7080:  "REQ-HAZARD-MONITOR-GREEN-SELF-PRODUCIBLE",
7081:  "REQ-HAZARD-MESH-BOOTSTRAP-TRAP",
7082:  "REQ-HAZARD-REGISTRY-STALL",
7083:  "REQ-HAZARD-SELF-ROW-LEASE-FREEZE",
7114:id = "REQ-HAZARD-EMPOWER-SESSION-RESURRECT"
7131:title = "THE PER-MACHINE SUPERVISOR SURFACE IS SPELLED `spt node`, AND `spt daemon` REMAINS A FULL ALIAS OF IT — ONE PARSE TREE, NOT TWO. The noun operators type for their own machine was `daemon`, which names the PROCESS rather than the thing the process supervises; the surface is a node's state (daemon state, member subnets, local endpoints), so `node` is the primary spelling and `daemon` is a clap `visible_alias` on the same command. THE ALIAS IS FULL AND PER-SUBCOMMAND, NOT ROOT-ONLY: bare (the status view), run (incl. the hidden --detached auto-start-ladder flag), start, stop (incl. --force), status, access + its allow/deny/remove editing arms, refresh, and the hidden brain entry (bare and stamped) all parse identically under either spelling. A root-only equivalence proves the alias resolves and proves NOTHING about a subcommand added later under one spelling, which is why the unit asserts the parsed action as a VALUE per subcommand rather than matching variants. THE CHANGE IS CLI-SURFACE-ONLY: the spt-daemon crate, the wire, and the docs model term `spt-daemon` are untouched, and `daemon access` is mirrored as a NOUN, not duplicated as policy — one parse tree, one roster store. THE DEPRECATION NOTE IS SHARED AND ALIAS-NEUTRAL (doyle fork-D ruling): clap renders help per COMMAND, not per alias, so the note lives in the one `///` block and is worded to be TRUE under both spellings — deprecation when read on `daemon --help`, information when read on `node --help`. No argv sniffing, no stderr-only notice, no second variant. THE BRAIN SPAWN ARGV KEEPS THE `daemon` SPELLING (doyle fork-A ruling, KH-2.3): brain_child_args builds `daemon brain --generation N --start-reason R`, and the compatibility it exists for runs toward binaries that PREDATE the alias — an N-1 parser knows only the old spelling and an alias cannot rescue a parser that never had it, so migrating the spawn site is a later milestone gated on a fleet version floor, never this lane. REMOVAL OF THE ALIAS IS BLOCKED ON AN INSTALL-ARTIFACT MIGRATION (doyle fork-C ruling) AND THAT CONSTRAINT RIDES THE DOC SURFACE, not this file alone: installed OS service units and scheduled-task rungs on every deployed machine already carry `spt daemon run`, and renaming the verb does not rewrite them, so a future milestone must migrate those artifacts before scheduling removal. THE DEPRECATED SPELLING IS DOCUMENTED, NOT HIDDEN (doyle fork-E ruling): `visible_alias` rather than the hidden `--deferred`-style precedent, so the alias reaches the generated reference as a findable deprecated row — a deprecation an operator cannot find is not a deprecation. Gate: impl — the primary/alias rename with the shared note, the dispatch arm, the surface-help path table moved to the primary spelling, and the KH-2.3 spawn-argv sentence; unit — per-subcommand alias equivalence over the enumerated surface, the bare form defaulting to the status view under both spellings, and the note rendering in BOTH spellings' long help (the shape-(i) choice made visible, so moving the note to a runtime print reds here); doc — CONTEXT.md's disambiguation line separating this VERB from the retired `spt-node` separate-process deliverable, plus the reference regen carrying the deprecated row and the removal constraint. Kin REQ-CLI-2 (the noun this re-spells), REQ-HAZARD-HANDOFF-ARGV-COMPAT (the spawn argv it must not modernize), REQ-DOCS-5 (the generator whose drift gate must be green on the regen)."
7157:# flagged: honoring it on the blocking carrier re-breaks REQ-HAZARD-PUMP-IPC-DEADLINE,
7162:title = "A BRAIN-IPC READ HANDED A DEADLINE ITS CARRIER CANNOT HONOR REFUSES BY NAME AT THE READ PRIMITIVE, never silently unbounded. `Brain::read_frame_until` takes `deadline: Option<Instant>` and dispatches on the carrier: the `Split` (pump) arm honors it as a total-wait `recv_timeout` on the remaining budget, and the blocking `Whole` arm CANNOT honor it at all — a timeout there would have to abandon a half-read frame, which is a desynced carrier, and that is precisely why REQ-HAZARD-PUMP-IPC-DEADLINE built the reader-thread carrier rather than reaching for a socket timeout (interprocess on Windows named pipes has no portable read timeout and its `set_nonblocking` corrupts mid-stream — measured at that requirement). So the fix is NOT to make the Whole arm bounded; the fix is to stop the Whole arm from ACCEPTING a bound it will not keep. Pre-fix it dropped the parameter on the floor and returned a blocking read, so a caller that asked for a bounded read got an unbounded one WITH NO DIAGNOSTIC — the caller's own deadline was the thing that vanished. THE INVARIANT IS TWO-SIDED AND BOTH SIDES ARE LOAD-BEARING: an ABSENT deadline STAYS ABSENT (the ordinary blocking read on a `Whole` carrier is untouched, and no default bound is fabricated for it — the absent-is-not-zero shape ruled on releases#201), while a PRESENT deadline on a carrier that cannot honor it becomes a NAMED, DISTINCT error naming the carrier arm and the remedy. THIS MOVES AN EXISTING RULE TO THE SEAM EVERY VERB CROSSES rather than inventing one: `digestlink::refuse_unbounded_carrier` already refuses a `Whole` brain for the digest-pull verb, and its own doc comment records why a comment was not enough — 'it already fooled one implementation of this very function'. One verb was guarded; every other deadline-taking verb (`read_event_until`, `broker_image_version_until`, `read_controller_event_resuming_until`, `read_peer_reply_until`) reached the same primitive unguarded, which is the declare-vs-enforce shape: the rule was declared in three doc comments and enforced at one call site. AT c62904e7 NO PRODUCTION CALLER PASSES A DEADLINE ON A WHOLE CARRIER — the rc pump, the peer pump and the digest pull all build `cold_start_pump`, and the two deadline-aware wrappers document that production passes `None` — so this is a latent unbounded read one construction away, filed as such rather than as a field incident. Gate: impl — the `Whole` arm of `read_frame_until` returns the named refusal for `Some(deadline)` and the unchanged blocking read for `None`, plus the one-line amendment at `refuse_unbounded_carrier` recording that the primitive now enforces what its comment used to only warn; int — three carrier arms measured together, because any one of them alone is satisfiable by a wrong fix: `Whole`+deadline must RETURN (the witnessed red, which pre-fix blocks to its kill bound), `Split`+deadline must STILL time out at its deadline (the positive control a blanket refusal would break), and `Whole`+`None` must still round-trip a real request (the negative control against a fabricated default). Kin REQ-HAZARD-PUMP-IPC-DEADLINE (the carrier split this protects) and REQ-DIGEST-CROSS-NODE-PULL (the one verb that guarded itself)."
