{"type":"title","v":1,"title":"","updatedAt":"2026-09-11T08:03:01.088Z","pad":" "}
{"type":"session","version":3,"id":"01a08f7d-cb60-7000-ad78-b9613e2b2b08","timestamp":"2026-09-11T08:03:01.088Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"cae8b6eb","parentId":null,"timestamp":"2026-09-11T08:03:01.153Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"bceca113","parentId":"cae8b6eb","timestamp":"2026-09-11T08:03:01.154Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"4e80d159","parentId":"bceca113","timestamp":"2026-09-11T08:03:01.155Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n\n\n\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n\n\n\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n\n\n\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n\n\n§ Context\n# Goal\nContinue releases#304 W3 source diagnosis while Main implements #300 in .worktrees/304-product at d89a655f.\n# Constraints\nREAD ONLY. Skip builds, tests, checks, formatters, runtime fixtures and production interaction. Rust execution requires separately sized allocation; none exists. Read relevant project orientation and diagnose skill. Source mapping is preparation, not reproduced root cause. Do not change any files. Ignore obsolete #293/#294 standing ledger.\n# Contract\nReturn exact source paths/ranges, current call flow, evidence gaps, smallest executable reproduction design and prerequisite allocation. No fixes or diagnosis claims without runtime evidence. Main owns interpretation and all product edits; Hertz owns regressions.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `AttachFreezeMap`. Currently visible peers:\n- `RosterWaitMap` — scout (sub, running)\n- `Main` — main (main, running)\n- `BootstrapLinux` — task (sub, idle)\n17 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n summary: string;\n files: { path: string; description: string; }[];\n architecture: string;\n report?: string;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\nW3 releases#302 recurring local/remote hitches, #49 refresh freeze, #267 update freeze. Source tree .worktrees/304-product; attach architecture at daemon/src/attach.rs, broker.rs, spt/src/rc.rs; refresh/update paths locate narrowly. Read actual issues in BigscreenVR/spt-bs-releases and docs/DEBUG-ROLLOUT.md before update-path research.\n# Change\nTrace each scenario independently through existing views and queued input. Find prior #49 fix and its actual coverage gap using issue/history evidence. Separate refresh/update/hitch causes. No runtime, modifications, validation, or assumptions that symptoms share cause.\n# Acceptance\nReturn per-issue exact source boundaries, known measured evidence, smallest reproduction design preserving views/queued input, and missing allocation prerequisites. Explain what prior coverage does and does not exercise; do not claim reproduced cause.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra:medium","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"2abdf41d","parentId":"4e80d159","timestamp":"2026-09-11T08:03:01.232Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nW3 releases#302 recurring local/remote hitches, #49 refresh freeze, #267 update freeze. Source tree .worktrees/304-product; attach architecture at daemon/src/attach.rs, broker.rs, spt/src/rc.rs; refresh/update paths locate narrowly. Read actual issues in BigscreenVR/spt-bs-releases and docs/DEBUG-ROLLOUT.md before update-path research.\n# Change\nTrace each scenario independently through existing views and queued input. Find prior #49 fix and its actual coverage gap using issue/history evidence. Separate refresh/update/hitch causes. No runtime, modifications, validation, or assumptions that symptoms share cause.\n# Acceptance\nReturn per-issue exact source boundaries, known measured evidence, smallest reproduction design preserving views/queued input, and missing allocation prerequisites. Explain what prior coverage does and does not exercise; do not claim reproduced cause."}],"attribution":"agent","timestamp":1789113781157}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_08TnxUatNWE2lCSWyGTXQP5f|fc_07a38c9435caeae6016aa3b5bc476087d28ac3f5e41fec1ab6","toolName":"read","startedAt":"2026-09-11T08:03:10.814Z","args":{"path":"skill://diagnose"},"intent":"Reading diagnosis procedure"},"id":"18ffad7f","parentId":"2abdf41d","timestamp":"2026-09-11T08:03:10.814Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_s9Z8iq7EG0T353ysJ4EiCgtG|fc_07a38c9435caeae6016aa3b5bc477887d2848a9d66f962fa77","toolName":"read","startedAt":"2026-09-11T08:03:10.815Z","args":{"path":".worktrees/304-product"},"intent":"Reading source orientation"},"id":"d82caf5d","parentId":"18ffad7f","timestamp":"2026-09-11T08:03:10.815Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_4fJUvWw16CWLMQExVnOLxDk9|fc_07a38c9435caeae6016aa3b5bc477c87d2b67eac3d874861a1","toolName":"read","startedAt":"2026-09-11T08:03:10.815Z","args":{"path":"issue://BigscreenVR/spt-bs-releases/302"},"intent":"Reading reported hitch issue"},"id":"88a65e28","parentId":"d82caf5d","timestamp":"2026-09-11T08:03:10.815Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_C4r5tq1pH4lEoC0AB2uqPvOI|fc_07a38c9435caeae6016aa3b5bc478487d29520526b665a9d4d","toolName":"read","startedAt":"2026-09-11T08:03:10.815Z","args":{"path":"issue://BigscreenVR/spt-bs-releases/49"},"intent":"Reading reported refresh freeze"},"id":"e22045e0","parentId":"88a65e28","timestamp":"2026-09-11T08:03:10.815Z"}
{"type":"message","id":"35d88dca","parentId":"e22045e0","timestamp":"2026-09-11T08:03:10.816Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_08TnxUatNWE2lCSWyGTXQP5f|fc_07a38c9435caeae6016aa3b5bc476087d28ac3f5e41fec1ab6","name":"read","arguments":{"i":"Reading diagnosis procedure","path":"skill://diagnose"},"intent":"Reading diagnosis procedure"},{"type":"toolCall","id":"call_s9Z8iq7EG0T353ysJ4EiCgtG|fc_07a38c9435caeae6016aa3b5bc477887d2848a9d66f962fa77","name":"read","arguments":{"i":"Reading source orientation","path":".worktrees/304-product"},"intent":"Reading source orientation"},{"type":"toolCall","id":"call_4fJUvWw16CWLMQExVnOLxDk9|fc_07a38c9435caeae6016aa3b5bc477c87d2b67eac3d874861a1","name":"read","arguments":{"i":"Reading reported hitch issue","path":"issue://BigscreenVR/spt-bs-releases/302"},"intent":"Reading reported hitch issue"},{"type":"toolCall","id":"call_C4r5tq1pH4lEoC0AB2uqPvOI|fc_07a38c9435caeae6016aa3b5bc478487d29520526b665a9d4d","name":"read","arguments":{"i":"Reading reported refresh freeze","path":"issue://BigscreenVR/spt-bs-releases/49"},"intent":"Reading reported refresh freeze"},{"type":"toolCall","id":"call_xMpxLj9VB3kvyxVvYpW6HWje|fc_07a38c9435caeae6016aa3b5bc478c87d28401a20394e049b7","name":"read","arguments":{"i":"Reading reported update freeze","path":"issue://BigscreenVR/spt-bs-releases/267"},"intent":"Reading reported update freeze"},{"type":"toolCall","id":"call_F02Shv31MZRjt82zq5Ok0TJW|fc_07a38c9435caeae6016aa3b5bc479887d296fea6db726a2bdc","name":"read","arguments":{"i":"Reading debug rollout policy","path":".worktrees/304-product/docs/DEBUG-ROLLOUT.md"},"intent":"Reading debug rollout policy"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10128,"output":192,"cacheRead":0,"cacheWrite":0,"totalTokens":10320,"cost":{"input":0.10128000000000001,"output":0.009600000000000001,"cacheRead":0,"cacheWrite":0,"total":0.11088}},"stopReason":"toolUse","timestamp":1789113781231,"responseId":"resp_07a38c9435caeae6016aa3b5b3802887d2adf872c0689f7321","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_07a38c9435caeae6016aa3b5bc476087d28ac3f5e41fec1ab6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading diagnosis procedure\",\"path\":\"skill://diagnose\"}","call_id":"call_08TnxUatNWE2lCSWyGTXQP5f","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5bc477887d2848a9d66f962fa77","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading source orientation\",\"path\":\".worktrees/304-product\"}","call_id":"call_s9Z8iq7EG0T353ysJ4EiCgtG","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5bc477c87d2b67eac3d874861a1","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading reported hitch issue\",\"path\":\"issue://BigscreenVR/spt-bs-releases/302\"}","call_id":"call_4fJUvWw16CWLMQExVnOLxDk9","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5bc478487d29520526b665a9d4d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading reported refresh freeze\",\"path\":\"issue://BigscreenVR/spt-bs-releases/49\"}","call_id":"call_C4r5tq1pH4lEoC0AB2uqPvOI","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5bc478c87d28401a20394e049b7","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading reported update freeze\",\"path\":\"issue://BigscreenVR/spt-bs-releases/267\"}","call_id":"call_xMpxLj9VB3kvyxVvYpW6HWje","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5bc479887d296fea6db726a2bdc","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading debug rollout policy\",\"path\":\".worktrees/304-product/docs/DEBUG-ROLLOUT.md\"}","call_id":"call_F02Shv31MZRjt82zq5Ok0TJW","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}}]},"duration":9547.163699999917,"ttft":9402.099499999546,"completedAt":1789113790787,"contextSnapshot":{"promptTokens":10128,"nonMessageTokens":10264,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_xMpxLj9VB3kvyxVvYpW6HWje|fc_07a38c9435caeae6016aa3b5bc478c87d28401a20394e049b7","toolName":"read","startedAt":"2026-09-11T08:03:10.816Z","args":{"path":"issue://BigscreenVR/spt-bs-releases/267"},"intent":"Reading reported update freeze"},"id":"5f51f569","parentId":"35d88dca","timestamp":"2026-09-11T08:03:10.816Z"}
{"type":"credential_pin","id":"5bf6bfab","parentId":"5f51f569","timestamp":"2026-09-11T08:03:10.816Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_F02Shv31MZRjt82zq5Ok0TJW|fc_07a38c9435caeae6016aa3b5bc479887d296fea6db726a2bdc","toolName":"read","startedAt":"2026-09-11T08:03:10.816Z","args":{"path":".worktrees/304-product/docs/DEBUG-ROLLOUT.md"},"intent":"Reading debug rollout policy"},"id":"a929ed2a","parentId":"5bf6bfab","timestamp":"2026-09-11T08:03:10.816Z"}
{"type":"message","id":"17ce1904","parentId":"a929ed2a","timestamp":"2026-09-11T08:03:10.822Z","message":{"role":"toolResult","toolCallId":"call_s9Z8iq7EG0T353ysJ4EiCgtG|fc_07a38c9435caeae6016aa3b5bc477887d2848a9d66f962fa77","toolName":"read","content":[{"type":"text","text":".\n - traceable-reqs.toml 2.0MB 14m ago\n - docs/ 51m ago\n - design/ 51m ago\n - W2-BUILT-REPORT.md 5.5KB 51m ago\n - adr/ 51m ago\n - UPDATE-WEDGE-2-ROUND3-RIG-VERDICT.md 5.2KB 51m ago\n - UPDATE-WEDGE-2-ROUND3-CODEREAD.md 7.6KB 51m ago\n - TWO-HOST-RUNBOOK.md 22.6KB 51m ago\n - TRACEABILITY.md 5.9KB 51m ago\n - THE-FORKENING-TRIAGE.md 6.2KB 51m ago\n - NEXT-MILESTONE-BUG-TRIAGE.md 43.9KB 51m ago\n - MUSL-W1-DISPATCH-RULING.md 4.1KB 51m ago\n - MUSL-W3-DISPATCH-RULING.md 4.5KB 51m ago\n - … 67 more\n - NEXT-MILESTONE-LIFECYCLETRUTH-TRIAGE.md 14.7KB 51m ago\n - releases-repo/ 51m ago\n - README.md 4.8KB 51m ago\n - SYNC.md 512B 51m ago\n - LICENSE-BINARY 1.8KB 51m ago\n - LICENSE-MIT 1.3KB 51m ago\n - installer/ 51m ago\n - install.ps1 12.5KB 51m ago\n - install.sh 8.2KB 51m ago\n - docs-site/ 51m ago\n - src/ 51m ago\n - llms.txt 5.2KB 51m ago\n - book.toml 872B 51m ago\n - theme/ 51m ago\n - crates/ 51m ago\n - xtask/ 51m ago\n - spt-live/ 51m ago\n - spt/ 51m ago\n - spt-term/ 51m ago\n - spt-procident/ 51m ago\n - spt-test-support/ 51m ago\n - spt-store/ 51m ago\n - spt-poolguard/ 51m ago\n - spt-daemon/ 51m ago\n - spt-net/ 51m ago\n - spt-msg/ 51m ago\n - … 1 more\n - spt-proto/ 51m ago\n - src/ 51m ago\n - .gitkeep 52B 51m ago\n - tests/ 51m ago\n - .gitkeep 24B 51m ago\n - M12-ENDPOINT-RUN-PICKER.md 5.6KB 51m ago\n - rust-toolchain.toml 33B 51m ago\n - M12-CANDIDATES.md 5.3KB 51m ago\n - V0.13.0-P1-RC-PASTE-DESIGN.md 5.0KB 51m ago\n - PHASE-B-RESULTS.md 15.1KB 51m ago\n - M11-PLAN.md 20.7KB 51m ago\n - V0.13.0-P0-PTY-INPUT-WRITER-DESIGN.md 7.2KB 51m ago\n - V0.13.0-P0-JIT-PLAN.md 6.9KB 51m ago\n - MESH-D8-PLAN.md 6.6KB 51m ago\n - M1-PLAN.md 9.6KB 51m ago\n - V0.13.0-DELIVERY-CONTROL-JIT.md 16.6KB 51m ago\n - W3-67-JIT.md 4.8KB 51m ago\n - MESH-D7-PLAN.md 9.0KB 51m ago\n - M0-PLAN.md 7.9KB 51m ago\n - V0.13.0-BUG2-RC-VT-TRANSLATE-PLAN.md 5.7KB 51m ago\n - M4-D9-PLAN.md 20.4KB 51m ago\n - MESH-D6-PLAN.md 7.7KB 51m ago\n - W3-272-MEASUREMENTS.md 4.3KB 51m ago\n - KEYSTONE-182-JIT.md 104.8KB 51m ago\n - V0.12.1-LIFECYCLE-JIT.md 17.9KB 51m ago\n - M4-D8-PLAN.md 14.5KB 51m ago\n - MESH-D5-PLAN.md 12.2KB 51m ago\n - W3-196-JIT.md 9.9KB 51m ago\n - IO-PARSER-22-JIT.md 6.1KB 51m ago\n - W3-196-CENSUS.md 9.9KB 51m ago\n - M4-D7.5-PLAN.md 9.0KB 51m ago\n - MESH-D4-PLAN.md 11.6KB 51m ago\n - U3-VERB-SURFACE-JIT.md 13.5KB 51m ago\n - W3-186-JIT.md 5.3KB 51m ago\n - M4-D7-PLAN.md 8.0KB 51m ago\n - MESH-D3-PLAN.md 9.9KB 51m ago\n - SUBNET-MESH-PLAN.md 11.8KB 51m ago\n - INBOUND-FIREWALL-JIT.md 6.2KB 51m ago\n - W3-172-JIT.md 6.7KB 51m ago\n - MESH-D2-PLAN.md 11.6KB 51m ago\n - M4-D6-PLAN.md 8.6KB 51m ago\n - IDLE-EDGE-JIT.md 13.0KB 51m ago\n - SIGNET-218-JIT.md 10.8KB 51m ago\n - W2-JIT.md 23.3KB 51m ago\n - M4-D5-PLAN.md 9.7KB 51m ago\n - MESH-D1-PLAN.md 6.3KB 51m ago\n - GATE-W2-272-CHECKLIST.md 372.7KB 51m ago\n - M4-D4-PLAN.md 5.9KB 51m ago\n - W1-TRANCHE2-JIT.md 5.2KB 51m ago\n - ROADMAP.md 29.4KB 51m ago\n - M4-D3-PLAN.md 6.1KB 51m ago\n - MESH-D0-PLAN.md 5.8KB 51m ago\n - W1-209-JIT.md 10.0KB 51m ago\n - FIELD-SEAL-63-JIT.md 5.8KB 51m ago\n - RESTORATION-PLAN.md 24.0KB 51m ago\n - M4-D2g-PLAN.md 4.6KB 51m ago\n - M9-WAVE3-JIT.md 16.7KB 51m ago\n - W1-209-CENSUS.md 12.1KB 51m ago\n - F-019-TRANSLATION-BINARY-INSTALL-DIR-RESOLVE-DESIGN.md 6.0KB 51m ago\n - M4-D2f-PLAN.md 4.1KB 51m ago\n - RESTORATION-D7-PLAN.md 36.2KB 51m ago\n - M9-WAVE2-ROLE-WRITERS.md 7.7KB 51m ago\n - V074-PLAN.md 14.8KB 51m ago\n - F-018-ADAPTER-ADD-NONDESTRUCTIVE-DESIGN.md 5.2KB 51m ago\n - M9-WAVE1-ADDRESSING-SURVEY.md 5.7KB 51m ago\n - M4-D2-WIRE-PLAN.md 7.6KB 51m ago\n - RESTORATION-D6-PLAN.md 39.3KB 51m ago\n - EMISSION-RESIDUAL-CENSUS-METER.py 2.7KB 51m ago\n - V042-PLAN.md 9.1KB 51m ago\n - M3c-PLAN.md 9.1KB 51m ago\n - M9-PLAN.md 12.0KB 51m ago\n - RESTORATION-D5-PLAN.md 22.4KB 51m ago\n - V032-PLAN.md 6.3KB 51m ago\n - adapters/ 51m ago\n - mock/ 51m ago\n - mock-gateway/ 51m ago\n - EMISSION-RESIDUAL-CENSUS-FINDING.md 7.9KB 51m ago\n - M3b-PLAN.md 15.8KB 51m ago\n - RESTORATION-D4-PLAN.md 19.0KB 51m ago\n - M9-GATEWAY-WAN-PLAN.md 5.8KB 51m ago\n - V031-PLAN.md 4.7KB 51m ago\n - DIGEST-MILESTONE-PLAN.md 8.9KB 51m ago\n - M3a-PLAN.md 11.4KB 51m ago\n - RESTORATION-D3-PLAN.md 13.0KB 51m ago\n - V0.19.0-P6-SCREEN-GRID-DESIGN.md 12.0KB 51m ago\n - M8-PLAN.md 20.1KB 51m ago\n - DAEMON-LIFECYCLE-VERIFICATION.md 3.0KB 51m ago\n - V0.17.0-ROBUST-JOIN-AND-PRESENCE-JIT.md 9.5KB 51m ago\n - M3-PLAN.md 20.0KB 51m ago\n - M8-ACCEPTANCE.md 9.0KB 51m ago\n - RESTORATION-D2-PLAN.md 6.3KB 51m ago\n - V0.16.0-UPDATE-ARC-AND-CLI-JIT.md 7.0KB 51m ago\n - DAEMON-LIFECYCLE-PLAN.md 6.9KB 51m ago\n - M2b-PLAN.md 17.3KB 51m ago\n - RESTORATION-D1-PLAN.md 4.5KB 51m ago\n - V0.15.0-PLAN.md 21.0KB 51m ago\n - M2a-PLAN.md 12.9KB 51m ago\n - M8-ACCEPTANCE-STEPS.md 17.3KB 51m ago\n - DAEMON-LIFECYCLE-COMPLETION-PLAN.md 8.5KB 51m ago\n - WEBSERVE-272-W3-DRIFT-RIDERS.md 7.7KB 51m ago\n - M7-PLAN.md 9.0KB 51m ago\n - M12-W5-PLAN.md 6.9KB 51m ago\n - RESIDENT-SERVICE-JIT.md 5.3KB 51m ago\n - V0.14.1-HOME-SUBNET-PICKER-LAYER-DESIGN.md 7.5KB 51m ago\n - Cargo.toml 3.7KB 51m ago\n - WEBSERVE-272-W2-JIT.md 35.6KB 51m ago\n - M12-W4-RULING.md 5.8KB 51m ago\n - REQ-MSG-ENVELOPE-PLAN.md 4.8KB 51m ago\n - Cargo.lock 140.9KB 51m ago\n - M6-PLAN.md 10.3KB 51m ago\n - V0.14.0-ENDPOINT-CREATION-FLOW-JIT.md 10.4KB 51m ago\n - M12-W4-PLAN.md 14.6KB 51m ago\n - CONTEXT.md 343.3KB 51m ago\n - M5-PLAN.md 21.4KB 51m ago\n - REGISTER-SWEEP-242-DRAFT.md 6.9KB 51m ago\n - M12-W3-RULING.md 3.2KB 51m ago\n - V0.13.2-ADAPTER-PACKAGING-JIT.md 8.0KB 51m ago\n - WEBSERVE-272-JIT.md 30.3KB 51m ago\n - M5-D9-PLAN.md 7.1KB 51m ago\n - .github/ 51m ago\n - workflows/ 51m ago\n - ci/ 51m ago\n - bench/ 51m ago\n - REGISTER-SWEEP-0671-DRAFT.md 28.2KB 51m ago\n - M12-W3-PLAN.md 3.7KB 51m ago\n - V0.13.0-W5-DRIVEN-BY-SELF-HEAL-PLAN.md 4.8KB 51m ago\n - WAX-SEAL-W3-JIT.md 5.5KB 51m ago\n - CONCIERGE-183-JIT.md 58.3KB 51m ago\n - M5-D8-PLAN.md 9.6KB 51m ago\n - README.md 2.7KB 51m ago\n - M12-W2.5-RULING.md 7.2KB 51m ago\n - V0.13.0-W4-PICKER-UX-PLAN.md 4.6KB 51m ago\n - WAX-SEAL-21-JIT.md 10.5KB 51m ago\n - CLAUDE.md 293B 51m ago\n - M5-D7-PLAN.md 8.5KB 51m ago\n - RCA-274-R1-LINUX.md 5.4KB 51m ago\n - V0.13.0-VIEWER-RING-ROLL-SNAP-JIT.md 5.2KB 51m ago\n - M12-W2.5-PLAN.md 23.8KB 51m ago\n - M5-D6-PLAN.md 8.7KB 51m ago\n - CI-SELFHOST-PLAN.md 3.8KB 51m ago\n - W5-211-DESIGN.md 7.3KB 51m ago\n - RCA-242-R2-LINUX.md 13.9KB 51m ago\n - V0.13.0-VIEWER-DRAIN-DECOUPLE-JIT.md 12.5KB 51m ago\n - M12-W2-RULING.md 8.8KB 51m ago\n - M5-D5-PLAN.md 7.2KB 51m ago\n - CHANGELOG.md 216.7KB 51m ago\n - PUMP-SEAM-PLAN.md 14.5KB 51m ago\n - W3-GATE-VERDICT.md 6.9KB 51m ago\n - M12-W2-PLAN.md 16.7KB 51m ago\n - V0.13.0-SKIP-TO-LIVE-JIT.md 8.3KB 51m ago\n - ASM-241-GATE-VERDICT.md 7.0KB 51m ago\n - M5-D4-PLAN.md 14.3KB 51m ago\n - PRD.md 31.6KB 51m ago\n - W3-DESIGN-PROPOSAL.md 16.5KB 51m ago\n - .gitattributes 2.2KB 51m ago\n - AGENTS.md 8.2KB 51m ago\n - M12-W1.5-PLAN.md 7.5KB 51m ago\n - V0.13.0-RC-VT-TRANSLATE-DESIGN.md 6.4KB 51m ago\n - M5-D3-PLAN.md 19.1KB 51m ago\n - W3-DESIGN-GATE.md 8.1KB 51m ago\n - M12-W1-PLAN.md 13.9KB 51m ago\n - PR-BODY-W2.md 21.2KB 51m ago\n - V0.13.0-P2-SESSION-RESUME-DESIGN.md 6.7KB 51m ago\n - .config/ 51m ago\n - nextest.toml 33.9KB 51m ago\n - .gitignore 3.8KB 51m ago\n - M4-PLAN.md 19.8KB 51m ago\n - W3-BISECT-JIT.md 4.2KB 51m ago\n - M12-PLAN.md 5.2KB 51m ago\n - PHASE-E-RULINGS.md 4.9KB 51m ago\n - V0.13.0-P1C-CONTROLLER-WRITER-REORDER-PLAN.md 8.3KB 51m ago\n\n[1 results limit reached. Use limit=2 for more]"}],"details":{"isDirectory":true,"resolvedPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product","meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product"},"limits":{"resultLimit":{"reached":1,"suggestion":2}}}},"isError":false,"timestamp":1789113790822}}
{"type":"message","id":"7345093a","parentId":"17ce1904","timestamp":"2026-09-11T08:03:10.823Z","message":{"role":"toolResult","toolCallId":"call_08TnxUatNWE2lCSWyGTXQP5f|fc_07a38c9435caeae6016aa3b5bc476087d28ac3f5e41fec1ab6","toolName":"read","content":[{"type":"text","text":"---\nname: diagnose\ndescription: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n---\n\n# Diagnose\n\nA discipline for hard bugs. Skip phases only when explicitly justified.\n\nWhen exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.\n\n## Phase 1 — Build a feedback loop\n\n**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.\n\nSpend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**\n\n### Ways to construct one — try them in roughly this order\n\n1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.\n2. **Curl / HTTP script** against a running dev server.\n3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.\n4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.\n5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.\n6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.\n7. **Property / fuzz loop.** If the bug is \"sometimes wrong output\", run 1000 random inputs and look for the failure mode.\n8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate \"boot at state X, check, repeat\" so you can `git bisect run` it.\n9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.\n10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.\n\nBuild the right feedback loop, and the bug is 90% fixed.\n\n### Iterate on the loop itself\n\nTreat the loop as a product. Once you have _a_ loop, ask:\n\n- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)\n- Can I make the signal sharper? (Assert on the specific symptom, not \"didn't crash\".)\n- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)\n\nA 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.\n\n### Non-deterministic bugs\n\nThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.\n\n### When you genuinely cannot build a loop\n\nStop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.\n\nDo not proceed to Phase 2 until you have a loop you believe in.\n\n## Phase 2 — Reproduce\n\nRun the loop. Watch the bug appear.\n\nConfirm:\n\n- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.\n- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).\n- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.\n\nDo not proceed until you reproduce the bug.\n\n## Phase 3 — Hypothesise\n\nGenerate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.\n\nEach hypothesis must be **falsifiable**: state the prediction it makes.\n\n> Format: \"If is the cause, then will make the bug disappear / will make it worse.\"\n\nIf you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.\n\n**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly (\"we just deployed a change to #3\"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.\n\n## Phase 4 — Instrument\n\nEach probe must map to a specific prediction from Phase 3. **Change one variable at a time.**\n\nTool preference:\n\n1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.\n2. **Targeted logs** at the boundaries that distinguish hypotheses.\n3. Never \"log everything and grep\".\n\n**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.\n\n**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.\n\n## Phase 5 — Fix + regression test\n\nWrite the regression test **before the fix** — but only if there is a **correct seam** for it.\n\nA correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.\n\n**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.\n\nIf a correct seam exists:\n\n1. Turn the minimised repro into a failing test at that seam.\n2. Watch it fail.\n3. Apply the fix.\n4. Watch it pass.\n5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.\n\n## Phase 6 — Cleanup + post-mortem\n\nRequired before declaring done:\n\n- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)\n- [ ] Regression test passes (or absence of seam is documented)\n- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)\n- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)\n- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns\n\n**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started."}],"details":{"resolvedPath":"C:\\Users\\decid\\.agents\\skills\\diagnose\\SKILL.md","contentType":"text/markdown","totalLines":117,"displayContent":{"text":"---\r\nname: diagnose\r\ndescription: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\r\n---\r\n\r\n# Diagnose\r\n\r\nA discipline for hard bugs. Skip phases only when explicitly justified.\r\n\r\nWhen exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.\r\n\r\n## Phase 1 — Build a feedback loop\r\n\r\n**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.\r\n\r\nSpend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**\r\n\r\n### Ways to construct one — try them in roughly this order\r\n\r\n1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.\r\n2. **Curl / HTTP script** against a running dev server.\r\n3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.\r\n4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.\r\n5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.\r\n6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.\r\n7. **Property / fuzz loop.** If the bug is \"sometimes wrong output\", run 1000 random inputs and look for the failure mode.\r\n8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate \"boot at state X, check, repeat\" so you can `git bisect run` it.\r\n9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.\r\n10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.\r\n\r\nBuild the right feedback loop, and the bug is 90% fixed.\r\n\r\n### Iterate on the loop itself\r\n\r\nTreat the loop as a product. Once you have _a_ loop, ask:\r\n\r\n- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)\r\n- Can I make the signal sharper? (Assert on the specific symptom, not \"didn't crash\".)\r\n- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)\r\n\r\nA 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.\r\n\r\n### Non-deterministic bugs\r\n\r\nThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.\r\n\r\n### When you genuinely cannot build a loop\r\n\r\nStop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.\r\n\r\nDo not proceed to Phase 2 until you have a loop you believe in.\r\n\r\n## Phase 2 — Reproduce\r\n\r\nRun the loop. Watch the bug appear.\r\n\r\nConfirm:\r\n\r\n- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.\r\n- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).\r\n- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.\r\n\r\nDo not proceed until you reproduce the bug.\r\n\r\n## Phase 3 — Hypothesise\r\n\r\nGenerate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.\r\n\r\nEach hypothesis must be **falsifiable**: state the prediction it makes.\r\n\r\n> Format: \"If is the cause, then will make the bug disappear / will make it worse.\"\r\n\r\nIf you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.\r\n\r\n**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly (\"we just deployed a change to #3\"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.\r\n\r\n## Phase 4 — Instrument\r\n\r\nEach probe must map to a specific prediction from Phase 3. **Change one variable at a time.**\r\n\r\nTool preference:\r\n\r\n1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.\r\n2. **Targeted logs** at the boundaries that distinguish hypotheses.\r\n3. Never \"log everything and grep\".\r\n\r\n**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.\r\n\r\n**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.\r\n\r\n## Phase 5 — Fix + regression test\r\n\r\nWrite the regression test **before the fix** — but only if there is a **correct seam** for it.\r\n\r\nA correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.\r\n\r\n**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.\r\n\r\nIf a correct seam exists:\r\n\r\n1. Turn the minimised repro into a failing test at that seam.\r\n2. Watch it fail.\r\n3. Apply the fix.\r\n4. Watch it pass.\r\n5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.\r\n\r\n## Phase 6 — Cleanup + post-mortem\r\n\r\nRequired before declaring done:\r\n\r\n- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)\r\n- [ ] Regression test passes (or absence of seam is documented)\r\n- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)\r\n- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)\r\n- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns\r\n\r\n**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117]},"meta":{"source":{"type":"internal","value":"skill://diagnose"}}},"isError":false,"timestamp":1789113790823}}
{"type":"message","id":"4b17873b","parentId":"7345093a","timestamp":"2026-09-11T08:03:10.824Z","message":{"role":"toolResult","toolCallId":"call_F02Shv31MZRjt82zq5Ok0TJW|fc_07a38c9435caeae6016aa3b5bc479887d296fea6db726a2bdc","toolName":"read","content":[{"type":"text","text":"# Debug rollout runbook\n\n\n\nDebug rollout is the maintainer-only fast path for testing a local spt-core\nbuild across a trusted lab subnet. It uses the normal signed self-update\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\nembedded debug trust anchor.\n\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\n\n## Mental model\n\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\n artifact digest per Rust target triple.\n- Each recipient verifies the set under its node-local `release-keys.json`,\n selects only its own platform artifact, stages it, and then follows the normal\n consent/apply policy.\n- Debug and stable are separate channels. A debug-pinned node accepts only\n `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\n- Debug versions are monotonic within the debug channel. To recover from a bad\n debug build, publish a higher debug version, even if the bytes are a previous\n known-good binary.\n- A broker-touching candidate may be staged, but apply refuses it while\n broker-held runtime is live. Shut down or suspend hosted endpoints first; the\n first flow does not auto-cycle them.\n\n## One-time lab setup\n\nGenerate a debug key on the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-keygen dev-debug-2026\n```\n\nSet the printed seed as a long-lived coordinator-local environment variable:\n\n```powershell\n$env:SPT_DEBUG_RELEASE_SEED = \"\"\n```\n\nPin each lab node to the debug channel with the printed public key:\n\n```powershell\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key \n```\n\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\n`\"stable\"` removes the node from debug rollout eligibility.\n\n## Stage a rollout\n\nFrom the fast coordinator, stage an update set into the local release cache:\n\n```powershell\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=\"\n```\n\nCommon flags:\n\n- `--build-current` builds and includes the coordinator's current platform.\n- `--artifact ` adds an already-built artifact for another target,\n such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\n- `--version ` overrides the local debug sequence. Use a higher value when\n recovering from lost local state.\n- `--product-version ` stamps the product semver on the signed set\n (default empty — the apply message then falls back to the release counter).\n The composite `spt update`'s adapters leg reads this field as its\n staged-basis floor comparison, so a lab recipe exercising adapter floors\n against a staged core must stamp it. Ordering stays with the monotonic\n counter; this field never decides which release is newer.\n- `--channel ` overrides the set's channel (default `debug`). A lab rig\n whose recipient home stays pinned to `stable` pairs this with a rig-key\n overlay in that home's `release-keys.json`; fleet debug nodes keep the\n default and the `debug-pin` flow.\n- `--stage-dir ` stages somewhere other than `$SPT_HOME/releases`.\n- `--state ` stores the local debug sequence somewhere other than\n `target/debug-rollout-state.json`.\n\nThe staged update then propagates through the normal pull-based update pump.\nThere is intentionally no bespoke push path.\n\n## Apply and observe\n\nOn a default-gated node, apply is still explicit:\n\n```powershell\nspt update apply\n```\n\nNodes configured for full-auto update may apply after staging without a prompt.\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\nquery peers promptly.\n\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\nrun the maintainer watcher from the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-converge --version [--subnet ] [--timeout 120] [--poll 3]\n```\n\nIt polls every expected node (the coordinator's trust rows; `--nodes `\noverrides) over the status-only update query and prints a per-node table —\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\n`Offline` — exiting `0` only when every node applied the target (`1`\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\nThe manual walk below remains the fallback.\n\nUseful outcomes:\n\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\n Rust target triple.\n- `WrongChannel` means the node is not pinned to `debug`.\n- `Rollback` means the offered debug version is not greater than the node's\n current debug-channel version.\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\n resources; quiesce hosted endpoints first.\n\n## Agent checklist\n\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\n `spt` CLI/help surface.\n3. Keep verification on the production update substrate: signed metadata,\n per-platform artifact digest, channel pinning, monotonic version, and\n apply-time re-verification.\n4. Add or update traceability evidence for `REQ-UPD-6`.\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`."}],"details":{"totalLines":130,"displayContent":{"text":"# Debug rollout runbook\r\n\r\n\r\n\r\nDebug rollout is the maintainer-only fast path for testing a local spt-core\r\nbuild across a trusted lab subnet. It uses the normal signed self-update\r\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\r\nembedded debug trust anchor.\r\n\r\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\r\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\r\n\r\n## Mental model\r\n\r\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\r\n artifact digest per Rust target triple.\r\n- Each recipient verifies the set under its node-local `release-keys.json`,\r\n selects only its own platform artifact, stages it, and then follows the normal\r\n consent/apply policy.\r\n- Debug and stable are separate channels. A debug-pinned node accepts only\r\n `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\r\n- Debug versions are monotonic within the debug channel. To recover from a bad\r\n debug build, publish a higher debug version, even if the bytes are a previous\r\n known-good binary.\r\n- A broker-touching candidate may be staged, but apply refuses it while\r\n broker-held runtime is live. Shut down or suspend hosted endpoints first; the\r\n first flow does not auto-cycle them.\r\n\r\n## One-time lab setup\r\n\r\nGenerate a debug key on the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-keygen dev-debug-2026\r\n```\r\n\r\nSet the printed seed as a long-lived coordinator-local environment variable:\r\n\r\n```powershell\r\n$env:SPT_DEBUG_RELEASE_SEED = \"\"\r\n```\r\n\r\nPin each lab node to the debug channel with the printed public key:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key \r\n```\r\n\r\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\r\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\r\n`\"stable\"` removes the node from debug rollout eligibility.\r\n\r\n## Stage a rollout\r\n\r\nFrom the fast coordinator, stage an update set into the local release cache:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=\"\r\n```\r\n\r\nCommon flags:\r\n\r\n- `--build-current` builds and includes the coordinator's current platform.\r\n- `--artifact ` adds an already-built artifact for another target,\r\n such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\r\n- `--version ` overrides the local debug sequence. Use a higher value when\r\n recovering from lost local state.\r\n- `--product-version ` stamps the product semver on the signed set\r\n (default empty — the apply message then falls back to the release counter).\r\n The composite `spt update`'s adapters leg reads this field as its\r\n staged-basis floor comparison, so a lab recipe exercising adapter floors\r\n against a staged core must stamp it. Ordering stays with the monotonic\r\n counter; this field never decides which release is newer.\r\n- `--channel ` overrides the set's channel (default `debug`). A lab rig\r\n whose recipient home stays pinned to `stable` pairs this with a rig-key\r\n overlay in that home's `release-keys.json`; fleet debug nodes keep the\r\n default and the `debug-pin` flow.\r\n- `--stage-dir ` stages somewhere other than `$SPT_HOME/releases`.\r\n- `--state ` stores the local debug sequence somewhere other than\r\n `target/debug-rollout-state.json`.\r\n\r\nThe staged update then propagates through the normal pull-based update pump.\r\nThere is intentionally no bespoke push path.\r\n\r\n## Apply and observe\r\n\r\nOn a default-gated node, apply is still explicit:\r\n\r\n```powershell\r\nspt update apply\r\n```\r\n\r\nNodes configured for full-auto update may apply after staging without a prompt.\r\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\r\nquery peers promptly.\r\n\r\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\r\nrun the maintainer watcher from the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-converge --version [--subnet ] [--timeout 120] [--poll 3]\r\n```\r\n\r\nIt polls every expected node (the coordinator's trust rows; `--nodes `\r\noverrides) over the status-only update query and prints a per-node table —\r\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\r\n`Offline` — exiting `0` only when every node applied the target (`1`\r\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\r\nThe manual walk below remains the fallback.\r\n\r\nUseful outcomes:\r\n\r\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\r\n Rust target triple.\r\n- `WrongChannel` means the node is not pinned to `debug`.\r\n- `Rollback` means the offered debug version is not greater than the node's\r\n current debug-channel version.\r\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\r\n resources; quiesce hosted endpoints first.\r\n\r\n## Agent checklist\r\n\r\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\r\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\r\n `spt` CLI/help surface.\r\n3. Keep verification on the production update substrate: signed metadata,\r\n per-platform artifact digest, channel pinning, monotonic version, and\r\n apply-time re-verification.\r\n4. Add or update traceability evidence for `REQ-UPD-6`.\r\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130]},"fileSize":5535,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\docs\\DEBUG-ROLLOUT.md"}}},"isError":false,"timestamp":1789113790824}}
{"type":"message","id":"731d0cc9","parentId":"4b17873b","timestamp":"2026-09-11T08:03:11.961Z","message":{"role":"toolResult","toolCallId":"call_4fJUvWw16CWLMQExVnOLxDk9|fc_07a38c9435caeae6016aa3b5bc477c87d2b67eac3d874861a1","toolName":"read","content":[{"type":"text","text":"# Issue #302: diagnose + fix: rc sessions frequently hitch\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-11T05:44:43Z\nUpdated: 2026-09-11T07:10:38Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/302\n\n## Body\n\npty stream + input freezes every 10-20 seconds. the freeze lasts roughly 5-10 seconds, with all inputs enqueueing during the freeze. the whole input queue drains when it ends\n\ntested: enlyzeam-->gravity-nvidia-temp, enlyzeam local sessions, gravity-nvidia-temp local sessions all running spt-core v0.69.0\n\n---\nRequester: discord:reavo."}],"details":{"contentType":"text/markdown","totalLines":17,"displayContent":{"text":"# Issue #302: diagnose + fix: rc sessions frequently hitch\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-11T05:44:43Z\nUpdated: 2026-09-11T07:10:38Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/302\n\n## Body\n\npty stream + input freezes every 10-20 seconds. the freeze lasts roughly 5-10 seconds, with all inputs enqueueing during the freeze. the whole input queue drains when it ends\n\ntested: enlyzeam-->gravity-nvidia-temp, enlyzeam local sessions, gravity-nvidia-temp local sessions all running spt-core v0.69.0\n\n---\nRequester: discord:reavo.","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17]},"meta":{"source":{"type":"internal","value":"issue://BigscreenVR/spt-bs-releases/302"}}},"isError":false,"timestamp":1789113791960}}
{"type":"message","id":"c760c22f","parentId":"731d0cc9","timestamp":"2026-09-11T08:03:11.962Z","message":{"role":"toolResult","toolCallId":"call_xMpxLj9VB3kvyxVvYpW6HWje|fc_07a38c9435caeae6016aa3b5bc478c87d28401a20394e049b7","toolName":"read","content":[{"type":"text","text":"# Issue #267: fix: `spt daemon refresh` stalls session PTYs\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-05T02:52:46Z\nUpdated: 2026-09-11T07:10:44Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/267\n\n## Body\n\nalso happens after `spt update`\n\nall PTYs recover ok **after** an intentional detach + followup `spt rc`/`spt go` back to the same endpoint session\n\n---\nRequester: discord:reavo."}],"details":{"contentType":"text/markdown","totalLines":17,"displayContent":{"text":"# Issue #267: fix: `spt daemon refresh` stalls session PTYs\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-05T02:52:46Z\nUpdated: 2026-09-11T07:10:44Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/267\n\n## Body\n\nalso happens after `spt update`\n\nall PTYs recover ok **after** an intentional detach + followup `spt rc`/`spt go` back to the same endpoint session\n\n---\nRequester: discord:reavo.","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17]},"meta":{"source":{"type":"internal","value":"issue://BigscreenVR/spt-bs-releases/267"}}},"isError":false,"timestamp":1789113791961}}
{"type":"message","id":"60812030","parentId":"c760c22f","timestamp":"2026-09-11T08:03:11.962Z","message":{"role":"toolResult","toolCallId":"call_C4r5tq1pH4lEoC0AB2uqPvOI|fc_07a38c9435caeae6016aa3b5bc478487d29520526b665a9d4d","toolName":"read","content":[{"type":"text","text":"# Issue #49: all spt rc connections freeze across `spt daemon refresh` / staged self-update restart (long-standing; prior fixes unsuccessful)\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-07-31T05:32:47Z\nUpdated: 2026-09-11T07:10:43Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/49\n\n## Body\n\nOperator-filed 2026-07-31 (via doyle).\n\nEvery active `spt rc` connection freezes whenever the daemon brain restarts under it: `spt daemon refresh` reproduces it directly, and `spt update` with a staged spt-core update (any equivalent brain-swap action) reproduces it the same way.\n\nThis is a LONG-STANDING bug with a failed-fix history — it has been attemptedly fixed before, more than once, and none of the attempts held. Treat every prior \"fixed\" claim in the history as refuted by field evidence; the RCA must explain why the prior attempts failed, not just propose another patch.\n\nContext the RCA should weigh (non-binding): the broker/brain split exists precisely to keep endpoints (including rc viewports) alive across a brain swap (seamless self-update architecture); rc reconnect obligations and no-endpoint-terminates-during-update obligations both exist in the registry and have shipped evidence, yet the field behavior persists — so either the contract is satisfied in test but unsound in the field path, or a different layer (viewport pump, attach lease, broker handoff) is the real owner.\n\nOperator sequencing ruling (2026-07-31): this Request is NOT in the current greenlit batch. It goes to a joint RCA-first lane alongside #42 (relay path RCA) AFTER the current EVAL batch (#40 #41 #43 #48) ships; fixes for both ship together from that RCA. RCA-first discipline applies (agreement-never-promotes-to-proven).\n\nAttachments:\n- [mint-rc-freeze.txt](https://github.com/BigscreenVR/spt-bs-releases/releases/download/untagged-3ecc0debcb4b3bffe480/shx-1785475938589153900-mint-rc-freeze.txt)\n\n---\nRequester: doyle"}],"details":{"contentType":"text/markdown","totalLines":26,"displayContent":{"text":"# Issue #49: all spt rc connections freeze across `spt daemon refresh` / staged self-update restart (long-standing; prior fixes unsuccessful)\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-07-31T05:32:47Z\nUpdated: 2026-09-11T07:10:43Z\nLabels: state: WIP, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/49\n\n## Body\n\nOperator-filed 2026-07-31 (via doyle).\n\nEvery active `spt rc` connection freezes whenever the daemon brain restarts under it: `spt daemon refresh` reproduces it directly, and `spt update` with a staged spt-core update (any equivalent brain-swap action) reproduces it the same way.\n\nThis is a LONG-STANDING bug with a failed-fix history — it has been attemptedly fixed before, more than once, and none of the attempts held. Treat every prior \"fixed\" claim in the history as refuted by field evidence; the RCA must explain why the prior attempts failed, not just propose another patch.\n\nContext the RCA should weigh (non-binding): the broker/brain split exists precisely to keep endpoints (including rc viewports) alive across a brain swap (seamless self-update architecture); rc reconnect obligations and no-endpoint-terminates-during-update obligations both exist in the registry and have shipped evidence, yet the field behavior persists — so either the contract is satisfied in test but unsound in the field path, or a different layer (viewport pump, attach lease, broker handoff) is the real owner.\n\nOperator sequencing ruling (2026-07-31): this Request is NOT in the current greenlit batch. It goes to a joint RCA-first lane alongside #42 (relay path RCA) AFTER the current EVAL batch (#40 #41 #43 #48) ships; fixes for both ship together from that RCA. RCA-first discipline applies (agreement-never-promotes-to-proven).\n\nAttachments:\n- [mint-rc-freeze.txt](https://github.com/BigscreenVR/spt-bs-releases/releases/download/untagged-3ecc0debcb4b3bffe480/shx-1785475938589153900-mint-rc-freeze.txt)\n\n---\nRequester: doyle","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26]},"meta":{"source":{"type":"internal","value":"issue://BigscreenVR/spt-bs-releases/49"}}},"isError":false,"timestamp":1789113791962}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_N6j4vvDR5mMNGZpG7lebRGZD|fc_07a38c9435caeae6016aa3b5c77c9c87d2bbbe11d85f83a9ce","toolName":"read","startedAt":"2026-09-11T08:03:21.917Z","args":{"path":".worktrees/304-product/AGENTS.md"},"intent":"Reading project rules"},"id":"bb4438e0","parentId":"60812030","timestamp":"2026-09-11T08:03:21.917Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uhwJPSGI4D7cC5TEnFFcolXY|fc_07a38c9435caeae6016aa3b5c77cb087d29a505f83ffef286a","toolName":"grep","startedAt":"2026-09-11T08:03:21.917Z","args":{"path":".worktrees/304-product/CHANGELOG.md;.worktrees/304-product/docs;.worktrees/304-product/CONTEXT.md"},"intent":"Locating freeze history"},"id":"0338cf43","parentId":"bb4438e0","timestamp":"2026-09-11T08:03:21.917Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_25L7ZUm2X8hsjQcoW6cHbFCf|fc_07a38c9435caeae6016aa3b5c77cbc87d288e3f47b78d3b3e0","toolName":"glob","startedAt":"2026-09-11T08:03:21.917Z","args":{"path":".worktrees/304-product/crates/**/attach.rs;.worktrees/304-product/crates/**/broker.rs;.worktrees/304-product/crates/**/rc.rs;.worktrees/304-product/crates/**/*refresh*;.worktrees/304-product/crates/**…"},"intent":"Locating attach and update sources"},"id":"020f2e41","parentId":"0338cf43","timestamp":"2026-09-11T08:03:21.917Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_G5bLExSGLGxfS78GHlvdJqxs|fc_07a38c9435caeae6016aa3b5c77cc487d2a6ef1d43eb240849","toolName":"read","startedAt":"2026-09-11T08:03:21.918Z","args":{"path":"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments"},"intent":"Reading issue discussion history"},"id":"c4805360","parentId":"020f2e41","timestamp":"2026-09-11T08:03:21.918Z"}
{"type":"message","id":"c941e582","parentId":"c4805360","timestamp":"2026-09-11T08:03:21.918Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_N6j4vvDR5mMNGZpG7lebRGZD|fc_07a38c9435caeae6016aa3b5c77c9c87d2bbbe11d85f83a9ce","name":"read","arguments":{"i":"Reading project rules","path":".worktrees/304-product/AGENTS.md"},"intent":"Reading project rules"},{"type":"toolCall","id":"call_uhwJPSGI4D7cC5TEnFFcolXY|fc_07a38c9435caeae6016aa3b5c77cb087d29a505f83ffef286a","name":"grep","arguments":{"i":"Locating freeze history","pattern":"#49|freeze|267|302","path":".worktrees/304-product/CHANGELOG.md;.worktrees/304-product/docs;.worktrees/304-product/CONTEXT.md","case":false,"gitignore":true,"skip":null},"intent":"Locating freeze history"},{"type":"toolCall","id":"call_25L7ZUm2X8hsjQcoW6cHbFCf|fc_07a38c9435caeae6016aa3b5c77cbc87d288e3f47b78d3b3e0","name":"glob","arguments":{"i":"Locating attach and update sources","path":".worktrees/304-product/crates/**/attach.rs;.worktrees/304-product/crates/**/broker.rs;.worktrees/304-product/crates/**/rc.rs;.worktrees/304-product/crates/**/*refresh*;.worktrees/304-product/crates/**/*update*;.worktrees/304-product/docs/*DOMAIN*;.worktrees/304-product/docs/adr/*0016*","hidden":true,"gitignore":true,"limit":60},"intent":"Locating attach and update sources"},{"type":"toolCall","id":"call_G5bLExSGLGxfS78GHlvdJqxs|fc_07a38c9435caeae6016aa3b5c77cc487d2a6ef1d43eb240849","name":"read","arguments":{"i":"Reading issue discussion history","path":"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments"},"intent":"Reading issue discussion history"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10053,"output":272,"cacheRead":8448,"cacheWrite":0,"totalTokens":18773,"cost":{"input":0.10053000000000001,"output":0.013600000000000001,"cacheRead":0.008447999999999999,"cacheWrite":0,"total":0.122578}},"stopReason":"toolUse","timestamp":1789113792011,"responseId":"resp_07a38c9435caeae6016aa3b5be2c9c87d2aedb760b5ace63a6","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_07a38c9435caeae6016aa3b5c77c9c87d2bbbe11d85f83a9ce","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading project rules\",\"path\":\".worktrees/304-product/AGENTS.md\"}","call_id":"call_N6j4vvDR5mMNGZpG7lebRGZD","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5c77cb087d29a505f83ffef286a","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating freeze history\",\"pattern\":\"#49|freeze|267|302\",\"path\":\".worktrees/304-product/CHANGELOG.md;.worktrees/304-product/docs;.worktrees/304-product/CONTEXT.md\",\"case\":false,\"gitignore\":true,\"skip\":null}","call_id":"call_uhwJPSGI4D7cC5TEnFFcolXY","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5c77cbc87d288e3f47b78d3b3e0","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating attach and update sources\",\"path\":\".worktrees/304-product/crates/**/attach.rs;.worktrees/304-product/crates/**/broker.rs;.worktrees/304-product/crates/**/rc.rs;.worktrees/304-product/crates/**/*refresh*;.worktrees/304-product/crates/**/*update*;.worktrees/304-product/docs/*DOMAIN*;.worktrees/304-product/docs/adr/*0016*\",\"hidden\":true,\"gitignore\":true,\"limit\":60}","call_id":"call_25L7ZUm2X8hsjQcoW6cHbFCf","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"glob","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5c77cc487d2a6ef1d43eb240849","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading issue discussion history\",\"path\":\"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments\"}","call_id":"call_G5bLExSGLGxfS78GHlvdJqxs","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}}]},"duration":9904.096400000155,"ttft":9858.18060000008,"completedAt":1789113801916,"contextSnapshot":{"promptTokens":18501,"nonMessageTokens":10264,"compactionEpoch":0}}}
{"type":"message","id":"d17e314d","parentId":"c941e582","timestamp":"2026-09-11T08:03:21.924Z","message":{"role":"toolResult","toolCallId":"call_N6j4vvDR5mMNGZpG7lebRGZD|fc_07a38c9435caeae6016aa3b5c77c9c87d2bbbe11d85f83a9ce","toolName":"read","content":[{"type":"text","text":"# spt-core — agent working rules\n\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\n\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\n\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\n\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\n\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\n\n## Requirement traceability (binding)\n\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\n\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\n\n## Issue tracking (unique case)\n\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\n\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\n\n## Other conventions\n\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\n\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\n3. Execute the /self-clear skill\n\n[Some lines truncated to 768 chars]"}],"details":{"totalLines":47,"displayContent":{"text":"# spt-core — agent working rules\r\n\r\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\r\n\r\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\r\n\r\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\r\n\r\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\r\n\r\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\r\n\r\n## Requirement traceability (binding)\r\n\r\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\r\n\r\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\r\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\r\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\r\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\r\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\r\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\r\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\r\n\r\n## Issue tracking (unique case)\r\n\r\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\r\n\r\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\r\n\r\n## Other conventions\r\n\r\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\r\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\r\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\r\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\r\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\r\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\r\n\r\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\r\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\r\n\r\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\r\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\r\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\r\n3. Execute the /self-clear skill\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47]},"fileSize":8436,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\AGENTS.md"},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789113801924}}
{"type":"message","id":"84c5d2b2","parentId":"d17e314d","timestamp":"2026-09-11T08:03:21.934Z","message":{"role":"toolResult","toolCallId":"call_25L7ZUm2X8hsjQcoW6cHbFCf|fc_07a38c9435caeae6016aa3b5c77cbc87d288e3f47b78d3b3e0","toolName":"glob","content":[{"type":"text","text":"# .worktrees/304-product/\n## crates/\n### spt/\n#### src/\nrc.rs\nattach.rs\n#### tests/\ndaemon_refresh_e2e.rs\n### spt-daemon/\n#### tests/\nattach.rs\nnotif_update_row_retire.rs\nbroker.rs\n#### src/\nupdate.rs\nattach.rs\nadapter_update.rs\nbroker.rs\n##### pump/\nupdate.rs\n### spt-net/src/net/\nupdate.rs\nattach.rs\n## docs/adr/\n0016-platform-targeted-update-sets.md"}],"details":{"scopePath":".worktrees/304-product/crates/**/attach.rs, .worktrees/304-product/crates/**/broker.rs, .worktrees/304-product/crates/**/rc.rs, .worktrees/304-product/crates/**/*refresh*, .worktrees/304-product/crates/**/*update*, .worktrees/304-product/docs/*DOMAIN*, .worktrees/304-product/docs/adr/*0016*","fileCount":14,"files":[".worktrees/304-product/crates/spt/src/rc.rs",".worktrees/304-product/crates/spt/src/attach.rs",".worktrees/304-product/docs/adr/0016-platform-targeted-update-sets.md",".worktrees/304-product/crates/spt/tests/daemon_refresh_e2e.rs",".worktrees/304-product/crates/spt-daemon/tests/attach.rs",".worktrees/304-product/crates/spt-daemon/tests/notif_update_row_retire.rs",".worktrees/304-product/crates/spt-daemon/src/pump/update.rs",".worktrees/304-product/crates/spt-daemon/src/update.rs",".worktrees/304-product/crates/spt-daemon/src/attach.rs",".worktrees/304-product/crates/spt-daemon/src/adapter_update.rs",".worktrees/304-product/crates/spt-net/src/net/update.rs",".worktrees/304-product/crates/spt-net/src/net/attach.rs",".worktrees/304-product/crates/spt-daemon/src/broker.rs",".worktrees/304-product/crates/spt-daemon/tests/broker.rs"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1789113801934}}
{"type":"message","id":"c4b6e604","parentId":"84c5d2b2","timestamp":"2026-09-11T08:03:21.953Z","message":{"role":"toolResult","toolCallId":"call_uhwJPSGI4D7cC5TEnFFcolXY|fc_07a38c9435caeae6016aa3b5c77cb087d29a505f83ffef286a","toolName":"grep","content":[{"type":"text","text":"# .worktrees/304-product/\n## CHANGELOG.md\n 1690|\n*1691|- `spt update` and `spt daemon refresh` no longer freeze attached views. An\n 1692| attached window could come back from one of these with its display stuck and\n 1693| its keyboard dead until it was detached and reattached. Attached windows now\n 1694| keep their control and keep working across the refresh.\n...\n 2003|\n*2004|- Attached endpoints no longer freeze for 15–25 seconds at a time. The daemon\n 2005| could keep re-applying old peer-directory updates; each update is now applied\n 2006| once and completed transfers are discarded immediately. This also ends the slow\n 2007| thread and memory growth that built up on long-lived connections.\n...\n 2029|\n*2030|- Attached sessions no longer freeze after a daemon update or refresh.\n 2031| Previously, a single bad viewer connection could hang an attached session for\n*2032| up to a minute; a stuck viewer can no longer freeze other sessions.\n 2033|\n 2034|- Improved the stability of controlled sessions across a daemon restart.\n 2035| Previously, session controllers could mix up and drop their attached sessions.\n...\n 2272|A reliability patch closing the last update-wedge failure mode: a stuck session\n*2273|consumer can no longer freeze the daemon under load.\n 2274|\n 2275|> **Applying this update needs a daemon restart.** Unlike the recent seamless\n 2276|> in-place updates, this fix lives in the always-on daemon, so `spt update fetch\n...\n 2293|A reliability patch completing the in-place-update fix: applying an update no longer\n*2294|freezes your live terminal sessions.\n 2295|\n 2296|### Fixed\n 2297|\n*2298|- Applying an update in place with `spt update fetch --apply` could still freeze all of\n 2299| your live terminal sessions a few seconds after the swap — they stopped streaming and\n 2300| `spt rc` could no longer attach, so the box had to be restarted to recover. (The\n 2301| previous release narrowed this but did not fully close it.) Resuming across the update\n 2302| no longer floods the daemon's internal channel, so your open sessions keep streaming and\n*2303| `spt rc` keeps working straight through the swap — no freeze, no restart. (Because the\n 2304| fix lives in the incoming version, updating *to* this release is what makes your next\n 2305| in-place update seamless.)\n 2306|\n...\n 2313|\n*2314|- Applying an update in place with `spt update fetch --apply` could freeze or seize\n 2315| control of your live terminal sessions as the daemon restarted — a resumed session\n 2316| could be taken over so that your open session and `spt rc` stopped responding across\n 2317| the swap. Resumed sessions now re-attach as observers instead of taking over the\n...\n 2327|\n*2328|- Applying an update in place with `spt update fetch --apply` could freeze every live\n 2329| terminal session for about 30 seconds and then roll the update back instead of\n 2330| completing the swap. The incoming version now drives the running daemon to clear a\n 2331| hard-stopped prior session during the handoff, so the update completes seamlessly with\n*2332| your sessions staying up — no freeze, no rollback. (Because the fix lives in the\n 2333| incoming version's logic, updating *to* this release is what makes your next in-place\n 2334| update seamless.)\n 2335|\n...\n 2401|\n*2402|A lifecycle-reliability release: previously-online sessions are re-launched automatically after a daemon restart, an attached terminal no longer freezes behind a slow or suspended session, a long multi-line message typed into a live session arrives intact, and an in-place update finishes in a single command.\n 2403|\n 2404|### Added\n 2405|\n...\n 2416|- **Hosted sessions are re-launched after a daemon restart.** Previously-online sessions come back automatically once the daemon restarts (including as part of an update) instead of being left offline. The restart still interrupts them — this restores the session, it does not preserve its in-flight work.\n*2417|- **An attached terminal no longer freezes behind a stalled session.** If a session's underlying process hangs or is suspended, `spt rc` keeps updating and a stuck connection is dropped automatically so you never lose control; reattaching and taking control (`--take`) keep working. `spt daemon status` reports when such a drop happened.\n 2418|- **A long, multi-line message typed into a live agent's terminal arrives complete.** When a message is delivered by typing it into a live session, it is no longer truncated at the front. (Messages drained through the polling channel were never affected.)\n 2419|- **`spt endpoint digest --json` no longer repeats rows.** Activity replayed across a session checkpoint is collapsed to a single entry.\n 2420|- **Waking an agent starts exactly one session.** Two wake requests arriving at once no longer launch it twice.\n...\n 2806|\n*2807|- **Pasting or typing into an spt-hosted endpoint no longer freezes the daemon.** A large paste or input burst could wedge the daemon's input path so every new attach died; input now runs on a dedicated per-session writer and never blocks the daemon (this also covers the effect-journal stall on interactive input).\n 2808|- **Session resume actually resumes now.** Agent endpoints track session history and offer explicit session resume via `spt endpoint run` (`--resume ` or *Resume from history*); the adapter manifest can now declare a `[session.resume]` command so the relaunch reattaches the prior session instead of always starting a new one. The run picker now shows each row's working directory and local time.\n 2809|- **`spt rc --view` viewers survive a high-output terminal.** A viewer no longer dies when the output backlog rolls over or it is briefly evicted — it snaps forward or skips to live instead of failing — and a slow controller can no longer starve a concurrent viewer.\n 2810|- **`spt rc` no longer races a just-started agent.** Attach now waits for the endpoint to come online, instead of failing when you attach immediately after `spt endpoint run`.\n...\n 2826|- **Closing the terminal that started an agent no longer kills it.** When `spt endpoint run` launches the background daemon for you, closing that terminal tab or window now leaves the agent running and re-attachable with `spt rc `.\n*2827|- **A crashed agent with a disconnected viewer no longer freezes the daemon.** A dead agent process combined with an abruptly-closed `spt rc` could previously wedge the daemon so new agents wouldn't start; the daemon now stays responsive and marks the dead agent offline.\n 2828|\n 2829|### Changed\n 2830|\n...\n 2917|\n*2918|- **A dead or unresponsive peer can no longer stall background sync.** The daemon now bounds every network operation it makes on a live agent's behalf, so a roster peer that has gone offline (or stopped responding mid-handshake) fails fast as an ordinary, recoverable error instead of hanging the daemon's peer-sync loop. Previously such a peer could freeze background synchronization for tens of minutes and force repeated internal restarts; now the peer is simply skipped and retried on the next cycle, and ...\n 2919|\n 2920|## [0.8.2] - 2026-06-16\n 2921|\n...\n 3040|\n*3041|- **An unreachable peer can no longer stall your node's background work.** If another machine on your subnet dropped off mid-exchange — a network drop, a sleep, a hard crash — the daemon's outbound loops (peer sync, notifications, update checks) could hang waiting on it, in the worst case for hours, until something restarted the service. Now a stalled exchange gives up on its own in under a minute and the background loops resume, so one dead peer never freezes the rest of your node.\n 3042|\n 3043|## [0.4.0] - 2026-06-10\n 3044|\n\n## docs/\n### F-030-PSYCHE-EPHEMERAL-DESIGN.md\n 245|- **Adapter (perri):** `psyche-ephemeral-parked` branch rebased once core API\n*246| shape freezes (she reviews W1/W2 key contract before her rebase — field\n 247| review slot like F-027 §7); publish ONLY after core floor releases.\n 248|- **hall-bf interim:** stays turn-functional + visibly stamped (v0.13.4) until\n 249| this wave lands; no interim core patch — the churn is bounded and loud now.\n### GATEWAY-LIVENESS-DISPATCH.md\n 18| 3. OR the human path applies a `reconcile_self_owned` local-truth override for locally-owned endpoints that the `--json` path skips (roster.rs:52 mentions reconcile_self_owned overriding stale subnet gossip).\n*19|- **DEFECT A (separate, CONFIRMED, stands):** `establish_perch`'s build (spt/src/api/startup.rs:214-302) carries `cwd/controllable/adapter/read_env` forward from the prior record but NOT `rest_state` → a re-bind writes a fresh InfoJson that WIPES the wake intent (flynn's tick11 rest_state:active vanish).\n 20|- **DEFECT B (RECLASSIFIED to LATENT — do NOT make it the primary fix):** the `status=online` write in `cmd_listen` (startup.rs:486-491) is gated on `live_capable` (manifest `[session.psyche_init]`); a gateway has no psyche_init so it never writes status=online. BUT the pid-fallback is DESIGNED to cover an absent status and DOES for the roster + advertised_status. The operator's ready_agent counterexample proved this: ready_agents work because claude-spt declares psyche_init (live_capable-by-manifest),...\n 21|\n 22|## The fix (after STEP-1 pin)\n### GATEWAY-RCA-STEP1.md\n 59|`prior.rest_state` on re-bind in `establish_perch`'s build (spt/src/api/startup.rs\n*60|~214-302), same carry-forward discipline as cwd/controllable/adapter/read_env.\n 61|\n 62|**Awaiting your greenlight on the pin + fix approach before I build (RCA-first).**\n 63|Open Q: should the reconcile live in the cli `--json` builder (surgical, mirrors\n### INFRA-REGISTER.md\n 852| 30792210008 was 5/5 green per job but ci.yml's test leg is kind(lib)+kind(bin) — the changed\n*853| integration test NEVER RAN there (verified by log grep, 0 hits / 3023 lines); CI proved\n 854| compile-everywhere (clippy all-targets = the pool-population check for a common/ module),\n 855| traceability, lib/bin clean. The BEHAVIORAL evidence is local: three clean runs (all verdicts\n 856| Killed, population empty) + the two mutation reds. reap.rs diff additive-only (zero deleted\n...\n 1684| `.worktrees\\hertz-ci-riders\\target\\POOL-OWNER.json` named `holder_pid 31380` with\n*1685| `holder_started_at 134302739211259713` = 2026-08-03 16:38:41. Pid 31380 on that box at read time was\n*1686| `claude.exe -n \"doyle @ HFENDULEAM (spt-core/)\"`, created 17:31:11, FILETIME 134302770715019370.\n 1687| Same boot, ~52 minutes apart, stamps MISMATCH. The claiming process died and the OS reissued its pid\n 1688| to the gater's own session. Every previously measured recycle produced a false-DEAD (reads free\n 1689| while the lane is live — the corrupting direction); this one produces a **false-LIVE**: a bare-pid\n...\n 1968| 62.7s natural-life death), fixed test-side in `dbe3daad` (v0.63.0's head). Full RCA + the\n*1969| observer-effect instrument record: releases#225 comments 5417343026/5418844404.\n 1970| **Standing lesson for the family:** an environmental slowdown is an accidental mitigation —\n 1971| REMEDIATING a box can EXPOSE latent knife-edge races (the storm had hidden this one for\n 1972| releases). And a \"random victim family\" should be tested against ONE window with\n...\n 2318| @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n*2319| cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n 2320| blind repros exit 0); v0.4.0 cut (version bump @`c9a8eb5`, tag pushed, 3 platform assets,\n 2321| release notes authored; refs sent to hertz). REMAINING and dispatched to hertz post-#182-landing:\n 2322| spt-core consumes v0.4.0 — CI version bump + placement config (enforce-on, module_banner=accept);\n...\n 2657| run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\n*2658| as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\n 2659| (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\n 2660| and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\n 2661| version of it.\n...\n 3214|- **Read COUNT and HASH together, because they fail in opposite directions.** Of 24 picks on this\n*3215| chain two did not match. `b2194aa9 → 4d6deed1` differed in COUNT (302 lane / 300 pick by the header-excluding pipeline above; **this entry originally cited 310/308, which is the RAW `^[+-]` count INCLUDING the 8 `+++`/`---` header lines of its 4 files** — the figures were taken without the second grep the entry itself prescribes. The DELTA is 2 under either meter, which is why the wrong figures never surfaced: they supported a correct conclusion, so nothing pressed them. Corrected todlando 2026-08-...\n 3216| defect. `f27f15c6 → 5865cc98` had the SAME count and a different HASH — benign: a `CONTEXT.md`\n 3217| paragraph the head had already amended for #209, whose merged result correctly carries both lanes'\n 3218| sentences. A count check MISSES the first class entirely; a hash check FLAGS the second as if it\n### KNOWN-HAZARDS.md\n 80|- **One process generation per read (releases#287):** modern `shell.launch.json` atomically stores `pid`, native `pid_started_at`, and wall-clock `launched_ms`. A modern `pid: 0` means explicitly pidless/cleared and never falls back to the numeric `shell.pid` mirror. Legacy records without `pid` retain their old numeric-PID plus optional-birth read. Publish the complete JSON identity before updating the compatibility mirror; failed publication preserves the previous identity. Never delete the previous bi...\n*81|- **No spontaneous relaunch of a NONPERSISTENT same-boot death:** the releases#78 force-kill freeze still protects nonpersistent instances, so killing one to free its exe does not arm a watcher underneath an overwrite. Recovery remains demand-driven. **Persistent instances are exempt** (operator ruling, releases#287): a kill is not a request to keep a declared-persistent shell down; use `teardown` or a nonpersistent manifest instead.\n 82|- **Watcher eligibility:** recorded `offline`, no live binary awaiting bind, and either `persistent`, no corpse, or a corpse whose launch predates the machine boot instant. A nonpersistent corpse without a launch stamp or boot oracle remains frozen; persistent instances require neither to become eligible. Birth-safe probes prevent a recycled pid from masquerading as a live shell.\n 83|- **spt-core mapping:** `spt_store::shellinfo::{shell_pid_provably_dead, effective_status, is_shell_online}` (the resolver — the shell-side twin of 2.5's `liveness.rs`, which gave *agent* perches exactly this and which shells never got); consumers in `linkhost::{relink_shell, prepare_drive, run_action}`, `shelldisc::discover`, `activity::observe_links`; the class-(c) eligibility read is `spt_daemon::shellwake::watcher_eligible` (+ `launch_predates_boot`, `BOOT_RESTORE_SLACK_MS`), and the birth stamp it...\n*84|- **Source:** spt-core, flynn's spt-alchemy field report (2026-07-25) — a deterministic recipe, not a race. Class-(c) re-based BAROMETER W2 (releases#78, doyle's ruling on comment 5156810267).\n 85|\n 86|### 2.7 A daemon or machine restart strands `persistent` shells — and a graceful cascade fixture suppresses the failing arm `[REQ-HAZARD-RESTART-STRANDS-PERSISTENT-SHELLS]`\n 87|- **Failure:** a restart can leave an `online` record over a corpse without a link-break or suspend edge. The original boot sweep fixed only machine reboots: it rejected corpses launched after machine boot, so a daemon-only restart still stranded every persistent shell. The measured releases#287 specimen launched at machine boot +46s and stayed down for 27 hours after a daemon restart despite its owner being online.\n...\n 90|- **Invariant:** a daemon-only or machine restart must not strand a persistent instance. **(a) Heal:** every reconcile cycle writes `offline` only where the derived birth-safe read contradicts recorded `online`; already-correct records are untouched. **(b) Restore:** the once-per-daemon-generation boot sweep and every owner offline→online edge run the same per-owner body. Relaunch every instance whose adapter declares `persistent`, whose owner is online, and whose binary is down in fact. There is **no ...\n*91|- **Regression shape:** construct recorded `online` over a corpse **without a suspend edge**, including a launch **after machine boot**, then bring its owner online after a spent boot sweep. Every stranded persistent sibling must be restored; offline owners and nonpersistent instances are not restored. Separately defend live/binding exclusion and the nonpersistent watcher freeze. Suspending in setup suppresses the failing arm and proves nothing about this class.\n 92|- **Per-owner enumeration:** the existing `SHELL_RECORD_HEALED:/` daemon diagnostic names **every** successfully healed instance, not one representative. Healthy and already-healed records produce no event. The restore diagnostics likewise identify each attempted instance and distinguish boot from owner-online triggers. \n 93|- **spt-core mapping:** `spt_daemon::shellwake::{heal_stale_online_records, restore_persistent_shells_at_boot, restore_persistent_shells_on_owner_online, OwnerOnlineEdge}`; `shellhost::live_launch_winner`; `spt_store::shellinfo::{ShellLaunch, shell_pid_provably_dead}`. `launch_predates_boot` and `BOOT_RESTORE_SLACK_MS` now govern only nonpersistent watcher eligibility.\n*94|- **Source:** BAROMETER W2 (releases#78); releases#287 operator ruling (2026-09-08), superseding the persistent force-kill freeze and boot-instant conjunct.\n 95|\n 96|\n 97|---\n...\n 502|\n*503|- **Failure:** the peer pump is a SINGLE thread driving every leg (registry/notif/sync/update) against every peer over ONE brain-IPC client. Its reply reads (`net_open_stream`, `net_stream_send`, `net_dial`, and the sync/update pull `read_event` loops) were `loop { read_event() }` with no deadline. When a peer's QUIC path black-holes, the broker's stream-open/send awaits the dead peer and never sends the reply, so the brain's `read_frame` blocks FOREVER and the pump freezes mid-round. The heartbeat (loop...\n 504|- **Invariant:** in PUMP mode the brain carrier is **SPLIT at construction** — a dedicated `pump-ipc-reader` thread does blocking `read_frame` on the `RecvHalf` and forwards each framed result down a channel; the main thread writes on the `SendHalf` and reads with `Receiver::recv_timeout`. Every IPC reply read is bounded by a per-call **total-wait** deadline (`PUMP_PEER_IO_TIMEOUT` = 30s, > any legitimate round-trip, < the 60s QUIC idle; re-armed on stream progress for the streaming pull legs so a heal...\n 505|- **spt-core mapping:** `Brain::cold_start_pump` (splits the carrier + arms the deadline) / `BrainConn::Split` (the `SendHalf` + reader-thread channel) / `call_deadline` / `read_event_until` / `read_frame_until` (the `recv_timeout` dispatch), `pump::run_peer_pump` (connects in pump mode) + `pump::peer_outcome` (the tier-split), the `request_sync`/`request_update` pull loops (deadline re-armed on progress). The broker-side half — the broker must never make a brain wait unbounded on a QUIC op (bound the ...\n 506|- **Source:** field diagnosis 2026-06-11 (the 2.2h hfenduleam wedge); doyle ruling A-now / B-deferred. The stall warning (M8 decision 23) was the band-aid; this is the fix. The B-half landed v0.8.3 (§7.8) after the 2026-06-16 recurrence.\n...\n 749|\n*750|- **Failure (paid-for, rig-CONFIRMED 2026-07-06/07 — `NtSuspendProcess` on the brain, no update involved):** a controller's writer thread does a BLOCKING socket write to its brain subscriber conn. When that brain is suspended (or black-holed) the write never returns. The output-driven eviction path (`append` → `mark_controller_gone`, bounded by 7.12's `CONTROLLER_WRITE_DEADLINE`) only fires on NEW output, and `reap_dead_controller` (7.29 companion) only caught a writer that had EXITED — so a contro...\n 751|- **Invariant:** no broker client ever observes a wedge because the BRAIN stalled. (1) The controller's writer publishes its IN-FLIGHT-write window (`write_blocked_since`: `Some(Instant)` set immediately before the blocking `write_frame`, `None` after — the mutex never held ACROSS the write); a reader sees a `Some` older than `BRAIN_WRITE_DEADLINE` (15 s = 3× the 7.12 controller bound, measured full-with-**zero writer progress**, so a slow-but-DRAINING brain never trips it) as a WEDGED writer and stal...\n 752|- **spt-core mapping:** `broker.rs` — `ControllerSink::write_blocked_since` + `controller_writer` (marks the in-flight window around both the initial-batch and live-loop writes) + `controller_write_stalled` (pure predicate over injected `now`/`deadline`) + `stall_evict_controller` (Inline stamp at `resolve_subscribe`, Deferred stamp at `reap_dead_controller` so the reap closure does no I/O under the shared sessions lock) + `record_stall_evict`/`stall_evict_stats` (the tally) + `dispatch_stall_evicts` (...\n 753|- **Source:** LIFECYCLE-TRUTH W2 (doyle rig `NtSuspendProcess` root + design ruling `docs/W2-DESIGN-RULING.md` @60ec0ed — minimal-plus scope, `BRAIN_WRITE_DEADLINE` 15 s, passive resubscribe + observability rider; todlando build 2026-07-07). The v0.27→v0.28 update-wedge night's flagship defect.\n...\n 809|\n*810|- **Failure (paid-for, hertz field RCA 2026-07-16 — live v0.34 boxes, recurrent 20–30s PTY/RC freezes, DISPATCH tails 17–62s):** a COMPOSITION, not one new timer. The dispatcher's retryable claims (500ms/1s ×3) re-drove the opener fallback whose guard arm is a broad `Err(_)` (`dispatch.rs:414` — comment intends old-broker-only; catches transport timeout/EOF/poison), each pass installing a throwaway peek subscriber. `StreamLog::attach` synchronously replays the ENTIRE retained ring under the per-...\n 811|- **Invariant:** subscriber I/O never holds the `StreamLog` mutex (enqueue-under-lock, I/O outside, bounded per-subscriber queue; overflow = detach + resume-from-cursor); replay and fan-out halt at the FIRST failed subscriber write and the failed subscriber is REMOVED (attach + append + finish, all sites, `PresenceLog` mirrors included); the ring-peek fallback fires ONLY on the explicit unsupported-verb/old-broker answer; a deadline-poisoned replay is circuit-broken (global backoff, no reinstall until th...\n 812|- **spt-core mapping:** `spt-daemon/src/nethost.rs` `StreamLog::attach`/`push`/`finish` + `PresenceLog` mirrors + serve/wire worker pairing; `spt-daemon/src/dispatch.rs` `first_line` fallback arm + claim retry/backoff + worker spawn; SharedSend bounded-write deadline (round-4, KH 7.7 kin).\n 813|- **Source:** REDISPATCH-STALL W1 (hertz v0.34 field RCA 2026-07-16, doyle seam-verified same day; ADR-0038 Amendment 2026-07-16; `.claude/reports/2026-07-16-redispatch-stall/rca-summary.md`; distinct from `update --restart`'s bounded 30s rc reconnect loop).\n...\n 962|- **spt-core mapping:** `spt-daemon/src/failedaddr.rs` (the shared record + the ONE equality site); `spt-daemon/src/nethost.rs` `submit_dial` (built here — the site that owns the dialed address — and carried to the pump on `PRESENCE_DIAL_FAILED.remote_addr`); `spt-daemon/src/pump/mod.rs` `resolve_submit_addr` leg 2 + `presence_state_effect`; `spt-daemon/src/seedproofx.rs` `reconcile_peeraddrs` suspect arm.\n*963|- **Source:** WAN-TRUTH batch #50 lane 1 (issue #40; hertz RCA + live-fire injection 2026-07-30; doyle's address-keyed ruling 2026-07-31, which amended the RCA's per-leg/per-peer F2/F3 wording precisely because that shape would have deleted 7.42's connection-free strand-heal). Kin 7.42 (`REQ-HAZARD-MESH-BOOTSTRAP-TRAP`, the first clause), 7.60 (the lease freeze that falsified the freshness assumption).\n 964|\n 965|---\n 966|\n*967|### 7.60 A node's advertised address is repairable by the node itself — a regressed epoch counter must never freeze its own roster row `[REQ-HAZARD-SELF-ROW-LEASE-FREEZE]`\n 968|\n*969|\n 970|- **Failure (paid-for, hertz forensics 2026-07-30, crash-correlated to the minute on two independent nodes):** `EpochSource::next_epoch` persists through the NON-durable atomic write, whose own doc classifies epoch counters as reconstructible state for which a post-crash NUL husk \"simply parse-fails to absent and is regenerated\". That classification was the defect: `load_from` silently degrades a husk to `0`, and the counter's VALUE is the fleet-wide lease authority, so `merge_entry`'s strictly-greater r...\n 971|- **Invariant:** before authoring its own roster entry — at boot and on every exchange-provider pass — a node consults the fleet-replicated lease it holds for its own pubkey and fast-forwards its `EpochSource` strictly past that ceiling. The heal is retroactive (an already-damaged node repairs itself on its next boot with zero operator surgery), which is why it, and not counter durability, is the primary fix. Defense in depth rides along: the epoch file is written durably, a NUL husk is distinguished...\n 972|- **spt-core mapping:** `spt-store/src/epoch.rs` `load_from` + `next_epoch` + the fast-forward; `spt-store/src/roster.rs` `upsert_self` (the authorship site) + `merge_entry` (strictly-greater); `spt-daemon/src/seedproofx.rs` `production_roster_exchange` provider (the lease peek); `spt-store/src/atomic.rs` (the reconstructible-state doc list).\n*973|- **Source:** WAN-TRUTH batch #50 lane 1 (issue #40; hertz epoch-regression RCA 2026-07-30). Kin 7.59 (the livelock this freeze fed), `REQ-HAZARD-REGISTRY-EPOCH-LEASE` (the counter's monotonicity contract, which this does not weaken — a fast-forward only ever moves it up).\n 974|\n 975|---\n 976|\n### MANIFEST.md\n 794|\n*795|**Watcher eligibility:** recorded-offline instances with no live binary are eligible if persistent, cleanly closed/never launched (no corpse), or a dated pre-boot corpse. The same-boot force-kill freeze applies **only to nonpersistent** instances, whose undatable corpses also remain frozen. Persistent instances bypass that freeze (releases#287 operator ruling); keeping one down requires `teardown` or a nonpersistent manifest, not a kill.\n 796|\n 797|`can_shutdown` authorizes `api owner-shutdown`. Cross-node *fresh-spawn* to wake an owner requires the owner's `shell_wake_spawn_anywhere` settings flag (pre-consent).\n 798|\n### NEXT-MILESTONE-BUG-TRIAGE.md\n 121|\n*122|**ID-marker spine (#7/#8/#14):** it's `StatusRow`/REQ-RC-IDENTITY (v0.16.0 W6), CLIENT-side in rc.rs:198-307 (NOT broker). Paints `{subnet}:{id}@{node}` right-aligned cyan on real terminal row 1 via DECSTBM scroll-region `ESC[2;{rows}r` + DECSC `\\x1b7`/home/`\\x1b[2K`/right-align/cyan/DECRC `\\x1b8` — ABSOLUTE one-shot. Repainted only on: attach (1297-1302), ReassertScanner alt-screen/DECSTBM-reset hit (1413-1419), polled size-change (1329-1349). NOT on ordinary scroll/redraw.