{"type":"title","v":1,"title":"","updatedAt":"2026-09-11T08:15:18.015Z","pad":" "}
{"type":"session","version":3,"id":"01a08f89-09ff-7000-8d77-1b26065c4ab3","timestamp":"2026-09-11T08:15:18.015Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"b9fca022","parentId":null,"timestamp":"2026-09-11T08:15:18.093Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"7f2fee1b","parentId":"b9fca022","timestamp":"2026-09-11T08:15:18.093Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"0f2a028e","parentId":"7f2fee1b","timestamp":"2026-09-11T08:15:18.096Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n\n\n\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n\n\n\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n\n\n\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n\n\n§ Context\n# Goal\nPrepare source-grounded implementation details for Hertz's separately allocated W3 real-RC continuity rig while W1 compiles.\n# Constraints\nREAD ONLY. Skip all builds, tests, linters, formatters and runtime fixtures. W1 source boundary c468e9df in .worktrees/hertz-304 is frozen; do not edit it. No production homes/daemons/network or firewall mutation. Root causes #302/#49/#267 remain unproven. Read .spt/preserved/todlando-304-w3-source-maps.json for prior map; do not redo issue research.\n# Contract\nReport exact reusable APIs/files, observable protocol, isolation gaps and minimum fixture dependencies. Main owns execution plan and integration. Plan real persistent rc frontend with numbered input and independently numbered PTY output before/during/after triggers; process survival alone insufficient. All proposed waits require wall budgets and progress evidence. Do not infer runtime results.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `ContinuityUpdate`. Currently visible peers:\n- `ContinuityApparatus` — scout (sub, running)\n- `Main` — main (main, running)\n10 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n summary: string;\n files: { path: string; description: string; }[];\n architecture: string;\n report?: string;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\nInspect .worktrees/hertz-304 existing live update/refresh end-to-end fixtures, DEBUG-ROLLOUT and ADR-0016. Non-goals actual rollout/signing/distribution or production changes.\n# Change\nRead-only: identify exact normal signed update staging and live brain-compatible apply pattern, fixture-local release keys/candidate artifact requirements, no-op adapter versus core apply phase observations, and ways to prevent fleet/network interaction with valid private daemon identity. Determine whether same-source rebuilt candidate can honestly test swap lifecycle without claiming version-specific regression reproduction. Keep explicit apply and plain composite update separate.\n# Acceptance\nReturn source-referenced recipe and concrete prerequisites, commands as proposals only, independent cases, expected process caps/artifact sizing inputs and cleanup hazards. Skip builds/tests/formatters/linters and all runtime.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra:medium","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"38764f6f","parentId":"0f2a028e","timestamp":"2026-09-11T08:15:18.178Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nInspect .worktrees/hertz-304 existing live update/refresh end-to-end fixtures, DEBUG-ROLLOUT and ADR-0016. Non-goals actual rollout/signing/distribution or production changes.\n# Change\nRead-only: identify exact normal signed update staging and live brain-compatible apply pattern, fixture-local release keys/candidate artifact requirements, no-op adapter versus core apply phase observations, and ways to prevent fleet/network interaction with valid private daemon identity. Determine whether same-source rebuilt candidate can honestly test swap lifecycle without claiming version-specific regression reproduction. Keep explicit apply and plain composite update separate.\n# Acceptance\nReturn source-referenced recipe and concrete prerequisites, commands as proposals only, independent cases, expected process caps/artifact sizing inputs and cleanup hazards. Skip builds/tests/formatters/linters and all runtime."}],"attribution":"agent","timestamp":1789114518098}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ZnN04CR5DR87IMz28FsBQCCZ|fc_0581413717c88920016aa3b895ff6087d18f26cc1a41837390","toolName":"read","startedAt":"2026-09-11T08:15:21.352Z","args":{"path":".spt/preserved/todlando-304-w3-source-maps.json"},"intent":"Reading preserved source map"},"id":"0ddbc8e5","parentId":"38764f6f","timestamp":"2026-09-11T08:15:21.352Z"}
{"type":"message","id":"623692be","parentId":"0ddbc8e5","timestamp":"2026-09-11T08:15:21.352Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_ZnN04CR5DR87IMz28FsBQCCZ|fc_0581413717c88920016aa3b895ff6087d18f26cc1a41837390","name":"read","arguments":{"i":"Reading preserved source map","path":".spt/preserved/todlando-304-w3-source-maps.json"},"intent":"Reading preserved source map"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10154,"output":39,"cacheRead":0,"cacheWrite":0,"totalTokens":10193,"cost":{"input":0.10154,"output":0.0019500000000000001,"cacheRead":0,"cacheWrite":0,"total":0.10349}},"stopReason":"toolUse","timestamp":1789114518177,"responseId":"resp_0581413717c88920016aa3b89468a887d1b3acb6e7131fd7fe","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b895ff6087d18f26cc1a41837390","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading preserved source map\",\"path\":\".spt/preserved/todlando-304-w3-source-maps.json\"}","call_id":"call_ZnN04CR5DR87IMz28FsBQCCZ","internal_chat_message_metadata_passthrough":{"create_time":1789114516.89969,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":3173.713999999687,"ttft":2175.5434999996796,"completedAt":1789114521351,"contextSnapshot":{"promptTokens":10154,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"credential_pin","id":"e0d19975","parentId":"623692be","timestamp":"2026-09-11T08:15:21.352Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"b97ae17c","parentId":"e0d19975","timestamp":"2026-09-11T08:15:21.354Z","message":{"role":"toolResult","toolCallId":"call_ZnN04CR5DR87IMz28FsBQCCZ|fc_0581413717c88920016aa3b895ff6087d18f26cc1a41837390","toolName":"read","content":[{"type":"text","text":"{\n \"roster\": {\n \"text\": \"## Scope and accepted measurements\\nRead https://github.com/BigscreenVR/spt-bs-releases/issues/299 and its comment https://github.com/BigscreenVR/spt-bs-releases/issues/299#issuecomment-5629569142 (not core). Reporter perri on HFENDULEAM, standalone 0.69.0: unpiped `endpoint list --show-all` took 3822, 10120, 10105ms, rc=0 each, byte-identical complete 2497-byte output. Accept these observations directly. Reported field corpus: 1210 UPS traces over 50.4h/10 endpoints; three live-roster stages 7454/10058/10061ms, total calls 10086/10307/11174ms. Two of seven peers reportedly unreachable at quic-connect. No adapter subprocess timeout; historic 5s versus current 20s hook allowance is mitigation context only. Neither causation nor failure rate follo…\n \"details\": {\n \"resolvedPath\": \"C:\\\\Users\\\\decid\\\\.omp\\\\agent\\\\sessions\\\\-Documents-projects-spt-core\\\\2026-09-09T23-45-42-317Z_01a08890-21ad-7000-8f54-208d4f4f2f2c\\\\RosterWaitMap.json\",\n \"contentType\": \"text/markdown\",\n \"meta\": {\n \"source\": {\n \"type\": \"internal\",\n \"value\": \"agent://RosterWaitMap?q=.report\"\n }\n }\n }\n },\n \"attach\": {\n \"text\": \"## Scope and evidence discipline\\nAll paths below are relative to `.worktrees/304-product`. Read actual issue bodies at https://github.com/BigscreenVR/spt-bs-releases/issues/302, https://github.com/BigscreenVR/spt-bs-releases/issues/49 and https://github.com/BigscreenVR/spt-bs-releases/issues/267. Read AGENTS.md, diagnosis skill, relevant CONTEXT terminal/update vocabulary, DEBUG-ROLLOUT.md and ADR-0016 before update research. No processes, fixtures, builds, tests, production probes or edits were run. This is preparation for reproduction, not reproduced diagnosis. Historical measurements below are attributed to their records, not re-measured now. The direct GitHub comments API returned 404; issue bodies were available through issue://, and in-tr…\n \"details\": {\n \"resolvedPath\": \"C:\\\\Users\\\\decid\\\\.omp\\\\agent\\\\sessions\\\\-Documents-projects-spt-core\\\\2026-09-09T23-45-42-317Z_01a08890-21ad-7000-8f54-208d4f4f2f2c\\\\AttachFreezeMap.json\",\n \"contentType\": \"text/markdown\",\n \"meta\": {\n \"source\": {\n \"type\": \"internal\",\n \"value\": \"agent://AttachFreezeMap?q=.report\"\n }\n }\n }\n }\n}\n\n[Some lines truncated to 768 chars]"}],"details":{"totalLines":28,"displayContent":{"text":"{\n \"roster\": {\n \"text\": \"## Scope and accepted measurements\\nRead https://github.com/BigscreenVR/spt-bs-releases/issues/299 and its comment https://github.com/BigscreenVR/spt-bs-releases/issues/299#issuecomment-5629569142 (not core). Reporter perri on HFENDULEAM, standalone 0.69.0: unpiped `endpoint list --show-all` took 3822, 10120, 10105ms, rc=0 each, byte-identical complete 2497-byte output. Accept these observations directly. Reported field corpus: 1210 UPS traces over 50.4h/10 endpoints; three live-roster stages 7454/10058/10061ms, total calls 10086/10307/11174ms. Two of seven peers reportedly unreachable at quic-connect. No adapter subprocess timeout; historic 5s versus current 20s hook allowance is mitigation context only. Neither causation nor failure rate follo…\n \"details\": {\n \"resolvedPath\": \"C:\\\\Users\\\\decid\\\\.omp\\\\agent\\\\sessions\\\\-Documents-projects-spt-core\\\\2026-09-09T23-45-42-317Z_01a08890-21ad-7000-8f54-208d4f4f2f2c\\\\RosterWaitMap.json\",\n \"contentType\": \"text/markdown\",\n \"meta\": {\n \"source\": {\n \"type\": \"internal\",\n \"value\": \"agent://RosterWaitMap?q=.report\"\n }\n }\n }\n },\n \"attach\": {\n \"text\": \"## Scope and evidence discipline\\nAll paths below are relative to `.worktrees/304-product`. Read actual issue bodies at https://github.com/BigscreenVR/spt-bs-releases/issues/302, https://github.com/BigscreenVR/spt-bs-releases/issues/49 and https://github.com/BigscreenVR/spt-bs-releases/issues/267. Read AGENTS.md, diagnosis skill, relevant CONTEXT terminal/update vocabulary, DEBUG-ROLLOUT.md and ADR-0016 before update research. No processes, fixtures, builds, tests, production probes or edits were run. This is preparation for reproduction, not reproduced diagnosis. Historical measurements below are attributed to their records, not re-measured now. The direct GitHub comments API returned 404; issue bodies were available through issue://, and in-tr…\n \"details\": {\n \"resolvedPath\": \"C:\\\\Users\\\\decid\\\\.omp\\\\agent\\\\sessions\\\\-Documents-projects-spt-core\\\\2026-09-09T23-45-42-317Z_01a08890-21ad-7000-8f54-208d4f4f2f2c\\\\AttachFreezeMap.json\",\n \"contentType\": \"text/markdown\",\n \"meta\": {\n \"source\": {\n \"type\": \"internal\",\n \"value\": \"agent://AttachFreezeMap?q=.report\"\n }\n }\n }\n }\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28]},"fileSize":32232,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\todlando-304-w3-source-maps.json"},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789114521353}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_95MReJDoHNCnFvJu2ngp0hmm|fc_0581413717c88920016aa3b898fd7487d19d3c03e6a2f143cb","toolName":"glob","startedAt":"2026-09-11T08:15:25.640Z","args":{"path":".worktrees/hertz-304/**/*{update,refresh,rollout,0016}*;.worktrees/hertz-304/**/DEBUG-ROLLOUT*;.worktrees/hertz-304/AGENTS.md"},"intent":"Locating rollout fixtures"},"id":"4d5a15d9","parentId":"b97ae17c","timestamp":"2026-09-11T08:15:25.640Z"}
{"type":"message","id":"d340516c","parentId":"4d5a15d9","timestamp":"2026-09-11T08:15:25.641Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_95MReJDoHNCnFvJu2ngp0hmm|fc_0581413717c88920016aa3b898fd7487d19d3c03e6a2f143cb","name":"glob","arguments":{"i":"Locating rollout fixtures","path":".worktrees/hertz-304/**/*{update,refresh,rollout,0016}*;.worktrees/hertz-304/**/DEBUG-ROLLOUT*;.worktrees/hertz-304/AGENTS.md","hidden":true,"gitignore":false,"limit":100},"intent":"Locating rollout fixtures"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":880,"output":82,"cacheRead":9984,"cacheWrite":0,"totalTokens":10946,"cost":{"input":0.0088,"output":0.0041,"cacheRead":0.009984,"cacheWrite":0,"total":0.022884}},"stopReason":"toolUse","timestamp":1789114521405,"responseId":"resp_0581413717c88920016aa3b897554487d1a916b4e8ba2f93ad","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b898fd7487d19d3c03e6a2f143cb","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating rollout fixtures\",\"path\":\".worktrees/hertz-304/**/*{update,refresh,rollout,0016}*;.worktrees/hertz-304/**/DEBUG-ROLLOUT*;.worktrees/hertz-304/AGENTS.md\",\"hidden\":true,\"gitignore\":false,\"limit\":100}","call_id":"call_95MReJDoHNCnFvJu2ngp0hmm","internal_chat_message_metadata_passthrough":{"create_time":1789114519.572572,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"glob","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":4234.383499999531,"ttft":1935.1766999997199,"completedAt":1789114525639,"contextSnapshot":{"promptTokens":10864,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"901b30b4","parentId":"d340516c","timestamp":"2026-09-11T08:15:25.727Z","message":{"role":"toolResult","toolCallId":"call_95MReJDoHNCnFvJu2ngp0hmm|fc_0581413717c88920016aa3b898fd7487d19d3c03e6a2f143cb","toolName":"glob","content":[{"type":"text","text":"# .worktrees/hertz-304/\nAGENTS.md\n## docs/\nDEBUG-ROLLOUT.md\n### design/\nv0.16.0-update-arc-and-cli.md\n### adr/\n0004-single-daemon-broker-brain-split-and-self-update.md\n0029-adapter-update-arc-resolve-not-execute.md\n0025-live-daemon-coordinated-adapter-update.md\n0016-platform-targeted-update-sets.md\n## docs-site/src/self-update/\n## crates/\n### spt/tests/\ndaemon_refresh_e2e.rs\n### spt-daemon/\n#### src/\nupdate.rs\nadapter_update.rs\n##### pump/\nupdate.rs\n#### tests/\nnotif_update_row_retire.rs\n### spt-net/src/net/\nupdate.rs"}],"details":{"scopePath":".worktrees/hertz-304/**/*{update,refresh,rollout,0016}*, .worktrees/hertz-304/**/DEBUG-ROLLOUT*, .worktrees/hertz-304/AGENTS.md","fileCount":14,"files":[".worktrees/hertz-304/docs/design/v0.16.0-update-arc-and-cli.md",".worktrees/hertz-304/docs-site/src/self-update/",".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs",".worktrees/hertz-304/docs/DEBUG-ROLLOUT.md",".worktrees/hertz-304/docs/adr/0004-single-daemon-broker-brain-split-and-self-update.md",".worktrees/hertz-304/docs/adr/0029-adapter-update-arc-resolve-not-execute.md",".worktrees/hertz-304/docs/adr/0025-live-daemon-coordinated-adapter-update.md",".worktrees/hertz-304/docs/adr/0016-platform-targeted-update-sets.md",".worktrees/hertz-304/crates/spt-daemon/src/update.rs",".worktrees/hertz-304/crates/spt-daemon/tests/notif_update_row_retire.rs",".worktrees/hertz-304/crates/spt-daemon/src/adapter_update.rs",".worktrees/hertz-304/crates/spt-daemon/src/pump/update.rs",".worktrees/hertz-304/crates/spt-net/src/net/update.rs",".worktrees/hertz-304/AGENTS.md"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1789114525726}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_CoDprOnH18BObIqM18PWjoUJ|fc_0581413717c88920016aa3b8a3731487d19703031b1f30ac31","toolName":"read","startedAt":"2026-09-11T08:15:33.857Z","args":{"path":".worktrees/hertz-304/docs/DEBUG-ROLLOUT.md"},"intent":"Reading rollout guidance"},"id":"e31b043c","parentId":"901b30b4","timestamp":"2026-09-11T08:15:33.857Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ZxOmDOiQHMICYtxDTUW4r2cV|fc_0581413717c88920016aa3b8a3732487d19f25a5312b082b7b","toolName":"read","startedAt":"2026-09-11T08:15:33.857Z","args":{"path":".worktrees/hertz-304/docs/adr/0016-platform-targeted-update-sets.md"},"intent":"Reading update contract ADR"},"id":"96b3c0b7","parentId":"e31b043c","timestamp":"2026-09-11T08:15:33.857Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_2JdmguW1uKUNOskkIowSzpFU|fc_0581413717c88920016aa3b8a3733087d1b93d233cd00558ed","toolName":"read","startedAt":"2026-09-11T08:15:33.857Z","args":{"path":".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs"},"intent":"Reading fixture structure"},"id":"7496aa01","parentId":"96b3c0b7","timestamp":"2026-09-11T08:15:33.857Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Php2bhoAEFSNU3QNa0yppYDu|fc_0581413717c88920016aa3b8a3733487d19a4ccb4c0ff7b066","toolName":"read","startedAt":"2026-09-11T08:15:33.858Z","args":{"path":".worktrees/hertz-304/AGENTS.md"},"intent":"Reading local repository rules"},"id":"61a604c1","parentId":"7496aa01","timestamp":"2026-09-11T08:15:33.858Z"}
{"type":"message","id":"2e9d04a8","parentId":"61a604c1","timestamp":"2026-09-11T08:15:33.858Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_CoDprOnH18BObIqM18PWjoUJ|fc_0581413717c88920016aa3b8a3731487d19703031b1f30ac31","name":"read","arguments":{"i":"Reading rollout guidance","path":".worktrees/hertz-304/docs/DEBUG-ROLLOUT.md"},"intent":"Reading rollout guidance"},{"type":"toolCall","id":"call_ZxOmDOiQHMICYtxDTUW4r2cV|fc_0581413717c88920016aa3b8a3732487d19f25a5312b082b7b","name":"read","arguments":{"i":"Reading update contract ADR","path":".worktrees/hertz-304/docs/adr/0016-platform-targeted-update-sets.md"},"intent":"Reading update contract ADR"},{"type":"toolCall","id":"call_2JdmguW1uKUNOskkIowSzpFU|fc_0581413717c88920016aa3b8a3733087d1b93d233cd00558ed","name":"read","arguments":{"i":"Reading fixture structure","path":".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs"},"intent":"Reading fixture structure"},{"type":"toolCall","id":"call_Php2bhoAEFSNU3QNa0yppYDu|fc_0581413717c88920016aa3b8a3733487d19a4ccb4c0ff7b066","name":"read","arguments":{"i":"Reading local repository rules","path":".worktrees/hertz-304/AGENTS.md"},"intent":"Reading local repository rules"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":362,"output":159,"cacheRead":10752,"cacheWrite":0,"totalTokens":11273,"cost":{"input":0.0036200000000000004,"output":0.00795,"cacheRead":0.010752,"cacheWrite":0,"total":0.022322}},"stopReason":"toolUse","timestamp":1789114525742,"responseId":"resp_0581413717c88920016aa3b89ba20487d1a4c97609ab0e90ba","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8a3731487d19703031b1f30ac31","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading rollout guidance\",\"path\":\".worktrees/hertz-304/docs/DEBUG-ROLLOUT.md\"}","call_id":"call_CoDprOnH18BObIqM18PWjoUJ","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8a3732487d19f25a5312b082b7b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading update contract ADR\",\"path\":\".worktrees/hertz-304/docs/adr/0016-platform-targeted-update-sets.md\"}","call_id":"call_ZxOmDOiQHMICYtxDTUW4r2cV","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8a3733087d1b93d233cd00558ed","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading fixture structure\",\"path\":\".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs\"}","call_id":"call_2JdmguW1uKUNOskkIowSzpFU","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8a3733487d19a4ccb4c0ff7b066","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading local repository rules\",\"path\":\".worktrees/hertz-304/AGENTS.md\"}","call_id":"call_Php2bhoAEFSNU3QNa0yppYDu","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":8113.684499999508,"ttft":8060.9104999993,"completedAt":1789114533856,"contextSnapshot":{"promptTokens":11114,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"3f44c305","parentId":"2e9d04a8","timestamp":"2026-09-11T08:15:33.859Z","message":{"role":"toolResult","toolCallId":"call_Php2bhoAEFSNU3QNa0yppYDu|fc_0581413717c88920016aa3b8a3733487d19a4ccb4c0ff7b066","toolName":"read","content":[{"type":"text","text":"# spt-core — agent working rules\n\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\n\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\n\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\n\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\n\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\n\n## Requirement traceability (binding)\n\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\n\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\n\n## Issue tracking (unique case)\n\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\n\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\n\n## Other conventions\n\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\n\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\n3. Execute the /self-clear skill\n\n[Some lines truncated to 768 chars]"}],"details":{"totalLines":47,"displayContent":{"text":"# spt-core — agent working rules\r\n\r\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\r\n\r\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\r\n\r\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\r\n\r\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\r\n\r\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\r\n\r\n## Requirement traceability (binding)\r\n\r\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\r\n\r\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\r\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\r\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\r\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\r\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\r\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\r\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\r\n\r\n## Issue tracking (unique case)\r\n\r\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\r\n\r\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\r\n\r\n## Other conventions\r\n\r\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\r\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\r\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\r\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\r\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\r\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\r\n\r\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\r\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\r\n\r\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\r\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\r\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\r\n3. Execute the /self-clear skill\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47]},"fileSize":8436,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\AGENTS.md"},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789114533859}}
{"type":"message","id":"e203d30d","parentId":"3f44c305","timestamp":"2026-09-11T08:15:33.860Z","message":{"role":"toolResult","toolCallId":"call_ZxOmDOiQHMICYtxDTUW4r2cV|fc_0581413717c88920016aa3b8a3732487d19f25a5312b082b7b","toolName":"read","content":[{"type":"text","text":"# Platform-targeted update sets for debug rollout and release distribution\n\n\n\n## Status\n\naccepted (2026-06-06)\n\nspt-core's peer-propagated update substrate should understand a signed update as a platform-targeted artifact set, not only as one opaque binary blob. A node offering an update may stage metadata for multiple platform artifacts (for example Windows x86_64 and Linux x86_64); each recipient verifies the set metadata, fetches only the artifact matching its own platform, verifies that artifact's digest, and then follows the existing consent/apply path.\n\nAn update set has one signature over the whole set metadata, with per-platform artifact digests inside that signed metadata. This makes a debug version or stable version an atomic, auditable set while still letting each recipient fetch only its matching artifact.\n\nIf a recipient's platform is missing from an offered set, the result is a typed rejection such as `NoArtifactForPlatform`, not an up-to-date/no-op answer. A malformed or incomplete debug rollout should be visible in convergence reporting.\n\nThe receiver may support both the original single-artifact `SignedRelease` shape and the new platform-targeted set shape during migration. Debug rollout can be the first user of update sets; stable release publishing can move later without blocking the debugging workflow.\n\nPlatform keys in the signed metadata use Rust target triples, for example `x86_64-pc-windows-msvc` and `x86_64-unknown-linux-gnu`. Release asset names remain a packaging concern and may keep their public-friendly names; target triples are the protocol identifiers.\n\nThis keeps debug rollout fast without turning it into raw peer file-copy: a fast coordinator can assemble and sign every platform artifact, then let the existing subnet update machinery distribute the right bytes to each node. The generic receiver/protocol support belongs in the production daemon because public releases and debug rollouts have the same cross-platform distribution problem. The rollout driver does not: build recipes, cross-build/WSL/runner coordination, dev-key signing, and \"stage this debug rollout\" live in source-repo maintainer tooling (for example `xtask`), not in the public `spt` CLI/help/docs for end users.\n\nRelease monotonicity is scoped to the pinned channel. Stable releases and debug rollouts use separate counters, so a fast debug sequence cannot consume, block, or roll back the stable release counter; rollback protection compares only against the latest accepted version for the recipient's pinned channel.\n\nDebug rollout targets are opt-in by channel pin, not by subnet membership alone. A debug offer may traverse trusted subnet peers, but a stable-pinned node rejects it at the metadata gate; only nodes pinned to the debug channel and provisioned with the dev signing key can stage and apply it.\n\nPinning a lab node to debug uses the existing release-key overlay: `$SPT_HOME/identity/release-keys.json` adds the dev public key and sets `\"channel\": \"debug\"` (for example `\"keys\": {\"dev-debug-2026\": \"\"}`). Removing the key or pinning the channel back to `\"stable\"` takes the node out of debug rollout eligibility.\n\nChannel pinning is exclusive. A debug-pinned node accepts only debug-channel offers and rejects stable offers until re-pinned to stable; a stable-pinned node accepts only stable-channel offers. This keeps rollback accounting and test provenance unambiguous.\n\nMaintainer tooling may provide a helper to write that file correctly, but the canonical mechanism remains the generic release-key overlay. `spt` itself does not need a special debug-mode command; source-repo tooling can offer convenience such as `xtask debug-pin` for local lab setup.\n\nBad debug builds recover the same way as stable releases: publish a newer signed debug rollout, even if the artifact bytes are a previous known-good binary. Numeric rollback remains rejected; the debug channel never gets a bypass around the anti-rollback invariant.\n\nDebug signing key custody is deliberately weaker than stable release signing. The stable release seed stays manual/password-manager driven per ADR-0015; the debug seed may live in a long-lived `SPT_DEBUG_RELEASE_SEED` environment variable on the fast coordinator so agents can drive rollouts. This is acceptable only because the key's blast radius is limited to nodes explicitly pinned to `debug` and provisioned with that dev public key; rotation is minting a new debug key, updating lab overlays, and deleting the old env var/key.\n\n`xtask debug-rollout` must not auto-mint a signing key. If `SPT_DEBUG_RELEASE_SEED` is missing it fails with setup guidance; a separate `xtask debug-keygen` may print a seed/public-key pair for deliberate lab setup.\n\nInitial debug rollout scope is the spt-core binary only. Adapter updates remain on the adapter ripple-update seam with adapter-owned signing or delegated verification; maintainer tooling may compose adapter updates later, but the fast core-debug loop should not blur those trust boundaries.\n\nDebug rollout may carry broker-touching updates. Brain-only debug applies keep the normal no-endpoint-termination invariant. If the candidate class requires replacing the broker, apply requires the node to quiesce first: no broker-held endpoints or live resources may be running, and tooling must refuse with a typed \"shut down/suspend hosted endpoints first\" result rather than cycling them implicitly.\n\nThe first broker-touching debug flow refuses only; it does not auto-suspend or auto-shutdown endpoints. The refusal should list the blocking broker-held endpoints/resources and print the commands needed to quiesce them, preserving lifecycle control with the operator.\n\nInitiation is local staging plus normal pull-based peer propagation. The debug driver writes the signed update set into the local daemon's staged-release cache and may poke the daemon to advertise/check immediately for responsiveness, but it must not introduce a bespoke \"push this binary to node X\" path.\n\nThe debug driver should verify convergence after staging. By default, \"expected\" means every reachable node in the selected lab subnet that is pinned to `debug`; maintainer tooling may accept an explicit node list for targeted tests. It watches until every expected debug-pinned reachable node reports the target debug version applied, or returns a timeout table with per-node state such as not pinned, offline, staged awaiting consent, blocked by live broker resources, applied, or rejected.\n\nThe debug channel sequence is maintainer-tooling state, not project truth or node identity. It may live in an ignored source-repo local file such as under `target/`; losing it is recoverable by choosing a higher debug version. Deployed nodes only require that the next accepted debug metadata version is greater than the current debug version they have seen.\n\nDebug rollout metadata should carry signed diagnostic provenance: source git commit, dirty flag, build host, build timestamp, and platform target. These fields are for observability (\"which bits are running where?\"), not for trust; verification remains signature plus artifact digest plus channel/version policy.\n\nThe first implementation slice is intentionally narrow: update-set metadata and verification, daemon staging/read path with local platform selection, maintainer `xtask` helpers for debug pinning and debug rollout, and loopback/two-host proof of propagation plus convergence reporting. Remote build orchestration, rich dashboards, adapter inclusion, and stable-release publishing migration are later work.\n\n## Considered Options\n\n- **Single artifact per staged update** — simpler metadata, but forces dev tooling to stage different binaries through platform-specific side paths and makes debug rollout brittle.\n- **Debug-only remote copy/install scripts** — fastest to hack, but bypasses the verification, rollback, channel, and consent gates that peer propagation exists to protect.\n- **Platform-targeted update set** — chosen: one generic substrate shape, recipients fetch only their matching artifact, and both stable releases and debug rollouts reuse the same trust path."}],"details":{"totalLines":57,"displayContent":{"text":"# Platform-targeted update sets for debug rollout and release distribution\r\n\r\n\r\n\r\n## Status\r\n\r\naccepted (2026-06-06)\r\n\r\nspt-core's peer-propagated update substrate should understand a signed update as a platform-targeted artifact set, not only as one opaque binary blob. A node offering an update may stage metadata for multiple platform artifacts (for example Windows x86_64 and Linux x86_64); each recipient verifies the set metadata, fetches only the artifact matching its own platform, verifies that artifact's digest, and then follows the existing consent/apply path.\r\n\r\nAn update set has one signature over the whole set metadata, with per-platform artifact digests inside that signed metadata. This makes a debug version or stable version an atomic, auditable set while still letting each recipient fetch only its matching artifact.\r\n\r\nIf a recipient's platform is missing from an offered set, the result is a typed rejection such as `NoArtifactForPlatform`, not an up-to-date/no-op answer. A malformed or incomplete debug rollout should be visible in convergence reporting.\r\n\r\nThe receiver may support both the original single-artifact `SignedRelease` shape and the new platform-targeted set shape during migration. Debug rollout can be the first user of update sets; stable release publishing can move later without blocking the debugging workflow.\r\n\r\nPlatform keys in the signed metadata use Rust target triples, for example `x86_64-pc-windows-msvc` and `x86_64-unknown-linux-gnu`. Release asset names remain a packaging concern and may keep their public-friendly names; target triples are the protocol identifiers.\r\n\r\nThis keeps debug rollout fast without turning it into raw peer file-copy: a fast coordinator can assemble and sign every platform artifact, then let the existing subnet update machinery distribute the right bytes to each node. The generic receiver/protocol support belongs in the production daemon because public releases and debug rollouts have the same cross-platform distribution problem. The rollout driver does not: build recipes, cross-build/WSL/runner coordination, dev-key signing, and \"stage this debug rollout\" live in source-repo maintainer tooling (for example `xtask`), not in the public `spt` CLI/help/docs for end users.\r\n\r\nRelease monotonicity is scoped to the pinned channel. Stable releases and debug rollouts use separate counters, so a fast debug sequence cannot consume, block, or roll back the stable release counter; rollback protection compares only against the latest accepted version for the recipient's pinned channel.\r\n\r\nDebug rollout targets are opt-in by channel pin, not by subnet membership alone. A debug offer may traverse trusted subnet peers, but a stable-pinned node rejects it at the metadata gate; only nodes pinned to the debug channel and provisioned with the dev signing key can stage and apply it.\r\n\r\nPinning a lab node to debug uses the existing release-key overlay: `$SPT_HOME/identity/release-keys.json` adds the dev public key and sets `\"channel\": \"debug\"` (for example `\"keys\": {\"dev-debug-2026\": \"\"}`). Removing the key or pinning the channel back to `\"stable\"` takes the node out of debug rollout eligibility.\r\n\r\nChannel pinning is exclusive. A debug-pinned node accepts only debug-channel offers and rejects stable offers until re-pinned to stable; a stable-pinned node accepts only stable-channel offers. This keeps rollback accounting and test provenance unambiguous.\r\n\r\nMaintainer tooling may provide a helper to write that file correctly, but the canonical mechanism remains the generic release-key overlay. `spt` itself does not need a special debug-mode command; source-repo tooling can offer convenience such as `xtask debug-pin` for local lab setup.\r\n\r\nBad debug builds recover the same way as stable releases: publish a newer signed debug rollout, even if the artifact bytes are a previous known-good binary. Numeric rollback remains rejected; the debug channel never gets a bypass around the anti-rollback invariant.\r\n\r\nDebug signing key custody is deliberately weaker than stable release signing. The stable release seed stays manual/password-manager driven per ADR-0015; the debug seed may live in a long-lived `SPT_DEBUG_RELEASE_SEED` environment variable on the fast coordinator so agents can drive rollouts. This is acceptable only because the key's blast radius is limited to nodes explicitly pinned to `debug` and provisioned with that dev public key; rotation is minting a new debug key, updating lab overlays, and deleting the old env var/key.\r\n\r\n`xtask debug-rollout` must not auto-mint a signing key. If `SPT_DEBUG_RELEASE_SEED` is missing it fails with setup guidance; a separate `xtask debug-keygen` may print a seed/public-key pair for deliberate lab setup.\r\n\r\nInitial debug rollout scope is the spt-core binary only. Adapter updates remain on the adapter ripple-update seam with adapter-owned signing or delegated verification; maintainer tooling may compose adapter updates later, but the fast core-debug loop should not blur those trust boundaries.\r\n\r\nDebug rollout may carry broker-touching updates. Brain-only debug applies keep the normal no-endpoint-termination invariant. If the candidate class requires replacing the broker, apply requires the node to quiesce first: no broker-held endpoints or live resources may be running, and tooling must refuse with a typed \"shut down/suspend hosted endpoints first\" result rather than cycling them implicitly.\r\n\r\nThe first broker-touching debug flow refuses only; it does not auto-suspend or auto-shutdown endpoints. The refusal should list the blocking broker-held endpoints/resources and print the commands needed to quiesce them, preserving lifecycle control with the operator.\r\n\r\nInitiation is local staging plus normal pull-based peer propagation. The debug driver writes the signed update set into the local daemon's staged-release cache and may poke the daemon to advertise/check immediately for responsiveness, but it must not introduce a bespoke \"push this binary to node X\" path.\r\n\r\nThe debug driver should verify convergence after staging. By default, \"expected\" means every reachable node in the selected lab subnet that is pinned to `debug`; maintainer tooling may accept an explicit node list for targeted tests. It watches until every expected debug-pinned reachable node reports the target debug version applied, or returns a timeout table with per-node state such as not pinned, offline, staged awaiting consent, blocked by live broker resources, applied, or rejected.\r\n\r\nThe debug channel sequence is maintainer-tooling state, not project truth or node identity. It may live in an ignored source-repo local file such as under `target/`; losing it is recoverable by choosing a higher debug version. Deployed nodes only require that the next accepted debug metadata version is greater than the current debug version they have seen.\r\n\r\nDebug rollout metadata should carry signed diagnostic provenance: source git commit, dirty flag, build host, build timestamp, and platform target. These fields are for observability (\"which bits are running where?\"), not for trust; verification remains signature plus artifact digest plus channel/version policy.\r\n\r\nThe first implementation slice is intentionally narrow: update-set metadata and verification, daemon staging/read path with local platform selection, maintainer `xtask` helpers for debug pinning and debug rollout, and loopback/two-host proof of propagation plus convergence reporting. Remote build orchestration, rich dashboards, adapter inclusion, and stable-release publishing migration are later work.\r\n\r\n## Considered Options\r\n\r\n- **Single artifact per staged update** — simpler metadata, but forces dev tooling to stage different binaries through platform-specific side paths and makes debug rollout brittle.\r\n- **Debug-only remote copy/install scripts** — fastest to hack, but bypasses the verification, rollback, channel, and consent gates that peer propagation exists to protect.\r\n- **Platform-targeted update set** — chosen: one generic substrate shape, recipients fetch only their matching artifact, and both stable releases and debug rollouts reuse the same trust path.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57]},"fileSize":8257,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\docs\\adr\\0016-platform-targeted-update-sets.md"}}},"isError":false,"timestamp":1789114533860}}
{"type":"message","id":"239db558","parentId":"e203d30d","timestamp":"2026-09-11T08:15:33.861Z","message":{"role":"toolResult","toolCallId":"call_CoDprOnH18BObIqM18PWjoUJ|fc_0581413717c88920016aa3b8a3731487d19703031b1f30ac31","toolName":"read","content":[{"type":"text","text":"# Debug rollout runbook\n\n\n\nDebug rollout is the maintainer-only fast path for testing a local spt-core\nbuild across a trusted lab subnet. It uses the normal signed self-update\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\nembedded debug trust anchor.\n\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\n\n## Mental model\n\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\n artifact digest per Rust target triple.\n- Each recipient verifies the set under its node-local `release-keys.json`,\n selects only its own platform artifact, stages it, and then follows the normal\n consent/apply policy.\n- Debug and stable are separate channels. A debug-pinned node accepts only\n `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\n- Debug versions are monotonic within the debug channel. To recover from a bad\n debug build, publish a higher debug version, even if the bytes are a previous\n known-good binary.\n- A broker-touching candidate may be staged, but apply refuses it while\n broker-held runtime is live. Shut down or suspend hosted endpoints first; the\n first flow does not auto-cycle them.\n\n## One-time lab setup\n\nGenerate a debug key on the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-keygen dev-debug-2026\n```\n\nSet the printed seed as a long-lived coordinator-local environment variable:\n\n```powershell\n$env:SPT_DEBUG_RELEASE_SEED = \"\"\n```\n\nPin each lab node to the debug channel with the printed public key:\n\n```powershell\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key \n```\n\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\n`\"stable\"` removes the node from debug rollout eligibility.\n\n## Stage a rollout\n\nFrom the fast coordinator, stage an update set into the local release cache:\n\n```powershell\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=\"\n```\n\nCommon flags:\n\n- `--build-current` builds and includes the coordinator's current platform.\n- `--artifact ` adds an already-built artifact for another target,\n such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\n- `--version ` overrides the local debug sequence. Use a higher value when\n recovering from lost local state.\n- `--product-version ` stamps the product semver on the signed set\n (default empty — the apply message then falls back to the release counter).\n The composite `spt update`'s adapters leg reads this field as its\n staged-basis floor comparison, so a lab recipe exercising adapter floors\n against a staged core must stamp it. Ordering stays with the monotonic\n counter; this field never decides which release is newer.\n- `--channel ` overrides the set's channel (default `debug`). A lab rig\n whose recipient home stays pinned to `stable` pairs this with a rig-key\n overlay in that home's `release-keys.json`; fleet debug nodes keep the\n default and the `debug-pin` flow.\n- `--stage-dir ` stages somewhere other than `$SPT_HOME/releases`.\n- `--state ` stores the local debug sequence somewhere other than\n `target/debug-rollout-state.json`.\n\nThe staged update then propagates through the normal pull-based update pump.\nThere is intentionally no bespoke push path.\n\n## Apply and observe\n\nOn a default-gated node, apply is still explicit:\n\n```powershell\nspt update apply\n```\n\nNodes configured for full-auto update may apply after staging without a prompt.\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\nquery peers promptly.\n\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\nrun the maintainer watcher from the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-converge --version [--subnet ] [--timeout 120] [--poll 3]\n```\n\nIt polls every expected node (the coordinator's trust rows; `--nodes `\noverrides) over the status-only update query and prints a per-node table —\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\n`Offline` — exiting `0` only when every node applied the target (`1`\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\nThe manual walk below remains the fallback.\n\nUseful outcomes:\n\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\n Rust target triple.\n- `WrongChannel` means the node is not pinned to `debug`.\n- `Rollback` means the offered debug version is not greater than the node's\n current debug-channel version.\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\n resources; quiesce hosted endpoints first.\n\n## Agent checklist\n\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\n `spt` CLI/help surface.\n3. Keep verification on the production update substrate: signed metadata,\n per-platform artifact digest, channel pinning, monotonic version, and\n apply-time re-verification.\n4. Add or update traceability evidence for `REQ-UPD-6`.\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`."}],"details":{"totalLines":130,"displayContent":{"text":"# Debug rollout runbook\r\n\r\n\r\n\r\nDebug rollout is the maintainer-only fast path for testing a local spt-core\r\nbuild across a trusted lab subnet. It uses the normal signed self-update\r\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\r\nembedded debug trust anchor.\r\n\r\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\r\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\r\n\r\n## Mental model\r\n\r\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\r\n artifact digest per Rust target triple.\r\n- Each recipient verifies the set under its node-local `release-keys.json`,\r\n selects only its own platform artifact, stages it, and then follows the normal\r\n consent/apply policy.\r\n- Debug and stable are separate channels. A debug-pinned node accepts only\r\n `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\r\n- Debug versions are monotonic within the debug channel. To recover from a bad\r\n debug build, publish a higher debug version, even if the bytes are a previous\r\n known-good binary.\r\n- A broker-touching candidate may be staged, but apply refuses it while\r\n broker-held runtime is live. Shut down or suspend hosted endpoints first; the\r\n first flow does not auto-cycle them.\r\n\r\n## One-time lab setup\r\n\r\nGenerate a debug key on the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-keygen dev-debug-2026\r\n```\r\n\r\nSet the printed seed as a long-lived coordinator-local environment variable:\r\n\r\n```powershell\r\n$env:SPT_DEBUG_RELEASE_SEED = \"\"\r\n```\r\n\r\nPin each lab node to the debug channel with the printed public key:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key \r\n```\r\n\r\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\r\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\r\n`\"stable\"` removes the node from debug rollout eligibility.\r\n\r\n## Stage a rollout\r\n\r\nFrom the fast coordinator, stage an update set into the local release cache:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=\"\r\n```\r\n\r\nCommon flags:\r\n\r\n- `--build-current` builds and includes the coordinator's current platform.\r\n- `--artifact ` adds an already-built artifact for another target,\r\n such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\r\n- `--version ` overrides the local debug sequence. Use a higher value when\r\n recovering from lost local state.\r\n- `--product-version ` stamps the product semver on the signed set\r\n (default empty — the apply message then falls back to the release counter).\r\n The composite `spt update`'s adapters leg reads this field as its\r\n staged-basis floor comparison, so a lab recipe exercising adapter floors\r\n against a staged core must stamp it. Ordering stays with the monotonic\r\n counter; this field never decides which release is newer.\r\n- `--channel ` overrides the set's channel (default `debug`). A lab rig\r\n whose recipient home stays pinned to `stable` pairs this with a rig-key\r\n overlay in that home's `release-keys.json`; fleet debug nodes keep the\r\n default and the `debug-pin` flow.\r\n- `--stage-dir ` stages somewhere other than `$SPT_HOME/releases`.\r\n- `--state ` stores the local debug sequence somewhere other than\r\n `target/debug-rollout-state.json`.\r\n\r\nThe staged update then propagates through the normal pull-based update pump.\r\nThere is intentionally no bespoke push path.\r\n\r\n## Apply and observe\r\n\r\nOn a default-gated node, apply is still explicit:\r\n\r\n```powershell\r\nspt update apply\r\n```\r\n\r\nNodes configured for full-auto update may apply after staging without a prompt.\r\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\r\nquery peers promptly.\r\n\r\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\r\nrun the maintainer watcher from the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-converge --version [--subnet ] [--timeout 120] [--poll 3]\r\n```\r\n\r\nIt polls every expected node (the coordinator's trust rows; `--nodes `\r\noverrides) over the status-only update query and prints a per-node table —\r\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\r\n`Offline` — exiting `0` only when every node applied the target (`1`\r\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\r\nThe manual walk below remains the fallback.\r\n\r\nUseful outcomes:\r\n\r\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\r\n Rust target triple.\r\n- `WrongChannel` means the node is not pinned to `debug`.\r\n- `Rollback` means the offered debug version is not greater than the node's\r\n current debug-channel version.\r\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\r\n resources; quiesce hosted endpoints first.\r\n\r\n## Agent checklist\r\n\r\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\r\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\r\n `spt` CLI/help surface.\r\n3. Keep verification on the production update substrate: signed metadata,\r\n per-platform artifact digest, channel pinning, monotonic version, and\r\n apply-time re-verification.\r\n4. Add or update traceability evidence for `REQ-UPD-6`.\r\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130]},"fileSize":5535,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\docs\\DEBUG-ROLLOUT.md"}}},"isError":false,"timestamp":1789114533860}}
