---
name: v0650-arc-in-flight
description: CONDUIT/v0.65.0 SHIPPED 2026-08-29 at counter 100 — four heads shaped, a full golden GREEN discarded on purpose, three reds each closed by a named mechanism and none by a rerun.
metadata:
  type: project
---

CONDUIT = releases#236 (members #234 io-events poll verb, #157 manifest resume-trigger doc,
#228 shell owner-online restore). Minted + greenlit 2026-08-28; targets **v0.65.0 at counter 100**.
**SHIPPED 2026-08-29 08:15Z, counter 100, tag==main==tested `4d6007ac`, golden 33239770968 9/9 attempt 1.** Verified at source: Latest flipped, 11 assets, update-set decodes version=100 product=0.65.0, 3 platforms each ipc=1 abi=1. Board DONE all five.

## The thing worth remembering: a GREEN was discarded on purpose

Head `110d1751` (shaped off gater head `1cab5df9`) **passed a full golden**, run 33223968222
attempt 3. It was thrown away. `spt api io-events` could never return COMMUNE/COMMUNE_FAIL —
`publish_commune_io` hand-built its own `IoBus` registering only `ShellLinkSink`, while `IoLogSink`
lives only in `default_bus` — yet four landed surfaces (REQ title, api.md, CONTEXT.md, integration
checklist) stated all six kinds were visible. todlando found it in his OWN gated lane, after the
gate passed, mid-rerun, and reported it against his own interest.

**The no-ship reasoning, which is the reusable part** (recorded #236 c5459798254, written while
attempt 3 was still in flight and its verdict UNKNOWN):
1. A misstated *published* surface is what adapter authors blind-build from — worse than a missing one.
2. The broken half was the MOTIVATING half: #234 was ruled a poll verb *because* wake markers are
   adapter-owned, and wake markers ride commune events.
3. **There is no cheap middle — CHECK THIS BEFORE ASSUMING ONE.** Softening the docs does NOT dodge
   the window: the docs-drift gate reads those files, so gated docs sit INSIDE golden's evidence and
   a docs-only edit is Q1-YES under the respin test exactly as a code fix is. Identical cost ⇒ keep
   the promise rather than narrow it.
4. A counter is not a deadline. *Explained is still red* covers explained-by-my-own-schedule.

## Pool accumulation — the number, not the anecdote

The golden's first red was the Windows free-space floor (`free_bytes=23303536640`
`floor_bytes=34359738368`), both Windows jobs dead at step 2 with **checkout SKIPPED** ⇒ zero code
signal. Cause was mine: a cold rebuild through the main pool.

- Reaped main `target/`: **140.51 GB**. Free 21.74 → 161.12 GB, **139.38 GB reclaimed**.
- A FRESH full rebuild of the same tree: **7.78 GB**.
- ⇒ a milestone of sequential lane-sharing accumulates roughly **18×** a single build's working set
  with nothing reaping between lanes. State it as that ratio; "the disk filled up" does not survive
  retelling and does not predict the next box.

Teardown was releases#103-conformant: outbound classified (`LinkType` empty, no `Target` ⇒ REAL
DIR, deleted as a tree), inbound reparse sweep across `projects/` + `C:\actions-runner` returned
zero links aimed at it, before/after measured. Only the `target` SUBTREE removed. A peer's warm pool
(48 GB) was declined ON THE NUMBERS, not politeness.

## Respin intake added a leg that did not exist before

On respin head `bf56baaa` I checked **`110d1751` is NOT an ancestor**. A respin quietly built on the
discarded shape would have carried the bump forward and passed EVERY other leg *including the shape
leg*, because it would genuinely read 0.65.0. todlando ran the POSITIVE complement (`27a14c1c` IS an
ancestor; all four cells present by name). **Absence-of-the-wrong and presence-of-the-right are
independent claims — neither leg detects the other's failure.**

Respin shaped to `0c17eb09`, pushed to a NEW ref `golden/conduit-236-r2` rather than force-moving
the old branch: keeps the discarded lineage's record and gives the run its own concurrency group.
(Earlier trap the same night: doyle's hand-off push and my shaped push sat in ONE group —
`group: golden-${{ github.ref }}`, `cancel-in-progress: false` — so mine queued behind a run at an
unshippable sha. He cancelled his; a cancel on a QUEUED run shows `in_progress` on its way to
terminal, which is not a failed cancel.)

