First launch on an alt profile SETS ITSELF UP: a launch whose account root is MISSING runs the one-shot `alt init` itself and proceeds, and the account name defaults to "alt" — the user is never asked to run a binary command. Request BigscreenVR/claude-spt-bs#15 (requester discord:reavo, 2026-08-22): v0.29.0 shipped `claude-spt alt init <account>` as a user-facing setup step, but a user launching the shipped `claude-spt:alt` profile has no straightforward path to the `claude-spt` binary (it lives in the adapter dir, not on PATH), so asking them to run it is unacceptable — setup must happen automatically on the first launch of an endpoint via the alt profile. THE FAST PATH IS PRESERVED, which is what keeps this compatible with the ADR-0010 rejection of per-launch maintenance (the ccs cost this feature exists to remove): init runs at launch in EXACTLY ONE case, Preflight::MissingRoot — every launch after the first pays only the preflight stat it already paid. A FAILED auto-init fails the launch loudly and names `claude-spt alt init <account>` as the manual repair (the observation is reported, not a diagnosis); a successful one falls through to the normal credential preflight, so the first launch ends at Claude Code's own login prompt exactly as v0.29.0 documented. The default account name "alt" is a shared constant with the shipped profile's literal `--account alt`, so `alt init` bare and the profile agree by construction. The manifest is UNCHANGED — the shipped profile already bakes `--account alt` into every role's command; what this removes is the human step, not a profile knob.
       The plugin reconcile is VERIFY-THEN-NOTIFY (the documented [update.post] pattern; the 2026-07-16 fresh-install incident proved exit codes alone lie): after the marketplace/plugin steps, post-update RE-READS installed_plugins.json and asserts sptc@cplugs is present — claude-primary verification failure is LOUD stderr + exit nonzero with an empty stdout (no happy notice can fire); verified success prints the ✔-VERIFIED custom stdout notice (custom supersedes the static [update].message); the static [update].message is reworded failure-aware because core's emit_fallback fires it even after a failed post-step (deliberate, documented core design — NOT a core bug; doyle classification 2026-07-16). ccs-primary trees are per-account and unverifiable from this process — they keep the sentinel/static path rather than a false FAIL.
       Perched sessions are steered to BACKGROUND long-running work so the perch stays reachable — the spt reachability notice, ported from legacy owl's <owl_reachability_notice> (sibling claude_skill_owl hook_prompt.rs + hook_check.rs) and renamed to spt semantics (<spt_reachability_notice>, 'active spt perch'). Two injection sites, both perch-gated (a plain CC session is never told it has a perch): (1) UserPromptSubmit — EVERY perched turn's additionalContext closes with the general notice ('when spawning subagents or running long tasks, use run_in_background: true so you stay reachable for incoming messages'), appended AFTER any skill injection + drained messages (a notice never displaces a delivery); (2) PreToolUse — when the tool about to run is a subagent spawn (tool_name Agent, or its older payload name Task — matched both ways so a CC rename in either direction keeps the nudge alive), the targeted launch-this-in-background nudge rides the same emit, messages first, nudge last, and emits EVEN when the drain is empty (the point is catching the foreground spawn before it happens); and (3) PreToolUse — when the tool is `Bash`, `run_in_background` is not true, and the call is LONG-RUNNING by its own declaration (an explicit `timeout` of 60s or more) or by command shape (cargo, npm/pnpm/yarn, gh, pytest/jest, make, cmake, docker, sleep, `find`, `rg`, recursive `grep`), the same nudge rides the emit with a Bash-specific body — CAPPED AT THREE PER TURN (operator's number), the counter reset by each UserPromptSubmit, so the steering is early enough to shape the turn without becoming wallpaper. Non-spawn, non-long-Bash tools with an empty drain stay silent. Both ride the existing once-capped emit (spill guard unchanged). ADVISORY ONLY, deliberately: PreToolUse returns `additionalContext` and the tool runs anyway, so a nudge cannot convert the call it fires on — only the next one. Deny-and-steer (PreToolUse denying the call so the agent re-issues it backgrounded) is the only lever that would convert the current call and was RULED OUT by the operator 2026-08-04. This buys coverage, not enforcement. WHY (field, 2026-07-07 operator): every claude-spt agent ran subagents/long tasks in the FOREGROUND, going unreachable for the task's whole duration — the legacy-owl notice was the missing steering pressure. WHY THE BASH ARM (2026-08-04 grill): both legacy-owl legs were already ported and shipped, so the honest finding was not 'the feature is missing' but 'the feature does not cover the common case' — long foreground Bash (cargo, gh, test suites, recursive greps) is the ordinary way a perch goes unreachable and fired NOTHING. Observed in the grill session itself: a foreground `grep` blocked 120s and the harness backgrounded it, with the general notice already in context and no targeted nudge existing for that call.