7177:title = "WHERE AN INVOCATION CAME FROM IS DATA THE CHAIN REASONS ABOUT, NOT A SHORT-CIRCUIT BEFORE IT. Until releases#209 the chain's step 1 was `if local, return Allow(SameNode)`, so locally-authored traffic never reached `AccessStore::decide` at all. That was invisible while local traffic was ungated, and it is exactly what would have foreclosed the operator's intra-node governance surface (releases#211) — which under the ruled shape is NOT a new tier between the per-endpoint entries and the node tier, but SELF-REFERENTIAL Node subjects at the EXISTING tiers (v1's slot-3.5 reading withdrawn in full, operator-rephrased 2026-08-22). A tier the local path short-circuits past is not a tier. So `AccessRequest` carries an `Origin` SET AT EXACTLY ONE CONSTRUCTION SITE — the chain's own — and never re-derived per call site, because a discriminant with two derivations is one that will eventually disagree with itself. THE LOCAL VARIANT CARRIES THE ORIGIN ENDPOINT ID, not merely the fact of locality: same-node governance discriminates by SENDER at the EXISTING tier-1 `SenderEndpoint` subject, so the id has to reach `decide` as part of the origin rather than be re-derived at each call site. Dropping it at construction would cost a second plumbing pass through this very seam — and releases#215 measures precisely what re-derivation costs when it is left to call sites: three feeders hand this one parameter three different value shapes, and a tier-1 rule silently cannot match on one of them. It is carried from the first commit even though nothing consumes it yet, and it is carried in the VARIANT rather than beside it so that constructing a local origin without deciding what to put there is not expressible. Its provenance differs from the wire's and the type says so: a remote sender endpoint is DAEMON-STAMPED and session-proven, while a local one is SESSION-DETECTED in the authoring process — never the caller-supplied `from`, which an explicit `--from` owns and which would admit a forged subject (KNOWN-HAZARDS 7.5, the same reasoning that keeps `from` out of tier 1). The same-node allow is DEMOTED to the chain BOTTOM, where it always semantically belonged: nothing named this traffic, so it is the same-node operation it always was. THE FIX MUST WIDEN NOTHING, and two tiers would have widened it silently if left alone. (1) THE MODE TIERS ABSTAIN FOR A LOCAL ORIGIN. A mode is a blanket posture about who may reach this node FROM OUTSIDE it; `closed` has never in this codebase's history been asked about traffic authored on this machine, because such traffic never reached the function. Letting the modes answer now would convert every `closed` posture in the field into 'and also stop the agents on this box talking to each other' — the hole-punch failure arriving through a door nobody opened deliberately. (2) A LOCAL ORIGIN CARRIES NO SUBNETS. This node is a member of its own subnets, so handing them in would let a subnet-wildcard DENY — written to keep some peer group out — begin refusing locally-authored traffic the moment that traffic reached the chain. Only rules that NAME the local origin explicitly speak about it; everything else falls to the same-node bottom, so today's local behaviour is preserved BY CONSTRUCTION rather than by inspection. A STORE DEGRADE MUST NOT CLOSE THE NODE IN ON ITSELF: ADR-0053's fail-closed refusal protects the node from the network, and applied to local traffic it would stop the agents here talking to each other every time `access.json` was mid-write, so a local origin takes the chain bottom on a degrade. The engine room is unaffected by that arm — its lock is step 0, above all of this, and its own posture read is independently fail-closed. A NODE WITH NO IDENTITY reads as local: nothing can be proven remote either, since a wire arrival carries a handshake-proven hex by construction (REQ-HAZARD-WAN-ORIGIN-AUTH), so an empty origin can only have come from a local authoring path — and that is also the fail-open direction for the same-node hole-punch. THESE SEMANTICS ARE NOT DECIDED HERE. This requirement owes #211 a reachable slot and a carried subject, nothing more: the ORIGIN AXIS and the local sender it carries. NO NEW TIER AND NO MODE TWIN ARE OWED — the v1 shape (a slot 3.5 with a mode twin 6.5, whose twin would refuse local traffic rather than abstain) is WITHDRAWN IN FULL, operator-rephrased 2026-08-22: #211's intra-node governance is SELF-REFERENTIAL Node subjects at the EXISTING tiers, rules-only, with modes-only-abstain staying exactly as this requirement built it. The ER lock stays at step 0 regardless, because same-node governance is a rules surface and never a replacement for the ratified engine-room semantics. Gate: impl — the `Origin` axis on `AccessRequest` set at one site and carrying the local sender id, the mode-tier abstention, the empty local subnets, the demoted same-node bottom, and the local degrade arm (the v1 slot markers are NOT part of this requirement's evidence and are removed with the withdrawal above — a marker describing an unbuilt tier certifies a design, not an implementation); unit — the hole-punch negatives with a CONCRETE adversary rule in the store (a subnet-scoped DENY present, and a closed node mode present, and a local send still admitted under each), plus a remote send under the same store still refused, which is what proves the abstention did not simply disable the tiers rather than scope them. Kin REQ-ACL-SUBJECT-CHAIN (the tier order this inserts into), REQ-ER-INBOUND-LOCK-ALL-PATHS (the lane that needed the axis), REQ-SEC-1."
7192:title = "A WAX SEAL IS A DURABLE RECORD BINDING CONTENT TO A MINTER: `{token, content_hash, minter, minted_at, ceremony_kind}` — the token (REQ-SEAL-TOKEN-FORMAT), the lowercase-hex SHA-256 over the EXACT BYTES presented at the ceremony (the artifact-digest convention, `sha256_hex` house style: no prefix, no truncation), the FULLY-QUALIFIED minter address `subnet:endpoint@node` (the subnet component IS the binding subnet — the record carries no separate subnet field, and the store derives scoping by parsing the minter through the spt-proto address grammar, one truth not two), the mint timestamp in epoch ms, and the ceremony kind as an open string (`totp` arrives W2; FIDO2 is fast-follow; test-seam mints name themselves honestly and never wear a ceremony they did not run). NO EXPIRY AND NO REVOCATION IN V1 (operator ruling 6, 2026-08-23): the timestamp is in the record and a reversed decision is a NEWER seal, so records are IMMUTABLE ONCE MINTED — which is what makes the replicated store a join-semilattice for free (REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED). A seal is EVIDENCE, never an authorization subject by itself (the KNOWN-HAZARDS 7.5 discipline transported): nothing grants on token possession; only a BOUND verify verdict (REQ-SEAL-VERIFY-CONTENT-BOUND) is citable. W1 lands the mint machinery behind an INTERNAL SEAM ONLY — no public mint verb, no ceremony; W2 wires the TOTP ceremony to that seam. The seam refuses EMPTY content: a seal over zero bytes proves nothing and the verify surface treats empty stdin as absent content, so admitting the mint would create a record whose verification is indistinguishable from the no-content refusal. Gate: doc — the ratified CONTEXT.md wax-seal entry carries the record shape; impl — the record struct + mint seam in spt-store; unit — roundtrip persistence, minter-parse-derived binding subnet, empty-content mint refusal."
