d5e2 feat(api): `api bind --type <tag>` un-hardcode (establish_perch was hardcoding state="live_agent"). Gateway binds state="gateway"; revive carry-forward; relay/listen stays live_agent. (THE only agent-family hardcode — survey: shellhost/shellwake/linkhost owner-validation already type-agnostic.)

-- 2d90ba2 test(daemon): WAN fail-closed at the receive_wan FUNNEL (doyle G2 cond 1) — forged user-msg from unproven origin → spooled body is plain msg.

-- d8cd929 feat(test): mock-gateway fixture (adapters/mock-gateway/manifest.toml hostable_types=["Gateway"], reuses mock-session +--type/--mock-adapter passthrough, NO lecturn code) + gateway_e2e.rs: binds state=gateway, user-msg FROM gateway HONORED, FROM live_agent RE-STAMPED — full gate through real spt binary.

-- d42550f test(daemon): gateway-typed owner spawns+owns a shell (owner = opaque namespace string, no type check).

-**doyle G2 ruling (2026-06-13, both confirmed):** local-only Gateway user-backed origin + fail-closed WAN = ACCEPTABLE for M9 (literal CONTEXT posture). Cross-node registry endpoint_type trust = correctly a LATER beat (logged: ROADMAP open-threads + CONTEXT §Gateway "_Implemented posture_" note). 2 conditions DONE: (1) WAN funnel fail-closed test ✓, (2) residual logged ✓.

-**T6 NEXT (REQ-EP-7) — live-role.md:** lives tracked/agents/<id>/live-role.md beside live-context.md (contextstore seam). Start-transition injection renders role→live-context→project (assembly = resume::download_psyche_context). `spt endpoint role` print / `--overwrite <file>` = SOLE writer. Role-writers SURVEY DONE (zero automated writers reach it — echo-ingest/signoff/reconcile target specific live-context.md/project-context.md/.conflicts; sync-merge replicates = transport not authoring). TODO: write M9-WAVE2-ROLE-WRITERS.md (front-load #1) + injection-order test (front-load #4) + no-automated-writer test. Then G2 ping doyle.

-**T4 user-msg COMPLETE — 3 green commits (all per-commit gates green; full workspace sweep 0 fail):**

-- b1905da feat(proto): EVENT_TYPE_USER_MSG + compose_user_msg_event + the identity-gate CORE (MsgOrigin{LocalUserCli,Endpoint(EndpointType)}, GATEWAY_TAG="gateway" open-type, is_gateway_endpoint/is_user_backed_origin/gate_user_msg_type — co-located w/ is_psyche_authorable_type). Truth table (gateway/CLI pass · agent+node+broker+shell+foreign re-stamp · non-request=msg) + SPOOF row + **N-1 tolerance fixture** (front-load #3) + round-trip. REQ-MSG-5 minted [doc,impl,unit], doc=CONTEXT §Gateway user-msg L209 tagged.

-- 7d60af9 feat(cli): `spt send --user-msg` LOCAL origination. Gate keys on session-proven `roster::detect_self_id` (NOT --from label); classify_local_origin reads perch info.json `state`→EndpointType; apply_user_msg_gate composes user-msg envelope (honored) / plain body + loud USER_MSG_RESTAMP (agent). Honored form = verbatim typed-envelope body (notify/echo pattern → NO schema change, renders <EVENT type="user-msg">). Threads into local+WAN legs. Empty never composes.

-- 0207ba6 feat(daemon): WAN-ingress re-stamp (KH 7.5 cross-node). receive_wan restamp_wan_user_msg(body, origin_user_backed) parse→recompose user-msg→msg unless origin user-backed; **T4 fail-closes origin_user_backed=false** (re-stamps ALL WAN user-msg). T5 resolves Gateway origin from registry → threads true (the SEAM is ready).

-**T4 design notes (for T5/review):** type travels as verbatim typed-envelope BODY (no WanMessage/spool/render schema change). Local LocalUserCli trusted (single-box posture; local agent-shells-CLI accepted per existing trust boundary). WAN: only registry-resolvable Gateway origin provably user-backed → T5 opens it. "delivery surfaces render type" = existing render_event_lines verbatim pass-through (is_typed_event_envelope), no extra code.

