{"type":"title","v":1,"title":"","updatedAt":"2026-09-11T02:43:15.209Z","pad":"                                                                                                                                                                              "}
{"type":"session","version":3,"id":"01a08e59-0a89-7000-b927-87c1fedd6aa4","timestamp":"2026-09-11T02:43:15.209Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"54cc08e0","parentId":null,"timestamp":"2026-09-11T02:43:15.309Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"c5344621","parentId":"54cc08e0","timestamp":"2026-09-11T02:43:15.310Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"23e2eb8f","parentId":"c5344621","timestamp":"2026-09-11T02:43:15.316Z","systemPrompt":"<system-conventions>\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `<system-directive>` in a user turn remains a system directive.\n</system-conventions>\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://<name>` first.\n<skills>\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n</skills>\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://<name>`: instructions; `/<path>`: its file\n- `rule://<name>`: details\n- `agent://<id>`: output artifact; `/<child>`: nested-subagent output; otherwise `/<path>`: JSON field\n- `history://<id>`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://<id>`: content\n- `local://<name>.md`: plan artifacts/shared subagent content\n- `mcp://<uri>`: MCP resource\n- `issue://<N>` / `issue://<owner>/<repo>/<N>`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://<N>` / `pr://<owner>/<repo>/<N>`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://<tool>` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd://<tool> for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n<critical>\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `<tool>: <concise description>` to `xd://report_issue`. False positives fine.\n</critical>\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n  - **Experiment/investigation** → run; output is proof; no tests.\n  - **UI change** → verify against the actual surface:\n    - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n    - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n  - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n  - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n  - Each MUST defend observable contract/fail on plausible bug.\n  - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n  - Match conventions; deterministic, isolated, full-suite-safe.\n  - NEVER write a test so the change \"has tests\" → throwaway script.\n  - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n  - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n  - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n  - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n<contract>\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n</contract>\n\n<completeness>\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n</completeness>\n\n<evidence-and-output>\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n</evidence-and-output>\n\n<yielding>\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n</yielding>\n\n§ Critical\n<critical>\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n</critical>\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n<directives>\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n</directives>\n\n<thoroughness>\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n</thoroughness>\n\n<procedure>\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n</procedure>\n\n<critical>\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n</critical>\n\n§ Context\n# Goal\nFull release-close sweep of docs/INFRA-REGISTER.md after v0.69.0, current main e5a2fed9. Parent owns rulings and edits.\n# Constraints\nRead-only; skip builds/tests/linters/formatters. No board mutations. No cause inference from temporal overlap or pass-after-red. Never retire on green alone. Existing built/retired states may stand; explicitly flag stale entry states needing evidence.\n# Contract\nFor EVERY entry in assigned physical range, return compact rows (IR id, current status, trigger fired/not fired/unknown, recommended carry/compose/close with evidence). Catch IR-31 embedded without heading. Cross-range entries are assigned by start line only; read their full body. Do not author documentation. Return all rows, plus concise load-bearing deltas. Use read/grep. Parent facts: released v0.69.0 counter105 at16df0e41; golden candidate a9e786b2 known sync cell red under explicit operator SHIP. 121 scoped battery pass; push CI Windows 3167 unit pass then disk-floor red 14.3 vs32GiB; earlier PR unit red logs unavailable remains unclassified. Release build success. IR92 reconciled by driver core215/217 merged, needs source/contract verification before changing entry. Disk cleanup root target62.32GiB and CI debug59.70GiB, then38 clean merged worktrees + obsolete clone etc net4.22GiB; no unmerged/dirty/retained evidence removed. These are mitigations not structural closure. IR96/97 remain open; hertz offline and investigation brief delivered not acknowledged.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `SweepEarlierEntries`. Currently visible peers:\n- `SweepLaterEntries` — scout (sub, running)\n- `Main` — main (main, running)\n- `ProjectsCleanupAudit` — scout (sub, idle)\n- `HomeCleanupAudit` — scout (sub, idle)\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://<id>` and `agent://<id>` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n  data: {\n    summary: string;\n    files: { path: string; description: string; }[];\n    architecture: string;\n    report?: string;\n  };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n<workstation>\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n</workstation>\n<critical>\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n</critical>","task":"Complete assignment thoroughly:\n\n# Target\nAll entries beginning in docs/INFRA-REGISTER.md lines180-2725, including IR54, IR15 and embedded IR31 despite heading irregularities. No other ownership.\n# Change\nRead full assigned entries and enumerate every one. Evaluate triggers against release facts in shared context; use source/history only for specific uncertain claimed closures or changed mechanisms. Do not run measurements or tests. Return compact exhaustive per-entry table; highlight operator cleanup effects on IR14/26/27/49 and latest disk/receipt effects on IR40/46.\n# Acceptance\nEvery entry starting in range represented once; no broad closure without proof. No edits. Skip all validation suites.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra:medium","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"97f40bcd","parentId":"23e2eb8f","timestamp":"2026-09-11T02:43:15.382Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nAll entries beginning in docs/INFRA-REGISTER.md lines180-2725, including IR54, IR15 and embedded IR31 despite heading irregularities. No other ownership.\n# Change\nRead full assigned entries and enumerate every one. Evaluate triggers against release facts in shared context; use source/history only for specific uncertain claimed closures or changed mechanisms. Do not run measurements or tests. Return compact exhaustive per-entry table; highlight operator cleanup effects on IR14/26/27/49 and latest disk/receipt effects on IR40/46.\n# Acceptance\nEvery entry starting in range represented once; no broad closure without proof. No edits. Skip all validation suites."}],"attribution":"agent","timestamp":1789094595319}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Ch7cEJPZ52KqxRwdXY7qjnSX|fc_074aee81620ae383016aa36ac2d4a887d1a58f1251e2bd0327","toolName":"grep","startedAt":"2026-09-11T02:43:18.933Z","args":{"path":"docs/INFRA-REGISTER.md:180-2770"},"intent":"Locating register entry boundaries"},"id":"eec69bae","parentId":"97f40bcd","timestamp":"2026-09-11T02:43:18.933Z"}
{"type":"message","id":"8ea7677d","parentId":"eec69bae","timestamp":"2026-09-11T02:43:18.933Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_Ch7cEJPZ52KqxRwdXY7qjnSX|fc_074aee81620ae383016aa36ac2d4a887d1a58f1251e2bd0327","name":"grep","arguments":{"i":"Locating register entry boundaries","pattern":"IR[- ]?[0-9]+|^##","path":"docs/INFRA-REGISTER.md:180-2770","case":true,"gitignore":true,"skip":0},"intent":"Locating register entry boundaries"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1804,"output":64,"cacheRead":8448,"cacheWrite":0,"totalTokens":10316,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094595380,"responseId":"resp_074aee81620ae383016aa36ac1a05c87d1bbd4e751a364d31c","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_074aee81620ae383016aa36ac2d4a887d1a58f1251e2bd0327","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating register entry boundaries\",\"pattern\":\"IR[- ]?[0-9]+|^##\",\"path\":\"docs/INFRA-REGISTER.md:180-2770\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_Ch7cEJPZ52KqxRwdXY7qjnSX","internal_chat_message_metadata_passthrough":{"create_time":1789094594.033841,"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":3550.6924999998882,"ttft":1805.1615999992937,"completedAt":1789094598931,"contextSnapshot":{"promptTokens":10252,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"credential_pin","id":"3132a037","parentId":"8ea7677d","timestamp":"2026-09-11T02:43:18.933Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"d21835c4","parentId":"3132a037","timestamp":"2026-09-11T02:43:18.953Z","message":{"role":"toolResult","toolCallId":"call_Ch7cEJPZ52KqxRwdXY7qjnSX|fc_074aee81620ae383016aa36ac2d4a887d1a58f1251e2bd0327","toolName":"grep","content":[{"type":"text","text":"*180|### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n 181|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n 182|  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n 183|  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n...\n 204|  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\n*205|  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\n 206|  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\n 207|  could not make.\n 208|\n*209|### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\n 210|- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\n 211|  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\n 212|  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\n...\n 233|\n*234|### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\n 235|- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\n 236|- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\n 237|  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\n...\n 246|\n*247|### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n 248|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n 249|  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n 250|  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n...\n 268|\n*269|### IR-5 — Shared nextest summary parser\n 270|- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n 271|- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\n 272|  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\n...\n 287|\n*288|### IR-6 — Membership logging on subnet gates\n 289|- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n 290|- **What/why:** counts beside results, membership beside counts — gate logs that state a count\n 291|  without naming the population keep producing unreadable reds. Standardize membership\n...\n 299|\n*300|### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\n 301|- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\n 302|- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\n 303|  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\n...\n 306|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*307|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 308|- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\n 309|- **Size:** medium.\n 310|\n*311|### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\n 312|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\n 313|  (ex releases#122)\n 314|- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\n...\n 341|  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\n*342|- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\n 343|- **Size:** small.\n 344|\n*345|### IR-9 — Golden boxes run different clippy versions\n 346|- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\n 347|  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\n 348|  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\n...\n 370|  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n*371|  leg. Natural companion to IR-4's toolchain-version print step.\n 372|- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\n 373|  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\n 374|  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\n...\n 378|- **Size:** built.\n*379|- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\n 380|  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n 381|  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n 382|\n*383|### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n 384|- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n 385|- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\n 386|  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\n...\n 390|\n*391|### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\n 392|- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\n 393|- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\n 394|  as a column it makes the orphan-vs-own-shell call one glance.\n...\n 397|\n*398|### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\n 399|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\n 400|  releases#116\n 401|- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\n...\n 411|  The original rig mechanism remains unproven (old-mtime restoration or two target directories\n*412|  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\n 413|  register at the WEBSERVE close sweep.\n 414|  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\n 415|- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\n...\n 445|\n*446|### IR-13 — Test-soundness follow-ups from the uniform-table sweep\n 447|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\n 448|- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\n 449|  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\n...\n 456|\n*457|### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n 458|- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\n 459|  now sought directly when the entry ripens, not via board flag)\n 460|- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\n...\n 466|\n*467|#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\n 468|\n 469|Three people measuring \"the worktrees\" got three answers. None was wrong; they answered three\n 470|different questions, and nothing in the tree states which one is meant:\n...\n 487|\n*488|#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\n 489|\n 490|⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\n 491|a junction that a REGISTERED worktree uses as its `target/`:\n...\n 534|\n*535|#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\n 536|\n 537|Read-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\n 538|directory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\n...\n 544|\n*545|#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\n 546|\n 547|**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\n 548|scripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\n...\n 554|\n*555|#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n 556|\n 557|Classes B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\n 558|A, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\n...\n 574|  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\n*575|  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\n 576|  executed on the gater's own rigs:** evidence preserved FIRST\n 577|  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\n 578|  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\n...\n 597|  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\n*598|  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\n 599|  to sweep, not a norm.\n 600|- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\n 601|  class-A pool findings are armed hazards and do not wait for it.\n...\n 605|  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\n*606|  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\n 607|\n*608|### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\n 609|- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\n 610|- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\n 611|  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\n...\n 626|  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\n*627|  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\n 628|  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\n 629|  `broker_survived`: false in every killed round of the positive control, true in every healthy\n 630|  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\n...\n 634|  failed the discriminator question and does not support the kill read.** The kill read now rests\n*635|  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\n 636|  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\n*637|  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\n 638|  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\n 639|  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\n 640|  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\n...\n 671|  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\n*672|  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\n 673|  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\n 674|  is the claim that survives someone fixing this box; the sub-observation is what is actionable\n 675|  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\n 676|  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\n*677|  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\n 678|  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\n 679|  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\n 680|  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\n...\n 685|  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\n*686|  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\n 687|  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\n 688|  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\n 689|  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\n...\n 715|  triages). The family's host-INDEPENDENT claim\n*716|  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\n 717|  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\n 718|  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\n 719|  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\n...\n 725|\n*726|### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\n 727|- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\n 728|  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\n 729|  deployah's log read\n...\n 740|  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\n*741|  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\n 742|  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\n*743|- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\n 744|  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\n 745|- **Size:** small.\n 746|- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\n*747|  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\n*748|  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\n 749|  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\n 750|  at all rather than silently skipping it).\n 751|- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\n...\n 753|  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\n*754|  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\n 755|  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\n 756|  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\n 757|  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\n...\n 762|\n*763|### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n 764|- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n 765|  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\n 766|  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\n...\n 773|  teardown by this verdict · **Origin:** hertz\n*774|  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\n 775|  reproduction\n 776|- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\n 777|  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\n...\n 799|  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\n*800|  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\n*801|  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\n 802|  bare pid. Kill what you pinned, not the number it happens to hold.\n 803|- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\n 804|  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\n...\n 810|  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\n*811|  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\n 812|  The service outlives its daemon because `detached_no_inherit_env` spawns it\n 813|  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\n 814|  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\n*815|  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\n 816|  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\n 817|  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\n 818|  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\n 819|  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\n*820|  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\n 821|  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\n 822|  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\n 823|  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\n...\n 854|  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\n*855|  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\n 856|  same night — the third instance of that sentence tonight, this time inside our own instrument):\n 857|  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\n 858|  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\n*859|  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\n 860|  image, on this box. So the population assertion counts unreadable-path processes as their OWN\n 861|  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\n 862|  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\n 863|  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\n*864|  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\n 865|  stays open.\n 866|- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\n 867|  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\n...\n 875|  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\n*876|  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\n 877|  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\n*878|  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\n 879|  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\n 880|  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\n 881|  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\n...\n 905|  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\n*906|  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\n 907|  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\n 908|  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\n 909|  reach, not load-bearing. `unreadable` stays FATAL as ruled.\n...\n 911|  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\n*912|  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\n 913|  lane under the dispatch split; the two cross-ref, they do not merge.\n 914|- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\n 915|  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\n...\n 950|  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\n*951|  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\n 952|  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\n 953|  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\n*954|  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\n*955|  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\n 956|  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\n 957|  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\n 958|  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\n...\n 968|  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\n*969|  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\n 970|  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\n 971|  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\n 972|  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\n...\n 983|  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\n*984|  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\n 985|  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\n 986|  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\n 987|  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\n*988|  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\n 989|  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\n 990|  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\n 991|  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\n...\n 1047|\n*1048|### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\n 1049|- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\n 1050|  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\n 1051|  source same night.\n...\n 1076|\n*1077|### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\n*1078|- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\n 1079|  (hfenduleam, log kept); routed text, doyle-landed.\n 1080|- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\n 1081|  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\n...\n 1095|  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\n*1096|  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\n 1097|  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\n 1098|  the work. Exactly why the population gate exists rather than per-pid checks alone.\n 1099|- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\n...\n 1105|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*1106|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 1107|- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\n 1108|- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\n 1109|\n*1110|### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\n 1111|- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1112|  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\n 1113|  both mechanisms measured at the cut, neither cost this run anything because the driver caught\n...\n 1141|\n*1142|## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\n 1143|\n 1144|- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\n 1145|  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\n...\n 1147|\n*1148|## BUILT / RETIRED\n 1149|\n*1150|### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\n 1151|- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\n 1152|- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\n 1153|  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\n...\n 1160|- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\n*1161|  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\n 1162|  GREEN; main ff'd to a5042ec.\n 1163|- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\n 1164|  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\n...\n 1166|  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\n*1167|  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\n 1168|  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\n*1169|  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\n 1170|  test-side rather than product-side. A recurrence must discriminate between them, not assume\n*1171|  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\n*1172|  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\n 1173|  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\n*1174|  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\n 1175|  healthy runs and discriminates nothing.)\n 1176|\n*1177|### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\n 1178|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\n 1179|  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\n 1180|  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\n...\n 1195|\n*1196|#### THE MECHANISM (measured, both ends)\n 1197|\n 1198|**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\n 1199|never emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\n...\n 1227|\n*1228|#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\n 1229|\n 1230|**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\n 1231|Both members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\n...\n 1253|\n*1254|#### THE ONE CI-SIDE MEMBER THAT IS REAL\n 1255|\n 1256|`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\n 1257|and `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\n...\n 1264|Somebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\n*1265|the comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\n 1266|would find it.\n 1267|\n*1268|#### POPULATION\n 1269|\n 1270|**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\n 1271|`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\n...\n 1276|| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\n*1277|| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\n 1278|| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\n 1279|\n 1280|**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\n...\n 1324|\n*1325|#### REMEDY SHAPE (not ruled)\n 1326|\n 1327|The distinction that matters is location vs. build:\n 1328|\n...\n 1347|\n*1348|#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\n 1349|- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\n 1350|  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\n 1351|  here so the next clean rig does not re-diagnose them as code reds.\n...\n 1391|\n*1392|### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\n 1393|- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\n 1394|  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\n 1395|- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\n...\n 1403|  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\n*1404|  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\n 1405|- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\n 1406|  vars, so this fires for every builder on a perched session and for nobody running from a bare\n 1407|  shell — which is precisely the split between how builders work and how CI runs.\n...\n 1413|\n*1414|### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\n 1415|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\n 1416|- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\n 1417|  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\n...\n 1438|\n*1439|### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\n 1440|- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\n 1441|  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\n 1442|  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\n...\n 1444|  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\n*1445|  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\n 1446|  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\n 1447|  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\n 1448|  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\n...\n 1450|  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\n*1451|  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\n 1452|  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\n 1453|  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\n 1454|  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\n 1455|  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\n*1456|  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\n 1457|  NOT folded into that lane (doyle ruling, same day) and filed instead.\n 1458|- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\n*1459|  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\n 1460|  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\n 1461|  where it lives — the module already decided that these returns are worth reading.\n*1462|- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\n 1463|  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\n 1464|  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\n 1465|  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\n...\n 1468|  second ruling gets smuggled into a lane scoped to one.\n*1469|- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\n 1470|  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\n*1471|  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\n 1472|  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\n 1473|  its direct process in the same breath, which is what makes the middle hop dead by construction\n 1474|  there. **That is the first thing to check, and it is not assumed.**\n*1475|- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\n 1476|  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\n 1477|  cost-of-loss question is answered for this subject.\n 1478|\n*1479|### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\n 1480|- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\n 1481|  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\n 1482|  assembled.\n...\n 1506|- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\n*1507|  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\n 1508|  different mechanism, which is why these are two entries and not one.\n 1509|- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\n 1510|  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\n 1511|  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\n*1512|  The same tool gap acquitted [[IR-21]]'s golden question the same day.\n 1513|- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\n 1514|  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\n 1515|  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\n...\n 1521|  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\n*1522|- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\n 1523|  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\n 1524|  rule (gate with nextest); medium to harden the three marginal tests.\n 1525|\n*1526|### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n 1527|- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n 1528|  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\n 1529|  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\n...\n 1545|  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\n*1546|  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\n 1547|  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\n 1548|  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\n 1549|  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\n...\n 1589|  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\n*1590|  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\n 1591|  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\n 1592|  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\n 1593|  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\n...\n 1607|  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\n*1608|  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\n*1609|  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\n*1610|  kept out of [[IR-16]] — folding it in settles its question in passing.\n 1611|- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\n 1612|  **Size:** small once the remedy question is settled.\n 1613|- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\n...\n 1637|  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\n*1638|  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\n 1639|  \"the stamp arm handles it\" is false for most claims that actually exist.\n 1640|- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\n 1641|  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\n...\n 1672|  construction and re-measure, but expect the geometry to usually hold.\n*1673|- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\n 1674|  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\n 1675|  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\n 1676|  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\n...\n 1694|  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\n*1695|  lane as or beside the IR-26 remedy. Size: small.\n 1696|\n*1697|### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\n 1698|- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\n*1699|  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\n 1700|- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\n 1701|  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\n 1702|  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\n...\n 1730|\n*1731|### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\n 1732|- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1733|  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\n 1734|- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\n...\n 1745|\n*1746|### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\n 1747|- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\n 1748|  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\n 1749|  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\n...\n 1808|\n*1809|### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\n 1810|- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\n 1811|  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\n 1812|  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\n...\n 1819|  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\n*1820|  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\n 1821|  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\n 1822|  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\n 1823|  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\n...\n 1834|  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\n*1835|  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\n 1836|  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\n 1837|  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\n 1838|  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\n...\n 1927|  start — the claim verb is the natural seat (print box free + du of known lane targets at\n*1928|  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\n 1929|  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\n 1930|  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\n 1931|  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\n...\n 2034|  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\n*2035|  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\n 2036|  class recurring, left for retry rather than forced.\n 2037|\n 2038|- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\n...\n 2068|\n*2069|### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\n 2070|- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\n 2071|  the builder to the gater deliberately — register shape is doyle's to own.\n 2072|- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\n...\n 2095|\n*2096|### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\n 2097|- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\n 2098|- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\n 2099|  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\n...\n 2108|  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\n*2109|  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\n 2110|- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\n 2111|  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\n 2112|  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\n...\n 2134|- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\n*2135|  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\n 2136|  (b) raise the main thread stack for the binary (build config), buying headroom without\n 2137|  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\n 2138|  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\n...\n 2143|\n*2144|### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\n 2145|- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\n 2146|  characterized same day by hertz from retained logs, ownership falsified by todlando.\n 2147|- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\n...\n 2164|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2165|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 2166|- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\n 2167|- **Size:** small.\n 2168|\n*2169|### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\n 2170|- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\n 2171|- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\n 2172|  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\n...\n 2174|  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\n*2175|  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\n 2176|  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\n 2177|  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\n 2178|  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\n...\n 2200|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2201|  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\n 2202|- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\n 2203|- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\n 2204|\n*2205|### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n 2206|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n 2207|  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\n 2208|  item-2 sweep ruling; doyle ruled file-don't-sweep.\n...\n 2224|  is gone.\n*2225|- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\n*2226|  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\n 2227|- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\n 2228|- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\n 2229|  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\n 2230|  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\n*2231|  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\n 2232|  rides the same lane.\n 2233|- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\n 2234|  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\n...\n 2238|  generated targets as absent before generation. Its small refactor + unit keeps source and\n*2239|  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\n 2240|\n*2241|### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\n 2242|- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\n 2243|  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n 2244|  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n...\n 2258|  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\n*2259|  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\n 2260|  gate itself.\n 2261|- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT\n\n[Showing lines 1-675 of 852 (50.0KB limit). Use :676 to continue]"}],"details":{"scopePath":"docs/INFRA-REGISTER.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":175,"fileCount":1,"files":["docs/INFRA-REGISTER.md"],"fileMatches":[{"path":"docs/INFRA-REGISTER.md","count":175}],"truncated":true,"displayContent":" *180│### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n  181│- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n  182│  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n  183│  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n     │...\n  204│  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\n *205│  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\n  206│  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\n  207│  could not make.\n  208│\n *209│### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\n  210│- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\n  211│  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\n  212│  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\n     │...\n  233│\n *234│### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\n  235│- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\n  236│- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\n  237│  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\n     │...\n  246│\n *247│### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n  248│- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n  249│  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n  250│  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n     │...\n  268│\n *269│### IR-5 — Shared nextest summary parser\n  270│- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n  271│- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\n  272│  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\n     │...\n  287│\n *288│### IR-6 — Membership logging on subnet gates\n  289│- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n  290│- **What/why:** counts beside results, membership beside counts — gate logs that state a count\n  291│  without naming the population keep producing unreadable reds. Standardize membership\n     │...\n  299│\n *300│### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\n  301│- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\n  302│- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\n  303│  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\n     │...\n  306│- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n *307│  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n  308│- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\n  309│- **Size:** medium.\n  310│\n *311│### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\n  312│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\n  313│  (ex releases#122)\n  314│- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\n     │...\n  341│  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\n *342│- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\n  343│- **Size:** small.\n  344│\n *345│### IR-9 — Golden boxes run different clippy versions\n  346│- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\n  347│  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\n  348│  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\n     │...\n  370│  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n *371│  leg. Natural companion to IR-4's toolchain-version print step.\n  372│- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\n  373│  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\n  374│  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\n     │...\n  378│- **Size:** built.\n *379│- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\n  380│  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n  381│  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n  382│\n *383│### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n  384│- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n  385│- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\n  386│  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\n     │...\n  390│\n *391│### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\n  392│- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\n  393│- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\n  394│  as a column it makes the orphan-vs-own-shell call one glance.\n     │...\n  397│\n *398│### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\n  399│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\n  400│  releases#116\n  401│- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\n     │...\n  411│  The original rig mechanism remains unproven (old-mtime restoration or two target directories\n *412│  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\n  413│  register at the WEBSERVE close sweep.\n  414│  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\n  415│- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\n     │...\n  445│\n *446│### IR-13 — Test-soundness follow-ups from the uniform-table sweep\n  447│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\n  448│- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\n  449│  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\n     │...\n  456│\n *457│### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n  458│- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\n  459│  now sought directly when the entry ripens, not via board flag)\n  460│- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\n     │...\n  466│\n *467│#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\n  468│\n  469│Three people measuring \"the worktrees\" got three answers. None was wrong; they answered three\n  470│different questions, and nothing in the tree states which one is meant:\n     │...\n  487│\n *488│#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\n  489│\n  490│⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\n  491│a junction that a REGISTERED worktree uses as its `target/`:\n     │...\n  534│\n *535│#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\n  536│\n  537│Read-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\n  538│directory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\n     │...\n  544│\n *545│#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\n  546│\n  547│**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\n  548│scripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\n     │...\n  554│\n *555│#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n  556│\n  557│Classes B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\n  558│A, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\n     │...\n  574│  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\n *575│  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\n  576│  executed on the gater's own rigs:** evidence preserved FIRST\n  577│  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\n  578│  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\n     │...\n  597│  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\n *598│  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\n  599│  to sweep, not a norm.\n  600│- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\n  601│  class-A pool findings are armed hazards and do not wait for it.\n     │...\n  605│  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\n *606│  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\n  607│\n *608│### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\n  609│- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\n  610│- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\n  611│  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\n     │...\n  626│  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\n *627│  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\n  628│  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\n  629│  `broker_survived`: false in every killed round of the positive control, true in every healthy\n  630│  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\n     │...\n  634│  failed the discriminator question and does not support the kill read.** The kill read now rests\n *635│  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\n  636│  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\n *637│  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\n  638│  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\n  639│  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\n  640│  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\n     │...\n  671│  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\n *672│  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\n  673│  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\n  674│  is the claim that survives someone fixing this box; the sub-observation is what is actionable\n  675│  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\n  676│  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\n *677│  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\n  678│  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\n  679│  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\n  680│  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\n     │...\n  685│  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\n *686│  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\n  687│  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\n  688│  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\n  689│  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\n     │...\n  715│  triages). The family's host-INDEPENDENT claim\n *716│  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\n  717│  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\n  718│  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\n  719│  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\n     │...\n  725│\n *726│### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\n  727│- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\n  728│  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\n  729│  deployah's log read\n     │...\n  740│  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\n *741│  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\n  742│  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\n *743│- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\n  744│  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\n  745│- **Size:** small.\n  746│- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\n *747│  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\n *748│  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\n  749│  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\n  750│  at all rather than silently skipping it).\n  751│- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\n     │...\n  753│  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\n *754│  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\n  755│  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\n  756│  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\n  757│  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\n     │...\n  762│\n *763│### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n  764│- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n  765│  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\n  766│  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\n     │...\n  773│  teardown by this verdict · **Origin:** hertz\n *774│  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\n  775│  reproduction\n  776│- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\n  777│  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\n     │...\n  799│  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\n *800│  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\n *801│  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\n  802│  bare pid. Kill what you pinned, not the number it happens to hold.\n  803│- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\n  804│  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\n     │...\n  810│  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\n *811│  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\n  812│  The service outlives its daemon because `detached_no_inherit_env` spawns it\n  813│  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\n  814│  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\n *815│  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\n  816│  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\n  817│  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\n  818│  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\n  819│  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\n *820│  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\n  821│  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\n  822│  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\n  823│  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\n     │...\n  854│  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\n *855│  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\n  856│  same night — the third instance of that sentence tonight, this time inside our own instrument):\n  857│  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\n  858│  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\n *859│  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\n  860│  image, on this box. So the population assertion counts unreadable-path processes as their OWN\n  861│  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\n  862│  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\n  863│  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\n *864│  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\n  865│  stays open.\n  866│- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\n  867│  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\n     │...\n  875│  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\n *876│  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\n  877│  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\n *878│  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\n  879│  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\n  880│  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\n  881│  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\n     │...\n  905│  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\n *906│  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\n  907│  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\n  908│  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\n  909│  reach, not load-bearing. `unreadable` stays FATAL as ruled.\n     │...\n  911│  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\n *912│  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\n  913│  lane under the dispatch split; the two cross-ref, they do not merge.\n  914│- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\n  915│  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\n     │...\n  950│  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\n *951│  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\n  952│  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\n  953│  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\n *954│  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\n *955│  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\n  956│  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\n  957│  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\n  958│  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\n     │...\n  968│  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\n *969│  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\n  970│  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\n  971│  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\n  972│  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\n     │...\n  983│  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\n *984│  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\n  985│  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\n  986│  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\n  987│  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\n *988│  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\n  989│  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\n  990│  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\n  991│  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\n     │...\n 1047│\n*1048│### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\n 1049│- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\n 1050│  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\n 1051│  source same night.\n     │...\n 1076│\n*1077│### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\n*1078│- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\n 1079│  (hfenduleam, log kept); routed text, doyle-landed.\n 1080│- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\n 1081│  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\n     │...\n 1095│  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\n*1096│  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\n 1097│  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\n 1098│  the work. Exactly why the population gate exists rather than per-pid checks alone.\n 1099│- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\n     │...\n 1105│- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*1106│  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 1107│- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\n 1108│- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\n 1109│\n*1110│### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\n 1111│- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1112│  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\n 1113│  both mechanisms measured at the cut, neither cost this run anything because the driver caught\n     │...\n 1141│\n*1142│## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\n 1143│\n 1144│- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\n 1145│  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\n     │...\n 1147│\n*1148│## BUILT / RETIRED\n 1149│\n*1150│### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\n 1151│- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\n 1152│- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\n 1153│  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\n     │...\n 1160│- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\n*1161│  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\n 1162│  GREEN; main ff'd to a5042ec.\n 1163│- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\n 1164│  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\n     │...\n 1166│  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\n*1167│  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\n 1168│  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\n*1169│  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\n 1170│  test-side rather than product-side. A recurrence must discriminate between them, not assume\n*1171│  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\n*1172│  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\n 1173│  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\n*1174│  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\n 1175│  healthy runs and discriminates nothing.)\n 1176│\n*1177│### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\n 1178│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\n 1179│  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\n 1180│  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\n     │...\n 1195│\n*1196│#### THE MECHANISM (measured, both ends)\n 1197│\n 1198│**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\n 1199│never emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\n     │...\n 1227│\n*1228│#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\n 1229│\n 1230│**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\n 1231│Both members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\n     │...\n 1253│\n*1254│#### THE ONE CI-SIDE MEMBER THAT IS REAL\n 1255│\n 1256│`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\n 1257│and `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\n     │...\n 1264│Somebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\n*1265│the comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\n 1266│would find it.\n 1267│\n*1268│#### POPULATION\n 1269│\n 1270│**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\n 1271│`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\n     │...\n 1276│| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\n*1277│| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\n 1278│| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\n 1279│\n 1280│**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\n     │...\n 1324│\n*1325│#### REMEDY SHAPE (not ruled)\n 1326│\n 1327│The distinction that matters is location vs. build:\n 1328│\n     │...\n 1347│\n*1348│#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\n 1349│- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\n 1350│  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\n 1351│  here so the next clean rig does not re-diagnose them as code reds.\n     │...\n 1391│\n*1392│### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\n 1393│- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\n 1394│  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\n 1395│- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\n     │...\n 1403│  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\n*1404│  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\n 1405│- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\n 1406│  vars, so this fires for every builder on a perched session and for nobody running from a bare\n 1407│  shell — which is precisely the split between how builders work and how CI runs.\n     │...\n 1413│\n*1414│### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\n 1415│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\n 1416│- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\n 1417│  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\n     │...\n 1438│\n*1439│### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\n 1440│- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\n 1441│  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\n 1442│  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\n     │...\n 1444│  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\n*1445│  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\n 1446│  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\n 1447│  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\n 1448│  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\n     │...\n 1450│  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\n*1451│  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\n 1452│  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\n 1453│  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\n 1454│  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\n 1455│  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\n*1456│  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\n 1457│  NOT folded into that lane (doyle ruling, same day) and filed instead.\n 1458│- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\n*1459│  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\n 1460│  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\n 1461│  where it lives — the module already decided that these returns are worth reading.\n*1462│- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\n 1463│  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\n 1464│  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\n 1465│  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\n     │...\n 1468│  second ruling gets smuggled into a lane scoped to one.\n*1469│- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\n 1470│  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\n*1471│  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\n 1472│  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\n 1473│  its direct process in the same breath, which is what makes the middle hop dead by construction\n 1474│  there. **That is the first thing to check, and it is not assumed.**\n*1475│- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\n 1476│  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\n 1477│  cost-of-loss question is answered for this subject.\n 1478│\n*1479│### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\n 1480│- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\n 1481│  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\n 1482│  assembled.\n     │...\n 1506│- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\n*1507│  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\n 1508│  different mechanism, which is why these are two entries and not one.\n 1509│- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\n 1510│  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\n 1511│  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\n*1512│  The same tool gap acquitted [[IR-21]]'s golden question the same day.\n 1513│- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\n 1514│  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\n 1515│  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\n     │...\n 1521│  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\n*1522│- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\n 1523│  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\n 1524│  rule (gate with nextest); medium to harden the three marginal tests.\n 1525│\n*1526│### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n 1527│- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n 1528│  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\n 1529│  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\n     │...\n 1545│  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\n*1546│  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\n 1547│  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\n 1548│  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\n 1549│  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\n     │...\n 1589│  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\n*1590│  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\n 1591│  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\n 1592│  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\n 1593│  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\n     │...\n 1607│  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\n*1608│  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\n*1609│  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\n*1610│  kept out of [[IR-16]] — folding it in settles its question in passing.\n 1611│- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\n 1612│  **Size:** small once the remedy question is settled.\n 1613│- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\n     │...\n 1637│  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\n*1638│  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\n 1639│  \"the stamp arm handles it\" is false for most claims that actually exist.\n 1640│- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\n 1641│  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\n     │...\n 1672│  construction and re-measure, but expect the geometry to usually hold.\n*1673│- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\n 1674│  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\n 1675│  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\n 1676│  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\n     │...\n 1694│  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\n*1695│  lane as or beside the IR-26 remedy. Size: small.\n 1696│\n*1697│### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\n 1698│- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\n*1699│  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\n 1700│- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\n 1701│  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\n 1702│  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\n     │...\n 1730│\n*1731│### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\n 1732│- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1733│  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\n 1734│- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\n     │...\n 1745│\n*1746│### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\n 1747│- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\n 1748│  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\n 1749│  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\n     │...\n 1808│\n*1809│### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\n 1810│- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\n 1811│  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\n 1812│  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\n     │...\n 1819│  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\n*1820│  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\n 1821│  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\n 1822│  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\n 1823│  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\n     │...\n 1834│  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\n*1835│  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\n 1836│  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\n 1837│  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\n 1838│  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\n     │...\n 1927│  start — the claim verb is the natural seat (print box free + du of known lane targets at\n*1928│  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\n 1929│  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\n 1930│  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\n 1931│  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\n     │...\n 2034│  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\n*2035│  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\n 2036│  class recurring, left for retry rather than forced.\n 2037│\n 2038│- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\n     │...\n 2068│\n*2069│### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\n 2070│- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\n 2071│  the builder to the gater deliberately — register shape is doyle's to own.\n 2072│- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\n     │...\n 2095│\n*2096│### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\n 2097│- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\n 2098│- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\n 2099│  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\n     │...\n 2108│  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\n*2109│  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\n 2110│- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\n 2111│  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\n 2112│  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\n     │...\n 2134│- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\n*2135│  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\n 2136│  (b) raise the main thread stack for the binary (build config), buying headroom without\n 2137│  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\n 2138│  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\n     │...\n 2143│\n*2144│### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\n 2145│- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\n 2146│  characterized same day by hertz from retained logs, ownership falsified by todlando.\n 2147│- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\n     │...\n 2164│- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2165│  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 2166│- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\n 2167│- **Size:** small.\n 2168│\n*2169│### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\n 2170│- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\n 2171│- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\n 2172│  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\n     │...\n 2174│  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\n*2175│  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\n 2176│  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\n 2177│  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\n 2178│  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\n     │...\n 2200│- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2201│  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\n 2202│- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\n 2203│- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\n 2204│\n*2205│### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n 2206│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n 2207│  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\n 2208│  item-2 sweep ruling; doyle ruled file-don't-sweep.\n     │...\n 2224│  is gone.\n*2225│- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\n*2226│  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\n 2227│- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\n 2228│- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\n 2229│  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\n 2230│  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\n*2231│  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\n 2232│  rides the same lane.\n 2233│- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\n 2234│  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\n     │...\n 2238│  generated targets as absent before generation. Its small refactor + unit keeps source and\n*2239│  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\n 2240│\n*2241│### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\n 2242│- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\n 2243│  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n 2244│  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n     │...\n 2258│  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\n*2259│  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\n 2260│  gate itself.\n 2261│- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT\n 2262│  established. Separating the only tag of a single-tagged REQ at the stage under test would settle\n     │...\n 2292│  including the single-tag displaced discriminator shape and the interposed-const shape.\n*2293│  Requested by hertz as the IR-37 prerequisite of his test-hygiene family lane (KEYSTONE #182).\n 2294│  spt-core consumes the upstream RELEASE only — no local shadow checker. Issue/branch/PR refs\n 2295│  land here when the lane reports.\n 2296│\n*2297│### IR-38 — CLASS: an e2e that ends with a live daemon-spawning binary wedges the NEXT build in its pool, and the diagnostic names the wrong lane\n 2298│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-04,\n 2299│  `shell_relink_force_e2e` on the #6 lane (filed by doyle; the finding and the fix are todlando's).\n 2300│- **What/why:** the e2e ends with a LIVE binary by design; on Windows a live process holds its\n     │...\n 2311│  `shell_relink_force_e2e` and `shell_stale_online_e2e`.\n*2312│- **Kin:** [[IR-7]] (phase-A daemon+brain pair leak), the exe-lock reap-by-path rule, and the\n*2313│  wrong-lane-diagnostic family ([[IR-21]]'s location-not-build class).\n 2314│- **SECOND HOLDER CLASS, measured 2026-08-04 (doyle, own gate rig):** an **ORPHANED CONHOST with an\n 2315│  inherited CWD** inside the test tree blocks `git worktree remove` with Permission-denied on a\n 2316│  DIRECTORY handle — invisible to any exe-path scan (conhost runs from System32; the parent that\n*2317│  spawned it was already dead). Found via `.github/ci/find-cwd-holders.ps1` (IR-11's instrument);\n 2318│  killed by pid after parent-dead classification; 34.78 GB reclaimed. Mechanism chain: the\n 2319│  windowless spawn path masks DETACHED_PROCESS off, the child owns a console, conhost inherits the\n 2320│  child's cwd and can OUTLIVE it. Boundary (hertz's, correct): this find and his field-4 companion\n     │...\n 2328│  locks — two populations, either alone is a clean zero on the other.\n*2329│- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36 family) — sweep every e2e that ends\n 2330│  with a live spawning binary, apply the same reap-after-assertions shape.\n 2331│- **Size:** small per test; population unknown until swept.\n 2332│- **Built evidence:** focused runs of both live-at-success tests pass back-to-back in one target\n     │...\n 2335│\n*2336│### IR-39 — CLASS: the missing-fixture-bin defect has TWO failure faces, and one of them impersonates a lifecycle defect of the subject under test\n 2337│- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz + todlando\n 2338│  2026-08-04, same evening from opposite sides (filed by doyle; hertz relayed todlando's\n 2339│  suggestion without endorsing scope).\n     │...\n 2353│  test fail downstream in its own vocabulary.\n*2354│- **Kin:** [[IR-21]] (wrong-lane-diagnostic family: the failure names the wrong actor), the\n 2355│  cargo-builds-package-bins-for-integration-tests rule (cross-package row is the only unguaranteed\n 2356│  build), golden.yml's dedicated fixture prebuild step.\n*2357│- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36/IR-38 family) — same sweep population;\n 2358│  or standalone small if that lane keeps slipping.\n 2359│- **Size:** small — one shared helper + a sweep of local `sibling_bin` resolver copies (24 known).\n 2360│- **Addendum (doyle, 2026-08-04 late): third and fourth sightings inside 24 h.** Face 1 twice\n     │...\n 2372│\n*2373│### IR-40 — CLASS: NO envelope-side ordering signal on a resume brief tracks content recency, and a CI informant's per-job line is a claim about that STEP, not the run\n 2374│- **Status:** open · **Origin:** three sightings in one night, 2026-08-04/05 — hertz, doyle,\n 2375│  todlando (filed by doyle; the artifacts are hertz's and todlando's, the CI arm is doyle's with\n 2376│  deployah's framing). Two arms of ONE family: a stale record that carries a confident ordering\n     │...\n 2438│  is a HYPOTHESIS to re-derive before acting.\n*2439│- **Kin:** [[IR-21]] and [[IR-39]] (the diagnostic names the wrong actor / the wrong subject),\n*2440│  [[IR-32]] (a gate that cannot see its own blind spot), [[IR-34]] (an intermittent marker read as\n 2441│  a signal).\n 2442│- **Ripe when:** the next commune/psyche-tier touch for arm A (the routing layer is spt-core's own\n 2443│  `spool`/psyche ingest, so a remedy is in-repo, not upstream); for arm B, the next `golden.yml`\n     │...\n 2449│\n*2450│### IR-41 — A QUEUED main run is superseded without a record; `cancel-in-progress: false` protects only STARTED runs\n 2451│- **Status:** open — mechanism CONFIRMED (doyle ruling 2026-08-05); the runbook sentence it\n 2452│  falsified is already corrected (`docs/RELEASE-RUNBOOK.md` step 3, same commit as this entry)\n 2453│  · **Origin:** deployah, v0.55.0 publish night, filed by him explicitly as UNPROVEN with the\n     │...\n 2478│  lane if taken.\n*2479│- **Kin:** [[IR-40]] (a record that is right-in-the-end-but-early vs a record that never comes to\n 2480│  exist — both read as clean states unless labelled), [[cancelled-measurement-leaves-labelled-hole]].\n 2481│\n*2482│### IR-42 — `pool-claim` writes a record; only the BUILD enforces — and AGENTS.md invited the misread\n 2483│- **Status:** BUILT 2026-08-19 — the AGENTS.md corrective line lands in the SAME COMMIT as this\n 2484│  entry (the register batch commit), which is the entry's stated exit condition. The optional\n 2485│  code-side nicety (claim verb prints the incumbent record it overwrites, information only)\n*2486│  remains unclaimed — a candidate rider on the IR-26 remedy lane, which already touches\n 2487│  `pool_claim`'s read-before-write path, NOT a reason to keep this entry open ·\n 2488│  **Origin:** doyle + todlando independently at source, 2026-08-19, during the #193 gate.\n 2489│- **Mechanism (source-verified):** `xtask pool-claim` (crates/xtask/src/main.rs:2232-2294 at the\n     │...\n 2495│  arms — `Refuse` (SPT_POOL_FOREIGN), `Takeover` (loud), `Unproven`, `HatchOpen` — live in\n*2496│  crates/spt-store/build.rs:31-113 and speak only at the next BUILD. (Same object [[IR-26]]'s\n 2497│  CLAIM-OBSERVABILITY measurement saw from the displaced side; this entry is the CLAIMING side\n 2498│  plus the doc that invited the misread.)\n 2499│- **Measured consequence:** 2026-08-19, doyle's gate claim over todlando's unlanded\n     │...\n 2507│\n*2508│### IR-43 — knock answer carrier: `NoReply` landed at 60.08s against a stated 30s carrier deadline\n 2509│- **Status:** open, OBSERVATION — mechanism unmeasured, filed exactly as wide as the datum ·\n 2510│  **Origin:** KNOCK-169 RCA layer 1 (todlando, read-only), golden 32191618042 @`93c1130`,\n 2511│  twohost-b, 2026-08-18.\n     │...\n 2518│  bound (a composed wait wearing one bound's name), or a bound armed after a wait it does not\n*2519│  cover (the [[IR-30]] nethost.rs permit-wait shape: `sem.acquire_owned()` outside the timeout).\n 2520│- **Ask:** derive where the 30s is armed and what path yields a 60s `NoReply` — one code read\n 2521│  from the emit site, before any instrument.\n 2522│- **Ripe when:** next knock-carrier touch, or the next `NoReply`-shaped red — whichever first.\n     │...\n 2524│\n*2525│### IR-44 — perch-sentinel comment overclaims: serialization is not preservation, and the comment teaches the false step\n 2526│- **Status:** open · **Origin:** #188 RCA lock read (todlando flagged, doyle confirmed the lock\n 2527│  read), 2026-08-18; the collapse-of-branches argument is on #188 and in the RCA record.\n 2528│- **What/why:** `lock_perch_sentinel` (info.rs:778 at `b20e770`, the diag sha — re-derive the\n     │...\n 2545│\n*2546│### IR-45 — twohost rig home premise, SETTLED: pump paths resolve under the per-run TEMP root (rig is disk-hermetic; the \"live fleet roster\" reading is retired)\n 2547│- **Status:** RETIRED 2026-08-19 — ask answered by the one code read at main @`78a9a16`; residue\n 2548│  re-homed (see Answer). · **Origin:** #188/#189 RCA readouts (todlando, doyle's 2a-2d), runs\n 2549│  32097943571 + 32108557362 + 32111921251, 2026-08-18.\n     │...\n 2576│\n*2577│### IR-46 — the Windows disk-floor preflight asserts an INSTANT; workspace free space moves tens of GB inside the hour, so a green floor is not a claim about run headroom\n 2578│- **Status:** open — mechanism CONFIRMED by a measurement series on hfenduleam; doyle ruled it\n 2579│  register-shaped 2026-08-18 · **Origin:** deployah, NAMEPLATE #181 golden-head intake, on the\n*2580│  run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\n*2581│  as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\n*2582│  (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\n*2583│  and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\n 2584│  version of it.\n 2585│- **What/why:** `golden.yml`'s Windows preflight computes `$freeBytes` once at job start and\n 2586│  hard-fails under a `32GB` floor. As a fast-fail that is correct and it did its job — it refused\n     │...\n 2627│- **Size:** small in `golden.yml`, load-bearing in what a green run is taken to prove.\n*2628│- **Kin:** [[IR-41]] and [[IR-40]] (a state that reads as a clean verdict unless it is labelled —\n 2629│  here a PASS that is read as headroom it never measured), [[measure-the-box-before-the-instrument]],\n 2630│  [[cancelled-measurement-leaves-labelled-hole]].\n 2631│\n*2632│- **2026-09-06 addendum (doyle, v0.67.1 close sweep): trigger FIRED at `04e32c8c` — `golden.yml` touched (2-line HEAVY reclass of `brain_resume_conn_deadlock` on the respin) with no remedy weighed. Not a drive-by by choice: the touch rode a respin under a pre-registered hard stop, which is no remedy window. COMPOSED with IR-59 (log-the-floor) + IR-73 (literal-first sites) as one hertz workflow rider on WEBSERVE #272; the remedy weighing happens on THAT lane, before the WEBSERVE golden head.**\n 2633│\n 2634│<!-- [doc->REQ-CI-FREE-SPACE-PREFLIGHT] -->\n 2635│- **2026-09-06 remedy ruling (doyle, WEBSERVE rider):** retain 32 GiB; record raw-byte\n     │...\n 2637│  End DISK assertions run `if: always()` before teardown, including after failed workloads.\n*2638│  A fresh `FLOOR_DOCS` assertion immediately before docs-drift composes with IR-73's second half.\n 2639│  Raising the floor is refused without a measured peak; continuous sampling adds lifecycle\n 2640│  machinery while remaining blind between samples. Start/end are a dataset, not a minimum or\n 2641│  headroom guarantee. Golden execution evidence waits for the WEBSERVE golden head; the thin\n     │...\n 2643│\n*2644│### IR-47 — ci-notify treats a missing co-author trailer as a quiet info line; silent attribution loss reads as \"there was none\"\n 2645│- **Status:** open — patch AUTHORED and stashed unlanded since 2026-07-29\n 2646│  (`.worktrees/_patches/ci-notify-missing-trailer.patch` + its `test-ci-notify.sh` harness in the\n 2647│  sibling `.untracked` dir); surfaced by doyle's 2026-08-19 idle-queue verification of that stash ·\n     │...\n 2662│  applies against the script's post-`SEND_BOUND_SECS` shape.\n*2663│- **Ripe when:** next `golden.yml`/ci-notify touch — natural co-rider with [[IR-46]]'s remedy\n 2664│  window (same file family, same \"weigh then, not drive-by\" rule). The stashed test harness rides\n 2665│  with it.\n 2666│- **Size:** ~10 lines in one shell script plus its test.\n*2667│- **Kin:** [[IR-40]] (an unlabelled state read as a clean verdict — here a quiet info line read as\n 2668│  \"no co-author existed\"), the AGENTS.md `%(trailers:)` tokenizer mandate (the sibling silent-zero\n 2669│  on the AUDIT side).\n 2670│\n*2671│### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\n 2672│- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\n 2673│  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\n 2674│  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\n     │...\n 2689│- **Kin:** the W3 gate finding this swept out of (skeleton cells, fixed at the fixture edge in\n*2690│  lane commit e99633f); [[IR-40]] (an untested tolerance read as a guarantee).\n 2691│\n*2692│### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\n 2693│- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\n 2694│  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\n 2695│  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\n     │...\n 2721│- **Size:** one fallback arm in `git_lane_state` + two fixtures.\n*2722│- **Kin:** [[IR-26]] (dead-holder takeover AUTHORIZED when it shouldn't be — this is the mirror:\n*2723│  takeover UNREACHABLE when it should fire), [[IR-42]] (claim writes, build enforces), the\n 2724│  AGENTS.md pool mandate this contradicts.\n 2725│\n*2726│### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\n 2727│- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\n 2728│  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\n 2729│  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\n     │...\n 2736│  read failure with channel + exact looked-at path + OS error (absent-sink regression pins\n*2737│  it — the IR-40 unlabelled-absence class was caught at gate and fixed in `2ac9543`);\n 2738│  censused every daemon-run captured-stderr panel outside `engine_room_bringup_e2e` (rides\n 2739│  #199 lane) and `er_briefing_*` (rides #164 lane); engineroom.rs:145 misnomer rider landed\n 2740│  in the same lane. Gate figure 781/781 at `2ac9543` (measured at the pre-reword tree,","truncation":{"content":"*180|### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n 181|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n 182|  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n 183|  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n...\n 204|  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\n*205|  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\n 206|  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\n 207|  could not make.\n 208|\n*209|### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\n 210|- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\n 211|  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\n 212|  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\n...\n 233|\n*234|### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\n 235|- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\n 236|- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\n 237|  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\n...\n 246|\n*247|### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n 248|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n 249|  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n 250|  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n...\n 268|\n*269|### IR-5 — Shared nextest summary parser\n 270|- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n 271|- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\n 272|  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\n...\n 287|\n*288|### IR-6 — Membership logging on subnet gates\n 289|- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n 290|- **What/why:** counts beside results, membership beside counts — gate logs that state a count\n 291|  without naming the population keep producing unreadable reds. Standardize membership\n...\n 299|\n*300|### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\n 301|- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\n 302|- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\n 303|  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\n...\n 306|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*307|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 308|- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\n 309|- **Size:** medium.\n 310|\n*311|### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\n 312|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\n 313|  (ex releases#122)\n 314|- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\n...\n 341|  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\n*342|- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\n 343|- **Size:** small.\n 344|\n*345|### IR-9 — Golden boxes run different clippy versions\n 346|- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\n 347|  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\n 348|  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\n...\n 370|  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n*371|  leg. Natural companion to IR-4's toolchain-version print step.\n 372|- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\n 373|  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\n 374|  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\n...\n 378|- **Size:** built.\n*379|- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\n 380|  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n 381|  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n 382|\n*383|### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n 384|- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n 385|- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\n 386|  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\n...\n 390|\n*391|### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\n 392|- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\n 393|- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\n 394|  as a column it makes the orphan-vs-own-shell call one glance.\n...\n 397|\n*398|### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\n 399|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\n 400|  releases#116\n 401|- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\n...\n 411|  The original rig mechanism remains unproven (old-mtime restoration or two target directories\n*412|  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\n 413|  register at the WEBSERVE close sweep.\n 414|  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\n 415|- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\n...\n 445|\n*446|### IR-13 — Test-soundness follow-ups from the uniform-table sweep\n 447|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\n 448|- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\n 449|  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\n...\n 456|\n*457|### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n 458|- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\n 459|  now sought directly when the entry ripens, not via board flag)\n 460|- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\n...\n 466|\n*467|#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\n 468|\n 469|Three people measuring \"the worktrees\" got three answers. None was wrong; they answered three\n 470|different questions, and nothing in the tree states which one is meant:\n...\n 487|\n*488|#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\n 489|\n 490|⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\n 491|a junction that a REGISTERED worktree uses as its `target/`:\n...\n 534|\n*535|#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\n 536|\n 537|Read-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\n 538|directory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\n...\n 544|\n*545|#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\n 546|\n 547|**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\n 548|scripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\n...\n 554|\n*555|#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n 556|\n 557|Classes B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\n 558|A, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\n...\n 574|  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\n*575|  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\n 576|  executed on the gater's own rigs:** evidence preserved FIRST\n 577|  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\n 578|  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\n...\n 597|  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\n*598|  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\n 599|  to sweep, not a norm.\n 600|- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\n 601|  class-A pool findings are armed hazards and do not wait for it.\n...\n 605|  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\n*606|  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\n 607|\n*608|### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\n 609|- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\n 610|- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\n 611|  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\n...\n 626|  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\n*627|  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\n 628|  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\n 629|  `broker_survived`: false in every killed round of the positive control, true in every healthy\n 630|  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\n...\n 634|  failed the discriminator question and does not support the kill read.** The kill read now rests\n*635|  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\n 636|  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\n*637|  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\n 638|  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\n 639|  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\n 640|  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\n...\n 671|  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\n*672|  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\n 673|  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\n 674|  is the claim that survives someone fixing this box; the sub-observation is what is actionable\n 675|  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\n 676|  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\n*677|  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\n 678|  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\n 679|  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\n 680|  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\n...\n 685|  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\n*686|  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\n 687|  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\n 688|  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\n 689|  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\n...\n 715|  triages). The family's host-INDEPENDENT claim\n*716|  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\n 717|  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\n 718|  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\n 719|  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\n...\n 725|\n*726|### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\n 727|- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\n 728|  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\n 729|  deployah's log read\n...\n 740|  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\n*741|  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\n 742|  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\n*743|- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\n 744|  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\n 745|- **Size:** small.\n 746|- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\n*747|  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\n*748|  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\n 749|  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\n 750|  at all rather than silently skipping it).\n 751|- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\n...\n 753|  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\n*754|  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\n 755|  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\n 756|  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\n 757|  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\n...\n 762|\n*763|### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n 764|- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n 765|  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\n 766|  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\n...\n 773|  teardown by this verdict · **Origin:** hertz\n*774|  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\n 775|  reproduction\n 776|- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\n 777|  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\n...\n 799|  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\n*800|  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\n*801|  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\n 802|  bare pid. Kill what you pinned, not the number it happens to hold.\n 803|- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\n 804|  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\n...\n 810|  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\n*811|  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\n 812|  The service outlives its daemon because `detached_no_inherit_env` spawns it\n 813|  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\n 814|  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\n*815|  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\n 816|  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\n 817|  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\n 818|  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\n 819|  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\n*820|  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\n 821|  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\n 822|  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\n 823|  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\n...\n 854|  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\n*855|  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\n 856|  same night — the third instance of that sentence tonight, this time inside our own instrument):\n 857|  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\n 858|  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\n*859|  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\n 860|  image, on this box. So the population assertion counts unreadable-path processes as their OWN\n 861|  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\n 862|  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\n 863|  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\n*864|  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\n 865|  stays open.\n 866|- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\n 867|  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\n...\n 875|  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\n*876|  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\n 877|  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\n*878|  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\n 879|  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\n 880|  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\n 881|  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\n...\n 905|  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\n*906|  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\n 907|  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\n 908|  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\n 909|  reach, not load-bearing. `unreadable` stays FATAL as ruled.\n...\n 911|  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\n*912|  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\n 913|  lane under the dispatch split; the two cross-ref, they do not merge.\n 914|- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\n 915|  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\n...\n 950|  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\n*951|  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\n 952|  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\n 953|  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\n*954|  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\n*955|  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\n 956|  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\n 957|  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\n 958|  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\n...\n 968|  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\n*969|  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\n 970|  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\n 971|  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\n 972|  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\n...\n 983|  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\n*984|  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\n 985|  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\n 986|  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\n 987|  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\n*988|  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\n 989|  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\n 990|  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\n 991|  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\n...\n 1047|\n*1048|### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\n 1049|- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\n 1050|  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\n 1051|  source same night.\n...\n 1076|\n*1077|### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\n*1078|- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\n 1079|  (hfenduleam, log kept); routed text, doyle-landed.\n 1080|- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\n 1081|  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\n...\n 1095|  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\n*1096|  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\n 1097|  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\n 1098|  the work. Exactly why the population gate exists rather than per-pid checks alone.\n 1099|- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\n...\n 1105|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*1106|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 1107|- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\n 1108|- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\n 1109|\n*1110|### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\n 1111|- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1112|  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\n 1113|  both mechanisms measured at the cut, neither cost this run anything because the driver caught\n...\n 1141|\n*1142|## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\n 1143|\n 1144|- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\n 1145|  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\n...\n 1147|\n*1148|## BUILT / RETIRED\n 1149|\n*1150|### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\n 1151|- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\n 1152|- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\n 1153|  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\n...\n 1160|- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\n*1161|  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\n 1162|  GREEN; main ff'd to a5042ec.\n 1163|- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\n 1164|  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\n...\n 1166|  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\n*1167|  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\n 1168|  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\n*1169|  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\n 1170|  test-side rather than product-side. A recurrence must discriminate between them, not assume\n*1171|  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\n*1172|  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\n 1173|  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\n*1174|  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\n 1175|  healthy runs and discriminates nothing.)\n 1176|\n*1177|### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\n 1178|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\n 1179|  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\n 1180|  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\n...\n 1195|\n*1196|#### THE MECHANISM (measured, both ends)\n 1197|\n 1198|**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\n 1199|never emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\n...\n 1227|\n*1228|#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\n 1229|\n 1230|**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\n 1231|Both members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\n...\n 1253|\n*1254|#### THE ONE CI-SIDE MEMBER THAT IS REAL\n 1255|\n 1256|`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\n 1257|and `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\n...\n 1264|Somebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\n*1265|the comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\n 1266|would find it.\n 1267|\n*1268|#### POPULATION\n 1269|\n 1270|**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\n 1271|`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\n...\n 1276|| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\n*1277|| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\n 1278|| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\n 1279|\n 1280|**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\n...\n 1324|\n*1325|#### REMEDY SHAPE (not ruled)\n 1326|\n 1327|The distinction that matters is location vs. build:\n 1328|\n...\n 1347|\n*1348|#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\n 1349|- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\n 1350|  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\n 1351|  here so the next clean rig does not re-diagnose them as code reds.\n...\n 1391|\n*1392|### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\n 1393|- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\n 1394|  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\n 1395|- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\n...\n 1403|  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\n*1404|  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\n 1405|- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\n 1406|  vars, so this fires for every builder on a perched session and for nobody running from a bare\n 1407|  shell — which is precisely the split between how builders work and how CI runs.\n...\n 1413|\n*1414|### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\n 1415|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\n 1416|- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\n 1417|  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\n...\n 1438|\n*1439|### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\n 1440|- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\n 1441|  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\n 1442|  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\n...\n 1444|  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\n*1445|  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\n 1446|  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\n 1447|  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\n 1448|  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\n...\n 1450|  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\n*1451|  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\n 1452|  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\n 1453|  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\n 1454|  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\n 1455|  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\n*1456|  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\n 1457|  NOT folded into that lane (doyle ruling, same day) and filed instead.\n 1458|- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\n*1459|  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\n 1460|  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\n 1461|  where it lives — the module already decided that these returns are worth reading.\n*1462|- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\n 1463|  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\n 1464|  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\n 1465|  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\n...\n 1468|  second ruling gets smuggled into a lane scoped to one.\n*1469|- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\n 1470|  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\n*1471|  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\n 1472|  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\n 1473|  its direct process in the same breath, which is what makes the middle hop dead by construction\n 1474|  there. **That is the first thing to check, and it is not assumed.**\n*1475|- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\n 1476|  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\n 1477|  cost-of-loss question is answered for this subject.\n 1478|\n*1479|### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\n 1480|- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\n 1481|  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\n 1482|  assembled.\n...\n 1506|- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\n*1507|  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\n 1508|  different mechanism, which is why these are two entries and not one.\n 1509|- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\n 1510|  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\n 1511|  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\n*1512|  The same tool gap acquitted [[IR-21]]'s golden question the same day.\n 1513|- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\n 1514|  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\n 1515|  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\n...\n 1521|  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\n*1522|- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\n 1523|  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\n 1524|  rule (gate with nextest); medium to harden the three marginal tests.\n 1525|\n*1526|### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n 1527|- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n 1528|  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\n 1529|  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\n...\n 1545|  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\n*1546|  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\n 1547|  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\n 1548|  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\n 1549|  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\n...\n 1589|  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\n*1590|  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\n 1591|  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\n 1592|  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\n 1593|  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\n...\n 1607|  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\n*1608|  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\n*1609|  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\n*1610|  kept out of [[IR-16]] — folding it in settles its question in passing.\n 1611|- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\n 1612|  **Size:** small once the remedy question is settled.\n 1613|- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\n...\n 1637|  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\n*1638|  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\n 1639|  \"the stamp arm handles it\" is false for most claims that actually exist.\n 1640|- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\n 1641|  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\n...\n 1672|  construction and re-measure, but expect the geometry to usually hold.\n*1673|- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\n 1674|  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\n 1675|  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\n 1676|  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\n...\n 1694|  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\n*1695|  lane as or beside the IR-26 remedy. Size: small.\n 1696|\n*1697|### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\n 1698|- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\n*1699|  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\n 1700|- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\n 1701|  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\n 1702|  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\n...\n 1730|\n*1731|### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\n 1732|- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n 1733|  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\n 1734|- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\n...\n 1745|\n*1746|### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\n 1747|- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\n 1748|  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\n 1749|  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\n...\n 1808|\n*1809|### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\n 1810|- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\n 1811|  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\n 1812|  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\n...\n 1819|  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\n*1820|  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\n 1821|  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\n 1822|  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\n 1823|  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\n...\n 1834|  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\n*1835|  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\n 1836|  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\n 1837|  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\n 1838|  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\n...\n 1927|  start — the claim verb is the natural seat (print box free + du of known lane targets at\n*1928|  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\n 1929|  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\n 1930|  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\n 1931|  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\n...\n 2034|  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\n*2035|  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\n 2036|  class recurring, left for retry rather than forced.\n 2037|\n 2038|- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\n...\n 2068|\n*2069|### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\n 2070|- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\n 2071|  the builder to the gater deliberately — register shape is doyle's to own.\n 2072|- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\n...\n 2095|\n*2096|### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\n 2097|- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\n 2098|- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\n 2099|  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\n...\n 2108|  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\n*2109|  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\n 2110|- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\n 2111|  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\n 2112|  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\n...\n 2134|- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\n*2135|  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\n 2136|  (b) raise the main thread stack for the binary (build config), buying headroom without\n 2137|  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\n 2138|  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\n...\n 2143|\n*2144|### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\n 2145|- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\n 2146|  characterized same day by hertz from retained logs, ownership falsified by todlando.\n 2147|- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\n...\n 2164|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2165|  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n 2166|- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\n 2167|- **Size:** small.\n 2168|\n*2169|### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\n 2170|- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\n 2171|- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\n 2172|  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\n...\n 2174|  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\n*2175|  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\n 2176|  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\n 2177|  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\n 2178|  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\n...\n 2200|- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n*2201|  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\n 2202|- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\n 2203|- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\n 2204|\n*2205|### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n 2206|- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n 2207|  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\n 2208|  item-2 sweep ruling; doyle ruled file-don't-sweep.\n...\n 2224|  is gone.\n*2225|- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\n*2226|  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\n 2227|- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\n 2228|- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\n 2229|  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\n 2230|  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\n*2231|  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\n 2232|  rides the same lane.\n 2233|- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\n 2234|  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\n...\n 2238|  generated targets as absent before generation. Its small refactor + unit keeps source and\n*2239|  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\n 2240|\n*2241|### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\n 2242|- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\n 2243|  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n 2244|  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n...\n 2258|  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\n*2259|  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\n 2260|  gate itself.\n 2261|- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT","truncated":true,"truncatedBy":"bytes","totalLines":852,"totalBytes":65145,"outputLines":675,"outputBytes":51167,"lastLinePartial":false,"firstLineExceedsLimit":false},"meta":{"truncation":{"direction":"head","truncatedBy":"bytes","totalLines":852,"totalBytes":65145,"outputLines":675,"outputBytes":51167,"shownRange":{"start":1,"end":675},"nextOffset":676}}},"isError":false,"timestamp":1789094598952}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_nNCpgWzFRDIoXf8Idjxdv1Qn|fc_074aee81620ae383016aa36acb3e8887d19c44153f2e6a4fb0","toolName":"read","startedAt":"2026-09-11T02:43:25.670Z","args":{"path":"docs/INFRA-REGISTER.md:180-607"},"intent":"Reading early register entries"},"id":"9726b086","parentId":"d21835c4","timestamp":"2026-09-11T02:43:25.670Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_NC10ZoSYrhknngv0yv1qrYx6|fc_074aee81620ae383016aa36acb3e9c87d1878d86623cf307aa","toolName":"read","startedAt":"2026-09-11T02:43:25.670Z","args":{"path":"docs/INFRA-REGISTER.md:608-1047"},"intent":"Reading middle entry bodies"},"id":"c2d3588f","parentId":"9726b086","timestamp":"2026-09-11T02:43:25.670Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_YKT2rLkPxdTIAwRkHbjRl6sO|fc_074aee81620ae383016aa36acb3ea487d190c3b06b732b96c9","toolName":"read","startedAt":"2026-09-11T02:43:25.670Z","args":{"path":"docs/INFRA-REGISTER.md:2241-2765"},"intent":"Reading remaining assigned boundaries"},"id":"2a251661","parentId":"c2d3588f","timestamp":"2026-09-11T02:43:25.670Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_L1Fesn2YMj3f3ARzurzzApDN|fc_074aee81620ae383016aa36acb3ea887d19e7be88b1c372c2d","toolName":"read","startedAt":"2026-09-11T02:43:25.670Z","args":{"path":"docs/INFRA-REGISTER.md:1048-1696"},"intent":"Reading rig and ownership entries"},"id":"2241b386","parentId":"2a251661","timestamp":"2026-09-11T02:43:25.670Z"}