{"type":"message","id":"992f6567","parentId":"239db558","timestamp":"2026-09-11T08:15:33.862Z","message":{"role":"toolResult","toolCallId":"call_2JdmguW1uKUNOskkIowSzpFU|fc_0581413717c88920016aa3b8a3733087d1b93d233cd00558ed","toolName":"read","content":[{"type":"text","text":"//! THE-FORKENING W4 — `spt daemon refresh` on a LIVE daemon with a hosted\n//! endpoint (REQ-DAEMON-REFRESH): the brain generation cycles (new brain pid,\n//! generation bumped) with NO binary swap, while the broker process, the hosted\n//! harness session, and the endpoint's ONLINE perch all survive untouched — the\n//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\n//! verb. The recovery story: wedged brain-held state no longer needs a full\n//! daemon bounce that kills every PTY.\n//!\n//! Real `spt daemon run` broker + supervised brain + a REAL dummy-harness\n//! `[session.self]` session (the live_adapt_translation_swap_e2e rig, minus the\n//! translation child). Bounded everywhere; every spawned pid is reaped SCOPED\n//! at test end.\n//\n// [int->REQ-DAEMON-REFRESH]\n\nuse std::path::{Path, PathBuf};\nuse std::process::{Child, Command, Stdio};\nuse std::time::{Duration, Instant};\n\nmod common;\nuse common::CommandNoWindowExt;\n\nuse spt_store::perch::{self, ParentHint};\n\n/// Scoped pid-tree kill (cleanup) — never machine-wide.\nfn kill_pid(pid: u32) {\n #[cfg(windows)]\n let _ = Command::new(\"taskkill\")\n .no_window()\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\n .output();\n #[cfg(unix)]\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\n}\n\n/// `(pid, generation)` out of `brain.ready`; `None` until it parses.\nfn read_ready(path: &Path) -> Option<(u32, u64)> {\n let v: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()?;\n Some((\n v.get(\"pid\")?.as_u64()? as u32,\n v.get(\"generation\")?.as_u64()?,\n ))\n}\n\n/// Poll `brain.ready` until it holds a pid different from `was`, up to `budget`.\nfn wait_ready_not(path: &Path, was: Option, budget: Duration) -> Option<(u32, u64)> {\n let deadline = Instant::now() + budget;\n while Instant::now() < deadline {\n if let Some((pid, generation)) = read_ready(path) {\n if was != Some(pid) {\n return Some((pid, generation));\n }\n }\n std::thread::sleep(Duration::from_millis(50));\n }\n None\n}\n\n\n\n#[test]\nfn daemon_refresh_cycles_brain_while_hosted_endpoint_survives() {\n let now_ms = || {\n std::time::SystemTime::now()\n .duration_since(std::time::UNIX_EPOCH)\n .map(|d| d.as_millis() as u64)\n .unwrap_or(0)\n };\n let _ = now_ms; // rig parity; the CLI verb needs no in-proc Brain here.\n\n // ── (1) Isolated, NET-LESS SPT_HOME. ──\n let home = tempfile::tempdir().unwrap();\n std::env::set_var(\"SPT_HOME\", home.path());\n let identity_dir = home.path().join(\"identity\");\n std::fs::create_dir_all(&identity_dir).unwrap();\n std::fs::write(identity_dir.join(\"node.key\"), \"not-a-valid-seed\").unwrap();\n\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n let exe_suffix = spt_bin\n .extension()\n .map(|e| format!(\".{}\", e.to_string_lossy()))\n .unwrap_or_default();\n let mock_session = common::sibling_bin(\"mock-session\");\n assert!(\n mock_session.exists(),\n \"the dummy-harness program must be built: {}\",\n mock_session.display()\n );\n\n // ── (2) Register adapter `cc` with a long-lived dummy-harness session\n // (the live_adapt rig's manifest, minus the translation binary). ──\n let install_dir = perch::spt_home().join(\"srcs\").join(\"cc\");\n std::fs::create_dir_all(&install_dir).unwrap();\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\n let self_cmd = format!(\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\n --spt {spt_for_cmd} --mock-adapter cc --type live_agent --heartbeat-ms 200\"\n );\n let psyche_bin = install_dir.join(format!(\"psychebin{exe_suffix}\"));\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\n let drops = home.path().join(\"drops\");\n std::fs::create_dir_all(&drops).unwrap();\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\n let manifest_toml = format!(\n \"[adapter]\\nname=\\\"cc\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\n );\n std::fs::write(install_dir.join(\"manifest.toml\"), &manifest_toml).unwrap();\n spt_runtime::registry::register(&perch::adapters_dir(), &install_dir, 1000).unwrap();\n\n // ── (3) The REAL daemon broker process. ──\n let brain_log = home.path().join(\"brain.stderr.log\");\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\n let mut broker: Child = Command::new(&spt_bin)\n .no_window()\n .args([\"daemon\", \"run\"])\n .env(\"SPT_HOME\", home.path())\n // Rig daemon: the advisory well-known ports belong to this box's resident\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n .env(\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\n \"1\",\n )\n .stdout(Stdio::null())\n .stderr(Stdio::from(brain_log_file))\n .spawn()\n .expect(\"spawn spt daemon run (broker process)\");\n let ready_path = home.path().join(\"brain.ready\");\n let (brain_pid_before, gen_before) =\n match wait_ready_not(&ready_path, None, Duration::from_secs(30)) {\n Some(r) => r,\n None => {\n let _ = broker.kill();\n let _ = broker.wait();\n panic!(\n \"PRECONDITION: brain never came up.\\n{}\",\n common::daemon_stderr_panel(&brain_log)\n );\n }\n };\n let broker_pid = broker.id();\n\n // ── (4) Host a real endpoint: `endpoint create ccX --adapter cc + endpoint start ccX`,\n // wait for its perch ONLINE. ──\n let id = \"ccX\";\n // U3: the mint and the first session are separate verbs.\n common::create_endpoint(&spt_bin, home.path(), id, \"cc\");\n let run = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"endpoint\", \"start\", id])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(45))\n };\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\n let harness_pid: Option = run_stderr\n .split(\"pid=\")\n .nth(1)\n .and_then(|s| s.split_whitespace().next())\n .and_then(|s| s.trim().parse().ok());\n\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\n let mut online = false;\n let deadline = Instant::now() + Duration::from_secs(25);\n while Instant::now() < deadline {\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\n online = true;\n break;\n }\n std::thread::sleep(Duration::from_millis(150));\n }\n\n // ── (5) THE VERB: `spt daemon refresh` — the production CLI path. ──\n let refresh = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"daemon\", \"refresh\"])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(30))\n };\n let refresh_stdout = String::from_utf8_lossy(&refresh.stdout).to_string();\n let refresh_stderr = String::from_utf8_lossy(&refresh.stderr).to_string();\n\n // ── (6) The brain must CYCLE: a new pid stamps brain.ready with a bumped\n // generation (no binary swapped anywhere). ──\n let cycled = wait_ready_not(&ready_path, Some(brain_pid_before), Duration::from_secs(30));\n\n // The broker process must be the SAME OS process (never restarted).\n let broker_still_running = broker.try_wait().map(|st| st.is_none()).unwrap_or(false);\n\n // The hosted endpoint survives: harness alive + perch back/still ONLINE.\n let harness_alive_after = harness_pid\n .map(spt_store::proc::is_process_alive)\n .unwrap_or(false);\n let mut still_online = false;\n let online_deadline = Instant::now() + Duration::from_secs(10);\n while Instant::now() < online_deadline {\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\n still_online = true;\n break;\n }\n std::thread::sleep(Duration::from_millis(150));\n }\n\n let brain_stderr = common::daemon_stderr_panel(&brain_log);\n eprintln!(\n \"=== W4 daemon refresh: run_ok={} online={online} harness_pid={harness_pid:?} \\\n refresh_ok={} brain_before={brain_pid_before}/g{gen_before} cycled={cycled:?} \\\n broker_alive={broker_still_running} harness_alive_after={harness_alive_after} \\\n still_online={still_online} ===\\n--- refresh stdout ---\\n{refresh_stdout}\\n\\\n --- refresh stderr ---\\n{refresh_stderr}\\n=== endpoint start stderr ===\\n{run_stderr}\\n\\\n {brain_stderr}\",\n run.status.success(),\n refresh.status.success(),\n );\n\n // ── (7) Reap the ENTIRE tree SCOPED before asserting. ──\n if let Some(p) = harness_pid {\n kill_pid(p);\n }\n let psyche_perch = perch::resolve_perch_path(&format!(\"{id}-psyche\"), ParentHint::Explicit(id));\n if let Some(p) = spt_store::info::read_pid(&psyche_perch) {\n kill_pid(p);\n }\n let _ = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"daemon\", \"stop\", \"--force\"])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(20))\n };\n if let Some((pid, _)) = cycled {\n kill_pid(pid);\n }\n kill_pid(brain_pid_before);\n let _ = broker.kill();\n let _ = broker.wait();\n\n // ── ASSERTIONS ──\n assert!(\n run.status.success(),\n \"endpoint start must succeed: {run_stderr}\"\n );\n assert!(\n online,\n \"PRECONDITION: the cc endpoint must bind ONLINE before the refresh.\\n\\\n {brain_stderr}\"\n );\n assert!(\n refresh.status.success(),\n \"REQ-DAEMON-REFRESH: `spt daemon refresh` must exit 0 against a live daemon \\\n (stdout: {refresh_stdout}; stderr: {refresh_stderr}).\\n\\\n {brain_stderr}\"\n );\n let (brain_pid_after, gen_after) = cycled.unwrap_or_else(|| {\n panic!(\n \"REQ-DAEMON-REFRESH: the brain must CYCLE (a new pid must stamp brain.ready) \\\n after refresh — pid stayed {brain_pid_before}.\\n{brain_stderr}\"\n )\n });\n assert_ne!(\n brain_pid_after, brain_pid_before,\n \"a fresh brain process must own the ready stamp\"\n );\n assert!(\n gen_after > gen_before,\n \"REQ-DAEMON-REFRESH: the brain GENERATION must advance across a refresh \\\n (before g{gen_before}, after g{gen_after}) — the supervisor cycle, not a re-stamp.\\n\\\n {brain_stderr}\"\n );\n assert!(\n broker_still_running,\n \"REQ-DAEMON-REFRESH: the broker process must survive the refresh untouched \\\n (pid {broker_pid}).\\n{brain_stderr}\"\n );\n assert!(\n harness_alive_after,\n \"REQ-DAEMON-REFRESH: the hosted harness session must STILL be ALIVE across the \\\n refresh — only the brain cycles, never the hosted PTYs. harness_pid={harness_pid:?}.\\n\\\n {brain_stderr}\"\n );\n assert!(\n still_online,\n \"REQ-DAEMON-REFRESH: the endpoint perch must remain ONLINE across the refresh \\\n (the session was never torn down).\\n{brain_stderr}\"\n );\n}"}],"details":{"totalLines":291,"displayContent":{"text":"//! THE-FORKENING W4 — `spt daemon refresh` on a LIVE daemon with a hosted\r\n//! endpoint (REQ-DAEMON-REFRESH): the brain generation cycles (new brain pid,\r\n//! generation bumped) with NO binary swap, while the broker process, the hosted\r\n//! harness session, and the endpoint's ONLINE perch all survive untouched — the\r\n//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\r\n//! verb. The recovery story: wedged brain-held state no longer needs a full\r\n//! daemon bounce that kills every PTY.\r\n//!\r\n//! Real `spt daemon run` broker + supervised brain + a REAL dummy-harness\r\n//! `[session.self]` session (the live_adapt_translation_swap_e2e rig, minus the\r\n//! translation child). Bounded everywhere; every spawned pid is reaped SCOPED\r\n//! at test end.\r\n//\r\n// [int->REQ-DAEMON-REFRESH]\r\n\r\nuse std::path::{Path, PathBuf};\r\nuse std::process::{Child, Command, Stdio};\r\nuse std::time::{Duration, Instant};\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nuse spt_store::perch::{self, ParentHint};\r\n\r\n/// Scoped pid-tree kill (cleanup) — never machine-wide.\r\nfn kill_pid(pid: u32) {\r\n #[cfg(windows)]\r\n let _ = Command::new(\"taskkill\")\r\n .no_window()\r\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\r\n .output();\r\n #[cfg(unix)]\r\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\r\n}\r\n\r\n/// `(pid, generation)` out of `brain.ready`; `None` until it parses.\r\nfn read_ready(path: &Path) -> Option<(u32, u64)> {\r\n let v: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()?;\r\n Some((\r\n v.get(\"pid\")?.as_u64()? as u32,\r\n v.get(\"generation\")?.as_u64()?,\r\n ))\r\n}\r\n\r\n/// Poll `brain.ready` until it holds a pid different from `was`, up to `budget`.\r\nfn wait_ready_not(path: &Path, was: Option, budget: Duration) -> Option<(u32, u64)> {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some((pid, generation)) = read_ready(path) {\r\n if was != Some(pid) {\r\n return Some((pid, generation));\r\n }\r\n }\r\n std::thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n\r\n\r\n#[test]\r\nfn daemon_refresh_cycles_brain_while_hosted_endpoint_survives() {\r\n let now_ms = || {\r\n std::time::SystemTime::now()\r\n .duration_since(std::time::UNIX_EPOCH)\r\n .map(|d| d.as_millis() as u64)\r\n .unwrap_or(0)\r\n };\r\n let _ = now_ms; // rig parity; the CLI verb needs no in-proc Brain here.\r\n\r\n // ── (1) Isolated, NET-LESS SPT_HOME. ──\r\n let home = tempfile::tempdir().unwrap();\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n let identity_dir = home.path().join(\"identity\");\r\n std::fs::create_dir_all(&identity_dir).unwrap();\r\n std::fs::write(identity_dir.join(\"node.key\"), \"not-a-valid-seed\").unwrap();\r\n\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let exe_suffix = spt_bin\r\n .extension()\r\n .map(|e| format!(\".{}\", e.to_string_lossy()))\r\n .unwrap_or_default();\r\n let mock_session = common::sibling_bin(\"mock-session\");\r\n assert!(\r\n mock_session.exists(),\r\n \"the dummy-harness program must be built: {}\",\r\n mock_session.display()\r\n );\r\n\r\n // ── (2) Register adapter `cc` with a long-lived dummy-harness session\r\n // (the live_adapt rig's manifest, minus the translation binary). ──\r\n let install_dir = perch::spt_home().join(\"srcs\").join(\"cc\");\r\n std::fs::create_dir_all(&install_dir).unwrap();\r\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\r\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\r\n let self_cmd = format!(\r\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\r\n --spt {spt_for_cmd} --mock-adapter cc --type live_agent --heartbeat-ms 200\"\r\n );\r\n let psyche_bin = install_dir.join(format!(\"psychebin{exe_suffix}\"));\r\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\r\n let drops = home.path().join(\"drops\");\r\n std::fs::create_dir_all(&drops).unwrap();\r\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\r\n let manifest_toml = format!(\r\n \"[adapter]\\nname=\\\"cc\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\r\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\r\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\r\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\r\n );\r\n std::fs::write(install_dir.join(\"manifest.toml\"), &manifest_toml).unwrap();\r\n spt_runtime::registry::register(&perch::adapters_dir(), &install_dir, 1000).unwrap();\r\n\r\n // ── (3) The REAL daemon broker process. ──\r\n let brain_log = home.path().join(\"brain.stderr.log\");\r\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\r\n let mut broker: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"daemon\", \"run\"])\r\n .env(\"SPT_HOME\", home.path())\r\n // Rig daemon: the advisory well-known ports belong to this box's resident\r\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\r\n .env(\r\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\r\n \"1\",\r\n )\r\n .stdout(Stdio::null())\r\n .stderr(Stdio::from(brain_log_file))\r\n .spawn()\r\n .expect(\"spawn spt daemon run (broker process)\");\r\n let ready_path = home.path().join(\"brain.ready\");\r\n let (brain_pid_before, gen_before) =\r\n match wait_ready_not(&ready_path, None, Duration::from_secs(30)) {\r\n Some(r) => r,\r\n None => {\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n panic!(\r\n \"PRECONDITION: brain never came up.\\n{}\",\r\n common::daemon_stderr_panel(&brain_log)\r\n );\r\n }\r\n };\r\n let broker_pid = broker.id();\r\n\r\n // ── (4) Host a real endpoint: `endpoint create ccX --adapter cc + endpoint start ccX`,\r\n // wait for its perch ONLINE. ──\r\n let id = \"ccX\";\r\n // U3: the mint and the first session are separate verbs.\r\n common::create_endpoint(&spt_bin, home.path(), id, \"cc\");\r\n let run = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"endpoint\", \"start\", id])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(45))\r\n };\r\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\r\n let harness_pid: Option = run_stderr\r\n .split(\"pid=\")\r\n .nth(1)\r\n .and_then(|s| s.split_whitespace().next())\r\n .and_then(|s| s.trim().parse().ok());\r\n\r\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\r\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\r\n let mut online = false;\r\n let deadline = Instant::now() + Duration::from_secs(25);\r\n while Instant::now() < deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n // ── (5) THE VERB: `spt daemon refresh` — the production CLI path. ──\r\n let refresh = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"daemon\", \"refresh\"])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(30))\r\n };\r\n let refresh_stdout = String::from_utf8_lossy(&refresh.stdout).to_string();\r\n let refresh_stderr = String::from_utf8_lossy(&refresh.stderr).to_string();\r\n\r\n // ── (6) The brain must CYCLE: a new pid stamps brain.ready with a bumped\r\n // generation (no binary swapped anywhere). ──\r\n let cycled = wait_ready_not(&ready_path, Some(brain_pid_before), Duration::from_secs(30));\r\n\r\n // The broker process must be the SAME OS process (never restarted).\r\n let broker_still_running = broker.try_wait().map(|st| st.is_none()).unwrap_or(false);\r\n\r\n // The hosted endpoint survives: harness alive + perch back/still ONLINE.\r\n let harness_alive_after = harness_pid\r\n .map(spt_store::proc::is_process_alive)\r\n .unwrap_or(false);\r\n let mut still_online = false;\r\n let online_deadline = Instant::now() + Duration::from_secs(10);\r\n while Instant::now() < online_deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n still_online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n let brain_stderr = common::daemon_stderr_panel(&brain_log);\r\n eprintln!(\r\n \"=== W4 daemon refresh: run_ok={} online={online} harness_pid={harness_pid:?} \\\r\n refresh_ok={} brain_before={brain_pid_before}/g{gen_before} cycled={cycled:?} \\\r\n broker_alive={broker_still_running} harness_alive_after={harness_alive_after} \\\r\n still_online={still_online} ===\\n--- refresh stdout ---\\n{refresh_stdout}\\n\\\r\n --- refresh stderr ---\\n{refresh_stderr}\\n=== endpoint start stderr ===\\n{run_stderr}\\n\\\r\n {brain_stderr}\",\r\n run.status.success(),\r\n refresh.status.success(),\r\n );\r\n\r\n // ── (7) Reap the ENTIRE tree SCOPED before asserting. ──\r\n if let Some(p) = harness_pid {\r\n kill_pid(p);\r\n }\r\n let psyche_perch = perch::resolve_perch_path(&format!(\"{id}-psyche\"), ParentHint::Explicit(id));\r\n if let Some(p) = spt_store::info::read_pid(&psyche_perch) {\r\n kill_pid(p);\r\n }\r\n let _ = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"daemon\", \"stop\", \"--force\"])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(20))\r\n };\r\n if let Some((pid, _)) = cycled {\r\n kill_pid(pid);\r\n }\r\n kill_pid(brain_pid_before);\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n\r\n // ── ASSERTIONS ──\r\n assert!(\r\n run.status.success(),\r\n \"endpoint start must succeed: {run_stderr}\"\r\n );\r\n assert!(\r\n online,\r\n \"PRECONDITION: the cc endpoint must bind ONLINE before the refresh.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n refresh.status.success(),\r\n \"REQ-DAEMON-REFRESH: `spt daemon refresh` must exit 0 against a live daemon \\\r\n (stdout: {refresh_stdout}; stderr: {refresh_stderr}).\\n\\\r\n {brain_stderr}\"\r\n );\r\n let (brain_pid_after, gen_after) = cycled.unwrap_or_else(|| {\r\n panic!(\r\n \"REQ-DAEMON-REFRESH: the brain must CYCLE (a new pid must stamp brain.ready) \\\r\n after refresh — pid stayed {brain_pid_before}.\\n{brain_stderr}\"\r\n )\r\n });\r\n assert_ne!(\r\n brain_pid_after, brain_pid_before,\r\n \"a fresh brain process must own the ready stamp\"\r\n );\r\n assert!(\r\n gen_after > gen_before,\r\n \"REQ-DAEMON-REFRESH: the brain GENERATION must advance across a refresh \\\r\n (before g{gen_before}, after g{gen_after}) — the supervisor cycle, not a re-stamp.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n broker_still_running,\r\n \"REQ-DAEMON-REFRESH: the broker process must survive the refresh untouched \\\r\n (pid {broker_pid}).\\n{brain_stderr}\"\r\n );\r\n assert!(\r\n harness_alive_after,\r\n \"REQ-DAEMON-REFRESH: the hosted harness session must STILL be ALIVE across the \\\r\n refresh — only the brain cycles, never the hosted PTYs. harness_pid={harness_pid:?}.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n still_online,\r\n \"REQ-DAEMON-REFRESH: the endpoint perch must remain ONLINE across the refresh \\\r\n (the session was never torn down).\\n{brain_stderr}\"\r\n );\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291]},"fileSize":12084,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt\\tests\\daemon_refresh_e2e.rs"}}},"isError":false,"timestamp":1789114533861}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_rPI3JRhqFdBZUxqFUJJWprVe|fc_0581413717c88920016aa3b8a53a8887d1b6f675d914dd34d0","toolName":"grep","startedAt":"2026-09-11T08:15:38.352Z","args":{"path":".worktrees/hertz-304/crates/spt/tests;.worktrees/hertz-304/crates/spt-daemon/src;.worktrees/hertz-304/xtask"},"intent":"Locating signed live fixtures"},"id":"624eb601","parentId":"992f6567","timestamp":"2026-09-11T08:15:38.352Z"}
{"type":"message","id":"88140fbb","parentId":"624eb601","timestamp":"2026-09-11T08:15:38.352Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_rPI3JRhqFdBZUxqFUJJWprVe|fc_0581413717c88920016aa3b8a53a8887d1b6f675d914dd34d0","name":"grep","arguments":{"i":"Locating signed live fixtures","pattern":"SignedUpdateSet|apply_staged|live.*update|release-keys|NO_NETWORK|DISABLE.*NET","path":".worktrees/hertz-304/crates/spt/tests;.worktrees/hertz-304/crates/spt-daemon/src;.worktrees/hertz-304/xtask","case":null,"gitignore":false,"skip":null},"intent":"Locating signed live fixtures"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":8064,"output":100,"cacheRead":11008,"cacheWrite":0,"totalTokens":19172,"cost":{"input":0.08064,"output":0.005,"cacheRead":0.011007999999999999,"cacheWrite":0,"total":0.09664800000000001}},"stopReason":"toolUse","timestamp":1789114533881,"responseId":"resp_0581413717c88920016aa3b8a3ca7487d1ba58228ee9452727","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8a53a8887d1b6f675d914dd34d0","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating signed live fixtures\",\"pattern\":\"SignedUpdateSet|apply_staged|live.*update|release-keys|NO_NETWORK|DISABLE.*NET\",\"path\":\".worktrees/hertz-304/crates/spt/tests;.worktrees/hertz-304/crates/spt-daemon/src;.worktrees/hertz-304/xtask\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_rPI3JRhqFdBZUxqFUJJWprVe","internal_chat_message_metadata_passthrough":{"create_time":1789114532.123331,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":4469.579599999823,"ttft":1698.7066000001505,"completedAt":1789114538351,"contextSnapshot":{"promptTokens":19072,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"6a2dc78f","parentId":"88140fbb","timestamp":"2026-09-11T08:15:38.440Z","message":{"role":"toolResult","toolCallId":"call_rPI3JRhqFdBZUxqFUJJWprVe|fc_0581413717c88920016aa3b8a53a8887d1b6f675d914dd34d0","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/\n\n## spt/tests/\n### composite_e2e.rs\n 8|//! and no real gh auth. The trust anchor is a test key overlaid via\n*9|//! `release-keys.json`; the core apply is the daemonless path (no daemon in\n 10|//! this home), which swaps THIS test's private copy of the spt binary (never\n 11|//! the shared target/debug artifact).\n 12|//!\n...\n 64| let sig = release_key().sign(metadata_json.as_bytes());\n*65| serde_json::to_string(&spt_daemon::SignedUpdateSet {\n 66| metadata_json,\n 67| signature_hex: hex(&sig.to_bytes()),\n 68| })\n...\n 111| std::fs::write(\n*112| identity.join(\"release-keys.json\"),\n 113| serde_json::json!({ \"keys\": { KEY_ID: hex(release_key().verifying_key().as_bytes()) } })\n 114| .to_string(),\n 115| )\n### daemon_refresh_e2e.rs\n 4|//! harness session, and the endpoint's ONLINE perch all survive untouched — the\n*5|//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\n 6|//! verb. The recovery story: wedged brain-held state no longer needs a full\n 7|//! daemon bounce that kills every PTY.\n 8|//!\n### docs_bundle_e2e.rs\n 9|//! it ⇒ the daemonless apply path), the trust anchor is a test key overlaid\n*10|//! via `release-keys.json`, and the set is staged directly through the\n 11|//! spt-daemon lib — the gh fetch avenue is REQ-UPDATE-GH-TRANSPORT's own leg.\n 12|//\n 13|// [int->REQ-DOCS-RELEASE-ASSET]\n...\n 31|/// `docs_sha` (`None` ⇒ docs-less set).\n*32|fn signed_set(version: u64, artifact: &[u8], docs_sha: Option) -> spt_daemon::SignedUpdateSet {\n 33| let meta = spt_daemon::UpdateSetMetadata {\n 34| version,\n 35| channel: \"stable\".to_string(),\n...\n 55| let sig = release_key().sign(metadata_json.as_bytes());\n*56| spt_daemon::SignedUpdateSet {\n 57| metadata_json,\n 58| signature_hex: hex(&sig.to_bytes()),\n 59| }\n...\n 72| std::fs::write(\n*73| identity.join(\"release-keys.json\"),\n 74| serde_json::json!({ \"keys\": { KEY_ID: hex(vk.as_bytes()) } }).to_string(),\n 75| )\n 76| .unwrap();\n### live_adapt_translation_swap_e2e.rs\n*1|//! W3e NO-MOCKS int B — REQ-ADAPTER-LIVE-UPDATE (v0.13.2 live adapter update).\n 2|//!\n 3|//! The broker-coordinated live apply, the keystone PASS: a daemon-hosted endpoint\n 4|//! is running a resident translation child FROM its install dir; a live adapter\n...\n 386|\n*387| // Brain-parity: the endpoint NEVER restarted across the live update.\n 388| assert!(\n 389| harness_alive_after,\n 390| \"REQ-ADAPTER-LIVE-UPDATE (brain-parity): the harness session must STILL be ALIVE \\\n*391| after the live update — only the translation child cycles, the endpoint never \\\n 392| restarts. harness_pid={harness_pid:?} was dead post-apply.\\n\\\n 393| {brain_stderr}\"\n 394| );\n...\n 397| \"REQ-ADAPTER-LIVE-UPDATE (brain-parity): the endpoint perch must remain ONLINE \\\n*398| across the live update (the session was never torn down).\\n\\\n 399| {brain_stderr}\"\n 400| );\n 401|}\n...\n 545|\n*546|// F015B test (a) — a `--adapter cc:prof` COMPOSITE endpoint's live update. The\n 547|// endpoint stores the composite `cc:prof` on its broker session; the apply carries\n 548|// the bare PARENT `cc`. The keystone above proves the swap for a BARE-adapter\n 549|// endpoint; this proves the profile dimension: the shared parent-matcher\n...\n 800| );\n*801| // Brain-parity: the composite endpoint never restarted across the live update.\n 802| assert!(\n 803| harness_alive_after,\n 804| \"REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP (brain-parity): the cc:prof harness must STILL be \\\n### trial_drain_drive_e2e.rs\n 73|//! `SPT_LIVEHOST_RECONCILE_DISABLE` to silence it — faithfully reproducing the field's\n*74|//! livehost-silent update-trial (PIN Q2: the trial-brain livehost's first reconcile\n 75|//! tick landed around the 30s kill), the exact condition the fix makes the reap\n 76|//! independent of.**\n 77|//! - **Leg 2 (lighter, doyle FINALIZE refinement).** Assert the broker's stall-evict\n\n## spt-daemon/src/\n### applyhost.rs\n 11|//!\n*12|//! [`apply_staged`] drives the whole chain against what the peer pump left\n 13|//! behind (REQ-UPD-4: staged + consent-notified, never auto-applied):\n 14|//!\n 15|//! 1. **Re-verify at rest** (`plan_verified` under the production\n*16|//! `release-keys.json` policy): apply never trusts the cache — a tampered\n 17|//! or expired artifact refuses here. The monotonic-version floor was\n 18|//! enforced at *stage* time (REQ-HAZARD-UPDATE-ROLLBACK); the apply-time\n 19|//! re-check guards authenticity/integrity/expiry of the bytes on disk.\n...\n 51|\n*52|/// What [`apply_staged`] did — loud + typed, never silent.\n 53|#[derive(Debug, Clone, PartialEq, Eq)]\n 54|pub enum ApplyStagedOutcome {\n 55| /// Nothing staged (or a torn stage that never offers) — idempotent no-op.\n...\n 105|/// swap, carrying the verified bytes. The shared verify/classify preamble both\n*106|/// [`apply_staged`] and [`apply_staged_daemonless`] run before they diverge on\n 107|/// whether a live broker is handed off to.\n 108|enum Prepared {\n 109| /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\n...\n 171| return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n*172| \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\n 173| )));\n 174| }\n 175| let (plan, artifact) = match staged {\n...\n 298|/// the canonical broker socket the brain handoff runs against. For a stopped box,\n*299|/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n 300|/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n 301|// [impl->REQ-UPD-3]\n 302|// [impl->REQ-UPD-4]\n*303|pub fn apply_staged(\n 304| cache: &ReleaseCache,\n 305| release_keys: &Path,\n 306| exe_path: &Path,\n...\n 380|/// the handoff path's does. Runs the identical verify/classify gate as\n*381|/// [`apply_staged`], so every fail-closed refusal is preserved.\n 382|// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n 383|// [impl->REQ-UPD-4]\n*384|pub fn apply_staged_daemonless(\n 385| cache: &ReleaseCache,\n 386| release_keys: &Path,\n 387| exe_path: &Path,\n...\n 404|/// Already-applied classifier (F-025): whether the staged `staged_version` is\n*405|/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\n 406|/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\n 407|/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\n 408|/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n...\n 472| use crate::release::{\n*473| current_platform, sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet,\n 474| UpdateArtifactMetadata, UpdateSetMetadata,\n 475| };\n 476| use crate::update::BROKER_RESOURCE_ABI;\n...\n 607|\n*608| /// Stage a signed release + write the matching release-keys.json.\n 609| /// `resource_abi` lets a test force the broker-breaking class.\n 610| fn stage(\n 611| dir: &Path,\n...\n 640|\n*641| let keys = dir.join(\"release-keys.json\");\n 642| let pub_hex: String = sk\n 643| .verifying_key()\n 644| .to_bytes()\n...\n 687| let sig = sk.sign(metadata_json.as_bytes());\n*688| let signed = SignedUpdateSet {\n 689| metadata_json,\n 690| signature_hex: sig.to_bytes().iter().map(|b| format!(\"{b:02x}\")).collect(),\n 691| };\n...\n 702|\n*703| let keys = dir.join(\"release-keys.json\");\n 704| let pub_hex: String = sk\n 705| .verifying_key()\n 706| .to_bytes()\n...\n 718| /// Sign a single release (sk = [9u8;32], matching `stage`) and write the\n*719| /// matching release-keys.json — WITHOUT staging, so a test controls the\n 720| /// platform stamp itself.\n 721| fn sign_single(dir: &Path, version: u64, artifact: &[u8]) -> (SignedRelease, std::path::PathBuf) {\n 722| let sk = SigningKey::from_bytes(&[9u8; 32]);\n...\n 738| };\n*739| let keys = dir.join(\"release-keys.json\");\n 740| let pub_hex: String = sk\n 741| .verifying_key()\n 742| .to_bytes()\n...\n 760| #[test]\n*761| fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n 762| let dir = tempfile::tempdir().unwrap();\n 763| let name = unique_name();\n 764| let _broker = served_broker(&name);\n...\n 773| cache.stage(&signed, b\"CROSS-OS BYTES\").unwrap();\n*774| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 775| assert!(\n 776| matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(\"platform\")),\n 777| \"unstamped single must refuse, got {out:?}\"\n...\n 792| .unwrap();\n*793| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 794| assert!(\n 795| matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(other)),\n 796| \"mismatched-platform single must refuse, got {out:?}\"\n### brain.rs\n 1814|\n*1815| /// W3d (ADR-0025): hand a live adapter update's APPLY to the broker — for every\n 1816| /// session running `req.adapter`, the broker stops the resident translation\n 1817| /// child (freeing the OS file lock), CRC-swaps `install_dir` from `staging_dir`,\n 1818| /// then restarts the translation from the NEW manifest path. Blocks for the\n### broker.rs\n 4147| /// The adapter name owning this session (W3a, ADR-0025) — empty for a\n*4148| /// legacy/test/shell spawn. A live adapter update finds every live session\n 4149| /// whose `adapter` matches to cycle its resident children.\n 4150| adapter: String,\n 4151| /// The adapter's install dir for this session (W3a) — `None` if unknown. The\n*4152| /// apply target for a live update's CRC swap.\n 4153| install_dir: Option,\n 4154| /// When the session spawned (ADR-0041 decision 6) — the zombie verdict's\n 4155| /// boot-grace anchor: a just-spawned adapter harness has no client chain\n...\n 4624|/// (reused; only the translation child is created). Extracted verbatim from\n*4625|/// `dispatch_spawn` so a live-update restart (`dispatch_adapter_apply`, W3d) can\n 4626|/// rebuild a session's translation child from the NEW binary without disturbing\n 4627|/// the PTY / output log / session (brain-parity).\n 4628|// [impl->REQ-MSG-IDLE-TRANSLATION-BINARY]\n...\n 4697|/// `None` if there is no such manifest / declaration. Read fresh from disk so a\n*4698|/// live-update restart picks up a MOVED/renamed binary (verdict flag-5: never\n 4699|/// reuse the stale cached `SpawnReq.translation_binary`). (W3d)\n 4700|// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 4701|// [impl->REQ-TRANSLATE-COMMAND]\n...\n 4708| // program token resolved against the install dir (same as the initial spawn in\n*4709| // harnesshost) so the W3d live-update RESPAWN runs the real binary, not a\n 4710| // verbatim path Command::new fails to find (which would spool idle inbound).\n 4711| spt_runtime::runtime::resolve_translation_argv(\n 4712| decl,\n...\n 5519|/// from per-session `(endpoint, adapter, install_dir)` rows. Sessions with no\n*5520|/// recorded install dir are dropped (a live update needs a target). Pure (no\n*5521|/// lock, no I/O) so the live-update endpoint-selection is unit-testable without\n 5522|/// constructing real `HostedSession`s. (W3a, ADR-0025)\n 5523|// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5524|fn select_endpoints_running_adapter(\n...\n 5866| /// The live **resident adapter children** (translation binaries) for\n*5867| /// `endpoint` — the processes a live adapter update (W3d) stops and restarts\n 5868| /// so the install dir's locked binaries free up. The broker `sessions` map IS\n 5869| /// the per-endpoint resident registry (W3a, ADR-0025): each `HostedSession`\n 5870| /// already carries its `endpoint` + lifecycle-managed `translation` child.\n...\n 5881| /// The live endpoints running `adapter`, each with its install dir — the apply\n*5882| /// targets for a live adapter update (W3d decides daemon-apply vs CLI-direct\n 5883| /// from whether this is empty). Distinct, sorted. (W3a, ADR-0025)\n 5884| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5885| #[allow(dead_code)] // consumed by W3d `dispatch_adapter_apply` (next sub-commit)\n...\n 9846|\n*9847| /// W3d (ADR-0025): apply a live adapter update to every session running\n 9848| /// `req.adapter`. LOCK DISCIPLINE (binding): the sessions `Mutex` is never held\n 9849| /// across the bounded `terminate()` or the CRC swap — only across the\n 9850| /// snapshot, the per-session `input` fetch, and the re-insert.\n...\n 13138| // [unit->REQ-ADAPTER-LIVE-UPDATE] [unit->REQ-TRANSLATE-COMMAND]\n*13139| // `read_translation_command` is the broker-side probe a live adapter-update\n 13140| // uses to decide whether the idle-translation binary changed across a\n 13141| // crc-swap: it reads the JUST-installed `/manifest.toml` and\n 13142| // resolves the declared `[message-idle-translation-binary]` (`command` or the\n### crc_swap.rs\n*1|//! W3b — content-hash-gated atomic per-file swap for a live adapter update\n 2|//! (ADR-0025, REQ-ADAPTER-LIVE-UPDATE).\n 3|//!\n 4|//! The legacy `spt adapter update` path does `remove_dir_all(install_dir)` then a\n### harnesshost.rs\n 269| // The adapter's install dir (W3a, ADR-0025) — recorded on the broker session\n*270| // so a live adapter update can target this endpoint's resident children.\n 271| install_dir: Option<&str>,\n 272| // This node's advertised label for `{node}` (REQ-MANIFEST-NODE-KEY), resolved by\n 273| // the caller via `hostlabel::node_fill_label`. Forwarded to the spawn-prep catalog.\n### lanhost.rs\n 60|use crate::release::{\n*61| current_platform, sha256_hex, verify_update_set_metadata, SignedUpdateSet, VerifyPolicy,\n 62|};\n 63|\n 64|/// The default LAN bootstrap port (ADR-0059). Deliberately NOT 5474 — a\n...\n 225|/// path because it is serialized once from the record the gate authenticated.\n*226|fn sidecar_body(signed: &SignedUpdateSet) -> String {\n 227| serde_json::to_string_pretty(&serde_json::json!({\n 228| \"metadata_json\": signed.metadata_json,\n 229| \"signature_hex\": signed.signature_hex,\n...\n 822| (\n*823| StagedUpdate::Set(SignedUpdateSet {\n 824| metadata_json,\n 825| signature_hex,\n 826| }),\n...\n 840| /// anchor compiled into this binary. Containment, not equality — the\n*841| /// production policy is documented to let `release-keys.json` overlay the\n 842| /// builtins, so a node with extra provisioned keys is conforming and a node\n 843| /// that has LOST the anchor is not.\n 844| ///\n### lib.rs\n 199|};\n*200|pub use applyhost::{apply_staged, apply_staged_daemonless, refresh_brain, ApplyStagedOutcome};\n 201|pub use attach::{request_attach, send_attach_input, serve_attach, AttachServeOutcome};\n 202|pub use brain::{Brain, BrainState, BrokerEvent};\n 203|pub use broker::Broker;\n...\n 268| RejectReason,\n*269| ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateArtifactMetadata, UpdateDocsMetadata,\n 270| UpdateSetMetadata, UpdateSetProvenance, VerifyPolicy,\n 271|};\n 272|pub use resthost::{request_rest, serve_rest, RestRequestOutcome, RestServeOutcome};\n### lifecycle.rs\n 817| // psyche role's bare program token resolves there before PATH (a\n*818| // self-contained `.spt`); a live update's refresh re-pins it (W3c).\n 819| Some(BrainLifecycle {\n 820| cell: ManifestCell::new(manifest.clone(), install_dir),\n 821| install_dir: install_dir.map(Path::to_path_buf),\n...\n 1220| // W3c reload-on-dirty: seed with the manifest hash at bringup so only a\n*1221| // LATER on-disk change (a live update's CRC swap) triggers a refresh, not\n 1222| // the initial state.\n 1223| let mut manifest_hash = self.manifest_disk_hash();\n 1224| // F-030 W1: consecutive per-event turn-failure count (C3(b) budget). Lives\n...\n 1245| }\n*1246| // Pull any live-update manifest swap from disk before the tick so the\n 1247| // tick (psyche turn / echo) runs against the fresh manifest. (W3c)\n 1248| self.reload_manifest_if_changed(&mut manifest_hash);\n 1249| match self.pulse_tick(session_id) {\n...\n 1289| // W3c gate (i): snapshot the manifest (guard dropped before the bounded\n*1290| // history fetch below), so a live-update refresh never waits on it.\n 1291| let manifest = self.cell.manifest_snapshot();\n 1292| let Some(h) = &manifest.history else {\n 1293| return Vec::new();\n...\n 1590| ///\n*1591| /// Read from the SNAPSHOT the tick already holds, so a live-update manifest\n 1592| /// swap (`reload_manifest_if_changed`, run immediately before the tick) is\n 1593| /// picked up on the next fire — which is what makes the cleared-status arm\n 1594| /// below real rather than theoretical: declare the role, and the next pulse\n...\n 4451|\n*4452| // --- W3c live-update: ManifestCell refresh + reload-on-dirty (REQ-ADAPTER-LIVE-UPDATE, ADR-0025) ---\n 4453|\n 4454| // The TOML for a live-capable manifest at a given adapter.version. Same shape\n 4455| // as `live_manifest` (Psyche init + commune dir) so it parses into a host;\n### livehost.rs\n 1380| // drive the same broker reap and mask the fix (todlando 2026-07-09). Setting\n*1381| // it faithfully REPRODUCES THE FIELD'S livehost-silent update-trial condition\n 1382| // (PIN Q2: the trial-brain livehost's first reconcile tick landed around the\n 1383| // 30s kill, so it never drove the reap) — the exact failure mode the fix\n 1384| // makes the wedge-reap independent of. Runtime env (not cfg(test)): the rig\n### msg.rs\n 64|pub const KIND_TEARDOWN: &str = \"session-teardown\";\n*65|/// CLI→broker: apply a live adapter update to every session running the adapter\n 66|/// (W3d, ADR-0025). Per affected endpoint the broker stops the resident\n 67|/// translation child (releasing the OS file lock), CRC-swaps the install dir from\n 68|/// the CLI-extracted staging tree, then restarts the translation from the NEW\n...\n 515| /// The adapter name owning this session (W3a, ADR-0025). The broker records\n*516| /// it on the `HostedSession` so a live adapter update can find every live\n 517| /// session running adapter X to cycle its resident children. Empty = unknown\n 518| /// (a legacy/test/shell spawn not tied to a registered adapter). Additive +\n 519| /// serde-defaulted: an N-1 brain/broker omits it.\n...\n 523| /// The adapter's install dir for this session (W3a, ADR-0025) — where its\n*524| /// binaries live and a live update swaps files. `None` = unknown (legacy/test).\n 525| /// Additive + serde-defaulted.\n 526| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 527| #[serde(default, skip_serializing_if = \"Option::is_none\")]\n...\n 555|\n*556|/// `adapter-apply` payload (W3d, ADR-0025) — the CLI hands a live adapter update's\n 557|/// APPLY to the broker for every session running `adapter`. The CLI has already\n 558|/// fetched, verified, and EXTRACTED the new `.spt` into `staging_dir` (a\n 559|/// same-machine temp tree); the broker stops each resident translation child,\n### propagate.rs\n 42| current_platform, verify_metadata, verify_update_set_metadata, RejectReason, ReleaseMetadata,\n*43| SignedRelease, SignedUpdateSet, UpdateSetMetadata, VerifyPolicy,\n 44|};\n 45|use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdatePlan};\n 46|\n...\n 76| Single(SignedRelease),\n*77| Set(SignedUpdateSet),\n 78|}\n 79|\n 80|impl OfferedUpdate {\n...\n 139| let policy = VerifyPolicy::load_from(\n*140| &spt_store::perch::identity_dir().join(\"release-keys.json\"),\n 141| 0,\n 142| 0,\n 143| );\n...\n 433| } if xid == upd_id => {\n*434| let as_set = SignedUpdateSet {\n 435| metadata_json: metadata_json.clone(),\n 436| signature_hex: signature_hex.clone(),\n 437| };\n### relcache.rs\n 30|use crate::release::{\n*31| current_platform, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateSetMetadata,\n 32|};\n 33|\n 34|/// File name of the staged release's signed metadata (the commit point).\n...\n 43|/// (the v0.3.1 cross-OS brick root cause), so the apply guard\n*44|/// ([`crate::applyhost::apply_staged`]) trusts this stamp only when a path that\n 45|/// genuinely KNOWS the artifact's platform wrote it ([`stage_single_with_platform`]).\n 46|/// A plain [`stage`](ReleaseCache::stage) leaves it absent ⇒ the apply\n 47|/// fail-safe refuses (REQ-UPD-8). Update sets self-describe their platforms in\n...\n 122| Single(SignedRelease),\n*123| Set(SignedUpdateSet),\n 124|}\n 125|\n 126|impl StagedUpdate {\n...\n 267| &self,\n*268| signed: &SignedUpdateSet,\n 269| artifacts: &std::collections::BTreeMap>,\n 270| ) -> io::Result<()> {\n 271| std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n...\n 338| {\n*339| Some(StagedUpdate::Set(SignedUpdateSet {\n 340| metadata_json: signed.metadata_json,\n 341| signature_hex: signed.signature_hex,\n 342| }))\n...\n 517|\n*518| fn signed_set(version: u64) -> SignedUpdateSet {\n*519| SignedUpdateSet {\n 520| metadata_json: format!(\n 521| \"{{\\\"version\\\":{version},\\\"channel\\\":\\\"debug\\\",\\\"expires_at_ms\\\":999999,\\\"key_id\\\":\\\"dev\\\",\\\"artifacts\\\":{{\\\"x86_64-pc-windows-msvc\\\":{{\\\"artifact_sha256\\\":\\\"00\\\",\\\"brain_ipc_version\\\":1,\\\"broker_resource_abi\\\":1}},\\\"x86_64-unknown-linux-gnu\\\":{{\\\"artifact_sha256\\\":\\\"11\\\",\\\"brain_ipc_version\\\":1,\\\"broker_resource_abi\\\":1}}}}}}\"\n 522| ),\n### release.rs\n 194|#[derive(Debug, Clone, Serialize, Deserialize)]\n*195|pub struct SignedUpdateSet {\n 196| /// The exact UTF-8 bytes that were signed (serialized [`UpdateSetMetadata`]).\n 197| pub metadata_json: String,\n 198| /// The Ed25519 signature over `metadata_json`'s bytes, lowercase hex.\n...\n 307|\n*308|/// The default channel pin when `release-keys.json` names none.\n 309|pub const DEFAULT_CHANNEL: &str = \"stable\";\n 310|\n 311|/// The release trust anchor **compiled into every binary** (ADR-0015,\n...\n 320|///\n*321|/// `release-keys.json` (identity dir) *overlays* this set: file keys add to\n 322|/// it, file revocations void builtin ids too — so a compromised builtin key\n 323|/// is still revocable per node without a rebuild.\n 324|// [impl->REQ-REL-3]\n...\n 335|\n*336|/// On-disk trusted-release-keys config (`identity/release-keys.json`) — the\n 337|/// production [`VerifyPolicy`] source (D9-1). Human-editable JSON:\n 338|/// `{\"keys\": {\"\": \"\"}, \"revoked\": [\"\"],\n 339|/// \"channel\": \"stable\"}`. A missing or malformed file yields an **empty**\n...\n 353| /// Assemble the production policy: trusted keys + channel pin from\n*354| /// `release-keys.json` under the identity dir, the caller's\n 355| /// `current_version` (the staged release's version, or `0` when nothing\n 356| /// is staged — only strictly-newer offers pass the monotonic gate), and\n 357| /// the caller's clock.\n...\n 360| Self::load_from(\n*361| &spt_store::perch::identity_dir().join(\"release-keys.json\"),\n 362| current_version,\n 363| now_ms,\n 364| )\n...\n 539|pub fn verify_update_set_metadata(\n*540| signed: &SignedUpdateSet,\n 541| policy: &VerifyPolicy,\n 542|) -> Result {\n 543| let meta = parse_update_set_meta(signed)?;\n...\n 593|\n*594|fn parse_update_set_meta(signed: &SignedUpdateSet) -> Result {\n 595| serde_json::from_str(&signed.metadata_json).map_err(|e| RejectReason::Malformed(e.to_string()))\n 596|}\n 597|\n...\n 844|\n*845| fn sign_update_set(sk: &SigningKey, meta: &UpdateSetMetadata) -> SignedUpdateSet {\n 846| let metadata_json = serde_json::to_string(meta).unwrap();\n 847| let sig = sk.sign(metadata_json.as_bytes());\n*848| SignedUpdateSet {\n 849| metadata_json,\n 850| signature_hex: hex_encode(&sig.to_bytes()),\n 851| }\n...\n 951| let dir = tempfile::tempdir().unwrap();\n*952| let path = dir.path().join(\"release-keys.json\");\n 953|\n 954| // Missing file: exactly the embedded builtin set, default channel.\n 955| let p = VerifyPolicy::load_from(&path, 3, 1_000);\n\n### pump/\n#### mod.rs\n 250| pub releases: PathBuf,\n*251| /// `release-keys.json` ([`VerifyPolicy::load_from`]).\n 252| pub release_keys: PathBuf,\n 253| /// The wake-edge freshness-pull marker (D9-2, REQ-INST-3): a\n 254| /// dormant→active transition drops it; the pump consumes it and forces a\n...\n 298| releases: home.join(\"releases\"),\n*299| release_keys: identity.join(\"release-keys.json\"),\n 300| pull_marker: identity.join(crate::resting::PULL_MARKER_FILE),\n 301| advertise_marker: identity.join(crate::registryhost::ADVERTISE_MARKER_FILE),\n 302| peer_addrs: identity.join(\"peer-addrs.json\"),\n...\n 631| let mut ops = EpochSource::load_from(&paths.ops);\n*632| // The live per-peer connection cache (updated by presence events) + the\n 633| // per-peer dial schedule (G5 backoff). Both RAM-only, re-primed on restart.\n 634| let mut conns: HashMap = HashMap::new();\n 635| let mut sched: HashMap = HashMap::new();\n...\n 2687| releases: root.join(\"releases\"),\n*2688| release_keys: root.join(\"release-keys.json\"),\n 2689| pull_marker: root.join(\"sync-pull-now\"),\n 2690| advertise_marker: root.join(\"advertise-now\"),\n 2691| peer_addrs: root.join(\"peer-addrs.json\"),\n#### update.rs\n 3|//! `peer_step` runs the REQ-UPD-1/4/6 leg under the PRODUCTION gate: the\n*4|//! VerifyPolicy floor arithmetic (keys + channel pin from `release-keys.json`,\n 5|//! version floor = the staged release as the rollback gate, wall clock for\n 6|//! expiry only), the [`request_update`] pull, and — on a fresh stage — the\n 7|//! consent-notif production minted from the registry's CANONICAL epoch\n...\n 39| releases: PathBuf,\n*40| /// `release-keys.json` ([`VerifyPolicy::load_from`]).\n 41| release_keys: PathBuf,\n 42| /// Transient pull scratch.\n 43| scratch: PathBuf,\n...\n 119|/// keyless row is structurally unreachable by it. A node that is ALREADY on the\n*120|/// advertised version therefore holds a live \"update available\" row forever,\n 121|/// re-surfacing once per endpoint at every boundary. The origin's own one-time\n 122|/// live send is not preventable from here; this kills the row's AFTERLIFE,\n 123|/// which is the repeating harm.\n...\n 218| // The peer-propagation pull (REQ-UPD-1) under the PRODUCTION gate: keys\n*219| // + channel pin from release-keys.json (fail-closed when unprovisioned),\n 220| // version floor = the staged release (rollback gate), wall clock for\n 221| // expiry only.\n 222| let cache = ReleaseCache::open(&self.releases);\n\nShowing files 1-20 of 21+. Use skip=20 for the next page, or narrow paths/pattern.\n\nSkipped missing paths: .worktrees/hertz-304/xtask"}],"details":{"scopePath":".worktrees/hertz-304/crates/spt/tests, .worktrees/hertz-304/crates/spt-daemon/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":96,"fileCount":20,"files":[".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs",".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs",".worktrees/hertz-304/crates/spt/tests/docs_bundle_e2e.rs",".worktrees/hertz-304/crates/spt/tests/live_adapt_translation_swap_e2e.rs",".worktrees/hertz-304/crates/spt/tests/trial_drain_drive_e2e.rs",".worktrees/hertz-304/crates/spt-daemon/src/applyhost.rs",".worktrees/hertz-304/crates/spt-daemon/src/brain.rs",".worktrees/hertz-304/crates/spt-daemon/src/broker.rs",".worktrees/hertz-304/crates/spt-daemon/src/crc_swap.rs",".worktrees/hertz-304/crates/spt-daemon/src/harnesshost.rs",".worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs",".worktrees/hertz-304/crates/spt-daemon/src/lib.rs",".worktrees/hertz-304/crates/spt-daemon/src/lifecycle.rs",".worktrees/hertz-304/crates/spt-daemon/src/livehost.rs",".worktrees/hertz-304/crates/spt-daemon/src/msg.rs",".worktrees/hertz-304/crates/spt-daemon/src/propagate.rs",".worktrees/hertz-304/crates/spt-daemon/src/pump/mod.rs",".worktrees/hertz-304/crates/spt-daemon/src/pump/update.rs",".worktrees/hertz-304/crates/spt-daemon/src/relcache.rs",".worktrees/hertz-304/crates/spt-daemon/src/release.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs","count":3},{"path":".worktrees/hertz-304/crates/spt/tests/daemon_refresh_e2e.rs","count":1},{"path":".worktrees/hertz-304/crates/spt/tests/docs_bundle_e2e.rs","count":4},{"path":".worktrees/hertz-304/crates/spt/tests/live_adapt_translation_swap_e2e.rs","count":6},{"path":".worktrees/hertz-304/crates/spt/tests/trial_drain_drive_e2e.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/applyhost.rs","count":20},{"path":".worktrees/hertz-304/crates/spt-daemon/src/brain.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/broker.rs","count":11},{"path":".worktrees/hertz-304/crates/spt-daemon/src/crc_swap.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/harnesshost.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs","count":4},{"path":".worktrees/hertz-304/crates/spt-daemon/src/lib.rs","count":2},{"path":".worktrees/hertz-304/crates/spt-daemon/src/lifecycle.rs","count":6},{"path":".worktrees/hertz-304/crates/spt-daemon/src/livehost.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/msg.rs","count":4},{"path":".worktrees/hertz-304/crates/spt-daemon/src/propagate.rs","count":4},{"path":".worktrees/hertz-304/crates/spt-daemon/src/pump/mod.rs","count":4},{"path":".worktrees/hertz-304/crates/spt-daemon/src/pump/update.rs","count":4},{"path":".worktrees/hertz-304/crates/spt-daemon/src/relcache.rs","count":7},{"path":".worktrees/hertz-304/crates/spt-daemon/src/release.rs","count":11}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/hertz-304/crates/\n\n## spt/tests/\n### composite_e2e.rs\n 8│//! and no real gh auth. The trust anchor is a test key overlaid via\n *9│//! `release-keys.json`; the core apply is the daemonless path (no daemon in\n 10│//! this home), which swaps THIS test's private copy of the spt binary (never\n 11│//! the shared target/debug artifact).\n 12│//!\n │...\n 64│ let sig = release_key().sign(metadata_json.as_bytes());\n *65│ serde_json::to_string(&spt_daemon::SignedUpdateSet {\n 66│ metadata_json,\n 67│ signature_hex: hex(&sig.to_bytes()),\n 68│ })\n │...\n 111│ std::fs::write(\n*112│ identity.join(\"release-keys.json\"),\n 113│ serde_json::json!({ \"keys\": { KEY_ID: hex(release_key().verifying_key().as_bytes()) } })\n 114│ .to_string(),\n 115│ )\n### daemon_refresh_e2e.rs\n 4│//! harness session, and the endpoint's ONLINE perch all survive untouched — the\n*5│//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\n 6│//! verb. The recovery story: wedged brain-held state no longer needs a full\n 7│//! daemon bounce that kills every PTY.\n 8│//!\n### docs_bundle_e2e.rs\n 9│//! it ⇒ the daemonless apply path), the trust anchor is a test key overlaid\n*10│//! via `release-keys.json`, and the set is staged directly through the\n 11│//! spt-daemon lib — the gh fetch avenue is REQ-UPDATE-GH-TRANSPORT's own leg.\n 12│//\n 13│// [int->REQ-DOCS-RELEASE-ASSET]\n │...\n 31│/// `docs_sha` (`None` ⇒ docs-less set).\n*32│fn signed_set(version: u64, artifact: &[u8], docs_sha: Option) -> spt_daemon::SignedUpdateSet {\n 33│ let meta = spt_daemon::UpdateSetMetadata {\n 34│ version,\n 35│ channel: \"stable\".to_string(),\n │...\n 55│ let sig = release_key().sign(metadata_json.as_bytes());\n*56│ spt_daemon::SignedUpdateSet {\n 57│ metadata_json,\n 58│ signature_hex: hex(&sig.to_bytes()),\n 59│ }\n │...\n 72│ std::fs::write(\n*73│ identity.join(\"release-keys.json\"),\n 74│ serde_json::json!({ \"keys\": { KEY_ID: hex(vk.as_bytes()) } }).to_string(),\n 75│ )\n 76│ .unwrap();\n### live_adapt_translation_swap_e2e.rs\n *1│//! W3e NO-MOCKS int B — REQ-ADAPTER-LIVE-UPDATE (v0.13.2 live adapter update).\n 2│//!\n 3│//! The broker-coordinated live apply, the keystone PASS: a daemon-hosted endpoint\n 4│//! is running a resident translation child FROM its install dir; a live adapter\n │...\n 386│\n*387│ // Brain-parity: the endpoint NEVER restarted across the live update.\n 388│ assert!(\n 389│ harness_alive_after,\n 390│ \"REQ-ADAPTER-LIVE-UPDATE (brain-parity): the harness session must STILL be ALIVE \\\n*391│ after the live update — only the translation child cycles, the endpoint never \\\n 392│ restarts. harness_pid={harness_pid:?} was dead post-apply.\\n\\\n 393│ {brain_stderr}\"\n 394│ );\n │...\n 397│ \"REQ-ADAPTER-LIVE-UPDATE (brain-parity): the endpoint perch must remain ONLINE \\\n*398│ across the live update (the session was never torn down).\\n\\\n 399│ {brain_stderr}\"\n 400│ );\n 401│}\n │...\n 545│\n*546│// F015B test (a) — a `--adapter cc:prof` COMPOSITE endpoint's live update. The\n 547│// endpoint stores the composite `cc:prof` on its broker session; the apply carries\n 548│// the bare PARENT `cc`. The keystone above proves the swap for a BARE-adapter\n 549│// endpoint; this proves the profile dimension: the shared parent-matcher\n │...\n 800│ );\n*801│ // Brain-parity: the composite endpoint never restarted across the live update.\n 802│ assert!(\n 803│ harness_alive_after,\n 804│ \"REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP (brain-parity): the cc:prof harness must STILL be \\\n### trial_drain_drive_e2e.rs\n 73│//! `SPT_LIVEHOST_RECONCILE_DISABLE` to silence it — faithfully reproducing the field's\n*74│//! livehost-silent update-trial (PIN Q2: the trial-brain livehost's first reconcile\n 75│//! tick landed around the 30s kill), the exact condition the fix makes the reap\n 76│//! independent of.**\n 77│//! - **Leg 2 (lighter, doyle FINALIZE refinement).** Assert the broker's stall-evict\n\n## spt-daemon/src/\n### applyhost.rs\n 11│//!\n *12│//! [`apply_staged`] drives the whole chain against what the peer pump left\n 13│//! behind (REQ-UPD-4: staged + consent-notified, never auto-applied):\n 14│//!\n 15│//! 1. **Re-verify at rest** (`plan_verified` under the production\n *16│//! `release-keys.json` policy): apply never trusts the cache — a tampered\n 17│//! or expired artifact refuses here. The monotonic-version floor was\n 18│//! enforced at *stage* time (REQ-HAZARD-UPDATE-ROLLBACK); the apply-time\n 19│//! re-check guards authenticity/integrity/expiry of the bytes on disk.\n │...\n 51│\n *52│/// What [`apply_staged`] did — loud + typed, never silent.\n 53│#[derive(Debug, Clone, PartialEq, Eq)]\n 54│pub enum ApplyStagedOutcome {\n 55│ /// Nothing staged (or a torn stage that never offers) — idempotent no-op.\n │...\n 105│/// swap, carrying the verified bytes. The shared verify/classify preamble both\n*106│/// [`apply_staged`] and [`apply_staged_daemonless`] run before they diverge on\n 107│/// whether a live broker is handed off to.