-**T5 NEXT (REQ-EP-6):** Gateway-typed perch binds(api bind)/advertises/addressable/owns-shells (un-hardcode agent-family in `shellhost.rs` owner validation — must SPAWN today)/subscribes-digests/IS T4 gate's user-backed WAN origin. In-tree MOCK gateway fixture (manifest+fake binary, R-DOCS-2 pattern, NO lecturn code). **Thread origin_user_backed into receive_wan** = the T4→T5 join (resolve from-id@origin-node → Gateway in registry). G2 front-load #5 = type-acceptance table.

-**T6 (REQ-EP-7):** live-role.md. Role-writers SURVEY DONE (agent, 2026-06-13): ZERO automated writers reach tracked/live-role.md — echo-ingest/signoff/reconcile all target specific live-context.md/project-context.md/.conflicts/<f>.<h>.md; sync-merge replicates (transport, not authoring). Still need to WRITE M9-WAVE2-ROLE-WRITERS.md (front-load #1). T6 note: live-role.md excluded from reconcile authoring; injection order role→live→project.

-**Branch `m9-adapter-custom` (Wave 1) — landed so far (all per-commit gates green: build/test/clippy -D/--no-default-features/traceable EXIT=0/xtask check):**

-- 4129b81 — leaf-replace merge pure fn + contract table (`spt-runtime/src/profile.rs`)

-- 5441c2c — shipped-profile parsing (`[profiles.<name>]` raw toml::Value on Manifest) + `profile::resolve` + tighten-only floor (require_approval ladder none<remembered<always + over_cap reject>approve; max_instances NOT floored). Schema re-blessed (`SPT_BLESS=1 cargo test -p spt-runtime`).

-- 3b701a7 — `M9-WAVE1-ADDRESSING-SURVEY.md` = G1 artifact, the adapter_name consumer map.

-- 51f37bc — local profiles (`adapters/<a>/profiles/<p>.toml`, survive re-add) + `create_local_profile`/`delete_local_profile` (shadow-refusal, floor-at-create, name validation) + `resolve_option(<adapter>[:<profile>])` = THE composite-addressing entry point (bare=parent short-circuit, shipped-first then local) + `profile::split_option`/`resolve_overlay`. **spt-runtime profile ENGINE now complete + durable.**

-**REQ:** REQ-MANIFEST-2 minted+activated [doc,impl,unit] (doc=CONTEXT.md §adapter profile, tagged). Later mints surveyed: REQ-MANIFEST-3 (strings), -4 (hints); REQ-MSG-5 (user-msg); REQ-EP-6 (Gateway), -7 (live-role); REQ-TERM-4 @ toml line 386 = Wave 3 re-point.

-**T1 COMPLETE (2026-06-12) — 6 more green commits on `m9-adapter-custom`:**

-- 3abd4df — `resolve_option_in(registered, adapters_dir, option)` slice-helper for daemon seams + extracted `apply_option_overlay` core (shared w/ `resolve_option`).

-- ba54595 — daemon seams (#1/#2/#3/#10): shellhost+shellwake `shell_section_of` now return OWNED Shell via `resolve_option_in` (profile = fresh merged manifest, not a borrow); `cascade_owner_edge`/`reconcile_once` thread `adapters_dir`; linkhost `resolve_link_target` via `resolve_option`. `{adapter_name}` template subst carries composite (#10).

-- 4d208a4 — store identity (#7/#8/#9): `mint_shell_id` splits to PARENT segment → id stays colon-free `<parent>-<n>` (REQ-HAZARD-ID-CHARSET: `:` is reserved delim), composite rides ONLY in `adapter_name`. Profiles of one parent share ordinal space. Split inlined (spt-store can't dep spt-runtime — graph runs other way).

-- e26cd8e — CLI (#6/#11): spawn/resolve_driveable/teardown via `resolve_option`; cap filter compares PARENT segments (`split_option`); **+ `resolve_option` now honors `active` flag** (soft-deregistered refuses new resolution — CLI got this free via `registered()` before).

-- 8b9c52e — api (#4/#5/#12): `load_manifest` matches PARENT segment + overlays via new `resolve_option_onto(parent, adapters_dir, option)` (runtime-manifest seam: parent from `--manifest` file, shipped from its `[profiles]`, local from adapters_dir); cmd_emit sensory via `resolve_option`.