\n 123|\n 124|**D-#6 scrollback corrupt** · conf H · effort L · cross-platform. ROOT: broker is raw-byte pump, NO terminal/grid model — OutputLog.ring VecDeque<(seq,Vec)> (broker.rs:213-216), on attach replays raw bytes from from_seq; cold rc → net_from_seq=0 (attach.rs:198-213)+cursor=0 (rc.rs:1313) → ENTIRE ring dumped into fresh terminal. For alt-screen TUI (CC) history has interleaved ?1049h/l + scroll-region + abs-cursor → flips alt on/off mid-replay → TUI frames into main buffer = corrupt scroll...\n 125|\n...\n 178|`spt endpoint digest eel-a` → `NO_DIGEST:eel-a has no activity buffer (no session-log source / no records yet?)`. **LIVE EVIDENCE:** eel-a has ZERO entries in daemon-effects.log → no records produced. Operator hypothesis: manifest setup vs code, perri-side. Either (a) the claude-spt adapter's session-log source (manifest [digest]/session-log path) isn't wired for eel-a, or (b) eel-a's brain wedged (#16) before producing records. Disentangle adapter-manifest-wiring vs spt-core-digest-source vs downstr...\n*179|- **Root cause (agent G, conf H): ADAPTER-MANIFEST CONFIG (perri-side), NOT spt-core, NOT downstream of #16.** digest reads ONLY two sources, neither auto-populated by spt-core: (1) `[digest]` extractor (digest.rs:164-177 → spt_live::extract_digest) resolving `[digest].source` template (else `[history].locate_template`) over the harness's own transcript (CC `~/.claude/projects/{project}/{session_id}.jsonl`); (2) log-less `perch/digest.log` via explicit `api digest-entry`. NO_DIGEST = both empty + never...\n 180|\n 181|### G-#18 — `spt adapter update claude-spt` re-register fails · STATUS: SHIPPED @9305d19 (W6, REQ-ADAPTER-UPDATE-INPLACE)\n 182|`claude-spt 0.9.0→0.9.2`: fetch OK, unsigned-trusting OK, LIVE daemon-coordinated apply, then `ADAPTER_UPDATE_FAIL:claude-spt: re-register: io: The system cannot find the file specified. (os error 2)`. The post-extract re-register step can't find a file — likely the extracted adapter root path or a manifest-referenced binary/install_dir. Class: adapter update ripple / install-dir resolve (cf. F-019 translation install-dir, REQ-HAZARD-DEFERRED-MANIFEST). perri-adjacent (claude-spt v0.9.2).\n### NEXT-MILESTONE-LIFECYCLETRUTH-TRIAGE.md\n 54|session-output writes ride UNDER the per-session log lock (broker.rs:19-20). Failed writes are\n*55|handled (cursor freeze + detach, :3486); BLOCKED writes are not. Suspended brain ⇒ within\n*56|seconds: attached rc output freezes; detach does NOT release the control stamp (release routes\n 57|through the brain); reattach REFUSED (controlled-by); `rc --take` hangs; `daemon status` stays\n*58|healthy. Field: every brain cycle (incl. every `update apply`) has a freeze window; a stalled\n 59|or slow-draining new brain (6 sessions + psyches + WAN on the incident night) = permanent\n 60|wedge until bounce. `brain.ready` ≠ subscribers drained — why the 22:47 apply \"promoted\"\n 61|while frozen.\n...\n 93|reconnect loop AUTO-LAUNCHES a daemon via WMI (rig: DAEMON_LAUNCH_VIA_WMI from the rc) —\n*94|resurrection fights the operator's stops; (b) rc freezes at \"Reconnecting to local daemon…\"\n 95|forever when its session died with the broker. Fix: rc NEVER auto-starts a daemon (reconnect\n 96|only to an already-up broker; loud \"session lost — daemon down\" exit otherwise), bounded\n 97|reconnect with visible countdown.\n### NEXT-MILESTONE-REMOTETRUTH-TRIAGE.md\n 127|`pump-ops.json`, `epoch.json`) mint from 1 into ONE broker journal keyspace\n*128|`(NET_EFFECT_SESSION, op)` (broker.rs:3021); CLI wake op colliding with an\n 129|already-journaled daemon op reproduces the error with NO broker restart. Same\n 130|latent class: net-dial (broker.rs:2783), shell-link, sync/update pulls. Fix\n 131|(ADR-0034): (i) journal key gains a minter tag (`cli`/`pump`/`psyche`/`epoch`\n### NEXT-MILESTONE-WORKERTRUTH-TRIAGE.md\n 81|the RETIRED resident `psyche_init` shape. Core verdict: **0.26.0 does NOT\n*82|carry a fix and none is needed core-side for the key itself** — the freeze\n 83|contract (lifecycle.rs:841 `run_psyche_event_turn` doc; the F-030 design doc)\n 84|never lists `{psyche_dir}`; the catalog retired it deliberately\n 85|(runtime.rs:65 — \"a catalog key must have a real fill\"). Fix is ADAPTER-side\n...\n 110|1. **N-1 + W-2 together** (both change the worker-start/stop verb shape — ONE\n*111| contract freeze, perri coordinates once).\n 112|2. **V-1 + V-2** (pure view filters; unblock the operator-visible symptom\n 113| immediately; independent of 1).\n 114|3. **W-3 reap** (needs W-2's stored sid/parent linkage for the session-end leg).\n...\n 116|5. perri adapter legs (psyche_resume cwd fix = URGENT, ships independent of\n*117| core; loud-refusal logging + worker verb migration after the freeze in 1).\n 118|\n 119|Roles: todlando executes core waves, doyle gates per chunk, perri owns adapter\n 120|halves (blind-builds from published docs — publish the frozen verb shape to\n### RCA-FLEET-DAEMON-14444.md\n 78|newly reproduced event. A read-only sample of the currently installed\n*79|`%LOCALAPPDATA%/spt-core/logs/daemon.stderr.log` ended at byte **4,163,267**:\n 80|the last **1,999,958 complete-line bytes** spanned wall stamps\n 81|**1788997126331–1788998151874** (1025.543 s). It contained **5127** first writes\n 82|(656,158 bytes), **5092** unpoisoned/non-timeout closes (850,622 bytes),\n### REDISPATCH-STALL-TRIAGE.md\n 7|discard-errors replay-under-mutex into serial 15s subscriber-poison windows\n*8|that compose into 17–62s PTY/RC freezes. Counter-63 fast-follow after\n 9|MESH-RECOVERY's counter 62.\n 10|\n 11|**Canonical RCA:** hertz 2026-07-16, doyle seam-verified the same day; repo\n...\n 14|**Hazard:** KNOWN-HAZARDS 7.43.\n*15|**Field incident:** live v0.34 boxes, recurrent 20–30s freezes, DISPATCH tails\n 16|17–62s, poison interarrival median 95.5s; 33 `CONN_WRITE_POISONED` windows all\n 17|15,000–15,154 ms (the round-4 SharedSend deadline); 4361 stream-sub-attach\n 18|records/generation; per-stream, not broker-wide (unrelated conns progressed\n### REDISPATCH-TRUTH-TRIAGE.md\n 12|`spt daemon refresh` / `spt update` (same brain-cycle path, `applyhost.rs`)\n*13|freezes active remote `spt rc` sessions. The PTYs and broker-held QUIC\n*14|streams survive by construction — the freeze is a **production redispatch\n 15|bug** in the fresh brain's stream reconstruction:\n 16|\n 17|1. **Stale replay steals live controllers.** The fresh\n### REGISTRY-LIFECYCLE-TRIAGE.md\n 71|green every leg (retire machinery + registry gate = substrate). Field discriminator\n*72|post-release: hertz's snapshot poison count freezes; brain CPU drops to noise; broker thread\n 73|census bounded.\n 74|\n 75|### W2 — ENDPOINT-LIFECYCLE (todlando; REQs registered, activate at W2 start)\n...\n 139| voice per RELEASE-RUNBOOK step-2 standard.\n*140|- hertz field-verifies against their preserved baseline (poison count freeze + CPU + thread\n 141| census + WAKE_RESUME absence are the discriminators).\n### RELEASE-RUNBOOK.md\n 401| effect**, not the mechanism: not \"replay halts at the first failed write and\n*402| the poisoned subscriber is dropped\" but \"a stuck viewer can no longer freeze\n 403| other sessions.\" An internal-diagnostics change collapses to one plain line\n 404| (e.g. \"Improved logging granularity for attached endpoints\") under\n 405| **Internal** — never sell the mechanism as an **Added** feature.\n\n### adr/\n#### 0001-clean-room-fork-from-claude-skill-owl.md\n*1|# Clean-room fork from claude_skill_owl with hard freeze on the sister project\n 2|\n 3|## Status\n 4|\n...\n 20|\n*21|3. **Hard freeze on claude_skill_owl from 2026-05-28.** Only security and breakage fixes during the rebuild — no new features, no refactors. Soft and no-freeze policies expand the parity moving target indefinitely; hard freeze accepts living with the sister project's current bugs in exchange for finishing.\n 22|\n 23|## Consequences\n 24|\n*25|- Dual-maintenance burden is bounded by the freeze, not eliminated. Any breakage fix landed on claude_skill_owl must be considered for porting into spt-core's design (often shape-different, sometimes obsolete).\n 26|- The sister project keeps shipping until the rebuilt spt plugin (built atop spt-core) reaches feature parity. Until then, the user runs claude_skill_owl in production.\n*27|- The \"feature parity\" bar is whatever the sister project does on the freeze date — not a moving target.\n#### 0034-per-minter-op-id-namespacing.md\n 146| string across the IPC boundary. Changing the phrase is a wire-compat break\n*147| and is treated like a frozen discriminant (see the freeze rule above).\n 148|- **Match discrimination is tested**: a different broker error must NOT\n 149| trigger the retry (rides the durable-family negative control).\n 150|- A typed wire variant (rejected for now) is the right move only if a second\n#### 0040-bounded-stream-seat-lifecycle-one-way-terminal.md\n 95| plateau at O(active). The field discriminators: hertz's preserved snapshot's poison count\n*96| freezes; brain CPU drops to noise (with the self-hash fix, REQ-BRAIN-HASH-ONCE); broker\n 97| thread census bounded and named.\n 98|- New wire surface: `KIND_NET_STREAM_UNSUBSCRIBE` (additive, best-effort) + a lifetime\n 99| class on stream open (additive field; absent = Durable, so N-1 openers keep today's\n...\n 198|the field's sleeping laptop. The rig asserts the port is still bound after the\n*199|sever, and proves the freeze landed by watching the net runtime's reactor canary\n 200|go stale (0ms → 2006ms) after asserting it was fresh beforehand — a capability\n 201|probe on the instrument itself, in the RC-RENDER-TRUTH oracle discipline.\n 202|\n#### 0047-daemon-lifecycle-custody-authority.md\n 31|\n*32|3. **`spt update` freezes every attached rc PTY.** Pinned by the v0.40.0 OBS\n 33| breadcrumbs on an authorized same-seam `daemon refresh` (falsifying the\n 34| presumed gen+1 mechanism): during post-cycle dispatcher replay the broker\n 35| processed the SAME conn / SAME identity / SAME generation subscribe twice\n...\n 40| also fires against the same LIVE conn: the lease kills its own writer and the\n*41| viewer freezes until a manual detach + re-attach.\n 42|\n 43|A fourth field bug (spt-hosted PTY corruption at fixed geometry) is still being\n 44|RCA'd (hertz, on enlyzeam, isolated-rig non-repro already banked as the\n\nShowing files 1-20 of 24. Use skip=20 for the next page, or narrow paths/pattern.\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".worktrees/304-product/CHANGELOG.md, .worktrees/304-product/docs, .worktrees/304-product/CONTEXT.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":66,"fileCount":20,"files":[".worktrees/304-product/CHANGELOG.md",".worktrees/304-product/docs/F-030-PSYCHE-EPHEMERAL-DESIGN.md",".worktrees/304-product/docs/GATEWAY-LIVENESS-DISPATCH.md",".worktrees/304-product/docs/GATEWAY-RCA-STEP1.md",".worktrees/304-product/docs/INFRA-REGISTER.md",".worktrees/304-product/docs/KNOWN-HAZARDS.md",".worktrees/304-product/docs/MANIFEST.md",".worktrees/304-product/docs/NEXT-MILESTONE-BUG-TRIAGE.md",".worktrees/304-product/docs/NEXT-MILESTONE-LIFECYCLETRUTH-TRIAGE.md",".worktrees/304-product/docs/NEXT-MILESTONE-REMOTETRUTH-TRIAGE.md",".worktrees/304-product/docs/NEXT-MILESTONE-WORKERTRUTH-TRIAGE.md",".worktrees/304-product/docs/RCA-FLEET-DAEMON-14444.md",".worktrees/304-product/docs/REDISPATCH-STALL-TRIAGE.md",".worktrees/304-product/docs/REDISPATCH-TRUTH-TRIAGE.md",".worktrees/304-product/docs/REGISTRY-LIFECYCLE-TRIAGE.md",".worktrees/304-product/docs/RELEASE-RUNBOOK.md",".worktrees/304-product/docs/adr/0001-clean-room-fork-from-claude-skill-owl.md",".worktrees/304-product/docs/adr/0034-per-minter-op-id-namespacing.md",".worktrees/304-product/docs/adr/0040-bounded-stream-seat-lifecycle-one-way-terminal.md",".worktrees/304-product/docs/adr/0047-daemon-lifecycle-custody-authority.md"],"fileMatches":[{"path":".worktrees/304-product/CHANGELOG.md","count":17},{"path":".worktrees/304-product/docs/F-030-PSYCHE-EPHEMERAL-DESIGN.md","count":1},{"path":".worktrees/304-product/docs/GATEWAY-LIVENESS-DISPATCH.md","count":1},{"path":".worktrees/304-product/docs/GATEWAY-RCA-STEP1.md","count":1},{"path":".worktrees/304-product/docs/INFRA-REGISTER.md","count":7},{"path":".worktrees/304-product/docs/KNOWN-HAZARDS.md","count":11},{"path":".worktrees/304-product/docs/MANIFEST.md","count":1},{"path":".worktrees/304-product/docs/NEXT-MILESTONE-BUG-TRIAGE.md","count":2},{"path":".worktrees/304-product/docs/NEXT-MILESTONE-LIFECYCLETRUTH-TRIAGE.md","count":4},{"path":".worktrees/304-product/docs/NEXT-MILESTONE-REMOTETRUTH-TRIAGE.md","count":1},{"path":".worktrees/304-product/docs/NEXT-MILESTONE-WORKERTRUTH-TRIAGE.md","count":3},{"path":".worktrees/304-product/docs/RCA-FLEET-DAEMON-14444.md","count":1},{"path":".worktrees/304-product/docs/REDISPATCH-STALL-TRIAGE.md","count":2},{"path":".worktrees/304-product/docs/REDISPATCH-TRUTH-TRIAGE.md","count":2},{"path":".worktrees/304-product/docs/REGISTRY-LIFECYCLE-TRIAGE.md","count":2},{"path":".worktrees/304-product/docs/RELEASE-RUNBOOK.md","count":1},{"path":".worktrees/304-product/docs/adr/0001-clean-room-fork-from-claude-skill-owl.md","count":4},{"path":".worktrees/304-product/docs/adr/0034-per-minter-op-id-namespacing.md","count":1},{"path":".worktrees/304-product/docs/adr/0040-bounded-stream-seat-lifecycle-one-way-terminal.md","count":2},{"path":".worktrees/304-product/docs/adr/0047-daemon-lifecycle-custody-authority.md","count":2}],"truncated":true,"fileLimitReached":20,"displayContent":"# .worktrees/304-product/\n## CHANGELOG.md\n 1690│\n*1691│- `spt update` and `spt daemon refresh` no longer freeze attached views. An\n 1692│ attached window could come back from one of these with its display stuck and\n 1693│ its keyboard dead until it was detached and reattached. Attached windows now\n 1694│ keep their control and keep working across the refresh.\n │...\n 2003│\n*2004│- Attached endpoints no longer freeze for 15–25 seconds at a time. The daemon\n 2005│ could keep re-applying old peer-directory updates; each update is now applied\n 2006│ once and completed transfers are discarded immediately. This also ends the slow\n 2007│ thread and memory growth that built up on long-lived connections.\n │...\n 2029│\n*2030│- Attached sessions no longer freeze after a daemon update or refresh.\n 2031│ Previously, a single bad viewer connection could hang an attached session for\n*2032│ up to a minute; a stuck viewer can no longer freeze other sessions.\n 2033│\n 2034│- Improved the stability of controlled sessions across a daemon restart.\n 2035│ Previously, session controllers could mix up and drop their attached sessions.\n │...\n 2272│A reliability patch closing the last update-wedge failure mode: a stuck session\n*2273│consumer can no longer freeze the daemon under load.\n 2274│\n 2275│> **Applying this update needs a daemon restart.** Unlike the recent seamless\n 2276│> in-place updates, this fix lives in the always-on daemon, so `spt update fetch\n │...\n 2293│A reliability patch completing the in-place-update fix: applying an update no longer\n*2294│freezes your live terminal sessions.\n 2295│\n 2296│### Fixed\n 2297│\n*2298│- Applying an update in place with `spt update fetch --apply` could still freeze all of\n 2299│ your live terminal sessions a few seconds after the swap — they stopped streaming and\n 2300│ `spt rc` could no longer attach, so the box had to be restarted to recover. (The\n 2301│ previous release narrowed this but did not fully close it.) Resuming across the update\n 2302│ no longer floods the daemon's internal channel, so your open sessions keep streaming and\n*2303│ `spt rc` keeps working straight through the swap — no freeze, no restart. (Because the\n 2304│ fix lives in the incoming version, updating *to* this release is what makes your next\n 2305│ in-place update seamless.)\n 2306│\n │...\n 2313│\n*2314│- Applying an update in place with `spt update fetch --apply` could freeze or seize\n 2315│ control of your live terminal sessions as the daemon restarted — a resumed session\n 2316│ could be taken over so that your open session and `spt rc` stopped responding across\n 2317│ the swap. Resumed sessions now re-attach as observers instead of taking over the\n │...\n 2327│\n*2328│- Applying an update in place with `spt update fetch --apply` could freeze every live\n 2329│ terminal session for about 30 seconds and then roll the update back instead of\n 2330│ completing the swap. The incoming version now drives the running daemon to clear a\n 2331│ hard-stopped prior session during the handoff, so the update completes seamlessly with\n*2332│ your sessions staying up — no freeze, no rollback. (Because the fix lives in the\n 2333│ incoming version's logic, updating *to* this release is what makes your next in-place\n 2334│ update seamless.)\n 2335│\n │...\n 2401│\n*2402│A lifecycle-reliability release: previously-online sessions are re-launched automatically after a daemon restart, an attached terminal no longer freezes behind a slow or suspended session, a long multi-line message typed into a live session arrives intact, and an in-place update finishes in a single command.\n 2403│\n 2404│### Added\n 2405│\n │...\n 2416│- **Hosted sessions are re-launched after a daemon restart.** Previously-online sessions come back automatically once the daemon restarts (including as part of an update) instead of being left offline. The restart still interrupts them — this restores the session, it does not preserve its in-flight work.\n*2417│- **An attached terminal no longer freezes behind a stalled session.** If a session's underlying process hangs or is suspended, `spt rc` keeps updating and a stuck connection is dropped automatically so you never lose control; reattaching and taking control (`--take`) keep working. `spt daemon status` reports when such a drop happened.\n 2418│- **A long, multi-line message typed into a live agent's terminal arrives complete.** When a message is delivered by typing it into a live session, it is no longer truncated at the front. (Messages drained through the polling channel were never affected.)\n 2419│- **`spt endpoint digest --json` no longer repeats rows.** Activity replayed across a session checkpoint is collapsed to a single entry.\n 2420│- **Waking an agent starts exactly one session.** Two wake requests arriving at once no longer launch it twice.\n │...\n 2806│\n*2807│- **Pasting or typing into an spt-hosted endpoint no longer freezes the daemon.** A large paste or input burst could wedge the daemon's input path so every new attach died; input now runs on a dedicated per-session writer and never blocks the daemon (this also covers the effect-journal stall on interactive input).\n 2808│- **Session resume actually resumes now.** Agent endpoints track session history and offer explicit session resume via `spt endpoint run` (`--resume ` or *Resume from history*); the adapter manifest can now declare a `[session.resume]` command so the relaunch reattaches the prior session instead of always starting a new one. The run picker now shows each row's working directory and local time.\n 2809│- **`spt rc --view` viewers survive a high-output terminal.** A viewer no longer dies when the output backlog rolls over or it is briefly evicted — it snaps forward or skips to live instead of failing — and a slow controller can no longer starve a concurrent viewer.\n 2810│- **`spt rc` no longer races a just-started agent.** Attach now waits for the endpoint to come online, instead of failing when you attach immediately after `spt endpoint run`.\n │...\n 2826│- **Closing the terminal that started an agent no longer kills it.** When `spt endpoint run` launches the background daemon for you, closing that terminal tab or window now leaves the agent running and re-attachable with `spt rc `.\n*2827│- **A crashed agent with a disconnected viewer no longer freezes the daemon.** A dead agent process combined with an abruptly-closed `spt rc` could previously wedge the daemon so new agents wouldn't start; the daemon now stays responsive and marks the dead agent offline.\n 2828│\n 2829│### Changed\n 2830│\n │...\n 2917│\n*2918│- **A dead or unresponsive peer can no longer stall background sync.** The daemon now bounds every network operation it makes on a live agent's behalf, so a roster peer that has gone offline (or stopped responding mid-handshake) fails fast as an ordinary, recoverable error instead of hanging the daemon's peer-sync loop. Previously such a peer could freeze background synchronization for tens of minutes and force repeated internal restarts; now the peer is simply skipped and retried on the next cycle, and ...\n 2919│\n 2920│## [0.8.2] - 2026-06-16\n 2921│\n │...\n 3040│\n*3041│- **An unreachable peer can no longer stall your node's background work.** If another machine on your subnet dropped off mid-exchange — a network drop, a sleep, a hard crash — the daemon's outbound loops (peer sync, notifications, update checks) could hang waiting on it, in the worst case for hours, until something restarted the service. Now a stalled exchange gives up on its own in under a minute and the background loops resume, so one dead peer never freezes the rest of your node.\n 3042│\n 3043│## [0.4.0] - 2026-06-10\n 3044│\n\n## docs/\n### F-030-PSYCHE-EPHEMERAL-DESIGN.md\n 245│- **Adapter (perri):** `psyche-ephemeral-parked` branch rebased once core API\n*246│ shape freezes (she reviews W1/W2 key contract before her rebase — field\n 247│ review slot like F-027 §7); publish ONLY after core floor releases.\n 248│- **hall-bf interim:** stays turn-functional + visibly stamped (v0.13.4) until\n 249│ this wave lands; no interim core patch — the churn is bounded and loud now.\n### GATEWAY-LIVENESS-DISPATCH.md\n 18│ 3. OR the human path applies a `reconcile_self_owned` local-truth override for locally-owned endpoints that the `--json` path skips (roster.rs:52 mentions reconcile_self_owned overriding stale subnet gossip).\n*19│- **DEFECT A (separate, CONFIRMED, stands):** `establish_perch`'s build (spt/src/api/startup.rs:214-302) carries `cwd/controllable/adapter/read_env` forward from the prior record but NOT `rest_state` → a re-bind writes a fresh InfoJson that WIPES the wake intent (flynn's tick11 rest_state:active vanish).\n 20│- **DEFECT B (RECLASSIFIED to LATENT — do NOT make it the primary fix):** the `status=online` write in `cmd_listen` (startup.rs:486-491) is gated on `live_capable` (manifest `[session.psyche_init]`); a gateway has no psyche_init so it never writes status=online. BUT the pid-fallback is DESIGNED to cover an absent status and DOES for the roster + advertised_status. The operator's ready_agent counterexample proved this: ready_agents work because claude-spt declares psyche_init (live_capable-by-manifest),...\n 21│\n 22│## The fix (after STEP-1 pin)\n### GATEWAY-RCA-STEP1.md\n 59│`prior.rest_state` on re-bind in `establish_perch`'s build (spt/src/api/startup.rs\n*60│~214-302), same carry-forward discipline as cwd/controllable/adapter/read_env.\n 61│\n 62│**Awaiting your greenlight on the pin + fix approach before I build (RCA-first).**\n 63│Open Q: should the reconcile live in the cli `--json` builder (surgical, mirrors\n### INFRA-REGISTER.md\n 852│ 30792210008 was 5/5 green per job but ci.yml's test leg is kind(lib)+kind(bin) — the changed\n *853│ integration test NEVER RAN there (verified by log grep, 0 hits / 3023 lines); CI proved\n 854│ compile-everywhere (clippy all-targets = the pool-population check for a common/ module),\n 855│ traceability, lib/bin clean. The BEHAVIORAL evidence is local: three clean runs (all verdicts\n 856│ Killed, population empty) + the two mutation reds. reap.rs diff additive-only (zero deleted\n │...\n 1684│ `.worktrees\\hertz-ci-riders\\target\\POOL-OWNER.json` named `holder_pid 31380` with\n*1685│ `holder_started_at 134302739211259713` = 2026-08-03 16:38:41. Pid 31380 on that box at read time was\n*1686│ `claude.exe -n \"doyle @ HFENDULEAM (spt-core/)\"`, created 17:31:11, FILETIME 134302770715019370.\n 1687│ Same boot, ~52 minutes apart, stamps MISMATCH. The claiming process died and the OS reissued its pid\n 1688│ to the gater's own session. Every previously measured recycle produced a false-DEAD (reads free\n 1689│ while the lane is live — the corrupting direction); this one produces a **false-LIVE**: a bare-pid\n │...\n 1968│ 62.7s natural-life death), fixed test-side in `dbe3daad` (v0.63.0's head). Full RCA + the\n*1969│ observer-effect instrument record: releases#225 comments 5417343026/5418844404.\n 1970│ **Standing lesson for the family:** an environmental slowdown is an accidental mitigation —\n 1971│ REMEDIATING a box can EXPOSE latent knife-edge races (the storm had hidden this one for\n 1972│ releases). And a \"random victim family\" should be tested against ONE window with\n │...\n 2318│ @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n*2319│ cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n 2320│ blind repros exit 0); v0.4.0 cut (version bump @`c9a8eb5`, tag pushed, 3 platform assets,\n 2321│ release notes authored; refs sent to hertz). REMAINING and dispatched to hertz post-#182-landing:\n 2322│ spt-core consumes v0.4.0 — CI version bump + placement config (enforce-on, module_banner=accept);\n │...\n 2657│ run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\n*2658│ as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\n 2659│ (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\n 2660│ and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\n 2661│ version of it.\n │...\n 3214│- **Read COUNT and HASH together, because they fail in opposite directions.** Of 24 picks on this\n*3215│ chain two did not match. `b2194aa9 → 4d6deed1` differed in COUNT (302 lane / 300 pick by the header-excluding pipeline above; **this entry originally cited 310/308, which is the RAW `^[+-]` count INCLUDING the 8 `+++`/`---` header lines of its 4 files** — the figures were taken without the second grep the entry itself prescribes. The DELTA is 2 under either meter, which is why the wrong figures never surfaced: they supported a correct conclusion, so nothing pressed them. Corrected todlando 2026-08-...\n 3216│ defect. `f27f15c6 → 5865cc98` had the SAME count and a different HASH — benign: a `CONTEXT.md`\n 3217│ paragraph the head had already amended for #209, whose merged result correctly carries both lanes'\n 3218│ sentences. A count check MISSES the first class entirely; a hash check FLAGS the second as if it\n### KNOWN-HAZARDS.md\n 80│- **One process generation per read (releases#287):** modern `shell.launch.json` atomically stores `pid`, native `pid_started_at`, and wall-clock `launched_ms`. A modern `pid: 0` means explicitly pidless/cleared and never falls back to the numeric `shell.pid` mirror. Legacy records without `pid` retain their old numeric-PID plus optional-birth read. Publish the complete JSON identity before updating the compatibility mirror; failed publication preserves the previous identity. Never delete the previous bi...\n *81│- **No spontaneous relaunch of a NONPERSISTENT same-boot death:** the releases#78 force-kill freeze still protects nonpersistent instances, so killing one to free its exe does not arm a watcher underneath an overwrite. Recovery remains demand-driven. **Persistent instances are exempt** (operator ruling, releases#287): a kill is not a request to keep a declared-persistent shell down; use `teardown` or a nonpersistent manifest instead.\n 82│- **Watcher eligibility:** recorded `offline`, no live binary awaiting bind, and either `persistent`, no corpse, or a corpse whose launch predates the machine boot instant. A nonpersistent corpse without a launch stamp or boot oracle remains frozen; persistent instances require neither to become eligible. Birth-safe probes prevent a recycled pid from masquerading as a live shell.\n 83│- **spt-core mapping:** `spt_store::shellinfo::{shell_pid_provably_dead, effective_status, is_shell_online}` (the resolver — the shell-side twin of 2.5's `liveness.rs`, which gave *agent* perches exactly this and which shells never got); consumers in `linkhost::{relink_shell, prepare_drive, run_action}`, `shelldisc::discover`, `activity::observe_links`; the class-(c) eligibility read is `spt_daemon::shellwake::watcher_eligible` (+ `launch_predates_boot`, `BOOT_RESTORE_SLACK_MS`), and the birth stamp it...\n *84│- **Source:** spt-core, flynn's spt-alchemy field report (2026-07-25) — a deterministic recipe, not a race. Class-(c) re-based BAROMETER W2 (releases#78, doyle's ruling on comment 5156810267).\n 85│\n 86│### 2.7 A daemon or machine restart strands `persistent` shells — and a graceful cascade fixture suppresses the failing arm `[REQ-HAZARD-RESTART-STRANDS-PERSISTENT-SHELLS]`\n 87│- **Failure:** a restart can leave an `online` record over a corpse without a link-break or suspend edge. The original boot sweep fixed only machine reboots: it rejected corpses launched after machine boot, so a daemon-only restart still stranded every persistent shell. The measured releases#287 specimen launched at machine boot +46s and stayed down for 27 hours after a daemon restart despite its owner being online.\n │...\n 90│- **Invariant:** a daemon-only or machine restart must not strand a persistent instance. **(a) Heal:** every reconcile cycle writes `offline` only where the derived birth-safe read contradicts recorded `online`; already-correct records are untouched. **(b) Restore:** the once-per-daemon-generation boot sweep and every owner offline→online edge run the same per-owner body. Relaunch every instance whose adapter declares `persistent`, whose owner is online, and whose binary is down in fact. There is **no ...\n *91│- **Regression shape:** construct recorded `online` over a corpse **without a suspend edge**, including a launch **after machine boot**, then bring its owner online after a spent boot sweep. Every stranded persistent sibling must be restored; offline owners and nonpersistent instances are not restored. Separately defend live/binding exclusion and the nonpersistent watcher freeze. Suspending in setup suppresses the failing arm and proves nothing about this class.\n 92│- **Per-owner enumeration:** the existing `SHELL_RECORD_HEALED:/` daemon diagnostic names **every** successfully healed instance, not one representative. Healthy and already-healed records produce no event. The restore diagnostics likewise identify each attempted instance and distinguish boot from owner-online triggers. \n 93│- **spt-core mapping:** `spt_daemon::shellwake::{heal_stale_online_records, restore_persistent_shells_at_boot, restore_persistent_shells_on_owner_online, OwnerOnlineEdge}`; `shellhost::live_launch_winner`; `spt_store::shellinfo::{ShellLaunch, shell_pid_provably_dead}`. `launch_predates_boot` and `BOOT_RESTORE_SLACK_MS` now govern only nonpersistent watcher eligibility.\n *94│- **Source:** BAROMETER W2 (releases#78); releases#287 operator ruling (2026-09-08), superseding the persistent force-kill freeze and boot-instant conjunct.\n 95│\n 96│\n 97│---\n │...\n 502│\n*503│- **Failure:** the peer pump is a SINGLE thread driving every leg (registry/notif/sync/update) against every peer over ONE brain-IPC client. Its reply reads (`net_open_stream`, `net_stream_send`, `net_dial`, and the sync/update pull `read_event` loops) were `loop { read_event() }` with no deadline. When a peer's QUIC path black-holes, the broker's stream-open/send awaits the dead peer and never sends the reply, so the brain's `read_frame` blocks FOREVER and the pump freezes mid-round. The heartbeat (loop...\n 504│- **Invariant:** in PUMP mode the brain carrier is **SPLIT at construction** — a dedicated `pump-ipc-reader` thread does blocking `read_frame` on the `RecvHalf` and forwards each framed result down a channel; the main thread writes on the `SendHalf` and reads with `Receiver::recv_timeout`. Every IPC reply read is bounded by a per-call **total-wait** deadline (`PUMP_PEER_IO_TIMEOUT` = 30s, > any legitimate round-trip, < the 60s QUIC idle; re-armed on stream progress for the streaming pull legs so a heal...\n 505│- **spt-core mapping:** `Brain::cold_start_pump` (splits the carrier + arms the deadline) / `BrainConn::Split` (the `SendHalf` + reader-thread channel) / `call_deadline` / `read_event_until` / `read_frame_until` (the `recv_timeout` dispatch), `pump::run_peer_pump` (connects in pump mode) + `pump::peer_outcome` (the tier-split), the `request_sync`/`request_update` pull loops (deadline re-armed on progress). The broker-side half — the broker must never make a brain wait unbounded on a QUIC op (bound the ...\n 506│- **Source:** field diagnosis 2026-06-11 (the 2.2h hfenduleam wedge); doyle ruling A-now / B-deferred. The stall warning (M8 decision 23) was the band-aid; this is the fix. The B-half landed v0.8.3 (§7.8) after the 2026-06-16 recurrence.\n │...\n 749│\n*750│- **Failure (paid-for, rig-CONFIRMED 2026-07-06/07 — `NtSuspendProcess` on the brain, no update involved):** a controller's writer thread does a BLOCKING socket write to its brain subscriber conn. When that brain is suspended (or black-holed) the write never returns. The output-driven eviction path (`append` → `mark_controller_gone`, bounded by 7.12's `CONTROLLER_WRITE_DEADLINE`) only fires on NEW output, and `reap_dead_controller` (7.29 companion) only caught a writer that had EXITED — so a contro...\n 751│- **Invariant:** no broker client ever observes a wedge because the BRAIN stalled. (1) The controller's writer publishes its IN-FLIGHT-write window (`write_blocked_since`: `Some(Instant)` set immediately before the blocking `write_frame`, `None` after — the mutex never held ACROSS the write); a reader sees a `Some` older than `BRAIN_WRITE_DEADLINE` (15 s = 3× the 7.12 controller bound, measured full-with-**zero writer progress**, so a slow-but-DRAINING brain never trips it) as a WEDGED writer and stal...\n 752│- **spt-core mapping:** `broker.rs` — `ControllerSink::write_blocked_since` + `controller_writer` (marks the in-flight window around both the initial-batch and live-loop writes) + `controller_write_stalled` (pure predicate over injected `now`/`deadline`) + `stall_evict_controller` (Inline stamp at `resolve_subscribe`, Deferred stamp at `reap_dead_controller` so the reap closure does no I/O under the shared sessions lock) + `record_stall_evict`/`stall_evict_stats` (the tally) + `dispatch_stall_evicts` (...\n 753│- **Source:** LIFECYCLE-TRUTH W2 (doyle rig `NtSuspendProcess` root + design ruling `docs/W2-DESIGN-RULING.md` @60ec0ed — minimal-plus scope, `BRAIN_WRITE_DEADLINE` 15 s, passive resubscribe + observability rider; todlando build 2026-07-07). The v0.27→v0.28 update-wedge night's flagship defect.\n │...\n 809│\n*810│- **Failure (paid-for, hertz field RCA 2026-07-16 — live v0.34 boxes, recurrent 20–30s PTY/RC freezes, DISPATCH tails 17–62s):** a COMPOSITION, not one new timer. The dispatcher's retryable claims (500ms/1s ×3) re-drove the opener fallback whose guard arm is a broad `Err(_)` (`dispatch.rs:414` — comment intends old-broker-only; catches transport timeout/EOF/poison), each pass installing a throwaway peek subscriber. `StreamLog::attach` synchronously replays the ENTIRE retained ring under the per-...\n 811│- **Invariant:** subscriber I/O never holds the `StreamLog` mutex (enqueue-under-lock, I/O outside, bounded per-subscriber queue; overflow = detach + resume-from-cursor); replay and fan-out halt at the FIRST failed subscriber write and the failed subscriber is REMOVED (attach + append + finish, all sites, `PresenceLog` mirrors included); the ring-peek fallback fires ONLY on the explicit unsupported-verb/old-broker answer; a deadline-poisoned replay is circuit-broken (global backoff, no reinstall until th...\n 812│- **spt-core mapping:** `spt-daemon/src/nethost.rs` `StreamLog::attach`/`push`/`finish` + `PresenceLog` mirrors + serve/wire worker pairing; `spt-daemon/src/dispatch.rs` `first_line` fallback arm + claim retry/backoff + worker spawn; SharedSend bounded-write deadline (round-4, KH 7.7 kin).\n 813│- **Source:** REDISPATCH-STALL W1 (hertz v0.34 field RCA 2026-07-16, doyle seam-verified same day; ADR-0038 Amendment 2026-07-16; `.claude/reports/2026-07-16-redispatch-stall/rca-summary.md`; distinct from `update --restart`'s bounded 30s rc reconnect loop).\n │...\n 962│- **spt-core mapping:** `spt-daemon/src/failedaddr.rs` (the shared record + the ONE equality site); `spt-daemon/src/nethost.rs` `submit_dial` (built here — the site that owns the dialed address — and carried to the pump on `PRESENCE_DIAL_FAILED.remote_addr`); `spt-daemon/src/pump/mod.rs` `resolve_submit_addr` leg 2 + `presence_state_effect`; `spt-daemon/src/seedproofx.rs` `reconcile_peeraddrs` suspect arm.\n*963│- **Source:** WAN-TRUTH batch #50 lane 1 (issue #40; hertz RCA + live-fire injection 2026-07-30; doyle's address-keyed ruling 2026-07-31, which amended the RCA's per-leg/per-peer F2/F3 wording precisely because that shape would have deleted 7.42's connection-free strand-heal). Kin 7.42 (`REQ-HAZARD-MESH-BOOTSTRAP-TRAP`, the first clause), 7.60 (the lease freeze that falsified the freshness assumption).\n 964│\n 965│---\n 966│\n*967│### 7.60 A node's advertised address is repairable by the node itself — a regressed epoch counter must never freeze its own roster row `[REQ-HAZARD-SELF-ROW-LEASE-FREEZE]`\n 968│\n*969│\n 970│- **Failure (paid-for, hertz forensics 2026-07-30, crash-correlated to the minute on two independent nodes):** `EpochSource::next_epoch` persists through the NON-durable atomic write, whose own doc classifies epoch counters as reconstructible state for which a post-crash NUL husk \"simply parse-fails to absent and is regenerated\". That classification was the defect: `load_from` silently degrades a husk to `0`, and the counter's VALUE is the fleet-wide lease authority, so `merge_entry`'s strictly-greater r...\n 971│- **Invariant:** before authoring its own roster entry — at boot and on every exchange-provider pass — a node consults the fleet-replicated lease it holds for its own pubkey and fast-forwards its `EpochSource` strictly past that ceiling. The heal is retroactive (an already-damaged node repairs itself on its next boot with zero operator surgery), which is why it, and not counter durability, is the primary fix. Defense in depth rides along: the epoch file is written durably, a NUL husk is distinguished...\n 972│- **spt-core mapping:** `spt-store/src/epoch.rs` `load_from` + `next_epoch` + the fast-forward; `spt-store/src/roster.rs` `upsert_self` (the authorship site) + `merge_entry` (strictly-greater); `spt-daemon/src/seedproofx.rs` `production_roster_exchange` provider (the lease peek); `spt-store/src/atomic.rs` (the reconstructible-state doc list).\n*973│- **Source:** WAN-TRUTH batch #50 lane 1 (issue #40; hertz epoch-regression RCA 2026-07-30). Kin 7.59 (the livelock this freeze fed), `REQ-HAZARD-REGISTRY-EPOCH-LEASE` (the counter's monotonicity contract, which this does not weaken — a fast-forward only ever moves it up).\n 974│\n 975│---\n 976│\n### MANIFEST.md\n 794│\n*795│**Watcher eligibility:** recorded-offline instances with no live binary are eligible if persistent, cleanly closed/never launched (no corpse), or a dated pre-boot corpse. The same-boot force-kill freeze applies **only to nonpersistent** instances, whose undatable corpses also remain frozen. Persistent instances bypass that freeze (releases#287 operator ruling); keeping one down requires `teardown` or a nonpersistent manifest, not a kill.\n 796│\n 797│`can_shutdown` authorizes `api owner-shutdown`. Cross-node *fresh-spawn* to wake an owner requires the owner's `shell_wake_spawn_anywhere` settings flag (pre-consent).\n 798│\n### NEXT-MILESTONE-BUG-TRIAGE.md\n 121│\n*122│**ID-marker spine (#7/#8/#14):** it's `StatusRow`/REQ-RC-IDENTITY (v0.16.0 W6), CLIENT-side in rc.rs:198-307 (NOT broker). Paints `{subnet}:{id}@{node}` right-aligned cyan on real terminal row 1 via DECSTBM scroll-region `ESC[2;{rows}r` + DECSC `\\x1b7`/home/`\\x1b[2K`/right-align/cyan/DECRC `\\x1b8` — ABSOLUTE one-shot. Repainted only on: attach (1297-1302), ReassertScanner alt-screen/DECSTBM-reset hit (1413-1419), polled size-change (1329-1349). NOT on ordinary scroll/redraw.\n 123│\n 124│**D-#6 scrollback corrupt** · conf H · effort L · cross-platform. ROOT: broker is raw-byte pump, NO terminal/grid model — OutputLog.ring VecDeque<(seq,Vec)> (broker.rs:213-216), on attach replays raw bytes from from_seq; cold rc → net_from_seq=0 (attach.rs:198-213)+cursor=0 (rc.rs:1313) → ENTIRE ring dumped into fresh terminal. For alt-screen TUI (CC) history has interleaved ?1049h/l + scroll-region + abs-cursor → flips alt on/off mid-replay → TUI frames into main buffer = corrupt scroll...\n 125│\n │...\n 178│`spt endpoint digest eel-a` → `NO_DIGEST:eel-a has no activity buffer (no session-log source / no records yet?)`. **LIVE EVIDENCE:** eel-a has ZERO entries in daemon-effects.log → no records produced. Operator hypothesis: manifest setup vs code, perri-side. Either (a) the claude-spt adapter's session-log source (manifest [digest]/session-log path) isn't wired for eel-a, or (b) eel-a's brain wedged (#16) before producing records. Disentangle adapter-manifest-wiring vs spt-core-digest-source vs downstr...\n*179│- **Root cause (agent G, conf H): ADAPTER-MANIFEST CONFIG (perri-side), NOT spt-core, NOT downstream of #16.** digest reads ONLY two sources, neither auto-populated by spt-core: (1) `[digest]` extractor (digest.rs:164-177 → spt_live::extract_digest) resolving `[digest].source` template (else `[history].locate_template`) over the harness's own transcript (CC `~/.claude/projects/{project}/{session_id}.jsonl`); (2) log-less `perch/digest.log` via explicit `api digest-entry`. NO_DIGEST = both empty + never...\n 180│\n 181│### G-#18 — `spt adapter update claude-spt` re-register fails · STATUS: SHIPPED @9305d19 (W6, REQ-ADAPTER-UPDATE-INPLACE)\n 182│`claude-spt 0.9.0→0.9.2`: fetch OK, unsigned-trusting OK, LIVE daemon-coordinated apply, then `ADAPTER_UPDATE_FAIL:claude-spt: re-register: io: The system cannot find the file specified. (os error 2)`. The post-extract re-register step can't find a file — likely the extracted adapter root path or a manifest-referenced binary/install_dir. Class: adapter update ripple / install-dir resolve (cf. F-019 translation install-dir, REQ-HAZARD-DEFERRED-MANIFEST). perri-adjacent (claude-spt v0.9.2).\n### NEXT-MILESTONE-LIFECYCLETRUTH-TRIAGE.md\n 54│session-output writes ride UNDER the per-session log lock (broker.rs:19-20). Failed writes are\n*55│handled (cursor freeze + detach, :3486); BLOCKED writes are not. Suspended brain ⇒ within\n*56│seconds: attached rc output freezes; detach does NOT release the control stamp (release routes\n 57│through the brain); reattach REFUSED (controlled-by); `rc --take` hangs; `daemon status` stays\n*58│healthy. Field: every brain cycle (incl. every `update apply`) has a freeze window; a stalled\n 59│or slow-draining new brain (6 sessions + psyches + WAN on the incident night) = permanent\n 60│wedge until bounce. `brain.ready` ≠ subscribers drained — why the 22:47 apply \"promoted\"\n 61│while frozen.\n │...\n 93│reconnect loop AUTO-LAUNCHES a daemon via WMI (rig: DAEMON_LAUNCH_VIA_WMI from the rc) —\n*94│resurrection fights the operator's stops; (b) rc freezes at \"Reconnecting to local daemon…\"\n 95│forever when its session died with the broker. Fix: rc NEVER auto-starts a daemon (reconnect\n 96│only to an already-up broker; loud \"session lost — daemon down\" exit otherwise), bounded\n 97│reconnect with visible countdown.\n### NEXT-MILESTONE-REMOTETRUTH-TRIAGE.md\n 127│`pump-ops.json`, `epoch.json`) mint from 1 into ONE broker journal keyspace\n*128│`(NET_EFFECT_SESSION, op)` (broker.rs:3021); CLI wake op colliding with an\n 129│already-journaled daemon op reproduces the error with NO broker restart. Same\n 130│latent class: net-dial (broker.rs:2783), shell-link, sync/update pulls. Fix\n 131│(ADR-0034): (i) journal key gains a minter tag (`cli`/`pump`/`psyche`/`epoch`\n### NEXT-MILESTONE-WORKERTRUTH-TRIAGE.md\n 81│the RETIRED resident `psyche_init` shape. Core verdict: **0.26.0 does NOT\n *82│carry a fix and none is needed core-side for the key itself** — the freeze\n 83│contract (lifecycle.rs:841 `run_psyche_event_turn` doc; the F-030 design doc)\n 84│never lists `{psyche_dir}`; the catalog retired it deliberately\n 85│(runtime.rs:65 — \"a catalog key must have a real fill\"). Fix is ADAPTER-side\n │...\n 110│1. **N-1 + W-2 together** (both change the worker-start/stop verb shape — ONE\n*111│ contract freeze, perri coordinates once).\n 112│2. **V-1 + V-2** (pure view filters; unblock the operator-visible symptom\n 113│ immediately; independent of 1).\n 114│3. **W-3 reap** (needs W-2's stored sid/parent linkage for the session-end leg).\n │...\n 116│5. perri adapter legs (psyche_resume cwd fix = URGENT, ships independent of\n*117│ core; loud-refusal logging + worker verb migration after the freeze in 1).\n 118│\n 119│Roles: todlando executes core waves, doyle gates per chunk, perri owns adapter\n 120│halves (blind-builds from published docs — publish the frozen verb shape to\n### RCA-FLEET-DAEMON-14444.md\n 78│newly reproduced event. A read-only sample of the currently installed\n*79│`%LOCALAPPDATA%/spt-core/logs/daemon.stderr.log` ended at byte **4,163,267**:\n 80│the last **1,999,958 complete-line bytes** spanned wall stamps\n 81│**1788997126331–1788998151874** (1025.543 s). It contained **5127** first writes\n 82│(656,158 bytes), **5092** unpoisoned/non-timeout closes (850,622 bytes),\n### REDISPATCH-STALL-TRIAGE.md\n 7│discard-errors replay-under-mutex into serial 15s subscriber-poison windows\n *8│that compose into 17–62s PTY/RC freezes. Counter-63 fast-follow after\n 9│MESH-RECOVERY's counter 62.\n 10│\n 11│**Canonical RCA:** hertz 2026-07-16, doyle seam-verified the same day; repo\n │...\n 14│**Hazard:** KNOWN-HAZARDS 7.43.\n*15│**Field incident:** live v0.34 boxes, recurrent 20–30s freezes, DISPATCH tails\n 16│17–62s, poison interarrival median 95.5s; 33 `CONN_WRITE_POISONED` windows all\n 17│15,000–15,154 ms (the round-4 SharedSend deadline); 4361 stream-sub-attach\n 18│records/generation; per-stream, not broker-wide (unrelated conns progressed\n### REDISPATCH-TRUTH-TRIAGE.md\n 12│`spt daemon refresh` / `spt update` (same brain-cycle path, `applyhost.rs`)\n*13│freezes active remote `spt rc` sessions. The PTYs and broker-held QUIC\n*14│streams survive by construction — the freeze is a **production redispatch\n 15│bug** in the fresh brain's stream reconstruction:\n 16│\n 17│1. **Stale replay steals live controllers.** The fresh\n### REGISTRY-LIFECYCLE-TRIAGE.md\n 71│green every leg (retire machinery + registry gate = substrate). Field discriminator\n *72│post-release: hertz's snapshot poison count freezes; brain CPU drops to noise; broker thread\n 73│census bounded.\n 74│\n 75│### W2 — ENDPOINT-LIFECYCLE (todlando; REQs registered, activate at W2 start)\n │...\n 139│ voice per RELEASE-RUNBOOK step-2 standard.\n*140│- hertz field-verifies against their preserved baseline (poison count freeze + CPU + thread\n 141│ census + WAKE_RESUME absence are the discriminators).\n### RELEASE-RUNBOOK.md\n 401│ effect**, not the mechanism: not \"replay halts at the first failed write and\n*402│ the poisoned subscriber is dropped\" but \"a stuck viewer can no longer freeze\n 403│ other sessions.\" An internal-diagnostics change collapses to one plain line\n 404│ (e.g. \"Improved logging granularity for attached endpoints\") under\n 405│ **Internal** — never sell the mechanism as an **Added** feature.\n\n### adr/\n#### 0001-clean-room-fork-from-claude-skill-owl.md\n *1│# Clean-room fork from claude_skill_owl with hard freeze on the sister project\n 2│\n 3│## Status\n 4│\n │...\n 20│\n*21│3. **Hard freeze on claude_skill_owl from 2026-05-28.** Only security and breakage fixes during the rebuild — no new features, no refactors. Soft and no-freeze policies expand the parity moving target indefinitely; hard freeze accepts living with the sister project's current bugs in exchange for finishing.\n 22│\n 23│## Consequences\n 24│\n*25│- Dual-maintenance burden is bounded by the freeze, not eliminated. Any breakage fix landed on claude_skill_owl must be considered for porting into spt-core's design (often shape-different, sometimes obsolete).\n 26│- The sister project keeps shipping until the rebuilt spt plugin (built atop spt-core) reaches feature parity. Until then, the user runs claude_skill_owl in production.\n*27│- The \"feature parity\" bar is whatever the sister project does on the freeze date — not a moving target.\n#### 0034-per-minter-op-id-namespacing.md\n 146│ string across the IPC boundary. Changing the phrase is a wire-compat break\n*147│ and is treated like a frozen discriminant (see the freeze rule above).\n 148│- **Match discrimination is tested**: a different broker error must NOT\n 149│ trigger the retry (rides the durable-family negative control).\n 150│- A typed wire variant (rejected for now) is the right move only if a second\n#### 0040-bounded-stream-seat-lifecycle-one-way-terminal.md\n 95│ plateau at O(active). The field discriminators: hertz's preserved snapshot's poison count\n *96│ freezes; brain CPU drops to noise (with the self-hash fix, REQ-BRAIN-HASH-ONCE); broker\n 97│ thread census bounded and named.\n 98│- New wire surface: `KIND_NET_STREAM_UNSUBSCRIBE` (additive, best-effort) + a lifetime\n 99│ class on stream open (additive field; absent = Durable, so N-1 openers keep today's\n │...\n 198│the field's sleeping laptop. The rig asserts the port is still bound after the\n*199│sever, and proves the freeze landed by watching the net runtime's reactor canary\n 200│go stale (0ms → 2006ms) after asserting it was fresh beforehand — a capability\n 201│probe on the instrument itself, in the RC-RENDER-TRUTH oracle discipline.\n 202│\n#### 0047-daemon-lifecycle-custody-authority.md\n 31│\n*32│3. **`spt update` freezes every attached rc PTY.** Pinned by the v0.40.0 OBS\n 33│ breadcrumbs on an authorized same-seam `daemon refresh` (falsifying the\n 34│ presumed gen+1 mechanism): during post-cycle dispatcher replay the broker\n 35│ processed the SAME conn / SAME identity / SAME generation subscribe twice\n │...\n 40│ also fires against the same LIVE conn: the lease kills its own writer and the\n*41│ viewer freezes until a manual detach + re-attach.\n 42│\n 43│A fourth field bug (spt-hosted PTY corruption at fixed geometry) is still being\n 44│RCA'd (hertz, on enlyzeam, isolated-rig non-repro already banked as the","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789113801953}}
{"type":"message","id":"478630d9","parentId":"c4b6e604","timestamp":"2026-09-11T08:03:22.055Z","message":{"role":"toolResult","toolCallId":"call_G5bLExSGLGxfS78GHlvdJqxs|fc_07a38c9435caeae6016aa3b5c77cc487d2a6ef1d43eb240849","toolName":"read","content":[{"type":"text","text":"URL: https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments\nContent-Type: application/json\nMethod: failed\nNotes: Failed to fetch URL (HTTP 404)\n\n---\n\n"}],"details":{"kind":"url","url":"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments","finalUrl":"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments","contentType":"application/json","method":"failed","truncated":false,"notes":["Failed to fetch URL (HTTP 404)"],"meta":{"source":{"type":"url","value":"https://api.github.com/repos/BigscreenVR/spt-bs-releases/issues/49/comments"}}},"isError":false,"timestamp":1789113802055}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_oigEGugq8jBgPf0I3kih7emf|fc_07a38c9435caeae6016aa3b5d4322c87d29486a51645132709","toolName":"read","startedAt":"2026-09-11T08:03:34.638Z","args":{"path":".worktrees/304-product/docs/adr/0047-daemon-lifecycle-custody-authority.md"},"intent":"Reading freeze fix decision"},"id":"fbc4e770","parentId":"478630d9","timestamp":"2026-09-11T08:03:34.638Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_luOzjkQZf3DTEpQ68YkVhZhv|fc_07a38c9435caeae6016aa3b5d4324487d28af2fb81c2dc9c46","toolName":"read","startedAt":"2026-09-11T08:03:34.638Z","args":{"path":".worktrees/304-product/crates/spt/tests/daemon_refresh_e2e.rs"},"intent":"Reading refresh coverage"},"id":"71e13a5b","parentId":"fbc4e770","timestamp":"2026-09-11T08:03:34.638Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_NjKR6pjD3EeWjo2HB5x8FY4f|fc_07a38c9435caeae6016aa3b5d4325087d28857c30efe74940b","toolName":"read","startedAt":"2026-09-11T08:03:34.639Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/attach.rs"},"intent":"Reading attach module map"},"id":"027af4a8","parentId":"71e13a5b","timestamp":"2026-09-11T08:03:34.639Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_E0cAWhnL6kYgvD5GoMYVSCxh|fc_07a38c9435caeae6016aa3b5d4325887d28c83c5965bfc53fa","toolName":"read","startedAt":"2026-09-11T08:03:34.639Z","args":{"path":".worktrees/304-product/crates/spt/src/rc.rs"},"intent":"Reading rc module map"},"id":"f4090bff","parentId":"027af4a8","timestamp":"2026-09-11T08:03:34.639Z"}
{"type":"message","id":"fc506c45","parentId":"f4090bff","timestamp":"2026-09-11T08:03:34.639Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_oigEGugq8jBgPf0I3kih7emf|fc_07a38c9435caeae6016aa3b5d4322c87d29486a51645132709","name":"read","arguments":{"i":"Reading freeze fix decision","path":".worktrees/304-product/docs/adr/0047-daemon-lifecycle-custody-authority.md"},"intent":"Reading freeze fix decision"},{"type":"toolCall","id":"call_luOzjkQZf3DTEpQ68YkVhZhv|fc_07a38c9435caeae6016aa3b5d4324487d28af2fb81c2dc9c46","name":"read","arguments":{"i":"Reading refresh coverage","path":".worktrees/304-product/crates/spt/tests/daemon_refresh_e2e.rs"},"intent":"Reading refresh coverage"},{"type":"toolCall","id":"call_NjKR6pjD3EeWjo2HB5x8FY4f|fc_07a38c9435caeae6016aa3b5d4325087d28857c30efe74940b","name":"read","arguments":{"i":"Reading attach module map","path":".worktrees/304-product/crates/spt-daemon/src/attach.rs"},"intent":"Reading attach module map"},{"type":"toolCall","id":"call_E0cAWhnL6kYgvD5GoMYVSCxh|fc_07a38c9435caeae6016aa3b5d4325887d28c83c5965bfc53fa","name":"read","arguments":{"i":"Reading rc module map","path":".worktrees/304-product/crates/spt/src/rc.rs"},"intent":"Reading rc module map"},{"type":"toolCall","id":"call_AjvGy94YKd9gH7ArF51E6Boa|fc_07a38c9435caeae6016aa3b5d4326087d29957ca2af1469ae4","name":"grep","arguments":{"i":"Locating relevant broker boundaries","pattern":"resolve_subscribe|same.*conn|generation|controller_writer|fn.*input|reap_dead_controller","path":".worktrees/304-product/crates/spt-daemon/src/broker.rs","case":false,"gitignore":true,"skip":null},"intent":"Locating relevant broker boundaries"},{"type":"toolCall","id":"call_DXmGR5dLS3BmCv6bMWaAvloL|fc_07a38c9435caeae6016aa3b5d4326487d2bc4476fff3ec0917","name":"read","arguments":{"i":"Reading update metadata decision","path":".worktrees/304-product/docs/adr/0016-platform-targeted-update-sets.md"},"intent":"Reading update metadata decision"},{"type":"toolCall","id":"call_HH7ZRwN3VFzXnQYFsS8deOJ1|fc_07a38c9435caeae6016aa3b5d4326c87d2b6e281a52a778f59","name":"grep","arguments":{"i":"Locating project model sections","pattern":"^#|debug rollout","path":".worktrees/304-product/CONTEXT.md","case":false,"gitignore":true,"skip":null},"intent":"Locating project model sections"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":12510,"output":329,"cacheRead":18304,"cacheWrite":0,"totalTokens":31143,"cost":{"input":0.12510000000000002,"output":0.01645,"cacheRead":0.018304,"cacheWrite":0,"total":0.159854}},"stopReason":"toolUse","timestamp":1789113802098,"responseId":"resp_07a38c9435caeae6016aa3b5c8351487d29ef677f4e8cb4e54","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_07a38c9435caeae6016aa3b5d4322c87d29486a51645132709","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading freeze fix decision\",\"path\":\".worktrees/304-product/docs/adr/0047-daemon-lifecycle-custody-authority.md\"}","call_id":"call_oigEGugq8jBgPf0I3kih7emf","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4324487d28af2fb81c2dc9c46","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading refresh coverage\",\"path\":\".worktrees/304-product/crates/spt/tests/daemon_refresh_e2e.rs\"}","call_id":"call_luOzjkQZf3DTEpQ68YkVhZhv","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4325087d28857c30efe74940b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading attach module map\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/attach.rs\"}","call_id":"call_NjKR6pjD3EeWjo2HB5x8FY4f","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4325887d28c83c5965bfc53fa","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading rc module map\",\"path\":\".worktrees/304-product/crates/spt/src/rc.rs\"}","call_id":"call_E0cAWhnL6kYgvD5GoMYVSCxh","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4326087d29957ca2af1469ae4","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating relevant broker boundaries\",\"pattern\":\"resolve_subscribe|same.*conn|generation|controller_writer|fn.*input|reap_dead_controller\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/broker.rs\",\"case\":false,\"gitignore\":true,\"skip\":null}","call_id":"call_AjvGy94YKd9gH7ArF51E6Boa","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4326487d2bc4476fff3ec0917","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading update metadata decision\",\"path\":\".worktrees/304-product/docs/adr/0016-platform-targeted-update-sets.md\"}","call_id":"call_DXmGR5dLS3BmCv6bMWaAvloL","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5d4326c87d2b6e281a52a778f59","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating project model sections\",\"pattern\":\"^#|debug rollout\",\"path\":\".worktrees/304-product/CONTEXT.md\",\"case\":false,\"gitignore\":true,\"skip\":null}","call_id":"call_HH7ZRwN3VFzXnQYFsS8deOJ1","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}}]},"duration":12538.188199999742,"ttft":12484.159500000067,"completedAt":1789113814637,"contextSnapshot":{"promptTokens":30814,"nonMessageTokens":10264,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_AjvGy94YKd9gH7ArF51E6Boa|fc_07a38c9435caeae6016aa3b5d4326087d29957ca2af1469ae4","toolName":"grep","startedAt":"2026-09-11T08:03:34.639Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/broker.rs"},"intent":"Locating relevant broker boundaries"},"id":"4b4b4a4e","parentId":"fc506c45","timestamp":"2026-09-11T08:03:34.639Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_DXmGR5dLS3BmCv6bMWaAvloL|fc_07a38c9435caeae6016aa3b5d4326487d2bc4476fff3ec0917","toolName":"read","startedAt":"2026-09-11T08:03:34.640Z","args":{"path":".worktrees/304-product/docs/adr/0016-platform-targeted-update-sets.md"},"intent":"Reading update metadata decision"},"id":"d3ed08a1","parentId":"4b4b4a4e","timestamp":"2026-09-11T08:03:34.640Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_HH7ZRwN3VFzXnQYFsS8deOJ1|fc_07a38c9435caeae6016aa3b5d4326c87d2b6e281a52a778f59","toolName":"grep","startedAt":"2026-09-11T08:03:34.640Z","args":{"path":".worktrees/304-product/CONTEXT.md"},"intent":"Locating project model sections"},"id":"1b888456","parentId":"d3ed08a1","timestamp":"2026-09-11T08:03:34.640Z"}
{"type":"message","id":"448368f6","parentId":"1b888456","timestamp":"2026-09-11T08:03:34.648Z","message":{"role":"toolResult","toolCallId":"call_HH7ZRwN3VFzXnQYFsS8deOJ1|fc_07a38c9435caeae6016aa3b5d4326c87d2b6e281a52a778f59","toolName":"grep","content":[{"type":"text","text":"*1|# spt-core\n 2|\n 3|**Platform scope:** Windows + Linux for v1. macOS is out (no test machine available) but kept structurally easy — `portable-pty` and Iroh both support it, so macOS is a later test/CI-budget decision, not a re-architecture.\n 4|\n...\n 10|\n*11|## Language\n 12|\n 13|**spt-core**:\n 14|The system. Canonical name. The Rust workspace and the umbrella project.\n...\n 43|\n*44|### Deliverable shape\n 45|\n 46|spt-core ships **both** a library workspace and a canonical binary:\n 47|\n...\n 52|\n*53|## Runtime model\n 54|\n 55|spt-core is harness-independent: it does not know about Claude Code, Codex, Cursor, or any other agent runtime. All harness-specific surfaces (how to invoke an agent session, fetch conversation history for an echo commune, detect activity/idleness, etc.) are abstracted behind a runtime layer that consumers supply.\n 56|\n...\n 122|\n*123|### Manifest seams (outbound contract, detailed)\n 124|\n 125|Governing principle: **SPT is not a harness.** Model choice, billing shape, harness-internal env, and harness-internal context are entirely the adapter's concern, expressed inside the adapter's own command templates. spt-core owns only the template *mechanism* (substitution keys), the substitution *values* it is responsible for, and the surrounding lifecycle. Env for the *endpoint binary itself* is auto-handled by spt-core/broker; env for the *agent running inside* that binary is the adapter's config (e....\n 126|\n...\n 182|\n*183|### Inbound `api` surface (detailed)\n 184|\n 185|All commands below are `api`-prefixed (machinery-facing). Every `api` invocation **and** every manifest carries a unified **`adapter_name`** string (e.g. `claude-spt`) identifying the owning adapter. This is load-bearing: one daemon hosts endpoints from multiple adapters (`claude-spt`, `spt-codex`, `spt-pi`), so the daemon resolves an endpoint's manifest + seams (history normalize-command, inject method, update avenue) by its `adapter_name`; adapter-update ripples target by it; capability lookup and tele...\n 186|\n...\n 209|\n*210|### Startup flows (the two topologies)\n 211|\n 212|**Adapters never resolve `$SPT_HOME`.** spt-core install registers its binary directory on the system-wide PATH, so adapters call `spt api …` on any OS without path math. All harness↔daemon bridging goes through `spt api` commands (the daemon is always running, or auto-started — below), so there is **no adapter-written file** in the bind path.\n 213|\n...\n 238|\n*239|### Endpoint types\n 240|\n 241|Each perch advertises an **endpoint type** — a tag that says what shape of entity lives at that perch and what operations it accepts. The set of day-one types:\n 242|\n...\n 317|\n*318|### Agent endpoints vs Shells\n 319|\n 320|Endpoint types split into two families:\n 321|\n...\n 334|\n*335|#### Shell model (detailed)\n 336|\n 337|A Shell is a **surface one agent controls** — embodiment of an agent in a new system/environment.\n 338|\n...\n 386|\n*387|#### Shell sleep/wake (offline ↔ online)\n 388|\n 389|A shell automatically goes **offline when its owner endpoint goes offline**. Two complementary manifest options bring it (and its owner) back:\n 390|\n...\n 528|\n*529|## Terminal wrapper\n 530|\n 531|The multiplatform terminal wrapper is the backbone for hosting agent sessions. Supersedes the sister project's planned \"capsule\" (which leaned on psmux). Architecturally a **process supervisor** with an abstract session surface. **The session-surface *mechanism* is delivered in M3a (`crates/spt-term`); the supervisor *process* (term-daemon) is delivered in M3b (`crates/spt-daemon`, 2026-06-03).**\n 532|\n...\n 573|\n*574|## Networking\n 575|\n 576|WAN cross-machine messaging is a **first-class, day-one capability** of spt-core — not a follow-on project. Goal: minimal-to-zero config, \"just works\" cross-machine SPT. The transport stack (Iroh + mDNS LAN discovery + pairing) is baked into the core library crates, behind a compile-time feature flag (`net`) that is default-on in the reference binary and optional for embedded/stripped library consumers.\n 577|\n...\n 588|\n*589|### The peer pump\n 590|\n 591|**peer pump**: the **one supervised daemon loop** driving all outbound cadenced peer traffic — registry advertisement, notif push, sync pull, update check — against every roster member of every attached subnet. The pump owns *when* and *toward whom*: the scheduling kernel (in-memory stagger-from-due-now cadences + wake markers — deliberately **not** deadline-grid converted, ADR-0018 `[V4]`; no per-loop timing writes), the per-round shared store loads, the per-subnet × per-peer fan-out (connection ...\n 592|\n...\n 598|\n*599|### The evidence route\n 600|\n 601|\n 602|**evidence route**: the send leg's fallback when resolution finds no registry row. `resolve_visible` NotFounds an endpoint with no live instance — even under an explicit `@node` pin — so a peer this node holds only **local evidence** of (an UNLISTED row: our own access rules name it, the contact ledger has traffic with it, we knocked on it) would render in `endpoint list` and be unreachable by `spt send`. A row the operator can see and cannot act on is a worse surface than no row, so the route closes...\n...\n 615|\n*616|### The presence probe\n 617|\n 618|\n 619|**presence probe**: the wire question `endpoint list` asks about an UNLISTED row — *is this peer there right now* — answered by the node that holds them, at the moment of asking. It exists because an evidence row is deliberately not a liveness claim (a stale rule can name an endpoint deleted a month ago), so the listing would otherwise show peers with no way to tell which are reachable. Distinct from **presence resolution** (REQ-PRES-1), which answers *where is the user* from `last_active_ms` stamps ...\n...\n 635|\n*636|### Cross-node Psyche sync\n 637|\n 638|**Sync scope is subnet-exclusive by default.** An endpoint's mind replicates only within **one subnet** unless told otherwise. Endpoint config carries a **subnet-membership list** for sync: the context syncs across the nodes of *every* subnet in that list, defaulting to just the endpoint's anchor subnet. This is distinct from registry *visibility* (*endpoint visibility*) — being addressable in a subnet does not imply replicating your mind there; mind-replication into a subnet requires that subnet to be...\n 639|\n...\n 652|\n*653|### Subnet notifications\n 654|\n 655|**notification (notif)**:\n 656|A first-class kind **distinct from an inter-agent message**: a **user-directed, dismissable, resurfacing** event (e.g. *new node paired*, *external-subnet pairing request*, *update available*, *consent needed*). Messages route agent→agent and are consumed once; notifs route **to the user** — via whichever endpoint is active — and **persist until dismissed**. The notif is the general primitive that the previously-ad-hoc \"deliver to the user's most-recently-active session\" flows are special cases of:...\n...\n 675|\n*676|## Self-update\n 677|\n 678|\n 679|Seamless, realtime self-updating is a day-one pillar. After a plugin performs the initial spt-core bootstrap, `spt.exe` self-updates from then on and **ripple-updates registered adapters** via each adapter's manifest update declaration. An adapter may include a `[update].message` — a plain human notice (markdown-rendered) that `spt adapter update` prints to stdout only when a new version is **actually applied** (never on a no-op). Useful for post-update operator actions, e.g. `\"Run \\`/reload-plugins\\` ...\n...\n 706|\n*707|**debug rollout**:\n*708|A deliberately non-production update distribution across a trusted lab subnet, used to test a local build on multiple nodes before a public release. It is still an update, not a raw peer file-copy: every recipient treats it as a signed, channel-scoped candidate that must pass the normal verification and consent gates; lab nodes pinned to the debug channel may explicitly opt into full-auto apply. Trust is node-local: debug rollout keys are installed through each lab node's release-key overlay, never embed...\n 709|_Avoid_: production release, peer proliferation, subnet binary copy\n 710|\n 711|**cadence/consent** — **not fully automatic by default; gated on user confirmation.** The update prompt is delivered via spt to the user's **most-recently-active live session** (v1 registry resolution — a precursor to PresenceChannel dispatch, implemented on the v1 registry, not the deferred channel) and offers an \"enable full-auto\" choice. Full-auto is the opt-in seamless path.\n 712|\n*713|## Web serving\n 714|\n 715|Ratified 2026-09-06 (WEBSERVE grill round 1, releases#272; ADR-0056..0059). The docs server\n 716|grows into the node's general serving surface; these are the terms the surface is described in.\n...\n 774|\n*775|## Instances\n 776|\n 777|The multi-instance identity model. An agent is no longer \"a perch on one machine\"; identity and materialization split into two layers:\n 778|\n...\n 829|\n*830|### Pieces the Instances model requires\n 831|\n 832|**subnet registry**:\n 833|Distributed, eventually-consistent map `endpoint_id → [instances: (node, perch, type, status)]`, **per subnet**. Every `spt-daemon` participates in the registry of each subnet it belongs to. This is the \"agent name resolution\" the sister project deferred — now first-class and mandatory.\n...\n 882|\n*883|### Off-node reach-back\n 884|\n 885|When the user is driving an instance from off-node, the agent should be able to:\n 886|- **detect** that it is being driven remotely (and from which node) — observable from the `spt-daemon`, which knows whether the driving session-surface stream is local or network-attached; (v1)\n...\n 889|\n*890|### v1 scope line (V1-mid)\n 891|\n 892|- **In v1:** the endpoint-ID / instance data-model split; the subnet registry; resolution policy; remote-drive of *already-running* instances (network session-surface); cross-node Psyche sync (full — replaces gh-repo-sync); cross-instance context-freshness auto-feed; off-node file transfer; off-node remote-drive detection.\n 893|- **Seam-compatible but deferred:** instantiate-anywhere + its consent gate; remote command execution + its security gate (workarounds: remote agent messages a local agent, or user interacts with a local agent directly).\n...\n 895|\n*896|## Workspace & versioning\n 897|\n 898|The crate-boundary design is the rebuild's main value (ADR-0001) — honest decoupling that prevents the sister project's tangle from re-forming. Principle: **many small, acyclically-layered crates** (not a few fat ones).\n 899|\n...\n 905|\n*906|## Pairing & trust\n 907|\n 908|How a single user's own nodes come to trust each other and form a subnet. Cross-*user* subnet (two *different* users' subnets interoperating) is explicitly deferred (the sister project's \"cross-subnet contract\" — very-early future concept), but the model is **built with the seam for it** (see *subnet membership*).\n 909|\n...\n 1117|\n*1118|## Consent & security gates\n 1119|\n 1120|Gates the high-risk cross-node capabilities. **Trust boundary:** everything is within *one user's own subnet* (their own TOTP-SPAKE2-paired, mutually-trusted nodes; cross-subnet is deferred). So consent is **not** stranger-authentication — it is guardrails against (1) an agent doing something surprising/destructive the user didn't want, (2) **runaway** (spawning instances / burning compute/billing across nodes), (3) **compromise containment** (limiting a compromised node/agent's cross-node blast radius).\n 1121|\n...\n 1191|\n*1192|### Messaging substrate\n 1193|\n 1194|**arriving-message envelope**:\n 1195|Every message that arrives at a consumer — an agent over `api listen`/`spt ready`, an adapter's hook composer over `api poll`/`api worker-poll`, the cross-node WAN feed — is delivered as the canonical **`body` envelope** (`spt-proto::event`, the ADR-0001 grammar; self-delimiting, `from` attribution, `
` body escaping, `` chunking). It is the one format adapters parse on, identical across every **arriving-message** surface on an agent perch. The earl...\n...\n 1199|\n*1200|## Installation\n 1201|\n 1202|\n 1203|\n...\n 1222|\n*1223|## Project infrastructure\n 1224|\n 1225|**repo topology (The Forkening, ADR-0036)**:\n 1226|Development home is **`BigscreenVR/spt-bs-core`** (private); the publish target is **`BigscreenVR/spt-bs-releases`** (private) — GitHub Releases carry the binaries, the docs bundle, and the signed update-set, reached only through an org-authenticated `gh`. **`SaberMage/spt-core` and `SaberMage/spt-releases` are retained as passive mirrors** (private; the merging agent pushes every main merge + tags; Actions disabled) — full history, may diverge from the dev home only if a genuine second contributor e...\n...\n 1254|\n*1255|### Frontend (day-one)\n 1256|\n 1257|The day-one headed frontend is a launcher/manager UX, not just a raw `attach`. The end user cares about *reaching a target agent*, not about PTY mechanics. The frontend must:\n 1258|\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".worktrees/304-product/CONTEXT.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\CONTEXT.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":33,"fileCount":1,"files":[".worktrees/304-product/CONTEXT.md"],"fileMatches":[{"path":".worktrees/304-product/CONTEXT.md","count":33}],"truncated":true,"displayContent":" *1│# spt-core\n 2│\n 3│**Platform scope:** Windows + Linux for v1. macOS is out (no test machine available) but kept structurally easy — `portable-pty` and Iroh both support it, so macOS is a later test/CI-budget decision, not a re-architecture.\n 4│\n │...\n 10│\n *11│## Language\n 12│\n 13│**spt-core**:\n 14│The system. Canonical name. The Rust workspace and the umbrella project.\n │...\n 43│\n *44│### Deliverable shape\n 45│\n 46│spt-core ships **both** a library workspace and a canonical binary:\n 47│\n │...\n 52│\n *53│## Runtime model\n 54│\n 55│spt-core is harness-independent: it does not know about Claude Code, Codex, Cursor, or any other agent runtime. All harness-specific surfaces (how to invoke an agent session, fetch conversation history for an echo commune, detect activity/idleness, etc.) are abstracted behind a runtime layer that consumers supply.\n 56│\n │...\n 122│\n *123│### Manifest seams (outbound contract, detailed)\n 124│\n 125│Governing principle: **SPT is not a harness.** Model choice, billing shape, harness-internal env, and harness-internal context are entirely the adapter's concern, expressed inside the adapter's own command templates. spt-core owns only the template *mechanism* (substitution keys), the substitution *values* it is responsible for, and the surrounding lifecycle. Env for the *endpoint binary itself* is auto-handled by spt-core/broker; env for the *agent running inside* that binary is the adapter's config (e....\n 126│\n │...\n 182│\n *183│### Inbound `api` surface (detailed)\n 184│\n 185│All commands below are `api`-prefixed (machinery-facing). Every `api` invocation **and** every manifest carries a unified **`adapter_name`** string (e.g. `claude-spt`) identifying the owning adapter. This is load-bearing: one daemon hosts endpoints from multiple adapters (`claude-spt`, `spt-codex`, `spt-pi`), so the daemon resolves an endpoint's manifest + seams (history normalize-command, inject method, update avenue) by its `adapter_name`; adapter-update ripples target by it; capability lookup and tele...\n 186│\n │...\n 209│\n *210│### Startup flows (the two topologies)\n 211│\n 212│**Adapters never resolve `$SPT_HOME`.** spt-core install registers its binary directory on the system-wide PATH, so adapters call `spt api …` on any OS without path math. All harness↔daemon bridging goes through `spt api` commands (the daemon is always running, or auto-started — below), so there is **no adapter-written file** in the bind path.\n 213│\n │...\n 238│\n *239│### Endpoint types\n 240│\n 241│Each perch advertises an **endpoint type** — a tag that says what shape of entity lives at that perch and what operations it accepts. The set of day-one types:\n 242│\n │...\n 317│\n *318│### Agent endpoints vs Shells\n 319│\n 320│Endpoint types split into two families:\n 321│\n │...\n 334│\n *335│#### Shell model (detailed)\n 336│\n 337│A Shell is a **surface one agent controls** — embodiment of an agent in a new system/environment.\n 338│\n │...\n 386│\n *387│#### Shell sleep/wake (offline ↔ online)\n 388│\n 389│A shell automatically goes **offline when its owner endpoint goes offline**. Two complementary manifest options bring it (and its owner) back:\n 390│\n │...\n 528│\n *529│## Terminal wrapper\n 530│\n 531│The multiplatform terminal wrapper is the backbone for hosting agent sessions. Supersedes the sister project's planned \"capsule\" (which leaned on psmux). Architecturally a **process supervisor** with an abstract session surface. **The session-surface *mechanism* is delivered in M3a (`crates/spt-term`); the supervisor *process* (term-daemon) is delivered in M3b (`crates/spt-daemon`, 2026-06-03).**\n 532│\n │...\n 573│\n *574│## Networking\n 575│\n 576│WAN cross-machine messaging is a **first-class, day-one capability** of spt-core — not a follow-on project. Goal: minimal-to-zero config, \"just works\" cross-machine SPT. The transport stack (Iroh + mDNS LAN discovery + pairing) is baked into the core library crates, behind a compile-time feature flag (`net`) that is default-on in the reference binary and optional for embedded/stripped library consumers.\n 577│\n │...\n 588│\n *589│### The peer pump\n 590│\n 591│**peer pump**: the **one supervised daemon loop** driving all outbound cadenced peer traffic — registry advertisement, notif push, sync pull, update check — against every roster member of every attached subnet. The pump owns *when* and *toward whom*: the scheduling kernel (in-memory stagger-from-due-now cadences + wake markers — deliberately **not** deadline-grid converted, ADR-0018 `[V4]`; no per-loop timing writes), the per-round shared store loads, the per-subnet × per-peer fan-out (connection ...\n 592│\n │...\n 598│\n *599│### The evidence route\n 600│\n 601│\n 602│**evidence route**: the send leg's fallback when resolution finds no registry row. `resolve_visible` NotFounds an endpoint with no live instance — even under an explicit `@node` pin — so a peer this node holds only **local evidence** of (an UNLISTED row: our own access rules name it, the contact ledger has traffic with it, we knocked on it) would render in `endpoint list` and be unreachable by `spt send`. A row the operator can see and cannot act on is a worse surface than no row, so the route closes...\n │...\n 615│\n *616│### The presence probe\n 617│\n 618│\n 619│**presence probe**: the wire question `endpoint list` asks about an UNLISTED row — *is this peer there right now* — answered by the node that holds them, at the moment of asking. It exists because an evidence row is deliberately not a liveness claim (a stale rule can name an endpoint deleted a month ago), so the listing would otherwise show peers with no way to tell which are reachable. Distinct from **presence resolution** (REQ-PRES-1), which answers *where is the user* from `last_active_ms` stamps ...\n │...\n 635│\n *636│### Cross-node Psyche sync\n 637│\n 638│**Sync scope is subnet-exclusive by default.** An endpoint's mind replicates only within **one subnet** unless told otherwise. Endpoint config carries a **subnet-membership list** for sync: the context syncs across the nodes of *every* subnet in that list, defaulting to just the endpoint's anchor subnet. This is distinct from registry *visibility* (*endpoint visibility*) — being addressable in a subnet does not imply replicating your mind there; mind-replication into a subnet requires that subnet to be...\n 639│\n │...\n 652│\n *653│### Subnet notifications\n 654│\n 655│**notification (notif)**:\n 656│A first-class kind **distinct from an inter-agent message**: a **user-directed, dismissable, resurfacing** event (e.g. *new node paired*, *external-subnet pairing request*, *update available*, *consent needed*). Messages route agent→agent and are consumed once; notifs route **to the user** — via whichever endpoint is active — and **persist until dismissed**. The notif is the general primitive that the previously-ad-hoc \"deliver to the user's most-recently-active session\" flows are special cases of:...\n │...\n 675│\n *676│## Self-update\n 677│\n 678│\n 679│Seamless, realtime self-updating is a day-one pillar. After a plugin performs the initial spt-core bootstrap, `spt.exe` self-updates from then on and **ripple-updates registered adapters** via each adapter's manifest update declaration. An adapter may include a `[update].message` — a plain human notice (markdown-rendered) that `spt adapter update` prints to stdout only when a new version is **actually applied** (never on a no-op). Useful for post-update operator actions, e.g. `\"Run \\`/reload-plugins\\` ...\n │...\n 706│\n *707│**debug rollout**:\n *708│A deliberately non-production update distribution across a trusted lab subnet, used to test a local build on multiple nodes before a public release. It is still an update, not a raw peer file-copy: every recipient treats it as a signed, channel-scoped candidate that must pass the normal verification and consent gates; lab nodes pinned to the debug channel may explicitly opt into full-auto apply. Trust is node-local: debug rollout keys are installed through each lab node's release-key overlay, never embed...\n 709│_Avoid_: production release, peer proliferation, subnet binary copy\n 710│\n 711│**cadence/consent** — **not fully automatic by default; gated on user confirmation.** The update prompt is delivered via spt to the user's **most-recently-active live session** (v1 registry resolution — a precursor to PresenceChannel dispatch, implemented on the v1 registry, not the deferred channel) and offers an \"enable full-auto\" choice. Full-auto is the opt-in seamless path.\n 712│\n *713│## Web serving\n 714│\n 715│Ratified 2026-09-06 (WEBSERVE grill round 1, releases#272; ADR-0056..0059). The docs server\n 716│grows into the node's general serving surface; these are the terms the surface is described in.\n │...\n 774│\n *775│## Instances\n 776│\n 777│The multi-instance identity model. An agent is no longer \"a perch on one machine\"; identity and materialization split into two layers:\n 778│\n │...\n 829│\n *830│### Pieces the Instances model requires\n 831│\n 832│**subnet registry**:\n 833│Distributed, eventually-consistent map `endpoint_id → [instances: (node, perch, type, status)]`, **per subnet**. Every `spt-daemon` participates in the registry of each subnet it belongs to. This is the \"agent name resolution\" the sister project deferred — now first-class and mandatory.\n │...\n 882│\n *883│### Off-node reach-back\n 884│\n 885│When the user is driving an instance from off-node, the agent should be able to:\n 886│- **detect** that it is being driven remotely (and from which node) — observable from the `spt-daemon`, which knows whether the driving session-surface stream is local or network-attached; (v1)\n │...\n 889│\n *890│### v1 scope line (V1-mid)\n 891│\n 892│- **In v1:** the endpoint-ID / instance data-model split; the subnet registry; resolution policy; remote-drive of *already-running* instances (network session-surface); cross-node Psyche sync (full — replaces gh-repo-sync); cross-instance context-freshness auto-feed; off-node file transfer; off-node remote-drive detection.\n 893│- **Seam-compatible but deferred:** instantiate-anywhere + its consent gate; remote command execution + its security gate (workarounds: remote agent messages a local agent, or user interacts with a local agent directly).\n │...\n 895│\n *896│## Workspace & versioning\n 897│\n 898│The crate-boundary design is the rebuild's main value (ADR-0001) — honest decoupling that prevents the sister project's tangle from re-forming. Principle: **many small, acyclically-layered crates** (not a few fat ones).\n 899│\n │...\n 905│\n *906│## Pairing & trust\n 907│\n 908│How a single user's own nodes come to trust each other and form a subnet. Cross-*user* subnet (two *different* users' subnets interoperating) is explicitly deferred (the sister project's \"cross-subnet contract\" — very-early future concept), but the model is **built with the seam for it** (see *subnet membership*).\n 909│\n │...\n 1117│\n*1118│## Consent & security gates\n 1119│\n 1120│Gates the high-risk cross-node capabilities. **Trust boundary:** everything is within *one user's own subnet* (their own TOTP-SPAKE2-paired, mutually-trusted nodes; cross-subnet is deferred). So consent is **not** stranger-authentication — it is guardrails against (1) an agent doing something surprising/destructive the user didn't want, (2) **runaway** (spawning instances / burning compute/billing across nodes), (3) **compromise containment** (limiting a compromised node/agent's cross-node blast radius).\n 1121│\n │...\n 1191│\n*1192│### Messaging substrate\n 1193│\n 1194│**arriving-message envelope**:\n 1195│Every message that arrives at a consumer — an agent over `api listen`/`spt ready`, an adapter's hook composer over `api poll`/`api worker-poll`, the cross-node WAN feed — is delivered as the canonical **`body` envelope** (`spt-proto::event`, the ADR-0001 grammar; self-delimiting, `from` attribution, `
