--- name: v0390-recharge-trust-trace description: "v0.39.0 SHIPPED 2026-09-09 (milestone #33 rest): recharge rename, trust auto-seed, hook-trace retention. ⭐ An instrument that dies before the investigation is not an instrument." metadata: node_type: memory type: project originSessionId: 45d4cae9-0ba3-42ec-a68a-54197b32289e modified: 2026-09-09T04:26:44.139Z --- **v0.39.0 shipped** (commit `1dd3470`, tag pushed, private release + public mirror + cplugs 0.1.19 all done). Gate PASS, 561 unit tests, `traceable-reqs check` exit 0. Milestone #33's remaining three Requests. **FIELD-VERIFIED 2026-09-09** (commit `d04c247`), except where noted: - **#34 CONFIRMED.** Clean binary cutover 01:57:31Z → 01:58:11Z with ZERO per-frame stale lines after it; one poll refusing 458 frames now writes ONE line. **2047.6 B/s → 34.7 B/s** across that cutover. The ROLL is now **FIELD-VERIFIED too** (2026-09-09T04:04Z, commit `42e1f5d`): the live file crossed its cap at `02:48:29Z` and rotated instead of truncating — `.1` holds 1808 lines with ZERO overlap against the live file and a seam contiguous to the millisecond (`.439Z` → `.440Z`), all 1808 recovered into the archive, 0 missing. ⭐ **The fix bought hours, not the days #32 needs**: 512KB at 34.7 B/s is ~4.2h per generation, so `ci/measure/trace-harvest.py` now carries every generation into a durable deduped archive at `%LOCALAPPDATA%\spt-claude-code\evidence\`. RUN IT EVERY SESSION. - **#31 CONFIRMED**, without spawning a harness: the seeder runs BEFORE the CLI is resolved, so `claude-spt launch --cli --account alt` from an unknown cwd seeds and exits 2 having spawned nothing. All three approvals, exact forward-slash key, the ALT account root (not the ambient one), siblings untouched, no stray tmp. ⭐ **`launch` is the seeder's ONLY caller** — `psyche` and `echo-commune` are different spawn kinds and do not seed (that is #31's stated scope, not a hole), so a commune is USELESS as a probe for it. - **#24: 3 of 4 surfaces live.** Keyword hint and start-of-session brief both fire with the new wording. The skill frontmatter is DELIVERED BUT NOT LIVE — cplugs 0.1.19 is installed with the correct `--recharge` text, yet running sessions still serve 0.1.18's `--across`, because every `claude` process on this node started 2026-09-07 01:03, two days before the 01:57:56Z install, and CC loads plugin skills at PROCESS START. ⭐ **That looks exactly like the #17 reached-nobody class and is not one — discriminate by process start time vs install time.** Consequence: `--recharge` cannot be verified from a session older than the install; verify it from the first post-restart one. **RE-CONFIRMED 2026-09-09T04:26Z, still not live, and a RECHARGE DOES NOT CLEAR IT** — a `/clear` rotates the session but not the process. Counts on disk: `0.1.18` = 3×`--across` / 0×`--recharge` (what running sessions serve); `0.1.19` = 3×`--recharge` + 1×`--across` (the staged "still accepted" line — correct); marketplace copy matches 0.1.19. Every `claude.exe` still starts Sep 7. ⭐ **Delivery is PROVEN correct; only liveness pends, and the ONLY unblock is an operator restarting their `claude` processes** — nothing I can do from inside a session closes this. ⭐⭐ **Two zero-hits I nearly believed this session, both from instruments that did not cover the population.** (1) Both trust stores hold ZERO fully-approved projects — that reads like #31 failing and is just "no bringup has run since the install". (2) The spt daemon's stderr log has zero hits for the seeding notice — and zero for `launch` OR `psyche` across 53 MB, i.e. it never carries launcher output at all. Validating instrument (2) cost two minutes and stopped a wrong bug report. **#34 hook-trace retention** (`REQ-HOOK-TRACE-RETENTION`). Two defects, both measured not estimated: 87 B/s, 512KB cap in 101 min, 247/263 lines (95% of bytes) were `arm_from_commune_frame` logging one line PER STALE FRAME PER POLL. Collapsed to one summary line per poll (silent when nothing refused — an unconditional summary is the same defect with a smaller constant) → ~32 h. And the roll was `fs::write(path, b"")`, an in-place TRUNCATION performed by whichever endpoint crossed the cap, so one agent's poll destroyed a peer's evidence; now rotates to `hook-trace.log.1`. ⭐ **An instrument that cannot outlive the gap between a defect and its investigation is not an instrument.