{"type":"message","id":"a33742a1","parentId":"2241b386","timestamp":"2026-09-11T02:43:25.670Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_nNCpgWzFRDIoXf8Idjxdv1Qn|fc_074aee81620ae383016aa36acb3e8887d19c44153f2e6a4fb0","name":"read","arguments":{"i":"Reading early register entries","path":"docs/INFRA-REGISTER.md:180-607"},"intent":"Reading early register entries"},{"type":"toolCall","id":"call_NC10ZoSYrhknngv0yv1qrYx6|fc_074aee81620ae383016aa36acb3e9c87d1878d86623cf307aa","name":"read","arguments":{"i":"Reading middle entry bodies","path":"docs/INFRA-REGISTER.md:608-1047"},"intent":"Reading middle entry bodies"},{"type":"toolCall","id":"call_YKT2rLkPxdTIAwRkHbjRl6sO|fc_074aee81620ae383016aa36acb3ea487d190c3b06b732b96c9","name":"read","arguments":{"i":"Reading remaining assigned boundaries","path":"docs/INFRA-REGISTER.md:2241-2765"},"intent":"Reading remaining assigned boundaries"},{"type":"toolCall","id":"call_L1Fesn2YMj3f3ARzurzzApDN|fc_074aee81620ae383016aa36acb3ea887d19e7be88b1c372c2d","name":"read","arguments":{"i":"Reading rig and ownership entries","path":"docs/INFRA-REGISTER.md:1048-1696"},"intent":"Reading rig and ownership entries"},{"type":"toolCall","id":"call_5kbTCbZNT8Zx2BJWA2M9Yx28|fc_074aee81620ae383016aa36acb3eac87d191d34791ebed08f3","name":"read","arguments":{"i":"Reading pool and golden entries","path":"docs/INFRA-REGISTER.md:1697-2240"},"intent":"Reading pool and golden entries"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":15094,"output":179,"cacheRead":10112,"cacheWrite":0,"totalTokens":25385,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094599003,"responseId":"resp_074aee81620ae383016aa36ac4ef5c87d1ad7fc123ab765084","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_074aee81620ae383016aa36acb3e8887d19c44153f2e6a4fb0","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading early register entries\",\"path\":\"docs/INFRA-REGISTER.md:180-607\"}","call_id":"call_nNCpgWzFRDIoXf8Idjxdv1Qn","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36acb3e9c87d1878d86623cf307aa","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading middle entry bodies\",\"path\":\"docs/INFRA-REGISTER.md:608-1047\"}","call_id":"call_NC10ZoSYrhknngv0yv1qrYx6","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36acb3ea487d190c3b06b732b96c9","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading remaining assigned boundaries\",\"path\":\"docs/INFRA-REGISTER.md:2241-2765\"}","call_id":"call_YKT2rLkPxdTIAwRkHbjRl6sO","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36acb3ea887d19e7be88b1c372c2d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading rig and ownership entries\",\"path\":\"docs/INFRA-REGISTER.md:1048-1696\"}","call_id":"call_L1Fesn2YMj3f3ARzurzzApDN","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36acb3eac87d191d34791ebed08f3","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading pool and golden entries\",\"path\":\"docs/INFRA-REGISTER.md:1697-2240\"}","call_id":"call_5kbTCbZNT8Zx2BJWA2M9Yx28","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":6663.664400000125,"ttft":6601.207200000063,"completedAt":1789094605668,"contextSnapshot":{"promptTokens":25206,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_5kbTCbZNT8Zx2BJWA2M9Yx28|fc_074aee81620ae383016aa36acb3eac87d191d34791ebed08f3","toolName":"read","startedAt":"2026-09-11T02:43:25.670Z","args":{"path":"docs/INFRA-REGISTER.md:1697-2240"},"intent":"Reading pool and golden entries"},"id":"06552719","parentId":"a33742a1","timestamp":"2026-09-11T02:43:25.670Z"}
{"type":"message","id":"4a0b0bfe","parentId":"06552719","timestamp":"2026-09-11T02:43:25.697Z","message":{"role":"toolResult","toolCallId":"call_nNCpgWzFRDIoXf8Idjxdv1Qn|fc_074aee81620ae383016aa36acb3e8887d19c44153f2e6a4fb0","toolName":"read","content":[{"type":"text","text":"\n### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n  success/NO-REPLY/UNAVAILABLE, always exit 0 — instrument, not gate). NOTE `bf8c4a2` is NOT\n  single-purpose: it also corrects the free-space preflight floor read\n  (`REQ-CI-FREE-SPACE-PREFLIGHT`, the ci-runner-has-no-warm-target shape) — no 1:1 commit→IR map\n  for this commit · **Origin:** golden/bench-wiring red triage 2026-08-02 (ex releases#126)\n- **What/why:** the shared-runner quiet predicate (zero non-terminal runs + no local\n  cargo/rustc/nextest by parent chain) is process-shaped; both axes passed on a box whose only\n  link was degrading (321s for a 1s checkout, bidirectional 10s QUIC dial timeouts). A tailscale\n  RTT probe to the peer box before two-host rendezvous, carried in the bench ledger, would have\n  called run 30771155390's red in seconds. Evidence: the arm-1 count table (PUMP_PEER_FAIL\n  a 0→3→0, b 8→22→8 across green/red/rerun).\n- **Permanent, not stopgap:** operator-confirmed 2026-08-02 that kitsubito cannot be provided\n  ethernet — wifi-only indefinitely, so the link cannot be hardened and the predicate must see\n  link health.\n- **Ripe when:** next CI-touching wave, or the next network-shaped golden red — whichever first.\n- **Size:** small (one probe step + ledger row + predicate doc).\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\n  #132 and **DISPATCHED to hertz 2026-08-03** (direct brief; the register is the spec, there is no\n  board issue). Leaves the register only when the lane lands or the entry is retired.\n- **FIRST FIELD USE, and it DISCRIMINATED (2026-08-04, golden 30873007187 attempt 1):** the probe\n  (landed via the rider lane, riding `4b37512`) read 4–7ms RTT healthy on both twohost legs\n  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\n  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\n  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\n  could not make.\n\n### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\n- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\n  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\n  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\n  discarded with the leg). Disk: OFF target 7.49 GB vs ON 11.40 GB = 3.91 GB / 34.3% saved\n  (smaller than the entry's 5.65 GB cold figure). Timing NOT causal-quality: sequential runs in\n  one persistent workspace let OFF inherit ON's cache (order contamination dominates the\n  apparent OFF speedups); Windows build-spt-bin +3.8%, Linux -5.1%. Retire reasoning: the\n  DECISION is answerable now — OFF produced no green golden, the timing question needs 4+\n  counterbalanced fresh-cache windows to answer cleanly, and the disk motivation has weakened\n  (box at ~148 GB free under the teardown discipline; the LNK1318 pressure era predates it).\n  Runs/artifacts preserved on the record. Reopen only if runner disk pressure returns as a\n  recurring floor-class red.\n- **Was:** open · **Origin:** #103/#108 bench-wiring lane 2026-08-02 (ex releases#127)\n- **What/why:** the #103 measurement (−29.8% wall, −5.65 GB/target, n=3) is COLD-build only.\n  Golden's runner `_work` target persists warm, where incremental is exactly what keeps it cheap;\n  CARGO_INCREMENTAL=0 was applied only to the genuine cold build (n1-gate pinned old-broker\n  cache) + local rig recipes (docs/GOLDEN-CI.md). Open question: does incremental still pay on\n  the warm runner, weighed against 5.65 GB/target on a box with LNK1318 free-space history?\n- **Method (hertz):** one full golden each way on a quiet box, outside a milestone, compared\n  per-step from the bench ledger.\n- **Ripe when:** a quiet between-milestone window with no queued lanes (the measurement burns\n  two golden windows).\n- **Size:** medium (two proving runs + verdict + possible leg flips).\n\n### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\n- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\n- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\n  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\n  broker-net workers stay quiescent across repeated endpoint create/destroy churn.\n- **Design constraint (pre-ruled):** assert on WAKEUP RATE / voluntary ctxt-switch delta over\n  the churn window, NOT %CPU — CPU thresholds flake under CI load; the defect signature\n  (~100 Hz per orphan loop) is load-independent. Mint the REQ at activation.\n- **Near-product:** this is runtime-defect visibility, the most product-adjacent entry here —\n  a candidate rider on any daemon-lifecycle milestone.\n- **Ripe when:** the next milestone touching spt-net endpoint lifecycle or daemon supervision.\n- **Size:** medium (churn harness + counter plumbing + flake-safe assertion).\n\n### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n- **What/why, three parts that land together:**\n  1. **xtask check leg:** assert Cargo.lock resolves swarm-discovery to git rev\n     `89a2200d54a4e3cab2f46cc75ebff49a1fb07614` while the patch is load-bearing; the check's\n     message states its own drop condition (upstream ships a post-PR#27 release AND iroh's pin\n     reaches it). Without it, stanza removal or a routine iroh bump silently returns the lock to\n     the spinning crate and nothing reds.\n  2. **Procedure rule for lock-touching lanes** (docs): targeted `cargo update -p <crate>` only,\n     never full re-resolve; count changed `[[package]]` blocks AND diff per-block edges (set-identical\n     hid 8 windows-sys edge movers at acaaa4f); two resolutions disagreeing = toolchain drift —\n     stop and compare against CI before shipping either lock; hand-edited lock acceptable iff\n     `cargo check --workspace --locked` passes.\n  3. **Toolchain-version print step in golden** (cargo/rustc versions, both OS legs): the acaaa4f\n     comparison against CI was impossible because no run log prints a version. One-grep audit.\n- **Ripe when:** next CI-touching wave; part 1 sooner if any iroh bump is proposed.\n- **Size:** small-medium (one xtask leg, one docs section, one workflow step).\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\n  #132 and **DISPATCHED to hertz 2026-08-03** (all three parts land together).\n\n### IR-5 — Shared nextest summary parser\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\n  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\n  singular-aware parser (single-source discriminant) for every consumer of nextest summaries.\n- **Ripe-when REWORDED 2026-08-04 (todlando audit): the old trigger was unfireable as worded.** At\n  `b7b00c3` the in-tree population of nextest-SUMMARY parsers is ZERO — the two scripts that read\n  nextest output (`g6-curve.ps1:83-90` per-test lines, `g6-postbounce.ps1:44` display-only grep)\n  neither parse counts nor carry the defect, so \"next wave touching any gate script that reads\n  nextest output\" could fire on a non-defective script while the real population (agent-authored\n  throwaway parsers, which never enter the tree) stays out of reach. New trigger: **the next time\n  anyone — agent or lane — needs a nextest summary COUNT**, the shared parser is built FIRST and the\n  need consumes it; rig briefs should name it so throwaways stop being authored.\n- **Size:** small.\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\n  known to be building** — an unreported condition leaves this entry open, not landed.\n\n### IR-6 — Membership logging on subnet gates\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\n- **What/why:** counts beside results, membership beside counts — gate logs that state a count\n  without naming the population keep producing unreadable reds. Standardize membership\n  enumeration in gate output.\n- **Ripe when:** next wave touching gate scripts / CI legs that report counts.\n- **Size:** small.\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\n  known to be building** — an unreported condition leaves this entry open, not landed.\n\n### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\n- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\n- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\n  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\n  key); the leaked pair holds target/debug/spt.exe and kills every golden job reaching the notify\n  relink. CI reaps as tourniquet (fa6e597); in-job test launch is the fix.\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\n- **Size:** medium.\n\n### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\n  (ex releases#122)\n- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\n  unreadable, so the survivors count can report clean while a holder lives. Needs a positive control\n  / explicit unreadable bucket in the verdict line (unreadable_path count exists; the ZERO must\n  refuse when it is nonzero).\n- **Defining specimen (golden 30782259675, hfenduleam test job, 2026-08-03):**\n  `CI-REAP summary: killed=5 kill_failed=1 scoped_survivors=0` — an admitted kill failure printed\n  beside a zero-survivors claim on the same verdict line. The held image surfaced one step later:\n  run-scoped tmp cleanup denied 5/5 attempts on `...\\relshell\\svcmock.exe` (2nd appearance of the\n  svcmock hold; 1st @7a3c08c, pre-kill-auth). hertz's addendum: an image-held survivor also blocks\n  WRITES to the exe path — the same class manufactures build/relink access-denied reds that mask as\n  build problems, not just cleanup warnings. Not per-run: the same-sha green rerun's leg read\n  `kill_failed=0 scoped_survivors=0` throughout (hertz, 30784469908) — intermittent sighting,\n  second of its class, not a deterministic fixture property.\n- **The Linux twin is strictly worse (todlando audit 2026-08-04, vs `b7b00c3`):** `reap-census.sh`\n  has NO `kill_failed` anywhere (0 occurrences vs 2 in the `.ps1`) — its kill loop increments\n  `killed` only in the success branch with no else, so a failed kill increments nothing and prints\n  nothing. The specimen that made this class VISIBLE on Windows would be INVISIBLE on Linux.\n  Population precision so this is not overclaimed: ESRCH is benign (already gone; the kill-time\n  re-resolve makes it the common case); the vanishing case is EPERM against another account's\n  process. The `.sh` `scoped_survivors` DOES come from a post-reap census re-measure, so survivors\n  are measured — the hole is failed kills and the unreadable bucket, not the survivor count.\n  Windows precision from the same audit: `unreadable_path` IS on the CI-CENSUS line (:157) but the\n  CI-REAP verdict line (:243, :246) still carries only killed/kill_failed/scoped_survivors — the\n  zero still does not refuse, exactly this entry's ask.\n- **Built evidence:** both verdict lines now carry `unreadable_path`; any nonzero unreadable\n  family population renders `scoped_survivors=UNPROVEN` rather than a false zero. Linux also\n  counts and reports failed kills. The shared predicate is mutation-pinned by\n  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\n- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\n- **Size:** small.\n\n### IR-9 — Golden boxes run different clippy versions\n- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\n  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\n  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\n  the toolchain print (`8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT`) exercised both legs of\n  golden run 30971976024 (`test` jobs 92198170694/92198170700 — scoped to `test`, not n1-gate;\n  grep token `TOOLCHAIN `). Runner-account facts, read by doyle 2026-08-05: hfenduleam\n  `cargo/rustc 1.93.0` + `clippy 0.1.93`, kitsubito `cargo/rustc 1.96.0` +\n  `clippy 0.1.96`; `stable (default)` on both proved the skew would otherwise decay silently.\n- **RULING (doyle, 2026-08-05, on the runner-account facts as the 2026-08-03 hold required):**\n  (1) align-by-event REJECTED — with both boxes on unpinned stable, alignment decays silently;\n  the skew is a mechanism and the fix must be one too. (2) declare-one-leg REJECTED as the\n  terminal state — it repairs lint authority but leaves the legs resolving with different cargo\n  versions, and the acaaa4f lock-attribution question this family started from is a resolver\n  question. (3) **PIN IN-REPO: `rust-toolchain.toml`, `channel = \"1.96.0\"`** — both runner\n  accounts already resolve their toolchain through rustup (witnessed by the `active=` line), so\n  the pin self-applies with zero per-box maintenance, and the judge's version becomes a property\n  of the TESTED SHA — the same object golden CI already guarantees. Bumps become reviewed lane\n  commits, tested by the golden run they ride; the hfenduleam leg proves 1.96.0 on the pin\n  lane's own run. (4) INTERIM until the pin lands: kitsubito's clippy leg is AUTHORITATIVE for\n  lint disputes — not because newer is stricter (skew direction stays unasserted) but because\n  1.96 is the version the pin names, so interim and terminal rulings agree.\n  · **Origin:** BAROMETER (ex releases#121); re-confirmed on the #125 fix lane\n  (builder's Windows clippy vs kitsubito's rust-1.96.0 lints); see [[CI-RIDER LANE STATE]]\n- **What/why:** a Windows-clean lane can land a lint that only reds on the Linux leg — toolchain\n  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n  leg. Natural companion to IR-4's toolchain-version print step.\n- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\n  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\n  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\n  and `rustup show active-toolchain` through PATH; pool ownership keys on source-tree/lane identity,\n  not rustup installation paths. `release.yml`'s `$HOME/.cargo/bin/mdbook` is an installed tool\n  location, not a Rust toolchain selector; its builds still invoke PATH-resolved `cargo`.\n- **Size:** built.\n- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n\n### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\n  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\n  runbook + scripts rather than living in memory.\n- **Ripe when:** next gate-runbook/docs wave.\n- **Size:** small (docs + gate-script checklist).\n\n### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\n- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\n- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\n  as a column it makes the orphan-vs-own-shell call one glance.\n- **Ripe when:** any rig-tooling wave; trivial rider.\n- **Size:** tiny.\n\n### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\n  releases#116\n- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\n  premise was a rig artifact, not a reproduced product hole. At `9f809f8d`, in isolated Linux\n  worktree `hertz-ir12-mutation`, build `spt` once, mutate only its root CLI help string, do not\n  rebuild, then run `cargo run -p xtask -- check` alone: **exit 1**, combined output **3435 bytes**,\n  ending `xtask check: docs-site/src/cli/reference.md drifted from the binary's --help` (followed\n  by the regeneration instruction). The binary hash changed during check; the stale input was\n  rebuilt by `gen(true)` → `spt_bin` → `cargo build -q -p spt --bin spt` before comparison.\n  `CARGO_TARGET_DIR=UNSET`, `SPT_BLESS=UNSET`; Cargo's metadata target and xtask's read path both\n  resolve to this worktree's `target/debug/spt`. Source mutation was restored byte-for-byte.\n  Acceptance files: `~/spt-evidence/ir12-mutation-20260906/{check.exit,check.raw,env.txt}` on kitsubito.\n  The original rig mechanism remains unproven (old-mtime restoration or two target directories\n  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\n  register at the WEBSERVE close sweep.\n  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\n- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\n  holds — `xtask check` does not regenerate-and-compare the schema — but staleness does NOT \"ship a\n  wrong public contract silently\": `checked_in_schema_is_current`\n  (crates/spt-runtime/src/manifest.rs:2363, `int->REQ-DOCS-5`, landed `be4e46c` 2026-06-05, BEFORE\n  this entry's last sweep — docs lagging code) asserts full content equality of the checked-in\n  `manifest.schema.json` against what the derives generate, CRLF-normalised, `SPT_BLESS=1` as the\n  regenerate path. It is REACHED (lib unit test; ci.yml:114 runs `-E kind(lib)+kind(bin)` on push;\n  golden Phase A re-runs the workspace). Exactly ONE schema file exists in the tree; `docs_bundle`\n  (xtask main.rs:609-618) COPIES it at build time, so no second stored copy can drift. Chain closes:\n  derives → checked-in (unit-gated) → bundle (copied, not stored).\n- **What remains open, and the entry narrows to it:** `check_llms_links` (xtask main.rs:521)\n  hardcodes `manifest.schema.json` and `llms-full.txt` as always-existing, so the link check can\n  never see them MISSING — a blind arm, not a drift hole.\n- **The discrimination is now PROVEN, not presumed (todlando 2026-08-04, burn-the-build arms in\n  isolated worktree ir12-mutation @`11169c1`, env verified clear of `SPT_BLESS` FIRST — set, the\n  test short-circuits into a WRITE and a mutation arm silently self-heals green; that env check is\n  now part of the rig recipe):** arm 0 baseline PASS by NAME (1 test run); arm 1 semantic single\n  byte (title `…manifest`→`…manifesX`, length unchanged, scripted edit with match-count refusal)\n  REDS at manifest.rs:2374 exit 100 — \"manifest.schema.json drifted from the derives — regenerate\n  with SPT_BLESS=1\", with the mutated token appearing exactly once in 96,248 B of assertion output\n  so the byte is provably the only delta; arm 2 whitespace-only (CRLF→LF, 1014 endings) PASSES —\n  and arm 0 is itself the stronger normalisation proof, since the on-disk file is CRLF while the\n  generated string is LF, so an unmutated PASS is only possible because the test normalises; arm 3\n  restore re-measured PASS at the pristine sha256. `checked_in_schema_is_current` is a REAL gate.\n- **Built evidence:** `check_llms_links` resolves stored root assets to their\n  real source paths and runs the `llms-full.txt` generator instead of returning\n  hardcoded `true`. A unit cell proves a missing schema and install script are\n  refused, then accepted only after the real source file exists.\n- **Ripe when:** next xtask/docs-gate wave (now sized to the blind arm only).\n- **Size:** tiny.\n\n### IR-13 — Test-soundness follow-ups from the uniform-table sweep\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\n- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\n  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\n  `HoldRelease`); changing held+release to start reds on that arm. Pure walk tests cover all four\n  `QuiesceOutcome` arms and all five `EffectKind` arms; making `KillUnconfirmed` clear or\n  `Registry` ephemeral reds independently. The join test now binds all six `JoinFail` variants to\n  both hold retention and the emitted failure class/retry payload; misclassifying `WrongCode`\n  reds. The access candidates had already landed in the W4 follow-up and its dead-seam removal,\n  so the hygiene lane does not manufacture a second test vocabulary beside them.\n\n### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\n  now sought directly when the entry ripens, not via board flag)\n- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\n  reap recipe + a hygiene rule for lane close-out. Teardown discipline per docs and memory (classify\n  before delete, outbound links first).\n- ⚠ **The header of this entry previously read \"14 untracked orphan dirs vs 25 git-tracked\". Both\n  numbers were stale AND UNDATED**, so nobody could tell drift from error. Every count below is dated\n  and carries its command.\n\n#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\n\nThree people measuring \"the worktrees\" got three answers. None was wrong; they answered three\ndifferent questions, and nothing in the tree states which one is meant:\n\n| answer | question it actually answers | command |\n|---|---|---|\n| **73** | all ENTRIES under `.worktrees/` | `ls -A .worktrees \\| wc -l` |\n| **52** | DIRECTORIES under `.worktrees/` | `ls -dA .worktrees/*/` |\n| **38** | registered worktrees INCLUDING the root checkout | `git worktree list` |\n| **37** | registered worktrees under `.worktrees/` | above, minus the root |\n\n**52 − 37 = 15 unregistered directories.** The 73 − 52 = **21 loose FILES** are covered below.\n\n**A count is only as good as its question.** Treat \"how many worktrees\" as under-specified until the\nanswer names its population — the same defect that made a naive `grep -rn` from the project root\ninflate a code count by **34.9×** (426 tracked `.rs` vs 14865 on disk excluding all `target/`), and\nmade that grep run past 120s while `git ls-files | xargs grep` returned instantly. **Scan roots and\npopulation definitions are the same class of error.** Use `git grep` / `git ls-files` for tracked\ncontent and `git worktree list --porcelain` for worktrees.\n\n#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\n\n⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\na junction that a REGISTERED worktree uses as its `target/`:\n\n| dir | inbound junction from | size | claim |\n|---|---|---|---|\n| `gate-target` | assembly-doorbell, doorbell-w1, doorbell-w2, doorbell-w3 | EMPTY | none |\n| `gate-target-render` | golden-render | 5.84 GB | `POOL-OWNER.json` → golden-render |\n| `gate-target-w4doc` | w4-cli-doc | 7.36 GB | none |\n\n**These are exactly the directories that read as obviously junk** — no `.git`, no source, leftover\nnames — and deleting one destroys a registered worktree's build pool and leaves a dangling junction.\n**Polarity was checked BEFORE classification, which is what caught it:** all 15 top-level dirs are\nREAL directories, none is itself a reparse point; the six junctions are **INBOUND**, at\n`<registered-worktree>/target`. See [[worktree-target-junction]], [[gate-worktree-target-disk]].\n\nTwo findings inside class A, neither of them a deletion question:\n- **`gate-target` has FOUR registered trees junctioned into ONE pool, with no `POOL-OWNER.json` at\n  all** — so nothing would refuse a second LIVE lane there. That is releases#103's exact hazard\n  sitting armed. The pool is also empty: someone reclaimed it and left four junctions aimed at a hole.\n- **`gate-target-render`'s `POOL-OWNER.json` carries only `owner_tree` and `written_by` — no pid and\n  no birth stamp.** A claim that cannot distinguish a live lane from a finished one is missing the one\n  property the claim mechanism exists to provide.\n\n**CLASS B — EMPTIED SKELETONS, ONE UNIFORM SHAPE.** 8 dirs, **0 files**: `acl-core`, `engine-room`,\n`ff-fastfollow`, `gate-23d5ceb`, `gate-ff`, `golden-a`, `golden-b`, `w2b-sender-stamp`. Every one is\nexactly `crates/spt-daemon/` and nothing else. **Eight independent removals stopping at the SAME\nrelative path is a mechanism, not litter.**\n\n**MECHANISM CORROBORATED LIVE, 2026-08-03:** a read-only PEB sweep of process CWDs during a running\n`spt-daemon` suite found ~20 processes — `spt_daemon-<hash>` test harnesses, `PING`, `cmd` — whose\nCWD was **exactly `<worktree>/crates/spt-daemon/`**, the precise path all eight skeletons froze at. A\n`git worktree remove` racing a straggler there deletes everything else and leaves that chain pinned.\nThe processes churn fast (all 17 sampled pids were gone within 30s, one already showing **pid reuse**\n— see [[pid-reuse-across-reboot]] for why a pid alone is never an identity), so the pin is a race, not\na steady state, and it recurs on every daemon-suite worktree.\n\n**CLASS C — FULLY EMPTY, no inbound junction.** 3 dirs, 0 bytes: `gate-41`, `gate-559632e`,\n`release-runbook-main-advance`. Class B with even the chain gone.\n\n**CLASS D — DELIBERATE SCRATCH, NOT RESIDUE.** 1 dir, 12 files, 50 KB: `_patches` — three `.patch`\nfiles with their `.untracked` manifests, plus `ir18-gate-logs/`. Modified the day before the audit,\ni.e. someone's working state.\n\n3 + 8 + 3 + 1 = 15.\n\n#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\n\nRead-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\ndirectory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\nrigs at the time. So removal of B and C would succeed today; nothing is retrying it.\n\n⚠ **The sweep read 412 of 593 processes; 181 were unreadable** (elevated/system, no\n`PROCESS_VM_READ`). The no-pin result therefore holds over the READABLE population only. Cheap to\nre-run elevated before acting — [[absence-needs-sibling-probe]].\n\n#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\n\n**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\nscripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\ndeclared `.worktrees/` a log drop; it became one.** Same class as the memory index: a shared location\nwith no stated contract accumulates whatever anyone puts there, and **the first person to tidy it\ncannot tell residue from someone's working state** — class D is that risk already realised. The\nhygiene rule this entry owes should name where gate logs and rig scripts belong, not only how to reap\nworktrees.\n\n#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n\nClasses B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\nA, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\nyou at the wrong target: on the audit date, free space was **12.5 GB against the 32 GB golden floor**\n([[free-space-floor-blocks-golden]]) while the two largest pools on the box were `gate-ec5f38a/target`\n(14.33 GB) and `gate-main/target` (28.12 GB) — **both REGISTERED, so both outside the orphan\npopulation entirely.** The disk question and the orphan question have different populations; answering\none correctly says nothing about the other.\n\n- **AUDIT EXECUTED 2026-08-30 (doyle, the v0.66.0→NOW-SIGNAL between-milestone window; full\n  output `wt-census-2026-08-30.txt` in the session scratchpad, method = this entry's own):**\n  four answers BEFORE the sweep: 85 entries / 85 dirs / 76 registered incl root / 75 under\n  `.worktrees` → 10 unregistered, 0 loose files (the 21 loose files of 08-03 are gone).\n  **The 08-03 headline populations have INVERTED:** zero pools and zero junctions exist under\n  `.worktrees` at all (every registered tree reads `target=none`; the reparse sweep found no\n  inbound junction) — class A is EMPTY, so the armed pool hazards this entry named are\n  currently unpopulated. Unregistered classified: 4 fully-empty (C), 3 `crates/spt-daemon`\n  skeletons (B — the mechanism's fingerprint again), `_patches` (D, kept — working scratch),\n  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\n  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\n  executed on the gater's own rigs:** evidence preserved FIRST\n  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\n  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\n  belongs to hertz's lane and was NOT touched beyond the read-only copy), 16 pinning conhosts\n  killed by pid after a fresh probe, 9 dead rigs removed. AFTER: **76 dirs = 75 registered +\n  `_patches`, fully reconciled; zero unexplained entries, zero pins.** Reclaim was ~38MB —\n  reconfirming this entry's arithmetic that the orphan sweep is hygiene, not a disk remedy.\n  Landed-classification caveat: `git cherry` patch-id reads conflict-resolved picks\n  as UNLANDED (emit-single-write, fix-206/208/209 all show UNLANDED with shipped content), so\n  the census's landed column is a datum, never a reap authorization.\n- **HYGIENE RULE (the text this entry owed, written 2026-08-30 while the loose-file population\n  is zero — the rule exists BEFORE it refills):** `.worktrees/` holds exactly two kinds of\n  entry: **registered worktrees** and **`_patches/`** (the one declared scratch location).\n  Nothing else. Gate/rig artifacts follow their lifetime: (1) driver scripts, exit/raw files,\n  and logs live INSIDE their rig's worktree for the rig's life — they leave WITH it, via the\n  preservation step (copy what the verdict cites into `spt-preserve/<occasion>/`, verified by\n  cmp or a listed tarball, restore cost stated) and never accumulate beside the rigs; (2)\n  anything meant to outlive its rig goes to the repo ROOT beside the verdicts and RCAs it\n  supports (the census/finding/JIT convention) or into `spt-preserve/` — never loose in\n  `.worktrees/`; (3) a file found loose in `.worktrees/` is treated as UNCLASSIFIED WORKING\n  STATE — moved to `_patches/` with a dated note, never deleted on sight (class D is the risk\n  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\n  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\n  to sweep, not a norm.\n- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\n  class-A pool findings are armed hazards and do not wait for it.\n- **Size:** small for the sweep; the hygiene rule and the pool-claim gaps are separate small items.\n- **Field instance (hertz sweep, 2026-08-04 — an unclaimed pool found rather than reasoned about):**\n  `.worktrees\\gate-target-w4doc` held **7,907,558,098 B with NO POOL-OWNER.json at all**. Not a stale\n  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\n  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\n\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\n…\n  anything that stalls it (the blanket-fsync canary; `attach_wedge_e2e` guards that budget).\n…\n\n\n[Showing lines 179-610 of 5781. Use :611 to continue]"}],"details":{"truncation":{"content":"\r\n### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\r\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\r\n  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\r\n  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\r\n  success/NO-REPLY/UNAVAILABLE, always exit 0 — instrument, not gate). NOTE `bf8c4a2` is NOT\r\n  single-purpose: it also corrects the free-space preflight floor read\r\n  (`REQ-CI-FREE-SPACE-PREFLIGHT`, the ci-runner-has-no-warm-target shape) — no 1:1 commit→IR map\r\n  for this commit · **Origin:** golden/bench-wiring red triage 2026-08-02 (ex releases#126)\r\n- **What/why:** the shared-runner quiet predicate (zero non-terminal runs + no local\r\n  cargo/rustc/nextest by parent chain) is process-shaped; both axes passed on a box whose only\r\n  link was degrading (321s for a 1s checkout, bidirectional 10s QUIC dial timeouts). A tailscale\r\n  RTT probe to the peer box before two-host rendezvous, carried in the bench ledger, would have\r\n  called run 30771155390's red in seconds. Evidence: the arm-1 count table (PUMP_PEER_FAIL\r\n  a 0→3→0, b 8→22→8 across green/red/rerun).\r\n- **Permanent, not stopgap:** operator-confirmed 2026-08-02 that kitsubito cannot be provided\r\n  ethernet — wifi-only indefinitely, so the link cannot be hardened and the predicate must see\r\n  link health.\r\n- **Ripe when:** next CI-touching wave, or the next network-shaped golden red — whichever first.\r\n- **Size:** small (one probe step + ledger row + predicate doc).\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\r\n  #132 and **DISPATCHED to hertz 2026-08-03** (direct brief; the register is the spec, there is no\r\n  board issue). Leaves the register only when the lane lands or the entry is retired.\r\n- **FIRST FIELD USE, and it DISCRIMINATED (2026-08-04, golden 30873007187 attempt 1):** the probe\r\n  (landed via the rider lane, riding `4b37512`) read 4–7ms RTT healthy on both twohost legs\r\n  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\r\n  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\r\n  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\r\n  could not make.\r\n\r\n### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\r\n- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\r\n  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\r\n  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\r\n  discarded with the leg). Disk: OFF target 7.49 GB vs ON 11.40 GB = 3.91 GB / 34.3% saved\r\n  (smaller than the entry's 5.65 GB cold figure). Timing NOT causal-quality: sequential runs in\r\n  one persistent workspace let OFF inherit ON's cache (order contamination dominates the\r\n  apparent OFF speedups); Windows build-spt-bin +3.8%, Linux -5.1%. Retire reasoning: the\r\n  DECISION is answerable now — OFF produced no green golden, the timing question needs 4+\r\n  counterbalanced fresh-cache windows to answer cleanly, and the disk motivation has weakened\r\n  (box at ~148 GB free under the teardown discipline; the LNK1318 pressure era predates it).\r\n  Runs/artifacts preserved on the record. Reopen only if runner disk pressure returns as a\r\n  recurring floor-class red.\r\n- **Was:** open · **Origin:** #103/#108 bench-wiring lane 2026-08-02 (ex releases#127)\r\n- **What/why:** the #103 measurement (−29.8% wall, −5.65 GB/target, n=3) is COLD-build only.\r\n  Golden's runner `_work` target persists warm, where incremental is exactly what keeps it cheap;\r\n  CARGO_INCREMENTAL=0 was applied only to the genuine cold build (n1-gate pinned old-broker\r\n  cache) + local rig recipes (docs/GOLDEN-CI.md). Open question: does incremental still pay on\r\n  the warm runner, weighed against 5.65 GB/target on a box with LNK1318 free-space history?\r\n- **Method (hertz):** one full golden each way on a quiet box, outside a milestone, compared\r\n  per-step from the bench ledger.\r\n- **Ripe when:** a quiet between-milestone window with no queued lanes (the measurement burns\r\n  two golden windows).\r\n- **Size:** medium (two proving runs + verdict + possible leg flips).\r\n\r\n### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\r\n- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\r\n- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\r\n  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\r\n  broker-net workers stay quiescent across repeated endpoint create/destroy churn.\r\n- **Design constraint (pre-ruled):** assert on WAKEUP RATE / voluntary ctxt-switch delta over\r\n  the churn window, NOT %CPU — CPU thresholds flake under CI load; the defect signature\r\n  (~100 Hz per orphan loop) is load-independent. Mint the REQ at activation.\r\n- **Near-product:** this is runtime-defect visibility, the most product-adjacent entry here —\r\n  a candidate rider on any daemon-lifecycle milestone.\r\n- **Ripe when:** the next milestone touching spt-net endpoint lifecycle or daemon supervision.\r\n- **Size:** medium (churn harness + counter plumbing + flake-safe assertion).\r\n\r\n### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\r\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\r\n  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\r\n  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\r\n- **What/why, three parts that land together:**\r\n  1. **xtask check leg:** assert Cargo.lock resolves swarm-discovery to git rev\r\n     `89a2200d54a4e3cab2f46cc75ebff49a1fb07614` while the patch is load-bearing; the check's\r\n     message states its own drop condition (upstream ships a post-PR#27 release AND iroh's pin\r\n     reaches it). Without it, stanza removal or a routine iroh bump silently returns the lock to\r\n     the spinning crate and nothing reds.\r\n  2. **Procedure rule for lock-touching lanes** (docs): targeted `cargo update -p <crate>` only,\r\n     never full re-resolve; count changed `[[package]]` blocks AND diff per-block edges (set-identical\r\n     hid 8 windows-sys edge movers at acaaa4f); two resolutions disagreeing = toolchain drift —\r\n     stop and compare against CI before shipping either lock; hand-edited lock acceptable iff\r\n     `cargo check --workspace --locked` passes.\r\n  3. **Toolchain-version print step in golden** (cargo/rustc versions, both OS legs): the acaaa4f\r\n     comparison against CI was impossible because no run log prints a version. One-grep audit.\r\n- **Ripe when:** next CI-touching wave; part 1 sooner if any iroh bump is proposed.\r\n- **Size:** small-medium (one xtask leg, one docs section, one workflow step).\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\r\n  #132 and **DISPATCHED to hertz 2026-08-03** (all three parts land together).\r\n\r\n### IR-5 — Shared nextest summary parser\r\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\r\n- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\r\n  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\r\n  singular-aware parser (single-source discriminant) for every consumer of nextest summaries.\r\n- **Ripe-when REWORDED 2026-08-04 (todlando audit): the old trigger was unfireable as worded.** At\r\n  `b7b00c3` the in-tree population of nextest-SUMMARY parsers is ZERO — the two scripts that read\r\n  nextest output (`g6-curve.ps1:83-90` per-test lines, `g6-postbounce.ps1:44` display-only grep)\r\n  neither parse counts nor carry the defect, so \"next wave touching any gate script that reads\r\n  nextest output\" could fire on a non-defective script while the real population (agent-authored\r\n  throwaway parsers, which never enter the tree) stays out of reach. New trigger: **the next time\r\n  anyone — agent or lane — needs a nextest summary COUNT**, the shared parser is built FIRST and the\r\n  need consumes it; rig briefs should name it so throwaways stop being authored.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\r\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\r\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\r\n  known to be building** — an unreported condition leaves this entry open, not landed.\r\n\r\n### IR-6 — Membership logging on subnet gates\r\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\r\n- **What/why:** counts beside results, membership beside counts — gate logs that state a count\r\n  without naming the population keep producing unreadable reds. Standardize membership\r\n  enumeration in gate output.\r\n- **Ripe when:** next wave touching gate scripts / CI legs that report counts.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\r\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\r\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\r\n  known to be building** — an unreported condition leaves this entry open, not landed.\r\n\r\n### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\r\n- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\r\n- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\r\n  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\r\n  key); the leaked pair holds target/debug/spt.exe and kills every golden job reaching the notify\r\n  relink. CI reaps as tourniquet (fa6e597); in-job test launch is the fix.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\r\n- **Size:** medium.\r\n\r\n### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\r\n  (ex releases#122)\r\n- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\r\n  unreadable, so the survivors count can report clean while a holder lives. Needs a positive control\r\n  / explicit unreadable bucket in the verdict line (unreadable_path count exists; the ZERO must\r\n  refuse when it is nonzero).\r\n- **Defining specimen (golden 30782259675, hfenduleam test job, 2026-08-03):**\r\n  `CI-REAP summary: killed=5 kill_failed=1 scoped_survivors=0` — an admitted kill failure printed\r\n  beside a zero-survivors claim on the same verdict line. The held image surfaced one step later:\r\n  run-scoped tmp cleanup denied 5/5 attempts on `...\\relshell\\svcmock.exe` (2nd appearance of the\r\n  svcmock hold; 1st @7a3c08c, pre-kill-auth). hertz's addendum: an image-held survivor also blocks\r\n  WRITES to the exe path — the same class manufactures build/relink access-denied reds that mask as\r\n  build problems, not just cleanup warnings. Not per-run: the same-sha green rerun's leg read\r\n  `kill_failed=0 scoped_survivors=0` throughout (hertz, 30784469908) — intermittent sighting,\r\n  second of its class, not a deterministic fixture property.\r\n- **The Linux twin is strictly worse (todlando audit 2026-08-04, vs `b7b00c3`):** `reap-census.sh`\r\n  has NO `kill_failed` anywhere (0 occurrences vs 2 in the `.ps1`) — its kill loop increments\r\n  `killed` only in the success branch with no else, so a failed kill increments nothing and prints\r\n  nothing. The specimen that made this class VISIBLE on Windows would be INVISIBLE on Linux.\r\n  Population precision so this is not overclaimed: ESRCH is benign (already gone; the kill-time\r\n  re-resolve makes it the common case); the vanishing case is EPERM against another account's\r\n  process. The `.sh` `scoped_survivors` DOES come from a post-reap census re-measure, so survivors\r\n  are measured — the hole is failed kills and the unreadable bucket, not the survivor count.\r\n  Windows precision from the same audit: `unreadable_path` IS on the CI-CENSUS line (:157) but the\r\n  CI-REAP verdict line (:243, :246) still carries only killed/kill_failed/scoped_survivors — the\r\n  zero still does not refuse, exactly this entry's ask.\r\n- **Built evidence:** both verdict lines now carry `unreadable_path`; any nonzero unreadable\r\n  family population renders `scoped_survivors=UNPROVEN` rather than a false zero. Linux also\r\n  counts and reports failed kills. The shared predicate is mutation-pinned by\r\n  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\r\n- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\r\n- **Size:** small.\r\n\r\n### IR-9 — Golden boxes run different clippy versions\r\n- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\r\n  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\r\n  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\r\n  the toolchain print (`8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT`) exercised both legs of\r\n  golden run 30971976024 (`test` jobs 92198170694/92198170700 — scoped to `test`, not n1-gate;\r\n  grep token `TOOLCHAIN `). Runner-account facts, read by doyle 2026-08-05: hfenduleam\r\n  `cargo/rustc 1.93.0` + `clippy 0.1.93`, kitsubito `cargo/rustc 1.96.0` +\r\n  `clippy 0.1.96`; `stable (default)` on both proved the skew would otherwise decay silently.\r\n- **RULING (doyle, 2026-08-05, on the runner-account facts as the 2026-08-03 hold required):**\r\n  (1) align-by-event REJECTED — with both boxes on unpinned stable, alignment decays silently;\r\n  the skew is a mechanism and the fix must be one too. (2) declare-one-leg REJECTED as the\r\n  terminal state — it repairs lint authority but leaves the legs resolving with different cargo\r\n  versions, and the acaaa4f lock-attribution question this family started from is a resolver\r\n  question. (3) **PIN IN-REPO: `rust-toolchain.toml`, `channel = \"1.96.0\"`** — both runner\r\n  accounts already resolve their toolchain through rustup (witnessed by the `active=` line), so\r\n  the pin self-applies with zero per-box maintenance, and the judge's version becomes a property\r\n  of the TESTED SHA — the same object golden CI already guarantees. Bumps become reviewed lane\r\n  commits, tested by the golden run they ride; the hfenduleam leg proves 1.96.0 on the pin\r\n  lane's own run. (4) INTERIM until the pin lands: kitsubito's clippy leg is AUTHORITATIVE for\r\n  lint disputes — not because newer is stricter (skew direction stays unasserted) but because\r\n  1.96 is the version the pin names, so interim and terminal rulings agree.\r\n  · **Origin:** BAROMETER (ex releases#121); re-confirmed on the #125 fix lane\r\n  (builder's Windows clippy vs kitsubito's rust-1.96.0 lints); see [[CI-RIDER LANE STATE]]\r\n- **What/why:** a Windows-clean lane can land a lint that only reds on the Linux leg — toolchain\r\n  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\r\n  leg. Natural companion to IR-4's toolchain-version print step.\r\n- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\r\n  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\r\n  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\r\n  and `rustup show active-toolchain` through PATH; pool ownership keys on source-tree/lane identity,\r\n  not rustup installation paths. `release.yml`'s `$HOME/.cargo/bin/mdbook` is an installed tool\r\n  location, not a Rust toolchain selector; its builds still invoke PATH-resolved `cargo`.\r\n- **Size:** built.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\r\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\r\n  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\r\n\r\n### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\r\n- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\r\n- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\r\n  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\r\n  runbook + scripts rather than living in memory.\r\n- **Ripe when:** next gate-runbook/docs wave.\r\n- **Size:** small (docs + gate-script checklist).\r\n\r\n### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\r\n- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\r\n- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\r\n  as a column it makes the orphan-vs-own-shell call one glance.\r\n- **Ripe when:** any rig-tooling wave; trivial rider.\r\n- **Size:** tiny.\r\n\r\n### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\r\n  releases#116\r\n- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\r\n  premise was a rig artifact, not a reproduced product hole. At `9f809f8d`, in isolated Linux\r\n  worktree `hertz-ir12-mutation`, build `spt` once, mutate only its root CLI help string, do not\r\n  rebuild, then run `cargo run -p xtask -- check` alone: **exit 1**, combined output **3435 bytes**,\r\n  ending `xtask check: docs-site/src/cli/reference.md drifted from the binary's --help` (followed\r\n  by the regeneration instruction). The binary hash changed during check; the stale input was\r\n  rebuilt by `gen(true)` → `spt_bin` → `cargo build -q -p spt --bin spt` before comparison.\r\n  `CARGO_TARGET_DIR=UNSET`, `SPT_BLESS=UNSET`; Cargo's metadata target and xtask's read path both\r\n  resolve to this worktree's `target/debug/spt`. Source mutation was restored byte-for-byte.\r\n  Acceptance files: `~/spt-evidence/ir12-mutation-20260906/{check.exit,check.raw,env.txt}` on kitsubito.\r\n  The original rig mechanism remains unproven (old-mtime restoration or two target directories\r\n  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\r\n  register at the WEBSERVE close sweep.\r\n  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\r\n- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\r\n  holds — `xtask check` does not regenerate-and-compare the schema — but staleness does NOT \"ship a\r\n  wrong public contract silently\": `checked_in_schema_is_current`\r\n  (crates/spt-runtime/src/manifest.rs:2363, `int->REQ-DOCS-5`, landed `be4e46c` 2026-06-05, BEFORE\r\n  this entry's last sweep — docs lagging code) asserts full content equality of the checked-in\r\n  `manifest.schema.json` against what the derives generate, CRLF-normalised, `SPT_BLESS=1` as the\r\n  regenerate path. It is REACHED (lib unit test; ci.yml:114 runs `-E kind(lib)+kind(bin)` on push;\r\n  golden Phase A re-runs the workspace). Exactly ONE schema file exists in the tree; `docs_bundle`\r\n  (xtask main.rs:609-618) COPIES it at build time, so no second stored copy can drift. Chain closes:\r\n  derives → checked-in (unit-gated) → bundle (copied, not stored).\r\n- **What remains open, and the entry narrows to it:** `check_llms_links` (xtask main.rs:521)\r\n  hardcodes `manifest.schema.json` and `llms-full.txt` as always-existing, so the link check can\r\n  never see them MISSING — a blind arm, not a drift hole.\r\n- **The discrimination is now PROVEN, not presumed (todlando 2026-08-04, burn-the-build arms in\r\n  isolated worktree ir12-mutation @`11169c1`, env verified clear of `SPT_BLESS` FIRST — set, the\r\n  test short-circuits into a WRITE and a mutation arm silently self-heals green; that env check is\r\n  now part of the rig recipe):** arm 0 baseline PASS by NAME (1 test run); arm 1 semantic single\r\n  byte (title `…manifest`→`…manifesX`, length unchanged, scripted edit with match-count refusal)\r\n  REDS at manifest.rs:2374 exit 100 — \"manifest.schema.json drifted from the derives — regenerate\r\n  with SPT_BLESS=1\", with the mutated token appearing exactly once in 96,248 B of assertion output\r\n  so the byte is provably the only delta; arm 2 whitespace-only (CRLF→LF, 1014 endings) PASSES —\r\n  and arm 0 is itself the stronger normalisation proof, since the on-disk file is CRLF while the\r\n  generated string is LF, so an unmutated PASS is only possible because the test normalises; arm 3\r\n  restore re-measured PASS at the pristine sha256. `checked_in_schema_is_current` is a REAL gate.\r\n- **Built evidence:** `check_llms_links` resolves stored root assets to their\r\n  real source paths and runs the `llms-full.txt` generator instead of returning\r\n  hardcoded `true`. A unit cell proves a missing schema and install script are\r\n  refused, then accepted only after the real source file exists.\r\n- **Ripe when:** next xtask/docs-gate wave (now sized to the blind arm only).\r\n- **Size:** tiny.\r\n\r\n### IR-13 — Test-soundness follow-ups from the uniform-table sweep\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\r\n- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\r\n  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\r\n  `HoldRelease`); changing held+release to start reds on that arm. Pure walk tests cover all four\r\n  `QuiesceOutcome` arms and all five `EffectKind` arms; making `KillUnconfirmed` clear or\r\n  `Registry` ephemeral reds independently. The join test now binds all six `JoinFail` variants to\r\n  both hold retention and the emitted failure class/retry payload; misclassifying `WrongCode`\r\n  reds. The access candidates had already landed in the W4 follow-up and its dead-seam removal,\r\n  so the hygiene lane does not manufacture a second test vocabulary beside them.\r\n\r\n### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\r\n- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\r\n  now sought directly when the entry ripens, not via board flag)\r\n- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\r\n  reap recipe + a hygiene rule for lane close-out. Teardown discipline per docs and memory (classify\r\n  before delete, outbound links first).\r\n- ⚠ **The header of this entry previously read \"14 untracked orphan dirs vs 25 git-tracked\". Both\r\n  numbers were stale AND UNDATED**, so nobody could tell drift from error. Every count below is dated\r\n  and carries its command.\r\n\r\n#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\r\n\r\nThree people measuring \"the worktrees\" got three answers. None was wrong; they answered three\r\ndifferent questions, and nothing in the tree states which one is meant:\r\n\r\n| answer | question it actually answers | command |\r\n|---|---|---|\r\n| **73** | all ENTRIES under `.worktrees/` | `ls -A .worktrees \\| wc -l` |\r\n| **52** | DIRECTORIES under `.worktrees/` | `ls -dA .worktrees/*/` |\r\n| **38** | registered worktrees INCLUDING the root checkout | `git worktree list` |\r\n| **37** | registered worktrees under `.worktrees/` | above, minus the root |\r\n\r\n**52 − 37 = 15 unregistered directories.** The 73 − 52 = **21 loose FILES** are covered below.\r\n\r\n**A count is only as good as its question.** Treat \"how many worktrees\" as under-specified until the\r\nanswer names its population — the same defect that made a naive `grep -rn` from the project root\r\ninflate a code count by **34.9×** (426 tracked `.rs` vs 14865 on disk excluding all `target/`), and\r\nmade that grep run past 120s while `git ls-files | xargs grep` returned instantly. **Scan roots and\r\npopulation definitions are the same class of error.** Use `git grep` / `git ls-files` for tracked\r\ncontent and `git worktree list --porcelain` for worktrees.\r\n\r\n#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\r\n\r\n⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\r\na junction that a REGISTERED worktree uses as its `target/`:\r\n\r\n| dir | inbound junction from | size | claim |\r\n|---|---|---|---|\r\n| `gate-target` | assembly-doorbell, doorbell-w1, doorbell-w2, doorbell-w3 | EMPTY | none |\r\n| `gate-target-render` | golden-render | 5.84 GB | `POOL-OWNER.json` → golden-render |\r\n| `gate-target-w4doc` | w4-cli-doc | 7.36 GB | none |\r\n\r\n**These are exactly the directories that read as obviously junk** — no `.git`, no source, leftover\r\nnames — and deleting one destroys a registered worktree's build pool and leaves a dangling junction.\r\n**Polarity was checked BEFORE classification, which is what caught it:** all 15 top-level dirs are\r\nREAL directories, none is itself a reparse point; the six junctions are **INBOUND**, at\r\n`<registered-worktree>/target`. See [[worktree-target-junction]], [[gate-worktree-target-disk]].\r\n\r\nTwo findings inside class A, neither of them a deletion question:\r\n- **`gate-target` has FOUR registered trees junctioned into ONE pool, with no `POOL-OWNER.json` at\r\n  all** — so nothing would refuse a second LIVE lane there. That is releases#103's exact hazard\r\n  sitting armed. The pool is also empty: someone reclaimed it and left four junctions aimed at a hole.\r\n- **`gate-target-render`'s `POOL-OWNER.json` carries only `owner_tree` and `written_by` — no pid and\r\n  no birth stamp.** A claim that cannot distinguish a live lane from a finished one is missing the one\r\n  property the claim mechanism exists to provide.\r\n\r\n**CLASS B — EMPTIED SKELETONS, ONE UNIFORM SHAPE.** 8 dirs, **0 files**: `acl-core`, `engine-room`,\r\n`ff-fastfollow`, `gate-23d5ceb`, `gate-ff`, `golden-a`, `golden-b`, `w2b-sender-stamp`. Every one is\r\nexactly `crates/spt-daemon/` and nothing else. **Eight independent removals stopping at the SAME\r\nrelative path is a mechanism, not litter.**\r\n\r\n**MECHANISM CORROBORATED LIVE, 2026-08-03:** a read-only PEB sweep of process CWDs during a running\r\n`spt-daemon` suite found ~20 processes — `spt_daemon-<hash>` test harnesses, `PING`, `cmd` — whose\r\nCWD was **exactly `<worktree>/crates/spt-daemon/`**, the precise path all eight skeletons froze at. A\r\n`git worktree remove` racing a straggler there deletes everything else and leaves that chain pinned.\r\nThe processes churn fast (all 17 sampled pids were gone within 30s, one already showing **pid reuse**\r\n— see [[pid-reuse-across-reboot]] for why a pid alone is never an identity), so the pin is a race, not\r\na steady state, and it recurs on every daemon-suite worktree.\r\n\r\n**CLASS C — FULLY EMPTY, no inbound junction.** 3 dirs, 0 bytes: `gate-41`, `gate-559632e`,\r\n`release-runbook-main-advance`. Class B with even the chain gone.\r\n\r\n**CLASS D — DELIBERATE SCRATCH, NOT RESIDUE.** 1 dir, 12 files, 50 KB: `_patches` — three `.patch`\r\nfiles with their `.untracked` manifests, plus `ir18-gate-logs/`. Modified the day before the audit,\r\ni.e. someone's working state.\r\n\r\n3 + 8 + 3 + 1 = 15.\r\n\r\n#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\r\n\r\nRead-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\r\ndirectory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\r\nrigs at the time. So removal of B and C would succeed today; nothing is retrying it.\r\n\r\n⚠ **The sweep read 412 of 593 processes; 181 were unreadable** (elevated/system, no\r\n`PROCESS_VM_READ`). The no-pin result therefore holds over the READABLE population only. Cheap to\r\nre-run elevated before acting — [[absence-needs-sibling-probe]].\r\n\r\n#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\r\n\r\n**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\r\nscripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\r\ndeclared `.worktrees/` a log drop; it became one.** Same class as the memory index: a shared location\r\nwith no stated contract accumulates whatever anyone puts there, and **the first person to tidy it\r\ncannot tell residue from someone's working state** — class D is that risk already realised. The\r\nhygiene rule this entry owes should name where gate logs and rig scripts belong, not only how to reap\r\nworktrees.\r\n\r\n#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\r\n\r\nClasses B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\r\nA, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\r\nyou at the wrong target: on the audit date, free space was **12.5 GB against the 32 GB golden floor**\r\n([[free-space-floor-blocks-golden]]) while the two largest pools on the box were `gate-ec5f38a/target`\r\n(14.33 GB) and `gate-main/target` (28.12 GB) — **both REGISTERED, so both outside the orphan\r\npopulation entirely.** The disk question and the orphan question have different populations; answering\r\none correctly says nothing about the other.\r\n\r\n- **AUDIT EXECUTED 2026-08-30 (doyle, the v0.66.0→NOW-SIGNAL between-milestone window; full\r\n  output `wt-census-2026-08-30.txt` in the session scratchpad, method = this entry's own):**\r\n  four answers BEFORE the sweep: 85 entries / 85 dirs / 76 registered incl root / 75 under\r\n  `.worktrees` → 10 unregistered, 0 loose files (the 21 loose files of 08-03 are gone).\r\n  **The 08-03 headline populations have INVERTED:** zero pools and zero junctions exist under\r\n  `.worktrees` at all (every registered tree reads `target=none`; the reparse sweep found no\r\n  inbound junction) — class A is EMPTY, so the armed pool hazards this entry named are\r\n  currently unpopulated. Unregistered classified: 4 fully-empty (C), 3 `crates/spt-daemon`\r\n  skeletons (B — the mechanism's fingerprint again), `_patches` (D, kept — working scratch),\r\n  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\r\n  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\r\n  executed on the gater's own rigs:** evidence preserved FIRST\r\n  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\r\n  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\r\n  belongs to hertz's lane and was NOT touched beyond the read-only copy), 16 pinning conhosts\r\n  killed by pid after a fresh probe, 9 dead rigs removed. AFTER: **76 dirs = 75 registered +\r\n  `_patches`, fully reconciled; zero unexplained entries, zero pins.** Reclaim was ~38MB —\r\n  reconfirming this entry's arithmetic that the orphan sweep is hygiene, not a disk remedy.\r\n  Landed-classification caveat: `git cherry` patch-id reads conflict-resolved picks\r\n  as UNLANDED (emit-single-write, fix-206/208/209 all show UNLANDED with shipped content), so\r\n  the census's landed column is a datum, never a reap authorization.\r\n- **HYGIENE RULE (the text this entry owed, written 2026-08-30 while the loose-file population\r\n  is zero — the rule exists BEFORE it refills):** `.worktrees/` holds exactly two kinds of\r\n  entry: **registered worktrees** and **`_patches/`** (the one declared scratch location).\r\n  Nothing else. Gate/rig artifacts follow their lifetime: (1) driver scripts, exit/raw files,\r\n  and logs live INSIDE their rig's worktree for the rig's life — they leave WITH it, via the\r\n  preservation step (copy what the verdict cites into `spt-preserve/<occasion>/`, verified by\r\n  cmp or a listed tarball, restore cost stated) and never accumulate beside the rigs; (2)\r\n  anything meant to outlive its rig goes to the repo ROOT beside the verdicts and RCAs it\r\n  supports (the census/finding/JIT convention) or into `spt-preserve/` — never loose in\r\n  `.worktrees/`; (3) a file found loose in `.worktrees/` is treated as UNCLASSIFIED WORKING\r\n  STATE — moved to `_patches/` with a dated note, never deleted on sight (class D is the risk\r\n  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\r\n  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\r\n  to sweep, not a norm.\r\n- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\r\n  class-A pool findings are armed hazards and do not wait for it.\r\n- **Size:** small for the sweep; the hygiene rule and the pool-claim gaps are separate small items.\r\n- **Field instance (hertz sweep, 2026-08-04 — an unclaimed pool found rather than reasoned about):**\r\n  `.worktrees\\gate-target-w4doc` held **7,907,558,098 B with NO POOL-OWNER.json at all**. Not a stale\r\n  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\r\n  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\r\n\r\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\r\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\r\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\r","truncated":true,"truncatedBy":"lines","totalLines":5603,"totalBytes":34244,"outputLines":432,"outputBytes":34244,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"\r\n### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\r\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\r\n  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\r\n  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\r\n  success/NO-REPLY/UNAVAILABLE, always exit 0 — instrument, not gate). NOTE `bf8c4a2` is NOT\r\n  single-purpose: it also corrects the free-space preflight floor read\r\n  (`REQ-CI-FREE-SPACE-PREFLIGHT`, the ci-runner-has-no-warm-target shape) — no 1:1 commit→IR map\r\n  for this commit · **Origin:** golden/bench-wiring red triage 2026-08-02 (ex releases#126)\r\n- **What/why:** the shared-runner quiet predicate (zero non-terminal runs + no local\r\n  cargo/rustc/nextest by parent chain) is process-shaped; both axes passed on a box whose only\r\n  link was degrading (321s for a 1s checkout, bidirectional 10s QUIC dial timeouts). A tailscale\r\n  RTT probe to the peer box before two-host rendezvous, carried in the bench ledger, would have\r\n  called run 30771155390's red in seconds. Evidence: the arm-1 count table (PUMP_PEER_FAIL\r\n  a 0→3→0, b 8→22→8 across green/red/rerun).\r\n- **Permanent, not stopgap:** operator-confirmed 2026-08-02 that kitsubito cannot be provided\r\n  ethernet — wifi-only indefinitely, so the link cannot be hardened and the predicate must see\r\n  link health.\r\n- **Ripe when:** next CI-touching wave, or the next network-shaped golden red — whichever first.\r\n- **Size:** small (one probe step + ledger row + predicate doc).\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\r\n  #132 and **DISPATCHED to hertz 2026-08-03** (direct brief; the register is the spec, there is no\r\n  board issue). Leaves the register only when the lane lands or the entry is retired.\r\n- **FIRST FIELD USE, and it DISCRIMINATED (2026-08-04, golden 30873007187 attempt 1):** the probe\r\n  (landed via the rider lane, riding `4b37512`) read 4–7ms RTT healthy on both twohost legs\r\n  minutes before both legs redded — REFUTING the degraded-link read for that red and steering\r\n  triage to the real mechanism (the [[IR-29]] serve-window race) instead of a link chase. The\r\n  instrument's first catch was a correct NEGATIVE — exactly the call run 30771155390 needed and\r\n  could not make.\r\n\r\n### IR-2 — Settle the warm-runner CARGO_INCREMENTAL delta\r\n- **Status:** RETIRED 2026-08-28, measurement run, verdict NO FLIP — incremental stays ON.\r\n  hertz paired goldens at main fed965f8: ON run 33167693879 GREEN; OFF run 33172022108 RED\r\n  (Windows input_ack_deadlock SetupFailed at a 3.0s IPC read deadline — the box-load family,\r\n  discarded with the leg). Disk: OFF target 7.49 GB vs ON 11.40 GB = 3.91 GB / 34.3% saved\r\n  (smaller than the entry's 5.65 GB cold figure). Timing NOT causal-quality: sequential runs in\r\n  one persistent workspace let OFF inherit ON's cache (order contamination dominates the\r\n  apparent OFF speedups); Windows build-spt-bin +3.8%, Linux -5.1%. Retire reasoning: the\r\n  DECISION is answerable now — OFF produced no green golden, the timing question needs 4+\r\n  counterbalanced fresh-cache windows to answer cleanly, and the disk motivation has weakened\r\n  (box at ~148 GB free under the teardown discipline; the LNK1318 pressure era predates it).\r\n  Runs/artifacts preserved on the record. Reopen only if runner disk pressure returns as a\r\n  recurring floor-class red.\r\n- **Was:** open · **Origin:** #103/#108 bench-wiring lane 2026-08-02 (ex releases#127)\r\n- **What/why:** the #103 measurement (−29.8% wall, −5.65 GB/target, n=3) is COLD-build only.\r\n  Golden's runner `_work` target persists warm, where incremental is exactly what keeps it cheap;\r\n  CARGO_INCREMENTAL=0 was applied only to the genuine cold build (n1-gate pinned old-broker\r\n  cache) + local rig recipes (docs/GOLDEN-CI.md). Open question: does incremental still pay on\r\n  the warm runner, weighed against 5.65 GB/target on a box with LNK1318 free-space history?\r\n- **Method (hertz):** one full golden each way on a quiet box, outside a milestone, compared\r\n  per-step from the bench ledger.\r\n- **Ripe when:** a quiet between-milestone window with no queued lanes (the measurement burns\r\n  two golden windows).\r\n- **Size:** medium (two proving runs + verdict + possible leg flips).\r\n\r\n### IR-3 — Daemon-level guard: broker-net wakeup rate bounded across endpoint churn\r\n- **Status:** open · **Origin:** releases#125 remediation, todlando REQ call 1 (ex releases#128)\r\n- **What/why:** the swarm-discovery GC-spin burned two cores for two weeks visible only in a\r\n  process table — no suite assertion sees the class. Wanted: a daemon-level assertion that\r\n  broker-net workers stay quiescent across repeated endpoint create/destroy churn.\r\n- **Design constraint (pre-ruled):** assert on WAKEUP RATE / voluntary ctxt-switch delta over\r\n  the churn window, NOT %CPU — CPU thresholds flake under CI load; the defect signature\r\n  (~100 Hz per orphan loop) is load-independent. Mint the REQ at activation.\r\n- **Near-product:** this is runtime-defect visibility, the most product-adjacent entry here —\r\n  a candidate rider on any daemon-lifecycle milestone.\r\n- **Ripe when:** the next milestone touching spt-net endpoint lifecycle or daemon supervision.\r\n- **Size:** medium (churn harness + counter plumbing + flake-safe assertion).\r\n\r\n### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\r\n- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\r\n  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\r\n  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\r\n- **What/why, three parts that land together:**\r\n  1. **xtask check leg:** assert Cargo.lock resolves swarm-discovery to git rev\r\n     `89a2200d54a4e3cab2f46cc75ebff49a1fb07614` while the patch is load-bearing; the check's\r\n     message states its own drop condition (upstream ships a post-PR#27 release AND iroh's pin\r\n     reaches it). Without it, stanza removal or a routine iroh bump silently returns the lock to\r\n     the spinning crate and nothing reds.\r\n  2. **Procedure rule for lock-touching lanes** (docs): targeted `cargo update -p <crate>` only,\r\n     never full re-resolve; count changed `[[package]]` blocks AND diff per-block edges (set-identical\r\n     hid 8 windows-sys edge movers at acaaa4f); two resolutions disagreeing = toolchain drift —\r\n     stop and compare against CI before shipping either lock; hand-edited lock acceptable iff\r\n     `cargo check --workspace --locked` passes.\r\n  3. **Toolchain-version print step in golden** (cargo/rustc versions, both OS legs): the acaaa4f\r\n     comparison against CI was impossible because no run log prints a version. One-grep audit.\r\n- **Ripe when:** next CI-touching wave; part 1 sooner if any iroh bump is proposed.\r\n- **Size:** small-medium (one xtask leg, one docs section, one workflow step).\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, hertz thin lane — 2026-08-03. GREENLIT with\r\n  #132 and **DISPATCHED to hertz 2026-08-03** (all three parts land together).\r\n\r\n### IR-5 — Shared nextest summary parser\r\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\r\n- **What/why:** two agents in one day wrote `[0-9]+ tests run` parsers that read \"1 test run\"\r\n  (singular) as zero — a guard fed by a broken parser condemns valid rounds. One shared,\r\n  singular-aware parser (single-source discriminant) for every consumer of nextest summaries.\r\n- **Ripe-when REWORDED 2026-08-04 (todlando audit): the old trigger was unfireable as worded.** At\r\n  `b7b00c3` the in-tree population of nextest-SUMMARY parsers is ZERO — the two scripts that read\r\n  nextest output (`g6-curve.ps1:83-90` per-test lines, `g6-postbounce.ps1:44` display-only grep)\r\n  neither parse counts nor carry the defect, so \"next wave touching any gate script that reads\r\n  nextest output\" could fire on a non-defective script while the real population (agent-authored\r\n  throwaway parsers, which never enter the tree) stays out of reach. New trigger: **the next time\r\n  anyone — agent or lane — needs a nextest summary COUNT**, the shared parser is built FIRST and the\r\n  need consumes it; rig briefs should name it so throwaways stop being authored.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\r\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\r\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\r\n  known to be building** — an unreported condition leaves this entry open, not landed.\r\n\r\n### IR-6 — Membership logging on subnet gates\r\n- **Status:** open · **Origin:** BAROMETER triage (standing recommendation, pre-register)\r\n- **What/why:** counts beside results, membership beside counts — gate logs that state a count\r\n  without naming the population keep producing unreadable reds. Standardize membership\r\n  enumeration in gate output.\r\n- **Ripe when:** next wave touching gate scripts / CI legs that report counts.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster, CONDITIONAL — lands iff the hertz thin lane\r\n  touches gate scripts; otherwise stays open here. 2026-08-03. Carried in hertz's 2026-08-03\r\n  dispatch brief as a **conditional** rider; hertz reports whether the condition fired. **Not yet\r\n  known to be building** — an unreported condition leaves this entry open, not landed.\r\n\r\n### IR-7 — Phase A rigs leak a daemon+brain pair on Windows (exe-lock kills notify relink)\r\n- **Status:** open · **Origin:** BAROMETER post-publish triage (ex releases#124 — full mechanism on the closed issue)\r\n- **What/why:** two Phase A rigs launch daemons that escape the job object via WMI-rung autostart\r\n  (double-space unquoted cmdline fingerprint; SPT_HOME in the wrapper cmdline is the attribution\r\n  key); the leaked pair holds target/debug/spt.exe and kills every golden job reaching the notify\r\n  relink. CI reaps as tourniquet (fa6e597); in-job test launch is the fix.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** next wave touching the Phase A rigs or daemon autostart path.\r\n- **Size:** medium.\r\n\r\n### IR-8 — reap-census scoped_survivors=0 is blind to unreadable-path holders\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** BAROMETER triage\r\n  (ex releases#122)\r\n- **What/why:** a zero that cannot see is not a zero — census scoping skips procs whose exe path is\r\n  unreadable, so the survivors count can report clean while a holder lives. Needs a positive control\r\n  / explicit unreadable bucket in the verdict line (unreadable_path count exists; the ZERO must\r\n  refuse when it is nonzero).\r\n- **Defining specimen (golden 30782259675, hfenduleam test job, 2026-08-03):**\r\n  `CI-REAP summary: killed=5 kill_failed=1 scoped_survivors=0` — an admitted kill failure printed\r\n  beside a zero-survivors claim on the same verdict line. The held image surfaced one step later:\r\n  run-scoped tmp cleanup denied 5/5 attempts on `...\\relshell\\svcmock.exe` (2nd appearance of the\r\n  svcmock hold; 1st @7a3c08c, pre-kill-auth). hertz's addendum: an image-held survivor also blocks\r\n  WRITES to the exe path — the same class manufactures build/relink access-denied reds that mask as\r\n  build problems, not just cleanup warnings. Not per-run: the same-sha green rerun's leg read\r\n  `kill_failed=0 scoped_survivors=0` throughout (hertz, 30784469908) — intermittent sighting,\r\n  second of its class, not a deterministic fixture property.\r\n- **The Linux twin is strictly worse (todlando audit 2026-08-04, vs `b7b00c3`):** `reap-census.sh`\r\n  has NO `kill_failed` anywhere (0 occurrences vs 2 in the `.ps1`) — its kill loop increments\r\n  `killed` only in the success branch with no else, so a failed kill increments nothing and prints\r\n  nothing. The specimen that made this class VISIBLE on Windows would be INVISIBLE on Linux.\r\n  Population precision so this is not overclaimed: ESRCH is benign (already gone; the kill-time\r\n  re-resolve makes it the common case); the vanishing case is EPERM against another account's\r\n  process. The `.sh` `scoped_survivors` DOES come from a post-reap census re-measure, so survivors\r\n  are measured — the hole is failed kills and the unreadable bucket, not the survivor count.\r\n  Windows precision from the same audit: `unreadable_path` IS on the CI-CENSUS line (:157) but the\r\n  CI-REAP verdict line (:243, :246) still carries only killed/kill_failed/scoped_survivors — the\r\n  zero still does not refuse, exactly this entry's ask.\r\n- **Built evidence:** both verdict lines now carry `unreadable_path`; any nonzero unreadable\r\n  family population renders `scoped_survivors=UNPROVEN` rather than a false zero. Linux also\r\n  counts and reports failed kills. The shared predicate is mutation-pinned by\r\n  `reap-census-selftest.sh`; the PowerShell implementation parses cleanly.\r\n- **Ripe when:** next census/reap script wave (natural pair with IR-7's lane) — now BOTH platforms.\r\n- **Size:** small.\r\n\r\n### IR-9 — Golden boxes run different clippy versions\r\n- **Status:** pin LANDED 2026-08-18 at `35968156` (`build: pin Rust 1.96.0`), then\r\n  audited **BUILT** at the 2026-08-29 v0.65.0 close sweep; the pin is an ancestor of\r\n  golden-green cut SHA `4d6007ac`. The earlier measurement half had already landed and run:\r\n  the toolchain print (`8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT`) exercised both legs of\r\n  golden run 30971976024 (`test` jobs 92198170694/92198170700 — scoped to `test`, not n1-gate;\r\n  grep token `TOOLCHAIN `). Runner-account facts, read by doyle 2026-08-05: hfenduleam\r\n  `cargo/rustc 1.93.0` + `clippy 0.1.93`, kitsubito `cargo/rustc 1.96.0` +\r\n  `clippy 0.1.96`; `stable (default)` on both proved the skew would otherwise decay silently.\r\n- **RULING (doyle, 2026-08-05, on the runner-account facts as the 2026-08-03 hold required):**\r\n  (1) align-by-event REJECTED — with both boxes on unpinned stable, alignment decays silently;\r\n  the skew is a mechanism and the fix must be one too. (2) declare-one-leg REJECTED as the\r\n  terminal state — it repairs lint authority but leaves the legs resolving with different cargo\r\n  versions, and the acaaa4f lock-attribution question this family started from is a resolver\r\n  question. (3) **PIN IN-REPO: `rust-toolchain.toml`, `channel = \"1.96.0\"`** — both runner\r\n  accounts already resolve their toolchain through rustup (witnessed by the `active=` line), so\r\n  the pin self-applies with zero per-box maintenance, and the judge's version becomes a property\r\n  of the TESTED SHA — the same object golden CI already guarantees. Bumps become reviewed lane\r\n  commits, tested by the golden run they ride; the hfenduleam leg proves 1.96.0 on the pin\r\n  lane's own run. (4) INTERIM until the pin lands: kitsubito's clippy leg is AUTHORITATIVE for\r\n  lint disputes — not because newer is stricter (skew direction stays unasserted) but because\r\n  1.96 is the version the pin names, so interim and terminal rulings agree.\r\n  · **Origin:** BAROMETER (ex releases#121); re-confirmed on the #125 fix lane\r\n  (builder's Windows clippy vs kitsubito's rust-1.96.0 lints); see [[CI-RIDER LANE STATE]]\r\n- **What/why:** a Windows-clean lane can land a lint that only reds on the Linux leg — toolchain\r\n  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\r\n  leg. Natural companion to IR-4's toolchain-version print step.\r\n- **Built evidence / fulfilment check:** `rust-toolchain.toml` contains\r\n  `channel = \"1.96.0\"` and rode the tested cut. A source sweep at close found no CI or pool\r\n  machinery keyed to a box-default toolchain **path**: golden invokes `cargo`, `rustc`, `clippy`,\r\n  and `rustup show active-toolchain` through PATH; pool ownership keys on source-tree/lane identity,\r\n  not rustup installation paths. `release.yml`'s `$HOME/.cargo/bin/mdbook` is an installed tool\r\n  location, not a Rust toolchain selector; its builds still invoke PATH-resolved `cargo`.\r\n- **Size:** built.\r\n- **Composed:** LOCKSMITH (#132) CI-rider cluster (rides IR-4's toolchain-version print step) —\r\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\r\n  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\r\n\r\n### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\r\n- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\r\n- **What/why:** legs chosen from changed crates miss the predicate's callers; a composed red is\r\n  triaged at the wave's own tip first. This is the gate-population rule made binding in the gate\r\n  runbook + scripts rather than living in memory.\r\n- **Ripe when:** next gate-runbook/docs wave.\r\n- **Size:** small (docs + gate-script checklist).\r\n\r\n### IR-11 — find-cwd-holders.ps1: --headless discriminator as a column\r\n- **Status:** open · **Origin:** worktree-pin triage tooling (ex releases#118)\r\n- **What/why:** the holder-triage script buries the headless-vs-interactive discriminator in prose;\r\n  as a column it makes the orphan-vs-own-shell call one glance.\r\n- **Ripe when:** any rig-tooling wave; trivial rider.\r\n- **Size:** tiny.\r\n\r\n### IR-12 — xtask contract-drift gate misses a stale manifest.schema.json\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane (the narrowed blind arm only). · **Origin:** ex\r\n  releases#116\r\n- **KIN NOTE RETIRED (2026-09-06, hertz; doyle measure-first ruling):** the stale-binary\r\n  premise was a rig artifact, not a reproduced product hole. At `9f809f8d`, in isolated Linux\r\n  worktree `hertz-ir12-mutation`, build `spt` once, mutate only its root CLI help string, do not\r\n  rebuild, then run `cargo run -p xtask -- check` alone: **exit 1**, combined output **3435 bytes**,\r\n  ending `xtask check: docs-site/src/cli/reference.md drifted from the binary's --help` (followed\r\n  by the regeneration instruction). The binary hash changed during check; the stale input was\r\n  rebuilt by `gen(true)` → `spt_bin` → `cargo build -q -p spt --bin spt` before comparison.\r\n  `CARGO_TARGET_DIR=UNSET`, `SPT_BLESS=UNSET`; Cargo's metadata target and xtask's read path both\r\n  resolve to this worktree's `target/debug/spt`. Source mutation was restored byte-for-byte.\r\n  Acceptance files: `~/spt-evidence/ir12-mutation-20260906/{check.exit,check.raw,env.txt}` on kitsubito.\r\n  The original rig mechanism remains unproven (old-mtime restoration or two target directories\r\n  are candidates, not findings). No product fix or permanent test added. IR-12 leaves the\r\n  register at the WEBSERVE close sweep.\r\n  The mandatory workspace-bins prebuild leg stays in every gate driver on its own merit (caught W2's spacerun red the night it was adopted); it is no longer justified by this note.\r\n- **What/why (corrected — the consequence sentence was false at `b7b00c3`):** the literal claim\r\n  holds — `xtask check` does not regenerate-and-compare the schema — but staleness does NOT \"ship a\r\n  wrong public contract silently\": `checked_in_schema_is_current`\r\n  (crates/spt-runtime/src/manifest.rs:2363, `int->REQ-DOCS-5`, landed `be4e46c` 2026-06-05, BEFORE\r\n  this entry's last sweep — docs lagging code) asserts full content equality of the checked-in\r\n  `manifest.schema.json` against what the derives generate, CRLF-normalised, `SPT_BLESS=1` as the\r\n  regenerate path. It is REACHED (lib unit test; ci.yml:114 runs `-E kind(lib)+kind(bin)` on push;\r\n  golden Phase A re-runs the workspace). Exactly ONE schema file exists in the tree; `docs_bundle`\r\n  (xtask main.rs:609-618) COPIES it at build time, so no second stored copy can drift. Chain closes:\r\n  derives → checked-in (unit-gated) → bundle (copied, not stored).\r\n- **What remains open, and the entry narrows to it:** `check_llms_links` (xtask main.rs:521)\r\n  hardcodes `manifest.schema.json` and `llms-full.txt` as always-existing, so the link check can\r\n  never see them MISSING — a blind arm, not a drift hole.\r\n- **The discrimination is now PROVEN, not presumed (todlando 2026-08-04, burn-the-build arms in\r\n  isolated worktree ir12-mutation @`11169c1`, env verified clear of `SPT_BLESS` FIRST — set, the\r\n  test short-circuits into a WRITE and a mutation arm silently self-heals green; that env check is\r\n  now part of the rig recipe):** arm 0 baseline PASS by NAME (1 test run); arm 1 semantic single\r\n  byte (title `…manifest`→`…manifesX`, length unchanged, scripted edit with match-count refusal)\r\n  REDS at manifest.rs:2374 exit 100 — \"manifest.schema.json drifted from the derives — regenerate\r\n  with SPT_BLESS=1\", with the mutated token appearing exactly once in 96,248 B of assertion output\r\n  so the byte is provably the only delta; arm 2 whitespace-only (CRLF→LF, 1014 endings) PASSES —\r\n  and arm 0 is itself the stronger normalisation proof, since the on-disk file is CRLF while the\r\n  generated string is LF, so an unmutated PASS is only possible because the test normalises; arm 3\r\n  restore re-measured PASS at the pristine sha256. `checked_in_schema_is_current` is a REAL gate.\r\n- **Built evidence:** `check_llms_links` resolves stored root assets to their\r\n  real source paths and runs the `llms-full.txt` generator instead of returning\r\n  hardcoded `true`. A unit cell proves a missing schema and install script are\r\n  refused, then accepted only after the real source file exists.\r\n- **Ripe when:** next xtask/docs-gate wave (now sized to the blind arm only).\r\n- **Size:** tiny.\r\n\r\n### IR-13 — Test-soundness follow-ups from the uniform-table sweep\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** ex releases#58\r\n- **What/why:** the remaining candidates from the closed issue were mutation-proved before changing\r\n  tests. `hold_outranks_everything` now walks all four `Opportunity` arms (including\r\n  `HoldRelease`); changing held+release to start reds on that arm. Pure walk tests cover all four\r\n  `QuiesceOutcome` arms and all five `EffectKind` arms; making `KillUnconfirmed` clear or\r\n  `Registry` ephemeral reds independently. The join test now binds all six `JoinFail` variants to\r\n  both hold retention and the emitted failure class/retry payload; misclassifying `WrongCode`\r\n  reds. The access candidates had already landed in the W4 follow-up and its dead-seam removal,\r\n  so the hygiene lane does not manufacture a second test vocabulary beside them.\r\n\r\n### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\r\n- **Status:** open · **Origin:** ex releases#56 (was flag: NEEDS-OPERATOR in eval — operator input\r\n  now sought directly when the entry ripens, not via board flag)\r\n- **What/why:** the project `.worktrees/` dir accumulates content beyond what git tracks; audit +\r\n  reap recipe + a hygiene rule for lane close-out. Teardown discipline per docs and memory (classify\r\n  before delete, outbound links first).\r\n- ⚠ **The header of this entry previously read \"14 untracked orphan dirs vs 25 git-tracked\". Both\r\n  numbers were stale AND UNDATED**, so nobody could tell drift from error. Every count below is dated\r\n  and carries its command.\r\n\r\n#### THE COUNT DISAGREEMENT IS THE FINDING (measured 2026-08-03, todlando + doyle, main @`3efd7e6`)\r\n\r\nThree people measuring \"the worktrees\" got three answers. None was wrong; they answered three\r\ndifferent questions, and nothing in the tree states which one is meant:\r\n\r\n| answer | question it actually answers | command |\r\n|---|---|---|\r\n| **73** | all ENTRIES under `.worktrees/` | `ls -A .worktrees \\| wc -l` |\r\n| **52** | DIRECTORIES under `.worktrees/` | `ls -dA .worktrees/*/` |\r\n| **38** | registered worktrees INCLUDING the root checkout | `git worktree list` |\r\n| **37** | registered worktrees under `.worktrees/` | above, minus the root |\r\n\r\n**52 − 37 = 15 unregistered directories.** The 73 − 52 = **21 loose FILES** are covered below.\r\n\r\n**A count is only as good as its question.** Treat \"how many worktrees\" as under-specified until the\r\nanswer names its population — the same defect that made a naive `grep -rn` from the project root\r\ninflate a code count by **34.9×** (426 tracked `.rs` vs 14865 on disk excluding all `target/`), and\r\nmade that grep run past 120s while `git ls-files | xargs grep` returned instantly. **Scan roots and\r\npopulation definitions are the same class of error.** Use `git grep` / `git ls-files` for tracked\r\ncontent and `git worktree list --porcelain` for worktrees.\r\n\r\n#### THE 15 UNREGISTERED DIRECTORIES ARE FOUR DIFFERENT KINDS OF THING\r\n\r\n⛔ **CLASS A — LIVE BUILD POOLS, NOT ORPHANS. DO NOT DELETE.** 3 dirs, 13.2 GB. Each is the TARGET of\r\na junction that a REGISTERED worktree uses as its `target/`:\r\n\r\n| dir | inbound junction from | size | claim |\r\n|---|---|---|---|\r\n| `gate-target` | assembly-doorbell, doorbell-w1, doorbell-w2, doorbell-w3 | EMPTY | none |\r\n| `gate-target-render` | golden-render | 5.84 GB | `POOL-OWNER.json` → golden-render |\r\n| `gate-target-w4doc` | w4-cli-doc | 7.36 GB | none |\r\n\r\n**These are exactly the directories that read as obviously junk** — no `.git`, no source, leftover\r\nnames — and deleting one destroys a registered worktree's build pool and leaves a dangling junction.\r\n**Polarity was checked BEFORE classification, which is what caught it:** all 15 top-level dirs are\r\nREAL directories, none is itself a reparse point; the six junctions are **INBOUND**, at\r\n`<registered-worktree>/target`. See [[worktree-target-junction]], [[gate-worktree-target-disk]].\r\n\r\nTwo findings inside class A, neither of them a deletion question:\r\n- **`gate-target` has FOUR registered trees junctioned into ONE pool, with no `POOL-OWNER.json` at\r\n  all** — so nothing would refuse a second LIVE lane there. That is releases#103's exact hazard\r\n  sitting armed. The pool is also empty: someone reclaimed it and left four junctions aimed at a hole.\r\n- **`gate-target-render`'s `POOL-OWNER.json` carries only `owner_tree` and `written_by` — no pid and\r\n  no birth stamp.** A claim that cannot distinguish a live lane from a finished one is missing the one\r\n  property the claim mechanism exists to provide.\r\n\r\n**CLASS B — EMPTIED SKELETONS, ONE UNIFORM SHAPE.** 8 dirs, **0 files**: `acl-core`, `engine-room`,\r\n`ff-fastfollow`, `gate-23d5ceb`, `gate-ff`, `golden-a`, `golden-b`, `w2b-sender-stamp`. Every one is\r\nexactly `crates/spt-daemon/` and nothing else. **Eight independent removals stopping at the SAME\r\nrelative path is a mechanism, not litter.**\r\n\r\n**MECHANISM CORROBORATED LIVE, 2026-08-03:** a read-only PEB sweep of process CWDs during a running\r\n`spt-daemon` suite found ~20 processes — `spt_daemon-<hash>` test harnesses, `PING`, `cmd` — whose\r\nCWD was **exactly `<worktree>/crates/spt-daemon/`**, the precise path all eight skeletons froze at. A\r\n`git worktree remove` racing a straggler there deletes everything else and leaves that chain pinned.\r\nThe processes churn fast (all 17 sampled pids were gone within 30s, one already showing **pid reuse**\r\n— see [[pid-reuse-across-reboot]] for why a pid alone is never an identity), so the pin is a race, not\r\na steady state, and it recurs on every daemon-suite worktree.\r\n\r\n**CLASS C — FULLY EMPTY, no inbound junction.** 3 dirs, 0 bytes: `gate-41`, `gate-559632e`,\r\n`release-runbook-main-advance`. Class B with even the chain gone.\r\n\r\n**CLASS D — DELIBERATE SCRATCH, NOT RESIDUE.** 1 dir, 12 files, 50 KB: `_patches` — three `.patch`\r\nfiles with their `.untracked` manifests, plus `ir18-gate-logs/`. Modified the day before the audit,\r\ni.e. someone's working state.\r\n\r\n3 + 8 + 3 + 1 = 15.\r\n\r\n#### PIN STATE: NO SKELETON IS HELD TODAY (with a stated blind spot)\r\n\r\nRead-only PEB CWD sweep, 2026-08-03: **zero processes hold a CWD in any class-B or class-C\r\ndirectory** — every live pin was in `gate-ec5f38a` and `gate-main`, both REGISTERED and both running\r\nrigs at the time. So removal of B and C would succeed today; nothing is retrying it.\r\n\r\n⚠ **The sweep read 412 of 593 processes; 181 were unreadable** (elevated/system, no\r\n`PROCESS_VM_READ`). The no-pin result therefore holds over the READABLE population only. Cheap to\r\nre-run elevated before acting — [[absence-needs-sibling-probe]].\r\n\r\n#### THE LOOSE FILES: A SHARED LOCATION WITH NO STATED CONTRACT\r\n\r\n**21 loose files sit in `.worktrees/`** — gate logs (`gate-*.log`, `gate-559632e-log.txt`), rig\r\nscripts (`g6-curve.ps1`, `g6-postbounce.ps1`, `gate-w5-*.ps1`), and `gate-w5-notes.md`. **Nobody\r\ndeclared `.worktrees/` a log drop; it became one.** Same class as the memory index: a shared location\r\nwith no stated contract accumulates whatever anyone puts there, and **the first person to tidy it\r\ncannot tell residue from someone's working state** — class D is that risk already realised. The\r\nhygiene rule this entry owes should name where gate logs and rig scripts belong, not only how to reap\r\nworktrees.\r\n\r\n#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\r\n\r\nClasses B, C and D together are **under 51 KB**. All 13.2 GB of the unregistered population is class\r\nA, behind live junctions. **An orphan sweep is not a disk-space remedy**, and reading it as one sends\r\nyou at the wrong target: on the audit date, free space was **12.5 GB against the 32 GB golden floor**\r\n([[free-space-floor-blocks-golden]]) while the two largest pools on the box were `gate-ec5f38a/target`\r\n(14.33 GB) and `gate-main/target` (28.12 GB) — **both REGISTERED, so both outside the orphan\r\npopulation entirely.** The disk question and the orphan question have different populations; answering\r\none correctly says nothing about the other.\r\n\r\n- **AUDIT EXECUTED 2026-08-30 (doyle, the v0.66.0→NOW-SIGNAL between-milestone window; full\r\n  output `wt-census-2026-08-30.txt` in the session scratchpad, method = this entry's own):**\r\n  four answers BEFORE the sweep: 85 entries / 85 dirs / 76 registered incl root / 75 under\r\n  `.worktrees` → 10 unregistered, 0 loose files (the 21 loose files of 08-03 are gone).\r\n  **The 08-03 headline populations have INVERTED:** zero pools and zero junctions exist under\r\n  `.worktrees` at all (every registered tree reads `target=none`; the reparse sweep found no\r\n  inbound junction) — class A is EMPTY, so the armed pool hazards this entry named are\r\n  currently unpopulated. Unregistered classified: 4 fully-empty (C), 3 `crates/spt-daemon`\r\n  skeletons (B — the mechanism's fingerprint again), `_patches` (D, kept — working scratch),\r\n  and TWO content-bearing checkout remnants (gate-signet-w1 10.8MB, gate-w1-a8f04aff 27MB) =\r\n  registry-pruned dirs held by the conhost CWD pins IR-63's third face names. **Sweep\r\n  executed on the gater's own rigs:** evidence preserved FIRST\r\n  (`spt-preserve\\audit-2026-08-30\\`: gate-w1-a8f04aff's 229 non-HEAD files as a verified\r\n  tarball; er-instrument's 115-line UNCOMMITTED instrument diff as a patch — that worktree\r\n  belongs to hertz's lane and was NOT touched beyond the read-only copy), 16 pinning conhosts\r\n  killed by pid after a fresh probe, 9 dead rigs removed. AFTER: **76 dirs = 75 registered +\r\n  `_patches`, fully reconciled; zero unexplained entries, zero pins.** Reclaim was ~38MB —\r\n  reconfirming this entry's arithmetic that the orphan sweep is hygiene, not a disk remedy.\r\n  Landed-classification caveat: `git cherry` patch-id reads conflict-resolved picks\r\n  as UNLANDED (emit-single-write, fix-206/208/209 all show UNLANDED with shipped content), so\r\n  the census's landed column is a datum, never a reap authorization.\r\n- **HYGIENE RULE (the text this entry owed, written 2026-08-30 while the loose-file population\r\n  is zero — the rule exists BEFORE it refills):** `.worktrees/` holds exactly two kinds of\r\n  entry: **registered worktrees** and **`_patches/`** (the one declared scratch location).\r\n  Nothing else. Gate/rig artifacts follow their lifetime: (1) driver scripts, exit/raw files,\r\n  and logs live INSIDE their rig's worktree for the rig's life — they leave WITH it, via the\r\n  preservation step (copy what the verdict cites into `spt-preserve/<occasion>/`, verified by\r\n  cmp or a listed tarball, restore cost stated) and never accumulate beside the rigs; (2)\r\n  anything meant to outlive its rig goes to the repo ROOT beside the verdicts and RCAs it\r\n  supports (the census/finding/JIT convention) or into `spt-preserve/` — never loose in\r\n  `.worktrees/`; (3) a file found loose in `.worktrees/` is treated as UNCLASSIFIED WORKING\r\n  STATE — moved to `_patches/` with a dated note, never deleted on sight (class D is the risk\r\n  realised). Lane close-out = `git worktree remove` + prune + the conhost CWD-pin check\r\n  ([[IR-63]] third face) when removal refuses; a registry-pruned dir left behind is a defect\r\n  to sweep, not a norm.\r\n- **Ripe when:** between-milestone idle window (it is a dev-box chore, zero product risk) — but the\r\n  class-A pool findings are armed hazards and do not wait for it.\r\n- **Size:** small for the sweep; the hygiene rule and the pool-claim gaps are separate small items.\r\n- **Field instance (hertz sweep, 2026-08-04 — an unclaimed pool found rather than reasoned about):**\r\n  `.worktrees\\gate-target-w4doc` held **7,907,558,098 B with NO POOL-OWNER.json at all**. Not a stale\r\n  claim, not a foreign claim — no claim. Exactly this entry's shape, first measured instance. Reaped\r\n  under doyle's ruling as part of [[IR-27]]'s two-step teardown; the measurement stands on its own.\r\n\r\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\r\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\r\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\r\n…\n  anything that stalls it (the blanket-fsync canary; `attach_wedge_e2e` guards that budget).\n…\n","startLine":179,"lineNumbers":[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,null,620,null,725]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5781,"totalBytes":34244,"outputLines":432,"outputBytes":34244,"shownRange":{"start":179,"end":610},"nextOffset":611}}},"isError":false,"timestamp":1789094605696}}