` body escaping, `` chunking). It is the one format adapters parse on, identical across every **arriving-message** surface on an agent perch. The earl...\n │...\n 1199│\n*1200│## Installation\n 1201│\n 1202│\n 1203│\n │...\n 1222│\n*1223│## Project infrastructure\n 1224│\n 1225│**repo topology (The Forkening, ADR-0036)**:\n 1226│Development home is **`BigscreenVR/spt-bs-core`** (private); the publish target is **`BigscreenVR/spt-bs-releases`** (private) — GitHub Releases carry the binaries, the docs bundle, and the signed update-set, reached only through an org-authenticated `gh`. **`SaberMage/spt-core` and `SaberMage/spt-releases` are retained as passive mirrors** (private; the merging agent pushes every main merge + tags; Actions disabled) — full history, may diverge from the dev home only if a genuine second contributor e...\n │...\n 1254│\n*1255│### Frontend (day-one)\n 1256│\n 1257│The day-one headed frontend is a launcher/manager UX, not just a raw `attach`. The end user cares about *reaching a target agent*, not about PTY mechanics. The frontend must:\n 1258│","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789113814648}}
{"type":"message","id":"c3f5f835","parentId":"448368f6","timestamp":"2026-09-11T08:03:34.649Z","message":{"role":"toolResult","toolCallId":"call_luOzjkQZf3DTEpQ68YkVhZhv|fc_07a38c9435caeae6016aa3b5d4324487d28af2fb81c2dc9c46","toolName":"read","content":[{"type":"text","text":"//! THE-FORKENING W4 — `spt daemon refresh` on a LIVE daemon with a hosted\n//! endpoint (REQ-DAEMON-REFRESH): the brain generation cycles (new brain pid,\n//! generation bumped) with NO binary swap, while the broker process, the hosted\n//! harness session, and the endpoint's ONLINE perch all survive untouched — the\n//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\n//! verb. The recovery story: wedged brain-held state no longer needs a full\n//! daemon bounce that kills every PTY.\n//!\n//! Real `spt daemon run` broker + supervised brain + a REAL dummy-harness\n//! `[session.self]` session (the live_adapt_translation_swap_e2e rig, minus the\n//! translation child). Bounded everywhere; every spawned pid is reaped SCOPED\n//! at test end.\n//\n// [int->REQ-DAEMON-REFRESH]\n\nuse std::path::{Path, PathBuf};\nuse std::process::{Child, Command, Stdio};\nuse std::time::{Duration, Instant};\n\nmod common;\nuse common::CommandNoWindowExt;\n\nuse spt_store::perch::{self, ParentHint};\n\n/// Scoped pid-tree kill (cleanup) — never machine-wide.\nfn kill_pid(pid: u32) {\n #[cfg(windows)]\n let _ = Command::new(\"taskkill\")\n .no_window()\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\n .output();\n #[cfg(unix)]\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\n}\n\n/// `(pid, generation)` out of `brain.ready`; `None` until it parses.\nfn read_ready(path: &Path) -> Option<(u32, u64)> {\n let v: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()?;\n Some((\n v.get(\"pid\")?.as_u64()? as u32,\n v.get(\"generation\")?.as_u64()?,\n ))\n}\n\n/// Poll `brain.ready` until it holds a pid different from `was`, up to `budget`.\nfn wait_ready_not(path: &Path, was: Option, budget: Duration) -> Option<(u32, u64)> {\n let deadline = Instant::now() + budget;\n while Instant::now() < deadline {\n if let Some((pid, generation)) = read_ready(path) {\n if was != Some(pid) {\n return Some((pid, generation));\n }\n }\n std::thread::sleep(Duration::from_millis(50));\n }\n None\n}\n\n\n\n#[test]\nfn daemon_refresh_cycles_brain_while_hosted_endpoint_survives() {\n let now_ms = || {\n std::time::SystemTime::now()\n .duration_since(std::time::UNIX_EPOCH)\n .map(|d| d.as_millis() as u64)\n .unwrap_or(0)\n };\n let _ = now_ms; // rig parity; the CLI verb needs no in-proc Brain here.\n\n // ── (1) Isolated, NET-LESS SPT_HOME. ──\n let home = tempfile::tempdir().unwrap();\n std::env::set_var(\"SPT_HOME\", home.path());\n let identity_dir = home.path().join(\"identity\");\n std::fs::create_dir_all(&identity_dir).unwrap();\n std::fs::write(identity_dir.join(\"node.key\"), \"not-a-valid-seed\").unwrap();\n\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n let exe_suffix = spt_bin\n .extension()\n .map(|e| format!(\".{}\", e.to_string_lossy()))\n .unwrap_or_default();\n let mock_session = common::sibling_bin(\"mock-session\");\n assert!(\n mock_session.exists(),\n \"the dummy-harness program must be built: {}\",\n mock_session.display()\n );\n\n // ── (2) Register adapter `cc` with a long-lived dummy-harness session\n // (the live_adapt rig's manifest, minus the translation binary). ──\n let install_dir = perch::spt_home().join(\"srcs\").join(\"cc\");\n std::fs::create_dir_all(&install_dir).unwrap();\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\n let self_cmd = format!(\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\n --spt {spt_for_cmd} --mock-adapter cc --type live_agent --heartbeat-ms 200\"\n );\n let psyche_bin = install_dir.join(format!(\"psychebin{exe_suffix}\"));\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\n let drops = home.path().join(\"drops\");\n std::fs::create_dir_all(&drops).unwrap();\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\n let manifest_toml = format!(\n \"[adapter]\\nname=\\\"cc\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\n );\n std::fs::write(install_dir.join(\"manifest.toml\"), &manifest_toml).unwrap();\n spt_runtime::registry::register(&perch::adapters_dir(), &install_dir, 1000).unwrap();\n\n // ── (3) The REAL daemon broker process. ──\n let brain_log = home.path().join(\"brain.stderr.log\");\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\n let mut broker: Child = Command::new(&spt_bin)\n .no_window()\n .args([\"daemon\", \"run\"])\n .env(\"SPT_HOME\", home.path())\n // Rig daemon: the advisory well-known ports belong to this box's resident\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n .env(\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\n \"1\",\n )\n .stdout(Stdio::null())\n .stderr(Stdio::from(brain_log_file))\n .spawn()\n .expect(\"spawn spt daemon run (broker process)\");\n let ready_path = home.path().join(\"brain.ready\");\n let (brain_pid_before, gen_before) =\n match wait_ready_not(&ready_path, None, Duration::from_secs(30)) {\n Some(r) => r,\n None => {\n let _ = broker.kill();\n let _ = broker.wait();\n panic!(\n \"PRECONDITION: brain never came up.\\n{}\",\n common::daemon_stderr_panel(&brain_log)\n );\n }\n };\n let broker_pid = broker.id();\n\n // ── (4) Host a real endpoint: `endpoint create ccX --adapter cc + endpoint start ccX`,\n // wait for its perch ONLINE. ──\n let id = \"ccX\";\n // U3: the mint and the first session are separate verbs.\n common::create_endpoint(&spt_bin, home.path(), id, \"cc\");\n let run = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"endpoint\", \"start\", id])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(45))\n };\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\n let harness_pid: Option = run_stderr\n .split(\"pid=\")\n .nth(1)\n .and_then(|s| s.split_whitespace().next())\n .and_then(|s| s.trim().parse().ok());\n\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\n let mut online = false;\n let deadline = Instant::now() + Duration::from_secs(25);\n while Instant::now() < deadline {\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\n online = true;\n break;\n }\n std::thread::sleep(Duration::from_millis(150));\n }\n\n // ── (5) THE VERB: `spt daemon refresh` — the production CLI path. ──\n let refresh = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"daemon\", \"refresh\"])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(30))\n };\n let refresh_stdout = String::from_utf8_lossy(&refresh.stdout).to_string();\n let refresh_stderr = String::from_utf8_lossy(&refresh.stderr).to_string();\n\n // ── (6) The brain must CYCLE: a new pid stamps brain.ready with a bumped\n // generation (no binary swapped anywhere). ──\n let cycled = wait_ready_not(&ready_path, Some(brain_pid_before), Duration::from_secs(30));\n\n // The broker process must be the SAME OS process (never restarted).\n let broker_still_running = broker.try_wait().map(|st| st.is_none()).unwrap_or(false);\n\n // The hosted endpoint survives: harness alive + perch back/still ONLINE.\n let harness_alive_after = harness_pid\n .map(spt_store::proc::is_process_alive)\n .unwrap_or(false);\n let mut still_online = false;\n let online_deadline = Instant::now() + Duration::from_secs(10);\n while Instant::now() < online_deadline {\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\n still_online = true;\n break;\n }\n std::thread::sleep(Duration::from_millis(150));\n }\n\n let brain_stderr = common::daemon_stderr_panel(&brain_log);\n eprintln!(\n \"=== W4 daemon refresh: run_ok={} online={online} harness_pid={harness_pid:?} \\\n refresh_ok={} brain_before={brain_pid_before}/g{gen_before} cycled={cycled:?} \\\n broker_alive={broker_still_running} harness_alive_after={harness_alive_after} \\\n still_online={still_online} ===\\n--- refresh stdout ---\\n{refresh_stdout}\\n\\\n --- refresh stderr ---\\n{refresh_stderr}\\n=== endpoint start stderr ===\\n{run_stderr}\\n\\\n {brain_stderr}\",\n run.status.success(),\n refresh.status.success(),\n );\n\n // ── (7) Reap the ENTIRE tree SCOPED before asserting. ──\n if let Some(p) = harness_pid {\n kill_pid(p);\n }\n let psyche_perch = perch::resolve_perch_path(&format!(\"{id}-psyche\"), ParentHint::Explicit(id));\n if let Some(p) = spt_store::info::read_pid(&psyche_perch) {\n kill_pid(p);\n }\n let _ = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"daemon\", \"stop\", \"--force\"])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(20))\n };\n if let Some((pid, _)) = cycled {\n kill_pid(pid);\n }\n kill_pid(brain_pid_before);\n let _ = broker.kill();\n let _ = broker.wait();\n\n // ── ASSERTIONS ──\n assert!(\n run.status.success(),\n \"endpoint start must succeed: {run_stderr}\"\n );\n assert!(\n online,\n \"PRECONDITION: the cc endpoint must bind ONLINE before the refresh.\\n\\\n {brain_stderr}\"\n );\n assert!(\n refresh.status.success(),\n \"REQ-DAEMON-REFRESH: `spt daemon refresh` must exit 0 against a live daemon \\\n (stdout: {refresh_stdout}; stderr: {refresh_stderr}).\\n\\\n {brain_stderr}\"\n );\n let (brain_pid_after, gen_after) = cycled.unwrap_or_else(|| {\n panic!(\n \"REQ-DAEMON-REFRESH: the brain must CYCLE (a new pid must stamp brain.ready) \\\n after refresh — pid stayed {brain_pid_before}.\\n{brain_stderr}\"\n )\n });\n assert_ne!(\n brain_pid_after, brain_pid_before,\n \"a fresh brain process must own the ready stamp\"\n );\n assert!(\n gen_after > gen_before,\n \"REQ-DAEMON-REFRESH: the brain GENERATION must advance across a refresh \\\n (before g{gen_before}, after g{gen_after}) — the supervisor cycle, not a re-stamp.\\n\\\n {brain_stderr}\"\n );\n assert!(\n broker_still_running,\n \"REQ-DAEMON-REFRESH: the broker process must survive the refresh untouched \\\n (pid {broker_pid}).\\n{brain_stderr}\"\n );\n assert!(\n harness_alive_after,\n \"REQ-DAEMON-REFRESH: the hosted harness session must STILL be ALIVE across the \\\n refresh — only the brain cycles, never the hosted PTYs. harness_pid={harness_pid:?}.\\n\\\n {brain_stderr}\"\n );\n assert!(\n still_online,\n \"REQ-DAEMON-REFRESH: the endpoint perch must remain ONLINE across the refresh \\\n (the session was never torn down).\\n{brain_stderr}\"\n );\n}"}],"details":{"totalLines":291,"displayContent":{"text":"//! THE-FORKENING W4 — `spt daemon refresh` on a LIVE daemon with a hosted\r\n//! endpoint (REQ-DAEMON-REFRESH): the brain generation cycles (new brain pid,\r\n//! generation bumped) with NO binary swap, while the broker process, the hosted\r\n//! harness session, and the endpoint's ONLINE perch all survive untouched — the\r\n//! apply_staged brain-cycle path minus the swap, driven through the REAL CLI\r\n//! verb. The recovery story: wedged brain-held state no longer needs a full\r\n//! daemon bounce that kills every PTY.\r\n//!\r\n//! Real `spt daemon run` broker + supervised brain + a REAL dummy-harness\r\n//! `[session.self]` session (the live_adapt_translation_swap_e2e rig, minus the\r\n//! translation child). Bounded everywhere; every spawned pid is reaped SCOPED\r\n//! at test end.\r\n//\r\n// [int->REQ-DAEMON-REFRESH]\r\n\r\nuse std::path::{Path, PathBuf};\r\nuse std::process::{Child, Command, Stdio};\r\nuse std::time::{Duration, Instant};\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nuse spt_store::perch::{self, ParentHint};\r\n\r\n/// Scoped pid-tree kill (cleanup) — never machine-wide.\r\nfn kill_pid(pid: u32) {\r\n #[cfg(windows)]\r\n let _ = Command::new(\"taskkill\")\r\n .no_window()\r\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\r\n .output();\r\n #[cfg(unix)]\r\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\r\n}\r\n\r\n/// `(pid, generation)` out of `brain.ready`; `None` until it parses.\r\nfn read_ready(path: &Path) -> Option<(u32, u64)> {\r\n let v: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()?;\r\n Some((\r\n v.get(\"pid\")?.as_u64()? as u32,\r\n v.get(\"generation\")?.as_u64()?,\r\n ))\r\n}\r\n\r\n/// Poll `brain.ready` until it holds a pid different from `was`, up to `budget`.\r\nfn wait_ready_not(path: &Path, was: Option, budget: Duration) -> Option<(u32, u64)> {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some((pid, generation)) = read_ready(path) {\r\n if was != Some(pid) {\r\n return Some((pid, generation));\r\n }\r\n }\r\n std::thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n\r\n\r\n#[test]\r\nfn daemon_refresh_cycles_brain_while_hosted_endpoint_survives() {\r\n let now_ms = || {\r\n std::time::SystemTime::now()\r\n .duration_since(std::time::UNIX_EPOCH)\r\n .map(|d| d.as_millis() as u64)\r\n .unwrap_or(0)\r\n };\r\n let _ = now_ms; // rig parity; the CLI verb needs no in-proc Brain here.\r\n\r\n // ── (1) Isolated, NET-LESS SPT_HOME. ──\r\n let home = tempfile::tempdir().unwrap();\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n let identity_dir = home.path().join(\"identity\");\r\n std::fs::create_dir_all(&identity_dir).unwrap();\r\n std::fs::write(identity_dir.join(\"node.key\"), \"not-a-valid-seed\").unwrap();\r\n\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let exe_suffix = spt_bin\r\n .extension()\r\n .map(|e| format!(\".{}\", e.to_string_lossy()))\r\n .unwrap_or_default();\r\n let mock_session = common::sibling_bin(\"mock-session\");\r\n assert!(\r\n mock_session.exists(),\r\n \"the dummy-harness program must be built: {}\",\r\n mock_session.display()\r\n );\r\n\r\n // ── (2) Register adapter `cc` with a long-lived dummy-harness session\r\n // (the live_adapt rig's manifest, minus the translation binary). ──\r\n let install_dir = perch::spt_home().join(\"srcs\").join(\"cc\");\r\n std::fs::create_dir_all(&install_dir).unwrap();\r\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\r\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\r\n let self_cmd = format!(\r\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\r\n --spt {spt_for_cmd} --mock-adapter cc --type live_agent --heartbeat-ms 200\"\r\n );\r\n let psyche_bin = install_dir.join(format!(\"psychebin{exe_suffix}\"));\r\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\r\n let drops = home.path().join(\"drops\");\r\n std::fs::create_dir_all(&drops).unwrap();\r\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\r\n let manifest_toml = format!(\r\n \"[adapter]\\nname=\\\"cc\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\r\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\r\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\r\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\r\n );\r\n std::fs::write(install_dir.join(\"manifest.toml\"), &manifest_toml).unwrap();\r\n spt_runtime::registry::register(&perch::adapters_dir(), &install_dir, 1000).unwrap();\r\n\r\n // ── (3) The REAL daemon broker process. ──\r\n let brain_log = home.path().join(\"brain.stderr.log\");\r\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\r\n let mut broker: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"daemon\", \"run\"])\r\n .env(\"SPT_HOME\", home.path())\r\n // Rig daemon: the advisory well-known ports belong to this box's resident\r\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\r\n .env(\r\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\r\n \"1\",\r\n )\r\n .stdout(Stdio::null())\r\n .stderr(Stdio::from(brain_log_file))\r\n .spawn()\r\n .expect(\"spawn spt daemon run (broker process)\");\r\n let ready_path = home.path().join(\"brain.ready\");\r\n let (brain_pid_before, gen_before) =\r\n match wait_ready_not(&ready_path, None, Duration::from_secs(30)) {\r\n Some(r) => r,\r\n None => {\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n panic!(\r\n \"PRECONDITION: brain never came up.\\n{}\",\r\n common::daemon_stderr_panel(&brain_log)\r\n );\r\n }\r\n };\r\n let broker_pid = broker.id();\r\n\r\n // ── (4) Host a real endpoint: `endpoint create ccX --adapter cc + endpoint start ccX`,\r\n // wait for its perch ONLINE. ──\r\n let id = \"ccX\";\r\n // U3: the mint and the first session are separate verbs.\r\n common::create_endpoint(&spt_bin, home.path(), id, \"cc\");\r\n let run = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"endpoint\", \"start\", id])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(45))\r\n };\r\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\r\n let harness_pid: Option = run_stderr\r\n .split(\"pid=\")\r\n .nth(1)\r\n .and_then(|s| s.split_whitespace().next())\r\n .and_then(|s| s.trim().parse().ok());\r\n\r\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\r\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\r\n let mut online = false;\r\n let deadline = Instant::now() + Duration::from_secs(25);\r\n while Instant::now() < deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n // ── (5) THE VERB: `spt daemon refresh` — the production CLI path. ──\r\n let refresh = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"daemon\", \"refresh\"])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(30))\r\n };\r\n let refresh_stdout = String::from_utf8_lossy(&refresh.stdout).to_string();\r\n let refresh_stderr = String::from_utf8_lossy(&refresh.stderr).to_string();\r\n\r\n // ── (6) The brain must CYCLE: a new pid stamps brain.ready with a bumped\r\n // generation (no binary swapped anywhere). ──\r\n let cycled = wait_ready_not(&ready_path, Some(brain_pid_before), Duration::from_secs(30));\r\n\r\n // The broker process must be the SAME OS process (never restarted).\r\n let broker_still_running = broker.try_wait().map(|st| st.is_none()).unwrap_or(false);\r\n\r\n // The hosted endpoint survives: harness alive + perch back/still ONLINE.\r\n let harness_alive_after = harness_pid\r\n .map(spt_store::proc::is_process_alive)\r\n .unwrap_or(false);\r\n let mut still_online = false;\r\n let online_deadline = Instant::now() + Duration::from_secs(10);\r\n while Instant::now() < online_deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n still_online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n let brain_stderr = common::daemon_stderr_panel(&brain_log);\r\n eprintln!(\r\n \"=== W4 daemon refresh: run_ok={} online={online} harness_pid={harness_pid:?} \\\r\n refresh_ok={} brain_before={brain_pid_before}/g{gen_before} cycled={cycled:?} \\\r\n broker_alive={broker_still_running} harness_alive_after={harness_alive_after} \\\r\n still_online={still_online} ===\\n--- refresh stdout ---\\n{refresh_stdout}\\n\\\r\n --- refresh stderr ---\\n{refresh_stderr}\\n=== endpoint start stderr ===\\n{run_stderr}\\n\\\r\n {brain_stderr}\",\r\n run.status.success(),\r\n refresh.status.success(),\r\n );\r\n\r\n // ── (7) Reap the ENTIRE tree SCOPED before asserting. ──\r\n if let Some(p) = harness_pid {\r\n kill_pid(p);\r\n }\r\n let psyche_perch = perch::resolve_perch_path(&format!(\"{id}-psyche\"), ParentHint::Explicit(id));\r\n if let Some(p) = spt_store::info::read_pid(&psyche_perch) {\r\n kill_pid(p);\r\n }\r\n let _ = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"daemon\", \"stop\", \"--force\"])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(20))\r\n };\r\n if let Some((pid, _)) = cycled {\r\n kill_pid(pid);\r\n }\r\n kill_pid(brain_pid_before);\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n\r\n // ── ASSERTIONS ──\r\n assert!(\r\n run.status.success(),\r\n \"endpoint start must succeed: {run_stderr}\"\r\n );\r\n assert!(\r\n online,\r\n \"PRECONDITION: the cc endpoint must bind ONLINE before the refresh.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n refresh.status.success(),\r\n \"REQ-DAEMON-REFRESH: `spt daemon refresh` must exit 0 against a live daemon \\\r\n (stdout: {refresh_stdout}; stderr: {refresh_stderr}).\\n\\\r\n {brain_stderr}\"\r\n );\r\n let (brain_pid_after, gen_after) = cycled.unwrap_or_else(|| {\r\n panic!(\r\n \"REQ-DAEMON-REFRESH: the brain must CYCLE (a new pid must stamp brain.ready) \\\r\n after refresh — pid stayed {brain_pid_before}.\\n{brain_stderr}\"\r\n )\r\n });\r\n assert_ne!(\r\n brain_pid_after, brain_pid_before,\r\n \"a fresh brain process must own the ready stamp\"\r\n );\r\n assert!(\r\n gen_after > gen_before,\r\n \"REQ-DAEMON-REFRESH: the brain GENERATION must advance across a refresh \\\r\n (before g{gen_before}, after g{gen_after}) — the supervisor cycle, not a re-stamp.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n broker_still_running,\r\n \"REQ-DAEMON-REFRESH: the broker process must survive the refresh untouched \\\r\n (pid {broker_pid}).\\n{brain_stderr}\"\r\n );\r\n assert!(\r\n harness_alive_after,\r\n \"REQ-DAEMON-REFRESH: the hosted harness session must STILL be ALIVE across the \\\r\n refresh — only the brain cycles, never the hosted PTYs. harness_pid={harness_pid:?}.\\n\\\r\n {brain_stderr}\"\r\n );\r\n assert!(\r\n still_online,\r\n \"REQ-DAEMON-REFRESH: the endpoint perch must remain ONLINE across the refresh \\\r\n (the session was never torn down).\\n{brain_stderr}\"\r\n );\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291]},"fileSize":12084,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt\\tests\\daemon_refresh_e2e.rs"}}},"isError":false,"timestamp":1789113814649}}
{"type":"message","id":"6b0db40f","parentId":"c3f5f835","timestamp":"2026-09-11T08:03:34.662Z","message":{"role":"toolResult","toolCallId":"call_AjvGy94YKd9gH7ArF51E6Boa|fc_07a38c9435caeae6016aa3b5d4326087d29957ca2af1469ae4","toolName":"grep","content":[{"type":"text","text":" 264| /// Which claim this is. A holder that was taken over as wedged may still\n*265| /// complete later and drop its guard; the generation is what stops that late\n 266| /// drop from releasing the claim that REPLACED it, which would re-open the\n 267| /// double-create window one wake later.\n*268| generation: u64,\n 269| /// The last spawn phase this holder stamped, and when.\n 270| phase: String,\n 271| phase_at: Instant,\n...\n 279|///\n*280|/// It releases ONLY ITS OWN GENERATION — see [`release_claim`].\n 281|struct WakeClaimGuard<'a> {\n 282| map: &'a Mutex>,\n 283| endpoint: String,\n*284| generation: u64,\n 285|}\n 286|\n 287|impl Drop for WakeClaimGuard<'_> {\n 288| fn drop(&mut self) {\n*289| release_claim(&mut recover(self.map), &self.endpoint, self.generation);\n 290| }\n 291|}\n 292|\n*293|/// Release a claim only if the entry still belongs to `generation`.\n 294|///\n 295|/// THE CASE THIS EXISTS FOR: a wedged holder is taken over, the new claimant\n*296|/// holds generation N+1, and the old holder finally completes and drops. A\n*297|/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298|/// is still in flight, so the next duplicate wake sails through the gate —\n 299|/// re-opening, one wake later, exactly the double-create this guard exists to\n 300|/// close. Pure over the map so the no-op is a unit.\n*301|fn release_claim(map: &mut HashMap, endpoint: &str, generation: u64) {\n*302| if map.get(endpoint).is_some_and(|c| c.generation == generation) {\n 303| map.remove(endpoint);\n 304| }\n 305|}\n...\n 528|// [impl->REQ-INPUT-CONTROLLER-FENCE]\n*529|fn rc_input_rejected(minter: Option, sender_is_controller: bool) -> bool {\n 530| minter == Some(Minter::Rc) && !sender_is_controller\n 531|}\n 532|\n...\n 583|/// The coordinator-image announce gate (F-025 amendment): accept ONLY an announce\n*584|/// whose generation is exactly the brain child this process currently supervises.\n 585|/// `supervised = None` (no brain spawned by this process) accepts nothing.\n 586|///\n 587|/// Pure so the discriminator is unit-testable without a live brain — it is the\n...\n 598|/// The coordinator-image read gate (F-025 amendment): a recorded\n*599|/// `(generation, version)` answers only while its generation is STILL the\n 600|/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601|/// reported — rather than the version of a process that no longer exists, so the\n 602|/// surface never outlives the process it describes (the stale-record class that\n...\n 609| record\n*610| .filter(|(generation, _)| supervised == Some(*generation))\n 611| .map(|(_, version)| version.clone())\n 612|}\n 613|\n...\n 834| send: SharedSend,\n*835| /// The controller's ATTACH GENERATION (ADR-0038 Amendment fix 6,\n*836| /// REQ-SERVE-OWNERSHIP-GENERATION): operator-minted wall-ms from the wire\n 837| /// Request (`0` = local / N-1). A same-identity re-take with an OLDER\n*838| /// generation is a replayed stale Request — refused; a stale worker's\n*839| /// late detach (older generation) never clears a newer controller.\n 840| attach_gen: u64,\n 841| /// The `from_seq` this seat was ESTABLISHED with — the fourth element of the\n 842| /// idempotent-replay key (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY).\n*843| /// A same-conn/same-gen subscribe carrying the SAME `from_seq` is a replay of\n 844| /// the establish already honored (the dispatcher's double-serve); one carrying\n 845| /// a DIFFERENT `from_seq` is the controller GAP RESUME re-fetching dropped\n 846| /// frames from its frozen floor (REQ-HAZARD-CONTROLLER-GAP-RESUME), which must\n...\n 871| /// The writer's IN-FLIGHT socket-write marker (LIFECYCLE-TRUTH W2,\n*872| /// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): the `controller_writer` sets it to\n 873| /// `Some(Instant::now())` immediately BEFORE it enters a blocking `write_frame`\n 874| /// and back to `None` the instant the write returns. A reader\n 875| /// ([`OutputLog::controller_stalled`]) sees a `Some` older than\n...\n 1017| controller: Option,\n*1018| /// Monotonic controller generation, shared with the live `controller_writer`\n 1019| /// thread (`Arc`). Bumped on every [`become_controller`]; the\n 1020| /// drain's deadline-evict ([`mark_controller_gone`]) carries the epoch it\n 1021| /// observed and only detaches if it still matches — so a slow-controller\n...\n 1144|/// Per-endpoint stamp-transition serial (ADR-0041 decision 4,\n*1145|/// REQ-CONTROL-STAMP-CONVERGENCE): the generation counter a definitive\n 1146|/// no-session truth (the exit-waiter reap) BUMPS, and a poll-derived stamp\n 1147|/// write VALIDATES against — so a `KIND_SESSIONS` snapshot taken PRE-reap can\n 1148|/// never relatch `controlled=true` after the reap cleared it (the session is\n...\n 1182|///\n*1183|/// `snap_gen` is the endpoint's stamp generation AT SNAPSHOT time (ADR-0041\n 1184|/// decision 4): the write is refused — loud, nothing written — when the\n*1185|/// generation has advanced since (an exit-waiter reap landed between our\n 1186|/// under-lock snapshot and this off-lock write; the snapshot is stale truth\n 1187|/// about a session that no longer exists). Validation + write run under the\n 1188|/// endpoint's stamp-write serial so the reap can never interleave the pair.\n...\n 1223| if control || viewer {\n*1224| // The two IN-MEMORY reap paths (`reap_dead_controller`, the stall-evict)\n 1225| // deliberately do not stamp under the log lock, so their attachment edge\n 1226| // becomes true HERE and nowhere else — signal it, or a controller that\n 1227| // died with its conn would leave a stale attachment frame standing until\n...\n 1235| // The THIRD engine-room drop edge (ADR-0052 §3a). The two in-memory\n*1236| // reap paths (`reap_dead_controller`, the stall-evict) deliberately do\n 1237| // NOT stamp under the log lock, so they never reach `clear_controller`;\n 1238| // this off-lock converge is where their release becomes true. Keying on\n 1239| // the recorded truth going FALSE means a controller that died with the\n...\n 1454| /// b4 (REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE): W1 moved the\n*1455| /// controller SOCKET WRITE off the drain (the `controller_writer` thread) but\n 1456| /// left the HANDOFF as an inline sleep-poll (`ControllerJob::deliver`, up to\n 1457| /// `CONTROLLER_WRITE_DEADLINE`) ON the drain — so a controller draining slower\n 1458| /// than the PTY floods filled its channel, the inline poll throttled the drain,\n...\n 1601| /// or `None` when undriven. The `by`-keyed ownership logic in\n*1602| /// [`resolve_subscribe`] reads this.\n 1603| fn controller_by(&self) -> Option<&str> {\n 1604| self.controller.as_ref().and_then(|c| c.by.as_deref())\n 1605| }\n...\n 1756| // `Unredeemed` and returned a REFUSAL that unseated the human mid-session\n*1757| // (measured on golden 32341702157, Linux leg: seat, same-conn re-serve\n 1758| // ~700ms later with `req_gen` unchanged, `engine-room-admit-unredeemed`,\n 1759| // `session-detach was_controller=true`).\n 1760| //\n 1761| // THE ORDER SWAP IS NOT A WIDENING, and the reason is the same one this\n*1762| // module already gives for why an attach GENERATION cannot be the\n*1763| // discriminator: a generation is a wall-ms number an agent on this box\n 1764| // can guess, while a broker CONNECTION id belongs to another process's\n 1765| // socket and cannot be claimed by asking (see\n 1766| // [`spt_store::engineroom::bringup_required`]). So the only attach this\n...\n 2593| // Drop the prior controller sink first (its writer's live loop ends when\n*2594| // tx drops), and bump the generation so (a) an in-flight deadline-evict\n 2595| // for the old controller can't unseat this one and (b) a prior writer\n 2596| // still flushing its initial batch returns before its next frame.\n 2597| // Attribution (F-039 legs b+d): the replaced conn's record names its\n...\n 2662| let writer = thread::spawn(move || {\n*2663| controller_writer(\n 2664| sid,\n 2665| writer_send,\n 2666| initial,\n...\n 2691| // The seat changed hands (or was filled): the incoming controller does\n*2692| // not inherit the outgoing one's authority. An equal-generation re-serve\n 2693| // is the SAME lease and keeps it.\n 2694| self.on_control_edge(prev_gen, Some(attach_gen));\n 2695| }\n...\n 2760| // [impl->REQ-CONTROLLER-LIVENESS-REAP]\n*2761| fn reap_dead_controller(&mut self) -> bool {\n 2762| let dead = self\n 2763| .controller\n 2764| .as_ref()\n...\n 2782| /// timed out its `send_timeout`. Detach it — but ONLY if it is still the same\n*2783| /// controller generation the drain saw (`epoch`), so a NEWER controller that\n 2784| /// attached during the stall is never unseated.\n 2785| fn mark_controller_gone(&mut self, epoch: u64) {\n 2786| if self.controller_epoch.load(Ordering::Acquire) == epoch {\n...\n 2807| /// Whether this session's controller is the brain's OWN LOCAL conn (`by: None`)\n*2808| /// AND wedged past `deadline` — the brain-generation promotion DRAINED gate reads\n*2809| /// it (REQ-UPDATE-PROMOTE-DRAINED). A killed OLD brain generation whose local\n 2810| /// controller conn is black-holed reads wedged here until the W2 stall-evict\n 2811| /// releases it (or the conn EOFs); a cleanly-closed conn is simply absent. A\n 2812| /// REMOTE operator's wedged conn (`by: Some`) is the W2 stall-evict concern, NOT\n...\n 2932| /// Production always goes through\n*2933| /// [`resolve_subscribe_gated`](Self::resolve_subscribe_gated) — the broker\n 2934| /// asks what the presented secret is on every subscribe, and the usual\n 2935| /// answer is \"not a ticket\". This wrapper exists so the exemption is\n 2936| /// something a caller must ASK for rather than something it can forget to\n...\n 2939| #[cfg(test)]\n*2940| fn resolve_subscribe(\n 2941| &mut self,\n 2942| sub: SharedSend,\n 2943| from_seq: u64,\n...\n 2948| ) -> SubscribeOutcome {\n*2949| self.resolve_subscribe_gated(sub, from_seq, intent, by, gen, code, AdmitTicket::None, false)\n 2950| .0\n 2951| }\n 2952|\n*2953| /// [`resolve_subscribe`](Self::resolve_subscribe) carrying the broker's\n 2954| /// verdict on a bring-up admit ticket presented for this exact session.\n 2955| // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n 2956| #[allow(clippy::too_many_arguments)]\n*2957| fn resolve_subscribe_gated(\n 2958| &mut self,\n 2959| sub: SharedSend,\n 2960| from_seq: u64,\n...\n 2968| // OBS RIDER leg 1 (ALWAYS-ON pin): one structured breadcrumb per subscribe\n*2969| // decision — ids/generations only, never PTY bytes. Rides the daemon stderr\n 2970| // sink (F-039 shape) → daemon.stderr.log. The incumbent snapshot is captured\n 2971| // BEFORE the decision runs (become_controller overwrites the controller slot\n 2972| // inside the inner call); a supersession is derivable downstream as\n...\n 2989| let mut seat_cred = None;\n*2990| let (outcome, decision) = self.resolve_subscribe_inner_gated(\n 2991| sub,\n 2992| from_seq,\n 2993| intent,\n...\n 3030| /// The W2.5 subscribe decision kernel — wrapped by\n*3031| /// [`OutputLog::resolve_subscribe`], which emits the always-on decision\n 3032| /// breadcrumb around it. See that wrapper for the field/observability contract.\n 3033| ///\n 3034| /// Returns the wire [`SubscribeOutcome`] AND the breadcrumb decision label;\n...\n 3037| /// The no-admit spelling of the inner kernel (see\n*3038| /// [`resolve_subscribe`](Self::resolve_subscribe) for why it stays).\n 3039| #[cfg(test)]\n*3040| fn resolve_subscribe_inner(\n 3041| &mut self,\n 3042| sub: SharedSend,\n 3043| from_seq: u64,\n...\n 3048| ) -> (SubscribeOutcome, &'static str) {\n*3049| self.resolve_subscribe_inner_gated(\n 3050| sub,\n 3051| from_seq,\n 3052| intent,\n...\n 3060|\n*3061| /// [`resolve_subscribe_inner`](Self::resolve_subscribe_inner) with the\n 3062| /// admit-ticket verdict carried through to the seat gate.\n 3063| ///\n 3064| /// `seat_cred` is an OUT-PARAM, deliberately, and it is the only thing about\n...\n 3072| #[allow(clippy::too_many_arguments)]\n*3073| fn resolve_subscribe_inner_gated(\n 3074| &mut self,\n 3075| sub: SharedSend,\n 3076| from_seq: u64,\n...\n 3124| if same_identity {\n*3125| // The GENERATION LADDER over the (by, nonzero attach_gen) LOGICAL\n 3126| // LEASE (ADR-0044 decision 1 + the 2026-07-18 ladder ruling over\n*3127| // the ADR-0038 fix-6 generation): node identity alone is NEVER a\n 3128| // lease — two same-node viewports are DISTINCT controllers,\n*3129| // discriminated by their generations; within one identity the\n*3130| // generation stays the LIFECYCLE discriminator.\n 3131| // gen == incumbent (nonzero) → the SAME lease re-served after a\n 3132| // dispatcher restart — the fix-6 successor, silent (gate #7).\n 3133| // gen < incumbent (nonzero) → a REPLAYED stale Request (an\n...\n 3145| // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n*3146| // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3147| let incumbent_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n 3148| let incumbent_conn = self.controller.as_ref().map(|c| c.send.id());\n*3149| // IDEMPOTENT REPLAY — the new leaf INSIDE the equal-generation rung\n 3150| // (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY). Same identity,\n*3151| // same NONZERO generation, and the SAME CONNECTION as the incumbent\n 3152| // seat means this is a replay of the establish we already honored, not\n 3153| // a successor: the seat and its writer are PRESERVED, no\n 3154| // `controller-replaced` fires, and no second initial batch is\n...\n 3160| // prior seat. Designed for a DEAD seat after a dispatcher restart, it\n*3161| // fired against the same LIVE conn: the lease killed its own writer\n 3162| // (channel-closed) and the rc viewport froze until a manual\n 3163| // detach + re-attach. \"spt update freezes every attached PTY.\"\n 3164| //\n*3165| // Equal generation on a DIFFERENT conn keeps today's silent swap — that\n 3166| // is the designed ADR-0038 fix-6 successor (the old seat is dead and the\n 3167| // lease is being re-served on a fresh carrier), and it must not regress.\n 3168| // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n...\n 3170| // The key includes `from_seq` because core itself re-subscribes on the\n*3171| // SAME conn with the SAME generation for a legitimate reason: the\n 3172| // controller GAP RESUME (REQ-HAZARD-CONTROLLER-GAP-RESUME,\n 3173| // `read_controller_event_resuming`) re-fetches dropped frames from its\n 3174| // frozen `delivered_through` floor. That request is NOT a replay of the\n...\n 3188| // Same lease (or legacy) that is NOT a replay of the establish:\n*3189| // a different conn (the fix-6 successor) or the SAME conn asking\n 3190| // from a different floor (the gap-resume re-fetch above). Silent\n 3191| // re-take either way, NEVER Displaced.\n 3192| self.become_controller(sub, by, from_seq, gen);\n...\n 3498| /// `driven_by` / `viewer_count` when a role actually changed.\n*3499| /// Generation-validated detach (ADR-0038 Amendment fix 6): `Some(g)` with\n*3500| /// a controller whose generation differs = a STALE worker's late release —\n 3501| /// the controller slot is left alone (viewer rows still clean up by ptr).\n 3502| /// `None` (N-1 / conn-cleanup) = today's ptr-identity behavior.\n*3503| // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3504| fn detach_if_gen(&mut self, sub: &SharedSend, gen: Option) {\n 3505| if let (Some(g), Some(c)) = (gen, self.controller.as_ref()) {\n 3506| if c.attach_gen != g {\n*3507| // Stale generation: never clears the (newer) controller.\n 3508| let before = self.viewers.len();\n 3509| self.viewers.retain(|_, sink| !Arc::ptr_eq(&sink.send, sub));\n 3510| if self.viewers.len() != before {\n...\n 3563| /// `driven_by` remote-only. The client's own-node vs remote guidance display\n*3564| /// (`rc.rs` `driver_phrase`) reads this verbatim stamp; the W2 generation\n 3565| /// ladder governs same-identity viewports at the broker, below that gate.\n 3566| // [impl->REQ-RCVIEW-1] [impl->REQ-REACH-1]\n 3567| fn stamp_driven_by(&self) {\n...\n 3647| // ADR-0041 decision 4: a reap is a DEFINITIVE no-session truth — bump\n*3648| // the endpoint's stamp generation UNDER the stamp-write serial, then\n 3649| // clear. A KIND_SESSIONS poll that snapshotted this session PRE-reap now\n*3650| // fails its generation check and can never relatch `controlled=true`\n 3651| // onto the perch of a session that no longer exists (the emphasys C3\n 3652| // poll-vs-reap window: no later poll would ever heal the latch).\n 3653| let slot = stamp_slot(&self.endpoint);\n...\n 3909|#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\n*3910|fn controller_writer(\n 3911| sid: u64,\n 3912| send: SharedSend,\n 3913| initial: Vec<(u64, Vec)>,\n...\n 4179|/// is the invariant, not its exact value.\n*4180|fn input_queue_depth() -> usize {\n 4181| match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\n 4182| Ok(n) => n\n 4183| .parse::()\n...\n 4217| /// whose PTY write handle this thread now exclusively owns.\n*4218| fn spawn(session: Arc, endpoint: String) -> Arc {\n 4219| let (tx, rx) = sync_channel::(input_queue_depth());\n 4220| let writer = thread::spawn(move || input_writer(session, rx));\n 4221| Arc::new(InputWriter {\n...\n 4234| // [impl->REQ-HAZARD-PTY-INPUT-WRITER-WEDGE]\n*4235| fn enqueue(&self, bytes: InputRecord) -> bool {\n 4236| match self.tx.try_send(bytes) {\n 4237| Ok(()) => {\n 4238| // Heal: input is flowing again — clear a prior backpressure stamp.\n...\n 4273|/// when the last `tx` clone drops at session teardown.\n*4274|fn input_writer(session: Arc, rx: Receiver) {\n 4275| while let Ok(bytes) = rx.recv() {\n 4276| let _ = session.write_input(&bytes);\n 4277| }\n...\n 4587|\n*4588|fn flush_inject_floor(floor: &Mutex, input: &InputWriter) {\n 4589| loop {\n 4590| let chunk = lock_floor(floor).take_or_release();\n 4591| match chunk {\n...\n 4756|// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n*4757|fn settle_before_inject(input: &InputWriter, log: &Mutex, endpoint: &str) -> bool {\n 4758| let baseline = recover_log(log).high_water();\n 4759| let deadline = Instant::now() + inject_settle_deadline();\n 4760| loop {\n...\n 4842|// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n*4843|fn enqueue_text_chunked(input: &InputWriter, bytes: Vec) {\n 4844| chunk_text(&bytes, inject_text_chunk(), |part| {\n 4845| input.enqueue(part.to_vec());\n 4846| });\n...\n 5291| wake_inflight: Mutex>,\n*5292| /// Monotonic claim generation (#235). Handed to each claim so a taken-over\n 5293| /// holder's late RAII drop cannot release its successor's claim.\n*5294| wake_generation: AtomicU64,\n 5295| /// Live per-connection handler-thread tally: incremented on [`handle_conn`]\n 5296| /// entry, decremented (RAII, panic-safe) when the handler returns. The\n 5297| /// UPDATE-WEDGE round-4 int gate's observability seam\n...\n 5302| /// The COORDINATOR image the supervised brain announced, as\n*5303| /// `(generation, version)` (F-025 amendment, FIELD-TRUTH W1). Recorded only\n*5304| /// when the announced generation matches the child the supervisor currently\n 5305| /// runs, and answered only while it STILL matches — so a record from a\n*5306| /// replaced generation stops being reported the instant its successor is\n 5307| /// spawned, without needing a clearing signal from the dying brain.\n 5308| /// In-memory by design: the running image is a property of a live process,\n 5309| /// and a durable copy would be exactly the outlives-its-process staleness\n...\n 5596| wake_inflight: Mutex::new(HashMap::new()),\n*5597| wake_generation: AtomicU64::new(0),\n 5598| conn_handlers: AtomicUsize::new(0),\n 5599| coordinator_image: Mutex::new(None),\n 5600| bringup_admits: Mutex::new(HashMap::new()),\n...\n 5910| /// trip) promotes a ready update candidate only once this reads `false`: an OLD\n*5911| /// generation whose local controller conn is black-holed reads wedged until the W2\n 5912| /// stall-evict releases it, so `brain.ready` inside the 15 s window can no longer\n 5913| /// promote onto a still-frozen control plane (the 22:47 false-promote). A cleanly-\n 5914| /// closed old conn is simply absent → `false` at once (the normal fast promote).\n...\n 6214| viewers: u32,\n*6215| // The endpoint's stamp generation AT snapshot time\n 6216| // (ADR-0041 decision 4) — the off-lock converge below\n 6217| // validates against it so a reap that lands between\n 6218| // this snapshot and the write refuses the stale stamp.\n...\n 6234| // cleared state and the stale info.json stamp clears.\n*6235| let _ = log.reap_dead_controller();\n 6236| let stamp_gen =\n 6237| stamp_slot(&endpoint).gen.load(Ordering::Acquire);\n 6238| SessSnap {\n...\n 6357| // remote target's read pump sees EOF, `serve_attach` runs\n*6358| // `detach_session` under its own serve generation (fix-6 validated:\n 6359| // a stale opener's late close can never evict a newer controller),\n 6360| // and the controller/viewer stamps clear — then terminal-retire the\n 6361| // local row (eligibility + physical teardown, the W1 machinery).\n...\n 8017| );\n*8018| if let Some(generation) = claim_gen.get() {\n 8019| let mut inflight = recover(&self.wake_inflight);\n 8020| if let Some(claim) = inflight.get_mut(&spawn_label) {\n*8021| // Only OUR generation: a holder taken over as wedged must not\n 8022| // keep refreshing the successor's claim from behind.\n*8023| if claim.generation == generation {\n 8024| claim.phase = phase.to_string();\n 8025| claim.phase_at = Instant::now();\n 8026| }\n...\n 8101| req.endpoint,\n*8102| prev.generation,\n 8103| prev.phase,\n 8104| prev.phase_at.elapsed().as_millis(),\n 8105| phase_wedge_ceiling(&prev.phase).as_millis(),\n...\n 8107| }\n*8108| let generation =\n*8109| self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\n 8110| inflight.insert(\n 8111| req.endpoint.clone(),\n 8112| WakeClaim {\n*8113| generation,\n 8114| phase: \"gate_claimed\".to_string(),\n 8115| phase_at: Instant::now(),\n 8116| },\n 8117| );\n*8118| claim_gen.set(Some(generation));\n 8119| Gate::Claimed(WakeClaimGuard {\n 8120| map: &self.wake_inflight,\n 8121| endpoint: req.endpoint.clone(),\n*8122| generation,\n 8123| })\n 8124| }\n 8125| }\n...\n 8453| // this session at all. Clearing before removal left a window where\n*8454| // a poll snapshotted AFTER the generation bump — same generation,\n 8455| // controller slot still occupied in the log — and legitimately\n 8456| // re-wrote `controlled=true` onto the perch of a session that was\n 8457| // about to vanish (the relatch the W2 int leg caught live). The\n...\n 8565| // outlive the session in info.json (or gossip a stale controller).\n*8566| // Bumps the stamp generation under the per-endpoint write serial,\n 8567| // so any snapshot taken BEFORE the removal is refused at write time.\n 8568| // [impl->REQ-HAZARD-CONTROL-STAMP-LIFETIME]\n 8569| // [impl->REQ-CONTROL-STAMP-CONVERGENCE]\n...\n 8686| let ticket = self.redeem_bringup_admit(req.code.as_deref(), req.session_id);\n*8687| let (outcome, seat_note) = recover_log(&log).resolve_subscribe_gated(\n 8688| Arc::clone(send),\n 8689| req.from_seq,\n 8690| req.intent,\n...\n 8745| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*8746| fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8747| let req: InputReq =\n 8748| serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n 8749| let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n...\n 8763| // an rc-tagged input must come from the ACTIVE controller lease's\n*8764| // originating conn — the same conn-identity gate resize has always had\n 8765| // — so a displaced viewport can never keep typing into the PTY, no\n 8766| // matter whether its Displaced notice was delivered, delayed, or lost.\n 8767| // SCOPED to `Minter::Rc`: shell/system injection (`Minter::Shell`,\n...\n 8825| // operator/rc path sends `ack=false`: writing the ack back onto the\n*8826| // same brain↔broker conn it is flooding with input fills the return\n 8827| // direction and deadlocks the per-conn handler (the wedge). With no\n 8828| // ack the handler never writes back while servicing the flood, so it\n 8829| // always drains. The acked path (`shellchan`, one-at-a-time) still\n...\n 8934| // [impl->REQ-MSG-IDLE-TRANSLATION-BINARY]\n*8935| fn dispatch_endpoint_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8936| let req: EndpointInputReq = serde_json::from_value(env.payload)\n 8937| .map_err(|e| format!(\"bad endpoint-input payload: {e}\"))?;\n 8938| let bytes =\n...\n 9151| /// Record the COORDINATOR (brain) image self-announce (F-025 amendment), but\n*9152| /// ONLY when the announced generation is the one this process's supervisor\n 9153| /// currently runs — the discriminator the connection role cannot provide:\n 9154| /// `recv_hello(.., Role::Brain)` admits every client, the CLI's own\n 9155| /// `Brain::cold_start` included, and that client is ALWAYS freshly installed,\n...\n 9157| /// coordinator's on precisely the node whose coordinator is stale. Only the\n*9158| /// supervised child is handed a generation (on its argv, ADR-0018 V2), so\n*9159| /// only it can satisfy this — the same exact-generation discipline the D6-2\n 9160| /// readiness gate uses against a stale ready stamp.\n 9161| ///\n 9162| /// Returns the verdict to the announcer rather than staying silent so an\n...\n 9165| fn dispatch_coordinator_image_announce(&self, env: Envelope, send: &SharedSend) {\n*9166| let supervised = crate::brainproc::supervised_generation();\n 9167| let accepted = match serde_json::from_value::(env.payload) {\n*9168| Ok(a) if coordinator_announce_accepted(a.generation, supervised) => {\n 9169| *self.coordinator_image.lock().expect(\"coordinator image lock\") =\n*9170| Some((a.generation, a.version));\n 9171| true\n 9172| }\n 9173| _ => false,\n...\n 9184| /// of [`dispatch_broker_image`](Self::dispatch_broker_image) for the half that\n*9185| /// restarts on an apply. The record answers only while its generation is\n 9186| /// still the supervised one; a record left by a replaced brain reports\n 9187| /// `None` (not reported) rather than the version of a process that is gone.\n 9188| // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n...\n 9194| .as_ref(),\n*9195| crate::brainproc::supervised_generation(),\n 9196| );\n 9197| let frame = Envelope::new(\n 9198| KIND_COORDINATOR_IMAGE_REPLY,\n...\n 9692| /// the dispatcher reports a serve loop that ran to completion, and the row\n*9693| /// leaves the table so no future dispatcher generation can rediscover and\n 9694| /// replay it (the KNOWN-HAZARDS 7.41 control-steal class).\n 9695| // [impl->REQ-REDISPATCH-FINISHED-RETIRE]\n 9696| fn dispatch_net_stream_retire(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n...\n 9792| /// on the caller's attached session, so teardown never claims the\n*9793| /// controller slot and never bumps the ADR-0044 lease generation — a\n 9794| /// teardown is not a control theft.\n 9795| /// 2. **Reaps the whole DESCENDANT subtree**, not just the PTY child. The\n 9796| /// hosted tree is adapter → node → harness → nested harness + MCP\n...\n 10109| // every client hellos as `Role::Brain`, the CLI's own `Brain::cold_start`\n*10110| // included — so the generation the supervisor handed the child is the gate,\n 10111| // and a client that holds none can never pass it.\n 10112| #[test]\n*10113| fn only_the_supervised_generation_can_claim_the_coordinator_image() {\n*10114| // The supervised child's own generation is the ONLY accepted announce.\n 10115| assert!(coordinator_announce_accepted(7, Some(7)));\n*10116| // A client with no generation (the serde default 0) against a live\n 10117| // supervisor at 7 — the CLI's shape — is refused.\n 10118| assert!(!coordinator_announce_accepted(0, Some(7)));\n*10119| // ...and is refused at generation 0 too when NOTHING is supervised, so a\n 10120| // brokerless/supervisorless process cannot be talked into a coordinator.\n 10121| assert!(!coordinator_announce_accepted(0, None));\n*10122| // A brain the supervisor has already replaced (older generation) refused.\n 10123| assert!(!coordinator_announce_accepted(6, Some(7)));\n 10124|\n*10125| // The read gate: a record answers only while its generation is current.\n 10126| let record = (7u64, \"0.20.0\".to_string());\n 10127| assert_eq!(\n 10128| recorded_coordinator_image(Some(&record), Some(7)).as_deref(),\n...\n 10134| None,\n*10135| \"a superseded generation's image is NOT reported — the record must not \\\n 10136| outlive the process it describes\"\n 10137| );\n 10138| assert_eq!(\n...\n 10386| // from a PRE-reap sessions snapshot is REFUSED once a newer no-session truth\n*10387| // (the reap's generation bump) has landed — the stale poll can never relatch\n 10388| // `controlled=true` onto a perch whose session died. A snapshot taken at the\n*10389| // CURRENT generation still applies (the legitimate late-bind convergence).\n 10390| #[test]\n*10391| fn stale_snapshot_stamp_write_refused_after_reap_generation_bump() {\n 10392| crate::test_home::with_home(|_| {\n 10393| let id = \"relatch\";\n 10394| let perch = resolve_perch_path(id, ParentHint::Infer);\n...\n 10399|\n*10400| // A poll snapshots at the current generation…\n 10401| let snap_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10402| // …then the exit-waiter reap lands first: bump + clear (what\n 10403| // stamp_reaped does).\n...\n 10415| !converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, snap_gen),\n*10416| \"a pre-reap snapshot must be refused after the generation bump\"\n 10417| );\n 10418| let after = spt_store::info::read_info(&perch).unwrap();\n 10419| assert!(!after.controlled, \"controlled stays cleared (no relatch)\");\n...\n 10422|\n*10423| // A snapshot at the CURRENT generation applies — the legitimate\n 10424| // late-bind convergence must keep working.\n 10425| let fresh_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10426| assert!(\n 10427| converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, fresh_gen),\n*10428| \"a current-generation snapshot converges normally\"\n 10429| );\n 10430| let after = spt_store::info::read_info(&perch).unwrap();\n 10431| assert!(after.controlled, \"late-bind convergence still lands\");\n...\n 10751| let mut log = OutputLog::new(9, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n*10752| let out = log.resolve_subscribe(Arc::clone(&send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10753| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10754|\n 10755| // Queue output THEN the Exit through the same fanout the exit waiter uses.\n...\n 10783|\n*10784| // [unit->REQ-CONTROLLER-LEASE-IDENTITY] The generation LADDER within one\n 10785| // node identity (ADR-0044 + the 2026-07-18 ladder ruling): a STRICTLY\n*10786| // NEWER generation — Control or Take alike — supersedes the incumbent\n 10787| // loudly (revoke marker + slot moves atomically with gen and conn; never\n 10788| // Busy-locked behind a stale-replay worker, never a silent sink swap); an\n*10789| // OLDER generation stays refused busy in BOTH intents (the ladder never\n 10790| // runs backwards).\n 10791| #[test]\n*10792| fn generation_ladder_newer_supersedes_loudly_older_refused_both_intents() {\n 10793| let (live, _ca, _ra) = controller_socket_pair();\n 10794| let (ctrl2, _cb, _rb) = controller_socket_pair();\n 10795| let (taker, _cc, _rc2) = controller_socket_pair();\n...\n 10797|\n*10798| let out = log.resolve_subscribe(Arc::clone(&live), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10799| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10800|\n 10801| // NEWER gen + plain Control → loud SUPERSESSION (the live replacement\n...\n 10804| // proven by `revoked_incumbent_writer_emits_the_terminal_displaced`.)\n*10805| let out = log.resolve_subscribe(Arc::clone(&ctrl2), 0, AttachIntent::Control, Some(\"op\".into()), 300, None);\n 10806| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10807| let c = log.controller.as_ref().expect(\"replacement holds the slot\");\n 10808| assert!(Arc::ptr_eq(&c.send, &ctrl2), \"the newer viewport superseded\");\n...\n 10814| let (stale, _c, _r) = controller_socket_pair();\n*10815| let out = log.resolve_subscribe(stale, 0, intent, Some(\"op\".into()), 250, None);\n 10816| assert!(\n 10817| matches!(out, SubscribeOutcome::BusyControlled { .. }),\n 10818| \"older-gen {intent:?} must refuse busy, got {out:?}\"\n...\n 10824| // NEWER gen + explicit Take → loud supersession, TookControl outcome.\n*10825| let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 400, None);\n 10826| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10827| let c = log.controller.as_ref().expect(\"taker holds the slot\");\n 10828| assert!(Arc::ptr_eq(&c.send, &taker));\n*10829| assert_eq!(c.attach_gen, 400, \"the slot carries the taker's lease generation\");\n 10830| // [unit->REQ-INPUT-CONTROLLER-FENCE]\n 10831| assert!(!log.is_controller(&ctrl2));\n 10832| assert!(log.is_controller(&taker));\n...\n 10849| // initial batch; the writer parks on its live queue).\n*10850| let out = log.resolve_subscribe(Arc::clone(&a_send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10851| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10852|\n 10853| // Distinct-lease Take: the old sink drops (tx closes) and its writer\n 10854| // must write the terminal Displaced to A's conn on exit.\n*10855| let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 300, None);\n 10856| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10857|\n 10858| let env = read_frame(&mut a_client).expect(\"A's conn carries the terminal frame\");\n...\n 10870| #[test]\n*10871| fn rc_input_fence_scopes_to_rc_minted_non_controller_input_only() {\n 10872| // The field split-brain: displaced rc lease keeps typing → rejected.\n 10873| assert!(rc_input_rejected(Some(Minter::Rc), false));\n 10874| // The live lease's own input applies.\n...\n 11017| /// the ORDER test; here the TEST is the consumer, draining `rx` deterministically.\n*11018| fn test_input_writer(depth: usize) -> (InputWriter, Receiver) {\n 11019| let (tx, rx) = sync_channel::(depth);\n 11020| let w = InputWriter {\n 11021| tx,\n...\n 11037| #[test]\n*11038| fn input_writer_preserves_strict_fifo_order_through_the_sole_writer() {\n 11039| use spt_term::surface::{SessionSurface, SurfaceError, SurfaceSize};\n 11040|\n 11041| /// A stub PTY write seam: appends every `write_input` to a shared Vec, in\n...\n 11044| impl SessionSurface for RecordingSurface {\n*11045| fn write_input(&self, bytes: &[u8]) -> Result<(), SurfaceError> {\n 11046| self.0.lock().unwrap().push(bytes.to_vec());\n 11047| Ok(())\n 11048| }\n...\n 11101| #[test]\n*11102| fn input_enqueue_drops_and_stamps_on_full_then_heals_on_drain() {\n 11103| const DEPTH: usize = 3;\n 11104| // Consumer is the test; it does NOT drain until we say so → the queue fills.\n 11105| let (w, rx) = test_input_writer(DEPTH);\n...\n 12181| // `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12182| // `controller_writer`'s `send.lock()` arm → RED). ──────────────────────────\n 12183|\n 12184| /// A connected local-socket pair for the unit: bind a listener, connect a\n 12185| /// client `Stream`, accept the server `Stream`. Returns the SERVER send half\n...\n 12253| /// `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12254| /// `controller_writer`'s `send.lock()` arm and writer-A flushes its stale\n 12255| /// repaint@1; since both writers serialize on the SAME socket mutex, writer-A's\n 12256| /// seq 1 can win the first slot → the first frame read is `1`, and\n 12257| /// `assert_eq!(seqs, [2])` fails — exactly the `got stale seq` reorder this\n...\n 12261| #[test]\n*12262| fn superseded_controller_writer_is_epoch_gated_silent_one_live_writer_per_conn() {\n 12263| let (send, mut client, _recv) = controller_socket_pair();\n 12264| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12265| // Two chunks in the ring (seqs 0,1); the grid now holds their screen state.\n...\n 12320|\n*12321| /// ADR-0047 decision 3 (REQ-ATTACH-IDEMPOTENT-REPLAY) — the equal-generation\n 12322| /// rung's four cells, keyed `(by, conn, gen, from_seq)`:\n 12323| ///\n*12324| /// 1. SAME conn + same nonzero gen + same from_seq = an IDEMPOTENT REPLAY of\n 12325| /// the establish already honored: the seat and its writer are PRESERVED\n 12326| /// (no `become_controller`, so no `controller-replaced`, no second initial\n 12327| /// batch) and the breadcrumb answers `decision=idempotent`.\n...\n 12332| ///\n*12333| /// RED-first: with the same-conn discriminator removed, cell 1 runs\n 12334| /// `become_controller` against its OWN live seat — the incumbent sink is\n 12335| /// dropped, its writer exits channel-closed, and the attached rc freezes\n 12336| /// until a manual detach + re-attach. That is hertz's v0.39.4 bug 4 (\"spt\n...\n 12340| #[test]\n*12341| fn equal_generation_same_conn_is_an_idempotent_replay() {\n 12342| let (a, _client_a, _recv_a) = controller_socket_pair();\n 12343| let (b, _client_b, _recv_b) = controller_socket_pair();\n 12344| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12345|\n*12346| // Establish: conn A holds the lease at generation 500.\n 12347| let (out, decision) =\n*12348| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12349| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12350| assert_eq!(decision, \"controller\");\n 12351| let epoch_after_establish = log.controller_epoch.load(Ordering::Acquire);\n 12352|\n*12353| // CELL 1 — the dispatcher's double-serve: the SAME conn, gen, and from_seq,\n*12354| // replayed. The seat is untouched: same sink, same generation, and the\n 12355| // controller EPOCH does not move (a bump is what stops the live writer\n 12356| // mid-batch, so an unchanged epoch IS \"the writer was never disturbed\").\n 12357| let (out, decision) =\n*12358| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12359| assert!(matches!(out, SubscribeOutcome::Controller), \"the wire answer stays Controller (N-1 tolerant), got {out:?}\");\n 12360| assert_eq!(decision, \"idempotent\", \"the breadcrumb distinguishes reuse from replacement\");\n 12361| let seat = log.controller.as_ref().expect(\"the seat survives its own replay\");\n...\n 12369|\n*12370| // CELL 2 — a DIFFERENT conn at the same generation is the fix-6 successor:\n 12371| // today's silent swap must NOT regress into idempotence.\n 12372| let (out, decision) =\n*12373| log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12374| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12375| assert_eq!(decision, \"controller\", \"a different carrier is a re-serve, not a replay\");\n 12376| assert!(\n...\n 12380|\n*12381| // CELL 3 — strictly newer generation still supersedes loudly...\n 12382| let (out, decision) =\n*12383| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Take, Some(\"op\".into()), 900, None);\n 12384| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 12385| assert_eq!(decision, \"took\");\n 12386|\n...\n 12388| let (out, decision) =\n*12389| log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12390| assert!(matches!(out, SubscribeOutcome::BusyControlled { .. }), \"got {out:?}\");\n 12391| assert_eq!(decision, \"busy\");\n 12392|\n...\n 12396| /// The COLLISION the `from_seq` key element exists for: core itself\n*12397| /// re-subscribes on the SAME conn with the SAME generation when a controller\n 12398| /// hits an output gap (`read_controller_event_resuming`,\n 12399| /// REQ-HAZARD-CONTROLLER-GAP-RESUME) — it re-fetches the dropped frames from\n 12400| /// its frozen `delivered_through` floor. That is NOT a replay of the establish\n...\n 12407| #[test]\n*12408| fn a_gap_resume_on_the_same_conn_is_served_not_suppressed() {\n 12409| let (worker, _client, _recv) = controller_socket_pair();\n 12410| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12411|\n*12412| let (out, decision) = log.resolve_subscribe_inner(\n 12413| Arc::clone(&worker),\n 12414| 0,\n 12415| AttachIntent::Control,\n...\n 12420|\n*12421| // The gap resume: same conn, same generation, but from the floor it has\n 12422| // since reached — a re-fetch, not a replay.\n*12423| let (out, decision) = log.resolve_subscribe_inner(\n 12424| Arc::clone(&worker),\n 12425| 12,\n 12426| AttachIntent::Control,\n...\n 12431| decision, \"controller\",\n*12432| \"a same-conn re-fetch from a DIFFERENT floor must be re-served — suppressing it strands the gap and reports a false truncation\"\n 12433| );\n 12434| assert_eq!(\n 12435| log.controller.as_ref().unwrap().establish_from_seq,\n...\n 12438| );\n*12439| assert_eq!(log.controller.as_ref().unwrap().attach_gen, 700, \"the generation is preserved (fix 6)\");\n 12440|\n 12441| log.clear_controller();\n 12442| }\n 12443|\n*12444| /// Ownership/generation validation (ADR-0038 Amendment fix 6): the\n*12445| /// same-identity silent re-take is for a SUCCESSOR — equal generation (the\n 12446| /// SAME Request re-served after a dispatcher restart) or newer. A REPLAYED\n 12447| /// stale Request — an UNFINISHED backlog row whose viewport died raw, the\n*12448| /// shape finished-row retirement cannot see — carries an OLDER generation\n 12449| /// than the live replacement controller and must be REFUSED busy, never\n 12450| /// silently steal the slot. `0` on either side keeps the N-1/local legacy\n 12451| /// re-take (a legacy peer must not be locked out).\n*12452| // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12453| #[test]\n*12454| fn same_identity_resubscribe_refuses_a_stale_generation() {\n 12455| let (live, _client_a, _recv_a) = controller_socket_pair();\n 12456| let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12457| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12458|\n*12459| // The live replacement controller holds the slot at generation 200.\n*12460| let out = log.resolve_subscribe(\n 12461| Arc::clone(&live),\n 12462| 0,\n 12463| AttachIntent::Control,\n...\n 12467|\n*12468| // A replayed stale Request (same identity, OLDER generation) is\n 12469| // refused busy — the incumbent is untouched.\n*12470| let out = log.resolve_subscribe(\n 12471| Arc::clone(&stale),\n 12472| 0,\n 12473| AttachIntent::Control,\n...\n 12476| let SubscribeOutcome::BusyControlled { by } = out else {\n*12477| panic!(\"a stale same-identity generation must refuse busy, got {out:?}\");\n 12478| };\n 12479| assert_eq!(by, \"op\");\n 12480| let c = log.controller.as_ref().expect(\"incumbent survives\");\n...\n 12483|\n*12484| // EQUAL generation = the same Request reconstructed (dispatcher\n 12485| // restart) — the silent re-take stays allowed.\n*12486| let out = log.resolve_subscribe(\n 12487| Arc::clone(&stale),\n 12488| 0,\n 12489| AttachIntent::Control,\n...\n 12494|\n*12495| // Generation 0 (local / N-1 legacy) keeps the legacy silent re-take —\n 12496| // even against a non-zero incumbent.\n*12497| let out = log.resolve_subscribe(\n 12498| Arc::clone(&live),\n 12499| 0,\n 12500| AttachIntent::Control,\n...\n 12509| /// mid-serve resume-from-floor (`read_controller_event_resuming`) carries\n*12510| /// its OWN generation — the SAME Request re-fetching dropped frames. The\n 12511| /// equal-gen re-take must PRESERVE the incumbent `attach_gen`, so that\n 12512| /// (a) a stale replayed Request is STILL refused after the resume, and\n 12513| /// (b) the worker's terminal `detach_session_gen(Some(serve_gen))` still\n...\n 12519| /// until conn drop).\n*12520| // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12521| #[test]\n*12522| fn gap_resume_resubscribe_preserves_the_generation_against_stale_replay() {\n 12523| let (worker, _client_a, _recv_a) = controller_socket_pair();\n 12524| let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12525| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12526|\n*12527| // The serve worker attaches with its generation (serve_gen = 200).\n*12528| let out = log.resolve_subscribe(\n 12529| Arc::clone(&worker),\n 12530| 0,\n 12531| AttachIntent::Control,\n...\n 12536| // Mid-serve gap resume: the SAME worker re-subscribes from its floor\n*12537| // carrying the SAME generation (what the fixed helper now sends).\n*12538| let out = log.resolve_subscribe(\n 12539| Arc::clone(&worker),\n 12540| 3,\n 12541| AttachIntent::Control,\n...\n 12547| 200,\n*12548| \"the resume preserves the incumbent generation (gen=0 here re-armed the steal)\"\n 12549| );\n 12550|\n 12551| // (a) A stale replayed Request is STILL refused after the resume.\n*12552| let out = log.resolve_subscribe(\n 12553| Arc::clone(&stale),\n 12554| 0,\n 12555| AttachIntent::Control,\n...\n 12563|\n*12564| // (b) The worker's terminal generation-validated release still clears.\n 12565| log.detach_if_gen(&worker, Some(200));\n 12566| assert!(\n 12567| log.controller.is_none(),\n...\n 12572| /// The release half of fix 6: a STALE serve worker's late detach\n*12573| /// (generation mismatch) never clears the (newer) controller — but its\n*12574| /// viewer rows still clean up by ptr identity. A matching generation and\n 12575| /// the `None` (N-1 / conn-cleanup) path keep today's clearing behavior.\n 12576| /// This is also the LATE-CLOSE IDENTITY guard ConnectionBound teardown\n 12577| /// rides (ADR-0040 decision 6): a stale opener A's conn-death FIN reaches\n\n[Showing lines 1-901 of 923 (49.9KB limit). Use :902 to continue]"}],"details":{"scopePath":".worktrees/304-product/crates/spt-daemon/src/broker.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt-daemon\\src\\broker.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":200,"fileCount":1,"files":[".worktrees/304-product/crates/spt-daemon/src/broker.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt-daemon/src/broker.rs","count":200}],"truncated":true,"perFileLimitReached":200,"displayContent":" 264│ /// Which claim this is. A holder that was taken over as wedged may still\n *265│ /// complete later and drop its guard; the generation is what stops that late\n 266│ /// drop from releasing the claim that REPLACED it, which would re-open the\n 267│ /// double-create window one wake later.\n *268│ generation: u64,\n 269│ /// The last spawn phase this holder stamped, and when.\n 270│ phase: String,\n 271│ phase_at: Instant,\n │...\n 279│///\n *280│/// It releases ONLY ITS OWN GENERATION — see [`release_claim`].\n 281│struct WakeClaimGuard<'a> {\n 282│ map: &'a Mutex>,\n 283│ endpoint: String,\n *284│ generation: u64,\n 285│}\n 286│\n 287│impl Drop for WakeClaimGuard<'_> {\n 288│ fn drop(&mut self) {\n *289│ release_claim(&mut recover(self.map), &self.endpoint, self.generation);\n 290│ }\n 291│}\n 292│\n *293│/// Release a claim only if the entry still belongs to `generation`.\n 294│///\n 295│/// THE CASE THIS EXISTS FOR: a wedged holder is taken over, the new claimant\n *296│/// holds generation N+1, and the old holder finally completes and drops. A\n *297│/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298│/// is still in flight, so the next duplicate wake sails through the gate —\n 299│/// re-opening, one wake later, exactly the double-create this guard exists to\n 300│/// close. Pure over the map so the no-op is a unit.\n *301│fn release_claim(map: &mut HashMap, endpoint: &str, generation: u64) {\n *302│ if map.get(endpoint).is_some_and(|c| c.generation == generation) {\n 303│ map.remove(endpoint);\n 304│ }\n 305│}\n │...\n 528│// [impl->REQ-INPUT-CONTROLLER-FENCE]\n *529│fn rc_input_rejected(minter: Option, sender_is_controller: bool) -> bool {\n 530│ minter == Some(Minter::Rc) && !sender_is_controller\n 531│}\n 532│\n │...\n 583│/// The coordinator-image announce gate (F-025 amendment): accept ONLY an announce\n *584│/// whose generation is exactly the brain child this process currently supervises.\n 585│/// `supervised = None` (no brain spawned by this process) accepts nothing.\n 586│///\n 587│/// Pure so the discriminator is unit-testable without a live brain — it is the\n │...\n 598│/// The coordinator-image read gate (F-025 amendment): a recorded\n *599│/// `(generation, version)` answers only while its generation is STILL the\n 600│/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601│/// reported — rather than the version of a process that no longer exists, so the\n 602│/// surface never outlives the process it describes (the stale-record class that\n │...\n 609│ record\n *610│ .filter(|(generation, _)| supervised == Some(*generation))\n 611│ .map(|(_, version)| version.clone())\n 612│}\n 613│\n │...\n 834│ send: SharedSend,\n *835│ /// The controller's ATTACH GENERATION (ADR-0038 Amendment fix 6,\n *836│ /// REQ-SERVE-OWNERSHIP-GENERATION): operator-minted wall-ms from the wire\n 837│ /// Request (`0` = local / N-1). A same-identity re-take with an OLDER\n *838│ /// generation is a replayed stale Request — refused; a stale worker's\n *839│ /// late detach (older generation) never clears a newer controller.\n 840│ attach_gen: u64,\n 841│ /// The `from_seq` this seat was ESTABLISHED with — the fourth element of the\n 842│ /// idempotent-replay key (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY).\n *843│ /// A same-conn/same-gen subscribe carrying the SAME `from_seq` is a replay of\n 844│ /// the establish already honored (the dispatcher's double-serve); one carrying\n 845│ /// a DIFFERENT `from_seq` is the controller GAP RESUME re-fetching dropped\n 846│ /// frames from its frozen floor (REQ-HAZARD-CONTROLLER-GAP-RESUME), which must\n │...\n 871│ /// The writer's IN-FLIGHT socket-write marker (LIFECYCLE-TRUTH W2,\n *872│ /// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): the `controller_writer` sets it to\n 873│ /// `Some(Instant::now())` immediately BEFORE it enters a blocking `write_frame`\n 874│ /// and back to `None` the instant the write returns. A reader\n 875│ /// ([`OutputLog::controller_stalled`]) sees a `Some` older than\n │...\n 1017│ controller: Option,\n *1018│ /// Monotonic controller generation, shared with the live `controller_writer`\n 1019│ /// thread (`Arc`). Bumped on every [`become_controller`]; the\n 1020│ /// drain's deadline-evict ([`mark_controller_gone`]) carries the epoch it\n 1021│ /// observed and only detaches if it still matches — so a slow-controller\n │...\n 1144│/// Per-endpoint stamp-transition serial (ADR-0041 decision 4,\n *1145│/// REQ-CONTROL-STAMP-CONVERGENCE): the generation counter a definitive\n 1146│/// no-session truth (the exit-waiter reap) BUMPS, and a poll-derived stamp\n 1147│/// write VALIDATES against — so a `KIND_SESSIONS` snapshot taken PRE-reap can\n 1148│/// never relatch `controlled=true` after the reap cleared it (the session is\n │...\n 1182│///\n *1183│/// `snap_gen` is the endpoint's stamp generation AT SNAPSHOT time (ADR-0041\n 1184│/// decision 4): the write is refused — loud, nothing written — when the\n *1185│/// generation has advanced since (an exit-waiter reap landed between our\n 1186│/// under-lock snapshot and this off-lock write; the snapshot is stale truth\n 1187│/// about a session that no longer exists). Validation + write run under the\n 1188│/// endpoint's stamp-write serial so the reap can never interleave the pair.\n │...\n 1223│ if control || viewer {\n *1224│ // The two IN-MEMORY reap paths (`reap_dead_controller`, the stall-evict)\n 1225│ // deliberately do not stamp under the log lock, so their attachment edge\n 1226│ // becomes true HERE and nowhere else — signal it, or a controller that\n 1227│ // died with its conn would leave a stale attachment frame standing until\n │...\n 1235│ // The THIRD engine-room drop edge (ADR-0052 §3a). The two in-memory\n *1236│ // reap paths (`reap_dead_controller`, the stall-evict) deliberately do\n 1237│ // NOT stamp under the log lock, so they never reach `clear_controller`;\n 1238│ // this off-lock converge is where their release becomes true. Keying on\n 1239│ // the recorded truth going FALSE means a controller that died with the\n │...\n 1454│ /// b4 (REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE): W1 moved the\n *1455│ /// controller SOCKET WRITE off the drain (the `controller_writer` thread) but\n 1456│ /// left the HANDOFF as an inline sleep-poll (`ControllerJob::deliver`, up to\n 1457│ /// `CONTROLLER_WRITE_DEADLINE`) ON the drain — so a controller draining slower\n 1458│ /// than the PTY floods filled its channel, the inline poll throttled the drain,\n │...\n 1601│ /// or `None` when undriven. The `by`-keyed ownership logic in\n *1602│ /// [`resolve_subscribe`] reads this.\n 1603│ fn controller_by(&self) -> Option<&str> {\n 1604│ self.controller.as_ref().and_then(|c| c.by.as_deref())\n 1605│ }\n │...\n 1756│ // `Unredeemed` and returned a REFUSAL that unseated the human mid-session\n *1757│ // (measured on golden 32341702157, Linux leg: seat, same-conn re-serve\n 1758│ // ~700ms later with `req_gen` unchanged, `engine-room-admit-unredeemed`,\n 1759│ // `session-detach was_controller=true`).\n 1760│ //\n 1761│ // THE ORDER SWAP IS NOT A WIDENING, and the reason is the same one this\n *1762│ // module already gives for why an attach GENERATION cannot be the\n *1763│ // discriminator: a generation is a wall-ms number an agent on this box\n 1764│ // can guess, while a broker CONNECTION id belongs to another process's\n 1765│ // socket and cannot be claimed by asking (see\n 1766│ // [`spt_store::engineroom::bringup_required`]). So the only attach this\n │...\n 2593│ // Drop the prior controller sink first (its writer's live loop ends when\n *2594│ // tx drops), and bump the generation so (a) an in-flight deadline-evict\n 2595│ // for the old controller can't unseat this one and (b) a prior writer\n 2596│ // still flushing its initial batch returns before its next frame.\n 2597│ // Attribution (F-039 legs b+d): the replaced conn's record names its\n │...\n 2662│ let writer = thread::spawn(move || {\n *2663│ controller_writer(\n 2664│ sid,\n 2665│ writer_send,\n 2666│ initial,\n │...\n 2691│ // The seat changed hands (or was filled): the incoming controller does\n *2692│ // not inherit the outgoing one's authority. An equal-generation re-serve\n 2693│ // is the SAME lease and keeps it.\n 2694│ self.on_control_edge(prev_gen, Some(attach_gen));\n 2695│ }\n │...\n 2760│ // [impl->REQ-CONTROLLER-LIVENESS-REAP]\n *2761│ fn reap_dead_controller(&mut self) -> bool {\n 2762│ let dead = self\n 2763│ .controller\n 2764│ .as_ref()\n │...\n 2782│ /// timed out its `send_timeout`. Detach it — but ONLY if it is still the same\n *2783│ /// controller generation the drain saw (`epoch`), so a NEWER controller that\n 2784│ /// attached during the stall is never unseated.\n 2785│ fn mark_controller_gone(&mut self, epoch: u64) {\n 2786│ if self.controller_epoch.load(Ordering::Acquire) == epoch {\n │...\n 2807│ /// Whether this session's controller is the brain's OWN LOCAL conn (`by: None`)\n *2808│ /// AND wedged past `deadline` — the brain-generation promotion DRAINED gate reads\n *2809│ /// it (REQ-UPDATE-PROMOTE-DRAINED). A killed OLD brain generation whose local\n 2810│ /// controller conn is black-holed reads wedged here until the W2 stall-evict\n 2811│ /// releases it (or the conn EOFs); a cleanly-closed conn is simply absent. A\n 2812│ /// REMOTE operator's wedged conn (`by: Some`) is the W2 stall-evict concern, NOT\n │...\n 2932│ /// Production always goes through\n *2933│ /// [`resolve_subscribe_gated`](Self::resolve_subscribe_gated) — the broker\n 2934│ /// asks what the presented secret is on every subscribe, and the usual\n 2935│ /// answer is \"not a ticket\". This wrapper exists so the exemption is\n 2936│ /// something a caller must ASK for rather than something it can forget to\n │...\n 2939│ #[cfg(test)]\n *2940│ fn resolve_subscribe(\n 2941│ &mut self,\n 2942│ sub: SharedSend,\n 2943│ from_seq: u64,\n │...\n 2948│ ) -> SubscribeOutcome {\n *2949│ self.resolve_subscribe_gated(sub, from_seq, intent, by, gen, code, AdmitTicket::None, false)\n 2950│ .0\n 2951│ }\n 2952│\n *2953│ /// [`resolve_subscribe`](Self::resolve_subscribe) carrying the broker's\n 2954│ /// verdict on a bring-up admit ticket presented for this exact session.\n 2955│ // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n 2956│ #[allow(clippy::too_many_arguments)]\n *2957│ fn resolve_subscribe_gated(\n 2958│ &mut self,\n 2959│ sub: SharedSend,\n 2960│ from_seq: u64,\n │...\n 2968│ // OBS RIDER leg 1 (ALWAYS-ON pin): one structured breadcrumb per subscribe\n *2969│ // decision — ids/generations only, never PTY bytes. Rides the daemon stderr\n 2970│ // sink (F-039 shape) → daemon.stderr.log. The incumbent snapshot is captured\n 2971│ // BEFORE the decision runs (become_controller overwrites the controller slot\n 2972│ // inside the inner call); a supersession is derivable downstream as\n │...\n 2989│ let mut seat_cred = None;\n *2990│ let (outcome, decision) = self.resolve_subscribe_inner_gated(\n 2991│ sub,\n 2992│ from_seq,\n 2993│ intent,\n │...\n 3030│ /// The W2.5 subscribe decision kernel — wrapped by\n *3031│ /// [`OutputLog::resolve_subscribe`], which emits the always-on decision\n 3032│ /// breadcrumb around it. See that wrapper for the field/observability contract.\n 3033│ ///\n 3034│ /// Returns the wire [`SubscribeOutcome`] AND the breadcrumb decision label;\n │...\n 3037│ /// The no-admit spelling of the inner kernel (see\n *3038│ /// [`resolve_subscribe`](Self::resolve_subscribe) for why it stays).