** I filed this DURING the milestone because #32's measurement was destroyed ~2 min after it was written. Same family as [[node-local-book-gate]]'s validate-the-instrument rule. **#24 recharge rename** (`REQ-RECHARGE-VOCABULARY`, ADR-**0011** — the plan said 0010, taken by account-roots; check `ls docs/adr/` before minting a number). STAGED: `--across` / "commune across" still accepted. ⭐ **A staged rename needs BOTH halves guarded, because each fails in the opposite direction** — drop the new name and the rename never happened; teach the old one as current usage and the staging is silently a no-op. `tests/recharge-vocabulary.sh` (modelled on `knock-vocabulary.sh`) asserts both; it caught a real miss in `CONTEXT.md` on its first run. Ids NOT renamed — an id is identity. History (CHANGELOG/ADR/plans) deliberately untouched. **#31 trust auto-seed** (`REQ-TRUST-AUTOSEED`, `launch.rs`). Seeds `hasTrustDialogAccepted` + `hasClaudeMdExternalIncludesApproved` + `hasClaudeMdExternalIncludesWarningShown` pre-spawn, tmp+ rename, on the root THE SPAWN resolves (account root > `$CLAUDE_CONFIG_DIR` > `~/.claude.json`), write-only-when-wrong. ⭐ **Re-verified the key shape on the live store rather than trusting my own 60-day-old memory: 75/75 forward-slash, 0 backslash.** Never canonicalize (Windows `\\?\` prefix would mint a second key nothing reads). **#32 busy race ships NOTHING, deliberately.** Stated root cause REFUTED (UPS *does* mark busy). ⭐ I demonstrated candidate (b) is REACHABLE by hand — that is NOT the claim that it FIRES in the field, and only the second justifies a fix. Its measurement needs #34's retention IN THE FIELD, so it opens the next milestone: `BUSY-RACE-PLAN.md` (step 0 = install v0.39.0 and confirm the instrument). **A CLOSED, CHANGELOGGED FIX THAT REACHED NOBODY** — the sharpest finding of the release, and found by ACCIDENT. `package-skeleton.sh --apply` staged a `send/SKILL.md` diff I never touched: the fix for **#17**, committed under an EARLIER release whose skeleton step was judged unnecessary. Issue closed on merge, changelog moved on, zero users had it until v0.39.0 happened to carry it (the sweep then credited #17 to v0.39.0 — correct, that IS when it shipped). ⭐ **The runbook was right and the judgement was wrong: a skill BODY edit is a structural plugin change.** ⭐⭐ **A rule that depends on per-release judgement fails silently; a gate does not.** Filed as **#35** (a predicate gate refusing a release when `plugin/sptc/` differs from the PUBLISHED skeleton without a `plugin.json` bump — the repo tree alone cannot tell delivered from undelivered, so the published copy is the baseline). Verified after the push: repo tree == published cplugs, so nothing is stranded *now* — but #17 was found by accident, so the historical population was never established. Same family as [[v0261-hints-never-called]] (declared ≠ delivered). **Release mechanics re-confirmed this run:** `mirror-public.sh --apply` in position 1; the snapshot tree excludes `traceable-reqs.toml` and root `*-PLAN.md` — I verified that at the CONSUMER (`git ls-tree` on the snapshot sha) rather than trusting the guard's exit, per [[exit-zero-from-a-flag-order-noop]]. `package-skeleton.sh --apply` surfaced a `send/SKILL.md` change from an EARLIER release whose skeleton step was skipped — ⭐ a skipped skeleton step leaves drift that only shows up at the next one, so read the cplugs diff before committing it. Related: [[commune-loop-and-stale-brief-task]], [[v0384-commune-frame-replay]], [[claudejson-write-hazard]], [[f027-trust-seam-groundtruth]], [[headless-spawn-external-imports-gate]], [[release-notes-ux-only]].