{"type":"message","id":"64148f50","parentId":"4a0b0bfe","timestamp":"2026-09-11T02:43:25.708Z","message":{"role":"toolResult","toolCallId":"call_NC10ZoSYrhknngv0yv1qrYx6|fc_074aee81620ae383016aa36acb3e9c87d1878d86623cf307aa","toolName":"read","content":[{"type":"text","text":"### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n…\n#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n…\n- **AUDIT EXECUTED 2026-08-30 (doyle, the v0.66.0→NOW-SIGNAL between-milestone window; full\n…\n- **Field instance (hertz sweep, 2026-08-04 — an unclaimed pool found rather than reasoned about):**\n…\n\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\n  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\n  panic: `spt::resident_service_e2e::a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\n  (hfenduleam, FAIL 123.99s, \"PRECONDITION: the daemon never came up\", run 30782259675, green on\n  same-sha rerun 30784469908) and `spt::activity_link_push_e2e` (kitsubito, full 30s, run\n  30607903133 specimen, green on same-sha rerun; its \"brain stderr EMPTY\" leg and its family\n  membership are both CORRECTED in the 2026-08-30 sweep update below — the kitsubito member is\n  CLOSED under a named mechanism).\n  Family reading, not one flake: same missed-window shape, host-independent, both mid-leg under\n  load. Cross-ref KNOWN-HAZARDS 5.13 — bring-up has a hard ONLINE budget with known sensitivity to\n  anything that stalls it (the blanket-fsync canary; `attach_wedge_e2e` guards that budget).\n- **State line (the discriminating datum, resident_service red):** `daemon_up=false boot_alive=true\n  boot_pid=Some(8920) rel_started=false broker_survived=false` — the boot process was ALIVE at\n  panic time and the daemon never reached up. Any characterization run records this line per run,\n  not the verdict (hertz protocol 2026-08-03).\n- **Read of that line, CORRECTED 2026-08-03 (hertz):** it is NOT \"started-but-never-bound\" (the\n  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\n  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\n  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\n  `broker_survived`: false in every killed round of the positive control, true in every healthy\n  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\n  ran before reporting; deployah, who had carried the leg into four register sites, swept every\n  placement): \"empty daemon.stderr.log = TerminateProcess signature\" was false — the stderr\n  block is empty on PASSING runs too, so it carries zero information in either direction; it\n  failed the discriminator question and does not support the kill read.** The kill read now rests\n  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\n  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\n  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\n  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\n  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\n  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\n  predicts 0/N and that number answers no live question; the only sound population was the test\n  INSIDE the Phase A parallel pool, which costs a full Phase A leg per sample, and the fix is\n  warranted by the source-verified hazard class regardless of the specimen's rate. No rate figure\n  will exist for this specimen — do not later read its absence as a low rate; (d) **positive\n  control still runs, falling out of the\n  hypothesis:** kill the spawned daemon by pid mid-bring-up — after boot-service spawn, before\n  ready — and it must reproduce the observed line field for field (`daemon_up=false\n  boot_alive=true broker_survived=false`). If the rig cannot make that shape on\n  demand, a 0/N from the untouched arm is worth nothing and must be reported as worth nothing.\n  The host-INDEPENDENT family claim (kitsubito's `activity_link_push_e2e`) is untouched by this:\n  it has no such kill site named, so the family survives even if this specimen leaves it.\n- **POSITIVE CONTROL RAN 2026-08-03 (hertz, prebuilt a5042ec binary, box confirmed clear —\n  0 open runs, 145.95 GB free): shape reproduced 3/3, deterministic.** Negative arm n=2: 2/2 PASS\n  (5.59s, 5.46s), `daemon_up=true boot_alive=true rel_started=true broker_survived=true\n  survived_teardown=true`. Positive arm (daemon killed by parent-scoped descent after\n  boot-service spawn, before ready) n=3: 3/3 FAIL (93.95/93.25/93.50s), state line identical to\n  the CI red in EVERY field except boot_pid (a pid, must differ), same panic, same site\n  (resident_service_e2e.rs:382). Structural fact the arm settled, and the refutation risk that\n  made it worth running: the boot service rises BEFORE brain.ready becomes readable — had the\n  order been reversed the arm would have produced daemon_up=true and refuted the mechanism.\n  CEILING MET, NOT EXCEEDED: the control used Stop-Process -Force (TerminateProcess — the same\n  primitive as taskkill /F), so it proves a forced daemon kill after breakaway-service spawn\n  produces this exact line ON DEMAND; it says nothing about WHO issued one in golden 30782259675.\n  Candidate mechanism, shape reproduced on demand — \"root caused\" written by nobody. Duration\n  note, recorded not explained: 93.5s local (idle box) vs 123.99s CI (Phase A parallelism), both\n  burning the same three 45s windows — consistent, not verified.\n- **Same-host sub-observation (hertz, host-CONSTANT — narrower claim, kept separate):** both\n  reds of 2026-08-03 sat on hfenduleam Windows Phase A and burned their full windows:\n  `a_tree_teardown_reaches_a_grandchild_the_service_spawned` (run 30776330383, FAIL 10.176s = the\n  full poll deadline, vs a 0.19–0.66s pass band — 15–50x out) + the resident_service row above.\n  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\n  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\n  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\n  is the claim that survives someone fixing this box; the sub-observation is what is actionable\n  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\n  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\n  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\n  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\n  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\n  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\n  narrowed by hertz's log forensics (competence-controlled: the capture channel demonstrably\n  prints): no DETACH_BREAKAWAY_DENIED (breakaway rung taken), no SERVICE_JOB_UNAVAILABLE (job\n  created + child enrolled), no SERVICE_TREE_KILL_INCOMPLETE (TerminateJobObject returned\n  success) — everything enrolled died; THE SURVIVOR WAS NEVER ENROLLED. Two hypotheses,\n  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\n  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\n  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\n  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\n  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\n  state: INSTRUMENTED-AWAITING-FIRE; a green retires nothing (doyle-ruled). **UPDATE 2026-08-04\n  (USHER att3):** row green at 17f95a7 (retires nothing, per the ruling). New shape evidence while\n  waiting for the probe: BOTH archived reds sit AT the 10s poll bound (daemon.rs:2757) — 10.176s and\n  10.225s — while todlando's 200 off-CI passes under live-fleet load ran 1-4s, never near it. The\n  post-fix red is therefore BOUND-EXPIRY-shaped (kill fired; the pinned identity stayed\n  not-provably-gone past 10s — TerminateJobObject is async), not kill-wrong-shaped. The bound\n  question (is 10s right for a loaded runner) is parked with hertz's USHER package item 4 and must\n  not touch the kill path or spawn flags before the probe fires. See also the FLAKE-LEDGER row for\n  the false-repeat correction (the 10.176s red was the PRE-a5042ec bare-pid mechanism).\n- **Declared read (2026-08-03, rules the next red):** a same-sha green rerun is protocol-conclusive\n  for the GATE, not the class. No third silent sample — the next occurrence of this signature gets\n  an instrumented resident-service bring-up investigation (hertz), not a rerun.\n- **SWEEP UPDATE 2026-08-30 (#242/v0.66.0 close — three corrections, correct-by-replacement):**\n  (1) **The 2026-08-03 \"brain stderr EMPTY\" reading on the kitsubito specimen is a METER\n  ARTIFACT, not a silent brain** (deployah measured 2026-08-29): the brain-panel stderr capture\n  only LANDED 2026-08-19 (`ab657626` + `e6e188e1`), 16 days after the specimen — at the specimen's\n  sha there was nothing to capture, so \"empty\" carried zero information; current bits label\n  absence explicitly, so empty-vs-present cannot recur as a distinction. This replaces the\n  \"cheap to settle next time someone has kitsubito\" item — there is nothing left to settle.\n  (2) **The kitsubito family member is CLOSED under a NAMED mechanism:** RCA-242-R2-LINUX.md\n  (v0.66.0 golden r2) measured `current_exe_hash()` on the READY PATH at ~10.1s per boot on\n  kitsubito under load (~1.5s Windows) via BRAIN_PHASE breadcrumbs + harvest-loop repro — a\n  bring-up that misses its ONLINE window under leg load is exactly what a ~10s synchronous hash\n  inside the ready path manufactures. The behaviour-change request (hash off the ready path,\n  ADR-0018 Q7) is minted on the board at this sweep as **releases#244** (BACKLOG, operator\n  triages). The family's host-INDEPENDENT claim\n  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\n  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\n  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\n  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\n  wait, #235 shape). Overlap with correction (2) checked at link time: his cells are TEST-side\n  (message truth + wait shape) and stand regardless of the product-side hash fix.\n- **Ripe when:** next occurrence of the signature (immediate instrumented dispatch), or a hertz\n  test-hardening wave (bring-up phase-timing instrumentation, per-phase deadline attribution).\n- **Size:** medium (bring-up instrumentation + attribution; the fix depends on what it shows).\n\n### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\n- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\n  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\n  deployah's log read\n  + todlando's flagged-not-asserted arm). Operator-classified infra 2026-08-02: daemon-kill\n  internals are agent-facing, not operator-facing surface.\n- **What/why:** `DetachedChild::kill_tree` (daemon.rs:1433 vicinity) calls\n  `unsafe { TerminateJobObject(self.job, 1) }` and discards the return; TerminateProcess likewise\n  unaudited. A job that was created and assigned at spawn but whose TERMINATION fails at kill time\n  yields the grandchild-survives symptom with zero log signal — the spawn-side\n  SERVICE_JOB_UNAVAILABLE announcement is correctly absent (that arm is instrumented and was\n  refuted for the specimen by a positively-controlled zero). Wanted: (1) check + log both\n  termination returns loudly on failure; (2) the degraded-arm decision — fallback process-table\n  tree-walk kill or explicit refusal, never a silent partial kill wearing REQ-RESIDENT-SERVICE's\n  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\n  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\n  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\n- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\n  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\n- **Size:** small.\n- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\n  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\n  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\n  at all rather than silently skipping it).\n- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\n  2026-08-04): `62c5623` satisfies (1) — both termination returns are now checked and the loss is\n  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\n  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\n  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\n  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\n  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\n  `detached_no_inherit_env` cosmetic rider did NOT land and was dropped at `de6a01d` on a MEASURED\n  false premise, not deferred. A Windows-specific finding rides the fix as a comment and is worth\n  keeping: `TerminateProcess` against a handle to an already-exited process returns 0 with\n  `GetLastError` 5 (`ERROR_ACCESS_DENIED`), so a naive check there fires on the ORDINARY path.\n\n### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\n  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\n  platforms — `spt::resident_service_e2e a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\n  PASS 17.773s (100/2637) on hfenduleam/Windows and PASS 17.895s (1364/2616) on kitsubito/Linux.\n  The pool was checked for the test rather than inferred from the job colour, because a green leg\n  that never ran the test is a competence-controlled zero, not an acquittal; `resident_service_e2e`\n  contains exactly ONE `#[test]`, so the test that ran IS the test the lane rewrote (229 lines of\n  that file changed in `6e1a962`). No red returned to doyle. `.worktrees/ir18` is released for\n  teardown by this verdict · **Origin:** hertz\n  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\n  reproduction\n- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\n  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\n  empty across the rebase, so the gate verdict and local behavioral evidence transfer). Gated by\n  doyle: full diff review (one blocking finding — the scope_lost assert condition contradicted its\n  own guard ruling — fixed and delta-verified at one line), mutation-proven locally both\n  directions (B: forced boot_pid=None → population sweep names the leak no per-pid check sees,\n  FAIL 101; A: wrong expected_exe → REFUSED-foreign-image reds loudly on the derivation check).\n  EVIDENCE SPLIT, stated so the check marks cannot carry it (hertz's absent-leg callout): lane CI\n  30792210008 was 5/5 green per job but ci.yml's test leg is kind(lib)+kind(bin) — the changed\n  integration test NEVER RAN there (verified by log grep, 0 hits / 3023 lines); CI proved\n  compile-everywhere (clippy all-targets = the pool-population check for a common/ module),\n  traceability, lib/bin clean. The BEHAVIORAL evidence is local: three clean runs (all verdicts\n  Killed, population empty) + the two mutation reds. reap.rs diff additive-only (zero deleted\n  lines, verified) — cross-test risk bounded to compilation, which CI covered. Evidence custody:\n  gate + mutation logs at `.worktrees/_patches/ir18-gate-logs/` (5 files); `.worktrees/ir18` is\n  KEPT deliberately until the golden verdict (NOT an orphan — do not reap; a Phase A red wants the\n  tree and logs in place, not rebuilt); its pool claim is released.\n- **What/why:** `crates/spt/tests/resident_service_e2e.rs:46` defines its own reaper —\n  `taskkill /PID <pid> /F /T`: bare pid, force, whole TREE, no identity check — and feeds it three\n  BREADCRUMB-derived pids in cleanup (`boot_pid`, `rel_service_pid` at :360, and the pid read out\n  of `brain.ready` at :363). The suite already ships the authenticated tool other tests use and\n  this one does not: `common::reap::authenticated_kill(label, pid, expected_exe, observed)` at\n  `crates/spt/tests/common/reap.rs:116`. Inside the Phase A parallel pool on a pid-churning box\n  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\n  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\n  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\n  bare pid. Kill what you pinned, not the number it happens to hold.\n- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\n  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\n  `CREATE_BREAKAWAY_FROM_JOB` spawn (`daemon.rs:1300`).\n- **Evidence rating — why it is a candidate and not a cause:** it predicts every field of the one\n  observed state line. The daemon is killed after spawning its boot service and before binding:\n  `broker_survived=false` (the discriminating field — false in every killed control round, true in\n  every healthy one) + `boot_alive=true boot_pid=Some(8920)` with the service's message in the\n  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\n  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\n  The service outlives its daemon because `detached_no_inherit_env` spawns it\n  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\n  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\n  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\n  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\n  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\n  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\n  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\n  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\n  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\n  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\n  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\n  the daemon dies, `rel_pid` is `None` so that service is never even a kill target, and the\n  breakaway child outlives everything. A teardown that leaks two processes per round currently\n  PASSES: the concrete case for `target_gone` as the gate's positive half. (Leak cleaned scoped,\n  each pid re-authenticated by image-path prefix + creation window at kill time, not from the\n  minute-old enumeration.) ONE LAYER DEEPER (deployah, same night, at source): the reap loop\n  (:359) is `[boot_pid, rel_service_pid].into_iter().flatten()` — `.flatten()` DROPS None, and\n  `mock_pid` (:100-106) collapses absent/permission-denied/IO-error/garbage into that None via\n  `.ok()?`/`.ok()` — the reap.rs:59-63 collapse in a THIRD location, inside this very test. So the\n  leak is both \"service never started\" AND \"pid unreadable, therefore never a kill target\":\n  absence of knowledge read as absence of target, in a teardown, again.\n- **GATE SPEC AMENDED PRE-BUILD (deployah found the hole, doyle-ruled 2026-08-03 — read this\n  BEFORE building the lane):** the two halves as first specified (trap-class-absent +\n  `target_gone` per pid) both operate on pids we HAVE — a process whose pid is None is invisible\n  to BOTH, so the specified gate PASSES hertz's own control-run leak (12 processes, 6+6, 2/round,\n  teardown reaped none). A gate its own reproduction case passes is not yet an instrument. THIRD\n  HALF, REQUIRED: a POPULATION assertion at teardown — zero surviving staged-service or\n  test-owned spt processes, by selectors external to the pid bookkeeping. SELECTOR RESPELLED\n  (hertz 2026-08-03, doyle-approved — the first spelling, \"parent-pid descent from the test\n  process\", would have caught ZERO of the 12: teardown kills the daemon before any check runs, the\n  BFS over the current (pid,ppid) table breaks at the dead middle hop, and descendants(test_pid)\n  returns empty exactly in the leak case — an absence read as a clean, the shape the lane exists\n  to kill; the control's own cleanup is the evidence, it had to use image+creation-window because\n  descent was already broken). THE TWO SELECTORS AS BUILT: (1) svcmock half by IMAGE PATH —\n  stage_adapter copies the service binary under this run's unique tempdir home, so \"any pid whose\n  exe_path canonicalizes under home\" names every staged service this run started and nothing else\n  on the box; no bookkeeping, immune to reuse and broken chains. (2) spt.exe half by SEEDED\n  descent + image — image alone is forbidden (target/debug/spt.exe is shared with concurrent\n  tests and live perches: the machine-wide selector class); seed with the ancestor set captured\n  WHILE ALIVE ({test, broker from the Child handle, brain from brain.ready — none via mock_pid}),\n  union descendants, keep only exe_path==spt_bin. Reuse exposure on seeds is assertion-only (a\n  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\n  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\n  same night — the third instance of that sentence tonight, this time inside our own instrument):\n  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\n  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\n  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\n  image, on this box. So the population assertion counts unreadable-path processes as their OWN\n  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\n  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\n  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\n  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\n  stays open.\n- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\n  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\n  filed remedy at source 2026-08-03: daemon.rs has exactly ONE CreateProcessW (:1187) and\n  BASE_FLAGS (:1105) already carries 0x0800_0000 = CREATE_NO_WINDOW on both rungs including the\n  ACCESS_DENIED fallback (which drops only BREAKAWAY), so the specified edit ORs an already-set\n  bit — a bit-for-bit identical flag word that would close a board item while its symptom, if\n  real, continues. #131 handed back to board triage with the finding and a candidate direction:\n  DETACHED_PROCESS gives the service no console, so a console child the SERVICE spawns flagless\n  allocates a NEW visible window — the grandchild, not the daemon's spawn, is the candidate\n  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\n  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\n  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\n  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\n  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\n  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\n  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\n  arrives as `extra_flags` at daemon.rs:1506), so renaming on the stated premise would have traded\n  an accurate word for one that drops a flag the function really sets. Independently fatal: the\n  premise, if true, covers the sibling `detached_no_inherit` equally — 17 references across\n  daemon.rs/deelevate.rs/shellhost.rs — and renaming one of two siblings of ONE posture leaves the\n  tree MORE inconsistent, not less. **What lands instead:** one doc-comment line on EACH function\n  naming the full effective flag word, which fixes the real complaint (neither name says breakaway)\n  without touching a call site. Kept here rather than deleted because this entry was the claim's\n  only home, and a reader who found the rename gone with no reason would re-derive it.) PER-PID GROUND TRUTH for expected_exe (hertz — SELF-CORRECTED\n  at source before it ever landed; his first derivation, \"Copy runs from adapters_dir(), Pointer\n  runs from srcs/\", was WRONG and registration mode is NOT the discriminator): servicehost.rs:1328\n  takes `install_dir` from `record.source_dir` on the Started arm for EVERY service, Copy and\n  Pointer alike, and Copy copies only the manifest + strings/ (registry.rs:395-404), never a\n  binary — `adapters_dir()` holds no executable in either mode. BOTH services run from their OWN\n  staged src dir: `staged_bin(<adapter's staged src dir>, \"svcmock\")`. The trap survives with a\n  different mechanism: two adapters staged into two DIFFERENT source dirs are two different files\n  on disk, so one expected_exe still cannot serve both. A lane that trusted the mode split would\n  derive a path with no binary at it. How it was caught, kept because it is the reusable part: not\n  by rereading the mode table but by finding where install_dir is COMPUTED instead of trusting an\n  already-published inference — the mode split was true of MANIFESTS and had been generalized to\n  BINARIES without checking the consumer; and the derivation-asserted-at-observe() instrument\n  would have caught it at runtime regardless — the instrument did its job before it ever ran,\n  argued against its own author. SCOPE_LOST RULED A GUARD, NOT A FINDING (hertz design change,\n  doyle-approved): a seed pid recycled before the sweep makes the sweep DECLINE that subtree\n  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\n  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\n  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\n  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\n  reach, not load-bearing. `unreadable` stays FATAL as ruled.\n  Sequencing: positive control\n  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\n  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\n  lane under the dispatch split; the two cross-ref, they do not merge.\n- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\n  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\n  passing spt_bin for those refuses every kill as foreign-image and LEAKS both services while the\n  reap reads hardened. Only `brain.ready`'s pid takes spt_bin. Also: `observe()` boot_pid at :210\n  while it is provably ours, so the reuse check has creation-time teeth instead of degrading to\n  image+ancestry.\n- **Gate the lane on killing, not on refusing (deployah 2026-08-03; REFINED by hertz same night\n  from reap.rs's own contract):** the hardened version fails safe in the WRONG direction —\n  refuse-everything leaks both services while printing exactly the reap line a reviewer wants to\n  see, strictly worse than the bare kill it replaces and invisible in the same log. But a BLANKET\n  zero-REFUSED gate is wrong too: reap.rs's module doc (:18–20) states refusal is the CORRECT\n  happy-path outcome when the test already stopped its daemon (`Refused(\"gone\")` — leak insurance,\n  not primary teardown), so the blanket gate reds healthy runs, someone loosens it to go green, and\n  the loosened version is exactly the one blind to foreign-image — the detector dies by\n  maintenance, wearing a green. The refusal reasons split, and only one class is a defect:\n  SOUND (expected): `gone`, `reused`, `breadcrumb-moved`, `self`, `ancestor` — target provably not\n  there. TRAP (the false-clean state): `foreign-image`, `unreadable-image`, `unproven-identity` —\n  something WAS there and authentication declined; `foreign-image` is precisely what a wrong\n  per-pid expected_exe produces on every pid, every run. THE GATE: in the arm that must kill,\n  assert no verdict in the trap class — structurally on the returned `Verdict` (Killed |\n  Refused(&'static str), stable tokens by design, reap.rs:48), not by scraping output; the\n  `REAP[label]: … verdict=` line stays as CI-log forensics. The gate's comment MUST say\n  `Refused(\"gone\")` is expected, or the next reader \"fixes\" it. Positive counterpart that actually\n  proves the reap: assert `target_gone(pid, expected_exe, observed)` (reap.rs:215 — no-knowledge\n  never read as death) per service pid; bare-liveness \"no survivors\" is the false-clean named above.\n  TOKEN SET VERIFIED COMPLETE-PLUS-ONE (deployah, refuse() sites enumerated at source): the eight\n  tokens above sit at :128 self, :132 ancestor, :136 breadcrumb-moved, :146 gone, :149\n  unproven-identity, :155 reused, :166 unreadable-image, :172 foreign-image — each in the right\n  class — and there is a NINTH neither list held: `Refused(\"no-breadcrumb\")` at :243, returned\n  before authenticated_kill is reached. Doyle-ruled 2026-08-03, both halves: (1) `no-breadcrumb`\n  classifies SOUND — **SCOPED (deployah source-read, same night): it is two states wearing one\n  name.** `breadcrumb_daemon_pid` (reap.rs:59–63) collapses file-absent, permission-denied, any IO\n  error, AND a husked/unparseable partial write into one `None` via two `.ok()`s — so the token is\n  ABSENCE OF KNOWLEDGE, not proof of absence, and it is SOUND only because the calling test has\n  already asserted its daemon stopped. Every other SOUND token carries positive proof; a LIVE\n  daemon whose pid file is unreadable or husked emits the identical token and leaks wearing\n  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\n  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\n  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\n  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\n  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\n  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\n  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\n  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\n  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\n  read-only): 21 caller tests, every one passing &spt_bin as expected_exe (the per-pid trap is\n  specific to resident_service_e2e's svcmock pids — it does not generalize to this population);\n  20 callers fire-and-forget the Verdict; the one value-assertion, reaper_guard.rs:192-196, pins\n  `Refused(\"no-breadcrumb\")` for an ABSENT breadcrumb only — absent KEEPS the token under the\n  split, so that assertion survives unchanged (:183's stale-pid check is the loose\n  `matches!(Refused(_))`). The split is ADDITIVE: one source split, one new token, zero caller\n  rewrites. THE GAP THAT LET THE COLLAPSE HIDE: reaper_guard covers eight refusal shapes but has\n  NO test for an unreadable or malformed daemon.pid — the one state where absence-of-knowledge\n  reads as absence-of-target is the one state without a conformance test; (b) ships with exactly\n  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\n  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\n  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\n  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\n  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\n  (reap.rs:59-63, resident_service_e2e's mock_pid :100-106, and the shape wherever a test reads a\n  self-written pid file) — so (b) lands ONE shared read-a-pid-breadcrumb helper that distinguishes\n  absent from unreadable ONCE, adopted at the enumerated sites, not a per-site token split; the\n  single-source-discriminant rule, applied before a fourth site mints itself.\n  **THIRD SITE CONFIRMED AT SOURCE (deployah, read-only 2026-08-04) — it was a predicted SHAPE and\n  is now an address:** `crates/spt/tests/resident_service_e2e.rs:136-137`, `brain_ready`, which\n  `.ok()?`s BOTH the read and the JSON parse — two collapses in two lines, the self-written-pid-file\n  shape this entry predicted. What makes it the worst of the three rather than the third of three:\n  its output feeds `brain_seed`, a population-sweep SEED, so an unreadable `brain.ready` silently\n  drops a whole subtree from the sweep. The other two sites lose one pid; this one degrades the very\n  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\n  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\n  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\n  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\n  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\n  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\n  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\n  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\n  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\n  SECOND (b) INTAKE ITEM (hertz self-noted at re-gate, doyle-ruled deferred): cleanliness is\n  currently stated at THREE sites (two asserts + `is_clean`) — the drift that produced the\n  scope_lost condition bug (a failed edit followed by a narrower successful one replaced the\n  message but not the condition; the artifact of that failure mode IS message/code disagreement).\n  (b) consolidates to conditions derived from one source, weighing the two-message diagnostic\n  split it would cost. The\n  exhaustive panic-catch-all match is what makes the split safe to do later: the new token lands\n  loud on first fire in every consuming gate, forced to be classified, never silently passed. Until then the scoped reading above is the\n  gate's contract — and the LANE BUILDER writes that scoped reading into the match's SOUND-arm\n  comment (the sketch's \"nothing to read is nothing to kill\" is the exact inference the source\n  forbids; the comment must not teach the false step); (2) the gate closes over the\n  token set — SPELLED BUILDABLY (hertz correction 2026-08-03; the earlier \"no wildcard arm\" wording\n  is an instruction rustc rejects, since the refusal reason is a `&'static str` (:55) and a string\n  match always requires a catch-all): the match names the six SOUND tokens as a pass arm, the three\n  TRAP tokens as a panic arm, and the REQUIRED catch-all arm is not a wildcard PASS — it panics\n  naming the unknown token (\"unclassified reap refusal token — classify it in this match\"), so\n  upstream drift announces itself the first run it fires instead of sliding into a silent pass.\n  Runtime fail-closed, not compile-time: compile-time closure needs the reason to become an enum in\n  common/reap.rs, an upstream change touching every consumer — ruled NOT smuggled into this lane\n  (candidate for its own thin lane if ever wanted; doyle concurs runtime fail-closed is\n  proportionate). Direction of the default, kept in the record: a missed trap state is an invisible\n  leak wearing the reap line a reviewer wants to see; an unclassified harmless token is a loud red\n  costing one edit. Cheap and loud beats silent and wrong. (Count hygiene, hertz self-flagged: a\n  single-line grep for the refuse() sites returns five of nine — three wrap across lines; the nine\n  stands on reading, not the grep. The sweep-count trap in miniature.)\n- **Prior observed instance of the class, in-tree (hertz 2026-08-03 — stated to understate):**\n  reap.rs:3–11 documents the measurement and a casualty: pid reuse on the Windows gate box at\n  2.2s minimum / p50 11.7s under a Phase-A battery, and a concurrent test process killed by a bare\n  kill on a stale breadcrumb pid, dying with bare exit 1 and no panic — the observed\n  `worker_lifecycle_e2e` red in golden job 90742055246 (that test's intermittent class is board\n  releases#32, still in-flight). Different test, different job — it does NOT reproduce this entry's\n  specimen and promotes nothing; what it settles is that the class is real IN THIS SUITE with a\n  named victim, and the authenticated reaper is the remedy someone already built for it —\n  resident_service_e2e simply never adopted it. Two shape-predictions it supplies, made before this\n  specimen existed: the p50 11.7s reuse window is short against this test's 45s waits and ~124s\n  runtime (window wide open). (A second claimed match — \"bare-exit-1-no-panic matches the empty\n  daemon.stderr.log\" — is RETRACTED as a category error, hertz+deployah 2026-08-03: reap.rs's\n  phrase describes the VICTIM TEST PROCESS dying, not a daemon's log; two processes, two\n  artifacts.) Predictions, not proof; the specimen stays CANDIDATE — shape since reproduced on\n  demand, agent unidentified (see the control record above).\n- **Rig near-miss, caught before first execution (hertz 2026-08-03) — kept as design justification,\n  not an anecdote:** the positive-control arm's first draft selected its victim machine-wide\n  (`Win32_Process Name='spt.exe'` + cmdline match `daemon run`, then force-kill). hfenduleam is the\n  Windows CI runner as well as a dev box, so that filter matches CI's own test daemons: run while a\n  leg was live, it would have force-killed a running job's daemon and reported the result as a\n  measurement — fabricating a red in someone else's job, the exact class this entry documents.\n  Corrected to a parent-scoped selector (daemon = child of the test pid; service = child of that\n  daemon); `CREATE_BREAKAWAY_FROM_JOB` does not weaken parent-id attribution, since breakaway leaves\n  the JOB, not the parent record — which is also why the orphaned svcmock stays attributable to the\n  daemon that spawned it. **The load bought the catch** (blocked on the box ⇒ re-read instead of\n  ran). Bearing on the fix: the INSTRUMENT built to study a bare-selector reaper was itself written\n  with a bare selector. The remedy therefore cannot be \"be careful\" — the authenticated path must be\n  the only one within reach in this suite.\n- **Ripe when:** RIPE NOW, and not gated on the rate run that was cancelled.\n- **Size:** small.\n\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\n  source same night.\n…\n\n\n[Showing lines 607-1050 of 5781. Use :1051 to continue]"}],"details":{"truncation":{"content":"\r\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\r\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\r\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\r\n  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\r\n  panic: `spt::resident_service_e2e::a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\r\n  (hfenduleam, FAIL 123.99s, \"PRECONDITION: the daemon never came up\", run 30782259675, green on\r\n  same-sha rerun 30784469908) and `spt::activity_link_push_e2e` (kitsubito, full 30s, run\r\n  30607903133 specimen, green on same-sha rerun; its \"brain stderr EMPTY\" leg and its family\r\n  membership are both CORRECTED in the 2026-08-30 sweep update below — the kitsubito member is\r\n  CLOSED under a named mechanism).\r\n  Family reading, not one flake: same missed-window shape, host-independent, both mid-leg under\r\n  load. Cross-ref KNOWN-HAZARDS 5.13 — bring-up has a hard ONLINE budget with known sensitivity to\r\n  anything that stalls it (the blanket-fsync canary; `attach_wedge_e2e` guards that budget).\r\n- **State line (the discriminating datum, resident_service red):** `daemon_up=false boot_alive=true\r\n  boot_pid=Some(8920) rel_started=false broker_survived=false` — the boot process was ALIVE at\r\n  panic time and the daemon never reached up. Any characterization run records this line per run,\r\n  not the verdict (hertz protocol 2026-08-03).\r\n- **Read of that line, CORRECTED 2026-08-03 (hertz):** it is NOT \"started-but-never-bound\" (the\r\n  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\r\n  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\r\n  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\r\n  `broker_survived`: false in every killed round of the positive control, true in every healthy\r\n  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\r\n  ran before reporting; deployah, who had carried the leg into four register sites, swept every\r\n  placement): \"empty daemon.stderr.log = TerminateProcess signature\" was false — the stderr\r\n  block is empty on PASSING runs too, so it carries zero information in either direction; it\r\n  failed the discriminator question and does not support the kill read.** The kill read now rests\r\n  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\r\n  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\r\n  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\r\n  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\r\n  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\r\n  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\r\n  predicts 0/N and that number answers no live question; the only sound population was the test\r\n  INSIDE the Phase A parallel pool, which costs a full Phase A leg per sample, and the fix is\r\n  warranted by the source-verified hazard class regardless of the specimen's rate. No rate figure\r\n  will exist for this specimen — do not later read its absence as a low rate; (d) **positive\r\n  control still runs, falling out of the\r\n  hypothesis:** kill the spawned daemon by pid mid-bring-up — after boot-service spawn, before\r\n  ready — and it must reproduce the observed line field for field (`daemon_up=false\r\n  boot_alive=true broker_survived=false`). If the rig cannot make that shape on\r\n  demand, a 0/N from the untouched arm is worth nothing and must be reported as worth nothing.\r\n  The host-INDEPENDENT family claim (kitsubito's `activity_link_push_e2e`) is untouched by this:\r\n  it has no such kill site named, so the family survives even if this specimen leaves it.\r\n- **POSITIVE CONTROL RAN 2026-08-03 (hertz, prebuilt a5042ec binary, box confirmed clear —\r\n  0 open runs, 145.95 GB free): shape reproduced 3/3, deterministic.** Negative arm n=2: 2/2 PASS\r\n  (5.59s, 5.46s), `daemon_up=true boot_alive=true rel_started=true broker_survived=true\r\n  survived_teardown=true`. Positive arm (daemon killed by parent-scoped descent after\r\n  boot-service spawn, before ready) n=3: 3/3 FAIL (93.95/93.25/93.50s), state line identical to\r\n  the CI red in EVERY field except boot_pid (a pid, must differ), same panic, same site\r\n  (resident_service_e2e.rs:382). Structural fact the arm settled, and the refutation risk that\r\n  made it worth running: the boot service rises BEFORE brain.ready becomes readable — had the\r\n  order been reversed the arm would have produced daemon_up=true and refuted the mechanism.\r\n  CEILING MET, NOT EXCEEDED: the control used Stop-Process -Force (TerminateProcess — the same\r\n  primitive as taskkill /F), so it proves a forced daemon kill after breakaway-service spawn\r\n  produces this exact line ON DEMAND; it says nothing about WHO issued one in golden 30782259675.\r\n  Candidate mechanism, shape reproduced on demand — \"root caused\" written by nobody. Duration\r\n  note, recorded not explained: 93.5s local (idle box) vs 123.99s CI (Phase A parallelism), both\r\n  burning the same three 45s windows — consistent, not verified.\r\n- **Same-host sub-observation (hertz, host-CONSTANT — narrower claim, kept separate):** both\r\n  reds of 2026-08-03 sat on hfenduleam Windows Phase A and burned their full windows:\r\n  `a_tree_teardown_reaches_a_grandchild_the_service_spawned` (run 30776330383, FAIL 10.176s = the\r\n  full poll deadline, vs a 0.19–0.66s pass band — 15–50x out) + the resident_service row above.\r\n  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\r\n  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\r\n  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\r\n  is the claim that survives someone fixing this box; the sub-observation is what is actionable\r\n  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\r\n  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\r\n  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\r\n  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\r\n  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\r\n  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\r\n  narrowed by hertz's log forensics (competence-controlled: the capture channel demonstrably\r\n  prints): no DETACH_BREAKAWAY_DENIED (breakaway rung taken), no SERVICE_JOB_UNAVAILABLE (job\r\n  created + child enrolled), no SERVICE_TREE_KILL_INCOMPLETE (TerminateJobObject returned\r\n  success) — everything enrolled died; THE SURVIVOR WAS NEVER ENROLLED. Two hypotheses,\r\n  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\r\n  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\r\n  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\r\n  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\r\n  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\r\n  state: INSTRUMENTED-AWAITING-FIRE; a green retires nothing (doyle-ruled). **UPDATE 2026-08-04\r\n  (USHER att3):** row green at 17f95a7 (retires nothing, per the ruling). New shape evidence while\r\n  waiting for the probe: BOTH archived reds sit AT the 10s poll bound (daemon.rs:2757) — 10.176s and\r\n  10.225s — while todlando's 200 off-CI passes under live-fleet load ran 1-4s, never near it. The\r\n  post-fix red is therefore BOUND-EXPIRY-shaped (kill fired; the pinned identity stayed\r\n  not-provably-gone past 10s — TerminateJobObject is async), not kill-wrong-shaped. The bound\r\n  question (is 10s right for a loaded runner) is parked with hertz's USHER package item 4 and must\r\n  not touch the kill path or spawn flags before the probe fires. See also the FLAKE-LEDGER row for\r\n  the false-repeat correction (the 10.176s red was the PRE-a5042ec bare-pid mechanism).\r\n- **Declared read (2026-08-03, rules the next red):** a same-sha green rerun is protocol-conclusive\r\n  for the GATE, not the class. No third silent sample — the next occurrence of this signature gets\r\n  an instrumented resident-service bring-up investigation (hertz), not a rerun.\r\n- **SWEEP UPDATE 2026-08-30 (#242/v0.66.0 close — three corrections, correct-by-replacement):**\r\n  (1) **The 2026-08-03 \"brain stderr EMPTY\" reading on the kitsubito specimen is a METER\r\n  ARTIFACT, not a silent brain** (deployah measured 2026-08-29): the brain-panel stderr capture\r\n  only LANDED 2026-08-19 (`ab657626` + `e6e188e1`), 16 days after the specimen — at the specimen's\r\n  sha there was nothing to capture, so \"empty\" carried zero information; current bits label\r\n  absence explicitly, so empty-vs-present cannot recur as a distinction. This replaces the\r\n  \"cheap to settle next time someone has kitsubito\" item — there is nothing left to settle.\r\n  (2) **The kitsubito family member is CLOSED under a NAMED mechanism:** RCA-242-R2-LINUX.md\r\n  (v0.66.0 golden r2) measured `current_exe_hash()` on the READY PATH at ~10.1s per boot on\r\n  kitsubito under load (~1.5s Windows) via BRAIN_PHASE breadcrumbs + harvest-loop repro — a\r\n  bring-up that misses its ONLINE window under leg load is exactly what a ~10s synchronous hash\r\n  inside the ready path manufactures. The behaviour-change request (hash off the ready path,\r\n  ADR-0018 Q7) is minted on the board at this sweep as **releases#244** (BACKLOG, operator\r\n  triages). The family's host-INDEPENDENT claim\r\n  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\r\n  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\r\n  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\r\n  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\r\n  wait, #235 shape). Overlap with correction (2) checked at link time: his cells are TEST-side\r\n  (message truth + wait shape) and stand regardless of the product-side hash fix.\r\n- **Ripe when:** next occurrence of the signature (immediate instrumented dispatch), or a hertz\r\n  test-hardening wave (bring-up phase-timing instrumentation, per-phase deadline attribution).\r\n- **Size:** medium (bring-up instrumentation + attribution; the fix depends on what it shows).\r\n\r\n### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\r\n- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\r\n  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\r\n  deployah's log read\r\n  + todlando's flagged-not-asserted arm). Operator-classified infra 2026-08-02: daemon-kill\r\n  internals are agent-facing, not operator-facing surface.\r\n- **What/why:** `DetachedChild::kill_tree` (daemon.rs:1433 vicinity) calls\r\n  `unsafe { TerminateJobObject(self.job, 1) }` and discards the return; TerminateProcess likewise\r\n  unaudited. A job that was created and assigned at spawn but whose TERMINATION fails at kill time\r\n  yields the grandchild-survives symptom with zero log signal — the spawn-side\r\n  SERVICE_JOB_UNAVAILABLE announcement is correctly absent (that arm is instrumented and was\r\n  refuted for the specimen by a positively-controlled zero). Wanted: (1) check + log both\r\n  termination returns loudly on failure; (2) the degraded-arm decision — fallback process-table\r\n  tree-walk kill or explicit refusal, never a silent partial kill wearing REQ-RESIDENT-SERVICE's\r\n  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\r\n  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\r\n  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\r\n- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\r\n  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\r\n  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\r\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\r\n  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\r\n  at all rather than silently skipping it).\r\n- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\r\n  2026-08-04): `62c5623` satisfies (1) — both termination returns are now checked and the loss is\r\n  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\r\n  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\r\n  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\r\n  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\r\n  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\r\n  `detached_no_inherit_env` cosmetic rider did NOT land and was dropped at `de6a01d` on a MEASURED\r\n  false premise, not deferred. A Windows-specific finding rides the fix as a comment and is worth\r\n  keeping: `TerminateProcess` against a handle to an already-exited process returns 0 with\r\n  `GetLastError` 5 (`ERROR_ACCESS_DENIED`), so a naive check there fires on the ORDINARY path.\r\n\r\n### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\r\n- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\r\n  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\r\n  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\r\n  platforms — `spt::resident_service_e2e a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\r\n  PASS 17.773s (100/2637) on hfenduleam/Windows and PASS 17.895s (1364/2616) on kitsubito/Linux.\r\n  The pool was checked for the test rather than inferred from the job colour, because a green leg\r\n  that never ran the test is a competence-controlled zero, not an acquittal; `resident_service_e2e`\r\n  contains exactly ONE `#[test]`, so the test that ran IS the test the lane rewrote (229 lines of\r\n  that file changed in `6e1a962`). No red returned to doyle. `.worktrees/ir18` is released for\r\n  teardown by this verdict · **Origin:** hertz\r\n  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\r\n  reproduction\r\n- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\r\n  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\r\n  empty across the rebase, so the gate verdict and local behavioral evidence transfer). Gated by\r\n  doyle: full diff review (one blocking finding — the scope_lost assert condition contradicted its\r\n  own guard ruling — fixed and delta-verified at one line), mutation-proven locally both\r\n  directions (B: forced boot_pid=None → population sweep names the leak no per-pid check sees,\r\n  FAIL 101; A: wrong expected_exe → REFUSED-foreign-image reds loudly on the derivation check).\r\n  EVIDENCE SPLIT, stated so the check marks cannot carry it (hertz's absent-leg callout): lane CI\r\n  30792210008 was 5/5 green per job but ci.yml's test leg is kind(lib)+kind(bin) — the changed\r\n  integration test NEVER RAN there (verified by log grep, 0 hits / 3023 lines); CI proved\r\n  compile-everywhere (clippy all-targets = the pool-population check for a common/ module),\r\n  traceability, lib/bin clean. The BEHAVIORAL evidence is local: three clean runs (all verdicts\r\n  Killed, population empty) + the two mutation reds. reap.rs diff additive-only (zero deleted\r\n  lines, verified) — cross-test risk bounded to compilation, which CI covered. Evidence custody:\r\n  gate + mutation logs at `.worktrees/_patches/ir18-gate-logs/` (5 files); `.worktrees/ir18` is\r\n  KEPT deliberately until the golden verdict (NOT an orphan — do not reap; a Phase A red wants the\r\n  tree and logs in place, not rebuilt); its pool claim is released.\r\n- **What/why:** `crates/spt/tests/resident_service_e2e.rs:46` defines its own reaper —\r\n  `taskkill /PID <pid> /F /T`: bare pid, force, whole TREE, no identity check — and feeds it three\r\n  BREADCRUMB-derived pids in cleanup (`boot_pid`, `rel_service_pid` at :360, and the pid read out\r\n  of `brain.ready` at :363). The suite already ships the authenticated tool other tests use and\r\n  this one does not: `common::reap::authenticated_kill(label, pid, expected_exe, observed)` at\r\n  `crates/spt/tests/common/reap.rs:116`. Inside the Phase A parallel pool on a pid-churning box\r\n  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\r\n  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\r\n  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\r\n  bare pid. Kill what you pinned, not the number it happens to hold.\r\n- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\r\n  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\r\n  `CREATE_BREAKAWAY_FROM_JOB` spawn (`daemon.rs:1300`).\r\n- **Evidence rating — why it is a candidate and not a cause:** it predicts every field of the one\r\n  observed state line. The daemon is killed after spawning its boot service and before binding:\r\n  `broker_survived=false` (the discriminating field — false in every killed control round, true in\r\n  every healthy one) + `boot_alive=true boot_pid=Some(8920)` with the service's message in the\r\n  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\r\n  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\r\n  The service outlives its daemon because `detached_no_inherit_env` spawns it\r\n  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\r\n  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\r\n  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\r\n  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\r\n  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\r\n  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\r\n  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\r\n  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\r\n  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\r\n  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\r\n  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\r\n  the daemon dies, `rel_pid` is `None` so that service is never even a kill target, and the\r\n  breakaway child outlives everything. A teardown that leaks two processes per round currently\r\n  PASSES: the concrete case for `target_gone` as the gate's positive half. (Leak cleaned scoped,\r\n  each pid re-authenticated by image-path prefix + creation window at kill time, not from the\r\n  minute-old enumeration.) ONE LAYER DEEPER (deployah, same night, at source): the reap loop\r\n  (:359) is `[boot_pid, rel_service_pid].into_iter().flatten()` — `.flatten()` DROPS None, and\r\n  `mock_pid` (:100-106) collapses absent/permission-denied/IO-error/garbage into that None via\r\n  `.ok()?`/`.ok()` — the reap.rs:59-63 collapse in a THIRD location, inside this very test. So the\r\n  leak is both \"service never started\" AND \"pid unreadable, therefore never a kill target\":\r\n  absence of knowledge read as absence of target, in a teardown, again.\r\n- **GATE SPEC AMENDED PRE-BUILD (deployah found the hole, doyle-ruled 2026-08-03 — read this\r\n  BEFORE building the lane):** the two halves as first specified (trap-class-absent +\r\n  `target_gone` per pid) both operate on pids we HAVE — a process whose pid is None is invisible\r\n  to BOTH, so the specified gate PASSES hertz's own control-run leak (12 processes, 6+6, 2/round,\r\n  teardown reaped none). A gate its own reproduction case passes is not yet an instrument. THIRD\r\n  HALF, REQUIRED: a POPULATION assertion at teardown — zero surviving staged-service or\r\n  test-owned spt processes, by selectors external to the pid bookkeeping. SELECTOR RESPELLED\r\n  (hertz 2026-08-03, doyle-approved — the first spelling, \"parent-pid descent from the test\r\n  process\", would have caught ZERO of the 12: teardown kills the daemon before any check runs, the\r\n  BFS over the current (pid,ppid) table breaks at the dead middle hop, and descendants(test_pid)\r\n  returns empty exactly in the leak case — an absence read as a clean, the shape the lane exists\r\n  to kill; the control's own cleanup is the evidence, it had to use image+creation-window because\r\n  descent was already broken). THE TWO SELECTORS AS BUILT: (1) svcmock half by IMAGE PATH —\r\n  stage_adapter copies the service binary under this run's unique tempdir home, so \"any pid whose\r\n  exe_path canonicalizes under home\" names every staged service this run started and nothing else\r\n  on the box; no bookkeeping, immune to reuse and broken chains. (2) spt.exe half by SEEDED\r\n  descent + image — image alone is forbidden (target/debug/spt.exe is shared with concurrent\r\n  tests and live perches: the machine-wide selector class); seed with the ancestor set captured\r\n  WHILE ALIVE ({test, broker from the Child handle, brain from brain.ready — none via mock_pid}),\r\n  union descendants, keep only exe_path==spt_bin. Reuse exposure on seeds is assertion-only (a\r\n  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\r\n  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\r\n  same night — the third instance of that sentence tonight, this time inside our own instrument):\r\n  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\r\n  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\r\n  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\r\n  image, on this box. So the population assertion counts unreadable-path processes as their OWN\r\n  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\r\n  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\r\n  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\r\n  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\r\n  stays open.\r\n- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\r\n  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\r\n  filed remedy at source 2026-08-03: daemon.rs has exactly ONE CreateProcessW (:1187) and\r\n  BASE_FLAGS (:1105) already carries 0x0800_0000 = CREATE_NO_WINDOW on both rungs including the\r\n  ACCESS_DENIED fallback (which drops only BREAKAWAY), so the specified edit ORs an already-set\r\n  bit — a bit-for-bit identical flag word that would close a board item while its symptom, if\r\n  real, continues. #131 handed back to board triage with the finding and a candidate direction:\r\n  DETACHED_PROCESS gives the service no console, so a console child the SERVICE spawns flagless\r\n  allocates a NEW visible window — the grandchild, not the daemon's spawn, is the candidate\r\n  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\r\n  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\r\n  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\r\n  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\r\n  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\r\n  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\r\n  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\r\n  arrives as `extra_flags` at daemon.rs:1506), so renaming on the stated premise would have traded\r\n  an accurate word for one that drops a flag the function really sets. Independently fatal: the\r\n  premise, if true, covers the sibling `detached_no_inherit` equally — 17 references across\r\n  daemon.rs/deelevate.rs/shellhost.rs — and renaming one of two siblings of ONE posture leaves the\r\n  tree MORE inconsistent, not less. **What lands instead:** one doc-comment line on EACH function\r\n  naming the full effective flag word, which fixes the real complaint (neither name says breakaway)\r\n  without touching a call site. Kept here rather than deleted because this entry was the claim's\r\n  only home, and a reader who found the rename gone with no reason would re-derive it.) PER-PID GROUND TRUTH for expected_exe (hertz — SELF-CORRECTED\r\n  at source before it ever landed; his first derivation, \"Copy runs from adapters_dir(), Pointer\r\n  runs from srcs/\", was WRONG and registration mode is NOT the discriminator): servicehost.rs:1328\r\n  takes `install_dir` from `record.source_dir` on the Started arm for EVERY service, Copy and\r\n  Pointer alike, and Copy copies only the manifest + strings/ (registry.rs:395-404), never a\r\n  binary — `adapters_dir()` holds no executable in either mode. BOTH services run from their OWN\r\n  staged src dir: `staged_bin(<adapter's staged src dir>, \"svcmock\")`. The trap survives with a\r\n  different mechanism: two adapters staged into two DIFFERENT source dirs are two different files\r\n  on disk, so one expected_exe still cannot serve both. A lane that trusted the mode split would\r\n  derive a path with no binary at it. How it was caught, kept because it is the reusable part: not\r\n  by rereading the mode table but by finding where install_dir is COMPUTED instead of trusting an\r\n  already-published inference — the mode split was true of MANIFESTS and had been generalized to\r\n  BINARIES without checking the consumer; and the derivation-asserted-at-observe() instrument\r\n  would have caught it at runtime regardless — the instrument did its job before it ever ran,\r\n  argued against its own author. SCOPE_LOST RULED A GUARD, NOT A FINDING (hertz design change,\r\n  doyle-approved): a seed pid recycled before the sweep makes the sweep DECLINE that subtree\r\n  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\r\n  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\r\n  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\r\n  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\r\n  reach, not load-bearing. `unreadable` stays FATAL as ruled.\r\n  Sequencing: positive control\r\n  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\r\n  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\r\n  lane under the dispatch split; the two cross-ref, they do not merge.\r\n- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\r\n  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\r\n  passing spt_bin for those refuses every kill as foreign-image and LEAKS both services while the\r\n  reap reads hardened. Only `brain.ready`'s pid takes spt_bin. Also: `observe()` boot_pid at :210\r\n  while it is provably ours, so the reuse check has creation-time teeth instead of degrading to\r\n  image+ancestry.\r\n- **Gate the lane on killing, not on refusing (deployah 2026-08-03; REFINED by hertz same night\r\n  from reap.rs's own contract):** the hardened version fails safe in the WRONG direction —\r\n  refuse-everything leaks both services while printing exactly the reap line a reviewer wants to\r\n  see, strictly worse than the bare kill it replaces and invisible in the same log. But a BLANKET\r\n  zero-REFUSED gate is wrong too: reap.rs's module doc (:18–20) states refusal is the CORRECT\r\n  happy-path outcome when the test already stopped its daemon (`Refused(\"gone\")` — leak insurance,\r\n  not primary teardown), so the blanket gate reds healthy runs, someone loosens it to go green, and\r\n  the loosened version is exactly the one blind to foreign-image — the detector dies by\r\n  maintenance, wearing a green. The refusal reasons split, and only one class is a defect:\r\n  SOUND (expected): `gone`, `reused`, `breadcrumb-moved`, `self`, `ancestor` — target provably not\r\n  there. TRAP (the false-clean state): `foreign-image`, `unreadable-image`, `unproven-identity` —\r\n  something WAS there and authentication declined; `foreign-image` is precisely what a wrong\r\n  per-pid expected_exe produces on every pid, every run. THE GATE: in the arm that must kill,\r\n  assert no verdict in the trap class — structurally on the returned `Verdict` (Killed |\r\n  Refused(&'static str), stable tokens by design, reap.rs:48), not by scraping output; the\r\n  `REAP[label]: … verdict=` line stays as CI-log forensics. The gate's comment MUST say\r\n  `Refused(\"gone\")` is expected, or the next reader \"fixes\" it. Positive counterpart that actually\r\n  proves the reap: assert `target_gone(pid, expected_exe, observed)` (reap.rs:215 — no-knowledge\r\n  never read as death) per service pid; bare-liveness \"no survivors\" is the false-clean named above.\r\n  TOKEN SET VERIFIED COMPLETE-PLUS-ONE (deployah, refuse() sites enumerated at source): the eight\r\n  tokens above sit at :128 self, :132 ancestor, :136 breadcrumb-moved, :146 gone, :149\r\n  unproven-identity, :155 reused, :166 unreadable-image, :172 foreign-image — each in the right\r\n  class — and there is a NINTH neither list held: `Refused(\"no-breadcrumb\")` at :243, returned\r\n  before authenticated_kill is reached. Doyle-ruled 2026-08-03, both halves: (1) `no-breadcrumb`\r\n  classifies SOUND — **SCOPED (deployah source-read, same night): it is two states wearing one\r\n  name.** `breadcrumb_daemon_pid` (reap.rs:59–63) collapses file-absent, permission-denied, any IO\r\n  error, AND a husked/unparseable partial write into one `None` via two `.ok()`s — so the token is\r\n  ABSENCE OF KNOWLEDGE, not proof of absence, and it is SOUND only because the calling test has\r\n  already asserted its daemon stopped. Every other SOUND token carries positive proof; a LIVE\r\n  daemon whose pid file is unreadable or husked emits the identical token and leaks wearing\r\n  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\r\n  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\r\n  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\r\n  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\r\n  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\r\n  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\r\n  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\r\n  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\r\n  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\r\n  read-only): 21 caller tests, every one passing &spt_bin as expected_exe (the per-pid trap is\r\n  specific to resident_service_e2e's svcmock pids — it does not generalize to this population);\r\n  20 callers fire-and-forget the Verdict; the one value-assertion, reaper_guard.rs:192-196, pins\r\n  `Refused(\"no-breadcrumb\")` for an ABSENT breadcrumb only — absent KEEPS the token under the\r\n  split, so that assertion survives unchanged (:183's stale-pid check is the loose\r\n  `matches!(Refused(_))`). The split is ADDITIVE: one source split, one new token, zero caller\r\n  rewrites. THE GAP THAT LET THE COLLAPSE HIDE: reaper_guard covers eight refusal shapes but has\r\n  NO test for an unreadable or malformed daemon.pid — the one state where absence-of-knowledge\r\n  reads as absence-of-target is the one state without a conformance test; (b) ships with exactly\r\n  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\r\n  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\r\n  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\r\n  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\r\n  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\r\n  (reap.rs:59-63, resident_service_e2e's mock_pid :100-106, and the shape wherever a test reads a\r\n  self-written pid file) — so (b) lands ONE shared read-a-pid-breadcrumb helper that distinguishes\r\n  absent from unreadable ONCE, adopted at the enumerated sites, not a per-site token split; the\r\n  single-source-discriminant rule, applied before a fourth site mints itself.\r\n  **THIRD SITE CONFIRMED AT SOURCE (deployah, read-only 2026-08-04) — it was a predicted SHAPE and\r\n  is now an address:** `crates/spt/tests/resident_service_e2e.rs:136-137`, `brain_ready`, which\r\n  `.ok()?`s BOTH the read and the JSON parse — two collapses in two lines, the self-written-pid-file\r\n  shape this entry predicted. What makes it the worst of the three rather than the third of three:\r\n  its output feeds `brain_seed`, a population-sweep SEED, so an unreadable `brain.ready` silently\r\n  drops a whole subtree from the sweep. The other two sites lose one pid; this one degrades the very\r\n  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\r\n  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\r\n  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\r\n  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\r\n  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\r\n  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\r\n  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\r\n  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\r\n  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\r\n  SECOND (b) INTAKE ITEM (hertz self-noted at re-gate, doyle-ruled deferred): cleanliness is\r\n  currently stated at THREE sites (two asserts + `is_clean`) — the drift that produced the\r\n  scope_lost condition bug (a failed edit followed by a narrower successful one replaced the\r\n  message but not the condition; the artifact of that failure mode IS message/code disagreement).\r\n  (b) consolidates to conditions derived from one source, weighing the two-message diagnostic\r\n  split it would cost. The\r\n  exhaustive panic-catch-all match is what makes the split safe to do later: the new token lands\r\n  loud on first fire in every consuming gate, forced to be classified, never silently passed. Until then the scoped reading above is the\r\n  gate's contract — and the LANE BUILDER writes that scoped reading into the match's SOUND-arm\r\n  comment (the sketch's \"nothing to read is nothing to kill\" is the exact inference the source\r\n  forbids; the comment must not teach the false step); (2) the gate closes over the\r\n  token set — SPELLED BUILDABLY (hertz correction 2026-08-03; the earlier \"no wildcard arm\" wording\r\n  is an instruction rustc rejects, since the refusal reason is a `&'static str` (:55) and a string\r\n  match always requires a catch-all): the match names the six SOUND tokens as a pass arm, the three\r\n  TRAP tokens as a panic arm, and the REQUIRED catch-all arm is not a wildcard PASS — it panics\r\n  naming the unknown token (\"unclassified reap refusal token — classify it in this match\"), so\r\n  upstream drift announces itself the first run it fires instead of sliding into a silent pass.\r\n  Runtime fail-closed, not compile-time: compile-time closure needs the reason to become an enum in\r\n  common/reap.rs, an upstream change touching every consumer — ruled NOT smuggled into this lane\r\n  (candidate for its own thin lane if ever wanted; doyle concurs runtime fail-closed is\r\n  proportionate). Direction of the default, kept in the record: a missed trap state is an invisible\r\n  leak wearing the reap line a reviewer wants to see; an unclassified harmless token is a loud red\r\n  costing one edit. Cheap and loud beats silent and wrong. (Count hygiene, hertz self-flagged: a\r\n  single-line grep for the refuse() sites returns five of nine — three wrap across lines; the nine\r\n  stands on reading, not the grep. The sweep-count trap in miniature.)\r\n- **Prior observed instance of the class, in-tree (hertz 2026-08-03 — stated to understate):**\r\n  reap.rs:3–11 documents the measurement and a casualty: pid reuse on the Windows gate box at\r\n  2.2s minimum / p50 11.7s under a Phase-A battery, and a concurrent test process killed by a bare\r\n  kill on a stale breadcrumb pid, dying with bare exit 1 and no panic — the observed\r\n  `worker_lifecycle_e2e` red in golden job 90742055246 (that test's intermittent class is board\r\n  releases#32, still in-flight). Different test, different job — it does NOT reproduce this entry's\r\n  specimen and promotes nothing; what it settles is that the class is real IN THIS SUITE with a\r\n  named victim, and the authenticated reaper is the remedy someone already built for it —\r\n  resident_service_e2e simply never adopted it. Two shape-predictions it supplies, made before this\r\n  specimen existed: the p50 11.7s reuse window is short against this test's 45s waits and ~124s\r\n  runtime (window wide open). (A second claimed match — \"bare-exit-1-no-panic matches the empty\r\n  daemon.stderr.log\" — is RETRACTED as a category error, hertz+deployah 2026-08-03: reap.rs's\r\n  phrase describes the VICTIM TEST PROCESS dying, not a daemon's log; two processes, two\r\n  artifacts.) Predictions, not proof; the specimen stays CANDIDATE — shape since reproduced on\r\n  demand, agent unidentified (see the control record above).\r\n- **Rig near-miss, caught before first execution (hertz 2026-08-03) — kept as design justification,\r\n  not an anecdote:** the positive-control arm's first draft selected its victim machine-wide\r\n  (`Win32_Process Name='spt.exe'` + cmdline match `daemon run`, then force-kill). hfenduleam is the\r\n  Windows CI runner as well as a dev box, so that filter matches CI's own test daemons: run while a\r\n  leg was live, it would have force-killed a running job's daemon and reported the result as a\r\n  measurement — fabricating a red in someone else's job, the exact class this entry documents.\r\n  Corrected to a parent-scoped selector (daemon = child of the test pid; service = child of that\r\n  daemon); `CREATE_BREAKAWAY_FROM_JOB` does not weaken parent-id attribution, since breakaway leaves\r\n  the JOB, not the parent record — which is also why the orphaned svcmock stays attributable to the\r\n  daemon that spawned it. **The load bought the catch** (blocked on the box ⇒ re-read instead of\r\n  ran). Bearing on the fix: the INSTRUMENT built to study a bare-selector reaper was itself written\r\n  with a bare selector. The remedy therefore cannot be \"be careful\" — the authenticated path must be\r\n  the only one within reach in this suite.\r\n- **Ripe when:** RIPE NOW, and not gated on the rate run that was cancelled.\r\n- **Size:** small.\r\n\r\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\r\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\r\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\r","truncated":true,"truncatedBy":"lines","totalLines":5175,"totalBytes":41448,"outputLines":444,"outputBytes":41448,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"### IR-14 — .worktrees audit: \"how many worktrees are there\" has four defensible answers, and the difference is not junk\n…\n#### RECLAIM ARITHMETIC — AND WHY THIS ENTRY IS NOT THE DISK FIX\n…\n- **AUDIT EXECUTED 2026-08-30 (doyle, the v0.66.0→NOW-SIGNAL between-milestone window; full\n…\n- **Field instance (hertz sweep, 2026-08-04 — an unclaimed pool found rather than reasoned about):**\n…\n\r\n### IR-17 — Deadline-burn bring-up family: a test burns its full window while the daemon/brain never comes up\r\n- **Status:** open · **Origin:** golden 30782259675 red triage 2026-08-03\r\n- **What/why:** two different tests on two runner hosts now share one signature — bring-up misses\r\n  its ONLINE window under leg load and the test burns its ENTIRE deadline before the PRECONDITION\r\n  panic: `spt::resident_service_e2e::a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\r\n  (hfenduleam, FAIL 123.99s, \"PRECONDITION: the daemon never came up\", run 30782259675, green on\r\n  same-sha rerun 30784469908) and `spt::activity_link_push_e2e` (kitsubito, full 30s, run\r\n  30607903133 specimen, green on same-sha rerun; its \"brain stderr EMPTY\" leg and its family\r\n  membership are both CORRECTED in the 2026-08-30 sweep update below — the kitsubito member is\r\n  CLOSED under a named mechanism).\r\n  Family reading, not one flake: same missed-window shape, host-independent, both mid-leg under\r\n  load. Cross-ref KNOWN-HAZARDS 5.13 — bring-up has a hard ONLINE budget with known sensitivity to\r\n  anything that stalls it (the blanket-fsync canary; `attach_wedge_e2e` guards that budget).\r\n- **State line (the discriminating datum, resident_service red):** `daemon_up=false boot_alive=true\r\n  boot_pid=Some(8920) rel_started=false broker_survived=false` — the boot process was ALIVE at\r\n  panic time and the daemon never reached up. Any characterization run records this line per run,\r\n  not the verdict (hertz protocol 2026-08-03).\r\n- **Read of that line, CORRECTED 2026-08-03 (hertz):** it is NOT \"started-but-never-bound\" (the\r\n  earlier reading here) and not \"never-started\" — it is **started, did work, then killed** —\r\n  CANDIDATE via [[IR-18]]. The daemon spawned its boot service and that service reached the CLI\r\n  (the spool holds its message), and `broker_survived=false`. The DISCRIMINATING field is\r\n  `broker_survived`: false in every killed round of the positive control, true in every healthy\r\n  round. **An earlier evidence leg here is RETRACTED (hertz, same night, off the negative arm he\r\n  ran before reporting; deployah, who had carried the leg into four register sites, swept every\r\n  placement): \"empty daemon.stderr.log = TerminateProcess signature\" was false — the stderr\r\n  block is empty on PASSING runs too, so it carries zero information in either direction; it\r\n  failed the discriminator question and does not support the kill read.** The kill read now rests\r\n  on the control's field-for-field reproduction and the IR-18 mechanism, not on the log.\r\n  Consequences: (a) the bring-up window is **exonerated for this specimen** — measuring it would\r\n  have measured nothing; (b) the candidate mechanism and its evidence now live in [[IR-18]]\r\n  (a sibling test's bare breadcrumb tree-kill), CANDIDATE — not reproduced, not proven;\r\n  (c) **the characterization population changed, and the rate run is CANCELLED** (doyle ruling\r\n  2026-08-03) — `resident_service_e2e` run ALONE has no sibling to collide with, so the mechanism\r\n  predicts 0/N and that number answers no live question; the only sound population was the test\r\n  INSIDE the Phase A parallel pool, which costs a full Phase A leg per sample, and the fix is\r\n  warranted by the source-verified hazard class regardless of the specimen's rate. No rate figure\r\n  will exist for this specimen — do not later read its absence as a low rate; (d) **positive\r\n  control still runs, falling out of the\r\n  hypothesis:** kill the spawned daemon by pid mid-bring-up — after boot-service spawn, before\r\n  ready — and it must reproduce the observed line field for field (`daemon_up=false\r\n  boot_alive=true broker_survived=false`). If the rig cannot make that shape on\r\n  demand, a 0/N from the untouched arm is worth nothing and must be reported as worth nothing.\r\n  The host-INDEPENDENT family claim (kitsubito's `activity_link_push_e2e`) is untouched by this:\r\n  it has no such kill site named, so the family survives even if this specimen leaves it.\r\n- **POSITIVE CONTROL RAN 2026-08-03 (hertz, prebuilt a5042ec binary, box confirmed clear —\r\n  0 open runs, 145.95 GB free): shape reproduced 3/3, deterministic.** Negative arm n=2: 2/2 PASS\r\n  (5.59s, 5.46s), `daemon_up=true boot_alive=true rel_started=true broker_survived=true\r\n  survived_teardown=true`. Positive arm (daemon killed by parent-scoped descent after\r\n  boot-service spawn, before ready) n=3: 3/3 FAIL (93.95/93.25/93.50s), state line identical to\r\n  the CI red in EVERY field except boot_pid (a pid, must differ), same panic, same site\r\n  (resident_service_e2e.rs:382). Structural fact the arm settled, and the refutation risk that\r\n  made it worth running: the boot service rises BEFORE brain.ready becomes readable — had the\r\n  order been reversed the arm would have produced daemon_up=true and refuted the mechanism.\r\n  CEILING MET, NOT EXCEEDED: the control used Stop-Process -Force (TerminateProcess — the same\r\n  primitive as taskkill /F), so it proves a forced daemon kill after breakaway-service spawn\r\n  produces this exact line ON DEMAND; it says nothing about WHO issued one in golden 30782259675.\r\n  Candidate mechanism, shape reproduced on demand — \"root caused\" written by nobody. Duration\r\n  note, recorded not explained: 93.5s local (idle box) vs 123.99s CI (Phase A parallelism), both\r\n  burning the same three 45s windows — consistent, not verified.\r\n- **Same-host sub-observation (hertz, host-CONSTANT — narrower claim, kept separate):** both\r\n  reds of 2026-08-03 sat on hfenduleam Windows Phase A and burned their full windows:\r\n  `a_tree_teardown_reaches_a_grandchild_the_service_spawned` (run 30776330383, FAIL 10.176s = the\r\n  full poll deadline, vs a 0.19–0.66s pass band — 15–50x out) + the resident_service row above.\r\n  MEMBERSHIP PROVISIONAL for the teardown row: it carries a candidate mechanism the bring-up burn\r\n  does not share — the pid-only oracle IR-15 just replaced. If the oracle caused it, that row\r\n  leaves the family and host-constant collapses to one sighting. The host-INDEPENDENT pair above\r\n  is the claim that survives someone fixing this box; the sub-observation is what is actionable\r\n  about hfenduleam (a live-daemon host) meanwhile. **UPDATE 2026-08-04 (golden 30873007187\r\n  attempt 1 — SECOND sighting, and the provisional question above is now ANSWERED): the\r\n  pid-only-oracle candidate is REFUTED for this row** — IR-15's authenticated repin rode the\r\n  failing tree (a5042ec ancestor of 4b37512) and the row failed anyway (10.225s, \"grandchild\r\n  51848 outlived the tree teardown\"), with is_stamped() asserted before the kill so the verdict\r\n  passed the authenticated gate. The row therefore STAYS a family member with its mechanism OPEN,\r\n  narrowed by hertz's log forensics (competence-controlled: the capture channel demonstrably\r\n  prints): no DETACH_BREAKAWAY_DENIED (breakaway rung taken), no SERVICE_JOB_UNAVAILABLE (job\r\n  created + child enrolled), no SERVICE_TREE_KILL_INCOMPLETE (TerminateJobObject returned\r\n  success) — everything enrolled died; THE SURVIVOR WAS NEVER ENROLLED. Two hypotheses,\r\n  inseparable in existing evidence: H1 test defect — the grandchild SELECTION is a bare\r\n  th32ParentProcessID match over a recycling pid space (IR-15's mechanism one level up: the\r\n  verdict was authenticated, the selection was not); H2 real enrollment gap. hertz's selection\r\n  probe (IsProcessInJob at selection time — decisive; birth stamp one-directional; image; same-\r\n  snapshot match count) is authored+compiled and makes the NEXT occurrence self-deciding. Row\r\n  state: INSTRUMENTED-AWAITING-FIRE; a green retires nothing (doyle-ruled). **UPDATE 2026-08-04\r\n  (USHER att3):** row green at 17f95a7 (retires nothing, per the ruling). New shape evidence while\r\n  waiting for the probe: BOTH archived reds sit AT the 10s poll bound (daemon.rs:2757) — 10.176s and\r\n  10.225s — while todlando's 200 off-CI passes under live-fleet load ran 1-4s, never near it. The\r\n  post-fix red is therefore BOUND-EXPIRY-shaped (kill fired; the pinned identity stayed\r\n  not-provably-gone past 10s — TerminateJobObject is async), not kill-wrong-shaped. The bound\r\n  question (is 10s right for a loaded runner) is parked with hertz's USHER package item 4 and must\r\n  not touch the kill path or spawn flags before the probe fires. See also the FLAKE-LEDGER row for\r\n  the false-repeat correction (the 10.176s red was the PRE-a5042ec bare-pid mechanism).\r\n- **Declared read (2026-08-03, rules the next red):** a same-sha green rerun is protocol-conclusive\r\n  for the GATE, not the class. No third silent sample — the next occurrence of this signature gets\r\n  an instrumented resident-service bring-up investigation (hertz), not a rerun.\r\n- **SWEEP UPDATE 2026-08-30 (#242/v0.66.0 close — three corrections, correct-by-replacement):**\r\n  (1) **The 2026-08-03 \"brain stderr EMPTY\" reading on the kitsubito specimen is a METER\r\n  ARTIFACT, not a silent brain** (deployah measured 2026-08-29): the brain-panel stderr capture\r\n  only LANDED 2026-08-19 (`ab657626` + `e6e188e1`), 16 days after the specimen — at the specimen's\r\n  sha there was nothing to capture, so \"empty\" carried zero information; current bits label\r\n  absence explicitly, so empty-vs-present cannot recur as a distinction. This replaces the\r\n  \"cheap to settle next time someone has kitsubito\" item — there is nothing left to settle.\r\n  (2) **The kitsubito family member is CLOSED under a NAMED mechanism:** RCA-242-R2-LINUX.md\r\n  (v0.66.0 golden r2) measured `current_exe_hash()` on the READY PATH at ~10.1s per boot on\r\n  kitsubito under load (~1.5s Windows) via BRAIN_PHASE breadcrumbs + harvest-loop repro — a\r\n  bring-up that misses its ONLINE window under leg load is exactly what a ~10s synchronous hash\r\n  inside the ready path manufactures. The behaviour-change request (hash off the ready path,\r\n  ADR-0018 Q7) is minted on the board at this sweep as **releases#244** (BACKLOG, operator\r\n  triages). The family's host-INDEPENDENT claim\r\n  therefore collapses: the Windows `resident_service_e2e` specimen (IR-18 kill-shape candidate)\r\n  and the hfenduleam sub-observation STAY OPEN as this entry's remaining live population.\r\n  (3) **Lane-linked:** hertz's queued fixup lane brief names this entry directly\r\n  (activity_link_push_e2e 4-cell fixup: false precondition message + progress-bounded readiness\r\n  wait, #235 shape). Overlap with correction (2) checked at link time: his cells are TEST-side\r\n  (message truth + wait shape) and stand regardless of the product-side hash fix.\r\n- **Ripe when:** next occurrence of the signature (immediate instrumented dispatch), or a hertz\r\n  test-hardening wave (bring-up phase-timing instrumentation, per-phase deadline attribution).\r\n- **Size:** medium (bring-up instrumentation + attribution; the fix depends on what it shows).\r\n\r\n### IR-16 — kill_tree discards TerminateJobObject/TerminateProcess returns (silent partial kill)\r\n- **Status:** BUILT 2026-08-03 (landed @62c5623 on the LOCKSMITH t1 lane; rides golden sha\r\n  b7b00c3, run 30860770146 green) · **Origin:** ex releases#130 (golden 30776330383 red triage;\r\n  deployah's log read\r\n  + todlando's flagged-not-asserted arm). Operator-classified infra 2026-08-02: daemon-kill\r\n  internals are agent-facing, not operator-facing surface.\r\n- **What/why:** `DetachedChild::kill_tree` (daemon.rs:1433 vicinity) calls\r\n  `unsafe { TerminateJobObject(self.job, 1) }` and discards the return; TerminateProcess likewise\r\n  unaudited. A job that was created and assigned at spawn but whose TERMINATION fails at kill time\r\n  yields the grandchild-survives symptom with zero log signal — the spawn-side\r\n  SERVICE_JOB_UNAVAILABLE announcement is correctly absent (that arm is instrumented and was\r\n  refuted for the specimen by a positively-controlled zero). Wanted: (1) check + log both\r\n  termination returns loudly on failure; (2) the degraded-arm decision — fallback process-table\r\n  tree-walk kill or explicit refusal, never a silent partial kill wearing REQ-RESIDENT-SERVICE's\r\n  unconditional promise. Do NOT add self.job==0 instrumentation (already loud; a second weaker\r\n  rule beside a working one). Discrimination pairing with [[IR-15]]: a red whose captured pid is\r\n  still ping.exe with no SERVICE_JOB_UNAVAILABLE in scope = this entry's arm.\r\n- **Ripe when:** RIPE NOW — IR-15 landed BUILT 2026-08-03 (its rig-side half), so this kill-side\r\n  half is the outstanding instrument; land with the next daemon-teardown wave or sooner.\r\n- **Size:** small.\r\n- **Composed:** LOCKSMITH (#132) — todlando product lane, with the `detached_no_inherit_env`\r\n  rename as cosmetic rider (IR-20's load-bearing-pid caution applies to any rig touch) —\r\n  2026-08-03. GREENLIT with #132 and **DISPATCHED to todlando 2026-08-03**, carrying IR-20's\r\n  load-bearing-pid precondition as a stated check (todlando reports whether the rig is touched\r\n  at all rather than silently skipping it).\r\n- **BUILT — fulfilment checked against the wanted list, not merely mapped to a commit** (doyle,\r\n  2026-08-04): `62c5623` satisfies (1) — both termination returns are now checked and the loss is\r\n  NAMED on failure, as the kill-time twin of the spawn-time `SERVICE_JOB_UNAVAILABLE` — and (2) by\r\n  the ruled LOUD REFUSAL arm rather than a tree-walk fallback, which [[IR-18]] measured blind in\r\n  exactly this failure state. The `self.job == 0` prohibition was honored: the new check is\r\n  `self.job != 0 && TerminateJobObject(...) == 0`, not a second weaker rule beside the working one.\r\n  The unix `ESRCH` quiet arm — which no Windows gate can see — is covered by `ec5f38a`. The\r\n  `detached_no_inherit_env` cosmetic rider did NOT land and was dropped at `de6a01d` on a MEASURED\r\n  false premise, not deferred. A Windows-specific finding rides the fix as a comment and is worth\r\n  keeping: `TerminateProcess` against a handle to an already-exited process returns 0 with\r\n  `GetLastError` 5 (`ERROR_ACCESS_DENIED`), so a naive check there fires on the ORDINARY path.\r\n\r\n### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\r\n- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\r\n  stated as the measurement rather than as the green board it sat on: LOCKSMITH's golden run\r\n  30860770146 (head `b7b00c3`, conclusion success) executed the changed test IN-POOL on BOTH\r\n  platforms — `spt::resident_service_e2e a_declared_service_rises_with_the_daemon_and_reaches_the_cli`\r\n  PASS 17.773s (100/2637) on hfenduleam/Windows and PASS 17.895s (1364/2616) on kitsubito/Linux.\r\n  The pool was checked for the test rather than inferred from the job colour, because a green leg\r\n  that never ran the test is a competence-controlled zero, not an acquittal; `resident_service_e2e`\r\n  contains exactly ONE `#[test]`, so the test that ran IS the test the lane rewrote (229 lines of\r\n  that file changed in `6e1a962`). No red returned to doyle. `.worktrees/ir18` is released for\r\n  teardown by this verdict · **Origin:** hertz\r\n  characterization of the [[IR-17]] resident_service red, 2026-08-03 — CANDIDATE mechanism, NOT a\r\n  reproduction\r\n- **Lane:** hertz `fix/ir18-authenticated-teardown` — MERGED to main @6e1a962 (PR #142; gated at\r\n  b48e35b, rebased 6e1a962 on 1e520b4 with zero code delta — doyle re-derived `git diff -- crates/`\r\n  empty across the rebase, so the gate verdict and local behavioral evidence transfer). Gated by\r\n  doyle: full diff review (one blocking finding — the scope_lost assert condition contradicted its\r\n  own guard ruling — fixed and delta-verified at one line), mutation-proven locally both\r\n  directions (B: forced boot_pid=None → population sweep names the leak no per-pid check sees,\r\n  FAIL 101; A: wrong expected_exe → REFUSED-foreign-image reds loudly on the derivation check).\r\n  EVIDENCE SPLIT, stated so the check marks cannot carry it (hertz's absent-leg callout): lane CI\r\n  30792210008 was 5/5 green per job but ci.yml's test leg is kind(lib)+kind(bin) — the changed\r\n  integration test NEVER RAN there (verified by log grep, 0 hits / 3023 lines); CI proved\r\n  compile-everywhere (clippy all-targets = the pool-population check for a common/ module),\r\n  traceability, lib/bin clean. The BEHAVIORAL evidence is local: three clean runs (all verdicts\r\n  Killed, population empty) + the two mutation reds. reap.rs diff additive-only (zero deleted\r\n  lines, verified) — cross-test risk bounded to compilation, which CI covered. Evidence custody:\r\n  gate + mutation logs at `.worktrees/_patches/ir18-gate-logs/` (5 files); `.worktrees/ir18` is\r\n  KEPT deliberately until the golden verdict (NOT an orphan — do not reap; a Phase A red wants the\r\n  tree and logs in place, not rebuilt); its pool claim is released.\r\n- **What/why:** `crates/spt/tests/resident_service_e2e.rs:46` defines its own reaper —\r\n  `taskkill /PID <pid> /F /T`: bare pid, force, whole TREE, no identity check — and feeds it three\r\n  BREADCRUMB-derived pids in cleanup (`boot_pid`, `rel_service_pid` at :360, and the pid read out\r\n  of `brain.ready` at :363). The suite already ships the authenticated tool other tests use and\r\n  this one does not: `common::reap::authenticated_kill(label, pid, expected_exe, observed)` at\r\n  `crates/spt/tests/common/reap.rs:116`. Inside the Phase A parallel pool on a pid-churning box\r\n  this is the KNOWN-HAZARDS stale-breadcrumb tree-kill class, live and **symmetric**: this test can\r\n  take a sibling's daemon and a sibling can take this test's. Same defect [[IR-15]] just fixed, on\r\n  the other side — IR-15 authenticated the READ (is the thing I pinned gone?), the KILL is still\r\n  bare pid. Kill what you pinned, not the number it happens to hold.\r\n- **Verified at source by deployah 2026-08-03** (relayed claims re-derived, all held): the bare\r\n  kill, its three breadcrumb feeds, the shipped-but-unused authenticated helper, and the\r\n  `CREATE_BREAKAWAY_FROM_JOB` spawn (`daemon.rs:1300`).\r\n- **Evidence rating — why it is a candidate and not a cause:** it predicts every field of the one\r\n  observed state line. The daemon is killed after spawning its boot service and before binding:\r\n  `broker_survived=false` (the discriminating field — false in every killed control round, true in\r\n  every healthy one) + `boot_alive=true boot_pid=Some(8920)` with the service's message in the\r\n  spool. (The \"empty stderr = silent death\" leg that originally sat here is RETRACTED — see\r\n  [[IR-17]]'s control record; stderr is empty on healthy runs too and discriminates nothing.)\r\n  The service outlives its daemon because `detached_no_inherit_env` spawns it\r\n  `CREATE_BREAKAWAY_FROM_JOB`, so it is NOT in the daemon's job and a daemon kill ORPHANS it\r\n  rather than reaping it — plausibly also the five denied `svcmock.exe` attempts in that job's\r\n  reap summary. **The [[IR-17]] positive control (2026-08-03) reproduced the shape 3/3\r\n  deterministically with a forced kill at that window — establishing the SHAPE on demand, not the\r\n  AGENT: nothing identifies who issued a kill in golden 30782259675.** The bare-pid tree-kill from\r\n  a concurrent test remains the candidate agent, on the source-verified hazard class and reap.rs's\r\n  documented prior casualty. **Not reproduced in the wild. Not proven. \"Root caused\" is not\r\n  written here by anyone.** The [[IR-17]] rate run is cancelled, so no rate will ever back this —\r\n  the fix stands on the source-verified hazard class alone. THE DEFECT IN MINIATURE, observed as a\r\n  side effect of the control (hertz 2026-08-03): the three killed rounds leaked 12 processes\r\n  (6 svcmock + 6 spt.exe, two services per round) and the test's own teardown reaped NONE — when\r\n  the daemon dies, `rel_pid` is `None` so that service is never even a kill target, and the\r\n  breakaway child outlives everything. A teardown that leaks two processes per round currently\r\n  PASSES: the concrete case for `target_gone` as the gate's positive half. (Leak cleaned scoped,\r\n  each pid re-authenticated by image-path prefix + creation window at kill time, not from the\r\n  minute-old enumeration.) ONE LAYER DEEPER (deployah, same night, at source): the reap loop\r\n  (:359) is `[boot_pid, rel_service_pid].into_iter().flatten()` — `.flatten()` DROPS None, and\r\n  `mock_pid` (:100-106) collapses absent/permission-denied/IO-error/garbage into that None via\r\n  `.ok()?`/`.ok()` — the reap.rs:59-63 collapse in a THIRD location, inside this very test. So the\r\n  leak is both \"service never started\" AND \"pid unreadable, therefore never a kill target\":\r\n  absence of knowledge read as absence of target, in a teardown, again.\r\n- **GATE SPEC AMENDED PRE-BUILD (deployah found the hole, doyle-ruled 2026-08-03 — read this\r\n  BEFORE building the lane):** the two halves as first specified (trap-class-absent +\r\n  `target_gone` per pid) both operate on pids we HAVE — a process whose pid is None is invisible\r\n  to BOTH, so the specified gate PASSES hertz's own control-run leak (12 processes, 6+6, 2/round,\r\n  teardown reaped none). A gate its own reproduction case passes is not yet an instrument. THIRD\r\n  HALF, REQUIRED: a POPULATION assertion at teardown — zero surviving staged-service or\r\n  test-owned spt processes, by selectors external to the pid bookkeeping. SELECTOR RESPELLED\r\n  (hertz 2026-08-03, doyle-approved — the first spelling, \"parent-pid descent from the test\r\n  process\", would have caught ZERO of the 12: teardown kills the daemon before any check runs, the\r\n  BFS over the current (pid,ppid) table breaks at the dead middle hop, and descendants(test_pid)\r\n  returns empty exactly in the leak case — an absence read as a clean, the shape the lane exists\r\n  to kill; the control's own cleanup is the evidence, it had to use image+creation-window because\r\n  descent was already broken). THE TWO SELECTORS AS BUILT: (1) svcmock half by IMAGE PATH —\r\n  stage_adapter copies the service binary under this run's unique tempdir home, so \"any pid whose\r\n  exe_path canonicalizes under home\" names every staged service this run started and nothing else\r\n  on the box; no bookkeeping, immune to reuse and broken chains. (2) spt.exe half by SEEDED\r\n  descent + image — image alone is forbidden (target/debug/spt.exe is shared with concurrent\r\n  tests and live perches: the machine-wide selector class); seed with the ancestor set captured\r\n  WHILE ALIVE ({test, broker from the Child handle, brain from brain.ready — none via mock_pid}),\r\n  union descendants, keep only exe_path==spt_bin. Reuse exposure on seeds is assertion-only (a\r\n  red, never a kill) and the image filter closes it. Both halves catch the 12-leak conformance\r\n  case; the first spelling caught none of it. PLUS THE [[IR-8]] BUCKET, REQUIRED (deployah,\r\n  same night — the third instance of that sentence tonight, this time inside our own instrument):\r\n  both selectors match on IMAGE PATH, and an exe path that cannot be READ yields no match — a\r\n  leaked svcmock holding an unreadable path is invisible to both halves and the count comes back a\r\n  zero that cannot see. Not hypothetical: IR-8's defining specimen is 5/5-denied on this exact\r\n  image, on this box. So the population assertion counts unreadable-path processes as their OWN\r\n  bucket and the zero-survivors claim REFUSES when that bucket is nonzero — zero seen AND zero\r\n  unseeable, or the assertion states it could not see. Built in from the start, not retrofitted\r\n  (may land in the lane's second commit at hertz's discretion; the requirement is that it lands in\r\n  the lane). This instantiates IR-8's remedy test-side; the CI reap-census script half of IR-8\r\n  stays open.\r\n- **Fix (thin lane, hertz — doyle-ruled 2026-08-03):** adopt `authenticated_kill` at all three\r\n  sites. (Board #131's `CREATE_NO_WINDOW` rider is DROPPED from this lane — hertz falsified the\r\n  filed remedy at source 2026-08-03: daemon.rs has exactly ONE CreateProcessW (:1187) and\r\n  BASE_FLAGS (:1105) already carries 0x0800_0000 = CREATE_NO_WINDOW on both rungs including the\r\n  ACCESS_DENIED fallback (which drops only BREAKAWAY), so the specified edit ORs an already-set\r\n  bit — a bit-for-bit identical flag word that would close a board item while its symptom, if\r\n  real, continues. #131 handed back to board triage with the finding and a candidate direction:\r\n  DETACHED_PROCESS gives the service no console, so a console child the SERVICE spawns flagless\r\n  allocates a NEW visible window — the grandchild, not the daemon's spawn, is the candidate\r\n  surface; wants its own diagnosis from an observed window. ~~The `detached_no_inherit_env` rename\r\n  (\"detached\" actually means breakaway-from-job) is a candidate cosmetic rider on [[IR-16]]'s\r\n  product lane~~ — **RENAME DROPPED 2026-08-03, ITS PREMISE MEASURED FALSE** (todlando, on the\r\n  IR-16 lane; doyle re-verified at source before ruling). \"detached\" is ACCURATE: `BASE_FLAGS`\r\n  (daemon.rs:1103-1105) is `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`, and\r\n  `0x0000_0008` IS DETACHED_PROCESS — the function sets BOTH postures and the name states one of\r\n  them. The name is not wrong, it is INCOMPLETE (silent about `CREATE_BREAKAWAY_FROM_JOB`, which\r\n  arrives as `extra_flags` at daemon.rs:1506), so renaming on the stated premise would have traded\r\n  an accurate word for one that drops a flag the function really sets. Independently fatal: the\r\n  premise, if true, covers the sibling `detached_no_inherit` equally — 17 references across\r\n  daemon.rs/deelevate.rs/shellhost.rs — and renaming one of two siblings of ONE posture leaves the\r\n  tree MORE inconsistent, not less. **What lands instead:** one doc-comment line on EACH function\r\n  naming the full effective flag word, which fixes the real complaint (neither name says breakaway)\r\n  without touching a call site. Kept here rather than deleted because this entry was the claim's\r\n  only home, and a reader who found the rename gone with no reason would re-derive it.) PER-PID GROUND TRUTH for expected_exe (hertz — SELF-CORRECTED\r\n  at source before it ever landed; his first derivation, \"Copy runs from adapters_dir(), Pointer\r\n  runs from srcs/\", was WRONG and registration mode is NOT the discriminator): servicehost.rs:1328\r\n  takes `install_dir` from `record.source_dir` on the Started arm for EVERY service, Copy and\r\n  Pointer alike, and Copy copies only the manifest + strings/ (registry.rs:395-404), never a\r\n  binary — `adapters_dir()` holds no executable in either mode. BOTH services run from their OWN\r\n  staged src dir: `staged_bin(<adapter's staged src dir>, \"svcmock\")`. The trap survives with a\r\n  different mechanism: two adapters staged into two DIFFERENT source dirs are two different files\r\n  on disk, so one expected_exe still cannot serve both. A lane that trusted the mode split would\r\n  derive a path with no binary at it. How it was caught, kept because it is the reusable part: not\r\n  by rereading the mode table but by finding where install_dir is COMPUTED instead of trusting an\r\n  already-published inference — the mode split was true of MANIFESTS and had been generalized to\r\n  BINARIES without checking the consumer; and the derivation-asserted-at-observe() instrument\r\n  would have caught it at runtime regardless — the instrument did its job before it ever ran,\r\n  argued against its own author. SCOPE_LOST RULED A GUARD, NOT A FINDING (hertz design change,\r\n  doyle-approved): a seed pid recycled before the sweep makes the sweep DECLINE that subtree\r\n  loudly, not fail — failing would turn ordinary pid churn on a busy runner into a red against a\r\n  clean teardown (the IR-15 false-red class re-minted inside its own fix); coverage holds without\r\n  it because the staged services are caught by image-path-under-home and the daemon + brain by NEW\r\n  direct per-pid target_gone checks (their pids this test never loses) — the ancestry half is\r\n  reach, not load-bearing. `unreadable` stays FATAL as ruled.\r\n  Sequencing: positive control\r\n  first (it is the instrument that could still refute the mechanism), then the lane. Does NOT ride\r\n  [[IR-16]] (doyle-ruled same day): that is the product-side kill_tree audit and stays a separate\r\n  lane under the dispatch split; the two cross-ref, they do not merge.\r\n- **Lane trap, flagged before build (hertz 2026-08-03 — the false-clean shape):** `expected_exe`\r\n  differs PER PID. `boot_pid` and `rel_service_pid` run the staged svcmock image, NOT spt.exe —\r\n  passing spt_bin for those refuses every kill as foreign-image and LEAKS both services while the\r\n  reap reads hardened. Only `brain.ready`'s pid takes spt_bin. Also: `observe()` boot_pid at :210\r\n  while it is provably ours, so the reuse check has creation-time teeth instead of degrading to\r\n  image+ancestry.\r\n- **Gate the lane on killing, not on refusing (deployah 2026-08-03; REFINED by hertz same night\r\n  from reap.rs's own contract):** the hardened version fails safe in the WRONG direction —\r\n  refuse-everything leaks both services while printing exactly the reap line a reviewer wants to\r\n  see, strictly worse than the bare kill it replaces and invisible in the same log. But a BLANKET\r\n  zero-REFUSED gate is wrong too: reap.rs's module doc (:18–20) states refusal is the CORRECT\r\n  happy-path outcome when the test already stopped its daemon (`Refused(\"gone\")` — leak insurance,\r\n  not primary teardown), so the blanket gate reds healthy runs, someone loosens it to go green, and\r\n  the loosened version is exactly the one blind to foreign-image — the detector dies by\r\n  maintenance, wearing a green. The refusal reasons split, and only one class is a defect:\r\n  SOUND (expected): `gone`, `reused`, `breadcrumb-moved`, `self`, `ancestor` — target provably not\r\n  there. TRAP (the false-clean state): `foreign-image`, `unreadable-image`, `unproven-identity` —\r\n  something WAS there and authentication declined; `foreign-image` is precisely what a wrong\r\n  per-pid expected_exe produces on every pid, every run. THE GATE: in the arm that must kill,\r\n  assert no verdict in the trap class — structurally on the returned `Verdict` (Killed |\r\n  Refused(&'static str), stable tokens by design, reap.rs:48), not by scraping output; the\r\n  `REAP[label]: … verdict=` line stays as CI-log forensics. The gate's comment MUST say\r\n  `Refused(\"gone\")` is expected, or the next reader \"fixes\" it. Positive counterpart that actually\r\n  proves the reap: assert `target_gone(pid, expected_exe, observed)` (reap.rs:215 — no-knowledge\r\n  never read as death) per service pid; bare-liveness \"no survivors\" is the false-clean named above.\r\n  TOKEN SET VERIFIED COMPLETE-PLUS-ONE (deployah, refuse() sites enumerated at source): the eight\r\n  tokens above sit at :128 self, :132 ancestor, :136 breadcrumb-moved, :146 gone, :149\r\n  unproven-identity, :155 reused, :166 unreadable-image, :172 foreign-image — each in the right\r\n  class — and there is a NINTH neither list held: `Refused(\"no-breadcrumb\")` at :243, returned\r\n  before authenticated_kill is reached. Doyle-ruled 2026-08-03, both halves: (1) `no-breadcrumb`\r\n  classifies SOUND — **SCOPED (deployah source-read, same night): it is two states wearing one\r\n  name.** `breadcrumb_daemon_pid` (reap.rs:59–63) collapses file-absent, permission-denied, any IO\r\n  error, AND a husked/unparseable partial write into one `None` via two `.ok()`s — so the token is\r\n  ABSENCE OF KNOWLEDGE, not proof of absence, and it is SOUND only because the calling test has\r\n  already asserted its daemon stopped. Every other SOUND token carries positive proof; a LIVE\r\n  daemon whose pid file is unreadable or husked emits the identical token and leaks wearing\r\n  \"nothing to reap\" — the helper's one fail-open path inside a fail-closed design (its own module\r\n  doc: no-knowledge is never read as death), and the same sentence as [[IR-8]]: a zero that cannot\r\n  see is not a zero. CORRECT REMEDY (doyle-ruled, deferred — not this lane, unreachable from this\r\n  test's pids): split at source into `no-breadcrumb` (absent) vs `unreadable-breadcrumb` (TRAP,\r\n  beside unreadable-image) — IR-8's unreadable-bucket fix in a second location; land the pair in\r\n  the census/reap wave IR-8 already names, one remedy for two entries. Precondition on the split\r\n  (hertz): common/reap.rs compiles into EVERY spt integration test binary, so enumerate the callers\r\n  that actually REACH `reap_breadcrumb_daemon` before the token split lands — those are the tests\r\n  whose teardown semantics change; own lane, not a rider. ENUMERATION DONE (deployah, same night,\r\n  read-only): 21 caller tests, every one passing &spt_bin as expected_exe (the per-pid trap is\r\n  specific to resident_service_e2e's svcmock pids — it does not generalize to this population);\r\n  20 callers fire-and-forget the Verdict; the one value-assertion, reaper_guard.rs:192-196, pins\r\n  `Refused(\"no-breadcrumb\")` for an ABSENT breadcrumb only — absent KEEPS the token under the\r\n  split, so that assertion survives unchanged (:183's stale-pid check is the loose\r\n  `matches!(Refused(_))`). The split is ADDITIVE: one source split, one new token, zero caller\r\n  rewrites. THE GAP THAT LET THE COLLAPSE HIDE: reaper_guard covers eight refusal shapes but has\r\n  NO test for an unreadable or malformed daemon.pid — the one state where absence-of-knowledge\r\n  reads as absence-of-target is the one state without a conformance test; (b) ships with exactly\r\n  that evidence (a garbage daemon.pid and an unreadable one, each asserting the new token).\r\n  ASSIGNED: deployah owns the (b) lane (doyle-ruled 2026-08-03), SEQUENCED AFTER hertz's IR-18\r\n  lane — the exhaustive panic-catch-all lands first, so the new token arrives forced-classified\r\n  per this entry's own design, and the (b) lane classifies it TRAP in the same change. SCOPE\r\n  RE-RULED (2026-08-03, on deployah's third-site find): the collapse now has THREE known sites\r\n  (reap.rs:59-63, resident_service_e2e's mock_pid :100-106, and the shape wherever a test reads a\r\n  self-written pid file) — so (b) lands ONE shared read-a-pid-breadcrumb helper that distinguishes\r\n  absent from unreadable ONCE, adopted at the enumerated sites, not a per-site token split; the\r\n  single-source-discriminant rule, applied before a fourth site mints itself.\r\n  **THIRD SITE CONFIRMED AT SOURCE (deployah, read-only 2026-08-04) — it was a predicted SHAPE and\r\n  is now an address:** `crates/spt/tests/resident_service_e2e.rs:136-137`, `brain_ready`, which\r\n  `.ok()?`s BOTH the read and the JSON parse — two collapses in two lines, the self-written-pid-file\r\n  shape this entry predicted. What makes it the worst of the three rather than the third of three:\r\n  its output feeds `brain_seed`, a population-sweep SEED, so an unreadable `brain.ready` silently\r\n  drops a whole subtree from the sweep. The other two sites lose one pid; this one degrades the very\r\n  instrument that is supposed to cover them, and it does so while the sweep still reports clean —\r\n  [[IR-8]]'s sentence again, now inside the instrument rather than beside it. The (b) lane's helper\r\n  therefore has to be adopted at this site to be worth landing at all. Still deployah's,\r\n  still after hertz's lane; hertz's lane does NOT wait for it (the population assertion covers the\r\n  leak class independent of pid bookkeeping — that is its virtue). (b) INTAKE ITEM (doyle gate on\r\n  the IR-18 lane, 2026-08-03, deferred there deliberately): the lane's verdict-gate SOUND-arm\r\n  comment reads \"provably not there\", which overclaims for `no-breadcrumb` (absence-of-knowledge,\r\n  not proof — the scoped reading belongs at that arm); comment-only, and (b) rewrites that arm\r\n  when `unreadable-breadcrumb` splits out, so it lands there rather than costing a solo respin.\r\n  SECOND (b) INTAKE ITEM (hertz self-noted at re-gate, doyle-ruled deferred): cleanliness is\r\n  currently stated at THREE sites (two asserts + `is_clean`) — the drift that produced the\r\n  scope_lost condition bug (a failed edit followed by a narrower successful one replaced the\r\n  message but not the condition; the artifact of that failure mode IS message/code disagreement).\r\n  (b) consolidates to conditions derived from one source, weighing the two-message diagnostic\r\n  split it would cost. The\r\n  exhaustive panic-catch-all match is what makes the split safe to do later: the new token lands\r\n  loud on first fire in every consuming gate, forced to be classified, never silently passed. Until then the scoped reading above is the\r\n  gate's contract — and the LANE BUILDER writes that scoped reading into the match's SOUND-arm\r\n  comment (the sketch's \"nothing to read is nothing to kill\" is the exact inference the source\r\n  forbids; the comment must not teach the false step); (2) the gate closes over the\r\n  token set — SPELLED BUILDABLY (hertz correction 2026-08-03; the earlier \"no wildcard arm\" wording\r\n  is an instruction rustc rejects, since the refusal reason is a `&'static str` (:55) and a string\r\n  match always requires a catch-all): the match names the six SOUND tokens as a pass arm, the three\r\n  TRAP tokens as a panic arm, and the REQUIRED catch-all arm is not a wildcard PASS — it panics\r\n  naming the unknown token (\"unclassified reap refusal token — classify it in this match\"), so\r\n  upstream drift announces itself the first run it fires instead of sliding into a silent pass.\r\n  Runtime fail-closed, not compile-time: compile-time closure needs the reason to become an enum in\r\n  common/reap.rs, an upstream change touching every consumer — ruled NOT smuggled into this lane\r\n  (candidate for its own thin lane if ever wanted; doyle concurs runtime fail-closed is\r\n  proportionate). Direction of the default, kept in the record: a missed trap state is an invisible\r\n  leak wearing the reap line a reviewer wants to see; an unclassified harmless token is a loud red\r\n  costing one edit. Cheap and loud beats silent and wrong. (Count hygiene, hertz self-flagged: a\r\n  single-line grep for the refuse() sites returns five of nine — three wrap across lines; the nine\r\n  stands on reading, not the grep. The sweep-count trap in miniature.)\r\n- **Prior observed instance of the class, in-tree (hertz 2026-08-03 — stated to understate):**\r\n  reap.rs:3–11 documents the measurement and a casualty: pid reuse on the Windows gate box at\r\n  2.2s minimum / p50 11.7s under a Phase-A battery, and a concurrent test process killed by a bare\r\n  kill on a stale breadcrumb pid, dying with bare exit 1 and no panic — the observed\r\n  `worker_lifecycle_e2e` red in golden job 90742055246 (that test's intermittent class is board\r\n  releases#32, still in-flight). Different test, different job — it does NOT reproduce this entry's\r\n  specimen and promotes nothing; what it settles is that the class is real IN THIS SUITE with a\r\n  named victim, and the authenticated reaper is the remedy someone already built for it —\r\n  resident_service_e2e simply never adopted it. Two shape-predictions it supplies, made before this\r\n  specimen existed: the p50 11.7s reuse window is short against this test's 45s waits and ~124s\r\n  runtime (window wide open). (A second claimed match — \"bare-exit-1-no-panic matches the empty\r\n  daemon.stderr.log\" — is RETRACTED as a category error, hertz+deployah 2026-08-03: reap.rs's\r\n  phrase describes the VICTIM TEST PROCESS dying, not a daemon's log; two processes, two\r\n  artifacts.) Predictions, not proof; the specimen stays CANDIDATE — shape since reproduced on\r\n  demand, agent unidentified (see the control record above).\r\n- **Rig near-miss, caught before first execution (hertz 2026-08-03) — kept as design justification,\r\n  not an anecdote:** the positive-control arm's first draft selected its victim machine-wide\r\n  (`Win32_Process Name='spt.exe'` + cmdline match `daemon run`, then force-kill). hfenduleam is the\r\n  Windows CI runner as well as a dev box, so that filter matches CI's own test daemons: run while a\r\n  leg was live, it would have force-killed a running job's daemon and reported the result as a\r\n  measurement — fabricating a red in someone else's job, the exact class this entry documents.\r\n  Corrected to a parent-scoped selector (daemon = child of the test pid; service = child of that\r\n  daemon); `CREATE_BREAKAWAY_FROM_JOB` does not weaken parent-id attribution, since breakaway leaves\r\n  the JOB, not the parent record — which is also why the orphaned svcmock stays attributable to the\r\n  daemon that spawned it. **The load bought the catch** (blocked on the box ⇒ re-read instead of\r\n  ran). Bearing on the fix: the INSTRUMENT built to study a bare-selector reaper was itself written\r\n  with a bare selector. The remedy therefore cannot be \"be careful\" — the authenticated path must be\r\n  the only one within reach in this suite.\r\n- **Ripe when:** RIPE NOW, and not gated on the rate run that was cancelled.\r\n- **Size:** small.\r\n\r\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\r\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\r\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\r\n  source same night.\n…\n","startLine":457,"lineNumbers":[457,null,555,null,565,null,603,null,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,null,1076]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5781,"totalBytes":41448,"outputLines":444,"outputBytes":41448,"shownRange":{"start":607,"end":1050},"nextOffset":1051}}},"isError":false,"timestamp":1789094605706}}