\n 3039│ #[cfg(test)]\n *3040│ fn resolve_subscribe_inner(\n 3041│ &mut self,\n 3042│ sub: SharedSend,\n 3043│ from_seq: u64,\n │...\n 3048│ ) -> (SubscribeOutcome, &'static str) {\n *3049│ self.resolve_subscribe_inner_gated(\n 3050│ sub,\n 3051│ from_seq,\n 3052│ intent,\n │...\n 3060│\n *3061│ /// [`resolve_subscribe_inner`](Self::resolve_subscribe_inner) with the\n 3062│ /// admit-ticket verdict carried through to the seat gate.\n 3063│ ///\n 3064│ /// `seat_cred` is an OUT-PARAM, deliberately, and it is the only thing about\n │...\n 3072│ #[allow(clippy::too_many_arguments)]\n *3073│ fn resolve_subscribe_inner_gated(\n 3074│ &mut self,\n 3075│ sub: SharedSend,\n 3076│ from_seq: u64,\n │...\n 3124│ if same_identity {\n *3125│ // The GENERATION LADDER over the (by, nonzero attach_gen) LOGICAL\n 3126│ // LEASE (ADR-0044 decision 1 + the 2026-07-18 ladder ruling over\n *3127│ // the ADR-0038 fix-6 generation): node identity alone is NEVER a\n 3128│ // lease — two same-node viewports are DISTINCT controllers,\n *3129│ // discriminated by their generations; within one identity the\n *3130│ // generation stays the LIFECYCLE discriminator.\n 3131│ // gen == incumbent (nonzero) → the SAME lease re-served after a\n 3132│ // dispatcher restart — the fix-6 successor, silent (gate #7).\n 3133│ // gen < incumbent (nonzero) → a REPLAYED stale Request (an\n │...\n 3145│ // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n *3146│ // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3147│ let incumbent_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n 3148│ let incumbent_conn = self.controller.as_ref().map(|c| c.send.id());\n *3149│ // IDEMPOTENT REPLAY — the new leaf INSIDE the equal-generation rung\n 3150│ // (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY). Same identity,\n *3151│ // same NONZERO generation, and the SAME CONNECTION as the incumbent\n 3152│ // seat means this is a replay of the establish we already honored, not\n 3153│ // a successor: the seat and its writer are PRESERVED, no\n 3154│ // `controller-replaced` fires, and no second initial batch is\n │...\n 3160│ // prior seat. Designed for a DEAD seat after a dispatcher restart, it\n *3161│ // fired against the same LIVE conn: the lease killed its own writer\n 3162│ // (channel-closed) and the rc viewport froze until a manual\n 3163│ // detach + re-attach. \"spt update freezes every attached PTY.\"\n 3164│ //\n *3165│ // Equal generation on a DIFFERENT conn keeps today's silent swap — that\n 3166│ // is the designed ADR-0038 fix-6 successor (the old seat is dead and the\n 3167│ // lease is being re-served on a fresh carrier), and it must not regress.\n 3168│ // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n │...\n 3170│ // The key includes `from_seq` because core itself re-subscribes on the\n *3171│ // SAME conn with the SAME generation for a legitimate reason: the\n 3172│ // controller GAP RESUME (REQ-HAZARD-CONTROLLER-GAP-RESUME,\n 3173│ // `read_controller_event_resuming`) re-fetches dropped frames from its\n 3174│ // frozen `delivered_through` floor. That request is NOT a replay of the\n │...\n 3188│ // Same lease (or legacy) that is NOT a replay of the establish:\n *3189│ // a different conn (the fix-6 successor) or the SAME conn asking\n 3190│ // from a different floor (the gap-resume re-fetch above). Silent\n 3191│ // re-take either way, NEVER Displaced.\n 3192│ self.become_controller(sub, by, from_seq, gen);\n │...\n 3498│ /// `driven_by` / `viewer_count` when a role actually changed.\n *3499│ /// Generation-validated detach (ADR-0038 Amendment fix 6): `Some(g)` with\n *3500│ /// a controller whose generation differs = a STALE worker's late release —\n 3501│ /// the controller slot is left alone (viewer rows still clean up by ptr).\n 3502│ /// `None` (N-1 / conn-cleanup) = today's ptr-identity behavior.\n *3503│ // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3504│ fn detach_if_gen(&mut self, sub: &SharedSend, gen: Option) {\n 3505│ if let (Some(g), Some(c)) = (gen, self.controller.as_ref()) {\n 3506│ if c.attach_gen != g {\n *3507│ // Stale generation: never clears the (newer) controller.\n 3508│ let before = self.viewers.len();\n 3509│ self.viewers.retain(|_, sink| !Arc::ptr_eq(&sink.send, sub));\n 3510│ if self.viewers.len() != before {\n │...\n 3563│ /// `driven_by` remote-only. The client's own-node vs remote guidance display\n *3564│ /// (`rc.rs` `driver_phrase`) reads this verbatim stamp; the W2 generation\n 3565│ /// ladder governs same-identity viewports at the broker, below that gate.\n 3566│ // [impl->REQ-RCVIEW-1] [impl->REQ-REACH-1]\n 3567│ fn stamp_driven_by(&self) {\n │...\n 3647│ // ADR-0041 decision 4: a reap is a DEFINITIVE no-session truth — bump\n *3648│ // the endpoint's stamp generation UNDER the stamp-write serial, then\n 3649│ // clear. A KIND_SESSIONS poll that snapshotted this session PRE-reap now\n *3650│ // fails its generation check and can never relatch `controlled=true`\n 3651│ // onto the perch of a session that no longer exists (the emphasys C3\n 3652│ // poll-vs-reap window: no later poll would ever heal the latch).\n 3653│ let slot = stamp_slot(&self.endpoint);\n │...\n 3909│#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\n *3910│fn controller_writer(\n 3911│ sid: u64,\n 3912│ send: SharedSend,\n 3913│ initial: Vec<(u64, Vec)>,\n │...\n 4179│/// is the invariant, not its exact value.\n *4180│fn input_queue_depth() -> usize {\n 4181│ match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\n 4182│ Ok(n) => n\n 4183│ .parse::()\n │...\n 4217│ /// whose PTY write handle this thread now exclusively owns.\n *4218│ fn spawn(session: Arc, endpoint: String) -> Arc {\n 4219│ let (tx, rx) = sync_channel::(input_queue_depth());\n 4220│ let writer = thread::spawn(move || input_writer(session, rx));\n 4221│ Arc::new(InputWriter {\n │...\n 4234│ // [impl->REQ-HAZARD-PTY-INPUT-WRITER-WEDGE]\n *4235│ fn enqueue(&self, bytes: InputRecord) -> bool {\n 4236│ match self.tx.try_send(bytes) {\n 4237│ Ok(()) => {\n 4238│ // Heal: input is flowing again — clear a prior backpressure stamp.\n │...\n 4273│/// when the last `tx` clone drops at session teardown.\n *4274│fn input_writer(session: Arc, rx: Receiver) {\n 4275│ while let Ok(bytes) = rx.recv() {\n 4276│ let _ = session.write_input(&bytes);\n 4277│ }\n │...\n 4587│\n *4588│fn flush_inject_floor(floor: &Mutex, input: &InputWriter) {\n 4589│ loop {\n 4590│ let chunk = lock_floor(floor).take_or_release();\n 4591│ match chunk {\n │...\n 4756│// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n *4757│fn settle_before_inject(input: &InputWriter, log: &Mutex, endpoint: &str) -> bool {\n 4758│ let baseline = recover_log(log).high_water();\n 4759│ let deadline = Instant::now() + inject_settle_deadline();\n 4760│ loop {\n │...\n 4842│// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n *4843│fn enqueue_text_chunked(input: &InputWriter, bytes: Vec) {\n 4844│ chunk_text(&bytes, inject_text_chunk(), |part| {\n 4845│ input.enqueue(part.to_vec());\n 4846│ });\n │...\n 5291│ wake_inflight: Mutex>,\n *5292│ /// Monotonic claim generation (#235). Handed to each claim so a taken-over\n 5293│ /// holder's late RAII drop cannot release its successor's claim.\n *5294│ wake_generation: AtomicU64,\n 5295│ /// Live per-connection handler-thread tally: incremented on [`handle_conn`]\n 5296│ /// entry, decremented (RAII, panic-safe) when the handler returns. The\n 5297│ /// UPDATE-WEDGE round-4 int gate's observability seam\n │...\n 5302│ /// The COORDINATOR image the supervised brain announced, as\n *5303│ /// `(generation, version)` (F-025 amendment, FIELD-TRUTH W1). Recorded only\n *5304│ /// when the announced generation matches the child the supervisor currently\n 5305│ /// runs, and answered only while it STILL matches — so a record from a\n *5306│ /// replaced generation stops being reported the instant its successor is\n 5307│ /// spawned, without needing a clearing signal from the dying brain.\n 5308│ /// In-memory by design: the running image is a property of a live process,\n 5309│ /// and a durable copy would be exactly the outlives-its-process staleness\n │...\n 5596│ wake_inflight: Mutex::new(HashMap::new()),\n *5597│ wake_generation: AtomicU64::new(0),\n 5598│ conn_handlers: AtomicUsize::new(0),\n 5599│ coordinator_image: Mutex::new(None),\n 5600│ bringup_admits: Mutex::new(HashMap::new()),\n │...\n 5910│ /// trip) promotes a ready update candidate only once this reads `false`: an OLD\n *5911│ /// generation whose local controller conn is black-holed reads wedged until the W2\n 5912│ /// stall-evict releases it, so `brain.ready` inside the 15 s window can no longer\n 5913│ /// promote onto a still-frozen control plane (the 22:47 false-promote). A cleanly-\n 5914│ /// closed old conn is simply absent → `false` at once (the normal fast promote).\n │...\n 6214│ viewers: u32,\n *6215│ // The endpoint's stamp generation AT snapshot time\n 6216│ // (ADR-0041 decision 4) — the off-lock converge below\n 6217│ // validates against it so a reap that lands between\n 6218│ // this snapshot and the write refuses the stale stamp.\n │...\n 6234│ // cleared state and the stale info.json stamp clears.\n *6235│ let _ = log.reap_dead_controller();\n 6236│ let stamp_gen =\n 6237│ stamp_slot(&endpoint).gen.load(Ordering::Acquire);\n 6238│ SessSnap {\n │...\n 6357│ // remote target's read pump sees EOF, `serve_attach` runs\n *6358│ // `detach_session` under its own serve generation (fix-6 validated:\n 6359│ // a stale opener's late close can never evict a newer controller),\n 6360│ // and the controller/viewer stamps clear — then terminal-retire the\n 6361│ // local row (eligibility + physical teardown, the W1 machinery).\n │...\n 8017│ );\n *8018│ if let Some(generation) = claim_gen.get() {\n 8019│ let mut inflight = recover(&self.wake_inflight);\n 8020│ if let Some(claim) = inflight.get_mut(&spawn_label) {\n *8021│ // Only OUR generation: a holder taken over as wedged must not\n 8022│ // keep refreshing the successor's claim from behind.\n *8023│ if claim.generation == generation {\n 8024│ claim.phase = phase.to_string();\n 8025│ claim.phase_at = Instant::now();\n 8026│ }\n │...\n 8101│ req.endpoint,\n *8102│ prev.generation,\n 8103│ prev.phase,\n 8104│ prev.phase_at.elapsed().as_millis(),\n 8105│ phase_wedge_ceiling(&prev.phase).as_millis(),\n │...\n 8107│ }\n *8108│ let generation =\n *8109│ self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\n 8110│ inflight.insert(\n 8111│ req.endpoint.clone(),\n 8112│ WakeClaim {\n *8113│ generation,\n 8114│ phase: \"gate_claimed\".to_string(),\n 8115│ phase_at: Instant::now(),\n 8116│ },\n 8117│ );\n *8118│ claim_gen.set(Some(generation));\n 8119│ Gate::Claimed(WakeClaimGuard {\n 8120│ map: &self.wake_inflight,\n 8121│ endpoint: req.endpoint.clone(),\n *8122│ generation,\n 8123│ })\n 8124│ }\n 8125│ }\n │...\n 8453│ // this session at all. Clearing before removal left a window where\n *8454│ // a poll snapshotted AFTER the generation bump — same generation,\n 8455│ // controller slot still occupied in the log — and legitimately\n 8456│ // re-wrote `controlled=true` onto the perch of a session that was\n 8457│ // about to vanish (the relatch the W2 int leg caught live). The\n │...\n 8565│ // outlive the session in info.json (or gossip a stale controller).\n *8566│ // Bumps the stamp generation under the per-endpoint write serial,\n 8567│ // so any snapshot taken BEFORE the removal is refused at write time.\n 8568│ // [impl->REQ-HAZARD-CONTROL-STAMP-LIFETIME]\n 8569│ // [impl->REQ-CONTROL-STAMP-CONVERGENCE]\n │...\n 8686│ let ticket = self.redeem_bringup_admit(req.code.as_deref(), req.session_id);\n *8687│ let (outcome, seat_note) = recover_log(&log).resolve_subscribe_gated(\n 8688│ Arc::clone(send),\n 8689│ req.from_seq,\n 8690│ req.intent,\n │...\n 8745│ // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n *8746│ fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8747│ let req: InputReq =\n 8748│ serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n 8749│ let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n │...\n 8763│ // an rc-tagged input must come from the ACTIVE controller lease's\n *8764│ // originating conn — the same conn-identity gate resize has always had\n 8765│ // — so a displaced viewport can never keep typing into the PTY, no\n 8766│ // matter whether its Displaced notice was delivered, delayed, or lost.\n 8767│ // SCOPED to `Minter::Rc`: shell/system injection (`Minter::Shell`,\n │...\n 8825│ // operator/rc path sends `ack=false`: writing the ack back onto the\n *8826│ // same brain↔broker conn it is flooding with input fills the return\n 8827│ // direction and deadlocks the per-conn handler (the wedge). With no\n 8828│ // ack the handler never writes back while servicing the flood, so it\n 8829│ // always drains. The acked path (`shellchan`, one-at-a-time) still\n │...\n 8934│ // [impl->REQ-MSG-IDLE-TRANSLATION-BINARY]\n *8935│ fn dispatch_endpoint_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8936│ let req: EndpointInputReq = serde_json::from_value(env.payload)\n 8937│ .map_err(|e| format!(\"bad endpoint-input payload: {e}\"))?;\n 8938│ let bytes =\n │...\n 9151│ /// Record the COORDINATOR (brain) image self-announce (F-025 amendment), but\n *9152│ /// ONLY when the announced generation is the one this process's supervisor\n 9153│ /// currently runs — the discriminator the connection role cannot provide:\n 9154│ /// `recv_hello(.., Role::Brain)` admits every client, the CLI's own\n 9155│ /// `Brain::cold_start` included, and that client is ALWAYS freshly installed,\n │...\n 9157│ /// coordinator's on precisely the node whose coordinator is stale. Only the\n *9158│ /// supervised child is handed a generation (on its argv, ADR-0018 V2), so\n *9159│ /// only it can satisfy this — the same exact-generation discipline the D6-2\n 9160│ /// readiness gate uses against a stale ready stamp.\n 9161│ ///\n 9162│ /// Returns the verdict to the announcer rather than staying silent so an\n │...\n 9165│ fn dispatch_coordinator_image_announce(&self, env: Envelope, send: &SharedSend) {\n *9166│ let supervised = crate::brainproc::supervised_generation();\n 9167│ let accepted = match serde_json::from_value::(env.payload) {\n *9168│ Ok(a) if coordinator_announce_accepted(a.generation, supervised) => {\n 9169│ *self.coordinator_image.lock().expect(\"coordinator image lock\") =\n *9170│ Some((a.generation, a.version));\n 9171│ true\n 9172│ }\n 9173│ _ => false,\n │...\n 9184│ /// of [`dispatch_broker_image`](Self::dispatch_broker_image) for the half that\n *9185│ /// restarts on an apply. The record answers only while its generation is\n 9186│ /// still the supervised one; a record left by a replaced brain reports\n 9187│ /// `None` (not reported) rather than the version of a process that is gone.\n 9188│ // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n │...\n 9194│ .as_ref(),\n *9195│ crate::brainproc::supervised_generation(),\n 9196│ );\n 9197│ let frame = Envelope::new(\n 9198│ KIND_COORDINATOR_IMAGE_REPLY,\n │...\n 9692│ /// the dispatcher reports a serve loop that ran to completion, and the row\n *9693│ /// leaves the table so no future dispatcher generation can rediscover and\n 9694│ /// replay it (the KNOWN-HAZARDS 7.41 control-steal class).\n 9695│ // [impl->REQ-REDISPATCH-FINISHED-RETIRE]\n 9696│ fn dispatch_net_stream_retire(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n │...\n 9792│ /// on the caller's attached session, so teardown never claims the\n *9793│ /// controller slot and never bumps the ADR-0044 lease generation — a\n 9794│ /// teardown is not a control theft.\n 9795│ /// 2. **Reaps the whole DESCENDANT subtree**, not just the PTY child. The\n 9796│ /// hosted tree is adapter → node → harness → nested harness + MCP\n │...\n 10109│ // every client hellos as `Role::Brain`, the CLI's own `Brain::cold_start`\n*10110│ // included — so the generation the supervisor handed the child is the gate,\n 10111│ // and a client that holds none can never pass it.\n 10112│ #[test]\n*10113│ fn only_the_supervised_generation_can_claim_the_coordinator_image() {\n*10114│ // The supervised child's own generation is the ONLY accepted announce.\n 10115│ assert!(coordinator_announce_accepted(7, Some(7)));\n*10116│ // A client with no generation (the serde default 0) against a live\n 10117│ // supervisor at 7 — the CLI's shape — is refused.\n 10118│ assert!(!coordinator_announce_accepted(0, Some(7)));\n*10119│ // ...and is refused at generation 0 too when NOTHING is supervised, so a\n 10120│ // brokerless/supervisorless process cannot be talked into a coordinator.\n 10121│ assert!(!coordinator_announce_accepted(0, None));\n*10122│ // A brain the supervisor has already replaced (older generation) refused.\n 10123│ assert!(!coordinator_announce_accepted(6, Some(7)));\n 10124│\n*10125│ // The read gate: a record answers only while its generation is current.\n 10126│ let record = (7u64, \"0.20.0\".to_string());\n 10127│ assert_eq!(\n 10128│ recorded_coordinator_image(Some(&record), Some(7)).as_deref(),\n │...\n 10134│ None,\n*10135│ \"a superseded generation's image is NOT reported — the record must not \\\n 10136│ outlive the process it describes\"\n 10137│ );\n 10138│ assert_eq!(\n │...\n 10386│ // from a PRE-reap sessions snapshot is REFUSED once a newer no-session truth\n*10387│ // (the reap's generation bump) has landed — the stale poll can never relatch\n 10388│ // `controlled=true` onto a perch whose session died. A snapshot taken at the\n*10389│ // CURRENT generation still applies (the legitimate late-bind convergence).\n 10390│ #[test]\n*10391│ fn stale_snapshot_stamp_write_refused_after_reap_generation_bump() {\n 10392│ crate::test_home::with_home(|_| {\n 10393│ let id = \"relatch\";\n 10394│ let perch = resolve_perch_path(id, ParentHint::Infer);\n │...\n 10399│\n*10400│ // A poll snapshots at the current generation…\n 10401│ let snap_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10402│ // …then the exit-waiter reap lands first: bump + clear (what\n 10403│ // stamp_reaped does).\n │...\n 10415│ !converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, snap_gen),\n*10416│ \"a pre-reap snapshot must be refused after the generation bump\"\n 10417│ );\n 10418│ let after = spt_store::info::read_info(&perch).unwrap();\n 10419│ assert!(!after.controlled, \"controlled stays cleared (no relatch)\");\n │...\n 10422│\n*10423│ // A snapshot at the CURRENT generation applies — the legitimate\n 10424│ // late-bind convergence must keep working.\n 10425│ let fresh_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10426│ assert!(\n 10427│ converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, fresh_gen),\n*10428│ \"a current-generation snapshot converges normally\"\n 10429│ );\n 10430│ let after = spt_store::info::read_info(&perch).unwrap();\n 10431│ assert!(after.controlled, \"late-bind convergence still lands\");\n │...\n 10751│ let mut log = OutputLog::new(9, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n*10752│ let out = log.resolve_subscribe(Arc::clone(&send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10753│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10754│\n 10755│ // Queue output THEN the Exit through the same fanout the exit waiter uses.\n │...\n 10783│\n*10784│ // [unit->REQ-CONTROLLER-LEASE-IDENTITY] The generation LADDER within one\n 10785│ // node identity (ADR-0044 + the 2026-07-18 ladder ruling): a STRICTLY\n*10786│ // NEWER generation — Control or Take alike — supersedes the incumbent\n 10787│ // loudly (revoke marker + slot moves atomically with gen and conn; never\n 10788│ // Busy-locked behind a stale-replay worker, never a silent sink swap); an\n*10789│ // OLDER generation stays refused busy in BOTH intents (the ladder never\n 10790│ // runs backwards).\n 10791│ #[test]\n*10792│ fn generation_ladder_newer_supersedes_loudly_older_refused_both_intents() {\n 10793│ let (live, _ca, _ra) = controller_socket_pair();\n 10794│ let (ctrl2, _cb, _rb) = controller_socket_pair();\n 10795│ let (taker, _cc, _rc2) = controller_socket_pair();\n │...\n 10797│\n*10798│ let out = log.resolve_subscribe(Arc::clone(&live), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10799│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10800│\n 10801│ // NEWER gen + plain Control → loud SUPERSESSION (the live replacement\n │...\n 10804│ // proven by `revoked_incumbent_writer_emits_the_terminal_displaced`.)\n*10805│ let out = log.resolve_subscribe(Arc::clone(&ctrl2), 0, AttachIntent::Control, Some(\"op\".into()), 300, None);\n 10806│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10807│ let c = log.controller.as_ref().expect(\"replacement holds the slot\");\n 10808│ assert!(Arc::ptr_eq(&c.send, &ctrl2), \"the newer viewport superseded\");\n │...\n 10814│ let (stale, _c, _r) = controller_socket_pair();\n*10815│ let out = log.resolve_subscribe(stale, 0, intent, Some(\"op\".into()), 250, None);\n 10816│ assert!(\n 10817│ matches!(out, SubscribeOutcome::BusyControlled { .. }),\n 10818│ \"older-gen {intent:?} must refuse busy, got {out:?}\"\n │...\n 10824│ // NEWER gen + explicit Take → loud supersession, TookControl outcome.\n*10825│ let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 400, None);\n 10826│ assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10827│ let c = log.controller.as_ref().expect(\"taker holds the slot\");\n 10828│ assert!(Arc::ptr_eq(&c.send, &taker));\n*10829│ assert_eq!(c.attach_gen, 400, \"the slot carries the taker's lease generation\");\n 10830│ // [unit->REQ-INPUT-CONTROLLER-FENCE]\n 10831│ assert!(!log.is_controller(&ctrl2));\n 10832│ assert!(log.is_controller(&taker));\n │...\n 10849│ // initial batch; the writer parks on its live queue).\n*10850│ let out = log.resolve_subscribe(Arc::clone(&a_send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10851│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10852│\n 10853│ // Distinct-lease Take: the old sink drops (tx closes) and its writer\n 10854│ // must write the terminal Displaced to A's conn on exit.\n*10855│ let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 300, None);\n 10856│ assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10857│\n 10858│ let env = read_frame(&mut a_client).expect(\"A's conn carries the terminal frame\");\n │...\n 10870│ #[test]\n*10871│ fn rc_input_fence_scopes_to_rc_minted_non_controller_input_only() {\n 10872│ // The field split-brain: displaced rc lease keeps typing → rejected.\n 10873│ assert!(rc_input_rejected(Some(Minter::Rc), false));\n 10874│ // The live lease's own input applies.\n │...\n 11017│ /// the ORDER test; here the TEST is the consumer, draining `rx` deterministically.\n*11018│ fn test_input_writer(depth: usize) -> (InputWriter, Receiver) {\n 11019│ let (tx, rx) = sync_channel::(depth);\n 11020│ let w = InputWriter {\n 11021│ tx,\n │...\n 11037│ #[test]\n*11038│ fn input_writer_preserves_strict_fifo_order_through_the_sole_writer() {\n 11039│ use spt_term::surface::{SessionSurface, SurfaceError, SurfaceSize};\n 11040│\n 11041│ /// A stub PTY write seam: appends every `write_input` to a shared Vec, in\n │...\n 11044│ impl SessionSurface for RecordingSurface {\n*11045│ fn write_input(&self, bytes: &[u8]) -> Result<(), SurfaceError> {\n 11046│ self.0.lock().unwrap().push(bytes.to_vec());\n 11047│ Ok(())\n 11048│ }\n │...\n 11101│ #[test]\n*11102│ fn input_enqueue_drops_and_stamps_on_full_then_heals_on_drain() {\n 11103│ const DEPTH: usize = 3;\n 11104│ // Consumer is the test; it does NOT drain until we say so → the queue fills.\n 11105│ let (w, rx) = test_input_writer(DEPTH);\n │...\n 12181│ // `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12182│ // `controller_writer`'s `send.lock()` arm → RED). ──────────────────────────\n 12183│\n 12184│ /// A connected local-socket pair for the unit: bind a listener, connect a\n 12185│ /// client `Stream`, accept the server `Stream`. Returns the SERVER send half\n │...\n 12253│ /// `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12254│ /// `controller_writer`'s `send.lock()` arm and writer-A flushes its stale\n 12255│ /// repaint@1; since both writers serialize on the SAME socket mutex, writer-A's\n 12256│ /// seq 1 can win the first slot → the first frame read is `1`, and\n 12257│ /// `assert_eq!(seqs, [2])` fails — exactly the `got stale seq` reorder this\n │...\n 12261│ #[test]\n*12262│ fn superseded_controller_writer_is_epoch_gated_silent_one_live_writer_per_conn() {\n 12263│ let (send, mut client, _recv) = controller_socket_pair();\n 12264│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12265│ // Two chunks in the ring (seqs 0,1); the grid now holds their screen state.\n │...\n 12320│\n*12321│ /// ADR-0047 decision 3 (REQ-ATTACH-IDEMPOTENT-REPLAY) — the equal-generation\n 12322│ /// rung's four cells, keyed `(by, conn, gen, from_seq)`:\n 12323│ ///\n*12324│ /// 1. SAME conn + same nonzero gen + same from_seq = an IDEMPOTENT REPLAY of\n 12325│ /// the establish already honored: the seat and its writer are PRESERVED\n 12326│ /// (no `become_controller`, so no `controller-replaced`, no second initial\n 12327│ /// batch) and the breadcrumb answers `decision=idempotent`.\n │...\n 12332│ ///\n*12333│ /// RED-first: with the same-conn discriminator removed, cell 1 runs\n 12334│ /// `become_controller` against its OWN live seat — the incumbent sink is\n 12335│ /// dropped, its writer exits channel-closed, and the attached rc freezes\n 12336│ /// until a manual detach + re-attach. That is hertz's v0.39.4 bug 4 (\"spt\n │...\n 12340│ #[test]\n*12341│ fn equal_generation_same_conn_is_an_idempotent_replay() {\n 12342│ let (a, _client_a, _recv_a) = controller_socket_pair();\n 12343│ let (b, _client_b, _recv_b) = controller_socket_pair();\n 12344│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12345│\n*12346│ // Establish: conn A holds the lease at generation 500.\n 12347│ let (out, decision) =\n*12348│ log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12349│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12350│ assert_eq!(decision, \"controller\");\n 12351│ let epoch_after_establish = log.controller_epoch.load(Ordering::Acquire);\n 12352│\n*12353│ // CELL 1 — the dispatcher's double-serve: the SAME conn, gen, and from_seq,\n*12354│ // replayed. The seat is untouched: same sink, same generation, and the\n 12355│ // controller EPOCH does not move (a bump is what stops the live writer\n 12356│ // mid-batch, so an unchanged epoch IS \"the writer was never disturbed\").\n 12357│ let (out, decision) =\n*12358│ log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12359│ assert!(matches!(out, SubscribeOutcome::Controller), \"the wire answer stays Controller (N-1 tolerant), got {out:?}\");\n 12360│ assert_eq!(decision, \"idempotent\", \"the breadcrumb distinguishes reuse from replacement\");\n 12361│ let seat = log.controller.as_ref().expect(\"the seat survives its own replay\");\n │...\n 12369│\n*12370│ // CELL 2 — a DIFFERENT conn at the same generation is the fix-6 successor:\n 12371│ // today's silent swap must NOT regress into idempotence.\n 12372│ let (out, decision) =\n*12373│ log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12374│ assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12375│ assert_eq!(decision, \"controller\", \"a different carrier is a re-serve, not a replay\");\n 12376│ assert!(\n │...\n 12380│\n*12381│ // CELL 3 — strictly newer generation still supersedes loudly...\n 12382│ let (out, decision) =\n*12383│ log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Take, Some(\"op\".into()), 900, None);\n 12384│ assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 12385│ assert_eq!(decision, \"took\");\n 12386│\n │...\n 12388│ let (out, decision) =\n*12389│ log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12390│ assert!(matches!(out, SubscribeOutcome::BusyControlled { .. }), \"got {out:?}\");\n 12391│ assert_eq!(decision, \"busy\");\n 12392│\n │...\n 12396│ /// The COLLISION the `from_seq` key element exists for: core itself\n*12397│ /// re-subscribes on the SAME conn with the SAME generation when a controller\n 12398│ /// hits an output gap (`read_controller_event_resuming`,\n 12399│ /// REQ-HAZARD-CONTROLLER-GAP-RESUME) — it re-fetches the dropped frames from\n 12400│ /// its frozen `delivered_through` floor. That is NOT a replay of the establish\n │...\n 12407│ #[test]\n*12408│ fn a_gap_resume_on_the_same_conn_is_served_not_suppressed() {\n 12409│ let (worker, _client, _recv) = controller_socket_pair();\n 12410│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12411│\n*12412│ let (out, decision) = log.resolve_subscribe_inner(\n 12413│ Arc::clone(&worker),\n 12414│ 0,\n 12415│ AttachIntent::Control,\n │...\n 12420│\n*12421│ // The gap resume: same conn, same generation, but from the floor it has\n 12422│ // since reached — a re-fetch, not a replay.\n*12423│ let (out, decision) = log.resolve_subscribe_inner(\n 12424│ Arc::clone(&worker),\n 12425│ 12,\n 12426│ AttachIntent::Control,\n │...\n 12431│ decision, \"controller\",\n*12432│ \"a same-conn re-fetch from a DIFFERENT floor must be re-served — suppressing it strands the gap and reports a false truncation\"\n 12433│ );\n 12434│ assert_eq!(\n 12435│ log.controller.as_ref().unwrap().establish_from_seq,\n │...\n 12438│ );\n*12439│ assert_eq!(log.controller.as_ref().unwrap().attach_gen, 700, \"the generation is preserved (fix 6)\");\n 12440│\n 12441│ log.clear_controller();\n 12442│ }\n 12443│\n*12444│ /// Ownership/generation validation (ADR-0038 Amendment fix 6): the\n*12445│ /// same-identity silent re-take is for a SUCCESSOR — equal generation (the\n 12446│ /// SAME Request re-served after a dispatcher restart) or newer. A REPLAYED\n 12447│ /// stale Request — an UNFINISHED backlog row whose viewport died raw, the\n*12448│ /// shape finished-row retirement cannot see — carries an OLDER generation\n 12449│ /// than the live replacement controller and must be REFUSED busy, never\n 12450│ /// silently steal the slot. `0` on either side keeps the N-1/local legacy\n 12451│ /// re-take (a legacy peer must not be locked out).\n*12452│ // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12453│ #[test]\n*12454│ fn same_identity_resubscribe_refuses_a_stale_generation() {\n 12455│ let (live, _client_a, _recv_a) = controller_socket_pair();\n 12456│ let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12457│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12458│\n*12459│ // The live replacement controller holds the slot at generation 200.\n*12460│ let out = log.resolve_subscribe(\n 12461│ Arc::clone(&live),\n 12462│ 0,\n 12463│ AttachIntent::Control,\n │...\n 12467│\n*12468│ // A replayed stale Request (same identity, OLDER generation) is\n 12469│ // refused busy — the incumbent is untouched.\n*12470│ let out = log.resolve_subscribe(\n 12471│ Arc::clone(&stale),\n 12472│ 0,\n 12473│ AttachIntent::Control,\n │...\n 12476│ let SubscribeOutcome::BusyControlled { by } = out else {\n*12477│ panic!(\"a stale same-identity generation must refuse busy, got {out:?}\");\n 12478│ };\n 12479│ assert_eq!(by, \"op\");\n 12480│ let c = log.controller.as_ref().expect(\"incumbent survives\");\n │...\n 12483│\n*12484│ // EQUAL generation = the same Request reconstructed (dispatcher\n 12485│ // restart) — the silent re-take stays allowed.\n*12486│ let out = log.resolve_subscribe(\n 12487│ Arc::clone(&stale),\n 12488│ 0,\n 12489│ AttachIntent::Control,\n │...\n 12494│\n*12495│ // Generation 0 (local / N-1 legacy) keeps the legacy silent re-take —\n 12496│ // even against a non-zero incumbent.\n*12497│ let out = log.resolve_subscribe(\n 12498│ Arc::clone(&live),\n 12499│ 0,\n 12500│ AttachIntent::Control,\n │...\n 12509│ /// mid-serve resume-from-floor (`read_controller_event_resuming`) carries\n*12510│ /// its OWN generation — the SAME Request re-fetching dropped frames. The\n 12511│ /// equal-gen re-take must PRESERVE the incumbent `attach_gen`, so that\n 12512│ /// (a) a stale replayed Request is STILL refused after the resume, and\n 12513│ /// (b) the worker's terminal `detach_session_gen(Some(serve_gen))` still\n │...\n 12519│ /// until conn drop).\n*12520│ // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12521│ #[test]\n*12522│ fn gap_resume_resubscribe_preserves_the_generation_against_stale_replay() {\n 12523│ let (worker, _client_a, _recv_a) = controller_socket_pair();\n 12524│ let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12525│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12526│\n*12527│ // The serve worker attaches with its generation (serve_gen = 200).\n*12528│ let out = log.resolve_subscribe(\n 12529│ Arc::clone(&worker),\n 12530│ 0,\n 12531│ AttachIntent::Control,\n │...\n 12536│ // Mid-serve gap resume: the SAME worker re-subscribes from its floor\n*12537│ // carrying the SAME generation (what the fixed helper now sends).\n*12538│ let out = log.resolve_subscribe(\n 12539│ Arc::clone(&worker),\n 12540│ 3,\n 12541│ AttachIntent::Control,\n │...\n 12547│ 200,\n*12548│ \"the resume preserves the incumbent generation (gen=0 here re-armed the steal)\"\n 12549│ );\n 12550│\n 12551│ // (a) A stale replayed Request is STILL refused after the resume.\n*12552│ let out = log.resolve_subscribe(\n 12553│ Arc::clone(&stale),\n 12554│ 0,\n 12555│ AttachIntent::Control,\n │...\n 12563│\n*12564│ // (b) The worker's terminal generation-validated release still clears.\n 12565│ log.detach_if_gen(&worker, Some(200));\n 12566│ assert!(\n 12567│ log.controller.is_none(),\n │...\n 12572│ /// The release half of fix 6: a STALE serve worker's late detach\n*12573│ /// (generation mismatch) never clears the (newer) controller — but its\n*12574│ /// viewer rows still clean up by ptr identity. A matching generation and\n 12575│ /// the `None` (N-1 / conn-cleanup) path keep today's clearing behavior.\n 12576│ /// This is also the LATE-CLOSE IDENTITY guard ConnectionBound teardown\n 12577│ /// rides (ADR-0040 decision 6): a stale opener A's conn-death FIN reaches\n 12578│ /// `detach_session_gen(serve_gen_A)` and can never evict newer controller B.\n*12579│ // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12580│ // [unit->REQ-STREAM-LEASE-CLASSES]\n 12581│ #[test]\n*12582│ fn stale_generation_detach_never_clears_the_newer_controller() {\n 12583│ let (send, _client, _recv) = controller_socket_pair();\n 12584│ let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12585│ log.become_controller(Arc::clone(&send), Some(\"op\".into()), 0, 200);\n │...\n 12587│ // A stale worker's late release (gen 100 vs incumbent 200): the\n*12588│ // controller survives; the same conn's viewer rows still ptr-clean.\n 12589│ log.add_viewer(Arc::clone(&send), 0, None);\n 12590│ assert_eq!(log.viewers.len(), 1);\n 12591│ log.detach_if_gen(&send, Some(100));\n │...\n 12593│ log.controller.is_some(),\n*12594│ \"a stale-generation release must not clear the live controller\"\n 12595│ );\n 12596│ assert!(log.viewers.is_empty(), \"viewer rows still clean up by ptr\");\n 12597│\n*12598│ // The matching generation releases normally.\n 12599│ log.detach_if_gen(&send, Some(200));","truncation":{"content":" 264| /// Which claim this is. A holder that was taken over as wedged may still\n*265| /// complete later and drop its guard; the generation is what stops that late\n 266| /// drop from releasing the claim that REPLACED it, which would re-open the\n 267| /// double-create window one wake later.\n*268| generation: u64,\n 269| /// The last spawn phase this holder stamped, and when.\n 270| phase: String,\n 271| phase_at: Instant,\n...\n 279|///\n*280|/// It releases ONLY ITS OWN GENERATION — see [`release_claim`].\n 281|struct WakeClaimGuard<'a> {\n 282| map: &'a Mutex>,\n 283| endpoint: String,\n*284| generation: u64,\n 285|}\n 286|\n 287|impl Drop for WakeClaimGuard<'_> {\n 288| fn drop(&mut self) {\n*289| release_claim(&mut recover(self.map), &self.endpoint, self.generation);\n 290| }\n 291|}\n 292|\n*293|/// Release a claim only if the entry still belongs to `generation`.\n 294|///\n 295|/// THE CASE THIS EXISTS FOR: a wedged holder is taken over, the new claimant\n*296|/// holds generation N+1, and the old holder finally completes and drops. A\n*297|/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298|/// is still in flight, so the next duplicate wake sails through the gate —\n 299|/// re-opening, one wake later, exactly the double-create this guard exists to\n 300|/// close. Pure over the map so the no-op is a unit.\n*301|fn release_claim(map: &mut HashMap, endpoint: &str, generation: u64) {\n*302| if map.get(endpoint).is_some_and(|c| c.generation == generation) {\n 303| map.remove(endpoint);\n 304| }\n 305|}\n...\n 528|// [impl->REQ-INPUT-CONTROLLER-FENCE]\n*529|fn rc_input_rejected(minter: Option, sender_is_controller: bool) -> bool {\n 530| minter == Some(Minter::Rc) && !sender_is_controller\n 531|}\n 532|\n...\n 583|/// The coordinator-image announce gate (F-025 amendment): accept ONLY an announce\n*584|/// whose generation is exactly the brain child this process currently supervises.\n 585|/// `supervised = None` (no brain spawned by this process) accepts nothing.\n 586|///\n 587|/// Pure so the discriminator is unit-testable without a live brain — it is the\n...\n 598|/// The coordinator-image read gate (F-025 amendment): a recorded\n*599|/// `(generation, version)` answers only while its generation is STILL the\n 600|/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601|/// reported — rather than the version of a process that no longer exists, so the\n 602|/// surface never outlives the process it describes (the stale-record class that\n...\n 609| record\n*610| .filter(|(generation, _)| supervised == Some(*generation))\n 611| .map(|(_, version)| version.clone())\n 612|}\n 613|\n...\n 834| send: SharedSend,\n*835| /// The controller's ATTACH GENERATION (ADR-0038 Amendment fix 6,\n*836| /// REQ-SERVE-OWNERSHIP-GENERATION): operator-minted wall-ms from the wire\n 837| /// Request (`0` = local / N-1). A same-identity re-take with an OLDER\n*838| /// generation is a replayed stale Request — refused; a stale worker's\n*839| /// late detach (older generation) never clears a newer controller.\n 840| attach_gen: u64,\n 841| /// The `from_seq` this seat was ESTABLISHED with — the fourth element of the\n 842| /// idempotent-replay key (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY).\n*843| /// A same-conn/same-gen subscribe carrying the SAME `from_seq` is a replay of\n 844| /// the establish already honored (the dispatcher's double-serve); one carrying\n 845| /// a DIFFERENT `from_seq` is the controller GAP RESUME re-fetching dropped\n 846| /// frames from its frozen floor (REQ-HAZARD-CONTROLLER-GAP-RESUME), which must\n...\n 871| /// The writer's IN-FLIGHT socket-write marker (LIFECYCLE-TRUTH W2,\n*872| /// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): the `controller_writer` sets it to\n 873| /// `Some(Instant::now())` immediately BEFORE it enters a blocking `write_frame`\n 874| /// and back to `None` the instant the write returns. A reader\n 875| /// ([`OutputLog::controller_stalled`]) sees a `Some` older than\n...\n 1017| controller: Option,\n*1018| /// Monotonic controller generation, shared with the live `controller_writer`\n 1019| /// thread (`Arc`). Bumped on every [`become_controller`]; the\n 1020| /// drain's deadline-evict ([`mark_controller_gone`]) carries the epoch it\n 1021| /// observed and only detaches if it still matches — so a slow-controller\n...\n 1144|/// Per-endpoint stamp-transition serial (ADR-0041 decision 4,\n*1145|/// REQ-CONTROL-STAMP-CONVERGENCE): the generation counter a definitive\n 1146|/// no-session truth (the exit-waiter reap) BUMPS, and a poll-derived stamp\n 1147|/// write VALIDATES against — so a `KIND_SESSIONS` snapshot taken PRE-reap can\n 1148|/// never relatch `controlled=true` after the reap cleared it (the session is\n...\n 1182|///\n*1183|/// `snap_gen` is the endpoint's stamp generation AT SNAPSHOT time (ADR-0041\n 1184|/// decision 4): the write is refused — loud, nothing written — when the\n*1185|/// generation has advanced since (an exit-waiter reap landed between our\n 1186|/// under-lock snapshot and this off-lock write; the snapshot is stale truth\n 1187|/// about a session that no longer exists). Validation + write run under the\n 1188|/// endpoint's stamp-write serial so the reap can never interleave the pair.\n...\n 1223| if control || viewer {\n*1224| // The two IN-MEMORY reap paths (`reap_dead_controller`, the stall-evict)\n 1225| // deliberately do not stamp under the log lock, so their attachment edge\n 1226| // becomes true HERE and nowhere else — signal it, or a controller that\n 1227| // died with its conn would leave a stale attachment frame standing until\n...\n 1235| // The THIRD engine-room drop edge (ADR-0052 §3a). The two in-memory\n*1236| // reap paths (`reap_dead_controller`, the stall-evict) deliberately do\n 1237| // NOT stamp under the log lock, so they never reach `clear_controller`;\n 1238| // this off-lock converge is where their release becomes true. Keying on\n 1239| // the recorded truth going FALSE means a controller that died with the\n...\n 1454| /// b4 (REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE): W1 moved the\n*1455| /// controller SOCKET WRITE off the drain (the `controller_writer` thread) but\n 1456| /// left the HANDOFF as an inline sleep-poll (`ControllerJob::deliver`, up to\n 1457| /// `CONTROLLER_WRITE_DEADLINE`) ON the drain — so a controller draining slower\n 1458| /// than the PTY floods filled its channel, the inline poll throttled the drain,\n...\n 1601| /// or `None` when undriven. The `by`-keyed ownership logic in\n*1602| /// [`resolve_subscribe`] reads this.\n 1603| fn controller_by(&self) -> Option<&str> {\n 1604| self.controller.as_ref().and_then(|c| c.by.as_deref())\n 1605| }\n...\n 1756| // `Unredeemed` and returned a REFUSAL that unseated the human mid-session\n*1757| // (measured on golden 32341702157, Linux leg: seat, same-conn re-serve\n 1758| // ~700ms later with `req_gen` unchanged, `engine-room-admit-unredeemed`,\n 1759| // `session-detach was_controller=true`).\n 1760| //\n 1761| // THE ORDER SWAP IS NOT A WIDENING, and the reason is the same one this\n*1762| // module already gives for why an attach GENERATION cannot be the\n*1763| // discriminator: a generation is a wall-ms number an agent on this box\n 1764| // can guess, while a broker CONNECTION id belongs to another process's\n 1765| // socket and cannot be claimed by asking (see\n 1766| // [`spt_store::engineroom::bringup_required`]). So the only attach this\n...\n 2593| // Drop the prior controller sink first (its writer's live loop ends when\n*2594| // tx drops), and bump the generation so (a) an in-flight deadline-evict\n 2595| // for the old controller can't unseat this one and (b) a prior writer\n 2596| // still flushing its initial batch returns before its next frame.\n 2597| // Attribution (F-039 legs b+d): the replaced conn's record names its\n...\n 2662| let writer = thread::spawn(move || {\n*2663| controller_writer(\n 2664| sid,\n 2665| writer_send,\n 2666| initial,\n...\n 2691| // The seat changed hands (or was filled): the incoming controller does\n*2692| // not inherit the outgoing one's authority. An equal-generation re-serve\n 2693| // is the SAME lease and keeps it.\n 2694| self.on_control_edge(prev_gen, Some(attach_gen));\n 2695| }\n...\n 2760| // [impl->REQ-CONTROLLER-LIVENESS-REAP]\n*2761| fn reap_dead_controller(&mut self) -> bool {\n 2762| let dead = self\n 2763| .controller\n 2764| .as_ref()\n...\n 2782| /// timed out its `send_timeout`. Detach it — but ONLY if it is still the same\n*2783| /// controller generation the drain saw (`epoch`), so a NEWER controller that\n 2784| /// attached during the stall is never unseated.\n 2785| fn mark_controller_gone(&mut self, epoch: u64) {\n 2786| if self.controller_epoch.load(Ordering::Acquire) == epoch {\n...\n 2807| /// Whether this session's controller is the brain's OWN LOCAL conn (`by: None`)\n*2808| /// AND wedged past `deadline` — the brain-generation promotion DRAINED gate reads\n*2809| /// it (REQ-UPDATE-PROMOTE-DRAINED). A killed OLD brain generation whose local\n 2810| /// controller conn is black-holed reads wedged here until the W2 stall-evict\n 2811| /// releases it (or the conn EOFs); a cleanly-closed conn is simply absent. A\n 2812| /// REMOTE operator's wedged conn (`by: Some`) is the W2 stall-evict concern, NOT\n...\n 2932| /// Production always goes through\n*2933| /// [`resolve_subscribe_gated`](Self::resolve_subscribe_gated) — the broker\n 2934| /// asks what the presented secret is on every subscribe, and the usual\n 2935| /// answer is \"not a ticket\". This wrapper exists so the exemption is\n 2936| /// something a caller must ASK for rather than something it can forget to\n...\n 2939| #[cfg(test)]\n*2940| fn resolve_subscribe(\n 2941| &mut self,\n 2942| sub: SharedSend,\n 2943| from_seq: u64,\n...\n 2948| ) -> SubscribeOutcome {\n*2949| self.resolve_subscribe_gated(sub, from_seq, intent, by, gen, code, AdmitTicket::None, false)\n 2950| .0\n 2951| }\n 2952|\n*2953| /// [`resolve_subscribe`](Self::resolve_subscribe) carrying the broker's\n 2954| /// verdict on a bring-up admit ticket presented for this exact session.\n 2955| // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n 2956| #[allow(clippy::too_many_arguments)]\n*2957| fn resolve_subscribe_gated(\n 2958| &mut self,\n 2959| sub: SharedSend,\n 2960| from_seq: u64,\n...\n 2968| // OBS RIDER leg 1 (ALWAYS-ON pin): one structured breadcrumb per subscribe\n*2969| // decision — ids/generations only, never PTY bytes. Rides the daemon stderr\n 2970| // sink (F-039 shape) → daemon.stderr.log. The incumbent snapshot is captured\n 2971| // BEFORE the decision runs (become_controller overwrites the controller slot\n 2972| // inside the inner call); a supersession is derivable downstream as\n...\n 2989| let mut seat_cred = None;\n*2990| let (outcome, decision) = self.resolve_subscribe_inner_gated(\n 2991| sub,\n 2992| from_seq,\n 2993| intent,\n...\n 3030| /// The W2.5 subscribe decision kernel — wrapped by\n*3031| /// [`OutputLog::resolve_subscribe`], which emits the always-on decision\n 3032| /// breadcrumb around it. See that wrapper for the field/observability contract.\n 3033| ///\n 3034| /// Returns the wire [`SubscribeOutcome`] AND the breadcrumb decision label;\n...\n 3037| /// The no-admit spelling of the inner kernel (see\n*3038| /// [`resolve_subscribe`](Self::resolve_subscribe) for why it stays).\n 3039| #[cfg(test)]\n*3040| fn resolve_subscribe_inner(\n 3041| &mut self,\n 3042| sub: SharedSend,\n 3043| from_seq: u64,\n...\n 3048| ) -> (SubscribeOutcome, &'static str) {\n*3049| self.resolve_subscribe_inner_gated(\n 3050| sub,\n 3051| from_seq,\n 3052| intent,\n...\n 3060|\n*3061| /// [`resolve_subscribe_inner`](Self::resolve_subscribe_inner) with the\n 3062| /// admit-ticket verdict carried through to the seat gate.\n 3063| ///\n 3064| /// `seat_cred` is an OUT-PARAM, deliberately, and it is the only thing about\n...\n 3072| #[allow(clippy::too_many_arguments)]\n*3073| fn resolve_subscribe_inner_gated(\n 3074| &mut self,\n 3075| sub: SharedSend,\n 3076| from_seq: u64,\n...\n 3124| if same_identity {\n*3125| // The GENERATION LADDER over the (by, nonzero attach_gen) LOGICAL\n 3126| // LEASE (ADR-0044 decision 1 + the 2026-07-18 ladder ruling over\n*3127| // the ADR-0038 fix-6 generation): node identity alone is NEVER a\n 3128| // lease — two same-node viewports are DISTINCT controllers,\n*3129| // discriminated by their generations; within one identity the\n*3130| // generation stays the LIFECYCLE discriminator.\n 3131| // gen == incumbent (nonzero) → the SAME lease re-served after a\n 3132| // dispatcher restart — the fix-6 successor, silent (gate #7).\n 3133| // gen < incumbent (nonzero) → a REPLAYED stale Request (an\n...\n 3145| // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n*3146| // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3147| let incumbent_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n 3148| let incumbent_conn = self.controller.as_ref().map(|c| c.send.id());\n*3149| // IDEMPOTENT REPLAY — the new leaf INSIDE the equal-generation rung\n 3150| // (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY). Same identity,\n*3151| // same NONZERO generation, and the SAME CONNECTION as the incumbent\n 3152| // seat means this is a replay of the establish we already honored, not\n 3153| // a successor: the seat and its writer are PRESERVED, no\n 3154| // `controller-replaced` fires, and no second initial batch is\n...\n 3160| // prior seat. Designed for a DEAD seat after a dispatcher restart, it\n*3161| // fired against the same LIVE conn: the lease killed its own writer\n 3162| // (channel-closed) and the rc viewport froze until a manual\n 3163| // detach + re-attach. \"spt update freezes every attached PTY.\"\n 3164| //\n*3165| // Equal generation on a DIFFERENT conn keeps today's silent swap — that\n 3166| // is the designed ADR-0038 fix-6 successor (the old seat is dead and the\n 3167| // lease is being re-served on a fresh carrier), and it must not regress.\n 3168| // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n...\n 3170| // The key includes `from_seq` because core itself re-subscribes on the\n*3171| // SAME conn with the SAME generation for a legitimate reason: the\n 3172| // controller GAP RESUME (REQ-HAZARD-CONTROLLER-GAP-RESUME,\n 3173| // `read_controller_event_resuming`) re-fetches dropped frames from its\n 3174| // frozen `delivered_through` floor. That request is NOT a replay of the\n...\n 3188| // Same lease (or legacy) that is NOT a replay of the establish:\n*3189| // a different conn (the fix-6 successor) or the SAME conn asking\n 3190| // from a different floor (the gap-resume re-fetch above). Silent\n 3191| // re-take either way, NEVER Displaced.\n 3192| self.become_controller(sub, by, from_seq, gen);\n...\n 3498| /// `driven_by` / `viewer_count` when a role actually changed.\n*3499| /// Generation-validated detach (ADR-0038 Amendment fix 6): `Some(g)` with\n*3500| /// a controller whose generation differs = a STALE worker's late release —\n 3501| /// the controller slot is left alone (viewer rows still clean up by ptr).\n 3502| /// `None` (N-1 / conn-cleanup) = today's ptr-identity behavior.\n*3503| // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n 3504| fn detach_if_gen(&mut self, sub: &SharedSend, gen: Option) {\n 3505| if let (Some(g), Some(c)) = (gen, self.controller.as_ref()) {\n 3506| if c.attach_gen != g {\n*3507| // Stale generation: never clears the (newer) controller.\n 3508| let before = self.viewers.len();\n 3509| self.viewers.retain(|_, sink| !Arc::ptr_eq(&sink.send, sub));\n 3510| if self.viewers.len() != before {\n...\n 3563| /// `driven_by` remote-only. The client's own-node vs remote guidance display\n*3564| /// (`rc.rs` `driver_phrase`) reads this verbatim stamp; the W2 generation\n 3565| /// ladder governs same-identity viewports at the broker, below that gate.\n 3566| // [impl->REQ-RCVIEW-1] [impl->REQ-REACH-1]\n 3567| fn stamp_driven_by(&self) {\n...\n 3647| // ADR-0041 decision 4: a reap is a DEFINITIVE no-session truth — bump\n*3648| // the endpoint's stamp generation UNDER the stamp-write serial, then\n 3649| // clear. A KIND_SESSIONS poll that snapshotted this session PRE-reap now\n*3650| // fails its generation check and can never relatch `controlled=true`\n 3651| // onto the perch of a session that no longer exists (the emphasys C3\n 3652| // poll-vs-reap window: no later poll would ever heal the latch).\n 3653| let slot = stamp_slot(&self.endpoint);\n...\n 3909|#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\n*3910|fn controller_writer(\n 3911| sid: u64,\n 3912| send: SharedSend,\n 3913| initial: Vec<(u64, Vec)>,\n...\n 4179|/// is the invariant, not its exact value.\n*4180|fn input_queue_depth() -> usize {\n 4181| match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\n 4182| Ok(n) => n\n 4183| .parse::()\n...\n 4217| /// whose PTY write handle this thread now exclusively owns.\n*4218| fn spawn(session: Arc, endpoint: String) -> Arc {\n 4219| let (tx, rx) = sync_channel::(input_queue_depth());\n 4220| let writer = thread::spawn(move || input_writer(session, rx));\n 4221| Arc::new(InputWriter {\n...\n 4234| // [impl->REQ-HAZARD-PTY-INPUT-WRITER-WEDGE]\n*4235| fn enqueue(&self, bytes: InputRecord) -> bool {\n 4236| match self.tx.try_send(bytes) {\n 4237| Ok(()) => {\n 4238| // Heal: input is flowing again — clear a prior backpressure stamp.\n...\n 4273|/// when the last `tx` clone drops at session teardown.\n*4274|fn input_writer(session: Arc, rx: Receiver) {\n 4275| while let Ok(bytes) = rx.recv() {\n 4276| let _ = session.write_input(&bytes);\n 4277| }\n...\n 4587|\n*4588|fn flush_inject_floor(floor: &Mutex, input: &InputWriter) {\n 4589| loop {\n 4590| let chunk = lock_floor(floor).take_or_release();\n 4591| match chunk {\n...\n 4756|// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n*4757|fn settle_before_inject(input: &InputWriter, log: &Mutex, endpoint: &str) -> bool {\n 4758| let baseline = recover_log(log).high_water();\n 4759| let deadline = Instant::now() + inject_settle_deadline();\n 4760| loop {\n...\n 4842|// [impl->REQ-INJECT-MULTILINE-INTEGRITY]\n*4843|fn enqueue_text_chunked(input: &InputWriter, bytes: Vec) {\n 4844| chunk_text(&bytes, inject_text_chunk(), |part| {\n 4845| input.enqueue(part.to_vec());\n 4846| });\n...\n 5291| wake_inflight: Mutex>,\n*5292| /// Monotonic claim generation (#235). Handed to each claim so a taken-over\n 5293| /// holder's late RAII drop cannot release its successor's claim.\n*5294| wake_generation: AtomicU64,\n 5295| /// Live per-connection handler-thread tally: incremented on [`handle_conn`]\n 5296| /// entry, decremented (RAII, panic-safe) when the handler returns. The\n 5297| /// UPDATE-WEDGE round-4 int gate's observability seam\n...\n 5302| /// The COORDINATOR image the supervised brain announced, as\n*5303| /// `(generation, version)` (F-025 amendment, FIELD-TRUTH W1). Recorded only\n*5304| /// when the announced generation matches the child the supervisor currently\n 5305| /// runs, and answered only while it STILL matches — so a record from a\n*5306| /// replaced generation stops being reported the instant its successor is\n 5307| /// spawned, without needing a clearing signal from the dying brain.\n 5308| /// In-memory by design: the running image is a property of a live process,\n 5309| /// and a durable copy would be exactly the outlives-its-process staleness\n...\n 5596| wake_inflight: Mutex::new(HashMap::new()),\n*5597| wake_generation: AtomicU64::new(0),\n 5598| conn_handlers: AtomicUsize::new(0),\n 5599| coordinator_image: Mutex::new(None),\n 5600| bringup_admits: Mutex::new(HashMap::new()),\n...\n 5910| /// trip) promotes a ready update candidate only once this reads `false`: an OLD\n*5911| /// generation whose local controller conn is black-holed reads wedged until the W2\n 5912| /// stall-evict releases it, so `brain.ready` inside the 15 s window can no longer\n 5913| /// promote onto a still-frozen control plane (the 22:47 false-promote). A cleanly-\n 5914| /// closed old conn is simply absent → `false` at once (the normal fast promote).\n...\n 6214| viewers: u32,\n*6215| // The endpoint's stamp generation AT snapshot time\n 6216| // (ADR-0041 decision 4) — the off-lock converge below\n 6217| // validates against it so a reap that lands between\n 6218| // this snapshot and the write refuses the stale stamp.\n...\n 6234| // cleared state and the stale info.json stamp clears.\n*6235| let _ = log.reap_dead_controller();\n 6236| let stamp_gen =\n 6237| stamp_slot(&endpoint).gen.load(Ordering::Acquire);\n 6238| SessSnap {\n...\n 6357| // remote target's read pump sees EOF, `serve_attach` runs\n*6358| // `detach_session` under its own serve generation (fix-6 validated:\n 6359| // a stale opener's late close can never evict a newer controller),\n 6360| // and the controller/viewer stamps clear — then terminal-retire the\n 6361| // local row (eligibility + physical teardown, the W1 machinery).\n...\n 8017| );\n*8018| if let Some(generation) = claim_gen.get() {\n 8019| let mut inflight = recover(&self.wake_inflight);\n 8020| if let Some(claim) = inflight.get_mut(&spawn_label) {\n*8021| // Only OUR generation: a holder taken over as wedged must not\n 8022| // keep refreshing the successor's claim from behind.\n*8023| if claim.generation == generation {\n 8024| claim.phase = phase.to_string();\n 8025| claim.phase_at = Instant::now();\n 8026| }\n...\n 8101| req.endpoint,\n*8102| prev.generation,\n 8103| prev.phase,\n 8104| prev.phase_at.elapsed().as_millis(),\n 8105| phase_wedge_ceiling(&prev.phase).as_millis(),\n...\n 8107| }\n*8108| let generation =\n*8109| self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\n 8110| inflight.insert(\n 8111| req.endpoint.clone(),\n 8112| WakeClaim {\n*8113| generation,\n 8114| phase: \"gate_claimed\".to_string(),\n 8115| phase_at: Instant::now(),\n 8116| },\n 8117| );\n*8118| claim_gen.set(Some(generation));\n 8119| Gate::Claimed(WakeClaimGuard {\n 8120| map: &self.wake_inflight,\n 8121| endpoint: req.endpoint.clone(),\n*8122| generation,\n 8123| })\n 8124| }\n 8125| }\n...\n 8453| // this session at all. Clearing before removal left a window where\n*8454| // a poll snapshotted AFTER the generation bump — same generation,\n 8455| // controller slot still occupied in the log — and legitimately\n 8456| // re-wrote `controlled=true` onto the perch of a session that was\n 8457| // about to vanish (the relatch the W2 int leg caught live). The\n...\n 8565| // outlive the session in info.json (or gossip a stale controller).\n*8566| // Bumps the stamp generation under the per-endpoint write serial,\n 8567| // so any snapshot taken BEFORE the removal is refused at write time.\n 8568| // [impl->REQ-HAZARD-CONTROL-STAMP-LIFETIME]\n 8569| // [impl->REQ-CONTROL-STAMP-CONVERGENCE]\n...\n 8686| let ticket = self.redeem_bringup_admit(req.code.as_deref(), req.session_id);\n*8687| let (outcome, seat_note) = recover_log(&log).resolve_subscribe_gated(\n 8688| Arc::clone(send),\n 8689| req.from_seq,\n 8690| req.intent,\n...\n 8745| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*8746| fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8747| let req: InputReq =\n 8748| serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n 8749| let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n...\n 8763| // an rc-tagged input must come from the ACTIVE controller lease's\n*8764| // originating conn — the same conn-identity gate resize has always had\n 8765| // — so a displaced viewport can never keep typing into the PTY, no\n 8766| // matter whether its Displaced notice was delivered, delayed, or lost.\n 8767| // SCOPED to `Minter::Rc`: shell/system injection (`Minter::Shell`,\n...\n 8825| // operator/rc path sends `ack=false`: writing the ack back onto the\n*8826| // same brain↔broker conn it is flooding with input fills the return\n 8827| // direction and deadlocks the per-conn handler (the wedge). With no\n 8828| // ack the handler never writes back while servicing the flood, so it\n 8829| // always drains. The acked path (`shellchan`, one-at-a-time) still\n...\n 8934| // [impl->REQ-MSG-IDLE-TRANSLATION-BINARY]\n*8935| fn dispatch_endpoint_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8936| let req: EndpointInputReq = serde_json::from_value(env.payload)\n 8937| .map_err(|e| format!(\"bad endpoint-input payload: {e}\"))?;\n 8938| let bytes =\n...\n 9151| /// Record the COORDINATOR (brain) image self-announce (F-025 amendment), but\n*9152| /// ONLY when the announced generation is the one this process's supervisor\n 9153| /// currently runs — the discriminator the connection role cannot provide:\n 9154| /// `recv_hello(.., Role::Brain)` admits every client, the CLI's own\n 9155| /// `Brain::cold_start` included, and that client is ALWAYS freshly installed,\n...\n 9157| /// coordinator's on precisely the node whose coordinator is stale. Only the\n*9158| /// supervised child is handed a generation (on its argv, ADR-0018 V2), so\n*9159| /// only it can satisfy this — the same exact-generation discipline the D6-2\n 9160| /// readiness gate uses against a stale ready stamp.\n 9161| ///\n 9162| /// Returns the verdict to the announcer rather than staying silent so an\n...\n 9165| fn dispatch_coordinator_image_announce(&self, env: Envelope, send: &SharedSend) {\n*9166| let supervised = crate::brainproc::supervised_generation();\n 9167| let accepted = match serde_json::from_value::(env.payload) {\n*9168| Ok(a) if coordinator_announce_accepted(a.generation, supervised) => {\n 9169| *self.coordinator_image.lock().expect(\"coordinator image lock\") =\n*9170| Some((a.generation, a.version));\n 9171| true\n 9172| }\n 9173| _ => false,\n...\n 9184| /// of [`dispatch_broker_image`](Self::dispatch_broker_image) for the half that\n*9185| /// restarts on an apply. The record answers only while its generation is\n 9186| /// still the supervised one; a record left by a replaced brain reports\n 9187| /// `None` (not reported) rather than the version of a process that is gone.\n 9188| // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n...\n 9194| .as_ref(),\n*9195| crate::brainproc::supervised_generation(),\n 9196| );\n 9197| let frame = Envelope::new(\n 9198| KIND_COORDINATOR_IMAGE_REPLY,\n...\n 9692| /// the dispatcher reports a serve loop that ran to completion, and the row\n*9693| /// leaves the table so no future dispatcher generation can rediscover and\n 9694| /// replay it (the KNOWN-HAZARDS 7.41 control-steal class).\n 9695| // [impl->REQ-REDISPATCH-FINISHED-RETIRE]\n 9696| fn dispatch_net_stream_retire(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n...\n 9792| /// on the caller's attached session, so teardown never claims the\n*9793| /// controller slot and never bumps the ADR-0044 lease generation — a\n 9794| /// teardown is not a control theft.\n 9795| /// 2. **Reaps the whole DESCENDANT subtree**, not just the PTY child. The\n 9796| /// hosted tree is adapter → node → harness → nested harness + MCP\n...\n 10109| // every client hellos as `Role::Brain`, the CLI's own `Brain::cold_start`\n*10110| // included — so the generation the supervisor handed the child is the gate,\n 10111| // and a client that holds none can never pass it.\n 10112| #[test]\n*10113| fn only_the_supervised_generation_can_claim_the_coordinator_image() {\n*10114| // The supervised child's own generation is the ONLY accepted announce.\n 10115| assert!(coordinator_announce_accepted(7, Some(7)));\n*10116| // A client with no generation (the serde default 0) against a live\n 10117| // supervisor at 7 — the CLI's shape — is refused.\n 10118| assert!(!coordinator_announce_accepted(0, Some(7)));\n*10119| // ...and is refused at generation 0 too when NOTHING is supervised, so a\n 10120| // brokerless/supervisorless process cannot be talked into a coordinator.\n 10121| assert!(!coordinator_announce_accepted(0, None));\n*10122| // A brain the supervisor has already replaced (older generation) refused.\n 10123| assert!(!coordinator_announce_accepted(6, Some(7)));\n 10124|\n*10125| // The read gate: a record answers only while its generation is current.\n 10126| let record = (7u64, \"0.20.0\".to_string());\n 10127| assert_eq!(\n 10128| recorded_coordinator_image(Some(&record), Some(7)).as_deref(),\n...\n 10134| None,\n*10135| \"a superseded generation's image is NOT reported — the record must not \\\n 10136| outlive the process it describes\"\n 10137| );\n 10138| assert_eq!(\n...\n 10386| // from a PRE-reap sessions snapshot is REFUSED once a newer no-session truth\n*10387| // (the reap's generation bump) has landed — the stale poll can never relatch\n 10388| // `controlled=true` onto a perch whose session died. A snapshot taken at the\n*10389| // CURRENT generation still applies (the legitimate late-bind convergence).\n 10390| #[test]\n*10391| fn stale_snapshot_stamp_write_refused_after_reap_generation_bump() {\n 10392| crate::test_home::with_home(|_| {\n 10393| let id = \"relatch\";\n 10394| let perch = resolve_perch_path(id, ParentHint::Infer);\n...\n 10399|\n*10400| // A poll snapshots at the current generation…\n 10401| let snap_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10402| // …then the exit-waiter reap lands first: bump + clear (what\n 10403| // stamp_reaped does).\n...\n 10415| !converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, snap_gen),\n*10416| \"a pre-reap snapshot must be refused after the generation bump\"\n 10417| );\n 10418| let after = spt_store::info::read_info(&perch).unwrap();\n 10419| assert!(!after.controlled, \"controlled stays cleared (no relatch)\");\n...\n 10422|\n*10423| // A snapshot at the CURRENT generation applies — the legitimate\n 10424| // late-bind convergence must keep working.\n 10425| let fresh_gen = stamp_slot(id).gen.load(Ordering::Acquire);\n 10426| assert!(\n 10427| converge_perch_stamps(id, Some(\"PEERHEX\"), true, 2, fresh_gen),\n*10428| \"a current-generation snapshot converges normally\"\n 10429| );\n 10430| let after = spt_store::info::read_info(&perch).unwrap();\n 10431| assert!(after.controlled, \"late-bind convergence still lands\");\n...\n 10751| let mut log = OutputLog::new(9, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n*10752| let out = log.resolve_subscribe(Arc::clone(&send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10753| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10754|\n 10755| // Queue output THEN the Exit through the same fanout the exit waiter uses.\n...\n 10783|\n*10784| // [unit->REQ-CONTROLLER-LEASE-IDENTITY] The generation LADDER within one\n 10785| // node identity (ADR-0044 + the 2026-07-18 ladder ruling): a STRICTLY\n*10786| // NEWER generation — Control or Take alike — supersedes the incumbent\n 10787| // loudly (revoke marker + slot moves atomically with gen and conn; never\n 10788| // Busy-locked behind a stale-replay worker, never a silent sink swap); an\n*10789| // OLDER generation stays refused busy in BOTH intents (the ladder never\n 10790| // runs backwards).\n 10791| #[test]\n*10792| fn generation_ladder_newer_supersedes_loudly_older_refused_both_intents() {\n 10793| let (live, _ca, _ra) = controller_socket_pair();\n 10794| let (ctrl2, _cb, _rb) = controller_socket_pair();\n 10795| let (taker, _cc, _rc2) = controller_socket_pair();\n...\n 10797|\n*10798| let out = log.resolve_subscribe(Arc::clone(&live), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10799| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10800|\n 10801| // NEWER gen + plain Control → loud SUPERSESSION (the live replacement\n...\n 10804| // proven by `revoked_incumbent_writer_emits_the_terminal_displaced`.)\n*10805| let out = log.resolve_subscribe(Arc::clone(&ctrl2), 0, AttachIntent::Control, Some(\"op\".into()), 300, None);\n 10806| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10807| let c = log.controller.as_ref().expect(\"replacement holds the slot\");\n 10808| assert!(Arc::ptr_eq(&c.send, &ctrl2), \"the newer viewport superseded\");\n...\n 10814| let (stale, _c, _r) = controller_socket_pair();\n*10815| let out = log.resolve_subscribe(stale, 0, intent, Some(\"op\".into()), 250, None);\n 10816| assert!(\n 10817| matches!(out, SubscribeOutcome::BusyControlled { .. }),\n 10818| \"older-gen {intent:?} must refuse busy, got {out:?}\"\n...\n 10824| // NEWER gen + explicit Take → loud supersession, TookControl outcome.\n*10825| let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 400, None);\n 10826| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10827| let c = log.controller.as_ref().expect(\"taker holds the slot\");\n 10828| assert!(Arc::ptr_eq(&c.send, &taker));\n*10829| assert_eq!(c.attach_gen, 400, \"the slot carries the taker's lease generation\");\n 10830| // [unit->REQ-INPUT-CONTROLLER-FENCE]\n 10831| assert!(!log.is_controller(&ctrl2));\n 10832| assert!(log.is_controller(&taker));\n...\n 10849| // initial batch; the writer parks on its live queue).\n*10850| let out = log.resolve_subscribe(Arc::clone(&a_send), 0, AttachIntent::Control, Some(\"op\".into()), 200, None);\n 10851| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 10852|\n 10853| // Distinct-lease Take: the old sink drops (tx closes) and its writer\n 10854| // must write the terminal Displaced to A's conn on exit.\n*10855| let out = log.resolve_subscribe(Arc::clone(&taker), 0, AttachIntent::Take, Some(\"op\".into()), 300, None);\n 10856| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 10857|\n 10858| let env = read_frame(&mut a_client).expect(\"A's conn carries the terminal frame\");\n...\n 10870| #[test]\n*10871| fn rc_input_fence_scopes_to_rc_minted_non_controller_input_only() {\n 10872| // The field split-brain: displaced rc lease keeps typing → rejected.\n 10873| assert!(rc_input_rejected(Some(Minter::Rc), false));\n 10874| // The live lease's own input applies.\n...\n 11017| /// the ORDER test; here the TEST is the consumer, draining `rx` deterministically.\n*11018| fn test_input_writer(depth: usize) -> (InputWriter, Receiver) {\n 11019| let (tx, rx) = sync_channel::(depth);\n 11020| let w = InputWriter {\n 11021| tx,\n...\n 11037| #[test]\n*11038| fn input_writer_preserves_strict_fifo_order_through_the_sole_writer() {\n 11039| use spt_term::surface::{SessionSurface, SurfaceError, SurfaceSize};\n 11040|\n 11041| /// A stub PTY write seam: appends every `write_input` to a shared Vec, in\n...\n 11044| impl SessionSurface for RecordingSurface {\n*11045| fn write_input(&self, bytes: &[u8]) -> Result<(), SurfaceError> {\n 11046| self.0.lock().unwrap().push(bytes.to_vec());\n 11047| Ok(())\n 11048| }\n...\n 11101| #[test]\n*11102| fn input_enqueue_drops_and_stamps_on_full_then_heals_on_drain() {\n 11103| const DEPTH: usize = 3;\n 11104| // Consumer is the test; it does NOT drain until we say so → the queue fills.\n 11105| let (w, rx) = test_input_writer(DEPTH);\n...\n 12181| // `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12182| // `controller_writer`'s `send.lock()` arm → RED). ──────────────────────────\n 12183|\n 12184| /// A connected local-socket pair for the unit: bind a listener, connect a\n 12185| /// client `Stream`, accept the server `Stream`. Returns the SERVER send half\n...\n 12253| /// `if controller_epoch.load(Acquire) != epoch { return; }` inside\n*12254| /// `controller_writer`'s `send.lock()` arm and writer-A flushes its stale\n 12255| /// repaint@1; since both writers serialize on the SAME socket mutex, writer-A's\n 12256| /// seq 1 can win the first slot → the first frame read is `1`, and\n 12257| /// `assert_eq!(seqs, [2])` fails — exactly the `got stale seq` reorder this\n...\n 12261| #[test]\n*12262| fn superseded_controller_writer_is_epoch_gated_silent_one_live_writer_per_conn() {\n 12263| let (send, mut client, _recv) = controller_socket_pair();\n 12264| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12265| // Two chunks in the ring (seqs 0,1); the grid now holds their screen state.\n...\n 12320|\n*12321| /// ADR-0047 decision 3 (REQ-ATTACH-IDEMPOTENT-REPLAY) — the equal-generation\n 12322| /// rung's four cells, keyed `(by, conn, gen, from_seq)`:\n 12323| ///\n*12324| /// 1. SAME conn + same nonzero gen + same from_seq = an IDEMPOTENT REPLAY of\n 12325| /// the establish already honored: the seat and its writer are PRESERVED\n 12326| /// (no `become_controller`, so no `controller-replaced`, no second initial\n 12327| /// batch) and the breadcrumb answers `decision=idempotent`.\n...\n 12332| ///\n*12333| /// RED-first: with the same-conn discriminator removed, cell 1 runs\n 12334| /// `become_controller` against its OWN live seat — the incumbent sink is\n 12335| /// dropped, its writer exits channel-closed, and the attached rc freezes\n 12336| /// until a manual detach + re-attach. That is hertz's v0.39.4 bug 4 (\"spt\n...\n 12340| #[test]\n*12341| fn equal_generation_same_conn_is_an_idempotent_replay() {\n 12342| let (a, _client_a, _recv_a) = controller_socket_pair();\n 12343| let (b, _client_b, _recv_b) = controller_socket_pair();\n 12344| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12345|\n*12346| // Establish: conn A holds the lease at generation 500.\n 12347| let (out, decision) =\n*12348| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12349| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12350| assert_eq!(decision, \"controller\");\n 12351| let epoch_after_establish = log.controller_epoch.load(Ordering::Acquire);\n 12352|\n*12353| // CELL 1 — the dispatcher's double-serve: the SAME conn, gen, and from_seq,\n*12354| // replayed. The seat is untouched: same sink, same generation, and the\n 12355| // controller EPOCH does not move (a bump is what stops the live writer\n 12356| // mid-batch, so an unchanged epoch IS \"the writer was never disturbed\").\n 12357| let (out, decision) =\n*12358| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12359| assert!(matches!(out, SubscribeOutcome::Controller), \"the wire answer stays Controller (N-1 tolerant), got {out:?}\");\n 12360| assert_eq!(decision, \"idempotent\", \"the breadcrumb distinguishes reuse from replacement\");\n 12361| let seat = log.controller.as_ref().expect(\"the seat survives its own replay\");\n...\n 12369|\n*12370| // CELL 2 — a DIFFERENT conn at the same generation is the fix-6 successor:\n 12371| // today's silent swap must NOT regress into idempotence.\n 12372| let (out, decision) =\n*12373| log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12374| assert!(matches!(out, SubscribeOutcome::Controller), \"got {out:?}\");\n 12375| assert_eq!(decision, \"controller\", \"a different carrier is a re-serve, not a replay\");\n 12376| assert!(\n...\n 12380|\n*12381| // CELL 3 — strictly newer generation still supersedes loudly...\n 12382| let (out, decision) =\n*12383| log.resolve_subscribe_inner(Arc::clone(&a), 0, AttachIntent::Take, Some(\"op\".into()), 900, None);\n 12384| assert!(matches!(out, SubscribeOutcome::TookControl), \"got {out:?}\");\n 12385| assert_eq!(decision, \"took\");\n 12386|\n...\n 12388| let (out, decision) =\n*12389| log.resolve_subscribe_inner(Arc::clone(&b), 0, AttachIntent::Control, Some(\"op\".into()), 500, None);\n 12390| assert!(matches!(out, SubscribeOutcome::BusyControlled { .. }), \"got {out:?}\");\n 12391| assert_eq!(decision, \"busy\");\n 12392|\n...\n 12396| /// The COLLISION the `from_seq` key element exists for: core itself\n*12397| /// re-subscribes on the SAME conn with the SAME generation when a controller\n 12398| /// hits an output gap (`read_controller_event_resuming`,\n 12399| /// REQ-HAZARD-CONTROLLER-GAP-RESUME) — it re-fetches the dropped frames from\n 12400| /// its frozen `delivered_through` floor. That is NOT a replay of the establish\n...\n 12407| #[test]\n*12408| fn a_gap_resume_on_the_same_conn_is_served_not_suppressed() {\n 12409| let (worker, _client, _recv) = controller_socket_pair();\n 12410| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12411|\n*12412| let (out, decision) = log.resolve_subscribe_inner(\n 12413| Arc::clone(&worker),\n 12414| 0,\n 12415| AttachIntent::Control,\n...\n 12420|\n*12421| // The gap resume: same conn, same generation, but from the floor it has\n 12422| // since reached — a re-fetch, not a replay.\n*12423| let (out, decision) = log.resolve_subscribe_inner(\n 12424| Arc::clone(&worker),\n 12425| 12,\n 12426| AttachIntent::Control,\n...\n 12431| decision, \"controller\",\n*12432| \"a same-conn re-fetch from a DIFFERENT floor must be re-served — suppressing it strands the gap and reports a false truncation\"\n 12433| );\n 12434| assert_eq!(\n 12435| log.controller.as_ref().unwrap().establish_from_seq,\n...\n 12438| );\n*12439| assert_eq!(log.controller.as_ref().unwrap().attach_gen, 700, \"the generation is preserved (fix 6)\");\n 12440|\n 12441| log.clear_controller();\n 12442| }\n 12443|\n*12444| /// Ownership/generation validation (ADR-0038 Amendment fix 6): the\n*12445| /// same-identity silent re-take is for a SUCCESSOR — equal generation (the\n 12446| /// SAME Request re-served after a dispatcher restart) or newer. A REPLAYED\n 12447| /// stale Request — an UNFINISHED backlog row whose viewport died raw, the\n*12448| /// shape finished-row retirement cannot see — carries an OLDER generation\n 12449| /// than the live replacement controller and must be REFUSED busy, never\n 12450| /// silently steal the slot. `0` on either side keeps the N-1/local legacy\n 12451| /// re-take (a legacy peer must not be locked out).\n*12452| // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12453| #[test]\n*12454| fn same_identity_resubscribe_refuses_a_stale_generation() {\n 12455| let (live, _client_a, _recv_a) = controller_socket_pair();\n 12456| let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12457| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12458|\n*12459| // The live replacement controller holds the slot at generation 200.\n*12460| let out = log.resolve_subscribe(\n 12461| Arc::clone(&live),\n 12462| 0,\n 12463| AttachIntent::Control,\n...\n 12467|\n*12468| // A replayed stale Request (same identity, OLDER generation) is\n 12469| // refused busy — the incumbent is untouched.\n*12470| let out = log.resolve_subscribe(\n 12471| Arc::clone(&stale),\n 12472| 0,\n 12473| AttachIntent::Control,\n...\n 12476| let SubscribeOutcome::BusyControlled { by } = out else {\n*12477| panic!(\"a stale same-identity generation must refuse busy, got {out:?}\");\n 12478| };\n 12479| assert_eq!(by, \"op\");\n 12480| let c = log.controller.as_ref().expect(\"incumbent survives\");\n...\n 12483|\n*12484| // EQUAL generation = the same Request reconstructed (dispatcher\n 12485| // restart) — the silent re-take stays allowed.\n*12486| let out = log.resolve_subscribe(\n 12487| Arc::clone(&stale),\n 12488| 0,\n 12489| AttachIntent::Control,\n...\n 12494|\n*12495| // Generation 0 (local / N-1 legacy) keeps the legacy silent re-take —\n 12496| // even against a non-zero incumbent.\n*12497| let out = log.resolve_subscribe(\n 12498| Arc::clone(&live),\n 12499| 0,\n 12500| AttachIntent::Control,\n...\n 12509| /// mid-serve resume-from-floor (`read_controller_event_resuming`) carries\n*12510| /// its OWN generation — the SAME Request re-fetching dropped frames. The\n 12511| /// equal-gen re-take must PRESERVE the incumbent `attach_gen`, so that\n 12512| /// (a) a stale replayed Request is STILL refused after the resume, and\n 12513| /// (b) the worker's terminal `detach_session_gen(Some(serve_gen))` still\n...\n 12519| /// until conn drop).\n*12520| // [unit->REQ-SERVE-OWNERSHIP-GENERATION]\n 12521| #[test]\n*12522| fn gap_resume_resubscribe_preserves_the_generation_against_stale_replay() {\n 12523| let (worker, _client_a, _recv_a) = controller_socket_pair();\n 12524| let (stale, _client_b, _recv_b) = controller_socket_pair();\n 12525| let mut log = OutputLog::new(1, DEFAULT_LOG_CHUNKS, String::new(), (24, 80));\n 12526|\n*12527| // The serve worker attaches with its generation (serve_gen = 200).\n*12528| let out = log.resolve_subscribe(\n 12529| Arc::clone(&worker),\n 12530| 0,\n 12531| AttachIntent::Control,\n...\n 12536| // Mid-serve gap resume: the SAME worker re-subscribes from its floor\n*12537| // carrying the SAME generation (what the fixed helper now sends).\n*12538| let out = log.resolve_subscribe(\n 12539| Arc::clone(&worker),\n 12540| 3,\n 12541| AttachIntent::Control,\n...\n 12547| 200,\n*12548| \"the resume preserves the incumbent generation (gen=0 here re-armed the steal)\"\n 12549| );\n 12550|\n 12551| // (a) A stale replayed Request is STILL refused after the resume.\n*12552| let out = log.resolve_subscribe(\n 12553| Arc::clone(&stale),\n 12554| 0,\n 12555| AttachIntent::Control,\n...\n 12563|\n*12564| // (b) The worker's terminal generation-validated release still clears.\n 12565| log.detach_if_gen(&worker, Some(200));\n 12566| assert!(\n 12567| log.controller.is_none(),\n...\n 12572| /// The release half of fix 6: a STALE serve worker's late detach\n*12573| /// (generation mismatch) never clears the (newer) controller — but its\n*12574| /// viewer rows still clean up by ptr identity. A matching generation and\n 12575| /// the `None` (N-1 / conn-cleanup) path keep today's clearing behavior.\n 12576| /// This is also the LATE-CLOSE IDENTITY guard ConnectionBound teardown\n 12577| /// rides (ADR-0040 decision 6): a stale opener A's conn-death FIN reaches","truncated":true,"truncatedBy":"bytes","totalLines":923,"totalBytes":52356,"outputLines":901,"outputBytes":51141,"lastLinePartial":false,"firstLineExceedsLimit":false},"meta":{"truncation":{"direction":"head","truncatedBy":"bytes","totalLines":923,"totalBytes":52356,"outputLines":901,"outputBytes":51141,"shownRange":{"start":1,"end":901},"nextOffset":902}}},"isError":false,"timestamp":1789113814662}}