       Subagent working perches follow the WORKER-TRUTH wave-1 contract (spt-core v0.27.0, doyle freeze 2026-07-06) and NEVER leak silently. SubagentStart (parent context) calls `api worker-start <parent> --session-id <parent sid> --agent-id <cc agent id> --agent-type <type>` — NO worker-id positional (core hard-mints `{parent}-w{N}`), NO token (operator ruling: sid-symmetric auth, registration stores the sid, stop accepts stored OR parent-current sid — /clear rotation covered from both ends). The MINTED id is read from worker-start's BARE STDOUT (machine-readable result; empty/refused = LOUD log, never silent) and persisted in adapter-owned state keyed by the CC agent_id (state/worker/<agent_id>.wid — the SubagentStop payload carries only the CC agent_id, so the mapping is the adapter's to hold; same contract-clean carrier as the F-024 sid proof). SubagentStop looks up the minted id and calls `api worker-stop <minted-id> --session-id <parent sid>` STRICTLY: a refusal is LOUD (stderr reason surfaced — the pre-0.27.0 silent-swallow leaked 100% of workers, the 2026-07-06 six-worker leak), a missing mapping is LOUD (WORKER_STOP_SKIP breadcrumb), and the state row is cleared on success. Missing agent_id on either hook = LOUD skip, never a silent no-op. Floor: min_spt_core 0.27.0 (older cores clap-reject the id-less worker-start — the doyle-accepted skew; core's registration-time floor enforcement guards the reverse direction).
       The session carrier (state/session/<eid>.sid) never advances past a FAILED strict registration. Pre-fix, handle_session_start persisted the current sid on EVERY SessionStart even when the bind/boundary spt_strict call was refused (error only logged) — which (a) poisons the NEXT rotation's auth proof (the perch still records the PRIOR sid, so the next boundary presents a sid the perch never accepted → AUTH_REFUSED → stranded perch, the F-024 class reached via carrier skew) and (b) would let the verified-identity fast path (REQ-UPS-IDENTITY-FASTPATH) trust a session the perch never bound. INVARIANT: carrier(eid, sid) is authoritative only when written immediately after a SUCCESSFUL strict bind/boundary registration this SessionStart; on failure the carrier keeps the prior sid (still the true proof for the retry). The seed leg (no endpoint id) never writes. 2026-07-10 UPS-timeout RCA prerequisite (hertz), converged 2026-07-15.