{"type":"message","id":"7b388207","parentId":"64148f50","timestamp":"2026-09-11T02:43:25.717Z","message":{"role":"toolResult","toolCallId":"call_YKT2rLkPxdTIAwRkHbjRl6sO|fc_074aee81620ae383016aa36acb3ea487d190c3b06b732b96c9","toolName":"read","content":[{"type":"text","text":"### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n…\n- **Declared validation extra:** the lane's docs-link gate exposed that `llms_target_exists` treated\n…\n\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\n  blind repros exit 0); v0.4.0 cut (version bump @`c9a8eb5`, tag pushed, 3 platform assets,\n  release notes authored; refs sent to hertz). REMAINING and dispatched to hertz post-#182-landing:\n  spt-core consumes v0.4.0 — CI version bump + placement config (enforce-on, module_banner=accept);\n  banner cleanup rides a later lane. Entry closes when the consume lane lands. · **Origin:** hertz\n  measurement 2026-08-04 (filed by doyle; the measurement is\n  hertz's), found when his own pre/post `check` comparison around a tag-adjacency fix came back\n  EXIT=0 on BOTH sides — the green he had cited beside the fix validated nothing.\n- **What/why:** measured on `test/teardown-bound-shape`: a `[unit->REQ-RESIDENT-SERVICE]` tag\n  SEPARATED from its `#[test]` fn (a const landed between tag block and fn — an AGENTS.md rule-1\n  violation) scores EXIT=0 identically to the fixed adjacency. Positive control explains the\n  mechanism: that REQ carries 57 unit tags across five files, so 56 other sites decide the\n  coverage verdict and no single tag's placement can turn it red. Consequence: AGENTS.md rule 1\n  (\"tag on or immediately above the real evidence\") is agent discipline only — drifted tags decay\n  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\n  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\n  gate itself.\n- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT\n  established. Separating the only tag of a single-tagged REQ at the stage under test would settle\n  whether placement is unenforced outright (still exit 0 ⇒ the checker never reads adjacency) or\n  merely un-enforceable at scale (exit 1 ⇒ the checker sees absence, and only multi-tag redundancy\n  masks drift). Run that discriminator BEFORE designing any remedy — the two outcomes want\n  different fixes (a placement rule in the checker vs a per-tag-nearest-item heuristic).\n- **Transfer:** doyle accepted this lane's independent EXIT-0 remeasurement and confirmed it\n  matches todlando's settled 2026-08-04 discriminator. Upstream remedy: enforce adjacency for\n  each individual `doc`/`impl`/`unit`/`int` tag, with separated-tag negatives covering\n  single-tag, interposed-const, file-top-banner, and one-of-many displacement. This repo consumes\n  the released checker only.\n- **Close condition:** doyle reviews and merges the upstream lane, cuts the `traceable-reqs`\n  release, and spt-core consumes that release. Issue/branch/PR/commit refs append here when the\n  upstream lane lands.\n- **Size:** measurement complete; remedy scope is upstream-owned and dispatched.\n- **DISCRIMINATOR RUN 2026-08-04 (todlando, authorized specimen on `build/w1t2-shell-relink-force`;\n  filed by doyle — the measurement is todlando's): the answer is the EXIT-0 ARM.** Single-tagged\n  int stage (`REQ-SHELL-RELINK-FORCE`), tag SEPARATED from its fn (parked at file top):\n  `traceable-reqs check` EXIT 0 and the REQ still reports `+int`. Tag reverted to adjacency:\n  EXIT 0, `+int`. Both exits redirect-read, no pipes. **Placement is UNENFORCED OUTRIGHT — the\n  checker never reads adjacency; multi-tag redundancy was never the mechanism, it only widened the\n  blind spot.** Remedy option (a) is the live one: a real placement rule in the checker (upstream\n  experimplate), not a per-tag-nearest-item heuristic. Measurement caveat, carried at the\n  measurer's own insistence: an intermediate probe printed `TAG_ADJACENT_AFTER_REVERT=0` and that\n  was the PROBE wrong (`grep -B 1` above the fn lands on `#[test]`, not the tag above it), not a\n  failed revert — the revert was verified directly (exactly one tag, above `#[test]`). The\n  discriminator result is the record; the intermediate zero is not.\n- **REMEDY DISPATCHED 2026-08-18 (doyle):** upstream lane opened in BigscreenVR/traceable-reqs\n  (the actual upstream remote; the checkout at `~/Documents/projects/traceable-reqs` tracks it —\n  \"experimplate\" above named the tool's origin project, not the repo) — checker-side placement\n  rule, default-on in `check`, positive controls all four stages + separated-tag negatives\n  including the single-tag displaced discriminator shape and the interposed-const shape.\n  Requested by hertz as the IR-37 prerequisite of his test-hygiene family lane (KEYSTONE #182).\n  spt-core consumes the upstream RELEASE only — no local shadow checker. Issue/branch/PR refs\n  land here when the lane reports.\n\n### IR-38 — CLASS: an e2e that ends with a live daemon-spawning binary wedges the NEXT build in its pool, and the diagnostic names the wrong lane\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-04,\n  `shell_relink_force_e2e` on the #6 lane (filed by doyle; the finding and the fix are todlando's).\n- **What/why:** the e2e ends with a LIVE binary by design; on Windows a live process holds its\n  image open, so the NEXT cargo invocation in that target dir dies with\n  `failed to remove file target\\debug\\spt.exe: Access is denied (os error 5)` — surfacing as\n  exit 101 with NO test summary, because the failure names the BUILD and the FILE, never the test\n  that leaked the holder. Actual holders measured: two lane-local `spt daemon run --detached` +\n  `daemon brain` processes spawned under the test's temp SPT_HOME by a child CLI's\n  `ensure_running`, still alive from an earlier run. **Reap BY IMAGE PATH** — the fleet's other\n  eleven spt processes run from the installed binary; a name-based sweep takes your own daemon.\n  The live shell-spawn population is eleven e2e files. Nine already end through product teardown\n  or their authenticated home-scoped reap. The two intentionally live-at-success siblings now\n  kill and prove the final resident gone AFTER all identity/wake assertions:\n  `shell_relink_force_e2e` and `shell_stale_online_e2e`.\n- **Kin:** [[IR-7]] (phase-A daemon+brain pair leak), the exe-lock reap-by-path rule, and the\n  wrong-lane-diagnostic family ([[IR-21]]'s location-not-build class).\n- **SECOND HOLDER CLASS, measured 2026-08-04 (doyle, own gate rig):** an **ORPHANED CONHOST with an\n  inherited CWD** inside the test tree blocks `git worktree remove` with Permission-denied on a\n  DIRECTORY handle — invisible to any exe-path scan (conhost runs from System32; the parent that\n  spawned it was already dead). Found via `.github/ci/find-cwd-holders.ps1` (IR-11's instrument);\n  killed by pid after parent-dead classification; 34.78 GB reclaimed. Mechanism chain: the\n  windowless spawn path masks DETACHED_PROCESS off, the child owns a console, conhost inherits the\n  child's cwd and can OUTLIVE it. Boundary (hertz's, correct): this find and his field-4 companion\n  are the SAME MECHANISM FAMILY measured on DIFFERENT populations by different instruments — his\n  capture measured a ppid-match COUNT (floor 2, companion identity UNMEASURED, his stated limit),\n  and this conhost is the first FIELD identity evidence in the family, on THIS population. Do not\n  cite his row as identity data it never carried. (His box-wide accretion count 77→80 is a third\n  population again.) Teardown rule\n  addendum: a disposal leg must GATE on the removal's exit code (a rig that logs \"reclaimed 0.01\n  GB\" from a failed remove fabricates its own success) and sweep CWD HOLDERS, not only image\n  locks — two populations, either alone is a clean zero on the other.\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36 family) — sweep every e2e that ends\n  with a live spawning binary, apply the same reap-after-assertions shape.\n- **Size:** small per test; population unknown until swept.\n- **Built evidence:** focused runs of both live-at-success tests pass back-to-back in one target\n  pool, followed by a build invocation from that same pool; the second test's final kill is polled\n  to proven process death rather than treated as fire-and-forget.\n\n### IR-39 — CLASS: the missing-fixture-bin defect has TWO failure faces, and one of them impersonates a lifecycle defect of the subject under test\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz + todlando\n  2026-08-04, same evening from opposite sides (filed by doyle; hertz relayed todlando's\n  suggestion without endorsing scope).\n- **What/why:** a rig whose narrowed build (`-p <pkg> --test <one>` / `-p spt --bin spt`) skips a\n  cross-package fixture bin fails in one of two ways depending on the consuming site.\n  Face 1 (cheap): `translate_proof_fixture` panics \"must be built: <path>\" — names the artifact\n  and the recipe, costs one build. Face 2 (expensive): `sibling_bin(\"mock-session\")` resolves to a\n  nonexistent exe, nothing spawns, and the test reds at a PRECONDITION assert whose message\n  (\"warm bring-up spawned=false\", left None / right Some(\"offline\")) reads as a lifecycle defect\n  of the subject — measured cost 186s + a triage inside a lent box window (hertz's F1 red arm,\n  attempt 1). The build gap itself is the known cross-package row of the fixture-bin population;\n  what this entry carries is the DIAGNOSTIC asymmetry.\n- **Ask:** a fixture-bin existence precondition that NAMES the missing exe and its build recipe\n  wherever a rig consumes one — `sibling_bin` (and the shared\n  `crates/spt-term/tests/support/fixture_bin.rs` resolver already carries the recipe string as an\n  argument, the shape to copy) refuses with the artifact + recipe instead of letting the consuming\n  test fail downstream in its own vocabulary.\n- **Kin:** [[IR-21]] (wrong-lane-diagnostic family: the failure names the wrong actor), the\n  cargo-builds-package-bins-for-integration-tests rule (cross-package row is the only unguaranteed\n  build), golden.yml's dedicated fixture prebuild step.\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36/IR-38 family) — same sweep population;\n  or standalone small if that lane keeps slipping.\n- **Size:** small — one shared helper + a sweep of local `sibling_bin` resolver copies (24 known).\n- **Addendum (doyle, 2026-08-04 late): third and fourth sightings inside 24 h.** Face 1 twice\n  more the same evening — todlando's teach-lane leg set (his own translate_proof_fixture, caught\n  by his prebuild), and doyle's cold gate rig for the same lane (first-pass spt-bins red at\n  136/611, correctly withheld from the lane verdict as rig evidence, fixed by `cargo build -p spt\n  --bins` + rerun 611/611). Four sightings in one day across three agents and both faces: the\n  ripeness condition (\"the test-hygiene lane keeps slipping\") is under measurable pressure — the\n  prebuild remedy is being re-derived per-rig per-agent, which is the recurring cost the shared\n  precondition helper exists to delete.\n- **Built evidence:** all 29 file-local `sibling_bin` resolvers now route through one shared\n  precondition. A missing fixture names its path and the package-correct `cargo build -p <owner>\n  --bin <name>` recovery command before product assertions or timeout paths run; a focused\n  negative test pins that diagnostic.\n\n### IR-40 — CLASS: NO envelope-side ordering signal on a resume brief tracks content recency, and a CI informant's per-job line is a claim about that STEP, not the run\n- **Status:** open · **Origin:** three sightings in one night, 2026-08-04/05 — hertz, doyle,\n  todlando (filed by doyle; the artifacts are hertz's and todlando's, the CI arm is doyle's with\n  deployah's framing). Two arms of ONE family: a stale record that carries a confident ordering\n  signal, and a status claim that arrives before the thing it describes.\n\n- **ARM A — resume briefs. What/why:** a session can receive TWO start-of-session briefs, and the\n  one routed LATER can carry the STALER project-context. Measured on hertz's pair (same node id):\n  routed_at_ms `1785897407373` > `1785896642480`, spill-filename epoch `1785897764588` >\n  `1785896658159`, and vector sequence `1242529/1242531` > `1241542/1241544` — **all three\n  monotonic orderings rank the staler-content brief as newer.** todlando's pair is the NEGATIVE\n  arm: his later brief (`…1785897765196`, routed `…577476`, vector `1242756/7`) genuinely WAS the\n  fresher one, so the same heuristic happened to pick right.\n- **The finding is UNCORRELATED, not inverted** — and that is the whole entry. An inverted signal\n  is usable once you know to flip it; an uncorrelated one reads as reliable until the pair where it\n  costs you. Neither agent could have known which pair he held without checking content against\n  measurement. **Do not name routed_at_ms specifically** — naming the stamp invites the repair that\n  fails (\"the timestamp is unreliable, use the sequence number\"). The vector is the most dangerous\n  of the three: a stamp looks like a clock and invites suspicion, a sequence number looks like an\n  ordering and does not.\n- **Visible failure mode if a brief is obeyed as instructed** (hertz's, measured): re-open\n  `releases#123` — work already ruled closed — and under-report his own claimed-pool count by one,\n  the row sitting under a live gate. doyle's own sighting the same night: a brief describing main\n  @`92b2482` with a teach lane \"mid-flight\" hours after every lane had gated.\n- **PRE-REFUSED DISCRIMINATOR, recorded so it is not rediscovered as a finding:** file SIZE ranks\n  the fresher brief correctly on BOTH pairs (hertz 16308 > 12649; todlando 14138 > 10418) — 2 of 2,\n  the only signal surviving both samples. **Do not use it.** Size measures RICHNESS, not recency;\n  the two correlated only because todlando's thin brief was a correction fragment, and hertz's\n  STALER brief was a full 12649-byte dump. Two full dumps hours apart go flat or inverted. Handed\n  over pre-refused by its own finder.\n- **ARM B — CI informants (doyle, 2026-08-05, run 30971976024).** `CI-KITSUBITO` sent\n  \"CI SUCCESS … sha 0a25b77\" while the run was measurably `status=in_progress` with\n  `conclusion=\"\"` — the EMPTY STRING, not `success`. The informant fires from a per-job `notify`\n  step, and at send time `notify` itself had no conclusion. All eight substantive jobs were green,\n  so the line was **right in the end but EARLY**. deployah's framing, kept verbatim in kind: *an\n  informant line that is right in the end but early is worse than one that is simply wrong, because\n  a wrong signal gets distrusted while an early-but-correct one gets promoted to the conclusion.*\n  todlando's sentence is the one to keep at the point of use: **a per-job notify step's message is\n  a claim about that STEP, not about the RUN.**\n- **ARM B MECHANISM — hertz, source read 2026-08-05, zero box cost. It is NOT a race; it fires\n  early on EVERY run, and the entry above understated it.** `notify` is a job INSIDE the run\n  (`golden.yml:1138`), and a job cannot observe its own run's conclusion — so `conclusion: \"\"` is\n  not a timing artifact, it is **the only value that can exist when the informant speaks. The\n  informant has never once made a statement about a run conclusion.** What `ci-notify.sh` actually\n  asserts is narrower and worth naming exactly: a verdict computed PURELY from six `needs` results\n  (changes, traceability, test, n1-gate, twohost-a, twohost-b — the two matrices collapse to one\n  result each) being neither failure nor cancelled. Nothing more.\n  **The blind spot is exactly ONE job: `notify` itself, the 9th — it cannot appear in its own\n  `needs` list. And that one job has a WITNESSED red path**, documented in the script's own header\n  (2026-07-27, twice on kitsubito): verdict computed, then `spt send` HUNG ~5 minutes until the\n  job's own 5-minute budget cancelled it, and that cancellation reddened the run. So *\"informant\n  says SUCCESS, run concludes FAILURE\"* is a real observed sequence, not a hypothetical. The 30s\n  `SEND_BOUND_SECS` added since bounds the hang but does not close the class — it makes the\n  informant's own failure FAST rather than impossible.\n  ⇒ The informant's SUCCESS covers 8 of 9 jobs and is blind to the 9th, and the 9th is the only one\n  with an observed failure mode that reds the run. This is why the ff predicate is the run's\n  conclusion field and never the informant line.\n- **RECOVERY, and it is the same for both arms: never rank the claims — re-derive from the source\n  object.** For briefs, hertz's four falsifiers are the method (main sha, claimed-pool count, lane\n  tip, issue state) and they work because each is a content claim checkable in ONE command against\n  a source NEITHER brief controls. For CI, read the RUN's own `conclusion` field, and prefer\n  independent reads of the run object (`gh run watch --exit-status` polls the run, so its exit is a\n  second measurement rather than an echo of `notify`). On the batch this was caught in, three\n  sources agreed with the informant excluded from all three before main was fast-forwarded.\n- **Standing rule this entry exists to enforce:** a resume brief's RULINGS are durable; its STATE\n  is a HYPOTHESIS to re-derive before acting.\n- **Kin:** [[IR-21]] and [[IR-39]] (the diagnostic names the wrong actor / the wrong subject),\n  [[IR-32]] (a gate that cannot see its own blind spot), [[IR-34]] (an intermittent marker read as\n  a signal).\n- **Ripe when:** the next commune/psyche-tier touch for arm A (the routing layer is spt-core's own\n  `spool`/psyche ingest, so a remedy is in-repo, not upstream); for arm B, the next `golden.yml`\n  informant touch — the cheap fix is that the notify step names its own scope in the message body\n  (STEP vs RUN) rather than emitting a bare \"CI SUCCESS\".\n- **Size:** arm B small (message text + scope word in one workflow step). Arm A unsized —\n  establishing whether ANY durable content-recency signal can ride the envelope is the measurement,\n  and until it runs the answer is \"re-derive, do not rank.\"\n\n### IR-41 — A QUEUED main run is superseded without a record; `cancel-in-progress: false` protects only STARTED runs\n- **Status:** open — mechanism CONFIRMED (doyle ruling 2026-08-05); the runbook sentence it\n  falsified is already corrected (`docs/RELEASE-RUNBOOK.md` step 3, same commit as this entry)\n  · **Origin:** deployah, v0.55.0 publish night, filed by him explicitly as UNPROVEN with the\n  manual-cancel alternative not ruled out; confirmed by doyle on the run objects.\n- **What/why:** `ci.yml` sets `cancel-in-progress: false` on main and the runbook read that as\n  \"main's concurrency policy never cancels this run; that preserves the record.\" FALSE for the\n  queued phase: a concurrency group holds at most one running + one pending run, and a newer push\n  REPLACES the pending run regardless of the flag — the flag governs only whether a STARTED run\n  is cancelled. A superseded queued run leaves NO record: zero jobs, conclusion `cancelled`,\n  nothing measured about its sha.\n- **Evidence (all read off the run objects, not the informant):** run 30973909279 at `327f1f8`\n  (push, main) — created 04:01:08Z, **zero jobs ever started**, cancelled 04:03:49Z, ONE SECOND\n  after `e8805f7`'s run 30974041521 entered the group (created 04:03:48Z), while `0a25b77`'s run\n  30973770039 was still in flight (done 04:07:59Z). One-running-one-pending, newer push landed,\n  pending run died. The 1s coupling to an unrelated push is the discriminator against deployah's\n  own manual-cancel alternative — a human cancel co-timed to the second with a push it had no\n  view of is not a credible mechanism; supersession fires on exactly that trigger by design.\n- **The hole this leaves:** under a rapid push sequence, an intermediate sha on MAIN can have no\n  thin-CI verdict AT ALL, and the absence reads as nothing rather than as supersession. Anyone\n  auditing \"did sha X pass main CI\" gets a hole where the runbook promised a record. Absence of\n  a run is now a labelled state, not evidence about the sha.\n- **Ripe when:** next ci.yml/runbook touch. Candidate remedies to weigh THEN, not now: accept and\n  document (done — the runbook now carries the mechanism), or give main's group per-sha keys\n  (`group: ci-${{ github.sha }}`) so runs never share a group — at the cost of concurrent main\n  runs competing for the boxes, which is exactly what the group exists to prevent. The trade is\n  real; do not fold it into a drive-by.\n- **Size:** docs half DONE in this commit; ci.yml half small but load-bearing — needs its own\n  lane if taken.\n- **Kin:** [[IR-40]] (a record that is right-in-the-end-but-early vs a record that never comes to\n  exist — both read as clean states unless labelled), [[cancelled-measurement-leaves-labelled-hole]].\n\n### IR-42 — `pool-claim` writes a record; only the BUILD enforces — and AGENTS.md invited the misread\n- **Status:** BUILT 2026-08-19 — the AGENTS.md corrective line lands in the SAME COMMIT as this\n  entry (the register batch commit), which is the entry's stated exit condition. The optional\n  code-side nicety (claim verb prints the incumbent record it overwrites, information only)\n  remains unclaimed — a candidate rider on the IR-26 remedy lane, which already touches\n  `pool_claim`'s read-before-write path, NOT a reason to keep this entry open ·\n  **Origin:** doyle + todlando independently at source, 2026-08-19, during the #193 gate.\n- **Mechanism (source-verified):** `xtask pool-claim` (crates/xtask/src/main.rs:2232-2294 at the\n  read sha) parses its args, reads the lane's own git identity, builds a `PoolOwner` and calls\n  `spt_poolguard::write_owner` UNCONDITIONALLY (:2280) — no `read_owner`, no verdict, no\n  comparison against the incumbent claim anywhere in the function. Claiming is last-writer-wins\n  by construction: two lanes can each \"hold\" a pool in sequence with only the last write\n  surviving, and the displaced lane learns nothing at displacement time. All four enforcement\n  arms — `Refuse` (SPT_POOL_FOREIGN), `Takeover` (loud), `Unproven`, `HatchOpen` — live in\n  crates/spt-store/build.rs:31-113 and speak only at the next BUILD. (Same object [[IR-26]]'s\n  CLAIM-OBSERVABILITY measurement saw from the displaced side; this entry is the CLAIMING side\n  plus the doc that invited the misread.)\n- **Measured consequence:** 2026-08-19, doyle's gate claim over todlando's unlanded\n  redeem-echo-diag claim — no refusal, no notice (three sequential overwrites that session, one\n  over a lane with an unlanded commit). todlando then predicted from AGENTS.md's refusal\n  sentence that the gate's claim \"will be REFUSED\" — a false warning to a gater mid-run. The\n  refusal sentence sat directly under the \"Claim a pool at lane start\" instruction, inviting the\n  build-time semantics to be read onto the claim verb.\n- **Corrective landed:** one AGENTS.md sentence — the claim WRITES a record and never refuses;\n  predict refusals from builds, never from `pool-claim`.\n\n### IR-43 — knock answer carrier: `NoReply` landed at 60.08s against a stated 30s carrier deadline\n- **Status:** open, OBSERVATION — mechanism unmeasured, filed exactly as wide as the datum ·\n  **Origin:** KNOCK-169 RCA layer 1 (todlando, read-only), golden 32191618042 @`93c1130`,\n  twohost-b, 2026-08-18.\n- **What/why:** B's `request_answer` yielded `NoReply` at 22:50:08.3605Z — 60.08s after A's\n  death — while the carrier deadline is stated at 30s. Recorded in the RCA as a side observation\n  with no claim; the cell's red itself was a CASCADE of A's earlier death (answerop.rs:73-81\n  produces the courtesy BEFORE returning, so the reply was never sent — that half is settled and\n  is NOT this entry). What this entry carries: a transport/liveness bound that reported at 2x its\n  stated value. Candidate shapes, neither asserted: two sequential 30s legs each honoring its own\n  bound (a composed wait wearing one bound's name), or a bound armed after a wait it does not\n  cover (the [[IR-30]] nethost.rs permit-wait shape: `sem.acquire_owned()` outside the timeout).\n- **Ask:** derive where the 30s is armed and what path yields a 60s `NoReply` — one code read\n  from the emit site, before any instrument.\n- **Ripe when:** next knock-carrier touch, or the next `NoReply`-shaped red — whichever first.\n- **Size:** small (code read; a token only if the read forks).\n\n### IR-44 — perch-sentinel comment overclaims: serialization is not preservation, and the comment teaches the false step\n- **Status:** open · **Origin:** #188 RCA lock read (todlando flagged, doyle confirmed the lock\n  read), 2026-08-18; the collapse-of-branches argument is on #188 and in the RCA record.\n- **What/why:** `lock_perch_sentinel` (info.rs:778 at `b20e770`, the diag sha — re-derive the\n  line on main before editing) takes a cross-process fs2 lock on a stable per-perch `.info.lock`\n  sentinel, and its comment claims it serializes \"ALL info.json writers so a whole-record write\n  and a locked RMW can never lose each other's update (`REQ-HAZARD-INFO-RMW-LOST-UPDATE`)\" —\n  TRUE for interleaving, FALSE for preservation. `write_info_unlocked` is module-private with\n  exactly three callers, all taking the sentinel first (bypass refuted by visibility), but every\n  caller of the public `write_info` composes its record BEFORE the lock is taken (:842) — **the\n  lock makes that write atomic; it cannot make it preserving.** Only `mutate_info` /\n  `establish_locked` read under the hold and can preserve. Measured field case: census write #1\n  (`twohost.rs:736`) clobbered `controlled` while correctly locked. A reader trusting the\n  comment infers lost-update immunity the funnel does not provide — the #188 hunt burned a\n  branch on exactly that inference before the collapse argument killed it.\n- **Ask:** respell the comment — serializes writers; a composed `write_info` is atomic, never\n  preserving; preservation requires `mutate_info`/`establish_locked` — and weigh whether\n  `REQ-HAZARD-INFO-RMW-LOST-UPDATE`'s doc wording carries the same overclaim.\n- **Ripe when:** next spt-store/info.rs touch. **Size:** tiny (comment + possibly one REQ doc\n  line).\n\n### IR-45 — twohost rig home premise, SETTLED: pump paths resolve under the per-run TEMP root (rig is disk-hermetic; the \"live fleet roster\" reading is retired)\n- **Status:** RETIRED 2026-08-19 — ask answered by the one code read at main @`78a9a16`; residue\n  re-homed (see Answer). · **Origin:** #188/#189 RCA readouts (todlando, doyle's 2a-2d), runs\n  32097943571 + 32108557362 + 32111921251, 2026-08-18.\n- **What/why, two measured halves in tension:** (1) B's pump dialed a THIRD node 155-159 times\n  per run at kitsubito's OWN tailscale IP (`100.98.197.12`), different hex + different ephemeral\n  port each run — a short-lived local endpoint re-minting identity between runs, present in both\n  the golden and the diag run. Read at the time as: the rig uses the CANONICAL home\n  (`canonical_pump_paths` → `perch::spt_home()`), so B's roster is kitsubito's live fleet\n  roster — environmental coupling of a CI rig to host fleet state. (2) The ER perch measured in\n  the chain runs resolves under a per-run TEMP root\n  (`…/_temp/spt-test-tmp-<run>…/owlery/engine-room`), NOT the canonical home. Both measurements\n  stand; they answer different artifacts (pump roster vs perches), and nothing on record settles\n  which home the PUMP paths actually resolve. #189's third-node evidence and its\n  cache-leg-never-heals reading rest on that premise (the tension is filed on the #188 record as\n  an open question against #189).\n- **Answer (2026-08-19, code read at `78a9a16`, unambiguous — no run token needed):** both role\n  tests set `SPT_HOME` to a fresh per-run `TempDir` as their FIRST act (`twohost.rs:813-814` role\n  B, `:1501-1502` role A), before any store touch. `canonical_pump_paths` resolves every path via\n  `perch::spt_home()` (`twohost.rs:396-414`), which honors the `SPT_HOME` override first\n  (`perch.rs:34-41`); the pump's roster source `presence::registry_snapshot_dir()` →\n  `perch::identity_dir()` sits under the same root (`presence.rs:83-85`). The rig is\n  DISK-HERMETIC per run; both prior measurements reconcile (ER perch observed under the temp\n  root, pump paths resolve there too). The misleader was the helper's name + doc comment (\"real\n  homes, not test roots\"), which describe production path LAYOUT, not the resolved ROOT.\n- **Residue disposition:** (1) #189's third-node evidence was corrected on the board (comment\n  5337519936) — the roster row arrived at RUNTIME into a temp-rooted store, ingress mechanism\n  OPEN on #189, no longer explained-environmental. (2) KEYSTONE #182's hygiene lane repaired the\n  `twohost.rs:394` comment to say exactly what the helper does: production path layout rooted in\n  the process's fresh per-run `SPT_HOME`.\n\n### IR-46 — the Windows disk-floor preflight asserts an INSTANT; workspace free space moves tens of GB inside the hour, so a green floor is not a claim about run headroom\n- **Status:** open — mechanism CONFIRMED by a measurement series on hfenduleam; doyle ruled it\n  register-shaped 2026-08-18 · **Origin:** deployah, NAMEPLATE #181 golden-head intake, on the\n  run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\n  as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\n  (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\n  and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\n  version of it.\n- **What/why:** `golden.yml`'s Windows preflight computes `$freeBytes` once at job start and\n  hard-fails under a `32GB` floor. As a fast-fail that is correct and it did its job — it refused\n  before compiling rather than dying deep in a link step. The defect is what a PASS is then read\n  to mean. The reading is a point sample of a quantity that moves by tens of GB unattended, so a\n  green preflight licenses a run whose headroom was never measured. Nothing downstream re-checks.\n- **Evidence — five readings of `C:` free on one box inside roughly one hour, 2026-08-18:**\n  - `03:01:54Z` — `free_bytes=2666205184` (2.48 GiB) against `floor_bytes=34359738368`, the\n    preflight's OWN reading; run `32093894524`, both `n1-gate` and `test` on Windows/hfenduleam\n    failed at this same step, before any compilation.\n  - `~03:2xZ` — ~2.50 GB, independent `Get-PSDrive` read, corroborating the preflight.\n  - pre-reap — **33.70 GB**, immediately before deployah deleted anything.\n  - post-reap-1 — 76.42 GB (42.72 GB reclaimed: `claude_skill_owl/target`, `golden-w1/target`).\n  - pre-reap-2 — **73.81 GB**, i.e. 2.61 GB consumed unattended between the two reaps; then\n    post-reap-2 129.70 GB (55.89 GB reclaimed: `.worktrees/nameplate-w1/target`).\n- **LABELLED HOLE — do not let this harden:** roughly **31 GB was released between the preflight\n  failure and the pre-reap reading by something OTHER than the reclaim**. Released-by-unknown.\n  The runner cleaning its workspace after the job died is *plausible* and is NOT the recorded\n  cause — it was never measured, and no one looked while it was happening. Recorded as a hole on\n  purpose (doyle's explicit ask at filing): a plausible cause written down as the cause would make\n  this row read as explained when the actual mechanism of the 31 GB is unknown.\n- **The hazard this leaves:** a run can clear the floor at preflight and starve mid-build, and\n  mid-build disk starvation does not present as disk — it surfaces as a link failure, a truncated\n  artifact, or a rustc ICE, i.e. as a defect in the tree under test. The failure mode inverts the\n  gate's purpose: the preflight's whole point is to keep box conditions from being read as lane\n  reds, and a passing preflight actively argues the opposite. Note the polarity — this row is\n  about the PASS, not the FAIL. The observed red was honest.\n- **#242/v0.66.0 GOLDEN ADDITIONS (deployah measured 2026-08-29, banked at the 08-30 close\n  sweep):** (i) per-job floor figures are SEPARATE INSTANTS — quote per job, never one figure for\n  both (attempt 1: `test` 26521477120 vs `n1-gate` 26535051264 free bytes, 8s apart, one run);\n  (ii) **CORRECTED TRAP** (retracting deployah's earlier \"attempt-2 hides jobs\" version): the\n  default `/runs/<id>/jobs` endpoint stamps `run_attempt=<current>` on EVERY job including ones\n  that never re-ran (4 of 8 mis-assigned on this run) — it is the RUN's attempt, not the JOB's,\n  so a stale green can read as re-earned; `started_at` is the discriminator and\n  `/runs/<id>/attempts/N/jobs` the authority. Also `rerun --failed` re-runs DEPENDENT jobs\n  (twohost re-ran despite a green attempt 1); (iii) a rerun preflight reads RAW free BYTES with\n  the CI step's own predicate, not display GB; (iv) a rerun green counts as floor-RCA-closing\n  evidence only after a step-level NON-VACUOUS check (checkout SUCCESS + workload steps ran) —\n  the v0.64.0 checkout-SKIPPED shape means a green job can carry zero code signal.\n- **Ripe when:** next `golden.yml` touch. Remedies to weigh THEN, not as a drive-by: re-assert the\n  floor at job END (turns a starvation into a labelled disk verdict instead of a fake lane red);\n  or raise the floor to cover a full build's peak rather than its entry condition; or sample free\n  space across the run and emit the minimum as a token. All three cost run time; none is obvious.\n- **Size:** small in `golden.yml`, load-bearing in what a green run is taken to prove.\n- **Kin:** [[IR-41]] and [[IR-40]] (a state that reads as a clean verdict unless it is labelled —\n  here a PASS that is read as headroom it never measured), [[measure-the-box-before-the-instrument]],\n  [[cancelled-measurement-leaves-labelled-hole]].\n\n- **2026-09-06 addendum (doyle, v0.67.1 close sweep): trigger FIRED at `04e32c8c` — `golden.yml` touched (2-line HEAVY reclass of `brain_resume_conn_deadlock` on the respin) with no remedy weighed. Not a drive-by by choice: the touch rode a respin under a pre-registered hard stop, which is no remedy window. COMPOSED with IR-59 (log-the-floor) + IR-73 (literal-first sites) as one hertz workflow rider on WEBSERVE #272; the remedy weighing happens on THAT lane, before the WEBSERVE golden head.**\n\n<!-- [doc->REQ-CI-FREE-SPACE-PREFLIGHT] -->\n- **2026-09-06 remedy ruling (doyle, WEBSERVE rider):** retain 32 GiB; record raw-byte\n  `FLOOR_START` and `FLOOR_END` PASS/RED tokens per job/runner, each labelled `sample=INSTANT`.\n  End DISK assertions run `if: always()` before teardown, including after failed workloads.\n  A fresh `FLOOR_DOCS` assertion immediately before docs-drift composes with IR-73's second half.\n  Raising the floor is refused without a measured peak; continuous sampling adds lifecycle\n  machinery while remaining blind between samples. Start/end are a dataset, not a minimum or\n  headroom guarantee. Golden execution evidence waits for the WEBSERVE golden head; the thin\n  PR must first show actual START/END output on its own green CI run.\n\n### IR-47 — ci-notify treats a missing co-author trailer as a quiet info line; silent attribution loss reads as \"there was none\"\n- **Status:** open — patch AUTHORED and stashed unlanded since 2026-07-29\n  (`.worktrees/_patches/ci-notify-missing-trailer.patch` + its `test-ci-notify.sh` harness in the\n  sibling `.untracked` dir); surfaced by doyle's 2026-08-19 idle-queue verification of that stash ·\n  **Origin:** the AGENTS.md trailer mandate's own hazard family (the space-spelling trailer is\n  structurally invisible to git's tokenizer, so confident zeros already read as attribution loss\n  once); this row is the NOTIFY-side twin.\n- **What/why:** `.github/ci/ci-notify.sh` parses the head commit for the line-anchored\n  `Co-authored by: <agent>` trailer to add a second notification recipient. When the trailer is\n  absent or unparseable, the current script emits one stdout info line (\"doyle only\") and moves\n  on — correct as a non-fatal outcome, wrong as a SILENT one: a lane that lost its attribution\n  (typo'd trailer, squash that dropped the body, hyphenated spelling) notifies doyle alone on\n  every run and nothing anywhere says an agent stopped being told about their own lane's verdicts.\n  The stashed patch keeps absence non-fatal but promotes it to a `::warning` workflow annotation\n  (visible on the run summary), and splits the legitimate quiet case (co-author IS doyle) from the\n  loss case so the two stop sharing one message.\n- **Evidence:** patch verified 2026-08-19 to still NOT be on main — the warning string is absent\n  from `.github/ci/ci-notify.sh` at the current tree. Patch content re-read at verification; it\n  applies against the script's post-`SEND_BOUND_SECS` shape.\n- **Ripe when:** next `golden.yml`/ci-notify touch — natural co-rider with [[IR-46]]'s remedy\n  window (same file family, same \"weigh then, not drive-by\" rule). The stashed test harness rides\n  with it.\n- **Size:** ~10 lines in one shell script plus its test.\n- **Kin:** [[IR-40]] (an unlabelled state read as a clean verdict — here a quiet info line read as\n  \"no co-author existed\"), the AGENTS.md `%(trailers:)` tokenizer mandate (the sibling silent-zero\n  on the AUDIT side).\n\n### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\n- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\n  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\n  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\n  smudges fresh checkouts CRLF, and the author's never-re-smudged tree stays LF — builder green,\n  every fresh rig/golden checkout red.\n- **What/why:** `crates/xtask/src/main.rs` `the_checked_in_config_is_in_parity` include_str!s\n  `.config/nextest.toml` and feeds `phase_a_overrides_missing_from_ci_windows`. TODAY this is\n  causally CRLF-tolerant — the parser is `str::lines()`+trim (`override_filters`, main.rs:434-440),\n  and the 52/52 fresh-rig green at the hygiene gate (2026-08-19, this box) is therefore causal, not\n  luck. The hazard is the MISSING CONTROL: nothing pins the tolerance, so a future\n  newline-sensitive arm in the parity predicate reds only on fresh Windows checkouts — the\n  builder-green/rig-red inversion, deterministic but reading as flake.\n- **Remedy (hertz's, platform-independent):** feed the parity predicate an LF fixture AND the same\n  fixture converted to CRLF, assert identical missing-sets (including one unmirrored negative), so\n  a newline-sensitive arm reds on EVERY host rather than only fresh Windows checkouts.\n- **Ripe when:** next xtask parity-cell touch; explicitly OUTSIDE the family-B lane (hertz\n  scoping). **Size:** one fixture-pair cell.\n- **Kin:** the W3 gate finding this swept out of (skeleton cells, fixed at the fixture edge in\n  lane commit e99633f); [[IR-40]] (an untested tolerance read as a guarantee).\n\n### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\n- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\n  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\n  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\n  landed fact — the checker was wrong with the guard, which is exactly how the guard will be\n  wrong alone.\n- **What/why:** `git_lane_state`'s final arm answers Settled/InFlight purely by\n  `merge-base --is-ancestor <lane tip> <integration head>`\n  (`crates/spt-poolguard/src/lib.rs:424-436`, probe at `:474-479`). Under ADR-0050 golden CI\n  (thin member lanes cherry-picked onto a stage branch, ff-only main) a MEMBER lane's own branch\n  tip never becomes an ancestor of main. Measured at origin/main `9ea595c`:\n  `build/keystone-182-w2-sealed-multi` @`ba2d998` and `fix/197-absent-code-uncounted` @`5eb6a3b`\n  both read NOT-ancestor while `git cherry -v` reports every lane commit `-` (already upstream).\n  So `LaneState::Settled` is unreachable for any cherry-pick-assembled member lane whose branch\n  still exists, the takeover arm can never fire, and the pool refuses forever — including with a\n  dead holder. That contradicts the AGENTS.md mandate (\"a merged branch is taken over\") because\n  the guard's notion of merged is ancestry-only and the golden model structurally never produces\n  ancestry for member branches. The branch-vanished (`:391`) and re-pointed (`:399`) arms still\n  fire, and the STAGE lane works (its tip IS an ancestor) — the hole is landed-member-branch-\n  still-exists only. It did not bite at the 2026-08-19 reaps solely because deleting a pool\n  deletes its claim; it bites the first time someone wants to TAKE OVER a landed lane's pool\n  rather than reap it.\n- **Remedy (todlando's candidate, doyle-endorsed direction):** when ancestry answers false, fall\n  back to patch-id containment (`git cherry` / `rev-list --cherry-mark` against the claimed\n  base) before concluding InFlight. **Known residual to state in the fix's docs/tests:** a\n  conflict-adjusted pick changes the patch-id, so such a lane still reads InFlight; its release\n  path is branch deletion (the vanished arm), which is at least reachable. Tests want a\n  cherry-picked-landed fixture plus a conflict-adjusted negative.\n- **Ripe when:** next poolguard touch, or the first landed-lane pool takeover request.\n- **Size:** one fallback arm in `git_lane_state` + two fixtures.\n- **Kin:** [[IR-26]] (dead-holder takeover AUTHORIZED when it shouldn't be — this is the mirror:\n  takeover UNREACHABLE when it should fire), [[IR-42]] (claim writes, build enforces), the\n  AGENTS.md pool mandate this contradicts.\n\n### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\n- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\n  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\n  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\n  2026-08-21) — lane `fix/ir50-stderr-sink-census` @`1a2f6a2`+`2ac9543`\n  (hertz; base `0c86b2d`; rides the CONCIERGE #183 chain; these shas are the 2026-08-19\n  message-only reword of `cb4cd9d`+`7336e03` — trees proved identical by tree-id, so every\n  measurement below carries): exported\n  `spt_daemon::stderrlog::sink_path(home)` with `stderr_log_path` routed through it +\n  equality unit; `daemon_stderr_panel` in tests/common renders BOTH channels and labels a\n  read failure with channel + exact looked-at path + OS error (absent-sink regression pins\n  it — the IR-40 unlabelled-absence class was caught at gate and fixed in `2ac9543`);\n  censused every daemon-run captured-stderr panel outside `engine_room_bringup_e2e` (rides\n  #199 lane) and `er_briefing_*` (rides #164 lane); engineroom.rs:145 misnomer rider landed\n  in the same lane. Gate figure 781/781 at `2ac9543` (measured at the pre-reword tree,\n  which is byte-identical; first-report 765 was transcription,\n  corrected with raw line + JSON provenance). CLASS FOLD (doyle ruling, no fresh row):\n  `er_briefing_presented_e2e` hit this exact class during its own authoring (blank panels\n  on a real loud line) and was fixed locally in `72efb6a` reading both channels.\n  **REGISTER CLOSED 2026-08-19:** branch `docs/ir50-register-close` links the\n  golden-tested implementation at `4661bc9d` and completes helper adoption in the five measured\n  residual files: `er_brief_once_per_session_e2e.rs`, `er_briefing_presented_e2e.rs`,\n  `er_sequestered_cwd_e2e.rs`, `endpoint_autostart_e2e.rs`, and `n1_pairing.rs`.\n  `engine_room_bringup_e2e` remains the explicit exclusion, recorded as todlando's direct\n  sink-path read from the #199 lane. ·\n  **Originally filed:** 2026-08-19 (todlando RCA inside the #199 investigation; the immediate\n  four-panel fix in `engine_room_bringup_e2e.rs` is his and rides the #199 lane — THIS entry is\n  the class census, hertz-class) · **Origin:** the #199 evidence void — 40 rca-v2 runs held zero\n  daemon-side evidence for either erhost face; `ENGINE_ROOM_SPAWN_FAIL` (broker.rs:5658) was\n  written to a log the rig destroyed at teardown. Absence discipline honoured: the SUCCESS-path\n  line (`ENGINE_ROOM_BROUGHT_UP`) was also absent from all 40, proving the channel dead rather\n  than the event absent.\n- **What/why:** product `stderrlog::install` (broker at cli.rs:7633, brain at brainproc.rs:200)\n  repoints the process STD_ERROR_HANDLE within its first statements (`redirect_stderr_to`,\n  stderrlog.rs:101 — Windows `SetStdHandle` + `mem::forget`), so a rig's `.stderr(File)` capture\n  holds only the pre-redirect window; from that line on every diagnostic lands in\n  `SPT_HOME/logs/daemon.stderr.log` (stderrlog.rs:34/42) inside the rig's temp home, destroyed\n  unread at teardown. Panels are also mislabelled (\"brain stderr\" holding the broker's first\n  lines). REQ-DAEMON-STDERR-PERSIST fixed this blindness PRODUCT-side (\"the incident-night\n  RCA-blind gap\", cli.rs:7626-7631); no rig was ever taught to read the sink, so the fix does\n  not reach any harness. Class: every e2e rig that spawns `spt daemon run` and prints a\n  captured-stderr panel has the same void.\n- **Remedy:** census all such rigs; failure panels additionally dump\n…\n  and remainder are hertz-class.\n…\n\n\n[Showing lines 2240-2768 of 5781. Use :2769 to continue]"}],"details":{"truncation":{"content":"\r\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\r\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\r\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\r\n  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\r\n  blind repros exit 0); v0.4.0 cut (version bump @`c9a8eb5`, tag pushed, 3 platform assets,\r\n  release notes authored; refs sent to hertz). REMAINING and dispatched to hertz post-#182-landing:\r\n  spt-core consumes v0.4.0 — CI version bump + placement config (enforce-on, module_banner=accept);\r\n  banner cleanup rides a later lane. Entry closes when the consume lane lands. · **Origin:** hertz\r\n  measurement 2026-08-04 (filed by doyle; the measurement is\r\n  hertz's), found when his own pre/post `check` comparison around a tag-adjacency fix came back\r\n  EXIT=0 on BOTH sides — the green he had cited beside the fix validated nothing.\r\n- **What/why:** measured on `test/teardown-bound-shape`: a `[unit->REQ-RESIDENT-SERVICE]` tag\r\n  SEPARATED from its `#[test]` fn (a const landed between tag block and fn — an AGENTS.md rule-1\r\n  violation) scores EXIT=0 identically to the fixed adjacency. Positive control explains the\r\n  mechanism: that REQ carries 57 unit tags across five files, so 56 other sites decide the\r\n  coverage verdict and no single tag's placement can turn it red. Consequence: AGENTS.md rule 1\r\n  (\"tag on or immediately above the real evidence\") is agent discipline only — drifted tags decay\r\n  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\r\n  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\r\n  gate itself.\r\n- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT\r\n  established. Separating the only tag of a single-tagged REQ at the stage under test would settle\r\n  whether placement is unenforced outright (still exit 0 ⇒ the checker never reads adjacency) or\r\n  merely un-enforceable at scale (exit 1 ⇒ the checker sees absence, and only multi-tag redundancy\r\n  masks drift). Run that discriminator BEFORE designing any remedy — the two outcomes want\r\n  different fixes (a placement rule in the checker vs a per-tag-nearest-item heuristic).\r\n- **Transfer:** doyle accepted this lane's independent EXIT-0 remeasurement and confirmed it\r\n  matches todlando's settled 2026-08-04 discriminator. Upstream remedy: enforce adjacency for\r\n  each individual `doc`/`impl`/`unit`/`int` tag, with separated-tag negatives covering\r\n  single-tag, interposed-const, file-top-banner, and one-of-many displacement. This repo consumes\r\n  the released checker only.\r\n- **Close condition:** doyle reviews and merges the upstream lane, cuts the `traceable-reqs`\r\n  release, and spt-core consumes that release. Issue/branch/PR/commit refs append here when the\r\n  upstream lane lands.\r\n- **Size:** measurement complete; remedy scope is upstream-owned and dispatched.\r\n- **DISCRIMINATOR RUN 2026-08-04 (todlando, authorized specimen on `build/w1t2-shell-relink-force`;\r\n  filed by doyle — the measurement is todlando's): the answer is the EXIT-0 ARM.** Single-tagged\r\n  int stage (`REQ-SHELL-RELINK-FORCE`), tag SEPARATED from its fn (parked at file top):\r\n  `traceable-reqs check` EXIT 0 and the REQ still reports `+int`. Tag reverted to adjacency:\r\n  EXIT 0, `+int`. Both exits redirect-read, no pipes. **Placement is UNENFORCED OUTRIGHT — the\r\n  checker never reads adjacency; multi-tag redundancy was never the mechanism, it only widened the\r\n  blind spot.** Remedy option (a) is the live one: a real placement rule in the checker (upstream\r\n  experimplate), not a per-tag-nearest-item heuristic. Measurement caveat, carried at the\r\n  measurer's own insistence: an intermediate probe printed `TAG_ADJACENT_AFTER_REVERT=0` and that\r\n  was the PROBE wrong (`grep -B 1` above the fn lands on `#[test]`, not the tag above it), not a\r\n  failed revert — the revert was verified directly (exactly one tag, above `#[test]`). The\r\n  discriminator result is the record; the intermediate zero is not.\r\n- **REMEDY DISPATCHED 2026-08-18 (doyle):** upstream lane opened in BigscreenVR/traceable-reqs\r\n  (the actual upstream remote; the checkout at `~/Documents/projects/traceable-reqs` tracks it —\r\n  \"experimplate\" above named the tool's origin project, not the repo) — checker-side placement\r\n  rule, default-on in `check`, positive controls all four stages + separated-tag negatives\r\n  including the single-tag displaced discriminator shape and the interposed-const shape.\r\n  Requested by hertz as the IR-37 prerequisite of his test-hygiene family lane (KEYSTONE #182).\r\n  spt-core consumes the upstream RELEASE only — no local shadow checker. Issue/branch/PR refs\r\n  land here when the lane reports.\r\n\r\n### IR-38 — CLASS: an e2e that ends with a live daemon-spawning binary wedges the NEXT build in its pool, and the diagnostic names the wrong lane\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-04,\r\n  `shell_relink_force_e2e` on the #6 lane (filed by doyle; the finding and the fix are todlando's).\r\n- **What/why:** the e2e ends with a LIVE binary by design; on Windows a live process holds its\r\n  image open, so the NEXT cargo invocation in that target dir dies with\r\n  `failed to remove file target\\debug\\spt.exe: Access is denied (os error 5)` — surfacing as\r\n  exit 101 with NO test summary, because the failure names the BUILD and the FILE, never the test\r\n  that leaked the holder. Actual holders measured: two lane-local `spt daemon run --detached` +\r\n  `daemon brain` processes spawned under the test's temp SPT_HOME by a child CLI's\r\n  `ensure_running`, still alive from an earlier run. **Reap BY IMAGE PATH** — the fleet's other\r\n  eleven spt processes run from the installed binary; a name-based sweep takes your own daemon.\r\n  The live shell-spawn population is eleven e2e files. Nine already end through product teardown\r\n  or their authenticated home-scoped reap. The two intentionally live-at-success siblings now\r\n  kill and prove the final resident gone AFTER all identity/wake assertions:\r\n  `shell_relink_force_e2e` and `shell_stale_online_e2e`.\r\n- **Kin:** [[IR-7]] (phase-A daemon+brain pair leak), the exe-lock reap-by-path rule, and the\r\n  wrong-lane-diagnostic family ([[IR-21]]'s location-not-build class).\r\n- **SECOND HOLDER CLASS, measured 2026-08-04 (doyle, own gate rig):** an **ORPHANED CONHOST with an\r\n  inherited CWD** inside the test tree blocks `git worktree remove` with Permission-denied on a\r\n  DIRECTORY handle — invisible to any exe-path scan (conhost runs from System32; the parent that\r\n  spawned it was already dead). Found via `.github/ci/find-cwd-holders.ps1` (IR-11's instrument);\r\n  killed by pid after parent-dead classification; 34.78 GB reclaimed. Mechanism chain: the\r\n  windowless spawn path masks DETACHED_PROCESS off, the child owns a console, conhost inherits the\r\n  child's cwd and can OUTLIVE it. Boundary (hertz's, correct): this find and his field-4 companion\r\n  are the SAME MECHANISM FAMILY measured on DIFFERENT populations by different instruments — his\r\n  capture measured a ppid-match COUNT (floor 2, companion identity UNMEASURED, his stated limit),\r\n  and this conhost is the first FIELD identity evidence in the family, on THIS population. Do not\r\n  cite his row as identity data it never carried. (His box-wide accretion count 77→80 is a third\r\n  population again.) Teardown rule\r\n  addendum: a disposal leg must GATE on the removal's exit code (a rig that logs \"reclaimed 0.01\r\n  GB\" from a failed remove fabricates its own success) and sweep CWD HOLDERS, not only image\r\n  locks — two populations, either alone is a clean zero on the other.\r\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36 family) — sweep every e2e that ends\r\n  with a live spawning binary, apply the same reap-after-assertions shape.\r\n- **Size:** small per test; population unknown until swept.\r\n- **Built evidence:** focused runs of both live-at-success tests pass back-to-back in one target\r\n  pool, followed by a build invocation from that same pool; the second test's final kill is polled\r\n  to proven process death rather than treated as fire-and-forget.\r\n\r\n### IR-39 — CLASS: the missing-fixture-bin defect has TWO failure faces, and one of them impersonates a lifecycle defect of the subject under test\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz + todlando\r\n  2026-08-04, same evening from opposite sides (filed by doyle; hertz relayed todlando's\r\n  suggestion without endorsing scope).\r\n- **What/why:** a rig whose narrowed build (`-p <pkg> --test <one>` / `-p spt --bin spt`) skips a\r\n  cross-package fixture bin fails in one of two ways depending on the consuming site.\r\n  Face 1 (cheap): `translate_proof_fixture` panics \"must be built: <path>\" — names the artifact\r\n  and the recipe, costs one build. Face 2 (expensive): `sibling_bin(\"mock-session\")` resolves to a\r\n  nonexistent exe, nothing spawns, and the test reds at a PRECONDITION assert whose message\r\n  (\"warm bring-up spawned=false\", left None / right Some(\"offline\")) reads as a lifecycle defect\r\n  of the subject — measured cost 186s + a triage inside a lent box window (hertz's F1 red arm,\r\n  attempt 1). The build gap itself is the known cross-package row of the fixture-bin population;\r\n  what this entry carries is the DIAGNOSTIC asymmetry.\r\n- **Ask:** a fixture-bin existence precondition that NAMES the missing exe and its build recipe\r\n  wherever a rig consumes one — `sibling_bin` (and the shared\r\n  `crates/spt-term/tests/support/fixture_bin.rs` resolver already carries the recipe string as an\r\n  argument, the shape to copy) refuses with the artifact + recipe instead of letting the consuming\r\n  test fail downstream in its own vocabulary.\r\n- **Kin:** [[IR-21]] (wrong-lane-diagnostic family: the failure names the wrong actor), the\r\n  cargo-builds-package-bins-for-integration-tests rule (cross-package row is the only unguaranteed\r\n  build), golden.yml's dedicated fixture prebuild step.\r\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36/IR-38 family) — same sweep population;\r\n  or standalone small if that lane keeps slipping.\r\n- **Size:** small — one shared helper + a sweep of local `sibling_bin` resolver copies (24 known).\r\n- **Addendum (doyle, 2026-08-04 late): third and fourth sightings inside 24 h.** Face 1 twice\r\n  more the same evening — todlando's teach-lane leg set (his own translate_proof_fixture, caught\r\n  by his prebuild), and doyle's cold gate rig for the same lane (first-pass spt-bins red at\r\n  136/611, correctly withheld from the lane verdict as rig evidence, fixed by `cargo build -p spt\r\n  --bins` + rerun 611/611). Four sightings in one day across three agents and both faces: the\r\n  ripeness condition (\"the test-hygiene lane keeps slipping\") is under measurable pressure — the\r\n  prebuild remedy is being re-derived per-rig per-agent, which is the recurring cost the shared\r\n  precondition helper exists to delete.\r\n- **Built evidence:** all 29 file-local `sibling_bin` resolvers now route through one shared\r\n  precondition. A missing fixture names its path and the package-correct `cargo build -p <owner>\r\n  --bin <name>` recovery command before product assertions or timeout paths run; a focused\r\n  negative test pins that diagnostic.\r\n\r\n### IR-40 — CLASS: NO envelope-side ordering signal on a resume brief tracks content recency, and a CI informant's per-job line is a claim about that STEP, not the run\r\n- **Status:** open · **Origin:** three sightings in one night, 2026-08-04/05 — hertz, doyle,\r\n  todlando (filed by doyle; the artifacts are hertz's and todlando's, the CI arm is doyle's with\r\n  deployah's framing). Two arms of ONE family: a stale record that carries a confident ordering\r\n  signal, and a status claim that arrives before the thing it describes.\r\n\r\n- **ARM A — resume briefs. What/why:** a session can receive TWO start-of-session briefs, and the\r\n  one routed LATER can carry the STALER project-context. Measured on hertz's pair (same node id):\r\n  routed_at_ms `1785897407373` > `1785896642480`, spill-filename epoch `1785897764588` >\r\n  `1785896658159`, and vector sequence `1242529/1242531` > `1241542/1241544` — **all three\r\n  monotonic orderings rank the staler-content brief as newer.** todlando's pair is the NEGATIVE\r\n  arm: his later brief (`…1785897765196`, routed `…577476`, vector `1242756/7`) genuinely WAS the\r\n  fresher one, so the same heuristic happened to pick right.\r\n- **The finding is UNCORRELATED, not inverted** — and that is the whole entry. An inverted signal\r\n  is usable once you know to flip it; an uncorrelated one reads as reliable until the pair where it\r\n  costs you. Neither agent could have known which pair he held without checking content against\r\n  measurement. **Do not name routed_at_ms specifically** — naming the stamp invites the repair that\r\n  fails (\"the timestamp is unreliable, use the sequence number\"). The vector is the most dangerous\r\n  of the three: a stamp looks like a clock and invites suspicion, a sequence number looks like an\r\n  ordering and does not.\r\n- **Visible failure mode if a brief is obeyed as instructed** (hertz's, measured): re-open\r\n  `releases#123` — work already ruled closed — and under-report his own claimed-pool count by one,\r\n  the row sitting under a live gate. doyle's own sighting the same night: a brief describing main\r\n  @`92b2482` with a teach lane \"mid-flight\" hours after every lane had gated.\r\n- **PRE-REFUSED DISCRIMINATOR, recorded so it is not rediscovered as a finding:** file SIZE ranks\r\n  the fresher brief correctly on BOTH pairs (hertz 16308 > 12649; todlando 14138 > 10418) — 2 of 2,\r\n  the only signal surviving both samples. **Do not use it.** Size measures RICHNESS, not recency;\r\n  the two correlated only because todlando's thin brief was a correction fragment, and hertz's\r\n  STALER brief was a full 12649-byte dump. Two full dumps hours apart go flat or inverted. Handed\r\n  over pre-refused by its own finder.\r\n- **ARM B — CI informants (doyle, 2026-08-05, run 30971976024).** `CI-KITSUBITO` sent\r\n  \"CI SUCCESS … sha 0a25b77\" while the run was measurably `status=in_progress` with\r\n  `conclusion=\"\"` — the EMPTY STRING, not `success`. The informant fires from a per-job `notify`\r\n  step, and at send time `notify` itself had no conclusion. All eight substantive jobs were green,\r\n  so the line was **right in the end but EARLY**. deployah's framing, kept verbatim in kind: *an\r\n  informant line that is right in the end but early is worse than one that is simply wrong, because\r\n  a wrong signal gets distrusted while an early-but-correct one gets promoted to the conclusion.*\r\n  todlando's sentence is the one to keep at the point of use: **a per-job notify step's message is\r\n  a claim about that STEP, not about the RUN.**\r\n- **ARM B MECHANISM — hertz, source read 2026-08-05, zero box cost. It is NOT a race; it fires\r\n  early on EVERY run, and the entry above understated it.** `notify` is a job INSIDE the run\r\n  (`golden.yml:1138`), and a job cannot observe its own run's conclusion — so `conclusion: \"\"` is\r\n  not a timing artifact, it is **the only value that can exist when the informant speaks. The\r\n  informant has never once made a statement about a run conclusion.** What `ci-notify.sh` actually\r\n  asserts is narrower and worth naming exactly: a verdict computed PURELY from six `needs` results\r\n  (changes, traceability, test, n1-gate, twohost-a, twohost-b — the two matrices collapse to one\r\n  result each) being neither failure nor cancelled. Nothing more.\r\n  **The blind spot is exactly ONE job: `notify` itself, the 9th — it cannot appear in its own\r\n  `needs` list. And that one job has a WITNESSED red path**, documented in the script's own header\r\n  (2026-07-27, twice on kitsubito): verdict computed, then `spt send` HUNG ~5 minutes until the\r\n  job's own 5-minute budget cancelled it, and that cancellation reddened the run. So *\"informant\r\n  says SUCCESS, run concludes FAILURE\"* is a real observed sequence, not a hypothetical. The 30s\r\n  `SEND_BOUND_SECS` added since bounds the hang but does not close the class — it makes the\r\n  informant's own failure FAST rather than impossible.\r\n  ⇒ The informant's SUCCESS covers 8 of 9 jobs and is blind to the 9th, and the 9th is the only one\r\n  with an observed failure mode that reds the run. This is why the ff predicate is the run's\r\n  conclusion field and never the informant line.\r\n- **RECOVERY, and it is the same for both arms: never rank the claims — re-derive from the source\r\n  object.** For briefs, hertz's four falsifiers are the method (main sha, claimed-pool count, lane\r\n  tip, issue state) and they work because each is a content claim checkable in ONE command against\r\n  a source NEITHER brief controls. For CI, read the RUN's own `conclusion` field, and prefer\r\n  independent reads of the run object (`gh run watch --exit-status` polls the run, so its exit is a\r\n  second measurement rather than an echo of `notify`). On the batch this was caught in, three\r\n  sources agreed with the informant excluded from all three before main was fast-forwarded.\r\n- **Standing rule this entry exists to enforce:** a resume brief's RULINGS are durable; its STATE\r\n  is a HYPOTHESIS to re-derive before acting.\r\n- **Kin:** [[IR-21]] and [[IR-39]] (the diagnostic names the wrong actor / the wrong subject),\r\n  [[IR-32]] (a gate that cannot see its own blind spot), [[IR-34]] (an intermittent marker read as\r\n  a signal).\r\n- **Ripe when:** the next commune/psyche-tier touch for arm A (the routing layer is spt-core's own\r\n  `spool`/psyche ingest, so a remedy is in-repo, not upstream); for arm B, the next `golden.yml`\r\n  informant touch — the cheap fix is that the notify step names its own scope in the message body\r\n  (STEP vs RUN) rather than emitting a bare \"CI SUCCESS\".\r\n- **Size:** arm B small (message text + scope word in one workflow step). Arm A unsized —\r\n  establishing whether ANY durable content-recency signal can ride the envelope is the measurement,\r\n  and until it runs the answer is \"re-derive, do not rank.\"\r\n\r\n### IR-41 — A QUEUED main run is superseded without a record; `cancel-in-progress: false` protects only STARTED runs\r\n- **Status:** open — mechanism CONFIRMED (doyle ruling 2026-08-05); the runbook sentence it\r\n  falsified is already corrected (`docs/RELEASE-RUNBOOK.md` step 3, same commit as this entry)\r\n  · **Origin:** deployah, v0.55.0 publish night, filed by him explicitly as UNPROVEN with the\r\n  manual-cancel alternative not ruled out; confirmed by doyle on the run objects.\r\n- **What/why:** `ci.yml` sets `cancel-in-progress: false` on main and the runbook read that as\r\n  \"main's concurrency policy never cancels this run; that preserves the record.\" FALSE for the\r\n  queued phase: a concurrency group holds at most one running + one pending run, and a newer push\r\n  REPLACES the pending run regardless of the flag — the flag governs only whether a STARTED run\r\n  is cancelled. A superseded queued run leaves NO record: zero jobs, conclusion `cancelled`,\r\n  nothing measured about its sha.\r\n- **Evidence (all read off the run objects, not the informant):** run 30973909279 at `327f1f8`\r\n  (push, main) — created 04:01:08Z, **zero jobs ever started**, cancelled 04:03:49Z, ONE SECOND\r\n  after `e8805f7`'s run 30974041521 entered the group (created 04:03:48Z), while `0a25b77`'s run\r\n  30973770039 was still in flight (done 04:07:59Z). One-running-one-pending, newer push landed,\r\n  pending run died. The 1s coupling to an unrelated push is the discriminator against deployah's\r\n  own manual-cancel alternative — a human cancel co-timed to the second with a push it had no\r\n  view of is not a credible mechanism; supersession fires on exactly that trigger by design.\r\n- **The hole this leaves:** under a rapid push sequence, an intermediate sha on MAIN can have no\r\n  thin-CI verdict AT ALL, and the absence reads as nothing rather than as supersession. Anyone\r\n  auditing \"did sha X pass main CI\" gets a hole where the runbook promised a record. Absence of\r\n  a run is now a labelled state, not evidence about the sha.\r\n- **Ripe when:** next ci.yml/runbook touch. Candidate remedies to weigh THEN, not now: accept and\r\n  document (done — the runbook now carries the mechanism), or give main's group per-sha keys\r\n  (`group: ci-${{ github.sha }}`) so runs never share a group — at the cost of concurrent main\r\n  runs competing for the boxes, which is exactly what the group exists to prevent. The trade is\r\n  real; do not fold it into a drive-by.\r\n- **Size:** docs half DONE in this commit; ci.yml half small but load-bearing — needs its own\r\n  lane if taken.\r\n- **Kin:** [[IR-40]] (a record that is right-in-the-end-but-early vs a record that never comes to\r\n  exist — both read as clean states unless labelled), [[cancelled-measurement-leaves-labelled-hole]].\r\n\r\n### IR-42 — `pool-claim` writes a record; only the BUILD enforces — and AGENTS.md invited the misread\r\n- **Status:** BUILT 2026-08-19 — the AGENTS.md corrective line lands in the SAME COMMIT as this\r\n  entry (the register batch commit), which is the entry's stated exit condition. The optional\r\n  code-side nicety (claim verb prints the incumbent record it overwrites, information only)\r\n  remains unclaimed — a candidate rider on the IR-26 remedy lane, which already touches\r\n  `pool_claim`'s read-before-write path, NOT a reason to keep this entry open ·\r\n  **Origin:** doyle + todlando independently at source, 2026-08-19, during the #193 gate.\r\n- **Mechanism (source-verified):** `xtask pool-claim` (crates/xtask/src/main.rs:2232-2294 at the\r\n  read sha) parses its args, reads the lane's own git identity, builds a `PoolOwner` and calls\r\n  `spt_poolguard::write_owner` UNCONDITIONALLY (:2280) — no `read_owner`, no verdict, no\r\n  comparison against the incumbent claim anywhere in the function. Claiming is last-writer-wins\r\n  by construction: two lanes can each \"hold\" a pool in sequence with only the last write\r\n  surviving, and the displaced lane learns nothing at displacement time. All four enforcement\r\n  arms — `Refuse` (SPT_POOL_FOREIGN), `Takeover` (loud), `Unproven`, `HatchOpen` — live in\r\n  crates/spt-store/build.rs:31-113 and speak only at the next BUILD. (Same object [[IR-26]]'s\r\n  CLAIM-OBSERVABILITY measurement saw from the displaced side; this entry is the CLAIMING side\r\n  plus the doc that invited the misread.)\r\n- **Measured consequence:** 2026-08-19, doyle's gate claim over todlando's unlanded\r\n  redeem-echo-diag claim — no refusal, no notice (three sequential overwrites that session, one\r\n  over a lane with an unlanded commit). todlando then predicted from AGENTS.md's refusal\r\n  sentence that the gate's claim \"will be REFUSED\" — a false warning to a gater mid-run. The\r\n  refusal sentence sat directly under the \"Claim a pool at lane start\" instruction, inviting the\r\n  build-time semantics to be read onto the claim verb.\r\n- **Corrective landed:** one AGENTS.md sentence — the claim WRITES a record and never refuses;\r\n  predict refusals from builds, never from `pool-claim`.\r\n\r\n### IR-43 — knock answer carrier: `NoReply` landed at 60.08s against a stated 30s carrier deadline\r\n- **Status:** open, OBSERVATION — mechanism unmeasured, filed exactly as wide as the datum ·\r\n  **Origin:** KNOCK-169 RCA layer 1 (todlando, read-only), golden 32191618042 @`93c1130`,\r\n  twohost-b, 2026-08-18.\r\n- **What/why:** B's `request_answer` yielded `NoReply` at 22:50:08.3605Z — 60.08s after A's\r\n  death — while the carrier deadline is stated at 30s. Recorded in the RCA as a side observation\r\n  with no claim; the cell's red itself was a CASCADE of A's earlier death (answerop.rs:73-81\r\n  produces the courtesy BEFORE returning, so the reply was never sent — that half is settled and\r\n  is NOT this entry). What this entry carries: a transport/liveness bound that reported at 2x its\r\n  stated value. Candidate shapes, neither asserted: two sequential 30s legs each honoring its own\r\n  bound (a composed wait wearing one bound's name), or a bound armed after a wait it does not\r\n  cover (the [[IR-30]] nethost.rs permit-wait shape: `sem.acquire_owned()` outside the timeout).\r\n- **Ask:** derive where the 30s is armed and what path yields a 60s `NoReply` — one code read\r\n  from the emit site, before any instrument.\r\n- **Ripe when:** next knock-carrier touch, or the next `NoReply`-shaped red — whichever first.\r\n- **Size:** small (code read; a token only if the read forks).\r\n\r\n### IR-44 — perch-sentinel comment overclaims: serialization is not preservation, and the comment teaches the false step\r\n- **Status:** open · **Origin:** #188 RCA lock read (todlando flagged, doyle confirmed the lock\r\n  read), 2026-08-18; the collapse-of-branches argument is on #188 and in the RCA record.\r\n- **What/why:** `lock_perch_sentinel` (info.rs:778 at `b20e770`, the diag sha — re-derive the\r\n  line on main before editing) takes a cross-process fs2 lock on a stable per-perch `.info.lock`\r\n  sentinel, and its comment claims it serializes \"ALL info.json writers so a whole-record write\r\n  and a locked RMW can never lose each other's update (`REQ-HAZARD-INFO-RMW-LOST-UPDATE`)\" —\r\n  TRUE for interleaving, FALSE for preservation. `write_info_unlocked` is module-private with\r\n  exactly three callers, all taking the sentinel first (bypass refuted by visibility), but every\r\n  caller of the public `write_info` composes its record BEFORE the lock is taken (:842) — **the\r\n  lock makes that write atomic; it cannot make it preserving.** Only `mutate_info` /\r\n  `establish_locked` read under the hold and can preserve. Measured field case: census write #1\r\n  (`twohost.rs:736`) clobbered `controlled` while correctly locked. A reader trusting the\r\n  comment infers lost-update immunity the funnel does not provide — the #188 hunt burned a\r\n  branch on exactly that inference before the collapse argument killed it.\r\n- **Ask:** respell the comment — serializes writers; a composed `write_info` is atomic, never\r\n  preserving; preservation requires `mutate_info`/`establish_locked` — and weigh whether\r\n  `REQ-HAZARD-INFO-RMW-LOST-UPDATE`'s doc wording carries the same overclaim.\r\n- **Ripe when:** next spt-store/info.rs touch. **Size:** tiny (comment + possibly one REQ doc\r\n  line).\r\n\r\n### IR-45 — twohost rig home premise, SETTLED: pump paths resolve under the per-run TEMP root (rig is disk-hermetic; the \"live fleet roster\" reading is retired)\r\n- **Status:** RETIRED 2026-08-19 — ask answered by the one code read at main @`78a9a16`; residue\r\n  re-homed (see Answer). · **Origin:** #188/#189 RCA readouts (todlando, doyle's 2a-2d), runs\r\n  32097943571 + 32108557362 + 32111921251, 2026-08-18.\r\n- **What/why, two measured halves in tension:** (1) B's pump dialed a THIRD node 155-159 times\r\n  per run at kitsubito's OWN tailscale IP (`100.98.197.12`), different hex + different ephemeral\r\n  port each run — a short-lived local endpoint re-minting identity between runs, present in both\r\n  the golden and the diag run. Read at the time as: the rig uses the CANONICAL home\r\n  (`canonical_pump_paths` → `perch::spt_home()`), so B's roster is kitsubito's live fleet\r\n  roster — environmental coupling of a CI rig to host fleet state. (2) The ER perch measured in\r\n  the chain runs resolves under a per-run TEMP root\r\n  (`…/_temp/spt-test-tmp-<run>…/owlery/engine-room`), NOT the canonical home. Both measurements\r\n  stand; they answer different artifacts (pump roster vs perches), and nothing on record settles\r\n  which home the PUMP paths actually resolve. #189's third-node evidence and its\r\n  cache-leg-never-heals reading rest on that premise (the tension is filed on the #188 record as\r\n  an open question against #189).\r\n- **Answer (2026-08-19, code read at `78a9a16`, unambiguous — no run token needed):** both role\r\n  tests set `SPT_HOME` to a fresh per-run `TempDir` as their FIRST act (`twohost.rs:813-814` role\r\n  B, `:1501-1502` role A), before any store touch. `canonical_pump_paths` resolves every path via\r\n  `perch::spt_home()` (`twohost.rs:396-414`), which honors the `SPT_HOME` override first\r\n  (`perch.rs:34-41`); the pump's roster source `presence::registry_snapshot_dir()` →\r\n  `perch::identity_dir()` sits under the same root (`presence.rs:83-85`). The rig is\r\n  DISK-HERMETIC per run; both prior measurements reconcile (ER perch observed under the temp\r\n  root, pump paths resolve there too). The misleader was the helper's name + doc comment (\"real\r\n  homes, not test roots\"), which describe production path LAYOUT, not the resolved ROOT.\r\n- **Residue disposition:** (1) #189's third-node evidence was corrected on the board (comment\r\n  5337519936) — the roster row arrived at RUNTIME into a temp-rooted store, ingress mechanism\r\n  OPEN on #189, no longer explained-environmental. (2) KEYSTONE #182's hygiene lane repaired the\r\n  `twohost.rs:394` comment to say exactly what the helper does: production path layout rooted in\r\n  the process's fresh per-run `SPT_HOME`.\r\n\r\n### IR-46 — the Windows disk-floor preflight asserts an INSTANT; workspace free space moves tens of GB inside the hour, so a green floor is not a claim about run headroom\r\n- **Status:** open — mechanism CONFIRMED by a measurement series on hfenduleam; doyle ruled it\r\n  register-shaped 2026-08-18 · **Origin:** deployah, NAMEPLATE #181 golden-head intake, on the\r\n  run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\r\n  as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\r\n  (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\r\n  and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\r\n  version of it.\r\n- **What/why:** `golden.yml`'s Windows preflight computes `$freeBytes` once at job start and\r\n  hard-fails under a `32GB` floor. As a fast-fail that is correct and it did its job — it refused\r\n  before compiling rather than dying deep in a link step. The defect is what a PASS is then read\r\n  to mean. The reading is a point sample of a quantity that moves by tens of GB unattended, so a\r\n  green preflight licenses a run whose headroom was never measured. Nothing downstream re-checks.\r\n- **Evidence — five readings of `C:` free on one box inside roughly one hour, 2026-08-18:**\r\n  - `03:01:54Z` — `free_bytes=2666205184` (2.48 GiB) against `floor_bytes=34359738368`, the\r\n    preflight's OWN reading; run `32093894524`, both `n1-gate` and `test` on Windows/hfenduleam\r\n    failed at this same step, before any compilation.\r\n  - `~03:2xZ` — ~2.50 GB, independent `Get-PSDrive` read, corroborating the preflight.\r\n  - pre-reap — **33.70 GB**, immediately before deployah deleted anything.\r\n  - post-reap-1 — 76.42 GB (42.72 GB reclaimed: `claude_skill_owl/target`, `golden-w1/target`).\r\n  - pre-reap-2 — **73.81 GB**, i.e. 2.61 GB consumed unattended between the two reaps; then\r\n    post-reap-2 129.70 GB (55.89 GB reclaimed: `.worktrees/nameplate-w1/target`).\r\n- **LABELLED HOLE — do not let this harden:** roughly **31 GB was released between the preflight\r\n  failure and the pre-reap reading by something OTHER than the reclaim**. Released-by-unknown.\r\n  The runner cleaning its workspace after the job died is *plausible* and is NOT the recorded\r\n  cause — it was never measured, and no one looked while it was happening. Recorded as a hole on\r\n  purpose (doyle's explicit ask at filing): a plausible cause written down as the cause would make\r\n  this row read as explained when the actual mechanism of the 31 GB is unknown.\r\n- **The hazard this leaves:** a run can clear the floor at preflight and starve mid-build, and\r\n  mid-build disk starvation does not present as disk — it surfaces as a link failure, a truncated\r\n  artifact, or a rustc ICE, i.e. as a defect in the tree under test. The failure mode inverts the\r\n  gate's purpose: the preflight's whole point is to keep box conditions from being read as lane\r\n  reds, and a passing preflight actively argues the opposite. Note the polarity — this row is\r\n  about the PASS, not the FAIL. The observed red was honest.\r\n- **#242/v0.66.0 GOLDEN ADDITIONS (deployah measured 2026-08-29, banked at the 08-30 close\r\n  sweep):** (i) per-job floor figures are SEPARATE INSTANTS — quote per job, never one figure for\r\n  both (attempt 1: `test` 26521477120 vs `n1-gate` 26535051264 free bytes, 8s apart, one run);\r\n  (ii) **CORRECTED TRAP** (retracting deployah's earlier \"attempt-2 hides jobs\" version): the\r\n  default `/runs/<id>/jobs` endpoint stamps `run_attempt=<current>` on EVERY job including ones\r\n  that never re-ran (4 of 8 mis-assigned on this run) — it is the RUN's attempt, not the JOB's,\r\n  so a stale green can read as re-earned; `started_at` is the discriminator and\r\n  `/runs/<id>/attempts/N/jobs` the authority. Also `rerun --failed` re-runs DEPENDENT jobs\r\n  (twohost re-ran despite a green attempt 1); (iii) a rerun preflight reads RAW free BYTES with\r\n  the CI step's own predicate, not display GB; (iv) a rerun green counts as floor-RCA-closing\r\n  evidence only after a step-level NON-VACUOUS check (checkout SUCCESS + workload steps ran) —\r\n  the v0.64.0 checkout-SKIPPED shape means a green job can carry zero code signal.\r\n- **Ripe when:** next `golden.yml` touch. Remedies to weigh THEN, not as a drive-by: re-assert the\r\n  floor at job END (turns a starvation into a labelled disk verdict instead of a fake lane red);\r\n  or raise the floor to cover a full build's peak rather than its entry condition; or sample free\r\n  space across the run and emit the minimum as a token. All three cost run time; none is obvious.\r\n- **Size:** small in `golden.yml`, load-bearing in what a green run is taken to prove.\r\n- **Kin:** [[IR-41]] and [[IR-40]] (a state that reads as a clean verdict unless it is labelled —\r\n  here a PASS that is read as headroom it never measured), [[measure-the-box-before-the-instrument]],\r\n  [[cancelled-measurement-leaves-labelled-hole]].\r\n\r\n- **2026-09-06 addendum (doyle, v0.67.1 close sweep): trigger FIRED at `04e32c8c` — `golden.yml` touched (2-line HEAVY reclass of `brain_resume_conn_deadlock` on the respin) with no remedy weighed. Not a drive-by by choice: the touch rode a respin under a pre-registered hard stop, which is no remedy window. COMPOSED with IR-59 (log-the-floor) + IR-73 (literal-first sites) as one hertz workflow rider on WEBSERVE #272; the remedy weighing happens on THAT lane, before the WEBSERVE golden head.**\r\n\r\n<!-- [doc->REQ-CI-FREE-SPACE-PREFLIGHT] -->\r\n- **2026-09-06 remedy ruling (doyle, WEBSERVE rider):** retain 32 GiB; record raw-byte\r\n  `FLOOR_START` and `FLOOR_END` PASS/RED tokens per job/runner, each labelled `sample=INSTANT`.\r\n  End DISK assertions run `if: always()` before teardown, including after failed workloads.\r\n  A fresh `FLOOR_DOCS` assertion immediately before docs-drift composes with IR-73's second half.\r\n  Raising the floor is refused without a measured peak; continuous sampling adds lifecycle\r\n  machinery while remaining blind between samples. Start/end are a dataset, not a minimum or\r\n  headroom guarantee. Golden execution evidence waits for the WEBSERVE golden head; the thin\r\n  PR must first show actual START/END output on its own green CI run.\r\n\r\n### IR-47 — ci-notify treats a missing co-author trailer as a quiet info line; silent attribution loss reads as \"there was none\"\r\n- **Status:** open — patch AUTHORED and stashed unlanded since 2026-07-29\r\n  (`.worktrees/_patches/ci-notify-missing-trailer.patch` + its `test-ci-notify.sh` harness in the\r\n  sibling `.untracked` dir); surfaced by doyle's 2026-08-19 idle-queue verification of that stash ·\r\n  **Origin:** the AGENTS.md trailer mandate's own hazard family (the space-spelling trailer is\r\n  structurally invisible to git's tokenizer, so confident zeros already read as attribution loss\r\n  once); this row is the NOTIFY-side twin.\r\n- **What/why:** `.github/ci/ci-notify.sh` parses the head commit for the line-anchored\r\n  `Co-authored by: <agent>` trailer to add a second notification recipient. When the trailer is\r\n  absent or unparseable, the current script emits one stdout info line (\"doyle only\") and moves\r\n  on — correct as a non-fatal outcome, wrong as a SILENT one: a lane that lost its attribution\r\n  (typo'd trailer, squash that dropped the body, hyphenated spelling) notifies doyle alone on\r\n  every run and nothing anywhere says an agent stopped being told about their own lane's verdicts.\r\n  The stashed patch keeps absence non-fatal but promotes it to a `::warning` workflow annotation\r\n  (visible on the run summary), and splits the legitimate quiet case (co-author IS doyle) from the\r\n  loss case so the two stop sharing one message.\r\n- **Evidence:** patch verified 2026-08-19 to still NOT be on main — the warning string is absent\r\n  from `.github/ci/ci-notify.sh` at the current tree. Patch content re-read at verification; it\r\n  applies against the script's post-`SEND_BOUND_SECS` shape.\r\n- **Ripe when:** next `golden.yml`/ci-notify touch — natural co-rider with [[IR-46]]'s remedy\r\n  window (same file family, same \"weigh then, not drive-by\" rule). The stashed test harness rides\r\n  with it.\r\n- **Size:** ~10 lines in one shell script plus its test.\r\n- **Kin:** [[IR-40]] (an unlabelled state read as a clean verdict — here a quiet info line read as\r\n  \"no co-author existed\"), the AGENTS.md `%(trailers:)` tokenizer mandate (the sibling silent-zero\r\n  on the AUDIT side).\r\n\r\n### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\r\n- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\r\n  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\r\n  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\r\n  smudges fresh checkouts CRLF, and the author's never-re-smudged tree stays LF — builder green,\r\n  every fresh rig/golden checkout red.\r\n- **What/why:** `crates/xtask/src/main.rs` `the_checked_in_config_is_in_parity` include_str!s\r\n  `.config/nextest.toml` and feeds `phase_a_overrides_missing_from_ci_windows`. TODAY this is\r\n  causally CRLF-tolerant — the parser is `str::lines()`+trim (`override_filters`, main.rs:434-440),\r\n  and the 52/52 fresh-rig green at the hygiene gate (2026-08-19, this box) is therefore causal, not\r\n  luck. The hazard is the MISSING CONTROL: nothing pins the tolerance, so a future\r\n  newline-sensitive arm in the parity predicate reds only on fresh Windows checkouts — the\r\n  builder-green/rig-red inversion, deterministic but reading as flake.\r\n- **Remedy (hertz's, platform-independent):** feed the parity predicate an LF fixture AND the same\r\n  fixture converted to CRLF, assert identical missing-sets (including one unmirrored negative), so\r\n  a newline-sensitive arm reds on EVERY host rather than only fresh Windows checkouts.\r\n- **Ripe when:** next xtask parity-cell touch; explicitly OUTSIDE the family-B lane (hertz\r\n  scoping). **Size:** one fixture-pair cell.\r\n- **Kin:** the W3 gate finding this swept out of (skeleton cells, fixed at the fixture edge in\r\n  lane commit e99633f); [[IR-40]] (an untested tolerance read as a guarantee).\r\n\r\n### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\r\n- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\r\n  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\r\n  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\r\n  landed fact — the checker was wrong with the guard, which is exactly how the guard will be\r\n  wrong alone.\r\n- **What/why:** `git_lane_state`'s final arm answers Settled/InFlight purely by\r\n  `merge-base --is-ancestor <lane tip> <integration head>`\r\n  (`crates/spt-poolguard/src/lib.rs:424-436`, probe at `:474-479`). Under ADR-0050 golden CI\r\n  (thin member lanes cherry-picked onto a stage branch, ff-only main) a MEMBER lane's own branch\r\n  tip never becomes an ancestor of main. Measured at origin/main `9ea595c`:\r\n  `build/keystone-182-w2-sealed-multi` @`ba2d998` and `fix/197-absent-code-uncounted` @`5eb6a3b`\r\n  both read NOT-ancestor while `git cherry -v` reports every lane commit `-` (already upstream).\r\n  So `LaneState::Settled` is unreachable for any cherry-pick-assembled member lane whose branch\r\n  still exists, the takeover arm can never fire, and the pool refuses forever — including with a\r\n  dead holder. That contradicts the AGENTS.md mandate (\"a merged branch is taken over\") because\r\n  the guard's notion of merged is ancestry-only and the golden model structurally never produces\r\n  ancestry for member branches. The branch-vanished (`:391`) and re-pointed (`:399`) arms still\r\n  fire, and the STAGE lane works (its tip IS an ancestor) — the hole is landed-member-branch-\r\n  still-exists only. It did not bite at the 2026-08-19 reaps solely because deleting a pool\r\n  deletes its claim; it bites the first time someone wants to TAKE OVER a landed lane's pool\r\n  rather than reap it.\r\n- **Remedy (todlando's candidate, doyle-endorsed direction):** when ancestry answers false, fall\r\n  back to patch-id containment (`git cherry` / `rev-list --cherry-mark` against the claimed\r\n  base) before concluding InFlight. **Known residual to state in the fix's docs/tests:** a\r\n  conflict-adjusted pick changes the patch-id, so such a lane still reads InFlight; its release\r\n  path is branch deletion (the vanished arm), which is at least reachable. Tests want a\r\n  cherry-picked-landed fixture plus a conflict-adjusted negative.\r\n- **Ripe when:** next poolguard touch, or the first landed-lane pool takeover request.\r\n- **Size:** one fallback arm in `git_lane_state` + two fixtures.\r\n- **Kin:** [[IR-26]] (dead-holder takeover AUTHORIZED when it shouldn't be — this is the mirror:\r\n  takeover UNREACHABLE when it should fire), [[IR-42]] (claim writes, build enforces), the\r\n  AGENTS.md pool mandate this contradicts.\r\n\r\n### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\r\n- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\r\n  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\r\n  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\r\n  2026-08-21) — lane `fix/ir50-stderr-sink-census` @`1a2f6a2`+`2ac9543`\r\n  (hertz; base `0c86b2d`; rides the CONCIERGE #183 chain; these shas are the 2026-08-19\r\n  message-only reword of `cb4cd9d`+`7336e03` — trees proved identical by tree-id, so every\r\n  measurement below carries): exported\r\n  `spt_daemon::stderrlog::sink_path(home)` with `stderr_log_path` routed through it +\r\n  equality unit; `daemon_stderr_panel` in tests/common renders BOTH channels and labels a\r\n  read failure with channel + exact looked-at path + OS error (absent-sink regression pins\r\n  it — the IR-40 unlabelled-absence class was caught at gate and fixed in `2ac9543`);\r\n  censused every daemon-run captured-stderr panel outside `engine_room_bringup_e2e` (rides\r\n  #199 lane) and `er_briefing_*` (rides #164 lane); engineroom.rs:145 misnomer rider landed\r\n  in the same lane. Gate figure 781/781 at `2ac9543` (measured at the pre-reword tree,\r\n  which is byte-identical; first-report 765 was transcription,\r\n  corrected with raw line + JSON provenance). CLASS FOLD (doyle ruling, no fresh row):\r\n  `er_briefing_presented_e2e` hit this exact class during its own authoring (blank panels\r\n  on a real loud line) and was fixed locally in `72efb6a` reading both channels.\r\n  **REGISTER CLOSED 2026-08-19:** branch `docs/ir50-register-close` links the\r\n  golden-tested implementation at `4661bc9d` and completes helper adoption in the five measured\r\n  residual files: `er_brief_once_per_session_e2e.rs`, `er_briefing_presented_e2e.rs`,\r\n  `er_sequestered_cwd_e2e.rs`, `endpoint_autostart_e2e.rs`, and `n1_pairing.rs`.\r\n  `engine_room_bringup_e2e` remains the explicit exclusion, recorded as todlando's direct\r\n  sink-path read from the #199 lane. ·\r\n  **Originally filed:** 2026-08-19 (todlando RCA inside the #199 investigation; the immediate\r\n  four-panel fix in `engine_room_bringup_e2e.rs` is his and rides the #199 lane — THIS entry is\r\n  the class census, hertz-class) · **Origin:** the #199 evidence void — 40 rca-v2 runs held zero\r\n  daemon-side evidence for either erhost face; `ENGINE_ROOM_SPAWN_FAIL` (broker.rs:5658) was\r\n  written to a log the rig destroyed at teardown. Absence discipline honoured: the SUCCESS-path\r\n  line (`ENGINE_ROOM_BROUGHT_UP`) was also absent from all 40, proving the channel dead rather\r\n  than the event absent.\r\n- **What/why:** product `stderrlog::install` (broker at cli.rs:7633, brain at brainproc.rs:200)\r\n  repoints the process STD_ERROR_HANDLE within its first statements (`redirect_stderr_to`,\r\n  stderrlog.rs:101 — Windows `SetStdHandle` + `mem::forget`), so a rig's `.stderr(File)` capture\r\n  holds only the pre-redirect window; from that line on every diagnostic lands in\r\n  `SPT_HOME/logs/daemon.stderr.log` (stderrlog.rs:34/42) inside the rig's temp home, destroyed\r\n  unread at teardown. Panels are also mislabelled (\"brain stderr\" holding the broker's first\r\n  lines). REQ-DAEMON-STDERR-PERSIST fixed this blindness PRODUCT-side (\"the incident-night\r\n  RCA-blind gap\", cli.rs:7626-7631); no rig was ever taught to read the sink, so the fix does\r\n  not reach any harness. Class: every e2e rig that spawns `spt daemon run` and prints a\r\n  captured-stderr panel has the same void.\r\n- **Remedy:** census all such rigs; failure panels additionally dump\r","truncated":true,"truncatedBy":"lines","totalLines":3542,"totalBytes":46415,"outputLines":529,"outputBytes":46415,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n…\n- **Declared validation extra:** the lane's docs-link gate exposed that `llms_target_exists` treated\n…\n\r\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\r\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\r\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\r\n  cells + sighted control; defect B enclosing-item fallback DECLARED in SPEC with cost; 267/267,\r\n  blind repros exit 0); v0.4.0 cut (version bump @`c9a8eb5`, tag pushed, 3 platform assets,\r\n  release notes authored; refs sent to hertz). REMAINING and dispatched to hertz post-#182-landing:\r\n  spt-core consumes v0.4.0 — CI version bump + placement config (enforce-on, module_banner=accept);\r\n  banner cleanup rides a later lane. Entry closes when the consume lane lands. · **Origin:** hertz\r\n  measurement 2026-08-04 (filed by doyle; the measurement is\r\n  hertz's), found when his own pre/post `check` comparison around a tag-adjacency fix came back\r\n  EXIT=0 on BOTH sides — the green he had cited beside the fix validated nothing.\r\n- **What/why:** measured on `test/teardown-bound-shape`: a `[unit->REQ-RESIDENT-SERVICE]` tag\r\n  SEPARATED from its `#[test]` fn (a const landed between tag block and fn — an AGENTS.md rule-1\r\n  violation) scores EXIT=0 identically to the fixed adjacency. Positive control explains the\r\n  mechanism: that REQ carries 57 unit tags across five files, so 56 other sites decide the\r\n  coverage verdict and no single tag's placement can turn it red. Consequence: AGENTS.md rule 1\r\n  (\"tag on or immediately above the real evidence\") is agent discipline only — drifted tags decay\r\n  silently while coverage stays green, and heavily-tagged REQs decay fastest. This is the\r\n  [[IR-32]] family shape (a gate that cannot see its own blind spot) applied to the traceability\r\n  gate itself.\r\n- **LIMIT, with falsifier (hertz's, verbatim in kind):** behaviour on a SINGLE-tagged REQ was NOT\r\n  established. Separating the only tag of a single-tagged REQ at the stage under test would settle\r\n  whether placement is unenforced outright (still exit 0 ⇒ the checker never reads adjacency) or\r\n  merely un-enforceable at scale (exit 1 ⇒ the checker sees absence, and only multi-tag redundancy\r\n  masks drift). Run that discriminator BEFORE designing any remedy — the two outcomes want\r\n  different fixes (a placement rule in the checker vs a per-tag-nearest-item heuristic).\r\n- **Transfer:** doyle accepted this lane's independent EXIT-0 remeasurement and confirmed it\r\n  matches todlando's settled 2026-08-04 discriminator. Upstream remedy: enforce adjacency for\r\n  each individual `doc`/`impl`/`unit`/`int` tag, with separated-tag negatives covering\r\n  single-tag, interposed-const, file-top-banner, and one-of-many displacement. This repo consumes\r\n  the released checker only.\r\n- **Close condition:** doyle reviews and merges the upstream lane, cuts the `traceable-reqs`\r\n  release, and spt-core consumes that release. Issue/branch/PR/commit refs append here when the\r\n  upstream lane lands.\r\n- **Size:** measurement complete; remedy scope is upstream-owned and dispatched.\r\n- **DISCRIMINATOR RUN 2026-08-04 (todlando, authorized specimen on `build/w1t2-shell-relink-force`;\r\n  filed by doyle — the measurement is todlando's): the answer is the EXIT-0 ARM.** Single-tagged\r\n  int stage (`REQ-SHELL-RELINK-FORCE`), tag SEPARATED from its fn (parked at file top):\r\n  `traceable-reqs check` EXIT 0 and the REQ still reports `+int`. Tag reverted to adjacency:\r\n  EXIT 0, `+int`. Both exits redirect-read, no pipes. **Placement is UNENFORCED OUTRIGHT — the\r\n  checker never reads adjacency; multi-tag redundancy was never the mechanism, it only widened the\r\n  blind spot.** Remedy option (a) is the live one: a real placement rule in the checker (upstream\r\n  experimplate), not a per-tag-nearest-item heuristic. Measurement caveat, carried at the\r\n  measurer's own insistence: an intermediate probe printed `TAG_ADJACENT_AFTER_REVERT=0` and that\r\n  was the PROBE wrong (`grep -B 1` above the fn lands on `#[test]`, not the tag above it), not a\r\n  failed revert — the revert was verified directly (exactly one tag, above `#[test]`). The\r\n  discriminator result is the record; the intermediate zero is not.\r\n- **REMEDY DISPATCHED 2026-08-18 (doyle):** upstream lane opened in BigscreenVR/traceable-reqs\r\n  (the actual upstream remote; the checkout at `~/Documents/projects/traceable-reqs` tracks it —\r\n  \"experimplate\" above named the tool's origin project, not the repo) — checker-side placement\r\n  rule, default-on in `check`, positive controls all four stages + separated-tag negatives\r\n  including the single-tag displaced discriminator shape and the interposed-const shape.\r\n  Requested by hertz as the IR-37 prerequisite of his test-hygiene family lane (KEYSTONE #182).\r\n  spt-core consumes the upstream RELEASE only — no local shadow checker. Issue/branch/PR refs\r\n  land here when the lane reports.\r\n\r\n### IR-38 — CLASS: an e2e that ends with a live daemon-spawning binary wedges the NEXT build in its pool, and the diagnostic names the wrong lane\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-04,\r\n  `shell_relink_force_e2e` on the #6 lane (filed by doyle; the finding and the fix are todlando's).\r\n- **What/why:** the e2e ends with a LIVE binary by design; on Windows a live process holds its\r\n  image open, so the NEXT cargo invocation in that target dir dies with\r\n  `failed to remove file target\\debug\\spt.exe: Access is denied (os error 5)` — surfacing as\r\n  exit 101 with NO test summary, because the failure names the BUILD and the FILE, never the test\r\n  that leaked the holder. Actual holders measured: two lane-local `spt daemon run --detached` +\r\n  `daemon brain` processes spawned under the test's temp SPT_HOME by a child CLI's\r\n  `ensure_running`, still alive from an earlier run. **Reap BY IMAGE PATH** — the fleet's other\r\n  eleven spt processes run from the installed binary; a name-based sweep takes your own daemon.\r\n  The live shell-spawn population is eleven e2e files. Nine already end through product teardown\r\n  or their authenticated home-scoped reap. The two intentionally live-at-success siblings now\r\n  kill and prove the final resident gone AFTER all identity/wake assertions:\r\n  `shell_relink_force_e2e` and `shell_stale_online_e2e`.\r\n- **Kin:** [[IR-7]] (phase-A daemon+brain pair leak), the exe-lock reap-by-path rule, and the\r\n  wrong-lane-diagnostic family ([[IR-21]]'s location-not-build class).\r\n- **SECOND HOLDER CLASS, measured 2026-08-04 (doyle, own gate rig):** an **ORPHANED CONHOST with an\r\n  inherited CWD** inside the test tree blocks `git worktree remove` with Permission-denied on a\r\n  DIRECTORY handle — invisible to any exe-path scan (conhost runs from System32; the parent that\r\n  spawned it was already dead). Found via `.github/ci/find-cwd-holders.ps1` (IR-11's instrument);\r\n  killed by pid after parent-dead classification; 34.78 GB reclaimed. Mechanism chain: the\r\n  windowless spawn path masks DETACHED_PROCESS off, the child owns a console, conhost inherits the\r\n  child's cwd and can OUTLIVE it. Boundary (hertz's, correct): this find and his field-4 companion\r\n  are the SAME MECHANISM FAMILY measured on DIFFERENT populations by different instruments — his\r\n  capture measured a ppid-match COUNT (floor 2, companion identity UNMEASURED, his stated limit),\r\n  and this conhost is the first FIELD identity evidence in the family, on THIS population. Do not\r\n  cite his row as identity data it never carried. (His box-wide accretion count 77→80 is a third\r\n  population again.) Teardown rule\r\n  addendum: a disposal leg must GATE on the removal's exit code (a rig that logs \"reclaimed 0.01\r\n  GB\" from a failed remove fabricates its own success) and sweep CWD HOLDERS, not only image\r\n  locks — two populations, either alone is a clean zero on the other.\r\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36 family) — sweep every e2e that ends\r\n  with a live spawning binary, apply the same reap-after-assertions shape.\r\n- **Size:** small per test; population unknown until swept.\r\n- **Built evidence:** focused runs of both live-at-success tests pass back-to-back in one target\r\n  pool, followed by a build invocation from that same pool; the second test's final kill is polled\r\n  to proven process death rather than treated as fire-and-forget.\r\n\r\n### IR-39 — CLASS: the missing-fixture-bin defect has TWO failure faces, and one of them impersonates a lifecycle defect of the subject under test\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz + todlando\r\n  2026-08-04, same evening from opposite sides (filed by doyle; hertz relayed todlando's\r\n  suggestion without endorsing scope).\r\n- **What/why:** a rig whose narrowed build (`-p <pkg> --test <one>` / `-p spt --bin spt`) skips a\r\n  cross-package fixture bin fails in one of two ways depending on the consuming site.\r\n  Face 1 (cheap): `translate_proof_fixture` panics \"must be built: <path>\" — names the artifact\r\n  and the recipe, costs one build. Face 2 (expensive): `sibling_bin(\"mock-session\")` resolves to a\r\n  nonexistent exe, nothing spawns, and the test reds at a PRECONDITION assert whose message\r\n  (\"warm bring-up spawned=false\", left None / right Some(\"offline\")) reads as a lifecycle defect\r\n  of the subject — measured cost 186s + a triage inside a lent box window (hertz's F1 red arm,\r\n  attempt 1). The build gap itself is the known cross-package row of the fixture-bin population;\r\n  what this entry carries is the DIAGNOSTIC asymmetry.\r\n- **Ask:** a fixture-bin existence precondition that NAMES the missing exe and its build recipe\r\n  wherever a rig consumes one — `sibling_bin` (and the shared\r\n  `crates/spt-term/tests/support/fixture_bin.rs` resolver already carries the recipe string as an\r\n  argument, the shape to copy) refuses with the artifact + recipe instead of letting the consuming\r\n  test fail downstream in its own vocabulary.\r\n- **Kin:** [[IR-21]] (wrong-lane-diagnostic family: the failure names the wrong actor), the\r\n  cargo-builds-package-bins-for-integration-tests rule (cross-package row is the only unguaranteed\r\n  build), golden.yml's dedicated fixture prebuild step.\r\n- **Ripe when:** the test-hygiene lane (IR-13/IR-23/IR-36/IR-38 family) — same sweep population;\r\n  or standalone small if that lane keeps slipping.\r\n- **Size:** small — one shared helper + a sweep of local `sibling_bin` resolver copies (24 known).