{"type":"message","id":"ca813762","parentId":"6b0db40f","timestamp":"2026-09-11T08:03:34.670Z","message":{"role":"toolResult","toolCallId":"call_oigEGugq8jBgPf0I3kih7emf|fc_07a38c9435caeae6016aa3b5d4322c87d29486a51645132709","toolName":"read","content":[{"type":"text","text":"# 0047 — Daemon lifecycle: custody identity, operator-stop authority, idempotent attach replay\n\nDate: 2026-07-22\nStatus: accepted\nAmends: ADR-0044 (controller lease ladder — equal-generation rung), REQ-DAEMON-3 (implicit daemon ensure — now yields to a standing operator stop)\n\n\n\n## Context\n\nThree v0.39.4 field regressions were RCA'd by hertz and code-verified the same day\n(2026-07-22), all in the daemon's lifecycle layer, all shipped-for-months latent\ndefects that the field finally selected:\n\n1. **False-ONLINE after core restart.** A live agent read as online while its\n session was not running. Root: `resume.pid` custody is a **bare PID** with no\n identity binding — `read_resume_pid(..).is_some_and(is_process_alive)` at both\n the restart gate and the liveness-reconcile DEFER. A dead spawn's pid, recycled\n by the OS onto an unrelated process (field proof: `resume.pid=29456` resolved\n to a random `cmd.exe`), reads as \"a resume is in flight\" forever: the reconcile\n defers every tick, the row stays online-authoritative, and no reader ever\n repairs it. The ABA problem, in process custody.\n\n2. **`daemon stop --force` non-terminal (respawn convoy).** Stopping the daemon\n spawns 5–10 ephemeral windows and the daemon is running again; it takes several\n force-stops to stay down. Root: every `spt api` invocation runs an\n **unconditional `ensure_daemon()`** (REQ-DAEMON-3's \"reliable anchor\"), and a\n box hosting live adapter sessions generates a steady stream of hook-driven api\n calls — so the stop is a race the operator loses. The rc-side twins of this bug\n were fixed earlier (rc.rs); the api anchor was left armed.\n\n3. **`spt update` freezes every attached rc PTY.** Pinned by the v0.40.0 OBS\n breadcrumbs on an authorized same-seam `daemon refresh` (falsifying the\n presumed gen+1 mechanism): during post-cycle dispatcher replay the broker\n processed the SAME conn / SAME identity / SAME generation subscribe twice\n 15 ms apart. The equal-generation rung of the ADR-0044 ladder classifies that\n as \"same lease, silent re-take\" — correct — but re-take is implemented as\n `become_controller`, which unconditionally drops the prior seat (its writer\n exits channel-closed). Designed for a dead seat after a dispatcher restart, it\n also fires against the same LIVE conn: the lease kills its own writer and the\n viewer freezes until a manual detach + re-attach.\n\nA fourth field bug (spt-hosted PTY corruption at fixed geometry) is still being\nRCA'd (hertz, on enlyzeam, isolated-rig non-repro already banked as the\nisolation-sensitivity discriminator). **Its fix rolls into this milestone as a\nlater wave when the RCA lands** (operator ruling 2026-07-22); nothing is minted\nfor it yet.\n\n## Decisions\n\n### 1. Process custody is an identity, never a bare PID\n\n\n\nA custody record that can gate lifecycle decisions (`resume.pid` first; the shape\ngeneralizes) stores an **identity pair — pid + process creation time** — written\natomically when the spawn is minted. Every consumer that today asks\n`is_process_alive(pid)` asks instead \"does a process with THIS pid AND THIS\ncreation time exist\": a recycled pid fails the pair test and reads **NOT OURS**.\n\n- **Mismatch is self-healing, not an error:** a custody record whose pair no\n longer matches a live process is DELETED by the reader that discovers it, and\n the gated decision proceeds as if no custody existed (the spawn is dead; saying\n so is the repair). No operator step.\n- **Atomic clear on the happy paths:** successful bind and spawn-reap both clear\n the custody record in the same mutation that records their own outcome — the\n record never outlives the question it answers.\n- Windows: creation time comes from the process snapshot, not from a retained\n handle (KNOWN-HAZARDS 7.50 — the asker owning a handle is exactly the unsound\n case). A platform with no snapshot yields \"unproven\", which defers ONE tick —\n it never manufactures either verdict (7.49/7.50 precedent).\n\n**Rejected:** a spawn-generation counter file next to the pid (a second file can\nskew against the first; the pair travels in one record); process-name matching\n(names collide by design — every spawn is `spt`).\n\n### 2. An operator stop outranks every implicit ensure\n\n\n\n`spt daemon stop` records a durable, machine-scoped **stop inhibit** BEFORE it\nbegins teardown. `ensure_daemon()` / `ensure_running()` — every implicit\nautostart path — consults the inhibit and, when present, **declines to spawn**,\nprinting one honest line (`daemon stopped by operator — spt daemon start to\nresume`) instead of silently resurrecting the daemon. REQ-DAEMON-3's anchor\ncontract is hereby amended: the anchor holds *except against a standing operator\nstop* — an explicit stop is operator intent, and no convenience path outranks it.\n\n- **Cleared by intent verbs only:** explicit `spt daemon start`, and the update\n paths that restart the daemon by design (`update apply --finish`). **No TTL** —\n a timeout would re-introduce the surprise respawn this decision exists to kill.\n A stale inhibit fails safe (daemon stays down, every api caller says why) and\n costs one explicit `daemon start`.\n- **Spawn serialization:** implicit autostart takes a machine-wide lock around\n probe-and-spawn, so N concurrent api calls can never launch N daemons (the\n convoy's second half — the 5–10 ephemeral windows were racing spawners).\n- `daemon stop` clears its own inhibit on teardown FAILURE exit paths only when\n it never began teardown; a partially-torn daemon with the inhibit standing is\n the correct resting state (down + honest refusals) rather than a half-up race.\n\n**Rejected:** TTL-based inhibit (surprise respawn, just later); process-scoped\ninhibit (the convoy IS cross-process); gating only `--force` (the non-force stop\nloses the same race).\n\n### 3. The equal-generation rung is idempotent for the same connection\n\n\n\nADR-0044's ladder gains a discriminator INSIDE the equal-generation rung: when a\nControl/Take subscribe carries the **same identity, same nonzero generation, AND\nthe same connection as the incumbent seat**, the broker treats it as an\n**idempotent replay** of the establish it already honored — the seat and its\nwriter are PRESERVED, no `controller-replaced` fires, no second initial batch is\nsynthesized. The subscribe decision breadcrumb answers `decision=idempotent`\n(additive vocabulary) so field captures distinguish reuse from replacement\nwithout correlating writer-exit lines.\n\n- Equal generation on a **different** connection keeps today's silent seat swap —\n that is the designed dispatcher-restart successor (ADR-0038 fix-6) where the\n old seat is dead and the lease is being re-served on a fresh carrier.\n- Strictly newer generation keeps the loud, fenced supersession; strictly older\n keeps the busy refusal. The ladder's ordering rules do not change — this is a\n new leaf inside one rung, keyed `(endpoint/session, by, conn, gen, from_seq)`.\n- **Key refinement (build-flagged, doyle-ruled 2026-07-22): `from_seq` is the\n FIFTH key element, and it is load-bearing.** Core itself re-subscribes on the\n SAME conn with the SAME generation for a legitimate reason: the controller\n gap resume (`read_controller_event_resuming`,\n REQ-HAZARD-CONTROLLER-GAP-RESUME) re-fetches dropped frames from its frozen\n `delivered_through` floor. That request is not a replay of the establish — it\n asks for different bytes — and keying on `(by, conn, gen)` alone would\n suppress it, strand the gap, and convert a recoverable gap into a false\n `ControllerIrrecoverablyBehind` truncation. A replayed establish carries the\n `from_seq` it was first honored with (`ControllerSink.establish_from_seq`); a\n re-fetch carries the floor it has since reached. **Accepted residual, stated\n honestly:** a gap with ZERO frames delivered since establish has\n `floor == establish_from_seq` and is suppressed — its consequence is a\n SURFACED truncation (never a silent lie), it needs a flood landing before any\n delivery advances the floor (not constructible in the rig), and a dedicated\n unit guards the collision cell.\n- Why the dispatcher served one held attach twice within 15 ms is a **banked\n open question** for this wave's build (it may have siblings); broker\n idempotence closes the symptom for every origin and does not wait on it.\n\n### 4. Wave map (build sequencing, not new semantics)\n\n- **W1 (dispatched now):** decisions 1–3 — the three field regressions with\n accepted RCAs. Regression legs ride each fix (see the REQ gates).\n- **W2 (registered inactive):** stream lifetime/lease classes — rc attach\n streams become ConnectionBound (FIN on opener-conn EOF) while inter-brain\n durable streams stay durable (the C2 raw-viewport leak, ADR-0038 territory) —\n and the C3 poll-vs-reap stamp-convergence race, which W1's gate must first\n re-verify still exists post-REGISTRY-LIFECYCLE. Design details are a W2 triage\n refresh against the code as it then stands, not this ADR.\n- **W3 (unminted):** the PTY-corruption fix, shaped by hertz's pending RCA.\n\n## Consequences\n\nThe daemon's lifecycle claims become custody-honest (a recycled pid can no\nlonger impersonate a live spawn), operator-honest (stop means stopped until the\noperator says otherwise), and lease-honest (a lease can no longer displace\nitself). The stop-inhibit is a deliberate behavior change to REQ-DAEMON-3's\nanchor: harness hooks on a stopped box now print a refusal instead of healing\nthe daemon — that is the point, and the message names the remedy.\n\n## Amendment 1 (2026-07-22) — W3 shaped: every resize entry rides ONE presentation barrier\n\n\n\n**The bug-3 RCA landed** (hertz, ENLYZEAM production byte capture, debug\nf31849c, same day as this ADR): the field PTY corruption is an **attach/resize\npresentation race**, not a parser or width defect. The controller attach\ndelivers the synthesized repaint at the session's OLD hosted geometry (80x24),\nthen rc's initial resize (the attach-stream verb `send_attach_resize`, ridden\nonce per viewport establish) lands the PTY + ScreenGrid on the client's real\ngeometry (131x60) — and **no resize-synchronized repaint follows**. Every\nsubsequent differential frame assumes the resized, reflowed model while the\nclient's physical screen still holds pre-resize cells; incremental keystroke\npaints expose them as the `/c`-scrap misalignment. Proof both directions:\nreplaying old-geometry repaint + post-resize frames in an independent emulator\nat 131x60 reproduces the corruption; replaying from the first post-resize full\nframe is clean; a fresh viewer (served a current-geometry repaint) is clean.\nTransport exonerated (raw-PTY and broker-frame taps byte-identical).\n\n**Why three iterations missed it:** v0.39.3/v0.39.4 built the geometry-epoch +\npresentation-barrier machinery for the IPC `ResizeReq` path — and that path is\nsound: `commit_resize` with an armed transition pushes the authoritative\nrepaint at the landed geometry. But the codebase has **two resize entries**,\nand the attach-stream resize verb never arms the barrier — it reaches the\nno-transition branch whose comment claims \"no suppression, so no sync frame\nowed\". The field capture falsifies that claim: **a geometry change invalidates\nthe client's painted cells by itself, bytes-in-flight or none.** It also\nexplains the isolated-rig non-repro (a fresh session has no stale-geometry\ncontent to expose) — isolation sensitivity resolved, not mysterious.\n\n**Decision:** geometry change is ONE transaction with ONE exit shape,\nregardless of entry: resize → grid lands → **authoritative full repaint at the\nnew geometry to every attached sink** → only then subsequent output. The\nattach-stream resize verb rides the SAME barrier machinery as `ResizeReq`\n(arm → settle → issue → commit/abort); the no-transition branch of\n`commit_resize` survives only for genuinely sink-less sessions, and its\n\"nothing owed\" claim is retired from any path with an attached sink. Ordering\nat attach specifically: a controller attach whose viewport geometry differs\nfrom the hosted geometry must not paint the old-geometry repaint as its final\nword — the initial resize's committed repaint supersedes it.\n\n**Oracle (binding, hertz's contract):** the regression replays the captured\nshape — 80x24 hosted session with content → 131x60 controller attach → the\nmenu/keystroke differential pattern — into an INDEPENDENT VT emulator and\nasserts final cells/colors. A ScreenGrid-only oracle shares the model under\ntest and MUST NOT be the sole authority (the REQ-SCREENGRID-WIDTH precedent).\n\nW3 is hereby shaped; REQ-ATTACH-RESIZE-REPAINT is minted inactive and\nactivates when W3 dispatches (sequenced behind W1 — same broker.rs seam, same\nbuilder, no parallel edits to one file).\n\n### Amendment 1 addendum (2026-07-22, same day) — scope widened: resize also corrupts the hosted terminal's INPUT discipline\n\n\n\nA second production capture (operator resized the EXISTING rc window live;\nhertz froze the taps) amends the RCA's scope two ways:\n\n1. **Not attach-limited.** A mid-session resize of an established viewport\n reproduces immediately — the presentation-ordering defect above applies to\n any geometry change, which the \"one transaction, any entry\" decision already\n covers.\n2. **A second, direct mechanism:** after the resize, the RAW ConPTY drain\n emits the operator's keystrokes as isolated OUTPUT records — literal\n one-byte `c`/`o`/`n`/`f`/`i` frames interleaved with the TUI's\n cursor-addressed diffs (raw and broker taps byte-identical, so this is the\n hosted terminal echoing, not transport or parser). The screenshot's\n `/c/config` line is exactly this unintended echo colliding with the menu's\n own `/config` cell paint. The hosted TUI runs raw/no-echo; something across\n the resize path re-enables console echo on the nested ConPTY — a path\n non-spt sessions do not traverse. spt-core never touches console input\n modes anywhere in-tree, so the alteration happens inside the\n portable_pty/ConPTY resize seam and is currently UNINSTRUMENTED.\n\n**Decision (investigation-shaped, not root-guessed):** W3 instruments Windows\nconsole input mode across the surface resize (`spt-term` pty resize) and\nimmediately before `write_input`, verifies `ENABLE_ECHO_INPUT` /\n`ENABLE_LINE_INPUT` remain disabled across a resize, and restores/asserts the\nmode if the seam proves to reset it. The echo mechanism is the likely `/c`\nproducer; the ordering fix above remains necessary on its own evidence. The\nregression gains hertz's second leg: active hosted TUI, resize 80x24→131x60,\ntype `/config` — raw PTY output must contain TUI frames and ZERO standalone\nechoed input bytes, and independent-VT final cells must equal ScreenGrid.\n\n## Amendment 2 (2026-07-22) — W3 bisect: mechanism 1's root is the rc CLIENT's console mode, not the broker seam\n\n\n\n\nAmendment 1 named a code root for the field `/c/config` corruption (\"the\nattach-stream resize never arms the barrier\"). **That root is RETRACTED.** The\nW3 bisect falsified it three independent ways and then pinned the real one.\nAbsence of a root in the seam we were auditing is a finding, not the absence of\none — and the mechanism the bisect exposed turned out to BE the answer.\n\n### What the bisect proved\n\nThree isolated probes, each removing one thing:\n\n1. **Our seam alone.** `ScreenGrid::new(24,80)` → advance(PRE window) →\n `resize(60,131)` → advance(POST window) → `render_repaint()`, rendered in\n `avt` against the authority built from the same file bytes: **0 divergent\n rows.** The grid, the resize and the repaint synthesis are byte-clean over\n the field capture.\n2. **The vehicle alone.** `capture-player` under a real ConPTY at a FIXED\n 60x131 — no broker, no grid, no attach, **no resize at all** — reproduced\n the ENTIRE observed divergence: one row, row 52, the exact field string\n (`\"/c/config\"` where the capture says `\" /config\"`). 100% of the red, with\n zero spt code in the path.\n3. **The mechanism, minimally.** `ESC[2J ESC[5;3H \"XX\" \"AB\"` renders row 6\n as `\" AB\"` in a spec VT (LF = INDEX: row down, **column preserved**) and\n as `\"AB\"` through a Windows console (LF = CR+LF: **column reset**).\n\nCapture record `t=1784714152501` is `CUP 51;3` + `EL` + SGR + a bare `0x0a`\nwith no `0x0d` + `\"/cd…\"` — a bare LF used as an index at column 3. Under the\nconsole's translation the row's paint starts at column 1 instead of 3; the\nlater absolutely-addressed writes (`ESC[52;3H\"/copy\"`, then `ESC[52;4H\"config\"`)\nrepaint from column 3 onward and never erase columns 1–2, so the `\"/c\"` residue\nsurvives to the final screen. That is the field string, derived.\n\n### The root (statically provable, no box required)\n\n`rc.rs` `with_vt_output` composes the operator console's OUTPUT mode as\n`prior | ENABLE_VIRTUAL_TERMINAL_PROCESSING | ENABLE_PROCESSED_OUTPUT`, and\n`DISABLE_NEWLINE_AUTO_RETURN` occurs **nowhere in the tree** (zero grep hits).\nWith processed output on and DNAR absent, the operator's console translates\nevery relayed bare LF into CR+LF. **The relay is byte-clean end to end and then\nour own client hands those bytes to a console configured to mangle them.** This\nis a presentation-truth defect in rc, independent of any resize.\n\nEvery prior observation collapses onto this one mechanism:\n\n- the field scraps appear at a **fixed window size** — bare-LF debris needs no\n resize, which is the no-resize interior-debris discriminator we could never\n place;\n- the **fresh-viewer-clean** contrast — a fresh attach is served the synthesized\n…\n differential stream carries them;\n…\n\n…\n\n…\nevidence is not contaminated by today's finding.\n\n[Showing lines 1-300 of 421. Use :301 to continue]"}],"details":{"truncation":{"content":"# 0047 — Daemon lifecycle: custody identity, operator-stop authority, idempotent attach replay\r\n\r\nDate: 2026-07-22\r\nStatus: accepted\r\nAmends: ADR-0044 (controller lease ladder — equal-generation rung), REQ-DAEMON-3 (implicit daemon ensure — now yields to a standing operator stop)\r\n\r\n\r\n\r\n## Context\r\n\r\nThree v0.39.4 field regressions were RCA'd by hertz and code-verified the same day\r\n(2026-07-22), all in the daemon's lifecycle layer, all shipped-for-months latent\r\ndefects that the field finally selected:\r\n\r\n1. **False-ONLINE after core restart.** A live agent read as online while its\r\n session was not running. Root: `resume.pid` custody is a **bare PID** with no\r\n identity binding — `read_resume_pid(..).is_some_and(is_process_alive)` at both\r\n the restart gate and the liveness-reconcile DEFER. A dead spawn's pid, recycled\r\n by the OS onto an unrelated process (field proof: `resume.pid=29456` resolved\r\n to a random `cmd.exe`), reads as \"a resume is in flight\" forever: the reconcile\r\n defers every tick, the row stays online-authoritative, and no reader ever\r\n repairs it. The ABA problem, in process custody.\r\n\r\n2. **`daemon stop --force` non-terminal (respawn convoy).** Stopping the daemon\r\n spawns 5–10 ephemeral windows and the daemon is running again; it takes several\r\n force-stops to stay down. Root: every `spt api` invocation runs an\r\n **unconditional `ensure_daemon()`** (REQ-DAEMON-3's \"reliable anchor\"), and a\r\n box hosting live adapter sessions generates a steady stream of hook-driven api\r\n calls — so the stop is a race the operator loses. The rc-side twins of this bug\r\n were fixed earlier (rc.rs); the api anchor was left armed.\r\n\r\n3. **`spt update` freezes every attached rc PTY.** Pinned by the v0.40.0 OBS\r\n breadcrumbs on an authorized same-seam `daemon refresh` (falsifying the\r\n presumed gen+1 mechanism): during post-cycle dispatcher replay the broker\r\n processed the SAME conn / SAME identity / SAME generation subscribe twice\r\n 15 ms apart. The equal-generation rung of the ADR-0044 ladder classifies that\r\n as \"same lease, silent re-take\" — correct — but re-take is implemented as\r\n `become_controller`, which unconditionally drops the prior seat (its writer\r\n exits channel-closed). Designed for a dead seat after a dispatcher restart, it\r\n also fires against the same LIVE conn: the lease kills its own writer and the\r\n viewer freezes until a manual detach + re-attach.\r\n\r\nA fourth field bug (spt-hosted PTY corruption at fixed geometry) is still being\r\nRCA'd (hertz, on enlyzeam, isolated-rig non-repro already banked as the\r\nisolation-sensitivity discriminator). **Its fix rolls into this milestone as a\r\nlater wave when the RCA lands** (operator ruling 2026-07-22); nothing is minted\r\nfor it yet.\r\n\r\n## Decisions\r\n\r\n### 1. Process custody is an identity, never a bare PID\r\n\r\n\r\n\r\nA custody record that can gate lifecycle decisions (`resume.pid` first; the shape\r\ngeneralizes) stores an **identity pair — pid + process creation time** — written\r\natomically when the spawn is minted. Every consumer that today asks\r\n`is_process_alive(pid)` asks instead \"does a process with THIS pid AND THIS\r\ncreation time exist\": a recycled pid fails the pair test and reads **NOT OURS**.\r\n\r\n- **Mismatch is self-healing, not an error:** a custody record whose pair no\r\n longer matches a live process is DELETED by the reader that discovers it, and\r\n the gated decision proceeds as if no custody existed (the spawn is dead; saying\r\n so is the repair). No operator step.\r\n- **Atomic clear on the happy paths:** successful bind and spawn-reap both clear\r\n the custody record in the same mutation that records their own outcome — the\r\n record never outlives the question it answers.\r\n- Windows: creation time comes from the process snapshot, not from a retained\r\n handle (KNOWN-HAZARDS 7.50 — the asker owning a handle is exactly the unsound\r\n case). A platform with no snapshot yields \"unproven\", which defers ONE tick —\r\n it never manufactures either verdict (7.49/7.50 precedent).\r\n\r\n**Rejected:** a spawn-generation counter file next to the pid (a second file can\r\nskew against the first; the pair travels in one record); process-name matching\r\n(names collide by design — every spawn is `spt`).\r\n\r\n### 2. An operator stop outranks every implicit ensure\r\n\r\n\r\n\r\n`spt daemon stop` records a durable, machine-scoped **stop inhibit** BEFORE it\r\nbegins teardown. `ensure_daemon()` / `ensure_running()` — every implicit\r\nautostart path — consults the inhibit and, when present, **declines to spawn**,\r\nprinting one honest line (`daemon stopped by operator — spt daemon start to\r\nresume`) instead of silently resurrecting the daemon. REQ-DAEMON-3's anchor\r\ncontract is hereby amended: the anchor holds *except against a standing operator\r\nstop* — an explicit stop is operator intent, and no convenience path outranks it.\r\n\r\n- **Cleared by intent verbs only:** explicit `spt daemon start`, and the update\r\n paths that restart the daemon by design (`update apply --finish`). **No TTL** —\r\n a timeout would re-introduce the surprise respawn this decision exists to kill.\r\n A stale inhibit fails safe (daemon stays down, every api caller says why) and\r\n costs one explicit `daemon start`.\r\n- **Spawn serialization:** implicit autostart takes a machine-wide lock around\r\n probe-and-spawn, so N concurrent api calls can never launch N daemons (the\r\n convoy's second half — the 5–10 ephemeral windows were racing spawners).\r\n- `daemon stop` clears its own inhibit on teardown FAILURE exit paths only when\r\n it never began teardown; a partially-torn daemon with the inhibit standing is\r\n the correct resting state (down + honest refusals) rather than a half-up race.\r\n\r\n**Rejected:** TTL-based inhibit (surprise respawn, just later); process-scoped\r\ninhibit (the convoy IS cross-process); gating only `--force` (the non-force stop\r\nloses the same race).\r\n\r\n### 3. The equal-generation rung is idempotent for the same connection\r\n\r\n\r\n\r\nADR-0044's ladder gains a discriminator INSIDE the equal-generation rung: when a\r\nControl/Take subscribe carries the **same identity, same nonzero generation, AND\r\nthe same connection as the incumbent seat**, the broker treats it as an\r\n**idempotent replay** of the establish it already honored — the seat and its\r\nwriter are PRESERVED, no `controller-replaced` fires, no second initial batch is\r\nsynthesized. The subscribe decision breadcrumb answers `decision=idempotent`\r\n(additive vocabulary) so field captures distinguish reuse from replacement\r\nwithout correlating writer-exit lines.\r\n\r\n- Equal generation on a **different** connection keeps today's silent seat swap —\r\n that is the designed dispatcher-restart successor (ADR-0038 fix-6) where the\r\n old seat is dead and the lease is being re-served on a fresh carrier.\r\n- Strictly newer generation keeps the loud, fenced supersession; strictly older\r\n keeps the busy refusal. The ladder's ordering rules do not change — this is a\r\n new leaf inside one rung, keyed `(endpoint/session, by, conn, gen, from_seq)`.\r\n- **Key refinement (build-flagged, doyle-ruled 2026-07-22): `from_seq` is the\r\n FIFTH key element, and it is load-bearing.** Core itself re-subscribes on the\r\n SAME conn with the SAME generation for a legitimate reason: the controller\r\n gap resume (`read_controller_event_resuming`,\r\n REQ-HAZARD-CONTROLLER-GAP-RESUME) re-fetches dropped frames from its frozen\r\n `delivered_through` floor. That request is not a replay of the establish — it\r\n asks for different bytes — and keying on `(by, conn, gen)` alone would\r\n suppress it, strand the gap, and convert a recoverable gap into a false\r\n `ControllerIrrecoverablyBehind` truncation. A replayed establish carries the\r\n `from_seq` it was first honored with (`ControllerSink.establish_from_seq`); a\r\n re-fetch carries the floor it has since reached. **Accepted residual, stated\r\n honestly:** a gap with ZERO frames delivered since establish has\r\n `floor == establish_from_seq` and is suppressed — its consequence is a\r\n SURFACED truncation (never a silent lie), it needs a flood landing before any\r\n delivery advances the floor (not constructible in the rig), and a dedicated\r\n unit guards the collision cell.\r\n- Why the dispatcher served one held attach twice within 15 ms is a **banked\r\n open question** for this wave's build (it may have siblings); broker\r\n idempotence closes the symptom for every origin and does not wait on it.\r\n\r\n### 4. Wave map (build sequencing, not new semantics)\r\n\r\n- **W1 (dispatched now):** decisions 1–3 — the three field regressions with\r\n accepted RCAs. Regression legs ride each fix (see the REQ gates).\r\n- **W2 (registered inactive):** stream lifetime/lease classes — rc attach\r\n streams become ConnectionBound (FIN on opener-conn EOF) while inter-brain\r\n durable streams stay durable (the C2 raw-viewport leak, ADR-0038 territory) —\r\n and the C3 poll-vs-reap stamp-convergence race, which W1's gate must first\r\n re-verify still exists post-REGISTRY-LIFECYCLE. Design details are a W2 triage\r\n refresh against the code as it then stands, not this ADR.\r\n- **W3 (unminted):** the PTY-corruption fix, shaped by hertz's pending RCA.\r\n\r\n## Consequences\r\n\r\nThe daemon's lifecycle claims become custody-honest (a recycled pid can no\r\nlonger impersonate a live spawn), operator-honest (stop means stopped until the\r\noperator says otherwise), and lease-honest (a lease can no longer displace\r\nitself). The stop-inhibit is a deliberate behavior change to REQ-DAEMON-3's\r\nanchor: harness hooks on a stopped box now print a refusal instead of healing\r\nthe daemon — that is the point, and the message names the remedy.\r\n\r\n## Amendment 1 (2026-07-22) — W3 shaped: every resize entry rides ONE presentation barrier\r\n\r\n\r\n\r\n**The bug-3 RCA landed** (hertz, ENLYZEAM production byte capture, debug\r\nf31849c, same day as this ADR): the field PTY corruption is an **attach/resize\r\npresentation race**, not a parser or width defect. The controller attach\r\ndelivers the synthesized repaint at the session's OLD hosted geometry (80x24),\r\nthen rc's initial resize (the attach-stream verb `send_attach_resize`, ridden\r\nonce per viewport establish) lands the PTY + ScreenGrid on the client's real\r\ngeometry (131x60) — and **no resize-synchronized repaint follows**. Every\r\nsubsequent differential frame assumes the resized, reflowed model while the\r\nclient's physical screen still holds pre-resize cells; incremental keystroke\r\npaints expose them as the `/c`-scrap misalignment. Proof both directions:\r\nreplaying old-geometry repaint + post-resize frames in an independent emulator\r\nat 131x60 reproduces the corruption; replaying from the first post-resize full\r\nframe is clean; a fresh viewer (served a current-geometry repaint) is clean.\r\nTransport exonerated (raw-PTY and broker-frame taps byte-identical).\r\n\r\n**Why three iterations missed it:** v0.39.3/v0.39.4 built the geometry-epoch +\r\npresentation-barrier machinery for the IPC `ResizeReq` path — and that path is\r\nsound: `commit_resize` with an armed transition pushes the authoritative\r\nrepaint at the landed geometry. But the codebase has **two resize entries**,\r\nand the attach-stream resize verb never arms the barrier — it reaches the\r\nno-transition branch whose comment claims \"no suppression, so no sync frame\r\nowed\". The field capture falsifies that claim: **a geometry change invalidates\r\nthe client's painted cells by itself, bytes-in-flight or none.** It also\r\nexplains the isolated-rig non-repro (a fresh session has no stale-geometry\r\ncontent to expose) — isolation sensitivity resolved, not mysterious.\r\n\r\n**Decision:** geometry change is ONE transaction with ONE exit shape,\r\nregardless of entry: resize → grid lands → **authoritative full repaint at the\r\nnew geometry to every attached sink** → only then subsequent output. The\r\nattach-stream resize verb rides the SAME barrier machinery as `ResizeReq`\r\n(arm → settle → issue → commit/abort); the no-transition branch of\r\n`commit_resize` survives only for genuinely sink-less sessions, and its\r\n\"nothing owed\" claim is retired from any path with an attached sink. Ordering\r\nat attach specifically: a controller attach whose viewport geometry differs\r\nfrom the hosted geometry must not paint the old-geometry repaint as its final\r\nword — the initial resize's committed repaint supersedes it.\r\n\r\n**Oracle (binding, hertz's contract):** the regression replays the captured\r\nshape — 80x24 hosted session with content → 131x60 controller attach → the\r\nmenu/keystroke differential pattern — into an INDEPENDENT VT emulator and\r\nasserts final cells/colors. A ScreenGrid-only oracle shares the model under\r\ntest and MUST NOT be the sole authority (the REQ-SCREENGRID-WIDTH precedent).\r\n\r\nW3 is hereby shaped; REQ-ATTACH-RESIZE-REPAINT is minted inactive and\r\nactivates when W3 dispatches (sequenced behind W1 — same broker.rs seam, same\r\nbuilder, no parallel edits to one file).\r\n\r\n### Amendment 1 addendum (2026-07-22, same day) — scope widened: resize also corrupts the hosted terminal's INPUT discipline\r\n\r\n\r\n\r\nA second production capture (operator resized the EXISTING rc window live;\r\nhertz froze the taps) amends the RCA's scope two ways:\r\n\r\n1. **Not attach-limited.** A mid-session resize of an established viewport\r\n reproduces immediately — the presentation-ordering defect above applies to\r\n any geometry change, which the \"one transaction, any entry\" decision already\r\n covers.\r\n2. **A second, direct mechanism:** after the resize, the RAW ConPTY drain\r\n emits the operator's keystrokes as isolated OUTPUT records — literal\r\n one-byte `c`/`o`/`n`/`f`/`i` frames interleaved with the TUI's\r\n cursor-addressed diffs (raw and broker taps byte-identical, so this is the\r\n hosted terminal echoing, not transport or parser). The screenshot's\r\n `/c/config` line is exactly this unintended echo colliding with the menu's\r\n own `/config` cell paint. The hosted TUI runs raw/no-echo; something across\r\n the resize path re-enables console echo on the nested ConPTY — a path\r\n non-spt sessions do not traverse. spt-core never touches console input\r\n modes anywhere in-tree, so the alteration happens inside the\r\n portable_pty/ConPTY resize seam and is currently UNINSTRUMENTED.\r\n\r\n**Decision (investigation-shaped, not root-guessed):** W3 instruments Windows\r\nconsole input mode across the surface resize (`spt-term` pty resize) and\r\nimmediately before `write_input`, verifies `ENABLE_ECHO_INPUT` /\r\n`ENABLE_LINE_INPUT` remain disabled across a resize, and restores/asserts the\r\nmode if the seam proves to reset it. The echo mechanism is the likely `/c`\r\nproducer; the ordering fix above remains necessary on its own evidence. The\r\nregression gains hertz's second leg: active hosted TUI, resize 80x24→131x60,\r\ntype `/config` — raw PTY output must contain TUI frames and ZERO standalone\r\nechoed input bytes, and independent-VT final cells must equal ScreenGrid.\r\n\r\n## Amendment 2 (2026-07-22) — W3 bisect: mechanism 1's root is the rc CLIENT's console mode, not the broker seam\r\n\r\n\r\n\r\n\r\nAmendment 1 named a code root for the field `/c/config` corruption (\"the\r\nattach-stream resize never arms the barrier\"). **That root is RETRACTED.** The\r\nW3 bisect falsified it three independent ways and then pinned the real one.\r\nAbsence of a root in the seam we were auditing is a finding, not the absence of\r\none — and the mechanism the bisect exposed turned out to BE the answer.\r\n\r\n### What the bisect proved\r\n\r\nThree isolated probes, each removing one thing:\r\n\r\n1. **Our seam alone.** `ScreenGrid::new(24,80)` → advance(PRE window) →\r\n `resize(60,131)` → advance(POST window) → `render_repaint()`, rendered in\r\n `avt` against the authority built from the same file bytes: **0 divergent\r\n rows.** The grid, the resize and the repaint synthesis are byte-clean over\r\n the field capture.\r\n2. **The vehicle alone.** `capture-player` under a real ConPTY at a FIXED\r\n 60x131 — no broker, no grid, no attach, **no resize at all** — reproduced\r\n the ENTIRE observed divergence: one row, row 52, the exact field string\r\n (`\"/c/config\"` where the capture says `\" /config\"`). 100% of the red, with\r\n zero spt code in the path.\r\n3. **The mechanism, minimally.** `ESC[2J ESC[5;3H \"XX\" \"AB\"` renders row 6\r\n as `\" AB\"` in a spec VT (LF = INDEX: row down, **column preserved**) and\r\n as `\"AB\"` through a Windows console (LF = CR+LF: **column reset**).\r\n\r\nCapture record `t=1784714152501` is `CUP 51;3` + `EL` + SGR + a bare `0x0a`\r\nwith no `0x0d` + `\"/cd…\"` — a bare LF used as an index at column 3. Under the\r\nconsole's translation the row's paint starts at column 1 instead of 3; the\r\nlater absolutely-addressed writes (`ESC[52;3H\"/copy\"`, then `ESC[52;4H\"config\"`)\r\nrepaint from column 3 onward and never erase columns 1–2, so the `\"/c\"` residue\r\nsurvives to the final screen. That is the field string, derived.\r\n\r\n### The root (statically provable, no box required)\r\n\r\n`rc.rs` `with_vt_output` composes the operator console's OUTPUT mode as\r\n`prior | ENABLE_VIRTUAL_TERMINAL_PROCESSING | ENABLE_PROCESSED_OUTPUT`, and\r\n`DISABLE_NEWLINE_AUTO_RETURN` occurs **nowhere in the tree** (zero grep hits).\r\nWith processed output on and DNAR absent, the operator's console translates\r\nevery relayed bare LF into CR+LF. **The relay is byte-clean end to end and then\r\nour own client hands those bytes to a console configured to mangle them.** This\r\nis a presentation-truth defect in rc, independent of any resize.\r\n\r\nEvery prior observation collapses onto this one mechanism:\r\n\r\n- the field scraps appear at a **fixed window size** — bare-LF debris needs no\r\n resize, which is the no-resize interior-debris discriminator we could never\r\n place;\r\n- the **fresh-viewer-clean** contrast — a fresh attach is served the synthesized\r","truncated":true,"truncatedBy":"lines","totalLines":421,"totalBytes":18578,"outputLines":300,"outputBytes":18578,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":421,"displayContent":{"text":"# 0047 — Daemon lifecycle: custody identity, operator-stop authority, idempotent attach replay\r\n\r\nDate: 2026-07-22\r\nStatus: accepted\r\nAmends: ADR-0044 (controller lease ladder — equal-generation rung), REQ-DAEMON-3 (implicit daemon ensure — now yields to a standing operator stop)\r\n\r\n\r\n\r\n## Context\r\n\r\nThree v0.39.4 field regressions were RCA'd by hertz and code-verified the same day\r\n(2026-07-22), all in the daemon's lifecycle layer, all shipped-for-months latent\r\ndefects that the field finally selected:\r\n\r\n1. **False-ONLINE after core restart.** A live agent read as online while its\r\n session was not running. Root: `resume.pid` custody is a **bare PID** with no\r\n identity binding — `read_resume_pid(..).is_some_and(is_process_alive)` at both\r\n the restart gate and the liveness-reconcile DEFER. A dead spawn's pid, recycled\r\n by the OS onto an unrelated process (field proof: `resume.pid=29456` resolved\r\n to a random `cmd.exe`), reads as \"a resume is in flight\" forever: the reconcile\r\n defers every tick, the row stays online-authoritative, and no reader ever\r\n repairs it. The ABA problem, in process custody.\r\n\r\n2. **`daemon stop --force` non-terminal (respawn convoy).** Stopping the daemon\r\n spawns 5–10 ephemeral windows and the daemon is running again; it takes several\r\n force-stops to stay down. Root: every `spt api` invocation runs an\r\n **unconditional `ensure_daemon()`** (REQ-DAEMON-3's \"reliable anchor\"), and a\r\n box hosting live adapter sessions generates a steady stream of hook-driven api\r\n calls — so the stop is a race the operator loses. The rc-side twins of this bug\r\n were fixed earlier (rc.rs); the api anchor was left armed.\r\n\r\n3. **`spt update` freezes every attached rc PTY.** Pinned by the v0.40.0 OBS\r\n breadcrumbs on an authorized same-seam `daemon refresh` (falsifying the\r\n presumed gen+1 mechanism): during post-cycle dispatcher replay the broker\r\n processed the SAME conn / SAME identity / SAME generation subscribe twice\r\n 15 ms apart. The equal-generation rung of the ADR-0044 ladder classifies that\r\n as \"same lease, silent re-take\" — correct — but re-take is implemented as\r\n `become_controller`, which unconditionally drops the prior seat (its writer\r\n exits channel-closed). Designed for a dead seat after a dispatcher restart, it\r\n also fires against the same LIVE conn: the lease kills its own writer and the\r\n viewer freezes until a manual detach + re-attach.\r\n\r\nA fourth field bug (spt-hosted PTY corruption at fixed geometry) is still being\r\nRCA'd (hertz, on enlyzeam, isolated-rig non-repro already banked as the\r\nisolation-sensitivity discriminator). **Its fix rolls into this milestone as a\r\nlater wave when the RCA lands** (operator ruling 2026-07-22); nothing is minted\r\nfor it yet.\r\n\r\n## Decisions\r\n\r\n### 1. Process custody is an identity, never a bare PID\r\n\r\n\r\n\r\nA custody record that can gate lifecycle decisions (`resume.pid` first; the shape\r\ngeneralizes) stores an **identity pair — pid + process creation time** — written\r\natomically when the spawn is minted. Every consumer that today asks\r\n`is_process_alive(pid)` asks instead \"does a process with THIS pid AND THIS\r\ncreation time exist\": a recycled pid fails the pair test and reads **NOT OURS**.\r\n\r\n- **Mismatch is self-healing, not an error:** a custody record whose pair no\r\n longer matches a live process is DELETED by the reader that discovers it, and\r\n the gated decision proceeds as if no custody existed (the spawn is dead; saying\r\n so is the repair). No operator step.\r\n- **Atomic clear on the happy paths:** successful bind and spawn-reap both clear\r\n the custody record in the same mutation that records their own outcome — the\r\n record never outlives the question it answers.\r\n- Windows: creation time comes from the process snapshot, not from a retained\r\n handle (KNOWN-HAZARDS 7.50 — the asker owning a handle is exactly the unsound\r\n case). A platform with no snapshot yields \"unproven\", which defers ONE tick —\r\n it never manufactures either verdict (7.49/7.50 precedent).\r\n\r\n**Rejected:** a spawn-generation counter file next to the pid (a second file can\r\nskew against the first; the pair travels in one record); process-name matching\r\n(names collide by design — every spawn is `spt`).\r\n\r\n### 2. An operator stop outranks every implicit ensure\r\n\r\n\r\n\r\n`spt daemon stop` records a durable, machine-scoped **stop inhibit** BEFORE it\r\nbegins teardown. `ensure_daemon()` / `ensure_running()` — every implicit\r\nautostart path — consults the inhibit and, when present, **declines to spawn**,\r\nprinting one honest line (`daemon stopped by operator — spt daemon start to\r\nresume`) instead of silently resurrecting the daemon. REQ-DAEMON-3's anchor\r\ncontract is hereby amended: the anchor holds *except against a standing operator\r\nstop* — an explicit stop is operator intent, and no convenience path outranks it.\r\n\r\n- **Cleared by intent verbs only:** explicit `spt daemon start`, and the update\r\n paths that restart the daemon by design (`update apply --finish`). **No TTL** —\r\n a timeout would re-introduce the surprise respawn this decision exists to kill.\r\n A stale inhibit fails safe (daemon stays down, every api caller says why) and\r\n costs one explicit `daemon start`.\r\n- **Spawn serialization:** implicit autostart takes a machine-wide lock around\r\n probe-and-spawn, so N concurrent api calls can never launch N daemons (the\r\n convoy's second half — the 5–10 ephemeral windows were racing spawners).\r\n- `daemon stop` clears its own inhibit on teardown FAILURE exit paths only when\r\n it never began teardown; a partially-torn daemon with the inhibit standing is\r\n the correct resting state (down + honest refusals) rather than a half-up race.\r\n\r\n**Rejected:** TTL-based inhibit (surprise respawn, just later); process-scoped\r\ninhibit (the convoy IS cross-process); gating only `--force` (the non-force stop\r\nloses the same race).\r\n\r\n### 3. The equal-generation rung is idempotent for the same connection\r\n\r\n\r\n\r\nADR-0044's ladder gains a discriminator INSIDE the equal-generation rung: when a\r\nControl/Take subscribe carries the **same identity, same nonzero generation, AND\r\nthe same connection as the incumbent seat**, the broker treats it as an\r\n**idempotent replay** of the establish it already honored — the seat and its\r\nwriter are PRESERVED, no `controller-replaced` fires, no second initial batch is\r\nsynthesized. The subscribe decision breadcrumb answers `decision=idempotent`\r\n(additive vocabulary) so field captures distinguish reuse from replacement\r\nwithout correlating writer-exit lines.\r\n\r\n- Equal generation on a **different** connection keeps today's silent seat swap —\r\n that is the designed dispatcher-restart successor (ADR-0038 fix-6) where the\r\n old seat is dead and the lease is being re-served on a fresh carrier.\r\n- Strictly newer generation keeps the loud, fenced supersession; strictly older\r\n keeps the busy refusal. The ladder's ordering rules do not change — this is a\r\n new leaf inside one rung, keyed `(endpoint/session, by, conn, gen, from_seq)`.\r\n- **Key refinement (build-flagged, doyle-ruled 2026-07-22): `from_seq` is the\r\n FIFTH key element, and it is load-bearing.** Core itself re-subscribes on the\r\n SAME conn with the SAME generation for a legitimate reason: the controller\r\n gap resume (`read_controller_event_resuming`,\r\n REQ-HAZARD-CONTROLLER-GAP-RESUME) re-fetches dropped frames from its frozen\r\n `delivered_through` floor. That request is not a replay of the establish — it\r\n asks for different bytes — and keying on `(by, conn, gen)` alone would\r\n suppress it, strand the gap, and convert a recoverable gap into a false\r\n `ControllerIrrecoverablyBehind` truncation. A replayed establish carries the\r\n `from_seq` it was first honored with (`ControllerSink.establish_from_seq`); a\r\n re-fetch carries the floor it has since reached. **Accepted residual, stated\r\n honestly:** a gap with ZERO frames delivered since establish has\r\n `floor == establish_from_seq` and is suppressed — its consequence is a\r\n SURFACED truncation (never a silent lie), it needs a flood landing before any\r\n delivery advances the floor (not constructible in the rig), and a dedicated\r\n unit guards the collision cell.\r\n- Why the dispatcher served one held attach twice within 15 ms is a **banked\r\n open question** for this wave's build (it may have siblings); broker\r\n idempotence closes the symptom for every origin and does not wait on it.\r\n\r\n### 4. Wave map (build sequencing, not new semantics)\r\n\r\n- **W1 (dispatched now):** decisions 1–3 — the three field regressions with\r\n accepted RCAs. Regression legs ride each fix (see the REQ gates).\r\n- **W2 (registered inactive):** stream lifetime/lease classes — rc attach\r\n streams become ConnectionBound (FIN on opener-conn EOF) while inter-brain\r\n durable streams stay durable (the C2 raw-viewport leak, ADR-0038 territory) —\r\n and the C3 poll-vs-reap stamp-convergence race, which W1's gate must first\r\n re-verify still exists post-REGISTRY-LIFECYCLE. Design details are a W2 triage\r\n refresh against the code as it then stands, not this ADR.\r\n- **W3 (unminted):** the PTY-corruption fix, shaped by hertz's pending RCA.\r\n\r\n## Consequences\r\n\r\nThe daemon's lifecycle claims become custody-honest (a recycled pid can no\r\nlonger impersonate a live spawn), operator-honest (stop means stopped until the\r\noperator says otherwise), and lease-honest (a lease can no longer displace\r\nitself). The stop-inhibit is a deliberate behavior change to REQ-DAEMON-3's\r\nanchor: harness hooks on a stopped box now print a refusal instead of healing\r\nthe daemon — that is the point, and the message names the remedy.\r\n\r\n## Amendment 1 (2026-07-22) — W3 shaped: every resize entry rides ONE presentation barrier\r\n\r\n\r\n\r\n**The bug-3 RCA landed** (hertz, ENLYZEAM production byte capture, debug\r\nf31849c, same day as this ADR): the field PTY corruption is an **attach/resize\r\npresentation race**, not a parser or width defect. The controller attach\r\ndelivers the synthesized repaint at the session's OLD hosted geometry (80x24),\r\nthen rc's initial resize (the attach-stream verb `send_attach_resize`, ridden\r\nonce per viewport establish) lands the PTY + ScreenGrid on the client's real\r\ngeometry (131x60) — and **no resize-synchronized repaint follows**. Every\r\nsubsequent differential frame assumes the resized, reflowed model while the\r\nclient's physical screen still holds pre-resize cells; incremental keystroke\r\npaints expose them as the `/c`-scrap misalignment. Proof both directions:\r\nreplaying old-geometry repaint + post-resize frames in an independent emulator\r\nat 131x60 reproduces the corruption; replaying from the first post-resize full\r\nframe is clean; a fresh viewer (served a current-geometry repaint) is clean.\r\nTransport exonerated (raw-PTY and broker-frame taps byte-identical).\r\n\r\n**Why three iterations missed it:** v0.39.3/v0.39.4 built the geometry-epoch +\r\npresentation-barrier machinery for the IPC `ResizeReq` path — and that path is\r\nsound: `commit_resize` with an armed transition pushes the authoritative\r\nrepaint at the landed geometry. But the codebase has **two resize entries**,\r\nand the attach-stream resize verb never arms the barrier — it reaches the\r\nno-transition branch whose comment claims \"no suppression, so no sync frame\r\nowed\". The field capture falsifies that claim: **a geometry change invalidates\r\nthe client's painted cells by itself, bytes-in-flight or none.** It also\r\nexplains the isolated-rig non-repro (a fresh session has no stale-geometry\r\ncontent to expose) — isolation sensitivity resolved, not mysterious.\r\n\r\n**Decision:** geometry change is ONE transaction with ONE exit shape,\r\nregardless of entry: resize → grid lands → **authoritative full repaint at the\r\nnew geometry to every attached sink** → only then subsequent output. The\r\nattach-stream resize verb rides the SAME barrier machinery as `ResizeReq`\r\n(arm → settle → issue → commit/abort); the no-transition branch of\r\n`commit_resize` survives only for genuinely sink-less sessions, and its\r\n\"nothing owed\" claim is retired from any path with an attached sink. Ordering\r\nat attach specifically: a controller attach whose viewport geometry differs\r\nfrom the hosted geometry must not paint the old-geometry repaint as its final\r\nword — the initial resize's committed repaint supersedes it.\r\n\r\n**Oracle (binding, hertz's contract):** the regression replays the captured\r\nshape — 80x24 hosted session with content → 131x60 controller attach → the\r\nmenu/keystroke differential pattern — into an INDEPENDENT VT emulator and\r\nasserts final cells/colors. A ScreenGrid-only oracle shares the model under\r\ntest and MUST NOT be the sole authority (the REQ-SCREENGRID-WIDTH precedent).\r\n\r\nW3 is hereby shaped; REQ-ATTACH-RESIZE-REPAINT is minted inactive and\r\nactivates when W3 dispatches (sequenced behind W1 — same broker.rs seam, same\r\nbuilder, no parallel edits to one file).\r\n\r\n### Amendment 1 addendum (2026-07-22, same day) — scope widened: resize also corrupts the hosted terminal's INPUT discipline\r\n\r\n\r\n\r\nA second production capture (operator resized the EXISTING rc window live;\r\nhertz froze the taps) amends the RCA's scope two ways:\r\n\r\n1. **Not attach-limited.** A mid-session resize of an established viewport\r\n reproduces immediately — the presentation-ordering defect above applies to\r\n any geometry change, which the \"one transaction, any entry\" decision already\r\n covers.\r\n2. **A second, direct mechanism:** after the resize, the RAW ConPTY drain\r\n emits the operator's keystrokes as isolated OUTPUT records — literal\r\n one-byte `c`/`o`/`n`/`f`/`i` frames interleaved with the TUI's\r\n cursor-addressed diffs (raw and broker taps byte-identical, so this is the\r\n hosted terminal echoing, not transport or parser). The screenshot's\r\n `/c/config` line is exactly this unintended echo colliding with the menu's\r\n own `/config` cell paint. The hosted TUI runs raw/no-echo; something across\r\n the resize path re-enables console echo on the nested ConPTY — a path\r\n non-spt sessions do not traverse. spt-core never touches console input\r\n modes anywhere in-tree, so the alteration happens inside the\r\n portable_pty/ConPTY resize seam and is currently UNINSTRUMENTED.\r\n\r\n**Decision (investigation-shaped, not root-guessed):** W3 instruments Windows\r\nconsole input mode across the surface resize (`spt-term` pty resize) and\r\nimmediately before `write_input`, verifies `ENABLE_ECHO_INPUT` /\r\n`ENABLE_LINE_INPUT` remain disabled across a resize, and restores/asserts the\r\nmode if the seam proves to reset it. The echo mechanism is the likely `/c`\r\nproducer; the ordering fix above remains necessary on its own evidence. The\r\nregression gains hertz's second leg: active hosted TUI, resize 80x24→131x60,\r\ntype `/config` — raw PTY output must contain TUI frames and ZERO standalone\r\nechoed input bytes, and independent-VT final cells must equal ScreenGrid.\r\n\r\n## Amendment 2 (2026-07-22) — W3 bisect: mechanism 1's root is the rc CLIENT's console mode, not the broker seam\r\n\r\n\r\n\r\n\r\nAmendment 1 named a code root for the field `/c/config` corruption (\"the\r\nattach-stream resize never arms the barrier\"). **That root is RETRACTED.** The\r\nW3 bisect falsified it three independent ways and then pinned the real one.\r\nAbsence of a root in the seam we were auditing is a finding, not the absence of\r\none — and the mechanism the bisect exposed turned out to BE the answer.\r\n\r\n### What the bisect proved\r\n\r\nThree isolated probes, each removing one thing:\r\n\r\n1. **Our seam alone.** `ScreenGrid::new(24,80)` → advance(PRE window) →\r\n `resize(60,131)` → advance(POST window) → `render_repaint()`, rendered in\r\n `avt` against the authority built from the same file bytes: **0 divergent\r\n rows.** The grid, the resize and the repaint synthesis are byte-clean over\r\n the field capture.\r\n2. **The vehicle alone.** `capture-player` under a real ConPTY at a FIXED\r\n 60x131 — no broker, no grid, no attach, **no resize at all** — reproduced\r\n the ENTIRE observed divergence: one row, row 52, the exact field string\r\n (`\"/c/config\"` where the capture says `\" /config\"`). 100% of the red, with\r\n zero spt code in the path.\r\n3. **The mechanism, minimally.** `ESC[2J ESC[5;3H \"XX\" \"AB\"` renders row 6\r\n as `\" AB\"` in a spec VT (LF = INDEX: row down, **column preserved**) and\r\n as `\"AB\"` through a Windows console (LF = CR+LF: **column reset**).\r\n\r\nCapture record `t=1784714152501` is `CUP 51;3` + `EL` + SGR + a bare `0x0a`\r\nwith no `0x0d` + `\"/cd…\"` — a bare LF used as an index at column 3. Under the\r\nconsole's translation the row's paint starts at column 1 instead of 3; the\r\nlater absolutely-addressed writes (`ESC[52;3H\"/copy\"`, then `ESC[52;4H\"config\"`)\r\nrepaint from column 3 onward and never erase columns 1–2, so the `\"/c\"` residue\r\nsurvives to the final screen. That is the field string, derived.\r\n\r\n### The root (statically provable, no box required)\r\n\r\n`rc.rs` `with_vt_output` composes the operator console's OUTPUT mode as\r\n`prior | ENABLE_VIRTUAL_TERMINAL_PROCESSING | ENABLE_PROCESSED_OUTPUT`, and\r\n`DISABLE_NEWLINE_AUTO_RETURN` occurs **nowhere in the tree** (zero grep hits).\r\nWith processed output on and DNAR absent, the operator's console translates\r\nevery relayed bare LF into CR+LF. **The relay is byte-clean end to end and then\r\nour own client hands those bytes to a console configured to mangle them.** This\r\nis a presentation-truth defect in rc, independent of any resize.\r\n\r\nEvery prior observation collapses onto this one mechanism:\r\n\r\n- the field scraps appear at a **fixed window size** — bare-LF debris needs no\r\n resize, which is the no-resize interior-debris discriminator we could never\r\n place;\r\n- the **fresh-viewer-clean** contrast — a fresh attach is served the synthesized\r\n…\n differential stream carries them;\n…\n\n…\n\n…\nevidence is not contaminated by today's finding.","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,null,302,null,309,null,317,null,421]},"fileSize":25881,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\docs\\adr\\0047-daemon-lifecycle-custody-authority.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":421,"totalBytes":18578,"outputLines":300,"outputBytes":18578,"shownRange":{"start":1,"end":300},"nextOffset":301}}},"isError":false,"timestamp":1789113814670}}
{"type":"message","id":"fe2ea2a4","parentId":"ca813762","timestamp":"2026-09-11T08:03:34.676Z","message":{"role":"toolResult","toolCallId":"call_NjKR6pjD3EeWjo2HB5x8FY4f|fc_07a38c9435caeae6016aa3b5d4325087d28857c30efe74940b","toolName":"read","content":[{"type":"text","text":"//! Remote terminal attach (M4-D5b, REQ-INST-8) — serve a byte-stream viewport\n//! onto a local session for an operator on another node.\n//!\n//! The operator's daemon opened a bidi QUIC stream to this node (D4) and sent\n//! [`AttachRecord::Request`]; this module is the target-side pump between that\n//! stream and the local broker-hosted session:\n//!\n//! - session `Output` chunks → [`AttachRecord::Output`] lines onto the wire\n//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\n//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\n//! operator-minted `op_id` — exactly-once at the PTY write through the B5\n//! journal (a replayed input record cannot double-type);\n//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\n//!\n//! ## Exactly-once lives at the EDGES, not the wire sends\n//!\n//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\n//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\n//! and *discards* everything interleaved — inside a full-duplex pump loop that\n//! eats the operator's `Input` records (both sides starve; found the hard way\n//! in `tests/attach.rs`). Idempotency holds without it because each direction\n//! dedups at its **effect**: the PTY write is journaled by the operator-minted\n//! `Input.op_id`, and the operator's viewport dedups `Output` records by their\n//! session-log `seq` (the render cursor). A post-restart re-serve may\n//! re-transmit output records on the wire — duplicates are dropped at the\n//! render cursor, the same discipline the local `OutputLog` replay uses\n//! (REQ-HAZARD-RESTART-IDEMPOTENT at the boundary that matters).\n//!\n//! **Compute + files stay here**; the operator is a viewport (CONTEXT\n//! §Remote-control vs local operation). The access gate runs before anything\n//! is served: the [`AttachRecord::Request`] is *unsolicited wire inbound*, so\n//! [`access_check`] sees the **handshake-proven** origin from the broker's\n//! stream table — never payload bytes (KNOWN-HAZARDS 7.5). Remote-drive of\n//! your own running instance is ungated by default (ADR-0009 default-open);\n//! the D5d whitelist drops in at this same call.\n//!\n//! Restart survival composes from D4/B5 with **no new machinery**: the broker\n//! owns the QUIC stream, the session, its `OutputLog`, and the effect journal.\n//! A restarted target brain re-attaches the session from its output cursor,\n//! resubscribes the stream from its net cursor, and re-drives journaled sends;\n//! a restarted operator brain resubscribes and dedups rendered chunks by\n//! `Output.seq`.\n\nuse std::io;\nuse std::time::{Duration, Instant};\n\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\nuse spt_net::net::ndjson;\n\nuse crate::access::{access_check, surface, InboundClass};\n\n/// The control surface an attach request gates against: a read-only viewer is\n/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\n/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\n/// endpoint without also handing over its keyboard.\n// [impl->REQ-ACL-RC-VIEW-SPLIT]\nfn attach_surface(intent: AttachIntent) -> &'static str {\n match intent {\n AttachIntent::Viewer => surface::RC_VIEW,\n AttachIntent::Control | AttachIntent::Take => surface::RC_ATTACH,\n }\n}\n\n/// What the engine room's structural locks say about one attach attempt\n/// (ADR-0052 §3).\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum EngineRoomLock {\n /// Not the engine room, or an attach its locks allow.\n Pass,\n /// The engine room has no viewport at ANY origin — refused.\n NoViewport,\n /// The engine room takes its controls from its own node only — refused.\n NotFromOffNode,\n}\n\n/// The engine room's rc locks, pure (ADR-0052 §3: \"no rc view; controls from\n/// the node itself\").\n///\n/// Two things make this a CARVE-OUT rather than a rule row in the access store:\n///\n/// - it must beat the same-node loopback `Allow`, which precedes the resolution\n/// chain (`access::access_check` step 1) — and a local `rc` reaches the target\n/// over exactly that loopback origin, so a chain-level rule could never see it;\n/// - the engine room's operator must not be able to open a viewport by writing\n/// themself a rule. A watchable governance surface is a governance surface\n/// whose secrets are watchable.\n///\n/// `from_this_node` is the handshake-proven origin's own-node answer (a local\n/// IPC subscribe with no origin is this node by construction), never anything a\n/// caller supplied (KNOWN-HAZARDS 7.5).\n// [impl->REQ-ER-RC-INTENT-LOCKS]\npub fn classify_rc_lock(\n is_engine_room: bool,\n from_this_node: bool,\n intent: AttachIntent,\n) -> EngineRoomLock {\n if !is_engine_room {\n return EngineRoomLock::Pass;\n }\n // View is refused FIRST and unconditionally: it is the lock that holds even\n // at the console, so an off-node viewer hears the reason that would still\n // apply if it moved to this machine.\n if intent == AttachIntent::Viewer {\n return EngineRoomLock::NoViewport;\n }\n if !from_this_node {\n return EngineRoomLock::NotFromOffNode;\n }\n // Local Control and local Take both pass — a take displaces the incumbent\n // loudly and drops its authority (ADR-0052 §3a); it is not a lesser intent.\n EngineRoomLock::Pass\n}\n\nuse crate::brain::{now_ms, Brain, BrokerEvent};\nuse crate::effect::{Minter, MintedOp};\nuse crate::msg::{decode_bytes, encode_bytes};\n\n/// Feed the resting-state machine at the attach edges (D9-2, REQ-INST-3): a\n/// served viewport is a **driver** — attaching wakes the endpoint, the\n/// viewport ending detaches it (active → dormant; the transition echo is\n/// gate-armed for the endpoint's own pulse loop). Best-effort exactly like\n/// [`mark_driven_by`]: a session served without a perch has no resting\n/// record to move.\n// [impl->REQ-INST-3]\nfn feed_rest(endpoint: &str, event: crate::resting::RestEvent) {\n let _ = crate::resting::daemon_rest_event(endpoint, event, None);\n}\n\n/// Why a serve loop returned.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub enum AttachServeOutcome {\n /// The access gate refused the requesting origin, OR a `Control` attach hit\n /// an endpoint a DIFFERENT operator already controls (busy-refuse,\n /// REQ-RCVIEW-1) — nothing was served. The operator's `rc` renders the\n /// busy guidance client-side from the endpoint's `driven_by`.\n Refused,\n /// The session's child exited; the `Exit` record was sent and the stream\n /// finished.\n Exited(Option),\n /// The operator closed its send side (detached); the viewport ended with\n /// the session still running.\n Detached,\n /// This controller was DISPLACED by a different operator's `--take`/`kick`\n /// (REQ-KICK-1): the loud `Displaced` notice was sent and the stream\n /// finished. The endpoint stays driven (by the taker) — no dormant edge.\n Displaced,\n}\n\n/// The role a serve loop resolved to, once the broker's [`SubscribeOutcome`]\n/// arrives — gates wake (controller-only) and PTY input.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\nenum ServeRole {\n /// The interactive controller (input + resize; wakes the endpoint).\n Controller,\n /// A read-only viewer (output only; wake-neutral).\n Viewer,\n}\n\n/// Minimum spacing between skip-to-live re-subscribes after a viewer eviction\n/// (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). HARD constraint: an evicted viewer that is\n/// hopelessly behind under a sustained flood will be re-evicted immediately after\n/// each re-subscribe; without spacing that is an evict→resubscribe CPU spin. With\n/// it, the operator sees an intermittent LIVE burst each interval (forward\n/// progress), never a busy-loop. ~200ms = several bursts/sec, imperceptible lag.\nconst RESUBSCRIBE_INTERVAL: Duration = Duration::from_millis(200);\n\n/// The CONTROLLER fell behind the live ring further than the ring holds — the\n/// dropped frames are GONE (`tail - delivered_through > cap_chunks`), so an\n/// exactly-once re-fetch is IMPOSSIBLE. Distinguishes the irrecoverable edge from\n/// an ordinary fatal so the serve loop can surface it (a marked truncation),\n/// rather than silent-skipping (a B2 lie) or spinning. Full graceful handling is\n/// DEFERRED to `REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND`.\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n#[derive(Debug)]\npub struct ControllerIrrecoverablyBehind {\n /// The frozen `delivered_through` floor the ring has already rolled past.\n pub floor: u64,\n}\n\nimpl std::fmt::Display for ControllerIrrecoverablyBehind {\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n write!(\n f,\n \"controller fell irrecoverably behind the live ring at seq {} (dropped frames rolled out of the ring)\",\n self.floor\n )\n }\n}\n\nimpl std::error::Error for ControllerIrrecoverablyBehind {}\n\n/// Is `e` the brain's strict reject-gap fatal (`output gap: got seq N want M`)?\n/// That is the only error the controller gap-resume recovers from; every other\n/// error propagates unchanged.\nfn is_output_gap(e: &io::Error) -> bool {\n e.kind() == io::ErrorKind::InvalidData && e.to_string().contains(\"output gap\")\n}\n\n/// Read one [`BrokerEvent`] for an attached CONTROLLER, RESUMING-FROM-FLOOR on a\n/// b4 drop-don't-block output-gap instead of fataling.\n///\n/// b4 made the controller a non-blocking `try_send` that DROPS frames when its\n/// bounded channel is full (a controller that falls behind its own echo under a\n/// hard flood). The next frame this reader sees is then a FORWARD gap that the\n/// strict reject-gap (`read_event`, legacy single-session path) FATALS. A\n/// controller CANNOT snap-above like a viewer (B2: it is authoritative — it\n/// advances `delivered_through`; skipping rolled frames would be a not-exactly-once\n/// resume). So instead it RE-FETCHES: re-subscribe from\n/// [`Brain::controller_resume_floor`] (`= delivered_through`, frozen at the drop by\n/// `contiguous_advance`) and the broker replays the dropped frames from the ring.\n///\n/// Exactly-once holds IFF the ring still retains the floor (`tail - delivered_through\n/// <= cap_chunks`). If it does not — the controller fell behind further than the\n/// ring holds — the re-subscribe's first frame is STILL a forward gap (floor\n/// unchanged across two resumes). That is [`ControllerIrrecoverablyBehind`]: the\n/// caller surfaces it (marked truncation), never silent-skips (B2 lie) and never\n/// spins. The helper swallows the `Subscribed` ack its own re-subscribe produces so\n/// the repeated-gap detection is not masked. Non-`Output` events (NetStreamData /\n/// Size / Exit / …) pass through unchanged.\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n/// `gen` is the serve worker's attach generation (ADR-0038 Amendment fix 6):\n/// the resume re-subscribe is the SAME Request re-fetching dropped frames, so\n/// it must carry the SAME generation — an equal-gen re-take preserves the\n/// incumbent `attach_gen`. Passing 0 here would reset the slot to legacy and\n/// (a) re-arm the stale-replay steal fix 6 refuses and (b) make the worker's\n/// own terminal `detach_session_gen` mismatch the slot it re-installed.\n// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\npub fn read_controller_event_resuming(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n) -> io::Result {\n read_controller_event_resuming_until(brain, session_id, gen, by, None)\n}\n\n/// Deadline-aware form of [`read_controller_event_resuming`].\n///\n/// Production callers pass no deadline through the wrapper above. Timed observers\n/// use this form so a quiet controller cannot hide their wall-clock bound inside an\n/// unbounded frame read.\npub fn read_controller_event_resuming_until(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n deadline: Option,\n) -> io::Result {\n let mut last_resume_floor: Option = None;\n let mut swallow_resume_ack = false;\n loop {\n match brain.read_event_until(deadline) {\n // Our own re-subscribe's Subscribed reply: swallow it (role is already\n // resolved) so it cannot mask a repeated gap as forward progress.\n Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\n swallow_resume_ack = false;\n continue;\n }\n Ok(ev) => return Ok(ev),\n Err(e) if is_output_gap(&e) => {\n let floor = brain.controller_resume_floor();\n if last_resume_floor == Some(floor) {\n // No progress across two resumes → the ring rolled past the\n // floor → the dropped frames are gone.\n return Err(io::Error::other(ControllerIrrecoverablyBehind { floor }));\n }\n last_resume_floor = Some(floor);\n // RE-FETCH from the frozen delivered_through (same operator `by` →\n // a silent re-take, no Displaced); the broker replays the dropped\n // frames from the ring.\n // No bring-up code here, and none is needed: this re-subscribe\n // arrives on the connection that already holds the seat, which is\n // exactly the exemption `engineroom::bringup_required` names — a\n // controller must not lose a gated endpoint's controls for having\n // fallen behind its own output.\n // THE decision, bound ONCE and passed: the same value is logged and\n // handed to `attach_as`, so the breadcrumb cannot drift from the\n // attach it describes. A separately-written label would still read\n // `control` on the day this choice becomes conditional.\n let intent = AttachIntent::Control;\n // Wildcard-free on purpose: a new `AttachIntent` variant must fail to\n // compile here rather than silently log as one of today's three.\n let intent_lbl = match intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // Emitted BEFORE the re-subscribe, on the daemon stderr sink, joinable\n // to the broker's SUBSCRIBE_DECISION on `session`. ids/counters only —\n // never PTY bytes. This is the same-conn different-floor re-take: the\n // caller's own writer is dropped by the broker's fallthrough, so when\n // a controller loses its seat with no Displaced event, THIS line is\n // what says the re-take was our own and names the floor it re-took at.\n spt_proto::emit_line_err!(\n \"ATTACH_INTENT_CHOSEN: site=gap_resume session={session_id} \\\n intent={intent_lbl} from_seq={floor} gen={gen}\"\n );\n brain.attach_as(session_id, floor, intent, gen, by)?;\n swallow_resume_ack = true;\n }\n…\n }\n }\n}\n\n[Showing lines 1-300 of 1099. Use :301 to continue]"}],"details":{"truncation":{"content":"//! Remote terminal attach (M4-D5b, REQ-INST-8) — serve a byte-stream viewport\r\n//! onto a local session for an operator on another node.\r\n//!\r\n//! The operator's daemon opened a bidi QUIC stream to this node (D4) and sent\r\n//! [`AttachRecord::Request`]; this module is the target-side pump between that\r\n//! stream and the local broker-hosted session:\r\n//!\r\n//! - session `Output` chunks → [`AttachRecord::Output`] lines onto the wire\r\n//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\r\n//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\r\n//! operator-minted `op_id` — exactly-once at the PTY write through the B5\r\n//! journal (a replayed input record cannot double-type);\r\n//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\r\n//!\r\n//! ## Exactly-once lives at the EDGES, not the wire sends\r\n//!\r\n//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\r\n//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\r\n//! and *discards* everything interleaved — inside a full-duplex pump loop that\r\n//! eats the operator's `Input` records (both sides starve; found the hard way\r\n//! in `tests/attach.rs`). Idempotency holds without it because each direction\r\n//! dedups at its **effect**: the PTY write is journaled by the operator-minted\r\n//! `Input.op_id`, and the operator's viewport dedups `Output` records by their\r\n//! session-log `seq` (the render cursor). A post-restart re-serve may\r\n//! re-transmit output records on the wire — duplicates are dropped at the\r\n//! render cursor, the same discipline the local `OutputLog` replay uses\r\n//! (REQ-HAZARD-RESTART-IDEMPOTENT at the boundary that matters).\r\n//!\r\n//! **Compute + files stay here**; the operator is a viewport (CONTEXT\r\n//! §Remote-control vs local operation). The access gate runs before anything\r\n//! is served: the [`AttachRecord::Request`] is *unsolicited wire inbound*, so\r\n//! [`access_check`] sees the **handshake-proven** origin from the broker's\r\n//! stream table — never payload bytes (KNOWN-HAZARDS 7.5). Remote-drive of\r\n//! your own running instance is ungated by default (ADR-0009 default-open);\r\n//! the D5d whitelist drops in at this same call.\r\n//!\r\n//! Restart survival composes from D4/B5 with **no new machinery**: the broker\r\n//! owns the QUIC stream, the session, its `OutputLog`, and the effect journal.\r\n//! A restarted target brain re-attaches the session from its output cursor,\r\n//! resubscribes the stream from its net cursor, and re-drives journaled sends;\r\n//! a restarted operator brain resubscribes and dedups rendered chunks by\r\n//! `Output.seq`.\r\n\r\nuse std::io;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\r\nuse spt_net::net::ndjson;\r\n\r\nuse crate::access::{access_check, surface, InboundClass};\r\n\r\n/// The control surface an attach request gates against: a read-only viewer is\r\n/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\r\n/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\r\n/// endpoint without also handing over its keyboard.\r\n// [impl->REQ-ACL-RC-VIEW-SPLIT]\r\nfn attach_surface(intent: AttachIntent) -> &'static str {\r\n match intent {\r\n AttachIntent::Viewer => surface::RC_VIEW,\r\n AttachIntent::Control | AttachIntent::Take => surface::RC_ATTACH,\r\n }\r\n}\r\n\r\n/// What the engine room's structural locks say about one attach attempt\r\n/// (ADR-0052 §3).\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub enum EngineRoomLock {\r\n /// Not the engine room, or an attach its locks allow.\r\n Pass,\r\n /// The engine room has no viewport at ANY origin — refused.\r\n NoViewport,\r\n /// The engine room takes its controls from its own node only — refused.\r\n NotFromOffNode,\r\n}\r\n\r\n/// The engine room's rc locks, pure (ADR-0052 §3: \"no rc view; controls from\r\n/// the node itself\").\r\n///\r\n/// Two things make this a CARVE-OUT rather than a rule row in the access store:\r\n///\r\n/// - it must beat the same-node loopback `Allow`, which precedes the resolution\r\n/// chain (`access::access_check` step 1) — and a local `rc` reaches the target\r\n/// over exactly that loopback origin, so a chain-level rule could never see it;\r\n/// - the engine room's operator must not be able to open a viewport by writing\r\n/// themself a rule. A watchable governance surface is a governance surface\r\n/// whose secrets are watchable.\r\n///\r\n/// `from_this_node` is the handshake-proven origin's own-node answer (a local\r\n/// IPC subscribe with no origin is this node by construction), never anything a\r\n/// caller supplied (KNOWN-HAZARDS 7.5).\r\n// [impl->REQ-ER-RC-INTENT-LOCKS]\r\npub fn classify_rc_lock(\r\n is_engine_room: bool,\r\n from_this_node: bool,\r\n intent: AttachIntent,\r\n) -> EngineRoomLock {\r\n if !is_engine_room {\r\n return EngineRoomLock::Pass;\r\n }\r\n // View is refused FIRST and unconditionally: it is the lock that holds even\r\n // at the console, so an off-node viewer hears the reason that would still\r\n // apply if it moved to this machine.\r\n if intent == AttachIntent::Viewer {\r\n return EngineRoomLock::NoViewport;\r\n }\r\n if !from_this_node {\r\n return EngineRoomLock::NotFromOffNode;\r\n }\r\n // Local Control and local Take both pass — a take displaces the incumbent\r\n // loudly and drops its authority (ADR-0052 §3a); it is not a lesser intent.\r\n EngineRoomLock::Pass\r\n}\r\n\r\nuse crate::brain::{now_ms, Brain, BrokerEvent};\r\nuse crate::effect::{Minter, MintedOp};\r\nuse crate::msg::{decode_bytes, encode_bytes};\r\n\r\n/// Feed the resting-state machine at the attach edges (D9-2, REQ-INST-3): a\r\n/// served viewport is a **driver** — attaching wakes the endpoint, the\r\n/// viewport ending detaches it (active → dormant; the transition echo is\r\n/// gate-armed for the endpoint's own pulse loop). Best-effort exactly like\r\n/// [`mark_driven_by`]: a session served without a perch has no resting\r\n/// record to move.\r\n// [impl->REQ-INST-3]\r\nfn feed_rest(endpoint: &str, event: crate::resting::RestEvent) {\r\n let _ = crate::resting::daemon_rest_event(endpoint, event, None);\r\n}\r\n\r\n/// Why a serve loop returned.\r\n#[derive(Debug, Clone, PartialEq, Eq)]\r\npub enum AttachServeOutcome {\r\n /// The access gate refused the requesting origin, OR a `Control` attach hit\r\n /// an endpoint a DIFFERENT operator already controls (busy-refuse,\r\n /// REQ-RCVIEW-1) — nothing was served. The operator's `rc` renders the\r\n /// busy guidance client-side from the endpoint's `driven_by`.\r\n Refused,\r\n /// The session's child exited; the `Exit` record was sent and the stream\r\n /// finished.\r\n Exited(Option),\r\n /// The operator closed its send side (detached); the viewport ended with\r\n /// the session still running.\r\n Detached,\r\n /// This controller was DISPLACED by a different operator's `--take`/`kick`\r\n /// (REQ-KICK-1): the loud `Displaced` notice was sent and the stream\r\n /// finished. The endpoint stays driven (by the taker) — no dormant edge.\r\n Displaced,\r\n}\r\n\r\n/// The role a serve loop resolved to, once the broker's [`SubscribeOutcome`]\r\n/// arrives — gates wake (controller-only) and PTY input.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\nenum ServeRole {\r\n /// The interactive controller (input + resize; wakes the endpoint).\r\n Controller,\r\n /// A read-only viewer (output only; wake-neutral).\r\n Viewer,\r\n}\r\n\r\n/// Minimum spacing between skip-to-live re-subscribes after a viewer eviction\r\n/// (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). HARD constraint: an evicted viewer that is\r\n/// hopelessly behind under a sustained flood will be re-evicted immediately after\r\n/// each re-subscribe; without spacing that is an evict→resubscribe CPU spin. With\r\n/// it, the operator sees an intermittent LIVE burst each interval (forward\r\n/// progress), never a busy-loop. ~200ms = several bursts/sec, imperceptible lag.\r\nconst RESUBSCRIBE_INTERVAL: Duration = Duration::from_millis(200);\r\n\r\n/// The CONTROLLER fell behind the live ring further than the ring holds — the\r\n/// dropped frames are GONE (`tail - delivered_through > cap_chunks`), so an\r\n/// exactly-once re-fetch is IMPOSSIBLE. Distinguishes the irrecoverable edge from\r\n/// an ordinary fatal so the serve loop can surface it (a marked truncation),\r\n/// rather than silent-skipping (a B2 lie) or spinning. Full graceful handling is\r\n/// DEFERRED to `REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND`.\r\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n#[derive(Debug)]\r\npub struct ControllerIrrecoverablyBehind {\r\n /// The frozen `delivered_through` floor the ring has already rolled past.\r\n pub floor: u64,\r\n}\r\n\r\nimpl std::fmt::Display for ControllerIrrecoverablyBehind {\r\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\r\n write!(\r\n f,\r\n \"controller fell irrecoverably behind the live ring at seq {} (dropped frames rolled out of the ring)\",\r\n self.floor\r\n )\r\n }\r\n}\r\n\r\nimpl std::error::Error for ControllerIrrecoverablyBehind {}\r\n\r\n/// Is `e` the brain's strict reject-gap fatal (`output gap: got seq N want M`)?\r\n/// That is the only error the controller gap-resume recovers from; every other\r\n/// error propagates unchanged.\r\nfn is_output_gap(e: &io::Error) -> bool {\r\n e.kind() == io::ErrorKind::InvalidData && e.to_string().contains(\"output gap\")\r\n}\r\n\r\n/// Read one [`BrokerEvent`] for an attached CONTROLLER, RESUMING-FROM-FLOOR on a\r\n/// b4 drop-don't-block output-gap instead of fataling.\r\n///\r\n/// b4 made the controller a non-blocking `try_send` that DROPS frames when its\r\n/// bounded channel is full (a controller that falls behind its own echo under a\r\n/// hard flood). The next frame this reader sees is then a FORWARD gap that the\r\n/// strict reject-gap (`read_event`, legacy single-session path) FATALS. A\r\n/// controller CANNOT snap-above like a viewer (B2: it is authoritative — it\r\n/// advances `delivered_through`; skipping rolled frames would be a not-exactly-once\r\n/// resume). So instead it RE-FETCHES: re-subscribe from\r\n/// [`Brain::controller_resume_floor`] (`= delivered_through`, frozen at the drop by\r\n/// `contiguous_advance`) and the broker replays the dropped frames from the ring.\r\n///\r\n/// Exactly-once holds IFF the ring still retains the floor (`tail - delivered_through\r\n/// <= cap_chunks`). If it does not — the controller fell behind further than the\r\n/// ring holds — the re-subscribe's first frame is STILL a forward gap (floor\r\n/// unchanged across two resumes). That is [`ControllerIrrecoverablyBehind`]: the\r\n/// caller surfaces it (marked truncation), never silent-skips (B2 lie) and never\r\n/// spins. The helper swallows the `Subscribed` ack its own re-subscribe produces so\r\n/// the repeated-gap detection is not masked. Non-`Output` events (NetStreamData /\r\n/// Size / Exit / …) pass through unchanged.\r\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n/// `gen` is the serve worker's attach generation (ADR-0038 Amendment fix 6):\r\n/// the resume re-subscribe is the SAME Request re-fetching dropped frames, so\r\n/// it must carry the SAME generation — an equal-gen re-take preserves the\r\n/// incumbent `attach_gen`. Passing 0 here would reset the slot to legacy and\r\n/// (a) re-arm the stale-replay steal fix 6 refuses and (b) make the worker's\r\n/// own terminal `detach_session_gen` mismatch the slot it re-installed.\r\n// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\r\npub fn read_controller_event_resuming(\r\n brain: &mut Brain,\r\n session_id: u64,\r\n gen: u64,\r\n by: Option<&str>,\r\n) -> io::Result {\r\n read_controller_event_resuming_until(brain, session_id, gen, by, None)\r\n}\r\n\r\n/// Deadline-aware form of [`read_controller_event_resuming`].\r\n///\r\n/// Production callers pass no deadline through the wrapper above. Timed observers\r\n/// use this form so a quiet controller cannot hide their wall-clock bound inside an\r\n/// unbounded frame read.\r\npub fn read_controller_event_resuming_until(\r\n brain: &mut Brain,\r\n session_id: u64,\r\n gen: u64,\r\n by: Option<&str>,\r\n deadline: Option,\r\n) -> io::Result {\r\n let mut last_resume_floor: Option = None;\r\n let mut swallow_resume_ack = false;\r\n loop {\r\n match brain.read_event_until(deadline) {\r\n // Our own re-subscribe's Subscribed reply: swallow it (role is already\r\n // resolved) so it cannot mask a repeated gap as forward progress.\r\n Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\r\n swallow_resume_ack = false;\r\n continue;\r\n }\r\n Ok(ev) => return Ok(ev),\r\n Err(e) if is_output_gap(&e) => {\r\n let floor = brain.controller_resume_floor();\r\n if last_resume_floor == Some(floor) {\r\n // No progress across two resumes → the ring rolled past the\r\n // floor → the dropped frames are gone.\r\n return Err(io::Error::other(ControllerIrrecoverablyBehind { floor }));\r\n }\r\n last_resume_floor = Some(floor);\r\n // RE-FETCH from the frozen delivered_through (same operator `by` →\r\n // a silent re-take, no Displaced); the broker replays the dropped\r\n // frames from the ring.\r\n // No bring-up code here, and none is needed: this re-subscribe\r\n // arrives on the connection that already holds the seat, which is\r\n // exactly the exemption `engineroom::bringup_required` names — a\r\n // controller must not lose a gated endpoint's controls for having\r\n // fallen behind its own output.