       A completed /compact must not leave an spt-hosted endpoint stuck ACTIVE with its parked messages undelivered until a human types. Field-proven (deployah 2026-07-21, hertz RCA): doyle's RELEASE GO was SENT (live listener delivery) 79-88ms before the operator submitted /compact; the stub the translation binary typed did not survive the compact collision, the body stayed committed in adapter msgpark, and SessionStart(source=compact) rebound the boundary but never transitioned ACTIVE->IDLE or re-drove the park — so the GO sat 46m45s until the operator's next UserPromptSubmit drained it (same black-hole class as REQ-HAZARD-STUCK-ACTIVE-NO-IDLE / -STOPFAILURE- / -INTERRUPT-, reached via /compact; the interrupt watcher cannot heal it — no interrupt marker). TWO SEAMS: (1) source-certain — the compact arm of handle_session_start must, after a successful boundary rebind, assert `state idle` and re-drive a non-empty msgpark by self-sending a redrive message through the OWN translation binary (--force-native), whose stub opens the turn whose UserPromptSubmit drains the park (custody unchanged: SessionStart never drains/commits the park itself — only a UPS/PreToolUse drain may stage, only post-emit commit destroys). (2) TRIGGER-GATED (the negative leg): an AUTO compact fires the same SessionStart(source=compact) MID-TURN — the agent is genuinely working, so marking idle or injecting a redrive there is the busy-injection hazard, and the continuing turn's next PreToolUse drains the park anyway (REQ-STUB-PARK-NO-STALL). The hook payload carries no trigger; the transcript's compact_boundary record does (`"subtype":"compact_boundary"`, `compactMetadata.trigger` = manual|auto, ground-truthed against live transcripts 2026-07-21). Read the LAST such record via the payload's transcript_path: trigger=auto -> skip (loud log); trigger=manual OR undeterminable (no path / no record / parse fail) -> heal, because the black-hole direction (46min unreachable) beats the noise direction (one stub turn CC queues behind the running turn, self-corrected at its next busy mark). An empty msgpark redrives NOTHING (no dead prompt: an operator compacting an idle session must not wake the agent). The redrive body must be self-explanatory to the receiving agent.
       The digest extractor's projects-root chain is SESSION-AWARE and never silent: it walks the precedence rungs (--config-dir capture → $CLAUDE_CONFIG_DIR env → legacy --in → ~/.claude/projects) and uses the first rung that actually CONTAINS the requested session's transcript — a rung that resolves to a real directory without the session must NOT end the search. When no rung holds it, the extractor says so on stderr (roots tried + session id) instead of exiting 0 with empty stdout. Rationale (field 2026-07-25, perri): the perch's bind-time {CLAUDE_CONFIG_DIR} capture is STALE the moment a later session boots under a different config root (a ccs-captured `~/.ccs/instances/<acct>` perch re-bound by a plain `~/.claude` session). The old first-rung-wins chain pointed the locator at the ccs tree, found no <sid>.jsonl, and returned empty-and-quiet — so the endpoint's digest carried spt-injected Context rows ONLY, its newest Agent entry frozen at the pre-reboot session, with no error anywhere on either side. Every digest consumer goes blind together: peers reading the endpoint, the Psyche's context sync, and any tool whose control channel is the digest (rebound's `!!done!!`/`!!wait=m!!` codes were unreachable for the whole session).
       The psyche host's resident loop is PACED and TERMINAL on persistent instant cycles: a healthy iteration blocks (perch poll or a real claude turn); when iterations complete sub-2s repeatedly (claude dying at spawn — the F-h untrusted-cwd trust prompt — or a thrashing poll), the host backs off exponentially (500ms doubling, 5s cap) and after 8 consecutive instant cycles exits LOUD + NONZERO (PSYCHE_HOST_GIVE_UP stderr, exit 3) so the wrapper DEATH becomes visible to spt-core's psyche_host_error/residency machinery — a silent internal loop is invisible to it (field: ~3 boots/sec for 30min, ordinal 5358, F-h). Threshold coupling (doyle-ruled): core's C3(b) backstop trips at >=10 ledger boundaries/60s; for the pure instant-death class this guard fires FIRST (<=8 boundaries, <60s wall clock); failure modes that dodge the streak (just-over-threshold cycles resetting it) legitimately reach the core backstop — a core trip on a guarded wrapper is correct backstop behavior, not a bug.