\r\n- **Addendum (doyle, 2026-08-04 late): third and fourth sightings inside 24 h.** Face 1 twice\r\n  more the same evening — todlando's teach-lane leg set (his own translate_proof_fixture, caught\r\n  by his prebuild), and doyle's cold gate rig for the same lane (first-pass spt-bins red at\r\n  136/611, correctly withheld from the lane verdict as rig evidence, fixed by `cargo build -p spt\r\n  --bins` + rerun 611/611). Four sightings in one day across three agents and both faces: the\r\n  ripeness condition (\"the test-hygiene lane keeps slipping\") is under measurable pressure — the\r\n  prebuild remedy is being re-derived per-rig per-agent, which is the recurring cost the shared\r\n  precondition helper exists to delete.\r\n- **Built evidence:** all 29 file-local `sibling_bin` resolvers now route through one shared\r\n  precondition. A missing fixture names its path and the package-correct `cargo build -p <owner>\r\n  --bin <name>` recovery command before product assertions or timeout paths run; a focused\r\n  negative test pins that diagnostic.\r\n\r\n### IR-40 — CLASS: NO envelope-side ordering signal on a resume brief tracks content recency, and a CI informant's per-job line is a claim about that STEP, not the run\r\n- **Status:** open · **Origin:** three sightings in one night, 2026-08-04/05 — hertz, doyle,\r\n  todlando (filed by doyle; the artifacts are hertz's and todlando's, the CI arm is doyle's with\r\n  deployah's framing). Two arms of ONE family: a stale record that carries a confident ordering\r\n  signal, and a status claim that arrives before the thing it describes.\r\n\r\n- **ARM A — resume briefs. What/why:** a session can receive TWO start-of-session briefs, and the\r\n  one routed LATER can carry the STALER project-context. Measured on hertz's pair (same node id):\r\n  routed_at_ms `1785897407373` > `1785896642480`, spill-filename epoch `1785897764588` >\r\n  `1785896658159`, and vector sequence `1242529/1242531` > `1241542/1241544` — **all three\r\n  monotonic orderings rank the staler-content brief as newer.** todlando's pair is the NEGATIVE\r\n  arm: his later brief (`…1785897765196`, routed `…577476`, vector `1242756/7`) genuinely WAS the\r\n  fresher one, so the same heuristic happened to pick right.\r\n- **The finding is UNCORRELATED, not inverted** — and that is the whole entry. An inverted signal\r\n  is usable once you know to flip it; an uncorrelated one reads as reliable until the pair where it\r\n  costs you. Neither agent could have known which pair he held without checking content against\r\n  measurement. **Do not name routed_at_ms specifically** — naming the stamp invites the repair that\r\n  fails (\"the timestamp is unreliable, use the sequence number\"). The vector is the most dangerous\r\n  of the three: a stamp looks like a clock and invites suspicion, a sequence number looks like an\r\n  ordering and does not.\r\n- **Visible failure mode if a brief is obeyed as instructed** (hertz's, measured): re-open\r\n  `releases#123` — work already ruled closed — and under-report his own claimed-pool count by one,\r\n  the row sitting under a live gate. doyle's own sighting the same night: a brief describing main\r\n  @`92b2482` with a teach lane \"mid-flight\" hours after every lane had gated.\r\n- **PRE-REFUSED DISCRIMINATOR, recorded so it is not rediscovered as a finding:** file SIZE ranks\r\n  the fresher brief correctly on BOTH pairs (hertz 16308 > 12649; todlando 14138 > 10418) — 2 of 2,\r\n  the only signal surviving both samples. **Do not use it.** Size measures RICHNESS, not recency;\r\n  the two correlated only because todlando's thin brief was a correction fragment, and hertz's\r\n  STALER brief was a full 12649-byte dump. Two full dumps hours apart go flat or inverted. Handed\r\n  over pre-refused by its own finder.\r\n- **ARM B — CI informants (doyle, 2026-08-05, run 30971976024).** `CI-KITSUBITO` sent\r\n  \"CI SUCCESS … sha 0a25b77\" while the run was measurably `status=in_progress` with\r\n  `conclusion=\"\"` — the EMPTY STRING, not `success`. The informant fires from a per-job `notify`\r\n  step, and at send time `notify` itself had no conclusion. All eight substantive jobs were green,\r\n  so the line was **right in the end but EARLY**. deployah's framing, kept verbatim in kind: *an\r\n  informant line that is right in the end but early is worse than one that is simply wrong, because\r\n  a wrong signal gets distrusted while an early-but-correct one gets promoted to the conclusion.*\r\n  todlando's sentence is the one to keep at the point of use: **a per-job notify step's message is\r\n  a claim about that STEP, not about the RUN.**\r\n- **ARM B MECHANISM — hertz, source read 2026-08-05, zero box cost. It is NOT a race; it fires\r\n  early on EVERY run, and the entry above understated it.** `notify` is a job INSIDE the run\r\n  (`golden.yml:1138`), and a job cannot observe its own run's conclusion — so `conclusion: \"\"` is\r\n  not a timing artifact, it is **the only value that can exist when the informant speaks. The\r\n  informant has never once made a statement about a run conclusion.** What `ci-notify.sh` actually\r\n  asserts is narrower and worth naming exactly: a verdict computed PURELY from six `needs` results\r\n  (changes, traceability, test, n1-gate, twohost-a, twohost-b — the two matrices collapse to one\r\n  result each) being neither failure nor cancelled. Nothing more.\r\n  **The blind spot is exactly ONE job: `notify` itself, the 9th — it cannot appear in its own\r\n  `needs` list. And that one job has a WITNESSED red path**, documented in the script's own header\r\n  (2026-07-27, twice on kitsubito): verdict computed, then `spt send` HUNG ~5 minutes until the\r\n  job's own 5-minute budget cancelled it, and that cancellation reddened the run. So *\"informant\r\n  says SUCCESS, run concludes FAILURE\"* is a real observed sequence, not a hypothetical. The 30s\r\n  `SEND_BOUND_SECS` added since bounds the hang but does not close the class — it makes the\r\n  informant's own failure FAST rather than impossible.\r\n  ⇒ The informant's SUCCESS covers 8 of 9 jobs and is blind to the 9th, and the 9th is the only one\r\n  with an observed failure mode that reds the run. This is why the ff predicate is the run's\r\n  conclusion field and never the informant line.\r\n- **RECOVERY, and it is the same for both arms: never rank the claims — re-derive from the source\r\n  object.** For briefs, hertz's four falsifiers are the method (main sha, claimed-pool count, lane\r\n  tip, issue state) and they work because each is a content claim checkable in ONE command against\r\n  a source NEITHER brief controls. For CI, read the RUN's own `conclusion` field, and prefer\r\n  independent reads of the run object (`gh run watch --exit-status` polls the run, so its exit is a\r\n  second measurement rather than an echo of `notify`). On the batch this was caught in, three\r\n  sources agreed with the informant excluded from all three before main was fast-forwarded.\r\n- **Standing rule this entry exists to enforce:** a resume brief's RULINGS are durable; its STATE\r\n  is a HYPOTHESIS to re-derive before acting.\r\n- **Kin:** [[IR-21]] and [[IR-39]] (the diagnostic names the wrong actor / the wrong subject),\r\n  [[IR-32]] (a gate that cannot see its own blind spot), [[IR-34]] (an intermittent marker read as\r\n  a signal).\r\n- **Ripe when:** the next commune/psyche-tier touch for arm A (the routing layer is spt-core's own\r\n  `spool`/psyche ingest, so a remedy is in-repo, not upstream); for arm B, the next `golden.yml`\r\n  informant touch — the cheap fix is that the notify step names its own scope in the message body\r\n  (STEP vs RUN) rather than emitting a bare \"CI SUCCESS\".\r\n- **Size:** arm B small (message text + scope word in one workflow step). Arm A unsized —\r\n  establishing whether ANY durable content-recency signal can ride the envelope is the measurement,\r\n  and until it runs the answer is \"re-derive, do not rank.\"\r\n\r\n### IR-41 — A QUEUED main run is superseded without a record; `cancel-in-progress: false` protects only STARTED runs\r\n- **Status:** open — mechanism CONFIRMED (doyle ruling 2026-08-05); the runbook sentence it\r\n  falsified is already corrected (`docs/RELEASE-RUNBOOK.md` step 3, same commit as this entry)\r\n  · **Origin:** deployah, v0.55.0 publish night, filed by him explicitly as UNPROVEN with the\r\n  manual-cancel alternative not ruled out; confirmed by doyle on the run objects.\r\n- **What/why:** `ci.yml` sets `cancel-in-progress: false` on main and the runbook read that as\r\n  \"main's concurrency policy never cancels this run; that preserves the record.\" FALSE for the\r\n  queued phase: a concurrency group holds at most one running + one pending run, and a newer push\r\n  REPLACES the pending run regardless of the flag — the flag governs only whether a STARTED run\r\n  is cancelled. A superseded queued run leaves NO record: zero jobs, conclusion `cancelled`,\r\n  nothing measured about its sha.\r\n- **Evidence (all read off the run objects, not the informant):** run 30973909279 at `327f1f8`\r\n  (push, main) — created 04:01:08Z, **zero jobs ever started**, cancelled 04:03:49Z, ONE SECOND\r\n  after `e8805f7`'s run 30974041521 entered the group (created 04:03:48Z), while `0a25b77`'s run\r\n  30973770039 was still in flight (done 04:07:59Z). One-running-one-pending, newer push landed,\r\n  pending run died. The 1s coupling to an unrelated push is the discriminator against deployah's\r\n  own manual-cancel alternative — a human cancel co-timed to the second with a push it had no\r\n  view of is not a credible mechanism; supersession fires on exactly that trigger by design.\r\n- **The hole this leaves:** under a rapid push sequence, an intermediate sha on MAIN can have no\r\n  thin-CI verdict AT ALL, and the absence reads as nothing rather than as supersession. Anyone\r\n  auditing \"did sha X pass main CI\" gets a hole where the runbook promised a record. Absence of\r\n  a run is now a labelled state, not evidence about the sha.\r\n- **Ripe when:** next ci.yml/runbook touch. Candidate remedies to weigh THEN, not now: accept and\r\n  document (done — the runbook now carries the mechanism), or give main's group per-sha keys\r\n  (`group: ci-${{ github.sha }}`) so runs never share a group — at the cost of concurrent main\r\n  runs competing for the boxes, which is exactly what the group exists to prevent. The trade is\r\n  real; do not fold it into a drive-by.\r\n- **Size:** docs half DONE in this commit; ci.yml half small but load-bearing — needs its own\r\n  lane if taken.\r\n- **Kin:** [[IR-40]] (a record that is right-in-the-end-but-early vs a record that never comes to\r\n  exist — both read as clean states unless labelled), [[cancelled-measurement-leaves-labelled-hole]].\r\n\r\n### IR-42 — `pool-claim` writes a record; only the BUILD enforces — and AGENTS.md invited the misread\r\n- **Status:** BUILT 2026-08-19 — the AGENTS.md corrective line lands in the SAME COMMIT as this\r\n  entry (the register batch commit), which is the entry's stated exit condition. The optional\r\n  code-side nicety (claim verb prints the incumbent record it overwrites, information only)\r\n  remains unclaimed — a candidate rider on the IR-26 remedy lane, which already touches\r\n  `pool_claim`'s read-before-write path, NOT a reason to keep this entry open ·\r\n  **Origin:** doyle + todlando independently at source, 2026-08-19, during the #193 gate.\r\n- **Mechanism (source-verified):** `xtask pool-claim` (crates/xtask/src/main.rs:2232-2294 at the\r\n  read sha) parses its args, reads the lane's own git identity, builds a `PoolOwner` and calls\r\n  `spt_poolguard::write_owner` UNCONDITIONALLY (:2280) — no `read_owner`, no verdict, no\r\n  comparison against the incumbent claim anywhere in the function. Claiming is last-writer-wins\r\n  by construction: two lanes can each \"hold\" a pool in sequence with only the last write\r\n  surviving, and the displaced lane learns nothing at displacement time. All four enforcement\r\n  arms — `Refuse` (SPT_POOL_FOREIGN), `Takeover` (loud), `Unproven`, `HatchOpen` — live in\r\n  crates/spt-store/build.rs:31-113 and speak only at the next BUILD. (Same object [[IR-26]]'s\r\n  CLAIM-OBSERVABILITY measurement saw from the displaced side; this entry is the CLAIMING side\r\n  plus the doc that invited the misread.)\r\n- **Measured consequence:** 2026-08-19, doyle's gate claim over todlando's unlanded\r\n  redeem-echo-diag claim — no refusal, no notice (three sequential overwrites that session, one\r\n  over a lane with an unlanded commit). todlando then predicted from AGENTS.md's refusal\r\n  sentence that the gate's claim \"will be REFUSED\" — a false warning to a gater mid-run. The\r\n  refusal sentence sat directly under the \"Claim a pool at lane start\" instruction, inviting the\r\n  build-time semantics to be read onto the claim verb.\r\n- **Corrective landed:** one AGENTS.md sentence — the claim WRITES a record and never refuses;\r\n  predict refusals from builds, never from `pool-claim`.\r\n\r\n### IR-43 — knock answer carrier: `NoReply` landed at 60.08s against a stated 30s carrier deadline\r\n- **Status:** open, OBSERVATION — mechanism unmeasured, filed exactly as wide as the datum ·\r\n  **Origin:** KNOCK-169 RCA layer 1 (todlando, read-only), golden 32191618042 @`93c1130`,\r\n  twohost-b, 2026-08-18.\r\n- **What/why:** B's `request_answer` yielded `NoReply` at 22:50:08.3605Z — 60.08s after A's\r\n  death — while the carrier deadline is stated at 30s. Recorded in the RCA as a side observation\r\n  with no claim; the cell's red itself was a CASCADE of A's earlier death (answerop.rs:73-81\r\n  produces the courtesy BEFORE returning, so the reply was never sent — that half is settled and\r\n  is NOT this entry). What this entry carries: a transport/liveness bound that reported at 2x its\r\n  stated value. Candidate shapes, neither asserted: two sequential 30s legs each honoring its own\r\n  bound (a composed wait wearing one bound's name), or a bound armed after a wait it does not\r\n  cover (the [[IR-30]] nethost.rs permit-wait shape: `sem.acquire_owned()` outside the timeout).\r\n- **Ask:** derive where the 30s is armed and what path yields a 60s `NoReply` — one code read\r\n  from the emit site, before any instrument.\r\n- **Ripe when:** next knock-carrier touch, or the next `NoReply`-shaped red — whichever first.\r\n- **Size:** small (code read; a token only if the read forks).\r\n\r\n### IR-44 — perch-sentinel comment overclaims: serialization is not preservation, and the comment teaches the false step\r\n- **Status:** open · **Origin:** #188 RCA lock read (todlando flagged, doyle confirmed the lock\r\n  read), 2026-08-18; the collapse-of-branches argument is on #188 and in the RCA record.\r\n- **What/why:** `lock_perch_sentinel` (info.rs:778 at `b20e770`, the diag sha — re-derive the\r\n  line on main before editing) takes a cross-process fs2 lock on a stable per-perch `.info.lock`\r\n  sentinel, and its comment claims it serializes \"ALL info.json writers so a whole-record write\r\n  and a locked RMW can never lose each other's update (`REQ-HAZARD-INFO-RMW-LOST-UPDATE`)\" —\r\n  TRUE for interleaving, FALSE for preservation. `write_info_unlocked` is module-private with\r\n  exactly three callers, all taking the sentinel first (bypass refuted by visibility), but every\r\n  caller of the public `write_info` composes its record BEFORE the lock is taken (:842) — **the\r\n  lock makes that write atomic; it cannot make it preserving.** Only `mutate_info` /\r\n  `establish_locked` read under the hold and can preserve. Measured field case: census write #1\r\n  (`twohost.rs:736`) clobbered `controlled` while correctly locked. A reader trusting the\r\n  comment infers lost-update immunity the funnel does not provide — the #188 hunt burned a\r\n  branch on exactly that inference before the collapse argument killed it.\r\n- **Ask:** respell the comment — serializes writers; a composed `write_info` is atomic, never\r\n  preserving; preservation requires `mutate_info`/`establish_locked` — and weigh whether\r\n  `REQ-HAZARD-INFO-RMW-LOST-UPDATE`'s doc wording carries the same overclaim.\r\n- **Ripe when:** next spt-store/info.rs touch. **Size:** tiny (comment + possibly one REQ doc\r\n  line).\r\n\r\n### IR-45 — twohost rig home premise, SETTLED: pump paths resolve under the per-run TEMP root (rig is disk-hermetic; the \"live fleet roster\" reading is retired)\r\n- **Status:** RETIRED 2026-08-19 — ask answered by the one code read at main @`78a9a16`; residue\r\n  re-homed (see Answer). · **Origin:** #188/#189 RCA readouts (todlando, doyle's 2a-2d), runs\r\n  32097943571 + 32108557362 + 32111921251, 2026-08-18.\r\n- **What/why, two measured halves in tension:** (1) B's pump dialed a THIRD node 155-159 times\r\n  per run at kitsubito's OWN tailscale IP (`100.98.197.12`), different hex + different ephemeral\r\n  port each run — a short-lived local endpoint re-minting identity between runs, present in both\r\n  the golden and the diag run. Read at the time as: the rig uses the CANONICAL home\r\n  (`canonical_pump_paths` → `perch::spt_home()`), so B's roster is kitsubito's live fleet\r\n  roster — environmental coupling of a CI rig to host fleet state. (2) The ER perch measured in\r\n  the chain runs resolves under a per-run TEMP root\r\n  (`…/_temp/spt-test-tmp-<run>…/owlery/engine-room`), NOT the canonical home. Both measurements\r\n  stand; they answer different artifacts (pump roster vs perches), and nothing on record settles\r\n  which home the PUMP paths actually resolve. #189's third-node evidence and its\r\n  cache-leg-never-heals reading rest on that premise (the tension is filed on the #188 record as\r\n  an open question against #189).\r\n- **Answer (2026-08-19, code read at `78a9a16`, unambiguous — no run token needed):** both role\r\n  tests set `SPT_HOME` to a fresh per-run `TempDir` as their FIRST act (`twohost.rs:813-814` role\r\n  B, `:1501-1502` role A), before any store touch. `canonical_pump_paths` resolves every path via\r\n  `perch::spt_home()` (`twohost.rs:396-414`), which honors the `SPT_HOME` override first\r\n  (`perch.rs:34-41`); the pump's roster source `presence::registry_snapshot_dir()` →\r\n  `perch::identity_dir()` sits under the same root (`presence.rs:83-85`). The rig is\r\n  DISK-HERMETIC per run; both prior measurements reconcile (ER perch observed under the temp\r\n  root, pump paths resolve there too). The misleader was the helper's name + doc comment (\"real\r\n  homes, not test roots\"), which describe production path LAYOUT, not the resolved ROOT.\r\n- **Residue disposition:** (1) #189's third-node evidence was corrected on the board (comment\r\n  5337519936) — the roster row arrived at RUNTIME into a temp-rooted store, ingress mechanism\r\n  OPEN on #189, no longer explained-environmental. (2) KEYSTONE #182's hygiene lane repaired the\r\n  `twohost.rs:394` comment to say exactly what the helper does: production path layout rooted in\r\n  the process's fresh per-run `SPT_HOME`.\r\n\r\n### IR-46 — the Windows disk-floor preflight asserts an INSTANT; workspace free space moves tens of GB inside the hour, so a green floor is not a claim about run headroom\r\n- **Status:** open — mechanism CONFIRMED by a measurement series on hfenduleam; doyle ruled it\r\n  register-shaped 2026-08-18 · **Origin:** deployah, NAMEPLATE #181 golden-head intake, on the\r\n  run that the floor red-floored · **Filed as IR-46 after an id collision:** this row was authored\r\n  as IR-42 and held unpushed under the v0.56.0 tag freeze, during which the release-close sweep\r\n  (`78a9a16`) issued IR-42..45 to other findings. Parallel issuance, not authored disagreement —\r\n  and noted here so a later reader chasing \"IR-42\" in this row's history does not hunt for a lost\r\n  version of it.\r\n- **What/why:** `golden.yml`'s Windows preflight computes `$freeBytes` once at job start and\r\n  hard-fails under a `32GB` floor. As a fast-fail that is correct and it did its job — it refused\r\n  before compiling rather than dying deep in a link step. The defect is what a PASS is then read\r\n  to mean. The reading is a point sample of a quantity that moves by tens of GB unattended, so a\r\n  green preflight licenses a run whose headroom was never measured. Nothing downstream re-checks.\r\n- **Evidence — five readings of `C:` free on one box inside roughly one hour, 2026-08-18:**\r\n  - `03:01:54Z` — `free_bytes=2666205184` (2.48 GiB) against `floor_bytes=34359738368`, the\r\n    preflight's OWN reading; run `32093894524`, both `n1-gate` and `test` on Windows/hfenduleam\r\n    failed at this same step, before any compilation.\r\n  - `~03:2xZ` — ~2.50 GB, independent `Get-PSDrive` read, corroborating the preflight.\r\n  - pre-reap — **33.70 GB**, immediately before deployah deleted anything.\r\n  - post-reap-1 — 76.42 GB (42.72 GB reclaimed: `claude_skill_owl/target`, `golden-w1/target`).\r\n  - pre-reap-2 — **73.81 GB**, i.e. 2.61 GB consumed unattended between the two reaps; then\r\n    post-reap-2 129.70 GB (55.89 GB reclaimed: `.worktrees/nameplate-w1/target`).\r\n- **LABELLED HOLE — do not let this harden:** roughly **31 GB was released between the preflight\r\n  failure and the pre-reap reading by something OTHER than the reclaim**. Released-by-unknown.\r\n  The runner cleaning its workspace after the job died is *plausible* and is NOT the recorded\r\n  cause — it was never measured, and no one looked while it was happening. Recorded as a hole on\r\n  purpose (doyle's explicit ask at filing): a plausible cause written down as the cause would make\r\n  this row read as explained when the actual mechanism of the 31 GB is unknown.\r\n- **The hazard this leaves:** a run can clear the floor at preflight and starve mid-build, and\r\n  mid-build disk starvation does not present as disk — it surfaces as a link failure, a truncated\r\n  artifact, or a rustc ICE, i.e. as a defect in the tree under test. The failure mode inverts the\r\n  gate's purpose: the preflight's whole point is to keep box conditions from being read as lane\r\n  reds, and a passing preflight actively argues the opposite. Note the polarity — this row is\r\n  about the PASS, not the FAIL. The observed red was honest.\r\n- **#242/v0.66.0 GOLDEN ADDITIONS (deployah measured 2026-08-29, banked at the 08-30 close\r\n  sweep):** (i) per-job floor figures are SEPARATE INSTANTS — quote per job, never one figure for\r\n  both (attempt 1: `test` 26521477120 vs `n1-gate` 26535051264 free bytes, 8s apart, one run);\r\n  (ii) **CORRECTED TRAP** (retracting deployah's earlier \"attempt-2 hides jobs\" version): the\r\n  default `/runs/<id>/jobs` endpoint stamps `run_attempt=<current>` on EVERY job including ones\r\n  that never re-ran (4 of 8 mis-assigned on this run) — it is the RUN's attempt, not the JOB's,\r\n  so a stale green can read as re-earned; `started_at` is the discriminator and\r\n  `/runs/<id>/attempts/N/jobs` the authority. Also `rerun --failed` re-runs DEPENDENT jobs\r\n  (twohost re-ran despite a green attempt 1); (iii) a rerun preflight reads RAW free BYTES with\r\n  the CI step's own predicate, not display GB; (iv) a rerun green counts as floor-RCA-closing\r\n  evidence only after a step-level NON-VACUOUS check (checkout SUCCESS + workload steps ran) —\r\n  the v0.64.0 checkout-SKIPPED shape means a green job can carry zero code signal.\r\n- **Ripe when:** next `golden.yml` touch. Remedies to weigh THEN, not as a drive-by: re-assert the\r\n  floor at job END (turns a starvation into a labelled disk verdict instead of a fake lane red);\r\n  or raise the floor to cover a full build's peak rather than its entry condition; or sample free\r\n  space across the run and emit the minimum as a token. All three cost run time; none is obvious.\r\n- **Size:** small in `golden.yml`, load-bearing in what a green run is taken to prove.\r\n- **Kin:** [[IR-41]] and [[IR-40]] (a state that reads as a clean verdict unless it is labelled —\r\n  here a PASS that is read as headroom it never measured), [[measure-the-box-before-the-instrument]],\r\n  [[cancelled-measurement-leaves-labelled-hole]].\r\n\r\n- **2026-09-06 addendum (doyle, v0.67.1 close sweep): trigger FIRED at `04e32c8c` — `golden.yml` touched (2-line HEAVY reclass of `brain_resume_conn_deadlock` on the respin) with no remedy weighed. Not a drive-by by choice: the touch rode a respin under a pre-registered hard stop, which is no remedy window. COMPOSED with IR-59 (log-the-floor) + IR-73 (literal-first sites) as one hertz workflow rider on WEBSERVE #272; the remedy weighing happens on THAT lane, before the WEBSERVE golden head.**\r\n\r\n<!-- [doc->REQ-CI-FREE-SPACE-PREFLIGHT] -->\r\n- **2026-09-06 remedy ruling (doyle, WEBSERVE rider):** retain 32 GiB; record raw-byte\r\n  `FLOOR_START` and `FLOOR_END` PASS/RED tokens per job/runner, each labelled `sample=INSTANT`.\r\n  End DISK assertions run `if: always()` before teardown, including after failed workloads.\r\n  A fresh `FLOOR_DOCS` assertion immediately before docs-drift composes with IR-73's second half.\r\n  Raising the floor is refused without a measured peak; continuous sampling adds lifecycle\r\n  machinery while remaining blind between samples. Start/end are a dataset, not a minimum or\r\n  headroom guarantee. Golden execution evidence waits for the WEBSERVE golden head; the thin\r\n  PR must first show actual START/END output on its own green CI run.\r\n\r\n### IR-47 — ci-notify treats a missing co-author trailer as a quiet info line; silent attribution loss reads as \"there was none\"\r\n- **Status:** open — patch AUTHORED and stashed unlanded since 2026-07-29\r\n  (`.worktrees/_patches/ci-notify-missing-trailer.patch` + its `test-ci-notify.sh` harness in the\r\n  sibling `.untracked` dir); surfaced by doyle's 2026-08-19 idle-queue verification of that stash ·\r\n  **Origin:** the AGENTS.md trailer mandate's own hazard family (the space-spelling trailer is\r\n  structurally invisible to git's tokenizer, so confident zeros already read as attribution loss\r\n  once); this row is the NOTIFY-side twin.\r\n- **What/why:** `.github/ci/ci-notify.sh` parses the head commit for the line-anchored\r\n  `Co-authored by: <agent>` trailer to add a second notification recipient. When the trailer is\r\n  absent or unparseable, the current script emits one stdout info line (\"doyle only\") and moves\r\n  on — correct as a non-fatal outcome, wrong as a SILENT one: a lane that lost its attribution\r\n  (typo'd trailer, squash that dropped the body, hyphenated spelling) notifies doyle alone on\r\n  every run and nothing anywhere says an agent stopped being told about their own lane's verdicts.\r\n  The stashed patch keeps absence non-fatal but promotes it to a `::warning` workflow annotation\r\n  (visible on the run summary), and splits the legitimate quiet case (co-author IS doyle) from the\r\n  loss case so the two stop sharing one message.\r\n- **Evidence:** patch verified 2026-08-19 to still NOT be on main — the warning string is absent\r\n  from `.github/ci/ci-notify.sh` at the current tree. Patch content re-read at verification; it\r\n  applies against the script's post-`SEND_BOUND_SECS` shape.\r\n- **Ripe when:** next `golden.yml`/ci-notify touch — natural co-rider with [[IR-46]]'s remedy\r\n  window (same file family, same \"weigh then, not drive-by\" rule). The stashed test harness rides\r\n  with it.\r\n- **Size:** ~10 lines in one shell script plus its test.\r\n- **Kin:** [[IR-40]] (an unlabelled state read as a clean verdict — here a quiet info line read as\r\n  \"no co-author existed\"), the AGENTS.md `%(trailers:)` tokenizer mandate (the sibling silent-zero\r\n  on the AUDIT side).\r\n\r\n### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\r\n- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\r\n  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\r\n  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\r\n  smudges fresh checkouts CRLF, and the author's never-re-smudged tree stays LF — builder green,\r\n  every fresh rig/golden checkout red.\r\n- **What/why:** `crates/xtask/src/main.rs` `the_checked_in_config_is_in_parity` include_str!s\r\n  `.config/nextest.toml` and feeds `phase_a_overrides_missing_from_ci_windows`. TODAY this is\r\n  causally CRLF-tolerant — the parser is `str::lines()`+trim (`override_filters`, main.rs:434-440),\r\n  and the 52/52 fresh-rig green at the hygiene gate (2026-08-19, this box) is therefore causal, not\r\n  luck. The hazard is the MISSING CONTROL: nothing pins the tolerance, so a future\r\n  newline-sensitive arm in the parity predicate reds only on fresh Windows checkouts — the\r\n  builder-green/rig-red inversion, deterministic but reading as flake.\r\n- **Remedy (hertz's, platform-independent):** feed the parity predicate an LF fixture AND the same\r\n  fixture converted to CRLF, assert identical missing-sets (including one unmirrored negative), so\r\n  a newline-sensitive arm reds on EVERY host rather than only fresh Windows checkouts.\r\n- **Ripe when:** next xtask parity-cell touch; explicitly OUTSIDE the family-B lane (hertz\r\n  scoping). **Size:** one fixture-pair cell.\r\n- **Kin:** the W3 gate finding this swept out of (skeleton cells, fixed at the fixture edge in\r\n  lane commit e99633f); [[IR-40]] (an untested tolerance read as a guarantee).\r\n\r\n### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\r\n- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\r\n  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\r\n  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\r\n  landed fact — the checker was wrong with the guard, which is exactly how the guard will be\r\n  wrong alone.\r\n- **What/why:** `git_lane_state`'s final arm answers Settled/InFlight purely by\r\n  `merge-base --is-ancestor <lane tip> <integration head>`\r\n  (`crates/spt-poolguard/src/lib.rs:424-436`, probe at `:474-479`). Under ADR-0050 golden CI\r\n  (thin member lanes cherry-picked onto a stage branch, ff-only main) a MEMBER lane's own branch\r\n  tip never becomes an ancestor of main. Measured at origin/main `9ea595c`:\r\n  `build/keystone-182-w2-sealed-multi` @`ba2d998` and `fix/197-absent-code-uncounted` @`5eb6a3b`\r\n  both read NOT-ancestor while `git cherry -v` reports every lane commit `-` (already upstream).\r\n  So `LaneState::Settled` is unreachable for any cherry-pick-assembled member lane whose branch\r\n  still exists, the takeover arm can never fire, and the pool refuses forever — including with a\r\n  dead holder. That contradicts the AGENTS.md mandate (\"a merged branch is taken over\") because\r\n  the guard's notion of merged is ancestry-only and the golden model structurally never produces\r\n  ancestry for member branches. The branch-vanished (`:391`) and re-pointed (`:399`) arms still\r\n  fire, and the STAGE lane works (its tip IS an ancestor) — the hole is landed-member-branch-\r\n  still-exists only. It did not bite at the 2026-08-19 reaps solely because deleting a pool\r\n  deletes its claim; it bites the first time someone wants to TAKE OVER a landed lane's pool\r\n  rather than reap it.\r\n- **Remedy (todlando's candidate, doyle-endorsed direction):** when ancestry answers false, fall\r\n  back to patch-id containment (`git cherry` / `rev-list --cherry-mark` against the claimed\r\n  base) before concluding InFlight. **Known residual to state in the fix's docs/tests:** a\r\n  conflict-adjusted pick changes the patch-id, so such a lane still reads InFlight; its release\r\n  path is branch deletion (the vanished arm), which is at least reachable. Tests want a\r\n  cherry-picked-landed fixture plus a conflict-adjusted negative.\r\n- **Ripe when:** next poolguard touch, or the first landed-lane pool takeover request.\r\n- **Size:** one fallback arm in `git_lane_state` + two fixtures.\r\n- **Kin:** [[IR-26]] (dead-holder takeover AUTHORIZED when it shouldn't be — this is the mirror:\r\n  takeover UNREACHABLE when it should fire), [[IR-42]] (claim writes, build enforces), the\r\n  AGENTS.md pool mandate this contradicts.\r\n\r\n### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\r\n- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\r\n  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\r\n  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\r\n  2026-08-21) — lane `fix/ir50-stderr-sink-census` @`1a2f6a2`+`2ac9543`\r\n  (hertz; base `0c86b2d`; rides the CONCIERGE #183 chain; these shas are the 2026-08-19\r\n  message-only reword of `cb4cd9d`+`7336e03` — trees proved identical by tree-id, so every\r\n  measurement below carries): exported\r\n  `spt_daemon::stderrlog::sink_path(home)` with `stderr_log_path` routed through it +\r\n  equality unit; `daemon_stderr_panel` in tests/common renders BOTH channels and labels a\r\n  read failure with channel + exact looked-at path + OS error (absent-sink regression pins\r\n  it — the IR-40 unlabelled-absence class was caught at gate and fixed in `2ac9543`);\r\n  censused every daemon-run captured-stderr panel outside `engine_room_bringup_e2e` (rides\r\n  #199 lane) and `er_briefing_*` (rides #164 lane); engineroom.rs:145 misnomer rider landed\r\n  in the same lane. Gate figure 781/781 at `2ac9543` (measured at the pre-reword tree,\r\n  which is byte-identical; first-report 765 was transcription,\r\n  corrected with raw line + JSON provenance). CLASS FOLD (doyle ruling, no fresh row):\r\n  `er_briefing_presented_e2e` hit this exact class during its own authoring (blank panels\r\n  on a real loud line) and was fixed locally in `72efb6a` reading both channels.\r\n  **REGISTER CLOSED 2026-08-19:** branch `docs/ir50-register-close` links the\r\n  golden-tested implementation at `4661bc9d` and completes helper adoption in the five measured\r\n  residual files: `er_brief_once_per_session_e2e.rs`, `er_briefing_presented_e2e.rs`,\r\n  `er_sequestered_cwd_e2e.rs`, `endpoint_autostart_e2e.rs`, and `n1_pairing.rs`.\r\n  `engine_room_bringup_e2e` remains the explicit exclusion, recorded as todlando's direct\r\n  sink-path read from the #199 lane. ·\r\n  **Originally filed:** 2026-08-19 (todlando RCA inside the #199 investigation; the immediate\r\n  four-panel fix in `engine_room_bringup_e2e.rs` is his and rides the #199 lane — THIS entry is\r\n  the class census, hertz-class) · **Origin:** the #199 evidence void — 40 rca-v2 runs held zero\r\n  daemon-side evidence for either erhost face; `ENGINE_ROOM_SPAWN_FAIL` (broker.rs:5658) was\r\n  written to a log the rig destroyed at teardown. Absence discipline honoured: the SUCCESS-path\r\n  line (`ENGINE_ROOM_BROUGHT_UP`) was also absent from all 40, proving the channel dead rather\r\n  than the event absent.\r\n- **What/why:** product `stderrlog::install` (broker at cli.rs:7633, brain at brainproc.rs:200)\r\n  repoints the process STD_ERROR_HANDLE within its first statements (`redirect_stderr_to`,\r\n  stderrlog.rs:101 — Windows `SetStdHandle` + `mem::forget`), so a rig's `.stderr(File)` capture\r\n  holds only the pre-redirect window; from that line on every diagnostic lands in\r\n  `SPT_HOME/logs/daemon.stderr.log` (stderrlog.rs:34/42) inside the rig's temp home, destroyed\r\n  unread at teardown. Panels are also mislabelled (\"brain stderr\" holding the broker's first\r\n  lines). REQ-DAEMON-STDERR-PERSIST fixed this blindness PRODUCT-side (\"the incident-night\r\n  RCA-blind gap\", cli.rs:7626-7631); no rig was ever taught to read the sink, so the fix does\r\n  not reach any harness. Class: every e2e rig that spawns `spt daemon run` and prints a\r\n  captured-stderr panel has the same void.\r\n- **Remedy:** census all such rigs; failure panels additionally dump\r\n…\n  and remainder are hertz-class.\n…\n","startLine":2205,"lineNumbers":[2205,2206,null,2237,null,2240,2241,2242,2243,2244,2245,2246,2247,2248,2249,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2263,2264,2265,2266,2267,2268,2269,2270,2271,2272,2273,2274,2275,2276,2277,2278,2279,2280,2281,2282,2283,2284,2285,2286,2287,2288,2289,2290,2291,2292,2293,2294,2295,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2306,2307,2308,2309,2310,2311,2312,2313,2314,2315,2316,2317,2318,2319,2320,2321,2322,2323,2324,2325,2326,2327,2328,2329,2330,2331,2332,2333,2334,2335,2336,2337,2338,2339,2340,2341,2342,2343,2344,2345,2346,2347,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,2370,2371,2372,2373,2374,2375,2376,2377,2378,2379,2380,2381,2382,2383,2384,2385,2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,2428,2429,2430,2431,2432,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,2448,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2465,2466,2467,2468,2469,2470,2471,2472,2473,2474,2475,2476,2477,2478,2479,2480,2481,2482,2483,2484,2485,2486,2487,2488,2489,2490,2491,2492,2493,2494,2495,2496,2497,2498,2499,2500,2501,2502,2503,2504,2505,2506,2507,2508,2509,2510,2511,2512,2513,2514,2515,2516,2517,2518,2519,2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533,2534,2535,2536,2537,2538,2539,2540,2541,2542,2543,2544,2545,2546,2547,2548,2549,2550,2551,2552,2553,2554,2555,2556,2557,2558,2559,2560,2561,2562,2563,2564,2565,2566,2567,2568,2569,2570,2571,2572,2573,2574,2575,2576,2577,2578,2579,2580,2581,2582,2583,2584,2585,2586,2587,2588,2589,2590,2591,2592,2593,2594,2595,2596,2597,2598,2599,2600,2601,2602,2603,2604,2605,2606,2607,2608,2609,2610,2611,2612,2613,2614,2615,2616,2617,2618,2619,2620,2621,2622,2623,2624,2625,2626,2627,2628,2629,2630,2631,2632,2633,2634,2635,2636,2637,2638,2639,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,2669,2670,2671,2672,2673,2674,2675,2676,2677,2678,2679,2680,2681,2682,2683,2684,2685,2686,2687,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,2699,2700,2701,2702,2703,2704,2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,2715,2716,2717,2718,2719,2720,2721,2722,2723,2724,2725,2726,2727,2728,2729,2730,2731,2732,2733,2734,2735,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,2751,2752,2753,2754,2755,2756,2757,2758,2759,2760,2761,2762,2763,2764,2765,2766,2767,2768,null,2777,null,2783]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5781,"totalBytes":46415,"outputLines":529,"outputBytes":46415,"shownRange":{"start":2240,"end":2768},"nextOffset":2769}}},"isError":false,"timestamp":1789094605716}}
{"type":"message","id":"9b385c85","parentId":"7b388207","timestamp":"2026-09-11T02:43:25.733Z","message":{"role":"toolResult","toolCallId":"call_5kbTCbZNT8Zx2BJWA2M9Yx28|fc_074aee81620ae383016aa36acb3eac87d191d34791ebed08f3","toolName":"read","content":[{"type":"text","text":"### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n…\n- **RULING (doyle, 2026-08-04) — the claim path must run the same guard the build path runs, and a\n…\n\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\n- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\n  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\n  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\n  Measured on this box: reaping `golden-render` and `w4-cli-doc` the obvious way would have reclaimed\n  ~26 MB of worktree and stranded **14.17 GB** of pool (`gate-target-render` 6,265,448,382 B +\n  `gate-target-w4doc` 7,907,558,098 B). Neither pool appears in any worktree listing.\n- **The second shape, same mechanism, already realised:** `.worktrees\\gate-target` was found at\n  **0 files / 0 bytes with FOUR live inbound junctions** (assembly-doorbell, doorbell-w1/w2/w3). Someone\n  had already reaped that pool and left four dangling-but-valid links behind. So the defect runs both\n  ways: remove the worktree and the pool is orphaned; remove the pool and the links are orphaned.\n  Either half alone leaves a lie on disk.\n- **Why it is not just \"be careful\":** the classification step people already know\n  (`Get-Item -Force` OUTBOUND, INBOUND reparse sweep) tells you HOW to delete an object you have\n  already decided to delete. It does not tell you that a second object exists. The missing thing is an\n  enumeration that reaches pools no worktree names.\n- **Remedy shape (CORRECTED by builder retraction, 2026-08-04 — the enumeration already exists and\n  shipped):** `xtask pool-sweep` (`c6515f1`, `REQ-POOL-GC-ORPHAN-RECLAIM`, ancestor of `b7b00c3` by\n  merge-base) walks the root for dirs AND links, counts inbound links over the whole sweep before\n  forming a verdict, classifies InUse/Owned/Orphaned, and reaps orphans on `--reap`. The gap is not\n  detection, it is TIMING: a junction-pooled tree's pool is `Owned` and not reclaimable right up to\n  the moment its worktree is removed, and `Orphaned` only after — so the reclaim always lands in a\n  LATER sweep, and nothing triggers one. `gate-target` (0 bytes, four dangling inbound links) is a\n  completed instance of that deferral. Remedy is a post-teardown pass or a teardown that runs the\n  sweep itself, not new enumeration. (An earlier draft of this entry proposed building the\n  enumeration; retracted by its author before ripening — the tool refuting it was one run away.)\n- **Ripe when:** next CI/infra batch. **Size:** small (one enumeration + report, no new policy).\n- **Discipline this cost, stated so it is not re-learned:** teardown must be TWO EXPLICIT STEPS per\n  junction-pooled tree — junction deleted AS A LINK (`Directory.Delete(path, recursive: false)`), then\n  the pool AS A TREE after an inbound sweep confirms it is linkless. Executed that way on 2026-08-04:\n  28 worktrees, 4 pools, 0 skipped, 0 pinned, 17.04 GiB measured on a box with concurrent writers.\n\n### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\n- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\n  wave-gap rider that rode the commit range but was never LOCKSMITH scope) while the alchemy release\n  verb promoted #125 to DONE and named it publicly as shipped — two published surfaces contradicting\n  each other until the post-publish docs-only repair (`9841592`). The rule was already right (the\n  runbook audits the changelog against the COMMIT RANGE); the EXECUTION missed it, because a notes\n  pass written from the milestone narrative never enumerates the range. The mechanism, not the\n  incident: any rider is board-visible and narrative-invisible.\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now requires a mechanical `vPREV..HEAD`\n  user-facing commit list, a changelog match beside every row, and an explicit accounting of every\n  unmatched row before the golden run. The repair precedent remains docs-only amend +\n  `gh release edit`, never retag. PR #176 passed `traceable-reqs check`.\n\n### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\n- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\n  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\n  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\n  owed and rides the same window as #145's closed-subnet knock row) · **Origin:** golden\n  30873007187 attempt 1 red, doyle timeline triage + hertz source diagnosis 2026-08-04.\n- **SECOND FACE, measured 2026-08-24 (WAX-SEAL #21 W3 gate climb @ 035c3fe6, doyle):** the class\n  recurs on a NEW rung, and this face is UNWINNABLE rather than racy. The W3 seal rung S1 mints\n  on A ~0.3s before A's ladder completes (mint mono 80843ms, ladder end ~81150ms, walked from\n  the capture), while the seal pump worker's cadence is 500ms — the pusher exits before its\n  first eligible post-mint tick, so ZERO feed pushes ever fire (both logs hold zero seal-feed\n  lines) and role B burns its full 900s window on \"seal: A's record replicated into B's store\".\n  Full-re-presentation heals only while a pump is RESIDENT; the rig kills it. Product not\n  implicated (local legs + design review all green at the sha). Dispatched to hertz 2026-08-24\n  with two fix shapes (mint early with ~120 ticks of resident-pump margin, or a\n  reverse-confirmation barrier on A's done-push); the climb re-runs on his fix. Lesson for\n  future rungs, stated as construction: a rung whose delivery is CADENCED must not sit inside\n  the terminal margin of the process that pushes it.\n- **Mechanism (hertz falsified the gater's first spelling, kept because the correction is the\n  entry):** NOT \"B exits early\" and NOT a missing barrier. B's contract (twohost.rs:1116-1121,\n  \"hold until A finishes its side — done-file as the ladder's completion barrier\") is right and B\n  obeys it. A BREAKS it: A pushes done.txt (:1819-1832, payload literally \"ladder complete on A\")\n  then runs the ENTIRE leg-D digest rung including the re-pull assert (:1959) before its own\n  `stop.store` (:1966). B tears down exactly when A said it could; the re-pull then races B's\n  post-signal teardown. The panic's hint text (\"may be running a version without cross-node\n  digest\") is pre-authored and was NOT evidence of version skew.\n- **Margin series, six draws of one race (deployah, markers cited by TEXT and positive-controlled\n  against a known draw before producing an unknown one):** golden 30860770146 +60s · a1 −0.6s\n  (the RED) · a2 +59.4s · a3 +60s · a4 +59.59s · a5 +63.89s. BIMODAL, not drifting: greens\n  cluster within seconds, one collapse through zero. A green does not mean the window got safer;\n  sample count characterizes a bimodal race, not margin size — the slack is incidental, not\n  designed. Local load on hfenduleam during A's leg D eats the margin directly (role A runs\n  there; the done-file is already pushed), which is why builds hold through twohost legs.\n- **⚠ THE SERIES IS CLOSED AT SIX DRAWS — ITS DERIVATION IS UNRECOVERABLE, AND NO SEVENTH NUMBER\n  MAY BE ADDED (ruled by doyle 2026-08-05, at the tranche-2 golden).** Asked to extend it with a\n  draw from run 30971976024, deployah positive-controlled the markers FIRST and the control\n  REFUSED: grepping `margin|deadline|serve window|slack|headroom|budget` against a control run\n  known to carry good twohost evidence (30940180764) returned ZERO. Source confirms it —\n  **`margin` is not an emitted token anywhere**: absent from `.github/workflows/golden.yml`, and\n  every `crates/` hit is unrelated (terminal right-margins in broker/resize tests,\n  `ROUND_DRAIN_MARGIN` in `pump/mod.rs`). So the six figures were DERIVED from log timestamps\n  against a bound that was never written down, by a measurer whose context has since been cleared;\n  the gater who recorded them never held the formula either. **Consequence, stated so nobody\n  re-derives it:** any new figure computed from these logs would be a DIFFERENT quantity wearing\n  the same name, and would enter a series whose value is its bimodality — the one structure a\n  mismatched sample corrupts invisibly. This run therefore gets a LABELLED HOLE, not a number.\n  What IS reportable for it, with endpoints named rather than a name reused: **ladder span**, node\n  start → `TWOHOST role B: ladder complete` = **183.50s** on the batch vs **259.21s** on the\n  control. Marker parity established under an IDENTICAL expression on both sides (25 = 25, after a\n  first pass that compared two different greps and would have read as parity by coincidence).\n- **The fix this makes obvious:** the twohost margin must become an EMITTED token with its two\n  events named at the emit site, so the next draw is read rather than reconstructed. A derived\n  quantity whose formula lives only in a measurer's context is one context reset away from being\n  unfalsifiable — which is exactly what happened here.\n- **Fix shape (doyle-approved):** move the done-push block to AFTER leg D, immediately ahead of\n  A's stop — one honest barrier made true, no second completion signal (a redundant pair is how\n  the next ordering bug lands after the SECOND one). `[int->REQ-REACH-1]` travels with the block.\n- **Cascade note, so a future triage does not count it:** in a1, twohost-b's gated-CLI red\n  (twohost_cli.rs:189, 910s) was the CASCADE — role-A's gated driver step SKIPPED after the\n  ladder death, so B waited for a row never produced. A red that postdates its carrier leg's\n  failure carries zero information about its own subject.\n- **Ripe when:** proving run at the next two-host window. **Size:** landed-sized already.\n\n### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\n- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\n  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\n  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\n  **v0.54.0** (USHER, merge `390204a3` et al.); attach-intent re-aim `37afa571` in **v0.55.0**).\n  Any later record citing these as \"authored-unlanded riders\" (the v0.63.0 FIELD-SEAL plan did,\n  carried forward from this ledger) is stale — this row is the correction. The #145 gate itself\n  CONCLUDED GREEN attempt 5, main ff'd, tested==merged · **Origin:** doyle, night of 2026-08-04,\n  run 30873007187 attempts 1-5.\n- **The record:** four reds, four DIFFERENT daemon-spawning tests, Windows leg only, Linux green\n  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\n  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\n  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\n  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\n  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\n  unjoined-thread gap between — predicts under-count only, matching all sightings; quiet-arm\n  control 40/40 PASS 0 leaky on a still box); a3 `brain_split::broker_survives_brain_kill…`\n  (\"supervisor did not respawn the brain\", 32.8s window burn; characterization queued); a4\n  `resume_no_control_steal_e2e::brain_respawn_keeps_every_session_controller…` — UNDER the\n  ruled quiesce-partial window with a measured-clean box, and its panic NAMED A MECHANISM ITS\n  OWN DATA CONTRADICTS (pre-authored Failure-A text; gained=[0,15,17] through ONE\n  resume_sessions while a steal displaces the SET; session 0 already 4x behind BEFORE the\n  window; the rig's child-liveness immunity was a COMMENT nothing measured). Every red\n  lane-independent by per-row delta test run fresh each time, never transferred.\n- **Instruments authored off it (all thin test/obs lanes off `11169c1`, compiled where stated;\n  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\n  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\n  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\n  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\n  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\n  authenticated child pin at t1 BEFORE teardown — read at assert time would convict the rig of\n  its own cleanup — three-way verdict PRECONDITION / measured-Failure-A-with-producer-story /\n  absent-producer-is-its-own-story); todlando `obs/resume-attach-intent` @`9c9e6c5`\n  — **a DEAD-PATH emit that never fired in production; removed 2026-08-04.** The\n  `RESUME_ATTACH_INTENT` breadcrumb sat in `resume_sessions`, which has had NO production\n  caller since `03c7109` (2026-07-09): the daemon's respawn path is `run_brain` ->\n  `resume_session_cursors`, cursor-only, no attach. Its absence from a field log therefore read\n  as \"no resume happened\" when it meant \"uncalled function\" — a clean-zero manufactory aimed at\n  the very #123 hunt it was built to serve. **Do not hunt for this token.** The instrument now\n  lives at the choosers the daemon actually executes, as `ATTACH_INTENT_CHOSEN` with a distinct\n  `site=` per chooser (`gap_resume` | `serve_request` | `shell_channel`), carrying the emit\n  discipline this one always had — intent bound once, logged and passed from that same binding,\n  wildcard-free label. No REQ, per the OBS-rider precedent.\n  - _Corrected 2026-08-04 (todlando, in the re-aim rider lane): this row previously described\n    the breadcrumb as a live instrument — \"intent bound once, logged and passed from the same\n    binding, per-call epoch makes set-vs-one readable off the log\". That sentence was true\n    about the emit's CONSTRUCTION and false about its REACH, and a reader consulting this\n    register during the #123 hunt would have been sent after a token that cannot fire.\n    Replaced rather than annotated, per the register's correction convention; the superseded\n    wording lives in git._\n- **Rulings that outlive the night:** a green retires NO intermittent row — grandchild and the\n  a4 row are INSTRUMENTED-AWAITING-FIRE, the next occurrence carries its own verdict; the\n  environmental family's leg 3 (runner off the fleet host) stays operator-ruled NON-OPTION\n  (\"stop proposing it\") — sightings accumulate in the family record, evidence files itself,\n  re-asking is direction; the quiesce-partial window is the sanctioned tool and it WORKED as a\n  discriminator (a4's red under quiesce is what forced the rig-soundness finding).\n- **Instrument notes minted on the way, cheap to lose:** (a) `gh run view --log` refuses for a\n  COMPLETED attempt while any later attempt is live (gates on the RUN) — recover per-job with\n  `gh api repos/<o>/<r>/actions/jobs/<id>/logs`; (b) a process-census RESIDENT COUNT is not\n  trendable (23→17→15 in 90s of inbox-poll CLI churn) — the CLASSIFICATION is the measurement,\n  the count is noise; (c) nextest's per-run LEAKY count is a free process-leakage series already\n  in every log (a1=12/a3=10/a4=13, and the multichunk row alone leaks 0/40 — the leaks are the\n  row's NEIGHBOURS); (d) diagnostic-token greps derive from the FAILING FRAME's own emit sites,\n  never from the register entry discussing the symptom — the gater's own\n  `REAP_JOB_TERMINATE_FAIL` zero over a path that emits `SERVICE_TREE_KILL_INCOMPLETE` was VOID,\n  and the emit sites document their own vocabulary (tree_kill_incomplete_line's doc names its\n  grep-partner); (e) **\"golden green ⇒ box free\" is FALSE — the ff-push that concludes a golden\n  STARTS the automatic post-merge ci run on the same box** (hertz, measured to the second:\n  Runner.Worker up 00:13:02 local = run 30886843672 job start 07:13:02Z, ~2min after the ff), so\n  the box empties after the POST-MERGE run, not after the golden; the box has a fourth actor no\n  agent steps off, woken by every main push (todlando's spelling), and post-golden sequencing\n  must gate on `gh run view --json jobs` of the post-merge run before any timing-sensitive work.\n- **Ripe when:** ~~instrument lanes land~~ (DONE, v0.54.0/v0.55.0); family sightings stay until\n  the family record closes them — the entry now waits on FIRES, not landings. **Size:** nothing\n  left to build; the next family sighting carries its own verdict via the landed instruments.\n- **LINUX-FACE SIGHTING + ITS RESOLUTION (doyle, v0.63.0 FIELD-SEAL goldens r1-r3 + proof runs,\n  2026-08-25 — the family's first measured MECHANISM, and it is environmental-amplifier ×\n  latent-test-defect, not a product fault):** three goldens, three DISTINCT kitsubito victims,\n  8/9 green each, victims migrating across same-sha reruns (r2/r3), every red a LONG death\n  (9.9s/59.4s/62.7s) of a fast cell — the family signature on the OTHER OS. Root-caused to ONE\n  window whose WIDTH varies with load: the brain's `spawn_session_pid` Spawned-wait\n  consumes-and-discards output racing ahead of the reply (KNOWN-HAZARDS 6.9, same-session face,\n  amended at `dbe3daad`); the broker execs the PTY child ~2ms BEFORE writing `Spawned`, so a\n  fast first chunk can be eaten. Under kitsubito's then-active kernel-audit backpressure\n  (see the kitsubito-audit entry below) the broker DISPATCH thread could stall arbitrarily in\n  that gap — the ~2ms window stretched to seconds, swallowing ANY marker prefix of ANY\n  spawn-wait test: random victims, long deaths, spawn-intensity × serialization scaling\n  (deployah's measured pair), migration across reruns. Box remediation narrowed the window back\n  to ~2ms, leaving exactly one knife-edge victim (a first-chunk needle, near-deterministic red,\n  62.7s natural-life death), fixed test-side in `dbe3daad` (v0.63.0's head). Full RCA + the\n  observer-effect instrument record: releases#225 comments 5417343026/5418844404.\n  **Standing lesson for the family:** an environmental slowdown is an accidental mitigation —\n  REMEDIATING a box can EXPOSE latent knife-edge races (the storm had hidden this one for\n  releases). And a \"random victim family\" should be tested against ONE window with\n  load-dependent width before positing per-victim mechanisms. The Windows face above remains\n  open on its own instruments; the two faces now have one shared candidate SHAPE (a race window\n  amplified by box load) with different windows.\n- **Status:** open · **Origin:** measured box event, HFENDULEAM 2026-08-04 ~05:00 local, during\n  USHER lane concurrency (hertz mechanism statement + both agents' reclaim arithmetic).\n- **What/why:** the box hit **0.00 bytes free** mid-build. Failure signatures it manufactured\n  look like toolchain or code defects, not disk: `rustc-LLVM ERROR: IO failure on output stream:\n  no space on device`, `LNK1318: Unexpected PDB error; LIMIT (12)`, `LNK1108: cannot write file`\n  — a red wearing a linker's face (doyle's U2 gate rig ate exactly this; verdict legs already\n  green survived, the suite leg had to be re-run). Contributions measured, not inferred: hertz\n  ~70 GB across four lane targets (er-seams **42.66 GB** cold `--workspace --tests`,\n  selection-probe 25.80, poolowner 1.03, ci-riders 0.91), doyle gate rig 15 GB cold full build.\n  Reclaim arithmetic reconciles both and neither alone: 0.00 → 25.47 GB (hertz reaps\n  selection-probe) → ~40 GB (doyle reaps rig). **The mechanism (hertz, ruled register-worthy):\n  every isolated lane worktree carries its OWN `target/`, so disk cost is multiplied by lane\n  count, while pool-claim — built to arbitrate a SHARED pool — sees none of it; a claim on\n  main's pool is ceremonial for a lane that never writes there. The tool we use to reason about\n  build-cache contention cannot see the resource that actually ran out.** Eight-plus worktrees\n  at 25–43 GB per cold full build is the shape of the next occurrence, and it will not announce\n  itself through pool-claim. Adjacent discipline failure the same night, named so the entry\n  carries it: a gater firing a cold full-workspace rig into a window with two live builder lanes\n  is the pre-flight question-1 failure (right-size the run) — targeted legs and warm pools\n  first.\n- **Remedy shape (sketch, not ruled):** (a) a box-level free-space floor as a RIG STEP at lane\n  start — the claim verb is the natural seat (print box free + du of known lane targets at\n  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\n  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\n  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\n  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\n  with sizes, so the sweep is one command instead of a du walk each agent re-derives.\n- **Ripe when:** next CI/rig-touching wave, or the next ENOSPC-signature red — whichever first.\n- **Size:** small-medium (claim-verb print + floor; census verb optional).\n- **Field addendum (2026-08-04 second event, same day filed — ripeness condition met):** the box\n  fell under the CI runner's 32 GiB free-space floor twice more (12:31 main @9d65e65 docs-only,\n  12:50 PR core#144 @b110bc8) while todlando's F-lane built. Both Windows unit legs REFUSED with\n  `RESOURCE=disk drive=C:\\ free_bytes=…` — the `REQ-CI-FREE-SPACE-PREFLIGHT` floor did exactly its\n  job: a docs-only main red named the resource instead of wearing a linker's face, and triage was\n  one log read instead of an RCA. That is the instrument's first field catch; the CI side of this\n  entry is PROVEN. The agent-lane side stays open: local trough measured 8.8 GB free mid-F-lane.\n  Reclaim, measured before/after per the teardown rule: doyle reaped gated u1+u2 lane targets\n  (POOL-OWNER claims verified own+dead-holder, inbound reparse sweep clean, worktrees kept)\n  8.8 → 59.5 GB (+50.7); hertz reaped er-seams target (pool-release first, same discipline)\n  59.46 → 101.16 GB (+42.66). Refined mechanism statement (hertz, this event): the disk floor is a\n  per-BOX resource our per-POOL instrument is structurally blind to — pool-claim answers a\n  question about contention that is not the question the box ran out of.\n- **AXIS ADDENDUM (deployah, golden 30928816784 / USHER `fc7fad1`, 2026-08-04) — one floor reading\n  is a SNAPSHOT, and the swing is bigger than the margin you fire on.** Two facts this entry's\n  remedy (a) has to be built against, both measured rather than reasoned:\n  (1) **A pre-fire PROCESS census cannot see the floor at all.** Mine came back clean minutes before\n  the run — zero test-path `spt.exe` residents, zero `cargo`/`rustc`/`link`/`cl` — and both Windows\n  legs then died in the disk preflight (`drive=C:\\ free_bytes=26099576832 floor_bytes=34359738368`,\n  `RESOURCE=disk`, exit 1) with a 128-line log carrying ZERO `Compiling`/`PASS`/`FAIL`/`Summary`\n  lines: no test signal, and the merge chain never indicted. Both readings were TRUE at the same\n  instant — the gater's finished assembly gates were sitting on disk as a DIRECTORY, not running as\n  a process. A process-axis probe is blind to a finished build's cost by construction; \"re-check\n  closer to the fire\" would have changed nothing, because the axis was never read.\n  (2) **The floor number itself moves by tens of GB inside one run window.** Same box, same drive,\n  same run, pulled from its own logs: `16:22:55` test-Windows free=26099576832 REFUSED · `16:23:07`\n  n1-gate-Windows free=26096607232 REFUSED · `16:46:54` twohost-a free=71033049088 PASSED and then\n  ran 11 minutes to success. ~45 GB returned with NO deliberate teardown, and my own reading at\n  17:13:45Z was 61352714240 — ~10 GB BELOW what twohost-a saw 27 minutes earlier. The observed swing\n  amplitude EXCEEDED the margin I was about to fire on (25.14 GiB).\n  So the rule remedy (a) must encode: measure BOTH axes (process residents AND free space against\n  the workflow's own 32 GiB floor), and reclaim until the margin exceeds the observed SWING, not one\n  sample. Triage corollary, equally load-bearing: twohost-a runs the same preflight on the same C:\n  and PASSED, so a preflight refusal is a threshold event on a moving number — never evidence the\n  box cannot run the work, and never by itself a reason to indict a merge chain.\n- **THIRD ADDENDUM (deployah, v0.54.0 cut, 2026-08-04) — the sweep answers \"0 B reclaimable\"\n  TRUTHFULLY on a box that cannot run its own work, because the reclaimable population and the\n  owned-lane population are DISJOINT.** This hazard blocked a release twice before it was seen.\n  Both Windows legs at the shipped sha `86f0d84` refused at the guard before compiling anything —\n  `ci.yml` at `free_bytes=28167569408` (26.2 GiB) and `release.yml` at `27690885120` (25.8 GiB),\n  both against `floor_bytes=34359738368`. `assemble` skipped in consequence, so no draft release\n  existed: the release was hard-blocked on disk, not on code. Neither leg produced a test verdict,\n  so both are LABELLED HOLES, not reds (ruled recorded-and-proceed by doyle, the shipped-sha delta\n  being 5 files and zero `.rs`).\n  **The finding is not the disk.** `xtask pool-sweep --root .worktrees` reported, correctly,\n  `total 66.43 GB across 3 pool(s); 0 B reclaimable in this sweep's scope` while the box sat ~6 GB\n  under its own floor. The sweep is behaving as designed — it refuses to reap owned, live lanes.\n  But the floor reasons over an AGGREGATE the sweep is forbidden to touch, so the designed\n  instrument, run at the exact moment of refusal, tells an operator there is nothing to reclaim.\n  That is true and useless. The gap between \"the sweep is correct\" and \"the box can run work\" is\n  the defect; it is not fixed by making the sweep more aggressive.\n  **Aggregate measured under `.worktrees`** (real target bytes, junction-classified first): 87.79 GB\n  across 9 lanes — 2.7x the entire 32 GiB floor. Registered pools: `w1t2-relink-force` 54.67 GB,\n  `obs-resume-attach-intent` 10.18, `w1t2-subnet-status` 1.58. Carrying targets the sweep does not\n  count as claimed pools: `hertz-teardown-bound` 11.25, `hertz-liveresolve-diag` 4.83,\n  `hertz-psyche-bound` 4.19, `hertz-poolowner` 1.03, `hertz-ci-riders` 0.91.\n  **The 54.67 GB single lane is NOT waste** (doyle's classification, ratified at this filing): a\n  verb lane at that size is workspace-all-targets e2e cost. No lane is misbehaving. That is what\n  makes this structural rather than a cleanup task — every lane is individually justified and the\n  sum still exceeds the floor.\n  **Reclaim taken, and its boundary.** 82.12 GB, from `spt-core/target` — the release driver's OWN\n  main-checkout pool, NOT a lane; free 23.23 → 105.34 GB. Classified before removal per the\n  teardown rule: OUTBOUND `Get-Item -Force` reported a real directory rather than a reparse point,\n  the INBOUND sweep found zero reparse points aimed at it, `CARGO_TARGET_DIR` was unset (no env\n  aliasing), the target SUBTREE only was reaped, both sides measured.\n  **Snapshot behavior reproduced inside this measurement window**, corroborating the axis addendum\n  above at a smaller amplitude: free read 25.49 GB when first measured and 23.23 GB at the reap\n  minutes later — it drifted 2.26 GB DOWNWARD while the operator was deciding what to do about it.\n  **Priced side effect, for the next reader:** reaping the main pool took the prebuilt `xtask` with\n  it, so the next lane claim rebuilds it first — the lane-check shortcut is cold until then. It cost\n  a 2m11s cold rebuild inside this release's own publish step.\n  **What this does NOT license:** reaping another agent's owned lane to clear a floor. The sweep's\n  refusal is correct and stays. What is missing is an AGGREGATE-AWARE signal — the box knowing its\n  lanes sum past the floor *before* a run is dispatched into a guard that will decline it.\n- **FOURTH ADDENDUM (doyle, 2026-08-04 late evening — fourth event in one day, and the first\n  RULING on this entry).** C: hit **0.44 GB free** during doyle's lane-2 stack gate and todlando's\n  re-aim leg set. Signatures manufactured this time, all initially read as something else:\n  `os error 112` mid-rlib-archive surfacing as xtask \"building spt failed\" (exit 101); a\n  servicehost force-kill unit red at a sha gated GREEN on the same rig an hour earlier; todlando's\n  6-of-7 leg table red with `LNK1318` while only traceable-reqs survived. Both agents' verdicts\n  from the window were VOIDED and re-run, not re-read.\n  **Discriminator correction (hertz, ratified at this filing):** \"treqs alone survives\" is a\n  POSITIVE TELL, never a clearing test — a full disk reds BEFORE any link step (rustc writing\n  rlibs), and treqs can red for its own reasons; signature absence says NOTHING. The only\n  falsifier for \"this red was the disk\" is free space AT RUN TIME, and no log on the box recorded\n  it, which made every red from the window unanswerable after the fact.\n  **RULING (doyle):** every rig/gate script records `FREE-AT-START` / `FREE-AT-END` in its own\n  SUMMARY — one line each, the datum that makes a disk confound answerable post-hoc. Effective\n  immediately for hand-authored rigs; hertz builds it into the shared rig harness at next touch\n  (assigned, not unasked). This is remedy (a) narrowed to its cheapest load-bearing slice.\n  **Reclaim, all FS-delta-measured:** todlando +59.4 GB (obs-resume-attach-intent 8.56 +\n  w1t2-relink-force 50.83; 0.44 → 59.83), hertz +1.79 GB (ci-riders + poolowner; sum-of-lengths\n  said 1.94, the FS delta governs; 59.09 → 60.87), doyle +38.8 GB (w1t2-subnet-status +\n  w1t2-perch-gc + w1t3-node-verb targets; 60.75 → 99.54). Full discipline each: outbound\n  classification, inbound reparse sweep (zero), CARGO_TARGET_DIR confirmed unset, subtree-only.\n  **Mechanism sharpened by this event:** the standing swing IS the finished-lane population —\n  ~110 GB of pools belonging to lanes already GATED AND PUSHED, held for hours because disposal\n  fires at GATE close (a rig step) while nothing fires at LANE finish; a pushed lane awaiting\n  assembly holds its pool invisibly. Corollary corrections carried: todlando withdrew his\n  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\n  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\n  class recurring, left for retry rather than forced.\n\n- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\n  CONSEQUENCE: reaping a pool UNCLAIMS its tree, and the next builder meets a refusal that is the\n  rule working.** (The disk-floor mechanism from the same event is doyle's to file at his\n  release-close sweep — one voice each, by division agreed in-window. This addendum stops at the\n  pool-claim consequence and deliberately does not restate the floor finding.)\n  Five FIELD-SEAL lane pools were reaped to clear the golden floor — gate rig `gate-222-ca30a79e`\n  plus lanes `fix-222`, `w2-seal-ux`, `w3-ingest`, `w4-exit-subject`; **148.48 GB measured by FS\n  delta**, free 1.37 → 149.84 GB, worktree checkouts kept, `main/target` untouched by ruling.\n  **The consequence to record:** `POOL-OWNER.json` lives INSIDE `target/`, so reaping the subtree\n  takes the claim with it. Those five trees are now **UNCLAIMED — which is fresh-not-foreign**, a\n  different state from the `SPT_POOL_FOREIGN` refusal. Whoever resumes one of those lanes (a hertz\n  fixup, a golden-red rebuild) must run `cargo run -p xtask -- pool-claim --pool <dir> --label\n  <lane>` **from that worktree** before the first build, or `crates/spt-store/build.rs` refuses.\n  **A refusal there is the rule working, not a defect** — filed precisely so a later reader does\n  not open an issue against the build script for behaving correctly. Naming it costs one line;\n  the alternative is an RCA against our own guard.\n  **Prediction-vs-meter, corroborating hertz's fourth-addendum note at ~75x its scale:** pre-reap\n  sum-of-lengths sizing predicted 163.9 GB; the FS delta paid 148.48 GB, a 15.4 GB shortfall left\n  UNEXPLAINED here rather than rationalized (allocation granularity, sparse/compressed extents and\n  concurrent writes all sit between the two meters). **The FS delta governs** — hertz ruled this at\n  1.94-vs-actual and it holds at three digits. Report the meter, never the estimate that agreed\n  with your plan.\n  **Discipline executed, for the audit trail:** outbound classification re-read AT REAP TIME (all\n  five real dirs, zero LinkType); inbound sweep over **2854** reparse points under `projects\\`\n  found zero aimed at any victim; `CARGO_TARGET_DIR` confirmed empty in process, **Machine and\n  User** scope (the arm that leaves no directory entry to notice afterwards); process census\n  RE-RUN at reap time rather than carried from a peer's snapshot — zero builders, zero processes\n  imaged out of a victim pool, both live `spt` images resolving to the installed path. The peer's\n  snapshot proved correct; it was re-run because a snapshot is not a standing property, which is\n  the reason it was offered with that caveat.\n\n### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\n- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\n  the builder to the gater deliberately — register shape is doyle's to own.\n- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\n  code, empty stdout, non-fatal to the generator), `cargo run -p xtask -- gen` wrote\n  `docs-site/src/cli/reference.md` reduced to EIGHT lines — title, do-not-edit banner, empty code\n  fence — deleting 3193 lines of published CLI reference. `xtask check` then exited 0, because\n  the drift gate compares what the binary emits NOW against what the file holds, and gen had just\n  overwritten the file with exactly that emit. **A producer that emits nothing agrees with itself\n  perfectly.** Caught only because the builder grepped the regenerated page for his new flag\n  names and treated the clean zero as suspicious ([[zero-match-filter-reads-as-absent]] shape);\n  the gate itself would never have said a word, and the gutted public reference ships green.\n  The mechanism generalizes past the stack overflow that exposed it: ANY failure mode that makes\n  `spt --help` produce empty stdout while exiting non-fatally to the generator gets the same\n  green. Kin to [[cli-command-docs-drift]] (the gate this defeats) — the gate detects DRIFT\n  between binary and page, and is structurally blind to a page just regenerated from a broken\n  binary.\n- **Remedy shape (builder's sketch, sound; not yet ruled on seat):** a floor in `xtask gen` —\n  refuse to write a page whose help block is empty, or whose output is implausibly shorter than\n  the file it replaces — so the generator fails loudly instead of producing a stub the gate\n  blesses. Gen is the right seat: check runs in CI on a fresh emit too, so a check-side floor\n  alone still lets a local gen gut the working tree.\n- **Ripe when:** next docs-tooling or xtask-touching lane; SOONER if any lane regenerates the CLI\n  reference before the floor exists (a gate on that lane must assert page LENGTH, not gen's exit\n  code, until this is built).\n- **Size:** small (one refusal + a length-plausibility floor in gen).\n\n### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\n- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\n- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\n  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\n  (`spt --version` included) died with `thread 'main' has overflowed its stack`, exit\n  -1073741571, before reaching any of its own code. Delta-tested, not assumed: the same command\n  on the main-pool binary from main printed normally. U1 repaired its own trigger (raw-argv\n  pre-scan for retired flags before clap parses; lane ends net +2 args) — but the CEILING\n  remains: the tree is now close enough that a handful of net new arguments in a debug build\n  reproduce a total binary outage — **and the handful is THREE, not six; see the correction\n  below before planning against this entry.** **#5's verb-surface rework is the next lane that adds\n  arguments and it is much bigger than U1** — this entry exists so #5 is planned knowing the\n  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\n  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\n- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\n  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\n  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\n  difference is the difference between \"plan carefully\" and \"one flag anywhere takes the binary\n  down\". N hidden bool args added to the ROOT `Cli` derive, tree restored from git between every\n  row, `--version` as the invocation (it carries no work of its own, so whatever it costs IS tree\n  construction):\n\n      N=0  exit 0                OK  (control — unmodified lane binary answers `spt 0.53.0`)\n      N=1  exit 0                OK\n      N=2  exit 0                OK\n      N=3  exit -1073741571      STACK-OVERFLOW\n      N=4 / N=6 / N=8            STACK-OVERFLOW\n\n  PLACEMENT DIFFERENTIAL, run because #5 adds args at `EndpointCmd` seats rather than at the root\n  and a root-only number could have measured the wrong thing: same N injected inside a NESTED\n  endpoint seat gives `SEAT N=2` OK, `SEAT N=3` STACK-OVERFLOW. **Identical ceiling — placement does\n  not move it**, so three is the number for the shape #5 actually builds. (Rig hazard worth keeping:\n  the first seat attempt produced a COMPILE error, E0027, because the dispatch destructures that\n  variant exhaustively — taken at face value it would have read as \"the seat is fine\". Both rows\n  above are from the fixed rig.) CONSEQUENCE FOR #5: the ratified MIN spelling ends net +2, i.e. it\n  would have shipped with ONE argument of headroom, and any later lane adding a single flag anywhere\n  in the tree would then take the whole binary down, `--version` included. Remedy (b) below stops\n  being \"buys headroom\" and becomes the precondition for #5 shipping safely.\n- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\n  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\n  (b) raise the main thread stack for the binary (build config), buying headroom without\n  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\n  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\n  where the ceiling sits before choosing.\n- **Ripe when:** #5 (U3 verb surface) PLANNING — this is a planning input, not just a build item;\n  the smoke tooth (a) is ripe for the next CI-touching lane regardless.\n- **Size:** small for (a); medium for (b)/(c) with the measurement.\n\n### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\n- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\n  characterized same day by hertz from retained logs, ownership falsified by todlando.\n- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\n  ADR-0041 zombie-detection fixture, whose subject is a corpse process kept alive-looking by a HELD\n  HANDLE) flags nextest LEAK on most draws but not all — measured 19 LEAK of 20 on a tree carrying\n  no #142 content (`test/grandchild-selection-probe` @`695398b`, based on `4b37512`: lib arm 10/10\n  LEAK across 822-test runs; full-suite arm 9/10 across 1044-test runs). The single clean PASS\n  kills \"intrinsic therefore always\": leakiness is DOMINANT BUT INTERMITTENT. Consequences:\n  (1) a gate or reader that treats this row's LEAK as a defect signal flaps at roughly 1 in 20;\n  (2) one non-leaky run is NEVER evidence that something fixed it (kin:\n  [[intermittent-green-is-zero-information]]); (3) the verdict method that closed it is the\n  template — two independent legs, neither load-bearing alone: the suspect lane's diff grepped\n  zero hits on the row's subject (zombie / handle_held / OpenProcess / corpse), AND a 20-draw\n  baseline on a tree predating the suspect change. This entry exists so the next gater who sees\n  the flag reads one register line instead of running that RCA cold.\n- **Remedy shape (sketch, not ruled):** annotate the row as expected-leak in nextest config\n  (per-test `leak-timeout` override or documented allowlist) so the flag stops presenting as\n  signal; alternatively a fixture-side close of the held handle on the clean path if ADR-0041's\n  arrangement permits — hertz's call, test/CI lane.\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\n- **Size:** small.\n\n### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\n- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\n- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\n  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\n  `started_at` and carried conclusion, so a carried failure is the SAME observation; dedupe before\n  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\n  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\n  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\n  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\n  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\n  closed.**\n- **The family:** 11 victim legs, 8 distinct tests, ONE cluster — process teardown / kill-reach /\n  respawn-controller survival, concentrated on hfenduleam. Per-victim dispositions live in the USHER\n  #150 triage ledger (releases#150 record). The only surviving cross-sha EXACT repeat after source\n  verification is `resume_no_control_steal_e2e` (:488, byte-identical @2138b16 + @4b37512) — and\n  both its reds PREDATE the post-#145 producer-side instrumentation, so what repeats is an AMBIGUOUS\n  observation (stolen controller vs starved child) twice; only a post-#145 red discriminates. The\n  `a_tree_teardown` pair was a FALSE repeat — two mechanisms wearing one assert string (see\n  FLAKE-LEDGER row; the counting lesson: assert-body identity must include the polled predicate's\n  SUBJECT).\n- **Off-CI discriminator (todlando 2026-08-04):** 0/400 (A 0/200 + B 0/200, interleaved,\n  `--test-threads 1`, filters positive-controlled, by-path sweeps every iteration) on the warm\n  d449ce5 pool UNDER live-fleet load (CPU 46-59%, 13-18 spt processes). Points the family at the\n  RUNNER ENVIRONMENT rather than a product race any Windows box expresses — not exoneration (absence\n  of reproduction is not proof of absence), but where the next hour goes. A-alone N=500 on the\n  instrumented tree ran post-close (result on releases#150).\n- **Remedy lanes already moving:** hertz 4-item test-rework package dispatched 2026-08-04 (psyche\n  bound split, live_resolve rig instrumentation, green-capture probe profile, resident_service/\n  teardown hardening); prod `wait_bounded` tree-kill-on-timeout filed to board as EVAL. This entry\n  is the RATE's home — it leaves the register when the operator has ruled on the rate (accept vs\n  hold-for-hertz) AND the hertz package has landed with a re-measured victim rate.\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\n- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\n- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\n\n### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\n  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\n  item-2 sweep ruling; doyle ruled file-don't-sweep.\n- **What/why:** 51 `fn output_bounded` definitions under `crates/spt/tests` — 50 per-file copies\n  plus `tests/common/mod.rs:53`, which is NOT pub, has ZERO callers outside its own module, and\n  whose doc comment states outright that the estate's copies predate the shared module. The lossy\n  timeout arm (panic loses everything captured, names nothing) is in 38 sites across 36 files.\n  The copies have already drifted: two variants of the deadline expect-string exist in the estate\n  (`\"captured spt call must complete within its deadline\"` in common/mod.rs:60 vs the\n  no-deadline-clause spelling in per-file copies), so a grep keyed to either string undercounts.\n  The right fix is a hoist-and-delete refactor (make the common copy pub, adopt it estate-wide,\n  carry the item-2 diagnostic arm once) — a 50-file test-estate touch that must NOT ride golden\n  cadence as a rider or hide inside a scoped diagnostics item (ADR-0050 thin-lane rationale;\n  hertz's USHER item 2 stays scoped to live_resolve, which keeps ONE improved copy as the model).\n- **Built evidence:** one public owning helper replaced all 50 file-local\n  clones. It owns and tree-kills a timed-out child, waits for reap, drains both\n  pipes, and includes the deadline plus partial stdout/stderr in the panic.\n  A dedicated regression observes both diagnostics and proves the timed-out PID\n  is gone.\n- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\n  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\n- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\n- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\n  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\n  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\n  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\n  rides the same lane.\n- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\n  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\n  timeout, drains both pipes, and reports partial stdout/stderr. `bounded_output_e2e` mutation-pins\n  both timeout ownership and retained diagnostics.\n- **Declared validation extra:** the lane's docs-link gate exposed that `llms_target_exists` treated\n  generated targets as absent before generation. Its small refactor + unit keeps source and\n  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\n\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\n…\n  EXIT=0 on BOTH sides — the green he had cited beside the fix validated nothing.\n…\n\n\n[Showing lines 1696-2243 of 5781. Use :2244 to continue]"}],"details":{"truncation":{"content":"\r\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\r\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\r\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\r\n- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\r\n  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\r\n  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\r\n  Measured on this box: reaping `golden-render` and `w4-cli-doc` the obvious way would have reclaimed\r\n  ~26 MB of worktree and stranded **14.17 GB** of pool (`gate-target-render` 6,265,448,382 B +\r\n  `gate-target-w4doc` 7,907,558,098 B). Neither pool appears in any worktree listing.\r\n- **The second shape, same mechanism, already realised:** `.worktrees\\gate-target` was found at\r\n  **0 files / 0 bytes with FOUR live inbound junctions** (assembly-doorbell, doorbell-w1/w2/w3). Someone\r\n  had already reaped that pool and left four dangling-but-valid links behind. So the defect runs both\r\n  ways: remove the worktree and the pool is orphaned; remove the pool and the links are orphaned.\r\n  Either half alone leaves a lie on disk.\r\n- **Why it is not just \"be careful\":** the classification step people already know\r\n  (`Get-Item -Force` OUTBOUND, INBOUND reparse sweep) tells you HOW to delete an object you have\r\n  already decided to delete. It does not tell you that a second object exists. The missing thing is an\r\n  enumeration that reaches pools no worktree names.\r\n- **Remedy shape (CORRECTED by builder retraction, 2026-08-04 — the enumeration already exists and\r\n  shipped):** `xtask pool-sweep` (`c6515f1`, `REQ-POOL-GC-ORPHAN-RECLAIM`, ancestor of `b7b00c3` by\r\n  merge-base) walks the root for dirs AND links, counts inbound links over the whole sweep before\r\n  forming a verdict, classifies InUse/Owned/Orphaned, and reaps orphans on `--reap`. The gap is not\r\n  detection, it is TIMING: a junction-pooled tree's pool is `Owned` and not reclaimable right up to\r\n  the moment its worktree is removed, and `Orphaned` only after — so the reclaim always lands in a\r\n  LATER sweep, and nothing triggers one. `gate-target` (0 bytes, four dangling inbound links) is a\r\n  completed instance of that deferral. Remedy is a post-teardown pass or a teardown that runs the\r\n  sweep itself, not new enumeration. (An earlier draft of this entry proposed building the\r\n  enumeration; retracted by its author before ripening — the tool refuting it was one run away.)\r\n- **Ripe when:** next CI/infra batch. **Size:** small (one enumeration + report, no new policy).\r\n- **Discipline this cost, stated so it is not re-learned:** teardown must be TWO EXPLICIT STEPS per\r\n  junction-pooled tree — junction deleted AS A LINK (`Directory.Delete(path, recursive: false)`), then\r\n  the pool AS A TREE after an inbound sweep confirms it is linkless. Executed that way on 2026-08-04:\r\n  28 worktrees, 4 pools, 0 skipped, 0 pinned, 17.04 GiB measured on a box with concurrent writers.\r\n\r\n### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\r\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\r\n  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\r\n- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\r\n  wave-gap rider that rode the commit range but was never LOCKSMITH scope) while the alchemy release\r\n  verb promoted #125 to DONE and named it publicly as shipped — two published surfaces contradicting\r\n  each other until the post-publish docs-only repair (`9841592`). The rule was already right (the\r\n  runbook audits the changelog against the COMMIT RANGE); the EXECUTION missed it, because a notes\r\n  pass written from the milestone narrative never enumerates the range. The mechanism, not the\r\n  incident: any rider is board-visible and narrative-invisible.\r\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now requires a mechanical `vPREV..HEAD`\r\n  user-facing commit list, a changelog match beside every row, and an explicit accounting of every\r\n  unmatched row before the golden run. The repair precedent remains docs-only amend +\r\n  `gh release edit`, never retag. PR #176 passed `traceable-reqs check`.\r\n\r\n### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\r\n- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\r\n  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\r\n  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\r\n  owed and rides the same window as #145's closed-subnet knock row) · **Origin:** golden\r\n  30873007187 attempt 1 red, doyle timeline triage + hertz source diagnosis 2026-08-04.\r\n- **SECOND FACE, measured 2026-08-24 (WAX-SEAL #21 W3 gate climb @ 035c3fe6, doyle):** the class\r\n  recurs on a NEW rung, and this face is UNWINNABLE rather than racy. The W3 seal rung S1 mints\r\n  on A ~0.3s before A's ladder completes (mint mono 80843ms, ladder end ~81150ms, walked from\r\n  the capture), while the seal pump worker's cadence is 500ms — the pusher exits before its\r\n  first eligible post-mint tick, so ZERO feed pushes ever fire (both logs hold zero seal-feed\r\n  lines) and role B burns its full 900s window on \"seal: A's record replicated into B's store\".\r\n  Full-re-presentation heals only while a pump is RESIDENT; the rig kills it. Product not\r\n  implicated (local legs + design review all green at the sha). Dispatched to hertz 2026-08-24\r\n  with two fix shapes (mint early with ~120 ticks of resident-pump margin, or a\r\n  reverse-confirmation barrier on A's done-push); the climb re-runs on his fix. Lesson for\r\n  future rungs, stated as construction: a rung whose delivery is CADENCED must not sit inside\r\n  the terminal margin of the process that pushes it.\r\n- **Mechanism (hertz falsified the gater's first spelling, kept because the correction is the\r\n  entry):** NOT \"B exits early\" and NOT a missing barrier. B's contract (twohost.rs:1116-1121,\r\n  \"hold until A finishes its side — done-file as the ladder's completion barrier\") is right and B\r\n  obeys it. A BREAKS it: A pushes done.txt (:1819-1832, payload literally \"ladder complete on A\")\r\n  then runs the ENTIRE leg-D digest rung including the re-pull assert (:1959) before its own\r\n  `stop.store` (:1966). B tears down exactly when A said it could; the re-pull then races B's\r\n  post-signal teardown. The panic's hint text (\"may be running a version without cross-node\r\n  digest\") is pre-authored and was NOT evidence of version skew.\r\n- **Margin series, six draws of one race (deployah, markers cited by TEXT and positive-controlled\r\n  against a known draw before producing an unknown one):** golden 30860770146 +60s · a1 −0.6s\r\n  (the RED) · a2 +59.4s · a3 +60s · a4 +59.59s · a5 +63.89s. BIMODAL, not drifting: greens\r\n  cluster within seconds, one collapse through zero. A green does not mean the window got safer;\r\n  sample count characterizes a bimodal race, not margin size — the slack is incidental, not\r\n  designed. Local load on hfenduleam during A's leg D eats the margin directly (role A runs\r\n  there; the done-file is already pushed), which is why builds hold through twohost legs.\r\n- **⚠ THE SERIES IS CLOSED AT SIX DRAWS — ITS DERIVATION IS UNRECOVERABLE, AND NO SEVENTH NUMBER\r\n  MAY BE ADDED (ruled by doyle 2026-08-05, at the tranche-2 golden).** Asked to extend it with a\r\n  draw from run 30971976024, deployah positive-controlled the markers FIRST and the control\r\n  REFUSED: grepping `margin|deadline|serve window|slack|headroom|budget` against a control run\r\n  known to carry good twohost evidence (30940180764) returned ZERO. Source confirms it —\r\n  **`margin` is not an emitted token anywhere**: absent from `.github/workflows/golden.yml`, and\r\n  every `crates/` hit is unrelated (terminal right-margins in broker/resize tests,\r\n  `ROUND_DRAIN_MARGIN` in `pump/mod.rs`). So the six figures were DERIVED from log timestamps\r\n  against a bound that was never written down, by a measurer whose context has since been cleared;\r\n  the gater who recorded them never held the formula either. **Consequence, stated so nobody\r\n  re-derives it:** any new figure computed from these logs would be a DIFFERENT quantity wearing\r\n  the same name, and would enter a series whose value is its bimodality — the one structure a\r\n  mismatched sample corrupts invisibly. This run therefore gets a LABELLED HOLE, not a number.\r\n  What IS reportable for it, with endpoints named rather than a name reused: **ladder span**, node\r\n  start → `TWOHOST role B: ladder complete` = **183.50s** on the batch vs **259.21s** on the\r\n  control. Marker parity established under an IDENTICAL expression on both sides (25 = 25, after a\r\n  first pass that compared two different greps and would have read as parity by coincidence).\r\n- **The fix this makes obvious:** the twohost margin must become an EMITTED token with its two\r\n  events named at the emit site, so the next draw is read rather than reconstructed. A derived\r\n  quantity whose formula lives only in a measurer's context is one context reset away from being\r\n  unfalsifiable — which is exactly what happened here.\r\n- **Fix shape (doyle-approved):** move the done-push block to AFTER leg D, immediately ahead of\r\n  A's stop — one honest barrier made true, no second completion signal (a redundant pair is how\r\n  the next ordering bug lands after the SECOND one). `[int->REQ-REACH-1]` travels with the block.\r\n- **Cascade note, so a future triage does not count it:** in a1, twohost-b's gated-CLI red\r\n  (twohost_cli.rs:189, 910s) was the CASCADE — role-A's gated driver step SKIPPED after the\r\n  ladder death, so B waited for a row never produced. A red that postdates its carrier leg's\r\n  failure carries zero information about its own subject.\r\n- **Ripe when:** proving run at the next two-host window. **Size:** landed-sized already.\r\n\r\n### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\r\n- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\r\n  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\r\n  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\r\n  **v0.54.0** (USHER, merge `390204a3` et al.); attach-intent re-aim `37afa571` in **v0.55.0**).\r\n  Any later record citing these as \"authored-unlanded riders\" (the v0.63.0 FIELD-SEAL plan did,\r\n  carried forward from this ledger) is stale — this row is the correction. The #145 gate itself\r\n  CONCLUDED GREEN attempt 5, main ff'd, tested==merged · **Origin:** doyle, night of 2026-08-04,\r\n  run 30873007187 attempts 1-5.\r\n- **The record:** four reds, four DIFFERENT daemon-spawning tests, Windows leg only, Linux green\r\n  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\r\n  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\r\n  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\r\n  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\r\n  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\r\n  unjoined-thread gap between — predicts under-count only, matching all sightings; quiet-arm\r\n  control 40/40 PASS 0 leaky on a still box); a3 `brain_split::broker_survives_brain_kill…`\r\n  (\"supervisor did not respawn the brain\", 32.8s window burn; characterization queued); a4\r\n  `resume_no_control_steal_e2e::brain_respawn_keeps_every_session_controller…` — UNDER the\r\n  ruled quiesce-partial window with a measured-clean box, and its panic NAMED A MECHANISM ITS\r\n  OWN DATA CONTRADICTS (pre-authored Failure-A text; gained=[0,15,17] through ONE\r\n  resume_sessions while a steal displaces the SET; session 0 already 4x behind BEFORE the\r\n  window; the rig's child-liveness immunity was a COMMENT nothing measured). Every red\r\n  lane-independent by per-row delta test run fresh each time, never transferred.\r\n- **Instruments authored off it (all thin test/obs lanes off `11169c1`, compiled where stated;\r\n  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\r\n  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\r\n  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\r\n  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\r\n  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\r\n  authenticated child pin at t1 BEFORE teardown — read at assert time would convict the rig of\r\n  its own cleanup — three-way verdict PRECONDITION / measured-Failure-A-with-producer-story /\r\n  absent-producer-is-its-own-story); todlando `obs/resume-attach-intent` @`9c9e6c5`\r\n  — **a DEAD-PATH emit that never fired in production; removed 2026-08-04.** The\r\n  `RESUME_ATTACH_INTENT` breadcrumb sat in `resume_sessions`, which has had NO production\r\n  caller since `03c7109` (2026-07-09): the daemon's respawn path is `run_brain` ->\r\n  `resume_session_cursors`, cursor-only, no attach. Its absence from a field log therefore read\r\n  as \"no resume happened\" when it meant \"uncalled function\" — a clean-zero manufactory aimed at\r\n  the very #123 hunt it was built to serve. **Do not hunt for this token.** The instrument now\r\n  lives at the choosers the daemon actually executes, as `ATTACH_INTENT_CHOSEN` with a distinct\r\n  `site=` per chooser (`gap_resume` | `serve_request` | `shell_channel`), carrying the emit\r\n  discipline this one always had — intent bound once, logged and passed from that same binding,\r\n  wildcard-free label. No REQ, per the OBS-rider precedent.\r\n  - _Corrected 2026-08-04 (todlando, in the re-aim rider lane): this row previously described\r\n    the breadcrumb as a live instrument — \"intent bound once, logged and passed from the same\r\n    binding, per-call epoch makes set-vs-one readable off the log\". That sentence was true\r\n    about the emit's CONSTRUCTION and false about its REACH, and a reader consulting this\r\n    register during the #123 hunt would have been sent after a token that cannot fire.\r\n    Replaced rather than annotated, per the register's correction convention; the superseded\r\n    wording lives in git._\r\n- **Rulings that outlive the night:** a green retires NO intermittent row — grandchild and the\r\n  a4 row are INSTRUMENTED-AWAITING-FIRE, the next occurrence carries its own verdict; the\r\n  environmental family's leg 3 (runner off the fleet host) stays operator-ruled NON-OPTION\r\n  (\"stop proposing it\") — sightings accumulate in the family record, evidence files itself,\r\n  re-asking is direction; the quiesce-partial window is the sanctioned tool and it WORKED as a\r\n  discriminator (a4's red under quiesce is what forced the rig-soundness finding).\r\n- **Instrument notes minted on the way, cheap to lose:** (a) `gh run view --log` refuses for a\r\n  COMPLETED attempt while any later attempt is live (gates on the RUN) — recover per-job with\r\n  `gh api repos/<o>/<r>/actions/jobs/<id>/logs`; (b) a process-census RESIDENT COUNT is not\r\n  trendable (23→17→15 in 90s of inbox-poll CLI churn) — the CLASSIFICATION is the measurement,\r\n  the count is noise; (c) nextest's per-run LEAKY count is a free process-leakage series already\r\n  in every log (a1=12/a3=10/a4=13, and the multichunk row alone leaks 0/40 — the leaks are the\r\n  row's NEIGHBOURS); (d) diagnostic-token greps derive from the FAILING FRAME's own emit sites,\r\n  never from the register entry discussing the symptom — the gater's own\r\n  `REAP_JOB_TERMINATE_FAIL` zero over a path that emits `SERVICE_TREE_KILL_INCOMPLETE` was VOID,\r\n  and the emit sites document their own vocabulary (tree_kill_incomplete_line's doc names its\r\n  grep-partner); (e) **\"golden green ⇒ box free\" is FALSE — the ff-push that concludes a golden\r\n  STARTS the automatic post-merge ci run on the same box** (hertz, measured to the second:\r\n  Runner.Worker up 00:13:02 local = run 30886843672 job start 07:13:02Z, ~2min after the ff), so\r\n  the box empties after the POST-MERGE run, not after the golden; the box has a fourth actor no\r\n  agent steps off, woken by every main push (todlando's spelling), and post-golden sequencing\r\n  must gate on `gh run view --json jobs` of the post-merge run before any timing-sensitive work.\r\n- **Ripe when:** ~~instrument lanes land~~ (DONE, v0.54.0/v0.55.0); family sightings stay until\r\n  the family record closes them — the entry now waits on FIRES, not landings. **Size:** nothing\r\n  left to build; the next family sighting carries its own verdict via the landed instruments.\r\n- **LINUX-FACE SIGHTING + ITS RESOLUTION (doyle, v0.63.0 FIELD-SEAL goldens r1-r3 + proof runs,\r\n  2026-08-25 — the family's first measured MECHANISM, and it is environmental-amplifier ×\r\n  latent-test-defect, not a product fault):** three goldens, three DISTINCT kitsubito victims,\r\n  8/9 green each, victims migrating across same-sha reruns (r2/r3), every red a LONG death\r\n  (9.9s/59.4s/62.7s) of a fast cell — the family signature on the OTHER OS. Root-caused to ONE\r\n  window whose WIDTH varies with load: the brain's `spawn_session_pid` Spawned-wait\r\n  consumes-and-discards output racing ahead of the reply (KNOWN-HAZARDS 6.9, same-session face,\r\n  amended at `dbe3daad`); the broker execs the PTY child ~2ms BEFORE writing `Spawned`, so a\r\n  fast first chunk can be eaten. Under kitsubito's then-active kernel-audit backpressure\r\n  (see the kitsubito-audit entry below) the broker DISPATCH thread could stall arbitrarily in\r\n  that gap — the ~2ms window stretched to seconds, swallowing ANY marker prefix of ANY\r\n  spawn-wait test: random victims, long deaths, spawn-intensity × serialization scaling\r\n  (deployah's measured pair), migration across reruns. Box remediation narrowed the window back\r\n  to ~2ms, leaving exactly one knife-edge victim (a first-chunk needle, near-deterministic red,\r\n  62.7s natural-life death), fixed test-side in `dbe3daad` (v0.63.0's head). Full RCA + the\r\n  observer-effect instrument record: releases#225 comments 5417343026/5418844404.\r\n  **Standing lesson for the family:** an environmental slowdown is an accidental mitigation —\r\n  REMEDIATING a box can EXPOSE latent knife-edge races (the storm had hidden this one for\r\n  releases). And a \"random victim family\" should be tested against ONE window with\r\n  load-dependent width before positing per-victim mechanisms. The Windows face above remains\r\n  open on its own instruments; the two faces now have one shared candidate SHAPE (a race window\r\n  amplified by box load) with different windows.\r\n- **Status:** open · **Origin:** measured box event, HFENDULEAM 2026-08-04 ~05:00 local, during\r\n  USHER lane concurrency (hertz mechanism statement + both agents' reclaim arithmetic).\r\n- **What/why:** the box hit **0.00 bytes free** mid-build. Failure signatures it manufactured\r\n  look like toolchain or code defects, not disk: `rustc-LLVM ERROR: IO failure on output stream:\r\n  no space on device`, `LNK1318: Unexpected PDB error; LIMIT (12)`, `LNK1108: cannot write file`\r\n  — a red wearing a linker's face (doyle's U2 gate rig ate exactly this; verdict legs already\r\n  green survived, the suite leg had to be re-run). Contributions measured, not inferred: hertz\r\n  ~70 GB across four lane targets (er-seams **42.66 GB** cold `--workspace --tests`,\r\n  selection-probe 25.80, poolowner 1.03, ci-riders 0.91), doyle gate rig 15 GB cold full build.\r\n  Reclaim arithmetic reconciles both and neither alone: 0.00 → 25.47 GB (hertz reaps\r\n  selection-probe) → ~40 GB (doyle reaps rig). **The mechanism (hertz, ruled register-worthy):\r\n  every isolated lane worktree carries its OWN `target/`, so disk cost is multiplied by lane\r\n  count, while pool-claim — built to arbitrate a SHARED pool — sees none of it; a claim on\r\n  main's pool is ceremonial for a lane that never writes there. The tool we use to reason about\r\n  build-cache contention cannot see the resource that actually ran out.** Eight-plus worktrees\r\n  at 25–43 GB per cold full build is the shape of the next occurrence, and it will not announce\r\n  itself through pool-claim. Adjacent discipline failure the same night, named so the entry\r\n  carries it: a gater firing a cold full-workspace rig into a window with two live builder lanes\r\n  is the pre-flight question-1 failure (right-size the run) — targeted legs and warm pools\r\n  first.\r\n- **Remedy shape (sketch, not ruled):** (a) a box-level free-space floor as a RIG STEP at lane\r\n  start — the claim verb is the natural seat (print box free + du of known lane targets at\r\n  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\r\n  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\r\n  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\r\n  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\r\n  with sizes, so the sweep is one command instead of a du walk each agent re-derives.\r\n- **Ripe when:** next CI/rig-touching wave, or the next ENOSPC-signature red — whichever first.\r\n- **Size:** small-medium (claim-verb print + floor; census verb optional).\r\n- **Field addendum (2026-08-04 second event, same day filed — ripeness condition met):** the box\r\n  fell under the CI runner's 32 GiB free-space floor twice more (12:31 main @9d65e65 docs-only,\r\n  12:50 PR core#144 @b110bc8) while todlando's F-lane built. Both Windows unit legs REFUSED with\r\n  `RESOURCE=disk drive=C:\\ free_bytes=…` — the `REQ-CI-FREE-SPACE-PREFLIGHT` floor did exactly its\r\n  job: a docs-only main red named the resource instead of wearing a linker's face, and triage was\r\n  one log read instead of an RCA. That is the instrument's first field catch; the CI side of this\r\n  entry is PROVEN. The agent-lane side stays open: local trough measured 8.8 GB free mid-F-lane.\r\n  Reclaim, measured before/after per the teardown rule: doyle reaped gated u1+u2 lane targets\r\n  (POOL-OWNER claims verified own+dead-holder, inbound reparse sweep clean, worktrees kept)\r\n  8.8 → 59.5 GB (+50.7); hertz reaped er-seams target (pool-release first, same discipline)\r\n  59.46 → 101.16 GB (+42.66). Refined mechanism statement (hertz, this event): the disk floor is a\r\n  per-BOX resource our per-POOL instrument is structurally blind to — pool-claim answers a\r\n  question about contention that is not the question the box ran out of.\r\n- **AXIS ADDENDUM (deployah, golden 30928816784 / USHER `fc7fad1`, 2026-08-04) — one floor reading\r\n  is a SNAPSHOT, and the swing is bigger than the margin you fire on.** Two facts this entry's\r\n  remedy (a) has to be built against, both measured rather than reasoned:\r\n  (1) **A pre-fire PROCESS census cannot see the floor at all.** Mine came back clean minutes before\r\n  the run — zero test-path `spt.exe` residents, zero `cargo`/`rustc`/`link`/`cl` — and both Windows\r\n  legs then died in the disk preflight (`drive=C:\\ free_bytes=26099576832 floor_bytes=34359738368`,\r\n  `RESOURCE=disk`, exit 1) with a 128-line log carrying ZERO `Compiling`/`PASS`/`FAIL`/`Summary`\r\n  lines: no test signal, and the merge chain never indicted. Both readings were TRUE at the same\r\n  instant — the gater's finished assembly gates were sitting on disk as a DIRECTORY, not running as\r\n  a process. A process-axis probe is blind to a finished build's cost by construction; \"re-check\r\n  closer to the fire\" would have changed nothing, because the axis was never read.\r\n  (2) **The floor number itself moves by tens of GB inside one run window.** Same box, same drive,\r\n  same run, pulled from its own logs: `16:22:55` test-Windows free=26099576832 REFUSED · `16:23:07`\r\n  n1-gate-Windows free=26096607232 REFUSED · `16:46:54` twohost-a free=71033049088 PASSED and then\r\n  ran 11 minutes to success. ~45 GB returned with NO deliberate teardown, and my own reading at\r\n  17:13:45Z was 61352714240 — ~10 GB BELOW what twohost-a saw 27 minutes earlier. The observed swing\r\n  amplitude EXCEEDED the margin I was about to fire on (25.14 GiB).\r\n  So the rule remedy (a) must encode: measure BOTH axes (process residents AND free space against\r\n  the workflow's own 32 GiB floor), and reclaim until the margin exceeds the observed SWING, not one\r\n  sample. Triage corollary, equally load-bearing: twohost-a runs the same preflight on the same C:\r\n  and PASSED, so a preflight refusal is a threshold event on a moving number — never evidence the\r\n  box cannot run the work, and never by itself a reason to indict a merge chain.\r\n- **THIRD ADDENDUM (deployah, v0.54.0 cut, 2026-08-04) — the sweep answers \"0 B reclaimable\"\r\n  TRUTHFULLY on a box that cannot run its own work, because the reclaimable population and the\r\n  owned-lane population are DISJOINT.** This hazard blocked a release twice before it was seen.\r\n  Both Windows legs at the shipped sha `86f0d84` refused at the guard before compiling anything —\r\n  `ci.yml` at `free_bytes=28167569408` (26.2 GiB) and `release.yml` at `27690885120` (25.8 GiB),\r\n  both against `floor_bytes=34359738368`. `assemble` skipped in consequence, so no draft release\r\n  existed: the release was hard-blocked on disk, not on code. Neither leg produced a test verdict,\r\n  so both are LABELLED HOLES, not reds (ruled recorded-and-proceed by doyle, the shipped-sha delta\r\n  being 5 files and zero `.rs`).\r\n  **The finding is not the disk.** `xtask pool-sweep --root .worktrees` reported, correctly,\r\n  `total 66.43 GB across 3 pool(s); 0 B reclaimable in this sweep's scope` while the box sat ~6 GB\r\n  under its own floor. The sweep is behaving as designed — it refuses to reap owned, live lanes.\r\n  But the floor reasons over an AGGREGATE the sweep is forbidden to touch, so the designed\r\n  instrument, run at the exact moment of refusal, tells an operator there is nothing to reclaim.\r\n  That is true and useless. The gap between \"the sweep is correct\" and \"the box can run work\" is\r\n  the defect; it is not fixed by making the sweep more aggressive.\r\n  **Aggregate measured under `.worktrees`** (real target bytes, junction-classified first): 87.79 GB\r\n  across 9 lanes — 2.7x the entire 32 GiB floor. Registered pools: `w1t2-relink-force` 54.67 GB,\r\n  `obs-resume-attach-intent` 10.18, `w1t2-subnet-status` 1.58. Carrying targets the sweep does not\r\n  count as claimed pools: `hertz-teardown-bound` 11.25, `hertz-liveresolve-diag` 4.83,\r\n  `hertz-psyche-bound` 4.19, `hertz-poolowner` 1.03, `hertz-ci-riders` 0.91.\r\n  **The 54.67 GB single lane is NOT waste** (doyle's classification, ratified at this filing): a\r\n  verb lane at that size is workspace-all-targets e2e cost. No lane is misbehaving. That is what\r\n  makes this structural rather than a cleanup task — every lane is individually justified and the\r\n  sum still exceeds the floor.\r\n  **Reclaim taken, and its boundary.** 82.12 GB, from `spt-core/target` — the release driver's OWN\r\n  main-checkout pool, NOT a lane; free 23.23 → 105.34 GB. Classified before removal per the\r\n  teardown rule: OUTBOUND `Get-Item -Force` reported a real directory rather than a reparse point,\r\n  the INBOUND sweep found zero reparse points aimed at it, `CARGO_TARGET_DIR` was unset (no env\r\n  aliasing), the target SUBTREE only was reaped, both sides measured.