\n 108│enum Prepared {\n 109│ /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\n │...\n 171│ return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n*172│ \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\n 173│ )));\n 174│ }\n 175│ let (plan, artifact) = match staged {\n │...\n 298│/// the canonical broker socket the brain handoff runs against. For a stopped box,\n*299│/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n 300│/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n 301│// [impl->REQ-UPD-3]\n 302│// [impl->REQ-UPD-4]\n*303│pub fn apply_staged(\n 304│ cache: &ReleaseCache,\n 305│ release_keys: &Path,\n 306│ exe_path: &Path,\n │...\n 380│/// the handoff path's does. Runs the identical verify/classify gate as\n*381│/// [`apply_staged`], so every fail-closed refusal is preserved.\n 382│// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n 383│// [impl->REQ-UPD-4]\n*384│pub fn apply_staged_daemonless(\n 385│ cache: &ReleaseCache,\n 386│ release_keys: &Path,\n 387│ exe_path: &Path,\n │...\n 404│/// Already-applied classifier (F-025): whether the staged `staged_version` is\n*405│/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\n 406│/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\n 407│/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\n 408│/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n │...\n 472│ use crate::release::{\n*473│ current_platform, sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet,\n 474│ UpdateArtifactMetadata, UpdateSetMetadata,\n 475│ };\n 476│ use crate::update::BROKER_RESOURCE_ABI;\n │...\n 607│\n*608│ /// Stage a signed release + write the matching release-keys.json.\n 609│ /// `resource_abi` lets a test force the broker-breaking class.\n 610│ fn stage(\n 611│ dir: &Path,\n │...\n 640│\n*641│ let keys = dir.join(\"release-keys.json\");\n 642│ let pub_hex: String = sk\n 643│ .verifying_key()\n 644│ .to_bytes()\n │...\n 687│ let sig = sk.sign(metadata_json.as_bytes());\n*688│ let signed = SignedUpdateSet {\n 689│ metadata_json,\n 690│ signature_hex: sig.to_bytes().iter().map(|b| format!(\"{b:02x}\")).collect(),\n 691│ };\n │...\n 702│\n*703│ let keys = dir.join(\"release-keys.json\");\n 704│ let pub_hex: String = sk\n 705│ .verifying_key()\n 706│ .to_bytes()\n │...\n 718│ /// Sign a single release (sk = [9u8;32], matching `stage`) and write the\n*719│ /// matching release-keys.json — WITHOUT staging, so a test controls the\n 720│ /// platform stamp itself.\n 721│ fn sign_single(dir: &Path, version: u64, artifact: &[u8]) -> (SignedRelease, std::path::PathBuf) {\n 722│ let sk = SigningKey::from_bytes(&[9u8; 32]);\n │...\n 738│ };\n*739│ let keys = dir.join(\"release-keys.json\");\n 740│ let pub_hex: String = sk\n 741│ .verifying_key()\n 742│ .to_bytes()\n │...\n 760│ #[test]\n*761│ fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n 762│ let dir = tempfile::tempdir().unwrap();\n 763│ let name = unique_name();\n 764│ let _broker = served_broker(&name);\n │...\n 773│ cache.stage(&signed, b\"CROSS-OS BYTES\").unwrap();\n*774│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 775│ assert!(\n 776│ matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(\"platform\")),\n 777│ \"unstamped single must refuse, got {out:?}\"\n │...\n 792│ .unwrap();\n*793│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 794│ assert!(\n 795│ matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(other)),\n 796│ \"mismatched-platform single must refuse, got {out:?}\"\n### brain.rs\n 1814│\n*1815│ /// W3d (ADR-0025): hand a live adapter update's APPLY to the broker — for every\n 1816│ /// session running `req.adapter`, the broker stops the resident translation\n 1817│ /// child (freeing the OS file lock), CRC-swaps `install_dir` from `staging_dir`,\n 1818│ /// then restarts the translation from the NEW manifest path. Blocks for the\n### broker.rs\n 4147│ /// The adapter name owning this session (W3a, ADR-0025) — empty for a\n *4148│ /// legacy/test/shell spawn. A live adapter update finds every live session\n 4149│ /// whose `adapter` matches to cycle its resident children.\n 4150│ adapter: String,\n 4151│ /// The adapter's install dir for this session (W3a) — `None` if unknown. The\n *4152│ /// apply target for a live update's CRC swap.\n 4153│ install_dir: Option,\n 4154│ /// When the session spawned (ADR-0041 decision 6) — the zombie verdict's\n 4155│ /// boot-grace anchor: a just-spawned adapter harness has no client chain\n │...\n 4624│/// (reused; only the translation child is created). Extracted verbatim from\n *4625│/// `dispatch_spawn` so a live-update restart (`dispatch_adapter_apply`, W3d) can\n 4626│/// rebuild a session's translation child from the NEW binary without disturbing\n 4627│/// the PTY / output log / session (brain-parity).\n 4628│// [impl->REQ-MSG-IDLE-TRANSLATION-BINARY]\n │...\n 4697│/// `None` if there is no such manifest / declaration. Read fresh from disk so a\n *4698│/// live-update restart picks up a MOVED/renamed binary (verdict flag-5: never\n 4699│/// reuse the stale cached `SpawnReq.translation_binary`). (W3d)\n 4700│// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 4701│// [impl->REQ-TRANSLATE-COMMAND]\n │...\n 4708│ // program token resolved against the install dir (same as the initial spawn in\n *4709│ // harnesshost) so the W3d live-update RESPAWN runs the real binary, not a\n 4710│ // verbatim path Command::new fails to find (which would spool idle inbound).\n 4711│ spt_runtime::runtime::resolve_translation_argv(\n 4712│ decl,\n │...\n 5519│/// from per-session `(endpoint, adapter, install_dir)` rows. Sessions with no\n *5520│/// recorded install dir are dropped (a live update needs a target). Pure (no\n *5521│/// lock, no I/O) so the live-update endpoint-selection is unit-testable without\n 5522│/// constructing real `HostedSession`s. (W3a, ADR-0025)\n 5523│// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5524│fn select_endpoints_running_adapter(\n │...\n 5866│ /// The live **resident adapter children** (translation binaries) for\n *5867│ /// `endpoint` — the processes a live adapter update (W3d) stops and restarts\n 5868│ /// so the install dir's locked binaries free up. The broker `sessions` map IS\n 5869│ /// the per-endpoint resident registry (W3a, ADR-0025): each `HostedSession`\n 5870│ /// already carries its `endpoint` + lifecycle-managed `translation` child.\n │...\n 5881│ /// The live endpoints running `adapter`, each with its install dir — the apply\n *5882│ /// targets for a live adapter update (W3d decides daemon-apply vs CLI-direct\n 5883│ /// from whether this is empty). Distinct, sorted. (W3a, ADR-0025)\n 5884│ // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5885│ #[allow(dead_code)] // consumed by W3d `dispatch_adapter_apply` (next sub-commit)\n │...\n 9846│\n *9847│ /// W3d (ADR-0025): apply a live adapter update to every session running\n 9848│ /// `req.adapter`. LOCK DISCIPLINE (binding): the sessions `Mutex` is never held\n 9849│ /// across the bounded `terminate()` or the CRC swap — only across the\n 9850│ /// snapshot, the per-session `input` fetch, and the re-insert.\n │...\n 13138│ // [unit->REQ-ADAPTER-LIVE-UPDATE] [unit->REQ-TRANSLATE-COMMAND]\n*13139│ // `read_translation_command` is the broker-side probe a live adapter-update\n 13140│ // uses to decide whether the idle-translation binary changed across a\n 13141│ // crc-swap: it reads the JUST-installed `/manifest.toml` and\n 13142│ // resolves the declared `[message-idle-translation-binary]` (`command` or the\n### crc_swap.rs\n*1│//! W3b — content-hash-gated atomic per-file swap for a live adapter update\n 2│//! (ADR-0025, REQ-ADAPTER-LIVE-UPDATE).\n 3│//!\n 4│//! The legacy `spt adapter update` path does `remove_dir_all(install_dir)` then a\n### harnesshost.rs\n 269│ // The adapter's install dir (W3a, ADR-0025) — recorded on the broker session\n*270│ // so a live adapter update can target this endpoint's resident children.\n 271│ install_dir: Option<&str>,\n 272│ // This node's advertised label for `{node}` (REQ-MANIFEST-NODE-KEY), resolved by\n 273│ // the caller via `hostlabel::node_fill_label`. Forwarded to the spawn-prep catalog.\n### lanhost.rs\n 60│use crate::release::{\n *61│ current_platform, sha256_hex, verify_update_set_metadata, SignedUpdateSet, VerifyPolicy,\n 62│};\n 63│\n 64│/// The default LAN bootstrap port (ADR-0059). Deliberately NOT 5474 — a\n │...\n 225│/// path because it is serialized once from the record the gate authenticated.\n*226│fn sidecar_body(signed: &SignedUpdateSet) -> String {\n 227│ serde_json::to_string_pretty(&serde_json::json!({\n 228│ \"metadata_json\": signed.metadata_json,\n 229│ \"signature_hex\": signed.signature_hex,\n │...\n 822│ (\n*823│ StagedUpdate::Set(SignedUpdateSet {\n 824│ metadata_json,\n 825│ signature_hex,\n 826│ }),\n │...\n 840│ /// anchor compiled into this binary. Containment, not equality — the\n*841│ /// production policy is documented to let `release-keys.json` overlay the\n 842│ /// builtins, so a node with extra provisioned keys is conforming and a node\n 843│ /// that has LOST the anchor is not.\n 844│ ///\n### lib.rs\n 199│};\n*200│pub use applyhost::{apply_staged, apply_staged_daemonless, refresh_brain, ApplyStagedOutcome};\n 201│pub use attach::{request_attach, send_attach_input, serve_attach, AttachServeOutcome};\n 202│pub use brain::{Brain, BrainState, BrokerEvent};\n 203│pub use broker::Broker;\n │...\n 268│ RejectReason,\n*269│ ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateArtifactMetadata, UpdateDocsMetadata,\n 270│ UpdateSetMetadata, UpdateSetProvenance, VerifyPolicy,\n 271│};\n 272│pub use resthost::{request_rest, serve_rest, RestRequestOutcome, RestServeOutcome};\n### lifecycle.rs\n 817│ // psyche role's bare program token resolves there before PATH (a\n *818│ // self-contained `.spt`); a live update's refresh re-pins it (W3c).\n 819│ Some(BrainLifecycle {\n 820│ cell: ManifestCell::new(manifest.clone(), install_dir),\n 821│ install_dir: install_dir.map(Path::to_path_buf),\n │...\n 1220│ // W3c reload-on-dirty: seed with the manifest hash at bringup so only a\n*1221│ // LATER on-disk change (a live update's CRC swap) triggers a refresh, not\n 1222│ // the initial state.\n 1223│ let mut manifest_hash = self.manifest_disk_hash();\n 1224│ // F-030 W1: consecutive per-event turn-failure count (C3(b) budget). Lives\n │...\n 1245│ }\n*1246│ // Pull any live-update manifest swap from disk before the tick so the\n 1247│ // tick (psyche turn / echo) runs against the fresh manifest. (W3c)\n 1248│ self.reload_manifest_if_changed(&mut manifest_hash);\n 1249│ match self.pulse_tick(session_id) {\n │...\n 1289│ // W3c gate (i): snapshot the manifest (guard dropped before the bounded\n*1290│ // history fetch below), so a live-update refresh never waits on it.\n 1291│ let manifest = self.cell.manifest_snapshot();\n 1292│ let Some(h) = &manifest.history else {\n 1293│ return Vec::new();\n │...\n 1590│ ///\n*1591│ /// Read from the SNAPSHOT the tick already holds, so a live-update manifest\n 1592│ /// swap (`reload_manifest_if_changed`, run immediately before the tick) is\n 1593│ /// picked up on the next fire — which is what makes the cleared-status arm\n 1594│ /// below real rather than theoretical: declare the role, and the next pulse\n │...\n 4451│\n*4452│ // --- W3c live-update: ManifestCell refresh + reload-on-dirty (REQ-ADAPTER-LIVE-UPDATE, ADR-0025) ---\n 4453│\n 4454│ // The TOML for a live-capable manifest at a given adapter.version. Same shape\n 4455│ // as `live_manifest` (Psyche init + commune dir) so it parses into a host;\n### livehost.rs\n 1380│ // drive the same broker reap and mask the fix (todlando 2026-07-09). Setting\n*1381│ // it faithfully REPRODUCES THE FIELD'S livehost-silent update-trial condition\n 1382│ // (PIN Q2: the trial-brain livehost's first reconcile tick landed around the\n 1383│ // 30s kill, so it never drove the reap) — the exact failure mode the fix\n 1384│ // makes the wedge-reap independent of. Runtime env (not cfg(test)): the rig\n### msg.rs\n 64│pub const KIND_TEARDOWN: &str = \"session-teardown\";\n *65│/// CLI→broker: apply a live adapter update to every session running the adapter\n 66│/// (W3d, ADR-0025). Per affected endpoint the broker stops the resident\n 67│/// translation child (releasing the OS file lock), CRC-swaps the install dir from\n 68│/// the CLI-extracted staging tree, then restarts the translation from the NEW\n │...\n 515│ /// The adapter name owning this session (W3a, ADR-0025). The broker records\n*516│ /// it on the `HostedSession` so a live adapter update can find every live\n 517│ /// session running adapter X to cycle its resident children. Empty = unknown\n 518│ /// (a legacy/test/shell spawn not tied to a registered adapter). Additive +\n 519│ /// serde-defaulted: an N-1 brain/broker omits it.\n │...\n 523│ /// The adapter's install dir for this session (W3a, ADR-0025) — where its\n*524│ /// binaries live and a live update swaps files. `None` = unknown (legacy/test).\n 525│ /// Additive + serde-defaulted.\n 526│ // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 527│ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n │...\n 555│\n*556│/// `adapter-apply` payload (W3d, ADR-0025) — the CLI hands a live adapter update's\n 557│/// APPLY to the broker for every session running `adapter`. The CLI has already\n 558│/// fetched, verified, and EXTRACTED the new `.spt` into `staging_dir` (a\n 559│/// same-machine temp tree); the broker stops each resident translation child,\n### propagate.rs\n 42│ current_platform, verify_metadata, verify_update_set_metadata, RejectReason, ReleaseMetadata,\n *43│ SignedRelease, SignedUpdateSet, UpdateSetMetadata, VerifyPolicy,\n 44│};\n 45│use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdatePlan};\n 46│\n │...\n 76│ Single(SignedRelease),\n *77│ Set(SignedUpdateSet),\n 78│}\n 79│\n 80│impl OfferedUpdate {\n │...\n 139│ let policy = VerifyPolicy::load_from(\n*140│ &spt_store::perch::identity_dir().join(\"release-keys.json\"),\n 141│ 0,\n 142│ 0,\n 143│ );\n │...\n 433│ } if xid == upd_id => {\n*434│ let as_set = SignedUpdateSet {\n 435│ metadata_json: metadata_json.clone(),\n 436│ signature_hex: signature_hex.clone(),\n 437│ };\n### relcache.rs\n 30│use crate::release::{\n *31│ current_platform, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateSetMetadata,\n 32│};\n 33│\n 34│/// File name of the staged release's signed metadata (the commit point).\n │...\n 43│/// (the v0.3.1 cross-OS brick root cause), so the apply guard\n *44│/// ([`crate::applyhost::apply_staged`]) trusts this stamp only when a path that\n 45│/// genuinely KNOWS the artifact's platform wrote it ([`stage_single_with_platform`]).\n 46│/// A plain [`stage`](ReleaseCache::stage) leaves it absent ⇒ the apply\n 47│/// fail-safe refuses (REQ-UPD-8). Update sets self-describe their platforms in\n │...\n 122│ Single(SignedRelease),\n*123│ Set(SignedUpdateSet),\n 124│}\n 125│\n 126│impl StagedUpdate {\n │...\n 267│ &self,\n*268│ signed: &SignedUpdateSet,\n 269│ artifacts: &std::collections::BTreeMap>,\n 270│ ) -> io::Result<()> {\n 271│ std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n │...\n 338│ {\n*339│ Some(StagedUpdate::Set(SignedUpdateSet {\n 340│ metadata_json: signed.metadata_json,\n 341│ signature_hex: signed.signature_hex,\n 342│ }))\n │...\n 517│\n*518│ fn signed_set(version: u64) -> SignedUpdateSet {\n*519│ SignedUpdateSet {\n 520│ metadata_json: format!(\n 521│ \"{{\\\"version\\\":{version},\\\"channel\\\":\\\"debug\\\",\\\"expires_at_ms\\\":999999,\\\"key_id\\\":\\\"dev\\\",\\\"artifacts\\\":{{\\\"x86_64-pc-windows-msvc\\\":{{\\\"artifact_sha256\\\":\\\"00\\\",\\\"brain_ipc_version\\\":1,\\\"broker_resource_abi\\\":1}},\\\"x86_64-unknown-linux-gnu\\\":{{\\\"artifact_sha256\\\":\\\"11\\\",\\\"brain_ipc_version\\\":1,\\\"broker_resource_abi\\\":1}}}}}}\"\n 522│ ),\n### release.rs\n 194│#[derive(Debug, Clone, Serialize, Deserialize)]\n*195│pub struct SignedUpdateSet {\n 196│ /// The exact UTF-8 bytes that were signed (serialized [`UpdateSetMetadata`]).\n 197│ pub metadata_json: String,\n 198│ /// The Ed25519 signature over `metadata_json`'s bytes, lowercase hex.\n │...\n 307│\n*308│/// The default channel pin when `release-keys.json` names none.\n 309│pub const DEFAULT_CHANNEL: &str = \"stable\";\n 310│\n 311│/// The release trust anchor **compiled into every binary** (ADR-0015,\n │...\n 320│///\n*321│/// `release-keys.json` (identity dir) *overlays* this set: file keys add to\n 322│/// it, file revocations void builtin ids too — so a compromised builtin key\n 323│/// is still revocable per node without a rebuild.\n 324│// [impl->REQ-REL-3]\n │...\n 335│\n*336│/// On-disk trusted-release-keys config (`identity/release-keys.json`) — the\n 337│/// production [`VerifyPolicy`] source (D9-1). Human-editable JSON:\n 338│/// `{\"keys\": {\"\": \"\"}, \"revoked\": [\"\"],\n 339│/// \"channel\": \"stable\"}`. A missing or malformed file yields an **empty**\n │...\n 353│ /// Assemble the production policy: trusted keys + channel pin from\n*354│ /// `release-keys.json` under the identity dir, the caller's\n 355│ /// `current_version` (the staged release's version, or `0` when nothing\n 356│ /// is staged — only strictly-newer offers pass the monotonic gate), and\n 357│ /// the caller's clock.\n │...\n 360│ Self::load_from(\n*361│ &spt_store::perch::identity_dir().join(\"release-keys.json\"),\n 362│ current_version,\n 363│ now_ms,\n 364│ )\n │...\n 539│pub fn verify_update_set_metadata(\n*540│ signed: &SignedUpdateSet,\n 541│ policy: &VerifyPolicy,\n 542│) -> Result {\n 543│ let meta = parse_update_set_meta(signed)?;\n │...\n 593│\n*594│fn parse_update_set_meta(signed: &SignedUpdateSet) -> Result {\n 595│ serde_json::from_str(&signed.metadata_json).map_err(|e| RejectReason::Malformed(e.to_string()))\n 596│}\n 597│\n │...\n 844│\n*845│ fn sign_update_set(sk: &SigningKey, meta: &UpdateSetMetadata) -> SignedUpdateSet {\n 846│ let metadata_json = serde_json::to_string(meta).unwrap();\n 847│ let sig = sk.sign(metadata_json.as_bytes());\n*848│ SignedUpdateSet {\n 849│ metadata_json,\n 850│ signature_hex: hex_encode(&sig.to_bytes()),\n 851│ }\n │...\n 951│ let dir = tempfile::tempdir().unwrap();\n*952│ let path = dir.path().join(\"release-keys.json\");\n 953│\n 954│ // Missing file: exactly the embedded builtin set, default channel.\n 955│ let p = VerifyPolicy::load_from(&path, 3, 1_000);\n\n### pump/\n#### mod.rs\n 250│ pub releases: PathBuf,\n *251│ /// `release-keys.json` ([`VerifyPolicy::load_from`]).\n 252│ pub release_keys: PathBuf,\n 253│ /// The wake-edge freshness-pull marker (D9-2, REQ-INST-3): a\n 254│ /// dormant→active transition drops it; the pump consumes it and forces a\n │...\n 298│ releases: home.join(\"releases\"),\n *299│ release_keys: identity.join(\"release-keys.json\"),\n 300│ pull_marker: identity.join(crate::resting::PULL_MARKER_FILE),\n 301│ advertise_marker: identity.join(crate::registryhost::ADVERTISE_MARKER_FILE),\n 302│ peer_addrs: identity.join(\"peer-addrs.json\"),\n │...\n 631│ let mut ops = EpochSource::load_from(&paths.ops);\n *632│ // The live per-peer connection cache (updated by presence events) + the\n 633│ // per-peer dial schedule (G5 backoff). Both RAM-only, re-primed on restart.\n 634│ let mut conns: HashMap = HashMap::new();\n 635│ let mut sched: HashMap = HashMap::new();\n │...\n 2687│ releases: root.join(\"releases\"),\n*2688│ release_keys: root.join(\"release-keys.json\"),\n 2689│ pull_marker: root.join(\"sync-pull-now\"),\n 2690│ advertise_marker: root.join(\"advertise-now\"),\n 2691│ peer_addrs: root.join(\"peer-addrs.json\"),\n#### update.rs\n 3│//! `peer_step` runs the REQ-UPD-1/4/6 leg under the PRODUCTION gate: the\n *4│//! VerifyPolicy floor arithmetic (keys + channel pin from `release-keys.json`,\n 5│//! version floor = the staged release as the rollback gate, wall clock for\n 6│//! expiry only), the [`request_update`] pull, and — on a fresh stage — the\n 7│//! consent-notif production minted from the registry's CANONICAL epoch\n │...\n 39│ releases: PathBuf,\n *40│ /// `release-keys.json` ([`VerifyPolicy::load_from`]).\n 41│ release_keys: PathBuf,\n 42│ /// Transient pull scratch.\n 43│ scratch: PathBuf,\n │...\n 119│/// keyless row is structurally unreachable by it. A node that is ALREADY on the\n*120│/// advertised version therefore holds a live \"update available\" row forever,\n 121│/// re-surfacing once per endpoint at every boundary. The origin's own one-time\n 122│/// live send is not preventable from here; this kills the row's AFTERLIFE,\n 123│/// which is the repeating harm.\n │...\n 218│ // The peer-propagation pull (REQ-UPD-1) under the PRODUCTION gate: keys\n*219│ // + channel pin from release-keys.json (fail-closed when unprovisioned),\n 220│ // version floor = the staged release (rollback gate), wall clock for\n 221│ // expiry only.\n 222│ let cache = ReleaseCache::open(&self.releases);","missingPaths":[".worktrees/hertz-304/xtask"]},"isError":false,"timestamp":1789114538439}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_pR4GobVyVwPdpnBV4O0MLCBR|fc_0581413717c88920016aa3b8a9a97887d19a3d2fbd504c02e0","toolName":"glob","startedAt":"2026-09-11T08:15:41.982Z","args":{"path":".worktrees/hertz-304/crates/**/tests/*{apply,swap,composite,trial}*;.worktrees/hertz-304/**/debug_rollout*"},"intent":"Finding live core fixtures"},"id":"4d85cc8c","parentId":"6a2dc78f","timestamp":"2026-09-11T08:15:41.982Z"}
{"type":"message","id":"d86ebe62","parentId":"4d85cc8c","timestamp":"2026-09-11T08:15:41.982Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_pR4GobVyVwPdpnBV4O0MLCBR|fc_0581413717c88920016aa3b8a9a97887d19a3d2fbd504c02e0","name":"glob","arguments":{"i":"Finding live core fixtures","path":".worktrees/hertz-304/crates/**/tests/*{apply,swap,composite,trial}*;.worktrees/hertz-304/**/debug_rollout*","hidden":true,"gitignore":false,"limit":80},"intent":"Finding live core fixtures"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":7951,"output":73,"cacheRead":18944,"cacheWrite":0,"totalTokens":26968,"cost":{"input":0.07951000000000001,"output":0.00365,"cacheRead":0.018944,"cacheWrite":0,"total":0.10210400000000001}},"stopReason":"toolUse","timestamp":1789114538444,"responseId":"resp_0581413717c88920016aa3b8a85d4087d192596f6bd2f28d90","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8a9a97887d19a3d2fbd504c02e0","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding live core fixtures\",\"path\":\".worktrees/hertz-304/crates/**/tests/*{apply,swap,composite,trial}*;.worktrees/hertz-304/**/debug_rollout*\",\"hidden\":true,\"gitignore\":false,\"limit\":80}","call_id":"call_pR4GobVyVwPdpnBV4O0MLCBR","internal_chat_message_metadata_passthrough":{"create_time":1789114536.637551,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"glob","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":3534.7275999998674,"ttft":1576.1743999999017,"completedAt":1789114541980,"contextSnapshot":{"promptTokens":26895,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"e571ba2c","parentId":"d86ebe62","timestamp":"2026-09-11T08:15:42.057Z","message":{"role":"toolResult","toolCallId":"call_pR4GobVyVwPdpnBV4O0MLCBR|fc_0581413717c88920016aa3b8a9a97887d19a3d2fbd504c02e0","toolName":"glob","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/\n## spt/tests/\ntrial_drain_drive_e2e.rs\nlive_adapt_translation_swap_e2e.rs\ncomposite_e2e.rs\n## spt-daemon/tests/\nbrain_swap.rs"}],"details":{"scopePath":".worktrees/hertz-304/crates/**/tests/*{apply,swap,composite,trial}*, .worktrees/hertz-304/**/debug_rollout*","fileCount":4,"files":[".worktrees/hertz-304/crates/spt/tests/trial_drain_drive_e2e.rs",".worktrees/hertz-304/crates/spt/tests/live_adapt_translation_swap_e2e.rs",".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs",".worktrees/hertz-304/crates/spt-daemon/tests/brain_swap.rs"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1789114542055}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_DWOyDxO1k7t09g80T3fIl1eX|fc_0581413717c88920016aa3b8b4dacc87d18ab65c103bc89722","toolName":"read","startedAt":"2026-09-11T08:15:51.254Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/tests/brain_swap.rs"},"intent":"Reading live swap fixture"},"id":"ca9e52e6","parentId":"e571ba2c","timestamp":"2026-09-11T08:15:51.254Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_G6vvkadO03e6PeR0a3gOq8sw|fc_0581413717c88920016aa3b8b4dadc87d19c159ee99f8697be","toolName":"read","startedAt":"2026-09-11T08:15:51.255Z","args":{"path":".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs:1-260"},"intent":"Reading composite fixture foundation"},"id":"ebb943d6","parentId":"ca9e52e6","timestamp":"2026-09-11T08:15:51.255Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_z5nJrNDw6FGFioWEJOOcSqs1|fc_0581413717c88920016aa3b8b4dae487d18a5d3575dd211ad7","toolName":"read","startedAt":"2026-09-11T08:15:51.255Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/applyhost.rs:110-430"},"intent":"Reading live apply source"},"id":"1aea86ea","parentId":"ebb943d6","timestamp":"2026-09-11T08:15:51.255Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_mk0haCvudDT40iVX5nmMYVws|fc_0581413717c88920016aa3b8b4daec87d1b06df59906631470","toolName":"grep","startedAt":"2026-09-11T08:15:51.255Z","args":{"path":".worktrees/hertz-304/crates/spt/src/daemon;.worktrees/hertz-304/crates/spt-daemon/src/nethost.rs;.worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs"},"intent":"Finding isolation configuration"},"id":"b4d955af","parentId":"1aea86ea","timestamp":"2026-09-11T08:15:51.255Z"}
{"type":"message","id":"15689fe2","parentId":"b4d955af","timestamp":"2026-09-11T08:15:51.255Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_DWOyDxO1k7t09g80T3fIl1eX|fc_0581413717c88920016aa3b8b4dacc87d18ab65c103bc89722","name":"read","arguments":{"i":"Reading live swap fixture","path":".worktrees/hertz-304/crates/spt-daemon/tests/brain_swap.rs"},"intent":"Reading live swap fixture"},{"type":"toolCall","id":"call_G6vvkadO03e6PeR0a3gOq8sw|fc_0581413717c88920016aa3b8b4dadc87d19c159ee99f8697be","name":"read","arguments":{"i":"Reading composite fixture foundation","path":".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs:1-260"},"intent":"Reading composite fixture foundation"},{"type":"toolCall","id":"call_z5nJrNDw6FGFioWEJOOcSqs1|fc_0581413717c88920016aa3b8b4dae487d18a5d3575dd211ad7","name":"read","arguments":{"i":"Reading live apply source","path":".worktrees/hertz-304/crates/spt-daemon/src/applyhost.rs:110-430"},"intent":"Reading live apply source"},{"type":"toolCall","id":"call_mk0haCvudDT40iVX5nmMYVws|fc_0581413717c88920016aa3b8b4daec87d1b06df59906631470","name":"grep","arguments":{"i":"Finding isolation configuration","pattern":"SPT_.*(DISABLE|EPHEMERAL|LAN|NET)|discovery|relay_mode|relay_url|bootstrap","path":".worktrees/hertz-304/crates/spt/src/daemon;.worktrees/hertz-304/crates/spt-daemon/src/nethost.rs;.worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs","case":null,"gitignore":false,"skip":null},"intent":"Finding isolation configuration"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":278,"output":251,"cacheRead":26752,"cacheWrite":0,"totalTokens":27281,"cost":{"input":0.0027800000000000004,"output":0.01255,"cacheRead":0.026751999999999998,"cacheWrite":0,"total":0.042081999999999994}},"stopReason":"toolUse","timestamp":1789114542068,"responseId":"resp_0581413717c88920016aa3b8ac007487d1955a759925868a3f","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8b4dacc87d18ab65c103bc89722","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading live swap fixture\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/tests/brain_swap.rs\"}","call_id":"call_DWOyDxO1k7t09g80T3fIl1eX","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8b4dadc87d19c159ee99f8697be","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading composite fixture foundation\",\"path\":\".worktrees/hertz-304/crates/spt/tests/composite_e2e.rs:1-260\"}","call_id":"call_G6vvkadO03e6PeR0a3gOq8sw","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8b4dae487d18a5d3575dd211ad7","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading live apply source\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/applyhost.rs:110-430\"}","call_id":"call_z5nJrNDw6FGFioWEJOOcSqs1","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8b4daec87d1b06df59906631470","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding isolation configuration\",\"pattern\":\"SPT_.*(DISABLE|EPHEMERAL|LAN|NET)|discovery|relay_mode|relay_url|bootstrap\",\"path\":\".worktrees/hertz-304/crates/spt/src/daemon;.worktrees/hertz-304/crates/spt-daemon/src/nethost.rs;.worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_mk0haCvudDT40iVX5nmMYVws","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":9183.675999999978,"ttft":9143.488300000317,"completedAt":1789114551253,"contextSnapshot":{"promptTokens":27030,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"f72dbf4c","parentId":"15689fe2","timestamp":"2026-09-11T08:15:51.266Z","message":{"role":"toolResult","toolCallId":"call_DWOyDxO1k7t09g80T3fIl1eX|fc_0581413717c88920016aa3b8b4dacc87d18ab65c103bc89722","toolName":"read","content":[{"type":"text","text":"//! C0 E2E — the M3c keystone: a **brain-only self-update** swaps the brain logic\n//! through the update engine with **zero hosted-endpoint interruption**\n//! (REQ-UPD-3, absolute for the brain-only class — ADR-0004 §A).\n//!\n//! This rides the same broker/brain substrate the B2 handoff test proves, but\n//! drives the swap through the *update engine* (`plan_update` → `apply_brain_only`)\n//! rather than calling `Brain::handoff` directly — the engine *triggers* a\n//! handoff, it does not re-implement one (`M3c-PLAN.md` §C0, clean-room posture).\n//!\n//! Shape: one echo child runs under a broker PTY for the whole test. The outgoing\n//! brain injects a marker it never reads, then the engine applies a brain-only\n//! update: the new brain re-attaches via the supplied relaunch closure (which\n//! stands for \"exec the verified new binary → `Brain::handoff`\") and must find\n//! that marker in the *replayed* buffer — proving the broker buffered output\n//! produced while no brain was attached. Throughout, the child's pid is unchanged\n//! and exactly one session is hosted: the endpoint never noticed the swap.\n//!\n//! **Filename note:** this file is `brain_swap.rs`, NOT `update.rs`, on purpose.\n//! Windows' installer-detection heuristic (UAC) forces elevation for any\n//! executable whose name contains `update`/`setup`/`install`/`patch`; a test\n//! binary `update-.exe` then fails to launch with `os error 740` (requires\n//! elevation). Do not rename this to match the module under test.\n//!\n//! **REQ-UPD-3 `int` re-pointed (restoration D7-1).** This test proves the\n//! *in-process* brain-only swap shape (the engine's `apply_brain_only` over an\n//! in-thread `Brain::handoff` closure) — valuable engine-mechanics coverage, but\n//! NOT process-level survival. The REQ-UPD-3 `int` evidence (no endpoint drops\n//! across a brain-only update) now lives in `crates/spt/tests/brain_survive.rs`,\n//! which swaps a real on-disk binary and respawns the real `spt daemon brain`\n//! child process (ADR-0018 V5). This file keeps exercising the engine path; it is\n//! no longer the REQ-UPD-3 int tag.\n\nuse std::sync::atomic::{AtomicU32, Ordering};\nuse std::sync::Arc;\nuse std::thread;\nuse std::time::Duration;\n\nuse spt_daemon::brain::{Brain, BrainState, BrokerEvent};\nuse spt_daemon::msg::SpawnReq;\nuse spt_daemon::update::{apply_brain_only, plan_update, BrokerAbi, ReleaseSpec, UpdateClass};\nuse spt_daemon::Broker;\n\nstatic SEQ: AtomicU32 = AtomicU32::new(0);\nfn unique_name() -> String {\n let n = SEQ.fetch_add(1, Ordering::Relaxed);\n format!(\"spt-daemon-c0-{}-{}.sock\", std::process::id(), n)\n}\n\nfn echo_spawn_req() -> SpawnReq {\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: String::new(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n }\n}\n\nfn cold_retry(name: &str, now_ms: u64) -> Brain {\n for _ in 0..300 {\n if let Ok(b) = Brain::cold_start(name, now_ms) {\n return b;\n }\n thread::sleep(Duration::from_millis(10));\n }\n panic!(\"brain cold-start could not connect\");\n}\n\n/// The relaunch closure C0's engine drives: it stands for \"the verified new\n/// binary's brain re-attaches over the existing substrate.\" Retries the connect\n/// (the broker may not have freed the prior brain's slot the instant we drop it),\n/// mirroring how a freshly-exec'd brain process races the broker on startup.\nfn handoff_relaunch(name: &str, prior: BrainState, now_ms: u64) -> std::io::Result {\n let mut last = None;\n for _ in 0..300 {\n match Brain::handoff(name, prior.clone(), now_ms) {\n Ok(b) => return Ok(b),\n Err(e) => last = Some(e),\n }\n thread::sleep(Duration::from_millis(10));\n }\n Err(last.unwrap_or_else(|| std::io::Error::other(\"relaunch never connected\")))\n}\n\n#[test]\nfn brain_only_update_swaps_logic_with_zero_endpoint_interruption() {\n let name = unique_name();\n let broker = Broker::bind(&name).expect(\"bind broker\");\n\n // The broker is the stable kernel: it outlives every brain generation.\n let serve_broker = Arc::clone(&broker);\n thread::spawn(move || {\n let _ = serve_broker.serve();\n });\n\n // Generation 0: cold-start the brain, spawn the long-lived hosted endpoint,\n // record its pid — the thing REQ-UPD-3 forbids us from disturbing.\n let mut now = 1_000_000u64;\n let mut brain = cold_retry(&name, now);\n let sid = brain\n .spawn_session(echo_spawn_req())\n .expect(\"spawn session\");\n let child_pid = broker.session_pid(sid);\n assert_eq!(brain.generation(), 0);\n\n // The engine classifies the release against the RUNNING broker. A pure logic\n // release (same held-resource ABI, a brain the running broker already hosts)\n // ⇒ brain-only: the routine, endpoint-preserving case.\n let running = BrokerAbi::current();\n let release = ReleaseSpec {\n brain_ipc_version: running.ipc_version,\n broker_resource_abi: running.resource_abi,\n };\n let plan = plan_update(&running, release);\n assert_eq!(\n plan.class,\n UpdateClass::BrainOnly,\n \"a pure-logic release is brain-only\"\n );\n\n // The outgoing brain hands a marker to its successor and then is swapped out\n // WITHOUT reading it — only a gapless re-attach can recover it from the\n // broker's replay buffer.\n brain\n .send_input(b\"UPDATED_MARKER_DONE\\r\")\n .expect(\"inject marker for successor\");\n\n // Apply the brain-only update through the engine. This is the swap: snapshot\n // → drop the outgoing brain (the crash boundary the broker tolerates) →\n // relaunch the new brain over the substrate. The engine touches no endpoint.\n now += 1; // wall clock advances so the new generation gets a fresh gen_start\n let mut brain = apply_brain_only(&plan, brain, |state| handoff_relaunch(&name, state, now))\n .expect(\"brain-only update must apply\");\n\n // ── REQ-UPD-3: the hosted endpoint never noticed the swap. ──\n assert_eq!(\n broker.session_count(),\n 1,\n \"exactly one session across the update\"\n );\n assert_eq!(\n broker.session_pid(sid),\n child_pid,\n \"the hosted child's pid is unchanged\"\n );\n\n // The new brain is a fresh generation with a fresh gen_start (the swap really\n // happened — it is not the same brain object).\n assert_eq!(brain.generation(), 1, \"the brain logic generation advanced\");\n assert_eq!(\n brain.gen_start_ms(),\n now,\n \"fresh gen_start on the swapped-in brain (2.4)\"\n );\n\n // Gapless resume: the marker the pre-update brain injected (and never read)\n // arrives via the broker's replayed buffer — output produced across the swap\n // window was not lost.\n let mut buf = Vec::new();\n brain\n .read_output_until(b\"UPDATED_MARKER_DONE\", &mut buf)\n .expect(\"the swapped-in brain must replay output gaplessly across the update\");\n\n // The post-update brain still fully drives the same endpoint: kill it and see\n // the exit event + reaping — the session was live and owned, not a husk.\n brain.kill_session().expect(\"kill session\");\n let deadline = brain.call_deadline();\n loop {\n if let BrokerEvent::Exit { session_id, .. } = brain.read_event_until(deadline).expect(\"read until exit\") {\n assert_eq!(session_id, sid);\n break;\n }\n }\n drop(brain);\n\n let mut reaped = false;\n for _ in 0..200 {\n if broker.session_count() == 0 {\n reaped = true;\n break;\n }\n thread::sleep(Duration::from_millis(10));\n }\n assert!(reaped, \"the killed session is reaped from the broker table\");\n}"}],"details":{"totalLines":194,"displayContent":{"text":"//! C0 E2E — the M3c keystone: a **brain-only self-update** swaps the brain logic\r\n//! through the update engine with **zero hosted-endpoint interruption**\r\n//! (REQ-UPD-3, absolute for the brain-only class — ADR-0004 §A).\r\n//!\r\n//! This rides the same broker/brain substrate the B2 handoff test proves, but\r\n//! drives the swap through the *update engine* (`plan_update` → `apply_brain_only`)\r\n//! rather than calling `Brain::handoff` directly — the engine *triggers* a\r\n//! handoff, it does not re-implement one (`M3c-PLAN.md` §C0, clean-room posture).\r\n//!\r\n//! Shape: one echo child runs under a broker PTY for the whole test. The outgoing\r\n//! brain injects a marker it never reads, then the engine applies a brain-only\r\n//! update: the new brain re-attaches via the supplied relaunch closure (which\r\n//! stands for \"exec the verified new binary → `Brain::handoff`\") and must find\r\n//! that marker in the *replayed* buffer — proving the broker buffered output\r\n//! produced while no brain was attached. Throughout, the child's pid is unchanged\r\n//! and exactly one session is hosted: the endpoint never noticed the swap.\r\n//!\r\n//! **Filename note:** this file is `brain_swap.rs`, NOT `update.rs`, on purpose.\r\n//! Windows' installer-detection heuristic (UAC) forces elevation for any\r\n//! executable whose name contains `update`/`setup`/`install`/`patch`; a test\r\n//! binary `update-.exe` then fails to launch with `os error 740` (requires\r\n//! elevation). Do not rename this to match the module under test.\r\n//!\r\n//! **REQ-UPD-3 `int` re-pointed (restoration D7-1).** This test proves the\r\n//! *in-process* brain-only swap shape (the engine's `apply_brain_only` over an\r\n//! in-thread `Brain::handoff` closure) — valuable engine-mechanics coverage, but\r\n//! NOT process-level survival. The REQ-UPD-3 `int` evidence (no endpoint drops\r\n//! across a brain-only update) now lives in `crates/spt/tests/brain_survive.rs`,\r\n//! which swaps a real on-disk binary and respawns the real `spt daemon brain`\r\n//! child process (ADR-0018 V5). This file keeps exercising the engine path; it is\r\n//! no longer the REQ-UPD-3 int tag.\r\n\r\nuse std::sync::atomic::{AtomicU32, Ordering};\r\nuse std::sync::Arc;\r\nuse std::thread;\r\nuse std::time::Duration;\r\n\r\nuse spt_daemon::brain::{Brain, BrainState, BrokerEvent};\r\nuse spt_daemon::msg::SpawnReq;\r\nuse spt_daemon::update::{apply_brain_only, plan_update, BrokerAbi, ReleaseSpec, UpdateClass};\r\nuse spt_daemon::Broker;\r\n\r\nstatic SEQ: AtomicU32 = AtomicU32::new(0);\r\nfn unique_name() -> String {\r\n let n = SEQ.fetch_add(1, Ordering::Relaxed);\r\n format!(\"spt-daemon-c0-{}-{}.sock\", std::process::id(), n)\r\n}\r\n\r\nfn echo_spawn_req() -> SpawnReq {\r\n #[cfg(unix)]\r\n let (program, args) = (\"cat\".to_string(), Vec::::new());\r\n #[cfg(windows)]\r\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\r\n SpawnReq {\r\n program,\r\n args,\r\n rows: 24,\r\n cols: 80,\r\n endpoint: String::new(),\r\n cwd: None,\r\n env: Default::default(),\r\n translation_binary: None,\r\n adapter: String::new(),\r\n install_dir: None,\r\n }\r\n}\r\n\r\nfn cold_retry(name: &str, now_ms: u64) -> Brain {\r\n for _ in 0..300 {\r\n if let Ok(b) = Brain::cold_start(name, now_ms) {\r\n return b;\r\n }\r\n thread::sleep(Duration::from_millis(10));\r\n }\r\n panic!(\"brain cold-start could not connect\");\r\n}\r\n\r\n/// The relaunch closure C0's engine drives: it stands for \"the verified new\r\n/// binary's brain re-attaches over the existing substrate.\" Retries the connect\r\n/// (the broker may not have freed the prior brain's slot the instant we drop it),\r\n/// mirroring how a freshly-exec'd brain process races the broker on startup.\r\nfn handoff_relaunch(name: &str, prior: BrainState, now_ms: u64) -> std::io::Result {\r\n let mut last = None;\r\n for _ in 0..300 {\r\n match Brain::handoff(name, prior.clone(), now_ms) {\r\n Ok(b) => return Ok(b),\r\n Err(e) => last = Some(e),\r\n }\r\n thread::sleep(Duration::from_millis(10));\r\n }\r\n Err(last.unwrap_or_else(|| std::io::Error::other(\"relaunch never connected\")))\r\n}\r\n\r\n#[test]\r\nfn brain_only_update_swaps_logic_with_zero_endpoint_interruption() {\r\n let name = unique_name();\r\n let broker = Broker::bind(&name).expect(\"bind broker\");\r\n\r\n // The broker is the stable kernel: it outlives every brain generation.\r\n let serve_broker = Arc::clone(&broker);\r\n thread::spawn(move || {\r\n let _ = serve_broker.serve();\r\n });\r\n\r\n // Generation 0: cold-start the brain, spawn the long-lived hosted endpoint,\r\n // record its pid — the thing REQ-UPD-3 forbids us from disturbing.\r\n let mut now = 1_000_000u64;\r\n let mut brain = cold_retry(&name, now);\r\n let sid = brain\r\n .spawn_session(echo_spawn_req())\r\n .expect(\"spawn session\");\r\n let child_pid = broker.session_pid(sid);\r\n assert_eq!(brain.generation(), 0);\r\n\r\n // The engine classifies the release against the RUNNING broker. A pure logic\r\n // release (same held-resource ABI, a brain the running broker already hosts)\r\n // ⇒ brain-only: the routine, endpoint-preserving case.\r\n let running = BrokerAbi::current();\r\n let release = ReleaseSpec {\r\n brain_ipc_version: running.ipc_version,\r\n broker_resource_abi: running.resource_abi,\r\n };\r\n let plan = plan_update(&running, release);\r\n assert_eq!(\r\n plan.class,\r\n UpdateClass::BrainOnly,\r\n \"a pure-logic release is brain-only\"\r\n );\r\n\r\n // The outgoing brain hands a marker to its successor and then is swapped out\r\n // WITHOUT reading it — only a gapless re-attach can recover it from the\r\n // broker's replay buffer.\r\n brain\r\n .send_input(b\"UPDATED_MARKER_DONE\\r\")\r\n .expect(\"inject marker for successor\");\r\n\r\n // Apply the brain-only update through the engine. This is the swap: snapshot\r\n // → drop the outgoing brain (the crash boundary the broker tolerates) →\r\n // relaunch the new brain over the substrate. The engine touches no endpoint.\r\n now += 1; // wall clock advances so the new generation gets a fresh gen_start\r\n let mut brain = apply_brain_only(&plan, brain, |state| handoff_relaunch(&name, state, now))\r\n .expect(\"brain-only update must apply\");\r\n\r\n // ── REQ-UPD-3: the hosted endpoint never noticed the swap. ──\r\n assert_eq!(\r\n broker.session_count(),\r\n 1,\r\n \"exactly one session across the update\"\r\n );\r\n assert_eq!(\r\n broker.session_pid(sid),\r\n child_pid,\r\n \"the hosted child's pid is unchanged\"\r\n );\r\n\r\n // The new brain is a fresh generation with a fresh gen_start (the swap really\r\n // happened — it is not the same brain object).\r\n assert_eq!(brain.generation(), 1, \"the brain logic generation advanced\");\r\n assert_eq!(\r\n brain.gen_start_ms(),\r\n now,\r\n \"fresh gen_start on the swapped-in brain (2.4)\"\r\n );\r\n\r\n // Gapless resume: the marker the pre-update brain injected (and never read)\r\n // arrives via the broker's replayed buffer — output produced across the swap\r\n // window was not lost.\r\n let mut buf = Vec::new();\r\n brain\r\n .read_output_until(b\"UPDATED_MARKER_DONE\", &mut buf)\r\n .expect(\"the swapped-in brain must replay output gaplessly across the update\");\r\n\r\n // The post-update brain still fully drives the same endpoint: kill it and see\r\n // the exit event + reaping — the session was live and owned, not a husk.\r\n brain.kill_session().expect(\"kill session\");\r\n let deadline = brain.call_deadline();\r\n loop {\r\n if let BrokerEvent::Exit { session_id, .. } = brain.read_event_until(deadline).expect(\"read until exit\") {\r\n assert_eq!(session_id, sid);\r\n break;\r\n }\r\n }\r\n drop(brain);\r\n\r\n let mut reaped = false;\r\n for _ in 0..200 {\r\n if broker.session_count() == 0 {\r\n reaped = true;\r\n break;\r\n }\r\n thread::sleep(Duration::from_millis(10));\r\n }\r\n assert!(reaped, \"the killed session is reaped from the broker table\");\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194]},"fileSize":8214,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\tests\\brain_swap.rs"}}},"isError":false,"timestamp":1789114551265}}
{"type":"message","id":"c2494d76","parentId":"f72dbf4c","timestamp":"2026-09-11T08:15:51.267Z","message":{"role":"toolResult","toolCallId":"call_G6vvkadO03e6PeR0a3gOq8sw|fc_0581413717c88920016aa3b8b4dadc87d19c159ee99f8697be","toolName":"read","content":[{"type":"text","text":"//! THE-FORKENING W4 — the bare `spt update` composite, end to end\n//! (REQ-UPDATE-DEFAULT-COMPOSITE): ONE invocation fetches + applies the core\n//! release, THEN updates a registered gh_release adapter — core-first order,\n//! both legs landing observably. Hermetic: a fake `gh` CLI (`gh_fixture`, a\n//! sibling `[[bin]]` copied to `gh(.exe)` on a PATH-prepended dir) serves the\n//! whole release channel from a local fixture dir, so the mandated gh carrier\n//! runs for real — subprocess, argv shapes, asset staging — with no network\n//! and no real gh auth. The trust anchor is a test key overlaid via\n//! `release-keys.json`; the core apply is the daemonless path (no daemon in\n//! this home), which swaps THIS test's private copy of the spt binary (never\n//! the shared target/debug artifact).\n//!\n//! NOTE: the file/binary name deliberately avoids the substring \"update\" —\n//! Windows' installer-detection heuristic forces UAC elevation on a\n//! manifest-less exe whose name contains it (os error 740; the\n//! post_step_fixture precedent).\n//\n// [int->REQ-UPDATE-DEFAULT-COMPOSITE]\n\nuse ed25519_dalek::{Signer, SigningKey};\nuse std::collections::BTreeMap;\nuse std::path::Path;\nuse std::process::Command;\nuse std::time::Duration;\n\nmod common;\nuse common::CommandNoWindowExt;\n\nconst KEY_ID: &str = \"rel-composite-e2e\";\nconst NEW_CORE_BYTES: &[u8] = b\"NEW-CORE-BYTES-composite-e2e\";\n\nfn release_key() -> SigningKey {\n SigningKey::from_bytes(&[7u8; 32])\n}\n\nfn hex(bytes: &[u8]) -> String {\n bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\n}\n\n\n\n/// The signed update set the fake channel serves: one artifact for the CURRENT\n/// platform (fetch requires `asset_name`), product 9.9.9, docs-less.\nfn signed_set_json(version: u64, artifact: &[u8]) -> String {\n let meta = spt_daemon::UpdateSetMetadata {\n version,\n channel: \"stable\".to_string(),\n expires_at_ms: u64::MAX,\n key_id: KEY_ID.to_string(),\n artifacts: BTreeMap::from([(\n spt_daemon::current_platform().to_string(),\n spt_daemon::UpdateArtifactMetadata {\n artifact_sha256: spt_daemon::sha256_hex(artifact),\n brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n asset_name: Some(\"spt-composite-artifact\".to_string()),\n },\n )]),\n provenance: None,\n product_version: \"9.9.9\".to_string(),\n docs: None,\n };\n let metadata_json = serde_json::to_string(&meta).unwrap();\n let sig = release_key().sign(metadata_json.as_bytes());\n serde_json::to_string(&spt_daemon::SignedUpdateSet {\n metadata_json,\n signature_hex: hex(&sig.to_bytes()),\n })\n .unwrap()\n}\n\n/// Build a `.spt` adapter release archive (tar, relative members — the exact\n/// shape `extract_release_archive` consumes) whose root manifest declares\n/// `version` and keeps the gh_release `[update]` block (so the re-register\n/// after the swap preserves the avenue).\nfn adapter_spt(scratch: &Path, version: &str) -> Vec {\n let tree = scratch.join(format!(\"adapter-tree-{version}\"));\n std::fs::create_dir_all(&tree).unwrap();\n std::fs::write(tree.join(\"manifest.toml\"), adapter_manifest(version)).unwrap();\n let out = scratch.join(format!(\"adapter-{version}.spt\"));\n let st = Command::new(\"tar\")\n .arg(\"-cf\")\n .arg(&out)\n .arg(\"-C\")\n .arg(&tree)\n .arg(\".\")\n .status()\n .expect(\"system tar (present on Win10+ and Linux)\");\n assert!(st.success(), \"tar the adapter tree\");\n std::fs::read(&out).unwrap()\n}\n\nfn adapter_manifest(version: &str) -> String {\n format!(\n \"[adapter]\\nname = \\\"cc\\\"\\nkind = \\\"harness\\\"\\nversion = \\\"{version}\\\"\\n\\\n min_spt_core_version = \\\"0\\\"\\n\\n\\\n [update]\\navenue = \\\"gh_release\\\"\\nrepo = \\\"u/r\\\"\\n\"\n )\n}\n\n#[test]\nfn bare_update_applies_core_then_updates_adapter_in_one_invocation() {\n // ── (1) Isolated home + this test's PRIVATE copy of the spt binary (the\n // core apply swaps `current_exe` — driving the shared target/debug\n // binary would clobber it for the rest of the suite). The fake gh sits\n // beside it on a PATH-prepended dir. ──\n let root = tempfile::tempdir().unwrap();\n let home = root.path().join(\"home\");\n let identity = home.join(\"identity\");\n std::fs::create_dir_all(&identity).unwrap();\n std::fs::write(\n identity.join(\"release-keys.json\"),\n serde_json::json!({ \"keys\": { KEY_ID: hex(release_key().verifying_key().as_bytes()) } })\n .to_string(),\n )\n .unwrap();\n\n let bindir = root.path().join(\"bin\");\n std::fs::create_dir_all(&bindir).unwrap();\n let spt = bindir.join(if cfg!(windows) { \"spt.exe\" } else { \"spt\" });\n std::fs::copy(env!(\"CARGO_BIN_EXE_spt\"), &spt).unwrap();\n let gh = bindir.join(if cfg!(windows) { \"gh.exe\" } else { \"gh\" });\n std::fs::copy(common::sibling_bin(\"gh_fixture\"), &gh).expect(\"gh_fixture must be built\");\n #[cfg(unix)]\n {\n use std::os::unix::fs::PermissionsExt;\n for b in [&spt, &gh] {\n let mut p = std::fs::metadata(b).unwrap().permissions();\n p.set_mode(0o755);\n std::fs::set_permissions(b, p).unwrap();\n }\n }\n let path_env = format!(\n \"{}{}{}\",\n bindir.display(),\n if cfg!(windows) { \";\" } else { \":\" },\n std::env::var(\"PATH\").unwrap_or_default()\n );\n\n // ── (2) The fake release channel: the CORE set (update-set.json + the\n // platform artifact) and the ADAPTER release (latest tag v1.1.0 +\n // adapter.spt with the bumped manifest). ──\n let gh_root = root.path().join(\"gh-root\");\n let assets = gh_root.join(\"assets\");\n std::fs::create_dir_all(&assets).unwrap();\n std::fs::write(gh_root.join(\"tag.txt\"), \"v1.1.0\").unwrap();\n std::fs::write(assets.join(\"update-set.json\"), signed_set_json(1, NEW_CORE_BYTES)).unwrap();\n std::fs::write(assets.join(\"spt-composite-artifact\"), NEW_CORE_BYTES).unwrap();\n std::fs::write(assets.join(\"adapter.spt\"), adapter_spt(root.path(), \"1.1.0\")).unwrap();\n let gh_log = root.path().join(\"gh.log\");\n\n // ── (3) Register the gh_release adapter `cc` at 1.0.0 (its install dir is\n // the registered source_dir — the in-place update target). ──\n std::env::set_var(\"SPT_HOME\", &home);\n let install_dir = spt_store::perch::spt_home().join(\"srcs\").join(\"cc\");\n std::fs::create_dir_all(&install_dir).unwrap();\n std::fs::write(install_dir.join(\"manifest.toml\"), adapter_manifest(\"1.0.0\")).unwrap();\n spt_runtime::registry::register(&spt_store::perch::adapters_dir(), &install_dir, 1000)\n .unwrap();\n std::env::remove_var(\"SPT_HOME\");\n\n // ── (4) ONE invocation: bare `spt update`. ──\n let out = {\n let mut cmd = Command::new(&spt);\n cmd.no_window()\n .arg(\"update\")\n .env(\"SPT_HOME\", &home)\n .env(\"PATH\", &path_env)\n .env(\"SPT_FAKE_GH_ROOT\", &gh_root)\n .env(\"SPT_FAKE_GH_LOG\", &gh_log);\n common::output_bounded(cmd, Duration::from_secs(120))\n };\n let stdout = String::from_utf8_lossy(&out.stdout).to_string();\n let stderr = String::from_utf8_lossy(&out.stderr).to_string();\n let log = std::fs::read_to_string(&gh_log).unwrap_or_default();\n eprintln!(\n \"=== composite: ok={} ===\\n--- stdout ---\\n{stdout}\\n--- stderr ---\\n{stderr}\\n--- gh log ---\\n{log}\",\n out.status.success()\n );\n\n assert!(\n out.status.success(),\n \"bare `spt update` must exit 0 when both legs succeed\"\n );\n\n // ── (5) CORE leg landed: the private spt copy now holds the NEW bytes\n // (daemonless swap — no daemon in this home), reported as installed. ──\n assert_eq!(\n std::fs::read(&spt).unwrap(),\n NEW_CORE_BYTES,\n \"the core apply must swap the invoking binary's on-disk seat\"\n );\n assert!(\n stdout.contains(\"Installed spt-core v9.9.9 on disk\"),\n \"the daemonless applied notice names the product version: {stdout}\"\n );\n\n // ── (6) ADAPTERS leg landed IN THE SAME INVOCATION: cc pulled 1.0.0 →\n // 1.1.0 through the fake channel and re-registered. ──\n assert!(\n stderr.contains(\"ADAPTER_UPDATE_DONE:cc\"),\n \"the adapter update must apply: {stderr}\"\n );\n assert!(\n stderr.contains(\"ADAPTER_UPDATE_SUMMARY:cc: updated 1.0.0 -> 1.1.0\"),\n \"the per-adapter summary line reports the pull: {stderr}\"\n );\n let landed = std::fs::read_to_string(install_dir.join(\"manifest.toml\")).unwrap();\n assert!(\n landed.contains(\"version = \\\"1.1.0\\\"\"),\n \"the registered install dir must hold the new manifest: {landed}\"\n );\n\n // ── (7) CORE-FIRST order (the composite doctrine): the set download\n // happens strictly before the adapter's latest-release query. ──\n let set_at = log\n .find(\"--pattern update-set.json\")\n .expect(\"the core leg downloaded the update set via gh\");\n let adapter_at = log\n .find(\"api repos/u/r/releases/latest\")\n .expect(\"the adapters leg queried the adapter release via gh\");\n assert!