       A session-limit 429 must not leave an spt-hosted endpoint stuck ACTIVE with the limit banner read as agent activity. When a turn ends on the account session limit, CC files a SYNTHETIC assistant message (model `<synthetic>`, `isApiErrorMessage: true`, `error: rate_limit`, text `You've hit your session limit · resets <time>`) into the transcript; the digest extractor renders it as an ordinary `agent` record, so the endpoint's digest shows an `Agent` entry on the latest turn. The interrupt watcher (REQ-HAZARD-INTERRUPT-STUCK-BUSY fix 3) reads any `Agent` entry as THE AGENT PRODUCING OUTPUT → 'genuinely resumed' → re-arm, never heal. StopFailure DOES fire and heal on the first limit hits, but each drained delivery re-marks busy and re-429s, and once CC stops attempting API calls for the limited session it fires NO further hook — the last delivery leaves the endpoint ACTIVE with the limit banner as its newest digest turn, and the watcher's misread makes the black hole PERMANENT: messages arriving after the limit resets can never wake it (field lia 2026-07-28, ~4h dark; the operator woke her by hand). FIX (watcher-side, the hook-independent layer): a digest turn carrying an `Agent` entry whose text STARTS WITH `You've hit your session limit` is a STUCK MARKER, not activity — (1) such a turn is never read as a resume, whatever else it carries (a real pre-limit `Agent`/`ToolSprint` entry on the same turn must not defeat the heal — the same misread class as the lia echo_mirror RCA); (2) a limit marker anywhere in the scan window with no real agent activity on the latest turn heals exactly once (mark idle via the carrier sid), sharing the interrupt marker's heal-once latch and re-arm rules. Prefix-match on the entry text START only — an agent merely quoting the phrase mid-text must not read as stuck (the false-positive direction is one idempotent idle mark, self-corrected at the next busy transition, but a start-anchored match keeps even that rare).
       CC's in-TUI /resume must NEVER silently strand an spt-hosted endpoint's perch. Mechanism (operator hunch, perri-confirmed 2026-07-07 across our hook.rs + the CC SessionStart hook contract + the live `spt api boundary/bind` CLI contract): the /resume slash command ends the current session (SessionEnd reason=resume) and re-fires SessionStart(source=resume) in the SAME broker child process, so $SPT_ENDPOINT_ID is STILL set — the hook takes the spt-hosted registration path. register_verb routes ONLY clear/compact to the proofed `boundary` rotation; every other source (incl. resume) with an endpoint id present falls to a plain `bind`. That bind path (a) presented NO ownership proof and (b) used the exit-ignored `spt` seam (silent). But the perch is ALREADY bound — its info.json records the DEPARTED pre-resume sid — so a proofless re-pin to the resumed sid is squat-protection REFUSED by core, and the adapter swallowed the refusal: the perch strands on the departed sid, every id-scoped call (poll/state/boundary) is AUTH_REFUSED, delivery is dead while the endpoint still looks healthy — the SESSION-PIN-WEDGE (REQ-HAZARD-SESSION-PIN-WEDGE) reached via /resume instead of a missed /clear. FIX (adapter-only — the live CLI shows `boundary <MODE>` is a hard enum {clear,compact}, so a new 'resume' boundary mode is blocked core-side; `bind` however accepts `--session-id <SESSION_ID>` = 'proving association (matches the perch info.json)', so the proof rides bind, not a boundary mode): the spt-hosted bind now presents the departed sid from the adapter state file ({adapter_dir}/state/session/<id>.sid, the REQ-DIST-BOUNDARY-ROTATE carrier) as `--session-id <prior>` ownership proof whenever a prior sid exists AND differs from the current sid (a re-pin/rotation), and runs STRICT + LOUD on any refusal (bind({src}) re-pin FAILED — never the silent swallow). The FIRST (fresh-spawn, source=startup) bind still binds proofless (no recorded sid to prove against — broker parentage is the credential) but is now strict too. This closes the resume leg of the never-silent-wedge invariant.
