---
name: broker-cutover-refuses-from-a-perched-shell
description: "spt update --restart refuses from any spt-hosted session (OWL_SESSION_ID) and EXITS 0 — a plain-shell success never generalises to a perched one, and the running broker only lifts on a real daemon bounce"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: d62f0296-f25d-4225-a244-7a5697de1b19
  modified: 2026-08-04T21:51:34.820Z
---

Measured on HFENDULEAM 2026-08-04 (installed 0.53.0, running broker 0.52.0), verbatim:

    UPDATE_FINISH_REFUSED: a broker-stopping command is never run by an spt endpoint
    ($OWL_SESSION_ID is set). this would kill the running session(s) of all 8 spt-hosted
    endpoint(s) on this node, including your own: ... No flag overrides this, `--force` included.
    === EXIT=0 ===

Post-state unchanged: `broker image: 0.52.0 (running)`, same daemon pid. Three facts to keep:

1. **`spt update --restart` is NOT a way around the hosted-session guard.** It hits the same
   refusal as `spt daemon stop`. A node whose daemon hosts endpoints can only be cut over from a
   NON-endpoint shell (a plain terminal — human hands). That was three of five fleet nodes.
2. **The refusal exits 0.** `spt update --restart && record_rolled` records a roll that never
   happened, on the majority path. Filed as releases#153 (BUGFIX). Read the OUTPUT, never the
   status.
3. **Installed version is not the running broker.** `spt --version` and `coordinator image:` can
   read 0.53.0 while `broker image:` runs 0.52.0 "for the life of this daemon" — measured on two
   of five nodes (hfenduleam 0.53/0.52, DESKTOP-VHCFIBH 0.52/0.46). doyle ratified RUNNING-broker
   as the predicate for the UNBOUND-unwedge retirement; installed-version sweeps are dead as a
   fleet instrument.

**Why:** I ran `--restart` successfully on kitsubito over ssh and told two other nodes' agents it
routed around the guard. It worked there only because a plain ssh shell carries no
`OWL_SESSION_ID` — **the caller's ENVIRONMENT was the variable, not the verb.** Both agents had
refused on their own judgement and were right; they held for my measurement instead of acting on
my claim, which is the only reason the bad advice cost nothing.

**How to apply:** when a command succeeds in one shell and you are about to tell someone it will
succeed in theirs, name what differs about the two ENVIRONMENTS first. Same class as
[[two-locks-one-env-var]] and [[perched-gate-run-strips-agent-env]]. And state a
documented-not-measured claim as such — but point the caveat at the right risk, which here was
generalisation, not the documentation.

Related: [[verdict-from-exit-not-from-silence]], [[exit-code-after-a-pipe-is-the-tails]],
[[derived-view-vs-on-disk-record]], [[relay-is-not-the-gaters-word]].