\r\n  **Snapshot behavior reproduced inside this measurement window**, corroborating the axis addendum\r\n  above at a smaller amplitude: free read 25.49 GB when first measured and 23.23 GB at the reap\r\n  minutes later — it drifted 2.26 GB DOWNWARD while the operator was deciding what to do about it.\r\n  **Priced side effect, for the next reader:** reaping the main pool took the prebuilt `xtask` with\r\n  it, so the next lane claim rebuilds it first — the lane-check shortcut is cold until then. It cost\r\n  a 2m11s cold rebuild inside this release's own publish step.\r\n  **What this does NOT license:** reaping another agent's owned lane to clear a floor. The sweep's\r\n  refusal is correct and stays. What is missing is an AGGREGATE-AWARE signal — the box knowing its\r\n  lanes sum past the floor *before* a run is dispatched into a guard that will decline it.\r\n- **FOURTH ADDENDUM (doyle, 2026-08-04 late evening — fourth event in one day, and the first\r\n  RULING on this entry).** C: hit **0.44 GB free** during doyle's lane-2 stack gate and todlando's\r\n  re-aim leg set. Signatures manufactured this time, all initially read as something else:\r\n  `os error 112` mid-rlib-archive surfacing as xtask \"building spt failed\" (exit 101); a\r\n  servicehost force-kill unit red at a sha gated GREEN on the same rig an hour earlier; todlando's\r\n  6-of-7 leg table red with `LNK1318` while only traceable-reqs survived. Both agents' verdicts\r\n  from the window were VOIDED and re-run, not re-read.\r\n  **Discriminator correction (hertz, ratified at this filing):** \"treqs alone survives\" is a\r\n  POSITIVE TELL, never a clearing test — a full disk reds BEFORE any link step (rustc writing\r\n  rlibs), and treqs can red for its own reasons; signature absence says NOTHING. The only\r\n  falsifier for \"this red was the disk\" is free space AT RUN TIME, and no log on the box recorded\r\n  it, which made every red from the window unanswerable after the fact.\r\n  **RULING (doyle):** every rig/gate script records `FREE-AT-START` / `FREE-AT-END` in its own\r\n  SUMMARY — one line each, the datum that makes a disk confound answerable post-hoc. Effective\r\n  immediately for hand-authored rigs; hertz builds it into the shared rig harness at next touch\r\n  (assigned, not unasked). This is remedy (a) narrowed to its cheapest load-bearing slice.\r\n  **Reclaim, all FS-delta-measured:** todlando +59.4 GB (obs-resume-attach-intent 8.56 +\r\n  w1t2-relink-force 50.83; 0.44 → 59.83), hertz +1.79 GB (ci-riders + poolowner; sum-of-lengths\r\n  said 1.94, the FS delta governs; 59.09 → 60.87), doyle +38.8 GB (w1t2-subnet-status +\r\n  w1t2-perch-gc + w1t3-node-verb targets; 60.75 → 99.54). Full discipline each: outbound\r\n  classification, inbound reparse sweep (zero), CARGO_TARGET_DIR confirmed unset, subtree-only.\r\n  **Mechanism sharpened by this event:** the standing swing IS the finished-lane population —\r\n  ~110 GB of pools belonging to lanes already GATED AND PUSHED, held for hours because disposal\r\n  fires at GATE close (a rig step) while nothing fires at LANE finish; a pushed lane awaiting\r\n  assembly holds its pool invisibly. Corollary corrections carried: todlando withdrew his\r\n  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\r\n  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\r\n  class recurring, left for retry rather than forced.\r\n\r\n- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\r\n  CONSEQUENCE: reaping a pool UNCLAIMS its tree, and the next builder meets a refusal that is the\r\n  rule working.** (The disk-floor mechanism from the same event is doyle's to file at his\r\n  release-close sweep — one voice each, by division agreed in-window. This addendum stops at the\r\n  pool-claim consequence and deliberately does not restate the floor finding.)\r\n  Five FIELD-SEAL lane pools were reaped to clear the golden floor — gate rig `gate-222-ca30a79e`\r\n  plus lanes `fix-222`, `w2-seal-ux`, `w3-ingest`, `w4-exit-subject`; **148.48 GB measured by FS\r\n  delta**, free 1.37 → 149.84 GB, worktree checkouts kept, `main/target` untouched by ruling.\r\n  **The consequence to record:** `POOL-OWNER.json` lives INSIDE `target/`, so reaping the subtree\r\n  takes the claim with it. Those five trees are now **UNCLAIMED — which is fresh-not-foreign**, a\r\n  different state from the `SPT_POOL_FOREIGN` refusal. Whoever resumes one of those lanes (a hertz\r\n  fixup, a golden-red rebuild) must run `cargo run -p xtask -- pool-claim --pool <dir> --label\r\n  <lane>` **from that worktree** before the first build, or `crates/spt-store/build.rs` refuses.\r\n  **A refusal there is the rule working, not a defect** — filed precisely so a later reader does\r\n  not open an issue against the build script for behaving correctly. Naming it costs one line;\r\n  the alternative is an RCA against our own guard.\r\n  **Prediction-vs-meter, corroborating hertz's fourth-addendum note at ~75x its scale:** pre-reap\r\n  sum-of-lengths sizing predicted 163.9 GB; the FS delta paid 148.48 GB, a 15.4 GB shortfall left\r\n  UNEXPLAINED here rather than rationalized (allocation granularity, sparse/compressed extents and\r\n  concurrent writes all sit between the two meters). **The FS delta governs** — hertz ruled this at\r\n  1.94-vs-actual and it holds at three digits. Report the meter, never the estimate that agreed\r\n  with your plan.\r\n  **Discipline executed, for the audit trail:** outbound classification re-read AT REAP TIME (all\r\n  five real dirs, zero LinkType); inbound sweep over **2854** reparse points under `projects\\`\r\n  found zero aimed at any victim; `CARGO_TARGET_DIR` confirmed empty in process, **Machine and\r\n  User** scope (the arm that leaves no directory entry to notice afterwards); process census\r\n  RE-RUN at reap time rather than carried from a peer's snapshot — zero builders, zero processes\r\n  imaged out of a victim pool, both live `spt` images resolving to the installed path. The peer's\r\n  snapshot proved correct; it was re-run because a snapshot is not a standing property, which is\r\n  the reason it was offered with that caveat.\r\n\r\n### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\r\n- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\r\n  the builder to the gater deliberately — register shape is doyle's to own.\r\n- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\r\n  code, empty stdout, non-fatal to the generator), `cargo run -p xtask -- gen` wrote\r\n  `docs-site/src/cli/reference.md` reduced to EIGHT lines — title, do-not-edit banner, empty code\r\n  fence — deleting 3193 lines of published CLI reference. `xtask check` then exited 0, because\r\n  the drift gate compares what the binary emits NOW against what the file holds, and gen had just\r\n  overwritten the file with exactly that emit. **A producer that emits nothing agrees with itself\r\n  perfectly.** Caught only because the builder grepped the regenerated page for his new flag\r\n  names and treated the clean zero as suspicious ([[zero-match-filter-reads-as-absent]] shape);\r\n  the gate itself would never have said a word, and the gutted public reference ships green.\r\n  The mechanism generalizes past the stack overflow that exposed it: ANY failure mode that makes\r\n  `spt --help` produce empty stdout while exiting non-fatally to the generator gets the same\r\n  green. Kin to [[cli-command-docs-drift]] (the gate this defeats) — the gate detects DRIFT\r\n  between binary and page, and is structurally blind to a page just regenerated from a broken\r\n  binary.\r\n- **Remedy shape (builder's sketch, sound; not yet ruled on seat):** a floor in `xtask gen` —\r\n  refuse to write a page whose help block is empty, or whose output is implausibly shorter than\r\n  the file it replaces — so the generator fails loudly instead of producing a stub the gate\r\n  blesses. Gen is the right seat: check runs in CI on a fresh emit too, so a check-side floor\r\n  alone still lets a local gen gut the working tree.\r\n- **Ripe when:** next docs-tooling or xtask-touching lane; SOONER if any lane regenerates the CLI\r\n  reference before the floor exists (a gate on that lane must assert page LENGTH, not gen's exit\r\n  code, until this is built).\r\n- **Size:** small (one refusal + a length-plausibility floor in gen).\r\n\r\n### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\r\n- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\r\n- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\r\n  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\r\n  (`spt --version` included) died with `thread 'main' has overflowed its stack`, exit\r\n  -1073741571, before reaching any of its own code. Delta-tested, not assumed: the same command\r\n  on the main-pool binary from main printed normally. U1 repaired its own trigger (raw-argv\r\n  pre-scan for retired flags before clap parses; lane ends net +2 args) — but the CEILING\r\n  remains: the tree is now close enough that a handful of net new arguments in a debug build\r\n  reproduce a total binary outage — **and the handful is THREE, not six; see the correction\r\n  below before planning against this entry.** **#5's verb-surface rework is the next lane that adds\r\n  arguments and it is much bigger than U1** — this entry exists so #5 is planned knowing the\r\n  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\r\n  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\r\n- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\r\n  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\r\n  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\r\n  difference is the difference between \"plan carefully\" and \"one flag anywhere takes the binary\r\n  down\". N hidden bool args added to the ROOT `Cli` derive, tree restored from git between every\r\n  row, `--version` as the invocation (it carries no work of its own, so whatever it costs IS tree\r\n  construction):\r\n\r\n      N=0  exit 0                OK  (control — unmodified lane binary answers `spt 0.53.0`)\r\n      N=1  exit 0                OK\r\n      N=2  exit 0                OK\r\n      N=3  exit -1073741571      STACK-OVERFLOW\r\n      N=4 / N=6 / N=8            STACK-OVERFLOW\r\n\r\n  PLACEMENT DIFFERENTIAL, run because #5 adds args at `EndpointCmd` seats rather than at the root\r\n  and a root-only number could have measured the wrong thing: same N injected inside a NESTED\r\n  endpoint seat gives `SEAT N=2` OK, `SEAT N=3` STACK-OVERFLOW. **Identical ceiling — placement does\r\n  not move it**, so three is the number for the shape #5 actually builds. (Rig hazard worth keeping:\r\n  the first seat attempt produced a COMPILE error, E0027, because the dispatch destructures that\r\n  variant exhaustively — taken at face value it would have read as \"the seat is fine\". Both rows\r\n  above are from the fixed rig.) CONSEQUENCE FOR #5: the ratified MIN spelling ends net +2, i.e. it\r\n  would have shipped with ONE argument of headroom, and any later lane adding a single flag anywhere\r\n  in the tree would then take the whole binary down, `--version` included. Remedy (b) below stops\r\n  being \"buys headroom\" and becomes the precondition for #5 shipping safely.\r\n- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\r\n  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\r\n  (b) raise the main thread stack for the binary (build config), buying headroom without\r\n  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\r\n  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\r\n  where the ceiling sits before choosing.\r\n- **Ripe when:** #5 (U3 verb surface) PLANNING — this is a planning input, not just a build item;\r\n  the smoke tooth (a) is ripe for the next CI-touching lane regardless.\r\n- **Size:** small for (a); medium for (b)/(c) with the measurement.\r\n\r\n### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\r\n- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\r\n  characterized same day by hertz from retained logs, ownership falsified by todlando.\r\n- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\r\n  ADR-0041 zombie-detection fixture, whose subject is a corpse process kept alive-looking by a HELD\r\n  HANDLE) flags nextest LEAK on most draws but not all — measured 19 LEAK of 20 on a tree carrying\r\n  no #142 content (`test/grandchild-selection-probe` @`695398b`, based on `4b37512`: lib arm 10/10\r\n  LEAK across 822-test runs; full-suite arm 9/10 across 1044-test runs). The single clean PASS\r\n  kills \"intrinsic therefore always\": leakiness is DOMINANT BUT INTERMITTENT. Consequences:\r\n  (1) a gate or reader that treats this row's LEAK as a defect signal flaps at roughly 1 in 20;\r\n  (2) one non-leaky run is NEVER evidence that something fixed it (kin:\r\n  [[intermittent-green-is-zero-information]]); (3) the verdict method that closed it is the\r\n  template — two independent legs, neither load-bearing alone: the suspect lane's diff grepped\r\n  zero hits on the row's subject (zombie / handle_held / OpenProcess / corpse), AND a 20-draw\r\n  baseline on a tree predating the suspect change. This entry exists so the next gater who sees\r\n  the flag reads one register line instead of running that RCA cold.\r\n- **Remedy shape (sketch, not ruled):** annotate the row as expected-leak in nextest config\r\n  (per-test `leak-timeout` override or documented allowlist) so the flag stops presenting as\r\n  signal; alternatively a fixture-side close of the held handle on the clean path if ADR-0041's\r\n  arrangement permits — hertz's call, test/CI lane.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\r\n- **Size:** small.\r\n\r\n### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\r\n- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\r\n- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\r\n  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\r\n  `started_at` and carried conclusion, so a carried failure is the SAME observation; dedupe before\r\n  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\r\n  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\r\n  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\r\n  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\r\n  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\r\n  closed.**\r\n- **The family:** 11 victim legs, 8 distinct tests, ONE cluster — process teardown / kill-reach /\r\n  respawn-controller survival, concentrated on hfenduleam. Per-victim dispositions live in the USHER\r\n  #150 triage ledger (releases#150 record). The only surviving cross-sha EXACT repeat after source\r\n  verification is `resume_no_control_steal_e2e` (:488, byte-identical @2138b16 + @4b37512) — and\r\n  both its reds PREDATE the post-#145 producer-side instrumentation, so what repeats is an AMBIGUOUS\r\n  observation (stolen controller vs starved child) twice; only a post-#145 red discriminates. The\r\n  `a_tree_teardown` pair was a FALSE repeat — two mechanisms wearing one assert string (see\r\n  FLAKE-LEDGER row; the counting lesson: assert-body identity must include the polled predicate's\r\n  SUBJECT).\r\n- **Off-CI discriminator (todlando 2026-08-04):** 0/400 (A 0/200 + B 0/200, interleaved,\r\n  `--test-threads 1`, filters positive-controlled, by-path sweeps every iteration) on the warm\r\n  d449ce5 pool UNDER live-fleet load (CPU 46-59%, 13-18 spt processes). Points the family at the\r\n  RUNNER ENVIRONMENT rather than a product race any Windows box expresses — not exoneration (absence\r\n  of reproduction is not proof of absence), but where the next hour goes. A-alone N=500 on the\r\n  instrumented tree ran post-close (result on releases#150).\r\n- **Remedy lanes already moving:** hertz 4-item test-rework package dispatched 2026-08-04 (psyche\r\n  bound split, live_resolve rig instrumentation, green-capture probe profile, resident_service/\r\n  teardown hardening); prod `wait_bounded` tree-kill-on-timeout filed to board as EVAL. This entry\r\n  is the RATE's home — it leaves the register when the operator has ruled on the rate (accept vs\r\n  hold-for-hertz) AND the hertz package has landed with a re-measured victim rate.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\r\n- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\r\n- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\r\n\r\n### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\r\n  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\r\n  item-2 sweep ruling; doyle ruled file-don't-sweep.\r\n- **What/why:** 51 `fn output_bounded` definitions under `crates/spt/tests` — 50 per-file copies\r\n  plus `tests/common/mod.rs:53`, which is NOT pub, has ZERO callers outside its own module, and\r\n  whose doc comment states outright that the estate's copies predate the shared module. The lossy\r\n  timeout arm (panic loses everything captured, names nothing) is in 38 sites across 36 files.\r\n  The copies have already drifted: two variants of the deadline expect-string exist in the estate\r\n  (`\"captured spt call must complete within its deadline\"` in common/mod.rs:60 vs the\r\n  no-deadline-clause spelling in per-file copies), so a grep keyed to either string undercounts.\r\n  The right fix is a hoist-and-delete refactor (make the common copy pub, adopt it estate-wide,\r\n  carry the item-2 diagnostic arm once) — a 50-file test-estate touch that must NOT ride golden\r\n  cadence as a rider or hide inside a scoped diagnostics item (ADR-0050 thin-lane rationale;\r\n  hertz's USHER item 2 stays scoped to live_resolve, which keeps ONE improved copy as the model).\r\n- **Built evidence:** one public owning helper replaced all 50 file-local\r\n  clones. It owns and tree-kills a timed-out child, waits for reap, drains both\r\n  pipes, and includes the deadline plus partial stdout/stderr in the panic.\r\n  A dedicated regression observes both diagnostics and proves the timed-out PID\r\n  is gone.\r\n- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\r\n  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\r\n- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\r\n- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\r\n  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\r\n  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\r\n  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\r\n  rides the same lane.\r\n- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\r\n  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\r\n  timeout, drains both pipes, and reports partial stdout/stderr. `bounded_output_e2e` mutation-pins\r\n  both timeout ownership and retained diagnostics.\r\n- **Declared validation extra:** the lane's docs-link gate exposed that `llms_target_exists` treated\r\n  generated targets as absent before generation. Its small refactor + unit keeps source and\r\n  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\r\n\r\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\r\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\r\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\r","truncated":true,"truncatedBy":"lines","totalLines":4086,"totalBytes":49392,"outputLines":548,"outputBytes":49392,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n…\n- **RULING (doyle, 2026-08-04) — the claim path must run the same guard the build path runs, and a\n…\n\r\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\r\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\r\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\r\n- **What/why:** a rig built as `worktree\\target -> junction -> .worktrees\\<pool>` has its build cache\r\n  in a directory that is NOT the worktree and NOT in `git worktree list`. `git worktree remove` deletes\r\n  the junction and reports success; the pool survives with zero inbound links and nothing naming it.\r\n  Measured on this box: reaping `golden-render` and `w4-cli-doc` the obvious way would have reclaimed\r\n  ~26 MB of worktree and stranded **14.17 GB** of pool (`gate-target-render` 6,265,448,382 B +\r\n  `gate-target-w4doc` 7,907,558,098 B). Neither pool appears in any worktree listing.\r\n- **The second shape, same mechanism, already realised:** `.worktrees\\gate-target` was found at\r\n  **0 files / 0 bytes with FOUR live inbound junctions** (assembly-doorbell, doorbell-w1/w2/w3). Someone\r\n  had already reaped that pool and left four dangling-but-valid links behind. So the defect runs both\r\n  ways: remove the worktree and the pool is orphaned; remove the pool and the links are orphaned.\r\n  Either half alone leaves a lie on disk.\r\n- **Why it is not just \"be careful\":** the classification step people already know\r\n  (`Get-Item -Force` OUTBOUND, INBOUND reparse sweep) tells you HOW to delete an object you have\r\n  already decided to delete. It does not tell you that a second object exists. The missing thing is an\r\n  enumeration that reaches pools no worktree names.\r\n- **Remedy shape (CORRECTED by builder retraction, 2026-08-04 — the enumeration already exists and\r\n  shipped):** `xtask pool-sweep` (`c6515f1`, `REQ-POOL-GC-ORPHAN-RECLAIM`, ancestor of `b7b00c3` by\r\n  merge-base) walks the root for dirs AND links, counts inbound links over the whole sweep before\r\n  forming a verdict, classifies InUse/Owned/Orphaned, and reaps orphans on `--reap`. The gap is not\r\n  detection, it is TIMING: a junction-pooled tree's pool is `Owned` and not reclaimable right up to\r\n  the moment its worktree is removed, and `Orphaned` only after — so the reclaim always lands in a\r\n  LATER sweep, and nothing triggers one. `gate-target` (0 bytes, four dangling inbound links) is a\r\n  completed instance of that deferral. Remedy is a post-teardown pass or a teardown that runs the\r\n  sweep itself, not new enumeration. (An earlier draft of this entry proposed building the\r\n  enumeration; retracted by its author before ripening — the tool refuting it was one run away.)\r\n- **Ripe when:** next CI/infra batch. **Size:** small (one enumeration + report, no new policy).\r\n- **Discipline this cost, stated so it is not re-learned:** teardown must be TWO EXPLICIT STEPS per\r\n  junction-pooled tree — junction deleted AS A LINK (`Directory.Delete(path, recursive: false)`), then\r\n  the pool AS A TREE after an inbound sweep confirms it is linkless. Executed that way on 2026-08-04:\r\n  28 worktrees, 4 pools, 0 skipped, 0 pinned, 17.04 GiB measured on a box with concurrent writers.\r\n\r\n### IR-28 — A wave-gap rider is visible to the request board and invisible to a milestone-narrative notes pass\r\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\r\n  · **Origin:** deployah, v0.53.0 release close 2026-08-04.\r\n- **What/why:** the v0.53.0 changelog omitted `184f2ac` (the releases#125 two-core CPU-burn fix, a\r\n  wave-gap rider that rode the commit range but was never LOCKSMITH scope) while the alchemy release\r\n  verb promoted #125 to DONE and named it publicly as shipped — two published surfaces contradicting\r\n  each other until the post-publish docs-only repair (`9841592`). The rule was already right (the\r\n  runbook audits the changelog against the COMMIT RANGE); the EXECUTION missed it, because a notes\r\n  pass written from the milestone narrative never enumerates the range. The mechanism, not the\r\n  incident: any rider is board-visible and narrative-invisible.\r\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now requires a mechanical `vPREV..HEAD`\r\n  user-facing commit list, a changelog match beside every row, and an explicit accounting of every\r\n  unmatched row before the golden run. The repair precedent remains docs-only amend +\r\n  `gh release edit`, never retag. PR #176 passed `traceable-reqs check`.\r\n\r\n### IR-29 — twohost ladder: role A fires the done-barrier BEFORE its last cross-node rung, so the re-pull's serve window is won by timing, not guaranteed\r\n- **Status:** open, FIX AUTHORED-AND-COMPILED unlanded — hertz `test/twohost-serve-window`\r\n  @`17bbbd8` off `11169c1` (+33/-18 twohost.rs, relocation proven byte-identical by\r\n  comment-stripped set-diff, cargo check + clippy -D warnings green; proving two-host run still\r\n  owed and rides the same window as #145's closed-subnet knock row) · **Origin:** golden\r\n  30873007187 attempt 1 red, doyle timeline triage + hertz source diagnosis 2026-08-04.\r\n- **SECOND FACE, measured 2026-08-24 (WAX-SEAL #21 W3 gate climb @ 035c3fe6, doyle):** the class\r\n  recurs on a NEW rung, and this face is UNWINNABLE rather than racy. The W3 seal rung S1 mints\r\n  on A ~0.3s before A's ladder completes (mint mono 80843ms, ladder end ~81150ms, walked from\r\n  the capture), while the seal pump worker's cadence is 500ms — the pusher exits before its\r\n  first eligible post-mint tick, so ZERO feed pushes ever fire (both logs hold zero seal-feed\r\n  lines) and role B burns its full 900s window on \"seal: A's record replicated into B's store\".\r\n  Full-re-presentation heals only while a pump is RESIDENT; the rig kills it. Product not\r\n  implicated (local legs + design review all green at the sha). Dispatched to hertz 2026-08-24\r\n  with two fix shapes (mint early with ~120 ticks of resident-pump margin, or a\r\n  reverse-confirmation barrier on A's done-push); the climb re-runs on his fix. Lesson for\r\n  future rungs, stated as construction: a rung whose delivery is CADENCED must not sit inside\r\n  the terminal margin of the process that pushes it.\r\n- **Mechanism (hertz falsified the gater's first spelling, kept because the correction is the\r\n  entry):** NOT \"B exits early\" and NOT a missing barrier. B's contract (twohost.rs:1116-1121,\r\n  \"hold until A finishes its side — done-file as the ladder's completion barrier\") is right and B\r\n  obeys it. A BREAKS it: A pushes done.txt (:1819-1832, payload literally \"ladder complete on A\")\r\n  then runs the ENTIRE leg-D digest rung including the re-pull assert (:1959) before its own\r\n  `stop.store` (:1966). B tears down exactly when A said it could; the re-pull then races B's\r\n  post-signal teardown. The panic's hint text (\"may be running a version without cross-node\r\n  digest\") is pre-authored and was NOT evidence of version skew.\r\n- **Margin series, six draws of one race (deployah, markers cited by TEXT and positive-controlled\r\n  against a known draw before producing an unknown one):** golden 30860770146 +60s · a1 −0.6s\r\n  (the RED) · a2 +59.4s · a3 +60s · a4 +59.59s · a5 +63.89s. BIMODAL, not drifting: greens\r\n  cluster within seconds, one collapse through zero. A green does not mean the window got safer;\r\n  sample count characterizes a bimodal race, not margin size — the slack is incidental, not\r\n  designed. Local load on hfenduleam during A's leg D eats the margin directly (role A runs\r\n  there; the done-file is already pushed), which is why builds hold through twohost legs.\r\n- **⚠ THE SERIES IS CLOSED AT SIX DRAWS — ITS DERIVATION IS UNRECOVERABLE, AND NO SEVENTH NUMBER\r\n  MAY BE ADDED (ruled by doyle 2026-08-05, at the tranche-2 golden).** Asked to extend it with a\r\n  draw from run 30971976024, deployah positive-controlled the markers FIRST and the control\r\n  REFUSED: grepping `margin|deadline|serve window|slack|headroom|budget` against a control run\r\n  known to carry good twohost evidence (30940180764) returned ZERO. Source confirms it —\r\n  **`margin` is not an emitted token anywhere**: absent from `.github/workflows/golden.yml`, and\r\n  every `crates/` hit is unrelated (terminal right-margins in broker/resize tests,\r\n  `ROUND_DRAIN_MARGIN` in `pump/mod.rs`). So the six figures were DERIVED from log timestamps\r\n  against a bound that was never written down, by a measurer whose context has since been cleared;\r\n  the gater who recorded them never held the formula either. **Consequence, stated so nobody\r\n  re-derives it:** any new figure computed from these logs would be a DIFFERENT quantity wearing\r\n  the same name, and would enter a series whose value is its bimodality — the one structure a\r\n  mismatched sample corrupts invisibly. This run therefore gets a LABELLED HOLE, not a number.\r\n  What IS reportable for it, with endpoints named rather than a name reused: **ladder span**, node\r\n  start → `TWOHOST role B: ladder complete` = **183.50s** on the batch vs **259.21s** on the\r\n  control. Marker parity established under an IDENTICAL expression on both sides (25 = 25, after a\r\n  first pass that compared two different greps and would have read as parity by coincidence).\r\n- **The fix this makes obvious:** the twohost margin must become an EMITTED token with its two\r\n  events named at the emit site, so the next draw is read rather than reconstructed. A derived\r\n  quantity whose formula lives only in a measurer's context is one context reset away from being\r\n  unfalsifiable — which is exactly what happened here.\r\n- **Fix shape (doyle-approved):** move the done-push block to AFTER leg D, immediately ahead of\r\n  A's stop — one honest barrier made true, no second completion signal (a redundant pair is how\r\n  the next ordering bug lands after the SECOND one). `[int->REQ-REACH-1]` travels with the block.\r\n- **Cascade note, so a future triage does not count it:** in a1, twohost-b's gated-CLI red\r\n  (twohost_cli.rs:189, 910s) was the CASCADE — role-A's gated driver step SKIPPED after the\r\n  ladder death, so B waited for a row never produced. A red that postdates its carrier leg's\r\n  failure carries zero information about its own subject.\r\n- **Ripe when:** proving run at the next two-host window. **Size:** landed-sized already.\r\n\r\n### IR-30 — GOLDEN 4b37512 (#145): five attempts, four distinct Windows victims, one sha — the random-victim family measured end to end, and the instruments it left behind\r\n- **Status:** open for the FAMILY SIGHTINGS ONLY — the instrument lanes LANDED as planned with\r\n  the next golden batches (measured 2026-08-25, doyle, `git merge-base --is-ancestor` + first\r\n  tag: serve-window `17bbbd8`, selection probe `695398ba`, resume taxonomy `58337879` all in\r\n  **v0.54.0** (USHER, merge `390204a3` et al.); attach-intent re-aim `37afa571` in **v0.55.0**).\r\n  Any later record citing these as \"authored-unlanded riders\" (the v0.63.0 FIELD-SEAL plan did,\r\n  carried forward from this ledger) is stale — this row is the correction. The #145 gate itself\r\n  CONCLUDED GREEN attempt 5, main ff'd, tested==merged · **Origin:** doyle, night of 2026-08-04,\r\n  run 30873007187 attempts 1-5.\r\n- **The record:** four reds, four DIFFERENT daemon-spawning tests, Windows leg only, Linux green\r\n  at the same sha every attempt: a1 `daemon::tests::a_tree_teardown_reaches_a_grandchild…`\r\n  (10.225s full deadline, 2nd golden sighting — see [[IR-17]]'s updated sub-observation); a2\r\n  `registry_lifecycle::multichunk_feed_applies_with_exactly_one_snapshot_write` (0-vs-1 at\r\n  mono_ms 77, THIRD sighting of the 2026-07-22 seed; hertz source-named the window: converge\r\n  polls rows landed at merge, assert reads `snapshot_writes` incremented in `write_snapshots`,\r\n  unjoined-thread gap between — predicts under-count only, matching all sightings; quiet-arm\r\n  control 40/40 PASS 0 leaky on a still box); a3 `brain_split::broker_survives_brain_kill…`\r\n  (\"supervisor did not respawn the brain\", 32.8s window burn; characterization queued); a4\r\n  `resume_no_control_steal_e2e::brain_respawn_keeps_every_session_controller…` — UNDER the\r\n  ruled quiesce-partial window with a measured-clean box, and its panic NAMED A MECHANISM ITS\r\n  OWN DATA CONTRADICTS (pre-authored Failure-A text; gained=[0,15,17] through ONE\r\n  resume_sessions while a steal displaces the SET; session 0 already 4x behind BEFORE the\r\n  window; the rig's child-liveness immunity was a COMMENT nothing measured). Every red\r\n  lane-independent by per-row delta test run fresh each time, never transferred.\r\n- **Instruments authored off it (all thin test/obs lanes off `11169c1`, compiled where stated;\r\n  ALL LANDED — v0.54.0/v0.55.0, see Status):** hertz `test/twohost-serve-window` @`17bbbd8`\r\n  ([[IR-29]]); hertz grandchild SELECTION probe (+166/-8 daemon.rs test-mod: IsProcessInJob at\r\n  selection time — decisive H1/H2 splitter, birth-stamp one-directional, image, same-snapshot\r\n  match COUNT; compiled + deliberate-break positive control); hertz `test/resume-steal-taxonomy`\r\n  (+109/-6: producer counter `Broker::session_output_seq` bracketing the consumer window,\r\n  authenticated child pin at t1 BEFORE teardown — read at assert time would convict the rig of\r\n  its own cleanup — three-way verdict PRECONDITION / measured-Failure-A-with-producer-story /\r\n  absent-producer-is-its-own-story); todlando `obs/resume-attach-intent` @`9c9e6c5`\r\n  — **a DEAD-PATH emit that never fired in production; removed 2026-08-04.** The\r\n  `RESUME_ATTACH_INTENT` breadcrumb sat in `resume_sessions`, which has had NO production\r\n  caller since `03c7109` (2026-07-09): the daemon's respawn path is `run_brain` ->\r\n  `resume_session_cursors`, cursor-only, no attach. Its absence from a field log therefore read\r\n  as \"no resume happened\" when it meant \"uncalled function\" — a clean-zero manufactory aimed at\r\n  the very #123 hunt it was built to serve. **Do not hunt for this token.** The instrument now\r\n  lives at the choosers the daemon actually executes, as `ATTACH_INTENT_CHOSEN` with a distinct\r\n  `site=` per chooser (`gap_resume` | `serve_request` | `shell_channel`), carrying the emit\r\n  discipline this one always had — intent bound once, logged and passed from that same binding,\r\n  wildcard-free label. No REQ, per the OBS-rider precedent.\r\n  - _Corrected 2026-08-04 (todlando, in the re-aim rider lane): this row previously described\r\n    the breadcrumb as a live instrument — \"intent bound once, logged and passed from the same\r\n    binding, per-call epoch makes set-vs-one readable off the log\". That sentence was true\r\n    about the emit's CONSTRUCTION and false about its REACH, and a reader consulting this\r\n    register during the #123 hunt would have been sent after a token that cannot fire.\r\n    Replaced rather than annotated, per the register's correction convention; the superseded\r\n    wording lives in git._\r\n- **Rulings that outlive the night:** a green retires NO intermittent row — grandchild and the\r\n  a4 row are INSTRUMENTED-AWAITING-FIRE, the next occurrence carries its own verdict; the\r\n  environmental family's leg 3 (runner off the fleet host) stays operator-ruled NON-OPTION\r\n  (\"stop proposing it\") — sightings accumulate in the family record, evidence files itself,\r\n  re-asking is direction; the quiesce-partial window is the sanctioned tool and it WORKED as a\r\n  discriminator (a4's red under quiesce is what forced the rig-soundness finding).\r\n- **Instrument notes minted on the way, cheap to lose:** (a) `gh run view --log` refuses for a\r\n  COMPLETED attempt while any later attempt is live (gates on the RUN) — recover per-job with\r\n  `gh api repos/<o>/<r>/actions/jobs/<id>/logs`; (b) a process-census RESIDENT COUNT is not\r\n  trendable (23→17→15 in 90s of inbox-poll CLI churn) — the CLASSIFICATION is the measurement,\r\n  the count is noise; (c) nextest's per-run LEAKY count is a free process-leakage series already\r\n  in every log (a1=12/a3=10/a4=13, and the multichunk row alone leaks 0/40 — the leaks are the\r\n  row's NEIGHBOURS); (d) diagnostic-token greps derive from the FAILING FRAME's own emit sites,\r\n  never from the register entry discussing the symptom — the gater's own\r\n  `REAP_JOB_TERMINATE_FAIL` zero over a path that emits `SERVICE_TREE_KILL_INCOMPLETE` was VOID,\r\n  and the emit sites document their own vocabulary (tree_kill_incomplete_line's doc names its\r\n  grep-partner); (e) **\"golden green ⇒ box free\" is FALSE — the ff-push that concludes a golden\r\n  STARTS the automatic post-merge ci run on the same box** (hertz, measured to the second:\r\n  Runner.Worker up 00:13:02 local = run 30886843672 job start 07:13:02Z, ~2min after the ff), so\r\n  the box empties after the POST-MERGE run, not after the golden; the box has a fourth actor no\r\n  agent steps off, woken by every main push (todlando's spelling), and post-golden sequencing\r\n  must gate on `gh run view --json jobs` of the post-merge run before any timing-sensitive work.\r\n- **Ripe when:** ~~instrument lanes land~~ (DONE, v0.54.0/v0.55.0); family sightings stay until\r\n  the family record closes them — the entry now waits on FIRES, not landings. **Size:** nothing\r\n  left to build; the next family sighting carries its own verdict via the landed instruments.\r\n- **LINUX-FACE SIGHTING + ITS RESOLUTION (doyle, v0.63.0 FIELD-SEAL goldens r1-r3 + proof runs,\r\n  2026-08-25 — the family's first measured MECHANISM, and it is environmental-amplifier ×\r\n  latent-test-defect, not a product fault):** three goldens, three DISTINCT kitsubito victims,\r\n  8/9 green each, victims migrating across same-sha reruns (r2/r3), every red a LONG death\r\n  (9.9s/59.4s/62.7s) of a fast cell — the family signature on the OTHER OS. Root-caused to ONE\r\n  window whose WIDTH varies with load: the brain's `spawn_session_pid` Spawned-wait\r\n  consumes-and-discards output racing ahead of the reply (KNOWN-HAZARDS 6.9, same-session face,\r\n  amended at `dbe3daad`); the broker execs the PTY child ~2ms BEFORE writing `Spawned`, so a\r\n  fast first chunk can be eaten. Under kitsubito's then-active kernel-audit backpressure\r\n  (see the kitsubito-audit entry below) the broker DISPATCH thread could stall arbitrarily in\r\n  that gap — the ~2ms window stretched to seconds, swallowing ANY marker prefix of ANY\r\n  spawn-wait test: random victims, long deaths, spawn-intensity × serialization scaling\r\n  (deployah's measured pair), migration across reruns. Box remediation narrowed the window back\r\n  to ~2ms, leaving exactly one knife-edge victim (a first-chunk needle, near-deterministic red,\r\n  62.7s natural-life death), fixed test-side in `dbe3daad` (v0.63.0's head). Full RCA + the\r\n  observer-effect instrument record: releases#225 comments 5417343026/5418844404.\r\n  **Standing lesson for the family:** an environmental slowdown is an accidental mitigation —\r\n  REMEDIATING a box can EXPOSE latent knife-edge races (the storm had hidden this one for\r\n  releases). And a \"random victim family\" should be tested against ONE window with\r\n  load-dependent width before positing per-victim mechanisms. The Windows face above remains\r\n  open on its own instruments; the two faces now have one shared candidate SHAPE (a race window\r\n  amplified by box load) with different windows.\r\n- **Status:** open · **Origin:** measured box event, HFENDULEAM 2026-08-04 ~05:00 local, during\r\n  USHER lane concurrency (hertz mechanism statement + both agents' reclaim arithmetic).\r\n- **What/why:** the box hit **0.00 bytes free** mid-build. Failure signatures it manufactured\r\n  look like toolchain or code defects, not disk: `rustc-LLVM ERROR: IO failure on output stream:\r\n  no space on device`, `LNK1318: Unexpected PDB error; LIMIT (12)`, `LNK1108: cannot write file`\r\n  — a red wearing a linker's face (doyle's U2 gate rig ate exactly this; verdict legs already\r\n  green survived, the suite leg had to be re-run). Contributions measured, not inferred: hertz\r\n  ~70 GB across four lane targets (er-seams **42.66 GB** cold `--workspace --tests`,\r\n  selection-probe 25.80, poolowner 1.03, ci-riders 0.91), doyle gate rig 15 GB cold full build.\r\n  Reclaim arithmetic reconciles both and neither alone: 0.00 → 25.47 GB (hertz reaps\r\n  selection-probe) → ~40 GB (doyle reaps rig). **The mechanism (hertz, ruled register-worthy):\r\n  every isolated lane worktree carries its OWN `target/`, so disk cost is multiplied by lane\r\n  count, while pool-claim — built to arbitrate a SHARED pool — sees none of it; a claim on\r\n  main's pool is ceremonial for a lane that never writes there. The tool we use to reason about\r\n  build-cache contention cannot see the resource that actually ran out.** Eight-plus worktrees\r\n  at 25–43 GB per cold full build is the shape of the next occurrence, and it will not announce\r\n  itself through pool-claim. Adjacent discipline failure the same night, named so the entry\r\n  carries it: a gater firing a cold full-workspace rig into a window with two live builder lanes\r\n  is the pre-flight question-1 failure (right-size the run) — targeted legs and warm pools\r\n  first.\r\n- **Remedy shape (sketch, not ruled):** (a) a box-level free-space floor as a RIG STEP at lane\r\n  start — the claim verb is the natural seat (print box free + du of known lane targets at\r\n  `pool-claim`, warn under a floor); kin to the CI-side `REQ-CI-FREE-SPACE-PREFLIGHT` (IR-1's\r\n  companion fix), which covers runners but not agent lane rigs; (b) teardown-on-gate-close is\r\n  already a rig step (the gate-target-disposal rule) — the gap is the AGGREGATE view across\r\n  lanes nobody owns; (c) possibly a `pool-census` xtask verb listing every `.worktrees/*/target`\r\n  with sizes, so the sweep is one command instead of a du walk each agent re-derives.\r\n- **Ripe when:** next CI/rig-touching wave, or the next ENOSPC-signature red — whichever first.\r\n- **Size:** small-medium (claim-verb print + floor; census verb optional).\r\n- **Field addendum (2026-08-04 second event, same day filed — ripeness condition met):** the box\r\n  fell under the CI runner's 32 GiB free-space floor twice more (12:31 main @9d65e65 docs-only,\r\n  12:50 PR core#144 @b110bc8) while todlando's F-lane built. Both Windows unit legs REFUSED with\r\n  `RESOURCE=disk drive=C:\\ free_bytes=…` — the `REQ-CI-FREE-SPACE-PREFLIGHT` floor did exactly its\r\n  job: a docs-only main red named the resource instead of wearing a linker's face, and triage was\r\n  one log read instead of an RCA. That is the instrument's first field catch; the CI side of this\r\n  entry is PROVEN. The agent-lane side stays open: local trough measured 8.8 GB free mid-F-lane.\r\n  Reclaim, measured before/after per the teardown rule: doyle reaped gated u1+u2 lane targets\r\n  (POOL-OWNER claims verified own+dead-holder, inbound reparse sweep clean, worktrees kept)\r\n  8.8 → 59.5 GB (+50.7); hertz reaped er-seams target (pool-release first, same discipline)\r\n  59.46 → 101.16 GB (+42.66). Refined mechanism statement (hertz, this event): the disk floor is a\r\n  per-BOX resource our per-POOL instrument is structurally blind to — pool-claim answers a\r\n  question about contention that is not the question the box ran out of.\r\n- **AXIS ADDENDUM (deployah, golden 30928816784 / USHER `fc7fad1`, 2026-08-04) — one floor reading\r\n  is a SNAPSHOT, and the swing is bigger than the margin you fire on.** Two facts this entry's\r\n  remedy (a) has to be built against, both measured rather than reasoned:\r\n  (1) **A pre-fire PROCESS census cannot see the floor at all.** Mine came back clean minutes before\r\n  the run — zero test-path `spt.exe` residents, zero `cargo`/`rustc`/`link`/`cl` — and both Windows\r\n  legs then died in the disk preflight (`drive=C:\\ free_bytes=26099576832 floor_bytes=34359738368`,\r\n  `RESOURCE=disk`, exit 1) with a 128-line log carrying ZERO `Compiling`/`PASS`/`FAIL`/`Summary`\r\n  lines: no test signal, and the merge chain never indicted. Both readings were TRUE at the same\r\n  instant — the gater's finished assembly gates were sitting on disk as a DIRECTORY, not running as\r\n  a process. A process-axis probe is blind to a finished build's cost by construction; \"re-check\r\n  closer to the fire\" would have changed nothing, because the axis was never read.\r\n  (2) **The floor number itself moves by tens of GB inside one run window.** Same box, same drive,\r\n  same run, pulled from its own logs: `16:22:55` test-Windows free=26099576832 REFUSED · `16:23:07`\r\n  n1-gate-Windows free=26096607232 REFUSED · `16:46:54` twohost-a free=71033049088 PASSED and then\r\n  ran 11 minutes to success. ~45 GB returned with NO deliberate teardown, and my own reading at\r\n  17:13:45Z was 61352714240 — ~10 GB BELOW what twohost-a saw 27 minutes earlier. The observed swing\r\n  amplitude EXCEEDED the margin I was about to fire on (25.14 GiB).\r\n  So the rule remedy (a) must encode: measure BOTH axes (process residents AND free space against\r\n  the workflow's own 32 GiB floor), and reclaim until the margin exceeds the observed SWING, not one\r\n  sample. Triage corollary, equally load-bearing: twohost-a runs the same preflight on the same C:\r\n  and PASSED, so a preflight refusal is a threshold event on a moving number — never evidence the\r\n  box cannot run the work, and never by itself a reason to indict a merge chain.\r\n- **THIRD ADDENDUM (deployah, v0.54.0 cut, 2026-08-04) — the sweep answers \"0 B reclaimable\"\r\n  TRUTHFULLY on a box that cannot run its own work, because the reclaimable population and the\r\n  owned-lane population are DISJOINT.** This hazard blocked a release twice before it was seen.\r\n  Both Windows legs at the shipped sha `86f0d84` refused at the guard before compiling anything —\r\n  `ci.yml` at `free_bytes=28167569408` (26.2 GiB) and `release.yml` at `27690885120` (25.8 GiB),\r\n  both against `floor_bytes=34359738368`. `assemble` skipped in consequence, so no draft release\r\n  existed: the release was hard-blocked on disk, not on code. Neither leg produced a test verdict,\r\n  so both are LABELLED HOLES, not reds (ruled recorded-and-proceed by doyle, the shipped-sha delta\r\n  being 5 files and zero `.rs`).\r\n  **The finding is not the disk.** `xtask pool-sweep --root .worktrees` reported, correctly,\r\n  `total 66.43 GB across 3 pool(s); 0 B reclaimable in this sweep's scope` while the box sat ~6 GB\r\n  under its own floor. The sweep is behaving as designed — it refuses to reap owned, live lanes.\r\n  But the floor reasons over an AGGREGATE the sweep is forbidden to touch, so the designed\r\n  instrument, run at the exact moment of refusal, tells an operator there is nothing to reclaim.\r\n  That is true and useless. The gap between \"the sweep is correct\" and \"the box can run work\" is\r\n  the defect; it is not fixed by making the sweep more aggressive.\r\n  **Aggregate measured under `.worktrees`** (real target bytes, junction-classified first): 87.79 GB\r\n  across 9 lanes — 2.7x the entire 32 GiB floor. Registered pools: `w1t2-relink-force` 54.67 GB,\r\n  `obs-resume-attach-intent` 10.18, `w1t2-subnet-status` 1.58. Carrying targets the sweep does not\r\n  count as claimed pools: `hertz-teardown-bound` 11.25, `hertz-liveresolve-diag` 4.83,\r\n  `hertz-psyche-bound` 4.19, `hertz-poolowner` 1.03, `hertz-ci-riders` 0.91.\r\n  **The 54.67 GB single lane is NOT waste** (doyle's classification, ratified at this filing): a\r\n  verb lane at that size is workspace-all-targets e2e cost. No lane is misbehaving. That is what\r\n  makes this structural rather than a cleanup task — every lane is individually justified and the\r\n  sum still exceeds the floor.\r\n  **Reclaim taken, and its boundary.** 82.12 GB, from `spt-core/target` — the release driver's OWN\r\n  main-checkout pool, NOT a lane; free 23.23 → 105.34 GB. Classified before removal per the\r\n  teardown rule: OUTBOUND `Get-Item -Force` reported a real directory rather than a reparse point,\r\n  the INBOUND sweep found zero reparse points aimed at it, `CARGO_TARGET_DIR` was unset (no env\r\n  aliasing), the target SUBTREE only was reaped, both sides measured.\r\n  **Snapshot behavior reproduced inside this measurement window**, corroborating the axis addendum\r\n  above at a smaller amplitude: free read 25.49 GB when first measured and 23.23 GB at the reap\r\n  minutes later — it drifted 2.26 GB DOWNWARD while the operator was deciding what to do about it.\r\n  **Priced side effect, for the next reader:** reaping the main pool took the prebuilt `xtask` with\r\n  it, so the next lane claim rebuilds it first — the lane-check shortcut is cold until then. It cost\r\n  a 2m11s cold rebuild inside this release's own publish step.\r\n  **What this does NOT license:** reaping another agent's owned lane to clear a floor. The sweep's\r\n  refusal is correct and stays. What is missing is an AGGREGATE-AWARE signal — the box knowing its\r\n  lanes sum past the floor *before* a run is dispatched into a guard that will decline it.\r\n- **FOURTH ADDENDUM (doyle, 2026-08-04 late evening — fourth event in one day, and the first\r\n  RULING on this entry).** C: hit **0.44 GB free** during doyle's lane-2 stack gate and todlando's\r\n  re-aim leg set. Signatures manufactured this time, all initially read as something else:\r\n  `os error 112` mid-rlib-archive surfacing as xtask \"building spt failed\" (exit 101); a\r\n  servicehost force-kill unit red at a sha gated GREEN on the same rig an hour earlier; todlando's\r\n  6-of-7 leg table red with `LNK1318` while only traceable-reqs survived. Both agents' verdicts\r\n  from the window were VOIDED and re-run, not re-read.\r\n  **Discriminator correction (hertz, ratified at this filing):** \"treqs alone survives\" is a\r\n  POSITIVE TELL, never a clearing test — a full disk reds BEFORE any link step (rustc writing\r\n  rlibs), and treqs can red for its own reasons; signature absence says NOTHING. The only\r\n  falsifier for \"this red was the disk\" is free space AT RUN TIME, and no log on the box recorded\r\n  it, which made every red from the window unanswerable after the fact.\r\n  **RULING (doyle):** every rig/gate script records `FREE-AT-START` / `FREE-AT-END` in its own\r\n  SUMMARY — one line each, the datum that makes a disk confound answerable post-hoc. Effective\r\n  immediately for hand-authored rigs; hertz builds it into the shared rig harness at next touch\r\n  (assigned, not unasked). This is remedy (a) narrowed to its cheapest load-bearing slice.\r\n  **Reclaim, all FS-delta-measured:** todlando +59.4 GB (obs-resume-attach-intent 8.56 +\r\n  w1t2-relink-force 50.83; 0.44 → 59.83), hertz +1.79 GB (ci-riders + poolowner; sum-of-lengths\r\n  said 1.94, the FS delta governs; 59.09 → 60.87), doyle +38.8 GB (w1t2-subnet-status +\r\n  w1t2-perch-gc + w1t3-node-verb targets; 60.75 → 99.54). Full discipline each: outbound\r\n  classification, inbound reparse sweep (zero), CARGO_TARGET_DIR confirmed unset, subtree-only.\r\n  **Mechanism sharpened by this event:** the standing swing IS the finished-lane population —\r\n  ~110 GB of pools belonging to lanes already GATED AND PUSHED, held for hours because disposal\r\n  fires at GATE close (a rig step) while nothing fires at LANE finish; a pushed lane awaiting\r\n  assembly holds its pool invisibly. Corollary corrections carried: todlando withdrew his\r\n  name-based pool census (10x off; ancestry, not directory names, classifies a pool as closed),\r\n  and hertz-selection-probe's worktree removal REFUSED Permission denied — IR-38's second holder\r\n  class recurring, left for retry rather than forced.\r\n\r\n- **FIFTH ADDENDUM (deployah, v0.63.0 FIELD-SEAL golden, 2026-08-25) — SCOPED DELIBERATELY TO ONE\r\n  CONSEQUENCE: reaping a pool UNCLAIMS its tree, and the next builder meets a refusal that is the\r\n  rule working.** (The disk-floor mechanism from the same event is doyle's to file at his\r\n  release-close sweep — one voice each, by division agreed in-window. This addendum stops at the\r\n  pool-claim consequence and deliberately does not restate the floor finding.)\r\n  Five FIELD-SEAL lane pools were reaped to clear the golden floor — gate rig `gate-222-ca30a79e`\r\n  plus lanes `fix-222`, `w2-seal-ux`, `w3-ingest`, `w4-exit-subject`; **148.48 GB measured by FS\r\n  delta**, free 1.37 → 149.84 GB, worktree checkouts kept, `main/target` untouched by ruling.\r\n  **The consequence to record:** `POOL-OWNER.json` lives INSIDE `target/`, so reaping the subtree\r\n  takes the claim with it. Those five trees are now **UNCLAIMED — which is fresh-not-foreign**, a\r\n  different state from the `SPT_POOL_FOREIGN` refusal. Whoever resumes one of those lanes (a hertz\r\n  fixup, a golden-red rebuild) must run `cargo run -p xtask -- pool-claim --pool <dir> --label\r\n  <lane>` **from that worktree** before the first build, or `crates/spt-store/build.rs` refuses.\r\n  **A refusal there is the rule working, not a defect** — filed precisely so a later reader does\r\n  not open an issue against the build script for behaving correctly. Naming it costs one line;\r\n  the alternative is an RCA against our own guard.\r\n  **Prediction-vs-meter, corroborating hertz's fourth-addendum note at ~75x its scale:** pre-reap\r\n  sum-of-lengths sizing predicted 163.9 GB; the FS delta paid 148.48 GB, a 15.4 GB shortfall left\r\n  UNEXPLAINED here rather than rationalized (allocation granularity, sparse/compressed extents and\r\n  concurrent writes all sit between the two meters). **The FS delta governs** — hertz ruled this at\r\n  1.94-vs-actual and it holds at three digits. Report the meter, never the estimate that agreed\r\n  with your plan.\r\n  **Discipline executed, for the audit trail:** outbound classification re-read AT REAP TIME (all\r\n  five real dirs, zero LinkType); inbound sweep over **2854** reparse points under `projects\\`\r\n  found zero aimed at any victim; `CARGO_TARGET_DIR` confirmed empty in process, **Machine and\r\n  User** scope (the arm that leaves no directory entry to notice afterwards); process census\r\n  RE-RUN at reap time rather than carried from a peer's snapshot — zero builders, zero processes\r\n  imaged out of a victim pool, both live `spt` images resolving to the installed path. The peer's\r\n  snapshot proved correct; it was re-run because a snapshot is not a standing property, which is\r\n  the reason it was offered with that caveat.\r\n\r\n### IR-32 — Docs-drift gate blesses its own gen: an empty-emitting producer agrees with itself perfectly\r\n- **Status:** open · **Origin:** todlando mid-lane stop-and-report, U1 (#144) 2026-08-04. Filed by\r\n  the builder to the gater deliberately — register shape is doyle's to own.\r\n- **What/why:** with a defective binary in the tree (stack-overflowed before reaching its own\r\n  code, empty stdout, non-fatal to the generator), `cargo run -p xtask -- gen` wrote\r\n  `docs-site/src/cli/reference.md` reduced to EIGHT lines — title, do-not-edit banner, empty code\r\n  fence — deleting 3193 lines of published CLI reference. `xtask check` then exited 0, because\r\n  the drift gate compares what the binary emits NOW against what the file holds, and gen had just\r\n  overwritten the file with exactly that emit. **A producer that emits nothing agrees with itself\r\n  perfectly.** Caught only because the builder grepped the regenerated page for his new flag\r\n  names and treated the clean zero as suspicious ([[zero-match-filter-reads-as-absent]] shape);\r\n  the gate itself would never have said a word, and the gutted public reference ships green.\r\n  The mechanism generalizes past the stack overflow that exposed it: ANY failure mode that makes\r\n  `spt --help` produce empty stdout while exiting non-fatally to the generator gets the same\r\n  green. Kin to [[cli-command-docs-drift]] (the gate this defeats) — the gate detects DRIFT\r\n  between binary and page, and is structurally blind to a page just regenerated from a broken\r\n  binary.\r\n- **Remedy shape (builder's sketch, sound; not yet ruled on seat):** a floor in `xtask gen` —\r\n  refuse to write a page whose help block is empty, or whose output is implausibly shorter than\r\n  the file it replaces — so the generator fails loudly instead of producing a stub the gate\r\n  blesses. Gen is the right seat: check runs in CI on a fresh emit too, so a check-side floor\r\n  alone still lets a local gen gut the working tree.\r\n- **Ripe when:** next docs-tooling or xtask-touching lane; SOONER if any lane regenerates the CLI\r\n  reference before the floor exists (a gate on that lane must assert page LENGTH, not gen's exit\r\n  code, until this is built).\r\n- **Size:** small (one refusal + a length-plausibility floor in gen).\r\n\r\n### IR-33 — Debug-build clap Command tree runs near the main-thread stack ceiling; the margin is THREE net new args, bisected at `8f291e1` (the original ~6 was measured on U1's tree and is superseded)\r\n- **Status:** open · **Origin:** todlando U1 (#144) 2026-08-04, delta-tested mid-lane.\r\n- **What/why:** eight extra hidden bool args across the five knock seats grew the derive-built\r\n  Command tree past what the debug binary's main thread stack can construct: EVERY invocation\r\n  (`spt --version` included) died with `thread 'main' has overflowed its stack`, exit\r\n  -1073741571, before reaching any of its own code. Delta-tested, not assumed: the same command\r\n  on the main-pool binary from main printed normally. U1 repaired its own trigger (raw-argv\r\n  pre-scan for retired flags before clap parses; lane ends net +2 args) — but the CEILING\r\n  remains: the tree is now close enough that a handful of net new arguments in a debug build\r\n  reproduce a total binary outage — **and the handful is THREE, not six; see the correction\r\n  below before planning against this entry.** **#5's verb-surface rework is the next lane that adds\r\n  arguments and it is much bigger than U1** — this entry exists so #5 is planned knowing the\r\n  margin, not discovering it. Note the failure's face: it presents as a broken binary, and via\r\n  [[IR-32]] it presents as a silently gutted docs page — neither names the stack.\r\n- **CORRECTION — the margin is THREE, bisected at `8f291e1` (todlando's U3 lane\r\n  `build/usher-u3-verb-surface`, own pool, debug profile; filed by deployah 2026-08-04).** The\r\n  original ~6 was measured on U1's tree and was right when written; it is wrong now, and the\r\n  difference is the difference between \"plan carefully\" and \"one flag anywhere takes the binary\r\n  down\". N hidden bool args added to the ROOT `Cli` derive, tree restored from git between every\r\n  row, `--version` as the invocation (it carries no work of its own, so whatever it costs IS tree\r\n  construction):\r\n\r\n      N=0  exit 0                OK  (control — unmodified lane binary answers `spt 0.53.0`)\r\n      N=1  exit 0                OK\r\n      N=2  exit 0                OK\r\n      N=3  exit -1073741571      STACK-OVERFLOW\r\n      N=4 / N=6 / N=8            STACK-OVERFLOW\r\n\r\n  PLACEMENT DIFFERENTIAL, run because #5 adds args at `EndpointCmd` seats rather than at the root\r\n  and a root-only number could have measured the wrong thing: same N injected inside a NESTED\r\n  endpoint seat gives `SEAT N=2` OK, `SEAT N=3` STACK-OVERFLOW. **Identical ceiling — placement does\r\n  not move it**, so three is the number for the shape #5 actually builds. (Rig hazard worth keeping:\r\n  the first seat attempt produced a COMPILE error, E0027, because the dispatch destructures that\r\n  variant exhaustively — taken at face value it would have read as \"the seat is fine\". Both rows\r\n  above are from the fixed rig.) CONSEQUENCE FOR #5: the ratified MIN spelling ends net +2, i.e. it\r\n  would have shipped with ONE argument of headroom, and any later lane adding a single flag anywhere\r\n  in the tree would then take the whole binary down, `--version` included. Remedy (b) below stops\r\n  being \"buys headroom\" and becomes the precondition for #5 shipping safely.\r\n- **Remedy shape (sketch, not ruled):** (a) cheapest tooth — a debug-build smoke that runs\r\n  `spt --help` and asserts non-empty stdout + exit 0, which also backstops IR-32's trigger;\r\n  (b) raise the main thread stack for the binary (build config), buying headroom without\r\n  restructuring; (c) structural — box/flatten the derive tree so construction cost stops scaling\r\n  with arg count. (a) is a rider candidate for any lane; (b)/(c) want a real measurement of\r\n  where the ceiling sits before choosing.\r\n- **Ripe when:** #5 (U3 verb surface) PLANNING — this is a planning input, not just a build item;\r\n  the smoke tooth (a) is ripe for the next CI-touching lane regardless.\r\n- **Size:** small for (a); medium for (b)/(c) with the measurement.\r\n\r\n### IR-34 — nextest LEAK flag on the zombie-fixture row is dominant-but-intermittent (19/20 measured); any gate reading it as a signal flaps\r\n- **Status:** open · **Origin:** doyle #142 F-lane gate 2026-08-04 (first sighting in a gate run);\r\n  characterized same day by hertz from retained logs, ownership falsified by todlando.\r\n- **What/why:** `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (the\r\n  ADR-0041 zombie-detection fixture, whose subject is a corpse process kept alive-looking by a HELD\r\n  HANDLE) flags nextest LEAK on most draws but not all — measured 19 LEAK of 20 on a tree carrying\r\n  no #142 content (`test/grandchild-selection-probe` @`695398b`, based on `4b37512`: lib arm 10/10\r\n  LEAK across 822-test runs; full-suite arm 9/10 across 1044-test runs). The single clean PASS\r\n  kills \"intrinsic therefore always\": leakiness is DOMINANT BUT INTERMITTENT. Consequences:\r\n  (1) a gate or reader that treats this row's LEAK as a defect signal flaps at roughly 1 in 20;\r\n  (2) one non-leaky run is NEVER evidence that something fixed it (kin:\r\n  [[intermittent-green-is-zero-information]]); (3) the verdict method that closed it is the\r\n  template — two independent legs, neither load-bearing alone: the suspect lane's diff grepped\r\n  zero hits on the row's subject (zombie / handle_held / OpenProcess / corpse), AND a 20-draw\r\n  baseline on a tree predating the suspect change. This entry exists so the next gater who sees\r\n  the flag reads one register line instead of running that RCA cold.\r\n- **Remedy shape (sketch, not ruled):** annotate the row as expected-leak in nextest config\r\n  (per-test `leak-timeout` override or documented allowlist) so the flag stops presenting as\r\n  signal; alternatively a fixture-side close of the held handle on the clean path if ADR-0041's\r\n  arrangement permits — hertz's call, test/CI lane.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** hertz's next nextest-config-touching lane; blocks nothing today.\r\n- **Size:** small.\r\n\r\n### IR-35 — hfenduleam Windows test-leg victim rate: one teardown/liveness family, measured at ~half of all executions\r\n- **Status:** open · **Origin:** USHER #150 golden triage 2026-08-04 (doyle; all rates deployah-measured).\r\n- **The numbers (15 golden runs 2026-08-02..08-04 + the USHER cycle, deduped on `(run, box,\r\n  started_at)` — GitHub partial reruns COPY untouched jobs into the new attempt with their ORIGINAL\r\n  `started_at` and carried conclusion, so a carried failure is the SAME observation; dedupe before\r\n  any rate math):** Windows (hfenduleam) 13 red / 22 executions = 59% leg-red, splitting 10/22 = 45%\r\n  test-victim + 3/22 infra (IR-31 class). Linux (kitsubito) 2/20 = 10%, 1 victim. Every victim-red\r\n  leg had EXACTLY ONE victim (8/8 legs). Clean-cycle arithmetic ≈ 0.55 × 0.95 ≈ half — a golden\r\n  cycle at these rates is a coin flip. knock145 (the previous green golden) took FIVE Windows\r\n  executions to its green; USHER took four. **A both-green draw is a draw, not evidence the family\r\n  closed.**\r\n- **The family:** 11 victim legs, 8 distinct tests, ONE cluster — process teardown / kill-reach /\r\n  respawn-controller survival, concentrated on hfenduleam. Per-victim dispositions live in the USHER\r\n  #150 triage ledger (releases#150 record). The only surviving cross-sha EXACT repeat after source\r\n  verification is `resume_no_control_steal_e2e` (:488, byte-identical @2138b16 + @4b37512) — and\r\n  both its reds PREDATE the post-#145 producer-side instrumentation, so what repeats is an AMBIGUOUS\r\n  observation (stolen controller vs starved child) twice; only a post-#145 red discriminates. The\r\n  `a_tree_teardown` pair was a FALSE repeat — two mechanisms wearing one assert string (see\r\n  FLAKE-LEDGER row; the counting lesson: assert-body identity must include the polled predicate's\r\n  SUBJECT).\r\n- **Off-CI discriminator (todlando 2026-08-04):** 0/400 (A 0/200 + B 0/200, interleaved,\r\n  `--test-threads 1`, filters positive-controlled, by-path sweeps every iteration) on the warm\r\n  d449ce5 pool UNDER live-fleet load (CPU 46-59%, 13-18 spt processes). Points the family at the\r\n  RUNNER ENVIRONMENT rather than a product race any Windows box expresses — not exoneration (absence\r\n  of reproduction is not proof of absence), but where the next hour goes. A-alone N=500 on the\r\n  instrumented tree ran post-close (result on releases#150).\r\n- **Remedy lanes already moving:** hertz 4-item test-rework package dispatched 2026-08-04 (psyche\r\n  bound split, live_resolve rig instrumentation, green-capture probe profile, resident_service/\r\n  teardown hardening); prod `wait_bounded` tree-kill-on-timeout filed to board as EVAL. This entry\r\n  is the RATE's home — it leaves the register when the operator has ruled on the rate (accept vs\r\n  hold-for-hertz) AND the hertz package has landed with a re-measured victim rate.\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); the rate re-measure rides that lane's landing.\r\n- **Ripe when:** operator brief at USHER close (immediate); re-measure after the hertz package lands.\r\n- **Size:** visibility entry + the re-measure; fix cost carried by the hertz package.\r\n\r\n### IR-36 — `output_bounded` is a 51-copy clone estate with a named-but-empty shared home; hoist-and-delete wants its own lane\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** hertz measurement\r\n  2026-08-04 (at `7465ac1`, counted before listing, listed untruncated), during the USHER package\r\n  item-2 sweep ruling; doyle ruled file-don't-sweep.\r\n- **What/why:** 51 `fn output_bounded` definitions under `crates/spt/tests` — 50 per-file copies\r\n  plus `tests/common/mod.rs:53`, which is NOT pub, has ZERO callers outside its own module, and\r\n  whose doc comment states outright that the estate's copies predate the shared module. The lossy\r\n  timeout arm (panic loses everything captured, names nothing) is in 38 sites across 36 files.\r\n  The copies have already drifted: two variants of the deadline expect-string exist in the estate\r\n  (`\"captured spt call must complete within its deadline\"` in common/mod.rs:60 vs the\r\n  no-deadline-clause spelling in per-file copies), so a grep keyed to either string undercounts.\r\n  The right fix is a hoist-and-delete refactor (make the common copy pub, adopt it estate-wide,\r\n  carry the item-2 diagnostic arm once) — a 50-file test-estate touch that must NOT ride golden\r\n  cadence as a rider or hide inside a scoped diagnostics item (ADR-0050 thin-lane rationale;\r\n  hertz's USHER item 2 stays scoped to live_resolve, which keeps ONE improved copy as the model).\r\n- **Built evidence:** one public owning helper replaced all 50 file-local\r\n  clones. It owns and tree-kills a timed-out child, waits for reap, drains both\r\n  pipes, and includes the deadline plus partial stdout/stderr in the panic.\r\n  A dedicated regression observes both diagnostics and proves the timed-out PID\r\n  is gone.\r\n- **Ripe when:** a dedicated post-batch test-hygiene lane (natural companion to IR-13's\r\n  mutation-proof loop and IR-23's home-collision fix — same hertz wave shape).\r\n- **Size:** medium by file count, small by risk (mechanical hoist; no assertion changes).\r\n- **Hygiene-lane scope addition (todlando, at #6, 2026-08-04):** a CI prebuild of\r\n  `cargo build -p mock-adapter --bin mock-shell` (derived from tracked `.github/` content) turns\r\n  SIX binedge baseline rows green at once instead of growing the burn-down list one consumer at a\r\n  time — belongs to this lane, not to any thin verb lane. [[IR-38]] (live-binary e2e reap sweep)\r\n  rides the same lane.\r\n- **Built evidence:** all 51 file-local definitions are gone; 158 call sites use the one public\r\n  `common::output_bounded`. The shared helper owns the child, kills and reaps its process tree on\r\n  timeout, drains both pipes, and reports partial stdout/stderr. `bounded_output_e2e` mutation-pins\r\n  both timeout ownership and retained diagnostics.\r\n- **Declared validation extra:** the lane's docs-link gate exposed that `llms_target_exists` treated\r\n  generated targets as absent before generation. Its small refactor + unit keeps source and\r\n  generated link targets distinct; it is deliberate validation fallout, not part of IR-36.\r\n\r\n### IR-37 — `traceable-reqs check` is coverage-only: tag PLACEMENT is unenforced on any multi-tagged REQ, and the more tags a REQ accumulates the less any one is checked\r\n- **Status:** UPSTREAM CLOSED THROUGH RELEASE 2026-08-19 — traceable-reqs PR #19 squash-merged\r\n  @`82d8b14` after doyle's targeted re-review PASS (defect A item-tables + 9 red-first regression\r\n…\n  EXIT=0 on BOTH sides — the green he had cited beside the fix validated nothing.\n…\n","startLine":1526,"lineNumbers":[1526,1527,null,1684,null,1696,1697,1698,1699,1700,1701,1702,1703,1704,1705,1706,1707,1708,1709,1710,1711,1712,1713,1714,1715,1716,1717,1718,1719,1720,1721,1722,1723,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1751,1752,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,1775,1776,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1796,1797,1798,1799,1800,1801,1802,1803,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,1814,1815,1816,1817,1818,1819,1820,1821,1822,1823,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1835,1836,1837,1838,1839,1840,1841,1842,1843,1844,1845,1846,1847,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,1858,1859,1860,1861,1862,1863,1864,1865,1866,1867,1868,1869,1870,1871,1872,1873,1874,1875,1876,1877,1878,1879,1880,1881,1882,1883,1884,1885,1886,1887,1888,1889,1890,1891,1892,1893,1894,1895,1896,1897,1898,1899,1900,1901,1902,1903,1904,1905,1906,1907,1908,1909,1910,1911,1912,1913,1914,1915,1916,1917,1918,1919,1920,1921,1922,1923,1924,1925,1926,1927,1928,1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940,1941,1942,1943,1944,1945,1946,1947,1948,1949,1950,1951,1952,1953,1954,1955,1956,1957,1958,1959,1960,1961,1962,1963,1964,1965,1966,1967,1968,1969,1970,1971,1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982,1983,1984,1985,1986,1987,1988,1989,1990,1991,1992,1993,1994,1995,1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,2022,2023,2024,2025,2026,2027,2028,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2039,2040,2041,2042,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,2055,2056,2057,2058,2059,2060,2061,2062,2063,2064,2065,2066,2067,2068,2069,2070,2071,2072,2073,2074,2075,2076,2077,2078,2079,2080,2081,2082,2083,2084,2085,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2110,2111,2112,2113,2114,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,2155,2156,2157,2158,2159,2160,2161,2162,2163,2164,2165,2166,2167,2168,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2181,2182,2183,2184,2185,2186,2187,2188,2189,2190,2191,2192,2193,2194,2195,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,2210,2211,2212,2213,2214,2215,2216,2217,2218,2219,2220,2221,2222,2223,2224,2225,2226,2227,2228,2229,2230,2231,2232,2233,2234,2235,2236,2237,2238,2239,2240,2241,2242,2243,null,2251,null,2296]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5781,"totalBytes":49392,"outputLines":548,"outputBytes":49392,"shownRange":{"start":1696,"end":2243},"nextOffset":2244}}},"isError":false,"timestamp":1789094605732}}
{"type":"message","id":"cb8eb73e","parentId":"9b385c85","timestamp":"2026-09-11T02:43:25.764Z","message":{"role":"toolResult","toolCallId":"call_L1Fesn2YMj3f3ARzurzzApDN|fc_074aee81620ae383016aa36acb3ea887d19e7be88b1c372c2d","toolName":"read","content":[{"type":"text","text":"## OPEN\n…\n### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n…\n- **Size:** small.\n\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\n  source same night.\n- **What/why:** `ci.yml`'s `changes` job classifies docs-only diffs ONLY for `pull_request` events\n  — push events hardcode `code=true` (ci.yml:45–48, an explicit branch, not a fallthrough), so\n  every docs-only push to main spins both full unit legs. Tonight: five register docs pushes each\n  queued a Windows unit leg on hfenduleam; concurrency kept one running + one pending (main is\n  never cancelled in-progress, pending runs supersede — the recorded behavior matches ci.yml:9–13).\n  FINDING SETTLED (deployah, same night, from the workflow): this is not intent — it is a scope\n  the classifier never had; the `*.md` / `traceable-reqs.toml` case arms are only ever REACHED on\n  pull_request (the early-return precedes them), and golden.yml's own hardcoded `code=true` is\n  unrelated (golden triggers only on golden/**). REMEDY STILL OPEN on a named tension: extending\n  the classifier to pushes leaves a docs-only main TIP with no run of its own — fine if\n  tested-sha==merged-sha means \"the code at this sha was tested\" (it was, at the last code sha),\n  not fine if any gate or reader takes \"main tip has a green run\" as the check. One person reads\n  the consuming gates before any remedy (doyle, at the next CI-touching wave) — three assuming is\n  how this class ships.\n- **Resolution:** the consuming contract already answers the held question:\n  `REQ-CI-DOCS-ONLY-THIN` is PR-only and explicitly says ADR-0050 supersedes\n  it for main pushes. Main-tip evidence remains full by design; no classifier\n  branch was widened.\n- **Interim rule (doyle, same night):** batch register edits into one push instead of landing them\n  as they occur — the cadence is a real gate on whoever is queued behind the runner.\n- **Ripe when:** next CI-touching wave, after the intent question is answered on the REQ record.\n- **Size:** small (one conditional, if the answer is \"extend\").\n- **Composed:** LOCKSMITH (#132) — doyle reads the consuming gates during the batch's CI-touching\n  wave (the intent question), BEFORE any classifier remedy. 2026-08-03.\n\n### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\n- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\n  (hfenduleam, log kept); routed text, doyle-landed.\n- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\n  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\n  rel Killed, brain Killed]; the brain's kill line names it `(child process of PID 46896)` — the\n  daemon — so the daemon was still resident too and was taken down by the `Child` handle, not the\n  stop. A stop that worked would have left the reaper `gone`. This rules OUT the innocent reading\n  (stop doesn't manage services): the stop did not reach the DAEMON either.\n- **NOT ESTABLISHED — two rungs, neither discriminated:** (1) the rig seeds a `doyle` perch with\n  `std::process::id()`, satisfying `ceremony_agent_ground`'s pid-ancestry rung for every child of\n  the harness; (2) the rig never scrubs `OWL_SESSION_ID`/`SPT_AGENT_ID`/`SPT_ENDPOINT_ID` from its\n  teardown commands, and the measuring run launched from a live agent session, so the env rung was\n  live too. `--force` overrides neither. The stop's output is discarded at the call site\n  (`let _ = spt(...)`) — no diagnostic names a denial, and no claim is made that one fired.\n  Settling it is one run with the stop's stderr captured — on the CI runner AS WELL AS the dev box,\n  since the rungs fire on different machines.\n- **Why it matters beyond this rig:** REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own failure shape\n  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\n  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\n  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\n  the work. Exactly why the population gate exists rather than per-pid checks alone.\n- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\n  three markers — REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own gate) is NOT free here: this rig's\n  `doyle` perch pid is load-bearing for the shell bind-by-token legs, so the two remedies are not\n  interchangeable — a lane taking this must check which legs depend on the pid before changing it,\n  or it fixes the stop and breaks the REQ-INSTALL-11 legs the rig exists for. Kin:\n  REQ-BROKER-STOP-ENDPOINT-DENY (the refusal being worked around).\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\n- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\n- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\n\n### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\n  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\n  both mechanisms measured at the cut, neither cost this run anything because the driver caught\n  them by hand. Filed at the release-close register sweep.\n- **What/why (three runbook amendments, one lane):**\n  1. **Release-shaping at ASSEMBLY intake, not post-golden.** The head arrived code-complete\n     but not release-shaped (no version bump, stale CHANGELOG top section) — 5 of the last 6\n     cuts. v0.59.0 fixed it by authoring version material BEFORE the golden run, which is what\n     produced the four-name shape (ruled sha == main tip == golden ref == tag == `c62904e7`,\n     first time in six cuts; the previous five each argued a post-golden delta inert). Amend\n     `docs/golden-head-intake` so the gater's assembly checklist asks the release-shaping\n     question at intake and the driver never authors on top.\n  2. **Never-executed-cells list is a hand-off artifact.** The runbook makes it a\n     gater-compiles / driver-re-checks item; PORTER's handoff omitted it and the driver had to\n     ask. Name it in the assembly checklist beside the greenlit-form delta: which new cells'\n     first CI execution is this golden, and where each HAS executed (lane gate / assembled\n     head) — it converts a golden red from an RCA into a lookup.\n  3. **Lockfile-refresh rule states the PROPERTY, not the command.** Step 1 prescribes\n     `cargo metadata --offline`; the driver used `cargo update --workspace --offline` and\n     proved the actual rule by diff (workspace members only, third-party pins untouched —\n     14 first-party line pairs, 90 third-party unchanged). The property is the rule and the\n     diff is its evidence (the standing by-diff rule exists because counting misread v0.39.4\n     and v0.41.0 in opposite directions — and the `windows-sys` 0.59.0 collision was LIVE at\n     this cut, the exact condition where counting fabricates a 15th \"first-party\" bump);\n     demote the command to an example vehicle.\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now asks the release-shaping question at assembly\n  intake, makes the never-executed-cells list part of the hand-off itself, and states lock refresh\n  as a diff-proven property with commands demoted to example vehicles. PR #176 passed\n  `traceable-reqs check`; the v0.65.0 cut had already exercised the release-shaped-head rule.\n- **Size:** small (one runbook doc lane; no code).\n\n## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\n\n- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\n  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\n  a live lane is never re-homed mid-flight. When each closes, any residue lands here as a new entry.\n\n## BUILT / RETIRED\n\n### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\n- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\n- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\n  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\n  (identity pinned at find time, re-verified at assert), both pid-only polling sites repinned\n  (daemon.rs teardown test; endpoint_lifecycle.rs relay_pid). Ruled polarity held: Absent⇒gone,\n  Present(same start)⇒not gone, Present(different)⇒gone, Unproven⇒NOT gone, missing-stamp\n  degrades to pid-only loudly — every unknown errs toward the recoverable red, zero new\n  false-green paths. Linux caveat documented in the helper (10ms jiffies: Present(different) is\n  narrowing, not decisive; same-tick reuse errs red, safe).\n- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\n  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\n  GREEN; main ff'd to a5042ec.\n- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\n  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\n  arm); rule-of-three bounds the original flake at ~7.5%/run/sha. Specimen 30776330383 remains\n  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\n  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\n  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\n  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\n  test-side rather than product-side. A recurrence must discriminate between them, not assume\n  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\n  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\n  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\n  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\n  healthy runs and discriminates nothing.)\n\n### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\n  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\n  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\n  day**: remedy (1) claimed the 11 same-package sites were missing a build edge, and todlando\n  falsified that by measurement while executing it (replicated independently by doyle). The error was\n  doyle's to carry — it was ruled on, not just written. The general rule that refutes it was already\n  in this entry's own CI-member section; diagnosing a class does not inoculate you against drawing\n  its opposite consequence one section later.\n- **Numbers below re-derived on `main` @`3efd7e6` over `git ls-files` (tracked files only). Each\n  carries its command; re-run rather than cite.**\n- ⚠ **Scan-root hazard, measured 2026-08-03 and worse than first reported:** a naive recursive\n  `grep -r` from the project root inflates by **~35×**, not the ~5× an earlier draft of this entry\n  claimed — 426 tracked `.rs` against 14,865 on disk with `target/` excluded, because `.worktrees/`\n  holds full copies of the tree. **And the unscoped grep does not COMPLETE** (still running at a\n  120s timeout while `git ls-files` returns instantly), so the failure mode is not only a wrong\n  number but a command that reads as hung on a tree where dozens of worktrees are normal. Use\n  `git grep` or `git ls-files | xargs grep`; both are scoped to tracked files by construction.\n\n#### THE MECHANISM (measured, both ends)\n\n**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\nnever emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\nfive executables, every one hash-suffixed under `target/<profile>/deps/`, and ZERO plain exes in\n`target/<profile>/`. The bin was built. The file the test looks for was not written.\n\n**Consumer end — the resolver borrows a guaranteed binary's path to locate an unguaranteed one.**\nAll 29 copies of `sibling_bin` in `crates/spt/tests/` reduce to two textual variants (22 + 7) of one\nbody:\n\n```rust\nfn sibling_bin(name: &str) -> PathBuf {\n    PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"))\n        .with_file_name(format!(\"{name}{}\", std::env::consts::EXE_SUFFIX))\n}\n```\n\n`CARGO_BIN_EXE_spt` is used **only as a directory anchor**. Cargo therefore sees a dependency on\n`spt` and on nothing else; the `{name}` half is a string join it cannot observe. The dependency edge\ndoes not exist at any level a build system could act on — which is why \"use the wider command\" is\nnot the fix and why the failure is invisible on a warm pool where some earlier run happened to leave\nthe file behind.\n\nThe unit-test resolver at `crates/spt/src/cli.rs:25601` reaches the SAME directory from a different\nanchor (`current_exe()` → `deps/` → parent) for the same reason: its own doc comment records that\nunit tests get no `CARGO_BIN_EXE_*` at all.\n\n**That mechanism explains both original members at once, including the polarity inversion that made\nthem look like different bugs:** whether `cargo test -p spt` or `cargo test -p spt --bins` happens\nto leave a plain exe behind is incidental to a dependency neither command was told about.\n\n#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\n\n**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\nBoth members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\nin-lane as a rig artifact. That is the whole field population to date.\n\n**GOLDEN IS ACQUITTED, and the acquittal is measured rather than assumed.** `cargo test --workspace\n--no-run` emits all 13 plain binaries — mock-session, mock-shell, capture-player,\nconsole-mode-probe, service_fixture and the rest — so a workspace build produces the cross-package\nhelpers by construction. Confirmed under nextest, the tool CI actually runs, with a real compile.\n\n⚠ **The measurement that establishes this is not the obvious one.** Deleting the plain exe and\nwatching it reappear is NOT evidence of a rebuild: cargo's uplift restores a hardlink from an intact\n`deps/` artifact, with link count 3 and an UNCHANGED mtime, which looks exactly like a build and\nsays nothing about a pool that never had the file — and a pool that never had it is the only kind a\nrig runs on. The sound probe removes the plain exe AND both `deps/` artifacts, confirms all three\nabsent, then watches the target actually recompile (mock-adapter, 5.77s, fresh mtime). The first two\nattempts were setup, not measurement.\n\n⚠ **The suspicion this acquits is structurally well-founded, so record the answer, not just the\nverdict.** `twohost-a`/`twohost-b` are `needs: test`, so the only mock-adapter prebuild runs AFTER\nthe phases that use it; `target/` is gitignored, so checkout never cleans it on a persistent\nself-hosted workdir. Every precondition for artifact leakage is present — the build simply does not\nneed it. The next person who reads that job graph will form the same hypothesis; this is the answer\nwaiting for them.\n\n#### THE ONE CI-SIDE MEMBER THAT IS REAL\n\n`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\nand `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\nconsumer therefore CANNOT express the dependency through the env var at all — it has no choice but\nto resolve by path. That is why `.github/workflows/ci.yml:105-106` carries a hand-written\n`cargo build -p spt --bin translate_proof_fixture` before the unit lane, with a comment\n(`ci.yml:102-104`) stating this exact mechanism.\n\n**Deleting that step would red the unit lane on a clean pool, and it would read as a code red.**\nSomebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\nthe comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\nwould find it.\n\n#### POPULATION\n\n**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\n`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\nthe other **11 are test helpers**, across three packages:\n\n| package | helpers |\n|---|---|\n| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\n| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\n| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\n\n**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\nresolvers**. Split by whether the BUILD IS ALREADY GUARANTEED — which is not the same question as\nwhether the env var is available, and an earlier version of this entry conflated the two:\n\n| class | sites | detail | build guaranteed? |\n|---|---|---|---|\n| **cross-package** | **33** | mock-session 26, mock-shell 6, service_fixture 1 | **NO — the hazard members** |\n| **same-package** | **11** | translate_proof_fixture 7, git_fixture 2, post_step_fixture 1, gh_fixture 1 | **YES — already, by construction** |\n\n⚠ **MEASURED TWICE, and it falsifies what this entry said on 2026-08-03 before this revision:** cargo\nbuilds **every bin target of a package whenever it builds ANY integration test of that package** —\nthat same act is what sets `CARGO_BIN_EXE_*` in the first place. So the 11 same-package sites were\nnever unexpressed in a way that could bite, and the hazard population is **33 cross-package sites\nplus the one unit-test member = 34**, not 44.\n\n- **Probe 1 (todlando, root pool):** deleted all four `translate_proof_fixture` artifacts (both\n  hash-suffixed harness exes, the `deps/` plain exe, the uplifted plain exe), confirmed absent, then\n  built ONE UNRELATED and UNMODIFIED integration test of the same package —\n  `cargo test -p spt --test attach_wedge_e2e --no-run`, exit 0, 14.45s. Both plain exes returned with\n  fresh mtimes; the hash-suffixed harness exes stayed absent, which is what distinguishes a bin\n  DEPENDENCY build from a `--bins` harness build.\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\n[…176ln elided…]\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\n  assembled.\n- **MEASURED, four arms, same box, same hour, matched load** (a second `cargo test -p spt-store\n  --lib` loop running throughout; `spt-store` itself stayed green in every round, so the box was not\n  generically failing):\n\n  | tree | instrument | result |\n  |---|---|---|\n  | lane `ec5f38a` | `cargo test --lib`, at rest | 821/821 ×4 |\n  | lane `ec5f38a` | `cargo test --lib`, under load | **2 of 3 RED** (142s, 117s) |\n  | lane `ec5f38a` minus its 5 new tests | `cargo test --lib`, under load | 3 of 3 green (117s, 84s, 105s) |\n  | main `932e14b` | `cargo test --lib`, under load | 3 of 3 green (97s, 119s, 104s) |\n  | lane `ec5f38a` | **`cargo nextest run`, under load** | **3 of 3 green, 821/821** (88s, 85s, 72s) |\n\n- **Three DIFFERENT victims across two loaded runs**, all process/timing-shaped, all PRESENT AT MAIN\n  and green there: `servicehost::…a_service_that_ignores_the_stop_marker_is_force_killed_and_confirmed_dead`\n  (panics `ForceKilled must MEAN the owned child is gone` right after `SERVICE_KILL_UNCONFIRMED`),\n  `applyhost::…broker_reports_its_compiled_image_version_over_ipc`, and\n  `daemon::…a_tree_teardown_reaches_a_grandchild_the_service_spawned`.\n- **MECHANISM: in-process thread interference, not product code.** Bare `cargo test` runs a crate's\n  tests as threads in ONE process. The lane's five new tests are process-spawning kill-tree tests;\n  under load they starve confirm windows of NEIGHBOURING tests that were always marginal. Removing\n  exactly those five flips 2-of-3-red to 0-of-3-green at the same sha, in the same binary, at the\n  same durations — one of the green runs sits at 117s, precisely a duration that had produced two\n  failures with them present.\n- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\n  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\n  different mechanism, which is why these are two entries and not one.\n- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\n  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\n  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\n  The same tool gap acquitted [[IR-21]]'s golden question the same day.\n- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\n  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\n  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\n- **Two rig defects of the gater's, recorded because they nearly cost the verdict:** (1) a first\n  re-run at rest came back 4/4 green and proves NOTHING — a sequential idle probe cannot express a\n  load-sensitive failure, so that is a competence-controlled zero, not an acquittal; (2) the first\n  baseline attempt ran its two arms UNSYNCHRONISED (the load generator finished while the measured\n  arm was still on run 1), which would have compared a loaded lane against an idle main and read as\n  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\n- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\n  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\n  rule (gate with nextest); medium to harden the three marginal tests.\n\n### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\n- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\n  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\n  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\n- **What/why:** a POOL-OWNER claim named a holder pid; lane liveness was read from whether that pid\n  was alive. hertz MEASURED the failure on this box: **3 of 3 claims had dead holders while one of\n  those lanes was live** — so the guard authorized exactly the interleaving takeover releases#103\n  exists to prevent. The remedy records the lane's GIT IDENTITY (branch + the base sha it carried at\n  claim time) and reads lane state from ancestry: in flight while the tip is not contained in\n  `origin/main`; settled once merged, once the branch is gone, or once the branch no longer carries\n  the claimed base (the branch-level twin of a recycled pid). Holder pid demotes to advisory — a\n  LIVE holder still refuses, a dead one no longer authorizes.\n- **The strongest finding in it, and it is a filter-competence one:** without the base anchor, a\n  missing branch read as \"settled, branch gone\" **out of a directory that was not a repository at\n  all**. An unanchored Settled verdict is a clean zero produced by a filter that cannot express the\n  question. A Settled verdict now requires the base object to be present in the reading repo;\n  unanchored is UNKNOWN. Sibling of [[zero-match-filter-reads-as-absent]] in the pool domain.\n- ⚠ **POLARITY, stated rather than buried:** the new arm (dead holder + unlanded lane => REFUSE)\n  converts a false-TAKEOVER into a false-REFUSAL. That is the better failure but not a free one, and\n  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\n  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\n  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\n  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\n  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\n  onto the blanket override. The refusal must NAME the remedy, not only the witness, and the remedy\n  must be exercised FROM the refusal state rather than reasoned about ([[remedy-must-run-from-refusal-state]]).\n  If the answer is \"it refuses\", that is a design change and returns to doyle before the lane lands.\n- **COMMITTED 2026-08-04 (was uncommitted when first measured):** `ci/poolowner-lane-claim` =\n  `8ce40d9` (the change) + `98cfafe` (the remedy fix below), both off `b7b00c3`. The original\n  measurement found ZERO commits and six modified files in `.worktrees/hertz-poolowner`, i.e. every\n  reported number had been measured against a tree no git object captured; the builder committed on\n  being told. Recorded because the near-loss is the lesson, not the correction.\n- **THE REMEDY DID NOT RUN — measured from the refusal state, which is the only place the question\n  can be asked.** The refusal named its witness AND a command, and executing that command verbatim\n  failed with the IDENTICAL `SPT_POOL_FOREIGN` block that printed it: **xtask depends on spt-store,\n  so every command that builds the tool goes through the pool being refused.** This is the same dead\n  end the unclaimed-foreign arm already hit in the field and fixed by leading its line with the\n  hatch — adding a second refusal arm re-broke it immediately. FIXED at `98cfafe`: the in-flight\n  remedy now leads with the hatch and names `pool-claim`, the command that actually resolves\n  ownership. Full chain re-measured on hfenduleam: refuse → verbatim remedy fails → hatch-prefixed\n  form succeeds → build proceeds.\n- **Answer to \"does `pool-release` clear a dead-holder + unlanded claim\", two-part:** it DOES — it\n  never consults the verdict, it rewrites `lane=None` — **but it is NOT the exit**, because after\n  release the same build is refused again on the pre-existing unclaimed-foreign arm (\"no lane has\n  claimed this pool\"). Release moves you from one refusal to another. `pool-claim` is the exit.\n- **The guard is a POPULATION, not a row** (builder's generalization, adopted by doyle as the\n  standard for this class): one test poses all three refusal arms and asserts that any remedy naming\n  a command leads with the hatch, PLUS membership — three posed, three refused — so no arm passes by\n  never being reached. The rule had been learned once already and the next arm added broke it, which\n  is the definition of something that needs a population test rather than a better comment. 26/26.\n- ⚠⚠ **FLEET PROPERTY — the rig refuted itself, and this is the entry's most important line.** The\n  first arm did NOT refuse, it TOOK OVER: the arriving worktree was at `b7b00c3`, so the build script\n  that ran was ITS OWN, pre-identity. **Enforcement code comes from the ARRIVING tree, never from\n  the claim.** So until this lands everywhere, an old tree still takes a live lane's pool, and the\n  guard is only ever as new as the tree that arrives. Found by measurement; reasoning would have\n  reported a refusal the rig never produced.\n- **RULING on the fleet property (doyle 2026-08-04) — a stamp VERSION LINE is REFUSED, and not on\n  taste: it cannot work.** The tree that must refuse is the OLD one, and an old build script does not\n  read a new stamp field because it does not know the field exists. You cannot make a stale enforcer\n  honor a new rule by writing something new into the record it enforces against — **the reader is\n  the problem, not the record.** A version line would help only a CURRENT tree explain itself while\n  doing nothing to the population it is aimed at, i.e. it would retire the worry without retiring the\n  risk. Ruled instead, in priority order: **(1)** land it and state the migration window honestly —\n  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\n  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\n  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\n  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\n  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\n  trees, this box carries ~45 worktrees and most are stale, so reaping them is real mitigation and\n  cheaper than code. (2) and (3) do NOT ride this lane.\n- **The unanchored row, as asked:** `a_claim_from_another_repository_reads_unknown_not_settled` was\n  RED before the base-object requirement existed. Verbatim: `left: Settled { reason: \"lane branch\n  build/lane-x no longer exists\" }  right: Unknown`, out of a tempdir that was not a repository at\n  all. It fails without the requirement and passes with it — a real negative control, not a row that\n  only ever passed.\n- **Builder's evidence (as reported, against that uncommitted tree):** spt-poolguard 25/25 with 7 new\n  rows, one per precedence cell, two carrying their own negative control; pool_guard_canary 3/3;\n  `cargo check -p xtask -p spt-store --all-targets` clean; clippy clean on the three touched crates;\n  `traceable-reqs check` exit 0 at 745/745 with new `REQ-POOL-LANE-IDENTITY` complete at doc+impl+unit.\n- **Composed:** its OWN thin lane, riding the same next golden batch as the CI-rider cluster but NOT\n  merged into it (doyle ruling 2026-08-04). A red must stay attributable: the riders change what the\n  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\n  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\n  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\n  kept out of [[IR-16]] — folding it in settles its question in passing.\n- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\n  **Size:** small once the remedy question is settled.\n- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\n  `.worktrees\\hertz-ci-riders\\target\\POOL-OWNER.json` named `holder_pid 31380` with\n  `holder_started_at 134302739211259713` = 2026-08-03 16:38:41. Pid 31380 on that box at read time was\n  `claude.exe -n \"doyle @ HFENDULEAM (spt-core/)\"`, created 17:31:11, FILETIME 134302770715019370.\n  Same boot, ~52 minutes apart, stamps MISMATCH. The claiming process died and the OS reissued its pid\n  to the gater's own session. Every previously measured recycle produced a false-DEAD (reads free\n  while the lane is live — the corrupting direction); this one produces a **false-LIVE**: a bare-pid\n  guard reads the claim as held by a running holder and refuses, naming doyle as the holder of hertz's\n  pool — the blocking direction, first time caught. The `holder_started_at` arm shipped in `8ce40d9`\n  discriminates it correctly — that field caught defending, not asserted to defend\n  ([[stable-anchor-is-not-a-recycling-defense]]).\n- **The mirror image, same box, same hour:** `.worktrees\\ir24-reap\\target` named `holder_pid 33612`,\n  DEAD — while that lane was genuinely LIVE, with `cargo clippy -q -p spt-daemon --lib --tests`\n  (pid 22452) running under todlando's session as it was read. Two claims, opposite errors, inside one\n  hour: liveness misreads in BOTH directions on the same box in the same hour. Holder liveness has no\n  sound polarity as a lane-state oracle. Ancestry decides ([[pool-claim-holder-death-is-not-lane-state]]).\n- **THE BARE-CLAIM GAP — a claim the stamp arm cannot adjudicate at all.** The main checkout's own pool\n  (`<root>\\target`, 72,001,016,671 B = 67.06 GiB) carries\n  `{\"owner_tree\": \"...\\\\spt-core\", \"written_by\": \"spt-poolguard\"}` — no `lane_label`, no `holder_pid`,\n  no `holder_started_at`, no `lane_branch`, no `lane_base`. `read_owner` maps that to `lane: None`, so\n  every arm the lane-identity work added is unreachable for it: it cannot be read as in-flight,\n  settled, or recycled. **FIVE of the eight** claims found on this box are this shape — `<root>\\target`,\n  `<root>\\target-seam` (below), `gate-target-render`, `ir21-xtask\\target`, `locksmith-t1\\target` —\n  against three carrying a lane identity (`hertz-ci-riders`, `hertz-poolowner`, `ir24-reap`). A claim\n  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\n  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\n  \"the stamp arm handles it\" is false for most claims that actually exist.\n- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\n  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\n  `5ae68f8`, v0.12.1 era), created 2026-06-18, last written 2026-08-02 — nothing in the tracked tree\n  references it (grep over rs/toml/md/yml/ps1/sh: zero hits outside this file). The inventory predicate\n  was \"a directory named `target` inside a worktree\"; a second root-level pool under a different name\n  is not expressible in that filter, so it returned a clean zero that was reported as a population\n  ([[verdict-from-probe-competence]] in the field). Corrects the earlier \"72 GB root pool is the\n  biggest object by 9x\": the two root pools are 67.06 + 52.06 = 119.1 GiB of a 133.43 GiB box pool\n  total, so the 44-tree sweep covered ~61% of pool bytes, not the population. **Ruling (doyle,\n  2026-08-04): target-seam stands for now** — free space is ~115 GB against the 32 GB golden floor, so\n  there is no pressure; it was written to yesterday, so \"cold\" is one day deep and its writer is\n  unidentified. It becomes a reap candidate at the next free-space squeeze, after a fresh last-write\n  check and identification of what wrote it on 08-02 — reaping a pool whose writer you cannot name is\n  how the v0.51.0 fabricated-red class starts.\n- **CLAIM-OBSERVABILITY, MEASURED (hertz, 2026-08-04, three-arm rig with competence control):** a\n  displaced claimant CANNOT distinguish takeover from never-claimed — the two states are byte-identical\n  on disk (arm 1 vs arm 2 identical; arm 3 proves the rig separates states that differ, so the null is\n  real). The takeover is silent on BOTH sides: the taker's `pool-claim` prints ordinary success naming\n  no prior owner. Mechanism at `b75258d`: `pool_claim` never calls `read_owner` — it constructs its own\n  `PoolOwner` and `fs::write`s unconditionally. The displaced lane's only channel is its next build's\n  refusal, which reports a STATE (\"this pool belongs to B\"), never a transition, and arrives pull-only\n  and arbitrarily late while interleaved-artifact harm is already underway. Labelled holes: measured\n  against the origin/main xtask binary (lane-tip carry is a source read, not a measurement);\n  pool-sweep-as-channel not exercised; single-process holder pid in all arms.\n- **Bootstrap property, not a defect (hertz, measured 2026-08-03 while claiming pools for the lanes\n  3-4 rebases):** a lane DELIVERING claim-identity cannot claim its own pool WITH that identity until\n  it lands — the prebuilt origin/main `xtask.exe` writes old-shaped stamps (owner_tree, lane_label,\n  holder pid+stamp; no lane_branch, no lane_base). Enforcer turnover surfacing at CLAIM time rather\n  than build time: coverage grows only as trees turn over. Recorded because it reads as a bug the\n  first time someone meets it in the field. Related lane-craft fact from the same queue: a rebase\n  changes SHAS necessarily but hunk OFFSETS only incidentally — todlando's main.rs hunks stayed at\n  @20/@53/@70 across the f2e4516→2f427b2 rebase; treat pre-rebase overlap measurements as stale by\n  construction and re-measure, but expect the geometry to usually hold.\n- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\n  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\n  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\n  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\n  (main.rs:2282) prints `(branch …, base …; advisory holder pid …)` and writes the nested lane.\n  A lane claimed with a stale tool records NO git identity and demotes its own adjudication back\n  to the refused bare-pid predicate. DETECTION that worked and is the reusable part: read the\n  claim line the tool PRINTS against the source just read — a mismatch names the stale enforcer\n  before it writes. REMEDY at claim time: rebuild xtask FROM THE LANE'S WORKTREE before\n  `pool-claim` (which the protocol's claim-from-your-own-worktree rule already implies; this\n  instance is why it is load-bearing and not ceremony).\n- **RULING (doyle, 2026-08-04) — the claim path must run the same guard the build path runs, and a\n  takeover becomes an event.** The documented design already says a finished lane is \"taken over\n  loudly, not refused\"; a silent unconditional overwrite violates the spelling the protocol shipped\n  under. Remedy, both halves, one small lane: (ii) `pool-claim` reads the prior owner before writing —\n  prior lane LIVE (ancestry + stamp arm, never bare pid) ⇒ refuse exactly as build.rs would; prior\n  lane finished ⇒ proceed AND announce the displacement, naming the displaced lane in the success\n  line; plus (i) a `displaced` field (prior owner + takeover stamp) rides the new claim, so the fact\n  survives in the artifact the late-reading claimant already reads. The identity-less bare claim\n  (majority field shape, above) must be handled explicitly by the same change: a bare claim carries no\n  lane to adjudicate, so takeover of a bare claim always proceeds-and-announces, and the announcement\n  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\n  lane as or beside the IR-26 remedy. Size: small.\n\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\n…\n\n…\n  at the end. · **Size:** a between-run census step plus a scoped reap in the harness.\n\n[Showing lines 1-264 and 441-663 of 663; 176 middle lines (14.2KB) elided. Use :1700 to continue. Read artifact://23 for full output]"}],"details":{"truncation":{"content":"\r\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\r\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\r\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\r\n  source same night.\r\n- **What/why:** `ci.yml`'s `changes` job classifies docs-only diffs ONLY for `pull_request` events\r\n  — push events hardcode `code=true` (ci.yml:45–48, an explicit branch, not a fallthrough), so\r\n  every docs-only push to main spins both full unit legs. Tonight: five register docs pushes each\r\n  queued a Windows unit leg on hfenduleam; concurrency kept one running + one pending (main is\r\n  never cancelled in-progress, pending runs supersede — the recorded behavior matches ci.yml:9–13).\r\n  FINDING SETTLED (deployah, same night, from the workflow): this is not intent — it is a scope\r\n  the classifier never had; the `*.md` / `traceable-reqs.toml` case arms are only ever REACHED on\r\n  pull_request (the early-return precedes them), and golden.yml's own hardcoded `code=true` is\r\n  unrelated (golden triggers only on golden/**). REMEDY STILL OPEN on a named tension: extending\r\n  the classifier to pushes leaves a docs-only main TIP with no run of its own — fine if\r\n  tested-sha==merged-sha means \"the code at this sha was tested\" (it was, at the last code sha),\r\n  not fine if any gate or reader takes \"main tip has a green run\" as the check. One person reads\r\n  the consuming gates before any remedy (doyle, at the next CI-touching wave) — three assuming is\r\n  how this class ships.\r\n- **Resolution:** the consuming contract already answers the held question:\r\n  `REQ-CI-DOCS-ONLY-THIN` is PR-only and explicitly says ADR-0050 supersedes\r\n  it for main pushes. Main-tip evidence remains full by design; no classifier\r\n  branch was widened.\r\n- **Interim rule (doyle, same night):** batch register edits into one push instead of landing them\r\n  as they occur — the cadence is a real gate on whoever is queued behind the runner.\r\n- **Ripe when:** next CI-touching wave, after the intent question is answered on the REQ record.\r\n- **Size:** small (one conditional, if the answer is \"extend\").\r\n- **Composed:** LOCKSMITH (#132) — doyle reads the consuming gates during the batch's CI-touching\r\n  wave (the intent question), BEFORE any classifier remedy. 2026-08-03.\r\n\r\n### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\r\n- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\r\n  (hfenduleam, log kept); routed text, doyle-landed.\r\n- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\r\n  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\r\n  rel Killed, brain Killed]; the brain's kill line names it `(child process of PID 46896)` — the\r\n  daemon — so the daemon was still resident too and was taken down by the `Child` handle, not the\r\n  stop. A stop that worked would have left the reaper `gone`. This rules OUT the innocent reading\r\n  (stop doesn't manage services): the stop did not reach the DAEMON either.