7197:title = "A SEAL TOKEN IS 8-10 CHARS FROM A NARROW UNAMBIGUOUS LOWERCASE CHARSET, minted by rejection-sampling the OsRng-backed identity source (the knock-code precedent — one randomness source, one audit point; no `rand` crate edge). The charset is the 30-glyph set `23456789abcdefghjkmnpqrstvwxyz`: digits drop `0`/`1` (collide with `o`/`l`/`i`), letters drop `i`/`l`/`o` (same collisions) and `u` (the Crockford accidental-obscenity drop) — REQ-HAZARD-ID-CHARSET's discipline applied to a NEW, NARROWER alphabet rather than reusing the endpoint-id set, because a seal token is read aloud and retyped by humans citing a decision, and `:`/`@` stay permanently reserved address delimiters so a token can never smuggle address structure. MINTS EMIT 10 CHARS (~49 bits over the 30-set — ample for a citation handle whose forgery is harmless by construction, since verify recomputes the content hash and possession grants nothing); VALIDATION ADMITS 8-10 so the format has headroom without a flag day (the sptkc_ versioning lesson: widen by admitting, never by breaking). Well-formedness lives in the STORE beside the record (the knock `is_well_formed` precedent) and every verb validates the token at its seam before touching the store — a malformed token is a refusal, never a lookup miss, so the two cannot be conflated by a caller. Gate: doc — the CONTEXT.md entry's 8-10-char clause; impl — charset const + validator + mint sampler in spt-store; unit — charset membership (every minted char in-set, ambiguous glyphs refused), length bounds both edges, malformed-vs-unknown distinction at the verb seam."
7202:title = "SEAL RECORDS LIVE IN SUBNET SECURITY MATERIAL AND REPLICATE SUBNET-SCOPED, so `spt api seal verify|describe` answers on ANY member node of the binding subnet. The store is `identity/trust/seals.json` beside the grant store and whitelist (one JSON document, atomic write, the grants.rs template; a new path fn in perch.rs per REQ-HAZARD-SINGLE-PATH-SOURCE). PREMISE CORRECTION, MEASURED AT INTAKE (0fcbc086): the grant store and whitelist are NODE-LOCAL AND DO NOT REPLICATE — their 'propagation seam' is aspirational prose with no wire family behind it — so 'same plumbing' is honored by riding the ONE shipped subnet-scoped replication pattern, the notif store's four-part shape: (1) MONOTONE JOIN — the apply point is insert-if-absent by token, so records commute, a replayed feed no-ops, and immutability (REQ-SEAL-RECORD) makes the store a join-semilattice with no delta bookkeeping; a same-token-different-content arrival is DROPPED WITH THE EXISTING RECORD KEPT and counted as an anomaly, never merged, because tokens are minted once and a collision is either astronomical or adversarial, and the adversarial copy is already harmless (verify recomputes the hash). (2) KIND-TAGGED WIRE RECORD — NDJSON with kind = 'seal' (the knockmsg N-1 lesson: an untagged record lands in an old daemon's WanMessage arm as a chat message; a tagged one drops cleanly). (3) STREAMFAMILY REGISTRATION — a `Seal` family arm in classify_first_line + serve dispatch, widening the census array the bijection test asserts. (4) APPLY GATE + FULL-RE-PRESENTATION EMIT + PUMP WORKER — the gate admits a row only when THIS node is a member of the record's binding subnet AND the handshake-proven origin node is on that subnet's roster (fail-closed: non-member subnet drops, untrusted origin drops — the REQ-NOTIF-1/REQ-MESH-5 posture verbatim); the emitter re-presents every record of the subnet (duplicates are free under the join); the pump worker fans per member subnet x roster peer through the existing fan_targets discipline. DEGRADE POLARITY IS OPEN-TO-EMPTY (the grants polarity, chosen deliberately): a husk or corrupt store loads empty, so verify answers unknown-token — the store failing can only LOSE the ability to prove, never mint false evidence, which is the safe direction for an evidence primitive. Binding-subnet scoping is derived from the minter address at the ONE parse helper on the record — the emitter and the gate share it, so the scope a record replicates under and the scope it is admitted under cannot diverge. Gate: doc — the CONTEXT.md entry's subnet-scoped replication clause; impl — store + wire record + family arm + gate/emit/worker; unit — join idempotence + collision-drop, gate's verdict arms (admitted, non-member-subnet dropped, untrusted-origin dropped, replay no-op), emit/decode roundtrip, husk-loads-empty. int at gate: a record minted on one member node answering describe on another."
7207:title = "`spt api seal verify <token>` IS CONTENT-BOUND: the content arrives on stdin, the verb recomputes the lowercase-hex SHA-256 over the exact bytes received and compares it to the record's `content_hash`, and the verdict is BOUND or NOT-BOUND with the record's fields printed alongside — a verify that does not read content is not a verify, so BARE VERIFY WITH NO CONTENT (empty or absent stdin) REFUSES BY NAME, pointing the caller at `describe` (operator ruling 7: `SEAL_VERIFY_NO_CONTENT`, the refusal names the verb that answers the question actually asked). EXIT CONTRACT, PINNED SO A SCRIPTED CALLER CAN NEVER MISREAD A NON-VERDICT AS EVIDENCE: exit 0 IF AND ONLY IF BOUND. NOT-BOUND prints its verdict line (with the expected-vs-presented hashes) on stdout and exits nonzero; an unknown token refuses `SEAL_UNKNOWN_TOKEN` on stderr; a malformed token refuses at the format seam (REQ-SEAL-TOKEN-FORMAT) — three distinct texts, none of them exit 0, because ONLY A BOUND VERDICT IS EVIDENCE (KH 7.5: the token, and any envelope attribute carrying it, is never an authorization subject by itself; forged or wrong tokens are harmless by construction precisely because this verb recomputes the hash). The verbs are READ-ONLY and take no auth gate (the EndpointInfo precedent): the store they read replicates subnet-scoped, so membership already bounds who can answer, and a verify mutates nothing. Gate: doc — the CONTEXT.md entry's verify clause; impl — the api verb, hash recomputation at the store's one helper, the no-content and unknown-token refusals; unit — BOUND on exact bytes, NOT-BOUND on a one-byte delta, empty-stdin refusal pointing at describe, unknown-token refusal distinct from malformed-token refusal, exit-0-iff-BOUND across all five arms. #220 (operator, FIELD-SEAL W2): TWO CHANGES, NEITHER OF WHICH WEAKENS THE BINDING. (1) THE MINT'S TRIM IS MIRRORED AS A SECOND CANDIDATE: `seal mint` seals `raw.trim()` (both ends, the CRLF rationale of REQ-HAZARD-ENVELOPE-CR-LINESAFE), so presented bytes carrying a shell's trailing newline — every `echo |` on the fleet — could never bind the seal minted from that same text. Verify hashes the EXACT bytes FIRST and, ONLY ON A MISS, hashes the mint-trimmed candidate: additive by construction, so nothing that binds today stops binding, including content deliberately sealed WITH its whitespace. The trim MIRRORS THE MINT rather than the ticket's narrower 'trailing' — `str::trim` for UTF-8 content (the identical function the mint calls), ASCII whitespace for bytes the mint verb could never have produced but the store can hold. (2) THE VERDICT'S RECORD BLOCK IS THE NARROW ONE: `token`, `content_hash` and `ceremony_kind` DO NOT surface from verify — the verdict line already carries the token (`SEAL_BOUND:<token>`) and, on a mismatch, both hashes in prose, and a field repeated beside its own verdict reads as a second, weaker answer; `describe` keeps all three. Verify's minter rides VERBATIM (the human render is describe's alone). Gate adds: unit — exact bytes bind, trailing-newline/CRLF/both-ends-padded bind through the fallback, a real one-byte delta and interior-whitespace differences still NOT-BOUND, a seal minted over trailing whitespace still binds its exact bytes, the non-UTF-8 arm, and the three dropped fields pinned as an ABSENCE."