       Every additionalContext spill gets its OWN file — a spill NEVER overwrites an earlier one, and a new spill's pointer NAMES any earlier spills of the same session so an unread one becomes visible instead of vanishing. The spill path used to be fixed per session (one `sptc-drain-<sid>.txt`), so the second oversized delivery of a session destroyed the first: field 2026-07-25 (lia) — a SessionStart brief spilled, then a peer broadcast spilled over it before the agent read it, and the agent's identity/role/live-context/resume tail were gone UNREAD. Silent by construction: no error, no marker, nothing tells the agent it ever had a brief, so the loss is indistinguishable from an agent that was never briefed — the one failure mode nobody catches. Blast radius is wider than one message: any agent collecting field evidence through spills has that evidence silently degraded (flynn had to retract the strength of an observation given to spt-core for exactly this reason).
       The spill POINTER can never itself be the thing that goes missing: an oversized delivery is surfaced by a notice that always reaches the agent, always names a file that actually exists, and always fits under CC's additionalContext limit. Three routes make a taken message read as a non-delivery even with REQ-HAZARD-SPILL-CLOBBER's unique paths in place — (a) a FAILED spill write emits a pointer naming nothing readable while the park is committed anyway, so the body exists nowhere; (b) only the UserPromptSubmit path names earlier spills, so an unread spill is never resurfaced by the PreToolUse mid-turn drain, the highest-volume spill path there is; (c) the pointer's earlier-spills list is unbounded, so a long session's own notice grows past CC's ~2KB limit and CC silently truncates the very notice whose job is to prevent silent truncation.
       An API-error turn-end must not leave an spt-hosted endpoint stuck ACTIVE/undrainable. CC fires NO `Stop` when a turn ends with an API error (matcher error types: rate_limit, authentication_failed, billing_error, invalid_request, server_error, max_output_tokens, unknown) — it fires `StopFailure` instead. The adapter marked idle ONLY on `Stop`, so an errored turn-end never got its idle mark and the daemon spooled every inbound without draining (same black-hole class as REQ-HAZARD-STUCK-ACTIVE-NO-IDLE, reached via API error instead of a never-completed first turn). FIX: wire `StopFailure` → `handle_stop_failure` → `state idle` (self_id-resolved, sid-scoped — mirrors the `Stop` idle mark); the error_type is logged (rare event; permanent observability + Step-0 coverage instrument).
       RETIRED 2026-08-29 by REQ-IO-COMPLIANCE-DECLARED (Release B): this adapter no longer parses or dispatches shortform - spt-core does, off the ingest payloads we report, and per-target outcomes surface through the now-signal DISPATCH_RESULTS category, which core documents as the only channel by design. The evidence this requirement described has been DELETED, not merely left untagged, so the stages are cleared rather than the requirement removed: what it protected is kept here as the reasoning that has to outlive the code. ORIGINAL: A shortform peer message (`@<targets body @>`) whose BODY contains code formatting still sends, and sends verbatim. The quotation guard is POSITIONAL — it decides whether the OPENER is quoted — and must never be implemented by splitting the text on code delimiters and scanning the pieces: that put an opener and its close in different pieces, so any tag whose body quoted a command was dropped whole, with no send and no error. Corollaries the tests pin: a `@>` inside code is quoted punctuation and not a terminator (an opener whose only close is inside code still does not fire); an UNTERMINATED backtick is literal text, not an open code span (one stray tick used to swallow the rest of the message); a fenced block inside a body survives intact. Field 2026-07-25: perri's request to doyle for a ledger item — a body full of backticked commands — was never delivered, and the silence read as an unresponsive peer rather than a lost message.