(\n set_at < adapter_at,\n \"core leg must run before the adapters leg (core-first): \\n{log}\"\n );\n}"}],"details":{"totalLines":226,"displayContent":{"text":"//! THE-FORKENING W4 — the bare `spt update` composite, end to end\r\n//! (REQ-UPDATE-DEFAULT-COMPOSITE): ONE invocation fetches + applies the core\r\n//! release, THEN updates a registered gh_release adapter — core-first order,\r\n//! both legs landing observably. Hermetic: a fake `gh` CLI (`gh_fixture`, a\r\n//! sibling `[[bin]]` copied to `gh(.exe)` on a PATH-prepended dir) serves the\r\n//! whole release channel from a local fixture dir, so the mandated gh carrier\r\n//! runs for real — subprocess, argv shapes, asset staging — with no network\r\n//! and no real gh auth. The trust anchor is a test key overlaid via\r\n//! `release-keys.json`; the core apply is the daemonless path (no daemon in\r\n//! this home), which swaps THIS test's private copy of the spt binary (never\r\n//! the shared target/debug artifact).\r\n//!\r\n//! NOTE: the file/binary name deliberately avoids the substring \"update\" —\r\n//! Windows' installer-detection heuristic forces UAC elevation on a\r\n//! manifest-less exe whose name contains it (os error 740; the\r\n//! post_step_fixture precedent).\r\n//\r\n// [int->REQ-UPDATE-DEFAULT-COMPOSITE]\r\n\r\nuse ed25519_dalek::{Signer, SigningKey};\r\nuse std::collections::BTreeMap;\r\nuse std::path::Path;\r\nuse std::process::Command;\r\nuse std::time::Duration;\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nconst KEY_ID: &str = \"rel-composite-e2e\";\r\nconst NEW_CORE_BYTES: &[u8] = b\"NEW-CORE-BYTES-composite-e2e\";\r\n\r\nfn release_key() -> SigningKey {\r\n SigningKey::from_bytes(&[7u8; 32])\r\n}\r\n\r\nfn hex(bytes: &[u8]) -> String {\r\n bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\r\n}\r\n\r\n\r\n\r\n/// The signed update set the fake channel serves: one artifact for the CURRENT\r\n/// platform (fetch requires `asset_name`), product 9.9.9, docs-less.\r\nfn signed_set_json(version: u64, artifact: &[u8]) -> String {\r\n let meta = spt_daemon::UpdateSetMetadata {\r\n version,\r\n channel: \"stable\".to_string(),\r\n expires_at_ms: u64::MAX,\r\n key_id: KEY_ID.to_string(),\r\n artifacts: BTreeMap::from([(\r\n spt_daemon::current_platform().to_string(),\r\n spt_daemon::UpdateArtifactMetadata {\r\n artifact_sha256: spt_daemon::sha256_hex(artifact),\r\n brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\r\n broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\r\n asset_name: Some(\"spt-composite-artifact\".to_string()),\r\n },\r\n )]),\r\n provenance: None,\r\n product_version: \"9.9.9\".to_string(),\r\n docs: None,\r\n };\r\n let metadata_json = serde_json::to_string(&meta).unwrap();\r\n let sig = release_key().sign(metadata_json.as_bytes());\r\n serde_json::to_string(&spt_daemon::SignedUpdateSet {\r\n metadata_json,\r\n signature_hex: hex(&sig.to_bytes()),\r\n })\r\n .unwrap()\r\n}\r\n\r\n/// Build a `.spt` adapter release archive (tar, relative members — the exact\r\n/// shape `extract_release_archive` consumes) whose root manifest declares\r\n/// `version` and keeps the gh_release `[update]` block (so the re-register\r\n/// after the swap preserves the avenue).\r\nfn adapter_spt(scratch: &Path, version: &str) -> Vec {\r\n let tree = scratch.join(format!(\"adapter-tree-{version}\"));\r\n std::fs::create_dir_all(&tree).unwrap();\r\n std::fs::write(tree.join(\"manifest.toml\"), adapter_manifest(version)).unwrap();\r\n let out = scratch.join(format!(\"adapter-{version}.spt\"));\r\n let st = Command::new(\"tar\")\r\n .arg(\"-cf\")\r\n .arg(&out)\r\n .arg(\"-C\")\r\n .arg(&tree)\r\n .arg(\".\")\r\n .status()\r\n .expect(\"system tar (present on Win10+ and Linux)\");\r\n assert!(st.success(), \"tar the adapter tree\");\r\n std::fs::read(&out).unwrap()\r\n}\r\n\r\nfn adapter_manifest(version: &str) -> String {\r\n format!(\r\n \"[adapter]\\nname = \\\"cc\\\"\\nkind = \\\"harness\\\"\\nversion = \\\"{version}\\\"\\n\\\r\n min_spt_core_version = \\\"0\\\"\\n\\n\\\r\n [update]\\navenue = \\\"gh_release\\\"\\nrepo = \\\"u/r\\\"\\n\"\r\n )\r\n}\r\n\r\n#[test]\r\nfn bare_update_applies_core_then_updates_adapter_in_one_invocation() {\r\n // ── (1) Isolated home + this test's PRIVATE copy of the spt binary (the\r\n // core apply swaps `current_exe` — driving the shared target/debug\r\n // binary would clobber it for the rest of the suite). The fake gh sits\r\n // beside it on a PATH-prepended dir. ──\r\n let root = tempfile::tempdir().unwrap();\r\n let home = root.path().join(\"home\");\r\n let identity = home.join(\"identity\");\r\n std::fs::create_dir_all(&identity).unwrap();\r\n std::fs::write(\r\n identity.join(\"release-keys.json\"),\r\n serde_json::json!({ \"keys\": { KEY_ID: hex(release_key().verifying_key().as_bytes()) } })\r\n .to_string(),\r\n )\r\n .unwrap();\r\n\r\n let bindir = root.path().join(\"bin\");\r\n std::fs::create_dir_all(&bindir).unwrap();\r\n let spt = bindir.join(if cfg!(windows) { \"spt.exe\" } else { \"spt\" });\r\n std::fs::copy(env!(\"CARGO_BIN_EXE_spt\"), &spt).unwrap();\r\n let gh = bindir.join(if cfg!(windows) { \"gh.exe\" } else { \"gh\" });\r\n std::fs::copy(common::sibling_bin(\"gh_fixture\"), &gh).expect(\"gh_fixture must be built\");\r\n #[cfg(unix)]\r\n {\r\n use std::os::unix::fs::PermissionsExt;\r\n for b in [&spt, &gh] {\r\n let mut p = std::fs::metadata(b).unwrap().permissions();\r\n p.set_mode(0o755);\r\n std::fs::set_permissions(b, p).unwrap();\r\n }\r\n }\r\n let path_env = format!(\r\n \"{}{}{}\",\r\n bindir.display(),\r\n if cfg!(windows) { \";\" } else { \":\" },\r\n std::env::var(\"PATH\").unwrap_or_default()\r\n );\r\n\r\n // ── (2) The fake release channel: the CORE set (update-set.json + the\r\n // platform artifact) and the ADAPTER release (latest tag v1.1.0 +\r\n // adapter.spt with the bumped manifest). ──\r\n let gh_root = root.path().join(\"gh-root\");\r\n let assets = gh_root.join(\"assets\");\r\n std::fs::create_dir_all(&assets).unwrap();\r\n std::fs::write(gh_root.join(\"tag.txt\"), \"v1.1.0\").unwrap();\r\n std::fs::write(assets.join(\"update-set.json\"), signed_set_json(1, NEW_CORE_BYTES)).unwrap();\r\n std::fs::write(assets.join(\"spt-composite-artifact\"), NEW_CORE_BYTES).unwrap();\r\n std::fs::write(assets.join(\"adapter.spt\"), adapter_spt(root.path(), \"1.1.0\")).unwrap();\r\n let gh_log = root.path().join(\"gh.log\");\r\n\r\n // ── (3) Register the gh_release adapter `cc` at 1.0.0 (its install dir is\r\n // the registered source_dir — the in-place update target). ──\r\n std::env::set_var(\"SPT_HOME\", &home);\r\n let install_dir = spt_store::perch::spt_home().join(\"srcs\").join(\"cc\");\r\n std::fs::create_dir_all(&install_dir).unwrap();\r\n std::fs::write(install_dir.join(\"manifest.toml\"), adapter_manifest(\"1.0.0\")).unwrap();\r\n spt_runtime::registry::register(&spt_store::perch::adapters_dir(), &install_dir, 1000)\r\n .unwrap();\r\n std::env::remove_var(\"SPT_HOME\");\r\n\r\n // ── (4) ONE invocation: bare `spt update`. ──\r\n let out = {\r\n let mut cmd = Command::new(&spt);\r\n cmd.no_window()\r\n .arg(\"update\")\r\n .env(\"SPT_HOME\", &home)\r\n .env(\"PATH\", &path_env)\r\n .env(\"SPT_FAKE_GH_ROOT\", &gh_root)\r\n .env(\"SPT_FAKE_GH_LOG\", &gh_log);\r\n common::output_bounded(cmd, Duration::from_secs(120))\r\n };\r\n let stdout = String::from_utf8_lossy(&out.stdout).to_string();\r\n let stderr = String::from_utf8_lossy(&out.stderr).to_string();\r\n let log = std::fs::read_to_string(&gh_log).unwrap_or_default();\r\n eprintln!(\r\n \"=== composite: ok={} ===\\n--- stdout ---\\n{stdout}\\n--- stderr ---\\n{stderr}\\n--- gh log ---\\n{log}\",\r\n out.status.success()\r\n );\r\n\r\n assert!(\r\n out.status.success(),\r\n \"bare `spt update` must exit 0 when both legs succeed\"\r\n );\r\n\r\n // ── (5) CORE leg landed: the private spt copy now holds the NEW bytes\r\n // (daemonless swap — no daemon in this home), reported as installed. ──\r\n assert_eq!(\r\n std::fs::read(&spt).unwrap(),\r\n NEW_CORE_BYTES,\r\n \"the core apply must swap the invoking binary's on-disk seat\"\r\n );\r\n assert!(\r\n stdout.contains(\"Installed spt-core v9.9.9 on disk\"),\r\n \"the daemonless applied notice names the product version: {stdout}\"\r\n );\r\n\r\n // ── (6) ADAPTERS leg landed IN THE SAME INVOCATION: cc pulled 1.0.0 →\r\n // 1.1.0 through the fake channel and re-registered. ──\r\n assert!(\r\n stderr.contains(\"ADAPTER_UPDATE_DONE:cc\"),\r\n \"the adapter update must apply: {stderr}\"\r\n );\r\n assert!(\r\n stderr.contains(\"ADAPTER_UPDATE_SUMMARY:cc: updated 1.0.0 -> 1.1.0\"),\r\n \"the per-adapter summary line reports the pull: {stderr}\"\r\n );\r\n let landed = std::fs::read_to_string(install_dir.join(\"manifest.toml\")).unwrap();\r\n assert!(\r\n landed.contains(\"version = \\\"1.1.0\\\"\"),\r\n \"the registered install dir must hold the new manifest: {landed}\"\r\n );\r\n\r\n // ── (7) CORE-FIRST order (the composite doctrine): the set download\r\n // happens strictly before the adapter's latest-release query. ──\r\n let set_at = log\r\n .find(\"--pattern update-set.json\")\r\n .expect(\"the core leg downloaded the update set via gh\");\r\n let adapter_at = log\r\n .find(\"api repos/u/r/releases/latest\")\r\n .expect(\"the adapters leg queried the adapter release via gh\");\r\n assert!(\r\n set_at < adapter_at,\r\n \"core leg must run before the adapters leg (core-first): \\n{log}\"\r\n );\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226]},"fileSize":9607,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt\\tests\\composite_e2e.rs"}}},"isError":false,"timestamp":1789114551266}}
{"type":"message","id":"c2dcbf2f","parentId":"c2494d76","timestamp":"2026-09-11T08:15:51.278Z","message":{"role":"toolResult","toolCallId":"call_z5nJrNDw6FGFioWEJOOcSqs1|fc_0581413717c88920016aa3b8b4dae487d18a5d3575dd211ad7","toolName":"read","content":[{"type":"text","text":"enum Prepared {\n /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\n /// Quarantined / Rejected / RefusedClass) — return it verbatim.\n Done(ApplyStagedOutcome),\n /// Verified brain-only bytes ready to land at the exe path.\n Proceed {\n version: u64,\n product_version: String,\n artifact: Vec,\n },\n}\n\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\n/// run this identical gate so their fail-closed posture never diverges.\n// [impl->REQ-UPD-4]\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result {\n let Some(staged) = cache.staged_update() else {\n return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\n };\n let version = cache.staged_version().unwrap_or(0);\n let product_version = staged.product_version().unwrap_or_default();\n\n // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\n // failed readiness on this node and auto-rolled-back is quarantined — never\n // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\n // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\n // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\n // operator override (`--force`) to re-apply a genuinely-good version whose\n // failure was environmental is the deferred escape hatch (note-i).\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n let applied_state = cache.applied_state();\n if let Some(AppliedRecord::RolledBack {\n quarantine_version, ..\n }) = &applied_state\n {\n if *quarantine_version == version {\n return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\n }\n }\n\n // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\n // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\n // applied image must NOT reach the binary-aside rename below — re-renaming an\n // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\n // to a friendly exit-0 no-op instead. Checked before verify/connect: an\n // already-applied node is up to date regardless of the staged bytes' state.\n // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\n return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\n version,\n product_version,\n }));\n }\n\n // At-rest re-verification. Version floor 0: monotonicity already gated\n // the stage; this check is authenticity/integrity/expiry of the bytes on\n // disk. Fail-closed on an unprovisioned key file (same posture as the\n // pump's pull leg).\n let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\n if policy.trusted_keys.is_empty() {\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\n )));\n }\n let (plan, artifact) = match staged {\n StagedUpdate::Single(signed) => {\n // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\n // cross-OS brick. A legacy single carries NO platform identity in\n // its signed metadata, so apply trusts only the cache's platform\n // stamp: apply proceeds solely when the stage asserted THIS node's\n // platform. An unstamped single (every P2P-pulled single, and any\n // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\n // — exactly the path that swapped a Linux ELF in as `spt.exe`.\n let here = current_platform();\n match cache.staged_platform() {\n Some(p) if p == here => {}\n Some(p) => {\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n \"staged single targets platform {p}, not this node's {here} — \\\n re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\n ))))\n }\n None => {\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\n refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\n (stages a platform-safe update set)\"\n .to_string(),\n )))\n }\n }\n let artifact = cache\n .load_artifact()\n .map_err(|e| format!(\"staged artifact: {e}\"))?;\n let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\n Ok(p) => p,\n Err(reason) => {\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n \"{reason:?}\"\n ))))\n }\n };\n (plan, artifact)\n }\n StagedUpdate::Set(signed) => {\n let platform = current_platform();\n let artifact = cache\n .load_artifact_for_platform(platform)\n .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\n let plan = match plan_verified_update_set(\n &BrokerAbi::current(),\n &signed,\n platform,\n &artifact,\n &policy,\n ) {\n Ok(p) => p,\n Err(reason) => {\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n \"{reason:?}\"\n ))))\n }\n };\n (plan, artifact)\n }\n };\n if plan.class != UpdateClass::BrainOnly {\n return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\n }\n\n Ok(Prepared::Proceed {\n version,\n product_version,\n artifact,\n })\n}\n\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\n/// whether a running brain is cycled afterwards.\n// [impl->REQ-UPD-6]\nfn swap_and_record(\n cache: &ReleaseCache,\n exe_path: &Path,\n version: u64,\n artifact: &[u8],\n) -> Result<(), String> {\n // Swap the binary: step aside, land the artifact, roll back on failure.\n let aside = swap_aside_path(exe_path, version);\n let _ = std::fs::remove_file(&aside); // stale prior apply of this version\n std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\n if let Err(e) = land_artifact(exe_path, artifact) {\n let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\n return Err(format!(\"land new binary (rolled back): {e}\"));\n }\n // The binary IS swapped from here on — but DO NOT claim `applied` yet\n // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\n // reached `ready`. Writing `applied` here is the optimism the design indicts\n // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n // carrying the last-known-good `rollback_binary` (the aside we just created)\n // so the broker's supervisor, a different process from this CLI, can promote\n // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\n // Best-effort: an unrecorded phase degrades the readiness gate, never the\n // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\n // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\n // [impl->REQ-UPD-6]\n let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\n version,\n rollback_binary: aside.to_string_lossy().into_owned(),\n candidate_started_ms: now_ms(),\n // The version actually running before this swap — what a rollback returns\n // to. The supervisor must NOT derive it as N-1 (a skip-version update,\n // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\n // the quarantined version, not the running one. `None` when nothing was\n // ever recorded applied (a first-ever apply) → the supervisor falls back\n // to N-1, the only honest guess then.\n prior_version: cache.applied_version(),\n });\n let _ = cache.record_last_outcome(\"apply-pending\");\n Ok(())\n}\n\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n// [impl->REQ-UPD-3]\n// [impl->REQ-UPD-4]\npub fn apply_staged(\n cache: &ReleaseCache,\n release_keys: &Path,\n exe_path: &Path,\n broker_name: &str,\n) -> Result {\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\n Prepared::Done(outcome) => return Ok(outcome),\n Prepared::Proceed {\n version,\n product_version,\n artifact,\n } => (version, product_version, artifact),\n };\n\n // Connect to the broker BEFORE the binary moves — a dead broker fails the\n // apply with the seat untouched. The connection is the channel the planned\n // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\n // attach to any session (the broker holds every hosted endpoint across the\n // brain cycle — that is the whole point).\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n\n swap_and_record(cache, exe_path, version, &artifact)?;\n\n // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\n // The broker signals its supervisor to cycle the brain child onto the\n // just-swapped binary with `start-reason=update`; new code runs immediately,\n // no manual bounce, every broker-held endpoint untouched at the process\n // level. This replaces the old in-process `apply_brain_only` handoff (the\n // regression: it re-attached a CLI-side subscriber while the live brain kept\n // running the OLD code). `classify` already gated this as brain-only, so the\n // broker never moves; only the brain restarts.\n //\n // A broker without a supervisor wired (`honored: false`) still swapped the\n // binary — the next daemon start uses the new executable. Readiness-gated\n // promotion + auto-rollback on a brain that fails to come up is D6.\n match brain.request_brain_restart() {\n Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\n version,\n product_version,\n }),\n Err(e) => Err(format!(\n \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\n and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\n predates the restart verb needs a one-time manual daemon restart to run the new code)\"\n )),\n }\n}\n\n/// Cycle the brain of a RUNNING daemon with NO binary swap and NO staging\n/// preconditions (REQ-DAEMON-REFRESH, `spt daemon refresh`): connect to the\n/// broker and raise the same supervisor brain-restart signal the post-swap\n/// apply rides ([`Brain::request_brain_restart`], ADR-0018 D3-3) — brain stop →\n/// respawn → readiness trial → promote, broker + every hosted PTY untouched by\n/// construction. The recovery verb for wedged brain-held state that previously\n/// needed a full daemon bounce. Nothing is verified, staged, or renamed: the\n/// respawn lands on the SAME on-disk binary. A candidate that fails readiness\n/// rides the existing trial rollback semantics unchanged. `Ok(honored)`\n/// mirrors the apply path: `false` means the broker has no supervisor wired\n/// (accepted, not acted on).\n// [impl->REQ-DAEMON-REFRESH]\npub fn refresh_brain(broker_name: &str) -> Result {\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n brain\n .request_brain_restart()\n .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n}\n\n/// Apply the staged release with NO daemon running (REQ-UPDATE-ONE-SHOT-FINISH):\n/// swap the binary + record the trial, and touch NO broker. This is the fix for\n/// the operator wart where `update apply` on a stopped box booted the OLD broker\n/// pre-swap (`ensure_daemon_announced`) just to hand off to it — guaranteeing a\n/// mixed old-broker/new-brain pair and a manual bounce. Here nothing is booted:\n/// the swapped bytes run when the daemon is NEXT started (either by the operator,\n/// or by `update apply --finish` which restarts it in the same command, riding\n/// REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so hosted endpoints come back). The\n/// recorded `AppliedPending` promotes on that fresh brain's `ready`, exactly as\n/// the handoff path's does. Runs the identical verify/classify gate as\n/// [`apply_staged`], so every fail-closed refusal is preserved.\n// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n// [impl->REQ-UPD-4]\npub fn apply_staged_daemonless(\n cache: &ReleaseCache,\n release_keys: &Path,\n exe_path: &Path,\n) -> Result {\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\n Prepared::Done(outcome) => return Ok(outcome),\n Prepared::Proceed {\n version,\n product_version,\n artifact,\n } => (version, product_version, artifact),\n };\n swap_and_record(cache, exe_path, version, &artifact)?;\n Ok(ApplyStagedOutcome::AppliedDaemonless {\n version,\n product_version,\n })\n}\n\n/// Already-applied classifier (F-025): whether the staged `staged_version` is\n/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\n/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\n/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\n/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n/// is >= the staged candidate, OR a still-open trial (`AppliedPending`) already\n/// landed this version (its bytes are on disk though not yet ready-promoted). Pure.\n// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\nfn staged_already_applied(\n applied_state: Option<&AppliedRecord>,\n applied_version: Option,\n staged_version: u64,\n) -> bool {\n // A trial for this version (or newer) already swapped the binary on disk.\n if let Some(AppliedRecord::AppliedPending { version, .. }) = applied_state {\n if *version >= staged_version {\n return true;\n }\n }\n // This version (or newer) is already the promoted, running image.\n applied_version.map(|a| a >= staged_version).unwrap_or(false)\n}\n\n/// Where the outgoing binary steps aside: a sibling `.old-`\n/// (suffix appended, never `set_extension` — `spt.exe` must keep `.exe` out\n/// of the aside name's way).\nfn swap_aside_path(exe_path: &Path, version: u64) -> std::path::PathBuf {\n let name = exe_path\n .file_name()\n .and_then(|n| n.to_str())\n .unwrap_or(\"spt-binary\");\n…\n}\n\n[Showing lines 109-433 of 1204. Use :434 to continue]"}],"details":{"truncation":{"content":" /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\r\n /// Quarantined / Rejected / RefusedClass) — return it verbatim.\r\n Done(ApplyStagedOutcome),\r\n /// Verified brain-only bytes ready to land at the exe path.\r\n Proceed {\r\n version: u64,\r\n product_version: String,\r\n artifact: Vec,\r\n },\r\n}\r\n\r\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\r\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\r\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\r\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\r\n/// run this identical gate so their fail-closed posture never diverges.\r\n// [impl->REQ-UPD-4]\r\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result {\r\n let Some(staged) = cache.staged_update() else {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\r\n };\r\n let version = cache.staged_version().unwrap_or(0);\r\n let product_version = staged.product_version().unwrap_or_default();\r\n\r\n // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\r\n // failed readiness on this node and auto-rolled-back is quarantined — never\r\n // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\r\n // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\r\n // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\r\n // operator override (`--force`) to re-apply a genuinely-good version whose\r\n // failure was environmental is the deferred escape hatch (note-i).\r\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n let applied_state = cache.applied_state();\r\n if let Some(AppliedRecord::RolledBack {\r\n quarantine_version, ..\r\n }) = &applied_state\r\n {\r\n if *quarantine_version == version {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\r\n }\r\n }\r\n\r\n // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\r\n // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\r\n // applied image must NOT reach the binary-aside rename below — re-renaming an\r\n // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\r\n // to a friendly exit-0 no-op instead. Checked before verify/connect: an\r\n // already-applied node is up to date regardless of the staged bytes' state.\r\n // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\n if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\r\n version,\r\n product_version,\r\n }));\r\n }\r\n\r\n // At-rest re-verification. Version floor 0: monotonicity already gated\r\n // the stage; this check is authenticity/integrity/expiry of the bytes on\r\n // disk. Fail-closed on an unprovisioned key file (same posture as the\r\n // pump's pull leg).\r\n let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\r\n if policy.trusted_keys.is_empty() {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\r\n )));\r\n }\r\n let (plan, artifact) = match staged {\r\n StagedUpdate::Single(signed) => {\r\n // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\r\n // cross-OS brick. A legacy single carries NO platform identity in\r\n // its signed metadata, so apply trusts only the cache's platform\r\n // stamp: apply proceeds solely when the stage asserted THIS node's\r\n // platform. An unstamped single (every P2P-pulled single, and any\r\n // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\r\n // — exactly the path that swapped a Linux ELF in as `spt.exe`.\r\n let here = current_platform();\r\n match cache.staged_platform() {\r\n Some(p) if p == here => {}\r\n Some(p) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"staged single targets platform {p}, not this node's {here} — \\\r\n re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\r\n ))))\r\n }\r\n None => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\r\n refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\r\n (stages a platform-safe update set)\"\r\n .to_string(),\r\n )))\r\n }\r\n }\r\n let artifact = cache\r\n .load_artifact()\r\n .map_err(|e| format!(\"staged artifact: {e}\"))?;\r\n let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\r\n Ok(p) => p,\r\n Err(reason) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"{reason:?}\"\r\n ))))\r\n }\r\n };\r\n (plan, artifact)\r\n }\r\n StagedUpdate::Set(signed) => {\r\n let platform = current_platform();\r\n let artifact = cache\r\n .load_artifact_for_platform(platform)\r\n .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\r\n let plan = match plan_verified_update_set(\r\n &BrokerAbi::current(),\r\n &signed,\r\n platform,\r\n &artifact,\r\n &policy,\r\n ) {\r\n Ok(p) => p,\r\n Err(reason) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"{reason:?}\"\r\n ))))\r\n }\r\n };\r\n (plan, artifact)\r\n }\r\n };\r\n if plan.class != UpdateClass::BrainOnly {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\r\n }\r\n\r\n Ok(Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n })\r\n}\r\n\r\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\r\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\r\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\r\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\r\n/// whether a running brain is cycled afterwards.\r\n// [impl->REQ-UPD-6]\r\nfn swap_and_record(\r\n cache: &ReleaseCache,\r\n exe_path: &Path,\r\n version: u64,\r\n artifact: &[u8],\r\n) -> Result<(), String> {\r\n // Swap the binary: step aside, land the artifact, roll back on failure.\r\n let aside = swap_aside_path(exe_path, version);\r\n let _ = std::fs::remove_file(&aside); // stale prior apply of this version\r\n std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\r\n if let Err(e) = land_artifact(exe_path, artifact) {\r\n let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\r\n return Err(format!(\"land new binary (rolled back): {e}\"));\r\n }\r\n // The binary IS swapped from here on — but DO NOT claim `applied` yet\r\n // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\r\n // reached `ready`. Writing `applied` here is the optimism the design indicts\r\n // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\r\n // ran the old code). Instead record the FIRST phase — `AppliedPending` —\r\n // carrying the last-known-good `rollback_binary` (the aside we just created)\r\n // so the broker's supervisor, a different process from this CLI, can promote\r\n // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\r\n // Best-effort: an unrecorded phase degrades the readiness gate, never the\r\n // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\r\n // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\r\n // [impl->REQ-UPD-6]\r\n let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\r\n version,\r\n rollback_binary: aside.to_string_lossy().into_owned(),\r\n candidate_started_ms: now_ms(),\r\n // The version actually running before this swap — what a rollback returns\r\n // to. The supervisor must NOT derive it as N-1 (a skip-version update,\r\n // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\r\n // the quarantined version, not the running one. `None` when nothing was\r\n // ever recorded applied (a first-ever apply) → the supervisor falls back\r\n // to N-1, the only honest guess then.\r\n prior_version: cache.applied_version(),\r\n });\r\n let _ = cache.record_last_outcome(\"apply-pending\");\r\n Ok(())\r\n}\r\n\r\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\r\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\r\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\r\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\r\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\r\n// [impl->REQ-UPD-3]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged(\r\n cache: &ReleaseCache,\r\n release_keys: &Path,\r\n exe_path: &Path,\r\n broker_name: &str,\r\n) -> Result {\r\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n Prepared::Done(outcome) => return Ok(outcome),\r\n Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n } => (version, product_version, artifact),\r\n };\r\n\r\n // Connect to the broker BEFORE the binary moves — a dead broker fails the\r\n // apply with the seat untouched. The connection is the channel the planned\r\n // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\r\n // attach to any session (the broker holds every hosted endpoint across the\r\n // brain cycle — that is the whole point).\r\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n\r\n swap_and_record(cache, exe_path, version, &artifact)?;\r\n\r\n // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\r\n // The broker signals its supervisor to cycle the brain child onto the\r\n // just-swapped binary with `start-reason=update`; new code runs immediately,\r\n // no manual bounce, every broker-held endpoint untouched at the process\r\n // level. This replaces the old in-process `apply_brain_only` handoff (the\r\n // regression: it re-attached a CLI-side subscriber while the live brain kept\r\n // running the OLD code). `classify` already gated this as brain-only, so the\r\n // broker never moves; only the brain restarts.\r\n //\r\n // A broker without a supervisor wired (`honored: false`) still swapped the\r\n // binary — the next daemon start uses the new executable. Readiness-gated\r\n // promotion + auto-rollback on a brain that fails to come up is D6.\r\n match brain.request_brain_restart() {\r\n Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\r\n version,\r\n product_version,\r\n }),\r\n Err(e) => Err(format!(\r\n \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\r\n and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\r\n predates the restart verb needs a one-time manual daemon restart to run the new code)\"\r\n )),\r\n }\r\n}\r\n\r\n/// Cycle the brain of a RUNNING daemon with NO binary swap and NO staging\r\n/// preconditions (REQ-DAEMON-REFRESH, `spt daemon refresh`): connect to the\r\n/// broker and raise the same supervisor brain-restart signal the post-swap\r\n/// apply rides ([`Brain::request_brain_restart`], ADR-0018 D3-3) — brain stop →\r\n/// respawn → readiness trial → promote, broker + every hosted PTY untouched by\r\n/// construction. The recovery verb for wedged brain-held state that previously\r\n/// needed a full daemon bounce. Nothing is verified, staged, or renamed: the\r\n/// respawn lands on the SAME on-disk binary. A candidate that fails readiness\r\n/// rides the existing trial rollback semantics unchanged. `Ok(honored)`\r\n/// mirrors the apply path: `false` means the broker has no supervisor wired\r\n/// (accepted, not acted on).\r\n// [impl->REQ-DAEMON-REFRESH]\r\npub fn refresh_brain(broker_name: &str) -> Result {\r\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n brain\r\n .request_brain_restart()\r\n .map_err(|e| format!(\"brain-restart trigger: {e}\"))\r\n}\r\n\r\n/// Apply the staged release with NO daemon running (REQ-UPDATE-ONE-SHOT-FINISH):\r\n/// swap the binary + record the trial, and touch NO broker. This is the fix for\r\n/// the operator wart where `update apply` on a stopped box booted the OLD broker\r\n/// pre-swap (`ensure_daemon_announced`) just to hand off to it — guaranteeing a\r\n/// mixed old-broker/new-brain pair and a manual bounce. Here nothing is booted:\r\n/// the swapped bytes run when the daemon is NEXT started (either by the operator,\r\n/// or by `update apply --finish` which restarts it in the same command, riding\r\n/// REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so hosted endpoints come back). The\r\n/// recorded `AppliedPending` promotes on that fresh brain's `ready`, exactly as\r\n/// the handoff path's does. Runs the identical verify/classify gate as\r\n/// [`apply_staged`], so every fail-closed refusal is preserved.\r\n// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged_daemonless(\r\n cache: &ReleaseCache,\r\n release_keys: &Path,\r\n exe_path: &Path,\r\n) -> Result {\r\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n Prepared::Done(outcome) => return Ok(outcome),\r\n Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n } => (version, product_version, artifact),\r\n };\r\n swap_and_record(cache, exe_path, version, &artifact)?;\r\n Ok(ApplyStagedOutcome::AppliedDaemonless {\r\n version,\r\n product_version,\r\n })\r\n}\r\n\r\n/// Already-applied classifier (F-025): whether the staged `staged_version` is\r\n/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\r\n/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\r\n/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\r\n/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\r\n/// is >= the staged candidate, OR a still-open trial (`AppliedPending`) already\r\n/// landed this version (its bytes are on disk though not yet ready-promoted). Pure.\r\n// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\nfn staged_already_applied(\r\n applied_state: Option<&AppliedRecord>,\r\n applied_version: Option,\r\n staged_version: u64,\r\n) -> bool {\r\n // A trial for this version (or newer) already swapped the binary on disk.\r\n if let Some(AppliedRecord::AppliedPending { version, .. }) = applied_state {\r\n if *version >= staged_version {\r\n return true;\r\n }\r\n }\r\n // This version (or newer) is already the promoted, running image.\r\n applied_version.map(|a| a >= staged_version).unwrap_or(false)\r\n}\r\n\r\n/// Where the outgoing binary steps aside: a sibling `.old-`\r\n/// (suffix appended, never `set_extension` — `spt.exe` must keep `.exe` out\r\n/// of the aside name's way).\r\nfn swap_aside_path(exe_path: &Path, version: u64) -> std::path::PathBuf {\r\n let name = exe_path\r\n .file_name()\r\n .and_then(|n| n.to_str())\r","truncated":true,"truncatedBy":"lines","totalLines":1096,"totalBytes":16397,"outputLines":325,"outputBytes":16397,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1204,"displayContent":{"text":"enum Prepared {\n /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\r\n /// Quarantined / Rejected / RefusedClass) — return it verbatim.\r\n Done(ApplyStagedOutcome),\r\n /// Verified brain-only bytes ready to land at the exe path.\r\n Proceed {\r\n version: u64,\r\n product_version: String,\r\n artifact: Vec,\r\n },\r\n}\r\n\r\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\r\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\r\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\r\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\r\n/// run this identical gate so their fail-closed posture never diverges.\r\n// [impl->REQ-UPD-4]\r\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result {\r\n let Some(staged) = cache.staged_update() else {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\r\n };\r\n let version = cache.staged_version().unwrap_or(0);\r\n let product_version = staged.product_version().unwrap_or_default();\r\n\r\n // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\r\n // failed readiness on this node and auto-rolled-back is quarantined — never\r\n // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\r\n // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\r\n // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\r\n // operator override (`--force`) to re-apply a genuinely-good version whose\r\n // failure was environmental is the deferred escape hatch (note-i).\r\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n let applied_state = cache.applied_state();\r\n if let Some(AppliedRecord::RolledBack {\r\n quarantine_version, ..\r\n }) = &applied_state\r\n {\r\n if *quarantine_version == version {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\r\n }\r\n }\r\n\r\n // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\r\n // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\r\n // applied image must NOT reach the binary-aside rename below — re-renaming an\r\n // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\r\n // to a friendly exit-0 no-op instead. Checked before verify/connect: an\r\n // already-applied node is up to date regardless of the staged bytes' state.\r\n // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\n if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\r\n version,\r\n product_version,\r\n }));\r\n }\r\n\r\n // At-rest re-verification. Version floor 0: monotonicity already gated\r\n // the stage; this check is authenticity/integrity/expiry of the bytes on\r\n // disk. Fail-closed on an unprovisioned key file (same posture as the\r\n // pump's pull leg).\r\n let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\r\n if policy.trusted_keys.is_empty() {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\r\n )));\r\n }\r\n let (plan, artifact) = match staged {\r\n StagedUpdate::Single(signed) => {\r\n // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\r\n // cross-OS brick. A legacy single carries NO platform identity in\r\n // its signed metadata, so apply trusts only the cache's platform\r\n // stamp: apply proceeds solely when the stage asserted THIS node's\r\n // platform. An unstamped single (every P2P-pulled single, and any\r\n // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\r\n // — exactly the path that swapped a Linux ELF in as `spt.exe`.\r\n let here = current_platform();\r\n match cache.staged_platform() {\r\n Some(p) if p == here => {}\r\n Some(p) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"staged single targets platform {p}, not this node's {here} — \\\r\n re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\r\n ))))\r\n }\r\n None => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\r\n refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\r\n (stages a platform-safe update set)\"\r\n .to_string(),\r\n )))\r\n }\r\n }\r\n let artifact = cache\r\n .load_artifact()\r\n .map_err(|e| format!(\"staged artifact: {e}\"))?;\r\n let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\r\n Ok(p) => p,\r\n Err(reason) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"{reason:?}\"\r\n ))))\r\n }\r\n };\r\n (plan, artifact)\r\n }\r\n StagedUpdate::Set(signed) => {\r\n let platform = current_platform();\r\n let artifact = cache\r\n .load_artifact_for_platform(platform)\r\n .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\r\n let plan = match plan_verified_update_set(\r\n &BrokerAbi::current(),\r\n &signed,\r\n platform,\r\n &artifact,\r\n &policy,\r\n ) {\r\n Ok(p) => p,\r\n Err(reason) => {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n \"{reason:?}\"\r\n ))))\r\n }\r\n };\r\n (plan, artifact)\r\n }\r\n };\r\n if plan.class != UpdateClass::BrainOnly {\r\n return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\r\n }\r\n\r\n Ok(Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n })\r\n}\r\n\r\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\r\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\r\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\r\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\r\n/// whether a running brain is cycled afterwards.\r\n// [impl->REQ-UPD-6]\r\nfn swap_and_record(\r\n cache: &ReleaseCache,\r\n exe_path: &Path,\r\n version: u64,\r\n artifact: &[u8],\r\n) -> Result<(), String> {\r\n // Swap the binary: step aside, land the artifact, roll back on failure.\r\n let aside = swap_aside_path(exe_path, version);\r\n let _ = std::fs::remove_file(&aside); // stale prior apply of this version\r\n std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\r\n if let Err(e) = land_artifact(exe_path, artifact) {\r\n let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\r\n return Err(format!(\"land new binary (rolled back): {e}\"));\r\n }\r\n // The binary IS swapped from here on — but DO NOT claim `applied` yet\r\n // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\r\n // reached `ready`. Writing `applied` here is the optimism the design indicts\r\n // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\r\n // ran the old code). Instead record the FIRST phase — `AppliedPending` —\r\n // carrying the last-known-good `rollback_binary` (the aside we just created)\r\n // so the broker's supervisor, a different process from this CLI, can promote\r\n // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\r\n // Best-effort: an unrecorded phase degrades the readiness gate, never the\r\n // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\r\n // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\r\n // [impl->REQ-UPD-6]\r\n let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\r\n version,\r\n rollback_binary: aside.to_string_lossy().into_owned(),\r\n candidate_started_ms: now_ms(),\r\n // The version actually running before this swap — what a rollback returns\r\n // to. The supervisor must NOT derive it as N-1 (a skip-version update,\r\n // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\r\n // the quarantined version, not the running one. `None` when nothing was\r\n // ever recorded applied (a first-ever apply) → the supervisor falls back\r\n // to N-1, the only honest guess then.\r\n prior_version: cache.applied_version(),\r\n });\r\n let _ = cache.record_last_outcome(\"apply-pending\");\r\n Ok(())\r\n}\r\n\r\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\r\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\r\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\r\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\r\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\r\n// [impl->REQ-UPD-3]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged(\r\n cache: &ReleaseCache,\r\n release_keys: &Path,\r\n exe_path: &Path,\r\n broker_name: &str,\r\n) -> Result {\r\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n Prepared::Done(outcome) => return Ok(outcome),\r\n Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n } => (version, product_version, artifact),\r\n };\r\n\r\n // Connect to the broker BEFORE the binary moves — a dead broker fails the\r\n // apply with the seat untouched. The connection is the channel the planned\r\n // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\r\n // attach to any session (the broker holds every hosted endpoint across the\r\n // brain cycle — that is the whole point).\r\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n\r\n swap_and_record(cache, exe_path, version, &artifact)?;\r\n\r\n // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\r\n // The broker signals its supervisor to cycle the brain child onto the\r\n // just-swapped binary with `start-reason=update`; new code runs immediately,\r\n // no manual bounce, every broker-held endpoint untouched at the process\r\n // level. This replaces the old in-process `apply_brain_only` handoff (the\r\n // regression: it re-attached a CLI-side subscriber while the live brain kept\r\n // running the OLD code). `classify` already gated this as brain-only, so the\r\n // broker never moves; only the brain restarts.\r\n //\r\n // A broker without a supervisor wired (`honored: false`) still swapped the\r\n // binary — the next daemon start uses the new executable. Readiness-gated\r\n // promotion + auto-rollback on a brain that fails to come up is D6.\r\n match brain.request_brain_restart() {\r\n Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\r\n version,\r\n product_version,\r\n }),\r\n Err(e) => Err(format!(\r\n \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\r\n and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\r\n predates the restart verb needs a one-time manual daemon restart to run the new code)\"\r\n )),\r\n }\r\n}\r\n\r\n/// Cycle the brain of a RUNNING daemon with NO binary swap and NO staging\r\n/// preconditions (REQ-DAEMON-REFRESH, `spt daemon refresh`): connect to the\r\n/// broker and raise the same supervisor brain-restart signal the post-swap\r\n/// apply rides ([`Brain::request_brain_restart`], ADR-0018 D3-3) — brain stop →\r\n/// respawn → readiness trial → promote, broker + every hosted PTY untouched by\r\n/// construction. The recovery verb for wedged brain-held state that previously\r\n/// needed a full daemon bounce. Nothing is verified, staged, or renamed: the\r\n/// respawn lands on the SAME on-disk binary. A candidate that fails readiness\r\n/// rides the existing trial rollback semantics unchanged. `Ok(honored)`\r\n/// mirrors the apply path: `false` means the broker has no supervisor wired\r\n/// (accepted, not acted on).\r\n// [impl->REQ-DAEMON-REFRESH]\r\npub fn refresh_brain(broker_name: &str) -> Result {\r\n let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n brain\r\n .request_brain_restart()\r\n .map_err(|e| format!(\"brain-restart trigger: {e}\"))\r\n}\r\n\r\n/// Apply the staged release with NO daemon running (REQ-UPDATE-ONE-SHOT-FINISH):\r\n/// swap the binary + record the trial, and touch NO broker. This is the fix for\r\n/// the operator wart where `update apply` on a stopped box booted the OLD broker\r\n/// pre-swap (`ensure_daemon_announced`) just to hand off to it — guaranteeing a\r\n/// mixed old-broker/new-brain pair and a manual bounce. Here nothing is booted:\r\n/// the swapped bytes run when the daemon is NEXT started (either by the operator,\r\n/// or by `update apply --finish` which restarts it in the same command, riding\r\n/// REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so hosted endpoints come back). The\r\n/// recorded `AppliedPending` promotes on that fresh brain's `ready`, exactly as\r\n/// the handoff path's does. Runs the identical verify/classify gate as\r\n/// [`apply_staged`], so every fail-closed refusal is preserved.\r\n// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged_daemonless(\r\n cache: &ReleaseCache,\r\n release_keys: &Path,\r\n exe_path: &Path,\r\n) -> Result {\r\n let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n Prepared::Done(outcome) => return Ok(outcome),\r\n Prepared::Proceed {\r\n version,\r\n product_version,\r\n artifact,\r\n } => (version, product_version, artifact),\r\n };\r\n swap_and_record(cache, exe_path, version, &artifact)?;\r\n Ok(ApplyStagedOutcome::AppliedDaemonless {\r\n version,\r\n product_version,\r\n })\r\n}\r\n\r\n/// Already-applied classifier (F-025): whether the staged `staged_version` is\r\n/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\r\n/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\r\n/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\r\n/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\r\n/// is >= the staged candidate, OR a still-open trial (`AppliedPending`) already\r\n/// landed this version (its bytes are on disk though not yet ready-promoted). Pure.\r\n// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\nfn staged_already_applied(\r\n applied_state: Option<&AppliedRecord>,\r\n applied_version: Option,\r\n staged_version: u64,\r\n) -> bool {\r\n // A trial for this version (or newer) already swapped the binary on disk.\r\n if let Some(AppliedRecord::AppliedPending { version, .. }) = applied_state {\r\n if *version >= staged_version {\r\n return true;\r\n }\r\n }\r\n // This version (or newer) is already the promoted, running image.\r\n applied_version.map(|a| a >= staged_version).unwrap_or(false)\r\n}\r\n\r\n/// Where the outgoing binary steps aside: a sibling `.old-`\r\n/// (suffix appended, never `set_extension` — `spt.exe` must keep `.exe` out\r\n/// of the aside name's way).\r\nfn swap_aside_path(exe_path: &Path, version: u64) -> std::path::PathBuf {\r\n let name = exe_path\r\n .file_name()\r\n .and_then(|n| n.to_str())\r\n .unwrap_or(\"spt-binary\");\n…\n}","startLine":108,"lineNumbers":[108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,null,436]},"fileSize":55910,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src\\applyhost.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1204,"totalBytes":16397,"outputLines":325,"outputBytes":16397,"shownRange":{"start":109,"end":433},"nextOffset":434}}},"isError":false,"timestamp":1789114551278}}