7258:title = "`spt seal mint` IS THE DECISION-SEAL ENTRY POINT: the text to seal arrives on STDIN, the verb requests the daemon's TOTP ceremony over exactly those bytes through the ONE production mint seam (Brain::seal_ceremony -> KIND_SEAL_CEREMONY; the CLI process never verifies, never ledgers, never mints - REQ-SEAL-CEREMONY-TOTP's write-through-daemon posture), and on admit prints the MINTED TOKEN to stdout as the whole result. STDIN IS TRIMMED EXACTLY AS `spt send` TRIMS ITS BODY (the REQ-HAZARD-ENVELOPE-CR-LINESAFE parity: a Windows `echo |` pipes a trailing CRLF, and a seal minted over an invisible trailing newline is a citation whose verify mysteriously reads NOT-BOUND) - so the buffer `spt seal mint` seals for a given text is byte-identical to the buffer a sealed send delivers for that same text; EMPTY content after the trim refuses fast CLI-side by name, before any ceremony opens (a ceremony over nothing asks the human to consent to nothing). REFUSALS RIDE THROUGH VERBATIM: no-surface, content cap, non-UTF-8, throttle, wrong-code and cancellation each surface the daemon's own outcome token and detail sentence - the CLI never re-words a refusal it did not decide (the W2 reply contract: every field is the broker's answer and none of it is the client's to summarize). The binding subnet resolves through REQ-SEAL-SUBNET-BINDING-DEFAULT (minter endpoint's anchor; `--subnet` overrides). EXIT CONTRACT, mirroring verify's 0-iff-BOUND: exit 0 IF AND ONLY IF the ceremony ADMITTED and the token printed; refused / throttled / cancelled / transport-error are each nonzero with the named reason on stderr. Gate: doc - the CONTEXT.md wax-seal entry's mint-verb sentence; impl - the CLI verb and its outcome mapping; unit - admit prints the bare token and exits 0, each non-admit outcome exits nonzero carrying the daemon's own detail verbatim, stdin trim parity with send, empty-content fast refusal by name."
7295:title = "AN ENROLLMENT RECORD IS DURABLE SUBNET SECURITY MATERIAL, MEMBER-VERIFIABLE BY CONSTRUCTION (#217 anchor 2): `{pubkey_hex, node, subnet, enrolled_at, backend_kind}` — pubkey as lowercase hex of the backend's raw public key bytes, node as THE DAEMON'S OWN NODE-KEY SHORT HEX (the nodeid::load_or_create + registry::key_prefix helper pair, 8 hex chars, the ADR-0054 roster short form — NEVER the hostname, the W2 gate ruling transported verbatim), the subnet name EXPLICIT (unlike a seal record, an enrollment has no minter address to derive scope from — the field is the scope), the mint timestamp in epoch ms, and the backend kind token (REQ-SEAL-AUTH-BACKEND-SEAM's encoding clause). THE STORE IS `trust/enrollments.json` BESIDE THE SEAL STORE — one JSON document, atomic write, a NEW path fn in perch.rs per REQ-HAZARD-SINGLE-PATH-SOURCE, absent/corrupt LOADS EMPTY (the evidence-store degrade polarity: a husk can only LOSE the ability to prove enrollment, never mint false evidence). RECORDS RIDE THE SAME SUBNET-SCOPED REPLICATION FAMILY AS SEAL RECORDS (the dispatch's same-family clause): an ADDITIVE KIND-TAGGED wire record in the Seal stream family's feed (the sealmsg NDJSON discipline — a tagged record an N-1 daemon does not know DROPS CLEANLY per line, never lands as chat, never fails the feed), the emitter re-presenting every enrollment record of the subnet beside its seal records (duplicates free under the join), the pump worker unchanged in cadence. THE APPLY POINT IS INSERT-IF-ABSENT KEYED BY (node, subnet) — records commute, replay no-ops, and the store is a join-semilattice like the seal store; a same-key-different-pubkey arrival is DROPPED WITH THE EXISTING RECORD KEPT and counted as an anomaly, never merged: FIRST-ENROLLED WINS EVERYWHERE, because records are immutable v1 (intake ruling 6) and a conflicting claim for an enrolled slot is either a partition echo or adversarial, and the adversarial copy is harmless only if it can never displace the enrolled key. THE APPLY GATE admits a row only when THIS node is a member of the record's subnet AND the handshake-proven origin node is on that subnet's roster (fail-closed, the REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED posture verbatim, same NotifPolicy plumbing). Immutable once minted, no expiry and no revocation v1 — a compromised or replaced authenticator is the stop-and-refer case by design. Gate: doc — the published records surface; impl — record struct + store + path fn + wire kind + gate/emit arms; unit — roundtrip persistence, insert-if-absent join (replay no-op, collision-drop-keeps-existing counted as anomaly), gate verdict arms (admitted / non-member-subnet dropped / untrusted-origin dropped), husk-loads-empty, node half is the 8-hex short form never a hostname. int at gate: a record enrolled on one member node readable on another."
7332:title = "EVERY WRITE INTO A SHARED CONTEXT-STORE WORKTREE IS SERIALIZED BY AN EXCLUSIVE ADVISORY LOCK ON THAT WORKTREE, AND A LOSER WAITS RATHER THAN FAILING (releases#221): concurrent per-agent project-tier ingests commit into ONE shared `p-<project_id>` worktree and race git's `index.lock` and the branch's HEAD ref -- 6 PSYCHE_INGEST_FAIL across 3 agents measured on HFENDULEAM 2026-08-25, `fatal: Unable to create '.../worktrees/<name>/index.lock': File exists` and `cannot lock ref 'HEAD': is at X but expected Y`. THE LOCK LIVES AT THE LEAF GIT OPS OF `BranchStore` -- `commit_in_worktree`, `fast_forward_worktree`, `merge_commit_in_worktree` -- NOT at the ingest call site (doyle ruling 2): the ingest path is one of SIX writers of the same worktree (spt-live reconcile, syncmerge fast-forward + merge, contextstore conflict/rename/monic arms), several of them in OTHER PROCESSES, so a narrow guard leaves the identical collision reachable through a rarer door. It is an EXCLUSIVE FILE LOCK ON A STABLE NEVER-RENAMED SENTINEL keyed by the WORKTREE PATH (the `worker_seq` precedent: fs2, RAII-released on handle drop or process death, so a crashed holder strands no file and there is no stale-lock class to sweep) -- NEVER git's own `index.lock`, which stays exactly what `sweep_stale_index_locks` treats it as. THE LOCK IS NON-REENTRANT AND ACQUIRED ONLY AT THE LEAF, so a caller walking many worktrees (the rename loop) acquires them ONE AT A TIME and never nests -- the no-lock-ordering claim is an ASSERTION IN A UNIT, not a comment (doyle ruling 2 rider). ACQUISITION BLOCKS WITH A BOUND (doyle ruling 3): default 10s (two pulse periods; the guarded op is sub-second, so contention is milliseconds), overridable ONLY by a test-scoped `SPT_TEST_*` env var that never enters the operator vocabulary. A pulse tick MAY block -- it blocks only that endpoint's own driver thread, and failing fast is the very defect. ON TIMEOUT the acquire returns an ERROR carrying THE SENTINEL PATH AND THE ELAPSED WAIT BESIDE THE BOUND (at-budget vs under-budget is the only discriminator between a deadlock and a slow box), and that error rides the EXISTING capture-and-continue seam: PSYCHE_INGEST_FAIL is printed, a hard-ingest strike accrues, and THE DROP FILE IS PRESERVED -- nothing is consumed, so nothing is lost, and the F-032 preserve-pending arm (REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE) is untouched beneath it. THE LOCK IS THE ONLY MECHANISM: no retry belt over git's own lock errors (doyle ruling 4) -- a second handler would make a broken lock invisible, and an index.lock failure observed WHILE the sentinel is held is a FINDING to file, never a transient to swallow. Sibling surface: REQ-PSYCHE-INGEST-FAILURE-LOUD (the misplaced-drop half of the same observability seam). Gate: impl -- the sentinel path fn + bounded exclusive acquire + its wiring at the three leaf ops; unit -- an acquire held by one handle makes a second measure elapsed >= the hold and THEN succeed (the lock is load-bearing, proven by elapsed not by a rate), the timeout error names the sentinel path AND the elapsed AND the bound, the bound is env-overridable in test scope only, a multi-worktree caller's acquisitions are sequential and never nested (the lock-ordering assertion), and a timed-out ingest DELETES NO DROP. int -- TWO PROCESSES committing concurrently into one shared worktree: zero failures, every slice PRESENT by existence read, per-arm durations reported, plus a DETERMINISTIC arm where process A holds the sentinel for a known T and process B's acquire measures elapsed >= T then succeeds."
