{
  "summary": "No located contract sets a numeric 10-second deadline for first cross-node Sync stream visibility. There IS an explicit seconds-not-~1-minute cold-start convergence requirement (REQ-CONV-1/M8 acceptance 6); this is not an eventual-only contract. Periodic mind propagation, presence-probe ceilings, bounded reconcile turns, and update-watcher budgets have separate scopes.",
  "files": [
    {
      "path": "traceable-reqs.toml:1288-1290",
      "description": "Candidate REQ-CONV-1 exact timing promise, acceptance-6 delegation, and ADR-0039 mechanism amendment."
    },
    {
      "path": "M8-PLAN.md:138-154,184-189",
      "description": "Cold-start convergence target and acceptance 6 observable: status --nodes, not raw Sync stream visibility."
    },
    {
      "path": "M8-ACCEPTANCE.md:82-104,129-135",
      "description": "Explicit separation of regression/tooling evidence from real-rig convergence timing."
    },
    {
      "path": "M8-ACCEPTANCE-STEPS.md:254-278",
      "description": "Recorded historical first-poll acceptance and explicit timing criterion."
    },
    {
      "path": "PRD.md:104-116,200-207",
      "description": "Context sync scope, catch-up-on-activation, eventual-consistency model; no numeric first-stream timing."
    },
    {
      "path": "CONTEXT.md:615-646",
      "description": "Presence probe's 10-second ceiling versus separate context-sync semantics."
    },
    {
      "path": "docs/adr/0013-psyche-reconciled-context-merge.md:35-72",
      "description": "Bounded reconciliation, durable failure artifacts, and git-bundle transport without first-stream numeric deadline."
    },
    {
      "path": "docs/STORAGE.md:198",
      "description": "Explicit periodic anti-entropy latency envelope, 60-second sync cadence, backoff, and first-tick-on-restart promise."
    },
    {
      "path": "docs/KNOWN-HAZARDS.md:229-233",
      "description": "General subprocess timeout requirement referenced by ADR-0013, not a stream SLA."
    },
    {
      "path": "docs/DEBUG-CONVERGE-PLAN.md:23-24,42-49,73-74",
      "description": "120-second update-deployment watcher budget, not first-sync guarantee."
    },
    {
      "path": "docs/adr/0039-peer-route-resolution-truth.md:33-36,149-152",
      "description": "Amends route retention mechanism, does not revoke cold-start timing."
    }
  ],
  "architecture": "Cold-start peer/registry convergence is judged through peer and endpoint status visibility. Context sync is a pull-based git-bundle protocol with periodic anti-entropy and separate reconciliation. A first visible transport stream is an intermediate observation, not proof of full convergence; unrelated per-operation timeouts do not define that intermediate observation's deadline.",
  "report": "## Provenance\nFinal candidate citations refer to files read under `.worktrees/hertz-294-sync-stages/`. Main supplied verified provenance: its ed8ecd94 equals a9e786b2 plus only five daemon diagnostic source changes; docs and registry are unchanged. I did not independently inspect Git objects. Paths/line numbers below are candidate-worktree-relative (not root registry, whose lines differ). No edits, builds, tests, validation commands, or filings were performed.\n\n## 1. Binding broader timing: not eventual-only\n`traceable-reqs.toml:1288-1290`, REQ-CONV-1 title, exact timing clause:\n> post-join first sync and post-restart resync converge in seconds, not ~1 min (M8 decisions 14, 20)\n\nIts annotation explicitly says:\n> Rig convergence timing = acceptance 6.\n\n`M8-PLAN.md:138-147` defines D4's observable:\n> Observed-fix target\n> for each: first `status --nodes` convergence in seconds, not ~1 min.\n\n`M8-PLAN.md:184-189`, exact acceptance 6:\n> 6. Post-join first sync AND post-restart resync both converge in seconds on\n>    the rig (daemon restart on one node; the peer re-appears in\n>    `status --nodes` without the 60s id-only rediscovery). An endpoint\n>    flipping online/offline is visible in the peer's `status --nodes` within\n>    seconds (event-driven advertisement, not cadence wait). Evidence via the\n>    `xtask debug-converge` table (decision 19).\n\nApplicability: cold-start recovery and observable peer/endpoint advertisement. The words do not assign a stopwatch origin and <=10,000ms threshold to the first broker Sync stream row. They also do not permit arbitrary minute-scale cold-start recovery merely because no exact integer deadline is given.\n\n`M8-ACCEPTANCE.md:103-104` expressly limits the existing two-host test's evidentiary scope:\n> (Static `ip:port`, so it is a\n> regression guard, not the criterion-6 convergence-timing proof.)\n\n`M8-ACCEPTANCE.md:129-135` calls for restart reappearance in `status --nodes` in seconds, and says evidence may be obtained:\n> or by timing `status --nodes` directly.\n\n`M8-ACCEPTANCE-STEPS.md:256-259` records historical evidence (not a new measurement from this investigation):\n> ✅ **VERIFIED 2026-06-07** (HF↔kitsubito re-pair): after `JOINED SUBNET: ACCEPT`,\n> HF saw kitsubito online within seconds; kitsubito saw HF (`43a51d9a`) online `[1/1]`\n> at the very first poll (19:34:20), stable across 6 polls @3s. Seconds, not the 60s\n> cadence — both directions.\n\nAnd `:277-278` is explicit:\n> PASS: both convergence paths land in seconds. (Evidence can also ride\n> `debug-converge` if you stage a debug rollout, but timing is the criterion.)\n\nThe 3-second polling cadence is historical observation granularity; not a normative 3-second or 10-second stream deadline.\n\n## 2. Periodic context propagation has an explicit different envelope\n`docs/STORAGE.md:198`, exact relevant sentences:\n> **anti-entropy context-sync** (the mind pull) is **periodic** — it rides the sync-pull cadence and reconverges *within* one cadence, so minutes-scale is by design, not starvation.