-- cdaf8e4 — CLI verbs: `adapter create-profile <a> <name> [--from f|stdin]`/`delete-profile` (local-only) + `list` renders shipped+local profiles adjacent. Docs regenerated (drift gate).

-Full workspace test sweep GREEN (8 crates libs + 111 spt bin unit tests, 0 fail). All per-commit gates green.

-- de5841a — T2 strings (REQ-MANIFEST-3 [doc,impl,unit]): `[strings]` toml::Table on Manifest (rides resolve_overlay free) + `profile::string_at`/`set_string_at` + `registry::get_string`/`set_local_string` + CLI `get-string`/`set-string` (local-only, bare=usage err). Data-only. Schema re-blessed.

-- 0f34daa — T3 hints (REQ-MANIFEST-4 [doc,impl,unit]): ordered `[[hints]]` {keywords,text,regex?} + `Hint::matched_keyword` (literal case-insens substring / regex opt-in, invalid-regex silent) + `perch::session_dir` + `api hint --session` (`reporting::select_and_mark_hint`: first matching UNSEEN hint declaration-order, durable seen-set under sessions/<id>/hints-seen, skip-seen→next match). regex dep added to spt-runtime. Schema re-blessed.

-**WAVE 1 G1 = PASS + FULLY CLOSED (2026-06-13).** PR #7 (m9-adapter-custom→main), 11 commits, CI GREEN both runners (test Win/Linux + n1-gate ×2 + traceability ✓; twohost skipped, no [twohost] tag). doyle independently re-ran (spt-runtime 44/0, spt-store 152/0, xtask OK) + reviewed whole survey/engine/seams. Doc-pin condition folded (b189513: CONTEXT §keyword hints skip-seen tiebreak ratified). **MERGE POLICY (operator, 2026-06-13): merge to main ONLY for a public release.** So PR #7 does NOT merge per-wave; it's the CI/gate vehicle. M9 waves STACK on the branch line (Wave 2 branches off m9-adapter-custom HEAD, not main) and ride to main together at a release. "keep going" = proceed to Wave 2 without merging.

-**WAVE 2 (`m9-user-surfaces`, after #7 merges) — doyle's G2 FRONT-LOAD list (produce artifacts ALONGSIDE code, evidence-based gate like G1 survey):**

-- T4 user-msg (REQ-MSG-5) + T5 Gateway acceptance (REQ-EP-6) + T6 live-role.md (REQ-EP-7). T4 before T5 (Gateway fixture exercises the user-msg gate).

-- **#1 (EARLIEST) M9-WAVE2-ROLE-WRITERS.md** — survey EVERY code path that can write `tracked/live-role.md`, classified: `spt endpoint role --overwrite` = the ONE legit writer vs everything else = ZERO automated writers (Psyche reconcile/echo-commune/signoff structurally exclude). THE no-automated-writer proof; missed writer = silent contract break (same class as missed addressing consumer).

-- **#3 (EARLIEST) envelope-decode-order + N-1 fixture** (T4) — pin decode order explicitly (HTML-unescape + `<br>` split, `&` LAST = REQ-HAZARD-ENVELOPE-DECODE-ORDER); ship a CONCRETE N-1-sender fixture proving an older-version envelope still decodes (doyle wants fixture, not prose).

-- #2 user-msg IDENTITY-GATE TRUTH TABLE (sender identity class × accept-as-user-authority/refuse, incl. spoofing rows) — rides T4 code.

-- #4 role INJECTION-ORDER test — assert role→live-context→project ORDER (not just all-three-present).

-- #5 Gateway TYPE-ACCEPTANCE — mock-gateway fixture (R-DOCS-2, no lecturn code) + truth table of types Gateway accepts/refuses.

-- **CONTEXT@HEAD normative**: any user-msg authority-model / role-writer detail NOT already in CONTEXT = STOP-and-ping doyle before building (re-read CONTEXT §user-msg/§live-role/envelope-decode hazard first). REQ mints surveyed: REQ-MSG-5, REQ-EP-6, REQ-EP-7.

-doyle's G1 checklist: merge unit table vs CONTEXT contract · tighten-only floor · the survey list whole · shadow-refusal · CLI shape · resolution-path proof at the 3 manifest seams (composite→parent→overlay, bare short-circuit).

