---
name: broker-is-daemon-state-anchor
description: Post-ADR-0018 the BROKER (not the brain child) is the always-up CLI-reachable daemon-lifetime state anchor; place ephemeral in-mem daemon state there
metadata: 
  node_type: memory
  type: project
  originSessionId: 7f5a5890-9c8c-4043-bcb6-647b6f7a36d7
---

Post-ADR-0018 broker/brain process split: the **BROKER** is the always-up anchor — it serves ALL CLI-reachable sockets (broker/seed/digest), survives brain restarts ("brain restart loses nothing", broker.rs), and dies only with the whole daemon. The **brain** is a restartable CLIENT child (KIND_BRAIN_RESTART, supervise_brain), serves nothing.

**How to apply:** Any in-mem daemon-lifetime state that must (a) be CLI-reachable and (b) survive brain restarts but die with the daemon belongs in the BROKER, alongside DigestHub (`Arc<DigestHub>` + `serve_digest_control`). State held in the brain is unreachable to the CLI and lost on every brain restart. close_shell runs IN the brain, so clearing broker-held state on link-break needs a brain→broker KIND verb.

**Why:** My M11-W2 drive-slot gate said "bind to the brain" — wrong word. My functional spec (always-up, CLI-reachable, survives restart) actually maps to the broker; todlando caught it before cutting code. Honoring the functional intent over the loose word was the right call (not a whipsaw — genuinely-blocking architecture data).

Drive-channel no-replay corollary: clear-on-link-break (brain→broker KIND_DRIVE_CLEAR) is NOT crash-robust alone — brain can die between offline-flip and clear-ack. The robust invariant is link-generation stamping (a gen-N frame never served to gen-N+1's relink token). See [[gate-against-documented-design]].