---
name: stable-anchor-is-not-a-recycling-defense
description: "Anchoring liveness on a \"stable\" pid (parent_pid, harness pid) changes WHICH pid is probed, not whether that pid can be recycled — two in-tree comments assert the defense anyway."
metadata: 
  node_type: memory
  type: project
  originSessionId: fd32d227-bb8d-494e-8092-e1178b0b920a
  modified: 2026-08-03T23:28:35.298Z
---

Measured at spt-core golden head `b7b00c3` (2026-08-03, is_process_alive stage-2 classification).
Two production comments claim a pid-recycle defense the code does not implement:

- `crates/spt-daemon/src/lifecycle.rs:1785-1787` (`harness_owner_gone`) — "anchors liveness on the
  stable harness-session pid … never an ephemeral poll pid (KNOWN-HAZARDS 2.1): a recycled
  ephemeral pid could read a foreign process as the Self and mask a real death."
- `crates/spt-store/src/seed.rs:35` — calls `Seed.session_id` "the pid-recycle discriminator (5.1)".
  At `startup.rs:430` the liveness gate fires BEFORE and independently of any session comparison,
  so the discriminator never runs at that decision.

**Why:** anchoring picks a *longer-lived* pid; longevity is not identity. Only a pid+birth PAIR
(`spt_store::liveness::relay_liveness(pid, recorded_birth)`) turns existence into identity. And no
parent-side birth stamp exists anywhere in the tree — `info.rs` carries `pid_started_at` for `pid`
only, `Seed` carries none (grep `parent_pid_started_at|parent_started_at|parent_birth` over
`crates/`+`docs/` returns nothing), so those five sites cannot be repaired without a new field,
while sites reading their OWN pid record can be repaired today.

**How to apply:** when a comment argues soundness from WHICH pid it probes, that is not a defense —
find the birth stamp or record its absence. A defense claim in a comment is a claim about data that
must exist on the record; check the struct, not the prose. See [[pid-reuse-across-reboot]],
[[flag-presence-is-not-flag-effect]], [[a-predicate-without-its-tool-is-not-evidence]].