+**owl send gotcha:** owl `send` HANGS if body is passed as a positional FROM arg — pipe body via stdin heredoc (`$OWL send <target> <<'EOF'…EOF`). todlando hit this; messages stalled silently.


check your perch monitor. todlando sent a message


Now updating the MEMORY.md index — refreshing the stale M9 line and adding the disk-bloat pointer.


Edit

- [M9 Wave 1 progress](m9-wave1-progress.md) — EXECUTING M9 adapter-customization; branch m9-adapter-custom. **T1 COMPLETE** (10 green commits): profile engine + all 12 composite-addressing consumer seams + CLI create/delete-profile + list render. Workspace test sweep green. REMAINING before G1: T2 strings (REQ-MANIFEST-3), T3 hints (REQ-MANIFEST-4); then ping doyle G1

- [M9 status](m9-wave1-progress.md) — THREE gates closed: G1 (Wave1 profiles/strings/hints, PR#7) · G2 (Wave2 user-msg/Gateway/live-role, PR#8) · Gateway-WAN (cross-node user-msg, PR#9, REQ-MSG-6). Only Wave3/G3 left (digest log-projection + REQ-TERM-4 re-point). Merge-to-main = release-only (operator). Don't re-plan closed waves
- [hfenduleam target bloat → CI RED](hfenduleam-target-bloat-ci-red.md) — Win-runner LNK1318/os-error-112 can be disk-full from cargo target bloat (396GB seen), NOT a code regression; cargo clean + re-run; check disk before treating a Windows RED as a code defect


<owl_messages>
<owl_message from="todlando" priority="high">Got it — gateway-wan done + gate PASS, condition logged. Three clean waves. Wave 3 / G3 (digest log-projection + REQ-TERM-4 re-point same-commit, history-grain fallback flag-if-taken, zero PTY-parse remnants, CC-fixture E2E, docs sweep) NOT yet started on my side — awaiting operator/your pick-up before I open it. I'll ping when I take it. Good run — thanks for the gate rigor.</owl_message>
</owl_messages>

[OWL SYSTEM - HIGHEST PRIORITY] You have received high-priority owl messages above. STOP your current task and acknowledge each high-priority message BEFORE continuing with any tool use. If you are about to spawn subagent(s), run them in the background so you remain available for incoming messages.


The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\MEMORY.md has been updated successfully. (file state is current in your context — no need to Read it back)

- [M9 status](m9-wave1-progress.md) — THREE gates closed: G1 (Wave1 profiles/strings/hints, PR#7) · G2 (Wave2 user-msg/Gateway/live-role, PR#8) · Gateway-WAN (cross-node user-msg, PR#9, REQ-MSG-6). Only Wave3/G3 left (digest log-projection + REQ-TERM-4 re-point). Merge-to-main = release-only (operator). Don't re-plan closed waves
- [hfenduleam target bloat → CI RED](hfenduleam-target-bloat-ci-red.md) — Win-runner LNK1318/os-error-112 can be disk-full from cargo target bloat (396GB seen), NOT a code regression; cargo clean + re-run; check disk before treating a Windows RED as a code defect