7391:title = "A COMMUNE IS ACCOUNTED AT THE DELETION CORE ALREADY PERFORMS, CARRYING THE DROP FILE CONTENT VERBATIM (operator ruling 5). The event fires where `ingest_drops` consumes a commune drop and unlinks it — the seam core already owns — and its payload is the bytes of that file, never Psyche output, never echo-commune output, never the composed brief a resume renders from it. Wake markers (`!!wake!!`) are the harness adapter's construct and get ZERO special treatment here: core carries the text through untouched and does not parse, strip, or act on them. TWO DELETIONS EXIST AT THIS SEAM AND ONLY ONE IS A CONSUMPTION: the F-032 commit-before-delete branch (REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE) deliberately PRESERVES a commune drop whose project slice could not be committed, rewriting it in place for a later resolvable ingest, and deletes only a SIGNOFF source there — a drop on that branch has not been consumed, it is coming back, and emitting for it would double-fire when the real consumption later deletes the same content. Emission is therefore keyed on the CONSUMPTION OUTCOME the ingest already reports (`preserved` false) rather than on reaching a call to remove_file, so the preserved path is excluded structurally instead of by a condition a later edit can drift past. A DELETED SIGNOFF DROP EMITS NOTHING: the vocabulary has no SIGNOFF token and one is not borrowed. Emission never alters ingest: a drop is consumed, preserved, or left to retry exactly as it is today regardless of the funnel."
7479:id = "REQ-HAZARD-IOLOG-SEQ-MONOTONIC"
7514:title = "A NODE-PREFIXED URL FOR A SUBNET PEER IS SERVED BY THE OWNER THROUGH THE LOCAL DAEMON, WITHOUT A CACHE (ADR-0056, ADR-0060, WEBSERVE W1, releases#272/#249). A request on the loopback server for `/<peer>/...` where `<peer>` is a KNOWN subnet member opens ONE Iroh stream of a NEW TAGGED stream family (kind web -- the Knock shape: an N-1 owner has no arm, classifies it Unknown and drops it, so the requester answers 502 naming the node under a DEADLINE, never a hang) and relays the owner's answer back verbatim. THE OWNER DECIDES: it runs access_check on the WEB surface with the origin taken from the HANDSHAKE-PROVEN stream identity (the serve_xfer shape, REQ-HAZARD-WAN-ORIGIN-AUTH), the subject being the served entry's registering endpoint, and a refusal comes back as 403 whose body names the SURFACE and never a sender (WEB is non-attributable in W1). The owner resolves the served name through the SAME router the local facet uses, so an edit is visible on the next fetch, a deleted source is the owner's 404 carried back as 404, and the reserved facets stay router-first on the requester (`/<peer>/f/`, `m/`, `bin/`, `install` answer locally, no stream opened). NO CACHE: nothing is written under the requesting node's SPT_HOME; the body is STREAMED in bounded chunks, never buffered whole. HEAD, Range (forwarded verbatim; the owner's 206 with Content-Range comes back; unsatisfiable is 416) and Content-Type are the owner's. STATUS NAMING, ruled 2026-09-07: unreachable owner / dropped stream / deadline = 502 naming the NODE; owner deny = 403 naming the SURFACE; an UNKNOWN first segment is the docs compatibility 404 UNCHANGED (ADR-0056 Am.1 order), never a 502; a served-name miss is the owner's NOT_FOUND body at 404. Gate: doc -- the cross-node serving page (grammar, statuses, deadline, no-cache) and the access-viewing WEB row text; impl -- the tagged wire family, the dispatcher arm, the owner-side gate + serve, the requester-side resolve-to-proxy, the streaming body; unit -- the record family round-trips and an unknown kind is skipped, the tagged first line classifies as Web and never as a message, the census bijection, the Range grammar (single range, suffix, open-ended, unsatisfiable), the router's proxy-or-local decision per facet, the 502 shape naming the node and the 403 shape naming the surface; int -- two REAL daemons on one box: byte-equal fetch through the requester, a WEB deny rule on the owner answering 403 naming WEB, Range answering 206 with Content-Range, the owner stopped answering 502 naming the node within the deadline, an unknown label answering the docs 404, a reserved facet answered locally; plus the two-host cells on the real rig (fetch, deny, range) as their own #[test] fns."
7540:title = "A SERVING ENTRY MAY NAME THE ONE ENDPOINT ALLOWED TO FETCH IT, AND THAT AUDIENCE IS ENFORCED WHEREVER THE ORIGIN IS PROVEN (ADR-0058 Amendment 1, operator-directed 2026-09-06, releases#272/#17). `audience` is a PER-ENTRY, KIND-INDEPENDENT field sitting beside ttl: ABSENT means the entry is reachable by anyone the WEB surface admits, which leaves REQ-WEB-ACCESS-SURFACE's default-on subnet posture UNCHANGED; PRESENT means the owner serves the entry ONLY to that endpoint id and answers everyone else 403 NAMING THE SURFACE -- deliberately the SAME refusal shape a WEB deny rule produces, so a narrower audience is not distinguishable from a denial by probing, and the registry does not become an oracle for what exists. IT IS ENFORCED WHERE THE FETCH ORIGIN IS PROVEN: the cross-node stream's handshake-proven identity (REQ-WEB-CROSS-NODE-PROXY, REQ-HAZARD-WAN-ORIGIN-AUTH), which is the only place a requester's endpoint id is evidence rather than a claim. LOOPBACK REMAINS THE TRUSTED MACHINE, and that is STATED rather than implied: a local browser presents no endpoint identity, so a request arriving on the loopback server is served, and an audience is therefore a CROSS-NODE NARROWING -- an operator who needs secrecy from other users of the same machine has file permissions, not this field. THE FIELD IS VISIBLE IN `spt serve list` beside ttl and origin, because the registry's one job is answering what this node exposes AND TO WHOM, and a hidden narrowing would make that answer a half-truth. Gate: doc -- the serving overview page's entry-fields section; impl -- the field on the entry, its persistence, the owner-side check on the cross-node path, the list rendering; unit -- an absent audience admits, a matching audience admits, a NON-matching audience refuses with the same 403 shape as a surface deny, loopback is served regardless of audience, and the field survives a registry round-trip and renders in list; int -- two real daemons where the named endpoint fetches byte-equal and a requester that is not the audience gets 403."