       A shortform peer message emitted on a pass where the tag-scan CURSOR IS ABSENT is still dispatched. The first run for an endpoint reads the whole transcript, so pre-existing history must not be re-dispatched — but the turn being written RIGHT NOW is not history, and the pass used to return before scanning anything, swallowing any tag in it whole: no send, no confirm, no error, and an agent with every reason to believe it had been delivered. The resolution is a NARROWING, not a widening: on the initializing pass only the FINAL assistant message (this turn's own output) is eligible, everything before it stays the history it is, and the cursor still jumps to EOF so the unscanned history can never be dispatched later. Cursor-absence is not exotic: a brand-new endpoint, a deleted state file, or an adapter re-registration that moves `source_dir` — which relocates EVERY endpoint’s cursor at once, exposing the whole fleet's next tag-bearing turn simultaneously.
       A CI gate that probes the spt CLI to decide which contract it is running against must FAIL CLOSED: when the probe cannot establish the shape, the int FAILS and names the port it needs — it never SKIPs, and it never reports a version verdict it did not measure. ROOT (deployah, 2026-08-04, at the spt-core 0.54.0 tag): `ci/subnet/multi-subnet-bringup-int.sh` gated on `spt endpoint run --help | grep -q -- '--subnet'` and skipped with 'needs v0.14.0' when the grep missed. 0.54.0 RETIRES `endpoint run`, so the command REFUSES, the grep misses for a reason that has nothing to do with v0.14.0, and the int exits 0 announcing it skipped for being too OLD — the whole multi-subnet suite passing by skipping on the exact version it exists to test, while stating the opposite of the truth. A feature that is ABSENT and a feature that MOVED are byte-indistinguishable in a grep count; only three of the four sibling ints announce themselves by failing, and this one did not. THE RULE: before a zero-match may mean 'feature absent', the probe must prove it read a real body — a positive control that MUST match (here, `--help` exiting 0 AND carrying 'usage'). A zero from a command that refused describes the probe, never the contract. Same family as REQ-TAG-SEND-PRETOOL-TRACE (an instrument silently covering one of two dispatch legs) and F-044 (a zero-match on a version-lagged docs surface read as a claim about the current contract). GENERALIZES beyond this int: any version-sniffing gate in ci/ owes a positive control and a fail-closed default.
       The [history] transcript-access seam (the echo-commune's feeder — 'stays opaque + single-session and feeds the echo-commune verbatim', published contract) is declared strategy="fetcher": `claude-spt history --session {session_id} --config-dir {CLAUDE_CONFIG_DIR}` locates the CC JSONL transcript with the SAME locate/precedence machinery as the [digest] fetcher (--config-dir read-var fill -> $CLAUDE_CONFIG_DIR env -> ~/.claude/projects; depth-1 then bounded-recursive slug sweep) and streams the file to stdout VERBATIM — opaque bytes, core never parses them, only the adapter's own echo_commune summarizer reads them. A literally-unsubstituted `{CLAUDE_CONFIG_DIR}` argv value is treated as absent (F-013 literal-brace guard class). Missing transcript / missing --session = LOUD stderr (HISTORY_FAIL:) + exit 1, never silent-empty stdout (an empty history would silently produce a vacuous echo-commune).