## Outcome so far — THREE heads shaped, none shipped (as of 2026-08-29 06:35Z)

| Head | Golden | Fate |
|---|---|---|
| `110d1751` | run 33223968222 a3 **GREEN** | DISCARDED on purpose (commune kinds unreachable) |
| `0c17eb09` | run 33231934813 **RED** (Linux, 2 MSG cells) | superseded — led to #240 |
| `8e098377` | run 33236164340 **RED** (twohost pair + Linux Phase B) | superseded — cells riding the SAME coin, not a regression |
| `4d6007ac` | run 33239770968 **GREEN 9/9** | **SHIPPED** |

## ⭐⭐ THE ENUMERATION-COIN CLASS — three instances in one night

`detect_self_by_ancestry` resolved an ancestor-pid tie by `read_dir` ORDER. Fixed (#240) to refuse
with `SELF_DETECT_AMBIGUOUS` -> `None`. The fix then exposed **cells that had been passing on the
same coin**:
1. the two MSG cells — red on Linux, green on Windows, IDENTICAL ambiguous state both platforms,
   only enumeration order differed;
2. `twohost_cli` `gated_cli_role_a` — a cell whose message literally pins "the parent_pid leg,
   never the cli origin", green by `read_dir` order all along on BOTH boxes;
3. `REQ-SELF-DETECT-PARENT-PID`'s **int evidence** — a ratified requirement standing on the coin.

⚠ **The tie-break is ARBITRARY PER DIRECTORY** — same filesystem gave `bob,alice` in one rig and
`alpha,beta` in another; neither alphabetical nor creation order. "NTFS is safe" was measured and
WITHDRAWN. No platform is safe; Windows had simply landed heads every time.

⭐⭐ **MUTATION-PROVING SHOWS A CELL CAN FAIL. IT DOES NOT SHOW ITS GREEN MEANS ANYTHING.** Both
halves paid here: head 1 shipped arms that COULD NOT fail (vacuous — the respin's cause); head 3's
arms demonstrably could fail and their green was still permitted by enumeration order rather than
FORCED by the mechanism under test. A cell earns "able to fail" from mutation; it earns "its green
is meaningful" only from the green being forced.

⚠ MY OWN MIS-READ, twice: I reported head 3 as "the #240 fix has a regression / side effect on
existing consumers unpaid". WRONG. The cell had been riding the coin and the fix stopped paying
out. Related class that survives and stays OPEN: **a refusal can out-radius the guess it replaced**
wherever a caller silently falls back (the from-stamp falls back to `cli@HOST`).

**Production reachability MEASURED, not argued** (this is what made it C-2 rather than C-1): two
`spt api bind` calls from ONE parent shell both succeed and record the SAME live `parent_pid` on two
top-level perches. No refusal, no seed gate, no guard. A universal negative ("production cannot
reach this") must be established BY CONSTRUCTION, never by not having observed it.

Ruled: no ship until fixed (#236 c5460423519). #240 minted + attached => milestone went from THREE
greenlit members to FOUR; **the ADD is recorded with its reason before golden** (c5460467798), which
is the intake rule working. A user-visible changelog line was ruled IN for the from-stamp change.

Related: [[v0640-arc-in-flight]] · [[first-execution-is-a-property-of-the-cell]] ·
[[a-shipped-defect-is-not-grandfathered-by-age]] · [[compare-at-one-layer-crlf-meter-class]]


**EMISSION LANE COMPLETE 2026-08-29 — parked GREEN-AND-READY at `d0fdd58d` on
`feat/emit-single-write`, waves 1-4 all PASS (doyle). BOARD-TRACKED AS `releases#241`
(BACKLOG / BUGFIX; lane evidence in comment `5461613480`) — reference #241 in any future
comment or commit touching this lane.** `REQ-EMIT-SINGLE-WRITE` minted with no
stages and activated at W1 start; `spt-proto::emit` carries `emit_line!`/`emit_block!` (writer-taking)
and `emit_line_err!`/`emit_block_err!` (stderr-aimed, error DISCARDED where `eprintln!` panics —
a reporting surface must never kill the operation it reports on). **The premise is MEASURED, not
read:** an interpolated `write_fmt` issues 5 writes with the terminator as its own call, a static
literal 1. Interior newlines ESCAPE in release + `debug_assert` in debug (doyle's ruling: a
tolerant branch must PRESERVE the invariant, never abandon it in the one build no test watches).
494 real sites converted across 4 waves; the only raw macro left workspace-wide is the stdout
`DRIVEN_BY`, ruled out of lane. **LANDING: doyle assembles off current main at the next milestone —
do NOT merge main into the lane, and it rides a GOLDEN because a 495-site rewrite is not
suite-inert.** Census corrections filed as IR-69 (the population is 486 colon-shaped, not 487 —
one phantom; the sealed macro column is wrong on 7 rows; the sealed tokens file has no final
newline). New craft banked: [[a-widening-that-fixes-an-undercount-can-introduce-an-overcount]],
[[a-fallback-that-fires-only-in-release-is-untestable-by-construction]],
[[preservation-is-its-own-step-before-any-reap-broadcast]], and the fixture-prebuild RECURRENCE in
[[cargo-test-bins-never-emits-fixture-exes]].