{"type":"message","id":"144a9f68","parentId":"c2dcbf2f","timestamp":"2026-09-11T08:15:51.293Z","message":{"role":"toolResult","toolCallId":"call_mk0haCvudDT40iVX5nmMYVws|fc_0581413717c88920016aa3b8b4daec87d1b06df59906631470","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/spt-daemon/src/\n## nethost.rs\n 38| BindScope, Connection, EndpointAddr, LocalDiscovery, NetEndpoint, RecvStream, RelayPolicy,\n*39| SendStream, SPT_NET_ALPN,\n 40|};\n 41|use spt_net::net::mesh::seedproof::ProofRole;\n 42|use spt_proto::identity::{Identity, PublicKey};\n...\n 86|/// (from `daemon.json` in production; [`RelayPolicy::Disabled`] in hermetic\n*87|/// tests), and whether mDNS LAN discovery rides along.\n 88|pub struct NetConfig {\n 89| /// The node identity the endpoint binds as (seed → same ed25519 keypair).\n 90| pub identity: Identity,\n...\n 92| pub relay: RelayPolicy,\n*93| /// mDNS LAN discovery on/off (off in hermetic tests).\n*94| pub discovery: LocalDiscovery,\n 95| /// Socket bind scope: [`BindScope::All`] in production;\n 96| /// [`BindScope::Loopback`] in hermetic tests (no real interface touched,\n 97| /// no per-test-binary Windows firewall prompt).\n...\n 904|/// the path address string, or `null` when id-only / path-less (nothing worth\n*905|/// seeding over discovery). Shared by [`register_conn`]'s presence write-back\n 906|/// and [`NetHost::conn_remote_addr_json`] so both seed identically.\n 907|// [impl->REQ-CONV-1]\n 908|fn observed_addr_json(conn: &Connection) -> serde_json::Value {\n...\n 910| if addr.is_empty() {\n*911| return serde_json::Value::Null; // id-only adds nothing over discovery\n 912| }\n 913| serde_json::to_value(addr).unwrap_or(serde_json::Value::Null)\n 914|}\n...\n 930|// [impl->REQ-SELF-ENDPOINT-ADDR-SURFACE]\n*931|pub fn addr_relay_urls(addr: &serde_json::Value) -> Vec {\n 932| addr.get(\"addrs\")\n 933| .and_then(|a| a.as_array())\n 934| .map(|paths| {\n...\n 943|\n*944|/// The node's HOME relay: the first relay path in [`addr_relay_urls`]. `None`\n 945|/// when the endpoint advertises no relay at all (relays disabled, or a purely\n 946|/// direct-path address) — which is itself the diagnosis, not an absence of one.\n 947|// [impl->REQ-SELF-ENDPOINT-ADDR-SURFACE]\n 948|pub fn addr_home_relay(addr: &serde_json::Value) -> Option {\n*949| addr_relay_urls(addr).into_iter().next()\n 950|}\n 951|\n 952|/// A `Send + 'static` snapshot of one dial's inputs — the SHARED connect path\n...\n 1218| loopback_conn: Mutex>,\n*1219| /// Serializes [`Self::open_loopback_pair`] (M11-W3) so the peer-row discovery\n 1220| /// (a before/after diff on the loopback conn's inbound rows) sees exactly the\n 1221| /// one row this open minted — concurrent pair-opens on the shared loopback conn\n 1222| /// would otherwise race the diff.\n...\n 1270| /// accept loop. The endpoint speaks TWO ALPNs (M7 D3, REQ-SUBNET-2): the\n*1271| /// trusted [`SPT_NET_ALPN`] (connections join the table as before) and\n 1272| /// the pre-trust pairing ALPN — routed to the always-on responder\n 1273| /// ([`crate::pairhost::respond`]), never registered in the stream table.\n 1274| /// One endpoint for both is deliberate: the pairing transcript binds and\n...\n 1294| cfg.relay.clone(),\n*1295| cfg.discovery,\n 1296| vec![\n*1297| SPT_NET_ALPN.to_vec(),\n 1298| spt_net::net::pairing::wire::SPT_PAIR_ALPN.to_vec(),\n 1299| ],\n 1300| cfg.scope,\n...\n 1375| cfg.relay,\n*1376| cfg.discovery,\n 1377| cfg.scope,\n 1378| );\n 1379|\n...\n 1559|\n*1560| /// Dial a peer over `SPT_NET_ALPN`, registering the connection in the table.\n 1561| /// Bridges sync→async via the host's own runtime (the broker's dispatch\n 1562| /// threads block here; the future runs on the net worker threads).\n 1563| // [impl->REQ-DAEMON-2]\n...\n 2316| let addr = EndpointAddr::new(id)\n*2317| .with_relay_url(relay.clone())\n 2318| .with_ip_addr(\"10.0.0.7:4711\".parse().unwrap());\n 2319| let json = serde_json::to_value(&addr).expect(\"EndpointAddr serializes\");\n 2320|\n...\n 2325| );\n*2326| assert_eq!(addr_relay_urls(&json).len(), 1, \"the direct path is not a relay: {json}\");\n 2327|\n 2328| // A relay-less address reports None — the honest diagnosis, not an error.\n 2329| let direct_only = serde_json::to_value(\n...\n 2343| relay: RelayPolicy::Disabled,\n*2344| discovery: LocalDiscovery::Off,\n 2345| scope: BindScope::Loopback,\n 2346| membership: None,\n 2347| }\n## lanhost.rs\n*1|//! The LAN bootstrap listener (ADR-0059 + Amendment 1, releases#266): a\n 2|//! SECOND, opt-in, operator-started hyper server in the BROKER, bound on\n 3|//! **all interfaces**, default `0.0.0.0:5470`. It exists to hand the spt\n 4|//! binary to a machine that is not yet a node.\n...\n 12|//! 404 naming this listener — there is deliberately no fall-through into a\n*13|//! 5474 code path, because a bootstrap surface that can reach the docs router\n 14|//! is a docs surface on all interfaces.\n 15|//!\n 16|//! ## Its audience is a stranger, so the gate is the operator\n...\n 19|//! listener must never grow a membership concept. The ONLY access gate is the\n*20|//! operator's explicit `spt serve lan --bootstrap`: off by default, off again\n 21|//! after `--stop`, off on every boot (see [`start_at`] — no up-state is\n 22|//! persisted, so a daemon restart never resurrects it).\n 23|//!\n...\n 39|//! by name while the host triple keeps serving — a missing musl artifact must\n*40|//! not block a Windows→Windows bootstrap.\n 41|//! - **Out-of-band anchor**: start prints one `sha256 ` line per\n 42|//! served triple, and `/install/` bakes THAT triple's hex into an\n 43|//! `--expect-sha256` flag (chosen by the page's segment, never sniffed). Two\n 44|//! machines on one LAN and a human comparing two lines is the only\n*45|//! non-circular anchor a transport-security-less bootstrap can honestly offer.\n 46|\n 47|use std::collections::BTreeMap;\n 48|use std::io;\n...\n 63|\n*64|/// The default LAN bootstrap port (ADR-0059). Deliberately NOT 5474 — a\n 65|/// separate listener with a separate router and a separate posture.\n 66|pub const DEFAULT_LAN_BOOTSTRAP_PORT: u16 = 5470;\n 67|\n*68|/// The env override for the bootstrap port (wins over `daemon.json`).\n*69|pub const LAN_BOOTSTRAP_PORT_ENV: &str = \"SPT_LAN_BOOTSTRAP_PORT\";\n 70|\n 71|/// The three ruled refusal codes. There is deliberately no\n 72|/// \"serve it marked unsigned\" branch — that is the supply-chain shape this\n...\n 78|pub const REFUSED_SET_NOT_APPLIED: &str = \"LAN_BOOTSTRAP_REFUSED:set-not-applied\";\n*79|/// `--bootstrap` while already up: the SAME url and shas, never a second\n 80|/// listener and never a re-run of the gate.\n 81|pub const ALREADY_UP: &str = \"LAN_BOOTSTRAP_ALREADY_UP\";\n 82|/// `--stop` while down: nothing to tear down, and that is not an error.\n...\n 111|\n*112|/// Resolve the effective bootstrap port: env override > config > default. A\n 113|/// malformed env value degrades to the next layer. Pure — unit-tested.\n 114|// [impl->REQ-WEB-LAN-BOOTSTRAP-LISTENER]\n 115|pub fn resolve_lan_port(config_port: Option, env_value: Option<&str>) -> u16 {\n...\n 192| // (the v0.3.1 cross-OS brick root cause), so it cannot anchor a\n*193| // multi-triple bootstrap: the exe it covers is unattributable to a triple.\n 194| let Some(StagedUpdate::Set(signed)) = staged else {\n 195| return Err(REFUSED_UNSIGNED_EXE);\n 196| };\n...\n 361|pub fn unknown_route_body() -> String {\n*362| \"NOT_FOUND: the spt LAN bootstrap listener serves only /bin//spt[.exe], \\\n 363| its .release.json sidecar, and /install — no other resource exists on this port.\\n\"\n 364| .to_string()\n 365|}\n...\n 420| // line-continuation.\n*421| \"# spt bootstrap — {triple}\\n\\\n 422| #\\n\\\n 423| # 1. download the binary and its provenance sidecar:\\n\\\n 424| Invoke-WebRequest -Uri {url} -OutFile .\\\\{name}\\n\\\n...\n 438| // on the unix page.\n*439| \"# spt bootstrap — {triple}\\n\\\n 440| #\\n\\\n 441| # 1. download the binary and its provenance sidecar:\\n\\\n 442| curl -fsSLO {url}\\n\\\n...\n 462| let mut out = String::from(\n*463| \"# spt bootstrap — pick YOUR platform's triple (this page never guesses it)\\n#\\n\",\n 464| );\n 465| for triple in set.shas.keys() {\n 466| out.push_str(&format!(\"{origin}/install/{triple}\\n\"));\n...\n 624|\n*625|/// Start the bootstrap listener at an explicit home, or refuse BY NAME.\n 626|///\n 627|/// Idempotent: already up ⇒ the SAME [`LanUp`] with `already_up` set, without a\n 628|/// second bind and without re-running the gate (a re-run could admit a\n...\n 685| std::thread::Builder::new()\n*686| .name(\"spt-lan-bootstrap\".to_string())\n 687| .spawn(move || {\n 688| let rt = match tokio::runtime::Builder::new_current_thread().enable_io().build() {\n 689| Ok(rt) => rt,\n...\n 1116| crate::docshost::DEFAULT_DOCS_PORT,\n*1117| \"the bootstrap listener is never the docs listener\"\n 1118| );\n 1119| }\n 1120|}\n\nSkipped missing paths: .worktrees/hertz-304/crates/spt/src/daemon"}],"details":{"scopePath":".worktrees/hertz-304/crates/spt-daemon/src/nethost.rs, .worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":36,"fileCount":2,"files":[".worktrees/hertz-304/crates/spt-daemon/src/nethost.rs",".worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/spt-daemon/src/nethost.rs","count":18},{"path":".worktrees/hertz-304/crates/spt-daemon/src/lanhost.rs","count":18}],"truncated":false,"displayContent":"# .worktrees/hertz-304/crates/spt-daemon/src/\n## nethost.rs\n 38│ BindScope, Connection, EndpointAddr, LocalDiscovery, NetEndpoint, RecvStream, RelayPolicy,\n *39│ SendStream, SPT_NET_ALPN,\n 40│};\n 41│use spt_net::net::mesh::seedproof::ProofRole;\n 42│use spt_proto::identity::{Identity, PublicKey};\n │...\n 86│/// (from `daemon.json` in production; [`RelayPolicy::Disabled`] in hermetic\n *87│/// tests), and whether mDNS LAN discovery rides along.\n 88│pub struct NetConfig {\n 89│ /// The node identity the endpoint binds as (seed → same ed25519 keypair).\n 90│ pub identity: Identity,\n │...\n 92│ pub relay: RelayPolicy,\n *93│ /// mDNS LAN discovery on/off (off in hermetic tests).\n *94│ pub discovery: LocalDiscovery,\n 95│ /// Socket bind scope: [`BindScope::All`] in production;\n 96│ /// [`BindScope::Loopback`] in hermetic tests (no real interface touched,\n 97│ /// no per-test-binary Windows firewall prompt).\n │...\n 904│/// the path address string, or `null` when id-only / path-less (nothing worth\n *905│/// seeding over discovery). Shared by [`register_conn`]'s presence write-back\n 906│/// and [`NetHost::conn_remote_addr_json`] so both seed identically.\n 907│// [impl->REQ-CONV-1]\n 908│fn observed_addr_json(conn: &Connection) -> serde_json::Value {\n │...\n 910│ if addr.is_empty() {\n *911│ return serde_json::Value::Null; // id-only adds nothing over discovery\n 912│ }\n 913│ serde_json::to_value(addr).unwrap_or(serde_json::Value::Null)\n 914│}\n │...\n 930│// [impl->REQ-SELF-ENDPOINT-ADDR-SURFACE]\n *931│pub fn addr_relay_urls(addr: &serde_json::Value) -> Vec {\n 932│ addr.get(\"addrs\")\n 933│ .and_then(|a| a.as_array())\n 934│ .map(|paths| {\n │...\n 943│\n *944│/// The node's HOME relay: the first relay path in [`addr_relay_urls`]. `None`\n 945│/// when the endpoint advertises no relay at all (relays disabled, or a purely\n 946│/// direct-path address) — which is itself the diagnosis, not an absence of one.\n 947│// [impl->REQ-SELF-ENDPOINT-ADDR-SURFACE]\n 948│pub fn addr_home_relay(addr: &serde_json::Value) -> Option {\n *949│ addr_relay_urls(addr).into_iter().next()\n 950│}\n 951│\n 952│/// A `Send + 'static` snapshot of one dial's inputs — the SHARED connect path\n │...\n 1218│ loopback_conn: Mutex>,\n*1219│ /// Serializes [`Self::open_loopback_pair`] (M11-W3) so the peer-row discovery\n 1220│ /// (a before/after diff on the loopback conn's inbound rows) sees exactly the\n 1221│ /// one row this open minted — concurrent pair-opens on the shared loopback conn\n 1222│ /// would otherwise race the diff.\n │...\n 1270│ /// accept loop. The endpoint speaks TWO ALPNs (M7 D3, REQ-SUBNET-2): the\n*1271│ /// trusted [`SPT_NET_ALPN`] (connections join the table as before) and\n 1272│ /// the pre-trust pairing ALPN — routed to the always-on responder\n 1273│ /// ([`crate::pairhost::respond`]), never registered in the stream table.\n 1274│ /// One endpoint for both is deliberate: the pairing transcript binds and\n │...\n 1294│ cfg.relay.clone(),\n*1295│ cfg.discovery,\n 1296│ vec![\n*1297│ SPT_NET_ALPN.to_vec(),\n 1298│ spt_net::net::pairing::wire::SPT_PAIR_ALPN.to_vec(),\n 1299│ ],\n 1300│ cfg.scope,\n │...\n 1375│ cfg.relay,\n*1376│ cfg.discovery,\n 1377│ cfg.scope,\n 1378│ );\n 1379│\n │...\n 1559│\n*1560│ /// Dial a peer over `SPT_NET_ALPN`, registering the connection in the table.\n 1561│ /// Bridges sync→async via the host's own runtime (the broker's dispatch\n 1562│ /// threads block here; the future runs on the net worker threads).\n 1563│ // [impl->REQ-DAEMON-2]\n │...\n 2316│ let addr = EndpointAddr::new(id)\n*2317│ .with_relay_url(relay.clone())\n 2318│ .with_ip_addr(\"10.0.0.7:4711\".parse().unwrap());\n 2319│ let json = serde_json::to_value(&addr).expect(\"EndpointAddr serializes\");\n 2320│\n │...\n 2325│ );\n*2326│ assert_eq!(addr_relay_urls(&json).len(), 1, \"the direct path is not a relay: {json}\");\n 2327│\n 2328│ // A relay-less address reports None — the honest diagnosis, not an error.\n 2329│ let direct_only = serde_json::to_value(\n │...\n 2343│ relay: RelayPolicy::Disabled,\n*2344│ discovery: LocalDiscovery::Off,\n 2345│ scope: BindScope::Loopback,\n 2346│ membership: None,\n 2347│ }\n## lanhost.rs\n *1│//! The LAN bootstrap listener (ADR-0059 + Amendment 1, releases#266): a\n 2│//! SECOND, opt-in, operator-started hyper server in the BROKER, bound on\n 3│//! **all interfaces**, default `0.0.0.0:5470`. It exists to hand the spt\n 4│//! binary to a machine that is not yet a node.\n │...\n 12│//! 404 naming this listener — there is deliberately no fall-through into a\n *13│//! 5474 code path, because a bootstrap surface that can reach the docs router\n 14│//! is a docs surface on all interfaces.\n 15│//!\n 16│//! ## Its audience is a stranger, so the gate is the operator\n │...\n 19│//! listener must never grow a membership concept. The ONLY access gate is the\n *20│//! operator's explicit `spt serve lan --bootstrap`: off by default, off again\n 21│//! after `--stop`, off on every boot (see [`start_at`] — no up-state is\n 22│//! persisted, so a daemon restart never resurrects it).\n 23│//!\n │...\n 39│//! by name while the host triple keeps serving — a missing musl artifact must\n *40│//! not block a Windows→Windows bootstrap.\n 41│//! - **Out-of-band anchor**: start prints one `sha256 ` line per\n 42│//! served triple, and `/install/` bakes THAT triple's hex into an\n 43│//! `--expect-sha256` flag (chosen by the page's segment, never sniffed). Two\n 44│//! machines on one LAN and a human comparing two lines is the only\n *45│//! non-circular anchor a transport-security-less bootstrap can honestly offer.\n 46│\n 47│use std::collections::BTreeMap;\n 48│use std::io;\n │...\n 63│\n *64│/// The default LAN bootstrap port (ADR-0059). Deliberately NOT 5474 — a\n 65│/// separate listener with a separate router and a separate posture.\n 66│pub const DEFAULT_LAN_BOOTSTRAP_PORT: u16 = 5470;\n 67│\n *68│/// The env override for the bootstrap port (wins over `daemon.json`).\n *69│pub const LAN_BOOTSTRAP_PORT_ENV: &str = \"SPT_LAN_BOOTSTRAP_PORT\";\n 70│\n 71│/// The three ruled refusal codes. There is deliberately no\n 72│/// \"serve it marked unsigned\" branch — that is the supply-chain shape this\n │...\n 78│pub const REFUSED_SET_NOT_APPLIED: &str = \"LAN_BOOTSTRAP_REFUSED:set-not-applied\";\n *79│/// `--bootstrap` while already up: the SAME url and shas, never a second\n 80│/// listener and never a re-run of the gate.\n 81│pub const ALREADY_UP: &str = \"LAN_BOOTSTRAP_ALREADY_UP\";\n 82│/// `--stop` while down: nothing to tear down, and that is not an error.\n │...\n 111│\n *112│/// Resolve the effective bootstrap port: env override > config > default. A\n 113│/// malformed env value degrades to the next layer. Pure — unit-tested.\n 114│// [impl->REQ-WEB-LAN-BOOTSTRAP-LISTENER]\n 115│pub fn resolve_lan_port(config_port: Option, env_value: Option<&str>) -> u16 {\n │...\n 192│ // (the v0.3.1 cross-OS brick root cause), so it cannot anchor a\n *193│ // multi-triple bootstrap: the exe it covers is unattributable to a triple.\n 194│ let Some(StagedUpdate::Set(signed)) = staged else {\n 195│ return Err(REFUSED_UNSIGNED_EXE);\n 196│ };\n │...\n 361│pub fn unknown_route_body() -> String {\n *362│ \"NOT_FOUND: the spt LAN bootstrap listener serves only /bin//spt[.exe], \\\n 363│ its .release.json sidecar, and /install — no other resource exists on this port.\\n\"\n 364│ .to_string()\n 365│}\n │...\n 420│ // line-continuation.\n *421│ \"# spt bootstrap — {triple}\\n\\\n 422│ #\\n\\\n 423│ # 1. download the binary and its provenance sidecar:\\n\\\n 424│ Invoke-WebRequest -Uri {url} -OutFile .\\\\{name}\\n\\\n │...\n 438│ // on the unix page.\n *439│ \"# spt bootstrap — {triple}\\n\\\n 440│ #\\n\\\n 441│ # 1. download the binary and its provenance sidecar:\\n\\\n 442│ curl -fsSLO {url}\\n\\\n │...\n 462│ let mut out = String::from(\n *463│ \"# spt bootstrap — pick YOUR platform's triple (this page never guesses it)\\n#\\n\",\n 464│ );\n 465│ for triple in set.shas.keys() {\n 466│ out.push_str(&format!(\"{origin}/install/{triple}\\n\"));\n │...\n 624│\n *625│/// Start the bootstrap listener at an explicit home, or refuse BY NAME.\n 626│///\n 627│/// Idempotent: already up ⇒ the SAME [`LanUp`] with `already_up` set, without a\n 628│/// second bind and without re-running the gate (a re-run could admit a\n │...\n 685│ std::thread::Builder::new()\n *686│ .name(\"spt-lan-bootstrap\".to_string())\n 687│ .spawn(move || {\n 688│ let rt = match tokio::runtime::Builder::new_current_thread().enable_io().build() {\n 689│ Ok(rt) => rt,\n │...\n 1116│ crate::docshost::DEFAULT_DOCS_PORT,\n*1117│ \"the bootstrap listener is never the docs listener\"\n 1118│ );\n 1119│ }\n 1120│}","missingPaths":[".worktrees/hertz-304/crates/spt/src/daemon"]},"isError":false,"timestamp":1789114551292}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_rgIEtA3VZCJEa4lqPROqZN3X|fc_0581413717c88920016aa3b8bf382c87d18e89acdfff2e489d","toolName":"read","startedAt":"2026-09-11T08:16:01.634Z","args":{"path":".worktrees/hertz-304/crates/spt/tests/brain_survive.rs"},"intent":"Reading actual process swap fixture"},"id":"87dd2f23","parentId":"144a9f68","timestamp":"2026-09-11T08:16:01.634Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_7vpkZg6Rx9LwLjXQ378wfyZi|fc_0581413717c88920016aa3b8bf384087d1a79648e9b5dc5fbf","toolName":"grep","startedAt":"2026-09-11T08:16:01.635Z","args":{"path":".worktrees/hertz-304/crates/spt/src;.worktrees/hertz-304/crates/xtask/src"},"intent":"Locating config and phase seams"},"id":"545a4ca4","parentId":"87dd2f23","timestamp":"2026-09-11T08:16:01.635Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uK9RGSxgw8xd1Akt9zH6OuZX|fc_0581413717c88920016aa3b8bf384887d19ca1653346f7e2e6","toolName":"read","startedAt":"2026-09-11T08:16:01.635Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/relcache.rs:34-120,248-310"},"intent":"Reading staged cache contract"},"id":"1ccffe05","parentId":"545a4ca4","timestamp":"2026-09-11T08:16:01.635Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_9sqKMXg1R0lWPMmLhjAjhpN2|fc_0581413717c88920016aa3b8bf385087d18c6373c372a03d32","toolName":"grep","startedAt":"2026-09-11T08:16:01.635Z","args":{"path":".worktrees/hertz-304/crates/xtask"},"intent":"Locating rollout staging implementation"},"id":"e293681b","parentId":"1ccffe05","timestamp":"2026-09-11T08:16:01.635Z"}
{"type":"message","id":"4067788e","parentId":"e293681b","timestamp":"2026-09-11T08:16:01.635Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_rgIEtA3VZCJEa4lqPROqZN3X|fc_0581413717c88920016aa3b8bf382c87d18e89acdfff2e489d","name":"read","arguments":{"i":"Reading actual process swap fixture","path":".worktrees/hertz-304/crates/spt/tests/brain_survive.rs"},"intent":"Reading actual process swap fixture"},{"type":"toolCall","id":"call_7vpkZg6Rx9LwLjXQ378wfyZi|fc_0581413717c88920016aa3b8bf384087d1a79648e9b5dc5fbf","name":"grep","arguments":{"i":"Locating config and phase seams","pattern":"RelayPolicy::Disabled|NetConfig \\{|SPT_.*(NET|RELAY)|ADAPTER_UPDATE_(SKIP|SUMMARY)|fn .*composite","path":".worktrees/hertz-304/crates/spt/src;.worktrees/hertz-304/crates/xtask/src","case":null,"gitignore":false,"skip":null},"intent":"Locating config and phase seams"},{"type":"toolCall","id":"call_uK9RGSxgw8xd1Akt9zH6OuZX|fc_0581413717c88920016aa3b8bf384887d19ca1653346f7e2e6","name":"read","arguments":{"i":"Reading staged cache contract","path":".worktrees/hertz-304/crates/spt-daemon/src/relcache.rs:34-120,248-310"},"intent":"Reading staged cache contract"},{"type":"toolCall","id":"call_9sqKMXg1R0lWPMmLhjAjhpN2|fc_0581413717c88920016aa3b8bf385087d18c6373c372a03d32","name":"grep","arguments":{"i":"Locating rollout staging implementation","pattern":"fn debug_rollout|stage_update_set|build-current|brain_ipc_version","path":".worktrees/hertz-304/crates/xtask","case":null,"gitignore":false,"skip":null},"intent":"Locating rollout staging implementation"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":11516,"output":262,"cacheRead":26880,"cacheWrite":0,"totalTokens":38658,"cost":{"input":0.11516000000000001,"output":0.0131,"cacheRead":0.026879999999999998,"cacheWrite":0,"total":0.15514}},"stopReason":"toolUse","timestamp":1789114551307,"responseId":"resp_0581413717c88920016aa3b8b5b65087d1b8a9315423cf40da","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8bf382c87d18e89acdfff2e489d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading actual process swap fixture\",\"path\":\".worktrees/hertz-304/crates/spt/tests/brain_survive.rs\"}","call_id":"call_rgIEtA3VZCJEa4lqPROqZN3X","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8bf384087d1a79648e9b5dc5fbf","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating config and phase seams\",\"pattern\":\"RelayPolicy::Disabled|NetConfig \\\\{|SPT_.*(NET|RELAY)|ADAPTER_UPDATE_(SKIP|SUMMARY)|fn .*composite\",\"path\":\".worktrees/hertz-304/crates/spt/src;.worktrees/hertz-304/crates/xtask/src\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_7vpkZg6Rx9LwLjXQ378wfyZi","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8bf384887d19ca1653346f7e2e6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading staged cache contract\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/relcache.rs:34-120,248-310\"}","call_id":"call_uK9RGSxgw8xd1Akt9zH6OuZX","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8bf385087d18c6373c372a03d32","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating rollout staging implementation\",\"pattern\":\"fn debug_rollout|stage_update_set|build-current|brain_ipc_version\",\"path\":\".worktrees/hertz-304/crates/xtask\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_9sqKMXg1R0lWPMmLhjAjhpN2","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":10324.41569999978,"ttft":10266.864500000142,"completedAt":1789114561632,"contextSnapshot":{"promptTokens":38396,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"a167ad66","parentId":"4067788e","timestamp":"2026-09-11T08:16:01.642Z","message":{"role":"toolResult","toolCallId":"call_rgIEtA3VZCJEa4lqPROqZN3X|fc_0581413717c88920016aa3b8bf382c87d18e89acdfff2e489d","toolName":"read","content":[{"type":"text","text":"//! Restoration D7-1 (ADR-0018 V5) — **process-level survival across a binary\n//! swap**: a hosted PTY child + a live QUIC connection survive a brain-**PROCESS**\n//! restart that lands on a **swapped on-disk binary**, with the broker holding\n//! both endpoints untouched throughout. This is the `int` E2E that re-points the\n//! regression-masked REQ-DAEMON-2 / REQ-UPD-3 evidence off the in-process\n//! `brain_swap.rs` shape onto a real process boundary.\n//!\n//! ## The proof is a TRIANGLE (doyle D7 vet, call 1) — this is leg (b)\n//!\n//! No single test proves the whole claim; three legs do, and this file is honest\n//! only when read alongside the other two:\n//!\n//! - **Leg (a) — the real-broker-process leg: `crates/spt/tests/brain_split.rs`.**\n//! The REAL `spt daemon run` broker *process* survives a brain kill and respawns\n//! it. That is where the broker's own process-packaging is proven.\n//! - **Leg (b) — the survival leg: THIS test.** A real brain *child process* +\n//! a real on-disk binary swap + real broker-**held** endpoints (a PTY child and\n//! a live QUIC conn). The broker is modeled **in-process** — faithful, not a\n//! weakening: the broker is the never-restarting anchor *by design*, so an\n//! in-process [`Broker`] runs the **same Broker code holding the same\n//! resources** the real broker would across a brain swap. The claim under test\n//! is the brain process + the swapped binary + broker-held endpoint survival —\n//! all real here. (Bonus: the in-process broker gives the test direct access to\n//! its session pid / count and QUIC conn count for the assertions.)\n//! - **Leg (c) — the field leg: D7-4.** The real daemon, a real `apply`, real\n//! hardware — the `exe_hash` flips and matches the released artifact.\n//!\n//! DEFERRED upgrade: once the live-agent adapter makes daemon-hosted sessions a\n//! production reality, a full-stack single-process E2E (the real `spt daemon run`\n//! hosting *and* surviving) becomes reachable — tracked in `docs/DEFERRED.md`,\n//! NOT D7 work.\n//!\n//! ## What makes this STRONGER than `brain_swap.rs`\n//!\n//! `brain_swap.rs` (REQ-UPD-3's prior `int`) relaunches the brain via an\n//! **in-process closure** — same process image, no disk involved. This test runs\n//! the **real `spt daemon brain` child process** the production\n//! [`supervise_brain`] spawns, swaps the on-disk binary it respawns from, and\n//! proves the post-respawn brain is running the **new bytes** via the D7-1\n//! `exe_hash` breadcrumb (`exe_hash == fixture-B != fixture-A`). It is also the\n//! **first process-level exercise of the D4 cursor-of-record resume with N≥1\n//! hosted sessions** (the supervised child re-attaches the test-established PTY\n//! session on cold start).\n//!\n//! The swap is modeled as a **path flip** between two distinct on-disk fixtures\n//! (B = A + appended padding — PE and ELF both tolerate trailing data, so behavior\n//! is identical but the hash flips). This is faithful to the production swap (the\n//! supervisor respawns from whatever the binary *selection* resolves to) and\n//! sidesteps the Windows running-exe lock (you cannot overwrite a live `.exe`).\n//!\n//! **Held AND functional (doyle F1).** Proving the endpoints are *held* (pid /\n//! session_count / conn_count unchanged) is not proving they are *alive* — a\n//! zombie conn or wedged PTY would pass. So after the swap the test also drives a\n//! marker through the held PTY child and watches the broker's output seq advance:\n//! the full round-trip (input → child → echo → broker ring) works through the\n//! swapped-in brain.\n// [int->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n// [int->REQ-UPD-3]\n// [int->REQ-DAEMON-2]\n\nuse std::path::PathBuf;\nuse std::process::Command;\nuse std::sync::atomic::{AtomicBool, Ordering};\nuse std::sync::{Arc, Mutex};\nuse std::thread;\nuse std::time::{Duration, Instant};\n\nuse spt_daemon::brain::Brain;\nuse spt_daemon::brainproc::{supervise_brain, BrainRestart, NoTrialEnv, StartReason};\nuse spt_daemon::codec::write_frame;\nuse spt_daemon::endpoint::broker_socket_name;\nuse spt_daemon::frame::{Envelope, Role};\nuse spt_daemon::msg::{encode_bytes, InputReq, SpawnReq, KIND_INPUT};\nuse spt_daemon::nethost::{NetConfig, NetHost};\nuse spt_daemon::transport::{send_hello, LocalSocketTransport};\nuse spt_daemon::Broker;\nuse spt_net::net::endpoint::{BindScope, LocalDiscovery, RelayPolicy};\nuse spt_proto::identity::Identity;\n\nmod common;\nuse common::CommandNoWindowExt;\n\n/// A long-lived echo child to host under a broker PTY (the endpoint REQ-UPD-3\n/// forbids us from disturbing across the swap). `cat`/`findstr` idle on stdin.\nfn echo_spawn_req() -> SpawnReq {\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: String::new(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n }\n}\n\n/// A hermetic net config (mirrors `netbroker.rs`): relays disabled, no discovery,\n/// loopback-only sockets — no real interface touched, no firewall prompt.\nfn hermetic(identity: Identity) -> NetConfig {\n NetConfig {\n identity,\n relay: RelayPolicy::Disabled,\n discovery: LocalDiscovery::Off,\n scope: BindScope::Loopback,\n membership: None,\n }\n}\n\n/// Bind a broker (serving on a background thread) that owns a hermetic QUIC\n/// endpoint for `identity`, with its effect journal under `dir`.\nfn net_broker(name: &str, identity: Identity, dir: &std::path::Path) -> Arc {\n let host = NetHost::start(hermetic(identity)).expect(\"net host start\");\n let broker = Broker::bind_in_with_net(name, dir.join(\"effects.log\"), Some(host))\n .expect(\"bind broker with net\");\n let serve = Arc::clone(&broker);\n thread::spawn(move || {\n let _ = serve.serve();\n });\n broker\n}\n\nfn connect_retry(name: &str) -> Brain {\n for _ in 0..400 {\n if let Ok(b) = Brain::cold_start(name, 1) {\n return b;\n }\n thread::sleep(Duration::from_millis(10));\n }\n panic!(\"brain could not connect to {name}\");\n}\n\n/// The three breadcrumb fields out of a `brain.ready` body (parsed inline so this\n/// test depends on no private brainproc helper). `None` until the file exists and\n/// carries a parseable pid.\nfn read_ready(path: &std::path::Path) -> Option<(u32, u64, Option)> {\n let body = std::fs::read_to_string(path).ok()?;\n let v: serde_json::Value = serde_json::from_str(&body).ok()?;\n let pid = v.get(\"pid\")?.as_u64()? as u32;\n let generation = v.get(\"generation\").and_then(|g| g.as_u64()).unwrap_or(0);\n let exe_hash = v\n .get(\"exe_hash\")\n .and_then(|h| h.as_str())\n .map(str::to_string);\n Some((pid, generation, exe_hash))\n}\n\n/// Poll `brain.ready` until it holds a pid (optionally one DIFFERENT from `was`),\n/// returning `(pid, generation, exe_hash)`. `None` if it never appears in time.\nfn wait_ready(\n path: &std::path::Path,\n was: Option,\n budget: Duration,\n) -> Option<(u32, u64, Option)> {\n let deadline = Instant::now() + budget;\n while Instant::now() < deadline {\n if let Some((pid, gen, hash)) = read_ready(path) {\n if was != Some(pid) {\n return Some((pid, gen, hash));\n }\n }\n thread::sleep(Duration::from_millis(50));\n }\n None\n}\n\n/// Lowercase-hex SHA-256 of a file (the same digest `brain.ready.exe_hash`\n/// carries; recomputed independently here to assert the breadcrumb matches the\n/// fixture the supervisor actually spawned).\nfn file_hash(path: &std::path::Path) -> String {\n use sha2::{Digest, Sha256};\n let bytes = std::fs::read(path).expect(\"read fixture for hashing\");\n let mut h = Sha256::new();\n h.update(&bytes);\n let digest = h.finalize();\n let mut s = String::with_capacity(digest.len() * 2);\n for b in digest {\n s.push_str(&format!(\"{b:02x}\"));\n }\n s\n}\n\n#[test]\nfn pty_and_quic_survive_brain_process_restart_onto_swapped_binary() {\n // The in-process broker + brain children both resolve `broker_socket_name()`\n // from SPT_HOME, so the supervised child connects to OUR broker. (The\n // established daemon-test pattern — daemon_e2e.rs et al. set it the same way.)\n let home = tempfile::tempdir().expect(\"tempdir\");\n // Single-test binary by design — this is the SOLE `#[test]` here, so it owns\n // the process-global SPT_HOME on its own thread (cross-binary tests are\n // separate processes). A SECOND `#[test]` added to this file MUST bring the\n // env-lock discipline (a shared mutex / serialized home), or it will race this\n // one — the D6 env-race lesson (see the spt-daemon test_home pattern).\n std::env::set_var(\"SPT_HOME\", home.path());\n\n // ── Two fixtures: A, and B = A + appended padding (the on-disk \"swap\"). ──\n // Both are the real `spt` binary, so `daemon brain` runs; B differs only by\n // trailing bytes (behavior identical, exe_hash flips).\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n let suffix = spt_bin.extension().map(|e| format!(\".{}\", e.to_string_lossy())).unwrap_or_default();\n let fixture_a = home.path().join(format!(\"brain-A{suffix}\"));\n let fixture_b = home.path().join(format!(\"brain-B{suffix}\"));\n std::fs::copy(&spt_bin, &fixture_a).expect(\"stage fixture A\");\n std::fs::copy(&spt_bin, &fixture_b).expect(\"stage fixture B\");\n {\n use std::io::Write;\n let mut f = std::fs::OpenOptions::new()\n .append(true)\n .open(&fixture_b)\n .expect(\"open fixture B to append padding\");\n f.write_all(&[0u8; 4096]).expect(\"append padding to fixture B\");\n }\n let hash_a = file_hash(&fixture_a);\n let hash_b = file_hash(&fixture_b);\n assert_ne!(hash_a, hash_b, \"the swap must flip the binary hash\");\n\n // ── The broker (leg-b stable kernel) + a loopback QUIC peer. ──\n let broker = net_broker(&broker_socket_name(), Identity::generate(), &home.path().join(\"a\"));\n let peer_name = format!(\"spt-d7-peer-{}.sock\", std::process::id());\n let _peer = net_broker(&peer_name, Identity::generate(), &home.path().join(\"b\"));\n\n // ── Establish the two endpoints ONCE via a test-driver brain, then drop it\n // HARD (the D4 hard-kill posture — the outgoing side is gone before the\n // supervised child resumes). ──\n let (sid, child_pid) = {\n let mut driver = connect_retry(&broker_socket_name());\n\n // (1) A hosted PTY child the broker holds.\n let sid = driver.spawn_session(echo_spawn_req()).expect(\"spawn session\");\n let child_pid = broker.session_pid(sid).expect(\"hosted child has a pid\");\n\n // (2) A live QUIC connection the broker holds: dial the loopback peer.\n let peer_addr = {\n let mut peer_brain = connect_retry(&peer_name);\n peer_brain.net_status().expect(\"peer status\").addr\n };\n driver.net_dial(peer_addr, None).expect(\"dial the loopback peer\");\n\n // Both endpoints are now broker-held.\n assert_eq!(broker.session_count(), 1, \"one hosted session established\");\n assert_eq!(broker.net_conn_count(), 1, \"one live QUIC conn established\");\n (sid, child_pid)\n // driver dropped here — HARD detach (no graceful handoff frame).\n };\n\n // ── Start the production supervisor, spawning the REAL `spt daemon brain`\n // child from the currently-selected fixture (A). NoTrialEnv = the\n // pre-D6 respawn loop (no readiness gate); the swap is driven by the\n // planned-restart signal, exactly as a real `apply` drives it (D3-3). ──\n let ready_path = home.path().join(\"brain.ready\");\n let stop = Arc::new(AtomicBool::new(false));\n let restart = Arc::new(BrainRestart::new());\n let selected = Arc::new(Mutex::new(fixture_a.clone()));\n let home_path = home.path().to_path_buf();\n\n let sup = {\n let stop = Arc::clone(&stop);\n let restart = Arc::clone(&restart);\n let selected = Arc::clone(&selected);\n thread::spawn(move || {\n supervise_brain(\n &stop,\n &restart,\n Duration::from_millis(50),\n &NoTrialEnv,\n Duration::from_secs(30),\n move |gen, reason: StartReason, _binary| {\n let exe = selected.lock().unwrap().clone();\n Command::new(&exe)\n .no_window()\n .args([\n \"daemon\",\n \"brain\",\n \"--generation\",\n &gen.to_string(),\n \"--start-reason\",\n reason.as_arg(),\n ])\n .env(\"SPT_HOME\", &home_path)\n .spawn()\n },\n );\n })\n };\n\n // ── Generation 0: the real child came up from fixture A, resumed the hosted\n // session (the first N≥1 cursor-of-record resume), and stamped exe_hash A. ──\n let (pid0, _gen0, hash0) = wait_ready(&ready_path, None, Duration::from_secs(45))\n .unwrap_or_else(|| teardown_panic(&stop, \"gen-0 brain never signalled ready\"));\n assert_eq!(\n hash0.as_deref(),\n Some(hash_a.as_str()),\n \"gen-0 brain.ready exe_hash must be fixture A\"\n );\n…\n}\n\n[Showing lines 1-300 of 403. Use :301 to continue]"}],"details":{"truncation":{"content":"//! Restoration D7-1 (ADR-0018 V5) — **process-level survival across a binary\r\n//! swap**: a hosted PTY child + a live QUIC connection survive a brain-**PROCESS**\r\n//! restart that lands on a **swapped on-disk binary**, with the broker holding\r\n//! both endpoints untouched throughout. This is the `int` E2E that re-points the\r\n//! regression-masked REQ-DAEMON-2 / REQ-UPD-3 evidence off the in-process\r\n//! `brain_swap.rs` shape onto a real process boundary.\r\n//!\r\n//! ## The proof is a TRIANGLE (doyle D7 vet, call 1) — this is leg (b)\r\n//!\r\n//! No single test proves the whole claim; three legs do, and this file is honest\r\n//! only when read alongside the other two:\r\n//!\r\n//! - **Leg (a) — the real-broker-process leg: `crates/spt/tests/brain_split.rs`.**\r\n//! The REAL `spt daemon run` broker *process* survives a brain kill and respawns\r\n//! it. That is where the broker's own process-packaging is proven.\r\n//! - **Leg (b) — the survival leg: THIS test.** A real brain *child process* +\r\n//! a real on-disk binary swap + real broker-**held** endpoints (a PTY child and\r\n//! a live QUIC conn). The broker is modeled **in-process** — faithful, not a\r\n//! weakening: the broker is the never-restarting anchor *by design*, so an\r\n//! in-process [`Broker`] runs the **same Broker code holding the same\r\n//! resources** the real broker would across a brain swap. The claim under test\r\n//! is the brain process + the swapped binary + broker-held endpoint survival —\r\n//! all real here. (Bonus: the in-process broker gives the test direct access to\r\n//! its session pid / count and QUIC conn count for the assertions.)\r\n//! - **Leg (c) — the field leg: D7-4.** The real daemon, a real `apply`, real\r\n//! hardware — the `exe_hash` flips and matches the released artifact.\r\n//!\r\n//! DEFERRED upgrade: once the live-agent adapter makes daemon-hosted sessions a\r\n//! production reality, a full-stack single-process E2E (the real `spt daemon run`\r\n//! hosting *and* surviving) becomes reachable — tracked in `docs/DEFERRED.md`,\r\n//! NOT D7 work.\r\n//!\r\n//! ## What makes this STRONGER than `brain_swap.rs`\r\n//!\r\n//! `brain_swap.rs` (REQ-UPD-3's prior `int`) relaunches the brain via an\r\n//! **in-process closure** — same process image, no disk involved. This test runs\r\n//! the **real `spt daemon brain` child process** the production\r\n//! [`supervise_brain`] spawns, swaps the on-disk binary it respawns from, and\r\n//! proves the post-respawn brain is running the **new bytes** via the D7-1\r\n//! `exe_hash` breadcrumb (`exe_hash == fixture-B != fixture-A`). It is also the\r\n//! **first process-level exercise of the D4 cursor-of-record resume with N≥1\r\n//! hosted sessions** (the supervised child re-attaches the test-established PTY\r\n//! session on cold start).\r\n//!\r\n//! The swap is modeled as a **path flip** between two distinct on-disk fixtures\r\n//! (B = A + appended padding — PE and ELF both tolerate trailing data, so behavior\r\n//! is identical but the hash flips). This is faithful to the production swap (the\r\n//! supervisor respawns from whatever the binary *selection* resolves to) and\r\n//! sidesteps the Windows running-exe lock (you cannot overwrite a live `.exe`).\r\n//!\r\n//! **Held AND functional (doyle F1).** Proving the endpoints are *held* (pid /\r\n//! session_count / conn_count unchanged) is not proving they are *alive* — a\r\n//! zombie conn or wedged PTY would pass. So after the swap the test also drives a\r\n//! marker through the held PTY child and watches the broker's output seq advance:\r\n//! the full round-trip (input → child → echo → broker ring) works through the\r\n//! swapped-in brain.\r\n// [int->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n// [int->REQ-UPD-3]\r\n// [int->REQ-DAEMON-2]\r\n\r\nuse std::path::PathBuf;\r\nuse std::process::Command;\r\nuse std::sync::atomic::{AtomicBool, Ordering};\r\nuse std::sync::{Arc, Mutex};\r\nuse std::thread;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_daemon::brain::Brain;\r\nuse spt_daemon::brainproc::{supervise_brain, BrainRestart, NoTrialEnv, StartReason};\r\nuse spt_daemon::codec::write_frame;\r\nuse spt_daemon::endpoint::broker_socket_name;\r\nuse spt_daemon::frame::{Envelope, Role};\r\nuse spt_daemon::msg::{encode_bytes, InputReq, SpawnReq, KIND_INPUT};\r\nuse spt_daemon::nethost::{NetConfig, NetHost};\r\nuse spt_daemon::transport::{send_hello, LocalSocketTransport};\r\nuse spt_daemon::Broker;\r\nuse spt_net::net::endpoint::{BindScope, LocalDiscovery, RelayPolicy};\r\nuse spt_proto::identity::Identity;\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\n/// A long-lived echo child to host under a broker PTY (the endpoint REQ-UPD-3\r\n/// forbids us from disturbing across the swap). `cat`/`findstr` idle on stdin.\r\nfn echo_spawn_req() -> SpawnReq {\r\n #[cfg(unix)]\r\n let (program, args) = (\"cat\".to_string(), Vec::::new());\r\n #[cfg(windows)]\r\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\r\n SpawnReq {\r\n program,\r\n args,\r\n rows: 24,\r\n cols: 80,\r\n endpoint: String::new(),\r\n cwd: None,\r\n env: Default::default(),\r\n translation_binary: None,\r\n adapter: String::new(),\r\n install_dir: None,\r\n }\r\n}\r\n\r\n/// A hermetic net config (mirrors `netbroker.rs`): relays disabled, no discovery,\r\n/// loopback-only sockets — no real interface touched, no firewall prompt.\r\nfn hermetic(identity: Identity) -> NetConfig {\r\n NetConfig {\r\n identity,\r\n relay: RelayPolicy::Disabled,\r\n discovery: LocalDiscovery::Off,\r\n scope: BindScope::Loopback,\r\n membership: None,\r\n }\r\n}\r\n\r\n/// Bind a broker (serving on a background thread) that owns a hermetic QUIC\r\n/// endpoint for `identity`, with its effect journal under `dir`.\r\nfn net_broker(name: &str, identity: Identity, dir: &std::path::Path) -> Arc {\r\n let host = NetHost::start(hermetic(identity)).expect(\"net host start\");\r\n let broker = Broker::bind_in_with_net(name, dir.join(\"effects.log\"), Some(host))\r\n .expect(\"bind broker with net\");\r\n let serve = Arc::clone(&broker);\r\n thread::spawn(move || {\r\n let _ = serve.serve();\r\n });\r\n broker\r\n}\r\n\r\nfn connect_retry(name: &str) -> Brain {\r\n for _ in 0..400 {\r\n if let Ok(b) = Brain::cold_start(name, 1) {\r\n return b;\r\n }\r\n thread::sleep(Duration::from_millis(10));\r\n }\r\n panic!(\"brain could not connect to {name}\");\r\n}\r\n\r\n/// The three breadcrumb fields out of a `brain.ready` body (parsed inline so this\r\n/// test depends on no private brainproc helper). `None` until the file exists and\r\n/// carries a parseable pid.\r\nfn read_ready(path: &std::path::Path) -> Option<(u32, u64, Option)> {\r\n let body = std::fs::read_to_string(path).ok()?;\r\n let v: serde_json::Value = serde_json::from_str(&body).ok()?;\r\n let pid = v.get(\"pid\")?.as_u64()? as u32;\r\n let generation = v.get(\"generation\").and_then(|g| g.as_u64()).unwrap_or(0);\r\n let exe_hash = v\r\n .get(\"exe_hash\")\r\n .and_then(|h| h.as_str())\r\n .map(str::to_string);\r\n Some((pid, generation, exe_hash))\r\n}\r\n\r\n/// Poll `brain.ready` until it holds a pid (optionally one DIFFERENT from `was`),\r\n/// returning `(pid, generation, exe_hash)`. `None` if it never appears in time.\r\nfn wait_ready(\r\n path: &std::path::Path,\r\n was: Option,\r\n budget: Duration,\r\n) -> Option<(u32, u64, Option)> {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some((pid, gen, hash)) = read_ready(path) {\r\n if was != Some(pid) {\r\n return Some((pid, gen, hash));\r\n }\r\n }\r\n thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n/// Lowercase-hex SHA-256 of a file (the same digest `brain.ready.exe_hash`\r\n/// carries; recomputed independently here to assert the breadcrumb matches the\r\n/// fixture the supervisor actually spawned).\r\nfn file_hash(path: &std::path::Path) -> String {\r\n use sha2::{Digest, Sha256};\r\n let bytes = std::fs::read(path).expect(\"read fixture for hashing\");\r\n let mut h = Sha256::new();\r\n h.update(&bytes);\r\n let digest = h.finalize();\r\n let mut s = String::with_capacity(digest.len() * 2);\r\n for b in digest {\r\n s.push_str(&format!(\"{b:02x}\"));\r\n }\r\n s\r\n}\r\n\r\n#[test]\r\nfn pty_and_quic_survive_brain_process_restart_onto_swapped_binary() {\r\n // The in-process broker + brain children both resolve `broker_socket_name()`\r\n // from SPT_HOME, so the supervised child connects to OUR broker. (The\r\n // established daemon-test pattern — daemon_e2e.rs et al. set it the same way.)\r\n let home = tempfile::tempdir().expect(\"tempdir\");\r\n // Single-test binary by design — this is the SOLE `#[test]` here, so it owns\r\n // the process-global SPT_HOME on its own thread (cross-binary tests are\r\n // separate processes). A SECOND `#[test]` added to this file MUST bring the\r\n // env-lock discipline (a shared mutex / serialized home), or it will race this\r\n // one — the D6 env-race lesson (see the spt-daemon test_home pattern).\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n\r\n // ── Two fixtures: A, and B = A + appended padding (the on-disk \"swap\"). ──\r\n // Both are the real `spt` binary, so `daemon brain` runs; B differs only by\r\n // trailing bytes (behavior identical, exe_hash flips).\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let suffix = spt_bin.extension().map(|e| format!(\".{}\", e.to_string_lossy())).unwrap_or_default();\r\n let fixture_a = home.path().join(format!(\"brain-A{suffix}\"));\r\n let fixture_b = home.path().join(format!(\"brain-B{suffix}\"));\r\n std::fs::copy(&spt_bin, &fixture_a).expect(\"stage fixture A\");\r\n std::fs::copy(&spt_bin, &fixture_b).expect(\"stage fixture B\");\r\n {\r\n use std::io::Write;\r\n let mut f = std::fs::OpenOptions::new()\r\n .append(true)\r\n .open(&fixture_b)\r\n .expect(\"open fixture B to append padding\");\r\n f.write_all(&[0u8; 4096]).expect(\"append padding to fixture B\");\r\n }\r\n let hash_a = file_hash(&fixture_a);\r\n let hash_b = file_hash(&fixture_b);\r\n assert_ne!(hash_a, hash_b, \"the swap must flip the binary hash\");\r\n\r\n // ── The broker (leg-b stable kernel) + a loopback QUIC peer. ──\r\n let broker = net_broker(&broker_socket_name(), Identity::generate(), &home.path().join(\"a\"));\r\n let peer_name = format!(\"spt-d7-peer-{}.sock\", std::process::id());\r\n let _peer = net_broker(&peer_name, Identity::generate(), &home.path().join(\"b\"));\r\n\r\n // ── Establish the two endpoints ONCE via a test-driver brain, then drop it\r\n // HARD (the D4 hard-kill posture — the outgoing side is gone before the\r\n // supervised child resumes). ──\r\n let (sid, child_pid) = {\r\n let mut driver = connect_retry(&broker_socket_name());\r\n\r\n // (1) A hosted PTY child the broker holds.\r\n let sid = driver.spawn_session(echo_spawn_req()).expect(\"spawn session\");\r\n let child_pid = broker.session_pid(sid).expect(\"hosted child has a pid\");\r\n\r\n // (2) A live QUIC connection the broker holds: dial the loopback peer.\r\n let peer_addr = {\r\n let mut peer_brain = connect_retry(&peer_name);\r\n peer_brain.net_status().expect(\"peer status\").addr\r\n };\r\n driver.net_dial(peer_addr, None).expect(\"dial the loopback peer\");\r\n\r\n // Both endpoints are now broker-held.\r\n assert_eq!(broker.session_count(), 1, \"one hosted session established\");\r\n assert_eq!(broker.net_conn_count(), 1, \"one live QUIC conn established\");\r\n (sid, child_pid)\r\n // driver dropped here — HARD detach (no graceful handoff frame).\r\n };\r\n\r\n // ── Start the production supervisor, spawning the REAL `spt daemon brain`\r\n // child from the currently-selected fixture (A). NoTrialEnv = the\r\n // pre-D6 respawn loop (no readiness gate); the swap is driven by the\r\n // planned-restart signal, exactly as a real `apply` drives it (D3-3). ──\r\n let ready_path = home.path().join(\"brain.ready\");\r\n let stop = Arc::new(AtomicBool::new(false));\r\n let restart = Arc::new(BrainRestart::new());\r\n let selected = Arc::new(Mutex::new(fixture_a.clone()));\r\n let home_path = home.path().to_path_buf();\r\n\r\n let sup = {\r\n let stop = Arc::clone(&stop);\r\n let restart = Arc::clone(&restart);\r\n let selected = Arc::clone(&selected);\r\n thread::spawn(move || {\r\n supervise_brain(\r\n &stop,\r\n &restart,\r\n Duration::from_millis(50),\r\n &NoTrialEnv,\r\n Duration::from_secs(30),\r\n move |gen, reason: StartReason, _binary| {\r\n let exe = selected.lock().unwrap().clone();\r\n Command::new(&exe)\r\n .no_window()\r\n .args([\r\n \"daemon\",\r\n \"brain\",\r\n \"--generation\",\r\n &gen.to_string(),\r\n \"--start-reason\",\r\n reason.as_arg(),\r\n ])\r\n .env(\"SPT_HOME\", &home_path)\r\n .spawn()\r\n },\r\n );\r\n })\r\n };\r\n\r\n // ── Generation 0: the real child came up from fixture A, resumed the hosted\r\n // session (the first N≥1 cursor-of-record resume), and stamped exe_hash A. ──\r\n let (pid0, _gen0, hash0) = wait_ready(&ready_path, None, Duration::from_secs(45))\r\n .unwrap_or_else(|| teardown_panic(&stop, \"gen-0 brain never signalled ready\"));\r\n assert_eq!(\r\n hash0.as_deref(),\r\n Some(hash_a.as_str()),\r\n \"gen-0 brain.ready exe_hash must be fixture A\"\r\n );\r","truncated":true,"truncatedBy":"lines","totalLines":403,"totalBytes":13945,"outputLines":300,"outputBytes":13945,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":403,"displayContent":{"text":"//! Restoration D7-1 (ADR-0018 V5) — **process-level survival across a binary\r\n//! swap**: a hosted PTY child + a live QUIC connection survive a brain-**PROCESS**\r\n//! restart that lands on a **swapped on-disk binary**, with the broker holding\r\n//! both endpoints untouched throughout. This is the `int` E2E that re-points the\r\n//! regression-masked REQ-DAEMON-2 / REQ-UPD-3 evidence off the in-process\r\n//! `brain_swap.rs` shape onto a real process boundary.\r\n//!\r\n//! ## The proof is a TRIANGLE (doyle D7 vet, call 1) — this is leg (b)\r\n//!\r\n//! No single test proves the whole claim; three legs do, and this file is honest\r\n//! only when read alongside the other two:\r\n//!\r\n//! - **Leg (a) — the real-broker-process leg: `crates/spt/tests/brain_split.rs`.**\r\n//! The REAL `spt daemon run` broker *process* survives a brain kill and respawns\r\n//! it. That is where the broker's own process-packaging is proven.\r\n//! - **Leg (b) — the survival leg: THIS test.** A real brain *child process* +\r\n//! a real on-disk binary swap + real broker-**held** endpoints (a PTY child and\r\n//! a live QUIC conn). The broker is modeled **in-process** — faithful, not a\r\n//! weakening: the broker is the never-restarting anchor *by design*, so an\r\n//! in-process [`Broker`] runs the **same Broker code holding the same\r\n//! resources** the real broker would across a brain swap. The claim under test\r\n//! is the brain process + the swapped binary + broker-held endpoint survival —\r\n//! all real here. (Bonus: the in-process broker gives the test direct access to\r\n//! its session pid / count and QUIC conn count for the assertions.)\r\n//! - **Leg (c) — the field leg: D7-4.** The real daemon, a real `apply`, real\r\n//! hardware — the `exe_hash` flips and matches the released artifact.\r\n//!\r\n//! DEFERRED upgrade: once the live-agent adapter makes daemon-hosted sessions a\r\n//! production reality, a full-stack single-process E2E (the real `spt daemon run`\r\n//! hosting *and* surviving) becomes reachable — tracked in `docs/DEFERRED.md`,\r\n//! NOT D7 work.\r\n//!\r\n//! ## What makes this STRONGER than `brain_swap.rs`\r\n//!\r\n//! `brain_swap.rs` (REQ-UPD-3's prior `int`) relaunches the brain via an\r\n//! **in-process closure** — same process image, no disk involved. This test runs\r\n//! the **real `spt daemon brain` child process** the production\r\n//! [`supervise_brain`] spawns, swaps the on-disk binary it respawns from, and\r\n//! proves the post-respawn brain is running the **new bytes** via the D7-1\r\n//! `exe_hash` breadcrumb (`exe_hash == fixture-B != fixture-A`). It is also the\r\n//! **first process-level exercise of the D4 cursor-of-record resume with N≥1\r\n//! hosted sessions** (the supervised child re-attaches the test-established PTY\r\n//! session on cold start).\r\n//!\r\n//! The swap is modeled as a **path flip** between two distinct on-disk fixtures\r\n//! (B = A + appended padding — PE and ELF both tolerate trailing data, so behavior\r\n//! is identical but the hash flips). This is faithful to the production swap (the\r\n//! supervisor respawns from whatever the binary *selection* resolves to) and\r\n//! sidesteps the Windows running-exe lock (you cannot overwrite a live `.exe`).\r\n//!\r\n//! **Held AND functional (doyle F1).** Proving the endpoints are *held* (pid /\r\n//! session_count / conn_count unchanged) is not proving they are *alive* — a\r\n//! zombie conn or wedged PTY would pass. So after the swap the test also drives a\r\n//! marker through the held PTY child and watches the broker's output seq advance:\r\n//! the full round-trip (input → child → echo → broker ring) works through the\r\n//! swapped-in brain.\r\n// [int->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n// [int->REQ-UPD-3]\r\n// [int->REQ-DAEMON-2]\r\n\r\nuse std::path::PathBuf;\r\nuse std::process::Command;\r\nuse std::sync::atomic::{AtomicBool, Ordering};\r\nuse std::sync::{Arc, Mutex};\r\nuse std::thread;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_daemon::brain::Brain;\r\nuse spt_daemon::brainproc::{supervise_brain, BrainRestart, NoTrialEnv, StartReason};\r\nuse spt_daemon::codec::write_frame;\r\nuse spt_daemon::endpoint::broker_socket_name;\r\nuse spt_daemon::frame::{Envelope, Role};\r\nuse spt_daemon::msg::{encode_bytes, InputReq, SpawnReq, KIND_INPUT};\r\nuse spt_daemon::nethost::{NetConfig, NetHost};\r\nuse spt_daemon::transport::{send_hello, LocalSocketTransport};\r\nuse spt_daemon::Broker;\r\nuse spt_net::net::endpoint::{BindScope, LocalDiscovery, RelayPolicy};\r\nuse spt_proto::identity::Identity;\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\n/// A long-lived echo child to host under a broker PTY (the endpoint REQ-UPD-3\r\n/// forbids us from disturbing across the swap). `cat`/`findstr` idle on stdin.\r\nfn echo_spawn_req() -> SpawnReq {\r\n #[cfg(unix)]\r\n let (program, args) = (\"cat\".to_string(), Vec::::new());\r\n #[cfg(windows)]\r\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\r\n SpawnReq {\r\n program,\r\n args,\r\n rows: 24,\r\n cols: 80,\r\n endpoint: String::new(),\r\n cwd: None,\r\n env: Default::default(),\r\n translation_binary: None,\r\n adapter: String::new(),\r\n install_dir: None,\r\n }\r\n}\r\n\r\n/// A hermetic net config (mirrors `netbroker.rs`): relays disabled, no discovery,\r\n/// loopback-only sockets — no real interface touched, no firewall prompt.\r\nfn hermetic(identity: Identity) -> NetConfig {\r\n NetConfig {\r\n identity,\r\n relay: RelayPolicy::Disabled,\r\n discovery: LocalDiscovery::Off,\r\n scope: BindScope::Loopback,\r\n membership: None,\r\n }\r\n}\r\n\r\n/// Bind a broker (serving on a background thread) that owns a hermetic QUIC\r\n/// endpoint for `identity`, with its effect journal under `dir`.\r\nfn net_broker(name: &str, identity: Identity, dir: &std::path::Path) -> Arc {\r\n let host = NetHost::start(hermetic(identity)).expect(\"net host start\");\r\n let broker = Broker::bind_in_with_net(name, dir.join(\"effects.log\"), Some(host))\r\n .expect(\"bind broker with net\");\r\n let serve = Arc::clone(&broker);\r\n thread::spawn(move || {\r\n let _ = serve.serve();\r\n });\r\n broker\r\n}\r\n\r\nfn connect_retry(name: &str) -> Brain {\r\n for _ in 0..400 {\r\n if let Ok(b) = Brain::cold_start(name, 1) {\r\n return b;\r\n }\r\n thread::sleep(Duration::from_millis(10));\r\n }\r\n panic!(\"brain could not connect to {name}\");\r\n}\r\n\r\n/// The three breadcrumb fields out of a `brain.ready` body (parsed inline so this\r\n/// test depends on no private brainproc helper). `None` until the file exists and\r\n/// carries a parseable pid.\r\nfn read_ready(path: &std::path::Path) -> Option<(u32, u64, Option)> {\r\n let body = std::fs::read_to_string(path).ok()?;\r\n let v: serde_json::Value = serde_json::from_str(&body).ok()?;\r\n let pid = v.get(\"pid\")?.as_u64()? as u32;\r\n let generation = v.get(\"generation\").and_then(|g| g.as_u64()).unwrap_or(0);\r\n let exe_hash = v\r\n .get(\"exe_hash\")\r\n .and_then(|h| h.as_str())\r\n .map(str::to_string);\r\n Some((pid, generation, exe_hash))\r\n}\r\n\r\n/// Poll `brain.ready` until it holds a pid (optionally one DIFFERENT from `was`),\r\n/// returning `(pid, generation, exe_hash)`. `None` if it never appears in time.\r\nfn wait_ready(\r\n path: &std::path::Path,\r\n was: Option,\r\n budget: Duration,\r\n) -> Option<(u32, u64, Option)> {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some((pid, gen, hash)) = read_ready(path) {\r\n if was != Some(pid) {\r\n return Some((pid, gen, hash));\r\n }\r\n }\r\n thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n/// Lowercase-hex SHA-256 of a file (the same digest `brain.ready.exe_hash`\r\n/// carries; recomputed independently here to assert the breadcrumb matches the\r\n/// fixture the supervisor actually spawned).\r\nfn file_hash(path: &std::path::Path) -> String {\r\n use sha2::{Digest, Sha256};\r\n let bytes = std::fs::read(path).expect(\"read fixture for hashing\");\r\n let mut h = Sha256::new();\r\n h.update(&bytes);\r\n let digest = h.finalize();\r\n let mut s = String::with_capacity(digest.len() * 2);\r\n for b in digest {\r\n s.push_str(&format!(\"{b:02x}\"));\r\n }\r\n s\r\n}\r\n\r\n#[test]\r\nfn pty_and_quic_survive_brain_process_restart_onto_swapped_binary() {\r\n // The in-process broker + brain children both resolve `broker_socket_name()`\r\n // from SPT_HOME, so the supervised child connects to OUR broker. (The\r\n // established daemon-test pattern — daemon_e2e.rs et al. set it the same way.)\r\n let home = tempfile::tempdir().expect(\"tempdir\");\r\n // Single-test binary by design — this is the SOLE `#[test]` here, so it owns\r\n // the process-global SPT_HOME on its own thread (cross-binary tests are\r\n // separate processes). A SECOND `#[test]` added to this file MUST bring the\r\n // env-lock discipline (a shared mutex / serialized home), or it will race this\r\n // one — the D6 env-race lesson (see the spt-daemon test_home pattern).\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n\r\n // ── Two fixtures: A, and B = A + appended padding (the on-disk \"swap\"). ──\r\n // Both are the real `spt` binary, so `daemon brain` runs; B differs only by\r\n // trailing bytes (behavior identical, exe_hash flips).\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let suffix = spt_bin.extension().map(|e| format!(\".{}\", e.to_string_lossy())).unwrap_or_default();\r\n let fixture_a = home.path().join(format!(\"brain-A{suffix}\"));\r\n let fixture_b = home.path().join(format!(\"brain-B{suffix}\"));\r\n std::fs::copy(&spt_bin, &fixture_a).expect(\"stage fixture A\");\r\n std::fs::copy(&spt_bin, &fixture_b).expect(\"stage fixture B\");\r\n {\r\n use std::io::Write;\r\n let mut f = std::fs::OpenOptions::new()\r\n .append(true)\r\n .open(&fixture_b)\r\n .expect(\"open fixture B to append padding\");\r\n f.write_all(&[0u8; 4096]).expect(\"append padding to fixture B\");\r\n }\r\n let hash_a = file_hash(&fixture_a);\r\n let hash_b = file_hash(&fixture_b);\r\n assert_ne!(hash_a, hash_b, \"the swap must flip the binary hash\");\r\n\r\n // ── The broker (leg-b stable kernel) + a loopback QUIC peer. ──\r\n let broker = net_broker(&broker_socket_name(), Identity::generate(), &home.path().join(\"a\"));\r\n let peer_name = format!(\"spt-d7-peer-{}.sock\", std::process::id());\r\n let _peer = net_broker(&peer_name, Identity::generate(), &home.path().join(\"b\"));\r\n\r\n // ── Establish the two endpoints ONCE via a test-driver brain, then drop it\r\n // HARD (the D4 hard-kill posture — the outgoing side is gone before the\r\n // supervised child resumes). ──\r\n let (sid, child_pid) = {\r\n let mut driver = connect_retry(&broker_socket_name());\r\n\r\n // (1) A hosted PTY child the broker holds.\r\n let sid = driver.spawn_session(echo_spawn_req()).expect(\"spawn session\");\r\n let child_pid = broker.session_pid(sid).expect(\"hosted child has a pid\");\r\n\r\n // (2) A live QUIC connection the broker holds: dial the loopback peer.\r\n let peer_addr = {\r\n let mut peer_brain = connect_retry(&peer_name);\r\n peer_brain.net_status().expect(\"peer status\").addr\r\n };\r\n driver.net_dial(peer_addr, None).expect(\"dial the loopback peer\");\r\n\r\n // Both endpoints are now broker-held.\r\n assert_eq!(broker.session_count(), 1, \"one hosted session established\");\r\n assert_eq!(broker.net_conn_count(), 1, \"one live QUIC conn established\");\r\n (sid, child_pid)\r\n // driver dropped here — HARD detach (no graceful handoff frame).\r\n };\r\n\r\n // ── Start the production supervisor, spawning the REAL `spt daemon brain`\r\n // child from the currently-selected fixture (A). NoTrialEnv = the\r\n // pre-D6 respawn loop (no readiness gate); the swap is driven by the\r\n // planned-restart signal, exactly as a real `apply` drives it (D3-3). ──\r\n let ready_path = home.path().join(\"brain.ready\");\r\n let stop = Arc::new(AtomicBool::new(false));\r\n let restart = Arc::new(BrainRestart::new());\r\n let selected = Arc::new(Mutex::new(fixture_a.clone()));\r\n let home_path = home.path().to_path_buf();\r\n\r\n let sup = {\r\n let stop = Arc::clone(&stop);\r\n let restart = Arc::clone(&restart);\r\n let selected = Arc::clone(&selected);\r\n thread::spawn(move || {\r\n supervise_brain(\r\n &stop,\r\n &restart,\r\n Duration::from_millis(50),\r\n &NoTrialEnv,\r\n Duration::from_secs(30),\r\n move |gen, reason: StartReason, _binary| {\r\n let exe = selected.lock().unwrap().clone();\r\n Command::new(&exe)\r\n .no_window()\r\n .args([\r\n \"daemon\",\r\n \"brain\",\r\n \"--generation\",\r\n &gen.to_string(),\r\n \"--start-reason\",\r\n reason.as_arg(),\r\n ])\r\n .env(\"SPT_HOME\", &home_path)\r\n .spawn()\r\n },\r\n );\r\n })\r\n };\r\n\r\n // ── Generation 0: the real child came up from fixture A, resumed the hosted\r\n // session (the first N≥1 cursor-of-record resume), and stamped exe_hash A. ──\r\n let (pid0, _gen0, hash0) = wait_ready(&ready_path, None, Duration::from_secs(45))\r\n .unwrap_or_else(|| teardown_panic(&stop, \"gen-0 brain never signalled ready\"));\r\n assert_eq!(\r\n hash0.as_deref(),\r\n Some(hash_a.as_str()),\r\n \"gen-0 brain.ready exe_hash must be fixture A\"\r\n );\r\n…\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,null,396]},"fileSize":18645,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt\\tests\\brain_survive.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":403,"totalBytes":13945,"outputLines":300,"outputBytes":13945,"shownRange":{"start":1,"end":300},"nextOffset":301}}},"isError":false,"timestamp":1789114561641}}