\r\n // THE decision, bound ONCE and passed: the same value is logged and\r\n // handed to `attach_as`, so the breadcrumb cannot drift from the\r\n // attach it describes. A separately-written label would still read\r\n // `control` on the day this choice becomes conditional.\r\n let intent = AttachIntent::Control;\r\n // Wildcard-free on purpose: a new `AttachIntent` variant must fail to\r\n // compile here rather than silently log as one of today's three.\r\n let intent_lbl = match intent {\r\n AttachIntent::Viewer => \"viewer\",\r\n AttachIntent::Control => \"control\",\r\n AttachIntent::Take => \"take\",\r\n };\r\n // Emitted BEFORE the re-subscribe, on the daemon stderr sink, joinable\r\n // to the broker's SUBSCRIBE_DECISION on `session`. ids/counters only —\r\n // never PTY bytes. This is the same-conn different-floor re-take: the\r\n // caller's own writer is dropped by the broker's fallthrough, so when\r\n // a controller loses its seat with no Displaced event, THIS line is\r\n // what says the re-take was our own and names the floor it re-took at.\r\n spt_proto::emit_line_err!(\r\n \"ATTACH_INTENT_CHOSEN: site=gap_resume session={session_id} \\\r\n intent={intent_lbl} from_seq={floor} gen={gen}\"\r\n );\r\n brain.attach_as(session_id, floor, intent, gen, by)?;\r\n swallow_resume_ack = true;\r\n }\r","truncated":true,"truncatedBy":"lines","totalLines":1099,"totalBytes":15491,"outputLines":300,"outputBytes":15491,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1099,"displayContent":{"text":"//! Remote terminal attach (M4-D5b, REQ-INST-8) — serve a byte-stream viewport\r\n//! onto a local session for an operator on another node.\r\n//!\r\n//! The operator's daemon opened a bidi QUIC stream to this node (D4) and sent\r\n//! [`AttachRecord::Request`]; this module is the target-side pump between that\r\n//! stream and the local broker-hosted session:\r\n//!\r\n//! - session `Output` chunks → [`AttachRecord::Output`] lines onto the wire\r\n//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\r\n//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\r\n//! operator-minted `op_id` — exactly-once at the PTY write through the B5\r\n//! journal (a replayed input record cannot double-type);\r\n//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\r\n//!\r\n//! ## Exactly-once lives at the EDGES, not the wire sends\r\n//!\r\n//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\r\n//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\r\n//! and *discards* everything interleaved — inside a full-duplex pump loop that\r\n//! eats the operator's `Input` records (both sides starve; found the hard way\r\n//! in `tests/attach.rs`). Idempotency holds without it because each direction\r\n//! dedups at its **effect**: the PTY write is journaled by the operator-minted\r\n//! `Input.op_id`, and the operator's viewport dedups `Output` records by their\r\n//! session-log `seq` (the render cursor). A post-restart re-serve may\r\n//! re-transmit output records on the wire — duplicates are dropped at the\r\n//! render cursor, the same discipline the local `OutputLog` replay uses\r\n//! (REQ-HAZARD-RESTART-IDEMPOTENT at the boundary that matters).\r\n//!\r\n//! **Compute + files stay here**; the operator is a viewport (CONTEXT\r\n//! §Remote-control vs local operation). The access gate runs before anything\r\n//! is served: the [`AttachRecord::Request`] is *unsolicited wire inbound*, so\r\n//! [`access_check`] sees the **handshake-proven** origin from the broker's\r\n//! stream table — never payload bytes (KNOWN-HAZARDS 7.5). Remote-drive of\r\n//! your own running instance is ungated by default (ADR-0009 default-open);\r\n//! the D5d whitelist drops in at this same call.\r\n//!\r\n//! Restart survival composes from D4/B5 with **no new machinery**: the broker\r\n//! owns the QUIC stream, the session, its `OutputLog`, and the effect journal.\r\n//! A restarted target brain re-attaches the session from its output cursor,\r\n//! resubscribes the stream from its net cursor, and re-drives journaled sends;\r\n//! a restarted operator brain resubscribes and dedups rendered chunks by\r\n//! `Output.seq`.\r\n\r\nuse std::io;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\r\nuse spt_net::net::ndjson;\r\n\r\nuse crate::access::{access_check, surface, InboundClass};\r\n\r\n/// The control surface an attach request gates against: a read-only viewer is\r\n/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\r\n/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\r\n/// endpoint without also handing over its keyboard.\r\n// [impl->REQ-ACL-RC-VIEW-SPLIT]\r\nfn attach_surface(intent: AttachIntent) -> &'static str {\r\n match intent {\r\n AttachIntent::Viewer => surface::RC_VIEW,\r\n AttachIntent::Control | AttachIntent::Take => surface::RC_ATTACH,\r\n }\r\n}\r\n\r\n/// What the engine room's structural locks say about one attach attempt\r\n/// (ADR-0052 §3).\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub enum EngineRoomLock {\r\n /// Not the engine room, or an attach its locks allow.\r\n Pass,\r\n /// The engine room has no viewport at ANY origin — refused.\r\n NoViewport,\r\n /// The engine room takes its controls from its own node only — refused.\r\n NotFromOffNode,\r\n}\r\n\r\n/// The engine room's rc locks, pure (ADR-0052 §3: \"no rc view; controls from\r\n/// the node itself\").\r\n///\r\n/// Two things make this a CARVE-OUT rather than a rule row in the access store:\r\n///\r\n/// - it must beat the same-node loopback `Allow`, which precedes the resolution\r\n/// chain (`access::access_check` step 1) — and a local `rc` reaches the target\r\n/// over exactly that loopback origin, so a chain-level rule could never see it;\r\n/// - the engine room's operator must not be able to open a viewport by writing\r\n/// themself a rule. A watchable governance surface is a governance surface\r\n/// whose secrets are watchable.\r\n///\r\n/// `from_this_node` is the handshake-proven origin's own-node answer (a local\r\n/// IPC subscribe with no origin is this node by construction), never anything a\r\n/// caller supplied (KNOWN-HAZARDS 7.5).\r\n// [impl->REQ-ER-RC-INTENT-LOCKS]\r\npub fn classify_rc_lock(\r\n is_engine_room: bool,\r\n from_this_node: bool,\r\n intent: AttachIntent,\r\n) -> EngineRoomLock {\r\n if !is_engine_room {\r\n return EngineRoomLock::Pass;\r\n }\r\n // View is refused FIRST and unconditionally: it is the lock that holds even\r\n // at the console, so an off-node viewer hears the reason that would still\r\n // apply if it moved to this machine.\r\n if intent == AttachIntent::Viewer {\r\n return EngineRoomLock::NoViewport;\r\n }\r\n if !from_this_node {\r\n return EngineRoomLock::NotFromOffNode;\r\n }\r\n // Local Control and local Take both pass — a take displaces the incumbent\r\n // loudly and drops its authority (ADR-0052 §3a); it is not a lesser intent.\r\n EngineRoomLock::Pass\r\n}\r\n\r\nuse crate::brain::{now_ms, Brain, BrokerEvent};\r\nuse crate::effect::{Minter, MintedOp};\r\nuse crate::msg::{decode_bytes, encode_bytes};\r\n\r\n/// Feed the resting-state machine at the attach edges (D9-2, REQ-INST-3): a\r\n/// served viewport is a **driver** — attaching wakes the endpoint, the\r\n/// viewport ending detaches it (active → dormant; the transition echo is\r\n/// gate-armed for the endpoint's own pulse loop). Best-effort exactly like\r\n/// [`mark_driven_by`]: a session served without a perch has no resting\r\n/// record to move.\r\n// [impl->REQ-INST-3]\r\nfn feed_rest(endpoint: &str, event: crate::resting::RestEvent) {\r\n let _ = crate::resting::daemon_rest_event(endpoint, event, None);\r\n}\r\n\r\n/// Why a serve loop returned.\r\n#[derive(Debug, Clone, PartialEq, Eq)]\r\npub enum AttachServeOutcome {\r\n /// The access gate refused the requesting origin, OR a `Control` attach hit\r\n /// an endpoint a DIFFERENT operator already controls (busy-refuse,\r\n /// REQ-RCVIEW-1) — nothing was served. The operator's `rc` renders the\r\n /// busy guidance client-side from the endpoint's `driven_by`.\r\n Refused,\r\n /// The session's child exited; the `Exit` record was sent and the stream\r\n /// finished.\r\n Exited(Option),\r\n /// The operator closed its send side (detached); the viewport ended with\r\n /// the session still running.\r\n Detached,\r\n /// This controller was DISPLACED by a different operator's `--take`/`kick`\r\n /// (REQ-KICK-1): the loud `Displaced` notice was sent and the stream\r\n /// finished. The endpoint stays driven (by the taker) — no dormant edge.\r\n Displaced,\r\n}\r\n\r\n/// The role a serve loop resolved to, once the broker's [`SubscribeOutcome`]\r\n/// arrives — gates wake (controller-only) and PTY input.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\nenum ServeRole {\r\n /// The interactive controller (input + resize; wakes the endpoint).\r\n Controller,\r\n /// A read-only viewer (output only; wake-neutral).\r\n Viewer,\r\n}\r\n\r\n/// Minimum spacing between skip-to-live re-subscribes after a viewer eviction\r\n/// (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). HARD constraint: an evicted viewer that is\r\n/// hopelessly behind under a sustained flood will be re-evicted immediately after\r\n/// each re-subscribe; without spacing that is an evict→resubscribe CPU spin. With\r\n/// it, the operator sees an intermittent LIVE burst each interval (forward\r\n/// progress), never a busy-loop. ~200ms = several bursts/sec, imperceptible lag.\r\nconst RESUBSCRIBE_INTERVAL: Duration = Duration::from_millis(200);\r\n\r\n/// The CONTROLLER fell behind the live ring further than the ring holds — the\r\n/// dropped frames are GONE (`tail - delivered_through > cap_chunks`), so an\r\n/// exactly-once re-fetch is IMPOSSIBLE. Distinguishes the irrecoverable edge from\r\n/// an ordinary fatal so the serve loop can surface it (a marked truncation),\r\n/// rather than silent-skipping (a B2 lie) or spinning. Full graceful handling is\r\n/// DEFERRED to `REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND`.\r\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n#[derive(Debug)]\r\npub struct ControllerIrrecoverablyBehind {\r\n /// The frozen `delivered_through` floor the ring has already rolled past.\r\n pub floor: u64,\r\n}\r\n\r\nimpl std::fmt::Display for ControllerIrrecoverablyBehind {\r\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\r\n write!(\r\n f,\r\n \"controller fell irrecoverably behind the live ring at seq {} (dropped frames rolled out of the ring)\",\r\n self.floor\r\n )\r\n }\r\n}\r\n\r\nimpl std::error::Error for ControllerIrrecoverablyBehind {}\r\n\r\n/// Is `e` the brain's strict reject-gap fatal (`output gap: got seq N want M`)?\r\n/// That is the only error the controller gap-resume recovers from; every other\r\n/// error propagates unchanged.\r\nfn is_output_gap(e: &io::Error) -> bool {\r\n e.kind() == io::ErrorKind::InvalidData && e.to_string().contains(\"output gap\")\r\n}\r\n\r\n/// Read one [`BrokerEvent`] for an attached CONTROLLER, RESUMING-FROM-FLOOR on a\r\n/// b4 drop-don't-block output-gap instead of fataling.\r\n///\r\n/// b4 made the controller a non-blocking `try_send` that DROPS frames when its\r\n/// bounded channel is full (a controller that falls behind its own echo under a\r\n/// hard flood). The next frame this reader sees is then a FORWARD gap that the\r\n/// strict reject-gap (`read_event`, legacy single-session path) FATALS. A\r\n/// controller CANNOT snap-above like a viewer (B2: it is authoritative — it\r\n/// advances `delivered_through`; skipping rolled frames would be a not-exactly-once\r\n/// resume). So instead it RE-FETCHES: re-subscribe from\r\n/// [`Brain::controller_resume_floor`] (`= delivered_through`, frozen at the drop by\r\n/// `contiguous_advance`) and the broker replays the dropped frames from the ring.\r\n///\r\n/// Exactly-once holds IFF the ring still retains the floor (`tail - delivered_through\r\n/// <= cap_chunks`). If it does not — the controller fell behind further than the\r\n/// ring holds — the re-subscribe's first frame is STILL a forward gap (floor\r\n/// unchanged across two resumes). That is [`ControllerIrrecoverablyBehind`]: the\r\n/// caller surfaces it (marked truncation), never silent-skips (B2 lie) and never\r\n/// spins. The helper swallows the `Subscribed` ack its own re-subscribe produces so\r\n/// the repeated-gap detection is not masked. Non-`Output` events (NetStreamData /\r\n/// Size / Exit / …) pass through unchanged.\r\n// [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n/// `gen` is the serve worker's attach generation (ADR-0038 Amendment fix 6):\r\n/// the resume re-subscribe is the SAME Request re-fetching dropped frames, so\r\n/// it must carry the SAME generation — an equal-gen re-take preserves the\r\n/// incumbent `attach_gen`. Passing 0 here would reset the slot to legacy and\r\n/// (a) re-arm the stale-replay steal fix 6 refuses and (b) make the worker's\r\n/// own terminal `detach_session_gen` mismatch the slot it re-installed.\r\n// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\r\npub fn read_controller_event_resuming(\r\n brain: &mut Brain,\r\n session_id: u64,\r\n gen: u64,\r\n by: Option<&str>,\r\n) -> io::Result {\r\n read_controller_event_resuming_until(brain, session_id, gen, by, None)\r\n}\r\n\r\n/// Deadline-aware form of [`read_controller_event_resuming`].\r\n///\r\n/// Production callers pass no deadline through the wrapper above. Timed observers\r\n/// use this form so a quiet controller cannot hide their wall-clock bound inside an\r\n/// unbounded frame read.\r\npub fn read_controller_event_resuming_until(\r\n brain: &mut Brain,\r\n session_id: u64,\r\n gen: u64,\r\n by: Option<&str>,\r\n deadline: Option,\r\n) -> io::Result {\r\n let mut last_resume_floor: Option = None;\r\n let mut swallow_resume_ack = false;\r\n loop {\r\n match brain.read_event_until(deadline) {\r\n // Our own re-subscribe's Subscribed reply: swallow it (role is already\r\n // resolved) so it cannot mask a repeated gap as forward progress.\r\n Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\r\n swallow_resume_ack = false;\r\n continue;\r\n }\r\n Ok(ev) => return Ok(ev),\r\n Err(e) if is_output_gap(&e) => {\r\n let floor = brain.controller_resume_floor();\r\n if last_resume_floor == Some(floor) {\r\n // No progress across two resumes → the ring rolled past the\r\n // floor → the dropped frames are gone.\r\n return Err(io::Error::other(ControllerIrrecoverablyBehind { floor }));\r\n }\r\n last_resume_floor = Some(floor);\r\n // RE-FETCH from the frozen delivered_through (same operator `by` →\r\n // a silent re-take, no Displaced); the broker replays the dropped\r\n // frames from the ring.\r\n // No bring-up code here, and none is needed: this re-subscribe\r\n // arrives on the connection that already holds the seat, which is\r\n // exactly the exemption `engineroom::bringup_required` names — a\r\n // controller must not lose a gated endpoint's controls for having\r\n // fallen behind its own output.\r\n // THE decision, bound ONCE and passed: the same value is logged and\r\n // handed to `attach_as`, so the breadcrumb cannot drift from the\r\n // attach it describes. A separately-written label would still read\r\n // `control` on the day this choice becomes conditional.\r\n let intent = AttachIntent::Control;\r\n // Wildcard-free on purpose: a new `AttachIntent` variant must fail to\r\n // compile here rather than silently log as one of today's three.\r\n let intent_lbl = match intent {\r\n AttachIntent::Viewer => \"viewer\",\r\n AttachIntent::Control => \"control\",\r\n AttachIntent::Take => \"take\",\r\n };\r\n // Emitted BEFORE the re-subscribe, on the daemon stderr sink, joinable\r\n // to the broker's SUBSCRIBE_DECISION on `session`. ids/counters only —\r\n // never PTY bytes. This is the same-conn different-floor re-take: the\r\n // caller's own writer is dropped by the broker's fallthrough, so when\r\n // a controller loses its seat with no Displaced event, THIS line is\r\n // what says the re-take was our own and names the floor it re-took at.\r\n spt_proto::emit_line_err!(\r\n \"ATTACH_INTENT_CHOSEN: site=gap_resume session={session_id} \\\r\n intent={intent_lbl} from_seq={floor} gen={gen}\"\r\n );\r\n brain.attach_as(session_id, floor, intent, gen, by)?;\r\n swallow_resume_ack = true;\r\n }\r\n…\n }\n }\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,null,302,303,304]},"fileSize":54631,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt-daemon\\src\\attach.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1099,"totalBytes":15491,"outputLines":300,"outputBytes":15491,"shownRange":{"start":1,"end":300},"nextOffset":301}}},"isError":false,"timestamp":1789113814676}}
{"type":"message","id":"076e2616","parentId":"fe2ea2a4","timestamp":"2026-09-11T08:03:34.697Z","message":{"role":"toolResult","toolCallId":"call_E0cAWhnL6kYgvD5GoMYVSCxh|fc_07a38c9435caeae6016aa3b5d4325887d28c83c5965bfc53fa","toolName":"read","content":[{"type":"text","text":"//! `spt rc ` — the operator-side attach pump (M12-W1, REQ-RC-1): attach a\n//! local terminal to a broker-held PTY session.\n//!\n//! **One pump, swappable transport** (the doyle invariant). The attach protocol\n//! is `serve_attach` on the target side ⇄ this pump on the operator side, both\n//! speaking `AttachRecord` over a broker net-stream. *Local* attach is the\n//! degenerate single-node case: the operator dials its OWN node (loopback peer)\n//! and the broker's inbound-stream dispatch (`dispatch.rs`) runs `serve_attach`\n//! against the same broker — the exact cross-node accept+serve path, no local\n//! special-case branch. The one-path invariant lives at this pump, not the\n//! transport under the stream.\n//!\n//! **Detach never kills the session.** The broker owns the PTY; closing our send\n//! side ends the viewport with the session still running (`serve_attach` →\n//! `Detached`). PTY ownership stays with the broker (the KNOWN-HAZARDS\n//! attach-lifecycle invariant).\n//!\n//! **Single-Brain pump.** A `Brain` is `&mut`-single-threaded, so the main thread\n//! owns it: a stdin reader thread only *produces* raw bytes onto an mpsc channel\n//! (and watches for the detach keybind); the main loop interleaves draining that\n//! channel into `send_attach_input` with `read_event_until` for inbound `Output`.\n// [impl->REQ-RC-1]\n\nuse std::io::{Read, Write};\nuse std::sync::atomic::{AtomicU64, Ordering};\nuse std::sync::mpsc;\nuse std::time::{Duration, Instant};\n\nuse spt_daemon::attach::{\n request_attach_endpoint, send_attach_input, send_attach_resize, send_seal_ceremony_code,\n};\nuse spt_daemon::effect::{Minter, MintedOp};\nuse spt_daemon::brain::{now_ms, Brain, BrokerEvent};\nuse spt_daemon::msg::{decode_bytes, SEAL_CEREMONY_ADMITTED, SEAL_CEREMONY_REFUSED};\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\n\n/// The detach prefix: ctrl-b (0x02), matching the legacy capsule's prefix so the\n/// muscle memory carries over. `ctrl-b d` detaches; `ctrl-b ctrl-b` sends one\n/// literal ctrl-b to the session; any other byte after the prefix is sent\n/// through verbatim (prefix + byte). Documented in the CLI help.\nconst DETACH_PREFIX: u8 = 0x02; // ctrl-b\nconst DETACH_KEY: u8 = b'd';\n\n/// How long the main loop blocks for an inbound event before looping back to\n/// drain stdin — the full-duplex interleave granularity.\nconst POLL_SLICE: Duration = Duration::from_millis(40);\n\n/// A message from the stdin reader thread to the pump.\nenum StdinMsg {\n /// Raw bytes to forward to the session as `AttachRecord::Input`.\n Bytes(Vec),\n /// The operator hit the detach keybind — end the viewport, leave the session.\n Detach,\n}\n\n/// The harness's MOUSE-REPORTING mode, tracked from its OUTPUT stream's DECSET\n/// sequences (REQ-RC-MOUSE-FORWARD). On Windows `spt rc` captures the mouse (for\n/// right-click paste, REQ-RC-WIN-PASTE), which means WT forwards scroll-wheel\n/// events to us instead of scrolling its own buffer — so to keep scroll working we\n/// must FORWARD wheel events to the harness, but ONLY when the harness has asked\n/// for mouse reporting (else the bytes are garbage). The pump thread WRITES these\n/// (scanning output); the Windows stdin reader READS them to decide whether to\n/// forward a scroll. Two atomics so the cross-thread read is lock-free. Tracked on\n/// all platforms (the scan is cheap + keeps the model correct); only the Windows\n/// reader acts on it (Unix terminals scroll natively, no capture).\n#[derive(Default)]\nstruct MouseMode {\n /// The harness requested mouse reporting (DECSET 1000 / 1002 / 1003).\n enabled: std::sync::atomic::AtomicBool,\n /// The harness requested SGR extended coordinates (DECSET 1006). We forward a\n /// scroll only when this is on (the modern encoding the harness will parse).\n sgr: std::sync::atomic::AtomicBool,\n}\n\n/// Scans a harness OUTPUT byte stream for the mouse-reporting DECSET set/reset\n/// sequences and updates a [`MouseMode`] (REQ-RC-MOUSE-FORWARD). Pump-local +\n/// single-threaded, so it owns a small `carry` buffer to survive a sequence SPLIT\n/// across two output chunks (the harness's mouse-enable can land across a decoder\n/// boundary). Recognizes `ESC[?[;...]h|l` private-mode sequences; for each\n/// `n` in {1000,1002,1003} sets `enabled = (final=='h')`, for 1006 sets `sgr`.\n#[derive(Default)]\nstruct MouseModeScanner {\n /// A partial `ESC[?…` left dangling at a chunk boundary, prepended next feed.\n carry: Vec,\n}\n\n/// The longest incomplete private-mode prefix we keep across a chunk boundary. A\n/// longer dangling `ESC[?…` with no final `h`/`l` is not a mode-set we care about\n/// (runaway) — dropped rather than buffered unboundedly.\nconst MOUSE_DECSET_CARRY_MAX: usize = 32;\n\nimpl MouseModeScanner {\n /// Feed one output chunk; apply any complete DECSET mouse-mode toggles to\n /// `mode`, carrying a trailing partial sequence to the next call.\n fn feed(&mut self, mode: &MouseMode, chunk: &[u8]) {\n // Fast path: no ESC anywhere and nothing carried ⇒ nothing to do.\n if self.carry.is_empty() && !chunk.contains(&0x1b) {\n return;\n }\n let mut buf = std::mem::take(&mut self.carry);\n buf.extend_from_slice(chunk);\n let mut i = 0;\n while i < buf.len() {\n if buf[i] != 0x1b {\n i += 1;\n continue;\n }\n match parse_decset_private(&buf[i..]) {\n DecsetParse::Complete { consumed, params, set } => {\n for p in params {\n apply_mouse_mode(mode, p, set);\n }\n i += consumed;\n }\n // An incomplete `ESC[?…` at the tail: carry it (bounded) for the\n // next chunk; a too-long dangling run is treated as not-a-DECSET.\n DecsetParse::Incomplete => {\n let tail = &buf[i..];\n if tail.len() <= MOUSE_DECSET_CARRY_MAX {\n self.carry = tail.to_vec();\n }\n return;\n }\n // Not a private-mode sequence — skip this ESC, keep scanning.\n DecsetParse::NotDecset => i += 1,\n }\n }\n }\n}\n\n/// Result of trying to parse a private-mode set/reset at the start of `s` (which\n/// begins with `ESC`).\nenum DecsetParse {\n /// A complete `ESC[?h|l`: the byte length consumed, the numeric\n /// params, and `set` (`true` for `h`, `false` for `l`).\n Complete { consumed: usize, params: Vec, set: bool },\n /// `ESC[?…` with no final `h`/`l` yet (chunk boundary) — carry + retry.\n Incomplete,\n /// `s` does not start a private-mode sequence (`ESC` of something else).\n NotDecset,\n}\n\n/// Parse a single `ESC[?[;…]h|l` private-mode sequence at the\n/// start of `s`. Pure, so the split-across-chunk behavior unit-tests directly.\nfn parse_decset_private(s: &[u8]) -> DecsetParse {\n // Need at least `ESC [ ?`.\n if s.len() < 3 {\n // Could be the very start of one split across the boundary.\n if s.first() == Some(&0x1b) && s.get(1).is_none_or(|&b| b == b'[')\n && s.get(2).is_none_or(|&b| b == b'?')\n {\n return DecsetParse::Incomplete;\n }\n return DecsetParse::NotDecset;\n }\n if s[1] != b'[' || s[2] != b'?' {\n return DecsetParse::NotDecset;\n }\n let mut params: Vec = Vec::new();\n let mut cur: Option = None;\n let mut j = 3;\n while j < s.len() {\n match s[j] {\n b'0'..=b'9' => {\n let d = (s[j] - b'0') as u32;\n cur = Some(cur.unwrap_or(0).saturating_mul(10).saturating_add(d));\n }\n b';' => {\n params.push(cur.unwrap_or(0).min(u16::MAX as u32) as u16);\n cur = None;\n }\n b'h' | b'l' => {\n if let Some(v) = cur {\n params.push(v.min(u16::MAX as u32) as u16);\n }\n return DecsetParse::Complete {\n consumed: j + 1,\n params,\n set: s[j] == b'h',\n };\n }\n // Any other byte ⇒ this isn't a clean private-mode set/reset.\n _ => return DecsetParse::NotDecset,\n }\n j += 1;\n }\n // Ran out before a final `h`/`l` ⇒ split across the chunk boundary.\n DecsetParse::Incomplete\n}\n\n/// Apply one DECSET private-mode toggle to the tracked [`MouseMode`].\nfn apply_mouse_mode(mode: &MouseMode, param: u16, set: bool) {\n use std::sync::atomic::Ordering::Release;\n match param {\n 1000 | 1002 | 1003 => mode.enabled.store(set, Release),\n 1006 => mode.sgr.store(set, Release),\n _ => {}\n }\n}\n\n/// Bug #14 (REQ-RC-IDMARKER-DISABLE): ship the top-right endpoint-id status\n/// marker DISABLED. As a one-shot absolutely-positioned paint it scrolls off\n/// screen and is never re-stickied (#14), and its DECSC/clear/SGR injection\n/// splices into the harness's in-flight drawing, leaving residual artifacts on\n/// animate/scroll/resize (#7/#8). Operator ruling: OFF for now — revisit as a\n/// proper per-frame sticky overlay only once REQ-BROKER-SCREEN-GRID provides a\n/// server-side screen model (the concept is saved for a future web SPT GUI).\n/// Flip to `true` to restore the v0.16.0 W6 behavior (the StatusRow byte-emit\n/// machinery + its unit tests are kept intact, only the wiring is gated).\nconst STATUS_ROW_ENABLED: bool = false;\n\n/// Whether the controller reserved-row identity marker is active for this attach:\n/// only for a controller (a viewer's viewport is read-only) AND only while the\n/// marker is enabled (bug #14 ships it off).\n// [impl->REQ-RC-IDMARKER-DISABLE]\nfn status_row_active(view: bool) -> bool {\n !view && STATUS_ROW_ENABLED\n}\n\n/// The CONTROLLER's reserved TOP status row (v0.16.0 W6, REQ-RC-IDENTITY): a\n/// one-line identity banner — `{subnet} : {endpoint_id} @ {node}` — painted on the\n/// real terminal's row 1, right-aligned + cyan, while the harness PTY runs in a\n/// scroll region reserving that row (DECSTBM). It tells the operator WHICH endpoint\n/// on WHICH node they are driving, so a multi-attach operator never types into the\n/// wrong session. Pure byte-emit (no I/O) so the exact VT shapes unit-test\n/// directly; the pump writes the bytes. Tracks the FULL terminal `rows` (it paints\n/// row 1 on the real terminal) while the PTY is told it has `rows - 1`.\n// [impl->REQ-RC-IDENTITY]\nstruct StatusRow {\n /// The resolved identity line (ASCII status text, right-aligned on paint).\n text: String,\n /// The REAL terminal row count (the status owns row 1; the PTY gets rows-1).\n rows: u16,\n /// The terminal column count (the right-align anchor).\n cols: u16,\n}\n\nimpl StatusRow {\n /// Set the DECSTBM scroll region to reserve row 1, then paint the banner.\n /// `ESC[2;{rows}r` makes the harness scroll within rows 2..=rows (the harness\n /// never touches row 1), then [`repaint_bytes`](Self::repaint_bytes) draws it.\n // [impl->REQ-RC-IDENTITY]\n fn assert_bytes(&self) -> Vec {\n let mut out = Vec::new();\n // Reserve the top row: top margin = line 2, bottom margin = rows.\n out.extend_from_slice(format!(\"\\x1b[2;{}r\", self.rows).as_bytes());\n out.extend_from_slice(&self.repaint_bytes());\n out\n }\n\n /// Repaint row 1 WITHOUT disturbing the harness cursor: save cursor (DECSC),\n /// home to row 1, clear the line, jump to the right-aligned start column, set\n /// cyan, write the text, reset SGR, restore cursor (DECRC). The right-align\n /// start column is `cols - width + 1` clamped to ≥ 1 (text wider than the\n /// terminal starts at col 1 and is allowed to fill the row).\n // [impl->REQ-RC-IDENTITY]\n fn repaint_bytes(&self) -> Vec {\n let width = self.display_width();\n // Right-align: 1-based start column, clamped to col 1 when text ≥ cols.\n let col = (self.cols as usize)\n .saturating_sub(width)\n .saturating_add(1)\n .max(1);\n let mut out = Vec::new();\n out.extend_from_slice(b\"\\x1b7\"); // DECSC: save cursor\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1, col 1\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the whole line\n out.extend_from_slice(format!(\"\\x1b[1;{col}H\").as_bytes()); // right-align start\n out.extend_from_slice(b\"\\x1b[36m\"); // cyan\n out.extend_from_slice(self.text.as_bytes());\n out.extend_from_slice(b\"\\x1b[0m\"); // reset SGR\n out.extend_from_slice(b\"\\x1b8\"); // DECRC: restore cursor\n out\n }\n\n /// Tear the status down on detach: reset the scroll region to the full screen\n /// (`ESC[r`), home to row 1, clear it — so the terminal is clean afterward.\n // [impl->REQ-RC-IDENTITY]\n fn restore_bytes() -> Vec {\n let mut out = Vec::new();\n out.extend_from_slice(b\"\\x1b[r\"); // reset scroll region (full screen)\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the reclaimed row\n out\n }\n\n /// Update the tracked terminal size on a window-change (the pump re-asserts\n /// the margin + repaints after).\n // [impl->REQ-RC-IDENTITY]\n fn update_size(&mut self, rows: u16, cols: u16) {\n self.rows = rows;\n self.cols = cols;\n }\n\n /// The on-screen width of the banner. ASCII status text, so a `chars` count is\n /// the cell width (no wide-char / combining concerns here).\n fn display_width(&self) -> usize {\n self.text.chars().count()\n }\n}\n\n[Showing lines 1-300 of 5692. Use :301 to continue]"}],"details":{"truncation":{"content":"//! `spt rc ` — the operator-side attach pump (M12-W1, REQ-RC-1): attach a\r\n//! local terminal to a broker-held PTY session.\r\n//!\r\n//! **One pump, swappable transport** (the doyle invariant). The attach protocol\r\n//! is `serve_attach` on the target side ⇄ this pump on the operator side, both\r\n//! speaking `AttachRecord` over a broker net-stream. *Local* attach is the\r\n//! degenerate single-node case: the operator dials its OWN node (loopback peer)\r\n//! and the broker's inbound-stream dispatch (`dispatch.rs`) runs `serve_attach`\r\n//! against the same broker — the exact cross-node accept+serve path, no local\r\n//! special-case branch. The one-path invariant lives at this pump, not the\r\n//! transport under the stream.\r\n//!\r\n//! **Detach never kills the session.** The broker owns the PTY; closing our send\r\n//! side ends the viewport with the session still running (`serve_attach` →\r\n//! `Detached`). PTY ownership stays with the broker (the KNOWN-HAZARDS\r\n//! attach-lifecycle invariant).\r\n//!\r\n//! **Single-Brain pump.** A `Brain` is `&mut`-single-threaded, so the main thread\r\n//! owns it: a stdin reader thread only *produces* raw bytes onto an mpsc channel\r\n//! (and watches for the detach keybind); the main loop interleaves draining that\r\n//! channel into `send_attach_input` with `read_event_until` for inbound `Output`.\r\n// [impl->REQ-RC-1]\r\n\r\nuse std::io::{Read, Write};\r\nuse std::sync::atomic::{AtomicU64, Ordering};\r\nuse std::sync::mpsc;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_daemon::attach::{\r\n request_attach_endpoint, send_attach_input, send_attach_resize, send_seal_ceremony_code,\r\n};\r\nuse spt_daemon::effect::{Minter, MintedOp};\r\nuse spt_daemon::brain::{now_ms, Brain, BrokerEvent};\r\nuse spt_daemon::msg::{decode_bytes, SEAL_CEREMONY_ADMITTED, SEAL_CEREMONY_REFUSED};\r\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\r\n\r\n/// The detach prefix: ctrl-b (0x02), matching the legacy capsule's prefix so the\r\n/// muscle memory carries over. `ctrl-b d` detaches; `ctrl-b ctrl-b` sends one\r\n/// literal ctrl-b to the session; any other byte after the prefix is sent\r\n/// through verbatim (prefix + byte). Documented in the CLI help.\r\nconst DETACH_PREFIX: u8 = 0x02; // ctrl-b\r\nconst DETACH_KEY: u8 = b'd';\r\n\r\n/// How long the main loop blocks for an inbound event before looping back to\r\n/// drain stdin — the full-duplex interleave granularity.\r\nconst POLL_SLICE: Duration = Duration::from_millis(40);\r\n\r\n/// A message from the stdin reader thread to the pump.\r\nenum StdinMsg {\r\n /// Raw bytes to forward to the session as `AttachRecord::Input`.\r\n Bytes(Vec),\r\n /// The operator hit the detach keybind — end the viewport, leave the session.\r\n Detach,\r\n}\r\n\r\n/// The harness's MOUSE-REPORTING mode, tracked from its OUTPUT stream's DECSET\r\n/// sequences (REQ-RC-MOUSE-FORWARD). On Windows `spt rc` captures the mouse (for\r\n/// right-click paste, REQ-RC-WIN-PASTE), which means WT forwards scroll-wheel\r\n/// events to us instead of scrolling its own buffer — so to keep scroll working we\r\n/// must FORWARD wheel events to the harness, but ONLY when the harness has asked\r\n/// for mouse reporting (else the bytes are garbage). The pump thread WRITES these\r\n/// (scanning output); the Windows stdin reader READS them to decide whether to\r\n/// forward a scroll. Two atomics so the cross-thread read is lock-free. Tracked on\r\n/// all platforms (the scan is cheap + keeps the model correct); only the Windows\r\n/// reader acts on it (Unix terminals scroll natively, no capture).\r\n#[derive(Default)]\r\nstruct MouseMode {\r\n /// The harness requested mouse reporting (DECSET 1000 / 1002 / 1003).\r\n enabled: std::sync::atomic::AtomicBool,\r\n /// The harness requested SGR extended coordinates (DECSET 1006). We forward a\r\n /// scroll only when this is on (the modern encoding the harness will parse).\r\n sgr: std::sync::atomic::AtomicBool,\r\n}\r\n\r\n/// Scans a harness OUTPUT byte stream for the mouse-reporting DECSET set/reset\r\n/// sequences and updates a [`MouseMode`] (REQ-RC-MOUSE-FORWARD). Pump-local +\r\n/// single-threaded, so it owns a small `carry` buffer to survive a sequence SPLIT\r\n/// across two output chunks (the harness's mouse-enable can land across a decoder\r\n/// boundary). Recognizes `ESC[?[;...]h|l` private-mode sequences; for each\r\n/// `n` in {1000,1002,1003} sets `enabled = (final=='h')`, for 1006 sets `sgr`.\r\n#[derive(Default)]\r\nstruct MouseModeScanner {\r\n /// A partial `ESC[?…` left dangling at a chunk boundary, prepended next feed.\r\n carry: Vec,\r\n}\r\n\r\n/// The longest incomplete private-mode prefix we keep across a chunk boundary. A\r\n/// longer dangling `ESC[?…` with no final `h`/`l` is not a mode-set we care about\r\n/// (runaway) — dropped rather than buffered unboundedly.\r\nconst MOUSE_DECSET_CARRY_MAX: usize = 32;\r\n\r\nimpl MouseModeScanner {\r\n /// Feed one output chunk; apply any complete DECSET mouse-mode toggles to\r\n /// `mode`, carrying a trailing partial sequence to the next call.\r\n fn feed(&mut self, mode: &MouseMode, chunk: &[u8]) {\r\n // Fast path: no ESC anywhere and nothing carried ⇒ nothing to do.\r\n if self.carry.is_empty() && !chunk.contains(&0x1b) {\r\n return;\r\n }\r\n let mut buf = std::mem::take(&mut self.carry);\r\n buf.extend_from_slice(chunk);\r\n let mut i = 0;\r\n while i < buf.len() {\r\n if buf[i] != 0x1b {\r\n i += 1;\r\n continue;\r\n }\r\n match parse_decset_private(&buf[i..]) {\r\n DecsetParse::Complete { consumed, params, set } => {\r\n for p in params {\r\n apply_mouse_mode(mode, p, set);\r\n }\r\n i += consumed;\r\n }\r\n // An incomplete `ESC[?…` at the tail: carry it (bounded) for the\r\n // next chunk; a too-long dangling run is treated as not-a-DECSET.\r\n DecsetParse::Incomplete => {\r\n let tail = &buf[i..];\r\n if tail.len() <= MOUSE_DECSET_CARRY_MAX {\r\n self.carry = tail.to_vec();\r\n }\r\n return;\r\n }\r\n // Not a private-mode sequence — skip this ESC, keep scanning.\r\n DecsetParse::NotDecset => i += 1,\r\n }\r\n }\r\n }\r\n}\r\n\r\n/// Result of trying to parse a private-mode set/reset at the start of `s` (which\r\n/// begins with `ESC`).\r\nenum DecsetParse {\r\n /// A complete `ESC[?h|l`: the byte length consumed, the numeric\r\n /// params, and `set` (`true` for `h`, `false` for `l`).\r\n Complete { consumed: usize, params: Vec, set: bool },\r\n /// `ESC[?…` with no final `h`/`l` yet (chunk boundary) — carry + retry.\r\n Incomplete,\r\n /// `s` does not start a private-mode sequence (`ESC` of something else).\r\n NotDecset,\r\n}\r\n\r\n/// Parse a single `ESC[?[;…]h|l` private-mode sequence at the\r\n/// start of `s`. Pure, so the split-across-chunk behavior unit-tests directly.\r\nfn parse_decset_private(s: &[u8]) -> DecsetParse {\r\n // Need at least `ESC [ ?`.\r\n if s.len() < 3 {\r\n // Could be the very start of one split across the boundary.\r\n if s.first() == Some(&0x1b) && s.get(1).is_none_or(|&b| b == b'[')\r\n && s.get(2).is_none_or(|&b| b == b'?')\r\n {\r\n return DecsetParse::Incomplete;\r\n }\r\n return DecsetParse::NotDecset;\r\n }\r\n if s[1] != b'[' || s[2] != b'?' {\r\n return DecsetParse::NotDecset;\r\n }\r\n let mut params: Vec = Vec::new();\r\n let mut cur: Option = None;\r\n let mut j = 3;\r\n while j < s.len() {\r\n match s[j] {\r\n b'0'..=b'9' => {\r\n let d = (s[j] - b'0') as u32;\r\n cur = Some(cur.unwrap_or(0).saturating_mul(10).saturating_add(d));\r\n }\r\n b';' => {\r\n params.push(cur.unwrap_or(0).min(u16::MAX as u32) as u16);\r\n cur = None;\r\n }\r\n b'h' | b'l' => {\r\n if let Some(v) = cur {\r\n params.push(v.min(u16::MAX as u32) as u16);\r\n }\r\n return DecsetParse::Complete {\r\n consumed: j + 1,\r\n params,\r\n set: s[j] == b'h',\r\n };\r\n }\r\n // Any other byte ⇒ this isn't a clean private-mode set/reset.\r\n _ => return DecsetParse::NotDecset,\r\n }\r\n j += 1;\r\n }\r\n // Ran out before a final `h`/`l` ⇒ split across the chunk boundary.\r\n DecsetParse::Incomplete\r\n}\r\n\r\n/// Apply one DECSET private-mode toggle to the tracked [`MouseMode`].\r\nfn apply_mouse_mode(mode: &MouseMode, param: u16, set: bool) {\r\n use std::sync::atomic::Ordering::Release;\r\n match param {\r\n 1000 | 1002 | 1003 => mode.enabled.store(set, Release),\r\n 1006 => mode.sgr.store(set, Release),\r\n _ => {}\r\n }\r\n}\r\n\r\n/// Bug #14 (REQ-RC-IDMARKER-DISABLE): ship the top-right endpoint-id status\r\n/// marker DISABLED. As a one-shot absolutely-positioned paint it scrolls off\r\n/// screen and is never re-stickied (#14), and its DECSC/clear/SGR injection\r\n/// splices into the harness's in-flight drawing, leaving residual artifacts on\r\n/// animate/scroll/resize (#7/#8). Operator ruling: OFF for now — revisit as a\r\n/// proper per-frame sticky overlay only once REQ-BROKER-SCREEN-GRID provides a\r\n/// server-side screen model (the concept is saved for a future web SPT GUI).\r\n/// Flip to `true` to restore the v0.16.0 W6 behavior (the StatusRow byte-emit\r\n/// machinery + its unit tests are kept intact, only the wiring is gated).\r\nconst STATUS_ROW_ENABLED: bool = false;\r\n\r\n/// Whether the controller reserved-row identity marker is active for this attach:\r\n/// only for a controller (a viewer's viewport is read-only) AND only while the\r\n/// marker is enabled (bug #14 ships it off).\r\n// [impl->REQ-RC-IDMARKER-DISABLE]\r\nfn status_row_active(view: bool) -> bool {\r\n !view && STATUS_ROW_ENABLED\r\n}\r\n\r\n/// The CONTROLLER's reserved TOP status row (v0.16.0 W6, REQ-RC-IDENTITY): a\r\n/// one-line identity banner — `{subnet} : {endpoint_id} @ {node}` — painted on the\r\n/// real terminal's row 1, right-aligned + cyan, while the harness PTY runs in a\r\n/// scroll region reserving that row (DECSTBM). It tells the operator WHICH endpoint\r\n/// on WHICH node they are driving, so a multi-attach operator never types into the\r\n/// wrong session. Pure byte-emit (no I/O) so the exact VT shapes unit-test\r\n/// directly; the pump writes the bytes. Tracks the FULL terminal `rows` (it paints\r\n/// row 1 on the real terminal) while the PTY is told it has `rows - 1`.\r\n// [impl->REQ-RC-IDENTITY]\r\nstruct StatusRow {\r\n /// The resolved identity line (ASCII status text, right-aligned on paint).\r\n text: String,\r\n /// The REAL terminal row count (the status owns row 1; the PTY gets rows-1).\r\n rows: u16,\r\n /// The terminal column count (the right-align anchor).\r\n cols: u16,\r\n}\r\n\r\nimpl StatusRow {\r\n /// Set the DECSTBM scroll region to reserve row 1, then paint the banner.\r\n /// `ESC[2;{rows}r` makes the harness scroll within rows 2..=rows (the harness\r\n /// never touches row 1), then [`repaint_bytes`](Self::repaint_bytes) draws it.\r\n // [impl->REQ-RC-IDENTITY]\r\n fn assert_bytes(&self) -> Vec {\r\n let mut out = Vec::new();\r\n // Reserve the top row: top margin = line 2, bottom margin = rows.\r\n out.extend_from_slice(format!(\"\\x1b[2;{}r\", self.rows).as_bytes());\r\n out.extend_from_slice(&self.repaint_bytes());\r\n out\r\n }\r\n\r\n /// Repaint row 1 WITHOUT disturbing the harness cursor: save cursor (DECSC),\r\n /// home to row 1, clear the line, jump to the right-aligned start column, set\r\n /// cyan, write the text, reset SGR, restore cursor (DECRC). The right-align\r\n /// start column is `cols - width + 1` clamped to ≥ 1 (text wider than the\r\n /// terminal starts at col 1 and is allowed to fill the row).\r\n // [impl->REQ-RC-IDENTITY]\r\n fn repaint_bytes(&self) -> Vec {\r\n let width = self.display_width();\r\n // Right-align: 1-based start column, clamped to col 1 when text ≥ cols.\r\n let col = (self.cols as usize)\r\n .saturating_sub(width)\r\n .saturating_add(1)\r\n .max(1);\r\n let mut out = Vec::new();\r\n out.extend_from_slice(b\"\\x1b7\"); // DECSC: save cursor\r\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1, col 1\r\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the whole line\r\n out.extend_from_slice(format!(\"\\x1b[1;{col}H\").as_bytes()); // right-align start\r\n out.extend_from_slice(b\"\\x1b[36m\"); // cyan\r\n out.extend_from_slice(self.text.as_bytes());\r\n out.extend_from_slice(b\"\\x1b[0m\"); // reset SGR\r\n out.extend_from_slice(b\"\\x1b8\"); // DECRC: restore cursor\r\n out\r\n }\r\n\r\n /// Tear the status down on detach: reset the scroll region to the full screen\r\n /// (`ESC[r`), home to row 1, clear it — so the terminal is clean afterward.\r\n // [impl->REQ-RC-IDENTITY]\r\n fn restore_bytes() -> Vec {\r\n let mut out = Vec::new();\r\n out.extend_from_slice(b\"\\x1b[r\"); // reset scroll region (full screen)\r\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1\r\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the reclaimed row\r\n out\r\n }\r\n\r\n /// Update the tracked terminal size on a window-change (the pump re-asserts\r\n /// the margin + repaints after).\r\n // [impl->REQ-RC-IDENTITY]\r\n fn update_size(&mut self, rows: u16, cols: u16) {\r\n self.rows = rows;\r\n self.cols = cols;\r\n }\r\n\r\n /// The on-screen width of the banner. ASCII status text, so a `chars` count is\r\n /// the cell width (no wide-char / combining concerns here).\r\n fn display_width(&self) -> usize {\r\n self.text.chars().count()\r\n }\r\n}\r","truncated":true,"truncatedBy":"lines","totalLines":5692,"totalBytes":14055,"outputLines":300,"outputBytes":14055,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5692,"displayContent":{"text":"//! `spt rc ` — the operator-side attach pump (M12-W1, REQ-RC-1): attach a\r\n//! local terminal to a broker-held PTY session.\r\n//!\r\n//! **One pump, swappable transport** (the doyle invariant). The attach protocol\r\n//! is `serve_attach` on the target side ⇄ this pump on the operator side, both\r\n//! speaking `AttachRecord` over a broker net-stream. *Local* attach is the\r\n//! degenerate single-node case: the operator dials its OWN node (loopback peer)\r\n//! and the broker's inbound-stream dispatch (`dispatch.rs`) runs `serve_attach`\r\n//! against the same broker — the exact cross-node accept+serve path, no local\r\n//! special-case branch. The one-path invariant lives at this pump, not the\r\n//! transport under the stream.\r\n//!\r\n//! **Detach never kills the session.** The broker owns the PTY; closing our send\r\n//! side ends the viewport with the session still running (`serve_attach` →\r\n//! `Detached`). PTY ownership stays with the broker (the KNOWN-HAZARDS\r\n//! attach-lifecycle invariant).\r\n//!\r\n//! **Single-Brain pump.** A `Brain` is `&mut`-single-threaded, so the main thread\r\n//! owns it: a stdin reader thread only *produces* raw bytes onto an mpsc channel\r\n//! (and watches for the detach keybind); the main loop interleaves draining that\r\n//! channel into `send_attach_input` with `read_event_until` for inbound `Output`.\r\n// [impl->REQ-RC-1]\r\n\r\nuse std::io::{Read, Write};\r\nuse std::sync::atomic::{AtomicU64, Ordering};\r\nuse std::sync::mpsc;\r\nuse std::time::{Duration, Instant};\r\n\r\nuse spt_daemon::attach::{\r\n request_attach_endpoint, send_attach_input, send_attach_resize, send_seal_ceremony_code,\r\n};\r\nuse spt_daemon::effect::{Minter, MintedOp};\r\nuse spt_daemon::brain::{now_ms, Brain, BrokerEvent};\r\nuse spt_daemon::msg::{decode_bytes, SEAL_CEREMONY_ADMITTED, SEAL_CEREMONY_REFUSED};\r\nuse spt_net::net::attach::{AttachDecoder, AttachIntent, AttachRecord};\r\n\r\n/// The detach prefix: ctrl-b (0x02), matching the legacy capsule's prefix so the\r\n/// muscle memory carries over. `ctrl-b d` detaches; `ctrl-b ctrl-b` sends one\r\n/// literal ctrl-b to the session; any other byte after the prefix is sent\r\n/// through verbatim (prefix + byte). Documented in the CLI help.\r\nconst DETACH_PREFIX: u8 = 0x02; // ctrl-b\r\nconst DETACH_KEY: u8 = b'd';\r\n\r\n/// How long the main loop blocks for an inbound event before looping back to\r\n/// drain stdin — the full-duplex interleave granularity.\r\nconst POLL_SLICE: Duration = Duration::from_millis(40);\r\n\r\n/// A message from the stdin reader thread to the pump.\r\nenum StdinMsg {\r\n /// Raw bytes to forward to the session as `AttachRecord::Input`.\r\n Bytes(Vec),\r\n /// The operator hit the detach keybind — end the viewport, leave the session.\r\n Detach,\r\n}\r\n\r\n/// The harness's MOUSE-REPORTING mode, tracked from its OUTPUT stream's DECSET\r\n/// sequences (REQ-RC-MOUSE-FORWARD). On Windows `spt rc` captures the mouse (for\r\n/// right-click paste, REQ-RC-WIN-PASTE), which means WT forwards scroll-wheel\r\n/// events to us instead of scrolling its own buffer — so to keep scroll working we\r\n/// must FORWARD wheel events to the harness, but ONLY when the harness has asked\r\n/// for mouse reporting (else the bytes are garbage). The pump thread WRITES these\r\n/// (scanning output); the Windows stdin reader READS them to decide whether to\r\n/// forward a scroll. Two atomics so the cross-thread read is lock-free. Tracked on\r\n/// all platforms (the scan is cheap + keeps the model correct); only the Windows\r\n/// reader acts on it (Unix terminals scroll natively, no capture).\r\n#[derive(Default)]\r\nstruct MouseMode {\r\n /// The harness requested mouse reporting (DECSET 1000 / 1002 / 1003).\r\n enabled: std::sync::atomic::AtomicBool,\r\n /// The harness requested SGR extended coordinates (DECSET 1006). We forward a\r\n /// scroll only when this is on (the modern encoding the harness will parse).\r\n sgr: std::sync::atomic::AtomicBool,\r\n}\r\n\r\n/// Scans a harness OUTPUT byte stream for the mouse-reporting DECSET set/reset\r\n/// sequences and updates a [`MouseMode`] (REQ-RC-MOUSE-FORWARD). Pump-local +\r\n/// single-threaded, so it owns a small `carry` buffer to survive a sequence SPLIT\r\n/// across two output chunks (the harness's mouse-enable can land across a decoder\r\n/// boundary). Recognizes `ESC[?[;...]h|l` private-mode sequences; for each\r\n/// `n` in {1000,1002,1003} sets `enabled = (final=='h')`, for 1006 sets `sgr`.\r\n#[derive(Default)]\r\nstruct MouseModeScanner {\r\n /// A partial `ESC[?…` left dangling at a chunk boundary, prepended next feed.\r\n carry: Vec,\r\n}\r\n\r\n/// The longest incomplete private-mode prefix we keep across a chunk boundary. A\r\n/// longer dangling `ESC[?…` with no final `h`/`l` is not a mode-set we care about\r\n/// (runaway) — dropped rather than buffered unboundedly.\r\nconst MOUSE_DECSET_CARRY_MAX: usize = 32;\r\n\r\nimpl MouseModeScanner {\r\n /// Feed one output chunk; apply any complete DECSET mouse-mode toggles to\r\n /// `mode`, carrying a trailing partial sequence to the next call.\r\n fn feed(&mut self, mode: &MouseMode, chunk: &[u8]) {\r\n // Fast path: no ESC anywhere and nothing carried ⇒ nothing to do.\r\n if self.carry.is_empty() && !chunk.contains(&0x1b) {\r\n return;\r\n }\r\n let mut buf = std::mem::take(&mut self.carry);\r\n buf.extend_from_slice(chunk);\r\n let mut i = 0;\r\n while i < buf.len() {\r\n if buf[i] != 0x1b {\r\n i += 1;\r\n continue;\r\n }\r\n match parse_decset_private(&buf[i..]) {\r\n DecsetParse::Complete { consumed, params, set } => {\r\n for p in params {\r\n apply_mouse_mode(mode, p, set);\r\n }\r\n i += consumed;\r\n }\r\n // An incomplete `ESC[?…` at the tail: carry it (bounded) for the\r\n // next chunk; a too-long dangling run is treated as not-a-DECSET.\r\n DecsetParse::Incomplete => {\r\n let tail = &buf[i..];\r\n if tail.len() <= MOUSE_DECSET_CARRY_MAX {\r\n self.carry = tail.to_vec();\r\n }\r\n return;\r\n }\r\n // Not a private-mode sequence — skip this ESC, keep scanning.\r\n DecsetParse::NotDecset => i += 1,\r\n }\r\n }\r\n }\r\n}\r\n\r\n/// Result of trying to parse a private-mode set/reset at the start of `s` (which\r\n/// begins with `ESC`).\r\nenum DecsetParse {\r\n /// A complete `ESC[?h|l`: the byte length consumed, the numeric\r\n /// params, and `set` (`true` for `h`, `false` for `l`).\r\n Complete { consumed: usize, params: Vec, set: bool },\r\n /// `ESC[?…` with no final `h`/`l` yet (chunk boundary) — carry + retry.\r\n Incomplete,\r\n /// `s` does not start a private-mode sequence (`ESC` of something else).\r\n NotDecset,\r\n}\r\n\r\n/// Parse a single `ESC[?[;…]h|l` private-mode sequence at the\r\n/// start of `s`. Pure, so the split-across-chunk behavior unit-tests directly.\r\nfn parse_decset_private(s: &[u8]) -> DecsetParse {\r\n // Need at least `ESC [ ?`.\r\n if s.len() < 3 {\r\n // Could be the very start of one split across the boundary.\r\n if s.first() == Some(&0x1b) && s.get(1).is_none_or(|&b| b == b'[')\r\n && s.get(2).is_none_or(|&b| b == b'?')\r\n {\r\n return DecsetParse::Incomplete;\r\n }\r\n return DecsetParse::NotDecset;\r\n }\r\n if s[1] != b'[' || s[2] != b'?' {\r\n return DecsetParse::NotDecset;\r\n }\r\n let mut params: Vec = Vec::new();\r\n let mut cur: Option = None;\r\n let mut j = 3;\r\n while j < s.len() {\r\n match s[j] {\r\n b'0'..=b'9' => {\r\n let d = (s[j] - b'0') as u32;\r\n cur = Some(cur.unwrap_or(0).saturating_mul(10).saturating_add(d));\r\n }\r\n b';' => {\r\n params.push(cur.unwrap_or(0).min(u16::MAX as u32) as u16);\r\n cur = None;\r\n }\r\n b'h' | b'l' => {\r\n if let Some(v) = cur {\r\n params.push(v.min(u16::MAX as u32) as u16);\r\n }\r\n return DecsetParse::Complete {\r\n consumed: j + 1,\r\n params,\r\n set: s[j] == b'h',\r\n };\r\n }\r\n // Any other byte ⇒ this isn't a clean private-mode set/reset.\r\n _ => return DecsetParse::NotDecset,\r\n }\r\n j += 1;\r\n }\r\n // Ran out before a final `h`/`l` ⇒ split across the chunk boundary.\r\n DecsetParse::Incomplete\r\n}\r\n\r\n/// Apply one DECSET private-mode toggle to the tracked [`MouseMode`].\r\nfn apply_mouse_mode(mode: &MouseMode, param: u16, set: bool) {\r\n use std::sync::atomic::Ordering::Release;\r\n match param {\r\n 1000 | 1002 | 1003 => mode.enabled.store(set, Release),\r\n 1006 => mode.sgr.store(set, Release),\r\n _ => {}\r\n }\r\n}\r\n\r\n/// Bug #14 (REQ-RC-IDMARKER-DISABLE): ship the top-right endpoint-id status\r\n/// marker DISABLED. As a one-shot absolutely-positioned paint it scrolls off\r\n/// screen and is never re-stickied (#14), and its DECSC/clear/SGR injection\r\n/// splices into the harness's in-flight drawing, leaving residual artifacts on\r\n/// animate/scroll/resize (#7/#8). Operator ruling: OFF for now — revisit as a\r\n/// proper per-frame sticky overlay only once REQ-BROKER-SCREEN-GRID provides a\r\n/// server-side screen model (the concept is saved for a future web SPT GUI).\r\n/// Flip to `true` to restore the v0.16.0 W6 behavior (the StatusRow byte-emit\r\n/// machinery + its unit tests are kept intact, only the wiring is gated).\r\nconst STATUS_ROW_ENABLED: bool = false;\r\n\r\n/// Whether the controller reserved-row identity marker is active for this attach:\r\n/// only for a controller (a viewer's viewport is read-only) AND only while the\r\n/// marker is enabled (bug #14 ships it off).\r\n// [impl->REQ-RC-IDMARKER-DISABLE]\r\nfn status_row_active(view: bool) -> bool {\r\n !view && STATUS_ROW_ENABLED\r\n}\r\n\r\n/// The CONTROLLER's reserved TOP status row (v0.16.0 W6, REQ-RC-IDENTITY): a\r\n/// one-line identity banner — `{subnet} : {endpoint_id} @ {node}` — painted on the\r\n/// real terminal's row 1, right-aligned + cyan, while the harness PTY runs in a\r\n/// scroll region reserving that row (DECSTBM). It tells the operator WHICH endpoint\r\n/// on WHICH node they are driving, so a multi-attach operator never types into the\r\n/// wrong session. Pure byte-emit (no I/O) so the exact VT shapes unit-test\r\n/// directly; the pump writes the bytes. Tracks the FULL terminal `rows` (it paints\r\n/// row 1 on the real terminal) while the PTY is told it has `rows - 1`.\r\n// [impl->REQ-RC-IDENTITY]\r\nstruct StatusRow {\r\n /// The resolved identity line (ASCII status text, right-aligned on paint).\r\n text: String,\r\n /// The REAL terminal row count (the status owns row 1; the PTY gets rows-1).\r\n rows: u16,\r\n /// The terminal column count (the right-align anchor).\r\n cols: u16,\r\n}\r\n\r\nimpl StatusRow {\r\n /// Set the DECSTBM scroll region to reserve row 1, then paint the banner.\r\n /// `ESC[2;{rows}r` makes the harness scroll within rows 2..=rows (the harness\r\n /// never touches row 1), then [`repaint_bytes`](Self::repaint_bytes) draws it.\r\n // [impl->REQ-RC-IDENTITY]\r\n fn assert_bytes(&self) -> Vec {\r\n let mut out = Vec::new();\r\n // Reserve the top row: top margin = line 2, bottom margin = rows.\r\n out.extend_from_slice(format!(\"\\x1b[2;{}r\", self.rows).as_bytes());\r\n out.extend_from_slice(&self.repaint_bytes());\r\n out\r\n }\r\n\r\n /// Repaint row 1 WITHOUT disturbing the harness cursor: save cursor (DECSC),\r\n /// home to row 1, clear the line, jump to the right-aligned start column, set\r\n /// cyan, write the text, reset SGR, restore cursor (DECRC). The right-align\r\n /// start column is `cols - width + 1` clamped to ≥ 1 (text wider than the\r\n /// terminal starts at col 1 and is allowed to fill the row).\r\n // [impl->REQ-RC-IDENTITY]\r\n fn repaint_bytes(&self) -> Vec {\r\n let width = self.display_width();\r\n // Right-align: 1-based start column, clamped to col 1 when text ≥ cols.\r\n let col = (self.cols as usize)\r\n .saturating_sub(width)\r\n .saturating_add(1)\r\n .max(1);\r\n let mut out = Vec::new();\r\n out.extend_from_slice(b\"\\x1b7\"); // DECSC: save cursor\r\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1, col 1\r\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the whole line\r\n out.extend_from_slice(format!(\"\\x1b[1;{col}H\").as_bytes()); // right-align start\r\n out.extend_from_slice(b\"\\x1b[36m\"); // cyan\r\n out.extend_from_slice(self.text.as_bytes());\r\n out.extend_from_slice(b\"\\x1b[0m\"); // reset SGR\r\n out.extend_from_slice(b\"\\x1b8\"); // DECRC: restore cursor\r\n out\r\n }\r\n\r\n /// Tear the status down on detach: reset the scroll region to the full screen\r\n /// (`ESC[r`), home to row 1, clear it — so the terminal is clean afterward.\r\n // [impl->REQ-RC-IDENTITY]\r\n fn restore_bytes() -> Vec {\r\n let mut out = Vec::new();\r\n out.extend_from_slice(b\"\\x1b[r\"); // reset scroll region (full screen)\r\n out.extend_from_slice(b\"\\x1b[1;1H\"); // home to row 1\r\n out.extend_from_slice(b\"\\x1b[2K\"); // clear the reclaimed row\r\n out\r\n }\r\n\r\n /// Update the tracked terminal size on a window-change (the pump re-asserts\r\n /// the margin + repaints after).\r\n // [impl->REQ-RC-IDENTITY]\r\n fn update_size(&mut self, rows: u16, cols: u16) {\r\n self.rows = rows;\r\n self.cols = cols;\r\n }\r\n\r\n /// The on-screen width of the banner. ASCII status text, so a `chars` count is\r\n /// the cell width (no wide-char / combining concerns here).\r\n fn display_width(&self) -> usize {\r\n self.text.chars().count()\r\n }\r\n}\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300]},"fileSize":280828,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt\\src\\rc.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5692,"totalBytes":14055,"outputLines":300,"outputBytes":14055,"shownRange":{"start":1,"end":300},"nextOffset":301}}},"isError":false,"timestamp":1789113814697}}
{"type":"message","id":"d9a35281","parentId":"076e2616","timestamp":"2026-09-11T08:03:34.698Z","message":{"role":"toolResult","toolCallId":"call_DXmGR5dLS3BmCv6bMWaAvloL|fc_07a38c9435caeae6016aa3b5d4326487d2bc4476fff3ec0917","toolName":"read","content":[{"type":"text","text":"# Platform-targeted update sets for debug rollout and release distribution\n\n\n\n## Status\n\naccepted (2026-06-06)\n\nspt-core's peer-propagated update substrate should understand a signed update as a platform-targeted artifact set, not only as one opaque binary blob. A node offering an update may stage metadata for multiple platform artifacts (for example Windows x86_64 and Linux x86_64); each recipient verifies the set metadata, fetches only the artifact matching its own platform, verifies that artifact's digest, and then follows the existing consent/apply path.\n\nAn update set has one signature over the whole set metadata, with per-platform artifact digests inside that signed metadata. This makes a debug version or stable version an atomic, auditable set while still letting each recipient fetch only its matching artifact.\n\nIf a recipient's platform is missing from an offered set, the result is a typed rejection such as `NoArtifactForPlatform`, not an up-to-date/no-op answer. A malformed or incomplete debug rollout should be visible in convergence reporting.\n\nThe receiver may support both the original single-artifact `SignedRelease` shape and the new platform-targeted set shape during migration. Debug rollout can be the first user of update sets; stable release publishing can move later without blocking the debugging workflow.\n\nPlatform keys in the signed metadata use Rust target triples, for example `x86_64-pc-windows-msvc` and `x86_64-unknown-linux-gnu`. Release asset names remain a packaging concern and may keep their public-friendly names; target triples are the protocol identifiers.\n\nThis keeps debug rollout fast without turning it into raw peer file-copy: a fast coordinator can assemble and sign every platform artifact, then let the existing subnet update machinery distribute the right bytes to each node. The generic receiver/protocol support belongs in the production daemon because public releases and debug rollouts have the same cross-platform distribution problem. The rollout driver does not: build recipes, cross-build/WSL/runner coordination, dev-key signing, and \"stage this debug rollout\" live in source-repo maintainer tooling (for example `xtask`), not in the public `spt` CLI/help/docs for end users.\n\nRelease monotonicity is scoped to the pinned channel. Stable releases and debug rollouts use separate counters, so a fast debug sequence cannot consume, block, or roll back the stable release counter; rollback protection compares only against the latest accepted version for the recipient's pinned channel.\n\nDebug rollout targets are opt-in by channel pin, not by subnet membership alone. A debug offer may traverse trusted subnet peers, but a stable-pinned node rejects it at the metadata gate; only nodes pinned to the debug channel and provisioned with the dev signing key can stage and apply it.\n\nPinning a lab node to debug uses the existing release-key overlay: `$SPT_HOME/identity/release-keys.json` adds the dev public key and sets `\"channel\": \"debug\"` (for example `\"keys\": {\"dev-debug-2026\": \"\"}`). Removing the key or pinning the channel back to `\"stable\"` takes the node out of debug rollout eligibility.\n\nChannel pinning is exclusive. A debug-pinned node accepts only debug-channel offers and rejects stable offers until re-pinned to stable; a stable-pinned node accepts only stable-channel offers. This keeps rollback accounting and test provenance unambiguous.\n\nMaintainer tooling may provide a helper to write that file correctly, but the canonical mechanism remains the generic release-key overlay. `spt` itself does not need a special debug-mode command; source-repo tooling can offer convenience such as `xtask debug-pin` for local lab setup.\n\nBad debug builds recover the same way as stable releases: publish a newer signed debug rollout, even if the artifact bytes are a previous known-good binary. Numeric rollback remains rejected; the debug channel never gets a bypass around the anti-rollback invariant.\n\nDebug signing key custody is deliberately weaker than stable release signing. The stable release seed stays manual/password-manager driven per ADR-0015; the debug seed may live in a long-lived `SPT_DEBUG_RELEASE_SEED` environment variable on the fast coordinator so agents can drive rollouts. This is acceptable only because the key's blast radius is limited to nodes explicitly pinned to `debug` and provisioned with that dev public key; rotation is minting a new debug key, updating lab overlays, and deleting the old env var/key.\n\n`xtask debug-rollout` must not auto-mint a signing key. If `SPT_DEBUG_RELEASE_SEED` is missing it fails with setup guidance; a separate `xtask debug-keygen` may print a seed/public-key pair for deliberate lab setup.\n\nInitial debug rollout scope is the spt-core binary only. Adapter updates remain on the adapter ripple-update seam with adapter-owned signing or delegated verification; maintainer tooling may compose adapter updates later, but the fast core-debug loop should not blur those trust boundaries.\n\nDebug rollout may carry broker-touching updates. Brain-only debug applies keep the normal no-endpoint-termination invariant. If the candidate class requires replacing the broker, apply requires the node to quiesce first: no broker-held endpoints or live resources may be running, and tooling must refuse with a typed \"shut down/suspend hosted endpoints first\" result rather than cycling them implicitly.\n\nThe first broker-touching debug flow refuses only; it does not auto-suspend or auto-shutdown endpoints. The refusal should list the blocking broker-held endpoints/resources and print the commands needed to quiesce them, preserving lifecycle control with the operator.\n\nInitiation is local staging plus normal pull-based peer propagation. The debug driver writes the signed update set into the local daemon's staged-release cache and may poke the daemon to advertise/check immediately for responsiveness, but it must not introduce a bespoke \"push this binary to node X\" path.\n\nThe debug driver should verify convergence after staging. By default, \"expected\" means every reachable node in the selected lab subnet that is pinned to `debug`; maintainer tooling may accept an explicit node list for targeted tests. It watches until every expected debug-pinned reachable node reports the target debug version applied, or returns a timeout table with per-node state such as not pinned, offline, staged awaiting consent, blocked by live broker resources, applied, or rejected.\n\nThe debug channel sequence is maintainer-tooling state, not project truth or node identity. It may live in an ignored source-repo local file such as under `target/`; losing it is recoverable by choosing a higher debug version. Deployed nodes only require that the next accepted debug metadata version is greater than the current debug version they have seen.\n\nDebug rollout metadata should carry signed diagnostic provenance: source git commit, dirty flag, build host, build timestamp, and platform target. These fields are for observability (\"which bits are running where?\"), not for trust; verification remains signature plus artifact digest plus channel/version policy.\n\nThe first implementation slice is intentionally narrow: update-set metadata and verification, daemon staging/read path with local platform selection, maintainer `xtask` helpers for debug pinning and debug rollout, and loopback/two-host proof of propagation plus convergence reporting. Remote build orchestration, rich dashboards, adapter inclusion, and stable-release publishing migration are later work.\n\n## Considered Options\n\n- **Single artifact per staged update** — simpler metadata, but forces dev tooling to stage different binaries through platform-specific side paths and makes debug rollout brittle.\n- **Debug-only remote copy/install scripts** — fastest to hack, but bypasses the verification, rollback, channel, and consent gates that peer propagation exists to protect.\n- **Platform-targeted update set** — chosen: one generic substrate shape, recipients fetch only their matching artifact, and both stable releases and debug rollouts reuse the same trust path."}],"details":{"totalLines":57,"displayContent":{"text":"# Platform-targeted update sets for debug rollout and release distribution\r\n\r\n\r\n\r\n## Status\r\n\r\naccepted (2026-06-06)\r\n\r\nspt-core's peer-propagated update substrate should understand a signed update as a platform-targeted artifact set, not only as one opaque binary blob. A node offering an update may stage metadata for multiple platform artifacts (for example Windows x86_64 and Linux x86_64); each recipient verifies the set metadata, fetches only the artifact matching its own platform, verifies that artifact's digest, and then follows the existing consent/apply path.\r\n\r\nAn update set has one signature over the whole set metadata, with per-platform artifact digests inside that signed metadata. This makes a debug version or stable version an atomic, auditable set while still letting each recipient fetch only its matching artifact.\r\n\r\nIf a recipient's platform is missing from an offered set, the result is a typed rejection such as `NoArtifactForPlatform`, not an up-to-date/no-op answer. A malformed or incomplete debug rollout should be visible in convergence reporting.\r\n\r\nThe receiver may support both the original single-artifact `SignedRelease` shape and the new platform-targeted set shape during migration. Debug rollout can be the first user of update sets; stable release publishing can move later without blocking the debugging workflow.\r\n\r\nPlatform keys in the signed metadata use Rust target triples, for example `x86_64-pc-windows-msvc` and `x86_64-unknown-linux-gnu`. Release asset names remain a packaging concern and may keep their public-friendly names; target triples are the protocol identifiers.\r\n\r\nThis keeps debug rollout fast without turning it into raw peer file-copy: a fast coordinator can assemble and sign every platform artifact, then let the existing subnet update machinery distribute the right bytes to each node. The generic receiver/protocol support belongs in the production daemon because public releases and debug rollouts have the same cross-platform distribution problem. The rollout driver does not: build recipes, cross-build/WSL/runner coordination, dev-key signing, and \"stage this debug rollout\" live in source-repo maintainer tooling (for example `xtask`), not in the public `spt` CLI/help/docs for end users.\r\n\r\nRelease monotonicity is scoped to the pinned channel. Stable releases and debug rollouts use separate counters, so a fast debug sequence cannot consume, block, or roll back the stable release counter; rollback protection compares only against the latest accepted version for the recipient's pinned channel.\r\n\r\nDebug rollout targets are opt-in by channel pin, not by subnet membership alone. A debug offer may traverse trusted subnet peers, but a stable-pinned node rejects it at the metadata gate; only nodes pinned to the debug channel and provisioned with the dev signing key can stage and apply it.\r\n\r\nPinning a lab node to debug uses the existing release-key overlay: `$SPT_HOME/identity/release-keys.json` adds the dev public key and sets `\"channel\": \"debug\"` (for example `\"keys\": {\"dev-debug-2026\": \"\"}`). Removing the key or pinning the channel back to `\"stable\"` takes the node out of debug rollout eligibility.\r\n\r\nChannel pinning is exclusive. A debug-pinned node accepts only debug-channel offers and rejects stable offers until re-pinned to stable; a stable-pinned node accepts only stable-channel offers. This keeps rollback accounting and test provenance unambiguous.\r\n\r\nMaintainer tooling may provide a helper to write that file correctly, but the canonical mechanism remains the generic release-key overlay. `spt` itself does not need a special debug-mode command; source-repo tooling can offer convenience such as `xtask debug-pin` for local lab setup.\r\n\r\nBad debug builds recover the same way as stable releases: publish a newer signed debug rollout, even if the artifact bytes are a previous known-good binary. Numeric rollback remains rejected; the debug channel never gets a bypass around the anti-rollback invariant.\r\n\r\nDebug signing key custody is deliberately weaker than stable release signing. The stable release seed stays manual/password-manager driven per ADR-0015; the debug seed may live in a long-lived `SPT_DEBUG_RELEASE_SEED` environment variable on the fast coordinator so agents can drive rollouts. This is acceptable only because the key's blast radius is limited to nodes explicitly pinned to `debug` and provisioned with that dev public key; rotation is minting a new debug key, updating lab overlays, and deleting the old env var/key.\r\n\r\n`xtask debug-rollout` must not auto-mint a signing key. If `SPT_DEBUG_RELEASE_SEED` is missing it fails with setup guidance; a separate `xtask debug-keygen` may print a seed/public-key pair for deliberate lab setup.\r\n\r\nInitial debug rollout scope is the spt-core binary only. Adapter updates remain on the adapter ripple-update seam with adapter-owned signing or delegated verification; maintainer tooling may compose adapter updates later, but the fast core-debug loop should not blur those trust boundaries.\r\n\r\nDebug rollout may carry broker-touching updates. Brain-only debug applies keep the normal no-endpoint-termination invariant. If the candidate class requires replacing the broker, apply requires the node to quiesce first: no broker-held endpoints or live resources may be running, and tooling must refuse with a typed \"shut down/suspend hosted endpoints first\" result rather than cycling them implicitly.\r\n\r\nThe first broker-touching debug flow refuses only; it does not auto-suspend or auto-shutdown endpoints. The refusal should list the blocking broker-held endpoints/resources and print the commands needed to quiesce them, preserving lifecycle control with the operator.\r\n\r\nInitiation is local staging plus normal pull-based peer propagation. The debug driver writes the signed update set into the local daemon's staged-release cache and may poke the daemon to advertise/check immediately for responsiveness, but it must not introduce a bespoke \"push this binary to node X\" path.\r\n\r\nThe debug driver should verify convergence after staging. By default, \"expected\" means every reachable node in the selected lab subnet that is pinned to `debug`; maintainer tooling may accept an explicit node list for targeted tests. It watches until every expected debug-pinned reachable node reports the target debug version applied, or returns a timeout table with per-node state such as not pinned, offline, staged awaiting consent, blocked by live broker resources, applied, or rejected.\r\n\r\nThe debug channel sequence is maintainer-tooling state, not project truth or node identity. It may live in an ignored source-repo local file such as under `target/`; losing it is recoverable by choosing a higher debug version. Deployed nodes only require that the next accepted debug metadata version is greater than the current debug version they have seen.\r\n\r\nDebug rollout metadata should carry signed diagnostic provenance: source git commit, dirty flag, build host, build timestamp, and platform target. These fields are for observability (\"which bits are running where?\"), not for trust; verification remains signature plus artifact digest plus channel/version policy.\r\n\r\nThe first implementation slice is intentionally narrow: update-set metadata and verification, daemon staging/read path with local platform selection, maintainer `xtask` helpers for debug pinning and debug rollout, and loopback/two-host proof of propagation plus convergence reporting. Remote build orchestration, rich dashboards, adapter inclusion, and stable-release publishing migration are later work.\r\n\r\n## Considered Options\r\n\r\n- **Single artifact per staged update** — simpler metadata, but forces dev tooling to stage different binaries through platform-specific side paths and makes debug rollout brittle.\r\n- **Debug-only remote copy/install scripts** — fastest to hack, but bypasses the verification, rollback, channel, and consent gates that peer propagation exists to protect.\r\n- **Platform-targeted update set** — chosen: one generic substrate shape, recipients fetch only their matching artifact, and both stable releases and debug rollouts reuse the same trust path.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57]},"fileSize":8257,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\docs\\adr\\0016-platform-targeted-update-sets.md"}}},"isError":false,"timestamp":1789113814697}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_lf4zIBD4Nnyfz0zY1GuE5A8I|fc_07a38c9435caeae6016aa3b5e3931c87d28c34f1f4626a1149","toolName":"grep","startedAt":"2026-09-11T08:03:50.003Z","args":{"path":".worktrees/304-product/crates/spt/src/rc.rs:1400-2450"},"intent":"Locating rc loop boundaries"},"id":"36767a38","parentId":"d9a35281","timestamp":"2026-09-11T08:03:50.003Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uKTXK6gIXdzSpHhyhua8dmFp|fc_07a38c9435caeae6016aa3b5e3933487d2af8ed7f4bf6e01e0","toolName":"grep","startedAt":"2026-09-11T08:03:50.003Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/attach.rs"},"intent":"Locating attach serve boundaries"},"id":"39206a90","parentId":"36767a38","timestamp":"2026-09-11T08:03:50.003Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_LZ3Zf4CNUVQN3TZywbQz7OgK|fc_07a38c9435caeae6016aa3b5e3934087d28e4299fe0013b324","toolName":"grep","startedAt":"2026-09-11T08:03:50.004Z","args":{"path":".worktrees/304-product/crates/spt/src/daemon.rs;.worktrees/304-product/crates/spt/src/update;.worktrees/304-product/crates/spt-daemon/src/applyhost.rs"},"intent":"Locating refresh apply entrypoints"},"id":"8920a3c6","parentId":"39206a90","timestamp":"2026-09-11T08:03:50.004Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_MbqVZwIWVOpYARB1BG66S5b5|fc_07a38c9435caeae6016aa3b5e3934887d2a333eeff15124446","toolName":"read","startedAt":"2026-09-11T08:03:50.004Z","args":{"path":".worktrees/304-product/docs/REDISPATCH-TRUTH-TRIAGE.md"},"intent":"Reading prior restart fix coverage"},"id":"c91b23b9","parentId":"8920a3c6","timestamp":"2026-09-11T08:03:50.004Z"}
{"type":"message","id":"26b0d986","parentId":"c91b23b9","timestamp":"2026-09-11T08:03:50.004Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_lf4zIBD4Nnyfz0zY1GuE5A8I|fc_07a38c9435caeae6016aa3b5e3931c87d28c34f1f4626a1149","name":"grep","arguments":{"i":"Locating rc loop boundaries","pattern":"fn .*|try_recv|read_event_until|reconnect|send_attach_input","path":".worktrees/304-product/crates/spt/src/rc.rs:1400-2450","case":true,"gitignore":true,"skip":null},"intent":"Locating rc loop boundaries"},{"type":"toolCall","id":"call_uKTXK6gIXdzSpHhyhua8dmFp|fc_07a38c9435caeae6016aa3b5e3933487d2af8ed7f4bf6e01e0","name":"grep","arguments":{"i":"Locating attach serve boundaries","pattern":"pub fn|fn serve|read_event|send_effect|AttachRecord::Input|net_stream_send|spawn","path":".worktrees/304-product/crates/spt-daemon/src/attach.rs","case":true,"gitignore":true,"skip":null},"intent":"Locating attach serve boundaries"},{"type":"toolCall","id":"call_LZ3Zf4CNUVQN3TZywbQz7OgK|fc_07a38c9435caeae6016aa3b5e3934087d28e4299fe0013b324","name":"grep","arguments":{"i":"Locating refresh apply entrypoints","pattern":"fn .*refresh|refresh_brain|apply_staged|fn .*apply|brain_cycle","path":".worktrees/304-product/crates/spt/src/daemon.rs;.worktrees/304-product/crates/spt/src/update;.worktrees/304-product/crates/spt-daemon/src/applyhost.rs","case":false,"gitignore":true,"skip":null},"intent":"Locating refresh apply entrypoints"},{"type":"toolCall","id":"call_MbqVZwIWVOpYARB1BG66S5b5|fc_07a38c9435caeae6016aa3b5e3934887d2a333eeff15124446","name":"read","arguments":{"i":"Reading prior restart fix coverage","path":".worktrees/304-product/docs/REDISPATCH-TRUTH-TRIAGE.md"},"intent":"Reading prior restart fix coverage"},{"type":"toolCall","id":"call_ZdCLM3I3lKyqh9T4aCcTVSL7|fc_07a38c9435caeae6016aa3b5e3935487d299393534e3a930ab","name":"grep","arguments":{"i":"Locating issue linked history","pattern":"#49|ATTACH-IDEMPOTENT|idempotent.*replay|15 ms","path":".worktrees/304-product/DAEMON-LIFECYCLE*;.worktrees/304-product/docs/*VERDICT*;.worktrees/304-product/crates/spt-daemon/tests;.worktrees/304-product/CHANGELOG.md","case":false,"gitignore":true,"skip":null},"intent":"Locating issue linked history"},{"type":"toolCall","id":"call_AHu1MYF09IpTjJoWpULZdlzt|fc_07a38c9435caeae6016aa3b5e3935c87d2aba292d919b499b4","name":"read","arguments":{"i":"Reading terminal and update glossary","path":".worktrees/304-product/CONTEXT.md:529-573,676-711"},"intent":"Reading terminal and update glossary"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":34346,"output":448,"cacheRead":30720,"cacheWrite":0,"totalTokens":65514,"cost":{"input":0.34346000000000004,"output":0.0224,"cacheRead":0.030719999999999997,"cacheWrite":0,"total":0.39658000000000004}},"stopReason":"toolUse","timestamp":1789113814751,"responseId":"resp_07a38c9435caeae6016aa3b5d4c0b087d2913de7f5ab13d7ee","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_07a38c9435caeae6016aa3b5e3931c87d28c34f1f4626a1149","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating rc loop boundaries\",\"pattern\":\"fn .*|try_recv|read_event_until|reconnect|send_attach_input\",\"path\":\".worktrees/304-product/crates/spt/src/rc.rs:1400-2450\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_lf4zIBD4Nnyfz0zY1GuE5A8I","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5e3933487d2af8ed7f4bf6e01e0","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating attach serve boundaries\",\"pattern\":\"pub fn|fn serve|read_event|send_effect|AttachRecord::Input|net_stream_send|spawn\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/attach.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_uKTXK6gIXdzSpHhyhua8dmFp","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5e3934087d28e4299fe0013b324","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating refresh apply entrypoints\",\"pattern\":\"fn .*refresh|refresh_brain|apply_staged|fn .*apply|brain_cycle\",\"path\":\".worktrees/304-product/crates/spt/src/daemon.rs;.worktrees/304-product/crates/spt/src/update;.worktrees/304-product/crates/spt-daemon/src/applyhost.rs\",\"case\":false,\"gitignore\":true,\"skip\":null}","call_id":"call_LZ3Zf4CNUVQN3TZywbQz7OgK","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5e3934887d2a333eeff15124446","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading prior restart fix coverage\",\"path\":\".worktrees/304-product/docs/REDISPATCH-TRUTH-TRIAGE.md\"}","call_id":"call_MbqVZwIWVOpYARB1BG66S5b5","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5e3935487d299393534e3a930ab","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating issue linked history\",\"pattern\":\"#49|ATTACH-IDEMPOTENT|idempotent.*replay|15 ms\",\"path\":\".worktrees/304-product/DAEMON-LIFECYCLE*;.worktrees/304-product/docs/*VERDICT*;.worktrees/304-product/crates/spt-daemon/tests;.worktrees/304-product/CHANGELOG.md\",\"case\":false,\"gitignore\":true,\"skip\":null}","call_id":"call_ZdCLM3I3lKyqh9T4aCcTVSL7","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5e3935c87d2aba292d919b499b4","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading terminal and update glossary\",\"path\":\".worktrees/304-product/CONTEXT.md:529-573,676-711\"}","call_id":"call_AHu1MYF09IpTjJoWpULZdlzt","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}}]},"duration":15250.030199999921,"ttft":15183.365800000262,"completedAt":1789113830002,"contextSnapshot":{"promptTokens":65066,"nonMessageTokens":10264,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ZdCLM3I3lKyqh9T4aCcTVSL7|fc_07a38c9435caeae6016aa3b5e3935487d299393534e3a930ab","toolName":"grep","startedAt":"2026-09-11T08:03:50.004Z","args":{"path":".worktrees/304-product/DAEMON-LIFECYCLE*;.worktrees/304-product/docs/*VERDICT*;.worktrees/304-product/crates/spt-daemon/tests;.worktrees/304-product/CHANGELOG.md"},"intent":"Locating issue linked history"},"id":"36724f46","parentId":"26b0d986","timestamp":"2026-09-11T08:03:50.004Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_AHu1MYF09IpTjJoWpULZdlzt|fc_07a38c9435caeae6016aa3b5e3935c87d2aba292d919b499b4","toolName":"read","startedAt":"2026-09-11T08:03:50.004Z","args":{"path":".worktrees/304-product/CONTEXT.md:529-573,676-711"},"intent":"Reading terminal and update glossary"},"id":"c13d83ef","parentId":"36724f46","timestamp":"2026-09-11T08:03:50.004Z"}
