import os
os.chdir(r'C:\Users\decid\Documents\projects\spt-core\.worktrees\351-w0')

class F:
    def __init__(self, p):
        self.p = p
        raw = open(p, 'rb').read().decode('utf-8')
        self.crlf = '\r\n' in raw
        self.s = raw.replace('\r\n', '\n')
    def sub(self, a, b, n=1):
        c = self.s.count(a)
        assert c == n, (self.p, a[:80], c)
        self.s = self.s.replace(a, b)
    def save(self):
        out = self.s.replace('\n', '\r\n') if self.crlf else self.s
        open(self.p, 'wb').write(out.encode('utf-8'))

c = F('CONTEXT.md')
c.sub('''**instantiate-anywhere** (seam day-one, behavior deferred):
From node Y, spin up an instance of an endpoint on node X by routing a launch command to X's daemon, which runs the endpoint's manifest locally. "Agents can spin up instances (including of themselves) on any node, possibly requiring user consent" — so a **consent gate** governs remote instantiation. The consent-UX design is deferred; the model is built to accommodate it.
''', '''<!-- [doc->REQ-ENDPOINT-UID] -->
**endpoint uid** (INSTANCE-AXES W0, releases#354):
A random 128-bit value that tells two endpoints with the same name apart. It is minted where the endpoint is **hosted** (at creation, or at the first bind of this version for an endpoint that predates it), stored in the tracked mind as the `endpoint-uid` file on the `a-<id>` branch so it replicates with the mind, cached in `info.json`, and carried on every registry row the endpoint advertises. A node that only holds the replicated mind never mints one. A rename carries it; a fork is a new identity and mints a new one. The uid **identifies, never authenticates**: it is not a secret, and nothing is allowed because a request names it.

<!-- [doc->REQ-SIBLING-JOIN] -->
**sibling instance**:
Two registry rows for the same id on different nodes are **siblings** — instances of ONE endpoint — when both carry the endpoint uid and the uids are equal. A different uid, or an absent uid on either side, is still a name clash and still collides (REQ-INST-9). Siblings coexist in a subnet across every advertise round.

<!-- [doc->REQ-ENDPOINT-SPAN-VERB] -->
**span** (`spt endpoint span <id> [--node <NODE>] [--adapter <A>]`):
The only way a sibling is born: bring up an instance of an EXISTING endpoint on this node or on `NODE`. It is **not a create verb** — it refuses unless the target node holds the endpoint's replicated mind with its uid (`SPAN_NO_MIND`), refuses when an instance is already there (`SPAN_ALREADY_HERE`), and refuses when no other node advertises that uid (`SPAN_NO_ENDPOINT`). The new instance lands **dormant** when a sibling is active. The remote arm is answered by the target node, and **no reply is never success** (`SPAN_UNCONFIRMED`). Every other local bring-up that would mint a perch for an id another node holds (Offline rows included) refuses with `HELD_ELSEWHERE` and names `spt endpoint span <id>`: nothing makes a sibling implicitly. The picker's **Span to node** option runs the same verb.

<!-- [doc->REQ-ENDPOINT-SPAN-SURFACE] -->
**`ENDPOINT_SPAN` surface**:
Spanning to a node is gated on the TARGET node by one open-vocabulary surface row, not default-on, evaluated under the standard chain with the **spanned endpoint id as the rule target**. A per-endpoint rule says "endpoint X may (or may not) span to this node"; node and subnet subjects cover every endpoint of a node or subnet. A closed node with no rule cannot be spanned to from another node; a span run on the target node itself is blocked only by a rule. **Trust boundary (R4-6):** a node that holds the mind of an endpoint may become its sibling — holding the mind is already the trust the uid rides on, and `ENDPOINT_SPAN` is where an operator narrows it.