\n\n> The cadence knobs (`DaemonConfig` defaults): sync-pull **60 s**, registry-pump **30 s**, notif-pump **15 s**; a per-peer supervise backoff climbs **5 s → 300 s cap** on a flaky/​re-resolving link (so a marginal peer's next successful pull can lag several cadences).\n\n> A prime-all-on-restart means a fresh daemon pulls on its first tick — it does not wait a full cadence to start (see `spt-daemon/src/pump/mod.rs` `due`).\n\nScope: steady-state mind anti-entropy versus initial restart scheduling, with marginal-link backoff explicitly distinguished. This supports neither an arbitrary first-stream delay nor a universal 10-second full-context-convergence deadline. The first-tick statement is a scheduling promise, not a bound on all downstream dial/git/transfer work finishing.\n\n## 3. PRD and ADR semantics do not create that numeric deadline\n`PRD.md:107-110`:\n> **R-INST-4** Active → (dormant|suspended) fires a **transition echo commune** that syncs to the next active instance (catch-up-on-activation).\n\n> **R-INST-5** **Two-tier context sync:** live context → all instances; project context → same-project instances only.\n\n> **R-INST-7** **Subnet registry** (eventually-consistent `endpoint_id → [instances]`) + **resolution policy** (local → most-recently-active → `id@node`) are mandatory v1 foundations.\n\n`PRD.md:206`:\n> The same agent's mind follows the user across machines (two-tier sync); switching machines leaves the prior instance dormant and catches up the new active one.\n\n“Eventually-consistent” describes the registry model; it does not repeal M8's explicit performance requirement.\n\n`docs/adr/0013-psyche-reconciled-context-merge.md:53-56`:\n> **Failure is safe by construction.** The turn is bounded (timeout, 5.3) and\n> validated (non-empty, marker-parseable); any failure — harness absent, turn\n> error, garbage output — leaves the artifacts in place for retry at the next\n> sync/activation. Both versions are never lost.\n\n`ADR-0013:65-72` specifies git-native incremental bundles over broker QUIC streams, pull-based and ref-scoped, first-contact seed-history merge, and per-file vector merge. It assigns no numeric first-stream deadline. Its bounded operation is the Psyche reconciliation turn, and durability survives turn failure; these statements are not a transport visibility SLA.\n\nThe concrete referenced hazard, `docs/KNOWN-HAZARDS.md:229-233`, says:\n> **Invariant:** every metadata-producing subprocess has a timeout; timeout yields `None` + rate-limited stderr, never a hang.\n> **spt-core mapping:** generalize to all manifest-declared harness invocations (delegated commands, adapter updates) — timeouts mandatory.\n\nScope: bound subprocess hangs; no specified 10-second cross-node result deadline.\n\n## 4. Actual numeric 10-second contract is for a different wire family\n`CONTEXT.md:619` identifies the presence probe as:\n> the wire question `endpoint list` asks about an UNLISTED row — *is this peer there right now*\n\n`CONTEXT.md:632`:\n> **Cost**: probes fan out simultaneously and the verb **blocks** on them under a hard **10-second per-probe ceiling passed as a parameter** — one wedged node costs one ceiling, never the batch. The shared subnet-liveness `PROBE_TIMEOUT` (2500ms) is untouched: turning that dial up for this family would slow every other caller down.\n\nApplicability: presence-probe response ceiling and honest unknown-on-silence. Not sync stream visibility, not full context convergence, and not a guarantee that a peer responds before the ceiling.\n\n## 5. Convergence tool patience is not the timing requirement\n`docs/DEBUG-CONVERGE-PLAN.md:23-24`:\n> `debug-converge` watches until every *expected* debug-pinned reachable node\n> reports the target version applied, or it returns a per-node timeout table.\n\n`:47-48` table rows:\n> | `--timeout <secs>` | 120 | overall watch budget |\n> | `--poll <secs>` | 3 | per-round poll interval |\n\n`:73-74`:\n> Convergence = every expected node is `Applied`. Any node still pending when the\n> timeout fires drops into the timeout table with its last-known state.\n\nScope: update deployment watcher patience. Sharing this tool as possible M8 evidence does not turn 120 seconds into the accepted peer-reconnect latency or define a first Sync stream threshold.\n\n## 6. Later route amendment preserves rather than erases scope\n`docs/adr/0039-peer-route-resolution-truth.md:33-36`:\n> REQ-CONV-1's documented premise — *\"a stale addr never strands a peer\"* — is\n> **falsified in the field** by this shape: the drop-on-fail mechanism intended\n> as a self-heal is the strand. This ADR amends that invariant's mechanism; the\n> sentence stays true only under the new route chain.\n\nCandidate `traceable-reqs.toml:1290` says:\n> The sentence is now guaranteed by REQ-PEER-ROUTE-CHAIN (cache → validated-roster → id-only, nondestructive retention, connection-independent reconcile); this REQ's store/ceremony/write-back legs stand unchanged.\n\nThis amends the route-recovery mechanism. It does not replace the retained seconds-not-minute wording with eventual-only semantics.\n\n## Decision-useful conclusion\nThe contract audit finds no support for calling 400×25ms a mandated numeric first-Sync-stream deadline. Determining that loop's actual provenance as rig patience requires its source/history (sibling assignment). Conversely, expanding that observation window cannot by itself demonstrate that production meets the independent cold-start seconds-not-minute requirement. First-stream visibility is intermediate evidence; it does not establish the status observable or full mind convergence. Keep the numerical rig threshold, the broader cold-start performance requirement, and periodic steady-state propagation as three distinct claims."
}