--- hazards doc tail ---
| 7.1 | Local `api` mutation authenticated to endpoint | api surface / broker IPC |
| 7.2 | Idempotent delivery across brain restart | broker↔brain IPC |
| 7.3 | Psyche outbound captured + `from=`/target stripped + reply-to-sender / notify-to-own-user | live-Psyche driver / daemon relay (ADR-0012) |
| 7.4 | Per-agent pulse/psyche/echo runs off the shared scheduler (no serial blocking across agents) | daemon multi-agent hosting (ADR-0004) |
| 7.5 | WAN-inbound origin = QUIC handshake identity from the broker's stream table, never payload bytes | wan receive funnel + every wire-inbound consumer (ADR-0009) |
| 7.6 | Pump brain-IPC reads deadline-bounded (30s total-wait); TimedOut → supervised restart, never per-peer retry | `Brain::cold_start_pump` / `BrainConn::Split` (reader-thread + `recv_timeout`), `pump::peer_outcome` |
| 7.8 | Broker bounds every brain-waiting QUIC op (10s < the brain's 30s); a dead peer fails as an ORDINARY error the broker replies → per-peer redial, round continues, no pump restart (the 7.6 B-half) | `NetHost::bounded_block_on` wrapping `dial`/`open_stream`/`send_stream` |
| 7.9 | A daemon-state wire change (e.g. the v0.9.0 agnostic Seed) needs a deliberate broker restart — the resident old broker can't read new bytes; the seed-skew EOF surfaces an actionable `spt daemon stop` hint, not "failed to fill whole buffer"; forward: additive + serde-default daemon-state | `cmd_seed`/`seed_fail_message`, broker seed-control residency |
| 7.10 | A view is independent from the endpoint: the cold-started daemon is launched JOB-NEUTRAL (WMI `Win32_Process.Create` PRIMARY → WmiPrvSE child, outside any terminal job from birth; breakaway DEMOTED to a fallback rung because a job CAN deny it). A WMI/scheduler child does NOT inherit transient shell env, so `SPT_*` (esp. `SPT_HOME`) is forwarded via a `cmd /c set … & start /b` wrapper. Ladder (first-success-wins, both cold-start + `spt daemon start`): WMI → schtasks → breakaway → in-job. int IS CI-testable via the WMI rung (no nesting false-red — WMI escapes regardless of job policy); operator WT/VSCode tab-close = final non-gating confirmation. `detached_no_inherit` unchanged for `launch_shell`; elevated `deelevate` keeps L1 breakaway (WMI-reparent = follow-up) | `daemon.rs::launch_daemon_job_neutral` (ladder), `spawn_daemon_via_wmi`/`wrapped_daemon_command`, int `job_escape_e2e.rs` |
| 7.11 | A dead PTY child + a dropped operator pump does NOT wedge the broker — PROVE-DON'T-CHANGE: send_stream already QUIC-deadline-bounded (7.8), the loopback duplex is drained broker-internally (evict-not-park), block_on parks the dispatch thread not a net worker; dead endpoint offlined within a reconcile tick | int `attach_wedge_e2e.rs` |
| 7.12 | Controller output delivered OFF the drain thread (dedicated writer + bounded deadline-detach), never inline under the log lock — a backed-up controller can't wedge the session | broker `OutputLog::append`/`controller_writer`, int `inject_control_wedge.rs` |
| 7.13 | `spt rc` maps Windows legacy-console delete keys so Backspace→char-delete / Ctrl+Backspace→word-delete; does NOT enable VT console input (= win32-input-mode on WT, broke detach). SUPERSEDED on Windows by 7.16 (the byte-swap `normalize_key_byte` removed; behavior native in `translate_key_event`) | `rc.rs` → 7.16 `translate_key_event` |
| 7.14 | `EffectJournal::apply_once` releases its lock ACROSS `effect()` (reserve→release→run→finalize), never holding it across the blocking PTY write; `EffectKind::PtyWrite` is ephemeral (no per-keystroke fsync, in-memory dedup), durable kinds keep fsync — fixes interactive stutter + the hard input wedge (`brain IPC read deadline`) | `effect.rs` `apply_once`/`is_durable`, int `inject_control_wedge.rs` |
| 7.15 | `reconcile_hosted_liveness` clears stale `driven_by` when it offlines a sessionless controllable perch (no live broker session) — an OFFLINE endpoint never renders phantom `ONLINE+CONTROLLED`; race-free (no session ⇒ no concurrent broker re-stamp). `controller_by==None` is ambiguous (local controller reads None) so it is NOT a clear trigger; the idle wedged-remote leg is deferred (`REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT`) | `livehost.rs` `reconcile_hosted_liveness`, int `driven_by_selfheal.rs`/`inject_control_wedge.rs` |
| 7.16 | `spt rc` on Windows reads crossterm KEY EVENTS and translates to standard xterm VT (arrows/Home/End/PgUp/Dn/Ins/Del/F-keys + modifiers reach the harness; agnostic, NOT win32-input-mode); `ctrl-b d` detach preserved event-sourced; non-tty + Unix keep the byte path; supersedes the 7.13 byte-swap | `rc.rs` `translate_key_event`/`key_event_step`/`spawn_stdin_reader_events`, unit-only (live = HITL) |
| 7.17 | PTY **input** is single-writer: each session spawns ONE dedicated input-writer thread = the SOLE caller of the blocking `write_input`, fed by a bounded FIFO (`sync_channel`). Every caller (`dispatch_input`, `dispatch_endpoint_input`, the inject worker/floor flush) ENQUEUES (`try_send`) + returns at once — a paste burst that fills the harness input buffer parks only that thread, never the broker dispatch thread. Full queue ⇒ DROP excess + stamp the perch `input_backpressure` (heal-on-resume: cleared on the next accepted enqueue); the daemon NEVER wedges on a stuck harness. Completes the W1b-deferred fix (2) of 7.14. The OUTPUT-side single-writer (7.12) mirror, applied to input | broker `InputWriter`/`input_writer`/`flush_inject_floor`/`run_inject_worker`/`dispatch_input`, `spt_store::info::set_input_backpressure`, int `inject_control_wedge.rs` |
| 7.18 | `spt rc` paste is **client-originated** on Windows: CC runs daemon-side with no access to the operator's LOCAL clipboard. On a RIGHT-CLICK rc reads the local clipboard itself and injects a BRACKETED paste (`ESC[200~` + content + `ESC[201~`) — CC has bracketed-paste mode on (`ESC[?2004h`), so a multi-line paste lands intact with NO `\r` submit-storm, harness-agnostic, content VERBATIM. RawGuard captures the mouse (disables console QuickEdit so right-click reaches the app) on an interactive console only + restores on drop. **ctrl+V is NOT intercepted** (P1b): WT consumes it (Key RELEASE only, never Press) + injects the clipboard as a key flood — it rides WT's native paste as keystrokes (no wedge, 7.19; bracketed = right-click). cfg(windows) only — Unix pastes natively | `rc.rs` `wrap_bracketed_paste`/`mouse_is_paste`/`clipboard_paste`/`read_clipboard`/`RawGuard`/`spawn_stdin_reader_events`, unit-only (live clipboard+mouse = HITL) |