\r\n- **NOT ESTABLISHED — two rungs, neither discriminated:** (1) the rig seeds a `doyle` perch with\r\n  `std::process::id()`, satisfying `ceremony_agent_ground`'s pid-ancestry rung for every child of\r\n  the harness; (2) the rig never scrubs `OWL_SESSION_ID`/`SPT_AGENT_ID`/`SPT_ENDPOINT_ID` from its\r\n  teardown commands, and the measuring run launched from a live agent session, so the env rung was\r\n  live too. `--force` overrides neither. The stop's output is discarded at the call site\r\n  (`let _ = spt(...)`) — no diagnostic names a denial, and no claim is made that one fired.\r\n  Settling it is one run with the stop's stderr captured — on the CI runner AS WELL AS the dev box,\r\n  since the rungs fire on different machines.\r\n- **Why it matters beyond this rig:** REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own failure shape\r\n  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\r\n  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\r\n  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\r\n  the work. Exactly why the population gate exists rather than per-pid checks alone.\r\n- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\r\n  three markers — REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own gate) is NOT free here: this rig's\r\n  `doyle` perch pid is load-bearing for the shell bind-by-token legs, so the two remedies are not\r\n  interchangeable — a lane taking this must check which legs depend on the pid before changing it,\r\n  or it fixes the stop and breaks the REQ-INSTALL-11 legs the rig exists for. Kin:\r\n  REQ-BROKER-STOP-ENDPOINT-DENY (the refusal being worked around).\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\r\n- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\r\n\r\n### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\r\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\r\n  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\r\n  both mechanisms measured at the cut, neither cost this run anything because the driver caught\r\n  them by hand. Filed at the release-close register sweep.\r\n- **What/why (three runbook amendments, one lane):**\r\n  1. **Release-shaping at ASSEMBLY intake, not post-golden.** The head arrived code-complete\r\n     but not release-shaped (no version bump, stale CHANGELOG top section) — 5 of the last 6\r\n     cuts. v0.59.0 fixed it by authoring version material BEFORE the golden run, which is what\r\n     produced the four-name shape (ruled sha == main tip == golden ref == tag == `c62904e7`,\r\n     first time in six cuts; the previous five each argued a post-golden delta inert). Amend\r\n     `docs/golden-head-intake` so the gater's assembly checklist asks the release-shaping\r\n     question at intake and the driver never authors on top.\r\n  2. **Never-executed-cells list is a hand-off artifact.** The runbook makes it a\r\n     gater-compiles / driver-re-checks item; PORTER's handoff omitted it and the driver had to\r\n     ask. Name it in the assembly checklist beside the greenlit-form delta: which new cells'\r\n     first CI execution is this golden, and where each HAS executed (lane gate / assembled\r\n     head) — it converts a golden red from an RCA into a lookup.\r\n  3. **Lockfile-refresh rule states the PROPERTY, not the command.** Step 1 prescribes\r\n     `cargo metadata --offline`; the driver used `cargo update --workspace --offline` and\r\n     proved the actual rule by diff (workspace members only, third-party pins untouched —\r\n     14 first-party line pairs, 90 third-party unchanged). The property is the rule and the\r\n     diff is its evidence (the standing by-diff rule exists because counting misread v0.39.4\r\n     and v0.41.0 in opposite directions — and the `windows-sys` 0.59.0 collision was LIVE at\r\n     this cut, the exact condition where counting fabricates a 15th \"first-party\" bump);\r\n     demote the command to an example vehicle.\r\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now asks the release-shaping question at assembly\r\n  intake, makes the never-executed-cells list part of the hand-off itself, and states lock refresh\r\n  as a diff-proven property with commands demoted to example vehicles. PR #176 passed\r\n  `traceable-reqs check`; the v0.65.0 cut had already exercised the release-shaped-head rule.\r\n- **Size:** small (one runbook doc lane; no code).\r\n\r\n## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\r\n\r\n- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\r\n  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\r\n  a live lane is never re-homed mid-flight. When each closes, any residue lands here as a new entry.\r\n\r\n## BUILT / RETIRED\r\n\r\n### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\r\n- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\r\n- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\r\n  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\r\n  (identity pinned at find time, re-verified at assert), both pid-only polling sites repinned\r\n  (daemon.rs teardown test; endpoint_lifecycle.rs relay_pid). Ruled polarity held: Absent⇒gone,\r\n  Present(same start)⇒not gone, Present(different)⇒gone, Unproven⇒NOT gone, missing-stamp\r\n  degrades to pid-only loudly — every unknown errs toward the recoverable red, zero new\r\n  false-green paths. Linux caveat documented in the helper (10ms jiffies: Present(different) is\r\n  narrowing, not decisive; same-tick reuse errs red, safe).\r\n- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\r\n  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\r\n  GREEN; main ff'd to a5042ec.\r\n- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\r\n  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\r\n  arm); rule-of-three bounds the original flake at ~7.5%/run/sha. Specimen 30776330383 remains\r\n  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\r\n  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\r\n  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\r\n  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\r\n  test-side rather than product-side. A recurrence must discriminate between them, not assume\r\n  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\r\n  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\r\n  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\r\n  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\r\n  healthy runs and discriminates nothing.)\r\n\r\n### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\r\n  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\r\n  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\r\n  day**: remedy (1) claimed the 11 same-package sites were missing a build edge, and todlando\r\n  falsified that by measurement while executing it (replicated independently by doyle). The error was\r\n  doyle's to carry — it was ruled on, not just written. The general rule that refutes it was already\r\n  in this entry's own CI-member section; diagnosing a class does not inoculate you against drawing\r\n  its opposite consequence one section later.\r\n- **Numbers below re-derived on `main` @`3efd7e6` over `git ls-files` (tracked files only). Each\r\n  carries its command; re-run rather than cite.**\r\n- ⚠ **Scan-root hazard, measured 2026-08-03 and worse than first reported:** a naive recursive\r\n  `grep -r` from the project root inflates by **~35×**, not the ~5× an earlier draft of this entry\r\n  claimed — 426 tracked `.rs` against 14,865 on disk with `target/` excluded, because `.worktrees/`\r\n  holds full copies of the tree. **And the unscoped grep does not COMPLETE** (still running at a\r\n  120s timeout while `git ls-files` returns instantly), so the failure mode is not only a wrong\r\n  number but a command that reads as hung on a tree where dozens of worktrees are normal. Use\r\n  `git grep` or `git ls-files | xargs grep`; both are scoped to tracked files by construction.\r\n\r\n#### THE MECHANISM (measured, both ends)\r\n\r\n**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\r\nnever emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\r\nfive executables, every one hash-suffixed under `target/<profile>/deps/`, and ZERO plain exes in\r\n`target/<profile>/`. The bin was built. The file the test looks for was not written.\r\n\r\n**Consumer end — the resolver borrows a guaranteed binary's path to locate an unguaranteed one.**\r\nAll 29 copies of `sibling_bin` in `crates/spt/tests/` reduce to two textual variants (22 + 7) of one\r\nbody:\r\n\r\n```rust\r\nfn sibling_bin(name: &str) -> PathBuf {\r\n    PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"))\r\n        .with_file_name(format!(\"{name}{}\", std::env::consts::EXE_SUFFIX))\r\n}\r\n```\r\n\r\n`CARGO_BIN_EXE_spt` is used **only as a directory anchor**. Cargo therefore sees a dependency on\r\n`spt` and on nothing else; the `{name}` half is a string join it cannot observe. The dependency edge\r\ndoes not exist at any level a build system could act on — which is why \"use the wider command\" is\r\nnot the fix and why the failure is invisible on a warm pool where some earlier run happened to leave\r\nthe file behind.\r\n\r\nThe unit-test resolver at `crates/spt/src/cli.rs:25601` reaches the SAME directory from a different\r\nanchor (`current_exe()` → `deps/` → parent) for the same reason: its own doc comment records that\r\nunit tests get no `CARGO_BIN_EXE_*` at all.\r\n\r\n**That mechanism explains both original members at once, including the polarity inversion that made\r\nthem look like different bugs:** whether `cargo test -p spt` or `cargo test -p spt --bins` happens\r\nto leave a plain exe behind is incidental to a dependency neither command was told about.\r\n\r\n#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\r\n\r\n**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\r\nBoth members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\r\nin-lane as a rig artifact. That is the whole field population to date.\r\n\r\n**GOLDEN IS ACQUITTED, and the acquittal is measured rather than assumed.** `cargo test --workspace\r\n--no-run` emits all 13 plain binaries — mock-session, mock-shell, capture-player,\r\nconsole-mode-probe, service_fixture and the rest — so a workspace build produces the cross-package\r\nhelpers by construction. Confirmed under nextest, the tool CI actually runs, with a real compile.\r\n\r\n⚠ **The measurement that establishes this is not the obvious one.** Deleting the plain exe and\r\nwatching it reappear is NOT evidence of a rebuild: cargo's uplift restores a hardlink from an intact\r\n`deps/` artifact, with link count 3 and an UNCHANGED mtime, which looks exactly like a build and\r\nsays nothing about a pool that never had the file — and a pool that never had it is the only kind a\r\nrig runs on. The sound probe removes the plain exe AND both `deps/` artifacts, confirms all three\r\nabsent, then watches the target actually recompile (mock-adapter, 5.77s, fresh mtime). The first two\r\nattempts were setup, not measurement.\r\n\r\n⚠ **The suspicion this acquits is structurally well-founded, so record the answer, not just the\r\nverdict.** `twohost-a`/`twohost-b` are `needs: test`, so the only mock-adapter prebuild runs AFTER\r\nthe phases that use it; `target/` is gitignored, so checkout never cleans it on a persistent\r\nself-hosted workdir. Every precondition for artifact leakage is present — the build simply does not\r\nneed it. The next person who reads that job graph will form the same hypothesis; this is the answer\r\nwaiting for them.\r\n\r\n#### THE ONE CI-SIDE MEMBER THAT IS REAL\r\n\r\n`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\r\nand `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\r\nconsumer therefore CANNOT express the dependency through the env var at all — it has no choice but\r\nto resolve by path. That is why `.github/workflows/ci.yml:105-106` carries a hand-written\r\n`cargo build -p spt --bin translate_proof_fixture` before the unit lane, with a comment\r\n(`ci.yml:102-104`) stating this exact mechanism.\r\n\r\n**Deleting that step would red the unit lane on a clean pool, and it would read as a code red.**\r\nSomebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\r\nthe comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\r\nwould find it.\r\n\r\n#### POPULATION\r\n\r\n**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\r\n`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\r\nthe other **11 are test helpers**, across three packages:\r\n\r\n| package | helpers |\r\n|---|---|\r\n| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\r\n| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\r\n| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\r\n\r\n**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\r\nresolvers**. Split by whether the BUILD IS ALREADY GUARANTEED — which is not the same question as\r\nwhether the env var is available, and an earlier version of this entry conflated the two:\r\n\r\n| class | sites | detail | build guaranteed? |\r\n|---|---|---|---|\r\n| **cross-package** | **33** | mock-session 26, mock-shell 6, service_fixture 1 | **NO — the hazard members** |\r\n| **same-package** | **11** | translate_proof_fixture 7, git_fixture 2, post_step_fixture 1, gh_fixture 1 | **YES — already, by construction** |\r\n\r\n⚠ **MEASURED TWICE, and it falsifies what this entry said on 2026-08-03 before this revision:** cargo\r\nbuilds **every bin target of a package whenever it builds ANY integration test of that package** —\r\nthat same act is what sets `CARGO_BIN_EXE_*` in the first place. So the 11 same-package sites were\r\nnever unexpressed in a way that could bite, and the hazard population is **33 cross-package sites\r\nplus the one unit-test member = 34**, not 44.\r\n\r\n- **Probe 1 (todlando, root pool):** deleted all four `translate_proof_fixture` artifacts (both\r\n  hash-suffixed harness exes, the `deps/` plain exe, the uplifted plain exe), confirmed absent, then\r\n  built ONE UNRELATED and UNMODIFIED integration test of the same package —\r\n  `cargo test -p spt --test attach_wedge_e2e --no-run`, exit 0, 14.45s. Both plain exes returned with\r\n  fresh mtimes; the hash-suffixed harness exes stayed absent, which is what distinguishes a bin\r\n  DEPENDENCY build from a `--bins` harness build.\r\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\r\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\r\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\r\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\r\n  against the 09:00 it carried before), so this is a real build and not the hardlink uplift this\r\n  entry warns about elsewhere; the harness exe stayed absent.\r\n- **Neither probe needs a baseline arm:** the probe test is unmodified and references nothing under\r\n  edit, so what it measures is cargo's behaviour, not anyone's change.\r\n- **Corroborated by this entry's own field data:** neither original member was a same-package\r\n  integration site — member 1 is a UNIT test, member 2 is CROSS-package. The class never had a\r\n  same-package integration member, and the CI-member section below already stated the governing rule\r\n  (`CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package) one\r\n  section before the remedy drew the opposite consequence from it.\r\n\r\nCommand: `git ls-files '*.rs' | xargs grep -hon 'sibling_bin(\"[a-z_-]*\"' | sed 's/.*sibling_bin(\"//;\r\ns/\"//' | sort | uniq -c`.\r\n\r\n⚠ An earlier report gave 48 sites and a 6/11/37 split. Take the table above: it counts only literal\r\ncall sites in tracked files and it ships its command. The 11 is the same 11 in both counts.\r\n\r\n**The LOCATION half of this class is already closed** by `crates/spt-term/tests/support/fixture_bin.rs`\r\n— a shared resolver rather than 29 copies. It does not close the BUILD half, and should not be\r\nmistaken for having done so.\r\n\r\n#### REMEDY SHAPE (not ruled)\r\n\r\nThe distinction that matters is location vs. build:\r\n\r\n1. **The 11 same-package sites are NOT hazard members and need no build fix.** Their build edge\r\n   already exists (see the two probes in POPULATION above); `env!(\"CARGO_BIN_EXE_<name>\")` for the\r\n   fixture itself would add nothing to it. Converting them is a **CLARITY** change, worth doing on\r\n   its own smaller merits — the path becomes the one cargo actually emitted rather than a string-join\r\n   of a directory anchor and `EXE_SUFFIX`, five copies of `sibling_bin` stop existing (29 → 24), and\r\n   it completes a migration already paid for: `crates/spt/tests/fixtures/translate_proof_fixture.rs:7-12`\r\n   records that the fixture was re-homed into `spt` precisely to obtain\r\n   `CARGO_BIN_EXE_translate_proof_fixture`, and then all 7 call sites resolved by path anyway. **It is\r\n   not a build fix and must not be filed as one.**\r\n2. **The 33 cross-package sites cannot**, by cargo's design. Their options are an asserted build in\r\n   the test's own setup, a `dev-dependencies` artifact dependency, or an explicit documented\r\n   prebuild — the ci.yml:106 shape, made a rule instead of a local fix.\r\n3. **Standardising on one wider invocation is NOT a remedy.** It changes which pools happen to work;\r\n   it does not create the dependency edge, and the two original members had opposite polarity under\r\n   exactly that theory.\r\n4. Collapsing the 29 resolver copies is worth doing on the `fixture_bin.rs` model, but on its own it\r\n   makes the class HARDER to see — one shared resolver still anchored on `CARGO_BIN_EXE_spt` hides\r\n   the 33 genuinely unexpressed dependencies among its 44 call sites behind one function.\r\n\r\n#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\r\n- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\r\n  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\r\n  here so the next clean rig does not re-diagnose them as code reds.\r\n- The first two versions of this entry framed the class as \"the rig's command does not build what\r\n  the test needs\" and proposed standardising on a wider invocation. **Both are superseded by the\r\n  measured mechanism above** — the dependency is not under-expressed, it is INEXPRESSIBLE in the\r\n  form these call sites use, so no choice of invocation creates it. Kept only as the two FIELD\r\n  MEASUREMENTS that produced the class, which remain true:\r\n- **MEMBER 1 — MEASURED:** `cli::tests::adapter_translate_proof_gates_on_commit` failed on the\r\n  first `cargo test -p spt --bins` run. Its fixture binary `translate_proof_fixture` (a\r\n  `tests/`-homed `[[bin]]`) was ABSENT from the pool — `ls` on the path returned No such file.\r\n  Building it explicitly and re-running the IDENTICAL command PASSED, after which the full `--bins`\r\n  suite passed 584/585 with only the releases#117 probe red (that one RED by design). So the\r\n  discriminator is the fixture's presence, not the tree: same command, same sha, red then green\r\n  across one `cargo build` of the fixture.\r\n- **MEMBER 2 — MEASURED:** `cargo test -p spt` does not build `mock-adapter --bin mock-session`, so\r\n  `attach_wedge_e2e` panics `\"the dummy-harness program must be built\"`. Note the polarity is\r\n  INVERTED against member 1 — there the narrower `--bins` was the defective invocation and\r\n  `cargo test -p spt` the correct one; here `cargo test -p spt` is itself insufficient. So the\r\n  class is NOT \"use the wider command\"; it is that the dependency is not expressed to the build at\r\n  all, and which invocation happens to work is incidental.\r\n- **What/why (still true):** on a WARM pool the helper is already there from some earlier run and\r\n  the test passes, so the defect is invisible exactly where most people work and fires only on a\r\n  clean pool — i.e. on a GATE RIG, which is the one place a false red costs the most.\r\n- **The sweep this entry once called its first step HAS BEEN RUN** (todlando 2026-08-03) and its\r\n  result is the POPULATION section above. It is no longer outstanding.\r\n\r\n- **Why it is register debt and not a lane bug:** nothing in the product is wrong. The gap is\r\n  between what a test needs built and what the rig's command builds, and the fix belongs to the\r\n  tests' declarations, not to whoever is running a gate that day. Sibling rule:\r\n  [[gate-clean-target-not-incremental]].\r\n- **Built evidence:** golden now names every cross-package fixture prebuild\r\n  (`mock-session`, `mock-shell`, `capture-player`, `console-mode-probe`,\r\n  `service_fixture`) explicitly; `xtask binedge-check` reports zero missing\r\n  edges. All 29 local `sibling_bin` resolvers collapsed into\r\n  `tests/common/mod.rs`; the shared precondition names the missing fixture and\r\n  its package-correct build command before any product timeout.\r\n- **Ripe when:** the next gate-rig or CI-touching wave. Cheap, and it pays for itself the first time\r\n  it stops someone chasing a phantom red on a clean pool.\r\n- **Size:** remedy (1) is small AND optional — it buys clarity and subtraction, never a build edge;\r\n  medium for (2), which is a design call before it is an edit and is the only remedy that closes the\r\n  class.\r\n\r\n### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\r\n- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\r\n  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\r\n- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\r\n  the daemon-stop refusal fired on the running session's own identity env. It named\r\n  `$OWL_SESSION_ID`; clearing that made it name `$SPT_ENDPOINT_ID`. With `OWL_SESSION_ID`,\r\n  `SPT_ENDPOINT_ID`, `SPT_AGENT_ID` and `SPT_SESSION_ID` all cleared: exit 0, 1 passed.\r\n- **The finding is the DIAGNOSTIC SHAPE, not the env hygiene.** Naming one variable at a time means\r\n  a correct partial fix produces an identical-looking failure, so the natural reading of \"I cleared\r\n  it and it still fails\" is that the clearing did not work — when in fact each step was right and\r\n  the message had simply moved on to the next name. A refusal that can only ever name one member of\r\n  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\r\n  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\r\n- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\r\n  vars, so this fires for every builder on a perched session and for nobody running from a bare\r\n  shell — which is precisely the split between how builders work and how CI runs.\r\n- **Candidate remedies (not ruled):** have the refusal name EVERY identity var it found set, in one\r\n  line, rather than the first; and/or have the affected tests clear the identity set in their own\r\n  setup so a perched session is not a special environment. The first is the one that pays off\r\n  outside this test.\r\n- **Ripe when:** next CI/test-hygiene wave. **Size:** small.\r\n\r\n### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\r\n- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\r\n  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\r\n  parallel inside one binary each holds the file the other wants: `os error 32`, \"used by another\r\n  process\". **Signature: WHICH of the two fails alternates between runs.** Under\r\n  `--test-threads=1`: 2 passed, exit 0 — and the wall clock drops from 182s to 14s.\r\n- **What/why:** two defects in one, and they should not be conflated. (1) The tests are not\r\n  isolated from each other. (2) The staging path is the MACHINE-GLOBAL spt home rather than the\r\n  test's own temp home — on a box that is also a CI runner, so the blast radius is not confined to\r\n  the suite. (2) is the one worth fixing; (1) is a symptom of it.\r\n- **Note on why this is not already caught:** the standing rule is that integration tests run\r\n  through nextest, which gives each test its own process and hides the collision entirely. So this\r\n  is latent on the sanctioned path and only bites the bare `cargo test` path — the rule is working\r\n  and masking a real defect at the same time, which is why the entry exists rather than a shrug.\r\n- **Candidate remedy (not ruled):** stage the fixture into the test's own temp home. Sweep for\r\n  siblings first — any other test writing under `perch::spt_home()` rather than a temp home shares\r\n  the shape, and nobody has counted them.\r\n- **Built evidence:** adapter source, manifest registration, and psyche fixture\r\n  staging now use the rig TempDir. The two process-global resolver users are\r\n  explicitly serialized, and the bare `cargo test` path passes both cells with\r\n  `--test-threads=2` in 13.82s after the declared fixture prebuild.\r\n- **Ripe when:** next test-hygiene wave; the 182s -> 14s figure makes it pay for itself on the\r\n  bare path. **Size:** small per test, unknown until the sweep.\r\n\r\n### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\r\n- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\r\n  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\r\n  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\r\n  the daemon holds no other handle to reach them` — which also ANSWERS the cost-of-loss question\r\n  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\r\n  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\r\n  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\r\n  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\r\n  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\r\n  (`terminate_job_return_discriminates_broken_handle_from_ordinary_states`, cfg(windows), with a\r\n  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\r\n  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\r\n  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\r\n  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\r\n  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\r\n  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\r\n  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\r\n  NOT folded into that lane (doyle ruling, same day) and filed instead.\r\n- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\r\n  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\r\n  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\r\n  where it lives — the module already decided that these returns are worth reading.\r\n- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\r\n  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\r\n  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\r\n  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\r\n  termination cost here\" — and that answer has not been written down by anyone. Folding it in would\r\n  have meant settling that question in passing, inside a commit about the supervisor, which is how a\r\n  second ruling gets smuggled into a lane scoped to one.\r\n- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\r\n  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\r\n  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\r\n  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\r\n  its direct process in the same breath, which is what makes the middle hop dead by construction\r\n  there. **That is the first thing to check, and it is not assumed.**\r\n- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\r\n  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\r\n  cost-of-loss question is answered for this subject.\r\n\r\n### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\r\n- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\r\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\r\n  assembled.\r\n- **MEASURED, four arms, same box, same hour, matched load** (a second `cargo test -p spt-store\r\n  --lib` loop running throughout; `spt-store` itself stayed green in every round, so the box was not\r\n  generically failing):\r\n\r\n  | tree | instrument | result |\r\n  |---|---|---|\r\n  | lane `ec5f38a` | `cargo test --lib`, at rest | 821/821 ×4 |\r\n  | lane `ec5f38a` | `cargo test --lib`, under load | **2 of 3 RED** (142s, 117s) |\r\n  | lane `ec5f38a` minus its 5 new tests | `cargo test --lib`, under load | 3 of 3 green (117s, 84s, 105s) |\r\n  | main `932e14b` | `cargo test --lib`, under load | 3 of 3 green (97s, 119s, 104s) |\r\n  | lane `ec5f38a` | **`cargo nextest run`, under load** | **3 of 3 green, 821/821** (88s, 85s, 72s) |\r\n\r\n- **Three DIFFERENT victims across two loaded runs**, all process/timing-shaped, all PRESENT AT MAIN\r\n  and green there: `servicehost::…a_service_that_ignores_the_stop_marker_is_force_killed_and_confirmed_dead`\r\n  (panics `ForceKilled must MEAN the owned child is gone` right after `SERVICE_KILL_UNCONFIRMED`),\r\n  `applyhost::…broker_reports_its_compiled_image_version_over_ipc`, and\r\n  `daemon::…a_tree_teardown_reaches_a_grandchild_the_service_spawned`.\r\n- **MECHANISM: in-process thread interference, not product code.** Bare `cargo test` runs a crate's\r\n  tests as threads in ONE process. The lane's five new tests are process-spawning kill-tree tests;\r\n  under load they starve confirm windows of NEIGHBOURING tests that were always marginal. Removing\r\n  exactly those five flips 2-of-3-red to 0-of-3-green at the same sha, in the same binary, at the\r\n  same durations — one of the green runs sits at 117s, precisely a duration that had produced two\r\n  failures with them present.\r\n- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\r\n  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\r\n  different mechanism, which is why these are two entries and not one.\r\n- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\r\n  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\r\n  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\r\n  The same tool gap acquitted [[IR-21]]'s golden question the same day.\r\n- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\r\n  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\r\n  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\r\n- **Two rig defects of the gater's, recorded because they nearly cost the verdict:** (1) a first\r\n  re-run at rest came back 4/4 green and proves NOTHING — a sequential idle probe cannot express a\r\n  load-sensitive failure, so that is a competence-controlled zero, not an acquittal; (2) the first\r\n  baseline attempt ran its two arms UNSYNCHRONISED (the load generator finished while the measured\r\n  arm was still on run 1), which would have compared a loaded lane against an idle main and read as\r\n  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\r\n- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\r\n  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\r\n  rule (gate with nextest); medium to harden the three marginal tests.\r\n\r\n### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\r\n- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\r\n  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\r\n  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\r\n- **What/why:** a POOL-OWNER claim named a holder pid; lane liveness was read from whether that pid\r\n  was alive. hertz MEASURED the failure on this box: **3 of 3 claims had dead holders while one of\r\n  those lanes was live** — so the guard authorized exactly the interleaving takeover releases#103\r\n  exists to prevent. The remedy records the lane's GIT IDENTITY (branch + the base sha it carried at\r\n  claim time) and reads lane state from ancestry: in flight while the tip is not contained in\r\n  `origin/main`; settled once merged, once the branch is gone, or once the branch no longer carries\r\n  the claimed base (the branch-level twin of a recycled pid). Holder pid demotes to advisory — a\r\n  LIVE holder still refuses, a dead one no longer authorizes.\r\n- **The strongest finding in it, and it is a filter-competence one:** without the base anchor, a\r\n  missing branch read as \"settled, branch gone\" **out of a directory that was not a repository at\r\n  all**. An unanchored Settled verdict is a clean zero produced by a filter that cannot express the\r\n  question. A Settled verdict now requires the base object to be present in the reading repo;\r\n  unanchored is UNKNOWN. Sibling of [[zero-match-filter-reads-as-absent]] in the pool domain.\r\n- ⚠ **POLARITY, stated rather than buried:** the new arm (dead holder + unlanded lane => REFUSE)\r\n  converts a false-TAKEOVER into a false-REFUSAL. That is the better failure but not a free one, and\r\n  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\r\n  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\r\n  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\r\n  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\r\n  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\r\n  onto the blanket override. The refusal must NAME the remedy, not only the witness, and the remedy\r\n  must be exercised FROM the refusal state rather than reasoned about ([[remedy-must-run-from-refusal-state]]).\r\n  If the answer is \"it refuses\", that is a design change and returns to doyle before the lane lands.\r\n- **COMMITTED 2026-08-04 (was uncommitted when first measured):** `ci/poolowner-lane-claim` =\r\n  `8ce40d9` (the change) + `98cfafe` (the remedy fix below), both off `b7b00c3`. The original\r\n  measurement found ZERO commits and six modified files in `.worktrees/hertz-poolowner`, i.e. every\r\n  reported number had been measured against a tree no git object captured; the builder committed on\r\n  being told. Recorded because the near-loss is the lesson, not the correction.\r\n- **THE REMEDY DID NOT RUN — measured from the refusal state, which is the only place the question\r\n  can be asked.** The refusal named its witness AND a command, and executing that command verbatim\r\n  failed with the IDENTICAL `SPT_POOL_FOREIGN` block that printed it: **xtask depends on spt-store,\r\n  so every command that builds the tool goes through the pool being refused.** This is the same dead\r\n  end the unclaimed-foreign arm already hit in the field and fixed by leading its line with the\r\n  hatch — adding a second refusal arm re-broke it immediately. FIXED at `98cfafe`: the in-flight\r\n  remedy now leads with the hatch and names `pool-claim`, the command that actually resolves\r\n  ownership. Full chain re-measured on hfenduleam: refuse → verbatim remedy fails → hatch-prefixed\r\n  form succeeds → build proceeds.\r\n- **Answer to \"does `pool-release` clear a dead-holder + unlanded claim\", two-part:** it DOES — it\r\n  never consults the verdict, it rewrites `lane=None` — **but it is NOT the exit**, because after\r\n  release the same build is refused again on the pre-existing unclaimed-foreign arm (\"no lane has\r\n  claimed this pool\"). Release moves you from one refusal to another. `pool-claim` is the exit.\r\n- **The guard is a POPULATION, not a row** (builder's generalization, adopted by doyle as the\r\n  standard for this class): one test poses all three refusal arms and asserts that any remedy naming\r\n  a command leads with the hatch, PLUS membership — three posed, three refused — so no arm passes by\r\n  never being reached. The rule had been learned once already and the next arm added broke it, which\r\n  is the definition of something that needs a population test rather than a better comment. 26/26.\r\n- ⚠⚠ **FLEET PROPERTY — the rig refuted itself, and this is the entry's most important line.** The\r\n  first arm did NOT refuse, it TOOK OVER: the arriving worktree was at `b7b00c3`, so the build script\r\n  that ran was ITS OWN, pre-identity. **Enforcement code comes from the ARRIVING tree, never from\r\n  the claim.** So until this lands everywhere, an old tree still takes a live lane's pool, and the\r\n  guard is only ever as new as the tree that arrives. Found by measurement; reasoning would have\r\n  reported a refusal the rig never produced.\r\n- **RULING on the fleet property (doyle 2026-08-04) — a stamp VERSION LINE is REFUSED, and not on\r\n  taste: it cannot work.** The tree that must refuse is the OLD one, and an old build script does not\r\n  read a new stamp field because it does not know the field exists. You cannot make a stale enforcer\r\n  honor a new rule by writing something new into the record it enforces against — **the reader is\r\n  the problem, not the record.** A version line would help only a CURRENT tree explain itself while\r\n  doing nothing to the population it is aimed at, i.e. it would retire the worry without retiring the\r\n  risk. Ruled instead, in priority order: **(1)** land it and state the migration window honestly —\r\n  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\r\n  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\r\n  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\r\n  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\r\n  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\r\n  trees, this box carries ~45 worktrees and most are stale, so reaping them is real mitigation and\r\n  cheaper than code. (2) and (3) do NOT ride this lane.\r\n- **The unanchored row, as asked:** `a_claim_from_another_repository_reads_unknown_not_settled` was\r\n  RED before the base-object requirement existed. Verbatim: `left: Settled { reason: \"lane branch\r\n  build/lane-x no longer exists\" }  right: Unknown`, out of a tempdir that was not a repository at\r\n  all. It fails without the requirement and passes with it — a real negative control, not a row that\r\n  only ever passed.\r\n- **Builder's evidence (as reported, against that uncommitted tree):** spt-poolguard 25/25 with 7 new\r\n  rows, one per precedence cell, two carrying their own negative control; pool_guard_canary 3/3;\r\n  `cargo check -p xtask -p spt-store --all-targets` clean; clippy clean on the three touched crates;\r\n  `traceable-reqs check` exit 0 at 745/745 with new `REQ-POOL-LANE-IDENTITY` complete at doc+impl+unit.\r\n- **Composed:** its OWN thin lane, riding the same next golden batch as the CI-rider cluster but NOT\r\n  merged into it (doyle ruling 2026-08-04). A red must stay attributable: the riders change what the\r\n  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\r\n  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\r\n  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\r\n  kept out of [[IR-16]] — folding it in settles its question in passing.\r\n- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\r\n  **Size:** small once the remedy question is settled.\r\n- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\r\n  `.worktrees\\hertz-ci-riders\\target\\POOL-OWNER.json` named `holder_pid 31380` with\r\n  `holder_started_at 134302739211259713` = 2026-08-03 16:38:41. Pid 31380 on that box at read time was\r\n  `claude.exe -n \"doyle @ HFENDULEAM (spt-core/)\"`, created 17:31:11, FILETIME 134302770715019370.\r\n  Same boot, ~52 minutes apart, stamps MISMATCH. The claiming process died and the OS reissued its pid\r\n  to the gater's own session. Every previously measured recycle produced a false-DEAD (reads free\r\n  while the lane is live — the corrupting direction); this one produces a **false-LIVE**: a bare-pid\r\n  guard reads the claim as held by a running holder and refuses, naming doyle as the holder of hertz's\r\n  pool — the blocking direction, first time caught. The `holder_started_at` arm shipped in `8ce40d9`\r\n  discriminates it correctly — that field caught defending, not asserted to defend\r\n  ([[stable-anchor-is-not-a-recycling-defense]]).\r\n- **The mirror image, same box, same hour:** `.worktrees\\ir24-reap\\target` named `holder_pid 33612`,\r\n  DEAD — while that lane was genuinely LIVE, with `cargo clippy -q -p spt-daemon --lib --tests`\r\n  (pid 22452) running under todlando's session as it was read. Two claims, opposite errors, inside one\r\n  hour: liveness misreads in BOTH directions on the same box in the same hour. Holder liveness has no\r\n  sound polarity as a lane-state oracle. Ancestry decides ([[pool-claim-holder-death-is-not-lane-state]]).\r\n- **THE BARE-CLAIM GAP — a claim the stamp arm cannot adjudicate at all.** The main checkout's own pool\r\n  (`<root>\\target`, 72,001,016,671 B = 67.06 GiB) carries\r\n  `{\"owner_tree\": \"...\\\\spt-core\", \"written_by\": \"spt-poolguard\"}` — no `lane_label`, no `holder_pid`,\r\n  no `holder_started_at`, no `lane_branch`, no `lane_base`. `read_owner` maps that to `lane: None`, so\r\n  every arm the lane-identity work added is unreachable for it: it cannot be read as in-flight,\r\n  settled, or recycled. **FIVE of the eight** claims found on this box are this shape — `<root>\\target`,\r\n  `<root>\\target-seam` (below), `gate-target-render`, `ir21-xtask\\target`, `locksmith-t1\\target` —\r\n  against three carrying a lane identity (`hertz-ci-riders`, `hertz-poolowner`, `ir24-reap`). A claim\r\n  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\r\n  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\r\n  \"the stamp arm handles it\" is false for most claims that actually exist.\r\n- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\r\n  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\r\n  `5ae68f8`, v0.12.1 era), created 2026-06-18, last written 2026-08-02 — nothing in the tracked tree\r\n  references it (grep over rs/toml/md/yml/ps1/sh: zero hits outside this file). The inventory predicate\r\n  was \"a directory named `target` inside a worktree\"; a second root-level pool under a different name\r\n  is not expressible in that filter, so it returned a clean zero that was reported as a population\r\n  ([[verdict-from-probe-competence]] in the field). Corrects the earlier \"72 GB root pool is the\r\n  biggest object by 9x\": the two root pools are 67.06 + 52.06 = 119.1 GiB of a 133.43 GiB box pool\r\n  total, so the 44-tree sweep covered ~61% of pool bytes, not the population. **Ruling (doyle,\r\n  2026-08-04): target-seam stands for now** — free space is ~115 GB against the 32 GB golden floor, so\r\n  there is no pressure; it was written to yesterday, so \"cold\" is one day deep and its writer is\r\n  unidentified. It becomes a reap candidate at the next free-space squeeze, after a fresh last-write\r\n  check and identification of what wrote it on 08-02 — reaping a pool whose writer you cannot name is\r\n  how the v0.51.0 fabricated-red class starts.\r\n- **CLAIM-OBSERVABILITY, MEASURED (hertz, 2026-08-04, three-arm rig with competence control):** a\r\n  displaced claimant CANNOT distinguish takeover from never-claimed — the two states are byte-identical\r\n  on disk (arm 1 vs arm 2 identical; arm 3 proves the rig separates states that differ, so the null is\r\n  real). The takeover is silent on BOTH sides: the taker's `pool-claim` prints ordinary success naming\r\n  no prior owner. Mechanism at `b75258d`: `pool_claim` never calls `read_owner` — it constructs its own\r\n  `PoolOwner` and `fs::write`s unconditionally. The displaced lane's only channel is its next build's\r\n  refusal, which reports a STATE (\"this pool belongs to B\"), never a transition, and arrives pull-only\r\n  and arbitrarily late while interleaved-artifact harm is already underway. Labelled holes: measured\r\n  against the origin/main xtask binary (lane-tip carry is a source read, not a measurement);\r\n  pool-sweep-as-channel not exercised; single-process holder pid in all arms.\r\n- **Bootstrap property, not a defect (hertz, measured 2026-08-03 while claiming pools for the lanes\r\n  3-4 rebases):** a lane DELIVERING claim-identity cannot claim its own pool WITH that identity until\r\n  it lands — the prebuilt origin/main `xtask.exe` writes old-shaped stamps (owner_tree, lane_label,\r\n  holder pid+stamp; no lane_branch, no lane_base). Enforcer turnover surfacing at CLAIM time rather\r\n  than build time: coverage grows only as trees turn over. Recorded because it reads as a bug the\r\n  first time someone meets it in the field. Related lane-craft fact from the same queue: a rebase\r\n  changes SHAS necessarily but hunk OFFSETS only incidentally — todlando's main.rs hunks stayed at\r\n  @20/@53/@70 across the f2e4516→2f427b2 rebase; treat pre-rebase overlap measurements as stale by\r\n  construction and re-measure, but expect the geometry to usually hold.\r\n- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\r\n  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\r\n  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\r\n  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\r\n  (main.rs:2282) prints `(branch …, base …; advisory holder pid …)` and writes the nested lane.\r\n  A lane claimed with a stale tool records NO git identity and demotes its own adjudication back\r\n  to the refused bare-pid predicate. DETECTION that worked and is the reusable part: read the\r\n  claim line the tool PRINTS against the source just read — a mismatch names the stale enforcer\r\n  before it writes. REMEDY at claim time: rebuild xtask FROM THE LANE'S WORKTREE before\r\n  `pool-claim` (which the protocol's claim-from-your-own-worktree rule already implies; this\r\n  instance is why it is load-bearing and not ceremony).\r\n- **RULING (doyle, 2026-08-04) — the claim path must run the same guard the build path runs, and a\r\n  takeover becomes an event.** The documented design already says a finished lane is \"taken over\r\n  loudly, not refused\"; a silent unconditional overwrite violates the spelling the protocol shipped\r\n  under. Remedy, both halves, one small lane: (ii) `pool-claim` reads the prior owner before writing —\r\n  prior lane LIVE (ancestry + stamp arm, never bare pid) ⇒ refuse exactly as build.rs would; prior\r\n  lane finished ⇒ proceed AND announce the displacement, naming the displaced lane in the success\r\n  line; plus (i) a `displaced` field (prior owner + takeover stamp) rides the new claim, so the fact\r\n  survives in the artifact the late-reading claimant already reads. The identity-less bare claim\r\n  (majority field shape, above) must be handled explicitly by the same change: a bare claim carries no\r\n  lane to adjudicate, so takeover of a bare claim always proceeds-and-announces, and the announcement\r\n  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\r\n  lane as or beside the IR-26 remedy. Size: small.\r\n\r\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\r\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\r\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\r","truncated":true,"truncatedBy":"lines","totalLines":4735,"totalBytes":55073,"outputLines":653,"outputBytes":55073,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"## OPEN\n…\n### IR-18 — resident_service_e2e kills breadcrumb pids BARE (stale-breadcrumb tree-kill; kill-side twin of IR-15)\n- **Status:** BUILT 2026-08-04 — the named acceptance carrier RAN and the condition is DISCHARGED,\n…\n- **Size:** small.\n\r\n### IR-19 — Docs-only pushes to main run full unit legs (classifier is PR-only) — intent unverified\r\n- **Status:** RETIRED 2026-08-18 — intentional for main pushes, not a classifier defect. · **Origin:** hertz observation 2026-08-03 (register-push\r\n  cadence gated his rig behind repeated hfenduleam unit legs); mechanism verified by doyle at\r\n  source same night.\r\n- **What/why:** `ci.yml`'s `changes` job classifies docs-only diffs ONLY for `pull_request` events\r\n  — push events hardcode `code=true` (ci.yml:45–48, an explicit branch, not a fallthrough), so\r\n  every docs-only push to main spins both full unit legs. Tonight: five register docs pushes each\r\n  queued a Windows unit leg on hfenduleam; concurrency kept one running + one pending (main is\r\n  never cancelled in-progress, pending runs supersede — the recorded behavior matches ci.yml:9–13).\r\n  FINDING SETTLED (deployah, same night, from the workflow): this is not intent — it is a scope\r\n  the classifier never had; the `*.md` / `traceable-reqs.toml` case arms are only ever REACHED on\r\n  pull_request (the early-return precedes them), and golden.yml's own hardcoded `code=true` is\r\n  unrelated (golden triggers only on golden/**). REMEDY STILL OPEN on a named tension: extending\r\n  the classifier to pushes leaves a docs-only main TIP with no run of its own — fine if\r\n  tested-sha==merged-sha means \"the code at this sha was tested\" (it was, at the last code sha),\r\n  not fine if any gate or reader takes \"main tip has a green run\" as the check. One person reads\r\n  the consuming gates before any remedy (doyle, at the next CI-touching wave) — three assuming is\r\n  how this class ships.\r\n- **Resolution:** the consuming contract already answers the held question:\r\n  `REQ-CI-DOCS-ONLY-THIN` is PR-only and explicitly says ADR-0050 supersedes\r\n  it for main pushes. Main-tip evidence remains full by design; no classifier\r\n  branch was widened.\r\n- **Interim rule (doyle, same night):** batch register edits into one push instead of landing them\r\n  as they occur — the cadence is a real gate on whoever is queued behind the runner.\r\n- **Ripe when:** next CI-touching wave, after the intent question is answered on the REQ record.\r\n- **Size:** small (one conditional, if the answer is \"extend\").\r\n- **Composed:** LOCKSMITH (#132) — doyle reads the consuming gates during the batch's CI-touching\r\n  wave (the intent question), BEFORE any classifier remedy. 2026-08-03.\r\n\r\n### IR-20 — resident_service_e2e's `spt daemon stop --force` does not stop the daemon; teardown is complete only because the kills are\r\n- **Status:** open · **Origin:** hertz 2026-08-03, measured on the IR-18 lane's own clean run\r\n  (hfenduleam, log kept); routed text, doyle-landed.\r\n- **MEASURED:** teardown runs `spt(&[\"daemon\",\"stop\",\"--force\"])` then reaps. At reaper fire, every\r\n  target was still ALIVE and every verdict was `Killed`, not `gone` — verdicts=[boot Killed,\r\n  rel Killed, brain Killed]; the brain's kill line names it `(child process of PID 46896)` — the\r\n  daemon — so the daemon was still resident too and was taken down by the `Child` handle, not the\r\n  stop. A stop that worked would have left the reaper `gone`. This rules OUT the innocent reading\r\n  (stop doesn't manage services): the stop did not reach the DAEMON either.\r\n- **NOT ESTABLISHED — two rungs, neither discriminated:** (1) the rig seeds a `doyle` perch with\r\n  `std::process::id()`, satisfying `ceremony_agent_ground`'s pid-ancestry rung for every child of\r\n  the harness; (2) the rig never scrubs `OWL_SESSION_ID`/`SPT_AGENT_ID`/`SPT_ENDPOINT_ID` from its\r\n  teardown commands, and the measuring run launched from a live agent session, so the env rung was\r\n  live too. `--force` overrides neither. The stop's output is discarded at the call site\r\n  (`let _ = spt(...)`) — no diagnostic names a denial, and no claim is made that one fired.\r\n  Settling it is one run with the stop's stderr captured — on the CI runner AS WELL AS the dev box,\r\n  since the rungs fire on different machines.\r\n- **Why it matters beyond this rig:** REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own failure shape\r\n  inside a rig that passes — teardown completeness rested entirely on breadcrumb kills that were,\r\n  until IR-18, bare `taskkill /F /T` on unauthenticated pids; the most trustworthy-LOOKING\r\n  component (an explicit `--force` stop) was doing nothing while the least trustworthy one did all\r\n  the work. Exactly why the population gate exists rather than per-pid checks alone.\r\n- **Remedy caution (the sentence that must not drop):** the prescribed fix (seed pid 0, scrub the\r\n  three markers — REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN's own gate) is NOT free here: this rig's\r\n  `doyle` perch pid is load-bearing for the shell bind-by-token legs, so the two remedies are not\r\n  interchangeable — a lane taking this must check which legs depend on the pid before changing it,\r\n  or it fixes the stop and breaks the REQ-INSTALL-11 legs the rig exists for. Kin:\r\n  REQ-BROKER-STOP-ENDPOINT-DENY (the refusal being worked around).\r\n- **LANE-LINKED 2026-08-30 (#242 close sweep):** hertz's queued daemon-leak fixup lane carries\r\n  this entry (brief cites IR-7/17/20/34/35/63); leaves the register when that lane lands.\r\n- **Ripe when:** a hertz test-hardening wave, or alongside the (b) helper lane's touch of this rig.\r\n- **Size:** small (stderr-captured discrimination run × two machines, then the scoped remedy).\r\n\r\n### IR-54 — golden-head-intake runbook: three properties this cut proved should be construction, not discipline\r\n- **Status:** BUILT 2026-08-29 — PR #176 (`880b3b9c`, landed on main via `37368263`).\r\n  · **Origin:** PORTER (#205) v0.59.0 cut, 2026-08-21 — doyle (gater) + deployah (driver),\r\n  both mechanisms measured at the cut, neither cost this run anything because the driver caught\r\n  them by hand. Filed at the release-close register sweep.\r\n- **What/why (three runbook amendments, one lane):**\r\n  1. **Release-shaping at ASSEMBLY intake, not post-golden.** The head arrived code-complete\r\n     but not release-shaped (no version bump, stale CHANGELOG top section) — 5 of the last 6\r\n     cuts. v0.59.0 fixed it by authoring version material BEFORE the golden run, which is what\r\n     produced the four-name shape (ruled sha == main tip == golden ref == tag == `c62904e7`,\r\n     first time in six cuts; the previous five each argued a post-golden delta inert). Amend\r\n     `docs/golden-head-intake` so the gater's assembly checklist asks the release-shaping\r\n     question at intake and the driver never authors on top.\r\n  2. **Never-executed-cells list is a hand-off artifact.** The runbook makes it a\r\n     gater-compiles / driver-re-checks item; PORTER's handoff omitted it and the driver had to\r\n     ask. Name it in the assembly checklist beside the greenlit-form delta: which new cells'\r\n     first CI execution is this golden, and where each HAS executed (lane gate / assembled\r\n     head) — it converts a golden red from an RCA into a lookup.\r\n  3. **Lockfile-refresh rule states the PROPERTY, not the command.** Step 1 prescribes\r\n     `cargo metadata --offline`; the driver used `cargo update --workspace --offline` and\r\n     proved the actual rule by diff (workspace members only, third-party pins untouched —\r\n     14 first-party line pairs, 90 third-party unchanged). The property is the rule and the\r\n     diff is its evidence (the standing by-diff rule exists because counting misread v0.39.4\r\n     and v0.41.0 in opposite directions — and the `windows-sys` 0.59.0 collision was LIVE at\r\n     this cut, the exact condition where counting fabricates a 15th \"first-party\" bump);\r\n     demote the command to an example vehicle.\r\n- **Built evidence:** `docs/RELEASE-RUNBOOK.md` now asks the release-shaping question at assembly\r\n  intake, makes the never-executed-cells list part of the hand-off itself, and states lock refresh\r\n  as a diff-proven property with commands demoted to example vehicles. PR #176 passed\r\n  `traceable-reqs check`; the v0.65.0 cut had already exercised the release-shaped-head rule.\r\n- **Size:** small (one runbook doc lane; no code).\r\n\r\n## IN-FLIGHT ON THE BOARD (not re-homed — live WIP lanes)\r\n\r\n- releases#93 (servicehost swap test pid-inequality), releases#47 (thin-lane unit(Windows)\r\n  isolation class), releases#32 (worker_lifecycle_e2e Phase A intermittent) — infra-shaped but WIP;\r\n  a live lane is never re-homed mid-flight. When each closes, any residue lands here as a new entry.\r\n\r\n## BUILT / RETIRED\r\n\r\n### IR-15 — provably_gone is pid-only on Windows: teardown tests can fabricate reds\r\n- **Status:** BUILT 2026-08-03 · **Origin:** golden 30776330383 red on the #125 fix lane (2026-08-02)\r\n- **Lane:** hertz `golden/ir15` @a5042ec — REQ-TEST-LIVENESS-ORACLE-AUTHENTICATED (impl+unit): one\r\n  shared authenticated death-oracle test helper backed by `spt_procident::process_identity`\r\n  (identity pinned at find time, re-verified at assert), both pid-only polling sites repinned\r\n  (daemon.rs teardown test; endpoint_lifecycle.rs relay_pid). Ruled polarity held: Absent⇒gone,\r\n  Present(same start)⇒not gone, Present(different)⇒gone, Unproven⇒NOT gone, missing-stamp\r\n  degrades to pid-only loudly — every unknown errs toward the recoverable red, zero new\r\n  false-green paths. Linux caveat documented in the helper (10ms jiffies: Present(different) is\r\n  narrowing, not decisive; same-tick reuse errs red, safe).\r\n- **Golden:** run 30782259675 red on `resident_service_e2e` bring-up — delta exonerated (unrelated\r\n  family, now [[IR-17]]; same job minted [[IR-8]]'s defining specimen). Same-sha rerun 30784469908\r\n  GREEN; main ff'd to a5042ec.\r\n- **A/B discriminator (hertz):** 80/80 green both arms, quiet + churn phases; churn arm\r\n  positive-controlled (pid-allocator wrap observed <400ms, so reuse pressure was REAL in the churn\r\n  arm); rule-of-three bounds the original flake at ~7.5%/run/sha. Specimen 30776330383 remains\r\n  not-reproduced, cause unidentified — the repin removes the false-red MECHANISM; it does not\r\n  adjudicate the specimen. [[IR-16]]'s kill-side arm (TerminateJobObject return discarded) stays\r\n  a live discriminating instrument for any recurrence — and since 2026-08-03 it is no longer the\r\n  only one: [[IR-18]] (the test's OWN bare breadcrumb tree-kill) is the second kill-side candidate,\r\n  test-side rather than product-side. A recurrence must discriminate between them, not assume\r\n  either: IR-16's arm is a job whose termination silently half-fails (survivor still holds the\r\n  captured image); IR-18's is a victim killed by a bare pid it no longer owns —\r\n  `broker_survived=false` with the boot service still ALIVE and its message spooled. (An earlier\r\n  spelling of IR-18's signature here said \"empty stderr\"; retracted — empty stderr is present on\r\n  healthy runs and discriminates nothing.)\r\n\r\n### IR-21 — CLASS: a helper binary's build is never requested, only its LOCATION is, so any narrow invocation manufactures a red that belongs to the rig\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03. Filed as one instance, rewritten as a CLASS the\r\n  same day when a second member appeared, rewritten AGAIN when the mechanism was measured — the\r\n  first two versions described symptoms and got the remedy wrong. **Corrected a fourth time the same\r\n  day**: remedy (1) claimed the 11 same-package sites were missing a build edge, and todlando\r\n  falsified that by measurement while executing it (replicated independently by doyle). The error was\r\n  doyle's to carry — it was ruled on, not just written. The general rule that refutes it was already\r\n  in this entry's own CI-member section; diagnosing a class does not inoculate you against drawing\r\n  its opposite consequence one section later.\r\n- **Numbers below re-derived on `main` @`3efd7e6` over `git ls-files` (tracked files only). Each\r\n  carries its command; re-run rather than cite.**\r\n- ⚠ **Scan-root hazard, measured 2026-08-03 and worse than first reported:** a naive recursive\r\n  `grep -r` from the project root inflates by **~35×**, not the ~5× an earlier draft of this entry\r\n  claimed — 426 tracked `.rs` against 14,865 on disk with `target/` excluded, because `.worktrees/`\r\n  holds full copies of the tree. **And the unscoped grep does not COMPLETE** (still running at a\r\n  120s timeout while `git ls-files` returns instantly), so the failure mode is not only a wrong\r\n  number but a command that reads as hung on a tree where dozens of worktrees are normal. Use\r\n  `git grep` or `git ls-files | xargs grep`; both are scoped to tracked files by construction.\r\n\r\n#### THE MECHANISM (measured, both ends)\r\n\r\n**Build end — `cargo test` with a narrow target selector compiles a `[[bin]]` AS A TEST HARNESS and\r\nnever emits the plain executable.** Measured: `cargo test -p spt --bins` on a clean pool produced\r\nfive executables, every one hash-suffixed under `target/<profile>/deps/`, and ZERO plain exes in\r\n`target/<profile>/`. The bin was built. The file the test looks for was not written.\r\n\r\n**Consumer end — the resolver borrows a guaranteed binary's path to locate an unguaranteed one.**\r\nAll 29 copies of `sibling_bin` in `crates/spt/tests/` reduce to two textual variants (22 + 7) of one\r\nbody:\r\n\r\n```rust\r\nfn sibling_bin(name: &str) -> PathBuf {\r\n    PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"))\r\n        .with_file_name(format!(\"{name}{}\", std::env::consts::EXE_SUFFIX))\r\n}\r\n```\r\n\r\n`CARGO_BIN_EXE_spt` is used **only as a directory anchor**. Cargo therefore sees a dependency on\r\n`spt` and on nothing else; the `{name}` half is a string join it cannot observe. The dependency edge\r\ndoes not exist at any level a build system could act on — which is why \"use the wider command\" is\r\nnot the fix and why the failure is invisible on a warm pool where some earlier run happened to leave\r\nthe file behind.\r\n\r\nThe unit-test resolver at `crates/spt/src/cli.rs:25601` reaches the SAME directory from a different\r\nanchor (`current_exe()` → `deps/` → parent) for the same reason: its own doc comment records that\r\nunit tests get no `CARGO_BIN_EXE_*` at all.\r\n\r\n**That mechanism explains both original members at once, including the polarity inversion that made\r\nthem look like different bugs:** whether `cargo test -p spt` or `cargo test -p spt --bins` happens\r\nto leave a plain exe behind is incidental to a dependency neither command was told about.\r\n\r\n#### SCOPE — WHERE IT BITES, AND WHERE IT DOES NOT\r\n\r\n**It bites NARROW invocations — `-p <pkg>`, `--bins`, `--lib` — i.e. gate rigs and local runs.**\r\nBoth members were hit on the LOCKSMITH t1 lane against fresh throwaway pools; each was discharged\r\nin-lane as a rig artifact. That is the whole field population to date.\r\n\r\n**GOLDEN IS ACQUITTED, and the acquittal is measured rather than assumed.** `cargo test --workspace\r\n--no-run` emits all 13 plain binaries — mock-session, mock-shell, capture-player,\r\nconsole-mode-probe, service_fixture and the rest — so a workspace build produces the cross-package\r\nhelpers by construction. Confirmed under nextest, the tool CI actually runs, with a real compile.\r\n\r\n⚠ **The measurement that establishes this is not the obvious one.** Deleting the plain exe and\r\nwatching it reappear is NOT evidence of a rebuild: cargo's uplift restores a hardlink from an intact\r\n`deps/` artifact, with link count 3 and an UNCHANGED mtime, which looks exactly like a build and\r\nsays nothing about a pool that never had the file — and a pool that never had it is the only kind a\r\nrig runs on. The sound probe removes the plain exe AND both `deps/` artifacts, confirms all three\r\nabsent, then watches the target actually recompile (mock-adapter, 5.77s, fresh mtime). The first two\r\nattempts were setup, not measurement.\r\n\r\n⚠ **The suspicion this acquits is structurally well-founded, so record the answer, not just the\r\nverdict.** `twohost-a`/`twohost-b` are `needs: test`, so the only mock-adapter prebuild runs AFTER\r\nthe phases that use it; `target/` is gitignored, so checkout never cleans it on a persistent\r\nself-hosted workdir. Every precondition for artifact leakage is present — the build simply does not\r\nneed it. The next person who reads that job graph will form the same hypothesis; this is the answer\r\nwaiting for them.\r\n\r\n#### THE ONE CI-SIDE MEMBER THAT IS REAL\r\n\r\n`crates/spt/src/cli.rs::adapter_translate_proof_gates_on_commit` is a **unit** test (`kind(bin)`),\r\nand `CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package. A unit\r\nconsumer therefore CANNOT express the dependency through the env var at all — it has no choice but\r\nto resolve by path. That is why `.github/workflows/ci.yml:105-106` carries a hand-written\r\n`cargo build -p spt --bin translate_proof_fixture` before the unit lane, with a comment\r\n(`ci.yml:102-104`) stating this exact mechanism.\r\n\r\n**Deleting that step would red the unit lane on a clean pool, and it would read as a code red.**\r\nSomebody already hit this class, fixed their own leg correctly, and never turned it into a rule —\r\nthe comment at `ci.yml:102` is IR-21 written a milestone early, in the one place only its author\r\nwould find it.\r\n\r\n#### POPULATION\r\n\r\n**13 bin targets in the workspace** (`cargo metadata --no-deps`, not a grep — an auto-target under\r\n`src/bin/` and `xtask` are both invisible to a `[[bin]]` grep). Two are not helpers (`spt`, `xtask`);\r\nthe other **11 are test helpers**, across three packages:\r\n\r\n| package | helpers |\r\n|---|---|\r\n| `adapters/mock` | mock-session, mock-shell, capture-player, console-mode-probe |\r\n| `crates/spt-daemon` | dispatch_fixture, service_fixture, summarizer_fixture, xlate_choreo_fixture (⚠ this row was mis-\"corrected\" 2026-08-22 to claim `xlate_choreo_fixture` no longer existed — IT DOES, as an AUTODISCOVERED `src/bin/` target with no `[[bin]]` stanza; the original row was right and merely predated `summarizer_fixture`. See IR-58) |\r\n| `crates/spt` | translate_proof_fixture, post_step_fixture, gh_fixture, git_fixture |\r\n\r\n**44 literal `sibling_bin(\"…\")` call sites**, all in `crates/spt/tests/`, served by **29 copied\r\nresolvers**. Split by whether the BUILD IS ALREADY GUARANTEED — which is not the same question as\r\nwhether the env var is available, and an earlier version of this entry conflated the two:\r\n\r\n| class | sites | detail | build guaranteed? |\r\n|---|---|---|---|\r\n| **cross-package** | **33** | mock-session 26, mock-shell 6, service_fixture 1 | **NO — the hazard members** |\r\n| **same-package** | **11** | translate_proof_fixture 7, git_fixture 2, post_step_fixture 1, gh_fixture 1 | **YES — already, by construction** |\r\n\r\n⚠ **MEASURED TWICE, and it falsifies what this entry said on 2026-08-03 before this revision:** cargo\r\nbuilds **every bin target of a package whenever it builds ANY integration test of that package** —\r\nthat same act is what sets `CARGO_BIN_EXE_*` in the first place. So the 11 same-package sites were\r\nnever unexpressed in a way that could bite, and the hazard population is **33 cross-package sites\r\nplus the one unit-test member = 34**, not 44.\r\n\r\n- **Probe 1 (todlando, root pool):** deleted all four `translate_proof_fixture` artifacts (both\r\n  hash-suffixed harness exes, the `deps/` plain exe, the uplifted plain exe), confirmed absent, then\r\n  built ONE UNRELATED and UNMODIFIED integration test of the same package —\r\n  `cargo test -p spt --test attach_wedge_e2e --no-run`, exit 0, 14.45s. Both plain exes returned with\r\n  fresh mtimes; the hash-suffixed harness exes stayed absent, which is what distinguishes a bin\r\n  DEPENDENCY build from a `--bins` harness build.\r\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\r\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\r\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\r\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\r\n  against the 09:00 it carried before), so this is a real build and not the hardlink uplift this\r\n  entry warns about elsewhere; the harness exe stayed absent.\r\n- **Neither probe needs a baseline arm:** the probe test is unmodified and references nothing under\r\n  edit, so what it measures is cargo's behaviour, not anyone's change.\r\n- **Corroborated by this entry's own field data:** neither original member was a same-package\r\n  integration site — member 1 is a UNIT test, member 2 is CROSS-package. The class never had a\r\n  same-package integration member, and the CI-member section below already stated the governing rule\r\n  (`CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package) one\r\n  section before the remedy drew the opposite consequence from it.\r\n\r\nCommand: `git ls-files '*.rs' | xargs grep -hon 'sibling_bin(\"[a-z_-]*\"' | sed 's/.*sibling_bin(\"//;\r\ns/\"//' | sort | uniq -c`.\r\n\r\n⚠ An earlier report gave 48 sites and a 6/11/37 split. Take the table above: it counts only literal\r\ncall sites in tracked files and it ships its command. The 11 is the same 11 in both counts.\r\n\r\n**The LOCATION half of this class is already closed** by `crates/spt-term/tests/support/fixture_bin.rs`\r\n— a shared resolver rather than 29 copies. It does not close the BUILD half, and should not be\r\nmistaken for having done so.\r\n\r\n#### REMEDY SHAPE (not ruled)\r\n\r\nThe distinction that matters is location vs. build:\r\n\r\n1. **The 11 same-package sites are NOT hazard members and need no build fix.** Their build edge\r\n   already exists (see the two probes in POPULATION above); `env!(\"CARGO_BIN_EXE_<name>\")` for the\r\n   fixture itself would add nothing to it. Converting them is a **CLARITY** change, worth doing on\r\n   its own smaller merits — the path becomes the one cargo actually emitted rather than a string-join\r\n   of a directory anchor and `EXE_SUFFIX`, five copies of `sibling_bin` stop existing (29 → 24), and\r\n   it completes a migration already paid for: `crates/spt/tests/fixtures/translate_proof_fixture.rs:7-12`\r\n   records that the fixture was re-homed into `spt` precisely to obtain\r\n   `CARGO_BIN_EXE_translate_proof_fixture`, and then all 7 call sites resolved by path anyway. **It is\r\n   not a build fix and must not be filed as one.**\r\n2. **The 33 cross-package sites cannot**, by cargo's design. Their options are an asserted build in\r\n   the test's own setup, a `dev-dependencies` artifact dependency, or an explicit documented\r\n   prebuild — the ci.yml:106 shape, made a rule instead of a local fix.\r\n3. **Standardising on one wider invocation is NOT a remedy.** It changes which pools happen to work;\r\n   it does not create the dependency edge, and the two original members had opposite polarity under\r\n   exactly that theory.\r\n4. Collapsing the 29 resolver copies is worth doing on the `fixture_bin.rs` model, but on its own it\r\n   makes the class HARDER to see — one shared resolver still anchored on `CARGO_BIN_EXE_spt` hides\r\n   the 33 genuinely unexpressed dependencies among its 44 call sites behind one function.\r\n\r\n#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\r\n- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\r\n  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\r\n  here so the next clean rig does not re-diagnose them as code reds.\r\n- The first two versions of this entry framed the class as \"the rig's command does not build what\r\n  the test needs\" and proposed standardising on a wider invocation. **Both are superseded by the\r\n  measured mechanism above** — the dependency is not under-expressed, it is INEXPRESSIBLE in the\r\n  form these call sites use, so no choice of invocation creates it. Kept only as the two FIELD\r\n  MEASUREMENTS that produced the class, which remain true:\r\n- **MEMBER 1 — MEASURED:** `cli::tests::adapter_translate_proof_gates_on_commit` failed on the\r\n  first `cargo test -p spt --bins` run. Its fixture binary `translate_proof_fixture` (a\r\n  `tests/`-homed `[[bin]]`) was ABSENT from the pool — `ls` on the path returned No such file.\r\n  Building it explicitly and re-running the IDENTICAL command PASSED, after which the full `--bins`\r\n  suite passed 584/585 with only the releases#117 probe red (that one RED by design). So the\r\n  discriminator is the fixture's presence, not the tree: same command, same sha, red then green\r\n  across one `cargo build` of the fixture.\r\n- **MEMBER 2 — MEASURED:** `cargo test -p spt` does not build `mock-adapter --bin mock-session`, so\r\n  `attach_wedge_e2e` panics `\"the dummy-harness program must be built\"`. Note the polarity is\r\n  INVERTED against member 1 — there the narrower `--bins` was the defective invocation and\r\n  `cargo test -p spt` the correct one; here `cargo test -p spt` is itself insufficient. So the\r\n  class is NOT \"use the wider command\"; it is that the dependency is not expressed to the build at\r\n  all, and which invocation happens to work is incidental.\r\n- **What/why (still true):** on a WARM pool the helper is already there from some earlier run and\r\n  the test passes, so the defect is invisible exactly where most people work and fires only on a\r\n  clean pool — i.e. on a GATE RIG, which is the one place a false red costs the most.\r\n- **The sweep this entry once called its first step HAS BEEN RUN** (todlando 2026-08-03) and its\r\n  result is the POPULATION section above. It is no longer outstanding.\r\n\r\n- **Why it is register debt and not a lane bug:** nothing in the product is wrong. The gap is\r\n  between what a test needs built and what the rig's command builds, and the fix belongs to the\r\n  tests' declarations, not to whoever is running a gate that day. Sibling rule:\r\n  [[gate-clean-target-not-incremental]].\r\n- **Built evidence:** golden now names every cross-package fixture prebuild\r\n  (`mock-session`, `mock-shell`, `capture-player`, `console-mode-probe`,\r\n  `service_fixture`) explicitly; `xtask binedge-check` reports zero missing\r\n  edges. All 29 local `sibling_bin` resolvers collapsed into\r\n  `tests/common/mod.rs`; the shared precondition names the missing fixture and\r\n  its package-correct build command before any product timeout.\r\n- **Ripe when:** the next gate-rig or CI-touching wave. Cheap, and it pays for itself the first time\r\n  it stops someone chasing a phantom red on a clean pool.\r\n- **Size:** remedy (1) is small AND optional — it buys clarity and subtraction, never a build edge;\r\n  medium for (2), which is a design call before it is an edit and is the only remedy that closes the\r\n  class.\r\n\r\n### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\r\n- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\r\n  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\r\n- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\r\n  the daemon-stop refusal fired on the running session's own identity env. It named\r\n  `$OWL_SESSION_ID`; clearing that made it name `$SPT_ENDPOINT_ID`. With `OWL_SESSION_ID`,\r\n  `SPT_ENDPOINT_ID`, `SPT_AGENT_ID` and `SPT_SESSION_ID` all cleared: exit 0, 1 passed.\r\n- **The finding is the DIAGNOSTIC SHAPE, not the env hygiene.** Naming one variable at a time means\r\n  a correct partial fix produces an identical-looking failure, so the natural reading of \"I cleared\r\n  it and it still fails\" is that the clearing did not work — when in fact each step was right and\r\n  the message had simply moved on to the next name. A refusal that can only ever name one member of\r\n  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\r\n  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\r\n- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\r\n  vars, so this fires for every builder on a perched session and for nobody running from a bare\r\n  shell — which is precisely the split between how builders work and how CI runs.\r\n- **Candidate remedies (not ruled):** have the refusal name EVERY identity var it found set, in one\r\n  line, rather than the first; and/or have the affected tests clear the identity set in their own\r\n  setup so a perched session is not a special environment. The first is the one that pays off\r\n  outside this test.\r\n- **Ripe when:** next CI/test-hygiene wave. **Size:** small.\r\n\r\n### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\r\n- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\r\n  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\r\n  parallel inside one binary each holds the file the other wants: `os error 32`, \"used by another\r\n  process\". **Signature: WHICH of the two fails alternates between runs.** Under\r\n  `--test-threads=1`: 2 passed, exit 0 — and the wall clock drops from 182s to 14s.\r\n- **What/why:** two defects in one, and they should not be conflated. (1) The tests are not\r\n  isolated from each other. (2) The staging path is the MACHINE-GLOBAL spt home rather than the\r\n  test's own temp home — on a box that is also a CI runner, so the blast radius is not confined to\r\n  the suite. (2) is the one worth fixing; (1) is a symptom of it.\r\n- **Note on why this is not already caught:** the standing rule is that integration tests run\r\n  through nextest, which gives each test its own process and hides the collision entirely. So this\r\n  is latent on the sanctioned path and only bites the bare `cargo test` path — the rule is working\r\n  and masking a real defect at the same time, which is why the entry exists rather than a shrug.\r\n- **Candidate remedy (not ruled):** stage the fixture into the test's own temp home. Sweep for\r\n  siblings first — any other test writing under `perch::spt_home()` rather than a temp home shares\r\n  the shape, and nobody has counted them.\r\n- **Built evidence:** adapter source, manifest registration, and psyche fixture\r\n  staging now use the rig TempDir. The two process-global resolver users are\r\n  explicitly serialized, and the bare `cargo test` path passes both cells with\r\n  `--test-threads=2` in 13.82s after the declared fixture prebuild.\r\n- **Ripe when:** next test-hygiene wave; the 182s -> 14s figure makes it pay for itself on the\r\n  bare path. **Size:** small per test, unknown until the sweep.\r\n\r\n### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\r\n- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\r\n  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\r\n  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\r\n  the daemon holds no other handle to reach them` — which also ANSWERS the cost-of-loss question\r\n  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\r\n  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\r\n  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\r\n  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\r\n  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\r\n  (`terminate_job_return_discriminates_broken_handle_from_ordinary_states`, cfg(windows), with a\r\n  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\r\n  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\r\n  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\r\n  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\r\n  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\r\n  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\r\n  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\r\n  NOT folded into that lane (doyle ruling, same day) and filed instead.\r\n- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\r\n  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\r\n  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\r\n  where it lives — the module already decided that these returns are worth reading.\r\n- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\r\n  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\r\n  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\r\n  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\r\n  termination cost here\" — and that answer has not been written down by anyone. Folding it in would\r\n  have meant settling that question in passing, inside a commit about the supervisor, which is how a\r\n  second ruling gets smuggled into a lane scoped to one.\r\n- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\r\n  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\r\n  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\r\n  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\r\n  its direct process in the same breath, which is what makes the middle hop dead by construction\r\n  there. **That is the first thing to check, and it is not assumed.**\r\n- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\r\n  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\r\n  cost-of-loss question is answered for this subject.\r\n\r\n### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\r\n- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\r\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\r\n  assembled.\r\n- **MEASURED, four arms, same box, same hour, matched load** (a second `cargo test -p spt-store\r\n  --lib` loop running throughout; `spt-store` itself stayed green in every round, so the box was not\r\n  generically failing):\r\n\r\n  | tree | instrument | result |\r\n  |---|---|---|\r\n  | lane `ec5f38a` | `cargo test --lib`, at rest | 821/821 ×4 |\r\n  | lane `ec5f38a` | `cargo test --lib`, under load | **2 of 3 RED** (142s, 117s) |\r\n  | lane `ec5f38a` minus its 5 new tests | `cargo test --lib`, under load | 3 of 3 green (117s, 84s, 105s) |\r\n  | main `932e14b` | `cargo test --lib`, under load | 3 of 3 green (97s, 119s, 104s) |\r\n  | lane `ec5f38a` | **`cargo nextest run`, under load** | **3 of 3 green, 821/821** (88s, 85s, 72s) |\r\n\r\n- **Three DIFFERENT victims across two loaded runs**, all process/timing-shaped, all PRESENT AT MAIN\r\n  and green there: `servicehost::…a_service_that_ignores_the_stop_marker_is_force_killed_and_confirmed_dead`\r\n  (panics `ForceKilled must MEAN the owned child is gone` right after `SERVICE_KILL_UNCONFIRMED`),\r\n  `applyhost::…broker_reports_its_compiled_image_version_over_ipc`, and\r\n  `daemon::…a_tree_teardown_reaches_a_grandchild_the_service_spawned`.\r\n- **MECHANISM: in-process thread interference, not product code.** Bare `cargo test` runs a crate's\r\n  tests as threads in ONE process. The lane's five new tests are process-spawning kill-tree tests;\r\n  under load they starve confirm windows of NEIGHBOURING tests that were always marginal. Removing\r\n  exactly those five flips 2-of-3-red to 0-of-3-green at the same sha, in the same binary, at the\r\n  same durations — one of the green runs sits at 117s, precisely a duration that had produced two\r\n  failures with them present.\r\n- **IT DOES NOT REACH GOLDEN.** nextest gives every test its own process, and golden runs nextest.\r\n  The population is GATE RIGS AND LOCAL RUNS — the same population as [[IR-21]], reached by a\r\n  different mechanism, which is why these are two entries and not one.\r\n- ⚠ **The instrument switch is the whole finding.** Measured with bare `cargo test`, this reads as a\r\n  lane blocker; measured with the tool CI actually runs, it is a rig-scoped nuisance. Anyone\r\n  re-opening this must state WHICH instrument produced their observation before quoting a verdict.\r\n  The same tool gap acquitted [[IR-21]]'s golden question the same day.\r\n- ⚠ **The pre-existing fragility is NOT thereby closed.** Those three tests were marginal before this\r\n  lane and the lane only exposed them; \"make the new tests quieter\" would re-hide a real weakness.\r\n  Hardening them is test-side work (hertz's lane by the dispatch split), not the builder's.\r\n- **Two rig defects of the gater's, recorded because they nearly cost the verdict:** (1) a first\r\n  re-run at rest came back 4/4 green and proves NOTHING — a sequential idle probe cannot express a\r\n  load-sensitive failure, so that is a competence-controlled zero, not an acquittal; (2) the first\r\n  baseline attempt ran its two arms UNSYNCHRONISED (the load generator finished while the measured\r\n  arm was still on run 1), which would have compared a loaded lane against an idle main and read as\r\n  \"the lane broke it\". A discriminator whose arms ran under different conditions cannot discriminate.\r\n- **Ripe when:** alongside [[IR-21]] on the next gate-rig or CI-touching wave, or immediately if\r\n  anyone starts gating on bare `cargo test` on a loaded box. **Size:** small to document the rig\r\n  rule (gate with nextest); medium to harden the three marginal tests.\r\n\r\n### IR-26 — POOL-OWNER claims authorize takeover from a DEAD holder, so releases#103's hazard reaches through the guard\r\n- **Status:** open, LANE BUILT BUT UNCOMMITTED (see the warning below — this is not a figure of\r\n  speech) · **Origin:** hertz 2026-08-03/04, found by its own test rather than by reading, and\r\n  reported unfiled for composition. Composition ruling is doyle's, 2026-08-04.\r\n- **What/why:** a POOL-OWNER claim named a holder pid; lane liveness was read from whether that pid\r\n  was alive. hertz MEASURED the failure on this box: **3 of 3 claims had dead holders while one of\r\n  those lanes was live** — so the guard authorized exactly the interleaving takeover releases#103\r\n  exists to prevent. The remedy records the lane's GIT IDENTITY (branch + the base sha it carried at\r\n  claim time) and reads lane state from ancestry: in flight while the tip is not contained in\r\n  `origin/main`; settled once merged, once the branch is gone, or once the branch no longer carries\r\n  the claimed base (the branch-level twin of a recycled pid). Holder pid demotes to advisory — a\r\n  LIVE holder still refuses, a dead one no longer authorizes.\r\n- **The strongest finding in it, and it is a filter-competence one:** without the base anchor, a\r\n  missing branch read as \"settled, branch gone\" **out of a directory that was not a repository at\r\n  all**. An unanchored Settled verdict is a clean zero produced by a filter that cannot express the\r\n  question. A Settled verdict now requires the base object to be present in the reading repo;\r\n  unanchored is UNKNOWN. Sibling of [[zero-match-filter-reads-as-absent]] in the pool domain.\r\n- ⚠ **POLARITY, stated rather than buried:** the new arm (dead holder + unlanded lane => REFUSE)\r\n  converts a false-TAKEOVER into a false-REFUSAL. That is the better failure but not a free one, and\r\n  its triggering case is not exotic — it is an agent going down mid-lane, which happened to hertz\r\n  itself this same batch and cost [[IR-1]]/[[IR-4]]/[[IR-9]] their landing. **The open gating\r\n  question, put to hertz 2026-08-04 and NOT yet answered:** from the refusal state, does\r\n  `pool-release` still clear a claim whose holder is dead and whose lane is unlanded, or does the new\r\n  arm refuse that too? A guard whose only escape is the blanket `SPT_POOL_UNCHECKED=1` trains people\r\n  onto the blanket override. The refusal must NAME the remedy, not only the witness, and the remedy\r\n  must be exercised FROM the refusal state rather than reasoned about ([[remedy-must-run-from-refusal-state]]).\r\n  If the answer is \"it refuses\", that is a design change and returns to doyle before the lane lands.\r\n- **COMMITTED 2026-08-04 (was uncommitted when first measured):** `ci/poolowner-lane-claim` =\r\n  `8ce40d9` (the change) + `98cfafe` (the remedy fix below), both off `b7b00c3`. The original\r\n  measurement found ZERO commits and six modified files in `.worktrees/hertz-poolowner`, i.e. every\r\n  reported number had been measured against a tree no git object captured; the builder committed on\r\n  being told. Recorded because the near-loss is the lesson, not the correction.\r\n- **THE REMEDY DID NOT RUN — measured from the refusal state, which is the only place the question\r\n  can be asked.** The refusal named its witness AND a command, and executing that command verbatim\r\n  failed with the IDENTICAL `SPT_POOL_FOREIGN` block that printed it: **xtask depends on spt-store,\r\n  so every command that builds the tool goes through the pool being refused.** This is the same dead\r\n  end the unclaimed-foreign arm already hit in the field and fixed by leading its line with the\r\n  hatch — adding a second refusal arm re-broke it immediately. FIXED at `98cfafe`: the in-flight\r\n  remedy now leads with the hatch and names `pool-claim`, the command that actually resolves\r\n  ownership. Full chain re-measured on hfenduleam: refuse → verbatim remedy fails → hatch-prefixed\r\n  form succeeds → build proceeds.\r\n- **Answer to \"does `pool-release` clear a dead-holder + unlanded claim\", two-part:** it DOES — it\r\n  never consults the verdict, it rewrites `lane=None` — **but it is NOT the exit**, because after\r\n  release the same build is refused again on the pre-existing unclaimed-foreign arm (\"no lane has\r\n  claimed this pool\"). Release moves you from one refusal to another. `pool-claim` is the exit.\r\n- **The guard is a POPULATION, not a row** (builder's generalization, adopted by doyle as the\r\n  standard for this class): one test poses all three refusal arms and asserts that any remedy naming\r\n  a command leads with the hatch, PLUS membership — three posed, three refused — so no arm passes by\r\n  never being reached. The rule had been learned once already and the next arm added broke it, which\r\n  is the definition of something that needs a population test rather than a better comment. 26/26.\r\n- ⚠⚠ **FLEET PROPERTY — the rig refuted itself, and this is the entry's most important line.** The\r\n  first arm did NOT refuse, it TOOK OVER: the arriving worktree was at `b7b00c3`, so the build script\r\n  that ran was ITS OWN, pre-identity. **Enforcement code comes from the ARRIVING tree, never from\r\n  the claim.** So until this lands everywhere, an old tree still takes a live lane's pool, and the\r\n  guard is only ever as new as the tree that arrives. Found by measurement; reasoning would have\r\n  reported a refusal the rig never produced.\r\n- **RULING on the fleet property (doyle 2026-08-04) — a stamp VERSION LINE is REFUSED, and not on\r\n  taste: it cannot work.** The tree that must refuse is the OLD one, and an old build script does not\r\n  read a new stamp field because it does not know the field exists. You cannot make a stale enforcer\r\n  honor a new rule by writing something new into the record it enforces against — **the reader is\r\n  the problem, not the record.** A version line would help only a CURRENT tree explain itself while\r\n  doing nothing to the population it is aimed at, i.e. it would retire the worry without retiring the\r\n  risk. Ruled instead, in priority order: **(1)** land it and state the migration window honestly —\r\n  the arm protects a lane only when the ARRIVING tree carries the change, coverage grows as trees\r\n  turn over, never retroactive; **(2)** NAME THE LOSS YOU CANNOT PREVENT ([[IR-16]]'s pattern) — the\r\n  claiming side may be able to notice afterwards that its pool was taken and say so loudly, turning\r\n  silent artifact corruption into a named event; scope separately and MEASURE whether the claiming\r\n  side can observe it at all before committing; **(3)** SHRINK THE POPULATION — old enforcers are old\r\n  trees, this box carries ~45 worktrees and most are stale, so reaping them is real mitigation and\r\n  cheaper than code. (2) and (3) do NOT ride this lane.\r\n- **The unanchored row, as asked:** `a_claim_from_another_repository_reads_unknown_not_settled` was\r\n  RED before the base-object requirement existed. Verbatim: `left: Settled { reason: \"lane branch\r\n  build/lane-x no longer exists\" }  right: Unknown`, out of a tempdir that was not a repository at\r\n  all. It fails without the requirement and passes with it — a real negative control, not a row that\r\n  only ever passed.\r\n- **Builder's evidence (as reported, against that uncommitted tree):** spt-poolguard 25/25 with 7 new\r\n  rows, one per precedence cell, two carrying their own negative control; pool_guard_canary 3/3;\r\n  `cargo check -p xtask -p spt-store --all-targets` clean; clippy clean on the three touched crates;\r\n  `traceable-reqs check` exit 0 at 745/745 with new `REQ-POOL-LANE-IDENTITY` complete at doc+impl+unit.\r\n- **Composed:** its OWN thin lane, riding the same next golden batch as the CI-rider cluster but NOT\r\n  merged into it (doyle ruling 2026-08-04). A red must stay attributable: the riders change what the\r\n  pipeline measures, this changes a build-time REFUSAL, and a guard whose failure mode is refusing\r\n  builds is the worst thing to make inseparable from a pipeline change. IR-14's four-trees-into-one-\r\n  unclaimed-pool finding stays OUT of this lane and stays IR-14's, on the same ground [[IR-24]] was\r\n  kept out of [[IR-16]] — folding it in settles its question in passing.\r\n- **Ripe when:** next CI/infra batch, gated on the polarity question above being answered first.\r\n  **Size:** small once the remedy question is settled.\r\n- **FALSE-LIVE, first specimen of the blocking polarity (hertz sweep, measured 2026-08-04):**\r\n  `.worktrees\\hertz-ci-riders\\target\\POOL-OWNER.json` named `holder_pid 31380` with\r\n  `holder_started_at 134302739211259713` = 2026-08-03 16:38:41. Pid 31380 on that box at read time was\r\n  `claude.exe -n \"doyle @ HFENDULEAM (spt-core/)\"`, created 17:31:11, FILETIME 134302770715019370.\r\n  Same boot, ~52 minutes apart, stamps MISMATCH. The claiming process died and the OS reissued its pid\r\n  to the gater's own session. Every previously measured recycle produced a false-DEAD (reads free\r\n  while the lane is live — the corrupting direction); this one produces a **false-LIVE**: a bare-pid\r\n  guard reads the claim as held by a running holder and refuses, naming doyle as the holder of hertz's\r\n  pool — the blocking direction, first time caught. The `holder_started_at` arm shipped in `8ce40d9`\r\n  discriminates it correctly — that field caught defending, not asserted to defend\r\n  ([[stable-anchor-is-not-a-recycling-defense]]).\r\n- **The mirror image, same box, same hour:** `.worktrees\\ir24-reap\\target` named `holder_pid 33612`,\r\n  DEAD — while that lane was genuinely LIVE, with `cargo clippy -q -p spt-daemon --lib --tests`\r\n  (pid 22452) running under todlando's session as it was read. Two claims, opposite errors, inside one\r\n  hour: liveness misreads in BOTH directions on the same box in the same hour. Holder liveness has no\r\n  sound polarity as a lane-state oracle. Ancestry decides ([[pool-claim-holder-death-is-not-lane-state]]).\r\n- **THE BARE-CLAIM GAP — a claim the stamp arm cannot adjudicate at all.** The main checkout's own pool\r\n  (`<root>\\target`, 72,001,016,671 B = 67.06 GiB) carries\r\n  `{\"owner_tree\": \"...\\\\spt-core\", \"written_by\": \"spt-poolguard\"}` — no `lane_label`, no `holder_pid`,\r\n  no `holder_started_at`, no `lane_branch`, no `lane_base`. `read_owner` maps that to `lane: None`, so\r\n  every arm the lane-identity work added is unreachable for it: it cannot be read as in-flight,\r\n  settled, or recycled. **FIVE of the eight** claims found on this box are this shape — `<root>\\target`,\r\n  `<root>\\target-seam` (below), `gate-target-render`, `ir21-xtask\\target`, `locksmith-t1\\target` —\r\n  against three carrying a lane identity (`hertz-ci-riders`, `hertz-poolowner`, `ir24-reap`). A claim\r\n  written by a plain build rather than by `pool-claim` is structurally un-adjudicable, and it is the\r\n  MAJORITY shape in the field. Whatever IR-26 does next has to say what an identity-less claim means —\r\n  \"the stamp arm handles it\" is false for most claims that actually exist.\r\n- **The fifth bare claim was invisible to the first inventory, and the miss is its own lesson:**\r\n  `<root>\\target-seam`, **52.06 GiB**, real dir, gitignored on its own line (`/target-seam`, added\r\n  `5ae68f8`, v0.12.1 era), created 2026-06-18, last written 2026-08-02 — nothing in the tracked tree\r\n  references it (grep over rs/toml/md/yml/ps1/sh: zero hits outside this file). The inventory predicate\r\n  was \"a directory named `target` inside a worktree\"; a second root-level pool under a different name\r\n  is not expressible in that filter, so it returned a clean zero that was reported as a population\r\n  ([[verdict-from-probe-competence]] in the field). Corrects the earlier \"72 GB root pool is the\r\n  biggest object by 9x\": the two root pools are 67.06 + 52.06 = 119.1 GiB of a 133.43 GiB box pool\r\n  total, so the 44-tree sweep covered ~61% of pool bytes, not the population. **Ruling (doyle,\r\n  2026-08-04): target-seam stands for now** — free space is ~115 GB against the 32 GB golden floor, so\r\n  there is no pressure; it was written to yesterday, so \"cold\" is one day deep and its writer is\r\n  unidentified. It becomes a reap candidate at the next free-space squeeze, after a fresh last-write\r\n  check and identification of what wrote it on 08-02 — reaping a pool whose writer you cannot name is\r\n  how the v0.51.0 fabricated-red class starts.\r\n- **CLAIM-OBSERVABILITY, MEASURED (hertz, 2026-08-04, three-arm rig with competence control):** a\r\n  displaced claimant CANNOT distinguish takeover from never-claimed — the two states are byte-identical\r\n  on disk (arm 1 vs arm 2 identical; arm 3 proves the rig separates states that differ, so the null is\r\n  real). The takeover is silent on BOTH sides: the taker's `pool-claim` prints ordinary success naming\r\n  no prior owner. Mechanism at `b75258d`: `pool_claim` never calls `read_owner` — it constructs its own\r\n  `PoolOwner` and `fs::write`s unconditionally. The displaced lane's only channel is its next build's\r\n  refusal, which reports a STATE (\"this pool belongs to B\"), never a transition, and arrives pull-only\r\n  and arbitrarily late while interleaved-artifact harm is already underway. Labelled holes: measured\r\n  against the origin/main xtask binary (lane-tip carry is a source read, not a measurement);\r\n  pool-sweep-as-channel not exercised; single-process holder pid in all arms.\r\n- **Bootstrap property, not a defect (hertz, measured 2026-08-03 while claiming pools for the lanes\r\n  3-4 rebases):** a lane DELIVERING claim-identity cannot claim its own pool WITH that identity until\r\n  it lands — the prebuilt origin/main `xtask.exe` writes old-shaped stamps (owner_tree, lane_label,\r\n  holder pid+stamp; no lane_branch, no lane_base). Enforcer turnover surfacing at CLAIM time rather\r\n  than build time: coverage grows only as trees turn over. Recorded because it reads as a bug the\r\n  first time someone meets it in the field. Related lane-craft fact from the same queue: a rebase\r\n  changes SHAS necessarily but hunk OFFSETS only incidentally — todlando's main.rs hunks stayed at\r\n  @20/@53/@70 across the f2e4516→2f427b2 rebase; treat pre-rebase overlap measurements as stale by\r\n  construction and re-measure, but expect the geometry to usually hold.\r\n- **Bootstrap property FIELD INSTANCE, main checkout (todlando 2026-08-04, IR-12 rig):** the\r\n  prebuilt `target/debug/xtask.exe` in the MAIN checkout pool was stale against main's own source\r\n  at `11169c1` — it printed `(holder pid …, born …)` and wrote a FLAT identity-less claim\r\n  (owner_tree/lane_label/holder_pid/holder_started_at/written_by) where main's source\r\n  (main.rs:2282) prints `(branch …, base …; advisory holder pid …)` and writes the nested lane.\r\n  A lane claimed with a stale tool records NO git identity and demotes its own adjudication back\r\n  to the refused bare-pid predicate. DETECTION that worked and is the reusable part: read the\r\n  claim line the tool PRINTS against the source just read — a mismatch names the stale enforcer\r\n  before it writes. REMEDY at claim time: rebuild xtask FROM THE LANE'S WORKTREE before\r\n  `pool-claim` (which the protocol's claim-from-your-own-worktree rule already implies; this\r\n  instance is why it is load-bearing and not ceremony).\r\n- **RULING (doyle, 2026-08-04) — the claim path must run the same guard the build path runs, and a\r\n  takeover becomes an event.** The documented design already says a finished lane is \"taken over\r\n  loudly, not refused\"; a silent unconditional overwrite violates the spelling the protocol shipped\r\n  under. Remedy, both halves, one small lane: (ii) `pool-claim` reads the prior owner before writing —\r\n  prior lane LIVE (ancestry + stamp arm, never bare pid) ⇒ refuse exactly as build.rs would; prior\r\n  lane finished ⇒ proceed AND announce the displacement, naming the displaced lane in the success\r\n  line; plus (i) a `displaced` field (prior owner + takeover stamp) rides the new claim, so the fact\r\n  survives in the artifact the late-reading claimant already reads. The identity-less bare claim\r\n  (majority field shape, above) must be handled explicitly by the same change: a bare claim carries no\r\n  lane to adjudicate, so takeover of a bare claim always proceeds-and-announces, and the announcement\r\n  names the claim as identity-less — never silently, never refused. Ripe: next CI/infra batch, same\r\n  lane as or beside the IR-26 remedy. Size: small.\r\n\r\n### IR-27 — A junction-pooled rig is TWO objects and teardown only ever removes one\r\n- **Status:** open, found in the wild 2026-08-04 · **Origin:** hertz's 44-tree worktree sweep\r\n  (IR-26 follow-on 3) · **Cross-ref:** [[IR-14]] (unclaimed pools), [[worktree-target-junction]]\r\n…\n\n…\n  at the end. · **Size:** a between-run census step plus a scoped reap in the harness.","startLine":178,"lineNumbers":[178,null,763,764,null,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,1236,1237,1238,1239,1240,1241,1242,1243,1244,1245,1246,1247,1248,1249,1250,1251,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1289,1290,1291,1292,1293,1294,1295,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,1333,1334,1335,1336,1337,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1357,1358,1359,1360,1361,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1395,1396,1397,1398,1399,1400,1401,1402,1403,1404,1405,1406,1407,1408,1409,1410,1411,1412,1413,1414,1415,1416,1417,1418,1419,1420,1421,1422,1423,1424,1425,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507,1508,1509,1510,1511,1512,1513,1514,1515,1516,1517,1518,1519,1520,1521,1522,1523,1524,1525,1526,1527,1528,1529,1530,1531,1532,1533,1534,1535,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1614,1615,1616,1617,1618,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1675,1676,1677,1678,1679,1680,1681,1682,1683,1684,1685,1686,1687,1688,1689,1690,1691,1692,1693,1694,1695,1696,1697,1698,1699,null,1730,null,5781]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"middle","truncatedBy":"middle","totalLines":663,"totalBytes":55422,"outputLines":488,"outputBytes":40867,"maxBytes":40960,"headRange":{"start":1,"end":264},"tailRange":{"start":441,"end":663},"elidedLines":176,"elidedBytes":14577,"artifactId":"23","nextOffset":1700}}},"isError":false,"timestamp":1789094605762}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_qCHZWuCSnXmNXInAnO7jj8Y7|fc_074aee81620ae383016aa36ad5633487d19ca62b721271a4d7","toolName":"read","startedAt":"2026-09-11T02:43:35.784Z","args":{"path":"docs/INFRA-REGISTER.md:1300-1482:raw"},"intent":"Recovering omitted entry bodies"},"id":"16d394e5","parentId":"cb8eb73e","timestamp":"2026-09-11T02:43:35.784Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_5F31RMWMHEd204ERtbbX85Y0|fc_074aee81620ae383016aa36ad5634087d1aec4db9d532d2624","toolName":"grep","startedAt":"2026-09-11T02:43:35.784Z","args":{"path":"docs/INFRA-REGISTER.md:2650-2820"},"intent":"Checking exact final ownership boundary"},"id":"d5eb08f6","parentId":"16d394e5","timestamp":"2026-09-11T02:43:35.784Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_P6kZ3Ot7rbM6Sqbv29sLYrQ8|fc_074aee81620ae383016aa36ad5634487d1967b9395ef34eee9","toolName":"grep","startedAt":"2026-09-11T02:43:35.784Z","args":{"path":".github;crates/xtask/src;crates/spt-poolguard/src;traceable-reqs.toml"},"intent":"Locating uncertain closure mechanisms"},"id":"f03cb446","parentId":"d5eb08f6","timestamp":"2026-09-11T02:43:35.784Z"}
{"type":"message","id":"90838790","parentId":"f03cb446","timestamp":"2026-09-11T02:43:35.784Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_qCHZWuCSnXmNXInAnO7jj8Y7|fc_074aee81620ae383016aa36ad5633487d19ca62b721271a4d7","name":"read","arguments":{"i":"Recovering omitted entry bodies","path":"docs/INFRA-REGISTER.md:1300-1482:raw"},"intent":"Recovering omitted entry bodies"},{"type":"toolCall","id":"call_5F31RMWMHEd204ERtbbX85Y0|fc_074aee81620ae383016aa36ad5634087d1aec4db9d532d2624","name":"grep","arguments":{"i":"Checking exact final ownership boundary","pattern":"^### IR-|^\\- \\*\\*Status","path":"docs/INFRA-REGISTER.md:2650-2820","case":true,"gitignore":true,"skip":0},"intent":"Checking exact final ownership boundary"},{"type":"toolCall","id":"call_P6kZ3Ot7rbM6Sqbv29sLYrQ8|fc_074aee81620ae383016aa36ad5634487d1967b9395ef34eee9","name":"grep","arguments":{"i":"Locating uncertain closure mechanisms","pattern":"REQ-CI-LINK-HEALTH-PROBE|REQ-CI-TOOLCHAIN-VERSION-PRINT|REQ-POOL-LANE-IDENTITY|FLOOR_START|FLOOR_END|FLOOR_DOCS|module_banner|enforce|v0\\.4\\.0|swarm.*pin|89a2200d","path":".github;crates/xtask/src;crates/spt-poolguard/src;traceable-reqs.toml","case":false,"gitignore":true,"skip":0},"intent":"Locating uncertain closure mechanisms"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":56259,"output":252,"cacheRead":25088,"cacheWrite":0,"totalTokens":81599,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094605818,"responseId":"resp_074aee81620ae383016aa36acbfa4887d18ea2533b381a9eb9","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_074aee81620ae383016aa36ad5633487d19ca62b721271a4d7","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering omitted entry bodies\",\"path\":\"docs/INFRA-REGISTER.md:1300-1482:raw\"}","call_id":"call_qCHZWuCSnXmNXInAnO7jj8Y7","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ad5634087d1aec4db9d532d2624","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking exact final ownership boundary\",\"pattern\":\"^### IR-|^\\\\- \\\\*\\\\*Status\",\"path\":\"docs/INFRA-REGISTER.md:2650-2820\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_5F31RMWMHEd204ERtbbX85Y0","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ad5634487d1967b9395ef34eee9","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating uncertain closure mechanisms\",\"pattern\":\"REQ-CI-LINK-HEALTH-PROBE|REQ-CI-TOOLCHAIN-VERSION-PRINT|REQ-POOL-LANE-IDENTITY|FLOOR_START|FLOOR_END|FLOOR_DOCS|module_banner|enforce|v0\\\\.4\\\\.0|swarm.*pin|89a2200d\",\"path\":\".github;crates/xtask/src;crates/spt-poolguard/src;traceable-reqs.toml\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_P6kZ3Ot7rbM6Sqbv29sLYrQ8","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":9964.092799999751,"ttft":9919.161299999803,"completedAt":1789094615783,"contextSnapshot":{"promptTokens":81347,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"message","id":"1783fe7e","parentId":"90838790","timestamp":"2026-09-11T02:43:35.792Z","message":{"role":"toolResult","toolCallId":"call_5F31RMWMHEd204ERtbbX85Y0|fc_074aee81620ae383016aa36ad5634087d1aec4db9d532d2624","toolName":"grep","content":[{"type":"text","text":" 2670|\n*2671|### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\n*2672|- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\n 2673|  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\n 2674|  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\n 2675|  smudges fresh checkouts CRLF, and the author's never-re-smudged tree stays LF — builder green,\n...\n 2691|\n*2692|### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\n*2693|- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\n 2694|  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\n 2695|  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\n 2696|  landed fact — the checker was wrong with the guard, which is exactly how the guard will be\n...\n 2725|\n*2726|### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\n*2727|- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\n 2728|  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\n 2729|  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\n 2730|  2026-08-21) — lane `fix/ir50-stderr-sink-census` @`1a2f6a2`+`2ac9543`\n...\n 2783|\n*2784|### IR-51 — engine-room e2e daemon runs NET-ENABLED on real interfaces; rig hermeticity is disk-deep only\n*2785|- **Status:** open — filed 2026-08-19 (todlando's x40 run-4 sink read, the first live read any\n 2786|  rig has had of the daemon sink; doyle ruled own-id rather than riding #199, at the finder's\n 2787|  own request) · **Origin:** unasked-for find inside the #199 instrument's first catch.\n 2788|- **What/why:** the rig's temp `SPT_HOME` buys DISK hermeticity ([[IR-45]]'s settlement — which\n...\n 2812|\n*2813|### IR-53 — failed-address expiry unit panics during the first 10m01s after Windows boot\n*2814|- **Status:** BUILT 2026-08-21 on `fix/ir53-cold-boot-instant` — LANDED in v0.59.0\n 2815|  (PORTER rider, pick `7b26f28d` on `assembly/porter-205`, main @`c62904e7`; register\n 2816|  sweep 2026-08-21 at release close) · **Origin:** todlando,\n 2817|  found and falsifiably measured mid-releases#204; this rider fixes the latent CI-pipeline"}],"details":{"scopePath":"docs/INFRA-REGISTER.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":10,"fileCount":1,"files":["docs/INFRA-REGISTER.md"],"fileMatches":[{"path":"docs/INFRA-REGISTER.md","count":10}],"truncated":false,"displayContent":" 2670│\n*2671│### IR-48 — the nextest.toml parity cell tolerates CRLF only by parser accident; a newline-sensitive arm added later reds fresh Windows checkouts alone\n*2672│- **Status:** open — filed 2026-08-19 (doyle route, hertz verdict: REGISTER as preventive\n 2673│  hardening, not current defect) · **Origin:** sibling sweep after the W3 gate CRLF finding —\n 2674│  parent mechanism: `include_str!` embeds working-tree bytes verbatim, `core.autocrlf=true`\n 2675│  smudges fresh checkouts CRLF, and the author's never-re-smudged tree stays LF — builder green,\n     │...\n 2691│\n*2692│### IR-49 — poolguard's landed-lane predicate is ancestry-only, so a cherry-picked member lane can never read Settled and its pool can never be taken over\n*2693│- **Status:** open — filed 2026-08-19 (todlando measurement at the keystone-w1/fix-197 reap,\n 2694│  doyle ruling; doyle re-verified the predicate at source before filing) · **Origin:** todlando's\n 2695│  post-landing landed-check used the guard's own predicate and it contradicted the (correct)\n 2696│  landed fact — the checker was wrong with the guard, which is exactly how the guard will be\n     │...\n 2725│\n*2726│### IR-50 — e2e failure panels read the PRE-REDIRECT stderr capture; every daemon-side diagnostic lands in a sink the rig deletes unread\n*2727│- **Status:** CLOSED — BUILT 2026-08-19; adoption-completion lane\n 2728│  `docs/ir50-register-close` @`e02f565f` (hertz, doyle-gated 2026-08-20) LANDED in\n 2729│  v0.59.0 as a PORTER rider (pick `e702d4b7` tip, main @`c62904e7`; register sweep\n 2730│  2026-08-21) — lane `fix/ir50-stderr-sink-census` @`1a2f6a2`+`2ac9543`\n     │...\n 2783│\n*2784│### IR-51 — engine-room e2e daemon runs NET-ENABLED on real interfaces; rig hermeticity is disk-deep only\n*2785│- **Status:** open — filed 2026-08-19 (todlando's x40 run-4 sink read, the first live read any\n 2786│  rig has had of the daemon sink; doyle ruled own-id rather than riding #199, at the finder's\n 2787│  own request) · **Origin:** unasked-for find inside the #199 instrument's first catch.\n 2788│- **What/why:** the rig's temp `SPT_HOME` buys DISK hermeticity ([[IR-45]]'s settlement — which\n     │...\n 2812│\n*2813│### IR-53 — failed-address expiry unit panics during the first 10m01s after Windows boot\n*2814│- **Status:** BUILT 2026-08-21 on `fix/ir53-cold-boot-instant` — LANDED in v0.59.0\n 2815│  (PORTER rider, pick `7b26f28d` on `assembly/porter-205`, main @`c62904e7`; register\n 2816│  sweep 2026-08-21 at release close) · **Origin:** todlando,\n 2817│  found and falsifiably measured mid-releases#204; this rider fixes the latent CI-pipeline"},"isError":false,"timestamp":1789094615791}}