{"type":"message","id":"678993cd","parentId":"a167ad66","timestamp":"2026-09-11T08:16:01.643Z","message":{"role":"toolResult","toolCallId":"call_9sqKMXg1R0lWPMmLhjAjhpN2|fc_0581413717c88920016aa3b8bf385087d18c6373c372a03d32","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/xtask/src/\n## main.rs\n 1801| artifact_sha256: spt_daemon::release::sha256_hex(&bytes),\n*1802| brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 1803| broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1804| product_version: product_version.to_string(),\n 1805| };\n...\n 1879| artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*1880| brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 1881| broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1882| asset_name: Some(name.to_string()),\n 1883| },\n...\n 2272|// [impl->REQ-UPD-6]\n*2273|fn debug_rollout_meta(\n 2274| version: u64,\n 2275| channel: &str,\n 2276| product_version: &str,\n...\n 2342|// [impl->REQ-UPD-6]\n*2343|fn debug_rollout(args: &[String]) {\n 2344| let mut key_id = \"dev-debug-2026\".to_string();\n 2345| let mut version = None;\n 2346| let mut expires_days: u64 = 14;\n...\n 2375| \"--state\" => state_path = it.next().map(PathBuf::from),\n*2376| \"--build-current\" => build_current = true,\n 2377| \"--artifact\" => {\n 2378| artifact_args.push(it.next().cloned().expect(\"--artifact \"))\n 2379| }\n...\n 2397| !artifact_paths.is_empty(),\n*2398| \"provide --artifact or --build-current\"\n 2399| );\n 2400|\n 2401| let now = system_time_ms();\n...\n 2409| artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*2410| brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 2411| broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n 2412| asset_name: path\n 2413| .file_name()\n...\n 2462| spt_daemon::ReleaseCache::open(&stage_dir)\n*2463| .stage_update_set(&signed, &artifact_bytes)\n 2464| .expect(\"stage debug update set\");\n 2465| write_debug_version(&state_path, version);\n 2466| println!("}],"details":{"scopePath":".worktrees/hertz-304/crates/xtask","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\xtask","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":8,"fileCount":1,"files":[".worktrees/hertz-304/crates/xtask/src/main.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/xtask/src/main.rs","count":8}],"truncated":false,"displayContent":"# .worktrees/hertz-304/crates/xtask/src/\n## main.rs\n 1801│ artifact_sha256: spt_daemon::release::sha256_hex(&bytes),\n*1802│ brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 1803│ broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1804│ product_version: product_version.to_string(),\n 1805│ };\n │...\n 1879│ artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*1880│ brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 1881│ broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1882│ asset_name: Some(name.to_string()),\n 1883│ },\n │...\n 2272│// [impl->REQ-UPD-6]\n*2273│fn debug_rollout_meta(\n 2274│ version: u64,\n 2275│ channel: &str,\n 2276│ product_version: &str,\n │...\n 2342│// [impl->REQ-UPD-6]\n*2343│fn debug_rollout(args: &[String]) {\n 2344│ let mut key_id = \"dev-debug-2026\".to_string();\n 2345│ let mut version = None;\n 2346│ let mut expires_days: u64 = 14;\n │...\n 2375│ \"--state\" => state_path = it.next().map(PathBuf::from),\n*2376│ \"--build-current\" => build_current = true,\n 2377│ \"--artifact\" => {\n 2378│ artifact_args.push(it.next().cloned().expect(\"--artifact \"))\n 2379│ }\n │...\n 2397│ !artifact_paths.is_empty(),\n*2398│ \"provide --artifact or --build-current\"\n 2399│ );\n 2400│\n 2401│ let now = system_time_ms();\n │...\n 2409│ artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*2410│ brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n 2411│ broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n 2412│ asset_name: path\n 2413│ .file_name()\n │...\n 2462│ spt_daemon::ReleaseCache::open(&stage_dir)\n*2463│ .stage_update_set(&signed, &artifact_bytes)\n 2464│ .expect(\"stage debug update set\");\n 2465│ write_debug_version(&state_path, version);\n 2466│ println!("},"isError":false,"timestamp":1789114561643}}
{"type":"message","id":"3e5578b6","parentId":"678993cd","timestamp":"2026-09-11T08:16:01.650Z","message":{"role":"toolResult","toolCallId":"call_uK9RGSxgw8xd1Akt9zH6OuZX|fc_0581413717c88920016aa3b8bf384887d19ca1653346f7e2e6","toolName":"read","content":[{"type":"text","text":"/// File name of the staged release's signed metadata (the commit point).\nconst RELEASE_FILE: &str = \"release.json\";\n/// File name of the staged artifact bytes.\nconst ARTIFACT_FILE: &str = \"artifact.bin\";\n/// Directory for platform-targeted update-set artifact bytes.\nconst ARTIFACTS_DIR: &str = \"artifacts\";\n/// File name of the platform stamp for a staged **single** release — the\n/// target triple the staging side asserts the single artifact is for. A legacy\n/// [`SignedRelease`] carries no platform identity in its signed metadata\n/// (the v0.3.1 cross-OS brick root cause), so the apply guard\n/// ([`crate::applyhost::apply_staged`]) trusts this stamp only when a path that\n/// genuinely KNOWS the artifact's platform wrote it ([`stage_single_with_platform`]).\n/// A plain [`stage`](ReleaseCache::stage) leaves it absent ⇒ the apply\n/// fail-safe refuses (REQ-UPD-8). Update sets self-describe their platforms in\n/// the signed metadata and never use this stamp.\n// [impl->REQ-UPD-8]\nconst PLATFORM_FILE: &str = \"platform.json\";\n\n/// The staged docs bundle (the release's platform-independent `spt-docs.tar.gz`\n/// bytes, verified against the signed set's docs entry before staging).\n// [impl->REQ-DOCS-RELEASE-ASSET]\nconst DOCS_BUNDLE_FILE: &str = \"docs.tar.gz\";\n\n/// The two-phase applied-state record (ADR-0018 Q7, restoration D6). The legacy\n/// `applied.json` + `last-outcome.json` are written *optimistically* at the\n/// moment of binary swap — before the new brain has even booted (the\n/// `applied.json={version:6}` observed on `enlyzeam` while the box still ran the\n/// old code in memory). This record makes the apply outcome **two-phase**, gated\n/// on the new brain reaching `ready`:\n///\n/// - [`AppliedRecord::AppliedPending`] — written by `apply` at the moment of\n/// swap (the bytes are on disk, the trial brain is about to spawn). It carries\n/// the `rollback_binary` (the `.old-` aside `apply` just created)\n/// because the broker's supervisor — a **different process** from the CLI that\n/// ran `apply` — is what later promotes or rolls back, and the record is the\n/// only channel between them (no shared memory).\n/// - [`AppliedRecord::Applied`] — written by the **supervisor** when the trial\n/// brain signals ready (promotion, restoration D6-2).\n/// - [`AppliedRecord::RolledBack`] — written by the **supervisor** when the trial\n/// brain exhausts its retry budget pre-ready (correction, D6-2): the broker\n/// switches binary selection to `running_version`'s binary and quarantines\n/// `quarantine_version`.\n///\n/// Stored as `applied-state.json`, atomic-write + corrupt/absent-degrades-to-None\n/// (the supervisor reads `None` as \"no pending trial\", never a hard fail — the\n/// same posture as every other durable file here). **Additive durable state**\n/// (restoration D6-3 / KH 6.8): a rolled-back pre-D6 binary does not know this\n/// file and falls back to the legacy `applied.json` it does understand, so the\n/// new file is rollback-N-1-safe by construction.\n// [impl->REQ-UPD-6]\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(tag = \"phase\", rename_all = \"kebab-case\")]\npub enum AppliedRecord {\n /// Binary swapped on disk; the trial brain has not yet ready-promoted.\n AppliedPending {\n version: u64,\n /// Last-known-good binary to roll back to (the `.old-`).\n rollback_binary: String,\n /// When the candidate trial started (epoch ms) — observability.\n candidate_started_ms: u64,\n /// The version actually running before this swap — what a rollback\n /// returns to. Captured by `apply` from the pre-swap `applied.json`. The\n /// `.old-` aside name encodes the *quarantined* version (N), NOT\n /// the running one, so a skip-version update (applied v5 → candidate v8)\n /// must not derive `running = N-1 = v7` — that binary never existed.\n /// `None` (absent on a pre-D6-2b record, `serde(default)`) degrades to the\n /// `N-1` derivation. **Additive** — `serde(default)` keeps the record\n /// rollback-N-1-readable (the D6-3 tripwire owns this).\n #[serde(default)]\n prior_version: Option,\n },\n /// The trial brain reached `ready` — the swap is accepted.\n Applied { version: u64 },\n /// The trial brain failed readiness — rolled back to `running_version` and\n /// quarantined `quarantine_version` (no auto re-apply/re-fetch).\n RolledBack {\n quarantine_version: u64,\n running_version: u64,\n rollback_binary: String,\n },\n}\n\n/// A staged update can be the legacy single-artifact shape or the newer\n/// platform-targeted set shape. Both use the same detached-signature wire\n/// envelope; the signed metadata's inner schema distinguishes them.\n// [impl->REQ-UPD-6]\n#[derive(Debug, Clone)]\n…\n\n /// The platform stamp of the staged single release, if one was recorded by\n /// [`stage_single_with_platform`]. `None` for an unstamped single (a bare\n /// [`stage`](Self::stage), incl. every P2P-pulled single) or an update set.\n // [impl->REQ-UPD-8]\n pub fn staged_platform(&self) -> Option {\n let s = std::fs::read_to_string(self.platform_path()).ok()?;\n serde_json::from_str::(&s)\n .ok()?\n .get(\"platform\")?\n .as_str()\n .map(str::to_string)\n }\n\n /// Stage a platform-targeted update set: every artifact first, signed\n /// metadata last (commit point). The caller MUST have verified that the\n /// provided bytes match the signed digests.\n // [impl->REQ-UPD-6]\n pub fn stage_update_set(\n &self,\n signed: &SignedUpdateSet,\n artifacts: &std::collections::BTreeMap>,\n ) -> io::Result<()> {\n std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n let _ = std::fs::remove_file(self.artifact_path());\n // A set self-describes its platforms in signed metadata; the single\n // stamp must not linger from a prior single stage. [impl->REQ-UPD-8]\n let _ = std::fs::remove_file(self.platform_path());\n for (platform, bytes) in artifacts {\n atomic_write_bytes(&self.artifact_path_for_platform(platform), bytes)?;\n }\n let json = serde_json::to_string_pretty(signed)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n atomic_write_string(&self.release_path(), &json)\n }\n\n /// Path of the staged docs bundle (`spt-docs.tar.gz` bytes), staged beside\n /// the artifacts by [`stage_docs`](Self::stage_docs).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn docs_bundle_path(&self) -> PathBuf {\n self.dir.join(DOCS_BUNDLE_FILE)\n }\n\n /// Stage a verified docs bundle beside the staged set. The caller MUST\n /// have verified the bytes against the signed set's docs entry\n /// (`verify_update_set_docs`) — the cache never re-derives trust. Failure\n /// isolation lives with the CALLER: a docs staging error must never fail\n /// the binary staging that preceded it (ADR-0036 §4).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn stage_docs(&self, bundle: &[u8]) -> io::Result<()> {\n std::fs::create_dir_all(&self.dir)?;\n atomic_write_bytes(&self.docs_bundle_path(), bundle)\n }\n\n /// The staged docs bundle bytes, or `None` when no bundle is staged (a\n /// docs-less release, or a skipped/failed docs fetch — retried next fetch).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn staged_docs(&self) -> Option> {\n std::fs::read(self.docs_bundle_path()).ok()\n }\n\n /// Drop the staged docs bundle (after a successful apply landed it, or to\n /// force a re-fetch)."}],"details":{"displayContent":{"text":"/// File name of the staged release's signed metadata (the commit point).\nconst RELEASE_FILE: &str = \"release.json\";\n/// File name of the staged artifact bytes.\nconst ARTIFACT_FILE: &str = \"artifact.bin\";\n/// Directory for platform-targeted update-set artifact bytes.\nconst ARTIFACTS_DIR: &str = \"artifacts\";\n/// File name of the platform stamp for a staged **single** release — the\n/// target triple the staging side asserts the single artifact is for. A legacy\n/// [`SignedRelease`] carries no platform identity in its signed metadata\n/// (the v0.3.1 cross-OS brick root cause), so the apply guard\n/// ([`crate::applyhost::apply_staged`]) trusts this stamp only when a path that\n/// genuinely KNOWS the artifact's platform wrote it ([`stage_single_with_platform`]).\n/// A plain [`stage`](ReleaseCache::stage) leaves it absent ⇒ the apply\n/// fail-safe refuses (REQ-UPD-8). Update sets self-describe their platforms in\n/// the signed metadata and never use this stamp.\n// [impl->REQ-UPD-8]\nconst PLATFORM_FILE: &str = \"platform.json\";\n\n/// The staged docs bundle (the release's platform-independent `spt-docs.tar.gz`\n/// bytes, verified against the signed set's docs entry before staging).\n// [impl->REQ-DOCS-RELEASE-ASSET]\nconst DOCS_BUNDLE_FILE: &str = \"docs.tar.gz\";\n\n/// The two-phase applied-state record (ADR-0018 Q7, restoration D6). The legacy\n/// `applied.json` + `last-outcome.json` are written *optimistically* at the\n/// moment of binary swap — before the new brain has even booted (the\n/// `applied.json={version:6}` observed on `enlyzeam` while the box still ran the\n/// old code in memory). This record makes the apply outcome **two-phase**, gated\n/// on the new brain reaching `ready`:\n///\n/// - [`AppliedRecord::AppliedPending`] — written by `apply` at the moment of\n/// swap (the bytes are on disk, the trial brain is about to spawn). It carries\n/// the `rollback_binary` (the `.old-` aside `apply` just created)\n/// because the broker's supervisor — a **different process** from the CLI that\n/// ran `apply` — is what later promotes or rolls back, and the record is the\n/// only channel between them (no shared memory).\n/// - [`AppliedRecord::Applied`] — written by the **supervisor** when the trial\n/// brain signals ready (promotion, restoration D6-2).\n/// - [`AppliedRecord::RolledBack`] — written by the **supervisor** when the trial\n/// brain exhausts its retry budget pre-ready (correction, D6-2): the broker\n/// switches binary selection to `running_version`'s binary and quarantines\n/// `quarantine_version`.\n///\n/// Stored as `applied-state.json`, atomic-write + corrupt/absent-degrades-to-None\n/// (the supervisor reads `None` as \"no pending trial\", never a hard fail — the\n/// same posture as every other durable file here). **Additive durable state**\n/// (restoration D6-3 / KH 6.8): a rolled-back pre-D6 binary does not know this\n/// file and falls back to the legacy `applied.json` it does understand, so the\n/// new file is rollback-N-1-safe by construction.\n// [impl->REQ-UPD-6]\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(tag = \"phase\", rename_all = \"kebab-case\")]\npub enum AppliedRecord {\n /// Binary swapped on disk; the trial brain has not yet ready-promoted.\n AppliedPending {\n version: u64,\n /// Last-known-good binary to roll back to (the `.old-`).\n rollback_binary: String,\n /// When the candidate trial started (epoch ms) — observability.\n candidate_started_ms: u64,\n /// The version actually running before this swap — what a rollback\n /// returns to. Captured by `apply` from the pre-swap `applied.json`. The\n /// `.old-` aside name encodes the *quarantined* version (N), NOT\n /// the running one, so a skip-version update (applied v5 → candidate v8)\n /// must not derive `running = N-1 = v7` — that binary never existed.\n /// `None` (absent on a pre-D6-2b record, `serde(default)`) degrades to the\n /// `N-1` derivation. **Additive** — `serde(default)` keeps the record\n /// rollback-N-1-readable (the D6-3 tripwire owns this).\n #[serde(default)]\n prior_version: Option,\n },\n /// The trial brain reached `ready` — the swap is accepted.\n Applied { version: u64 },\n /// The trial brain failed readiness — rolled back to `running_version` and\n /// quarantined `quarantine_version` (no auto re-apply/re-fetch).\n RolledBack {\n quarantine_version: u64,\n running_version: u64,\n rollback_binary: String,\n },\n}\n\n/// A staged update can be the legacy single-artifact shape or the newer\n/// platform-targeted set shape. Both use the same detached-signature wire\n/// envelope; the signed metadata's inner schema distinguishes them.\n// [impl->REQ-UPD-6]\n#[derive(Debug, Clone)]\n…\n\n /// The platform stamp of the staged single release, if one was recorded by\n /// [`stage_single_with_platform`]. `None` for an unstamped single (a bare\n /// [`stage`](Self::stage), incl. every P2P-pulled single) or an update set.\n // [impl->REQ-UPD-8]\n pub fn staged_platform(&self) -> Option {\n let s = std::fs::read_to_string(self.platform_path()).ok()?;\n serde_json::from_str::(&s)\n .ok()?\n .get(\"platform\")?\n .as_str()\n .map(str::to_string)\n }\n\n /// Stage a platform-targeted update set: every artifact first, signed\n /// metadata last (commit point). The caller MUST have verified that the\n /// provided bytes match the signed digests.\n // [impl->REQ-UPD-6]\n pub fn stage_update_set(\n &self,\n signed: &SignedUpdateSet,\n artifacts: &std::collections::BTreeMap>,\n ) -> io::Result<()> {\n std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n let _ = std::fs::remove_file(self.artifact_path());\n // A set self-describes its platforms in signed metadata; the single\n // stamp must not linger from a prior single stage. [impl->REQ-UPD-8]\n let _ = std::fs::remove_file(self.platform_path());\n for (platform, bytes) in artifacts {\n atomic_write_bytes(&self.artifact_path_for_platform(platform), bytes)?;\n }\n let json = serde_json::to_string_pretty(signed)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n atomic_write_string(&self.release_path(), &json)\n }\n\n /// Path of the staged docs bundle (`spt-docs.tar.gz` bytes), staged beside\n /// the artifacts by [`stage_docs`](Self::stage_docs).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn docs_bundle_path(&self) -> PathBuf {\n self.dir.join(DOCS_BUNDLE_FILE)\n }\n\n /// Stage a verified docs bundle beside the staged set. The caller MUST\n /// have verified the bytes against the signed set's docs entry\n /// (`verify_update_set_docs`) — the cache never re-derives trust. Failure\n /// isolation lives with the CALLER: a docs staging error must never fail\n /// the binary staging that preceded it (ADR-0036 §4).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn stage_docs(&self, bundle: &[u8]) -> io::Result<()> {\n std::fs::create_dir_all(&self.dir)?;\n atomic_write_bytes(&self.docs_bundle_path(), bundle)\n }\n\n /// The staged docs bundle bytes, or `None` when no bundle is staged (a\n /// docs-less release, or a skipped/failed docs fetch — retried next fetch).\n // [impl->REQ-DOCS-RELEASE-ASSET]\n pub fn staged_docs(&self) -> Option> {\n std::fs::read(self.docs_bundle_path()).ok()\n }\n\n /// Drop the staged docs bundle (after a successful apply landed it, or to\n /// force a re-fetch).","startLine":34,"lineNumbers":[34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,null,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310]},"fileSize":33505,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src\\relcache.rs"}}},"isError":false,"timestamp":1789114561650}}
{"type":"message","id":"2731ca74","parentId":"3e5578b6","timestamp":"2026-09-11T08:16:01.756Z","message":{"role":"toolResult","toolCallId":"call_7vpkZg6Rx9LwLjXQ378wfyZi|fc_0581413717c88920016aa3b8bf384087d1a79648e9b5dc5fbf","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/spt/src/\n## cli.rs\n 9518|// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\n*9519|fn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\n 9520| let mut worst = 0;\n 9521| for leg in plan_update_legs(core_only, restart) {\n 9522| let code = match leg {\n...\n 9567|// [impl->REQ-UPDATE-COMPOSITE-EXIT-PRECEDENCE]\n*9568|fn composite_exit_rank(code: i32) -> u8 {\n 9569| match code {\n 9570| 0 => 0,\n 9571| EXIT_REFUSED_NO_WORK => 1, // == EXIT_NOT_ELEVATED; the VALUE is the class\n...\n 9590|// [impl->REQ-UPDATE-COMPOSITE-EXIT-PRECEDENCE]\n*9591|fn fold_composite_exit(so_far: i32, code: i32) -> i32 {\n 9592| if composite_exit_rank(code) > composite_exit_rank(so_far) {\n 9593| code\n 9594| } else {\n...\n 9603|// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\n*9604|fn composite_abort_on_failure(leg: UpdateLeg) -> bool {\n 9605| matches!(leg, UpdateLeg::FetchApply | UpdateLeg::Fetch)\n 9606|}\n 9607|\n...\n 21925| AdapterUpdateOutcome::Updated { from, to } => {\n*21926| format!(\"ADAPTER_UPDATE_SUMMARY:{name}: updated {from} -> {to}\")\n 21927| }\n 21928| AdapterUpdateOutcome::UpToDate { version } => {\n*21929| format!(\"ADAPTER_UPDATE_SUMMARY:{name}: up to date ({version})\")\n 21930| }\n 21931| AdapterUpdateOutcome::SkippedLocal => format!(\n*21932| \"ADAPTER_UPDATE_SUMMARY:{name}: skipped (local registration — no gh_release avenue)\"\n 21933| ),\n 21934| // A REFUSAL NAMES THE RULE THAT HELD (releases#153). \"FAILED\" sends the\n 21935| // reader hunting a broken updater; \"REFUSED (floor …)\" tells them what\n...\n 21937| AdapterUpdateOutcome::Refused { reason } => {\n*21938| format!(\"ADAPTER_UPDATE_SUMMARY:{name}: REFUSED ({reason})\")\n 21939| }\n*21940| AdapterUpdateOutcome::Failed => format!(\"ADAPTER_UPDATE_SUMMARY:{name}: FAILED\"),\n 21941| }\n 21942|}\n 21943|\n...\n 22042| eprintln!(\n*22043| \"ADAPTER_UPDATE_SKIP:{}: local registration (no [update] avenue = \\\n 22044| \\\"gh_release\\\") — skipped\",\n 22045| record.name\n 22046| );\n...\n 25289| #[test]\n*25290| fn a_composite_subject_is_refused_while_a_bare_id_still_builds() {\n 25291| let err = build_access_rule(\n 25292| spt_store::access::RuleDecision::Allow,\n 25293| Some(\"MSG\".into()),\n...\n 25976| render_adapter_update_summary(\"cc\", &outcomes[0].1),\n*25977| \"ADAPTER_UPDATE_SUMMARY:cc: updated 1.0.0 -> 1.1.0\"\n 25978| );\n 25979| assert_eq!(\n 25980| render_adapter_update_summary(\"dd\", &outcomes[1].1),\n*25981| \"ADAPTER_UPDATE_SUMMARY:dd: FAILED\"\n 25982| );\n 25983| assert_eq!(\n 25984| render_adapter_update_summary(\"ee\", &outcomes[2].1),\n*25985| \"ADAPTER_UPDATE_SUMMARY:ee: skipped (local registration — no gh_release avenue)\"\n 25986| );\n 25987| assert_eq!(\n 25988| render_adapter_update_summary(\"ff\", &outcomes[3].1),\n*25989| \"ADAPTER_UPDATE_SUMMARY:ff: up to date (2.0.0)\"\n 25990| );\n 25991| // No failures => success exit.\n 25992| let ok = vec![(\"ee\".to_string(), AdapterUpdateOutcome::SkippedLocal)];\n...\n 26148| #[test]\n*26149| fn bare_update_parses_composite_flags() {\n 26150| match parse(&[\"spt\", \"update\"]).unwrap().cmd {\n 26151| Some(Cmd::Update {\n 26152| action: None,\n...\n 26197| #[test]\n*26198| fn composite_plans_core_first_and_core_only_skips_adapters() {\n 26199| assert_eq!(\n 26200| plan_update_legs(false, false),\n 26201| vec![UpdateLeg::FetchApply, UpdateLeg::Adapters]\n...\n 28533| #[test]\n*28534| fn a_composite_judges_floors_against_the_staged_core_not_the_running_one() {\n 28535| let meta = staged_set_metadata(42, Some(\"9.9.9\"));\n 28536|\n 28537| let basis = floor_basis(Some(&meta));\n## rc.rs\n 4181| let name = spt_daemon::endpoint::broker_socket_name();\n*4182| let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4183| identity: spt_proto::identity::Identity::generate(),\n*4184| relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4185| discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4186| scope: spt_net::net::endpoint::BindScope::Loopback,\n 4187| membership: None,\n...\n 4627|\n*4628| let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4629| identity: spt_proto::identity::Identity::generate(),\n*4630| relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4631| discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4632| scope: spt_net::net::endpoint::BindScope::Loopback,\n 4633| membership: None,\n...\n 4753| let start_net_broker = |name: &str, tag: &str| {\n*4754| let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4755| identity: spt_proto::identity::Identity::generate(),\n*4756| relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4757| discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4758| scope: spt_net::net::endpoint::BindScope::Loopback,\n 4759| membership: None,\n...\n 4970| let name = spt_daemon::endpoint::broker_socket_name();\n*4971| let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4972| identity: spt_proto::identity::Identity::from_seed(&[9u8; 32]),\n*4973| relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4974| discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4975| scope: spt_net::net::endpoint::BindScope::Loopback,\n 4976| membership: None,\n## wansend.rs\n 2110| fn net_broker(name: &str, dir: &Path) -> Arc {\n*2111| let host = NetHost::start(NetConfig {\n 2112| identity: Identity::generate(),\n*2113| relay: RelayPolicy::Disabled,\n 2114| discovery: LocalDiscovery::Off,\n 2115| scope: BindScope::Loopback,\n 2116| membership: None,\n\n## api/\n### mod.rs\n 1086| #[test]\n*1087| fn load_manifest_resolves_composite_adapter_option() {\n 1088| let _h = crate::testutil::isolated_home();\n 1089| let dir = spt_store::perch::spt_home().join(\"mh\");\n 1090| std::fs::create_dir_all(&dir).unwrap();"}],"details":{"scopePath":".worktrees/hertz-304/crates/spt/src, .worktrees/hertz-304/crates/xtask/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":29,"fileCount":4,"files":[".worktrees/hertz-304/crates/spt/src/api/mod.rs",".worktrees/hertz-304/crates/spt/src/cli.rs",".worktrees/hertz-304/crates/spt/src/rc.rs",".worktrees/hertz-304/crates/spt/src/wansend.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/spt/src/api/mod.rs","count":1},{"path":".worktrees/hertz-304/crates/spt/src/cli.rs","count":18},{"path":".worktrees/hertz-304/crates/spt/src/rc.rs","count":8},{"path":".worktrees/hertz-304/crates/spt/src/wansend.rs","count":2}],"truncated":false,"displayContent":"# .worktrees/hertz-304/crates/spt/src/\n## cli.rs\n 9518│// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\n *9519│fn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\n 9520│ let mut worst = 0;\n 9521│ for leg in plan_update_legs(core_only, restart) {\n 9522│ let code = match leg {\n │...\n 9567│// [impl->REQ-UPDATE-COMPOSITE-EXIT-PRECEDENCE]\n *9568│fn composite_exit_rank(code: i32) -> u8 {\n 9569│ match code {\n 9570│ 0 => 0,\n 9571│ EXIT_REFUSED_NO_WORK => 1, // == EXIT_NOT_ELEVATED; the VALUE is the class\n │...\n 9590│// [impl->REQ-UPDATE-COMPOSITE-EXIT-PRECEDENCE]\n *9591│fn fold_composite_exit(so_far: i32, code: i32) -> i32 {\n 9592│ if composite_exit_rank(code) > composite_exit_rank(so_far) {\n 9593│ code\n 9594│ } else {\n │...\n 9603│// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\n *9604│fn composite_abort_on_failure(leg: UpdateLeg) -> bool {\n 9605│ matches!(leg, UpdateLeg::FetchApply | UpdateLeg::Fetch)\n 9606│}\n 9607│\n │...\n 21925│ AdapterUpdateOutcome::Updated { from, to } => {\n*21926│ format!(\"ADAPTER_UPDATE_SUMMARY:{name}: updated {from} -> {to}\")\n 21927│ }\n 21928│ AdapterUpdateOutcome::UpToDate { version } => {\n*21929│ format!(\"ADAPTER_UPDATE_SUMMARY:{name}: up to date ({version})\")\n 21930│ }\n 21931│ AdapterUpdateOutcome::SkippedLocal => format!(\n*21932│ \"ADAPTER_UPDATE_SUMMARY:{name}: skipped (local registration — no gh_release avenue)\"\n 21933│ ),\n 21934│ // A REFUSAL NAMES THE RULE THAT HELD (releases#153). \"FAILED\" sends the\n 21935│ // reader hunting a broken updater; \"REFUSED (floor …)\" tells them what\n │...\n 21937│ AdapterUpdateOutcome::Refused { reason } => {\n*21938│ format!(\"ADAPTER_UPDATE_SUMMARY:{name}: REFUSED ({reason})\")\n 21939│ }\n*21940│ AdapterUpdateOutcome::Failed => format!(\"ADAPTER_UPDATE_SUMMARY:{name}: FAILED\"),\n 21941│ }\n 21942│}\n 21943│\n │...\n 22042│ eprintln!(\n*22043│ \"ADAPTER_UPDATE_SKIP:{}: local registration (no [update] avenue = \\\n 22044│ \\\"gh_release\\\") — skipped\",\n 22045│ record.name\n 22046│ );\n │...\n 25289│ #[test]\n*25290│ fn a_composite_subject_is_refused_while_a_bare_id_still_builds() {\n 25291│ let err = build_access_rule(\n 25292│ spt_store::access::RuleDecision::Allow,\n 25293│ Some(\"MSG\".into()),\n │...\n 25976│ render_adapter_update_summary(\"cc\", &outcomes[0].1),\n*25977│ \"ADAPTER_UPDATE_SUMMARY:cc: updated 1.0.0 -> 1.1.0\"\n 25978│ );\n 25979│ assert_eq!(\n 25980│ render_adapter_update_summary(\"dd\", &outcomes[1].1),\n*25981│ \"ADAPTER_UPDATE_SUMMARY:dd: FAILED\"\n 25982│ );\n 25983│ assert_eq!(\n 25984│ render_adapter_update_summary(\"ee\", &outcomes[2].1),\n*25985│ \"ADAPTER_UPDATE_SUMMARY:ee: skipped (local registration — no gh_release avenue)\"\n 25986│ );\n 25987│ assert_eq!(\n 25988│ render_adapter_update_summary(\"ff\", &outcomes[3].1),\n*25989│ \"ADAPTER_UPDATE_SUMMARY:ff: up to date (2.0.0)\"\n 25990│ );\n 25991│ // No failures => success exit.\n 25992│ let ok = vec![(\"ee\".to_string(), AdapterUpdateOutcome::SkippedLocal)];\n │...\n 26148│ #[test]\n*26149│ fn bare_update_parses_composite_flags() {\n 26150│ match parse(&[\"spt\", \"update\"]).unwrap().cmd {\n 26151│ Some(Cmd::Update {\n 26152│ action: None,\n │...\n 26197│ #[test]\n*26198│ fn composite_plans_core_first_and_core_only_skips_adapters() {\n 26199│ assert_eq!(\n 26200│ plan_update_legs(false, false),\n 26201│ vec![UpdateLeg::FetchApply, UpdateLeg::Adapters]\n │...\n 28533│ #[test]\n*28534│ fn a_composite_judges_floors_against_the_staged_core_not_the_running_one() {\n 28535│ let meta = staged_set_metadata(42, Some(\"9.9.9\"));\n 28536│\n 28537│ let basis = floor_basis(Some(&meta));\n## rc.rs\n 4181│ let name = spt_daemon::endpoint::broker_socket_name();\n*4182│ let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4183│ identity: spt_proto::identity::Identity::generate(),\n*4184│ relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4185│ discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4186│ scope: spt_net::net::endpoint::BindScope::Loopback,\n 4187│ membership: None,\n │...\n 4627│\n*4628│ let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4629│ identity: spt_proto::identity::Identity::generate(),\n*4630│ relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4631│ discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4632│ scope: spt_net::net::endpoint::BindScope::Loopback,\n 4633│ membership: None,\n │...\n 4753│ let start_net_broker = |name: &str, tag: &str| {\n*4754│ let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4755│ identity: spt_proto::identity::Identity::generate(),\n*4756│ relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4757│ discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4758│ scope: spt_net::net::endpoint::BindScope::Loopback,\n 4759│ membership: None,\n │...\n 4970│ let name = spt_daemon::endpoint::broker_socket_name();\n*4971│ let host = spt_daemon::nethost::NetHost::start(spt_daemon::nethost::NetConfig {\n 4972│ identity: spt_proto::identity::Identity::from_seed(&[9u8; 32]),\n*4973│ relay: spt_net::net::endpoint::RelayPolicy::Disabled,\n 4974│ discovery: spt_net::net::endpoint::LocalDiscovery::Off,\n 4975│ scope: spt_net::net::endpoint::BindScope::Loopback,\n 4976│ membership: None,\n## wansend.rs\n 2110│ fn net_broker(name: &str, dir: &Path) -> Arc {\n*2111│ let host = NetHost::start(NetConfig {\n 2112│ identity: Identity::generate(),\n*2113│ relay: RelayPolicy::Disabled,\n 2114│ discovery: LocalDiscovery::Off,\n 2115│ scope: BindScope::Loopback,\n 2116│ membership: None,\n\n## api/\n### mod.rs\n 1086│ #[test]\n*1087│ fn load_manifest_resolves_composite_adapter_option() {\n 1088│ let _h = crate::testutil::isolated_home();\n 1089│ let dir = spt_store::perch::spt_home().join(\"mh\");\n 1090│ std::fs::create_dir_all(&dir).unwrap();"},"isError":false,"timestamp":1789114561755}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_s8qOjpTLxMCneArToiwT4CE7|fc_0581413717c88920016aa3b8c1cac887d1bda5efbb919292c9","toolName":"grep","startedAt":"2026-09-11T08:16:07.204Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/daemonhost.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs;.worktrees/hertz-304/crates/spt-daemon/src"},"intent":"Locating real daemon isolation wiring"},"id":"1d524b47","parentId":"2731ca74","timestamp":"2026-09-11T08:16:07.204Z"}
{"type":"message","id":"28067be3","parentId":"1d524b47","timestamp":"2026-09-11T08:16:07.205Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_s8qOjpTLxMCneArToiwT4CE7|fc_0581413717c88920016aa3b8c1cac887d1bda5efbb919292c9","name":"grep","arguments":{"i":"Locating real daemon isolation wiring","pattern":"NetConfig \\{|LocalDiscovery::|BindScope::|relay_policy|SPT_TEST","path":".worktrees/hertz-304/crates/spt-daemon/src/daemonhost.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs;.worktrees/hertz-304/crates/spt-daemon/src","case":null,"gitignore":false,"skip":null},"intent":"Locating real daemon isolation wiring"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":8418,"output":108,"cacheRead":38272,"cacheWrite":0,"totalTokens":46798,"cost":{"input":0.08418,"output":0.0054,"cacheRead":0.038272,"cacheWrite":0,"total":0.12785200000000002}},"stopReason":"toolUse","timestamp":1789114561793,"responseId":"resp_0581413717c88920016aa3b8bfd08087d187e9b91a3bfcc305","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8c1cac887d1bda5efbb919292c9","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating real daemon isolation wiring\",\"pattern\":\"NetConfig \\\\{|LocalDiscovery::|BindScope::|relay_policy|SPT_TEST\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/daemonhost.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs;.worktrees/hertz-304/crates/spt-daemon/src\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_s8qOjpTLxMCneArToiwT4CE7","internal_chat_message_metadata_passthrough":{"create_time":1789114560.083998,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":5409.6505000004545,"ttft":2351.2620999999344,"completedAt":1789114567203,"contextSnapshot":{"promptTokens":46690,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"2f9c0f63","parentId":"28067be3","timestamp":"2026-09-11T08:16:07.222Z","message":{"role":"toolResult","toolCallId":"call_s8qOjpTLxMCneArToiwT4CE7|fc_0581413717c88920016aa3b8c1cac887d1bda5efbb919292c9","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/spt-daemon/src/\n## broker.rs\n 1325|\n*1326|/// TEST-RIG-ONLY WINDOW WIDENER (`SPT_TEST_RESIZE_WINDOW_MS`, unset = 0 = no-op).\n 1327|///\n 1328|/// **DEBUG BUILDS ONLY** — the release twin below is a no-op that never reads the\n 1329|/// environment at all, so no shipped binary can be made to sleep in the resize path\n...\n 1353|fn test_widen_resize_window() {\n*1354| if let Some(ms) = std::env::var(\"SPT_TEST_RESIZE_WINDOW_MS\")\n 1355| .ok()\n 1356| .and_then(|v| v.parse::().ok())\n 1357| .filter(|ms| *ms > 0)\n...\n 6013| // auto-subscribes. TEST-RIG-ONLY valve (the N-1 loud-fail leg):\n*6014| // with SPT_TEST_SPAWN_FRESH_UNSUPPORTED set this broker answers\n 6015| // EXACTLY like an N-1 broker that predates the verb — the\n 6016| // forward-compat unknown-kind reply, byte-identical. Never set\n 6017| // in production.\n...\n 6019| KIND_SPAWN_FRESH => {\n*6020| if std::env::var(\"SPT_TEST_SPAWN_FRESH_UNSUPPORTED\").is_ok() {\n 6021| send_error(&send, &format!(\"unknown command kind {:?}\", env.kind));\n 6022| } else {\n 6023| match self.dispatch_spawn_fresh(env, &send) {\n...\n 6164| // TEST-RIG-ONLY (T7 mixed-image N-1): with\n*6165| // SPT_TEST_STREAM_OPENER_UNSUPPORTED set this broker\n 6166| // answers the verb EXACTLY like an N-1 broker that\n 6167| // predates it — the forward-compat unknown-kind reply\n 6168| // below, byte-identical (the stable KH-2.3 wire fact the\n...\n 6170| // production.\n*6171| if std::env::var(\"SPT_TEST_STREAM_OPENER_UNSUPPORTED\").is_ok() {\n 6172| send_error(&send, &format!(\"unknown command kind {:?}\", env.kind));\n 6173| } else if let Err(msg) = self.dispatch_net_stream_opener(env, &send) {\n 6174| send_error(&send, &msg);\n...\n 8389| // NOT the same kind of valve as this file's two siblings\n*8390| // (SPT_TEST_SPAWN_FRESH_UNSUPPORTED / SPT_TEST_STREAM_OPENER_UNSUPPORTED):\n 8391| // those make this broker answer like an OLDER broker — a state that\n 8392| // genuinely exists in the fleet — whereas this one makes it a BROKEN\n 8393| // one. It SUPPRESSES a correctness mechanism, so tripping it in the\n...\n 8405| // [impl->REQ-LIVENESS-ORACLE-SOUND]\n*8406| let waiter_suppressed = std::env::var(\"SPT_TEST_EXIT_WAITER_SUPPRESSED\").is_ok();\n 8407| // TEST-RIG-ONLY FAULT INJECTION. Never set in production.\n 8408| //\n 8409| // The NARROW sibling of the valve above, and it exists because that one\n...\n 8431| // by the emission below, not by this valve.\n*8432| let wait_err_injected = std::env::var(\"SPT_TEST_EXIT_WAIT_ERR\").is_ok();\n 8433| thread::spawn(move || {\n 8434| if waiter_suppressed {\n 8435| // Never wait, never remove the row: the session stays tabled\n...\n 8445| Err(spt_term::SurfaceError::Io(io::Error::other(\n*8446| \"SPT_TEST_EXIT_WAIT_ERR\",\n 8447| )))\n 8448| } else {\n 8449| status\n## daemon.rs\n 535| let identity = spt_store::nodeid::load_or_create().ok()?;\n*536| let net_cfg = NetConfig {\n 537| identity,\n 538| relay,\n*539| discovery: LocalDiscovery::Mdns,\n*540| scope: BindScope::All, // production: real interfaces\n 541| // Mesh-D2: enforce seed-proof on every dial + accept, reading the live\n 542| // subnet store each connect.\n 543| membership: Some(crate::seedproofx::production_membership()),\n## docshost.rs\n 93|/// production well-known ports shared with resident fleet daemons.\n*94|pub const TEST_EPHEMERAL_ADVISORY_PORTS_ENV: &str = \"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\";\n 95|\n 96|/// Resolve the effective docs port: env override > config > default. A\n 97|/// malformed env value degrades to the next layer (a broken override must\n## nethost.rs\n 87|/// tests), and whether mDNS LAN discovery rides along.\n*88|pub struct NetConfig {\n 89| /// The node identity the endpoint binds as (seed → same ed25519 keypair).\n 90| pub identity: Identity,\n 91| /// Relay stance (ADR-0002): n0 default / self-host / disabled.\n...\n 94| pub discovery: LocalDiscovery,\n*95| /// Socket bind scope: [`BindScope::All`] in production;\n*96| /// [`BindScope::Loopback`] in hermetic tests (no real interface touched,\n 97| /// no per-test-binary Windows firewall prompt).\n 98| pub scope: BindScope,\n 99| /// Live source of this node's subnet credentials for the connect-time\n...\n 1284| // scopes keep the decision-18 offset correction.\n*1285| spt_net::net::pairing::ntp::set_enabled(!matches!(cfg.scope, BindScope::Loopback));\n 1286| let runtime = tokio::runtime::Builder::new_multi_thread()\n 1287| .worker_threads(2)\n 1288| .thread_name(\"spt-broker-net\")\n...\n 2339|\n*2340| fn hermetic(identity: &Identity) -> NetConfig {\n*2341| NetConfig {\n 2342| identity: Identity::from_seed(&identity.seed()),\n 2343| relay: RelayPolicy::Disabled,\n*2344| discovery: LocalDiscovery::Off,\n*2345| scope: BindScope::Loopback,\n 2346| membership: None,\n 2347| }\n 2348| }\n## pairhost.rs\n 165|/// daemon must keep running net-less-for-pairing rather than die. A\n*166|/// [`BindScope::Port`] scope is mapped to [`BindScope::All`] — the fixed\n 167|/// port belongs to the main endpoint; a second bind on it would always fail.\n 168|// [impl->REQ-SUBNET-2]\n 169|pub fn spawn_meet_rotation(\n...\n 176| let scope = match scope {\n*177| BindScope::Port(_) => BindScope::All,\n 178| s => s,\n 179| };\n 180| handle.spawn(async move {\n\n## pump/\n### mod.rs\n 2750| let dir = tempfile::tempdir().unwrap();\n*2751| let host = NetHost::start(NetConfig {\n 2752| identity: Identity::generate(),\n 2753| relay: RelayPolicy::Disabled,\n*2754| discovery: LocalDiscovery::Off,\n*2755| scope: BindScope::Loopback,\n 2756| membership: None,\n 2757| })\n 2758| .expect(\"net host\");\n\nSkipped missing paths: .worktrees/hertz-304/crates/spt-daemon/src/daemonhost.rs"}],"details":{"scopePath":".worktrees/hertz-304/crates/spt-daemon/src/config.rs, .worktrees/hertz-304/crates/spt-daemon/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":27,"fileCount":6,"files":[".worktrees/hertz-304/crates/spt-daemon/src/broker.rs",".worktrees/hertz-304/crates/spt-daemon/src/daemon.rs",".worktrees/hertz-304/crates/spt-daemon/src/docshost.rs",".worktrees/hertz-304/crates/spt-daemon/src/nethost.rs",".worktrees/hertz-304/crates/spt-daemon/src/pairhost.rs",".worktrees/hertz-304/crates/spt-daemon/src/pump/mod.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/spt-daemon/src/broker.rs","count":10},{"path":".worktrees/hertz-304/crates/spt-daemon/src/daemon.rs","count":3},{"path":".worktrees/hertz-304/crates/spt-daemon/src/docshost.rs","count":1},{"path":".worktrees/hertz-304/crates/spt-daemon/src/nethost.rs","count":8},{"path":".worktrees/hertz-304/crates/spt-daemon/src/pairhost.rs","count":2},{"path":".worktrees/hertz-304/crates/spt-daemon/src/pump/mod.rs","count":3}],"truncated":false,"displayContent":"# .worktrees/hertz-304/crates/spt-daemon/src/\n## broker.rs\n 1325│\n*1326│/// TEST-RIG-ONLY WINDOW WIDENER (`SPT_TEST_RESIZE_WINDOW_MS`, unset = 0 = no-op).\n 1327│///\n 1328│/// **DEBUG BUILDS ONLY** — the release twin below is a no-op that never reads the\n 1329│/// environment at all, so no shipped binary can be made to sleep in the resize path\n │...\n 1353│fn test_widen_resize_window() {\n*1354│ if let Some(ms) = std::env::var(\"SPT_TEST_RESIZE_WINDOW_MS\")\n 1355│ .ok()\n 1356│ .and_then(|v| v.parse::().ok())\n 1357│ .filter(|ms| *ms > 0)\n │...\n 6013│ // auto-subscribes. TEST-RIG-ONLY valve (the N-1 loud-fail leg):\n*6014│ // with SPT_TEST_SPAWN_FRESH_UNSUPPORTED set this broker answers\n 6015│ // EXACTLY like an N-1 broker that predates the verb — the\n 6016│ // forward-compat unknown-kind reply, byte-identical. Never set\n 6017│ // in production.\n │...\n 6019│ KIND_SPAWN_FRESH => {\n*6020│ if std::env::var(\"SPT_TEST_SPAWN_FRESH_UNSUPPORTED\").is_ok() {\n 6021│ send_error(&send, &format!(\"unknown command kind {:?}\", env.kind));\n 6022│ } else {\n 6023│ match self.dispatch_spawn_fresh(env, &send) {\n │...\n 6164│ // TEST-RIG-ONLY (T7 mixed-image N-1): with\n*6165│ // SPT_TEST_STREAM_OPENER_UNSUPPORTED set this broker\n 6166│ // answers the verb EXACTLY like an N-1 broker that\n 6167│ // predates it — the forward-compat unknown-kind reply\n 6168│ // below, byte-identical (the stable KH-2.3 wire fact the\n │...\n 6170│ // production.\n*6171│ if std::env::var(\"SPT_TEST_STREAM_OPENER_UNSUPPORTED\").is_ok() {\n 6172│ send_error(&send, &format!(\"unknown command kind {:?}\", env.kind));\n 6173│ } else if let Err(msg) = self.dispatch_net_stream_opener(env, &send) {\n 6174│ send_error(&send, &msg);\n │...\n 8389│ // NOT the same kind of valve as this file's two siblings\n*8390│ // (SPT_TEST_SPAWN_FRESH_UNSUPPORTED / SPT_TEST_STREAM_OPENER_UNSUPPORTED):\n 8391│ // those make this broker answer like an OLDER broker — a state that\n 8392│ // genuinely exists in the fleet — whereas this one makes it a BROKEN\n 8393│ // one. It SUPPRESSES a correctness mechanism, so tripping it in the\n │...\n 8405│ // [impl->REQ-LIVENESS-ORACLE-SOUND]\n*8406│ let waiter_suppressed = std::env::var(\"SPT_TEST_EXIT_WAITER_SUPPRESSED\").is_ok();\n 8407│ // TEST-RIG-ONLY FAULT INJECTION. Never set in production.\n 8408│ //\n 8409│ // The NARROW sibling of the valve above, and it exists because that one\n │...\n 8431│ // by the emission below, not by this valve.\n*8432│ let wait_err_injected = std::env::var(\"SPT_TEST_EXIT_WAIT_ERR\").is_ok();\n 8433│ thread::spawn(move || {\n 8434│ if waiter_suppressed {\n 8435│ // Never wait, never remove the row: the session stays tabled\n │...\n 8445│ Err(spt_term::SurfaceError::Io(io::Error::other(\n*8446│ \"SPT_TEST_EXIT_WAIT_ERR\",\n 8447│ )))\n 8448│ } else {\n 8449│ status\n## daemon.rs\n 535│ let identity = spt_store::nodeid::load_or_create().ok()?;\n*536│ let net_cfg = NetConfig {\n 537│ identity,\n 538│ relay,\n*539│ discovery: LocalDiscovery::Mdns,\n*540│ scope: BindScope::All, // production: real interfaces\n 541│ // Mesh-D2: enforce seed-proof on every dial + accept, reading the live\n 542│ // subnet store each connect.\n 543│ membership: Some(crate::seedproofx::production_membership()),\n## docshost.rs\n 93│/// production well-known ports shared with resident fleet daemons.\n*94│pub const TEST_EPHEMERAL_ADVISORY_PORTS_ENV: &str = \"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\";\n 95│\n 96│/// Resolve the effective docs port: env override > config > default. A\n 97│/// malformed env value degrades to the next layer (a broken override must\n## nethost.rs\n 87│/// tests), and whether mDNS LAN discovery rides along.\n *88│pub struct NetConfig {\n 89│ /// The node identity the endpoint binds as (seed → same ed25519 keypair).\n 90│ pub identity: Identity,\n 91│ /// Relay stance (ADR-0002): n0 default / self-host / disabled.\n │...\n 94│ pub discovery: LocalDiscovery,\n *95│ /// Socket bind scope: [`BindScope::All`] in production;\n *96│ /// [`BindScope::Loopback`] in hermetic tests (no real interface touched,\n 97│ /// no per-test-binary Windows firewall prompt).\n 98│ pub scope: BindScope,\n 99│ /// Live source of this node's subnet credentials for the connect-time\n │...\n 1284│ // scopes keep the decision-18 offset correction.\n*1285│ spt_net::net::pairing::ntp::set_enabled(!matches!(cfg.scope, BindScope::Loopback));\n 1286│ let runtime = tokio::runtime::Builder::new_multi_thread()\n 1287│ .worker_threads(2)\n 1288│ .thread_name(\"spt-broker-net\")\n │...\n 2339│\n*2340│ fn hermetic(identity: &Identity) -> NetConfig {\n*2341│ NetConfig {\n 2342│ identity: Identity::from_seed(&identity.seed()),\n 2343│ relay: RelayPolicy::Disabled,\n*2344│ discovery: LocalDiscovery::Off,\n*2345│ scope: BindScope::Loopback,\n 2346│ membership: None,\n 2347│ }\n 2348│ }\n## pairhost.rs\n 165│/// daemon must keep running net-less-for-pairing rather than die. A\n*166│/// [`BindScope::Port`] scope is mapped to [`BindScope::All`] — the fixed\n 167│/// port belongs to the main endpoint; a second bind on it would always fail.\n 168│// [impl->REQ-SUBNET-2]\n 169│pub fn spawn_meet_rotation(\n │...\n 176│ let scope = match scope {\n*177│ BindScope::Port(_) => BindScope::All,\n 178│ s => s,\n 179│ };\n 180│ handle.spawn(async move {\n\n## pump/\n### mod.rs\n 2750│ let dir = tempfile::tempdir().unwrap();\n*2751│ let host = NetHost::start(NetConfig {\n 2752│ identity: Identity::generate(),\n 2753│ relay: RelayPolicy::Disabled,\n*2754│ discovery: LocalDiscovery::Off,\n*2755│ scope: BindScope::Loopback,\n 2756│ membership: None,\n 2757│ })\n 2758│ .expect(\"net host\");","missingPaths":[".worktrees/hertz-304/crates/spt-daemon/src/daemonhost.rs"]},"isError":false,"timestamp":1789114567222}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_omWDctQjvJyrSsK4VwhKE5si|fc_0581413717c88920016aa3b8cf36e087d19a02593503cca461","toolName":"read","startedAt":"2026-09-11T08:16:17.616Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/daemon.rs:480-568"},"intent":"Reading daemon network startup"},"id":"c8d09714","parentId":"2f9c0f63","timestamp":"2026-09-11T08:16:17.616Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_FW8NqZBYfj4MqzedmpXMMU2o|fc_0581413717c88920016aa3b8cf374487d18d67b821600455a6","toolName":"read","startedAt":"2026-09-11T08:16:17.616Z","args":{"path":".worktrees/hertz-304/crates/spt/src/cli.rs:9450-9557"},"intent":"Reading composite execution order"},"id":"7badce00","parentId":"c8d09714","timestamp":"2026-09-11T08:16:17.616Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Uzbnq1wA4HEQ1i4q2zItPn7r|fc_0581413717c88920016aa3b8cf375487d1a7b2e525e585e01b","toolName":"read","startedAt":"2026-09-11T08:16:17.616Z","args":{"path":".worktrees/hertz-304/crates/xtask/src/main.rs:2343-2477"},"intent":"Reading fixture staging tooling"},"id":"f5a5c17b","parentId":"7badce00","timestamp":"2026-09-11T08:16:17.616Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_OATATkoYNOlyrGSgVND1Qmub|fc_0581413717c88920016aa3b8cf376c87d19efa8f1636349757","toolName":"grep","startedAt":"2026-09-11T08:16:17.616Z","args":{"path":".worktrees/hertz-304/crates/spt/src/cli.rs:9600-10400;.worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs"},"intent":"Finding apply polling budgets"},"id":"b0734119","parentId":"f5a5c17b","timestamp":"2026-09-11T08:16:17.616Z"}