| 7.19 | An operator input FLOOD must not deadlock the broker: `serve_attach` sends N `Input` frames on one conn without reading, the broker acks each on the SAME conn → the return direction fills (~pipe buffer) → `send_frame` blocks the per-conn handler → mutual full-duplex DEADLOCK (permanent broker wedge, controller latched). FIX: opt-in ack — `InputReq.ack` (serde default true); the operator/rc path sends `ack=false` (`send_effect_no_ack`), `dispatch_input` skips the applied frame → the handler never writes back while draining the flood. `shellchan` keeps `ack=true` (its `Applied`-wait). Exactly-once unaffected (dedup at the applied-set). N-1: an old resident broker still acks until restart (7.9 class) | `msg.rs` `InputReq.ack`, `brain.rs` `send_effect_no_ack`, `attach.rs` `serve_attach`, `broker.rs` `dispatch_input`, int (flood repro) |
| 7.20 | `spt rc` must forward the SCROLL wheel to the harness — our mouse capture (for right-click paste, 7.18) steals WT's native scroll. Track the harness's mouse-reporting mode from its OUTPUT (DECSET `ESC[?1000/1002/1003h` + `1006h` SGR, and `…l` off; scan survives a split across output chunks) into `MouseMode{enabled,sgr}`; forward `ScrollUp/Down` as an xterm SGR report (`ESC[<64/65;col+1;row+1M`) ONLY when `enabled && sgr`, else drop; Moved/drag/clicks dropped. cfg(windows) only — Unix scrolls natively | `rc.rs` `MouseMode`/`MouseModeScanner`/`scroll_dir`/`scroll_sgr`/`spawn_stdin_reader_events`, unit-only (live mouse = HITL) |
| 7.21 | Exactly ONE LIVE `controller_writer` per brain↔broker connection + every writer emits an ASCENDING seq stream ⇒ a snap-above consumer over the surviving writer's COMPLETE `[0,end]` replay delivers `[K,end]` with no skip/dup. A brain-restart re-serve double-registered the controller (handoff's `subscribe(from_seq=K)` + the re-serve's `attach_as(sid,0)`) → two writers raced one socket → the consumer's strict reject-gap legacy path saw `got seq 1 want 0` (flaky `attach_survives_target_brain_restart_exactly_once`). FIX (fix #1 "drop handoff's subscribe" REVERTED — it's the standalone-resume mechanism): (1) `handoff` seeds `session_cursors` → dedup-below + snap-above (correctness, made complete by the ascending-merge property); (2) `controller_writer` epoch-gated via shared `Arc<AtomicU64>` `controller_epoch`, re-read UNDER `send.lock()` (single live writer); (3) `subscribe_with` resets the resume-mode dedup cursor to `from_seq` (shared by `attach`/`attach_as`) — the LOAD-BEARING fix for the operator-stream boundary: serve_attach consumes the handoff replay's seq K before `attached`, advancing the cursor; the `attach_as(0)` re-subscribe reset re-delivers it so the operator viewport stays gapless. Pre-existing; P1b innocent | `brain.rs` `handoff`/`subscribe_with`, `broker.rs` `become_controller`/`controller_writer`/`controller_epoch`, unit `src/broker.rs`, int `tests/broker.rs`+`attach.rs` (keystone + restart carrier, 20× on kitsubito) |
| 7.22 | Endpoint-stop / brain-death reaps a brain-LESS perch's orphan detached Psyche via the cmdline-scoped guard — the handle-reap (`stop_host`, REQ-HAZARD-UNHOST-PSYCHE-REAP) CANNOT (the owning brain is dead, so its `psyche_child` handle died with it) and the brain-START sweep (REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP) never fires for a perch being STOPPED rather than re-hosted. So the live-host runs the scoped reap after `stop_host` at the reconcile stop-side AND in `confirm_residency_or_unhost`. Fail-safe-decline (pid-alive AND basename==psyche-program AND cmdline contains `<id>-psyche`; any unreadable signal DECLINES — a missed dup is bounded, a wrong-kill catastrophic). The orphan-leak half of perri F-010xF-015 (the psyche own-copy is the other half, ADR-0025 amendment) | `livehost.rs` `reap_orphan_psyche_for`/`reap_stopped_endpoint_orphan_psyche`/`reconcile_once`/`confirm_residency_or_unhost`, unit `livehost.rs`, int W3e (perri step 3) |
<!-- [doc->REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP] -->
| 7.23 | An already-spooled message (WAN-arrived or spooled-while-active) NEVER depends on adapter hook-poll cadence to reach a relay-less spt-hosted endpoint — the daemon drives delivery on the events it owns. TWO daemon triggers feed ONE shared translation-binary inject leg (`spt_daemon::inject::try_spt_hosted_inject`): WAN ingress (`receive_wan` injects before spool — leg 1, `[REQ-WAN-SPT-HOSTED-DELIVERY]`) + the ACTIVE→IDLE edge (`drain_idle_window` claims the pending spool — NON-DEFERRED ONLY since the 2026-07-27 scope amendment; `active_only` is hook-carried and outside the guarantee — and injects, reusing the hook-poll take/ack so a concurrent `api poll` can't double-deliver — leg 2, `[REQ-MSG-IDLE-EDGE-DRAIN]`). v0.14.3 LAW holds on both: no binary ⇒ SPOOL LOUD (row released intact), never a raw PTY write. Fixes F-023 "sent but never lands" on an idle relay-less perch with a healthy binary | `inject.rs` `try_spt_hosted_inject`, `wan.rs` `receive_wan`, `delivery.rs` `drain_idle_window` + `spool.rs` `claim_idle_edge_at`/`release_at`, int `inject_control_wedge.rs` `wan_arrival_to_idle_spt_hosted_injects_with_no_hook_poll` + `idle_edge_drain_e2e.rs` `spool_while_active_then_idle_fires_injection` |
<!-- [doc->REQ-HAZARD-DELIVERY-STARVATION] -->
| 7.24 | A DELEGATED live adapter apply never reports success without swapping, and the live-update seam uses ONE parent-aware matcher. `spt_runtime::profile::adapter_parent_matches(session_adapter, parent)` (`split_option().0 == parent`) at ALL three comparators (CLI `adapter_has_live_endpoint`, broker `dispatch_adapter_apply` filter, `select_endpoints_running_adapter`) — no exact `==` against a record name, so a `--adapter cc:ccs` composite endpoint resolves to parent `cc`. `dispatch_adapter_apply` swaps UNCONDITIONALLY (empty-affected early-return removed); `KIND_APPLIED` only after a real swap. Fixes F015B silent no-op (D1 matcher skew dropped every `:profile` endpoint → affected=[] → D2 success-without-swap) | `profile.rs` `adapter_parent_matches`, `broker.rs` `dispatch_adapter_apply`/`select_endpoints_running_adapter`, `cli.rs` `adapter_has_live_endpoint`, unit `profile.rs`+`broker.rs`, int (e2e a/b/c, this wave) |
<!-- [doc->REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP] -->