       claude-spt REPORTS the turn's closing output on its end-of-turn idle call, so spt-core's IO funnel publishes an AGENT_OUTPUT event for this adapter's turns. Enabling half of BigscreenVR/spt-pacer-tool#14 (requester discord:reavo), which retires pacer's bespoke agent-output detection in favour of the AGENT_OUTPUT io kind; the operator ruled the sequencing on 2026-08-28 (claude-spt first, verify a frame actually lands, then pacer). WHY IT WAS NEEDED: the io funnel shipped in core 0.64.0 and AGENT_OUTPUT rides the activity report an adapter already makes (`spt api state idle <id> --payload-stdin`), but claude-spt passed no payload at any of its eight `state idle` call sites — validated scan, 197 files, 0 payload call sites against 151 control hits — so no AGENT_OUTPUT had ever been published for a Claude Code session and any consumer of the kind was structurally deaf on this adapter. TWO CONTRACT QUESTIONS WERE PUT TO CORE BEFORE BUILDING, either of which would have invalidated the release, both answered by doyle 2026-08-28 against shipped 0.64.0: (1) a fetcher-pulled digest entry emits NO io event by itself — the emission population is exactly payload-carrying `api state` calls, the MSG_IN/MSG_OUT delivery edges, and COMMUNE/COMMUNE_FAIL — so our `[digest] strategy = "fetcher"` does not create the second event the frames page warns about (that warning targets an adapter double-REPORTING the same turn text through payload-carrying calls); (2) riding `api state idle` is transport reuse, not coupled semantics — emission is per payload-carrying call, not per transition, and payload reporting leaves activity behaviour untouched. ONCE-PER-TURN IS THE ADAPTER'S DISCIPLINE AND IT IS KEPT AS A CALL-SITE RULE: core does not deduplicate, so exactly ONE `state idle` in the adapter carries a payload — the Stop end-of-turn mark. The other seven (receive-heal, Notification(idle_prompt), bringup bind, compact/clear) are healers and lifecycle marks, not turn ends, and a payload on any of them publishes a phantom AGENT_OUTPUT for a turn that never happened. WE DO NOT TRUNCATE, deliberately: bodies cap at 16 KB and core cuts a longer one on a character boundary and stamps `truncated="1"`, which is the entire mechanism by which a consumer learns to follow `seq` to the digest for the remainder. Cutting adapter-side to stay under the cap would deliver the same bytes with the truncation flag ABSENT — a silent loss wearing the shape of a complete payload, the same lossy-copy-invisible-at-the-far-end class as the dropped envelope attributes (REQ-EVENT-ATTR-PASSTHROUGH-RENDER). Core's cut is announced; ours would not be. ACCEPTED GAP, recorded not worked around: the across-clear quiet window returns before the idle mark, so a commune-across turn publishes no AGENT_OUTPUT — that turn ends in a `/clear` and is rebuilt from the commune. OUT OF SCOPE, deliberately: the USER_INPUT payload on `state busy` (nothing consumes it yet, and a second payload seam is a second once-per-turn discipline to keep), and `[io] compliance = true`, which declares this adapter's own tag parser deleted so core may parse our ingest for shortform — tag_scan.rs is live and shipping, and the published rule is to declare compliance in the release that removes the local parser, never before. FORWARD FLAG (releases#238, operator-ruled backlog): core will add framed emission of mid-turn digest entries with inline payloads and will respecify the dedup discipline and amend frames.md/patterns.md in the same change. A release built to today's contract stays correct; the design consequence taken NOW is that nothing here assumes one AGENT_OUTPUT per turn.
       The access-control surfaces we TEACH carry spt-core's current directionality vocabulary and the reply exemption: the two knock `[[hints]]` and the `/sptc:knock` operative body. Operator ask (discord:reavo, 2026-08-21): an agent must learn (a) that a knock REQUIRES choosing between `--send-only` and `--send-receive` and what each means, and (b) that `--send-only` does NOT silence the far side — it bars unsolicited sends, not answers. (b) IS THE GENERAL ACCESS CONTRACT, RULED BY doyle 2026-08-21 and not inferred by us: a reply correlated to the endpoint's own outbound is admitted with no rule of its own — REQ-SEC-1's own title clause (stateful-firewall, reply/outbound exempt; ADR-0009 family), and the exemption precedes rules, modes AND the rule store, surviving a degraded store by ratified design (ADR-0053). The ENGINE ROOM is the strictest CONSUMER of that rule, not its owner, which is why the published docs stated it only as an engine-room instance — a REAL docs gap, now closed at source at the consumption point (docs-site networking/knocking.md, section 'Two-way reach is offered, never imposed', passage 'What --send-only does not bar: replies'), doc stage activated on REQ-SEC-1, publishing with the next core cut. PHRASING IS PART OF THE REQUIREMENT (doyle): teach it as 'they can answer what you send', NEVER as 'messaging someone once opens a permanent back-channel' — the correlation bound is real and its width is implementation detail, so no number is quoted for it. Also taught: `new-code --subnet` seals a code (comma list or repeated flag; OMITTING it seals to every subnet the minter belongs to, and a redeemer must share a sealed subnet to read the code's route at all), a capability that landed after the 0.54.0 amendment the body was last written against. WHY A GUARD AND NOT JUST TEXT: 0.54.0 retired the old flags with no aliases, so text teaching the old spelling hands the agent a hard parse error rather than a deprecation warning — the body was amended once already and nothing stopped a later edit from undoing it.