{"type":"message","id":"377325d4","parentId":"c13d83ef","timestamp":"2026-09-11T08:03:50.011Z","message":{"role":"toolResult","toolCallId":"call_uKTXK6gIXdzSpHhyhua8dmFp|fc_07a38c9435caeae6016aa3b5e3933487d2af8ed7f4bf6e01e0","toolName":"grep","content":[{"type":"text","text":" 9|//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\n*10|//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\n 11|//! operator-minted `op_id` — exactly-once at the PTY write through the B5\n 12|//! journal (a replayed input record cannot double-type);\n 13|//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\n...\n 17|//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\n*18|//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\n 19|//! and *discards* everything interleaved — inside a full-duplex pump loop that\n 20|//! eats the operator's `Input` records (both sides starve; found the hard way\n 21|//! in `tests/attach.rs`). Idempotency holds without it because each direction\n...\n 91|// [impl->REQ-ER-RC-INTENT-LOCKS]\n*92|pub fn classify_rc_lock(\n 93| is_engine_room: bool,\n 94| from_this_node: bool,\n 95| intent: AttachIntent,\n...\n 204|/// hard flood). The next frame this reader sees is then a FORWARD gap that the\n*205|/// strict reject-gap (`read_event`, legacy single-session path) FATALS. A\n 206|/// controller CANNOT snap-above like a viewer (B2: it is authoritative — it\n 207|/// advances `delivered_through`; skipping rolled frames would be a not-exactly-once\n 208|/// resume). So instead it RE-FETCHES: re-subscribe from\n...\n 227|// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n*228|pub fn read_controller_event_resuming(\n 229| brain: &mut Brain,\n 230| session_id: u64,\n 231| gen: u64,\n...\n 241|/// unbounded frame read.\n*242|pub fn read_controller_event_resuming_until(\n 243| brain: &mut Brain,\n 244| session_id: u64,\n 245| gen: u64,\n...\n 251| loop {\n*252| match brain.read_event_until(deadline) {\n 253| // Our own re-subscribe's Subscribed reply: swallow it (role is already\n 254| // resolved) so it cannot mask a repeated gap as forward progress.\n 255| Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\n...\n 305|\n*306|/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n 307|/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n 308|/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n 309|/// its own session table, so a remote operator — which cannot know our local\n...\n 368| {\n*369| wire.net_stream_send(stream_id, &[], None, true)?;\n 370| return Ok(Some(AttachServeOutcome::Refused));\n 371| }\n 372| let sid = remote_session.unwrap_or(session_id);\n...\n 448|#[allow(clippy::too_many_arguments)]\n*449|pub fn serve_attach(\n 450| brain: &mut Brain,\n 451| broker_name: &str,\n 452| stream_id: u64,\n...\n 569| });\n*570| let _ = wire.net_stream_send(stream_id, &line, None, true);\n 571| feed_rest(endpoint, crate::resting::RestEvent::Detach);\n 572| return Err(e);\n 573| }\n...\n 579| }\n*580| _ => brain.read_event_until(deadline)?,\n 581| };\n 582| match event {\n 583| // ── Wire → session: requests, input, resize. ───────────────────\n...\n 624| }\n*625| AttachRecord::Input { data_b64, op_id }\n 626| if attached && intent != AttachIntent::Viewer =>\n 627| {\n 628| let bytes = decode_bytes(&data_b64)\n...\n 642| // so it carries the `rc` journal tag (ADR-0034).\n*643| brain.send_effect_no_ack(\n 644| MintedOp::new(Minter::Rc, op_id),\n 645| &bytes,\n 646| )?\n...\n 710| let line = ndjson::encode_line(&AttachRecord::Notice { text });\n*711| wire.net_stream_send(stream_id, &line, None, false)?;\n 712| }\n 713| // A driver attached — the wake edge (controller-only;\n 714| // idempotent on an already-active seat).\n...\n 718| for (op, b) in pending_input.drain(..) {\n*719| brain.send_effect(MintedOp::new(Minter::Rc, op), &b)?;\n 720| }\n 721| }\n 722| O::Viewer => {\n...\n 731| // renders the busy guidance client-side from driven_by.\n*732| wire.net_stream_send(stream_id, &[], None, true)?;\n 733| return Ok(AttachServeOutcome::Refused);\n 734| }\n 735| }\n...\n 762| });\n*763| wire.net_stream_send(stream_id, &line, None, false)?;\n 764| }\n 765| BrokerEvent::SealCeremonyResult {\n 766| ceremony_id,\n...\n 775| });\n*776| wire.net_stream_send(stream_id, &line, None, false)?;\n 777| }\n 778| // Viewer letterbox feed: the current PTY size (on attach + resize).\n 779| BrokerEvent::Size { rows, cols, .. } if attached => {\n 780| let line = ndjson::encode_line(&AttachRecord::Size { rows, cols });\n*781| wire.net_stream_send(stream_id, &line, None, false)?;\n 782| }\n 783| // This controller was kicked by a different operator's `--take`.\n 784| BrokerEvent::Displaced { by, .. } if attached => {\n 785| let line = ndjson::encode_line(&AttachRecord::Displaced { by });\n*786| wire.net_stream_send(stream_id, &line, None, true)?;\n 787| // No dormant edge: the endpoint stays driven by the taker (whose\n 788| // own serve loop already fired the wake).\n 789| return Ok(AttachServeOutcome::Displaced);\n...\n 815| BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\n*816| wire.net_stream_send(stream_id, &[], None, true)?;\n 817| // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\n 818| // info.json, carrying the current driven_by through), THEN release\n 819| // the role over IPC so the broker's driven_by=None is the LAST\n...\n 840| // the record, and the operator's render cursor is the dedup.\n*841| wire.net_stream_send(stream_id, &line, None, false)?;\n 842| }\n 843| BrokerEvent::Exit { code, .. } if attached => {\n 844| let line = ndjson::encode_line(&AttachRecord::Exit { code });\n*845| wire.net_stream_send(stream_id, &line, None, true)?;\n 846| if role == Some(ServeRole::Controller) {\n 847| feed_rest(endpoint, crate::resting::RestEvent::Detach);\n 848| }\n...\n 866|/// ([`AttachRecord::Output`] frames, deduped by `seq`) and writes\n*867|/// ([`AttachRecord::Input`] with operator-minted op ids). `open_op` is the\n 868|/// durable id for the exactly-once stream open (safe to block for its ack —\n 869|/// no attach traffic can be in flight before the stream exists); the Request\n 870|/// send itself is unjournaled (see module docs — a replayed Request re-gates\n...\n 872|// [impl->REQ-INST-8]\n*873|pub fn request_attach(\n 874| brain: &mut Brain,\n 875| conn_id: u64,\n 876| session_id: u64,\n...\n 892|#[allow(clippy::too_many_arguments)]\n*893|pub fn request_attach_endpoint(\n 894| brain: &mut Brain,\n 895| conn_id: u64,\n 896| session_id: u64,\n...\n 933| });\n*934| brain.net_stream_send(opened.stream_id, &line, None, false)?;\n 935| Ok(opened.stream_id)\n 936|}\n 937|\n...\n 943|// [impl->REQ-RCVIEW-1]\n*944|pub fn send_attach_resize(\n 945| brain: &mut Brain,\n 946| stream_id: u64,\n 947| rows: u16,\n...\n 950| let line = ndjson::encode_line(&AttachRecord::Resize { rows, cols });\n*951| brain.net_stream_send(stream_id, &line, None, false)?;\n 952| Ok(())\n 953|}\n 954|\n...\n 964|// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*965|pub fn send_seal_ceremony_code(\n 966| brain: &mut Brain,\n 967| stream_id: u64,\n 968| ceremony_id: u64,\n...\n 979| });\n*980| brain.net_stream_send(stream_id, &line, None, false)?;\n 981| Ok(())\n 982|}\n 983|\n...\n 988|// [impl->REQ-INST-8]\n*989|pub fn send_attach_input(\n 990| brain: &mut Brain,\n 991| stream_id: u64,\n 992| bytes: &[u8],\n...\n 994|) -> io::Result<()> {\n*995| let line = ndjson::encode_line(&AttachRecord::Input {\n 996| data_b64: encode_bytes(bytes),\n 997| op_id: wire_op,\n 998| });\n*999| brain.net_stream_send(stream_id, &line, None, false)?;\n 1000| Ok(())\n 1001|}\n 1002|"}],"details":{"scopePath":".worktrees/304-product/crates/spt-daemon/src/attach.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt-daemon\\src\\attach.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":35,"fileCount":1,"files":[".worktrees/304-product/crates/spt-daemon/src/attach.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt-daemon/src/attach.rs","count":35}],"truncated":false,"displayContent":" 9│//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\n *10│//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\n 11│//! operator-minted `op_id` — exactly-once at the PTY write through the B5\n 12│//! journal (a replayed input record cannot double-type);\n 13│//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\n │...\n 17│//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\n *18│//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\n 19│//! and *discards* everything interleaved — inside a full-duplex pump loop that\n 20│//! eats the operator's `Input` records (both sides starve; found the hard way\n 21│//! in `tests/attach.rs`). Idempotency holds without it because each direction\n │...\n 91│// [impl->REQ-ER-RC-INTENT-LOCKS]\n *92│pub fn classify_rc_lock(\n 93│ is_engine_room: bool,\n 94│ from_this_node: bool,\n 95│ intent: AttachIntent,\n │...\n 204│/// hard flood). The next frame this reader sees is then a FORWARD gap that the\n *205│/// strict reject-gap (`read_event`, legacy single-session path) FATALS. A\n 206│/// controller CANNOT snap-above like a viewer (B2: it is authoritative — it\n 207│/// advances `delivered_through`; skipping rolled frames would be a not-exactly-once\n 208│/// resume). So instead it RE-FETCHES: re-subscribe from\n │...\n 227│// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n *228│pub fn read_controller_event_resuming(\n 229│ brain: &mut Brain,\n 230│ session_id: u64,\n 231│ gen: u64,\n │...\n 241│/// unbounded frame read.\n *242│pub fn read_controller_event_resuming_until(\n 243│ brain: &mut Brain,\n 244│ session_id: u64,\n 245│ gen: u64,\n │...\n 251│ loop {\n *252│ match brain.read_event_until(deadline) {\n 253│ // Our own re-subscribe's Subscribed reply: swallow it (role is already\n 254│ // resolved) so it cannot mask a repeated gap as forward progress.\n 255│ Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\n │...\n 305│\n *306│/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n 307│/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n 308│/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n 309│/// its own session table, so a remote operator — which cannot know our local\n │...\n 368│ {\n *369│ wire.net_stream_send(stream_id, &[], None, true)?;\n 370│ return Ok(Some(AttachServeOutcome::Refused));\n 371│ }\n 372│ let sid = remote_session.unwrap_or(session_id);\n │...\n 448│#[allow(clippy::too_many_arguments)]\n *449│pub fn serve_attach(\n 450│ brain: &mut Brain,\n 451│ broker_name: &str,\n 452│ stream_id: u64,\n │...\n 569│ });\n *570│ let _ = wire.net_stream_send(stream_id, &line, None, true);\n 571│ feed_rest(endpoint, crate::resting::RestEvent::Detach);\n 572│ return Err(e);\n 573│ }\n │...\n 579│ }\n *580│ _ => brain.read_event_until(deadline)?,\n 581│ };\n 582│ match event {\n 583│ // ── Wire → session: requests, input, resize. ───────────────────\n │...\n 624│ }\n *625│ AttachRecord::Input { data_b64, op_id }\n 626│ if attached && intent != AttachIntent::Viewer =>\n 627│ {\n 628│ let bytes = decode_bytes(&data_b64)\n │...\n 642│ // so it carries the `rc` journal tag (ADR-0034).\n *643│ brain.send_effect_no_ack(\n 644│ MintedOp::new(Minter::Rc, op_id),\n 645│ &bytes,\n 646│ )?\n │...\n 710│ let line = ndjson::encode_line(&AttachRecord::Notice { text });\n *711│ wire.net_stream_send(stream_id, &line, None, false)?;\n 712│ }\n 713│ // A driver attached — the wake edge (controller-only;\n 714│ // idempotent on an already-active seat).\n │...\n 718│ for (op, b) in pending_input.drain(..) {\n *719│ brain.send_effect(MintedOp::new(Minter::Rc, op), &b)?;\n 720│ }\n 721│ }\n 722│ O::Viewer => {\n │...\n 731│ // renders the busy guidance client-side from driven_by.\n *732│ wire.net_stream_send(stream_id, &[], None, true)?;\n 733│ return Ok(AttachServeOutcome::Refused);\n 734│ }\n 735│ }\n │...\n 762│ });\n *763│ wire.net_stream_send(stream_id, &line, None, false)?;\n 764│ }\n 765│ BrokerEvent::SealCeremonyResult {\n 766│ ceremony_id,\n │...\n 775│ });\n *776│ wire.net_stream_send(stream_id, &line, None, false)?;\n 777│ }\n 778│ // Viewer letterbox feed: the current PTY size (on attach + resize).\n 779│ BrokerEvent::Size { rows, cols, .. } if attached => {\n 780│ let line = ndjson::encode_line(&AttachRecord::Size { rows, cols });\n *781│ wire.net_stream_send(stream_id, &line, None, false)?;\n 782│ }\n 783│ // This controller was kicked by a different operator's `--take`.\n 784│ BrokerEvent::Displaced { by, .. } if attached => {\n 785│ let line = ndjson::encode_line(&AttachRecord::Displaced { by });\n *786│ wire.net_stream_send(stream_id, &line, None, true)?;\n 787│ // No dormant edge: the endpoint stays driven by the taker (whose\n 788│ // own serve loop already fired the wake).\n 789│ return Ok(AttachServeOutcome::Displaced);\n │...\n 815│ BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\n *816│ wire.net_stream_send(stream_id, &[], None, true)?;\n 817│ // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\n 818│ // info.json, carrying the current driven_by through), THEN release\n 819│ // the role over IPC so the broker's driven_by=None is the LAST\n │...\n 840│ // the record, and the operator's render cursor is the dedup.\n *841│ wire.net_stream_send(stream_id, &line, None, false)?;\n 842│ }\n 843│ BrokerEvent::Exit { code, .. } if attached => {\n 844│ let line = ndjson::encode_line(&AttachRecord::Exit { code });\n *845│ wire.net_stream_send(stream_id, &line, None, true)?;\n 846│ if role == Some(ServeRole::Controller) {\n 847│ feed_rest(endpoint, crate::resting::RestEvent::Detach);\n 848│ }\n │...\n 866│/// ([`AttachRecord::Output`] frames, deduped by `seq`) and writes\n *867│/// ([`AttachRecord::Input`] with operator-minted op ids). `open_op` is the\n 868│/// durable id for the exactly-once stream open (safe to block for its ack —\n 869│/// no attach traffic can be in flight before the stream exists); the Request\n 870│/// send itself is unjournaled (see module docs — a replayed Request re-gates\n │...\n 872│// [impl->REQ-INST-8]\n *873│pub fn request_attach(\n 874│ brain: &mut Brain,\n 875│ conn_id: u64,\n 876│ session_id: u64,\n │...\n 892│#[allow(clippy::too_many_arguments)]\n *893│pub fn request_attach_endpoint(\n 894│ brain: &mut Brain,\n 895│ conn_id: u64,\n 896│ session_id: u64,\n │...\n 933│ });\n *934│ brain.net_stream_send(opened.stream_id, &line, None, false)?;\n 935│ Ok(opened.stream_id)\n 936│}\n 937│\n │...\n 943│// [impl->REQ-RCVIEW-1]\n *944│pub fn send_attach_resize(\n 945│ brain: &mut Brain,\n 946│ stream_id: u64,\n 947│ rows: u16,\n │...\n 950│ let line = ndjson::encode_line(&AttachRecord::Resize { rows, cols });\n *951│ brain.net_stream_send(stream_id, &line, None, false)?;\n 952│ Ok(())\n 953│}\n 954│\n │...\n 964│// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n *965│pub fn send_seal_ceremony_code(\n 966│ brain: &mut Brain,\n 967│ stream_id: u64,\n 968│ ceremony_id: u64,\n │...\n 979│ });\n *980│ brain.net_stream_send(stream_id, &line, None, false)?;\n 981│ Ok(())\n 982│}\n 983│\n │...\n 988│// [impl->REQ-INST-8]\n *989│pub fn send_attach_input(\n 990│ brain: &mut Brain,\n 991│ stream_id: u64,\n 992│ bytes: &[u8],\n │...\n 994│) -> io::Result<()> {\n *995│ let line = ndjson::encode_line(&AttachRecord::Input {\n 996│ data_b64: encode_bytes(bytes),\n 997│ op_id: wire_op,\n 998│ });\n *999│ brain.net_stream_send(stream_id, &line, None, false)?;\n 1000│ Ok(())\n 1001│}\n 1002│"},"isError":false,"timestamp":1789113830010}}
{"type":"message","id":"51f32487","parentId":"377325d4","timestamp":"2026-09-11T08:03:50.013Z","message":{"role":"toolResult","toolCallId":"call_lf4zIBD4Nnyfz0zY1GuE5A8I|fc_07a38c9435caeae6016aa3b5e3931c87d28c34f1f4626a1149","toolName":"grep","content":[{"type":"text","text":" 1404|/// relies on it. Detach is the `ctrl-b d` prefix on BOTH paths.\n*1405|fn spawn_stdin_reader(tx: mpsc::Sender, mouse_mode: std::sync::Arc) {\n 1406| #[cfg(windows)]\n 1407| {\n 1408| use std::io::IsTerminal;\n...\n 1421|/// SM. No key translation — a non-tty stream carries bytes, not console key events.\n*1422|fn spawn_stdin_reader_bytes(tx: mpsc::Sender) {\n 1423| std::thread::spawn(move || {\n 1424| let mut stdin = std::io::stdin().lock();\n 1425| let mut buf = [0u8; 1024];\n...\n 1455|#[cfg(windows)]\n*1456|fn spawn_stdin_reader_events(tx: mpsc::Sender, mouse_mode: std::sync::Arc) {\n 1457| use crossterm::event::{self, Event, KeyEventKind};\n 1458| use std::sync::atomic::Ordering::Acquire;\n 1459| std::thread::spawn(move || {\n...\n 1522|// [impl->REQ-RC-1] [impl->REQ-RCVIEW-1] [impl->REQ-KICK-1]\n*1523|pub fn run_attach(endpoint_id: &str, intent: AttachIntent) -> Result<(), String> {\n 1524| run_attach_inner(endpoint_id, intent, false, None)\n 1525|}\n 1526|\n...\n 1533|// [impl->REQ-ER-BRINGUP-TOTP-GATE]\n*1534|pub fn run_attach_coded(\n 1535| endpoint_id: &str,\n 1536| intent: AttachIntent,\n 1537| code: Option<&str>,\n...\n 1560|// [impl->REQ-ER-BRINGUP-PROMPT]\n*1561|pub(crate) fn fold_code_key(buf: &str, ke: &crossterm::event::KeyEvent) -> CodePromptStep {\n 1562| use crossterm::event::{KeyCode, KeyModifiers};\n 1563| match ke.code {\n 1564| KeyCode::Esc => CodePromptStep::Cancel,\n...\n 1626|/// operator can still see what the endpoint is doing while they decide.\n*1627|fn ceremony_capacity(rows: u16) -> usize {\n 1628| ((rows / 2) as usize).saturating_sub(CEREMONY_CHROME_ROWS).max(1)\n 1629|}\n 1630|\n...\n 1636|/// rows are on screen this frame.\n*1637|fn ceremony_display_rows(content: &[u8], cols: u16) -> Vec {\n 1638| let cols = cols.max(1) as usize;\n 1639| let mut rows = Vec::new();\n 1640| for l in String::from_utf8_lossy(content).split('\\n') {\n...\n 1663|// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*1664|fn fido2_offer_stands(\n 1665| own_node: Option<&str>,\n 1666| payload_to_sign_b64: Option<&str>,\n 1667| fido2_node: Option<&str>,\n...\n 1678|/// a side effect of rendering an overlay.\n*1679|fn own_node_short_hex() -> Option {\n 1680| spt_store::nodeid::load_existing()\n 1681| .map(|id| spt_net::net::registry::key_prefix(&id.public_key().to_hex()))\n 1682|}\n...\n 1691| // [impl->REQ-SEAL-CEREMONY-CONTENT-SHOWN]\n*1692| fn paint_bytes(&self, rows: u16, cols: u16) -> Vec {\n*1693| fn emit_row(out: &mut Vec, row: usize, bytes: &[u8], chrome: bool) {\n 1694| out.extend_from_slice(format!(\"\\x1b[{row};1H\\x1b[2K\").as_bytes());\n 1695| if chrome {\n 1696| out.extend_from_slice(b\"\\x1b[7;36m\"); // inverse cyan chrome\n...\n 1774| /// itself over time (cosmetic residue accepted — the Size-cue class).\n*1775| fn clear_bytes(&self, rows: u16, cols: u16) -> Vec {\n 1776| let content_rows = ceremony_display_rows(&self.content, cols)\n 1777| .len()\n 1778| .min(ceremony_capacity(rows));\n...\n 1798|// [impl->REQ-SEAL-CEREMONY-ESC-CANCEL]\n*1799|pub(crate) fn fold_code_bytes(buf: &str, bytes: &[u8]) -> CodePromptStep {\n 1800| use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};\n 1801| // A lone Esc byte is the cancel key; Esc followed by anything is a CSI/SS3\n 1802| // sequence and is not typing at all.\n...\n 1842|// [impl->REQ-ER-BRINGUP-PROMPT-NAMES-SEAT]\n*1843|pub(crate) fn bringup_prompt_label(node: Option<&str>, home_subnet: &str) -> String {\n 1844| // A node label is a rendering nicety and the OS can decline to supply one;\n 1845| // the SUBNET is the fact the human actually needs, so a missing label\n 1846| // drops the phrase rather than printing an empty one.\n...\n 1860|// [impl->REQ-ER-BRINGUP-PROMPT-NAMES-SEAT]\n*1861|pub fn prompt_bringup_code(endpoint_id: &str) -> Result, String> {\n 1862| use std::io::IsTerminal;\n 1863| if !std::io::stdin().is_terminal() {\n 1864| return Err(format!(\n...\n 1891|// [impl->REQ-ER-BRINGUP-PROMPT]\n*1892|pub fn prompt_digits(label: &str) -> Result, String> {\n 1893| use crossterm::event::{self, Event, KeyEventKind};\n 1894| use std::io::Write;\n 1895| let render = |buf: &str| {\n...\n 1937|// [impl->REQ-ENDPOINT-UNBOUND-ATTACH]\n*1938|pub fn run_attach_session_confirmed(\n 1939| endpoint_id: &str,\n 1940| intent: AttachIntent,\n 1941|) -> Result<(), String> {\n...\n 1944|\n*1945|fn run_attach_inner(\n 1946| endpoint_id: &str,\n 1947| intent: AttachIntent,\n 1948| session_confirmed: bool,\n...\n 1971| // same-identity viewports at the BROKER, below this gate — the recovery seams\n*1972| // (rc reconnect re-drive, dispatcher re-serve) enter there and stay reachable.\n 1973| // The engine room's locks, said plainly before any broker traffic (the\n 1974| // owning broker refuses these too — this is the copy that names why).\n 1975| if let Some(refusal) = engine_room_client_refusal(\n...\n 2059| // WITH a code is bringable, so its clean-exit row no longer\n*2060| // reaches this arm. Code-less — the reconnect re-drive — it\n 2061| // does, and that is right: there is nothing here to pay the\n 2062| // gate with.\n 2063| // [impl->REQ-HAZARD-RC-ATTACH-FAILFAST]\n...\n 2110| // Establish the attach (broker conn → session resolve → dial → attach-open →\n*2111| // subscribe). Factored out so the B-3 reconnect loop can RE-DRIVE the whole\n 2112| // sequence after a severed viewport (REQ-RC-RECONNECT). The first attempt\n 2113| // keeps today's clean-exit copy on a no-target miss.\n 2114| let est = match establish_attach(endpoint_id, intent, carried_brain, code) {\n...\n 2215|// [impl->REQ-PUBLIC-ERROR-SURFACES]\n*2216|fn public_attach_failure(endpoint_id: &str, e: String) -> String {\n 2217| if e.contains(\"brain IPC read deadline\") {\n 2218| format!(\n 2219| \"the daemon didn't answer in time while attaching to '{endpoint_id}' — \\\n...\n 2229|/// stream, and the op counter that minted it. One per (re)connect — the B-3\n*2230|/// reconnect loop re-mints the WHOLE bundle (a broker restart drops the conn,\n 2231|/// not just the stream; a fresh OpMinter keeps ADR-0034 `rc` op tracing per\n 2232|/// viewport). [impl->REQ-RC-RECONNECT]\n 2233|struct Established {\n...\n 2236| stream_id: u64,\n*2237| /// The owning node's label for a REMOTE attach (the reconnect-banner target\n 2238| /// + the honest-failure copy); `None` ⇒ local.\n 2239| remote_node: Option,\n 2240|}\n...\n 2245| /// unreachable) — the carried message is the CLEAN first-attempt exit copy;\n*2246| /// the reconnect loop retries it inside the window instead (the node may\n 2247| /// still be coming back).\n 2248| NoTarget(String),\n 2249| /// The daemon isn't running — rc is CONNECT-ONLY and refuses to auto-start it\n 2250| /// (REQ-RC-RECONNECT-TRUTH). On the initial attach this is a loud \"daemon\n*2251| /// isn't running — start it\" exit; inside the reconnect loop it's just another\n 2252| /// retry (the operator may bring the daemon back), never a resurrection.\n 2253| /// [impl->REQ-RC-RECONNECT-TRUTH]\n 2254| DaemonDown,\n...\n 2261|/// the A-4b tracing retry) → stream subscribe. Factored from `run_attach_inner`\n*2262|/// so the B-3 reconnect loop can re-drive it verbatim (REQ-RC-RECONNECT).\n 2263|///\n 2264|/// Transport for a LOCAL attach: a broker-minted in-process LOOPBACK connection\n 2265|/// (M12 W1.5, B1). A QUIC self-dial is refused by iroh (\"Connecting to ourself\n...\n 2283|// invocation (REQ-RC-SINGLE-PUMP-BRAIN) — `None` cold-starts fresh exactly as\n*2284|// before (every reconnect attempt, and the qualified/session-confirmed paths\n 2285|// that never ran a probe).\n 2286|// [impl->REQ-RC-SINGLE-PUMP-BRAIN]\n 2287|// OBS RIDER leg 2: a process-monotonic establish counter. Each establish_attach\n*2288|// call (the initial attach + every reconnect attempt) takes the next value — the\n 2289|// client-side attempt/epoch id in the always-on RC_ESTABLISH breadcrumb,\n 2290|// correlated to the broker's SUBSCRIBE_DECISION by (conn, session).\n 2291|static RC_ESTABLISH_SEQ: AtomicU64 = AtomicU64::new(0);\n*2292|fn establish_attach(\n 2293| endpoint_id: &str,\n 2294| intent: AttachIntent,\n 2295| carried_brain: Option,\n...\n 2307| // which fought the operator's `spt daemon stop` (the \"stop 2-4 times\" bug)\n*2308| // and, in the reconnect loop, re-birthed the very daemon the operator was\n 2309| // tearing down. A daemon-down probe returns `DaemonDown` so the caller exits\n*2310| // loud (initial) or keeps its bounded retry without spawning (reconnect). The\n 2311| // broker cold-connect below is already deadline-bounded, so a down daemon\n 2312| // never hangs.\n 2313| // [impl->REQ-RC-RECONNECT-TRUTH]\n...\n 2324| // from_env trace (REQ-RC-DISPLAY-SOLE-WRITER): this is ALSO the\n*2325| // reconnect loop's pump constructor — the field corruption was this\n*2326| // very marker landing at the reconnect banner's parked cursor.\n 2327| None => Brain::cold_start_pump(\n 2328| &spt_daemon::endpoint::broker_socket_name(),\n 2329| now_ms(),\n...\n 2371| // used to be that `evaluate_bringup` counted a code-less request as a failed\n*2372| // guess, so a code-less bring-up here would let the B-3 reconnect loop —\n 2373| // which deliberately re-establishes WITHOUT a code, a severed engine-room\n 2374| // viewport being re-taken on purpose after the typed code has rotated —\n 2375| // ratchet the human's own attempt budget toward a backoff. That ratchet is"}],"details":{"scopePath":".worktrees/304-product/crates/spt/src/rc.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt\\src\\rc.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":36,"fileCount":1,"files":[".worktrees/304-product/crates/spt/src/rc.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt/src/rc.rs","count":36}],"truncated":false,"displayContent":" 1404│/// relies on it. Detach is the `ctrl-b d` prefix on BOTH paths.\n*1405│fn spawn_stdin_reader(tx: mpsc::Sender, mouse_mode: std::sync::Arc) {\n 1406│ #[cfg(windows)]\n 1407│ {\n 1408│ use std::io::IsTerminal;\n │...\n 1421│/// SM. No key translation — a non-tty stream carries bytes, not console key events.\n*1422│fn spawn_stdin_reader_bytes(tx: mpsc::Sender) {\n 1423│ std::thread::spawn(move || {\n 1424│ let mut stdin = std::io::stdin().lock();\n 1425│ let mut buf = [0u8; 1024];\n │...\n 1455│#[cfg(windows)]\n*1456│fn spawn_stdin_reader_events(tx: mpsc::Sender, mouse_mode: std::sync::Arc) {\n 1457│ use crossterm::event::{self, Event, KeyEventKind};\n 1458│ use std::sync::atomic::Ordering::Acquire;\n 1459│ std::thread::spawn(move || {\n │...\n 1522│// [impl->REQ-RC-1] [impl->REQ-RCVIEW-1] [impl->REQ-KICK-1]\n*1523│pub fn run_attach(endpoint_id: &str, intent: AttachIntent) -> Result<(), String> {\n 1524│ run_attach_inner(endpoint_id, intent, false, None)\n 1525│}\n 1526│\n │...\n 1533│// [impl->REQ-ER-BRINGUP-TOTP-GATE]\n*1534│pub fn run_attach_coded(\n 1535│ endpoint_id: &str,\n 1536│ intent: AttachIntent,\n 1537│ code: Option<&str>,\n │...\n 1560│// [impl->REQ-ER-BRINGUP-PROMPT]\n*1561│pub(crate) fn fold_code_key(buf: &str, ke: &crossterm::event::KeyEvent) -> CodePromptStep {\n 1562│ use crossterm::event::{KeyCode, KeyModifiers};\n 1563│ match ke.code {\n 1564│ KeyCode::Esc => CodePromptStep::Cancel,\n │...\n 1626│/// operator can still see what the endpoint is doing while they decide.\n*1627│fn ceremony_capacity(rows: u16) -> usize {\n 1628│ ((rows / 2) as usize).saturating_sub(CEREMONY_CHROME_ROWS).max(1)\n 1629│}\n 1630│\n │...\n 1636│/// rows are on screen this frame.\n*1637│fn ceremony_display_rows(content: &[u8], cols: u16) -> Vec {\n 1638│ let cols = cols.max(1) as usize;\n 1639│ let mut rows = Vec::new();\n 1640│ for l in String::from_utf8_lossy(content).split('\\n') {\n │...\n 1663│// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*1664│fn fido2_offer_stands(\n 1665│ own_node: Option<&str>,\n 1666│ payload_to_sign_b64: Option<&str>,\n 1667│ fido2_node: Option<&str>,\n │...\n 1678│/// a side effect of rendering an overlay.\n*1679│fn own_node_short_hex() -> Option {\n 1680│ spt_store::nodeid::load_existing()\n 1681│ .map(|id| spt_net::net::registry::key_prefix(&id.public_key().to_hex()))\n 1682│}\n │...\n 1691│ // [impl->REQ-SEAL-CEREMONY-CONTENT-SHOWN]\n*1692│ fn paint_bytes(&self, rows: u16, cols: u16) -> Vec {\n*1693│ fn emit_row(out: &mut Vec, row: usize, bytes: &[u8], chrome: bool) {\n 1694│ out.extend_from_slice(format!(\"\\x1b[{row};1H\\x1b[2K\").as_bytes());\n 1695│ if chrome {\n 1696│ out.extend_from_slice(b\"\\x1b[7;36m\"); // inverse cyan chrome\n │...\n 1774│ /// itself over time (cosmetic residue accepted — the Size-cue class).\n*1775│ fn clear_bytes(&self, rows: u16, cols: u16) -> Vec {\n 1776│ let content_rows = ceremony_display_rows(&self.content, cols)\n 1777│ .len()\n 1778│ .min(ceremony_capacity(rows));\n │...\n 1798│// [impl->REQ-SEAL-CEREMONY-ESC-CANCEL]\n*1799│pub(crate) fn fold_code_bytes(buf: &str, bytes: &[u8]) -> CodePromptStep {\n 1800│ use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};\n 1801│ // A lone Esc byte is the cancel key; Esc followed by anything is a CSI/SS3\n 1802│ // sequence and is not typing at all.\n │...\n 1842│// [impl->REQ-ER-BRINGUP-PROMPT-NAMES-SEAT]\n*1843│pub(crate) fn bringup_prompt_label(node: Option<&str>, home_subnet: &str) -> String {\n 1844│ // A node label is a rendering nicety and the OS can decline to supply one;\n 1845│ // the SUBNET is the fact the human actually needs, so a missing label\n 1846│ // drops the phrase rather than printing an empty one.\n │...\n 1860│// [impl->REQ-ER-BRINGUP-PROMPT-NAMES-SEAT]\n*1861│pub fn prompt_bringup_code(endpoint_id: &str) -> Result, String> {\n 1862│ use std::io::IsTerminal;\n 1863│ if !std::io::stdin().is_terminal() {\n 1864│ return Err(format!(\n │...\n 1891│// [impl->REQ-ER-BRINGUP-PROMPT]\n*1892│pub fn prompt_digits(label: &str) -> Result, String> {\n 1893│ use crossterm::event::{self, Event, KeyEventKind};\n 1894│ use std::io::Write;\n 1895│ let render = |buf: &str| {\n │...\n 1937│// [impl->REQ-ENDPOINT-UNBOUND-ATTACH]\n*1938│pub fn run_attach_session_confirmed(\n 1939│ endpoint_id: &str,\n 1940│ intent: AttachIntent,\n 1941│) -> Result<(), String> {\n │...\n 1944│\n*1945│fn run_attach_inner(\n 1946│ endpoint_id: &str,\n 1947│ intent: AttachIntent,\n 1948│ session_confirmed: bool,\n │...\n 1971│ // same-identity viewports at the BROKER, below this gate — the recovery seams\n*1972│ // (rc reconnect re-drive, dispatcher re-serve) enter there and stay reachable.\n 1973│ // The engine room's locks, said plainly before any broker traffic (the\n 1974│ // owning broker refuses these too — this is the copy that names why).\n 1975│ if let Some(refusal) = engine_room_client_refusal(\n │...\n 2059│ // WITH a code is bringable, so its clean-exit row no longer\n*2060│ // reaches this arm. Code-less — the reconnect re-drive — it\n 2061│ // does, and that is right: there is nothing here to pay the\n 2062│ // gate with.\n 2063│ // [impl->REQ-HAZARD-RC-ATTACH-FAILFAST]\n │...\n 2110│ // Establish the attach (broker conn → session resolve → dial → attach-open →\n*2111│ // subscribe). Factored out so the B-3 reconnect loop can RE-DRIVE the whole\n 2112│ // sequence after a severed viewport (REQ-RC-RECONNECT). The first attempt\n 2113│ // keeps today's clean-exit copy on a no-target miss.\n 2114│ let est = match establish_attach(endpoint_id, intent, carried_brain, code) {\n │...\n 2215│// [impl->REQ-PUBLIC-ERROR-SURFACES]\n*2216│fn public_attach_failure(endpoint_id: &str, e: String) -> String {\n 2217│ if e.contains(\"brain IPC read deadline\") {\n 2218│ format!(\n 2219│ \"the daemon didn't answer in time while attaching to '{endpoint_id}' — \\\n │...\n 2229│/// stream, and the op counter that minted it. One per (re)connect — the B-3\n*2230│/// reconnect loop re-mints the WHOLE bundle (a broker restart drops the conn,\n 2231│/// not just the stream; a fresh OpMinter keeps ADR-0034 `rc` op tracing per\n 2232│/// viewport). [impl->REQ-RC-RECONNECT]\n 2233│struct Established {\n │...\n 2236│ stream_id: u64,\n*2237│ /// The owning node's label for a REMOTE attach (the reconnect-banner target\n 2238│ /// + the honest-failure copy); `None` ⇒ local.\n 2239│ remote_node: Option,\n 2240│}\n │...\n 2245│ /// unreachable) — the carried message is the CLEAN first-attempt exit copy;\n*2246│ /// the reconnect loop retries it inside the window instead (the node may\n 2247│ /// still be coming back).\n 2248│ NoTarget(String),\n 2249│ /// The daemon isn't running — rc is CONNECT-ONLY and refuses to auto-start it\n 2250│ /// (REQ-RC-RECONNECT-TRUTH). On the initial attach this is a loud \"daemon\n*2251│ /// isn't running — start it\" exit; inside the reconnect loop it's just another\n 2252│ /// retry (the operator may bring the daemon back), never a resurrection.\n 2253│ /// [impl->REQ-RC-RECONNECT-TRUTH]\n 2254│ DaemonDown,\n │...\n 2261│/// the A-4b tracing retry) → stream subscribe. Factored from `run_attach_inner`\n*2262│/// so the B-3 reconnect loop can re-drive it verbatim (REQ-RC-RECONNECT).\n 2263│///\n 2264│/// Transport for a LOCAL attach: a broker-minted in-process LOOPBACK connection\n 2265│/// (M12 W1.5, B1). A QUIC self-dial is refused by iroh (\"Connecting to ourself\n │...\n 2283│// invocation (REQ-RC-SINGLE-PUMP-BRAIN) — `None` cold-starts fresh exactly as\n*2284│// before (every reconnect attempt, and the qualified/session-confirmed paths\n 2285│// that never ran a probe).\n 2286│// [impl->REQ-RC-SINGLE-PUMP-BRAIN]\n 2287│// OBS RIDER leg 2: a process-monotonic establish counter. Each establish_attach\n*2288│// call (the initial attach + every reconnect attempt) takes the next value — the\n 2289│// client-side attempt/epoch id in the always-on RC_ESTABLISH breadcrumb,\n 2290│// correlated to the broker's SUBSCRIBE_DECISION by (conn, session).\n 2291│static RC_ESTABLISH_SEQ: AtomicU64 = AtomicU64::new(0);\n*2292│fn establish_attach(\n 2293│ endpoint_id: &str,\n 2294│ intent: AttachIntent,\n 2295│ carried_brain: Option,\n │...\n 2307│ // which fought the operator's `spt daemon stop` (the \"stop 2-4 times\" bug)\n*2308│ // and, in the reconnect loop, re-birthed the very daemon the operator was\n 2309│ // tearing down. A daemon-down probe returns `DaemonDown` so the caller exits\n*2310│ // loud (initial) or keeps its bounded retry without spawning (reconnect). The\n 2311│ // broker cold-connect below is already deadline-bounded, so a down daemon\n 2312│ // never hangs.\n 2313│ // [impl->REQ-RC-RECONNECT-TRUTH]\n │...\n 2324│ // from_env trace (REQ-RC-DISPLAY-SOLE-WRITER): this is ALSO the\n*2325│ // reconnect loop's pump constructor — the field corruption was this\n*2326│ // very marker landing at the reconnect banner's parked cursor.\n 2327│ None => Brain::cold_start_pump(\n 2328│ &spt_daemon::endpoint::broker_socket_name(),\n 2329│ now_ms(),\n │...\n 2371│ // used to be that `evaluate_bringup` counted a code-less request as a failed\n*2372│ // guess, so a code-less bring-up here would let the B-3 reconnect loop —\n 2373│ // which deliberately re-establishes WITHOUT a code, a severed engine-room\n 2374│ // viewport being re-taken on purpose after the typed code has rotated —\n 2375│ // ratchet the human's own attempt budget toward a backoff. That ratchet is"},"isError":false,"timestamp":1789113830013}}
{"type":"message","id":"f1250116","parentId":"51f32487","timestamp":"2026-09-11T08:03:50.015Z","message":{"role":"toolResult","toolCallId":"call_LZ3Zf4CNUVQN3TZywbQz7OgK|fc_07a38c9435caeae6016aa3b5e3934087d28e4299fe0013b324","toolName":"grep","content":[{"type":"text","text":" 11|//!\n*12|//! [`apply_staged`] drives the whole chain against what the peer pump left\n 13|//! behind (REQ-UPD-4: staged + consent-notified, never auto-applied):\n 14|//!\n 15|//! 1. **Re-verify at rest** (`plan_verified` under the production\n...\n 51|\n*52|/// What [`apply_staged`] did — loud + typed, never silent.\n 53|#[derive(Debug, Clone, PartialEq, Eq)]\n 54|pub enum ApplyStagedOutcome {\n 55| /// Nothing staged (or a torn stage that never offers) — idempotent no-op.\n...\n 105|/// swap, carrying the verified bytes. The shared verify/classify preamble both\n*106|/// [`apply_staged`] and [`apply_staged_daemonless`] run before they diverge on\n 107|/// whether a live broker is handed off to.\n 108|enum Prepared {\n 109| /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\n...\n 125|// [impl->REQ-UPD-4]\n*126|fn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result {\n 127| let Some(staged) = cache.staged_update() else {\n 128| return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\n 129| };\n...\n 298|/// the canonical broker socket the brain handoff runs against. For a stopped box,\n*299|/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n 300|/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n 301|// [impl->REQ-UPD-3]\n 302|// [impl->REQ-UPD-4]\n*303|pub fn apply_staged(\n 304| cache: &ReleaseCache,\n 305| release_keys: &Path,\n 306| exe_path: &Path,\n...\n 363|// [impl->REQ-DAEMON-REFRESH]\n*364|pub fn refresh_brain(broker_name: &str) -> Result {\n 365| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366| brain\n 367| .request_brain_restart()\n...\n 380|/// the handoff path's does. Runs the identical verify/classify gate as\n*381|/// [`apply_staged`], so every fail-closed refusal is preserved.\n 382|// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n 383|// [impl->REQ-UPD-4]\n*384|pub fn apply_staged_daemonless(\n 385| cache: &ReleaseCache,\n 386| release_keys: &Path,\n 387| exe_path: &Path,\n...\n 404|/// Already-applied classifier (F-025): whether the staged `staged_version` is\n*405|/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\n 406|/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\n 407|/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\n 408|/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n...\n 760| #[test]\n*761| fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n 762| let dir = tempfile::tempdir().unwrap();\n 763| let name = unique_name();\n 764| let _broker = served_broker(&name);\n...\n 773| cache.stage(&signed, b\"CROSS-OS BYTES\").unwrap();\n*774| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 775| assert!(\n 776| matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(\"platform\")),\n 777| \"unstamped single must refuse, got {out:?}\"\n...\n 792| .unwrap();\n*793| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 794| assert!(\n 795| matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(other)),\n 796| \"mismatched-platform single must refuse, got {out:?}\"\n...\n 804| .unwrap();\n*805| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 806| assert!(\n 807| matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 808| \"matching-platform single applies, got {out:?}\"\n...\n 844|\n*845| // [unit->REQ-DAEMON-REFRESH] `refresh_brain` routes the SAME supervisor\n 846| // brain-cycle signal as the post-swap apply — against a bare broker with NO\n 847| // staged release, NO release cache, NO binary swap. The verb has no staging\n 848| // preconditions: the signal raises and `honored` reports the supervisor\n...\n 850| #[test]\n*851| fn refresh_brain_cycles_without_staging_or_swap_preconditions() {\n 852| let name = unique_name();\n 853| let broker = served_broker(&name);\n 854|\n...\n 856| assert!(\n*857| !refresh_brain(&name).expect(\"refresh round-trips on a bare broker\"),\n 858| \"no supervisor wired must report honored=false\"\n 859| );\n 860|\n...\n 865| assert!(\n*866| refresh_brain(&name).expect(\"refresh round-trips\"),\n 867| \"a wired supervisor must report honored=true\"\n 868| );\n 869| assert!(\n...\n 899| #[test]\n*900| fn apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint() {\n 901| let dir = tempfile::tempdir().unwrap();\n 902| let name = unique_name();\n 903| let broker = served_broker(&name);\n...\n 914|\n*915| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 916| assert!(\n 917| matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 918| \"got {out:?}\"\n...\n 940| // running AT ALL (none bound, none served — the stopped-box shape the wart\n*941| // used to boot the old broker for), apply_staged_daemonless still swaps the\n 942| // binary + records the open trial and returns AppliedDaemonless. RED without\n*943| // the daemonless path: apply_staged would block on connect_retry against a\n 944| // dead socket (300×10ms) and then fail — never landing the bytes. Proves the\n 945| // swap no longer depends on a live broker to hand off to.\n 946| #[test]\n*947| fn apply_staged_daemonless_swaps_binary_with_no_broker() {\n 948| let dir = tempfile::tempdir().unwrap();\n 949| let exe = dir.path().join(\"spt-binary\");\n 950| std::fs::write(&exe, b\"OLD BINARY\").unwrap();\n...\n 953| // No served_broker — deliberately. A daemonless apply must not need one.\n*954| let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"apply ok\");\n 955| assert!(\n 956| matches!(out, ApplyStagedOutcome::AppliedDaemonless { version: 7, .. }),\n 957| \"got {out:?}\"\n...\n 985| #[test]\n*986| fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n 987| let dir = tempfile::tempdir().unwrap();\n 988| let exe = dir.path().join(\"spt-binary\");\n 989| std::fs::write(&exe, b\"OLD\").unwrap();\n...\n 993| let keys = dir.path().join(\"release-keys.json\");\n*994| let out = apply_staged_daemonless(&empty, &keys, &exe).expect(\"ok\");\n 995| assert!(matches!(out, ApplyStagedOutcome::NoUpdate), \"got {out:?}\");\n 996|\n 997| // Broker-breaking class: typed refusal, artifact stays staged, seat untouched.\n 998| let (cache, keys) = stage(dir.path(), 8, b\"X\", BROKER_RESOURCE_ABI + 1);\n*999| let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n 1000| assert!(\n 1001| matches!(\n 1002| out,\n...\n 1019| .unwrap();\n*1020| let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n 1021| assert!(\n 1022| matches!(out, ApplyStagedOutcome::AlreadyApplied { version: 9, .. }),\n 1023| \"got {out:?}\"\n...\n 1031| #[test]\n*1032| fn apply_staged_update_set_selects_local_platform_artifact() {\n 1033| let dir = tempfile::tempdir().unwrap();\n 1034| let name = unique_name();\n 1035| let broker = served_broker(&name);\n...\n 1045|\n*1046| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1047| assert!(\n 1048| matches!(out, ApplyStagedOutcome::AppliedPending { version: 11, .. }),\n 1049| \"got {out:?}\"\n...\n 1058| #[test]\n*1059| fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n 1060| let dir = tempfile::tempdir().unwrap();\n 1061| let name = unique_name();\n 1062| let broker = served_broker(&name);\n...\n 1067|\n*1068| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1069| assert!(\n 1070| matches!(out, ApplyStagedOutcome::AppliedPending { version: 13, .. }),\n 1071| \"got {out:?}\"\n...\n 1081| #[test]\n*1082| fn apply_staged_update_set_refuses_broker_touching_payloads() {\n 1083| let dir = tempfile::tempdir().unwrap();\n 1084| let name = unique_name();\n 1085| let _broker = served_broker(&name);\n...\n 1095|\n*1096| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1097| assert!(\n 1098| matches!(\n 1099| out,\n...\n 1111| #[test]\n*1112| fn apply_staged_gates_fail_closed_with_the_seat_untouched() {\n 1113| let dir = tempfile::tempdir().unwrap();\n 1114| let name = unique_name();\n 1115| let _broker = served_broker(&name);\n...\n 1121| let keys = dir.path().join(\"release-keys.json\");\n*1122| let out = apply_staged(&empty, &keys, &exe, &name).expect(\"ok\");\n 1123| assert!(matches!(out, ApplyStagedOutcome::NoUpdate), \"got {out:?}\");\n 1124|\n 1125| // Broker-breaking class: typed refusal, artifact stays staged.\n 1126| let (cache, keys) = stage(dir.path(), 8, b\"X\", BROKER_RESOURCE_ABI + 1);\n*1127| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1128| assert!(\n 1129| matches!(\n 1130| out,\n...\n 1140| std::fs::write(cache.artifact_path(), b\"EVIL BYTES\").unwrap();\n*1141| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1142| assert!(\n 1143| matches!(out, ApplyStagedOutcome::Rejected(_)),\n 1144| \"got {out:?}\"\n...\n 1150| let out =\n*1151| apply_staged(&cache, &dir.path().join(\"missing-keys.json\"), &exe, &name).expect(\"ok\");\n 1152| assert!(\n 1153| matches!(out, ApplyStagedOutcome::Rejected(_)),\n 1154| \"got {out:?}\"\n...\n 1164| #[test]\n*1165| fn apply_staged_refuses_a_quarantined_version() {\n 1166| let dir = tempfile::tempdir().unwrap();\n 1167| let name = unique_name();\n 1168| let _broker = served_broker(&name);\n...\n 1181|\n*1182| let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1183| assert!(\n 1184| matches!(out, ApplyStagedOutcome::Quarantined { version: 7 }),\n 1185| \"a quarantined version must refuse, got {out:?}\"\n...\n 1197| .unwrap();\n*1198| let out = apply_staged(&cache8, &keys8, &exe, &name).expect(\"ok\");\n 1199| assert!(\n 1200| matches!(out, ApplyStagedOutcome::AppliedPending { version: 8, .. }),\n 1201| \"a newer version is not quarantined, got {out:?}\"\n\nSkipped missing paths: .worktrees/304-product/crates/spt/src/daemon.rs, .worktrees/304-product/crates/spt/src/update"}],"details":{"scopePath":".worktrees/304-product/crates/spt-daemon/src/applyhost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt-daemon\\src\\applyhost.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":42,"fileCount":1,"files":[".worktrees/304-product/crates/spt-daemon/src/applyhost.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt-daemon/src/applyhost.rs","count":42}],"truncated":false,"displayContent":" 11│//!\n *12│//! [`apply_staged`] drives the whole chain against what the peer pump left\n 13│//! behind (REQ-UPD-4: staged + consent-notified, never auto-applied):\n 14│//!\n 15│//! 1. **Re-verify at rest** (`plan_verified` under the production\n │...\n 51│\n *52│/// What [`apply_staged`] did — loud + typed, never silent.\n 53│#[derive(Debug, Clone, PartialEq, Eq)]\n 54│pub enum ApplyStagedOutcome {\n 55│ /// Nothing staged (or a torn stage that never offers) — idempotent no-op.\n │...\n 105│/// swap, carrying the verified bytes. The shared verify/classify preamble both\n *106│/// [`apply_staged`] and [`apply_staged_daemonless`] run before they diverge on\n 107│/// whether a live broker is handed off to.\n 108│enum Prepared {\n 109│ /// A terminal outcome reached before any swap (NoUpdate / AlreadyApplied /\n │...\n 125│// [impl->REQ-UPD-4]\n *126│fn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result {\n 127│ let Some(staged) = cache.staged_update() else {\n 128│ return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\n 129│ };\n │...\n 298│/// the canonical broker socket the brain handoff runs against. For a stopped box,\n *299│/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n 300│/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n 301│// [impl->REQ-UPD-3]\n 302│// [impl->REQ-UPD-4]\n *303│pub fn apply_staged(\n 304│ cache: &ReleaseCache,\n 305│ release_keys: &Path,\n 306│ exe_path: &Path,\n │...\n 363│// [impl->REQ-DAEMON-REFRESH]\n *364│pub fn refresh_brain(broker_name: &str) -> Result {\n 365│ let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366│ brain\n 367│ .request_brain_restart()\n │...\n 380│/// the handoff path's does. Runs the identical verify/classify gate as\n *381│/// [`apply_staged`], so every fail-closed refusal is preserved.\n 382│// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n 383│// [impl->REQ-UPD-4]\n *384│pub fn apply_staged_daemonless(\n 385│ cache: &ReleaseCache,\n 386│ release_keys: &Path,\n 387│ exe_path: &Path,\n │...\n 404│/// Already-applied classifier (F-025): whether the staged `staged_version` is\n *405│/// already the running/applied image, so `apply_staged` must short-circuit BEFORE\n 406│/// the binary-aside rename (re-renaming an already-swapped exe is today's os-error-5)\n 407│/// and report a friendly exit-0 no-op. Mirrors fetch's v0.18.0 classifier\n 408│/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n │...\n 760│ #[test]\n *761│ fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n 762│ let dir = tempfile::tempdir().unwrap();\n 763│ let name = unique_name();\n 764│ let _broker = served_broker(&name);\n │...\n 773│ cache.stage(&signed, b\"CROSS-OS BYTES\").unwrap();\n *774│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 775│ assert!(\n 776│ matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(\"platform\")),\n 777│ \"unstamped single must refuse, got {out:?}\"\n │...\n 792│ .unwrap();\n *793│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 794│ assert!(\n 795│ matches!(out, ApplyStagedOutcome::Rejected(ref r) if r.contains(other)),\n 796│ \"mismatched-platform single must refuse, got {out:?}\"\n │...\n 804│ .unwrap();\n *805│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 806│ assert!(\n 807│ matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 808│ \"matching-platform single applies, got {out:?}\"\n │...\n 844│\n *845│ // [unit->REQ-DAEMON-REFRESH] `refresh_brain` routes the SAME supervisor\n 846│ // brain-cycle signal as the post-swap apply — against a bare broker with NO\n 847│ // staged release, NO release cache, NO binary swap. The verb has no staging\n 848│ // preconditions: the signal raises and `honored` reports the supervisor\n │...\n 850│ #[test]\n *851│ fn refresh_brain_cycles_without_staging_or_swap_preconditions() {\n 852│ let name = unique_name();\n 853│ let broker = served_broker(&name);\n 854│\n │...\n 856│ assert!(\n *857│ !refresh_brain(&name).expect(\"refresh round-trips on a bare broker\"),\n 858│ \"no supervisor wired must report honored=false\"\n 859│ );\n 860│\n │...\n 865│ assert!(\n *866│ refresh_brain(&name).expect(\"refresh round-trips\"),\n 867│ \"a wired supervisor must report honored=true\"\n 868│ );\n 869│ assert!(\n │...\n 899│ #[test]\n *900│ fn apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint() {\n 901│ let dir = tempfile::tempdir().unwrap();\n 902│ let name = unique_name();\n 903│ let broker = served_broker(&name);\n │...\n 914│\n *915│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 916│ assert!(\n 917│ matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 918│ \"got {out:?}\"\n │...\n 940│ // running AT ALL (none bound, none served — the stopped-box shape the wart\n *941│ // used to boot the old broker for), apply_staged_daemonless still swaps the\n 942│ // binary + records the open trial and returns AppliedDaemonless. RED without\n *943│ // the daemonless path: apply_staged would block on connect_retry against a\n 944│ // dead socket (300×10ms) and then fail — never landing the bytes. Proves the\n 945│ // swap no longer depends on a live broker to hand off to.\n 946│ #[test]\n *947│ fn apply_staged_daemonless_swaps_binary_with_no_broker() {\n 948│ let dir = tempfile::tempdir().unwrap();\n 949│ let exe = dir.path().join(\"spt-binary\");\n 950│ std::fs::write(&exe, b\"OLD BINARY\").unwrap();\n │...\n 953│ // No served_broker — deliberately. A daemonless apply must not need one.\n *954│ let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"apply ok\");\n 955│ assert!(\n 956│ matches!(out, ApplyStagedOutcome::AppliedDaemonless { version: 7, .. }),\n 957│ \"got {out:?}\"\n │...\n 985│ #[test]\n *986│ fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n 987│ let dir = tempfile::tempdir().unwrap();\n 988│ let exe = dir.path().join(\"spt-binary\");\n 989│ std::fs::write(&exe, b\"OLD\").unwrap();\n │...\n 993│ let keys = dir.path().join(\"release-keys.json\");\n *994│ let out = apply_staged_daemonless(&empty, &keys, &exe).expect(\"ok\");\n 995│ assert!(matches!(out, ApplyStagedOutcome::NoUpdate), \"got {out:?}\");\n 996│\n 997│ // Broker-breaking class: typed refusal, artifact stays staged, seat untouched.\n 998│ let (cache, keys) = stage(dir.path(), 8, b\"X\", BROKER_RESOURCE_ABI + 1);\n *999│ let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n 1000│ assert!(\n 1001│ matches!(\n 1002│ out,\n │...\n 1019│ .unwrap();\n*1020│ let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n 1021│ assert!(\n 1022│ matches!(out, ApplyStagedOutcome::AlreadyApplied { version: 9, .. }),\n 1023│ \"got {out:?}\"\n │...\n 1031│ #[test]\n*1032│ fn apply_staged_update_set_selects_local_platform_artifact() {\n 1033│ let dir = tempfile::tempdir().unwrap();\n 1034│ let name = unique_name();\n 1035│ let broker = served_broker(&name);\n │...\n 1045│\n*1046│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1047│ assert!(\n 1048│ matches!(out, ApplyStagedOutcome::AppliedPending { version: 11, .. }),\n 1049│ \"got {out:?}\"\n │...\n 1058│ #[test]\n*1059│ fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n 1060│ let dir = tempfile::tempdir().unwrap();\n 1061│ let name = unique_name();\n 1062│ let broker = served_broker(&name);\n │...\n 1067│\n*1068│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1069│ assert!(\n 1070│ matches!(out, ApplyStagedOutcome::AppliedPending { version: 13, .. }),\n 1071│ \"got {out:?}\"\n │...\n 1081│ #[test]\n*1082│ fn apply_staged_update_set_refuses_broker_touching_payloads() {\n 1083│ let dir = tempfile::tempdir().unwrap();\n 1084│ let name = unique_name();\n 1085│ let _broker = served_broker(&name);\n │...\n 1095│\n*1096│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"apply ok\");\n 1097│ assert!(\n 1098│ matches!(\n 1099│ out,\n │...\n 1111│ #[test]\n*1112│ fn apply_staged_gates_fail_closed_with_the_seat_untouched() {\n 1113│ let dir = tempfile::tempdir().unwrap();\n 1114│ let name = unique_name();\n 1115│ let _broker = served_broker(&name);\n │...\n 1121│ let keys = dir.path().join(\"release-keys.json\");\n*1122│ let out = apply_staged(&empty, &keys, &exe, &name).expect(\"ok\");\n 1123│ assert!(matches!(out, ApplyStagedOutcome::NoUpdate), \"got {out:?}\");\n 1124│\n 1125│ // Broker-breaking class: typed refusal, artifact stays staged.\n 1126│ let (cache, keys) = stage(dir.path(), 8, b\"X\", BROKER_RESOURCE_ABI + 1);\n*1127│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1128│ assert!(\n 1129│ matches!(\n 1130│ out,\n │...\n 1140│ std::fs::write(cache.artifact_path(), b\"EVIL BYTES\").unwrap();\n*1141│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1142│ assert!(\n 1143│ matches!(out, ApplyStagedOutcome::Rejected(_)),\n 1144│ \"got {out:?}\"\n │...\n 1150│ let out =\n*1151│ apply_staged(&cache, &dir.path().join(\"missing-keys.json\"), &exe, &name).expect(\"ok\");\n 1152│ assert!(\n 1153│ matches!(out, ApplyStagedOutcome::Rejected(_)),\n 1154│ \"got {out:?}\"\n │...\n 1164│ #[test]\n*1165│ fn apply_staged_refuses_a_quarantined_version() {\n 1166│ let dir = tempfile::tempdir().unwrap();\n 1167│ let name = unique_name();\n 1168│ let _broker = served_broker(&name);\n │...\n 1181│\n*1182│ let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n 1183│ assert!(\n 1184│ matches!(out, ApplyStagedOutcome::Quarantined { version: 7 }),\n 1185│ \"a quarantined version must refuse, got {out:?}\"\n │...\n 1197│ .unwrap();\n*1198│ let out = apply_staged(&cache8, &keys8, &exe, &name).expect(\"ok\");\n 1199│ assert!(\n 1200│ matches!(out, ApplyStagedOutcome::AppliedPending { version: 8, .. }),\n 1201│ \"a newer version is not quarantined, got {out:?}\"","missingPaths":[".worktrees/304-product/crates/spt/src/daemon.rs",".worktrees/304-product/crates/spt/src/update"]},"isError":false,"timestamp":1789113830015}}
{"type":"message","id":"0d32b047","parentId":"f1250116","timestamp":"2026-09-11T08:03:50.016Z","message":{"role":"toolResult","toolCallId":"call_MbqVZwIWVOpYARB1BG66S5b5|fc_07a38c9435caeae6016aa3b5e3934887d2a333eeff15124446","toolName":"read","content":[{"type":"text","text":"# REDISPATCH-TRUTH — milestone triage (JIT)\n\n> Doyle triage 2026-07-16, dispatched at the v0.33.0 boundary (ranked-first\n> from the hertz same-day RCA; displaces MESH-RECOVERY). Canonical RCA:\n> `.claude/reports/2026-07-16-redispatch-truth/hertz-refresh-rca.txt`\n> (hertz source-level, doyle seam-verified same day). Decision record:\n> ADR-0038. Lane: doyle triages → todlando builds → doyle gates → deployah\n> releases → hertz field-verify (they hold the incident logs).\n\n## Why (field: 4/5 endpoints frozen on one refresh, twice in one day)\n\n`spt daemon refresh` / `spt update` (same brain-cycle path, `applyhost.rs`)\nfreezes active remote `spt rc` sessions. The PTYs and broker-held QUIC\nstreams survive by construction — the freeze is a **production redispatch\nbug** in the fresh brain's stream reconstruction:\n\n1. **Stale replay steals live controllers.** The fresh\n `dispatch::run_dispatch_loop` starts with an EMPTY per-process `claimed`\n set (dispatch.rs:206) and its claim condition\n (`initiated_locally || next_seq == 0 || !claimed.insert`, dispatch.rs:214)\n has NO finished filter — while `NetShared.streams` has NO removal path\n (single insert nethost.rs ~649; `StreamLog::finish` (:245) only marks).\n So every dispatcher generation replays EVERY historical peer stream,\n including finished attach streams. A replayed historical Attach calls\n `attach_as(Control, same origin)` → same-identity silent\n `become_controller` (no `Displaced`) steals the CURRENT controller;\n the replayed EOF then `detach_session` CLEARS it. The live serve loop\n still believes it is Controller but its sink is deselected → operator\n sees a FROZEN PTY. Detach + fresh `spt rc` re-takes → explains the\n no-PTY-restart recovery.\n2. **Opener eviction permanently abandons an active stream.** Reconstruction\n classifies by `peek_first_line` (dispatch.rs:256) from ring seq 0, but\n `StreamLog` is a bounded 4096-transport-chunk ring\n (nethost.rs:111) — a high-traffic ACTIVE stream's Request record evicts\n → replay classifies Unknown/Failed; `claimed.insert` happens PRE-spawn\n and is never cleared/retried → that active stream is PERMANENTLY\n abandoned.\n\nField evidence (HFENDULEAM, hertz preserves\n`AppData/Local/spt-core/logs/daemon.stderr.log{,.1}`, brain generations\n2/3): 4/5 endpoints frozen across both 2026-07-16 doyle refreshes\n(deployah-recovery + the v0.33.0 apply) + lia on the update;\n`DISPATCH:N:Failed` lines with low/historical stream ids in fresh\ngenerations = the indiscriminate-replay supporting evidence.\n\nWhy CI never caught it: `attach_survives_target_brain_restart_exactly_once`\n(crates/spt-daemon/tests/attach.rs:779) manually re-serves a known short\nstream — it BYPASSES production rediscovery/classification and never rolls\nthe opener.\n\n**Distinct from the CLOSED 0.30.x resume-steal saga** (brain session-cursor\nresume, fixed cursor-only in 0.30.5/6). This is the NET DISPATCHER leg —\ndo not re-anchor the old theories.\n\n## Shape (hertz A–D, doyle-endorsed; ADR-0038)\n\nBroker stream-table rows gain explicit **lifecycle truth**, and the\ndispatcher redispatches only what is genuinely live:\n\n- **A — finished rows retire from redispatch eligibility.** A fresh\n dispatcher must never re-serve a terminal Attach request. Retain only the\n lifecycle state genuinely needed after EOF (presence/log reads); the\n redispatch enumeration must not see terminal rows.\n- **B — restart-durable opener/classification metadata.** Pin the\n per-stream immutable opener fact (or the complete first NDJSON record)\n OUTSIDE the evictable data ring, held until stream close. Recovery\n classifies from that metadata, never from ring seq 0.\n- **C — retryable claims.** Distinguish active/retryable vs served vs\n finished; a transient worker-setup failure requeues the claim; terminal\n outcomes do NOT hot-loop.\n- **D — three production-path regressions** (all through the REAL\n `run_dispatch_loop`, no manual re-serve):\n 1. finished historical Attach + current active Attach, same\n endpoint/origin; restart target brain only → historical stream neither\n takes nor clears the current controller; current input/output\n exactly-once without detach;\n 2. >4096 transport chunks on an active Attach (opener evicted); restart\n dispatcher → durable classification resumes the same operator stream;\n 3. one injected transient worker-start failure → claim retry recovers, no\n duplicate controller/output.\n\n## Waves\n\n### W1 — the fix cluster (single build wave; todlando)\n- **REQ-HAZARD-REDISPATCH-CONTROL-STEAL** — the invariant (KNOWN-HAZARDS\n 7.41) + regression D1.\n- **REQ-REDISPATCH-FINISHED-RETIRE** — mechanism A.\n- **REQ-STREAM-OPENER-DURABLE** — mechanism B + regression D2.\n- **REQ-DISPATCH-CLAIM-RETRY** — mechanism C + regression D3.\n\nThen: doyle gates → deployah releases → hertz field-verify on HFENDULEAM\n(daemon refresh with active remote `spt rc` sessions: no frozen PTYs, no\nhistorical `DISPATCH:N:Failed` replay storm in the fresh generation).\n\n## Gate rulings (pre-made, binding at gate)\n\n1. **Production-path only.** Every D regression exercises the real\n rediscovery path (`run_dispatch_loop` → peek/classify → serve). A test\n that manually re-serves a known stream does not count as evidence (the\n existing-e2e bypass is the lesson). The existing\n `attach_survives_target_brain_restart_exactly_once` stays as-is but is\n no longer the coverage for this class.\n2. **Successor re-take parity is binding.** The legitimate same-`by`\n successor re-subscribe after a brain restart (CONTEXT.md controller\n identity — silent re-take, `Displaced` only on genuine cross-operator\n Take) MUST keep working. The fix removes STALE-replay takeover, not the\n live reconstruction path. The discriminator is lifecycle (finished vs\n active), never origin identity.\n3. **B must not grow the evictable ring.** Opener metadata is a bounded\n per-stream side fact (one record), pinned until close; ring semantics\n and `DEFAULT_STREAM_RING_CHUNKS` untouched.\n4. **C must not hot-loop.** Terminal classification outcomes are terminal;\n retry is bounded/backoff-shaped for transient setup failures only —\n show the distinction in the test, not just the code.\n5. **Every new e2e that spawns a daemon tree enters the HEAVY nextest group\n AT BIRTH** (the HEAVY-AT-BIRTH ruling, doyle 2026-07-15; three identical\n strings: ci.yml Phase A +\n Phase B + nextest.toml).\n6. Standard gate hygiene: isolated worktree-of-sha + fresh\n `CARGO_TARGET_DIR`, nextest, workspace-wide clippy preflight,\n `traceable-reqs check` green.\n\n## Possible kin (NOT folded — verify, don't assume)\n\n- deployah zombie controlled-by latch (REQ-ENDPOINT-CYCLE-HONEST seed,\n daemon-lifecycle cluster): plausibly the same stale-stream fingerprint,\n but unproven. The seed stands in its own cluster unless W1 evidence\n shows the same root; do not widen this milestone on speculation.\n- stall-evict 15→17 baseline shift: likely same fingerprint; re-measure at\n field-verify, no dedicated work.\n\n## Explicitly out of scope\n\n- MESH-RECOVERY (sibling milestone candidate, separate contract; next in\n line).\n- Daemon-lifecycle cluster (endpoint-cycle-honest + comeback + massacre +\n orphan-listener).\n- Any change to attach-intent semantics, controller/viewer model, or the\n brain session-cursor resume path (0.30.5/6 fix stands)."}],"details":{"totalLines":139,"displayContent":{"text":"# REDISPATCH-TRUTH — milestone triage (JIT)\r\n\r\n> Doyle triage 2026-07-16, dispatched at the v0.33.0 boundary (ranked-first\r\n> from the hertz same-day RCA; displaces MESH-RECOVERY). Canonical RCA:\r\n> `.claude/reports/2026-07-16-redispatch-truth/hertz-refresh-rca.txt`\r\n> (hertz source-level, doyle seam-verified same day). Decision record:\r\n> ADR-0038. Lane: doyle triages → todlando builds → doyle gates → deployah\r\n> releases → hertz field-verify (they hold the incident logs).\r\n\r\n## Why (field: 4/5 endpoints frozen on one refresh, twice in one day)\r\n\r\n`spt daemon refresh` / `spt update` (same brain-cycle path, `applyhost.rs`)\r\nfreezes active remote `spt rc` sessions. The PTYs and broker-held QUIC\r\nstreams survive by construction — the freeze is a **production redispatch\r\nbug** in the fresh brain's stream reconstruction:\r\n\r\n1. **Stale replay steals live controllers.** The fresh\r\n `dispatch::run_dispatch_loop` starts with an EMPTY per-process `claimed`\r\n set (dispatch.rs:206) and its claim condition\r\n (`initiated_locally || next_seq == 0 || !claimed.insert`, dispatch.rs:214)\r\n has NO finished filter — while `NetShared.streams` has NO removal path\r\n (single insert nethost.rs ~649; `StreamLog::finish` (:245) only marks).\r\n So every dispatcher generation replays EVERY historical peer stream,\r\n including finished attach streams. A replayed historical Attach calls\r\n `attach_as(Control, same origin)` → same-identity silent\r\n `become_controller` (no `Displaced`) steals the CURRENT controller;\r\n the replayed EOF then `detach_session` CLEARS it. The live serve loop\r\n still believes it is Controller but its sink is deselected → operator\r\n sees a FROZEN PTY. Detach + fresh `spt rc` re-takes → explains the\r\n no-PTY-restart recovery.\r\n2. **Opener eviction permanently abandons an active stream.** Reconstruction\r\n classifies by `peek_first_line` (dispatch.rs:256) from ring seq 0, but\r\n `StreamLog` is a bounded 4096-transport-chunk ring\r\n (nethost.rs:111) — a high-traffic ACTIVE stream's Request record evicts\r\n → replay classifies Unknown/Failed; `claimed.insert` happens PRE-spawn\r\n and is never cleared/retried → that active stream is PERMANENTLY\r\n abandoned.\r\n\r\nField evidence (HFENDULEAM, hertz preserves\r\n`AppData/Local/spt-core/logs/daemon.stderr.log{,.1}`, brain generations\r\n2/3): 4/5 endpoints frozen across both 2026-07-16 doyle refreshes\r\n(deployah-recovery + the v0.33.0 apply) + lia on the update;\r\n`DISPATCH:N:Failed` lines with low/historical stream ids in fresh\r\ngenerations = the indiscriminate-replay supporting evidence.\r\n\r\nWhy CI never caught it: `attach_survives_target_brain_restart_exactly_once`\r\n(crates/spt-daemon/tests/attach.rs:779) manually re-serves a known short\r\nstream — it BYPASSES production rediscovery/classification and never rolls\r\nthe opener.\r\n\r\n**Distinct from the CLOSED 0.30.x resume-steal saga** (brain session-cursor\r\nresume, fixed cursor-only in 0.30.5/6). This is the NET DISPATCHER leg —\r\ndo not re-anchor the old theories.\r\n\r\n## Shape (hertz A–D, doyle-endorsed; ADR-0038)\r\n\r\nBroker stream-table rows gain explicit **lifecycle truth**, and the\r\ndispatcher redispatches only what is genuinely live:\r\n\r\n- **A — finished rows retire from redispatch eligibility.** A fresh\r\n dispatcher must never re-serve a terminal Attach request. Retain only the\r\n lifecycle state genuinely needed after EOF (presence/log reads); the\r\n redispatch enumeration must not see terminal rows.\r\n- **B — restart-durable opener/classification metadata.** Pin the\r\n per-stream immutable opener fact (or the complete first NDJSON record)\r\n OUTSIDE the evictable data ring, held until stream close. Recovery\r\n classifies from that metadata, never from ring seq 0.\r\n- **C — retryable claims.** Distinguish active/retryable vs served vs\r\n finished; a transient worker-setup failure requeues the claim; terminal\r\n outcomes do NOT hot-loop.\r\n- **D — three production-path regressions** (all through the REAL\r\n `run_dispatch_loop`, no manual re-serve):\r\n 1. finished historical Attach + current active Attach, same\r\n endpoint/origin; restart target brain only → historical stream neither\r\n takes nor clears the current controller; current input/output\r\n exactly-once without detach;\r\n 2. >4096 transport chunks on an active Attach (opener evicted); restart\r\n dispatcher → durable classification resumes the same operator stream;\r\n 3. one injected transient worker-start failure → claim retry recovers, no\r\n duplicate controller/output.\r\n\r\n## Waves\r\n\r\n### W1 — the fix cluster (single build wave; todlando)\r\n- **REQ-HAZARD-REDISPATCH-CONTROL-STEAL** — the invariant (KNOWN-HAZARDS\r\n 7.41) + regression D1.\r\n- **REQ-REDISPATCH-FINISHED-RETIRE** — mechanism A.\r\n- **REQ-STREAM-OPENER-DURABLE** — mechanism B + regression D2.\r\n- **REQ-DISPATCH-CLAIM-RETRY** — mechanism C + regression D3.\r\n\r\nThen: doyle gates → deployah releases → hertz field-verify on HFENDULEAM\r\n(daemon refresh with active remote `spt rc` sessions: no frozen PTYs, no\r\nhistorical `DISPATCH:N:Failed` replay storm in the fresh generation).\r\n\r\n## Gate rulings (pre-made, binding at gate)\r\n\r\n1. **Production-path only.** Every D regression exercises the real\r\n rediscovery path (`run_dispatch_loop` → peek/classify → serve). A test\r\n that manually re-serves a known stream does not count as evidence (the\r\n existing-e2e bypass is the lesson). The existing\r\n `attach_survives_target_brain_restart_exactly_once` stays as-is but is\r\n no longer the coverage for this class.\r\n2. **Successor re-take parity is binding.** The legitimate same-`by`\r\n successor re-subscribe after a brain restart (CONTEXT.md controller\r\n identity — silent re-take, `Displaced` only on genuine cross-operator\r\n Take) MUST keep working. The fix removes STALE-replay takeover, not the\r\n live reconstruction path. The discriminator is lifecycle (finished vs\r\n active), never origin identity.\r\n3. **B must not grow the evictable ring.** Opener metadata is a bounded\r\n per-stream side fact (one record), pinned until close; ring semantics\r\n and `DEFAULT_STREAM_RING_CHUNKS` untouched.\r\n4. **C must not hot-loop.** Terminal classification outcomes are terminal;\r\n retry is bounded/backoff-shaped for transient setup failures only —\r\n show the distinction in the test, not just the code.\r\n5. **Every new e2e that spawns a daemon tree enters the HEAVY nextest group\r\n AT BIRTH** (the HEAVY-AT-BIRTH ruling, doyle 2026-07-15; three identical\r\n strings: ci.yml Phase A +\r\n Phase B + nextest.toml).\r\n6. Standard gate hygiene: isolated worktree-of-sha + fresh\r\n `CARGO_TARGET_DIR`, nextest, workspace-wide clippy preflight,\r\n `traceable-reqs check` green.\r\n\r\n## Possible kin (NOT folded — verify, don't assume)\r\n\r\n- deployah zombie controlled-by latch (REQ-ENDPOINT-CYCLE-HONEST seed,\r\n daemon-lifecycle cluster): plausibly the same stale-stream fingerprint,\r\n but unproven. The seed stands in its own cluster unless W1 evidence\r\n shows the same root; do not widen this milestone on speculation.\r\n- stall-evict 15→17 baseline shift: likely same fingerprint; re-measure at\r\n field-verify, no dedicated work.\r\n\r\n## Explicitly out of scope\r\n\r\n- MESH-RECOVERY (sibling milestone candidate, separate contract; next in\r\n line).\r\n- Daemon-lifecycle cluster (endpoint-cycle-honest + comeback + massacre +\r\n orphan-listener).\r\n- Any change to attach-intent semantics, controller/viewer model, or the\r\n brain session-cursor resume path (0.30.5/6 fix stands).\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139]},"fileSize":7591,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\docs\\REDISPATCH-TRUTH-TRIAGE.md"}}},"isError":false,"timestamp":1789113830016}}
{"type":"message","id":"cacb837a","parentId":"0d32b047","timestamp":"2026-09-11T08:03:50.077Z","message":{"role":"toolResult","toolCallId":"call_AHu1MYF09IpTjJoWpULZdlzt|fc_07a38c9435caeae6016aa3b5e3935c87d2aba292d919b499b4","toolName":"read","content":[{"type":"text","text":"## Terminal wrapper\n\nThe multiplatform terminal wrapper is the backbone for hosting agent sessions. Supersedes the sister project's planned \"capsule\" (which leaned on psmux). Architecturally a **process supervisor** with an abstract session surface. **The session-surface *mechanism* is delivered in M3a (`crates/spt-term`); the supervisor *process* (term-daemon) is delivered in M3b (`crates/spt-daemon`, 2026-06-03).**\n\n**term-daemon** (process supervisor):\nA long-lived, one-per-machine daemon that owns the PTYs for all hosted sessions, multiplexes them (sessions addressable by name, tmux-style), and accepts attach/detach from frontends. A hosted agent session (a LiveAgent's Self, a ReadyAgent, etc.) runs *inside* a supervised PTY. **Headed** = a frontend is attached and rendering/driving the PTY; **headless** = the session runs with no frontend attached. The daemon's persistence is what lets a session keep running while unwatched and be re-attached \"on a whim.\" *(M3b ✅ — `spt-daemon` hosts many M3a `spt-term` surfaces behind a versioned local IPC, split into a stable **broker** (holds the PTYs/children/sockets) + a restartable **brain** (all logic) so a brain swap leaves hosted sessions gapless; `spt-term` its…\n\n**A view is independent from the endpoint** (invariant):\n\nAn spt-hosted endpoint runs in a **daemon-owned PTY, decoupled from whatever terminal launched it**. Closing the\ntab/window where the endpoint was brought up detaches only the `spt rc` attach pump — the endpoint keeps running under\nthe daemon and stays re-attachable via `spt rc `. A view is a transient frontend over a daemon-owned session, never\nthe session's lifeline. *Implementation:* the daemon must never live inside the launching terminal's process grouping —\non Windows the cold-started daemon is launched **job-neutral**: a job-neutral creator (**WMI `Win32_Process.Create`**,\nowned by WmiPrvSE — primary; a `schtasks` one-shot — fallback) starts it OUTSIDE any terminal Job Object from birth, so a\nterminal's `KILL_ON_JOB_CLOSE` job can never reap it (this is why Task-Scheduler-autostarted daemons never had the bug).\nA WMI/scheduler child does not inherit the launching shell's transient environment, so `SPT_*` (notably `SPT_HOME`) is\nforwarded explicitly. `CREATE_BREAKAWAY_FROM_JOB` is retained only as a fallback rung (a job *can* deny it). On Unix the\ndaemon's own session detachment (new session, no controlling terminal) already keeps the SIGHUP of a closing terminal off\nthe daemon's children. (The ConPTY/pseudoconsole isolation is correct on its own — the lifetime binding that leaks is the\nJob Object, not the console.)\n\n**session surface** (library abstraction):\nThe trait spt-core exposes over \"anything you can write input to and read output from\" — delivered in M3a as `spt_term::SessionSurface` (`write_input` + `resize`, with `send_keys`/`send_line` as first-class injection). Native PTY (`spt_term::PtySession`: ConPTY on Windows 10+, `forkpty(3)` on Unix, via the `portable-pty` crate) is the day-one implementation. The abstraction generalizes so future implementations — network-attached surfaces (for `spt-node` remote control), GUI text panes, etc. — are uniform to consumers. Pre-Windows-10 (winpty) is explicitly dropped. **OS-neutral by contract (Spike #4/#5):** the trait bakes in neither `forkpty`'s raw-ordered-pipe nor ConPTY's repaint-on-resize screen-buffer semantics; output is a plain byte stream (`spt_term::…\n\n**input injection**:\nTwo granularities, both first-class. `send-keys` — raw byte stream including escape sequences (e.g. `Ctrl-C`). `send-line` — cooked line-level input flushed on newline (the common case; matches how user input reaches an agent prompt). **PTY input is single-writer (v0.13.0 P0, KNOWN-HAZARDS 7.17):** broker-side, every write to a hosted session's PTY goes through ONE per-session input-writer thread — the sole caller of the blocking `write_input`, fed by a bounded FIFO. All callers (operator keystrokes, message injection, the inject-floor flush) ENQUEUE and return immediately, so a paste burst that fills the harness input buffer parks only that thread, never the broker dispatch thread. A genuinely wedged harness (queue full) DROPS excess input + stamps the perc…\n\n**scrollback**:\nIn-memory ring buffer per session for v1. **On-disk spillover for long sessions is an intended, tracked feature** (deferred past v1, not forgotten) — see `docs/DEFERRED.md`.\n\n**live activity buffer (session digest)**:\nA rolling, human-glanceable view of an endpoint's **recent context** — *what the agent did* (recent user turns + the agent output between them, with **tool-usage sprints collapsed**, e.g. ` used: **Write** `dir/file.txt` · **Bash** `first ~25 cmd chars` · […]`) **and** *what spt fed the agent* (**context-injection** entries — session-start psyche download, echo-commune mirror, incoming owl messages — collapsed by default, expandable). One time-ordered, glanceable timeline. **How much** is shown (window depth, arg-truncation, sprint-collapse) is the adapter's declared preference, consumer-overridable — *not* a fixed spt-core count. Distinct from both the **raw scrollback ring** (unparsed bytes) and full **transcript history** (the conversation be…\n\n- **Source = normalized session logs, never PTY parsing** (revised 2026-06-12, Gateway grill — supersedes the ADR-0008 source mechanism). A TUI's PTY stream is a *rendering protocol*, not a content log: scroll/resize trigger full repaints (duplicate content), and semantic turn boundaries drown in repaint soup. The split: **render surfaces read the PTY** (the R-TERM raw byte ring, unchanged); **content surfaces read the logs**. The digest reads the **same session logs as the echo-commune** but through its **own adapter-declared extractor** (the `[digest]` seam — see below), not echo's opaque normalizer: one source, two extractors (echo wants rich/opaque records; the digest wants the contract). Presentation knobs (window depth, sprint-collapse, arg truncation)…\n- **Topology-independent.** Because the source is logs, the digest works for harness-hosted endpoints too — Claude Code's per-session JSONL is Path A's worked example. Freshness = file-watch + adapter hook nudges; harnesses with no usable logs push entries directly via **`api digest-entry`** (the Path-B-style door). Near-realtime tailing needs an *incremental* normalize story (design-phase concern: Path A's normalize-command was shaped for occasional pulls).\n- **Thread-spanning across session boundaries.** A live agent's identity persists across many harness *sessions* (a `/clear` or `/compact` rotates the harness `session_id` — see `api boundary` / **post-spawn seam** — while the endpoint identity and `parent_pid` anchor hold). The digest follows the **agent thread**, not a single session: its rolling window may bridge a boundary (the tail of session N and the head of session N+1 coexist until the old turns age out), so a glance right after a `/clear` still shows the agent mid-thread rather than empty. A session boundary is itself **represented distinctively** in the digest (a visible boundary marker, e.g. a `/clear` divider), so a reader sees that context reset *there* without losing the thread. (Heir to the s…\n- **Two access modes.** **Snapshot pull** — `spt endpoint digest <[subnet:]id[@node]>` returns the current structured buffer (a Shell/CLI/GUI on-demand render; feeds the frontend's \"latest session output\" pane; a Gateway's agent-window). **Structured-delta stream** — a subscriber (live Shell pane, GUI, Gateway) receives only *changes* (new turn, new tool entry, collapse update), keyed to log records, for resource-efficient near-realtime reflection. **Access is address-gated** — fetch/subscribe is allowed for anyone who can address the endpoint (visible + resolvable per the resolution policy), the same gate as messaging. **Cross-node reach is pull-first** (ruled 2026-07-24): the snapshot pull (with `--after ` incremental polling — trustworthy precisely b…\n- **Turn sealing = idle-triggered** (ruled 2026-07-24, rebound grill; supersedes seal-on-next-input as the primary). A turn's records gain their stable `seq` when the turn **finishes**, and the authoritative finish signal is the endpoint's **idle transition** — the same adapter-reported signal the activity model already owns — not the arrival of the *next* user input (that arrival remains a harmless no-op fallback seal). A finished-but-idle turn is therefore never left `partial`/seq-less (the mint-then-idle deadlock: a scanner keyed on `seq` could not see the owner's latest turn until the owner was prompted again). Sealing is **idempotent and seq-stable**: it assigns `seq` to what the log holds at idle, and a late-flushing straggler record folds into the sea…\n- **\"Option (C)\" logging surface:** the digest may also be *persisted* (opt-in per-endpoint) as a coarse activity log appended to the native history store (Path B), on-boundary or periodic — off by default.\n- **Adapter-declared extraction (post-M9 milestone — reverses M9's \"no manifest seam\"):** M9 retired the PTY-parse engine and made the digest an on-demand projection over a published `{role,text,tool}` contract carried in `[history]`. That under-served real adapters: one normalizer cannot serve echo (opaque) and the digest (contract) at once, and a contract mismatch failed **silently**. So the digest gets its **own `[digest]` manifest seam** — an **imperative extractor** the adapter declares (its native log → the `{role, text, tool, ts}` contract; reads the same source files as `[history]` by default, own-source escape hatch), with **`api digest-entry`** as the always-available push fallback. **No declarative DSL** (anyone who could conform to a fixed format…\n- **Two-origin merge.** The digest interleaves two sources by `ts`: the adapter's **extracted log records** (agent activity) and spt's own **context-injection entries** (psyche download / echo mirror / owl message), which spt appends to the endpoint's `digest.log` (the existing Path-B sink — spt becomes an internal producer). The projection merges both newest-relevant within the window. **Deferred (no consumer yet):** the GUI collapse/expand of context-injection entries, the echo-commune-reads-the-digest delta loop, and the *autonomous file-watch freshness* nudge land with the milestones that own those surfaces; the data model (the `[digest]` seam, `ts`, the context-injection category, thread-spanning) lands now so the contract need not break again.\n\n_Avoid_: \"PTY digest\" (the superseded source mechanism); parsing agent content out of PTY bytes anywhere.\n\n…\n## Self-update\n\n\nSeamless, realtime self-updating is a day-one pillar. After a plugin performs the initial spt-core bootstrap, `spt.exe` self-updates from then on and **ripple-updates registered adapters** via each adapter's manifest update declaration. An adapter may include a `[update].message` — a plain human notice (markdown-rendered) that `spt adapter update` prints to stdout only when a new version is **actually applied** (never on a no-op). Useful for post-update operator actions, e.g. `\"Run \\`/reload-plugins\\` in any ongoing sessions.\"` for spt-claude-code.\n\n**release channel (private, gh-carried)** — the release channel is a **private** GitHub repo (`BigscreenVR/spt-bs-releases`, ADR-0036); the **gh CLI is the mandated carrier** for release discovery and asset download (each node authenticates via org membership). A node without an authed `gh` cannot fetch — refused loud with OS-specific install hints, never a silent hang. Signature verification is carrier-independent: bytes are verified after download exactly as before; counter, signing key, and update-set format are unchanged from the public-channel era. \n\n**docs bundle** — every release ships a platform-independent archive of the **built docs** (HTML + `llms.txt` + `llms-full.txt` + raw markdown + `manifest.schema.json`) as a **signed update-set asset**; apply lands it at `$SPT_HOME/docs`, so a node's docs always match its installed version. A docs-asset failure never fails the binary update (skip loud, retry next fetch). Consumed by the *docs server* (below). \n\n**docs server** — the daemon serves `$SPT_HOME/docs` over HTTP on **loopback only**, default `127.0.0.1:5474` (config/env-overridable). This is the **canonical docs surface** (supersedes the public Pages URL, ADR-0014→ADR-0036): agents and humans on the node read `http://localhost:5474`; `spt docs url` prints the resolved URL, bare `spt docs` opens the browser. The URL-path surface matches the retired Pages site verbatim (`/llms-full.txt`, append-`.md` raw markdown, `/manifest.schema.json`). Never LAN-exposed — a non-loopback bind would re-publish what privating hid. Under WEBSERVE (ADR-0056) the same paths are also reachable under the local node prefix; the bare paths stay as a compatibility alias. \n_Avoid_: public docs hosting; binding beyond loopback; docs drifting from the installed version.