{"type":"message","id":"d149b99e","parentId":"b0734119","timestamp":"2026-09-11T08:16:17.616Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_omWDctQjvJyrSsK4VwhKE5si|fc_0581413717c88920016aa3b8cf36e087d19a02593503cca461","name":"read","arguments":{"i":"Reading daemon network startup","path":".worktrees/hertz-304/crates/spt-daemon/src/daemon.rs:480-568"},"intent":"Reading daemon network startup"},{"type":"toolCall","id":"call_FW8NqZBYfj4MqzedmpXMMU2o|fc_0581413717c88920016aa3b8cf374487d18d67b821600455a6","name":"read","arguments":{"i":"Reading composite execution order","path":".worktrees/hertz-304/crates/spt/src/cli.rs:9450-9557"},"intent":"Reading composite execution order"},{"type":"toolCall","id":"call_Uzbnq1wA4HEQ1i4q2zItPn7r|fc_0581413717c88920016aa3b8cf375487d1a7b2e525e585e01b","name":"read","arguments":{"i":"Reading fixture staging tooling","path":".worktrees/hertz-304/crates/xtask/src/main.rs:2343-2477"},"intent":"Reading fixture staging tooling"},{"type":"toolCall","id":"call_OATATkoYNOlyrGSgVND1Qmub|fc_0581413717c88920016aa3b8cf376c87d19efa8f1636349757","name":"grep","arguments":{"i":"Finding apply polling budgets","pattern":"from_secs|AppliedPending|applied_state|brain.ready|timeout","path":".worktrees/hertz-304/crates/spt/src/cli.rs:9600-10400;.worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs","case":null,"gitignore":false,"skip":null},"intent":"Finding apply polling budgets"},{"type":"toolCall","id":"call_hS5BOpDxgBQa2MKUZw3VogmD|fc_0581413717c88920016aa3b8cf377487d1b0d233fa023d82df","name":"read","arguments":{"i":"Reading private identity encoding","path":".worktrees/hertz-304/crates/spt-store/src/nodeid.rs"},"intent":"Reading private identity encoding"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":2008,"output":280,"cacheRead":46592,"cacheWrite":0,"totalTokens":48880,"cost":{"input":0.02008,"output":0.014,"cacheRead":0.046591999999999995,"cacheWrite":0,"total":0.080672}},"stopReason":"toolUse","timestamp":1789114567276,"responseId":"resp_0581413717c88920016aa3b8c53af087d1a455fd93f1f034d6","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8cf36e087d19a02593503cca461","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading daemon network startup\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/daemon.rs:480-568\"}","call_id":"call_omWDctQjvJyrSsK4VwhKE5si","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8cf374487d18d67b821600455a6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading composite execution order\",\"path\":\".worktrees/hertz-304/crates/spt/src/cli.rs:9450-9557\"}","call_id":"call_FW8NqZBYfj4MqzedmpXMMU2o","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8cf375487d1a7b2e525e585e01b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading fixture staging tooling\",\"path\":\".worktrees/hertz-304/crates/xtask/src/main.rs:2343-2477\"}","call_id":"call_Uzbnq1wA4HEQ1i4q2zItPn7r","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8cf376c87d19efa8f1636349757","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding apply polling budgets\",\"pattern\":\"from_secs|AppliedPending|applied_state|brain.ready|timeout\",\"path\":\".worktrees/hertz-304/crates/spt/src/cli.rs:9600-10400;.worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs;.worktrees/hertz-304/crates/spt-daemon/src/config.rs\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_OATATkoYNOlyrGSgVND1Qmub","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8cf377487d1b0d233fa023d82df","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading private identity encoding\",\"path\":\".worktrees/hertz-304/crates/spt-store/src/nodeid.rs\"}","call_id":"call_hS5BOpDxgBQa2MKUZw3VogmD","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":10338.673299999908,"ttft":10295.75549999997,"completedAt":1789114577615,"contextSnapshot":{"promptTokens":48600,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_hS5BOpDxgBQa2MKUZw3VogmD|fc_0581413717c88920016aa3b8cf377487d1b0d233fa023d82df","toolName":"read","startedAt":"2026-09-11T08:16:17.617Z","args":{"path":".worktrees/hertz-304/crates/spt-store/src/nodeid.rs"},"intent":"Reading private identity encoding"},"id":"fbff6450","parentId":"d149b99e","timestamp":"2026-09-11T08:16:17.617Z"}
{"type":"message","id":"3b5558c8","parentId":"fbff6450","timestamp":"2026-09-11T08:16:17.619Z","message":{"role":"toolResult","toolCallId":"call_hS5BOpDxgBQa2MKUZw3VogmD|fc_0581413717c88920016aa3b8cf377487d1b0d233fa023d82df","toolName":"read","content":[{"type":"text","text":"//! `node.key` — the node's durable Ed25519 identity (`docs/STORAGE.md`).\n//!\n//! The keypair seed *is* the node's stable name: the iroh `EndpointId` is this\n//! key's public half (D1), trust rows and registry rows reference it, and the\n//! broker's network endpoint binds as it (D4). So it must be created once and\n//! loaded forever — [`load_or_create`] generates + persists a seed only when no\n//! file exists.\n//!\n//! A present-but-corrupt file is an **error, never a silent regeneration**:\n//! regenerating would silently change the node's name, orphaning every trust\n//! store entry and registry row that references the old key. The operator must\n//! decide (restore the file, or deliberately delete it to mint a new identity).\n//!\n//! Stored as the 32-byte seed in lowercase hex — per-node secret material under\n//! [`identity_dir`](crate::perch::identity_dir), never git-tracked, never synced.\n// [impl->REQ-NODE-IDENTITY]\n\nuse std::io;\nuse std::path::Path;\n\nuse spt_proto::identity::{Identity, SEED_LEN};\n\nuse crate::atomic::atomic_write_string_durable;\nuse crate::perch::node_key_file;\n\n/// Failures loading/creating the node identity.\n#[derive(Debug)]\npub enum NodeIdError {\n /// Reading or writing `node.key` failed (message preserved).\n Io(String),\n /// `node.key` exists but does not parse as a 64-char hex seed. Deliberately\n /// NOT auto-regenerated — see the module docs.\n Corrupt,\n}\n\nimpl std::fmt::Display for NodeIdError {\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n match self {\n NodeIdError::Io(e) => write!(f, \"node.key io: {e}\"),\n NodeIdError::Corrupt => write!(\n f,\n \"node.key exists but is corrupt; restore it (or delete it to \\\n deliberately mint a NEW node identity — old trust/registry rows \\\n will not recognize this node)\"\n ),\n }\n }\n}\n\nimpl std::error::Error for NodeIdError {}\n\n/// Load the node identity from the canonical `node.key`, generating + persisting\n/// a fresh one iff the file is absent. The stable-name contract: every call on\n/// the same home yields the same identity.\npub fn load_or_create() -> Result {\n load_or_create_at(&node_key_file())\n}\n\n/// **Non-minting** read: the node identity iff `node.key` already exists and\n/// parses; absent (or corrupt) → `None`. For read-side consumers — the context\n/// marker stamp, the access gate's same-node check — that must never mint an\n/// identity as a side effect (creation belongs to the daemon boot path). A\n/// corrupt key degrades to `None` here (the write proceeds pre-identity); the\n/// loud corrupt-key error stays with [`load_or_create`].\npub fn load_existing() -> Option {\n load_existing_at(&node_key_file())\n}\n\n/// [`load_existing`] against an explicit path (the testable core).\npub fn load_existing_at(path: &Path) -> Option {\n std::fs::read_to_string(path)\n .ok()\n .and_then(|s| parse_seed_hex(s.trim()))\n .map(|seed| Identity::from_seed(&seed))\n}\n\n/// [`load_or_create`] against an explicit path (the testable core).\npub fn load_or_create_at(path: &Path) -> Result {\n match std::fs::read_to_string(path) {\n Ok(s) => parse_seed_hex(s.trim())\n .map(|seed| Identity::from_seed(&seed))\n .ok_or(NodeIdError::Corrupt),\n Err(e) if e.kind() == io::ErrorKind::NotFound => {\n let id = Identity::generate();\n if let Some(parent) = path.parent() {\n if !parent.as_os_str().is_empty() {\n std::fs::create_dir_all(parent).map_err(|e| NodeIdError::Io(e.to_string()))?;\n }\n }\n // Durable atomic write so a crash mid-create can't leave a torn or\n // NUL-zero-filled (= corrupt, = node-bricking) seed file. Identity\n // material: written once, never regenerated on corrupt (nodeid errors\n // rather than mint a new key), so a lost seed is unrecoverable — it pays\n // the fsync (KNOWN-HAZARDS 5.13). [impl->REQ-HAZARD-PERCH-RECORD-POWER-LOSS]\n atomic_write_string_durable(path, &seed_to_hex(&id.seed()))\n .map_err(|e| NodeIdError::Io(e.to_string()))?;\n Ok(id)\n }\n Err(e) => Err(NodeIdError::Io(e.to_string())),\n }\n}\n\nfn seed_to_hex(seed: &[u8; SEED_LEN]) -> String {\n let mut s = String::with_capacity(SEED_LEN * 2);\n for b in seed {\n s.push_str(&format!(\"{b:02x}\"));\n }\n s\n}\n\nfn parse_seed_hex(s: &str) -> Option<[u8; SEED_LEN]> {\n if s.len() != SEED_LEN * 2 || !s.is_ascii() {\n return None;\n }\n let mut seed = [0u8; SEED_LEN];\n for (i, chunk) in s.as_bytes().chunks(2).enumerate() {\n let hex = std::str::from_utf8(chunk).ok()?;\n seed[i] = u8::from_str_radix(hex, 16).ok()?;\n }\n Some(seed)\n}\n\n#[cfg(test)]\nmod tests {\n use super::*;\n\n // [unit->REQ-NODE-IDENTITY] first call creates + persists; every later call\n // loads the SAME identity — the stable-name contract a daemon restart relies on.\n #[test]\n fn create_then_load_is_stable() {\n let dir = tempfile::tempdir().unwrap();\n let path = dir.path().join(\"identity\").join(\"node.key\");\n let first = load_or_create_at(&path).expect(\"create\");\n assert!(path.exists(), \"node.key persisted\");\n let second = load_or_create_at(&path).expect(\"load\");\n assert_eq!(\n first.public_key(),\n second.public_key(),\n \"same identity across loads\"\n );\n }\n\n // [unit->REQ-NODE-IDENTITY] a corrupt node.key errors — it is NEVER silently\n // regenerated (regeneration would change the node's name and orphan trust rows).\n #[test]\n fn corrupt_key_errors_never_regenerates() {\n let dir = tempfile::tempdir().unwrap();\n let path = dir.path().join(\"node.key\");\n std::fs::write(&path, \"not a seed\").unwrap();\n assert!(matches!(\n load_or_create_at(&path),\n Err(NodeIdError::Corrupt)\n ));\n // The corrupt file is left untouched for the operator.\n assert_eq!(std::fs::read_to_string(&path).unwrap(), \"not a seed\");\n }\n\n // [unit->REQ-NODE-IDENTITY] the persisted form round-trips the exact seed\n // (lowercase hex, trailing-whitespace tolerant on read).\n #[test]\n fn seed_hex_round_trips() {\n let dir = tempfile::tempdir().unwrap();\n let path = dir.path().join(\"node.key\");\n let id = load_or_create_at(&path).expect(\"create\");\n let on_disk = std::fs::read_to_string(&path).unwrap();\n assert_eq!(on_disk.len(), SEED_LEN * 2, \"bare 64-char hex\");\n std::fs::write(&path, format!(\"{on_disk}\\n\")).unwrap(); // editor-added newline\n let again = load_or_create_at(&path).expect(\"load trims\");\n assert_eq!(id.public_key(), again.public_key());\n }\n}"}],"details":{"totalLines":171,"displayContent":{"text":"//! `node.key` — the node's durable Ed25519 identity (`docs/STORAGE.md`).\r\n//!\r\n//! The keypair seed *is* the node's stable name: the iroh `EndpointId` is this\r\n//! key's public half (D1), trust rows and registry rows reference it, and the\r\n//! broker's network endpoint binds as it (D4). So it must be created once and\r\n//! loaded forever — [`load_or_create`] generates + persists a seed only when no\r\n//! file exists.\r\n//!\r\n//! A present-but-corrupt file is an **error, never a silent regeneration**:\r\n//! regenerating would silently change the node's name, orphaning every trust\r\n//! store entry and registry row that references the old key. The operator must\r\n//! decide (restore the file, or deliberately delete it to mint a new identity).\r\n//!\r\n//! Stored as the 32-byte seed in lowercase hex — per-node secret material under\r\n//! [`identity_dir`](crate::perch::identity_dir), never git-tracked, never synced.\r\n// [impl->REQ-NODE-IDENTITY]\r\n\r\nuse std::io;\r\nuse std::path::Path;\r\n\r\nuse spt_proto::identity::{Identity, SEED_LEN};\r\n\r\nuse crate::atomic::atomic_write_string_durable;\r\nuse crate::perch::node_key_file;\r\n\r\n/// Failures loading/creating the node identity.\r\n#[derive(Debug)]\r\npub enum NodeIdError {\r\n /// Reading or writing `node.key` failed (message preserved).\r\n Io(String),\r\n /// `node.key` exists but does not parse as a 64-char hex seed. Deliberately\r\n /// NOT auto-regenerated — see the module docs.\r\n Corrupt,\r\n}\r\n\r\nimpl std::fmt::Display for NodeIdError {\r\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\r\n match self {\r\n NodeIdError::Io(e) => write!(f, \"node.key io: {e}\"),\r\n NodeIdError::Corrupt => write!(\r\n f,\r\n \"node.key exists but is corrupt; restore it (or delete it to \\\r\n deliberately mint a NEW node identity — old trust/registry rows \\\r\n will not recognize this node)\"\r\n ),\r\n }\r\n }\r\n}\r\n\r\nimpl std::error::Error for NodeIdError {}\r\n\r\n/// Load the node identity from the canonical `node.key`, generating + persisting\r\n/// a fresh one iff the file is absent. The stable-name contract: every call on\r\n/// the same home yields the same identity.\r\npub fn load_or_create() -> Result {\r\n load_or_create_at(&node_key_file())\r\n}\r\n\r\n/// **Non-minting** read: the node identity iff `node.key` already exists and\r\n/// parses; absent (or corrupt) → `None`. For read-side consumers — the context\r\n/// marker stamp, the access gate's same-node check — that must never mint an\r\n/// identity as a side effect (creation belongs to the daemon boot path). A\r\n/// corrupt key degrades to `None` here (the write proceeds pre-identity); the\r\n/// loud corrupt-key error stays with [`load_or_create`].\r\npub fn load_existing() -> Option {\r\n load_existing_at(&node_key_file())\r\n}\r\n\r\n/// [`load_existing`] against an explicit path (the testable core).\r\npub fn load_existing_at(path: &Path) -> Option {\r\n std::fs::read_to_string(path)\r\n .ok()\r\n .and_then(|s| parse_seed_hex(s.trim()))\r\n .map(|seed| Identity::from_seed(&seed))\r\n}\r\n\r\n/// [`load_or_create`] against an explicit path (the testable core).\r\npub fn load_or_create_at(path: &Path) -> Result {\r\n match std::fs::read_to_string(path) {\r\n Ok(s) => parse_seed_hex(s.trim())\r\n .map(|seed| Identity::from_seed(&seed))\r\n .ok_or(NodeIdError::Corrupt),\r\n Err(e) if e.kind() == io::ErrorKind::NotFound => {\r\n let id = Identity::generate();\r\n if let Some(parent) = path.parent() {\r\n if !parent.as_os_str().is_empty() {\r\n std::fs::create_dir_all(parent).map_err(|e| NodeIdError::Io(e.to_string()))?;\r\n }\r\n }\r\n // Durable atomic write so a crash mid-create can't leave a torn or\r\n // NUL-zero-filled (= corrupt, = node-bricking) seed file. Identity\r\n // material: written once, never regenerated on corrupt (nodeid errors\r\n // rather than mint a new key), so a lost seed is unrecoverable — it pays\r\n // the fsync (KNOWN-HAZARDS 5.13). [impl->REQ-HAZARD-PERCH-RECORD-POWER-LOSS]\r\n atomic_write_string_durable(path, &seed_to_hex(&id.seed()))\r\n .map_err(|e| NodeIdError::Io(e.to_string()))?;\r\n Ok(id)\r\n }\r\n Err(e) => Err(NodeIdError::Io(e.to_string())),\r\n }\r\n}\r\n\r\nfn seed_to_hex(seed: &[u8; SEED_LEN]) -> String {\r\n let mut s = String::with_capacity(SEED_LEN * 2);\r\n for b in seed {\r\n s.push_str(&format!(\"{b:02x}\"));\r\n }\r\n s\r\n}\r\n\r\nfn parse_seed_hex(s: &str) -> Option<[u8; SEED_LEN]> {\r\n if s.len() != SEED_LEN * 2 || !s.is_ascii() {\r\n return None;\r\n }\r\n let mut seed = [0u8; SEED_LEN];\r\n for (i, chunk) in s.as_bytes().chunks(2).enumerate() {\r\n let hex = std::str::from_utf8(chunk).ok()?;\r\n seed[i] = u8::from_str_radix(hex, 16).ok()?;\r\n }\r\n Some(seed)\r\n}\r\n\r\n#[cfg(test)]\r\nmod tests {\r\n use super::*;\r\n\r\n // [unit->REQ-NODE-IDENTITY] first call creates + persists; every later call\r\n // loads the SAME identity — the stable-name contract a daemon restart relies on.\r\n #[test]\r\n fn create_then_load_is_stable() {\r\n let dir = tempfile::tempdir().unwrap();\r\n let path = dir.path().join(\"identity\").join(\"node.key\");\r\n let first = load_or_create_at(&path).expect(\"create\");\r\n assert!(path.exists(), \"node.key persisted\");\r\n let second = load_or_create_at(&path).expect(\"load\");\r\n assert_eq!(\r\n first.public_key(),\r\n second.public_key(),\r\n \"same identity across loads\"\r\n );\r\n }\r\n\r\n // [unit->REQ-NODE-IDENTITY] a corrupt node.key errors — it is NEVER silently\r\n // regenerated (regeneration would change the node's name and orphan trust rows).\r\n #[test]\r\n fn corrupt_key_errors_never_regenerates() {\r\n let dir = tempfile::tempdir().unwrap();\r\n let path = dir.path().join(\"node.key\");\r\n std::fs::write(&path, \"not a seed\").unwrap();\r\n assert!(matches!(\r\n load_or_create_at(&path),\r\n Err(NodeIdError::Corrupt)\r\n ));\r\n // The corrupt file is left untouched for the operator.\r\n assert_eq!(std::fs::read_to_string(&path).unwrap(), \"not a seed\");\r\n }\r\n\r\n // [unit->REQ-NODE-IDENTITY] the persisted form round-trips the exact seed\r\n // (lowercase hex, trailing-whitespace tolerant on read).\r\n #[test]\r\n fn seed_hex_round_trips() {\r\n let dir = tempfile::tempdir().unwrap();\r\n let path = dir.path().join(\"node.key\");\r\n let id = load_or_create_at(&path).expect(\"create\");\r\n let on_disk = std::fs::read_to_string(&path).unwrap();\r\n assert_eq!(on_disk.len(), SEED_LEN * 2, \"bare 64-char hex\");\r\n std::fs::write(&path, format!(\"{on_disk}\\n\")).unwrap(); // editor-added newline\r\n let again = load_or_create_at(&path).expect(\"load trims\");\r\n assert_eq!(id.public_key(), again.public_key());\r\n }\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171]},"fileSize":7142,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-store\\src\\nodeid.rs"}}},"isError":false,"timestamp":1789114577619}}
{"type":"message","id":"7348331a","parentId":"3b5558c8","timestamp":"2026-09-11T08:16:17.635Z","message":{"role":"toolResult","toolCallId":"call_Uzbnq1wA4HEQ1i4q2zItPn7r|fc_0581413717c88920016aa3b8cf375487d1a7b2e525e585e01b","toolName":"read","content":[{"type":"text","text":"// [impl->REQ-UPD-6]\nfn debug_rollout(args: &[String]) {\n let mut key_id = \"dev-debug-2026\".to_string();\n let mut version = None;\n let mut expires_days: u64 = 14;\n let mut stage_dir = None;\n let mut state_path = None;\n let mut build_current = false;\n let mut product_version = String::new();\n let mut channel = \"debug\".to_string();\n let mut artifact_args: Vec = Vec::new();\n let mut it = args.iter();\n while let Some(a) = it.next() {\n match a.as_str() {\n \"--key-id\" => key_id = it.next().cloned().expect(\"--key-id \"),\n \"--product-version\" => {\n product_version = it.next().cloned().expect(\"--product-version \")\n }\n \"--channel\" => channel = it.next().cloned().expect(\"--channel \"),\n \"--version\" => {\n version = Some(\n it.next()\n .and_then(|v| v.parse().ok())\n .expect(\"--version \"),\n )\n }\n \"--expires-days\" => {\n expires_days = it\n .next()\n .and_then(|v| v.parse().ok())\n .expect(\"--expires-days \")\n }\n \"--stage-dir\" => stage_dir = it.next().map(PathBuf::from),\n \"--state\" => state_path = it.next().map(PathBuf::from),\n \"--build-current\" => build_current = true,\n \"--artifact\" => {\n artifact_args.push(it.next().cloned().expect(\"--artifact \"))\n }\n other => panic!(\"unknown arg {other}\"),\n }\n }\n\n let root = repo_root();\n let state_path =\n state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\n let version = version.unwrap_or_else(|| next_debug_version(&state_path));\n let identity = debug_signing_identity();\n\n let mut artifact_paths: Vec<(String, PathBuf)> =\n artifact_args.iter().map(|a| parse_target_path(a)).collect();\n if build_current {\n let path = build_release_spt(&root);\n artifact_paths.push((spt_daemon::current_platform().to_string(), path));\n }\n assert!(\n !artifact_paths.is_empty(),\n \"provide --artifact or --build-current\"\n );\n\n let now = system_time_ms();\n let mut artifact_meta = std::collections::BTreeMap::new();\n let mut artifact_bytes = std::collections::BTreeMap::new();\n for (target, path) in artifact_paths {\n let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!(\"read {}: {e}\", path.display()));\n artifact_meta.insert(\n target.clone(),\n spt_daemon::UpdateArtifactMetadata {\n artifact_sha256: spt_daemon::sha256_hex(&bytes),\n brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n asset_name: path\n .file_name()\n .and_then(|n| n.to_str())\n .map(str::to_string),\n },\n );\n artifact_bytes.insert(target, bytes);\n }\n\n let meta = debug_rollout_meta(\n version,\n &channel,\n &product_version,\n expires_days,\n now,\n &key_id,\n artifact_meta,\n Some(spt_daemon::UpdateSetProvenance {\n git_commit: git_stdout(&root, &[\"rev-parse\", \"HEAD\"]),\n git_dirty: Some(\n git_stdout(&root, &[\"status\", \"--porcelain\"]).is_some_and(|s| !s.is_empty()),\n ),\n build_host: build_host(),\n build_timestamp_ms: Some(now),\n }),\n );\n let metadata_json = serde_json::to_string(&meta).expect(\"serialize update set\");\n let sig = identity.sign(metadata_json.as_bytes());\n let signed = spt_daemon::SignedUpdateSet {\n metadata_json,\n signature_hex: sig.iter().map(|b| format!(\"{b:02x}\")).collect(),\n };\n\n let pub_hex = identity.public_key().to_hex();\n let vk = spt_daemon::parse_verifying_key(&pub_hex).expect(\"debug public key parses\");\n let policy = spt_daemon::VerifyPolicy {\n trusted_keys: std::collections::BTreeMap::from([(key_id.clone(), vk)]),\n revoked_keys: std::collections::BTreeSet::new(),\n pinned_channel: channel.clone(),\n current_version: 0,\n now_ms: now,\n };\n let verified = spt_daemon::verify_update_set_metadata(&signed, &policy)\n .expect(\"freshly signed update set verifies\");\n for (target, bytes) in &artifact_bytes {\n spt_daemon::verify_update_set_artifact(&verified, target, bytes)\n .unwrap_or_else(|e| panic!(\"{target}: artifact verification failed: {e}\"));\n }\n\n let stage_dir = stage_dir.unwrap_or_else(|| spt_store::perch::spt_home().join(\"releases\"));\n spt_daemon::ReleaseCache::open(&stage_dir)\n .stage_update_set(&signed, &artifact_bytes)\n .expect(\"stage debug update set\");\n write_debug_version(&state_path, version);\n println!(\n \"DEBUG_ROLLOUT_STAGED version={version} channel={channel} platforms={} stage_dir={}\",\n verified\n .artifacts\n .keys()\n .cloned()\n .collect::>()\n .join(\",\"),\n stage_dir.display()\n );\n println!(\"Peers pinned to debug will fetch via the normal update pump; run/poke the daemon pump for immediate propagation.\");\n}\n\n/// `xtask debug-converge` (M8 decision 19, REQ-UPD-6,\n/// docs/DEBUG-CONVERGE-PLAN.md): after a coordinator stages a debug rollout,\n\n[Showing lines 2342-2480 of 3732. Use :2481 to continue]"}],"details":{"truncation":{"content":"// [impl->REQ-UPD-6]\r\nfn debug_rollout(args: &[String]) {\r\n let mut key_id = \"dev-debug-2026\".to_string();\r\n let mut version = None;\r\n let mut expires_days: u64 = 14;\r\n let mut stage_dir = None;\r\n let mut state_path = None;\r\n let mut build_current = false;\r\n let mut product_version = String::new();\r\n let mut channel = \"debug\".to_string();\r\n let mut artifact_args: Vec = Vec::new();\r\n let mut it = args.iter();\r\n while let Some(a) = it.next() {\r\n match a.as_str() {\r\n \"--key-id\" => key_id = it.next().cloned().expect(\"--key-id \"),\r\n \"--product-version\" => {\r\n product_version = it.next().cloned().expect(\"--product-version \")\r\n }\r\n \"--channel\" => channel = it.next().cloned().expect(\"--channel \"),\r\n \"--version\" => {\r\n version = Some(\r\n it.next()\r\n .and_then(|v| v.parse().ok())\r\n .expect(\"--version \"),\r\n )\r\n }\r\n \"--expires-days\" => {\r\n expires_days = it\r\n .next()\r\n .and_then(|v| v.parse().ok())\r\n .expect(\"--expires-days \")\r\n }\r\n \"--stage-dir\" => stage_dir = it.next().map(PathBuf::from),\r\n \"--state\" => state_path = it.next().map(PathBuf::from),\r\n \"--build-current\" => build_current = true,\r\n \"--artifact\" => {\r\n artifact_args.push(it.next().cloned().expect(\"--artifact \"))\r\n }\r\n other => panic!(\"unknown arg {other}\"),\r\n }\r\n }\r\n\r\n let root = repo_root();\r\n let state_path =\r\n state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\r\n let version = version.unwrap_or_else(|| next_debug_version(&state_path));\r\n let identity = debug_signing_identity();\r\n\r\n let mut artifact_paths: Vec<(String, PathBuf)> =\r\n artifact_args.iter().map(|a| parse_target_path(a)).collect();\r\n if build_current {\r\n let path = build_release_spt(&root);\r\n artifact_paths.push((spt_daemon::current_platform().to_string(), path));\r\n }\r\n assert!(\r\n !artifact_paths.is_empty(),\r\n \"provide --artifact or --build-current\"\r\n );\r\n\r\n let now = system_time_ms();\r\n let mut artifact_meta = std::collections::BTreeMap::new();\r\n let mut artifact_bytes = std::collections::BTreeMap::new();\r\n for (target, path) in artifact_paths {\r\n let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!(\"read {}: {e}\", path.display()));\r\n artifact_meta.insert(\r\n target.clone(),\r\n spt_daemon::UpdateArtifactMetadata {\r\n artifact_sha256: spt_daemon::sha256_hex(&bytes),\r\n brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\r\n broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\r\n asset_name: path\r\n .file_name()\r\n .and_then(|n| n.to_str())\r\n .map(str::to_string),\r\n },\r\n );\r\n artifact_bytes.insert(target, bytes);\r\n }\r\n\r\n let meta = debug_rollout_meta(\r\n version,\r\n &channel,\r\n &product_version,\r\n expires_days,\r\n now,\r\n &key_id,\r\n artifact_meta,\r\n Some(spt_daemon::UpdateSetProvenance {\r\n git_commit: git_stdout(&root, &[\"rev-parse\", \"HEAD\"]),\r\n git_dirty: Some(\r\n git_stdout(&root, &[\"status\", \"--porcelain\"]).is_some_and(|s| !s.is_empty()),\r\n ),\r\n build_host: build_host(),\r\n build_timestamp_ms: Some(now),\r\n }),\r\n );\r\n let metadata_json = serde_json::to_string(&meta).expect(\"serialize update set\");\r\n let sig = identity.sign(metadata_json.as_bytes());\r\n let signed = spt_daemon::SignedUpdateSet {\r\n metadata_json,\r\n signature_hex: sig.iter().map(|b| format!(\"{b:02x}\")).collect(),\r\n };\r\n\r\n let pub_hex = identity.public_key().to_hex();\r\n let vk = spt_daemon::parse_verifying_key(&pub_hex).expect(\"debug public key parses\");\r\n let policy = spt_daemon::VerifyPolicy {\r\n trusted_keys: std::collections::BTreeMap::from([(key_id.clone(), vk)]),\r\n revoked_keys: std::collections::BTreeSet::new(),\r\n pinned_channel: channel.clone(),\r\n current_version: 0,\r\n now_ms: now,\r\n };\r\n let verified = spt_daemon::verify_update_set_metadata(&signed, &policy)\r\n .expect(\"freshly signed update set verifies\");\r\n for (target, bytes) in &artifact_bytes {\r\n spt_daemon::verify_update_set_artifact(&verified, target, bytes)\r\n .unwrap_or_else(|e| panic!(\"{target}: artifact verification failed: {e}\"));\r\n }\r\n\r\n let stage_dir = stage_dir.unwrap_or_else(|| spt_store::perch::spt_home().join(\"releases\"));\r\n spt_daemon::ReleaseCache::open(&stage_dir)\r\n .stage_update_set(&signed, &artifact_bytes)\r\n .expect(\"stage debug update set\");\r\n write_debug_version(&state_path, version);\r\n println!(\r\n \"DEBUG_ROLLOUT_STAGED version={version} channel={channel} platforms={} stage_dir={}\",\r\n verified\r\n .artifacts\r\n .keys()\r\n .cloned()\r\n .collect::>()\r\n .join(\",\"),\r\n stage_dir.display()\r\n );\r\n println!(\"Peers pinned to debug will fetch via the normal update pump; run/poke the daemon pump for immediate propagation.\");\r\n}\r\n\r\n/// `xtask debug-converge` (M8 decision 19, REQ-UPD-6,\r\n/// docs/DEBUG-CONVERGE-PLAN.md): after a coordinator stages a debug rollout,\r","truncated":true,"truncatedBy":"lines","totalLines":1391,"totalBytes":5698,"outputLines":139,"outputBytes":5698,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3732,"displayContent":{"text":"// [impl->REQ-UPD-6]\r\nfn debug_rollout(args: &[String]) {\r\n let mut key_id = \"dev-debug-2026\".to_string();\r\n let mut version = None;\r\n let mut expires_days: u64 = 14;\r\n let mut stage_dir = None;\r\n let mut state_path = None;\r\n let mut build_current = false;\r\n let mut product_version = String::new();\r\n let mut channel = \"debug\".to_string();\r\n let mut artifact_args: Vec = Vec::new();\r\n let mut it = args.iter();\r\n while let Some(a) = it.next() {\r\n match a.as_str() {\r\n \"--key-id\" => key_id = it.next().cloned().expect(\"--key-id \"),\r\n \"--product-version\" => {\r\n product_version = it.next().cloned().expect(\"--product-version \")\r\n }\r\n \"--channel\" => channel = it.next().cloned().expect(\"--channel \"),\r\n \"--version\" => {\r\n version = Some(\r\n it.next()\r\n .and_then(|v| v.parse().ok())\r\n .expect(\"--version \"),\r\n )\r\n }\r\n \"--expires-days\" => {\r\n expires_days = it\r\n .next()\r\n .and_then(|v| v.parse().ok())\r\n .expect(\"--expires-days \")\r\n }\r\n \"--stage-dir\" => stage_dir = it.next().map(PathBuf::from),\r\n \"--state\" => state_path = it.next().map(PathBuf::from),\r\n \"--build-current\" => build_current = true,\r\n \"--artifact\" => {\r\n artifact_args.push(it.next().cloned().expect(\"--artifact \"))\r\n }\r\n other => panic!(\"unknown arg {other}\"),\r\n }\r\n }\r\n\r\n let root = repo_root();\r\n let state_path =\r\n state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\r\n let version = version.unwrap_or_else(|| next_debug_version(&state_path));\r\n let identity = debug_signing_identity();\r\n\r\n let mut artifact_paths: Vec<(String, PathBuf)> =\r\n artifact_args.iter().map(|a| parse_target_path(a)).collect();\r\n if build_current {\r\n let path = build_release_spt(&root);\r\n artifact_paths.push((spt_daemon::current_platform().to_string(), path));\r\n }\r\n assert!(\r\n !artifact_paths.is_empty(),\r\n \"provide --artifact or --build-current\"\r\n );\r\n\r\n let now = system_time_ms();\r\n let mut artifact_meta = std::collections::BTreeMap::new();\r\n let mut artifact_bytes = std::collections::BTreeMap::new();\r\n for (target, path) in artifact_paths {\r\n let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!(\"read {}: {e}\", path.display()));\r\n artifact_meta.insert(\r\n target.clone(),\r\n spt_daemon::UpdateArtifactMetadata {\r\n artifact_sha256: spt_daemon::sha256_hex(&bytes),\r\n brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\r\n broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\r\n asset_name: path\r\n .file_name()\r\n .and_then(|n| n.to_str())\r\n .map(str::to_string),\r\n },\r\n );\r\n artifact_bytes.insert(target, bytes);\r\n }\r\n\r\n let meta = debug_rollout_meta(\r\n version,\r\n &channel,\r\n &product_version,\r\n expires_days,\r\n now,\r\n &key_id,\r\n artifact_meta,\r\n Some(spt_daemon::UpdateSetProvenance {\r\n git_commit: git_stdout(&root, &[\"rev-parse\", \"HEAD\"]),\r\n git_dirty: Some(\r\n git_stdout(&root, &[\"status\", \"--porcelain\"]).is_some_and(|s| !s.is_empty()),\r\n ),\r\n build_host: build_host(),\r\n build_timestamp_ms: Some(now),\r\n }),\r\n );\r\n let metadata_json = serde_json::to_string(&meta).expect(\"serialize update set\");\r\n let sig = identity.sign(metadata_json.as_bytes());\r\n let signed = spt_daemon::SignedUpdateSet {\r\n metadata_json,\r\n signature_hex: sig.iter().map(|b| format!(\"{b:02x}\")).collect(),\r\n };\r\n\r\n let pub_hex = identity.public_key().to_hex();\r\n let vk = spt_daemon::parse_verifying_key(&pub_hex).expect(\"debug public key parses\");\r\n let policy = spt_daemon::VerifyPolicy {\r\n trusted_keys: std::collections::BTreeMap::from([(key_id.clone(), vk)]),\r\n revoked_keys: std::collections::BTreeSet::new(),\r\n pinned_channel: channel.clone(),\r\n current_version: 0,\r\n now_ms: now,\r\n };\r\n let verified = spt_daemon::verify_update_set_metadata(&signed, &policy)\r\n .expect(\"freshly signed update set verifies\");\r\n for (target, bytes) in &artifact_bytes {\r\n spt_daemon::verify_update_set_artifact(&verified, target, bytes)\r\n .unwrap_or_else(|e| panic!(\"{target}: artifact verification failed: {e}\"));\r\n }\r\n\r\n let stage_dir = stage_dir.unwrap_or_else(|| spt_store::perch::spt_home().join(\"releases\"));\r\n spt_daemon::ReleaseCache::open(&stage_dir)\r\n .stage_update_set(&signed, &artifact_bytes)\r\n .expect(\"stage debug update set\");\r\n write_debug_version(&state_path, version);\r\n println!(\r\n \"DEBUG_ROLLOUT_STAGED version={version} channel={channel} platforms={} stage_dir={}\",\r\n verified\r\n .artifacts\r\n .keys()\r\n .cloned()\r\n .collect::>()\r\n .join(\",\"),\r\n stage_dir.display()\r\n );\r\n println!(\"Peers pinned to debug will fetch via the normal update pump; run/poke the daemon pump for immediate propagation.\");\r\n}\r\n\r\n/// `xtask debug-converge` (M8 decision 19, REQ-UPD-6,\r\n/// docs/DEBUG-CONVERGE-PLAN.md): after a coordinator stages a debug rollout,\r","startLine":2342,"lineNumbers":[2342,2343,2344,2345,2346,2347,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,2370,2371,2372,2373,2374,2375,2376,2377,2378,2379,2380,2381,2382,2383,2384,2385,2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,2428,2429,2430,2431,2432,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,2448,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2465,2466,2467,2468,2469,2470,2471,2472,2473,2474,2475,2476,2477,2478,2479,2480]},"fileSize":159111,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\xtask\\src\\main.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3732,"totalBytes":5698,"outputLines":139,"outputBytes":5698,"shownRange":{"start":2342,"end":2480},"nextOffset":2481}}},"isError":false,"timestamp":1789114577635}}
{"type":"message","id":"ef564f03","parentId":"7348331a","timestamp":"2026-09-11T08:16:17.652Z","message":{"role":"toolResult","toolCallId":"call_omWDctQjvJyrSsK4VwhKE5si|fc_0581413717c88920016aa3b8cf36e087d19a02593503cca461","toolName":"read","content":[{"type":"text","text":"impl Daemon {\n…\n pub fn run() -> io::Result<()> {\n…\n // arbitrates the single-daemon-per-home invariant: a second daemon racing\n // to start fails this bind and exits, leaving the winner serving. It\n // returns only on a graceful `daemon stop` (the KIND_STOP latch).\n let serve = seedmap::serve_seed_control(&seed_socket_name(), reg);\n\n // Graceful-stop reap (REQ-HAZARD-DAEMON-STOP-REAP / Breap): the serve loop\n // returned because a `daemon stop` acked. Stop the supervisor FIRST (so it\n // does not respawn the brain we are about to kill) THEN reap the brain\n // subtree — the brain, its shellwake watchers, and its detached Psyches die\n // with the daemon instead of orphaning as ~8 stray claude-spt-psyche.exe /\n // spt.exe. The daemon is not in the reap container, so this never\n // self-terminates: it returns cleanly below.\n // [impl->REQ-HAZARD-DAEMON-STOP-REAP]\n brain_stop.store(true, std::sync::atomic::Ordering::SeqCst);\n reaper.reap();\n serve\n }\n\n /// Run the brain child (`spt daemon brain`, hidden — ADR-0018 D1). The\n /// broker process spawns + supervises this; it connects to the broker over\n /// the existing socket IPC, signals ready, and idles. Not a user-facing\n /// entry — `spt daemon run` (the broker) launches it. The broker stamps\n /// `{generation, start-reason}` onto the argv (ADR-0018 V2); `start_reason`\n /// is parsed leniently ([`crate::brainproc::StartReason::from_arg`]) so an\n /// unknown value from a newer broker defaults to `Cold` (KH-2.3).\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n pub fn run_brain(generation: u64, start_reason: &str) -> io::Result<()> {\n // Identity-env sanitize (F-036) — same first-thing scrub as the broker\n // entry: the brain is normally broker-spawned (already clean), but a\n // dev/manual `spt daemon brain` from inside a session must not carry\n // that session's identity into the brain's role spawns either.\n // [impl->REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE]\n spt_runtime::scrub_identity_env();\n // Anchor the monotonic half of the stderr correlation stamps at\n // process start (F-039 leg c). [impl->REQ-CONN-POISON-ATTRIBUTION]\n crate::conn::init_log_anchor();\n crate::brainproc::run_brain(\n generation,\n crate::brainproc::StartReason::from_arg(start_reason),\n )\n }\n}\n\n/// Try to bring up the broker's network host once: build the production\n/// `NetConfig` (durable node.key + relay/discovery/membership) and start the\n/// endpoint, wiring on-connect roster propagation (REQ-MESH-2). `None` on a\n/// `NET_BIND_FAIL` (e.g. the network/DNS stack not ready yet) or a missing\n/// identity — the caller binds net-less and (REQ-DAEMON-9) retries.\n// [impl->REQ-DAEMON-2]\n// [impl->REQ-DAEMON-9]\nfn try_start_net() -> Option {\n let cfg = DaemonConfig::load();\n let relay = match cfg.relay {\n RelayChoice::N0 => RelayPolicy::N0Default,\n RelayChoice::Disabled => RelayPolicy::Disabled,\n };\n let identity = spt_store::nodeid::load_or_create().ok()?;\n let net_cfg = NetConfig {\n identity,\n relay,\n discovery: LocalDiscovery::Mdns,\n scope: BindScope::All, // production: real interfaces\n // Mesh-D2: enforce seed-proof on every dial + accept, reading the live\n // subnet store each connect.\n membership: Some(crate::seedproofx::production_membership()),\n };\n match NetHost::start(net_cfg) {\n Ok(host) => {\n host.set_roster_exchange(crate::seedproofx::production_roster_exchange());\n // Inbound-reachability verify (releases#43). It belongs HERE, not\n // inside NetHost::start: the CLI starts short-lived net hosts too\n // (rc, wansend), and they bind sockets without being the daemon —\n // deciding (or repairing) a firewall rule against one of them would\n // point it at whichever build ran a command. This call site IS the\n // daemon, binding the production endpoint it will serve on, so the\n // process asking about its own reachability is the one peers reach.\n // Re-runs on every successful bind, including the REQ-DAEMON-9\n // self-heal retry — the port is new each time.\n if let Some(port) = host.bound_port() {\n crate::firewall::verify_and_record_self(port);\n }\n Some(host)\n }\n Err(e) => {\n spt_proto::emit_line_err!(\"NET_BIND_FAIL: {e} — broker runs net-less\");\n None\n }\n }\n}\n\n/// Background net self-heal supervisor (REQ-DAEMON-9): a daemon that came up\n/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\n/// up) keeps retrying `try_start_net` with capped backoff and, on success,\n\n[Showing lines 479-571 of 3532. Use :572 to continue]"}],"details":{"truncation":{"content":" // arbitrates the single-daemon-per-home invariant: a second daemon racing\r\n // to start fails this bind and exits, leaving the winner serving. It\r\n // returns only on a graceful `daemon stop` (the KIND_STOP latch).\r\n let serve = seedmap::serve_seed_control(&seed_socket_name(), reg);\r\n\r\n // Graceful-stop reap (REQ-HAZARD-DAEMON-STOP-REAP / Breap): the serve loop\r\n // returned because a `daemon stop` acked. Stop the supervisor FIRST (so it\r\n // does not respawn the brain we are about to kill) THEN reap the brain\r\n // subtree — the brain, its shellwake watchers, and its detached Psyches die\r\n // with the daemon instead of orphaning as ~8 stray claude-spt-psyche.exe /\r\n // spt.exe. The daemon is not in the reap container, so this never\r\n // self-terminates: it returns cleanly below.\r\n // [impl->REQ-HAZARD-DAEMON-STOP-REAP]\r\n brain_stop.store(true, std::sync::atomic::Ordering::SeqCst);\r\n reaper.reap();\r\n serve\r\n }\r\n\r\n /// Run the brain child (`spt daemon brain`, hidden — ADR-0018 D1). The\r\n /// broker process spawns + supervises this; it connects to the broker over\r\n /// the existing socket IPC, signals ready, and idles. Not a user-facing\r\n /// entry — `spt daemon run` (the broker) launches it. The broker stamps\r\n /// `{generation, start-reason}` onto the argv (ADR-0018 V2); `start_reason`\r\n /// is parsed leniently ([`crate::brainproc::StartReason::from_arg`]) so an\r\n /// unknown value from a newer broker defaults to `Cold` (KH-2.3).\r\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n pub fn run_brain(generation: u64, start_reason: &str) -> io::Result<()> {\r\n // Identity-env sanitize (F-036) — same first-thing scrub as the broker\r\n // entry: the brain is normally broker-spawned (already clean), but a\r\n // dev/manual `spt daemon brain` from inside a session must not carry\r\n // that session's identity into the brain's role spawns either.\r\n // [impl->REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE]\r\n spt_runtime::scrub_identity_env();\r\n // Anchor the monotonic half of the stderr correlation stamps at\r\n // process start (F-039 leg c). [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n crate::conn::init_log_anchor();\r\n crate::brainproc::run_brain(\r\n generation,\r\n crate::brainproc::StartReason::from_arg(start_reason),\r\n )\r\n }\r\n}\r\n\r\n/// Try to bring up the broker's network host once: build the production\r\n/// `NetConfig` (durable node.key + relay/discovery/membership) and start the\r\n/// endpoint, wiring on-connect roster propagation (REQ-MESH-2). `None` on a\r\n/// `NET_BIND_FAIL` (e.g. the network/DNS stack not ready yet) or a missing\r\n/// identity — the caller binds net-less and (REQ-DAEMON-9) retries.\r\n// [impl->REQ-DAEMON-2]\r\n// [impl->REQ-DAEMON-9]\r\nfn try_start_net() -> Option {\r\n let cfg = DaemonConfig::load();\r\n let relay = match cfg.relay {\r\n RelayChoice::N0 => RelayPolicy::N0Default,\r\n RelayChoice::Disabled => RelayPolicy::Disabled,\r\n };\r\n let identity = spt_store::nodeid::load_or_create().ok()?;\r\n let net_cfg = NetConfig {\r\n identity,\r\n relay,\r\n discovery: LocalDiscovery::Mdns,\r\n scope: BindScope::All, // production: real interfaces\r\n // Mesh-D2: enforce seed-proof on every dial + accept, reading the live\r\n // subnet store each connect.\r\n membership: Some(crate::seedproofx::production_membership()),\r\n };\r\n match NetHost::start(net_cfg) {\r\n Ok(host) => {\r\n host.set_roster_exchange(crate::seedproofx::production_roster_exchange());\r\n // Inbound-reachability verify (releases#43). It belongs HERE, not\r\n // inside NetHost::start: the CLI starts short-lived net hosts too\r\n // (rc, wansend), and they bind sockets without being the daemon —\r\n // deciding (or repairing) a firewall rule against one of them would\r\n // point it at whichever build ran a command. This call site IS the\r\n // daemon, binding the production endpoint it will serve on, so the\r\n // process asking about its own reachability is the one peers reach.\r\n // Re-runs on every successful bind, including the REQ-DAEMON-9\r\n // self-heal retry — the port is new each time.\r\n if let Some(port) = host.bound_port() {\r\n crate::firewall::verify_and_record_self(port);\r\n }\r\n Some(host)\r\n }\r\n Err(e) => {\r\n spt_proto::emit_line_err!(\"NET_BIND_FAIL: {e} — broker runs net-less\");\r\n None\r\n }\r\n }\r\n}\r\n\r\n/// Background net self-heal supervisor (REQ-DAEMON-9): a daemon that came up\r\n/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\r\n/// up) keeps retrying `try_start_net` with capped backoff and, on success,\r","truncated":true,"truncatedBy":"lines","totalLines":3054,"totalBytes":4990,"outputLines":93,"outputBytes":4990,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3532,"displayContent":{"text":"impl Daemon {\n…\n pub fn run() -> io::Result<()> {\n…\n // arbitrates the single-daemon-per-home invariant: a second daemon racing\r\n // to start fails this bind and exits, leaving the winner serving. It\r\n // returns only on a graceful `daemon stop` (the KIND_STOP latch).\r\n let serve = seedmap::serve_seed_control(&seed_socket_name(), reg);\r\n\r\n // Graceful-stop reap (REQ-HAZARD-DAEMON-STOP-REAP / Breap): the serve loop\r\n // returned because a `daemon stop` acked. Stop the supervisor FIRST (so it\r\n // does not respawn the brain we are about to kill) THEN reap the brain\r\n // subtree — the brain, its shellwake watchers, and its detached Psyches die\r\n // with the daemon instead of orphaning as ~8 stray claude-spt-psyche.exe /\r\n // spt.exe. The daemon is not in the reap container, so this never\r\n // self-terminates: it returns cleanly below.\r\n // [impl->REQ-HAZARD-DAEMON-STOP-REAP]\r\n brain_stop.store(true, std::sync::atomic::Ordering::SeqCst);\r\n reaper.reap();\r\n serve\r\n }\r\n\r\n /// Run the brain child (`spt daemon brain`, hidden — ADR-0018 D1). The\r\n /// broker process spawns + supervises this; it connects to the broker over\r\n /// the existing socket IPC, signals ready, and idles. Not a user-facing\r\n /// entry — `spt daemon run` (the broker) launches it. The broker stamps\r\n /// `{generation, start-reason}` onto the argv (ADR-0018 V2); `start_reason`\r\n /// is parsed leniently ([`crate::brainproc::StartReason::from_arg`]) so an\r\n /// unknown value from a newer broker defaults to `Cold` (KH-2.3).\r\n // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n pub fn run_brain(generation: u64, start_reason: &str) -> io::Result<()> {\r\n // Identity-env sanitize (F-036) — same first-thing scrub as the broker\r\n // entry: the brain is normally broker-spawned (already clean), but a\r\n // dev/manual `spt daemon brain` from inside a session must not carry\r\n // that session's identity into the brain's role spawns either.\r\n // [impl->REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE]\r\n spt_runtime::scrub_identity_env();\r\n // Anchor the monotonic half of the stderr correlation stamps at\r\n // process start (F-039 leg c). [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n crate::conn::init_log_anchor();\r\n crate::brainproc::run_brain(\r\n generation,\r\n crate::brainproc::StartReason::from_arg(start_reason),\r\n )\r\n }\r\n}\r\n\r\n/// Try to bring up the broker's network host once: build the production\r\n/// `NetConfig` (durable node.key + relay/discovery/membership) and start the\r\n/// endpoint, wiring on-connect roster propagation (REQ-MESH-2). `None` on a\r\n/// `NET_BIND_FAIL` (e.g. the network/DNS stack not ready yet) or a missing\r\n/// identity — the caller binds net-less and (REQ-DAEMON-9) retries.\r\n// [impl->REQ-DAEMON-2]\r\n// [impl->REQ-DAEMON-9]\r\nfn try_start_net() -> Option {\r\n let cfg = DaemonConfig::load();\r\n let relay = match cfg.relay {\r\n RelayChoice::N0 => RelayPolicy::N0Default,\r\n RelayChoice::Disabled => RelayPolicy::Disabled,\r\n };\r\n let identity = spt_store::nodeid::load_or_create().ok()?;\r\n let net_cfg = NetConfig {\r\n identity,\r\n relay,\r\n discovery: LocalDiscovery::Mdns,\r\n scope: BindScope::All, // production: real interfaces\r\n // Mesh-D2: enforce seed-proof on every dial + accept, reading the live\r\n // subnet store each connect.\r\n membership: Some(crate::seedproofx::production_membership()),\r\n };\r\n match NetHost::start(net_cfg) {\r\n Ok(host) => {\r\n host.set_roster_exchange(crate::seedproofx::production_roster_exchange());\r\n // Inbound-reachability verify (releases#43). It belongs HERE, not\r\n // inside NetHost::start: the CLI starts short-lived net hosts too\r\n // (rc, wansend), and they bind sockets without being the daemon —\r\n // deciding (or repairing) a firewall rule against one of them would\r\n // point it at whichever build ran a command. This call site IS the\r\n // daemon, binding the production endpoint it will serve on, so the\r\n // process asking about its own reachability is the one peers reach.\r\n // Re-runs on every successful bind, including the REQ-DAEMON-9\r\n // self-heal retry — the port is new each time.\r\n if let Some(port) = host.bound_port() {\r\n crate::firewall::verify_and_record_self(port);\r\n }\r\n Some(host)\r\n }\r\n Err(e) => {\r\n spt_proto::emit_line_err!(\"NET_BIND_FAIL: {e} — broker runs net-less\");\r\n None\r\n }\r\n }\r\n}\r\n\r\n/// Background net self-heal supervisor (REQ-DAEMON-9): a daemon that came up\r\n/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\r\n/// up) keeps retrying `try_start_net` with capped backoff and, on success,\r","startLine":43,"lineNumbers":[43,null,47,null,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571]},"fileSize":176265,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src\\daemon.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3532,"totalBytes":4990,"outputLines":93,"outputBytes":4990,"shownRange":{"start":479,"end":571},"nextOffset":572}}},"isError":false,"timestamp":1789114577651}}