       A session-limited endpoint's idle mark lands ~1 minute AFTER the limit resets, not while the session is still limited (operator-directed 2026-07-28, refining REQ-HAZARD-RATE-LIMIT-STUCK-BUSY). The banner carries the reset time (`You've hit your session limit · resets 7:50pm (America/Los_Angeles)`); marking idle IMMEDIATELY drains the spool into a session that cannot act — each delivery re-marks busy, re-429s, and burns a spooled message into CC's uncertain input queue (field lia 2026-07-28: 30+ StopFailure heal/drain cycles, messages effectively lost). DEFERRED HEAL, two legs: (1) WATCHER — parse the banner's wall-clock reset (H[:MM]am|pm), compute the deadline (first of today's/tomorrow's local occurrence still ahead of now, +60s) via the machine's current UTC offset (one shelled probe per process: unix `date +%z`, windows PowerShell `[DateTimeOffset]::Now.Offset.TotalSeconds`; the banner tz is ASSUMED to equal the machine tz — same account), and HOLD the heal (no idle mark, latch untouched) until the deadline passes, then heal once via the existing latch. A parse failure, missing offset, or implausible delay (> 5h30m — tz-mismatch distrust) falls back to the immediate heal (0.25.25 behavior): the fallback direction is ALWAYS heal-now, never hold-forever. Real agent activity on the latest turn cancels the hold (re-arm, operator woke it early). (2) HOOK — a `StopFailure` on an spt-hosted session whose transcript tail carries the SYNTHETIC banner record (`isApiErrorMessage: true` + content text start-anchored on the banner — an agent QUOTING the phrase must not match) SKIPS the immediate idle mark (loud log; the watcher owns the deadline), so deliveries stay in the durable spool instead of churning into the limited session. The banner is the WHOLE discriminator — `error_type` is deliberately not consulted: CC fires StopFailure with error_type="" even on a session-limit 429 (field lia 2026-07-28 21:53, the v0.25.26 residual — an etype==rate_limit gate never matched and the immediate heal defeated the watcher's hold). Non-hosted sessions (no $SPT_ENDPOINT_ID → no resident watcher) keep the immediate heal — hold-without-a-watcher would re-create the permanent black hole. (3) ACTIVE HOLD (v0.25.27, operator-directed): while the hold is live the watcher RE-ASSERTS `state busy` every tick — other idle sources (a hook miss, an idle_prompt Notification on the limited session sitting at its prompt) mark idle underneath a passive hold and the daemon drains deliveries into the dead session; the busy re-assert corrects any stray idle within ≤15s for the whole limited window. Idempotent; runs only while a hold is live (rare, bounded ~5h), inside the watcher cost discipline. (4) EVERY ADAPTER IDLE SOURCE YIELDS INSIDE THE WINDOW (v0.25.28): the bringup idle assert (a daemon restart resuming a session mid-window instantly drained the spool ahead of the 15s busy re-assert — field lia 2026-07-29 23:12, 2 spooled messages spent) and the idle_prompt Notification heal both SKIP (loudly) when the transcript shows a LIVE limit. The transcript test is keyed on the NEWEST assistant record — a recovered session's stale banner reads as history, so the STUCK-ACTIVE-NO-IDLE protections stand unweakened for every healthy endpoint; no transcript_path reads not-limited (fallback is always heal-now).