---
name: workertruth-triage
description: "WORKER-TRUTH bugfix milestone (operator-called 2026-07-06) — worker-perch leak + visibility; work order @247333c, todlando dispatched, perri owns adapter halves"
metadata: 
  node_type: memory
  type: project
  originSessionId: 91ad1526-6ce9-4f27-8a9c-01cc250c247c
---

**WORKER-TRUTH milestone TRIAGED + DISPATCHED 2026-07-06** (post-v0.26.0; operator-called via perri's filings + direct riders). Work order: `docs/NEXT-MILESTONE-WORKERTRUTH-TRIAGE.md` @247333c on main; 6 REQ seeds registered inactive.

Field driver: flynn (first real live agent on the F-030 ephemeral driver, claude-spt:ccs) leaked 6 worker perches OFFLINE from CC Task subagents; flynn's psyche DEAD on `{psyche_dir}` template fault.

Items: W-1 stop=soft-cleanup-by-design → fix is visibility+reap; W-2 sid never stored (worker.rs:44 hardcodes ""), stop effectively token-only → OPERATOR RULING: sid-symmetric, token retired, stop = parent-current-OR-stored-sid; W-3 no reap, rec.pid useless (dead hook pid, KH 7.34) → parent-lifecycle + TTL; V-1 workers out of default endpoint list (--workers flag); V-2 out of run picker (non-drivable); N-1 core-minted `{parent}-w{N}` names (sister hook_subagent_start shape), adapter ids demoted to metadata; P-1 `{psyche_dir}` retirement DELIBERATE (freeze at lifecycle.rs:841 never had it) → adapter 0.14.2 fixes cwd (perri, URGENT), core gains REQ-ADAPTER-TEMPLATE-KEY-VALIDATION (registration-time catalog validation).

Coordination: N-1+W-2 = ONE verb-shape freeze; todlando sends me the shape → I coordinate with perri BEFORE build (perri holds loud-refusal logging until freeze; docs-site publishes the shape with the wave). Build order: (1) N-1+W-2 freeze, (2) V-1+V-2 visibility (kills operator symptom fastest, independent), (3) W-3 after 1, (4) P-1 validation independent. doyle gates per wave.

Interim: `endpoint purge <id> --force` cleans leaked rows (operator already purged the 6).

**Wave-1 VERB SHAPE FROZEN (doyle-gated 2026-07-06, sent to perri):** worker-start `<parent> --session-id [--agent-id --agent-type]`, id positional dropped, core hard-mints {parent}-w{N} (persistent race-safe .wseq counter — NOT scan-max+1, reap would reuse N; CC parallel Task calls race the counter), no token anywhere; stdout = bare minted id ALONE (machine result), stderr = human WORKER_STARTED line; stop/poll sid-symmetric via dedicated worker_authenticate (stored-registration-sid OR parent-current-sid), parent resolved structurally from nested path; registration sid read from parent record (presented falls back). BREAKING migration: perri drops token+id-positional same wave + bumps adapter min_spt_core floor to shipping core. todlando implementing wave-1 FIRST (pivot doyle-approved: dependency root — perri migration + W-3 hang off it; purge --force holds V-1 symptom), wave-2 (V-1+V-2) after.

**Freeze ACKED both sides 2026-07-06:** todlando folded all rulings; perri NO OBJECTIONS, read-back exact (SubagentStart captures minted id from stdout, adapter-owned agent_id→minted-id state, SubagentStop looks up + sid-stop, no token, floor bumps to shipping core, adapter release TRAILS core cut awaiting doyle release ping w/ floor version). SKEW MODE ACCEPTED (doyle): new-core × ≤0.14.2 adapter = loud clap error per SubagentStart, workers unregistered until adapter update — non-fatal bounded degrade, deliberate hard-mint-only cost.

**Wave-1 GATED PASS + BLESSED @5e529bd (doyle 2026-07-06):** full rig green in isolated worktree (store 214/214, api 73/73, int, clippy, traceable). GUARD-REVERT LESSON: the specced GR-2 (reg_sid="" alone) CANNOT red the int — the parent-current auth leg covers it BY DESIGN; single-revert is unfalsifiable, the real W-2 leak root is the PAIR (reg_sid="" + worker_gated→gated) which DOES red; stored-sid leg isolated by the rotation unit instead. Comment fix rides wave-2. Earlier tip-move gotcha: 028e212→5e529bd (worker-start COLD-STARTS the daemon via api ensure-daemon preamble → int leaked daemons pre-fix; SEED filed: store-only verb booting infra). Wave-2 root pin (todlando): suffix-less CC ids classified Self_ → pre-N-1 workers wrote FLAT top-level → roster surfaces them = the 6 OFFLINE rows; V-1 filter must assert the FLAT-legacy shape explicitly. Leftover: .worktrees/gate-5e529bd dir pinned (conhost), retry removal later.

