---
name: f027-endpoint-spawn-fail-design
description: F-027 ENDPOINT_SPAWN_FAIL design FROZEN @56211da — bind-deadline honesty + pre_spawn perch-stamp env seam; impl post-F-029 (core=todlando, seeder=perri)
metadata: 
  node_type: memory
  type: project
  originSessionId: 8fda46ea-ed24-488a-8558-70a81c4d75be
---

F-027 design FROZEN 2026-07-03 @56211da (f028-runtruth):
docs/F-027-ENDPOINT-SPAWN-FAIL-DESIGN.md. Perri field-review Q1-Q4 all folded:
(1) 60s deadline default confirmed — real binds t+5-15s, every >20s bringup was
a wedge never a slow success, FLOOR 30s, per-node --bind-deadline override;
(2) pre_spawn on [session.resume] too — resume re-checks trust (INT-2: resumed
CC died at trust dialog); (3) mode-6 RELAUNCH-NEVER-BINDS = F-028 B1/B4 FIXED,
0.23.0 definitive repro (same-id rerun after tree-kill re-binds fresh session;
her first check was rig-void — --subnet omitted on multi-subnet box, caught it);
(4) env capture-at-creation = BINDING Half-B invariant: [env] direction="read"
vars perch-stamped at creation, seeder AND session spawn BOTH consume the stamp,
NEITHER reads own process env (else mismatch returns through back door).

Design spine (perri taxonomy, 6 modes): silent class {TRUST-WEDGE,
ACCOUNT-ROOT-MISMATCH, PSYCHE-CRASHLOOP(guarded), RELAUNCH-NEVER-BINDS} must
match loud pre-spawn class {ADAPTER-UNRESOLVED, STALE-CLI-CONTRACT}.
- Half A (core): ENDPOINT_RUN_STARTED moves to after observed bind; deadline
  miss = ENDPOINT_SPAWN_FAIL:{id}: reason={WEDGED_PRE_BIND|EXITED_PRE_BIND|
  NO_SESSION|PRE_SPAWN_FAIL} CLI stderr + nonzero exit + perch stamp (cleared
  on later bind). --no-wait prints ENDPOINT_RUN_DETACHED.
- Half B (core executes, adapter owns binary): manifest pre_spawn key in
  [session.<role>]; broker runs it under IDENTICAL env block as session spawn
  (env parity = kills account-root-mismatch by construction), install-dir-first
  (REQ-INSTALL-11), 30s bound, nonzero aborts loud.
- KEY CORRECTIONS from perri: backslash trust key = HER RIG ARTIFACT (CC writes
  + matches forward-slash exact-string keys); real seed-2 root = per-root trust
  × whether CLAUDE_CONFIG_DIR survives detached spawn env-rebuild (Reavo vs
  Brandon dual-root box).
- REQ seeds (register at wave start): REQ-ENDPOINT-RUN-BIND-DEADLINE,
  REQ-PRESPAWN-COMMAND-SEAM, REQ-HAZARD-ENDPOINT-STARTED-SILENT-WEDGE.
- Impl sequencing: post-F-029; core halves = todlando, seeder = perri.
- Recon anchors: success print cli.rs:1819/1833; ready ONLY written by
  establish_perch api/startup.rs:299 (harness's own bind hook); trust handling
  greenfield in core; TRANSLATION_SPAWN_FAILED daemon-stderr trap = channel to
  avoid.

Related: [[f028-runtruth-w3-progress]] (B6 root separate, stays OPEN).

**Index-detail preserved on 2026-07-06 compaction (F-030 seed line):** F-030 DESIGN WRITTEN + WAVE DISPATCHED 2026-07-04: docs/F-030-PSYCHE-EPHEMERAL-DESIGN.md @6f668c2 branch f030-psyche-ephemeral, todlando building (W1 driver → W2 sid custody → W3 residency retirement [conformance heart] → W4 nested-resolution → W5 .live-bin → W6 docs/ADR), doyle gates per chunk; perri rebases parked branch on W1/W2 contract freeze, publish floor-gated. Original seed: perri PSYCHE-EPHEMERAL-PLAN.md GATED PASS (adapter half; build now, publish parks). Core wave: per-event psyche driver (resume_psyche/run_psyche_turn/psyche_turn_and_relay built+tested, ZERO production callers — livehost only spawn_psyche_owned(sid,None) at host) + psyche-own sid custody ({session_id} fill = PARENT's sid, livehost:518 base_keys) + reseed path + docs ({psyche_context} keylist bug). Dissolves .live-bin rationale. Post-release seeds: translation_fault not human-rendered in list/whoami (SHIPPED v0.26.0 F-1); relay-unregister casualty (SHIPPED v0.26.0 F-2); adapter reason-gated session-end; owner-alive guard; latent 'companion' in shipped 0.23.0 changelog section.