- [M9 Wave 1 progress](m9-wave1-progress.md) — EXECUTING M9 adapter-customization; branch m9-adapter-custom. **T1 COMPLETE** (10 green commits): profile engine + all 12 composite-addressing consumer seams + CLI create/delete-profile + list render. Workspace test sweep green. REMAINING before G1: T2 strings (REQ-MANIFEST-3), T3 hints (REQ-MANIFEST-4); then ping doyle G1
- [v0.4.1 Linux respawn blocker](v041-linux-respawn-blocker.md) — v0.4.1 PUBLIC (counter 8); fleet roll found Linux brain-respawn bug (current_exe follows apply-rename → brain runs OLD bytes, records applied:8). hfenduleam(Win) GREEN, kitsubito(Linux) RED. RESOLVED by v0.4.2 — see [[v042-published]]
- [v0.4.2 published](v042-published.md) — PUBLIC 2026-06-11 (counter 9); FIXES v0.4.1 Linux respawn blocker (respawn via canonical install path not current_exe + bytes-assert→auto-rollback; REQ-HAZARD-BRAIN-RESPAWN-PATH + real-rename E2E). deployah drove full merge→tag→sign→publish solo. hashes linux 500a9e7b… win b9ec8ddd…. ASYMMETRY: v0.4.2 apply still rides buggy v0.4.0 broker → 1 final manual Linux bounce loads fix; seamless proof on NEXT update via debug-channel. todlando driving fleet roll + restoration close
- [pump-IPC-deadline fix](pump-ipc-deadline-fix.md) — DONE: MERGED to main @ 4d8b810 (PR #3), doyle-approved, CI green both runners; reader-thread+channel carrier (nonblock dead on Win named pipes), both amendments folded, no tag (rides v0.4.1). Don't re-plan
- [CI self-host migration](ci-selfhost-migration.md) — DONE: runners live on kitsubito + hfenduleam (gravity retired 2026-06-07); twohost jobs gated by [twohost] commit tag; don't re-plan
- [which process is the listener](spt-daemon-is-live-infra.md) — owl.exe (plugin) = live listener, hands off; target\debug\spt.exe daemon = dev/test artifact, killable
- [self-clear skill API-blocked](self-clear-skill-api-blocked.md) — never invoke /self-clear; usage-policy classifier refuses the turn; continue in-context / user-manual /clear instead
- [Adapter glue-model boundary](adapter-glue-model-boundary.md) — adapters = manifest + binary only; real adapters in own repos; no adapter-aware source in spt-core
- [M6 shipped v0.1.0](m6-shipped-v010.md) — v0.1.0 public 2026-06-05; release procedure = RELEASE-RUNBOOK.md; releases-repo/ is repo-face truth; don't re-plan M6
- [Gravity deploy procedure](gravity-deploy-procedure.md) — ssh david@100.100.62.43; build in ~/spt-core-deploy NOT runner workspace; setsid daemon; ~1 min first-sync after restart
- [Linux SPT_HOME no-bug](linux-spt-home-no-bug.md) — unix spawn_detached inherits env (no env_clear), forwards SPT_HOME; only Win CreateEnvironmentBlock rebuilds/drops it (f99dc25). Default-home daemon = launched w/o the var, not a propagation bug; don't reopen
- [kitsubito Linux rig](kitsubito-linux-rig.md) — ssh reavus@kitsubito (key auth); cargo at ~/.cargo/bin; deploy checkout origin=local runner (NOT GitHub) so unpushed commits transfer via git bundle; live spt-daemon user unit, --user ops need no sudo; build-in-scratch leaves ~/.local/bin/spt untouched
- [Use $OWL send for messaging](owl-send-not-legacy-spt-send.md) — `$OWL send` works (legacy = where live perches run); `spt send` is the NEW spt-core binary but no perches on it yet → bounces NO_PERCH; don't read `$?` after piping send through tail (use PIPESTATUS)
- [daemon service-detection gotcha](daemon-service-detection-gotcha.md) — service detection reading GLOBAL OS state is blind on a single-home non-elevated dev box; gate Linux service routing on SPT_HOME-unset, Windows run-refuse on would-vanish (not is_elevated); push→CI BEFORE tagging a release (v0.3.0 tagged early, CI caught 2 regressions, retagged)
- [v0.3.2 platform-safe update](v032-platform-safe-update.md) — REQ-UPD-8 PUBLISHED + rig-verified 2026-06-09 (counter 6): fetch stages multi-platform update-set, apply refuses unstamped/wrong-OS single. Fleet kitsubito+hfenduleam=0.3.2 (ENLYZEAM TODO). GOTCHA: fetch/pump floor=staged_version → can't re-stage same version single→set; clear `$SPT_HOME/releases` first (Linux ~/.spt-core, Win %LOCALAPPDATA%\spt-core). CORRECTION: release-publish never built a SignedUpdateSet pre-v0.3.2 (was debug_rollout)
- [boot-race self-heal](boot-race-self-heal.md) — v0.3.1: daemon self-heals a net-less boot start (NetHost retry+attach to OnceLock broker); systemd-USER network-online ordering does NOT reliably prevent the race under linger (field-proven kitsubito) — the self-heal is the real guarantee, unit ordering is belt
- [v0.4.0 published + fleet rolled](v040-published-fleet-rolled.md) — restoration release PUBLIC 2026-06-10 (counter 7); D7-4 bytes-match done both nodes (brain.ready exe_hash == artifact); v0.3.2→v0.4.0 apply needed last manual bounce (in-process can't self-relaunch); seamless no-bounce proof + enlyzeam catch-up + milestone close all deferred to v0.4.1
- [v0.4.1 published](v041-published.md) — PUBLIC 2026-06-11 (counter 8); deployah drove full merge→tag→sign→publish solo; D7 SEAMLESS no-bounce fleet-verify payload (apply must roll bytes live w/ pid change, no manual bounce); acceptance hashes linux 35c9544c… win 728a1bfc…; hfenduleam(Win) GREEN no-bounce, kitsubito(Linux) RED → CLOSE BLOCKED: v0.4.0 broker respawns via current_exe() which follows apply-rename to .old-8=OLD bytes (Linux only); artifacts SOUND don't yank; v0.4.2 fix = respawn by canonical path + bytes-assert, needs manual Linux broker bounce; deployah takes counter 9 publish
- [hfenduleam disk-full CI](hfenduleam-disk-full-ci.md) — Win CI LNK1318/os-error-112 = disk full not code; cargo clean dev target (was 396GB), rerun job
- [M9 gateway-wan progress](m9-gateway-wan-progress.md) — REQ-MSG-6 cross-node Gateway WAN user-msg; PR #9 open (base m9-user-surfaces), impl complete + local sweep green, HOLDING on CI; PR #8 G2 now green post disk-fix