**Waves 2 + P-2 GATED PASS + BLESSED (doyle 2026-07-06):** wave-2 V-1+V-2 @83b1a02 (4-leg list filter + --workers, picker worker+psyche exclusion, flat-legacy asserted, GR red ✓). P-2 @eb2ed17 CROSS-PLATFORM (Win full rig + kitsubito bundle leg — 39-count proves the cfg(unix) .sh fixture ran; GR-P2 drop-with_spawn_env red ✓); spawn_env precedence pin = stamp-wins-over-env_remove, doc+unit. THREE blesses banked (5e529bd, 83b1a02, eb2ed17). W-3 reap design doyle-confirmed: predicate KEEP iff parent_alive && !ttl && (ready||pending) with NAMED property TTL-overrides-ready (the only catch for ready-present+parent-alive-forever = the flynn class); guards = ttl clamp ≥1h + ORPHAN_GRACE 60s (boot-race damping); reconcile PRIMARY, erase reap-first-then-guard, soft-end reaps nothing; .wseq survives + wired twin unit; FLAKE-LEDGER #14 (rc attach_viewport reconnect full-parallel trip, 4th night-pattern) + nextest heavy-class test-group ride the W-3 chunk. GOTCHA this session: my bg gate-rig bash tasks got EXTERNALLY KILLED twice mid-run on hfenduleam (finished legs foreground); worktree dirs conhost-pin after foreground runs — retry removal later.

**W-3 GATED PASS + BLESSED @0de2a41 (doyle):** reap primitive + reconcile PRIMARY GC + erase-reap + worker_reap_ttl knob (clamp ≥1h, 0=off) + FLAKE-LEDGER #14 RECIPE PROOF independently confirmed (full bin spt full-parallel 361/361 ~19s, was 244s+timeout — heavy-broker-pty nextest group extended to the rc kind(bin) real-broker tests by exact name, extend-on-sighting). GR-A ttl-neuter + GR-B grace-drop each red their own unit ✓. FOUR blesses (5e529bd, 83b1a02, eb2ed17, 0de2a41). **RIG GOTCHA banked: FRESH gate target fails adapter_translate_proof_gates_on_commit — run `cargo build -p spt --bins` BEFORE the full bin leg (translate_proof_fixture.exe prebuilt; F-028 mock-session class). Isolated-fail discriminator caught it (fails isolated too = rig artifact, not flake).** Flat-legacy top-level workers deliberately OUT of reap scope (V-1 hides, purge removes, N-1 prevents) — optional disk-GC seeded for next triage + ensure-daemon-preamble seed (store verb boots infra). P-1 rulings issued: strict validate_role_templates at register+update-preswap ONLY (never parse — pointer installs re-read live, parse-reject would brick field), skip retired never-spawned roles, role-aware BASE∪extras catalog (notif 4 keys first), breaking registration OK (perri 0.14.2 pre-cleared — zero field coordination), + env_remove/read contradiction refusal.

**MILESTONE FEATURE-COMPLETE + FULLY GATED (doyle 2026-07-06): FIVE blesses** — 5e529bd (N-1+W-2 minted ids + sid-symmetric), 83b1a02 (V-1+V-2 visibility), eb2ed17 (P-2 spawn-env parity, cross-platform), 0de2a41 (W-3 reap + #14 recipe), af21f10 (P-1 template-key validation incl. doyle's unterminated-brace finding — validation scan silently stopped where fill_template errors; fixed+unit'd). Wave-final rig: FULL WORKSPACE 1648/1648 zero flake trips (recipe held at scale), GR-P1 red ✓. P-1 architecture: strict validate_role_templates at register+update-preswap ONLY (parse stays key-agnostic — pointer re-reads never brick). MERGE-PREP GO'd to todlando: push → PR → CI (Linux legs = W-3/P-1 cross-platform sweep) → merge → deployah v0.27.0 (counter 47). CHANGELOG surfaces for my cut-PR gate: BREAKING worker verbs (minted ids, no token, sid-symmetric), --workers list flag, picker exclusion, auto-reap + ttl knob, psyche account-root inheritance, registration template-key refusal + contradiction. Then perri release ping = floor version + worker-verb migration GO.

**ADAPTER HALF SHIPPED (perri, 2026-07-06 ~35min post-GO): claude-spt v0.15.0** — frozen shape consumed exactly (id-less start + metadata flags, minted id from bare stdout, agent_id→minted-id in state/worker/<agent_id>.wid, sid-stop, zero tokens, loud WORKER_START_REFUSED/WORKER_STOP_SKIP/WORKER_STOP_REFUSED), floor 0.27.0, REQ-DIST-WORKER-LIFECYCLE minted. HFENDULEAM holds adapter 0.14.2 until the operator's core-0.27.0 bounce window; that ONE window then discharges FOUR field proofs perri reports together: (1) P-2 flynn psyche root live-proof, (2) E-1 from-stamp check, (3) worker live-int (Task subagent visible under --workers during, GONE after — the exact original leak scenario), (4) v0.15.0 field verify. Milestone closed both halves pending that window.

**P-1 CLOSED adapter-side:** v0.14.2 published + HFENDULEAM re-registered (~40min turnaround) — shim owns psyche cwd ({psyche_context_file} parent dir), psyche_dir keys removed BOTH tables (pre-cleared for the registration gate). FLYNN NO-LATCH ruling (code-evidenced): pulse loop never stops firing, manifest live-reloads before each tick (lifecycle.rs:695), first success clears psyche_host_error (lifecycle.rs:1085-87) — self-heals, no bounce; stamp persisting past a couple pulses = NEW finding.

Queued behind this: flynn's cross-node digest seed + demoted crate-publish ([[spt-core-findings-backlog]]).