<!-- [doc->REQ-SIBLING-BYPASS] -->
**sibling bypass**:
Traffic between siblings bypasses the access rules. Inside the one access-chain body, AFTER the engine-room inbound lock (which still refuses) and before every rule tier, a request whose daemon-stamped sender is the target id itself, from a node whose registry row for that id carries the SAME uid as the local instance, is allowed and reported as a sibling allow. A different or absent uid is never bypassed. A surface whose wire carries no stamped sender is not reached by the bypass until its wire stamps one.

**instantiate-anywhere** (seam day-one, behavior deferred):
From node Y, spin up an instance of an endpoint on node X by routing a launch command to X's daemon, which runs the endpoint's manifest locally. "Agents can spin up instances (including of themselves) on any node, possibly requiring user consent" — so a **consent gate** governs remote instantiation. **Amended 2026-09-26 (releases#354):** a same-identity instance on a new node is a **span**, gated by `ENDPOINT_SPAN` on the target node; what stays deferred is a fresh spawn requested by another node's AGENT, and its consent UX.
''')
c.save()

o = F('docs-site/src/instances/overview.md')
o.sub('''## Startup defaults (`endpoint auto-start`)
''', '''## Spanning an endpoint to another node (`endpoint span`)

<!-- [doc->REQ-ENDPOINT-SPAN-VERB] -->
An **instance** of an endpoint on a second node is born one way:
`spt endpoint span <id> [--node <NODE>]`. Span is **not a create verb**. It
brings up another seat of an endpoint that already exists, and it refuses
anything else:

- the target node must already hold the endpoint's **mind**, with its
  **endpoint uid** (the mind replicates to members of the endpoint's subnet) —
  otherwise `SPAN_NO_MIND`;
- an instance already on that node — `SPAN_ALREADY_HERE`;
- no other node advertising that uid — `SPAN_NO_ENDPOINT`.

<!-- [doc->REQ-ENDPOINT-UID] -->
The **endpoint uid** is what makes this safe. Two endpoints can share a name;
their uids differ. A registry row for `sergey` on another node joins as a
**sibling** only when it carries the same uid, and a different or missing uid
still collides as a name clash. The uid identifies — it is not a secret and
authenticates nothing.

<!-- [doc->REQ-SIBLING-JOIN] -->
Siblings coexist in one subnet round after round. A new instance lands
**dormant** when a sibling is already active, so it never competes for your
input until something activates it.

Any other bring-up that would mint a perch for an id another node holds —
`endpoint create`, `endpoint run`, a first bind — refuses with
`HELD_ELSEWHERE` and names `spt endpoint span <id>`. Nothing makes a sibling
by accident. In the picker, **Span to node** on any endpoint row lists the
nodes that can take an instance and runs the same verb.

<!-- [doc->REQ-ENDPOINT-SPAN-SURFACE] -->
### Who may span to a node

The **target** node decides, under its `ENDPOINT_SPAN` surface, with the
spanned endpoint as the rule target. The surface is **not default-on**: a node
with no rule cannot be spanned to from another node, and says nothing back —
the requester prints `SPAN_UNCONFIRMED`, because no reply is never success.
Open it per endpoint or for a whole node or subnet with `spt access`. A span
run on the target node itself is blocked only by a rule.

<!-- [doc->REQ-SIBLING-BYPASS] -->
Once two siblings exist, traffic between them bypasses the access rules (the
engine-room lock still applies): a request whose stamped sender is the endpoint
itself, from a node whose row carries the same uid, is a sibling allow.

## Startup defaults (`endpoint auto-start`)
''')
o.sub('''`endpoint create` · `endpoint start` · `endpoint resume` ·''', '''`endpoint create` · `endpoint start` · `endpoint resume` · `endpoint span` ·''')
o.sub('''*Cold-launching an endpoint on a node that has no instance
("instantiate-anywhere") is deliberately deferred behind the consent
framework; the gate exists and refuses today.*''', '''*A fresh spawn requested by another node's agent ("instantiate-anywhere")
is deliberately deferred behind the consent framework. Bringing up another
instance of an endpoint you hold is `endpoint span`, above.*''')
o.save()
print('ok')