**POST-CUT CENSUS: DONE 2026-08-29 at the real cut sha `4d6007ac` (tag v0.65.0 == origin/main == golden r4 head, all three rev-parse equal).** 487 sites / 383 tokens / 26 consumer files, six crates, IDENTICAL to the precut reading — and identical BY CONSTRUCTION, not by luck: `8e098377 -> 4d6007ac` touches CHANGELOG.md and two TEST files and zero files under `crates/*/src`, and the TOKEN:-shaped mention sets inside both changed test files are character-identical across the shas. Cut artifacts sha256 sites `f10d6bfe`, tokens `80b0d183`, consumers `249a2e33`; hertz independently re-hashed 3/3 and preserved them plus the generator at `AppData\Local\spt-core\census-cut-4d6007ac`. **Two corrections to the SEALED precut artifacts, carried as TEXT because both parties hashed them (re-verified unchanged):** the macro column is wrong on 7 of 487 rows — true split is eprintln! 485 / println! 1 / eprint! 1, not 480/6/1 — and `census_tokens.txt` has no final newline, the 382-for-383 undercount still inside the artifact. `DRIVEN_BY` (reporting.rs:428) is a genuine `println!` and therefore not on the stderr tear surface at all. Method and the recovered colon-token consumer predicate are banked in [[instrument-soundness-guards]] guard 8. doyle's next call (2026-08-29 08:05Z): PAPER-PREP the single-write emission product lane — read sites, draft JIT plan/shape, NO cargo, no pools/builds until deployah source-verifies the counter-100 publish; ir66 reaps then and the lane gets its pool.

**POST-CUT TASK OWED BY todlando (recorded 2026-08-29 so it survives a context clear).** The emission-site census must be RE-RUN at the real v0.65.0 cut sha before it goes into hertz's IR entry — the precut reading is at `8e098377` and is method validation only. Requirements agreed with hertz: (1) every output file TERMINATES WITH A NEWLINE; (2) assert the LOGICAL record count in the generator, never via `wc -l` (a missing terminator undercounts by one, silently — it did, 382-for-383); (3) keep the mandatory known-positive sentinel `SUBSCRIBE_DECISION` asserted present, or the count is unfalsifiable; (4) the census predicate must use a LOOKBACK WINDOW for multi-line macro calls and must truncate ONLY at a `#[cfg(test)]` that opens a module — both traps cost me a wrong count today (286 → 412 → 487). Precut artifacts are hashed by both parties and MUST NOT be mutated: sites `064c8406…`, tokens `b7b62091…`, consumers `f6d5225b…`, preserved by hertz at `C:\Users\decid\AppData\Local\spt-core\census-precut-8e098377`. Precut figures: 487 sites, 383 tokens, six crates (spt-daemon 270, spt 195, spt-runtime 8, spt-live 5, spt-net 5, spt-store 4); 26 test files parse 26 distinct tokens off an inherited-stderr surface. The SINGLE-WRITE EMISSION LANE itself stays parked until main carries the cut.

## Closing facts worth keeping

- **hertz's twohost fix passed its FIRST NON-VACUOUS execution in the run that shipped it.** Those
  cells gate on `SPT_TWO_HOST` and return in ~9ms outside golden, so two prior 2/2 greens were
  VACUOUS BY THE DURATION RULE (the gater said so unprompted; hertz retracted his own ping census).
  I measured the gated CLI legs at 3m57s and 18m47s before treating the green as evidence.
  **Check a green's DURATION against its skip path before citing it.**
- The three prior heads' Windows greens on the io_events cells are VOID as evidence — measured, not
  suspected. Enumeration order, not correctness.
- `xtask gen` produced a phantom `reference.md` diff on ALL FOUR shapes: CRLF worktree vs LF blob.
  Revert, do not commit — and see [[compare-at-one-layer-crlf-meter-class]].
- Tag-time gap: all three objects (tag target, `origin/main`, ruled sha) were IDENTICAL this cut,
  the first time in the arc. Still printed both before pushing, which is the point.
- Every defect in this arc was reported by the agent who OWNED the work, before anyone asked.