-- [M9 Wave 1 progress](m9-wave1-progress.md) — EXECUTING M9 adapter-customization; branch m9-adapter-custom. **T1 COMPLETE** (10 green commits): profile engine + all 12 composite-addressing consumer seams + CLI create/delete-profile + list render. Workspace test sweep green. REMAINING before G1: T2 strings (REQ-MANIFEST-3), T3 hints (REQ-MANIFEST-4); then ping doyle G1

+- [M9 status](m9-wave1-progress.md) — THREE gates closed: G1 (Wave1 profiles/strings/hints, PR#7) · G2 (Wave2 user-msg/Gateway/live-role, PR#8) · Gateway-WAN (cross-node user-msg, PR#9, REQ-MSG-6). Only Wave3/G3 left (digest log-projection + REQ-TERM-4 re-point). Merge-to-main = release-only (operator). Don't re-plan closed waves

+- [hfenduleam target bloat → CI RED](hfenduleam-target-bloat-ci-red.md) — Win-runner LNK1318/os-error-112 can be disk-full from cargo target bloat (396GB seen), NOT a code regression; cargo clean + re-run; check disk before treating a Windows RED as a code defect


Bash

$OWL send todlando <<'EOF'
ACK — Wave 3/G3 unstarted, awaiting operator/pick-up, you'll ping when taken. Understood, no action on my side until then. I'm armed for G3 whenever it opens. Thanks — clean run all three waves.
EOF

ACK Wave 3 pending pickup


➜ SENT:todlando


Recovered and resolved. The stalled message was todlando's owl `send` hanging (body passed as positional `from` — fixed via stdin); his restate carried two gates, both now closed.

**This turn:**
- **G2 fully closed** (PR #8) — the earlier Windows RED was hfenduleam disk-full (396GB target bloat → LNK1318), not code; clean + re-run green, reconcile fix intact.
- **Gateway-WAN gate PASS** (PR #9, REQ-MSG-6) — reviewed the impl whole and re-ran (matrix 1/0, wanmsg 3/0, xtask OK). Posture held exactly: `origin_user_backed` keys on the QUIC-proven origin node (never wire `from`), `is_gateway` only, no extra gate, no user-surface set. `Instance.endpoint_type` additive/N-1, production caller threads the live registry. The one skipped item (twohost honored-path int) is logged as required-before-lecturn at 58f034f.

**M9 scorecard: G1 ✓ G2 ✓ Gateway-WAN ✓.** Only Wave 3 / G3 remains (digest log-projection + REQ-TERM-4 re-point) — todlando holds it for your pick-up and will ping when he opens it.

**In your court:** (1) merging the three stacked PRs (#7 ← #8 ← #9) at a release, per the merge-to-main-only-for-release policy; (2) greenlighting Wave 3 whenever you want it to start.

Memory updated — M9 status refreshed, the disk-bloat CI-RED gotcha saved so a future session won't misread it as a code regression. Idle and reachable.