| 7.25 | A perch pinned to a DEAD session self-heals; a LIVE-owner rotation still refuses. `authenticate()` (auth.rs): sid mismatch AND recorded owner pid DEAD (`proc::is_process_alive`) → accept caller sid + RE-PIN (`mutate_info` rotate `session_id` + LOUD `SESSION_REPIN`) — ADR-0032 layer 2, same trust as `establish_perch`'s dead-owner rebind. LIVE-owner mismatch (a `/clear`/`/compact` live-pid rotation) STILL refuses (squat, unwidened — live-rotation proof is the adapter's layer-1 job, `[REQ-BOUNDARY-ROTATION-CREDENTIAL]`; parent_pid ancestry = parked layer 3). ADDITIVE to token auth (branch fires only on no/failed token AND sid mismatch AND owner dead). Fixes the F-024C/D permanent-strand wedge (one lost boundary rotation → every id-scoped hook incl boundary AUTH_REFUSED forever, stderr-silent in a hook) | `auth.rs` `authenticate` dead-owner branch, unit `auth.rs` `pinned_to_dead_sid_mismatched_poll_repins`+`live_owner_mismatch_still_refuses`+`token_auth_path_unchanged` |
<!-- [doc->REQ-HAZARD-SESSION-PIN-WEDGE] -->
| 7.26 | Concurrent first-touch of ONE fresh BranchStore all-Ok — the non-atomic `git init` (template-hook copy) + `config.lock` race must never strand a first-toucher. `open_or_init` → `init_bare_tolerant` (bounded backoff-retry on the init collision that desyncs racers + open-after-lose on a racer-created HEAD) + `config_set_locked_retry` (bounded `config.lock`-aware retry; `core.autocrlf` idempotent). Convergence guaranteed: a lone re-init on a partial dir completes. Fixes the G3-gate pump.rs:442 flake | `branchstore.rs` `open_or_init`/`init_bare_tolerant`/`config_set_locked_retry`, unit `concurrent_open_or_init_on_one_fresh_store_all_ok` (N=8, RED-FIRST) |
| 7.27 | A control/viewer stamp never outlives its session — every teardown path clears what attach stamped. `/exit` kills the CHILD (endpoint suspends on child death) so the teardown runs the REAP path (exit-waiter → `sessions.remove`), never the controller-detach path — the only pre-fix stamp-clear. The exit-waiter now calls `OutputLog::stamp_reaped()` = `set_driven_by(None)`+`set_controlled(false)`+`set_viewer_count(0)` on reap (broker single-writer, unconditional/idempotent, race-free — dead session ⇒ no concurrent re-stamp). Fixes F-026 #2 (hall-a latched `controlled:true` + gossiped `controller_node=self` for hours after `/exit`). Distinct from 7.15 (sessionless reconcile heal) | `broker.rs` `OutputLog::stamp_reaped` + exit-waiter reap call, int `control_stamp_lifetime.rs` `reap_clears_control_and_viewer_stamps` (RED-first) |
| 7.28 | A relative manifest path naming an endpoint-read/written location resolves against the ENDPOINT's cwd (`info.cwd`, read at USE time), never the daemon's process cwd (one daemon hosts many cwds). commune_dir/signoff_dir resolve at ingest: absolute as-is, relative+cwd joined, relative+no-cwd SKIPPED loud-once. Project routing spt-internal-gated (an anchor under `$SPT_HOME` → no `p-<project>`, live slice still commits; else `project_id_for_dir` parity). Owlery-gated until releases#178 widened the base to the whole spt home — a strict superset, so the parity leg is unchanged for every real user project. {cwd}-templated (digest/history) + daemon-absolute-filled (session-role/translation) keys already anchored. Fixes F-026 SI-1 (pristine BranchStore box-wide; abs-only test fixtures masked the relative leg) | `lifecycle.rs` `resolve_endpoint_drop_dir`/`is_spt_internal`/`warn_no_cwd_once`/`pulse_tick`, `ingest.rs` `route_slices` empty-id skip, int `relative_commune_dir_resolves_against_endpoint_cwd_and_fills_project_branch` (RED-first) |
| 7.29 | Control/viewer stamps CONVERGE to broker session-table truth (upward), not merely edge-trigger — the companion to 7.27's downward edge-clear. A picker-created endpoint's spawn `set_controlled(true)` fires PRE-bind (no perch → `mutate_info` NotFound swallowed); the adapter binds `controlled:false` and no edge re-stamps → uncontrolled-forever-while-driven (hall-b). Broker (single-writer) re-asserts each live session's stamps DIVERGENCE-GATED (write only on diff, no fsync storm) on the `KIND_SESSIONS` poll (bounded window = reconcile cadence, no new timer); truth snapshotted under the log lock, writes OFF it. Event-on-input insufficient (idle controlled sessions). Fixes F-026 stamp-gap | `broker.rs` `stamp_divergence`/`converge_perch_stamps`/`has_controller`/`live_viewer_count` + KIND_SESSIONS handler, unit `stamp_divergence_gates_writes`, int `converge_stamps_on_sessions_poll_after_late_bind` (RED-first) |
| 7.30 | A Psyche failure of ANY shape never removes/alters the parent endpoint's ready/hosted state — a Psyche is a bounded per-event turn, so there is no "resident gone" signal; a turn failure stamps `psyche_host_error` ONLY, never `status`/ready. Residency machinery (`confirm_residency_or_unhost`) + the teardown-on-psyche-trouble deleted. Fixes the adapter v0.13.2 field brick (shim exit → residency teardown → ready removed → permanent `cli-gate-not-hosted`) | `livehost.rs` residency/reap deletions, `lifecycle.rs` `run_psyche_event_turn` psyche-fields-only stamp + `first_turn_psyche_context` non-empty, int (hall-bf shape: failing psyche → parent stays deliverable, no churn) |
<!-- [doc->REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION] -->
| 7.38 | Every physical broker-conn write bounded + cancelable + poison-on-failure (independent watchdog aborter; poisoned conn never reused; SendHalf never leaves the conn object) | broker `conn.rs` `BrokerConn`, all write sites (`controller_writer`/`viewer_writer`/`send_frame`/nethost), int `brain_decouple.rs` |
| 7.31 | The Psyche failure budget counts REAL per-event attempts — every bounded per-event turn feeds a consecutive-N budget (default 3), so per-event churn a resident rate-guard was blind to now counts by construction. Fixes hall-bf's ~12/min re-host churn that ran invisibly (boot records weren't ledger boundaries to the old guard) | `lifecycle.rs` `note_turn_outcome`/`psyche_turn_strikes_exhausted` (stamps `psyche_host_error` on exhaustion, no `status` de-stamp), unit synthetic failure-loop trips the budget (RED-first control) |
<!-- [doc->REQ-HAZARD-THRASH-GUARD-BLIND] -->
<!-- [doc->REQ-HAZARD-STORE-INIT-RACE] -->
| 7.64 | Session-scoped authority CARRIES across a session-id rotation as a MOVE, never a copy: after any path through the boundary it is reachable at at most ONE session id, and on a failure path at NEITHER (neutralize the old record BEFORE writing the new one; two barriers, removal then empty-in-place; loud, and never a boundary refusal). Gated on the endpoint that can hold one, since the record is keyed by session id ALONE. Closes the BOUNDARY edge only — the dead-owner re-pin and an `establish_perch` re-bind have the opposite polarity (DROP) and are filed as releases#138 | `empower::{carry_session,carry_between,neutralize_at}`, `api/reporting.rs` `cmd_boundary` (ER-gated, old sid captured under the rotation's own lock), ADR-0052 §3c |
<!-- [doc->REQ-HAZARD-EMPOWER-SESSION-RESURRECT] -->