{"type":"message","id":"6492763b","parentId":"ef564f03","timestamp":"2026-09-11T08:16:17.808Z","message":{"role":"toolResult","toolCallId":"call_FW8NqZBYfj4MqzedmpXMMU2o|fc_0581413717c88920016aa3b8cf374487d18d67b821600455a6","toolName":"read","content":[{"type":"text","text":"fn cmd_update_apply(finish: bool) -> i32 {\n…\n match outcome {\n…\n Err(e) => {\n…\n }\n }\n}\n\n/// One leg of the bare `spt update` composite (REQ-UPDATE-DEFAULT-COMPOSITE,\n/// REQ-UPDATE-RESTART-SAFE-SWAP).\n#[derive(Debug, PartialEq, Eq, Clone, Copy)]\nenum UpdateLeg {\n /// `update fetch --apply` — stage + install the core in one step (the\n /// brain-only cycle: the invoking process survives by construction).\n FetchApply,\n /// `update fetch` — stage only; the swap waits for the Finish leg.\n Fetch,\n /// `update adapters` — sweep every gh_release adapter.\n Adapters,\n /// `update apply --finish` — swap + full daemon restart. LETHAL: from an\n /// spt-hosted session the invoker's PTY dies here, so this leg is always\n /// planned LAST (everything else has completed by then).\n Finish,\n}\n\n/// Plan the composite's leg sequence — pure, unit-gated. The invariants:\n/// core before adapters (core-first doctrine); `--core-only` drops the\n/// adapters leg; `--restart` replaces the in-place apply with stage-now\n/// (`Fetch`) + `Finish` LAST (lethal-leg-last, operator-ruled: the whole-daemon\n/// restart must be the final act so every other leg completes from ANY\n/// invoking context, including a hosted session whose PTY the finish kills).\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\nfn plan_update_legs(core_only: bool, restart: bool) -> Vec {\n let mut legs = Vec::new();\n legs.push(if restart {\n UpdateLeg::Fetch\n } else {\n UpdateLeg::FetchApply\n });\n if !core_only {\n legs.push(UpdateLeg::Adapters);\n }\n if restart {\n legs.push(UpdateLeg::Finish);\n }\n legs\n}\n\n/// Bare `spt update` — the composite front door (REQ-UPDATE-DEFAULT-COMPOSITE):\n/// core first (`fetch --apply`; an already-current core no-ops and the run\n/// becomes adapters-only), then `update adapters`. The invoker survives the\n/// core leg by construction — apply cycles the BRAIN only, the broker and every\n/// PTY keep running (applyhost::apply_staged) — so no re-run machinery exists.\n/// With `--restart` (REQ-UPDATE-RESTART-SAFE-SWAP) the plan is fetch → adapters\n/// → `apply --finish` LAST: the one-step safe full-cycle swap.\n///\n/// Failure policy: a CORE-leg failure (fetch/apply refused, gh missing…)\n/// ABORTS the remaining legs — updating adapters against a channel that just\n/// refused is compounding, and a `--restart` finish after a failed fetch would\n/// bounce the daemon for nothing. An ADAPTERS-leg failure is isolated (that is\n/// its contract): loud, nonzero at exit, but the composite proceeds — under\n/// `--restart` the finish still completes the core cycle. The accepted\n/// asymmetry (new adapters briefly on old-activated core if the finish itself\n/// fails) is loud and operator-attended by nature of the flag.\n///\n/// Aggregation policy (releases#216): the composite's exit is the WORST leg\n/// outcome by PRECEDENCE — success < refusal (`3`) < failure (any other\n/// nonzero) — folded through [`fold_composite_exit`], never the last nonzero\n/// written. This doc stated the failure policy and said nothing about\n/// aggregation, which is how a refusal masking a failure stayed invisible to a\n/// source reader for as long as it did.\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\nfn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\n let mut worst = 0;\n for leg in plan_update_legs(core_only, restart) {\n let code = match leg {\n UpdateLeg::FetchApply => cmd_update_fetch(None, None, true),\n UpdateLeg::Fetch => cmd_update_fetch(None, None, false),\n // THE COMPOSITE LEG — the only composite entry, and it covers BOTH plans\n // (`plan_update_legs` pushes `Adapters` for the `--restart` and the plain\n // form alike). This is the one caller that must NOT ask about the running\n // core: the new core is staged and the invoking CLI is still the old image,\n // so the floor question is about the core this run will activate.\n // [impl->REQ-ADAPTER-FLOOR-VS-STAGED-CORE]\n UpdateLeg::Adapters => {\n let basis = floor_basis(staged_release_metadata_json().as_deref());\n // Degrade LOUDLY: an absent answer is not a zero, and silently comparing\n // against the running core is how this defect stayed invisible.\n if let Some(notice) = floor_basis_degrade_notice(&basis) {\n eprintln!(\"{notice}\");\n }\n let core_version = floor_basis_version(&basis, env!(\"CARGO_PKG_VERSION\"));\n cmd_adapter_update(&spt_store::perch::adapters_dir(), None, &core_version)\n }\n UpdateLeg::Finish => cmd_update_apply(true),\n };\n if code != 0 {\n if composite_abort_on_failure(leg) {\n eprintln!(\n \"UPDATE_COMPOSITE_ABORTED: the core update failed — the remaining \\\n leg(s) were not run\"\n );\n return code;\n }\n worst = fold_composite_exit(worst, code);\n }\n }\n worst\n}\n\n/// The composite exit CLASS of one leg's code — the fold's whole vocabulary\n/// (releases#216).\n///\n/// Classed BY VALUE, never by which constant minted it: the tree holds TWO\n\n[Showing lines 9449-9560 of 39777. Use :9561 to continue]"}],"details":{"truncation":{"content":" }\r\n }\r\n}\r\n\r\n/// One leg of the bare `spt update` composite (REQ-UPDATE-DEFAULT-COMPOSITE,\r\n/// REQ-UPDATE-RESTART-SAFE-SWAP).\r\n#[derive(Debug, PartialEq, Eq, Clone, Copy)]\r\nenum UpdateLeg {\r\n /// `update fetch --apply` — stage + install the core in one step (the\r\n /// brain-only cycle: the invoking process survives by construction).\r\n FetchApply,\r\n /// `update fetch` — stage only; the swap waits for the Finish leg.\r\n Fetch,\r\n /// `update adapters` — sweep every gh_release adapter.\r\n Adapters,\r\n /// `update apply --finish` — swap + full daemon restart. LETHAL: from an\r\n /// spt-hosted session the invoker's PTY dies here, so this leg is always\r\n /// planned LAST (everything else has completed by then).\r\n Finish,\r\n}\r\n\r\n/// Plan the composite's leg sequence — pure, unit-gated. The invariants:\r\n/// core before adapters (core-first doctrine); `--core-only` drops the\r\n/// adapters leg; `--restart` replaces the in-place apply with stage-now\r\n/// (`Fetch`) + `Finish` LAST (lethal-leg-last, operator-ruled: the whole-daemon\r\n/// restart must be the final act so every other leg completes from ANY\r\n/// invoking context, including a hosted session whose PTY the finish kills).\r\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\r\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\r\nfn plan_update_legs(core_only: bool, restart: bool) -> Vec {\r\n let mut legs = Vec::new();\r\n legs.push(if restart {\r\n UpdateLeg::Fetch\r\n } else {\r\n UpdateLeg::FetchApply\r\n });\r\n if !core_only {\r\n legs.push(UpdateLeg::Adapters);\r\n }\r\n if restart {\r\n legs.push(UpdateLeg::Finish);\r\n }\r\n legs\r\n}\r\n\r\n/// Bare `spt update` — the composite front door (REQ-UPDATE-DEFAULT-COMPOSITE):\r\n/// core first (`fetch --apply`; an already-current core no-ops and the run\r\n/// becomes adapters-only), then `update adapters`. The invoker survives the\r\n/// core leg by construction — apply cycles the BRAIN only, the broker and every\r\n/// PTY keep running (applyhost::apply_staged) — so no re-run machinery exists.\r\n/// With `--restart` (REQ-UPDATE-RESTART-SAFE-SWAP) the plan is fetch → adapters\r\n/// → `apply --finish` LAST: the one-step safe full-cycle swap.\r\n///\r\n/// Failure policy: a CORE-leg failure (fetch/apply refused, gh missing…)\r\n/// ABORTS the remaining legs — updating adapters against a channel that just\r\n/// refused is compounding, and a `--restart` finish after a failed fetch would\r\n/// bounce the daemon for nothing. An ADAPTERS-leg failure is isolated (that is\r\n/// its contract): loud, nonzero at exit, but the composite proceeds — under\r\n/// `--restart` the finish still completes the core cycle. The accepted\r\n/// asymmetry (new adapters briefly on old-activated core if the finish itself\r\n/// fails) is loud and operator-attended by nature of the flag.\r\n///\r\n/// Aggregation policy (releases#216): the composite's exit is the WORST leg\r\n/// outcome by PRECEDENCE — success < refusal (`3`) < failure (any other\r\n/// nonzero) — folded through [`fold_composite_exit`], never the last nonzero\r\n/// written. This doc stated the failure policy and said nothing about\r\n/// aggregation, which is how a refusal masking a failure stayed invisible to a\r\n/// source reader for as long as it did.\r\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\r\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\r\nfn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\r\n let mut worst = 0;\r\n for leg in plan_update_legs(core_only, restart) {\r\n let code = match leg {\r\n UpdateLeg::FetchApply => cmd_update_fetch(None, None, true),\r\n UpdateLeg::Fetch => cmd_update_fetch(None, None, false),\r\n // THE COMPOSITE LEG — the only composite entry, and it covers BOTH plans\r\n // (`plan_update_legs` pushes `Adapters` for the `--restart` and the plain\r\n // form alike). This is the one caller that must NOT ask about the running\r\n // core: the new core is staged and the invoking CLI is still the old image,\r\n // so the floor question is about the core this run will activate.\r\n // [impl->REQ-ADAPTER-FLOOR-VS-STAGED-CORE]\r\n UpdateLeg::Adapters => {\r\n let basis = floor_basis(staged_release_metadata_json().as_deref());\r\n // Degrade LOUDLY: an absent answer is not a zero, and silently comparing\r\n // against the running core is how this defect stayed invisible.\r\n if let Some(notice) = floor_basis_degrade_notice(&basis) {\r\n eprintln!(\"{notice}\");\r\n }\r\n let core_version = floor_basis_version(&basis, env!(\"CARGO_PKG_VERSION\"));\r\n cmd_adapter_update(&spt_store::perch::adapters_dir(), None, &core_version)\r\n }\r\n UpdateLeg::Finish => cmd_update_apply(true),\r\n };\r\n if code != 0 {\r\n if composite_abort_on_failure(leg) {\r\n eprintln!(\r\n \"UPDATE_COMPOSITE_ABORTED: the core update failed — the remaining \\\r\n leg(s) were not run\"\r\n );\r\n return code;\r\n }\r\n worst = fold_composite_exit(worst, code);\r\n }\r\n }\r\n worst\r\n}\r\n\r\n/// The composite exit CLASS of one leg's code — the fold's whole vocabulary\r\n/// (releases#216).\r\n///\r\n/// Classed BY VALUE, never by which constant minted it: the tree holds TWO\r","truncated":true,"truncatedBy":"lines","totalLines":30329,"totalBytes":5465,"outputLines":112,"outputBytes":5465,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":39777,"displayContent":{"text":"fn cmd_update_apply(finish: bool) -> i32 {\n…\n match outcome {\n…\n Err(e) => {\n…\n }\r\n }\r\n}\r\n\r\n/// One leg of the bare `spt update` composite (REQ-UPDATE-DEFAULT-COMPOSITE,\r\n/// REQ-UPDATE-RESTART-SAFE-SWAP).\r\n#[derive(Debug, PartialEq, Eq, Clone, Copy)]\r\nenum UpdateLeg {\r\n /// `update fetch --apply` — stage + install the core in one step (the\r\n /// brain-only cycle: the invoking process survives by construction).\r\n FetchApply,\r\n /// `update fetch` — stage only; the swap waits for the Finish leg.\r\n Fetch,\r\n /// `update adapters` — sweep every gh_release adapter.\r\n Adapters,\r\n /// `update apply --finish` — swap + full daemon restart. LETHAL: from an\r\n /// spt-hosted session the invoker's PTY dies here, so this leg is always\r\n /// planned LAST (everything else has completed by then).\r\n Finish,\r\n}\r\n\r\n/// Plan the composite's leg sequence — pure, unit-gated. The invariants:\r\n/// core before adapters (core-first doctrine); `--core-only` drops the\r\n/// adapters leg; `--restart` replaces the in-place apply with stage-now\r\n/// (`Fetch`) + `Finish` LAST (lethal-leg-last, operator-ruled: the whole-daemon\r\n/// restart must be the final act so every other leg completes from ANY\r\n/// invoking context, including a hosted session whose PTY the finish kills).\r\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\r\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\r\nfn plan_update_legs(core_only: bool, restart: bool) -> Vec {\r\n let mut legs = Vec::new();\r\n legs.push(if restart {\r\n UpdateLeg::Fetch\r\n } else {\r\n UpdateLeg::FetchApply\r\n });\r\n if !core_only {\r\n legs.push(UpdateLeg::Adapters);\r\n }\r\n if restart {\r\n legs.push(UpdateLeg::Finish);\r\n }\r\n legs\r\n}\r\n\r\n/// Bare `spt update` — the composite front door (REQ-UPDATE-DEFAULT-COMPOSITE):\r\n/// core first (`fetch --apply`; an already-current core no-ops and the run\r\n/// becomes adapters-only), then `update adapters`. The invoker survives the\r\n/// core leg by construction — apply cycles the BRAIN only, the broker and every\r\n/// PTY keep running (applyhost::apply_staged) — so no re-run machinery exists.\r\n/// With `--restart` (REQ-UPDATE-RESTART-SAFE-SWAP) the plan is fetch → adapters\r\n/// → `apply --finish` LAST: the one-step safe full-cycle swap.\r\n///\r\n/// Failure policy: a CORE-leg failure (fetch/apply refused, gh missing…)\r\n/// ABORTS the remaining legs — updating adapters against a channel that just\r\n/// refused is compounding, and a `--restart` finish after a failed fetch would\r\n/// bounce the daemon for nothing. An ADAPTERS-leg failure is isolated (that is\r\n/// its contract): loud, nonzero at exit, but the composite proceeds — under\r\n/// `--restart` the finish still completes the core cycle. The accepted\r\n/// asymmetry (new adapters briefly on old-activated core if the finish itself\r\n/// fails) is loud and operator-attended by nature of the flag.\r\n///\r\n/// Aggregation policy (releases#216): the composite's exit is the WORST leg\r\n/// outcome by PRECEDENCE — success < refusal (`3`) < failure (any other\r\n/// nonzero) — folded through [`fold_composite_exit`], never the last nonzero\r\n/// written. This doc stated the failure policy and said nothing about\r\n/// aggregation, which is how a refusal masking a failure stayed invisible to a\r\n/// source reader for as long as it did.\r\n// [impl->REQ-UPDATE-DEFAULT-COMPOSITE]\r\n// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\r\nfn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\r\n let mut worst = 0;\r\n for leg in plan_update_legs(core_only, restart) {\r\n let code = match leg {\r\n UpdateLeg::FetchApply => cmd_update_fetch(None, None, true),\r\n UpdateLeg::Fetch => cmd_update_fetch(None, None, false),\r\n // THE COMPOSITE LEG — the only composite entry, and it covers BOTH plans\r\n // (`plan_update_legs` pushes `Adapters` for the `--restart` and the plain\r\n // form alike). This is the one caller that must NOT ask about the running\r\n // core: the new core is staged and the invoking CLI is still the old image,\r\n // so the floor question is about the core this run will activate.\r\n // [impl->REQ-ADAPTER-FLOOR-VS-STAGED-CORE]\r\n UpdateLeg::Adapters => {\r\n let basis = floor_basis(staged_release_metadata_json().as_deref());\r\n // Degrade LOUDLY: an absent answer is not a zero, and silently comparing\r\n // against the running core is how this defect stayed invisible.\r\n if let Some(notice) = floor_basis_degrade_notice(&basis) {\r\n eprintln!(\"{notice}\");\r\n }\r\n let core_version = floor_basis_version(&basis, env!(\"CARGO_PKG_VERSION\"));\r\n cmd_adapter_update(&spt_store::perch::adapters_dir(), None, &core_version)\r\n }\r\n UpdateLeg::Finish => cmd_update_apply(true),\r\n };\r\n if code != 0 {\r\n if composite_abort_on_failure(leg) {\r\n eprintln!(\r\n \"UPDATE_COMPOSITE_ABORTED: the core update failed — the remaining \\\r\n leg(s) were not run\"\r\n );\r\n return code;\r\n }\r\n worst = fold_composite_exit(worst, code);\r\n }\r\n }\r\n worst\r\n}\r\n\r\n/// The composite exit CLASS of one leg's code — the fold's whole vocabulary\r\n/// (releases#216).\r\n///\r\n/// Classed BY VALUE, never by which constant minted it: the tree holds TWO\r","startLine":9392,"lineNumbers":[9392,null,9435,null,9446,null,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9526,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560]},"fileSize":1816404,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt\\src\\cli.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":39777,"totalBytes":5465,"outputLines":112,"outputBytes":5465,"shownRange":{"start":9449,"end":9560},"nextOffset":9561}}},"isError":false,"timestamp":1789114577808}}
{"type":"message","id":"1aeaf868","parentId":"6492763b","timestamp":"2026-09-11T08:16:17.833Z","message":{"role":"toolResult","toolCallId":"call_OATATkoYNOlyrGSgVND1Qmub|fc_0581413717c88920016aa3b8cf376c87d19efa8f1636349757","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-304/crates/\n\n## spt/src/\n### cli.rs\n 9653| &keys,\n*9654| Duration::from_secs(120),\n 9655| None,\n 9656| ) {\n 9657| Ok(out) if out.success() => {}\n...\n 9720| Ok(o @ O::AppliedDaemonless { .. })\n*9721| | Ok(o @ O::AppliedPending { .. })\n 9722| | Ok(o @ O::AlreadyApplied { .. }) => o,\n 9723| // The fail-closed refusals — nothing swapped, do NOT restart.\n 9724| Ok(refused) => return report_apply_outcome(refused),\n...\n 9749| }\n*9750| let down_by = std::time::Instant::now() + std::time::Duration::from_secs(10);\n 9751| while spt_daemon::is_running() && std::time::Instant::now() < down_by {\n 9752| std::thread::sleep(std::time::Duration::from_millis(50));\n 9753| }\n...\n 9768| }\n*9769| | O::AppliedPending {\n 9770| version,\n 9771| product_version,\n 9772| } => (version, product_version, false),\n...\n 9884|/// exits 0 only when a host is logged in. Bounded (REQ-HAZARD-SUBPROCESS-TIMEOUT);\n*9885|/// any spawn error / non-zero / timeout ⇒ unavailable (fall back to HTTPS).\n 9886|// [impl->REQ-ADAPTER-GH-TRANSPORT]\n 9887|fn gh_available() -> bool {\n 9888| matches!(\n...\n 9891| &std::collections::BTreeMap::new(),\n*9892| Duration::from_secs(10),\n 9893| None,\n 9894| ),\n 9895| Ok(out) if out.success()\n...\n 9914|/// OS package command) vs UNAUTHED (installed but no logged-in host — the fix is\n*9915|/// `gh auth login`). A probe timeout classifies as Unauthed: gh exists (it\n 9916|/// spawned) but cannot answer for its auth state.\n 9917|#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 9918|enum GhStatus {\n...\n 9931| &std::collections::BTreeMap::new(),\n*9932| Duration::from_secs(10),\n 9933| None,\n 9934| ) {\n 9935| Ok(out) if out.success() => GhStatus::Available,\n...\n 10101| &std::collections::BTreeMap::new(),\n*10102| Duration::from_secs(5),\n 10103| None,\n 10104| )\n 10105| .ok()?;\n...\n 10152| &keys,\n*10153| Duration::from_secs(30),\n 10154| None,\n 10155| ) {\n 10156| Ok(out) if out.success() && out.stdout.contains(\"ADDED\") => Ok(Some(format!(\n\n## spt-daemon/src/\n### brainproc.rs\n 33|use crate::brain::{now_ms, Brain};\n*34|use crate::endpoint::{brain_ready_path, broker_socket_name};\n 35|use crate::relcache::{AppliedRecord, ReleaseCache};\n 36|\n 37|/// Supervisor backoff floor after a brain death (mirrors the peer-pump\n...\n 39|/// doubles, capped at [`SUPERVISE_BACKOFF_CAP`].\n*40|const SUPERVISE_BACKOFF_BASE: Duration = Duration::from_secs(2);\n 41|/// Backoff ceiling — a persistently-crashing brain stays visible and bounded,\n 42|/// never a hot respawn loop.\n*43|const SUPERVISE_BACKOFF_CAP: Duration = Duration::from_secs(60);\n 44|/// A run at least this long counts as healthy and resets the backoff floor.\n 45|/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n 46|/// brain has this long to signal `ready` for its generation before the window\n 47|/// elapses (the \"up but useless\" alive-never-ready rollback path).\n*48|const SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n 49|/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n 50|/// **exits before** signaling ready is respawned this many consecutive times\n 51|/// (a transient first-boot hiccup should not abandon a good binary) before the\n...\n 225| // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*226| // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n 227| // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n 228| // paid for that twice: four cells burned a full 30s readiness budget while\n 229| // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n...\n 318| ready_cost.hash_computed,\n*319| brain_ready_path().display()\n 320| );\n 321|\n 322| // Shell wake-watchers (restoration D2-2): the offline half of the shell\n...\n 496| }\n*497| let _ = spt_store::atomic::atomic_write_string(&brain_ready_path(), &obj.to_string());\n 498| cost\n 499|}\n 500|\n...\n 542|\n*543|/// Parse the `generation` stamp out of a `brain.ready` body — pure, so the\n 544|/// staleness gate (D6-2) is unit-tested with explicit values, no wall-clock or\n 545|/// real process. `None` for an absent/garbled/legacy-bare-pid body (the gate\n 546|/// reads that as not-ready — fail-safe). Restoration D6-1b.\n...\n 554|\n*555|/// Parse the `exe_hash` breadcrumb out of a `brain.ready` body — pure (D7-1).\n 556|/// `None` for an absent field / garbled body (a legacy N-1 stamp carries none, so\n 557|/// `None` is the N-1-readable answer, not an error). The D7-1 survival E2E reads\n 558|/// this to prove a respawn ran the swapped binary's bytes.\n...\n 567|\n*568|/// Read the current `brain.ready` generation stamp from `path`, `None` if the\n 569|/// file is absent or its body has no parseable generation (fail-safe to\n 570|/// not-ready). The supervisor's \"is generation N ready?\" gate (D6-2) reads\n*571|/// [`brain_ready_path`]; the path is a parameter here so the unit harness points\n 572|/// it at a temp file. Restoration D6-1b.\n 573|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 574|pub fn ready_generation_at(path: &std::path::Path) -> Option {\n...\n 603| /// (absent/corrupt degrades to `None`).\n*604| fn applied_state(&self) -> Option;\n*605| /// The generation stamped in `brain.ready`, or `None` if absent/garbled\n 606| /// (the readiness gate reads `None` as not-ready — fail-safe).\n 607| fn ready_generation(&self) -> Option;\n*608| /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609| /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610| /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611| /// trial and falsely promote a brain that never booted).\n...\n 620| fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n*621| /// The `exe_hash` the candidate stamped in `brain.ready` (the bytes it is\n 622| /// actually running), or `None` if absent/garbled — degrades the promotion\n 623| /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n 624| fn ready_exe_hash(&self) -> Option;\n...\n 632| /// brain round-trip): the supervisor promotes a ready candidate only once this is\n*633| /// `true`, so `brain.ready` arriving inside the W2 `BRAIN_WRITE_DEADLINE` window\n 634| /// can no longer promote onto a still-frozen control plane (the 22:47 false-\n 635| /// promote). Fail-safe toward DRAINED (`true`) where there is nothing to read — a\n 636| /// net-less broker, no hosted sessions, or [`NoTrialEnv`] — so the gate never\n...\n 646|impl TrialEnv for NoTrialEnv {\n*647| fn applied_state(&self) -> Option {\n 648| None\n 649| }\n 650| fn ready_generation(&self) -> Option {\n...\n 670|/// Production [`TrialEnv`]: reads/writes the canonical `spt_home` durable files\n*671|/// (the `releases` relcache + the `brain.ready` breadcrumb) and fires the\n 672|/// rollback notif through the real producer front door. Constructed in the\n 673|/// broker process where `spt_home()` is stable.\n 674|///\n...\n 690|impl TrialEnv for ProductionTrialEnv {\n*691| fn applied_state(&self) -> Option {\n*692| self.cache().applied_state()\n 693| }\n 694| fn ready_generation(&self) -> Option {\n### config.rs\n 21|/// override it per machine.\n*22|pub const DEFAULT_PULSE_PERIOD: Duration = Duration::from_secs(5);\n 23|\n 24|/// Default drop-file precedence protection window (epoch-ms), mirroring the\n 25|/// interim `spt_live` guard. Surfaced here so the one config source owns it.\n...\n 32|/// teardown for long. Configurable per machine via `crash_grace_ms`.\n*33|pub const DEFAULT_CRASH_GRACE: Duration = Duration::from_secs(2);\n 34|\n 35|/// Default peer-pump cadences (D9-1): how often the daemon pushes its\n 36|/// registry/notif feeds to trusted peers and pulls context syncs from them.\n...\n 38|/// driver, so a missed tick costs only latency, never correctness.\n*39|pub const DEFAULT_REGISTRY_PUMP_PERIOD: Duration = Duration::from_secs(30);\n*40|pub const DEFAULT_NOTIF_PUMP_PERIOD: Duration = Duration::from_secs(15);\n*41|pub const DEFAULT_SYNC_PULL_PERIOD: Duration = Duration::from_secs(60);\n*42|pub const DEFAULT_UPDATE_CHECK_PERIOD: Duration = Duration::from_secs(3_600);\n 43|\n 44|/// Default silent-peer registry eviction window (KNOWN-HAZARDS 4.10): rows\n 45|/// authored by a node not heard within this window are evicted on the next\n...\n 49|/// stops poisoning bare-id resolution within minutes.\n*50|pub const DEFAULT_REGISTRY_EVICT_AFTER: Duration = Duration::from_secs(300);\n 51|\n 52|/// Which relay stance the broker's net endpoint runs (ADR-0002 / REQ-NET-2) —\n 53|/// the `\"relay\"` knob in `daemon.json`. Maps onto `spt-net`'s `RelayPolicy` in"}],"details":{"scopePath":".worktrees/hertz-304/crates/spt/src/cli.rs, .worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs, .worktrees/hertz-304/crates/spt-daemon/src/config.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":37,"fileCount":3,"files":[".worktrees/hertz-304/crates/spt/src/cli.rs",".worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs",".worktrees/hertz-304/crates/spt-daemon/src/config.rs"],"fileMatches":[{"path":".worktrees/hertz-304/crates/spt/src/cli.rs","count":10},{"path":".worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs","count":20},{"path":".worktrees/hertz-304/crates/spt-daemon/src/config.rs","count":7}],"truncated":true,"perFileLimitReached":20,"displayContent":"# .worktrees/hertz-304/crates/\n\n## spt/src/\n### cli.rs\n 9653│ &keys,\n *9654│ Duration::from_secs(120),\n 9655│ None,\n 9656│ ) {\n 9657│ Ok(out) if out.success() => {}\n │...\n 9720│ Ok(o @ O::AppliedDaemonless { .. })\n *9721│ | Ok(o @ O::AppliedPending { .. })\n 9722│ | Ok(o @ O::AlreadyApplied { .. }) => o,\n 9723│ // The fail-closed refusals — nothing swapped, do NOT restart.\n 9724│ Ok(refused) => return report_apply_outcome(refused),\n │...\n 9749│ }\n *9750│ let down_by = std::time::Instant::now() + std::time::Duration::from_secs(10);\n 9751│ while spt_daemon::is_running() && std::time::Instant::now() < down_by {\n 9752│ std::thread::sleep(std::time::Duration::from_millis(50));\n 9753│ }\n │...\n 9768│ }\n *9769│ | O::AppliedPending {\n 9770│ version,\n 9771│ product_version,\n 9772│ } => (version, product_version, false),\n │...\n 9884│/// exits 0 only when a host is logged in. Bounded (REQ-HAZARD-SUBPROCESS-TIMEOUT);\n *9885│/// any spawn error / non-zero / timeout ⇒ unavailable (fall back to HTTPS).\n 9886│// [impl->REQ-ADAPTER-GH-TRANSPORT]\n 9887│fn gh_available() -> bool {\n 9888│ matches!(\n │...\n 9891│ &std::collections::BTreeMap::new(),\n *9892│ Duration::from_secs(10),\n 9893│ None,\n 9894│ ),\n 9895│ Ok(out) if out.success()\n │...\n 9914│/// OS package command) vs UNAUTHED (installed but no logged-in host — the fix is\n *9915│/// `gh auth login`). A probe timeout classifies as Unauthed: gh exists (it\n 9916│/// spawned) but cannot answer for its auth state.\n 9917│#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 9918│enum GhStatus {\n │...\n 9931│ &std::collections::BTreeMap::new(),\n *9932│ Duration::from_secs(10),\n 9933│ None,\n 9934│ ) {\n 9935│ Ok(out) if out.success() => GhStatus::Available,\n │...\n 10101│ &std::collections::BTreeMap::new(),\n*10102│ Duration::from_secs(5),\n 10103│ None,\n 10104│ )\n 10105│ .ok()?;\n │...\n 10152│ &keys,\n*10153│ Duration::from_secs(30),\n 10154│ None,\n 10155│ ) {\n 10156│ Ok(out) if out.success() && out.stdout.contains(\"ADDED\") => Ok(Some(format!(\n\n## spt-daemon/src/\n### brainproc.rs\n 33│use crate::brain::{now_ms, Brain};\n *34│use crate::endpoint::{brain_ready_path, broker_socket_name};\n 35│use crate::relcache::{AppliedRecord, ReleaseCache};\n 36│\n 37│/// Supervisor backoff floor after a brain death (mirrors the peer-pump\n │...\n 39│/// doubles, capped at [`SUPERVISE_BACKOFF_CAP`].\n *40│const SUPERVISE_BACKOFF_BASE: Duration = Duration::from_secs(2);\n 41│/// Backoff ceiling — a persistently-crashing brain stays visible and bounded,\n 42│/// never a hot respawn loop.\n *43│const SUPERVISE_BACKOFF_CAP: Duration = Duration::from_secs(60);\n 44│/// A run at least this long counts as healthy and resets the backoff floor.\n 45│/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n 46│/// brain has this long to signal `ready` for its generation before the window\n 47│/// elapses (the \"up but useless\" alive-never-ready rollback path).\n *48│const SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n 49│/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n 50│/// **exits before** signaling ready is respawned this many consecutive times\n 51│/// (a transient first-boot hiccup should not abandon a good binary) before the\n │...\n 225│ // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*226│ // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n 227│ // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n 228│ // paid for that twice: four cells burned a full 30s readiness budget while\n 229│ // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n │...\n 318│ ready_cost.hash_computed,\n*319│ brain_ready_path().display()\n 320│ );\n 321│\n 322│ // Shell wake-watchers (restoration D2-2): the offline half of the shell\n │...\n 496│ }\n*497│ let _ = spt_store::atomic::atomic_write_string(&brain_ready_path(), &obj.to_string());\n 498│ cost\n 499│}\n 500│\n │...\n 542│\n*543│/// Parse the `generation` stamp out of a `brain.ready` body — pure, so the\n 544│/// staleness gate (D6-2) is unit-tested with explicit values, no wall-clock or\n 545│/// real process. `None` for an absent/garbled/legacy-bare-pid body (the gate\n 546│/// reads that as not-ready — fail-safe). Restoration D6-1b.\n │...\n 554│\n*555│/// Parse the `exe_hash` breadcrumb out of a `brain.ready` body — pure (D7-1).\n 556│/// `None` for an absent field / garbled body (a legacy N-1 stamp carries none, so\n 557│/// `None` is the N-1-readable answer, not an error). The D7-1 survival E2E reads\n 558│/// this to prove a respawn ran the swapped binary's bytes.\n │...\n 567│\n*568│/// Read the current `brain.ready` generation stamp from `path`, `None` if the\n 569│/// file is absent or its body has no parseable generation (fail-safe to\n 570│/// not-ready). The supervisor's \"is generation N ready?\" gate (D6-2) reads\n*571│/// [`brain_ready_path`]; the path is a parameter here so the unit harness points\n 572│/// it at a temp file. Restoration D6-1b.\n 573│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 574│pub fn ready_generation_at(path: &std::path::Path) -> Option {\n │...\n 603│ /// (absent/corrupt degrades to `None`).\n*604│ fn applied_state(&self) -> Option;\n*605│ /// The generation stamped in `brain.ready`, or `None` if absent/garbled\n 606│ /// (the readiness gate reads `None` as not-ready — fail-safe).\n 607│ fn ready_generation(&self) -> Option;\n*608│ /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609│ /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610│ /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611│ /// trial and falsely promote a brain that never booted).\n │...\n 620│ fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n*621│ /// The `exe_hash` the candidate stamped in `brain.ready` (the bytes it is\n 622│ /// actually running), or `None` if absent/garbled — degrades the promotion\n 623│ /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n 624│ fn ready_exe_hash(&self) -> Option;\n │...\n 632│ /// brain round-trip): the supervisor promotes a ready candidate only once this is\n*633│ /// `true`, so `brain.ready` arriving inside the W2 `BRAIN_WRITE_DEADLINE` window\n 634│ /// can no longer promote onto a still-frozen control plane (the 22:47 false-\n 635│ /// promote). Fail-safe toward DRAINED (`true`) where there is nothing to read — a\n 636│ /// net-less broker, no hosted sessions, or [`NoTrialEnv`] — so the gate never\n │...\n 646│impl TrialEnv for NoTrialEnv {\n*647│ fn applied_state(&self) -> Option {\n 648│ None\n 649│ }\n 650│ fn ready_generation(&self) -> Option {\n │...\n 670│/// Production [`TrialEnv`]: reads/writes the canonical `spt_home` durable files\n*671│/// (the `releases` relcache + the `brain.ready` breadcrumb) and fires the\n 672│/// rollback notif through the real producer front door. Constructed in the\n 673│/// broker process where `spt_home()` is stable.\n 674│///\n │...\n 690│impl TrialEnv for ProductionTrialEnv {\n*691│ fn applied_state(&self) -> Option {\n*692│ self.cache().applied_state()\n 693│ }\n 694│ fn ready_generation(&self) -> Option {\n### config.rs\n 21│/// override it per machine.\n*22│pub const DEFAULT_PULSE_PERIOD: Duration = Duration::from_secs(5);\n 23│\n 24│/// Default drop-file precedence protection window (epoch-ms), mirroring the\n 25│/// interim `spt_live` guard. Surfaced here so the one config source owns it.\n │...\n 32│/// teardown for long. Configurable per machine via `crash_grace_ms`.\n*33│pub const DEFAULT_CRASH_GRACE: Duration = Duration::from_secs(2);\n 34│\n 35│/// Default peer-pump cadences (D9-1): how often the daemon pushes its\n 36│/// registry/notif feeds to trusted peers and pulls context syncs from them.\n │...\n 38│/// driver, so a missed tick costs only latency, never correctness.\n*39│pub const DEFAULT_REGISTRY_PUMP_PERIOD: Duration = Duration::from_secs(30);\n*40│pub const DEFAULT_NOTIF_PUMP_PERIOD: Duration = Duration::from_secs(15);\n*41│pub const DEFAULT_SYNC_PULL_PERIOD: Duration = Duration::from_secs(60);\n*42│pub const DEFAULT_UPDATE_CHECK_PERIOD: Duration = Duration::from_secs(3_600);\n 43│\n 44│/// Default silent-peer registry eviction window (KNOWN-HAZARDS 4.10): rows\n 45│/// authored by a node not heard within this window are evicted on the next\n │...\n 49│/// stops poisoning bare-id resolution within minutes.\n*50│pub const DEFAULT_REGISTRY_EVICT_AFTER: Duration = Duration::from_secs(300);\n 51│\n 52│/// Which relay stance the broker's net endpoint runs (ADR-0002 / REQ-NET-2) —\n 53│/// the `\"relay\"` knob in `daemon.json`. Maps onto `spt-net`'s `RelayPolicy` in"},"isError":false,"timestamp":1789114577833}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_17mMHUw3ue3xyy3O8pRskMrh|fc_0581413717c88920016aa3b8d140f087d1b398638ca9b70ae8","toolName":"hub","startedAt":"2026-09-11T08:16:23.244Z","intent":"Sharing critical isolation gap"},"id":"81b4fc07","parentId":"1aeaf868","timestamp":"2026-09-11T08:16:23.244Z"}
{"type":"message","id":"e8537a2f","parentId":"81b4fc07","timestamp":"2026-09-11T08:16:23.245Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_17mMHUw3ue3xyy3O8pRskMrh|fc_0581413717c88920016aa3b8d140f087d1b398638ca9b70ae8","name":"hub","arguments":{"i":"Sharing critical isolation gap","op":"send","to":"Main","message":"Critical W3 isolation gap: real daemon try_start_net (crates/spt-daemon/src/daemon.rs:529-560) hardcodes Mdns + BindScope::All, calls firewall::verify_and_record_self; relay disabled/private valid node.key alone NOT hermetic. Existing refresh fixture corrupts node.key to suppress net, incompatible with valid-identity requirement. Hermetic NetConfig is reusable only in custom/in-process broker or separately allocated rig seam; detailed report forthcoming."},"intent":"Sharing critical isolation gap"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":8703,"output":128,"cacheRead":48512,"cacheWrite":0,"totalTokens":57343,"cost":{"input":0.08703000000000001,"output":0.0064,"cacheRead":0.048512,"cacheWrite":0,"total":0.141942}},"stopReason":"toolUse","timestamp":1789114577883,"responseId":"resp_0581413717c88920016aa3b8cfcab487d19bfb0939bd31ed79","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8d140f087d1b398638ca9b70ae8","type":"function_call","status":"completed","arguments":"{\"i\":\"Sharing critical isolation gap\",\"op\":\"send\",\"to\":\"Main\",\"message\":\"Critical W3 isolation gap: real daemon try_start_net (crates/spt-daemon/src/daemon.rs:529-560) hardcodes Mdns + BindScope::All, calls firewall::verify_and_record_self; relay disabled/private valid node.key alone NOT hermetic. Existing refresh fixture corrupts node.key to suppress net, incompatible with valid-identity requirement. Hermetic NetConfig is reusable only in custom/in-process broker or separately allocated rig seam; detailed report forthcoming.\"}","call_id":"call_17mMHUw3ue3xyy3O8pRskMrh","internal_chat_message_metadata_passthrough":{"create_time":1789114576.053228,"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"hub","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":5357.961199999787,"ttft":1722.1822000006214,"completedAt":1789114583242,"contextSnapshot":{"promptTokens":57215,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"message","id":"9a44df56","parentId":"e8537a2f","timestamp":"2026-09-11T08:16:23.245Z","message":{"role":"toolResult","toolCallId":"call_17mMHUw3ue3xyy3O8pRskMrh|fc_0581413717c88920016aa3b8d140f087d1b398638ca9b70ae8","toolName":"hub","content":[{"type":"text","text":"Delivered to 1 peer(s):\n- Main: injected"}],"details":{"op":"send","from":"ContinuityUpdate","to":"Main","receipts":[{"to":"Main","outcome":"injected"}]},"isError":false,"timestamp":1789114583245}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ECzalhV5gkmuA3SaBeryMNyF|fc_0581413717c88920016aa3b8de15f487d1b5b7d0ccd6a6022d","toolName":"read","startedAt":"2026-09-11T08:16:32.534Z","args":{"path":".worktrees/hertz-304/crates/spt/src/cli.rs:9280-9455"},"intent":"Reading explicit apply reporting"},"id":"20292706","parentId":"9a44df56","timestamp":"2026-09-11T08:16:32.534Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_O1iYpVMVNeuH7QSegOpfjVbT|fc_0581413717c88920016aa3b8de160887d18c67b89d65760485","toolName":"read","startedAt":"2026-09-11T08:16:32.534Z","args":{"path":".worktrees/hertz-304/crates/spt/src/bin/gh_fixture.rs"},"intent":"Reading fixture gh protocol"},"id":"d45eca6c","parentId":"20292706","timestamp":"2026-09-11T08:16:32.534Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uB1aARMg2NYqkABdHNVVukx1|fc_0581413717c88920016aa3b8de161087d1a7778245759b689b","toolName":"read","startedAt":"2026-09-11T08:16:32.534Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs:40-57,222-242,290-320"},"intent":"Reading supervisor phase logs"},"id":"33682aed","parentId":"d45eca6c","timestamp":"2026-09-11T08:16:32.534Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_yxnog2dki3EUXUkhpViJiFf3|fc_0581413717c88920016aa3b8de161487d19d9e04898d28a353","toolName":"read","startedAt":"2026-09-11T08:16:32.534Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/config.rs:52-115"},"intent":"Reading config relay contract"},"id":"072429a6","parentId":"33682aed","timestamp":"2026-09-11T08:16:32.534Z"}
{"type":"message","id":"4ce92fdb","parentId":"072429a6","timestamp":"2026-09-11T08:16:32.534Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_ECzalhV5gkmuA3SaBeryMNyF|fc_0581413717c88920016aa3b8de15f487d1b5b7d0ccd6a6022d","name":"read","arguments":{"i":"Reading explicit apply reporting","path":".worktrees/hertz-304/crates/spt/src/cli.rs:9280-9455"},"intent":"Reading explicit apply reporting"},{"type":"toolCall","id":"call_O1iYpVMVNeuH7QSegOpfjVbT|fc_0581413717c88920016aa3b8de160887d18c67b89d65760485","name":"read","arguments":{"i":"Reading fixture gh protocol","path":".worktrees/hertz-304/crates/spt/src/bin/gh_fixture.rs"},"intent":"Reading fixture gh protocol"},{"type":"toolCall","id":"call_uB1aARMg2NYqkABdHNVVukx1|fc_0581413717c88920016aa3b8de161087d1a7778245759b689b","name":"read","arguments":{"i":"Reading supervisor phase logs","path":".worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs:40-57,222-242,290-320"},"intent":"Reading supervisor phase logs"},{"type":"toolCall","id":"call_yxnog2dki3EUXUkhpViJiFf3|fc_0581413717c88920016aa3b8de161487d19d9e04898d28a353","name":"read","arguments":{"i":"Reading config relay contract","path":".worktrees/hertz-304/crates/spt-daemon/src/config.rs:52-115"},"intent":"Reading config relay contract"},{"type":"toolCall","id":"call_wyWUlbhyZCq5xqmp3WYF45zC|fc_0581413717c88920016aa3b8de161c87d1a1ed6bda035dd0f0","name":"grep","arguments":{"i":"Locating firewall mutation paths","pattern":"pub fn verify_and_record_self|add rule|Command|SPT_|elevat|repair","path":".worktrees/hertz-304/crates/spt-daemon/src/firewall.rs","case":null,"gitignore":false,"skip":null},"intent":"Locating firewall mutation paths"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":277,"output":258,"cacheRead":57088,"cacheWrite":0,"totalTokens":57623,"cost":{"input":0.0027700000000000003,"output":0.0129,"cacheRead":0.057088,"cacheWrite":0,"total":0.072758}},"stopReason":"toolUse","timestamp":1789114583306,"responseId":"resp_0581413717c88920016aa3b8d5372c87d1b49c31e9045e5b7d","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0581413717c88920016aa3b8de15f487d1b5b7d0ccd6a6022d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading explicit apply reporting\",\"path\":\".worktrees/hertz-304/crates/spt/src/cli.rs:9280-9455\"}","call_id":"call_ECzalhV5gkmuA3SaBeryMNyF","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8de160887d18c67b89d65760485","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading fixture gh protocol\",\"path\":\".worktrees/hertz-304/crates/spt/src/bin/gh_fixture.rs\"}","call_id":"call_O1iYpVMVNeuH7QSegOpfjVbT","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8de161087d1a7778245759b689b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading supervisor phase logs\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/brainproc.rs:40-57,222-242,290-320\"}","call_id":"call_uB1aARMg2NYqkABdHNVVukx1","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8de161487d19d9e04898d28a353","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading config relay contract\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/config.rs:52-115\"}","call_id":"call_yxnog2dki3EUXUkhpViJiFf3","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"read","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}},{"id":"fc_0581413717c88920016aa3b8de161c87d1a1ed6bda035dd0f0","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating firewall mutation paths\",\"pattern\":\"pub fn verify_and_record_self|add rule|Command|SPT_|elevat|repair\",\"path\":\".worktrees/hertz-304/crates/spt-daemon/src/firewall.rs\",\"case\":null,\"gitignore\":false,\"skip\":null}","call_id":"call_wyWUlbhyZCq5xqmp3WYF45zC","internal_chat_message_metadata_passthrough":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"},"name":"grep","metadata":{"turn_id":"864b2c79-8368-4e4c-a60e-570edb12a38d"}}]},"duration":9225.956900000572,"ttft":9137.583500000648,"completedAt":1789114592533,"contextSnapshot":{"promptTokens":57365,"nonMessageTokens":10296,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_wyWUlbhyZCq5xqmp3WYF45zC|fc_0581413717c88920016aa3b8de161c87d1a1ed6bda035dd0f0","toolName":"grep","startedAt":"2026-09-11T08:16:32.535Z","args":{"path":".worktrees/hertz-304/crates/spt-daemon/src/firewall.rs"},"intent":"Locating firewall mutation paths"},"id":"15b7f83c","parentId":"4ce92fdb","timestamp":"2026-09-11T08:16:32.535Z"}
{"type":"message","id":"89d33880","parentId":"15b7f83c","timestamp":"2026-09-11T08:16:32.546Z","message":{"role":"toolResult","toolCallId":"call_uB1aARMg2NYqkABdHNVVukx1|fc_0581413717c88920016aa3b8de161087d1a7778245759b689b","toolName":"read","content":[{"type":"text","text":"const SUPERVISE_BACKOFF_BASE: Duration = Duration::from_secs(2);\n/// Backoff ceiling — a persistently-crashing brain stays visible and bounded,\n/// never a hot respawn loop.\nconst SUPERVISE_BACKOFF_CAP: Duration = Duration::from_secs(60);\n/// A run at least this long counts as healthy and resets the backoff floor.\n/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n/// brain has this long to signal `ready` for its generation before the window\n/// elapses (the \"up but useless\" alive-never-ready rollback path).\nconst SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n/// **exits before** signaling ready is respawned this many consecutive times\n/// (a transient first-boot hiccup should not abandon a good binary) before the\n/// supervisor auto-rolls-back to the last-known-good binary. Matched to the\n/// capped-backoff cadence; either this budget OR an alive-but-never-ready\n/// window-expiry triggers rollback.\nconst TRIAL_PREREADY_BUDGET: u32 = 3;\n/// Poll/sleep slice so a `stop` request (and a child exit) land promptly.\nconst TICK: Duration = Duration::from_millis(200);\n…\n // error is consumed here rather than left on the conn for a later query.\n // Best-effort: a broker that cannot record it renders \"not reported\", which\n // is honest — it must never keep the brain from serving.\n // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n // paid for that twice: four cells burned a full 30s readiness budget while\n // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n // (blocked broker reply-read vs the first-call whole-exe hash) could not be\n // separated from the log at all. `activity_link_push_e2e` then failed again\n // WARM, which carved it out of the load-tail ruling and made the\n // undiscriminated window gate-blocking rather than a footnote.\n //\n // One token family, per-phase ELAPSED ms: `grep BRAIN_PHASE` yields three\n // numbers that sum to the gap, so the next occurrence names its stretch in\n // one read instead of a second instrumented run. Elapsed and not wall\n // stamps on purpose — `CONN_LIFECYCLE` already carries wall_ms for\n // correlation, and a second clock in the same log is how two clocks start\n // disagreeing.\n let phase_start = Instant::now();\n match brain.announce_coordinator_image(generation) {\n…\n }\n…\n // daemon hosts no PTY sessions), so the round-trip that actually happens is\n // precisely the one that never spoke.\n spt_proto::emit_line_err!(\n \"BRAIN_PHASE:resume done in {}ms\",\n phase_start.elapsed().as_millis()\n );\n let phase_start = Instant::now();\n\n // Signal READY only now — AFTER session resume (restoration D6-1b, ADR-0018\n // Q7): \"ready\" is the design's \"re-attached all sessions + resumed loops\",\n // not merely \"socket connected\". The supervisor's readiness gate (D6-2)\n // promotes the trial binary on this stamp; promoting on a bare post-connect\n // breadcrumb would accept a brain that connected but never rebuilt\n // continuity. Today resume is a near-noop (no daemon-hosted sessions), so\n // this is forward-correct: the gate is defined on the real readiness\n // semantic the live-agent adapter inherits.\n let ready_cost = write_ready(generation);\n // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] stretch 3 of 3, plus the PATH\n // written (gate rider): a test polls a path it resolved itself, so a\n // poller/writer mismatch is ruled in or out here rather than inferred. The\n // `hash` figure is the whole-exe SHA-256 `write_ready` does inline, and\n // `computed` says whether THIS call paid for it — the digest is a\n // once-per-process `OnceLock`, so a reader seeing 0ms must be able to tell\n // \"fast\" from \"not this process's turn\".\n spt_proto::emit_line_err!(\n \"BRAIN_PHASE:ready written in {}ms (exe-hash {}ms, computed={}) path {}\",\n phase_start.elapsed().as_millis(),\n ready_cost.hash_ms,\n ready_cost.hash_computed,\n brain_ready_path().display()\n );"}],"details":{"displayContent":{"text":"const SUPERVISE_BACKOFF_BASE: Duration = Duration::from_secs(2);\n/// Backoff ceiling — a persistently-crashing brain stays visible and bounded,\n/// never a hot respawn loop.\nconst SUPERVISE_BACKOFF_CAP: Duration = Duration::from_secs(60);\n/// A run at least this long counts as healthy and resets the backoff floor.\n/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n/// brain has this long to signal `ready` for its generation before the window\n/// elapses (the \"up but useless\" alive-never-ready rollback path).\nconst SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n/// **exits before** signaling ready is respawned this many consecutive times\n/// (a transient first-boot hiccup should not abandon a good binary) before the\n/// supervisor auto-rolls-back to the last-known-good binary. Matched to the\n/// capped-backoff cadence; either this budget OR an alive-but-never-ready\n/// window-expiry triggers rollback.\nconst TRIAL_PREREADY_BUDGET: u32 = 3;\n/// Poll/sleep slice so a `stop` request (and a child exit) land promptly.\nconst TICK: Duration = Duration::from_millis(200);\n…\n // error is consumed here rather than left on the conn for a later query.\n // Best-effort: a broker that cannot record it renders \"not reported\", which\n // is honest — it must never keep the brain from serving.\n // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n // paid for that twice: four cells burned a full 30s readiness budget while\n // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n // (blocked broker reply-read vs the first-call whole-exe hash) could not be\n // separated from the log at all. `activity_link_push_e2e` then failed again\n // WARM, which carved it out of the load-tail ruling and made the\n // undiscriminated window gate-blocking rather than a footnote.\n //\n // One token family, per-phase ELAPSED ms: `grep BRAIN_PHASE` yields three\n // numbers that sum to the gap, so the next occurrence names its stretch in\n // one read instead of a second instrumented run. Elapsed and not wall\n // stamps on purpose — `CONN_LIFECYCLE` already carries wall_ms for\n // correlation, and a second clock in the same log is how two clocks start\n // disagreeing.\n let phase_start = Instant::now();\n match brain.announce_coordinator_image(generation) {\n…\n }\n…\n // daemon hosts no PTY sessions), so the round-trip that actually happens is\n // precisely the one that never spoke.\n spt_proto::emit_line_err!(\n \"BRAIN_PHASE:resume done in {}ms\",\n phase_start.elapsed().as_millis()\n );\n let phase_start = Instant::now();\n\n // Signal READY only now — AFTER session resume (restoration D6-1b, ADR-0018\n // Q7): \"ready\" is the design's \"re-attached all sessions + resumed loops\",\n // not merely \"socket connected\". The supervisor's readiness gate (D6-2)\n // promotes the trial binary on this stamp; promoting on a bare post-connect\n // breadcrumb would accept a brain that connected but never rebuilt\n // continuity. Today resume is a near-noop (no daemon-hosted sessions), so\n // this is forward-correct: the gate is defined on the real readiness\n // semantic the live-agent adapter inherits.\n let ready_cost = write_ready(generation);\n // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] stretch 3 of 3, plus the PATH\n // written (gate rider): a test polls a path it resolved itself, so a\n // poller/writer mismatch is ruled in or out here rather than inferred. The\n // `hash` figure is the whole-exe SHA-256 `write_ready` does inline, and\n // `computed` says whether THIS call paid for it — the digest is a\n // once-per-process `OnceLock`, so a reader seeing 0ms must be able to tell\n // \"fast\" from \"not this process's turn\".\n spt_proto::emit_line_err!(\n \"BRAIN_PHASE:ready written in {}ms (exe-hash {}ms, computed={}) path {}\",\n phase_start.elapsed().as_millis(),\n ready_cost.hash_ms,\n ready_cost.hash_computed,\n brain_ready_path().display()\n );","startLine":40,"lineNumbers":[40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,null,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,null,248,null,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320]},"fileSize":120153,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-304\\crates\\spt-daemon\\src\\brainproc.rs"}}},"isError":false,"timestamp":1789114592546}}
{"type":"message","id":"cca4342c","parentId":"89d33880","timestamp":"2026-09-11T08:16:32.550Z","message":{"role":"toolResult","toolCallId":"call_yxnog2dki3EUXUkhpViJiFf3|fc_0581413717c88920016aa3b8de161487d19d9e04898d28a353","toolName":"read","content":[{"type":"text","text":"\n/// Which relay stance the broker's net endpoint runs (ADR-0002 / REQ-NET-2) —\n/// the `\"relay\"` knob in `daemon.json`. Maps onto `spt-net`'s `RelayPolicy` in\n/// `Daemon::run`; kept as a local enum so the config layer stays transport-free.\n/// The self-hosted variant (`RelayPolicy::SelfHosted`) needs a relay-map URL\n/// list and gets its config plumbing when a self-host consumer exists.\n// [impl->REQ-NET-2]\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum RelayChoice {\n /// n0's public relays — the zero-config default (`\"relay\": \"n0\"`).\n N0,\n /// No relays: direct/LAN only (`\"relay\": \"disabled\"`).\n Disabled,\n}\n\n/// One saved `endpoint auto-start` startup default (F-038 W5,\n/// REQ-ENDPOINT-AUTOSTART): the daemon REPLAYS these at start — the endpoint\n/// analog of the shipped `subnet attach/detach --save` precedent. Minimal by\n/// design: the adapter option is re-resolved fresh at each replay (an adapter\n/// update between restarts is honored, an uninstalled one loud-skips), and the\n/// endpoint's anchor subnet is NOT recorded (home is durable on the perch —\n/// REQ-INST-15). A replay is always a FRESH session (shape (c)\n/// restore-what-was-up was rejected — this is a startup default, not a\n/// session restore).\n// [impl->REQ-ENDPOINT-AUTOSTART]\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\npub struct StartupEndpoint {\n /// The endpoint id to bring up.\n pub id: String,\n /// The adapter option (`[:profile]`), resolved at replay time.\n pub adapter: String,\n /// The project cwd the harness PTY lands in (the endpoint's remembered\n /// folder, captured when auto-start was set).\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub cwd: Option,\n}\n\n/// The on-disk shape (`/daemon.json`). Every field is optional so a\n/// partial file still loads (forward/back-compat) — a missing field takes the\n/// default. Stored as plain integers (ms) to keep the file human-editable.\n#[derive(Debug, Clone, Default, Serialize, Deserialize)]\nstruct DaemonConfigFile {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pulse_period_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n protection_window_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n crash_grace_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n full_auto_update: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n relay: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n peer_pump: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n registry_pump_period_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n registry_evict_after_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n notif_pump_period_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n sync_pull_period_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n update_check_period_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n auto_suspend_after_ms: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n resources_blurb: Option,\n…\n}\n\n[Showing lines 51-118 of 735. Use :119 to continue]"}],"details":{"truncation":{"content":"\r\n/// Which relay stance the broker's net endpoint runs (ADR-0002 / REQ-NET-2) —\r\n/// the `\"relay\"` knob in `daemon.json`. Maps onto `spt-net`'s `RelayPolicy` in\r\n/// `Daemon::run`; kept as a local enum so the config layer stays transport-free.\r\n/// The self-hosted variant (`RelayPolicy::SelfHosted`) needs a relay-map URL\r\n/// list and gets its config plumbing when a self-host consumer exists.\r\n// [impl->REQ-NET-2]\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub enum RelayChoice {\r\n /// n0's public relays — the zero-config default (`\"relay\": \"n0\"`).\r\n N0,\r\n /// No relays: direct/LAN only (`\"relay\": \"disabled\"`).\r\n Disabled,\r\n}\r\n\r\n/// One saved `endpoint auto-start` startup default (F-038 W5,\r\n/// REQ-ENDPOINT-AUTOSTART): the daemon REPLAYS these at start — the endpoint\r\n/// analog of the shipped `subnet attach/detach --save` precedent. Minimal by\r\n/// design: the adapter option is re-resolved fresh at each replay (an adapter\r\n/// update between restarts is honored, an uninstalled one loud-skips), and the\r\n/// endpoint's anchor subnet is NOT recorded (home is durable on the perch —\r\n/// REQ-INST-15). A replay is always a FRESH session (shape (c)\r\n/// restore-what-was-up was rejected — this is a startup default, not a\r\n/// session restore).\r\n// [impl->REQ-ENDPOINT-AUTOSTART]\r\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\r\npub struct StartupEndpoint {\r\n /// The endpoint id to bring up.\r\n pub id: String,\r\n /// The adapter option (`[:profile]`), resolved at replay time.\r\n pub adapter: String,\r\n /// The project cwd the harness PTY lands in (the endpoint's remembered\r\n /// folder, captured when auto-start was set).\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n pub cwd: Option,\r\n}\r\n\r\n/// The on-disk shape (`/daemon.json`). Every field is optional so a\r\n/// partial file still loads (forward/back-compat) — a missing field takes the\r\n/// default. Stored as plain integers (ms) to keep the file human-editable.\r\n#[derive(Debug, Clone, Default, Serialize, Deserialize)]\r\nstruct DaemonConfigFile {\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n pulse_period_ms: Option,\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n protection_window_ms: Option,\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n crash_grace_ms: Option,\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n full_auto_update: Option,\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n relay: Option,\r\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\r\n peer_pump: Option