\n\n**update composite (`spt update`)** — the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update. `--core-only`/`-c` skips adapters; `spt update adapters [[,…]]` is the adapters leg alone (alias over `spt adapter update`). The composite's invoker always survives, because a routine apply cycles only the **brain** — the *restart-required* message on broker-side releases is a notice, not a restart. `spt update --restart` is the one-step **full cycle**: fetch → adapters → `apply --finish` last (the finish restarts the whole daemon, so it is the final act). **A REFUSAL IS NOT A FAILURE AND NEITHER IS A SUCCESS** (releases#153): every update surface answers with **`0` …\n\n**daemon refresh (`spt daemon refresh`)** — restart the **brain** in place, no binary swap, broker and every held PTY untouched: the routine-update handoff path minus the swap. The recovery verb for wedged brain-held state (broken endpoint bringup, a downed hosted agent) that previously required a full daemon bounce. \n\n**project index** — a node's endpoint→project attribution is DERIVED state, held as a **persistent materialized index** (ADR-0037): `spt-store` owns the versioned format + read path (daemon-offline reads = last persisted snapshot); the **daemon is the sole single-flight writer** (load-at-start, ready-without-warm, background batched reconcile, atomic replace, coalesced event-driven invalidation keyed on branch-tip fingerprints, last-known-good on failure). Readers — list, picker, endpoint-info, hooks — join index × perch roster and **never run git**; stale renders last-known or `-`, never a stall. Precedence (session-cwd → origin-cwd → context-recency) and rendered names are contract. **Since W3 the cutover is COMPLETE**: `endpoint list` (human + `--json`), …\n\n**index writer duty (daemon)** — the brain hosts ONE writer thread (`projwriter`, spawned beside the live host; single-flight by construction). Batched complexity is contract, `O(P+B+F+C)`: ONE branch enumeration per cycle (`for-each-ref` carries recency + tips), ≤1 tree scan per **changed** `p-*` branch (`ls-tree` at tip, membership cached by tip), ONE derivation per distinct normalized cwd (cache stamped on the repo-identity marker — `.git/config` / the `.git` gitfile — so **ordinary commits are a no-op by construction**); backgrounding the legacy 100+ process loop is REJECTED. Cold start: daemon ready + CLI fast before the background publish. Warm start: persisted index readable immediately; **unchanged generation performs no scan**. Any cycle failure kee…\n_Avoid_: synchronous git in any read path (the poisoned-git int rigs + the `gitrun` census exist to catch a regression — new list-shaped surfaces must join the index, never re-derive); readers falling back to enrichment; treating index presence as health; wall-clock CI gates (counters gate, wall-clock is manual acceptance); a writer-maintained generation counter (nothing maintains it — fingerprints only); mutating `p-*` branches outside the ContextStore funnels without a `projinval` nudge (the sync-pull seam nudges; the periodic reconcile is a backstop, not a license). \n\n**delivery** — peer-propagated over P2P, layered on self-fetch, with out-of-band still supported. One node learns of / obtains an update (marketplace drop *or* self-fetch from a release channel), gossips availability across the subnet, and peers pull the new binary over the networking layer — the subnet self-heals to latest. **All binaries are signature-verified before handoff regardless of source** (peer-propagation otherwise lets a compromised node poison the subnet). spt-core has its own release signing key, distinct from any OS-publisher code-signing (the Windows-publisher-trust question is separate).\n\n**handoff invariant** — **no endpoint process terminates or suspends during a self-update.** We cannot assume every endpoint can safely suspend. Satisfied by the broker/brain split: routine updates replace only the daemon brain, which rehydrates from disk state and re-attaches to the broker's held PTY/socket/child handles. Harness-hosted endpoints (topology 1) are safe by construction; spt-hosted endpoints (topology 2) are kept alive by the broker holding their PTY masters + child processes across the brain restart.\n\n**brain-trial promotion (readiness + drained)** — the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signals ready for its own generation **and** the OUTGOING generation's control plane has **drained** — the old brain's local (brain-owned) controller connection is closed or stall-evicted, never still holding blocked writes. A hard-killed prior generation leaves that connection **black-holed** (its hosted PTYs keep producing output the broker's writer blocks on, since a killed peer's pipe blocks rather than EOFs), and the drained signal is a *passive read* of broker truth — nothing in the isolated trial window would otherwise evict it. So **the boot/trial brain itself drives the evi…\n\n**resume re-attach is view-only for non-driven sessions** — on respawn the new brain queries the broker for every hosted session and re-attaches to rebuild output-continuity cursors, but it re-attaches as a **viewer**, never a controller, for any session it does not itself drive (which is *all* of them today — the supervised daemon brain hosts no PTY sessions; spt-hosted PTYs are driven by the operator's attach or the endpoint's own loop). Re-attaching as a controller would seize the controller slot of every free/local-controlled session — including the operator's local `spt rc` — and then, because the daemon brain never drains those PTYs, the broker would stall-evict that seized controller after the write deadline, leaving the session uncontrollable *and* h…\n\n**broker update frequency** — rare by design. Triggers: broker↔brain IPC contract change (versioned so a newer brain talks to an older broker — broker stays put as the brain updates), held-resource-type change, OS PTY/socket API change, or a broker bugfix. When the broker *must* update (the one case that can disturb held endpoints), it is a small well-scoped place that can use FD-passing or a rare planned endpoint-cycle — not the whole daemon.\n\n**debug rollout**:\nA deliberately non-production update distribution across a trusted lab subnet, used to test a local build on multiple nodes before a public release. It is still an update, not a raw peer file-copy: every recipient treats it as a signed, channel-scoped candidate that must pass the normal verification and consent gates; lab nodes pinned to the debug channel may explicitly opt into full-auto apply. Trust is node-local: debug rollout keys are installed through each lab node's release-key overlay, never embedded in the production trust anchor. A debug rollout may carry a platform artifact set assembled by one fast coordinator; each recipient applies only the artifact for its own platform. The rollout driver is maintainer/dev tooling that reuses SPT's update subst…\n_Avoid_: production release, peer proliferation, subnet binary copy\n\n**cadence/consent** — **not fully automatic by default; gated on user confirmation.** The update prompt is delivered via spt to the user's **most-recently-active live session** (v1 registry resolution — a precursor to PresenceChannel dispatch, implemented on the v1 registry, not the deferred channel) and offers an \"enable full-auto\" choice. Full-auto is the opt-in seamless path.\n\n\n[Some lines truncated to 768 chars]"}],"details":{"displayContent":{"text":"## Terminal wrapper\n\nThe multiplatform terminal wrapper is the backbone for hosting agent sessions. Supersedes the sister project's planned \"capsule\" (which leaned on psmux). Architecturally a **process supervisor** with an abstract session surface. **The session-surface *mechanism* is delivered in M3a (`crates/spt-term`); the supervisor *process* (term-daemon) is delivered in M3b (`crates/spt-daemon`, 2026-06-03).**\n\n**term-daemon** (process supervisor):\nA long-lived, one-per-machine daemon that owns the PTYs for all hosted sessions, multiplexes them (sessions addressable by name, tmux-style), and accepts attach/detach from frontends. A hosted agent session (a LiveAgent's Self, a ReadyAgent, etc.) runs *inside* a supervised PTY. **Headed** = a frontend is attached and rendering/driving the PTY; **headless** = the session runs with no frontend attached. The daemon's persistence is what lets a session keep running while unwatched and be re-attached \"on a whim.\" *(M3b ✅ — `spt-daemon` hosts many M3a `spt-term` surfaces behind a versioned local IPC, split into a stable **broker** (holds the PTYs/children/sockets) + a restartable **brain** (all logic) so a brain swap leaves hosted sessions gapless; `spt-term` its…\n\n**A view is independent from the endpoint** (invariant):\n\nAn spt-hosted endpoint runs in a **daemon-owned PTY, decoupled from whatever terminal launched it**. Closing the\ntab/window where the endpoint was brought up detaches only the `spt rc` attach pump — the endpoint keeps running under\nthe daemon and stays re-attachable via `spt rc `. A view is a transient frontend over a daemon-owned session, never\nthe session's lifeline. *Implementation:* the daemon must never live inside the launching terminal's process grouping —\non Windows the cold-started daemon is launched **job-neutral**: a job-neutral creator (**WMI `Win32_Process.Create`**,\nowned by WmiPrvSE — primary; a `schtasks` one-shot — fallback) starts it OUTSIDE any terminal Job Object from birth, so a\nterminal's `KILL_ON_JOB_CLOSE` job can never reap it (this is why Task-Scheduler-autostarted daemons never had the bug).\nA WMI/scheduler child does not inherit the launching shell's transient environment, so `SPT_*` (notably `SPT_HOME`) is\nforwarded explicitly. `CREATE_BREAKAWAY_FROM_JOB` is retained only as a fallback rung (a job *can* deny it). On Unix the\ndaemon's own session detachment (new session, no controlling terminal) already keeps the SIGHUP of a closing terminal off\nthe daemon's children. (The ConPTY/pseudoconsole isolation is correct on its own — the lifetime binding that leaks is the\nJob Object, not the console.)\n\n**session surface** (library abstraction):\nThe trait spt-core exposes over \"anything you can write input to and read output from\" — delivered in M3a as `spt_term::SessionSurface` (`write_input` + `resize`, with `send_keys`/`send_line` as first-class injection). Native PTY (`spt_term::PtySession`: ConPTY on Windows 10+, `forkpty(3)` on Unix, via the `portable-pty` crate) is the day-one implementation. The abstraction generalizes so future implementations — network-attached surfaces (for `spt-node` remote control), GUI text panes, etc. — are uniform to consumers. Pre-Windows-10 (winpty) is explicitly dropped. **OS-neutral by contract (Spike #4/#5):** the trait bakes in neither `forkpty`'s raw-ordered-pipe nor ConPTY's repaint-on-resize screen-buffer semantics; output is a plain byte stream (`spt_term::…\n\n**input injection**:\nTwo granularities, both first-class. `send-keys` — raw byte stream including escape sequences (e.g. `Ctrl-C`). `send-line` — cooked line-level input flushed on newline (the common case; matches how user input reaches an agent prompt). **PTY input is single-writer (v0.13.0 P0, KNOWN-HAZARDS 7.17):** broker-side, every write to a hosted session's PTY goes through ONE per-session input-writer thread — the sole caller of the blocking `write_input`, fed by a bounded FIFO. All callers (operator keystrokes, message injection, the inject-floor flush) ENQUEUE and return immediately, so a paste burst that fills the harness input buffer parks only that thread, never the broker dispatch thread. A genuinely wedged harness (queue full) DROPS excess input + stamps the perc…\n\n**scrollback**:\nIn-memory ring buffer per session for v1. **On-disk spillover for long sessions is an intended, tracked feature** (deferred past v1, not forgotten) — see `docs/DEFERRED.md`.\n\n**live activity buffer (session digest)**:\nA rolling, human-glanceable view of an endpoint's **recent context** — *what the agent did* (recent user turns + the agent output between them, with **tool-usage sprints collapsed**, e.g. ` used: **Write** `dir/file.txt` · **Bash** `first ~25 cmd chars` · […]`) **and** *what spt fed the agent* (**context-injection** entries — session-start psyche download, echo-commune mirror, incoming owl messages — collapsed by default, expandable). One time-ordered, glanceable timeline. **How much** is shown (window depth, arg-truncation, sprint-collapse) is the adapter's declared preference, consumer-overridable — *not* a fixed spt-core count. Distinct from both the **raw scrollback ring** (unparsed bytes) and full **transcript history** (the conversation be…\n\n- **Source = normalized session logs, never PTY parsing** (revised 2026-06-12, Gateway grill — supersedes the ADR-0008 source mechanism). A TUI's PTY stream is a *rendering protocol*, not a content log: scroll/resize trigger full repaints (duplicate content), and semantic turn boundaries drown in repaint soup. The split: **render surfaces read the PTY** (the R-TERM raw byte ring, unchanged); **content surfaces read the logs**. The digest reads the **same session logs as the echo-commune** but through its **own adapter-declared extractor** (the `[digest]` seam — see below), not echo's opaque normalizer: one source, two extractors (echo wants rich/opaque records; the digest wants the contract). Presentation knobs (window depth, sprint-collapse, arg truncation)…\n- **Topology-independent.** Because the source is logs, the digest works for harness-hosted endpoints too — Claude Code's per-session JSONL is Path A's worked example. Freshness = file-watch + adapter hook nudges; harnesses with no usable logs push entries directly via **`api digest-entry`** (the Path-B-style door). Near-realtime tailing needs an *incremental* normalize story (design-phase concern: Path A's normalize-command was shaped for occasional pulls).\n- **Thread-spanning across session boundaries.** A live agent's identity persists across many harness *sessions* (a `/clear` or `/compact` rotates the harness `session_id` — see `api boundary` / **post-spawn seam** — while the endpoint identity and `parent_pid` anchor hold). The digest follows the **agent thread**, not a single session: its rolling window may bridge a boundary (the tail of session N and the head of session N+1 coexist until the old turns age out), so a glance right after a `/clear` still shows the agent mid-thread rather than empty. A session boundary is itself **represented distinctively** in the digest (a visible boundary marker, e.g. a `/clear` divider), so a reader sees that context reset *there* without losing the thread. (Heir to the s…\n- **Two access modes.** **Snapshot pull** — `spt endpoint digest <[subnet:]id[@node]>` returns the current structured buffer (a Shell/CLI/GUI on-demand render; feeds the frontend's \"latest session output\" pane; a Gateway's agent-window). **Structured-delta stream** — a subscriber (live Shell pane, GUI, Gateway) receives only *changes* (new turn, new tool entry, collapse update), keyed to log records, for resource-efficient near-realtime reflection. **Access is address-gated** — fetch/subscribe is allowed for anyone who can address the endpoint (visible + resolvable per the resolution policy), the same gate as messaging. **Cross-node reach is pull-first** (ruled 2026-07-24): the snapshot pull (with `--after ` incremental polling — trustworthy precisely b…\n- **Turn sealing = idle-triggered** (ruled 2026-07-24, rebound grill; supersedes seal-on-next-input as the primary). A turn's records gain their stable `seq` when the turn **finishes**, and the authoritative finish signal is the endpoint's **idle transition** — the same adapter-reported signal the activity model already owns — not the arrival of the *next* user input (that arrival remains a harmless no-op fallback seal). A finished-but-idle turn is therefore never left `partial`/seq-less (the mint-then-idle deadlock: a scanner keyed on `seq` could not see the owner's latest turn until the owner was prompted again). Sealing is **idempotent and seq-stable**: it assigns `seq` to what the log holds at idle, and a late-flushing straggler record folds into the sea…\n- **\"Option (C)\" logging surface:** the digest may also be *persisted* (opt-in per-endpoint) as a coarse activity log appended to the native history store (Path B), on-boundary or periodic — off by default.\n- **Adapter-declared extraction (post-M9 milestone — reverses M9's \"no manifest seam\"):** M9 retired the PTY-parse engine and made the digest an on-demand projection over a published `{role,text,tool}` contract carried in `[history]`. That under-served real adapters: one normalizer cannot serve echo (opaque) and the digest (contract) at once, and a contract mismatch failed **silently**. So the digest gets its **own `[digest]` manifest seam** — an **imperative extractor** the adapter declares (its native log → the `{role, text, tool, ts}` contract; reads the same source files as `[history]` by default, own-source escape hatch), with **`api digest-entry`** as the always-available push fallback. **No declarative DSL** (anyone who could conform to a fixed format…\n- **Two-origin merge.** The digest interleaves two sources by `ts`: the adapter's **extracted log records** (agent activity) and spt's own **context-injection entries** (psyche download / echo mirror / owl message), which spt appends to the endpoint's `digest.log` (the existing Path-B sink — spt becomes an internal producer). The projection merges both newest-relevant within the window. **Deferred (no consumer yet):** the GUI collapse/expand of context-injection entries, the echo-commune-reads-the-digest delta loop, and the *autonomous file-watch freshness* nudge land with the milestones that own those surfaces; the data model (the `[digest]` seam, `ts`, the context-injection category, thread-spanning) lands now so the contract need not break again.\n\n_Avoid_: \"PTY digest\" (the superseded source mechanism); parsing agent content out of PTY bytes anywhere.\n\n…\n## Self-update\n\n\nSeamless, realtime self-updating is a day-one pillar. After a plugin performs the initial spt-core bootstrap, `spt.exe` self-updates from then on and **ripple-updates registered adapters** via each adapter's manifest update declaration. An adapter may include a `[update].message` — a plain human notice (markdown-rendered) that `spt adapter update` prints to stdout only when a new version is **actually applied** (never on a no-op). Useful for post-update operator actions, e.g. `\"Run \\`/reload-plugins\\` in any ongoing sessions.\"` for spt-claude-code.\n\n**release channel (private, gh-carried)** — the release channel is a **private** GitHub repo (`BigscreenVR/spt-bs-releases`, ADR-0036); the **gh CLI is the mandated carrier** for release discovery and asset download (each node authenticates via org membership). A node without an authed `gh` cannot fetch — refused loud with OS-specific install hints, never a silent hang. Signature verification is carrier-independent: bytes are verified after download exactly as before; counter, signing key, and update-set format are unchanged from the public-channel era. \n\n**docs bundle** — every release ships a platform-independent archive of the **built docs** (HTML + `llms.txt` + `llms-full.txt` + raw markdown + `manifest.schema.json`) as a **signed update-set asset**; apply lands it at `$SPT_HOME/docs`, so a node's docs always match its installed version. A docs-asset failure never fails the binary update (skip loud, retry next fetch). Consumed by the *docs server* (below). \n\n**docs server** — the daemon serves `$SPT_HOME/docs` over HTTP on **loopback only**, default `127.0.0.1:5474` (config/env-overridable). This is the **canonical docs surface** (supersedes the public Pages URL, ADR-0014→ADR-0036): agents and humans on the node read `http://localhost:5474`; `spt docs url` prints the resolved URL, bare `spt docs` opens the browser. The URL-path surface matches the retired Pages site verbatim (`/llms-full.txt`, append-`.md` raw markdown, `/manifest.schema.json`). Never LAN-exposed — a non-loopback bind would re-publish what privating hid. Under WEBSERVE (ADR-0056) the same paths are also reachable under the local node prefix; the bare paths stay as a compatibility alias. \n_Avoid_: public docs hosting; binding beyond loopback; docs drifting from the installed version.\n\n**update composite (`spt update`)** — the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update. `--core-only`/`-c` skips adapters; `spt update adapters [[,…]]` is the adapters leg alone (alias over `spt adapter update`). The composite's invoker always survives, because a routine apply cycles only the **brain** — the *restart-required* message on broker-side releases is a notice, not a restart. `spt update --restart` is the one-step **full cycle**: fetch → adapters → `apply --finish` last (the finish restarts the whole daemon, so it is the final act). **A REFUSAL IS NOT A FAILURE AND NEITHER IS A SUCCESS** (releases#153): every update surface answers with **`0` …\n\n**daemon refresh (`spt daemon refresh`)** — restart the **brain** in place, no binary swap, broker and every held PTY untouched: the routine-update handoff path minus the swap. The recovery verb for wedged brain-held state (broken endpoint bringup, a downed hosted agent) that previously required a full daemon bounce. \n\n**project index** — a node's endpoint→project attribution is DERIVED state, held as a **persistent materialized index** (ADR-0037): `spt-store` owns the versioned format + read path (daemon-offline reads = last persisted snapshot); the **daemon is the sole single-flight writer** (load-at-start, ready-without-warm, background batched reconcile, atomic replace, coalesced event-driven invalidation keyed on branch-tip fingerprints, last-known-good on failure). Readers — list, picker, endpoint-info, hooks — join index × perch roster and **never run git**; stale renders last-known or `-`, never a stall. Precedence (session-cwd → origin-cwd → context-recency) and rendered names are contract. **Since W3 the cutover is COMPLETE**: `endpoint list` (human + `--json`), …\n\n**index writer duty (daemon)** — the brain hosts ONE writer thread (`projwriter`, spawned beside the live host; single-flight by construction). Batched complexity is contract, `O(P+B+F+C)`: ONE branch enumeration per cycle (`for-each-ref` carries recency + tips), ≤1 tree scan per **changed** `p-*` branch (`ls-tree` at tip, membership cached by tip), ONE derivation per distinct normalized cwd (cache stamped on the repo-identity marker — `.git/config` / the `.git` gitfile — so **ordinary commits are a no-op by construction**); backgrounding the legacy 100+ process loop is REJECTED. Cold start: daemon ready + CLI fast before the background publish. Warm start: persisted index readable immediately; **unchanged generation performs no scan**. Any cycle failure kee…\n_Avoid_: synchronous git in any read path (the poisoned-git int rigs + the `gitrun` census exist to catch a regression — new list-shaped surfaces must join the index, never re-derive); readers falling back to enrichment; treating index presence as health; wall-clock CI gates (counters gate, wall-clock is manual acceptance); a writer-maintained generation counter (nothing maintains it — fingerprints only); mutating `p-*` branches outside the ContextStore funnels without a `projinval` nudge (the sync-pull seam nudges; the periodic reconcile is a backstop, not a license). \n\n**delivery** — peer-propagated over P2P, layered on self-fetch, with out-of-band still supported. One node learns of / obtains an update (marketplace drop *or* self-fetch from a release channel), gossips availability across the subnet, and peers pull the new binary over the networking layer — the subnet self-heals to latest. **All binaries are signature-verified before handoff regardless of source** (peer-propagation otherwise lets a compromised node poison the subnet). spt-core has its own release signing key, distinct from any OS-publisher code-signing (the Windows-publisher-trust question is separate).\n\n**handoff invariant** — **no endpoint process terminates or suspends during a self-update.** We cannot assume every endpoint can safely suspend. Satisfied by the broker/brain split: routine updates replace only the daemon brain, which rehydrates from disk state and re-attaches to the broker's held PTY/socket/child handles. Harness-hosted endpoints (topology 1) are safe by construction; spt-hosted endpoints (topology 2) are kept alive by the broker holding their PTY masters + child processes across the brain restart.\n\n**brain-trial promotion (readiness + drained)** — the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signals ready for its own generation **and** the OUTGOING generation's control plane has **drained** — the old brain's local (brain-owned) controller connection is closed or stall-evicted, never still holding blocked writes. A hard-killed prior generation leaves that connection **black-holed** (its hosted PTYs keep producing output the broker's writer blocks on, since a killed peer's pipe blocks rather than EOFs), and the drained signal is a *passive read* of broker truth — nothing in the isolated trial window would otherwise evict it. So **the boot/trial brain itself drives the evi…\n\n**resume re-attach is view-only for non-driven sessions** — on respawn the new brain queries the broker for every hosted session and re-attaches to rebuild output-continuity cursors, but it re-attaches as a **viewer**, never a controller, for any session it does not itself drive (which is *all* of them today — the supervised daemon brain hosts no PTY sessions; spt-hosted PTYs are driven by the operator's attach or the endpoint's own loop). Re-attaching as a controller would seize the controller slot of every free/local-controlled session — including the operator's local `spt rc` — and then, because the daemon brain never drains those PTYs, the broker would stall-evict that seized controller after the write deadline, leaving the session uncontrollable *and* h…\n\n**broker update frequency** — rare by design. Triggers: broker↔brain IPC contract change (versioned so a newer brain talks to an older broker — broker stays put as the brain updates), held-resource-type change, OS PTY/socket API change, or a broker bugfix. When the broker *must* update (the one case that can disturb held endpoints), it is a small well-scoped place that can use FD-passing or a rare planned endpoint-cycle — not the whole daemon.\n\n**debug rollout**:\nA deliberately non-production update distribution across a trusted lab subnet, used to test a local build on multiple nodes before a public release. It is still an update, not a raw peer file-copy: every recipient treats it as a signed, channel-scoped candidate that must pass the normal verification and consent gates; lab nodes pinned to the debug channel may explicitly opt into full-auto apply. Trust is node-local: debug rollout keys are installed through each lab node's release-key overlay, never embedded in the production trust anchor. A debug rollout may carry a platform artifact set assembled by one fast coordinator; each recipient applies only the artifact for its own platform. The rollout driver is maintainer/dev tooling that reuses SPT's update subst…\n_Avoid_: production release, peer proliferation, subnet binary copy\n\n**cadence/consent** — **not fully automatic by default; gated on user confirmation.** The update prompt is delivered via spt to the user's **most-recently-active live session** (v1 registry resolution — a precursor to PresenceChannel dispatch, implemented on the v1 registry, not the deferred channel) and offers an \"enable full-auto\" choice. Full-auto is the opt-in seamless path.\n","startLine":529,"lineNumbers":[529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,null,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712]},"fileSize":351501,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\CONTEXT.md"},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789113830077}}
{"type":"message","id":"4364cde1","parentId":"cacb837a","timestamp":"2026-09-11T08:03:50.101Z","message":{"role":"toolResult","toolCallId":"call_ZdCLM3I3lKyqh9T4aCcTVSL7|fc_07a38c9435caeae6016aa3b5e3935487d299393534e3a930ab","toolName":"grep","content":[{"type":"text","text":"# .worktrees/304-product/crates/spt-daemon/tests/\n## attach.rs\n 972| // the resulting authoritative screen still shows BOTH markers. The screen is the\n*973| // idempotent truth: a GAP from the restart/replay (a lost record) would leave a\n 974| // marker off the final screen. MARKER_ONE proves the pre-crash output survived\n 975| // the handoff + re-serve; MARKER_TWO proves the dead-window buffered input was\n 976| // delivered after life 2 took over. Rendering (vs a raw substring scan) is what\n## attach_idempotent_replay.rs\n*1|//! DAEMON-LIFECYCLE W1 fix 3 (REQ-ATTACH-IDEMPOTENT-REPLAY, ADR-0047 decision 3)\n 2|//! — the bug-4 rig, on a REAL broker + a REAL PTY child over the real IPC.\n 3|//!\n 4|//! ## The bug this gate locks down (hertz v0.39.4 field bug 4)\n...\n 9|//! processed the SAME conn / SAME identity / SAME generation subscribe twice,\n*10|//! 15 ms apart. ADR-0044's equal-generation rung classified that \"same lease,\n 11|//! silent re-take\" — correct — but re-take was `become_controller`, which\n 12|//! unconditionally DROPS the prior seat (its writer exits channel-closed) and\n 13|//! synthesizes a fresh initial batch. Designed for a dead seat after a\n...\n 45|//! The discriminating RED evidence is the unit matrix\n*46|//! (`broker::tests::equal_generation_same_conn_is_an_idempotent_replay`), which\n 47|//! asserts the seat's SINK IDENTITY and the unmoved `controller_epoch` and reds\n 48|//! immediately when the discriminator is removed — with the broker's own\n 49|//! breadcrumbs naming the mechanism: `controller-replaced ... new_conn=2` on\n...\n 237|\n*238|// [int->REQ-ATTACH-IDEMPOTENT-REPLAY]\n 239|#[test]\n 240|fn a_same_conn_equal_gen_replay_preserves_the_seat_and_replays_no_history() {\n 241| let _home = init_home();\n...\n 315| the discriminating RED lives in the broker unit matrix \\\n*316| (`equal_generation_same_conn_is_an_idempotent_replay`).\",\n 317| after_replay.len(),\n 318| String::from_utf8_lossy(&after_replay)\n 319| );\n## attach_resize_capture.rs\n 68|//! **Replay is ORDER, not pacing** (`capture-player` header). Pre-registered\n*69|//! with doyle: if the field mechanism is timing-dependent — the 15 ms-window\n 70|//! class — an order-only replay can pass without carrying the bug, so a pass\n 71|//! here is a reportable finding, not a clean bill.\n 72|//!\n## mesh_recovery.rs\n 613| // address for B, when its roster is the whole reason this test exists).\n*614| // This is the fact the #42/#49 relay RCA will read off a field log.\n 615| let legs = submits.lock().unwrap_or_else(|p| p.into_inner()).clone();\n 616| let for_b: Vec = legs\n 617| .iter()\n## notifsync.rs\n 11|//! - the **join holds over the wire**: a replayed feed is wholly `Unchanged`\n*12|//! (idempotent — replay/loss/reorder all reduce to \"apply again\");\n 13|//! - the framing survives **real QUIC chunking**: a record split across two\n 14|//! separate stream sends reassembles on B's decoder;\n 15|//! - the **gate is fail-closed under the handshake-proven origin**: an origin\n## wanmsg.rs\n 10|//! — and survives real QUIC chunking (a record split across two sends);\n*11|//! - **idempotency** (REQ-HAZARD-RESTART-IDEMPOTENT, wire-fed): a replayed\n 12|//! record (same wire `op_id`) is a no-op — including across a receiver brain\n 13|//! restart that resubscribes from a stale cursor and re-presents the whole\n 14|//! feed;"}],"details":{"scopePath":".worktrees/304-product/DAEMON-LIFECYCLE*, .worktrees/304-product/docs/*VERDICT*, .worktrees/304-product/crates/spt-daemon/tests, .worktrees/304-product/CHANGELOG.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":10,"fileCount":6,"files":[".worktrees/304-product/crates/spt-daemon/tests/attach.rs",".worktrees/304-product/crates/spt-daemon/tests/attach_idempotent_replay.rs",".worktrees/304-product/crates/spt-daemon/tests/attach_resize_capture.rs",".worktrees/304-product/crates/spt-daemon/tests/mesh_recovery.rs",".worktrees/304-product/crates/spt-daemon/tests/notifsync.rs",".worktrees/304-product/crates/spt-daemon/tests/wanmsg.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt-daemon/tests/attach.rs","count":1},{"path":".worktrees/304-product/crates/spt-daemon/tests/attach_idempotent_replay.rs","count":5},{"path":".worktrees/304-product/crates/spt-daemon/tests/attach_resize_capture.rs","count":1},{"path":".worktrees/304-product/crates/spt-daemon/tests/mesh_recovery.rs","count":1},{"path":".worktrees/304-product/crates/spt-daemon/tests/notifsync.rs","count":1},{"path":".worktrees/304-product/crates/spt-daemon/tests/wanmsg.rs","count":1}],"truncated":false,"displayContent":"# .worktrees/304-product/crates/spt-daemon/tests/\n## attach.rs\n 972│ // the resulting authoritative screen still shows BOTH markers. The screen is the\n*973│ // idempotent truth: a GAP from the restart/replay (a lost record) would leave a\n 974│ // marker off the final screen. MARKER_ONE proves the pre-crash output survived\n 975│ // the handoff + re-serve; MARKER_TWO proves the dead-window buffered input was\n 976│ // delivered after life 2 took over. Rendering (vs a raw substring scan) is what\n## attach_idempotent_replay.rs\n *1│//! DAEMON-LIFECYCLE W1 fix 3 (REQ-ATTACH-IDEMPOTENT-REPLAY, ADR-0047 decision 3)\n 2│//! — the bug-4 rig, on a REAL broker + a REAL PTY child over the real IPC.\n 3│//!\n 4│//! ## The bug this gate locks down (hertz v0.39.4 field bug 4)\n │...\n 9│//! processed the SAME conn / SAME identity / SAME generation subscribe twice,\n *10│//! 15 ms apart. ADR-0044's equal-generation rung classified that \"same lease,\n 11│//! silent re-take\" — correct — but re-take was `become_controller`, which\n 12│//! unconditionally DROPS the prior seat (its writer exits channel-closed) and\n 13│//! synthesizes a fresh initial batch. Designed for a dead seat after a\n │...\n 45│//! The discriminating RED evidence is the unit matrix\n *46│//! (`broker::tests::equal_generation_same_conn_is_an_idempotent_replay`), which\n 47│//! asserts the seat's SINK IDENTITY and the unmoved `controller_epoch` and reds\n 48│//! immediately when the discriminator is removed — with the broker's own\n 49│//! breadcrumbs naming the mechanism: `controller-replaced ... new_conn=2` on\n │...\n 237│\n*238│// [int->REQ-ATTACH-IDEMPOTENT-REPLAY]\n 239│#[test]\n 240│fn a_same_conn_equal_gen_replay_preserves_the_seat_and_replays_no_history() {\n 241│ let _home = init_home();\n │...\n 315│ the discriminating RED lives in the broker unit matrix \\\n*316│ (`equal_generation_same_conn_is_an_idempotent_replay`).\",\n 317│ after_replay.len(),\n 318│ String::from_utf8_lossy(&after_replay)\n 319│ );\n## attach_resize_capture.rs\n 68│//! **Replay is ORDER, not pacing** (`capture-player` header). Pre-registered\n*69│//! with doyle: if the field mechanism is timing-dependent — the 15 ms-window\n 70│//! class — an order-only replay can pass without carrying the bug, so a pass\n 71│//! here is a reportable finding, not a clean bill.\n 72│//!\n## mesh_recovery.rs\n 613│ // address for B, when its roster is the whole reason this test exists).\n*614│ // This is the fact the #42/#49 relay RCA will read off a field log.\n 615│ let legs = submits.lock().unwrap_or_else(|p| p.into_inner()).clone();\n 616│ let for_b: Vec = legs\n 617│ .iter()\n## notifsync.rs\n 11│//! - the **join holds over the wire**: a replayed feed is wholly `Unchanged`\n*12│//! (idempotent — replay/loss/reorder all reduce to \"apply again\");\n 13│//! - the framing survives **real QUIC chunking**: a record split across two\n 14│//! separate stream sends reassembles on B's decoder;\n 15│//! - the **gate is fail-closed under the handshake-proven origin**: an origin\n## wanmsg.rs\n 10│//! — and survives real QUIC chunking (a record split across two sends);\n*11│//! - **idempotency** (REQ-HAZARD-RESTART-IDEMPOTENT, wire-fed): a replayed\n 12│//! record (same wire `op_id`) is a no-op — including across a receiver brain\n 13│//! restart that resubscribes from a stale cursor and re-presents the whole\n 14│//! feed;"},"isError":false,"timestamp":1789113830100}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_NsFMixXGuwpdxnDexkCiSsek|fc_07a38c9435caeae6016aa3b5f470e087d29863023935cad6fb","toolName":"read","startedAt":"2026-09-11T08:04:06.904Z","args":{"path":".worktrees/304-product/crates/spt-daemon/tests/attach_idempotent_replay.rs:1-60,238-338"},"intent":"Reading idempotence coverage limitation"},"id":"3ff075bd","parentId":"4364cde1","timestamp":"2026-09-11T08:04:06.904Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_vVClGbURURCEpVXi6dEd2neE|fc_07a38c9435caeae6016aa3b5f470fc87d29491326277bf9c3d","toolName":"read","startedAt":"2026-09-11T08:04:06.904Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/attach.rs:449-550,582-646,674-739,815-852"},"intent":"Reading attach event handling"},"id":"372d4e58","parentId":"3ff075bd","timestamp":"2026-09-11T08:04:06.904Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_eLlZcTBhVnWhP4sVTOgY9WW4|fc_07a38c9435caeae6016aa3b5f4710887d28911c0c8e28fd553","toolName":"grep","startedAt":"2026-09-11T08:04:06.904Z","args":{"path":".worktrees/304-product/crates/spt/src/rc.rs:2600-3900"},"intent":"Locating active rc pump"},"id":"b1064ddf","parentId":"372d4e58","timestamp":"2026-09-11T08:04:06.904Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_IPhxjPPoVDUcjMhyGUOxxQfp|fc_07a38c9435caeae6016aa3b5f4711487d2aa3204e4671b5224","toolName":"grep","startedAt":"2026-09-11T08:04:06.904Z","args":{"path":".worktrees/304-product/crates/spt/src;.worktrees/304-product/crates/spt-daemon/src/brainproc.rs;.worktrees/304-product/crates/spt-daemon/src/brain.rs"},"intent":"Finding actual update cli files"},"id":"9a911743","parentId":"b1064ddf","timestamp":"2026-09-11T08:04:06.904Z"}
{"type":"message","id":"7ed2e90c","parentId":"9a911743","timestamp":"2026-09-11T08:04:06.905Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Focusing remaining reads**"},{"type":"toolCall","id":"call_NsFMixXGuwpdxnDexkCiSsek|fc_07a38c9435caeae6016aa3b5f470e087d29863023935cad6fb","name":"read","arguments":{"i":"Reading idempotence coverage limitation","path":".worktrees/304-product/crates/spt-daemon/tests/attach_idempotent_replay.rs:1-60,238-338"},"intent":"Reading idempotence coverage limitation"},{"type":"toolCall","id":"call_vVClGbURURCEpVXi6dEd2neE|fc_07a38c9435caeae6016aa3b5f470fc87d29491326277bf9c3d","name":"read","arguments":{"i":"Reading attach event handling","path":".worktrees/304-product/crates/spt-daemon/src/attach.rs:449-550,582-646,674-739,815-852"},"intent":"Reading attach event handling"},{"type":"toolCall","id":"call_eLlZcTBhVnWhP4sVTOgY9WW4|fc_07a38c9435caeae6016aa3b5f4710887d28911c0c8e28fd553","name":"grep","arguments":{"i":"Locating active rc pump","pattern":"fn pump|try_recv|read_event_until|Reconnect|RECONNECT|send_attach_input","path":".worktrees/304-product/crates/spt/src/rc.rs:2600-3900","case":true,"gitignore":true,"skip":null},"intent":"Locating active rc pump"},{"type":"toolCall","id":"call_IPhxjPPoVDUcjMhyGUOxxQfp|fc_07a38c9435caeae6016aa3b5f4711487d2aa3204e4671b5224","name":"grep","arguments":{"i":"Finding actual update cli files","pattern":"refresh_brain|apply_staged\\(|fn cmd_update|request_brain_restart","path":".worktrees/304-product/crates/spt/src;.worktrees/304-product/crates/spt-daemon/src/brainproc.rs;.worktrees/304-product/crates/spt-daemon/src/brain.rs","case":true,"gitignore":true,"skip":null},"intent":"Finding actual update cli files"},{"type":"toolCall","id":"call_K8yXnsTh8uoWO7DahjN1SFSZ|fc_07a38c9435caeae6016aa3b5f4712087d2966bbecab5ff5356","name":"read","arguments":{"i":"Reading restart exactly once coverage","path":".worktrees/304-product/crates/spt-daemon/tests/attach.rs:779-998"},"intent":"Reading restart exactly once coverage"},{"type":"toolCall","id":"call_UdzxXD5eOVaAuA77voq1WLnY|fc_07a38c9435caeae6016aa3b5f4712887d2a5532917bb89b7d4","name":"grep","arguments":{"i":"Locating dispatcher reconstruction","pattern":"pub fn run_dispatch_loop|fn first_line|serve_attach|claimed|claim_retry|peek_first","path":".worktrees/304-product/crates/spt-daemon/src/dispatch.rs","case":true,"gitignore":true,"skip":null},"intent":"Locating dispatcher reconstruction"},{"type":"toolCall","id":"call_6yo7FED7myYdGBIf5pVdcVqC|fc_07a38c9435caeae6016aa3b5f4713087d28fed2d706545e51a","name":"read","arguments":{"i":"Reading live apply and refresh implementation","path":".worktrees/304-product/crates/spt-daemon/src/applyhost.rs:303-374"},"intent":"Reading live apply and refresh implementation"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":16980,"output":461,"cacheRead":64896,"cacheWrite":0,"totalTokens":82337,"reasoningTokens":11,"cost":{"input":0.1698,"output":0.02305,"cacheRead":0.064896,"cacheWrite":0,"total":0.25774600000000003}},"stopReason":"toolUse","timestamp":1789113830146,"responseId":"resp_07a38c9435caeae6016aa3b5e40fb087d2ba920af722b5431e","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_07a38c9435caeae6016aa3b5e6573487d2a9db27a58b2c2567","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo7X0mQA6tVgD7yCnxBkrtl1sZCYordOhO46vpA-kpaWVlX0tY3ms14E9u2sS3YvnhruzvAfVnl5_elHaUfwTIX-jdMgCrdQCMOQzxu18N13yn2hsuC5K0GohuubS5MmRFUrrqY7br29ypp4OzywOdYejtVy-oZJkWEcjrzHihNiDYpzE19HJZmwaQhq25nX95BwXzT0t_feFp78bF4j15qg883q_fCb7SNzhMnT_nXen4o9ed0O-epEEniCFZfFyukVRNsZ5DqdHj9ujH7HoW6k-dbPxKO0LtWiAWMewizR2BNaIYfbWypLe2pQcy74X39IXhoLcUEGx1fizzJh8Y7wKcGLYPHO7mD53rJu62VDTzslcdbRbv_oXqe9hHhh6mPj9ghDPXt33t4AoX7Q_unKwFyKp7_QJAww1s_CizYGUKifsurgYaraVcarE02sBnLtToTZmwdF1wZrFvTtxCBgRjQSbUGOzcjDJiBE-X9dHX1Kr2XRHBTgB91Nw-kKhrNQsPzSFYoJW5PI9lZIM7crurKE-_HyZoUNcqtvpeSY6gn6e2kOFZBlBcXAwXDk81GVwW0zP-SkOCO2-O4gzsJT2RdzApEZE-Jw4Y19OBIUKixyq2UM6AUmXm8XwqCieJDZDlhSx0YnrNl1mnURuGPgW0tfjijuKMfzu6q9HtJCJXHmICSU98eD6Wn6eLYPzybbtrOoX3Tp4u7JUTNTamZXHyFPSQYIxPryR6NMBNY4oO42TZcNc_4odSxrlSz18tysr5COv-qjmFWL43nlInkSastpQitNc9YV7S4OWkCHQf2XPVd28S8eDuipZb0mmBgtQmlm3Exolt4Rz7P7-0nYnz-SF3Apn70QtA5NSJWCQYsTBJEoP5Kuvl2ez1MY63ovBl97jmPubRAQJKpZC7BzGu1REizatUyf4bBu0XnjFOAs_QfwfIycOpAkhWPIaVpMXzh9lgu7d5PatRCNijS0UkGnLCtixKPS5dfKGZMS8knVzEfZKz0KfZ34Eb4YYgR-uUEQ7V7ytOPRfyKD2C_gf7vYND4N1tZOm2_cwQpiLPPrFmViDSHp1UF7q_n02L8yOlnAI_RUmPHgQfCYh7W4qpd0u0B3Rxhofm6lh8vao8IhG0WC-ccuCRX6HtEJyDx89yVpy5FzyS0NuDI2E4V2mhquBKfUP6osUrlSPKogUG2CdQKNdNMNAdUPCoZ5FTy1FmJbGzj0kAhreVnyyP0mwiwCZFIbTGJAqTS_9XuJ5gh6iIP97JIlV9EmC_Yd5aGUBjTE3Q8ZjNvkncdwoI1NtyquKeOrJnOV2LanTsDo4FISl_oqqc-HoDmrz_jXT9Npw","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"summary":[{"type":"summary_text","text":"**Focusing remaining reads**"}],"metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f470e087d29863023935cad6fb","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading idempotence coverage limitation\",\"path\":\".worktrees/304-product/crates/spt-daemon/tests/attach_idempotent_replay.rs:1-60,238-338\"}","call_id":"call_NsFMixXGuwpdxnDexkCiSsek","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f470fc87d29491326277bf9c3d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading attach event handling\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/attach.rs:449-550,582-646,674-739,815-852\"}","call_id":"call_vVClGbURURCEpVXi6dEd2neE","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f4710887d28911c0c8e28fd553","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating active rc pump\",\"pattern\":\"fn pump|try_recv|read_event_until|Reconnect|RECONNECT|send_attach_input\",\"path\":\".worktrees/304-product/crates/spt/src/rc.rs:2600-3900\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_eLlZcTBhVnWhP4sVTOgY9WW4","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f4711487d2aa3204e4671b5224","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding actual update cli files\",\"pattern\":\"refresh_brain|apply_staged\\\\(|fn cmd_update|request_brain_restart\",\"path\":\".worktrees/304-product/crates/spt/src;.worktrees/304-product/crates/spt-daemon/src/brainproc.rs;.worktrees/304-product/crates/spt-daemon/src/brain.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_IPhxjPPoVDUcjMhyGUOxxQfp","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f4712087d2966bbecab5ff5356","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading restart exactly once coverage\",\"path\":\".worktrees/304-product/crates/spt-daemon/tests/attach.rs:779-998\"}","call_id":"call_K8yXnsTh8uoWO7DahjN1SFSZ","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f4712887d2a5532917bb89b7d4","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating dispatcher reconstruction\",\"pattern\":\"pub fn run_dispatch_loop|fn first_line|serve_attach|claimed|claim_retry|peek_first\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/dispatch.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_UdzxXD5eOVaAuA77voq1WLnY","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"grep","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}},{"id":"fc_07a38c9435caeae6016aa3b5f4713087d28fed2d706545e51a","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading live apply and refresh implementation\",\"path\":\".worktrees/304-product/crates/spt-daemon/src/applyhost.rs:303-374\"}","call_id":"call_6yo7FED7myYdGBIf5pVdcVqC","internal_chat_message_metadata_passthrough":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"},"name":"read","metadata":{"turn_id":"1bc06e33-20ee-4a7a-862f-f622c4b69c88"}}]},"duration":16756.17230000021,"ttft":2549.1105000004172,"completedAt":1789113846902,"contextSnapshot":{"promptTokens":81876,"nonMessageTokens":10264,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_K8yXnsTh8uoWO7DahjN1SFSZ|fc_07a38c9435caeae6016aa3b5f4712087d2966bbecab5ff5356","toolName":"read","startedAt":"2026-09-11T08:04:06.905Z","args":{"path":".worktrees/304-product/crates/spt-daemon/tests/attach.rs:779-998"},"intent":"Reading restart exactly once coverage"},"id":"efbb55b7","parentId":"7ed2e90c","timestamp":"2026-09-11T08:04:06.905Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_UdzxXD5eOVaAuA77voq1WLnY|fc_07a38c9435caeae6016aa3b5f4712887d2a5532917bb89b7d4","toolName":"grep","startedAt":"2026-09-11T08:04:06.905Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/dispatch.rs"},"intent":"Locating dispatcher reconstruction"},"id":"205489d4","parentId":"efbb55b7","timestamp":"2026-09-11T08:04:06.905Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_6yo7FED7myYdGBIf5pVdcVqC|fc_07a38c9435caeae6016aa3b5f4713087d28fed2d706545e51a","toolName":"read","startedAt":"2026-09-11T08:04:06.905Z","args":{"path":".worktrees/304-product/crates/spt-daemon/src/applyhost.rs:303-374"},"intent":"Reading live apply and refresh implementation"},"id":"47a497cc","parentId":"205489d4","timestamp":"2026-09-11T08:04:06.905Z"}
{"type":"message","id":"47750426","parentId":"47a497cc","timestamp":"2026-09-11T08:04:06.911Z","message":{"role":"toolResult","toolCallId":"call_UdzxXD5eOVaAuA77voq1WLnY|fc_07a38c9435caeae6016aa3b5f4712887d2a5532917bb89b7d4","toolName":"grep","content":[{"type":"text","text":" 46|//!\n*47|//! Each claimed stream gets its own worker thread with its **own** brain IPC\n 48|//! connection (the broker is multi-client by design; the probe-brain pattern\n 49|//! every E2E test uses). The peek and the serve use **separate** connections:\n 50|//! the peek brain subscribes from 0 to read the first line and is dropped;\n...\n 79|\n*80|use crate::attach::serve_attach;\n 81|use crate::brain::{Brain, BrokerEvent};\n 82|use crate::notifsync::{apply_notif_feed, NotifPolicy};\n 83|use crate::sealsync::{apply_seal_feed, SealApplyVerdict};\n...\n 323|\n*324|/// A claimed stream's dispatch lifecycle (ADR-0038 C,\n*325|/// REQ-DISPATCH-CLAIM-RETRY). The pre-fix `claimed` was a one-shot `HashSet`\n 326|/// insert performed BEFORE worker spawn and never cleared — one transient\n 327|/// worker-setup failure permanently abandoned the stream. Claims now\n 328|/// distinguish in-flight vs terminal vs retryable, and a transient failure\n...\n 450|\n*451|/// PURE claim decision: may this row be (re)claimed now? `Some(prior\n 452|/// failures)` = claim it; `None` = leave it (in flight, terminal, or backing\n 453|/// off). The unit-tested seam for the no-hot-loop ruling.\n 454|// [impl->REQ-DISPATCH-CLAIM-RETRY]\n...\n 656|/// stream).\n*657|pub fn run_dispatch_loop(\n 658| broker_name: &str,\n 659| paths: &DispatchPaths,\n 660| registry: Arc,\n...\n 693|/// inflating the count past the cells that really happened.\n*694|pub fn run_dispatch_loop_observed(\n 695| broker_name: &str,\n 696| paths: &DispatchPaths,\n 697| registry: Arc,\n...\n 921|/// (terminal); `Err` = transient (the claim requeues bounded).\n*922|fn first_line(\n 923| broker_name: &str,\n 924| stream_id: u64,\n 925| floor_seq: u64,\n...\n 951| }\n*952| peek_first_line(broker_name, stream_id, floor_seq)\n 953|}\n 954|\n 955|/// Peek the stream's first retained NDJSON line on a throwaway brain\n...\n 959|/// gap check.\n*960|fn peek_first_line(\n 961| broker_name: &str,\n 962| stream_id: u64,\n 963| floor_seq: u64,\n...\n 992|\n*993|/// One claimed stream's worker: peek → classify → run the family's serve\n 994|/// loop on a fresh brain connection.\n 995|/// The endpoint identity a stream's opener names, where the family carries\n 996|/// one (Amendment fix 9 — hertz's live catch on stream 7058 could not bind\n...\n 1174| // dispatcher-resolved session id on the cross-node leg (resolved HERE,\n*1175| // before serve_attach subscribes — never mid-serve, which would swallow\n 1176| // interleaved attach records) and `None` on the local path.\n 1177| let (endpoint, remote_session) = match line\n 1178| .get(\"endpoint_id\")\n...\n 1208| // [impl->REQ-STREAM-OPENER-DURABLE]\n*1209| Some(endpoint) => match serve_attach(\n 1210| &mut brain,\n 1211| broker_name,\n 1212| stream_id,\n...\n 1674|/// broker stream table's handshake-proven remote id — never from the\n*1675|/// record's `knocker_node_claimed`, which is inert diagnostics.\n 1676|/// 2. **The knocker endpoint is persisted as STAMPED.** The sending daemon\n 1677|/// asserted it at the `sender_proven` trust tier, and the receiving store\n 1678|/// keeps that value: an approval writes a whitelist entry for this id, so a\n...\n 1734|/// The gate runs BEFORE anything is created, on the handshake-proven origin\n*1735|/// from the broker's stream table — never on `requester_node_claimed`, which\n 1736|/// the record carries for the sender's diagnostics and which an authorization\n 1737|/// path must treat as inert. The gate's target is the SOURCE endpoint: its\n 1738|/// mind is the thing about to be copied, so its owner's grant is the one that\n...\n 2102|/// handshake, plus the sender-daemon-stamped `asker` at the `sender_proven`\n*2103|/// tier. `asker_node_claimed` is never consulted.\n 2104|///\n 2105|/// ## Nothing is written\n 2106|///\n...\n 2435|\n*2436| // And the untagged shape it must not resemble really would be claimed —\n 2437| // proving the tag is what does the work, not an accident of the fields.\n 2438| let untagged = json!({\"target\": \"ling\", \"op_id\": \"n:1\", \"from\": \"d\", \"body\": \"x\"});\n 2439| assert_eq!(classify_first_line(&untagged), StreamFamily::WanMsg);\n...\n 2442| // [unit->REQ-FORK-CONTROL-SURFACE] The tag is what keeps a fork request out\n*2443| // of the message family. An untagged record of this shape would be claimed\n 2444| // by the `WanMessage` arm and SPOOLED INTO SOMEBODY'S INBOX AS CHAT by a\n 2445| // receiver too old to know the verb — the failure this tag exists to\n 2446| // prevent, asserted rather than assumed.\n...\n 2614| // · variant in the enum, absent from ALL → its arm's index goes\n*2615| // unclaimed and some ALL entry lands at an index its own arm does\n 2616| // not name;\n 2617| // · ALL reordered or padded → the same equality breaks.\n 2618| // Order-coupled BY CHOICE: ALL's order is the order every family walk\n...\n 2629| // THE RESIDUAL THE TWO CHECKS BELOW CANNOT SEE, closed from the enum\n*2630| // side. Both the index loop above and the claimed/expected sets below\n 2631| // derive EVERY value they compare from `ALL` — so a variant that is in\n 2632| // the enum, carries a census arm claiming the TAIL index, and never\n 2633| // reached `ALL` leaves `ALL.len()` unchanged, every surviving entry\n*2634| // still matching its own arm, and `claimed == expected` still holding.\n 2635| // The variant is simply never visited. Iterating `StreamFamily` is the\n 2636| // independent side, and it is the only row here that fails on that\n 2637| // shape.\n...\n 2655|\n*2656| let claimed: std::collections::BTreeSet =\n 2657| StreamFamily::ALL.iter().map(|f| census_index(*f)).collect();\n 2658| let expected: std::collections::BTreeSet = (0..StreamFamily::ALL.len()).collect();\n 2659| assert_eq!(\n*2660| claimed, expected,\n 2661| \"the census has arms no ALL entry claims — a family is in the enum \\\n 2662| and missing from ALL, so every family walk skips it in silence\"\n 2663| );\n...\n 2876| // otherwise choose for us: the origin node is the HANDSHAKE-PROVEN one and\n*2877| // a forged `knocker_node_claimed` is inert; the knocker endpoint is\n 2878| // persisted exactly as the sending daemon stamped it (an approval writes a\n 2879| // whitelist entry for that id); and the flood bounds are applied against\n 2880| // THIS node's store — a bound the sender enforced would bind only the\n...\n 2890| let mut rec = KnockRecord::new(\"k-1\", \"doyle\", \"ling\", vec![\"MSG\".into()], false, false);\n*2891| rec.knocker_node_claimed = Some(\"a-node-i-do-not-control\".into());\n 2892|\n 2893| assert_eq!(record_inbound_knock(&rec, \"provenbeef\"), \"queued\");\n 2894|\n...\n 3243| let mut active = 0usize;\n*3244| let mut claimed = 0usize;\n 3245| for _row in 0..50 {\n 3246| if !pool_has_room(active) {\n 3247| break; // the loop's cold-table break\n...\n 3249| active += 1;\n*3250| claimed += 1;\n 3251| }\n 3252| assert_eq!(\n*3253| claimed, MAX_DISPATCH_WORKERS,\n 3254| \"a 50-row cold table claims exactly the pool bound in one poll\"\n 3255| );\n 3256| // A worker finishing frees a slot for the next tick."}],"details":{"scopePath":".worktrees/304-product/crates/spt-daemon/src/dispatch.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt-daemon\\src\\dispatch.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":28,"fileCount":1,"files":[".worktrees/304-product/crates/spt-daemon/src/dispatch.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt-daemon/src/dispatch.rs","count":28}],"truncated":false,"displayContent":" 46│//!\n *47│//! Each claimed stream gets its own worker thread with its **own** brain IPC\n 48│//! connection (the broker is multi-client by design; the probe-brain pattern\n 49│//! every E2E test uses). The peek and the serve use **separate** connections:\n 50│//! the peek brain subscribes from 0 to read the first line and is dropped;\n │...\n 79│\n *80│use crate::attach::serve_attach;\n 81│use crate::brain::{Brain, BrokerEvent};\n 82│use crate::notifsync::{apply_notif_feed, NotifPolicy};\n 83│use crate::sealsync::{apply_seal_feed, SealApplyVerdict};\n │...\n 323│\n *324│/// A claimed stream's dispatch lifecycle (ADR-0038 C,\n *325│/// REQ-DISPATCH-CLAIM-RETRY). The pre-fix `claimed` was a one-shot `HashSet`\n 326│/// insert performed BEFORE worker spawn and never cleared — one transient\n 327│/// worker-setup failure permanently abandoned the stream. Claims now\n 328│/// distinguish in-flight vs terminal vs retryable, and a transient failure\n │...\n 450│\n *451│/// PURE claim decision: may this row be (re)claimed now? `Some(prior\n 452│/// failures)` = claim it; `None` = leave it (in flight, terminal, or backing\n 453│/// off). The unit-tested seam for the no-hot-loop ruling.\n 454│// [impl->REQ-DISPATCH-CLAIM-RETRY]\n │...\n 656│/// stream).\n *657│pub fn run_dispatch_loop(\n 658│ broker_name: &str,\n 659│ paths: &DispatchPaths,\n 660│ registry: Arc,\n │...\n 693│/// inflating the count past the cells that really happened.\n *694│pub fn run_dispatch_loop_observed(\n 695│ broker_name: &str,\n 696│ paths: &DispatchPaths,\n 697│ registry: Arc,\n │...\n 921│/// (terminal); `Err` = transient (the claim requeues bounded).\n *922│fn first_line(\n 923│ broker_name: &str,\n 924│ stream_id: u64,\n 925│ floor_seq: u64,\n │...\n 951│ }\n *952│ peek_first_line(broker_name, stream_id, floor_seq)\n 953│}\n 954│\n 955│/// Peek the stream's first retained NDJSON line on a throwaway brain\n │...\n 959│/// gap check.\n *960│fn peek_first_line(\n 961│ broker_name: &str,\n 962│ stream_id: u64,\n 963│ floor_seq: u64,\n │...\n 992│\n *993│/// One claimed stream's worker: peek → classify → run the family's serve\n 994│/// loop on a fresh brain connection.\n 995│/// The endpoint identity a stream's opener names, where the family carries\n 996│/// one (Amendment fix 9 — hertz's live catch on stream 7058 could not bind\n │...\n 1174│ // dispatcher-resolved session id on the cross-node leg (resolved HERE,\n*1175│ // before serve_attach subscribes — never mid-serve, which would swallow\n 1176│ // interleaved attach records) and `None` on the local path.\n 1177│ let (endpoint, remote_session) = match line\n 1178│ .get(\"endpoint_id\")\n │...\n 1208│ // [impl->REQ-STREAM-OPENER-DURABLE]\n*1209│ Some(endpoint) => match serve_attach(\n 1210│ &mut brain,\n 1211│ broker_name,\n 1212│ stream_id,\n │...\n 1674│/// broker stream table's handshake-proven remote id — never from the\n*1675│/// record's `knocker_node_claimed`, which is inert diagnostics.\n 1676│/// 2. **The knocker endpoint is persisted as STAMPED.** The sending daemon\n 1677│/// asserted it at the `sender_proven` trust tier, and the receiving store\n 1678│/// keeps that value: an approval writes a whitelist entry for this id, so a\n │...\n 1734│/// The gate runs BEFORE anything is created, on the handshake-proven origin\n*1735│/// from the broker's stream table — never on `requester_node_claimed`, which\n 1736│/// the record carries for the sender's diagnostics and which an authorization\n 1737│/// path must treat as inert. The gate's target is the SOURCE endpoint: its\n 1738│/// mind is the thing about to be copied, so its owner's grant is the one that\n │...\n 2102│/// handshake, plus the sender-daemon-stamped `asker` at the `sender_proven`\n*2103│/// tier. `asker_node_claimed` is never consulted.\n 2104│///\n 2105│/// ## Nothing is written\n 2106│///\n │...\n 2435│\n*2436│ // And the untagged shape it must not resemble really would be claimed —\n 2437│ // proving the tag is what does the work, not an accident of the fields.\n 2438│ let untagged = json!({\"target\": \"ling\", \"op_id\": \"n:1\", \"from\": \"d\", \"body\": \"x\"});\n 2439│ assert_eq!(classify_first_line(&untagged), StreamFamily::WanMsg);\n │...\n 2442│ // [unit->REQ-FORK-CONTROL-SURFACE] The tag is what keeps a fork request out\n*2443│ // of the message family. An untagged record of this shape would be claimed\n 2444│ // by the `WanMessage` arm and SPOOLED INTO SOMEBODY'S INBOX AS CHAT by a\n 2445│ // receiver too old to know the verb — the failure this tag exists to\n 2446│ // prevent, asserted rather than assumed.\n │...\n 2614│ // · variant in the enum, absent from ALL → its arm's index goes\n*2615│ // unclaimed and some ALL entry lands at an index its own arm does\n 2616│ // not name;\n 2617│ // · ALL reordered or padded → the same equality breaks.\n 2618│ // Order-coupled BY CHOICE: ALL's order is the order every family walk\n │...\n 2629│ // THE RESIDUAL THE TWO CHECKS BELOW CANNOT SEE, closed from the enum\n*2630│ // side. Both the index loop above and the claimed/expected sets below\n 2631│ // derive EVERY value they compare from `ALL` — so a variant that is in\n 2632│ // the enum, carries a census arm claiming the TAIL index, and never\n 2633│ // reached `ALL` leaves `ALL.len()` unchanged, every surviving entry\n*2634│ // still matching its own arm, and `claimed == expected` still holding.\n 2635│ // The variant is simply never visited. Iterating `StreamFamily` is the\n 2636│ // independent side, and it is the only row here that fails on that\n 2637│ // shape.\n │...\n 2655│\n*2656│ let claimed: std::collections::BTreeSet =\n 2657│ StreamFamily::ALL.iter().map(|f| census_index(*f)).collect();\n 2658│ let expected: std::collections::BTreeSet = (0..StreamFamily::ALL.len()).collect();\n 2659│ assert_eq!(\n*2660│ claimed, expected,\n 2661│ \"the census has arms no ALL entry claims — a family is in the enum \\\n 2662│ and missing from ALL, so every family walk skips it in silence\"\n 2663│ );\n │...\n 2876│ // otherwise choose for us: the origin node is the HANDSHAKE-PROVEN one and\n*2877│ // a forged `knocker_node_claimed` is inert; the knocker endpoint is\n 2878│ // persisted exactly as the sending daemon stamped it (an approval writes a\n 2879│ // whitelist entry for that id); and the flood bounds are applied against\n 2880│ // THIS node's store — a bound the sender enforced would bind only the\n │...\n 2890│ let mut rec = KnockRecord::new(\"k-1\", \"doyle\", \"ling\", vec![\"MSG\".into()], false, false);\n*2891│ rec.knocker_node_claimed = Some(\"a-node-i-do-not-control\".into());\n 2892│\n 2893│ assert_eq!(record_inbound_knock(&rec, \"provenbeef\"), \"queued\");\n 2894│\n │...\n 3243│ let mut active = 0usize;\n*3244│ let mut claimed = 0usize;\n 3245│ for _row in 0..50 {\n 3246│ if !pool_has_room(active) {\n 3247│ break; // the loop's cold-table break\n │...\n 3249│ active += 1;\n*3250│ claimed += 1;\n 3251│ }\n 3252│ assert_eq!(\n*3253│ claimed, MAX_DISPATCH_WORKERS,\n 3254│ \"a 50-row cold table claims exactly the pool bound in one poll\"\n 3255│ );\n 3256│ // A worker finishing frees a slot for the next tick."},"isError":false,"timestamp":1789113846910}}
{"type":"message","id":"3581045d","parentId":"47750426","timestamp":"2026-09-11T08:04:06.913Z","message":{"role":"toolResult","toolCallId":"call_eLlZcTBhVnWhP4sVTOgY9WW4|fc_07a38c9435caeae6016aa3b5f4710887d28911c0c8e28fd553","toolName":"grep","content":[{"type":"text","text":" 2609| let severed_kind = match &end {\n*2610| Ok(e) if reconnect_class(e) == EndClass::Reconnect => match e {\n 2611| PumpEnd::BrokerGone => \"the daemon connection dropped\",\n 2612| _ => \"the connection was severed\",\n 2613| },\n...\n 2616|\n*2617| // Reconnect: full-screen centered banner (operator language — the internal\n 2618| // detail stays off the terminal per the Q4 UX rule), then re-drive\n 2619| // establish_attach inside the bounded window. A detach keypress mid-window\n 2620| // aborts the retry loop honestly. The banner repaints each iteration with a\n*2621| // live COUNTDOWN (REQ-RC-RECONNECT-TRUTH) so the operator sees rc is bounded\n*2622| // and working, never the old apparent freeze at a static \"Reconnecting…\".\n 2623| // establish_attach is CONNECT-ONLY: a down daemon yields DaemonDown here and\n 2624| // is retried (the operator may bring it back) WITHOUT any WMI resurrection.\n 2625| let target = remote_node.clone().unwrap_or_else(|| \"local daemon\".to_string());\n...\n 2639| &format!(\n*2640| \"RC_RECONNECT_ATTEMPT endpoint={endpoint_id} target={target} \\\n 2641| attempt={attempt} elapsed_ms={}\",\n 2642| elapsed.as_millis()\n 2643| ),\n...\n 2651| let mut detached = false;\n*2652| while let Ok(msg) = rx.try_recv() {\n 2653| if matches!(msg, StdinMsg::Detach) {\n 2654| detached = true;\n 2655| }\n...\n 2669| // operator to restart it, it does NOT auto-start one.\n*2670| Err(_) => std::thread::sleep(RECONNECT_PAUSE),\n 2671| }\n 2672| };\n 2673| match reestablished {\n...\n 2681| None => {\n*2682| // Give-up copy selection (REQ-RC-RECONNECT-TRUTH): a still-down local\n 2683| // daemon (only knowable for a LOCAL target) gets the loud \"session\n 2684| // lost — daemon down\" copy; anything else keeps the generic\n 2685| // didn't-reconnect copy. Remote severs never probe local daemon state.\n...\n 2687| remote_node.is_none() && !spt_daemon::daemon::is_running();\n*2688| return Ok(PumpEnd::ReconnectGaveUp {\n 2689| detail: severed_kind.to_string(),\n 2690| daemon_down,\n 2691| });\n...\n 2697|/// How long the B-3 reconnect loop keeps re-driving `establish_attach` after a\n*2698|/// severed viewport before the plain-language give-up (REQ-RC-RECONNECT).\n 2699|/// Generous: a daemon bounce (`spt daemon stop` + the next auto-start) and a\n 2700|/// node's broker restart both land well inside it.\n*2701|const RECONNECT_WINDOW: Duration = Duration::from_secs(30);\n 2702|/// The pause between reconnect attempts (each attempt already carries its own\n 2703|/// bounded setup deadlines — this just keeps the loop from hammering).\n*2704|const RECONNECT_PAUSE: Duration = Duration::from_secs(1);\n 2705|\n 2706|/// The give-up decision, pulled out so it unit-tests without a 30s wait.\n*2707|// [impl->REQ-RC-RECONNECT]\n 2708|fn reconnect_expired(elapsed: Duration) -> bool {\n*2709| elapsed >= RECONNECT_WINDOW\n 2710|}\n 2711|\n 2712|/// Seconds still left in the reconnect window, for the banner countdown\n*2713|/// (REQ-RC-RECONNECT-TRUTH). CEIL so the display reads a full `RECONNECT_WINDOW`s\n 2714|/// at the start and never flashes `0s` while the loop is still trying (0 only once\n 2715|/// the window is fully spent, where the caller has already broken to give-up).\n*2716|// [impl->REQ-RC-RECONNECT-TRUTH]\n 2717|fn reconnect_remaining_secs(elapsed: Duration) -> u64 {\n*2718| let left = RECONNECT_WINDOW.saturating_sub(elapsed);\n 2719| // ceil(left / 1s) via integer millis — 1..=WINDOW while any time remains, 0 at/past.\n 2720| (left.as_millis() as u64).div_ceil(1000)\n 2721|}\n...\n 2726| Final,\n*2727| Reconnect,\n 2728|}\n 2729|\n*2730|/// A severed transport is RECONNECTABLE: the broker-conn EOF class (broker\n 2731|/// bounce) and the serve-side EOF after rendered output (remote conn drop).\n 2732|/// Everything else — session exit, operator detach, displacement, the stall\n 2733|/// backstop, an attach refuse — is FINAL: re-driving those would re-attach to a\n 2734|/// session the operator (or the session itself) deliberately ended.\n*2735|// [impl->REQ-RC-RECONNECT]\n 2736|fn reconnect_class(end: &PumpEnd) -> EndClass {\n 2737| match end {\n*2738| PumpEnd::BrokerGone | PumpEnd::Severed => EndClass::Reconnect,\n 2739| PumpEnd::Exited(_)\n 2740| | PumpEnd::Detached\n 2741| | PumpEnd::Displaced(_)\n...\n 2743| | PumpEnd::NoLiveSession\n*2744| | PumpEnd::ReconnectGaveUp { .. } => EndClass::Final,\n 2745| }\n 2746|}\n 2747|\n...\n 2752|/// (#4, REQ-RC-CROSS-NODE-ATTACH).\n*2753|// [impl->REQ-RC-RECONNECT]\n 2754|fn serve_eof_end(rendered_any: bool) -> PumpEnd {\n 2755| if rendered_any {\n 2756| PumpEnd::Severed\n...\n 2765|/// operator language (Q4 UX rule) — the internal sever detail never paints here.\n*2766|// [impl->REQ-RC-RECONNECT]\n 2767|fn reconnect_banner_bytes(rows: u16, cols: u16, target: &str, remaining_secs: u64) -> Vec {\n*2768| // Visible countdown (REQ-RC-RECONNECT-TRUTH): the remaining-seconds suffix turns\n 2769| // the old static banner into a live \"rc is working, bounded\" signal — the operator\n 2770| // never mistakes a bounded retry for the historical freeze-forever.\n*2771| let text = format!(\"Reconnecting to {target}… {remaining_secs}s\");\n 2772| let row = (rows / 2).max(1);\n 2773| // Center on the CHARACTER count (the terminal cell count for this ASCII+…\n 2774| // line), clamped so an over-wide text still starts on-screen.\n...\n 2792| /// daemon-lifetime anchor and returns on the next `spt api` call, so this\n*2793| /// enters the B-3 reconnect loop (REQ-RC-RECONNECT) rather than exiting.\n 2794| BrokerGone,\n 2795| /// The serve side finished the stream AFTER rendering output — the remote\n 2796| /// conn dropped (node bounce, network cut), NOT an operator detach (that\n...\n 2799| /// \"detached — still running\"; it is the SEVERED case the reconnect loop\n*2800| /// re-drives. [impl->REQ-RC-RECONNECT]\n 2801| Severed,\n 2802| /// B-3 terminal state: the reconnect window expired without a successful\n 2803| /// re-attach. `detail` is the operator-language cause of the ORIGINAL sever\n 2804| /// (Q4 UX rule — never read-error lingo). `daemon_down` records whether the\n*2805| /// local daemon was still down at give-up (REQ-RC-RECONNECT-TRUTH) — it\n 2806| /// selects the loud \"session lost — daemon down\" copy over the generic\n*2807| /// didn't-reconnect copy. [impl->REQ-RC-RECONNECT] [impl->REQ-RC-RECONNECT-TRUTH]\n*2808| ReconnectGaveUp { detail: String, daemon_down: bool },\n 2809| /// The attach produced NO event whatsoever within the generous first-event\n 2810| /// backstop window (REQ-HAZARD-RC-ATTACH-FAILFAST path b): a healthy session —\n 2811| /// even one still painting / mid-init — replays its buffered output (or at\n...\n 2843|\n*2844|/// How the rc pump treats a `read_event_until` error (REQ-HAZARD-RC-EOF).\n 2845|#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 2846|enum ReadDisposition {\n 2847| /// Transient poll-slice timeout — loop and poll again.\n...\n 2855|\n*2856|/// Classify a `read_event_until` error kind. A poll-slice timeout retries; a\n 2857|/// severed-broker-stream EOF (the broker bounced — e.g. `spt daemon stop` —\n 2858|/// surfacing as `UnexpectedEof` \"failed to fill whole buffer\", or a\n 2859|/// reset/abort/broken-pipe in the same class) is RECOVERABLE and surfaces\n...\n 2873|\n*2874|/// The full-duplex pump: drain stdin → `send_attach_input`; render inbound\n 2875|/// `AttachRecord::Output` → stdout; end on `Exit`, EOF, or detach.\n 2876|#[allow(clippy::too_many_arguments)]\n*2877|fn pump(\n 2878| brain: &mut Brain,\n 2879| stream_id: u64,\n 2880| ops: &OpMinter,\n...\n 2970| loop {\n*2971| match rx.try_recv() {\n 2972| // A viewer owns only local detach, never input authority.\n 2973| // Keep this before ceremony handling as well as Input sends.\n 2974| // [impl->REQ-RCVIEW-1]\n...\n 3086| Ok(StdinMsg::Bytes(bytes)) => {\n*3087| send_attach_input(brain, stream_id, &bytes, ops.next())\n 3088| .map_err(|e| format!(\"send input: {e}\"))?;\n 3089| }\n 3090| Ok(StdinMsg::Detach) => return Ok(detach(brain, stream_id)),\n...\n 3099| // ── session → terminal ─────────────────────────────────────────────\n*3100| let ev = match brain.read_event_until(Some(Instant::now() + POLL_SLICE)) {\n 3101| Ok(ev) => ev,\n 3102| Err(e) => match classify_read_err(e.kind()) {\n 3103| // A poll-slice timeout: no event this slice. Before looping, the"}],"details":{"scopePath":".worktrees/304-product/crates/spt/src/rc.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\304-product\\crates\\spt\\src\\rc.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":38,"fileCount":1,"files":[".worktrees/304-product/crates/spt/src/rc.rs"],"fileMatches":[{"path":".worktrees/304-product/crates/spt/src/rc.rs","count":38}],"truncated":false,"displayContent":" 2609│ let severed_kind = match &end {\n*2610│ Ok(e) if reconnect_class(e) == EndClass::Reconnect => match e {\n 2611│ PumpEnd::BrokerGone => \"the daemon connection dropped\",\n 2612│ _ => \"the connection was severed\",\n 2613│ },\n │...\n 2616│\n*2617│ // Reconnect: full-screen centered banner (operator language — the internal\n 2618│ // detail stays off the terminal per the Q4 UX rule), then re-drive\n 2619│ // establish_attach inside the bounded window. A detach keypress mid-window\n 2620│ // aborts the retry loop honestly. The banner repaints each iteration with a\n*2621│ // live COUNTDOWN (REQ-RC-RECONNECT-TRUTH) so the operator sees rc is bounded\n*2622│ // and working, never the old apparent freeze at a static \"Reconnecting…\".\n 2623│ // establish_attach is CONNECT-ONLY: a down daemon yields DaemonDown here and\n 2624│ // is retried (the operator may bring it back) WITHOUT any WMI resurrection.\n 2625│ let target = remote_node.clone().unwrap_or_else(|| \"local daemon\".to_string());\n │...\n 2639│ &format!(\n*2640│ \"RC_RECONNECT_ATTEMPT endpoint={endpoint_id} target={target} \\\n 2641│ attempt={attempt} elapsed_ms={}\",\n 2642│ elapsed.as_millis()\n 2643│ ),\n │...\n 2651│ let mut detached = false;\n*2652│ while let Ok(msg) = rx.try_recv() {\n 2653│ if matches!(msg, StdinMsg::Detach) {\n 2654│ detached = true;\n 2655│ }\n │...\n 2669│ // operator to restart it, it does NOT auto-start one.\n*2670│ Err(_) => std::thread::sleep(RECONNECT_PAUSE),\n 2671│ }\n 2672│ };\n 2673│ match reestablished {\n │...\n 2681│ None => {\n*2682│ // Give-up copy selection (REQ-RC-RECONNECT-TRUTH): a still-down local\n 2683│ // daemon (only knowable for a LOCAL target) gets the loud \"session\n 2684│ // lost — daemon down\" copy; anything else keeps the generic\n 2685│ // didn't-reconnect copy. Remote severs never probe local daemon state.\n │...\n 2687│ remote_node.is_none() && !spt_daemon::daemon::is_running();\n*2688│ return Ok(PumpEnd::ReconnectGaveUp {\n 2689│ detail: severed_kind.to_string(),\n 2690│ daemon_down,\n 2691│ });\n │...\n 2697│/// How long the B-3 reconnect loop keeps re-driving `establish_attach` after a\n*2698│/// severed viewport before the plain-language give-up (REQ-RC-RECONNECT).\n 2699│/// Generous: a daemon bounce (`spt daemon stop` + the next auto-start) and a\n 2700│/// node's broker restart both land well inside it.\n*2701│const RECONNECT_WINDOW: Duration = Duration::from_secs(30);\n 2702│/// The pause between reconnect attempts (each attempt already carries its own\n 2703│/// bounded setup deadlines — this just keeps the loop from hammering).\n*2704│const RECONNECT_PAUSE: Duration = Duration::from_secs(1);\n 2705│\n 2706│/// The give-up decision, pulled out so it unit-tests without a 30s wait.\n*2707│// [impl->REQ-RC-RECONNECT]\n 2708│fn reconnect_expired(elapsed: Duration) -> bool {\n*2709│ elapsed >= RECONNECT_WINDOW\n 2710│}\n 2711│\n 2712│/// Seconds still left in the reconnect window, for the banner countdown\n*2713│/// (REQ-RC-RECONNECT-TRUTH). CEIL so the display reads a full `RECONNECT_WINDOW`s\n 2714│/// at the start and never flashes `0s` while the loop is still trying (0 only once\n 2715│/// the window is fully spent, where the caller has already broken to give-up).\n*2716│// [impl->REQ-RC-RECONNECT-TRUTH]\n 2717│fn reconnect_remaining_secs(elapsed: Duration) -> u64 {\n*2718│ let left = RECONNECT_WINDOW.saturating_sub(elapsed);\n 2719│ // ceil(left / 1s) via integer millis — 1..=WINDOW while any time remains, 0 at/past.\n 2720│ (left.as_millis() as u64).div_ceil(1000)\n 2721│}\n │...\n 2726│ Final,\n*2727│ Reconnect,\n 2728│}\n 2729│\n*2730│/// A severed transport is RECONNECTABLE: the broker-conn EOF class (broker\n 2731│/// bounce) and the serve-side EOF after rendered output (remote conn drop).\n 2732│/// Everything else — session exit, operator detach, displacement, the stall\n 2733│/// backstop, an attach refuse — is FINAL: re-driving those would re-attach to a\n 2734│/// session the operator (or the session itself) deliberately ended.\n*2735│// [impl->REQ-RC-RECONNECT]\n 2736│fn reconnect_class(end: &PumpEnd) -> EndClass {\n 2737│ match end {\n*2738│ PumpEnd::BrokerGone | PumpEnd::Severed => EndClass::Reconnect,\n 2739│ PumpEnd::Exited(_)\n 2740│ | PumpEnd::Detached\n 2741│ | PumpEnd::Displaced(_)\n │...\n 2743│ | PumpEnd::NoLiveSession\n*2744│ | PumpEnd::ReconnectGaveUp { .. } => EndClass::Final,\n 2745│ }\n 2746│}\n 2747│\n │...\n 2752│/// (#4, REQ-RC-CROSS-NODE-ATTACH).\n*2753│// [impl->REQ-RC-RECONNECT]\n 2754│fn serve_eof_end(rendered_any: bool) -> PumpEnd {\n 2755│ if rendered_any {\n 2756│ PumpEnd::Severed\n │...\n 2765│/// operator language (Q4 UX rule) — the internal sever detail never paints here.\n*2766│// [impl->REQ-RC-RECONNECT]\n 2767│fn reconnect_banner_bytes(rows: u16, cols: u16, target: &str, remaining_secs: u64) -> Vec {\n*2768│ // Visible countdown (REQ-RC-RECONNECT-TRUTH): the remaining-seconds suffix turns\n 2769│ // the old static banner into a live \"rc is working, bounded\" signal — the operator\n 2770│ // never mistakes a bounded retry for the historical freeze-forever.\n*2771│ let text = format!(\"Reconnecting to {target}… {remaining_secs}s\");\n 2772│ let row = (rows / 2).max(1);\n 2773│ // Center on the CHARACTER count (the terminal cell count for this ASCII+…\n 2774│ // line), clamped so an over-wide text still starts on-screen.\n │...\n 2792│ /// daemon-lifetime anchor and returns on the next `spt api` call, so this\n*2793│ /// enters the B-3 reconnect loop (REQ-RC-RECONNECT) rather than exiting.\n 2794│ BrokerGone,\n 2795│ /// The serve side finished the stream AFTER rendering output — the remote\n 2796│ /// conn dropped (node bounce, network cut), NOT an operator detach (that\n │...\n 2799│ /// \"detached — still running\"; it is the SEVERED case the reconnect loop\n*2800│ /// re-drives. [impl->REQ-RC-RECONNECT]\n 2801│ Severed,\n 2802│ /// B-3 terminal state: the reconnect window expired without a successful\n 2803│ /// re-attach. `detail` is the operator-language cause of the ORIGINAL sever\n 2804│ /// (Q4 UX rule — never read-error lingo). `daemon_down` records whether the\n*2805│ /// local daemon was still down at give-up (REQ-RC-RECONNECT-TRUTH) — it\n 2806│ /// selects the loud \"session lost — daemon down\" copy over the generic\n*2807│ /// didn't-reconnect copy. [impl->REQ-RC-RECONNECT] [impl->REQ-RC-RECONNECT-TRUTH]\n*2808│ ReconnectGaveUp { detail: String, daemon_down: bool },\n 2809│ /// The attach produced NO event whatsoever within the generous first-event\n 2810│ /// backstop window (REQ-HAZARD-RC-ATTACH-FAILFAST path b): a healthy session —\n 2811│ /// even one still painting / mid-init — replays its buffered output (or at\n │...\n 2843│\n*2844│/// How the rc pump treats a `read_event_until` error (REQ-HAZARD-RC-EOF).\n 2845│#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 2846│enum ReadDisposition {\n 2847│ /// Transient poll-slice timeout — loop and poll again.\n │...\n 2855│\n*2856│/// Classify a `read_event_until` error kind. A poll-slice timeout retries; a\n 2857│/// severed-broker-stream EOF (the broker bounced — e.g. `spt daemon stop` —\n 2858│/// surfacing as `UnexpectedEof` \"failed to fill whole buffer\", or a\n 2859│/// reset/abort/broken-pipe in the same class) is RECOVERABLE and surfaces\n │...\n 2873│\n*2874│/// The full-duplex pump: drain stdin → `send_attach_input`; render inbound\n 2875│/// `AttachRecord::Output` → stdout; end on `Exit`, EOF, or detach.\n 2876│#[allow(clippy::too_many_arguments)]\n*2877│fn pump(\n 2878│ brain: &mut Brain,\n 2879│ stream_id: u64,\n 2880│ ops: &OpMinter,\n │...\n 2970│ loop {\n*2971│ match rx.try_recv() {\n 2972│ // A viewer owns only local detach, never input authority.\n 2973│ // Keep this before ceremony handling as well as Input sends.\n 2974│ // [impl->REQ-RCVIEW-1]\n │...\n 3086│ Ok(StdinMsg::Bytes(bytes)) => {\n*3087│ send_attach_input(brain, stream_id, &bytes, ops.next())\n 3088│ .map_err(|e| format!(\"send input: {e}\"))?;\n 3089│ }\n 3090│ Ok(StdinMsg::Detach) => return Ok(detach(brain, stream_id)),\n │...\n 3099│ // ── session → terminal ─────────────────────────────────────────────\n*3100│ let ev = match brain.read_event_until(Some(Instant::now() + POLL_SLICE)) {\n 3101│ Ok(ev) => ev,\n 3102│ Err(e) => match classify_read_err(e.kind()) {\n 3103│ // A poll-slice timeout: no event this slice. Before looping, the"},"isError":false,"timestamp":1789113846913}}
{"type":"message","id":"48d0b60c","parentId":"3581045d","timestamp":"2026-09-11T08:04:06.920Z","message":{"role":"toolResult","toolCallId":"call_IPhxjPPoVDUcjMhyGUOxxQfp|fc_07a38c9435caeae6016aa3b5f4711487d2aa3204e4671b5224","toolName":"grep","content":[{"type":"text","text":"# .worktrees/304-product/crates/\n\n## spt/src/\n### cli.rs\n 8164| }\n*8165| match spt_daemon::refresh_brain(&spt_daemon::broker_socket_name()) {\n 8166| Ok(true) => {\n 8167| println!(\n 8168| \"Daemon coordinator restarted in place — hosted sessions and connections were \\\n...\n 9391|// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n*9392|fn cmd_update_apply(finish: bool) -> i32 {\n 9393| let exe = match std::env::current_exe() {\n 9394| Ok(p) => p,\n 9395| Err(e) => {\n...\n 9430| let outcome = if spt_daemon::is_running() {\n*9431| spt_daemon::apply_staged(&cache, &keys, &exe, &spt_daemon::broker_socket_name())\n 9432| } else {\n 9433| spt_daemon::apply_staged_daemonless(&cache, &keys, &exe)\n 9434| };\n...\n 9518|// [impl->REQ-UPDATE-RESTART-SAFE-SWAP]\n*9519|fn cmd_update_composite(core_only: bool, restart: bool) -> i32 {\n 9520| let mut worst = 0;\n 9521| for leg in plan_update_legs(core_only, restart) {\n 9522| let code = match leg {\n...\n 9704|// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n*9705|fn cmd_update_apply_finish(\n 9706| cache: &spt_daemon::ReleaseCache,\n 9707| keys: &std::path::Path,\n 9708| exe: &std::path::Path,\n...\n 10823|\n*10824|fn cmd_update_fetch(channel: Option, tag: Option, apply: bool) -> i32 {\n 10825| let repo = install_repo();\n 10826|\n 10827| // The gh CLI is the mandated carrier (ADR-0036 §3): the channel is private,\n\n## spt-daemon/src/\n### brain.rs\n 2236| // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*2237| pub fn request_brain_restart(&mut self) -> io::Result