{"type":"message","id":"b6df8abd","parentId":"1783fe7e","timestamp":"2026-09-11T02:43:35.795Z","message":{"role":"toolResult","toolCallId":"call_qCHZWuCSnXmNXInAnO7jj8Y7|fc_074aee81620ae383016aa36ad5633487d19ca62b721271a4d7","toolName":"read","content":[{"type":"text","text":"  DEPENDENCY build from a `--bins` harness build.\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\n  against the 09:00 it carried before), so this is a real build and not the hardlink uplift this\n  entry warns about elsewhere; the harness exe stayed absent.\n- **Neither probe needs a baseline arm:** the probe test is unmodified and references nothing under\n  edit, so what it measures is cargo's behaviour, not anyone's change.\n- **Corroborated by this entry's own field data:** neither original member was a same-package\n  integration site — member 1 is a UNIT test, member 2 is CROSS-package. The class never had a\n  same-package integration member, and the CI-member section below already stated the governing rule\n  (`CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package) one\n  section before the remedy drew the opposite consequence from it.\n\nCommand: `git ls-files '*.rs' | xargs grep -hon 'sibling_bin(\"[a-z_-]*\"' | sed 's/.*sibling_bin(\"//;\ns/\"//' | sort | uniq -c`.\n\n⚠ An earlier report gave 48 sites and a 6/11/37 split. Take the table above: it counts only literal\ncall sites in tracked files and it ships its command. The 11 is the same 11 in both counts.\n\n**The LOCATION half of this class is already closed** by `crates/spt-term/tests/support/fixture_bin.rs`\n— a shared resolver rather than 29 copies. It does not close the BUILD half, and should not be\nmistaken for having done so.\n\n#### REMEDY SHAPE (not ruled)\n\nThe distinction that matters is location vs. build:\n\n1. **The 11 same-package sites are NOT hazard members and need no build fix.** Their build edge\n   already exists (see the two probes in POPULATION above); `env!(\"CARGO_BIN_EXE_<name>\")` for the\n   fixture itself would add nothing to it. Converting them is a **CLARITY** change, worth doing on\n   its own smaller merits — the path becomes the one cargo actually emitted rather than a string-join\n   of a directory anchor and `EXE_SUFFIX`, five copies of `sibling_bin` stop existing (29 → 24), and\n   it completes a migration already paid for: `crates/spt/tests/fixtures/translate_proof_fixture.rs:7-12`\n   records that the fixture was re-homed into `spt` precisely to obtain\n   `CARGO_BIN_EXE_translate_proof_fixture`, and then all 7 call sites resolved by path anyway. **It is\n   not a build fix and must not be filed as one.**\n2. **The 33 cross-package sites cannot**, by cargo's design. Their options are an asserted build in\n   the test's own setup, a `dev-dependencies` artifact dependency, or an explicit documented\n   prebuild — the ci.yml:106 shape, made a rule instead of a local fix.\n3. **Standardising on one wider invocation is NOT a remedy.** It changes which pools happen to work;\n   it does not create the dependency edge, and the two original members had opposite polarity under\n   exactly that theory.\n4. Collapsing the 29 resolver copies is worth doing on the `fixture_bin.rs` model, but on its own it\n   makes the class HARDER to see — one shared resolver still anchored on `CARGO_BIN_EXE_spt` hides\n   the 33 genuinely unexpressed dependencies among its 44 call sites behind one function.\n\n#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\n- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\n  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\n  here so the next clean rig does not re-diagnose them as code reds.\n- The first two versions of this entry framed the class as \"the rig's command does not build what\n  the test needs\" and proposed standardising on a wider invocation. **Both are superseded by the\n  measured mechanism above** — the dependency is not under-expressed, it is INEXPRESSIBLE in the\n  form these call sites use, so no choice of invocation creates it. Kept only as the two FIELD\n  MEASUREMENTS that produced the class, which remain true:\n- **MEMBER 1 — MEASURED:** `cli::tests::adapter_translate_proof_gates_on_commit` failed on the\n  first `cargo test -p spt --bins` run. Its fixture binary `translate_proof_fixture` (a\n  `tests/`-homed `[[bin]]`) was ABSENT from the pool — `ls` on the path returned No such file.\n  Building it explicitly and re-running the IDENTICAL command PASSED, after which the full `--bins`\n  suite passed 584/585 with only the releases#117 probe red (that one RED by design). So the\n  discriminator is the fixture's presence, not the tree: same command, same sha, red then green\n  across one `cargo build` of the fixture.\n- **MEMBER 2 — MEASURED:** `cargo test -p spt` does not build `mock-adapter --bin mock-session`, so\n  `attach_wedge_e2e` panics `\"the dummy-harness program must be built\"`. Note the polarity is\n  INVERTED against member 1 — there the narrower `--bins` was the defective invocation and\n  `cargo test -p spt` the correct one; here `cargo test -p spt` is itself insufficient. So the\n  class is NOT \"use the wider command\"; it is that the dependency is not expressed to the build at\n  all, and which invocation happens to work is incidental.\n- **What/why (still true):** on a WARM pool the helper is already there from some earlier run and\n  the test passes, so the defect is invisible exactly where most people work and fires only on a\n  clean pool — i.e. on a GATE RIG, which is the one place a false red costs the most.\n- **The sweep this entry once called its first step HAS BEEN RUN** (todlando 2026-08-03) and its\n  result is the POPULATION section above. It is no longer outstanding.\n\n- **Why it is register debt and not a lane bug:** nothing in the product is wrong. The gap is\n  between what a test needs built and what the rig's command builds, and the fix belongs to the\n  tests' declarations, not to whoever is running a gate that day. Sibling rule:\n  [[gate-clean-target-not-incremental]].\n- **Built evidence:** golden now names every cross-package fixture prebuild\n  (`mock-session`, `mock-shell`, `capture-player`, `console-mode-probe`,\n  `service_fixture`) explicitly; `xtask binedge-check` reports zero missing\n  edges. All 29 local `sibling_bin` resolvers collapsed into\n  `tests/common/mod.rs`; the shared precondition names the missing fixture and\n  its package-correct build command before any product timeout.\n- **Ripe when:** the next gate-rig or CI-touching wave. Cheap, and it pays for itself the first time\n  it stops someone chasing a phantom red on a clean pool.\n- **Size:** remedy (1) is small AND optional — it buys clarity and subtraction, never a build edge;\n  medium for (2), which is a design call before it is an edit and is the only remedy that closes the\n  class.\n\n### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\n- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\n  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\n- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\n  the daemon-stop refusal fired on the running session's own identity env. It named\n  `$OWL_SESSION_ID`; clearing that made it name `$SPT_ENDPOINT_ID`. With `OWL_SESSION_ID`,\n  `SPT_ENDPOINT_ID`, `SPT_AGENT_ID` and `SPT_SESSION_ID` all cleared: exit 0, 1 passed.\n- **The finding is the DIAGNOSTIC SHAPE, not the env hygiene.** Naming one variable at a time means\n  a correct partial fix produces an identical-looking failure, so the natural reading of \"I cleared\n  it and it still fails\" is that the clearing did not work — when in fact each step was right and\n  the message had simply moved on to the next name. A refusal that can only ever name one member of\n  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\n  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\n- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\n  vars, so this fires for every builder on a perched session and for nobody running from a bare\n  shell — which is precisely the split between how builders work and how CI runs.\n- **Candidate remedies (not ruled):** have the refusal name EVERY identity var it found set, in one\n  line, rather than the first; and/or have the affected tests clear the identity set in their own\n  setup so a perched session is not a special environment. The first is the one that pays off\n  outside this test.\n- **Ripe when:** next CI/test-hygiene wave. **Size:** small.\n\n### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\n- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\n  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\n  parallel inside one binary each holds the file the other wants: `os error 32`, \"used by another\n  process\". **Signature: WHICH of the two fails alternates between runs.** Under\n  `--test-threads=1`: 2 passed, exit 0 — and the wall clock drops from 182s to 14s.\n- **What/why:** two defects in one, and they should not be conflated. (1) The tests are not\n  isolated from each other. (2) The staging path is the MACHINE-GLOBAL spt home rather than the\n  test's own temp home — on a box that is also a CI runner, so the blast radius is not confined to\n  the suite. (2) is the one worth fixing; (1) is a symptom of it.\n- **Note on why this is not already caught:** the standing rule is that integration tests run\n  through nextest, which gives each test its own process and hides the collision entirely. So this\n  is latent on the sanctioned path and only bites the bare `cargo test` path — the rule is working\n  and masking a real defect at the same time, which is why the entry exists rather than a shrug.\n- **Candidate remedy (not ruled):** stage the fixture into the test's own temp home. Sweep for\n  siblings first — any other test writing under `perch::spt_home()` rather than a temp home shares\n  the shape, and nobody has counted them.\n- **Built evidence:** adapter source, manifest registration, and psyche fixture\n  staging now use the rig TempDir. The two process-global resolver users are\n  explicitly serialized, and the bare `cargo test` path passes both cells with\n  `--test-threads=2` in 13.82s after the declared fixture prebuild.\n- **Ripe when:** next test-hygiene wave; the 182s -> 14s figure makes it pay for itself on the\n  bare path. **Size:** small per test, unknown until the sweep.\n\n### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\n- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\n  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\n  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\n  the daemon holds no other handle to reach them` — which also ANSWERS the cost-of-loss question\n  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\n  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\n  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\n  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\n  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\n  (`terminate_job_return_discriminates_broken_handle_from_ordinary_states`, cfg(windows), with a\n  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\n  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\n  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\n  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\n  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\n  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\n  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\n  NOT folded into that lane (doyle ruling, same day) and filed instead.\n- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\n  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\n  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\n  where it lives — the module already decided that these returns are worth reading.\n- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\n  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\n  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\n  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\n  termination cost here\" — and that answer has not been written down by anyone. Folding it in would\n  have meant settling that question in passing, inside a commit about the supervisor, which is how a\n  second ruling gets smuggled into a lane scoped to one.\n- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\n  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\n  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\n  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\n  its direct process in the same breath, which is what makes the middle hop dead by construction\n  there. **That is the first thing to check, and it is not assumed.**\n- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\n  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\n  cost-of-loss question is answered for this subject.\n\n### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\n- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\n  assembled.\n\n[Showing lines 1300-1482 of 5782. Use :1483 to continue]"}],"details":{"truncation":{"content":"  DEPENDENCY build from a `--bins` harness build.\r\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\r\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\r\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\r\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\r\n  against the 09:00 it carried before), so this is a real build and not the hardlink uplift this\r\n  entry warns about elsewhere; the harness exe stayed absent.\r\n- **Neither probe needs a baseline arm:** the probe test is unmodified and references nothing under\r\n  edit, so what it measures is cargo's behaviour, not anyone's change.\r\n- **Corroborated by this entry's own field data:** neither original member was a same-package\r\n  integration site — member 1 is a UNIT test, member 2 is CROSS-package. The class never had a\r\n  same-package integration member, and the CI-member section below already stated the governing rule\r\n  (`CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package) one\r\n  section before the remedy drew the opposite consequence from it.\r\n\r\nCommand: `git ls-files '*.rs' | xargs grep -hon 'sibling_bin(\"[a-z_-]*\"' | sed 's/.*sibling_bin(\"//;\r\ns/\"//' | sort | uniq -c`.\r\n\r\n⚠ An earlier report gave 48 sites and a 6/11/37 split. Take the table above: it counts only literal\r\ncall sites in tracked files and it ships its command. The 11 is the same 11 in both counts.\r\n\r\n**The LOCATION half of this class is already closed** by `crates/spt-term/tests/support/fixture_bin.rs`\r\n— a shared resolver rather than 29 copies. It does not close the BUILD half, and should not be\r\nmistaken for having done so.\r\n\r\n#### REMEDY SHAPE (not ruled)\r\n\r\nThe distinction that matters is location vs. build:\r\n\r\n1. **The 11 same-package sites are NOT hazard members and need no build fix.** Their build edge\r\n   already exists (see the two probes in POPULATION above); `env!(\"CARGO_BIN_EXE_<name>\")` for the\r\n   fixture itself would add nothing to it. Converting them is a **CLARITY** change, worth doing on\r\n   its own smaller merits — the path becomes the one cargo actually emitted rather than a string-join\r\n   of a directory anchor and `EXE_SUFFIX`, five copies of `sibling_bin` stop existing (29 → 24), and\r\n   it completes a migration already paid for: `crates/spt/tests/fixtures/translate_proof_fixture.rs:7-12`\r\n   records that the fixture was re-homed into `spt` precisely to obtain\r\n   `CARGO_BIN_EXE_translate_proof_fixture`, and then all 7 call sites resolved by path anyway. **It is\r\n   not a build fix and must not be filed as one.**\r\n2. **The 33 cross-package sites cannot**, by cargo's design. Their options are an asserted build in\r\n   the test's own setup, a `dev-dependencies` artifact dependency, or an explicit documented\r\n   prebuild — the ci.yml:106 shape, made a rule instead of a local fix.\r\n3. **Standardising on one wider invocation is NOT a remedy.** It changes which pools happen to work;\r\n   it does not create the dependency edge, and the two original members had opposite polarity under\r\n   exactly that theory.\r\n4. Collapsing the 29 resolver copies is worth doing on the `fixture_bin.rs` model, but on its own it\r\n   makes the class HARDER to see — one shared resolver still anchored on `CARGO_BIN_EXE_spt` hides\r\n   the 33 genuinely unexpressed dependencies among its 44 call sites behind one function.\r\n\r\n#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\r\n- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\r\n  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\r\n  here so the next clean rig does not re-diagnose them as code reds.\r\n- The first two versions of this entry framed the class as \"the rig's command does not build what\r\n  the test needs\" and proposed standardising on a wider invocation. **Both are superseded by the\r\n  measured mechanism above** — the dependency is not under-expressed, it is INEXPRESSIBLE in the\r\n  form these call sites use, so no choice of invocation creates it. Kept only as the two FIELD\r\n  MEASUREMENTS that produced the class, which remain true:\r\n- **MEMBER 1 — MEASURED:** `cli::tests::adapter_translate_proof_gates_on_commit` failed on the\r\n  first `cargo test -p spt --bins` run. Its fixture binary `translate_proof_fixture` (a\r\n  `tests/`-homed `[[bin]]`) was ABSENT from the pool — `ls` on the path returned No such file.\r\n  Building it explicitly and re-running the IDENTICAL command PASSED, after which the full `--bins`\r\n  suite passed 584/585 with only the releases#117 probe red (that one RED by design). So the\r\n  discriminator is the fixture's presence, not the tree: same command, same sha, red then green\r\n  across one `cargo build` of the fixture.\r\n- **MEMBER 2 — MEASURED:** `cargo test -p spt` does not build `mock-adapter --bin mock-session`, so\r\n  `attach_wedge_e2e` panics `\"the dummy-harness program must be built\"`. Note the polarity is\r\n  INVERTED against member 1 — there the narrower `--bins` was the defective invocation and\r\n  `cargo test -p spt` the correct one; here `cargo test -p spt` is itself insufficient. So the\r\n  class is NOT \"use the wider command\"; it is that the dependency is not expressed to the build at\r\n  all, and which invocation happens to work is incidental.\r\n- **What/why (still true):** on a WARM pool the helper is already there from some earlier run and\r\n  the test passes, so the defect is invisible exactly where most people work and fires only on a\r\n  clean pool — i.e. on a GATE RIG, which is the one place a false red costs the most.\r\n- **The sweep this entry once called its first step HAS BEEN RUN** (todlando 2026-08-03) and its\r\n  result is the POPULATION section above. It is no longer outstanding.\r\n\r\n- **Why it is register debt and not a lane bug:** nothing in the product is wrong. The gap is\r\n  between what a test needs built and what the rig's command builds, and the fix belongs to the\r\n  tests' declarations, not to whoever is running a gate that day. Sibling rule:\r\n  [[gate-clean-target-not-incremental]].\r\n- **Built evidence:** golden now names every cross-package fixture prebuild\r\n  (`mock-session`, `mock-shell`, `capture-player`, `console-mode-probe`,\r\n  `service_fixture`) explicitly; `xtask binedge-check` reports zero missing\r\n  edges. All 29 local `sibling_bin` resolvers collapsed into\r\n  `tests/common/mod.rs`; the shared precondition names the missing fixture and\r\n  its package-correct build command before any product timeout.\r\n- **Ripe when:** the next gate-rig or CI-touching wave. Cheap, and it pays for itself the first time\r\n  it stops someone chasing a phantom red on a clean pool.\r\n- **Size:** remedy (1) is small AND optional — it buys clarity and subtraction, never a build edge;\r\n  medium for (2), which is a design call before it is an edit and is the only remedy that closes the\r\n  class.\r\n\r\n### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\r\n- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\r\n  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\r\n- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\r\n  the daemon-stop refusal fired on the running session's own identity env. It named\r\n  `$OWL_SESSION_ID`; clearing that made it name `$SPT_ENDPOINT_ID`. With `OWL_SESSION_ID`,\r\n  `SPT_ENDPOINT_ID`, `SPT_AGENT_ID` and `SPT_SESSION_ID` all cleared: exit 0, 1 passed.\r\n- **The finding is the DIAGNOSTIC SHAPE, not the env hygiene.** Naming one variable at a time means\r\n  a correct partial fix produces an identical-looking failure, so the natural reading of \"I cleared\r\n  it and it still fails\" is that the clearing did not work — when in fact each step was right and\r\n  the message had simply moved on to the next name. A refusal that can only ever name one member of\r\n  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\r\n  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\r\n- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\r\n  vars, so this fires for every builder on a perched session and for nobody running from a bare\r\n  shell — which is precisely the split between how builders work and how CI runs.\r\n- **Candidate remedies (not ruled):** have the refusal name EVERY identity var it found set, in one\r\n  line, rather than the first; and/or have the affected tests clear the identity set in their own\r\n  setup so a perched session is not a special environment. The first is the one that pays off\r\n  outside this test.\r\n- **Ripe when:** next CI/test-hygiene wave. **Size:** small.\r\n\r\n### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\r\n- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\r\n  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\r\n  parallel inside one binary each holds the file the other wants: `os error 32`, \"used by another\r\n  process\". **Signature: WHICH of the two fails alternates between runs.** Under\r\n  `--test-threads=1`: 2 passed, exit 0 — and the wall clock drops from 182s to 14s.\r\n- **What/why:** two defects in one, and they should not be conflated. (1) The tests are not\r\n  isolated from each other. (2) The staging path is the MACHINE-GLOBAL spt home rather than the\r\n  test's own temp home — on a box that is also a CI runner, so the blast radius is not confined to\r\n  the suite. (2) is the one worth fixing; (1) is a symptom of it.\r\n- **Note on why this is not already caught:** the standing rule is that integration tests run\r\n  through nextest, which gives each test its own process and hides the collision entirely. So this\r\n  is latent on the sanctioned path and only bites the bare `cargo test` path — the rule is working\r\n  and masking a real defect at the same time, which is why the entry exists rather than a shrug.\r\n- **Candidate remedy (not ruled):** stage the fixture into the test's own temp home. Sweep for\r\n  siblings first — any other test writing under `perch::spt_home()` rather than a temp home shares\r\n  the shape, and nobody has counted them.\r\n- **Built evidence:** adapter source, manifest registration, and psyche fixture\r\n  staging now use the rig TempDir. The two process-global resolver users are\r\n  explicitly serialized, and the bare `cargo test` path passes both cells with\r\n  `--test-threads=2` in 13.82s after the declared fixture prebuild.\r\n- **Ripe when:** next test-hygiene wave; the 182s -> 14s figure makes it pay for itself on the\r\n  bare path. **Size:** small per test, unknown until the sweep.\r\n\r\n### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\r\n- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\r\n  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\r\n  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\r\n  the daemon holds no other handle to reach them` — which also ANSWERS the cost-of-loss question\r\n  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\r\n  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\r\n  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\r\n  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\r\n  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\r\n  (`terminate_job_return_discriminates_broken_handle_from_ordinary_states`, cfg(windows), with a\r\n  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\r\n  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\r\n  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\r\n  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\r\n  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\r\n  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\r\n  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\r\n  NOT folded into that lane (doyle ruling, same day) and filed instead.\r\n- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\r\n  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\r\n  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\r\n  where it lives — the module already decided that these returns are worth reading.\r\n- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\r\n  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\r\n  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\r\n  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\r\n  termination cost here\" — and that answer has not been written down by anyone. Folding it in would\r\n  have meant settling that question in passing, inside a commit about the supervisor, which is how a\r\n  second ruling gets smuggled into a lane scoped to one.\r\n- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\r\n  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\r\n  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\r\n  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\r\n  its direct process in the same breath, which is what makes the middle hop dead by construction\r\n  there. **That is the first thing to check, and it is not assumed.**\r\n- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\r\n  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\r\n  cost-of-loss question is answered for this subject.\r\n\r\n### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\r\n- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\r\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\r\n  assembled.\r","truncated":true,"truncatedBy":"lines","totalLines":4483,"totalBytes":15138,"outputLines":183,"outputBytes":15138,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5782,"displayContent":{"text":"  DEPENDENCY build from a `--bins` harness build.\r\n- **Probe 2 (doyle, `.worktrees/gate-ec5f38a` pool, independent replication with a different fixture\r\n  and a different probe test):** deleted `gh_fixture`'s plain exe, its `deps/` plain exe AND its\r\n  hash-suffixed harness exe, confirmed all three absent, then built `--test json_emit --no-run`\r\n  (exit 0) — a test that never names `gh_fixture`. The plain pair returned at a FRESH mtime (09:13\r\n  against the 09:00 it carried before), so this is a real build and not the hardlink uplift this\r\n  entry warns about elsewhere; the harness exe stayed absent.\r\n- **Neither probe needs a baseline arm:** the probe test is unmodified and references nothing under\r\n  edit, so what it measures is cargo's behaviour, not anyone's change.\r\n- **Corroborated by this entry's own field data:** neither original member was a same-package\r\n  integration site — member 1 is a UNIT test, member 2 is CROSS-package. The class never had a\r\n  same-package integration member, and the CI-member section below already stated the governing rule\r\n  (`CARGO_BIN_EXE_*` is set only for integration tests and benches of the declaring package) one\r\n  section before the remedy drew the opposite consequence from it.\r\n\r\nCommand: `git ls-files '*.rs' | xargs grep -hon 'sibling_bin(\"[a-z_-]*\"' | sed 's/.*sibling_bin(\"//;\r\ns/\"//' | sort | uniq -c`.\r\n\r\n⚠ An earlier report gave 48 sites and a 6/11/37 split. Take the table above: it counts only literal\r\ncall sites in tracked files and it ships its command. The 11 is the same 11 in both counts.\r\n\r\n**The LOCATION half of this class is already closed** by `crates/spt-term/tests/support/fixture_bin.rs`\r\n— a shared resolver rather than 29 copies. It does not close the BUILD half, and should not be\r\nmistaken for having done so.\r\n\r\n#### REMEDY SHAPE (not ruled)\r\n\r\nThe distinction that matters is location vs. build:\r\n\r\n1. **The 11 same-package sites are NOT hazard members and need no build fix.** Their build edge\r\n   already exists (see the two probes in POPULATION above); `env!(\"CARGO_BIN_EXE_<name>\")` for the\r\n   fixture itself would add nothing to it. Converting them is a **CLARITY** change, worth doing on\r\n   its own smaller merits — the path becomes the one cargo actually emitted rather than a string-join\r\n   of a directory anchor and `EXE_SUFFIX`, five copies of `sibling_bin` stop existing (29 → 24), and\r\n   it completes a migration already paid for: `crates/spt/tests/fixtures/translate_proof_fixture.rs:7-12`\r\n   records that the fixture was re-homed into `spt` precisely to obtain\r\n   `CARGO_BIN_EXE_translate_proof_fixture`, and then all 7 call sites resolved by path anyway. **It is\r\n   not a build fix and must not be filed as one.**\r\n2. **The 33 cross-package sites cannot**, by cargo's design. Their options are an asserted build in\r\n   the test's own setup, a `dev-dependencies` artifact dependency, or an explicit documented\r\n   prebuild — the ci.yml:106 shape, made a rule instead of a local fix.\r\n3. **Standardising on one wider invocation is NOT a remedy.** It changes which pools happen to work;\r\n   it does not create the dependency edge, and the two original members had opposite polarity under\r\n   exactly that theory.\r\n4. Collapsing the 29 resolver copies is worth doing on the `fixture_bin.rs` model, but on its own it\r\n   makes the class HARDER to see — one shared resolver still anchored on `CARGO_BIN_EXE_spt` hides\r\n   the 33 genuinely unexpressed dependencies among its 44 call sites behind one function.\r\n\r\n#### SUPERSEDED FRAMING, KEPT SO IT IS NOT RE-DERIVED\r\n- **Status of the original filing:** open · **Origin:** todlando 2026-08-03, both members hit on the\r\n  LOCKSMITH t1 lane against fresh throwaway pools; each discharged in-lane as a rig artifact, filed\r\n  here so the next clean rig does not re-diagnose them as code reds.\r\n- The first two versions of this entry framed the class as \"the rig's command does not build what\r\n  the test needs\" and proposed standardising on a wider invocation. **Both are superseded by the\r\n  measured mechanism above** — the dependency is not under-expressed, it is INEXPRESSIBLE in the\r\n  form these call sites use, so no choice of invocation creates it. Kept only as the two FIELD\r\n  MEASUREMENTS that produced the class, which remain true:\r\n- **MEMBER 1 — MEASURED:** `cli::tests::adapter_translate_proof_gates_on_commit` failed on the\r\n  first `cargo test -p spt --bins` run. Its fixture binary `translate_proof_fixture` (a\r\n  `tests/`-homed `[[bin]]`) was ABSENT from the pool — `ls` on the path returned No such file.\r\n  Building it explicitly and re-running the IDENTICAL command PASSED, after which the full `--bins`\r\n  suite passed 584/585 with only the releases#117 probe red (that one RED by design). So the\r\n  discriminator is the fixture's presence, not the tree: same command, same sha, red then green\r\n  across one `cargo build` of the fixture.\r\n- **MEMBER 2 — MEASURED:** `cargo test -p spt` does not build `mock-adapter --bin mock-session`, so\r\n  `attach_wedge_e2e` panics `\"the dummy-harness program must be built\"`. Note the polarity is\r\n  INVERTED against member 1 — there the narrower `--bins` was the defective invocation and\r\n  `cargo test -p spt` the correct one; here `cargo test -p spt` is itself insufficient. So the\r\n  class is NOT \"use the wider command\"; it is that the dependency is not expressed to the build at\r\n  all, and which invocation happens to work is incidental.\r\n- **What/why (still true):** on a WARM pool the helper is already there from some earlier run and\r\n  the test passes, so the defect is invisible exactly where most people work and fires only on a\r\n  clean pool — i.e. on a GATE RIG, which is the one place a false red costs the most.\r\n- **The sweep this entry once called its first step HAS BEEN RUN** (todlando 2026-08-03) and its\r\n  result is the POPULATION section above. It is no longer outstanding.\r\n\r\n- **Why it is register debt and not a lane bug:** nothing in the product is wrong. The gap is\r\n  between what a test needs built and what the rig's command builds, and the fix belongs to the\r\n  tests' declarations, not to whoever is running a gate that day. Sibling rule:\r\n  [[gate-clean-target-not-incremental]].\r\n- **Built evidence:** golden now names every cross-package fixture prebuild\r\n  (`mock-session`, `mock-shell`, `capture-player`, `console-mode-probe`,\r\n  `service_fixture`) explicitly; `xtask binedge-check` reports zero missing\r\n  edges. All 29 local `sibling_bin` resolvers collapsed into\r\n  `tests/common/mod.rs`; the shared precondition names the missing fixture and\r\n  its package-correct build command before any product timeout.\r\n- **Ripe when:** the next gate-rig or CI-touching wave. Cheap, and it pays for itself the first time\r\n  it stops someone chasing a phantom red on a clean pool.\r\n- **Size:** remedy (1) is small AND optional — it buys clarity and subtraction, never a build edge;\r\n  medium for (2), which is a design call before it is an edit and is the only remedy that closes the\r\n  class.\r\n\r\n### IR-22 — An inherited identity env var fails a test, and the diagnostic names them ONE AT A TIME so a correct fix reads as no fix\r\n- **Status:** open · **Origin:** todlando 2026-08-03, chasing what looked like an `attach_wedge_e2e`\r\n  code red on the LOCKSMITH t1 lane; root-caused to the runner's own process environment.\r\n- **MEASURED:** `attach_wedge_e2e` failed for an INHERITED PROCESS-GLOBAL and nothing in the tree:\r\n  the daemon-stop refusal fired on the running session's own identity env. It named\r\n  `$OWL_SESSION_ID`; clearing that made it name `$SPT_ENDPOINT_ID`. With `OWL_SESSION_ID`,\r\n  `SPT_ENDPOINT_ID`, `SPT_AGENT_ID` and `SPT_SESSION_ID` all cleared: exit 0, 1 passed.\r\n- **The finding is the DIAGNOSTIC SHAPE, not the env hygiene.** Naming one variable at a time means\r\n  a correct partial fix produces an identical-looking failure, so the natural reading of \"I cleared\r\n  it and it still fails\" is that the clearing did not work — when in fact each step was right and\r\n  the message had simply moved on to the next name. A refusal that can only ever name one member of\r\n  a set it is checking teaches the person debugging it the wrong lesson. Compare the same class in\r\n  [[IR-15]]/[[IR-18]] terms: the instrument is competent and the report is not.\r\n- **Why it matters beyond one test:** any agent running suites from a live spt session carries these\r\n  vars, so this fires for every builder on a perched session and for nobody running from a bare\r\n  shell — which is precisely the split between how builders work and how CI runs.\r\n- **Candidate remedies (not ruled):** have the refusal name EVERY identity var it found set, in one\r\n  line, rather than the first; and/or have the affected tests clear the identity set in their own\r\n  setup so a perched session is not a special environment. The first is the one that pays off\r\n  outside this test.\r\n- **Ripe when:** next CI/test-hygiene wave. **Size:** small.\r\n\r\n### IR-23 — `endpoint_teardown_authority_e2e`'s two tests collide with EACH OTHER through the machine-global spt home\r\n- **Status:** BUILT 2026-08-18 on KEYSTONE #182 hygiene lane. · **Origin:** todlando 2026-08-03, LOCKSMITH t1 lane.\r\n- **MEASURED:** both tests copy a psyche binary fixture into `perch::spt_home()/srcs/dummyharness/`\r\n  (`crates/spt/tests/endpoint_teardown_authority_e2e.rs:399`), which is process-global, so run in\r\n  parallel inside one binary each holds the file the other wants: `os error 32`, \"used by another\r\n  process\". **Signature: WHICH of the two fails alternates between runs.** Under\r\n  `--test-threads=1`: 2 passed, exit 0 — and the wall clock drops from 182s to 14s.\r\n- **What/why:** two defects in one, and they should not be conflated. (1) The tests are not\r\n  isolated from each other. (2) The staging path is the MACHINE-GLOBAL spt home rather than the\r\n  test's own temp home — on a box that is also a CI runner, so the blast radius is not confined to\r\n  the suite. (2) is the one worth fixing; (1) is a symptom of it.\r\n- **Note on why this is not already caught:** the standing rule is that integration tests run\r\n  through nextest, which gives each test its own process and hides the collision entirely. So this\r\n  is latent on the sanctioned path and only bites the bare `cargo test` path — the rule is working\r\n  and masking a real defect at the same time, which is why the entry exists rather than a shrug.\r\n- **Candidate remedy (not ruled):** stage the fixture into the test's own temp home. Sweep for\r\n  siblings first — any other test writing under `perch::spt_home()` rather than a temp home shares\r\n  the shape, and nobody has counted them.\r\n- **Built evidence:** adapter source, manifest registration, and psyche fixture\r\n  staging now use the rig TempDir. The two process-global resolver users are\r\n  explicitly serialized, and the bare `cargo test` path passes both cells with\r\n  `--test-threads=2` in 13.82s after the declared fixture prebuild.\r\n- **Ripe when:** next test-hygiene wave; the 182s -> 14s figure makes it pay for itself on the\r\n  bare path. **Size:** small per test, unknown until the sweep.\r\n\r\n### IR-24 — `reap::terminate_job` discards `TerminateJobObject`'s return, alone among its own module's siblings\r\n- **Status:** BUILT — landed `3d12cf3` on main (2026-08-03), fulfilment verified against this\r\n  entry's own wanted list by doyle 2026-08-04, not merely mapped to the commit: the return is\r\n  audited and the loss NAMED (`REAP_JOB_TERMINATE_FAIL: brain subtree NOT reaped (<os error>); …\r\n  the daemon holds no other handle to reach them` — which also ANSWERS the cost-of-loss question\r\n  this entry said nobody had written down); the \"first thing to check\" was checked and the ruling\r\n  came out OPPOSITE to IR-16's site in one respect, documented as measured asymmetry in the doc\r\n  comment: `TerminateJobObject` has NO ordinary failing path (zero only for a broken handle) so a\r\n  zero is a real loss, while `TerminateProcess` fails `ERROR_ACCESS_DENIED` on the ordinary\r\n  already-exited path and is deliberately NOT checked — the premise is unit-PINNED both directions\r\n  (`terminate_job_return_discriminates_broken_handle_from_ordinary_states`, cfg(windows), with a\r\n  memberless-job false-positive arm). No `job != 0` re-check (second-weaker-rule prohibition\r\n  honored, same as IR-16). Golden evidence: rides `4b37512` (run 30873007187 attempt 5, 9/9\r\n  green; the premise unit observed PASS in-pool on the Windows leg, Linux leg green — the\r\n  cross-platform quiet-`ESRCH` concern stays with `ec5f38a`'s coverage as before). Path\r\n  correction to this entry's MEASURED line: the site is `crates/spt-daemon/src/reap.rs` (brain\r\n  subtree reaper), not `crates/spt/src/reap.rs` as first filed ·\r\n  **Origin:** todlando 2026-08-03, swept while building [[IR-16]]; deliberately\r\n  NOT folded into that lane (doyle ruling, same day) and filed instead.\r\n- **MEASURED:** `crates/spt/src/reap.rs:207-211` calls `TerminateJobObject` and discards the result,\r\n  the identical shape [[IR-16]] closed at `spt-daemon`'s `kill_tree`. Its own module's\r\n  create/assign siblings at `:178` and `:202` ARE instrumented, so this call is the odd one out\r\n  where it lives — the module already decided that these returns are worth reading.\r\n- **Why it was NOT folded into IR-16:** different subject. IR-16's site is a SUPERVISED SERVICE's\r\n  teardown, where the loss is \"a supervised service's descendants survive\" and the promise it\r\n  breaks is `REQ-RESIDENT-SERVICE`'s tree claim. This site is the BRAIN SUBTREE's kill-on-close\r\n  job, which has its own lifetime, its own caller and its own answer to \"what does a failed\r\n  termination cost here\" — and that answer has not been written down by anyone. Folding it in would\r\n  have meant settling that question in passing, inside a commit about the supervisor, which is how a\r\n  second ruling gets smuggled into a lane scoped to one.\r\n- **What it needs that IR-16's fix does not supply:** IR-16 ruled a LOUD REFUSAL (option B) on the\r\n  ground that the alternative — a process-table tree-walk fallback — is measured blind in exactly\r\n  that failure state ([[IR-18]]: descent breaks at the dead middle hop) and would trade a silent\r\n  loss for a false clean. Whether the same reasoning holds here depends on whether this site kills\r\n  its direct process in the same breath, which is what makes the middle hop dead by construction\r\n  there. **That is the first thing to check, and it is not assumed.**\r\n- **Ripe when:** any wave touching reap/teardown; it inherits IR-16's vocabulary and its\r\n  discrimination note, so the second one is cheaper than the first. **Size:** small, once the\r\n  cost-of-loss question is answered for this subject.\r\n\r\n### IR-25 — `spt-daemon --lib` reds 2-in-3 under concurrent load with bare `cargo test`, and holds green under nextest\r\n- **Status:** open · **Origin:** doyle 2026-08-03, found while gating LOCKSMITH tranche 1 in an\r\n  isolated worktree; chased to a mechanism and scoped OUT of the release path before the head was\r\n  assembled.\r","startLine":1300,"lineNumbers":[1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,1333,1334,1335,1336,1337,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1357,1358,1359,1360,1361,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1395,1396,1397,1398,1399,1400,1401,1402,1403,1404,1405,1406,1407,1408,1409,1410,1411,1412,1413,1414,1415,1416,1417,1418,1419,1420,1421,1422,1423,1424,1425,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5782,"totalBytes":15138,"outputLines":183,"outputBytes":15138,"shownRange":{"start":1300,"end":1482},"nextOffset":1483}}},"isError":false,"timestamp":1789094615795}}
{"type":"message","id":"0aedc987","parentId":"b6df8abd","timestamp":"2026-09-11T02:43:35.840Z","message":{"role":"toolResult","toolCallId":"call_P6kZ3Ot7rbM6Sqbv29sLYrQ8|fc_074aee81620ae383016aa36ad5634487d1967b9395ef34eee9","toolName":"grep","content":[{"type":"text","text":"# traceable-reqs.toml\n 268|title = \"Endpoint visibility per-(endpoint,subnet): excluded semantics, OR-of-defaults + override, gates sync\"\n*269|required_stages = [\"impl\", \"unit\"]  # activated M4-D3e: spt_store::visibility::VisibilityStore (identity/visibility.json, atomic, degrade-safe) — hidden(E,S,flag) = per-(E,S) override wins both directions, else S.hide_new_endpoints OR E.default_hide (both ship OFF). SubnetRecord.hide_new_endpoints serde-defaulted (legacy subnet.json loads OFF). Enforcement in spt_net::net::registry: excluded = not advertised (advertise_if_visible gates BEFORE the collision check — hidden neither claims nor clashes) A...\n 270|[[requirements]]\n 271|id = \"REQ-INST-13\"\n 272|title = \"Subnet-exclusive sync + per-endpoint subnet-membership list\"\n...\n 567|id = \"REQ-POOL-FOREIGN-TREE-REFUSED\"\n*568|title = \"A SOURCE TREE MUST NOT SILENTLY BUILD INTO A CARGO TARGET DIRECTORY THAT BELONGS TO ANOTHER SOURCE TREE. Two trees sharing one pool overwrite each other artifacts -- measured, not inferred: two packages of the same name and version built from two DIFFERENT paths resolve to ONE build-script output dir. In the v0.51.0 BAROMETER W1/H1 window that fabricated an E0308 in a gate lane which vanished on re-run, a red belonging to neither tree. THE REFUSAL KEYS ON THE RELATIONSHIP, NEVER ON A PATH: the i...\n 569|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 (hertz, 2026-08-02), releases#103, doyle-ruled shape (a) after the cargo-pid lease was refused on measurement. int stays inactive: the field proof is a second source tree driven against a live pool, which the lane rig performs rather than the unit suite.\n 570|\n 571|[[requirements]]\n*572|id = \"REQ-POOL-LANE-IDENTITY\"\n 573|title = \"A LANE'S STATE IS READ FROM ITS GIT IDENTITY, AND THE HOLDER PROCESS IS ADVISORY. MEASURED, not inferred: a sweep of this box's pool claims found 3 of 3 holder processes dead while one of those three lanes was demonstrably LIVE -- the holder was an agent session that had been cleared, re-forked or re-parented, which is routine and says nothing about whether the lane finished. A claim that decides FINISHED from a dead holder hands the pool to a second tree mid-lane, which is releases#103's origin...\n 574|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED LOCKSMITH CI-rider lane (hertz, 2026-08-03), IR-14's pool-claim gap. doc = the module contract in spt-poolguard + the AGENTS.md pool paragraph; impl = LaneClaim's git identity, the ancestry probe, and the precedence table in decide/classify; unit = one row per precedence cell, each arm reachable from a constructed stamp. int stays inactive: the field proof is a second tree driven against a live pool, which the lane rig performs rather than the unit s...\n 575|\n...\n 577|id = \"REQ-POOL-CLAIM-TREE-MATCH\"\n*578|title = \"POOL-CLAIM MUST REFUSE BEFORE WRITING WHEN --POOL BELONGS TO A DIFFERENT GIT WORKTREE THAN THE CALLER'S CWD, UNLESS THE CALLER EXPLICITLY OPTS INTO THE SANCTIONED SEQUENTIAL TAKEOVER WITH --foreign-pool. The claim verb harvests owner_tree, branch, and base from cwd; an accidental crossing therefore writes a confidently wrong ownership record and reports success. A deliberate crossing is required by the build guard's own takeover remedy: it remains cwd-authored so the arriving lane becomes the ow...\n 579|required_stages = [\"impl\", \"unit\"]\n 580|\n 581|[[requirements]]\n...\n 597|id = \"REQ-POOL-GUARD-NOT-SILENCEABLE\"\n*598|title = \"THE POOL GUARD BUILD SCRIPT MUST EMIT NO `rerun-if` DIRECTIVE, AND A TEST MUST ENFORCE THAT RATHER THAN A COMMENT. MEASURED on a two-tree rig sharing one pool with the trees made BYTE-IDENTICAL (diff -r empty), sequence A B A A B: with no directives the script ran FOUR times (A, B, A, B) and the consecutive A A ran it once; with ONE cargo:rerun-if-changed added it ran ONCE and the foreign tree never ran it again at all. A script with no directives is re-run whenever cargo unit fingerprint change...\n*599|required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 (hertz, 2026-08-02), releases#103, doyle rider (a) on the enforcement-point ruling.\n 600|\n 601|[[requirements]]\n 602|id = \"REQ-POOL-ONE-LIVENESS-PREDICATE\"\n...\n 1124|title = \"The single-threaded peer pump's brain-IPC reads are deadline-bounded (PUMP_PEER_IO_TIMEOUT, total-wait per call); a TimedOut read POISONS the client and escalates to a SUPERVISED RESTART, never a per-peer retry — a black-holed peer must never wedge the whole pump\"\n*1125|required_stages = [\"doc\", \"impl\", \"unit\"]  # activated 2026-06-11: deployed v0.4.0 pump wedged 2.2h on hfenduleam — net_open_stream's unbounded `loop { read_event }` blocked on a peer conn the broker never replied for; the single-threaded pump froze and supervise_pump cannot rescue a BLOCKED thread (it only catches panic/error/return). Surfaced twice (2026-06-07 + this 2.2h wedge); the stall-warning was the band-aid, not the fix. fix = Brain pump-mode carrier SPLIT at construction (Brain::cold_start_pu...\n 1126|# --- Added 2026-06-16 (v0.8.3): the pump-IPC-deadline B-half — the broker-side complement of REQ-HAZARD-PUMP-IPC-DEADLINE (DEFERRED.md:42 resolved); rule 3 register-before-satisfy, rule 5 activate per wave ---\n 1127|[[requirements]]\n 1128|id = \"REQ-HAZARD-BROKER-QUIC-DEADLINE\"\n...\n 1158|title = \"Self-update rejects version rollback; metadata expiry + adapter content signing (codex #5)\"\n*1159|required_stages = [\"impl\", \"unit\"]  # activated M3c-C1: release::verify_metadata enforces monotonic version (rollback), metadata expiry, channel pinning, and key revocation. Adapter content signing is the C3 half (REQ-UPD-5/SEAM-UPDATE)\n 1160|[[requirements]]\n 1161|id = \"REQ-HAZARD-DAEMON-HOSTED-LIVENESS\"\n 1162|title = \"Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2.5)\"\n...\n 1175|id = \"REQ-HAZARD-BRAIN-RESPAWN-PATH\"\n*1176|title = \"The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE at broker start, never a per-spawn std::env::current_exe() — on Linux current_exe (readlink /proc/self/exe) is inode-tracking and follows the `apply` rename (spt -> spt.old-N), so a resident broker would respawn the brain onto OLD bytes while recording `applied` (Windows GetModuleFileName is path-at-start, so Windows was green; ADR-0018 Q3 silen...\n 1177|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated v0.4.2 (2026-06-11): minted from the v0.4.1 fleet-roll blocker. doc = KNOWN-HAZARDS 6.11 + ADR-0018 Q3 amendment; int = brain_respawn_rename.rs (real broker process, in-place rename P->P.old-N + new bytes at P, respawn must run B not A — fails Linux pre-fix). Stages: impl = brainproc.rs canonical-exe capture at spawn_brain_supervisor + promotion bytes-gate in supervise_brain Promoted arm (TrialEnv ready_exe_hash/staged_artifact_hash); unit =...\n 1178|# --- Added 2026-06-03 from grill-with-docs (ADR-0012, hazard 7.3); inactive until M4-D7.5 ---\n 1179|[[requirements]]\n...\n 1208|id = \"REQ-CONSENT-1\"\n*1209|title = \"Consent grant store: capability x subject-agent x target-node rows, enforced at the target node, subnet-settable (replicates as security material near the trust store), revocable; gated-capability ids (remote-exec, instantiate-anywhere) reserved-but-refusing; v1 consumers are the shell spawn gates (CONTEXT Consent & security gates)\"\n 1210|required_stages = [\"impl\", \"unit\"]  # activated M5-D1a: spt-store::grants GrantStore (trust/grants.json, default-deny polarity, corrupt-degrades-closed, exact-tuple match incl. qualifier) + spt-daemon::grants gate (reserved-refusal-first decide, target-node-local check front door) + spt grant add/revoke/list CLI (reserved ids refuse authoring). int = the D3d spawn-gate consumer E2E. M5-D9b rule-5: int stays unactivated — the escalation's end-to-end leg needs a real harness session answering a real prom...\n 1211|[[requirements]]\n 1212|id = \"REQ-CONSENT-2\"\n...\n 1361|title = \"Hard cutover from pairwise trust: delete peers.json + the is_trusted authorization path (no migration — expendable test fleet, re-pairs fresh under the new model, user decision 2026-06-08). Warn-on-change DEMOTED from a gate to an awareness notice anchored on machine_id (not label): 'machine M, last seen as K1, now presents K2' — fires the same event as the REQ-SUBNET-7 re-pair overwrite. The TrustStore/peers.json code and its call sites are removed, not left dead.\"\n*1362|required_stages = [\"impl\", \"unit\"]  # Mesh-D6 activated: impl = TrustStore + peers.json + every call site DELETED (spt-store mod, perch::trust_file, pairing wire trust write, peerloop push, CLI status/list/prune/leave, xtask); the serve/inbound gates authorize on roster membership (propagate serve_update → RosterStore::is_member_any; dispatch caller); warn-on-change re-homed onto machine_id as a non-blocking RekeyNotice at the repair_evict_superseded event. unit = roster::is_member_any spans subnets + ...\n 1363|[[requirements]]\n 1364|id = \"REQ-MESH-6\"\n 1365|title = \"Concurrent liveness probes: `spt subnet status --nodes` fans out its offline/serve-probes (REQ-SUBNET-5) CONCURRENTLY — total wall-time bounded by the single-probe ceiling (~3s), never k×ceiling. The mesh makes a node see ALL members (many possibly offline), so a serial probe loop would be offline_count×3s. (Planning verifies the current REQ-SUBNET-5 probe loop's behavior and fixes it if serial.)\"\n...\n 2012|title = \"`spt endpoint list` SHOWS THE CALLING ENDPOINT ITS OWN NESTED PERCHES, in a section of their own (releases#98, ADDITION; ruled 2026-08-02). A live agent cannot see its own psyche or its own workers on the surface that exists to answer what is running here: nested perches live at owlery/<parent>/nested/<child>/ and the roster this view is built from enumerates top-level perches only, so the children are invisible by construction rather than by choice. THE NESTING RELATION IS THE STRUCTURAL ONE SP...\n*2013|required_stages = [\"doc\", \"impl\", \"unit\"]  # doc ACTIVATED BAROMETER W4 doc leg (doyle-ruled, this milestone): the picker page's status-square table read as exhaustive and the nested section ships a THIRD row shape -- a named, status-free psyche companion with no glyph, whose absence of a square is the honest answer rather than a gap. -- ACTIVATED BAROMETER W4 leg 3 (todlando, 2026-08-02), releases#98. impl = spt_store::perch::list_nested_perch_ids_in (the nesting relation read as a DIRECTORY scan of owl...\n 2014|\n 2015|[[requirements]]\n 2016|id = \"REQ-CLI-WIN-VT-ENABLE\"\n...\n 2152|id = \"REQ-OPID-TRACING-RETRY\"\n*2153|title = \"A-4b (REMOTE-TRUTH triage §A + ADR-0034 Decision 2): the tracing-only op families auto-retry ONCE with a fresh op on the typed no-longer-held error, so a broker-restart-dropped conn/stream self-heals instead of surfacing core lingo to the user. ROOT: net/rest.rs declares rest op-ids 'tracing/correlation only … redelivery needs reporting, not dedup', yet the journal enforced exactly-once on them — a rest/attach op whose conn the broker no longer holds (post-restart) returned the typed 'alrea...\n 2154|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED REMOTE-TRUTH A-4b (todlando). impl = a shared FROZEN const OP_NO_LONGER_HELD_MARKER (effect.rs; extracted VERBATIM from the broker's current no-longer-held message which crosses the brain IPC boundary — new cli must match un-upgraded daemon text; broker.rs:2796/3047 reference it keeping the emitted text byte-identical) + a with_tracing_retry(mint, run) helper (effect.rs; substring-matches the const, re-mints a FRESH same-minter op once, on 2nd no-l...\n 2155|[[requirements]]\n 2156|id = \"REQ-REST-VERB-ROUTING\"\n...\n 2187|[[requirements]]\n*2188|id = \"REQ-ADAPTER-FLOOR-ENFORCE\"\n*2189|title = \"F-5 (REMOTE-TRUTH triage §F-5 + doyle rulings 2026-07-05): BOTH adapter acquisition verbs (spt adapter add + spt adapter update) REFUSE when the installed spt-core is BELOW the adapter's declared [adapter].min_spt_core_version floor — with an F-1 operator refusal naming the installed core, the floor, and the next action (update spt-core first). ROOT: the floor was PARSED + required (manifest.rs) but never compared to the running core — dead enforcement; and the [update].version_check knob t...\n*2190|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED REMOTE-TRUTH F-5 (todlando). doc = MANIFEST.md min_spt_core_version enforcement note (both verbs refuse below floor, numeric compare, before-any-write, version_check retired). impl = spt-runtime version_meets_floor (numeric semver-lite) + registry::register_with_core seam (register() delegates with env!(CARGO_PKG_VERSION)) + the floor gate after manifest-parse-before-write returning RegistryError::CoreFloor{adapter,core,floor} (F-1 Display) + cli sta...\n 2191|\n 2192|[[requirements]]\n 2193|id = \"REQ-ADAPTER-FLOOR-VS-STAGED-CORE\"\n*2194|title = \"IN A COMPOSITE UPDATE, AN ADAPTER'S CORE-VERSION FLOOR IS JUDGED AGAINST THE CORE THAT RUN WILL ACTIVATE, NOT THE ONE CURRENTLY RUNNING (releases#159, doyle ruling 2026-08-21). THIS DELIVERS A CONTRACT ALREADY RULED AND NEVER SATISFIED, which is what the lane is FOR: CONTEXT.md's adapter-manifest-header entry has said since the glossary was written that `when spt-core self-updates, re-verify adapters still satisfy (coordinate core + adapter updates when needed)` — the code never did. Same shap...\n 2195|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED TURNKEY W3 lane 2 (todlando build 2026-08-22, releases#159). doc ACTIVATED on doyle's 2026-08-22 catch: the amended CONTEXT.md clause IS the authoritative statement of the ruled cadence, so this requirement depends on a sentence the lane itself writes — landing it untagged would leave that dependency pointing at nothing. int DELIBERATELY NOT ACTIVATED (same ruling): the owed proof is FIELD ACCEPTANCE — one real composite roll on a real box landin...\n 2196|\n 2197|[[requirements]]\n...\n 2677|id = \"REQ-HEAVY-UNIT-CLASSIFICATION\"\n*2678|title = \"A unit test that stands up a REAL broker inside a lib/bin `#[cfg(test)]` block must sit in the `heavy-broker-pty` nextest group, and the classification must be ENFORCED rather than remembered. FLAKE-LEDGER: `attach_viewport_reconnects_across_a_broker_bounce` diagnosed this class in the `spt` binary, wrote the CLASS in prose, then shipped an ENUMERATION of four `rc::tests::` names — so the identical shape in `spt-daemon`'s lib (`applyhost`: a real `Broker::bind` + `serve()` in 10 of its 13 unit...\n*2679|required_stages = [\"impl\", \"unit\"]  # ACTIVATED 2026-07-20 (doyle). Rig/CI-recipe requirement: NO doc stage (the contract lives in .config/nextest.toml's own comments, which the check now enforces) and NO int stage (the enforcement IS `xtask check`, itself already a CI gate).\n 2680|\n 2681|# ── CI policy (operator-ruled 2026-07-16): thin CI on docs-only PRs. ──\n 2682|[[requirements]]\n...\n 2710|title = \"releases#107: the CI notifier classifies CANCELLED separately from FAILURE, so a cancelled golden run stops paging the fleet as a red. `.github/ci/ci-notify.sh` `check()` (lines 94-111) folds `failure | cancelled` into one `failing` string and renders `verdict=\\\"FAILURE\\\"` for any non-empty value. PRECEDENCE IS THE WHOLE RISK: a genuine failure normally CANCELS its siblings, so mixed failure+cancelled IS the shape of a real red — ANY `failure` present ⇒ FAILURE verdict (cancelled jobs may st...\n*2711|required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H1 (hertz 2026-08-02). Recipe-layer, so NO doc stage (the contract lives in the script's own comments) and NO int stage (the enforcement IS the golden.yml selftest step, itself already a gate). impl = the three-class split + SPT_CI_NOTIFY_LIB seam in .github/ci/ci-notify.sh; unit = .github/ci/ci-notify-selftest.sh (23 assertions incl. the failure+cancelled precedence row and the paired body-wording predicate with its positive control), wired at go...\n 2712|\n 2713|[[requirements]]\n 2714|id = \"REQ-GOLDEN-RESPIN-TEST\"\n\n# .github/\n\n## ci/\n### ws272-w0.py\n 38|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*39|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 40|# below must never be more lenient than the meter it stands in for.\n 41|FLOOR_BYTES = 32 << 30\n 42|# The perch identity a live agent's shell carries. A battery must never look\n### ws272-w1.py\n 44|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*45|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 46|# below must never be more lenient than the meter it stands in for.\n 47|FLOOR_BYTES = 32 << 30\n 48|# The perch identity a live agent's shell carries. A battery must never look\n### ws272-w2.py\n 51|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*52|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 53|# below must never be more lenient than the meter it stands in for.\n 54|FLOOR_BYTES = 32 << 30\n 55|# The perch identity a live agent's shell carries. A battery must never look\n\n## workflows/\n### ci.yml\n 38|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*39|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 40|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 41|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 42|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 77|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*78|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 79|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 80|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 81|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 107|          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*108|          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 109|          if ($freeBytes -lt $floorBytes) {\n 110|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 111|            exit 1\n...\n 124|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*125|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 126|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 127|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 128|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 153|          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*154|          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 155|          if ($freeBytes -lt $floorBytes) {\n 156|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 157|            exit 1\n...\n 169|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*170|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 171|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 172|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 173|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 194|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*195|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 196|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 197|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 198|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 219|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*220|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 221|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 222|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 223|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 242|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*243|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 244|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 245|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 246|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 284|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*285|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 286|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 287|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 288|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n### golden.yml\n 46|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*47|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 48|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 49|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 50|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 69|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*70|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 71|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 72|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 73|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 232|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*233|          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 234|          if ($freeBytes -lt $floorBytes) {\n 235|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 236|            exit 1\n...\n 248|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*249|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 250|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 251|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 252|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 275|      # and lint set a reader is asking about.\n*276|      # [impl->REQ-CI-TOOLCHAIN-VERSION-PRINT]\n 277|      - name: Toolchain versions (Windows)\n 278|        if: runner.os == 'Windows'\n 279|        shell: pwsh\n...\n 303|          exit 0\n*304|      # [impl->REQ-CI-TOOLCHAIN-VERSION-PRINT]\n 305|      - name: Toolchain versions (Linux)\n 306|        if: runner.os == 'Linux'\n 307|        shell: bash\n...\n 608|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*609|          printf 'FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 610|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 611|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 612|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 629|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*630|          Write-Host \"FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 631|          if ($freeBytes -lt $floorBytes) {\n 632|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 633|            exit 1\n...\n 717|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*718|          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 719|          if ($freeBytes -lt $floorBytes) {\n 720|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 721|            exit 1\n...\n 733|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*734|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 735|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 736|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 737|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 855|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*856|          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 857|          if ($freeBytes -lt $floorBytes) {\n 858|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 859|            exit 1\n...\n 871|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*872|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 873|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 874|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 875|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 972|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*973|          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 974|          if ($freeBytes -lt $floorBytes) {\n 975|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 976|            exit 1\n...\n 988|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*989|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 990|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 991|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 992|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 1063|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*1064|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 1065|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 1066|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 1067|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 1095|      # itself a finding.\n*1096|      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n 1097|      - name: Link health probe — peer hfenduleam (tailscale RTT)\n 1098|        if: always()\n 1099|        shell: bash\n...\n 1185|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*1186|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 1187|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 1188|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 1189|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 1236|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*1237|          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 1238|          if ($freeBytes -lt $floorBytes) {\n 1239|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 1240|            exit 1\n...\n 1263|      # itself a finding.\n*1264|      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n 1265|      - name: Link health probe — peer kitsubito (tailscale RTT)\n 1266|        if: always()\n 1267|        shell: pwsh\n...\n 1354|          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*1355|          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 1356|          if ($freeBytes -lt $floorBytes) {\n 1357|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 1358|            exit 1\n### release.yml\n 63|          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*64|          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 65|          if ($freeBytes -lt $floorBytes) {\n 66|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 67|            exit 1\n...\n 80|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*81|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 82|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 83|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 84|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 139|          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*140|          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 141|          if ($freeBytes -lt $floorBytes) {\n 142|            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 143|            exit 1\n...\n 155|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*156|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 157|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 158|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 159|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 179|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*180|          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 181|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 182|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 183|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n...\n 292|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*293|          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 294|            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 295|          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 296|            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n\n# crates/\n\n## xtask/src/\n### binedge.rs\n*1|//! Fixture-bin build edges (IR-21 remedy (c), the ENFORCED form).\n 2|//!\n 3|//! ## The question it answers\n 4|//!\n...\n 604|/// REAL guarantee and manufacture a red — the tolerable direction for this\n*605|/// check, but still a false alarm on a correct recipe, and an enforced check\n 606|/// that cries wolf gets ignored. (No wrapped prebuild exists in the tree today:\n 607|/// the allowlist this produces is identical with and without the tolerance.)\n 608|fn shell_gap(s: &[u8]) -> usize {\n### main.rs\n 1183|mod patch_pin_tests {\n*1184|    const REV: &str = \"89a2200d54a4e3cab2f46cc75ebff49a1fb07614\";\n 1185|\n 1186|    fn manifest_with_pin() -> String {\n 1187|        format!(\n...\n 3025|///\n*3026|/// The CLAIM half of the build-cache pool guard (releases#103). Enforcement is\n 3027|/// a build script and is pure mechanism; the claim is the one part that is\n 3028|/// discipline, and it is written HERE, at lane start, rather than by any build.\n 3029|///\n\n## spt-poolguard/src/\n### lib.rs\n 54|//!\n*55|//! ## Claim and enforcement are different jobs\n 56|//!\n 57|//! - **The lane CLAIM** is written at lane start by the rig (`cargo xtask\n 58|//!   pool-claim`) and names the lane's branch and base sha, plus a LONG-LIVED\n...\n 61|//!   would read as a live lane forever.\n*62|//! - **The ENFORCEMENT** is a build script, which never claims a lane. It only\n*63|//!   reads, decides, and refuses. That split is what keeps enforcement a\n 64|//!   mechanism while only the claim is discipline — and an unmade claim is\n 65|//!   LOUD (a refusal naming the command) rather than permissive.\n 66|//!\n...\n 108|/// process (the agent session or gate rig that ran the claim).\n*109|// [impl->REQ-POOL-LANE-IDENTITY]\n 110|#[derive(Debug, Clone, PartialEq, Eq)]\n 111|pub struct LaneClaim {\n 112|    /// Human label for the lane, for the refusal line.\n...\n 133|/// different question from \"did that lane finish\".\n*134|// [impl->REQ-POOL-LANE-IDENTITY]\n 135|#[derive(Debug, Clone, PartialEq, Eq)]\n 136|pub enum LaneState {\n 137|    /// The lane's tip is not contained in the integration head — work in\n...\n 223|/// discipline the holder arms already carry.\n*224|// [impl->REQ-POOL-LANE-IDENTITY]\n 225|pub fn decide_with(\n 226|    pool: &Path,\n 227|    this_tree: &Path,\n...\n 365|/// call a lane finished on the strength of a question it could not ask.\n*366|// [impl->REQ-POOL-LANE-IDENTITY]\n 367|pub fn git_lane_state(repo: &Path, claim: &LaneClaim) -> LaneState {\n 368|    // THE REPO-IDENTITY WITNESS, FIRST, AND EVERY ANSWER HANGS OFF IT. Only a\n 369|    // claimed base object present HERE can show that the repository being read\n...\n 642|/// affordance [`decide_with`] provides, for the same reason.\n*643|// [impl->REQ-POOL-LANE-IDENTITY]\n 644|pub fn classify_with(\n 645|    dir: &Path,\n 646|    inbound: usize,\n...\n 1234|    /// guard instead of around it.\n*1235|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1236|    #[test]\n 1237|    fn a_dead_holder_over_an_unlanded_lane_refuses_instead_of_taking_over() {\n 1238|        let p = pool();\n...\n 1281|    /// loudly. A guard that only ever added refusals would cost a pool per lane.\n*1282|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1283|    #[test]\n 1284|    fn a_landed_lane_with_a_dead_holder_is_still_a_takeover() {\n 1285|        let p = pool();\n...\n 1303|    /// — a NEW hazard invented by the fix.\n*1304|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1305|    #[test]\n 1306|    fn a_live_holder_refuses_even_when_the_lane_has_landed() {\n 1307|        let p = pool();\n...\n 1325|    /// upgrade becomes an incident.\n*1326|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1327|    #[test]\n 1328|    fn a_claim_with_no_git_identity_falls_back_and_names_the_fallback() {\n 1329|        let p = pool();\n...\n 1354|    /// a live lane's warm cache for deletion on this box.\n*1355|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1356|    #[test]\n 1357|    fn a_sweep_keeps_a_pool_whose_lane_is_in_flight_with_a_dead_holder() {\n 1358|        let d = pool();\n...\n 1388|    /// One row per arm is how that recurs; the invariant is the population.\n*1389|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1390|    #[test]\n 1391|    fn no_refusal_arm_names_a_command_that_cannot_be_run() {\n 1392|        let p = pool();\n...\n 1439|    /// what tells the two cases apart, and it must fail toward UNKNOWN.\n*1440|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1441|    #[test]\n 1442|    fn a_claim_from_another_repository_reads_unknown_not_settled() {\n 1443|        let repo = tempfile::tempdir().unwrap(); // not a git repository at all\n...\n 1458|    /// be a predicate nobody had ever run.\n*1459|    // [unit->REQ-POOL-LANE-IDENTITY]\n 1460|    #[test]\n 1461|    fn the_ancestry_probe_reads_a_real_repository_both_ways() {\n 1462|        let repo = tempfile::tempdir().unwrap();\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".github, crates/xtask/src, crates/spt-poolguard/src, traceable-reqs.toml","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":79,"fileCount":10,"files":[".github/ci/ws272-w0.py",".github/ci/ws272-w1.py",".github/ci/ws272-w2.py",".github/workflows/ci.yml",".github/workflows/golden.yml",".github/workflows/release.yml","crates/xtask/src/binedge.rs","crates/xtask/src/main.rs","crates/spt-poolguard/src/lib.rs","traceable-reqs.toml"],"fileMatches":[{"path":".github/ci/ws272-w0.py","count":1},{"path":".github/ci/ws272-w1.py","count":1},{"path":".github/ci/ws272-w2.py","count":1},{"path":".github/workflows/ci.yml","count":10},{"path":".github/workflows/golden.yml","count":20},{"path":".github/workflows/release.yml","count":6},{"path":"crates/xtask/src/binedge.rs","count":2},{"path":"crates/xtask/src/main.rs","count":2},{"path":"crates/spt-poolguard/src/lib.rs","count":16},{"path":"traceable-reqs.toml","count":20}],"truncated":true,"perFileLimitReached":20,"displayContent":"# traceable-reqs.toml\n  268│title = \"Endpoint visibility per-(endpoint,subnet): excluded semantics, OR-of-defaults + override, gates sync\"\n *269│required_stages = [\"impl\", \"unit\"]  # activated M4-D3e: spt_store::visibility::VisibilityStore (identity/visibility.json, atomic, degrade-safe) — hidden(E,S,flag) = per-(E,S) override wins both directions, else S.hide_new_endpoints OR E.default_hide (both ship OFF). SubnetRecord.hide_new_endpoints serde-defaulted (legacy subnet.json loads OFF). Enforcement in spt_net::net::registry: excluded = not advertised (advertise_if_visible gates BEFORE the collision check — hidden neither claims nor clashes) A...\n  270│[[requirements]]\n  271│id = \"REQ-INST-13\"\n  272│title = \"Subnet-exclusive sync + per-endpoint subnet-membership list\"\n     │...\n  567│id = \"REQ-POOL-FOREIGN-TREE-REFUSED\"\n *568│title = \"A SOURCE TREE MUST NOT SILENTLY BUILD INTO A CARGO TARGET DIRECTORY THAT BELONGS TO ANOTHER SOURCE TREE. Two trees sharing one pool overwrite each other artifacts -- measured, not inferred: two packages of the same name and version built from two DIFFERENT paths resolve to ONE build-script output dir. In the v0.51.0 BAROMETER W1/H1 window that fabricated an E0308 in a gate lane which vanished on re-run, a red belonging to neither tree. THE REFUSAL KEYS ON THE RELATIONSHIP, NEVER ON A PATH: the i...\n  569│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 (hertz, 2026-08-02), releases#103, doyle-ruled shape (a) after the cargo-pid lease was refused on measurement. int stays inactive: the field proof is a second source tree driven against a live pool, which the lane rig performs rather than the unit suite.\n  570│\n  571│[[requirements]]\n *572│id = \"REQ-POOL-LANE-IDENTITY\"\n  573│title = \"A LANE'S STATE IS READ FROM ITS GIT IDENTITY, AND THE HOLDER PROCESS IS ADVISORY. MEASURED, not inferred: a sweep of this box's pool claims found 3 of 3 holder processes dead while one of those three lanes was demonstrably LIVE -- the holder was an agent session that had been cleared, re-forked or re-parented, which is routine and says nothing about whether the lane finished. A claim that decides FINISHED from a dead holder hands the pool to a second tree mid-lane, which is releases#103's origin...\n  574│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED LOCKSMITH CI-rider lane (hertz, 2026-08-03), IR-14's pool-claim gap. doc = the module contract in spt-poolguard + the AGENTS.md pool paragraph; impl = LaneClaim's git identity, the ancestry probe, and the precedence table in decide/classify; unit = one row per precedence cell, each arm reachable from a constructed stamp. int stays inactive: the field proof is a second tree driven against a live pool, which the lane rig performs rather than the unit s...\n  575│\n     │...\n  577│id = \"REQ-POOL-CLAIM-TREE-MATCH\"\n *578│title = \"POOL-CLAIM MUST REFUSE BEFORE WRITING WHEN --POOL BELONGS TO A DIFFERENT GIT WORKTREE THAN THE CALLER'S CWD, UNLESS THE CALLER EXPLICITLY OPTS INTO THE SANCTIONED SEQUENTIAL TAKEOVER WITH --foreign-pool. The claim verb harvests owner_tree, branch, and base from cwd; an accidental crossing therefore writes a confidently wrong ownership record and reports success. A deliberate crossing is required by the build guard's own takeover remedy: it remains cwd-authored so the arriving lane becomes the ow...\n  579│required_stages = [\"impl\", \"unit\"]\n  580│\n  581│[[requirements]]\n     │...\n  597│id = \"REQ-POOL-GUARD-NOT-SILENCEABLE\"\n *598│title = \"THE POOL GUARD BUILD SCRIPT MUST EMIT NO `rerun-if` DIRECTIVE, AND A TEST MUST ENFORCE THAT RATHER THAN A COMMENT. MEASURED on a two-tree rig sharing one pool with the trees made BYTE-IDENTICAL (diff -r empty), sequence A B A A B: with no directives the script ran FOUR times (A, B, A, B) and the consecutive A A ran it once; with ONE cargo:rerun-if-changed added it ran ONCE and the foreign tree never ran it again at all. A script with no directives is re-run whenever cargo unit fingerprint change...\n *599│required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 (hertz, 2026-08-02), releases#103, doyle rider (a) on the enforcement-point ruling.\n  600│\n  601│[[requirements]]\n  602│id = \"REQ-POOL-ONE-LIVENESS-PREDICATE\"\n     │...\n 1124│title = \"The single-threaded peer pump's brain-IPC reads are deadline-bounded (PUMP_PEER_IO_TIMEOUT, total-wait per call); a TimedOut read POISONS the client and escalates to a SUPERVISED RESTART, never a per-peer retry — a black-holed peer must never wedge the whole pump\"\n*1125│required_stages = [\"doc\", \"impl\", \"unit\"]  # activated 2026-06-11: deployed v0.4.0 pump wedged 2.2h on hfenduleam — net_open_stream's unbounded `loop { read_event }` blocked on a peer conn the broker never replied for; the single-threaded pump froze and supervise_pump cannot rescue a BLOCKED thread (it only catches panic/error/return). Surfaced twice (2026-06-07 + this 2.2h wedge); the stall-warning was the band-aid, not the fix. fix = Brain pump-mode carrier SPLIT at construction (Brain::cold_start_pu...\n 1126│# --- Added 2026-06-16 (v0.8.3): the pump-IPC-deadline B-half — the broker-side complement of REQ-HAZARD-PUMP-IPC-DEADLINE (DEFERRED.md:42 resolved); rule 3 register-before-satisfy, rule 5 activate per wave ---\n 1127│[[requirements]]\n 1128│id = \"REQ-HAZARD-BROKER-QUIC-DEADLINE\"\n     │...\n 1158│title = \"Self-update rejects version rollback; metadata expiry + adapter content signing (codex #5)\"\n*1159│required_stages = [\"impl\", \"unit\"]  # activated M3c-C1: release::verify_metadata enforces monotonic version (rollback), metadata expiry, channel pinning, and key revocation. Adapter content signing is the C3 half (REQ-UPD-5/SEAM-UPDATE)\n 1160│[[requirements]]\n 1161│id = \"REQ-HAZARD-DAEMON-HOSTED-LIVENESS\"\n 1162│title = \"Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2.5)\"\n     │...\n 1175│id = \"REQ-HAZARD-BRAIN-RESPAWN-PATH\"\n*1176│title = \"The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE at broker start, never a per-spawn std::env::current_exe() — on Linux current_exe (readlink /proc/self/exe) is inode-tracking and follows the `apply` rename (spt -> spt.old-N), so a resident broker would respawn the brain onto OLD bytes while recording `applied` (Windows GetModuleFileName is path-at-start, so Windows was green; ADR-0018 Q3 silen...\n 1177│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated v0.4.2 (2026-06-11): minted from the v0.4.1 fleet-roll blocker. doc = KNOWN-HAZARDS 6.11 + ADR-0018 Q3 amendment; int = brain_respawn_rename.rs (real broker process, in-place rename P->P.old-N + new bytes at P, respawn must run B not A — fails Linux pre-fix). Stages: impl = brainproc.rs canonical-exe capture at spawn_brain_supervisor + promotion bytes-gate in supervise_brain Promoted arm (TrialEnv ready_exe_hash/staged_artifact_hash); unit =...\n 1178│# --- Added 2026-06-03 from grill-with-docs (ADR-0012, hazard 7.3); inactive until M4-D7.5 ---\n 1179│[[requirements]]\n     │...\n 1208│id = \"REQ-CONSENT-1\"\n*1209│title = \"Consent grant store: capability x subject-agent x target-node rows, enforced at the target node, subnet-settable (replicates as security material near the trust store), revocable; gated-capability ids (remote-exec, instantiate-anywhere) reserved-but-refusing; v1 consumers are the shell spawn gates (CONTEXT Consent & security gates)\"\n 1210│required_stages = [\"impl\", \"unit\"]  # activated M5-D1a: spt-store::grants GrantStore (trust/grants.json, default-deny polarity, corrupt-degrades-closed, exact-tuple match incl. qualifier) + spt-daemon::grants gate (reserved-refusal-first decide, target-node-local check front door) + spt grant add/revoke/list CLI (reserved ids refuse authoring). int = the D3d spawn-gate consumer E2E. M5-D9b rule-5: int stays unactivated — the escalation's end-to-end leg needs a real harness session answering a real prom...\n 1211│[[requirements]]\n 1212│id = \"REQ-CONSENT-2\"\n     │...\n 1361│title = \"Hard cutover from pairwise trust: delete peers.json + the is_trusted authorization path (no migration — expendable test fleet, re-pairs fresh under the new model, user decision 2026-06-08). Warn-on-change DEMOTED from a gate to an awareness notice anchored on machine_id (not label): 'machine M, last seen as K1, now presents K2' — fires the same event as the REQ-SUBNET-7 re-pair overwrite. The TrustStore/peers.json code and its call sites are removed, not left dead.\"\n*1362│required_stages = [\"impl\", \"unit\"]  # Mesh-D6 activated: impl = TrustStore + peers.json + every call site DELETED (spt-store mod, perch::trust_file, pairing wire trust write, peerloop push, CLI status/list/prune/leave, xtask); the serve/inbound gates authorize on roster membership (propagate serve_update → RosterStore::is_member_any; dispatch caller); warn-on-change re-homed onto machine_id as a non-blocking RekeyNotice at the repair_evict_superseded event. unit = roster::is_member_any spans subnets + ...\n 1363│[[requirements]]\n 1364│id = \"REQ-MESH-6\"\n 1365│title = \"Concurrent liveness probes: `spt subnet status --nodes` fans out its offline/serve-probes (REQ-SUBNET-5) CONCURRENTLY — total wall-time bounded by the single-probe ceiling (~3s), never k×ceiling. The mesh makes a node see ALL members (many possibly offline), so a serial probe loop would be offline_count×3s. (Planning verifies the current REQ-SUBNET-5 probe loop's behavior and fixes it if serial.)\"\n     │...\n 2012│title = \"`spt endpoint list` SHOWS THE CALLING ENDPOINT ITS OWN NESTED PERCHES, in a section of their own (releases#98, ADDITION; ruled 2026-08-02). A live agent cannot see its own psyche or its own workers on the surface that exists to answer what is running here: nested perches live at owlery/<parent>/nested/<child>/ and the roster this view is built from enumerates top-level perches only, so the children are invisible by construction rather than by choice. THE NESTING RELATION IS THE STRUCTURAL ONE SP...\n*2013│required_stages = [\"doc\", \"impl\", \"unit\"]  # doc ACTIVATED BAROMETER W4 doc leg (doyle-ruled, this milestone): the picker page's status-square table read as exhaustive and the nested section ships a THIRD row shape -- a named, status-free psyche companion with no glyph, whose absence of a square is the honest answer rather than a gap. -- ACTIVATED BAROMETER W4 leg 3 (todlando, 2026-08-02), releases#98. impl = spt_store::perch::list_nested_perch_ids_in (the nesting relation read as a DIRECTORY scan of owl...\n 2014│\n 2015│[[requirements]]\n 2016│id = \"REQ-CLI-WIN-VT-ENABLE\"\n     │...\n 2152│id = \"REQ-OPID-TRACING-RETRY\"\n*2153│title = \"A-4b (REMOTE-TRUTH triage §A + ADR-0034 Decision 2): the tracing-only op families auto-retry ONCE with a fresh op on the typed no-longer-held error, so a broker-restart-dropped conn/stream self-heals instead of surfacing core lingo to the user. ROOT: net/rest.rs declares rest op-ids 'tracing/correlation only … redelivery needs reporting, not dedup', yet the journal enforced exactly-once on them — a rest/attach op whose conn the broker no longer holds (post-restart) returned the typed 'alrea...\n 2154│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED REMOTE-TRUTH A-4b (todlando). impl = a shared FROZEN const OP_NO_LONGER_HELD_MARKER (effect.rs; extracted VERBATIM from the broker's current no-longer-held message which crosses the brain IPC boundary — new cli must match un-upgraded daemon text; broker.rs:2796/3047 reference it keeping the emitted text byte-identical) + a with_tracing_retry(mint, run) helper (effect.rs; substring-matches the const, re-mints a FRESH same-minter op once, on 2nd no-l...\n 2155│[[requirements]]\n 2156│id = \"REQ-REST-VERB-ROUTING\"\n     │...\n 2187│[[requirements]]\n*2188│id = \"REQ-ADAPTER-FLOOR-ENFORCE\"\n*2189│title = \"F-5 (REMOTE-TRUTH triage §F-5 + doyle rulings 2026-07-05): BOTH adapter acquisition verbs (spt adapter add + spt adapter update) REFUSE when the installed spt-core is BELOW the adapter's declared [adapter].min_spt_core_version floor — with an F-1 operator refusal naming the installed core, the floor, and the next action (update spt-core first). ROOT: the floor was PARSED + required (manifest.rs) but never compared to the running core — dead enforcement; and the [update].version_check knob t...\n*2190│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED REMOTE-TRUTH F-5 (todlando). doc = MANIFEST.md min_spt_core_version enforcement note (both verbs refuse below floor, numeric compare, before-any-write, version_check retired). impl = spt-runtime version_meets_floor (numeric semver-lite) + registry::register_with_core seam (register() delegates with env!(CARGO_PKG_VERSION)) + the floor gate after manifest-parse-before-write returning RegistryError::CoreFloor{adapter,core,floor} (F-1 Display) + cli sta...\n 2191│\n 2192│[[requirements]]\n 2193│id = \"REQ-ADAPTER-FLOOR-VS-STAGED-CORE\"\n*2194│title = \"IN A COMPOSITE UPDATE, AN ADAPTER'S CORE-VERSION FLOOR IS JUDGED AGAINST THE CORE THAT RUN WILL ACTIVATE, NOT THE ONE CURRENTLY RUNNING (releases#159, doyle ruling 2026-08-21). THIS DELIVERS A CONTRACT ALREADY RULED AND NEVER SATISFIED, which is what the lane is FOR: CONTEXT.md's adapter-manifest-header entry has said since the glossary was written that `when spt-core self-updates, re-verify adapters still satisfy (coordinate core + adapter updates when needed)` — the code never did. Same shap...\n 2195│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED TURNKEY W3 lane 2 (todlando build 2026-08-22, releases#159). doc ACTIVATED on doyle's 2026-08-22 catch: the amended CONTEXT.md clause IS the authoritative statement of the ruled cadence, so this requirement depends on a sentence the lane itself writes — landing it untagged would leave that dependency pointing at nothing. int DELIBERATELY NOT ACTIVATED (same ruling): the owed proof is FIELD ACCEPTANCE — one real composite roll on a real box landin...\n 2196│\n 2197│[[requirements]]\n     │...\n 2677│id = \"REQ-HEAVY-UNIT-CLASSIFICATION\"\n*2678│title = \"A unit test that stands up a REAL broker inside a lib/bin `#[cfg(test)]` block must sit in the `heavy-broker-pty` nextest group, and the classification must be ENFORCED rather than remembered. FLAKE-LEDGER: `attach_viewport_reconnects_across_a_broker_bounce` diagnosed this class in the `spt` binary, wrote the CLASS in prose, then shipped an ENUMERATION of four `rc::tests::` names — so the identical shape in `spt-daemon`'s lib (`applyhost`: a real `Broker::bind` + `serve()` in 10 of its 13 unit...\n*2679│required_stages = [\"impl\", \"unit\"]  # ACTIVATED 2026-07-20 (doyle). Rig/CI-recipe requirement: NO doc stage (the contract lives in .config/nextest.toml's own comments, which the check now enforces) and NO int stage (the enforcement IS `xtask check`, itself already a CI gate).\n 2680│\n 2681│# ── CI policy (operator-ruled 2026-07-16): thin CI on docs-only PRs. ──\n 2682│[[requirements]]\n     │...\n 2710│title = \"releases#107: the CI notifier classifies CANCELLED separately from FAILURE, so a cancelled golden run stops paging the fleet as a red. `.github/ci/ci-notify.sh` `check()` (lines 94-111) folds `failure | cancelled` into one `failing` string and renders `verdict=\\\"FAILURE\\\"` for any non-empty value. PRECEDENCE IS THE WHOLE RISK: a genuine failure normally CANCELS its siblings, so mixed failure+cancelled IS the shape of a real red — ANY `failure` present ⇒ FAILURE verdict (cancelled jobs may st...\n*2711│required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H1 (hertz 2026-08-02). Recipe-layer, so NO doc stage (the contract lives in the script's own comments) and NO int stage (the enforcement IS the golden.yml selftest step, itself already a gate). impl = the three-class split + SPT_CI_NOTIFY_LIB seam in .github/ci/ci-notify.sh; unit = .github/ci/ci-notify-selftest.sh (23 assertions incl. the failure+cancelled precedence row and the paired body-wording predicate with its positive control), wired at go...\n 2712│\n 2713│[[requirements]]\n 2714│id = \"REQ-GOLDEN-RESPIN-TEST\"\n\n# .github/\n\n## ci/\n### ws272-w0.py\n 38│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*39│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 40│# below must never be more lenient than the meter it stands in for.\n 41│FLOOR_BYTES = 32 << 30\n 42│# The perch identity a live agent's shell carries. A battery must never look\n### ws272-w1.py\n 44│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*45│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 46│# below must never be more lenient than the meter it stands in for.\n 47│FLOOR_BYTES = 32 << 30\n 48│# The perch identity a live agent's shell carries. A battery must never look\n### ws272-w2.py\n 51│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*52│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 53│# below must never be more lenient than the meter it stands in for.\n 54│FLOOR_BYTES = 32 << 30\n 55│# The perch identity a live agent's shell carries. A battery must never look\n\n## workflows/\n### ci.yml\n  38│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *39│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  40│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  41│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  42│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n  77│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *78│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  79│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  80│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  81│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 107│          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*108│          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 109│          if ($freeBytes -lt $floorBytes) {\n 110│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 111│            exit 1\n    │...\n 124│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*125│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 126│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 127│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 128│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 153│          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*154│          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 155│          if ($freeBytes -lt $floorBytes) {\n 156│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 157│            exit 1\n    │...\n 169│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*170│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 171│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 172│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 173│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 194│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*195│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 196│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 197│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 198│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 219│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*220│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 221│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 222│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 223│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 242│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*243│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 244│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 245│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 246│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 284│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*285│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 286│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 287│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 288│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n### golden.yml\n   46│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n  *47│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n   48│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n   49│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n   50│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n   69│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n  *70│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n   71│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n   72│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n   73│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n  232│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n *233│          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  234│          if ($freeBytes -lt $floorBytes) {\n  235│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  236│            exit 1\n     │...\n  248│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *249│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  250│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  251│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  252│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n  275│      # and lint set a reader is asking about.\n *276│      # [impl->REQ-CI-TOOLCHAIN-VERSION-PRINT]\n  277│      - name: Toolchain versions (Windows)\n  278│        if: runner.os == 'Windows'\n  279│        shell: pwsh\n     │...\n  303│          exit 0\n *304│      # [impl->REQ-CI-TOOLCHAIN-VERSION-PRINT]\n  305│      - name: Toolchain versions (Linux)\n  306│        if: runner.os == 'Linux'\n  307│        shell: bash\n     │...\n  608│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *609│          printf 'FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  610│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  611│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  612│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n  629│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n *630│          Write-Host \"FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  631│          if ($freeBytes -lt $floorBytes) {\n  632│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  633│            exit 1\n     │...\n  717│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n *718│          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  719│          if ($freeBytes -lt $floorBytes) {\n  720│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  721│            exit 1\n     │...\n  733│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *734│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  735│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  736│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  737│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n  855│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n *856│          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  857│          if ($freeBytes -lt $floorBytes) {\n  858│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  859│            exit 1\n     │...\n  871│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *872│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  873│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  874│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  875│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n  972│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n *973│          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  974│          if ($freeBytes -lt $floorBytes) {\n  975│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  976│            exit 1\n     │...\n  988│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *989│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  990│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  991│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  992│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n 1063│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*1064│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 1065│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 1066│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 1067│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n 1095│      # itself a finding.\n*1096│      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n 1097│      - name: Link health probe — peer hfenduleam (tailscale RTT)\n 1098│        if: always()\n 1099│        shell: bash\n     │...\n 1185│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*1186│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 1187│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 1188│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 1189│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n     │...\n 1236│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*1237│          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 1238│          if ($freeBytes -lt $floorBytes) {\n 1239│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 1240│            exit 1\n     │...\n 1263│      # itself a finding.\n*1264│      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n 1265│      - name: Link health probe — peer kitsubito (tailscale RTT)\n 1266│        if: always()\n 1267│        shell: pwsh\n     │...\n 1354│          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n*1355│          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 1356│          if ($freeBytes -lt $floorBytes) {\n 1357│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 1358│            exit 1\n### release.yml\n  63│          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n *64│          Write-Host \"FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n  65│          if ($freeBytes -lt $floorBytes) {\n  66│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n  67│            exit 1\n    │...\n  80│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n *81│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n  82│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n  83│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n  84│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 139│          $verdict = if ($freeBytes -lt $floorBytes) { 'RED' } else { 'PASS' }\n*140│          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n 141│          if ($freeBytes -lt $floorBytes) {\n 142│            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n 143│            exit 1\n    │...\n 155│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*156│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 157│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 158│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 159│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 179│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*180│          printf 'FLOOR_START job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 181│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 182│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 183│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n    │...\n 292│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n*293│          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n 294│            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n 295│          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n 296│            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n\n# crates/\n\n## xtask/src/\n### binedge.rs\n  *1│//! Fixture-bin build edges (IR-21 remedy (c), the ENFORCED form).\n   2│//!\n   3│//! ## The question it answers\n   4│//!\n    │...\n 604│/// REAL guarantee and manufacture a red — the tolerable direction for this\n*605│/// check, but still a false alarm on a correct recipe, and an enforced check\n 606│/// that cries wolf gets ignored. (No wrapped prebuild exists in the tree today:\n 607│/// the allowlist this produces is identical with and without the tolerance.)\n 608│fn shell_gap(s: &[u8]) -> usize {\n### main.rs\n 1183│mod patch_pin_tests {\n*1184│    const REV: &str = \"89a2200d54a4e3cab2f46cc75ebff49a1fb07614\";\n 1185│\n 1186│    fn manifest_with_pin() -> String {\n 1187│        format!(\n     │...\n 3025│///\n*3026│/// The CLAIM half of the build-cache pool guard (releases#103). Enforcement is\n 3027│/// a build script and is pure mechanism; the claim is the one part that is\n 3028│/// discipline, and it is written HERE, at lane start, rather than by any build.\n 3029│///\n\n## spt-poolguard/src/\n### lib.rs\n   54│//!\n  *55│//! ## Claim and enforcement are different jobs\n   56│//!\n   57│//! - **The lane CLAIM** is written at lane start by the rig (`cargo xtask\n   58│//!   pool-claim`) and names the lane's branch and base sha, plus a LONG-LIVED\n     │...\n   61│//!   would read as a live lane forever.\n  *62│//! - **The ENFORCEMENT** is a build script, which never claims a lane. It only\n  *63│//!   reads, decides, and refuses. That split is what keeps enforcement a\n   64│//!   mechanism while only the claim is discipline — and an unmade claim is\n   65│//!   LOUD (a refusal naming the command) rather than permissive.\n   66│//!\n     │...\n  108│/// process (the agent session or gate rig that ran the claim).\n *109│// [impl->REQ-POOL-LANE-IDENTITY]\n  110│#[derive(Debug, Clone, PartialEq, Eq)]\n  111│pub struct LaneClaim {\n  112│    /// Human label for the lane, for the refusal line.\n     │...\n  133│/// different question from \"did that lane finish\".\n *134│// [impl->REQ-POOL-LANE-IDENTITY]\n  135│#[derive(Debug, Clone, PartialEq, Eq)]\n  136│pub enum LaneState {\n  137│    /// The lane's tip is not contained in the integration head — work in\n     │...\n  223│/// discipline the holder arms already carry.\n *224│// [impl->REQ-POOL-LANE-IDENTITY]\n  225│pub fn decide_with(\n  226│    pool: &Path,\n  227│    this_tree: &Path,\n     │...\n  365│/// call a lane finished on the strength of a question it could not ask.\n *366│// [impl->REQ-POOL-LANE-IDENTITY]\n  367│pub fn git_lane_state(repo: &Path, claim: &LaneClaim) -> LaneState {\n  368│    // THE REPO-IDENTITY WITNESS, FIRST, AND EVERY ANSWER HANGS OFF IT. Only a\n  369│    // claimed base object present HERE can show that the repository being read\n     │...\n  642│/// affordance [`decide_with`] provides, for the same reason.\n *643│// [impl->REQ-POOL-LANE-IDENTITY]\n  644│pub fn classify_with(\n  645│    dir: &Path,\n  646│    inbound: usize,\n     │...\n 1234│    /// guard instead of around it.\n*1235│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1236│    #[test]\n 1237│    fn a_dead_holder_over_an_unlanded_lane_refuses_instead_of_taking_over() {\n 1238│        let p = pool();\n     │...\n 1281│    /// loudly. A guard that only ever added refusals would cost a pool per lane.\n*1282│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1283│    #[test]\n 1284│    fn a_landed_lane_with_a_dead_holder_is_still_a_takeover() {\n 1285│        let p = pool();\n     │...\n 1303│    /// — a NEW hazard invented by the fix.\n*1304│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1305│    #[test]\n 1306│    fn a_live_holder_refuses_even_when_the_lane_has_landed() {\n 1307│        let p = pool();\n     │...\n 1325│    /// upgrade becomes an incident.\n*1326│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1327│    #[test]\n 1328│    fn a_claim_with_no_git_identity_falls_back_and_names_the_fallback() {\n 1329│        let p = pool();\n     │...\n 1354│    /// a live lane's warm cache for deletion on this box.\n*1355│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1356│    #[test]\n 1357│    fn a_sweep_keeps_a_pool_whose_lane_is_in_flight_with_a_dead_holder() {\n 1358│        let d = pool();\n     │...\n 1388│    /// One row per arm is how that recurs; the invariant is the population.\n*1389│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1390│    #[test]\n 1391│    fn no_refusal_arm_names_a_command_that_cannot_be_run() {\n 1392│        let p = pool();\n     │...\n 1439│    /// what tells the two cases apart, and it must fail toward UNKNOWN.\n*1440│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1441│    #[test]\n 1442│    fn a_claim_from_another_repository_reads_unknown_not_settled() {\n 1443│        let repo = tempfile::tempdir().unwrap(); // not a git repository at all\n     │...\n 1458│    /// be a predicate nobody had ever run.\n*1459│    // [unit->REQ-POOL-LANE-IDENTITY]\n 1460│    #[test]\n 1461│    fn the_ancestry_probe_reads_a_real_repository_both_ways() {\n 1462│        let repo = tempfile::tempdir().unwrap();","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789094615840}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_P5jWKGZt06wtuuC2rbdcufKC|fc_074aee81620ae383016aa36ae257f487d1a9319c14fabb7913","toolName":"grep","startedAt":"2026-09-11T02:43:48.751Z","args":{"path":".github/ci/ci-notify.sh;.github/workflows/ci.yml;.github/workflows/golden.yml;crates/xtask/src/main.rs;.cargo;traceable-reqs.toml;docs/GOLDEN-CI.md;docs/RELEASE-RUNBOOK.md"},"intent":"Finding closure-specific source locations"},"id":"dc113214","parentId":"0aedc987","timestamp":"2026-09-11T02:43:48.751Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Nl8BtcxodFC5UY8BkbBpKgy5|fc_074aee81620ae383016aa36ae2580887d1bcea457834c5e352","toolName":"read","startedAt":"2026-09-11T02:43:48.751Z","args":{"path":"crates/spt-poolguard/src/lib.rs:367-443"},"intent":"Reading current pool ownership implementation"},"id":"326b004c","parentId":"dc113214","timestamp":"2026-09-11T02:43:48.751Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_zMCHqQmQVnoRJAHnWG2E0Mue|fc_074aee81620ae383016aa36ae2581087d18f3291c074d8e678","toolName":"read","startedAt":"2026-09-11T02:43:48.751Z","args":{"path":"crates/xtask/src/main.rs:3020-3130"},"intent":"Reading claim write and guard boundaries"},"id":"77453ce8","parentId":"326b004c","timestamp":"2026-09-11T02:43:48.751Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_j39AMk6DJgnXs9rBCFX1uyje|fc_074aee81620ae383016aa36ae2581887d1a2cd5feebac94c32","toolName":"read","startedAt":"2026-09-11T02:43:48.751Z","args":{"path":".github/workflows/golden.yml:593-640,703-744"},"intent":"Reading floor execution placement"},"id":"d89a6b2c","parentId":"77453ce8","timestamp":"2026-09-11T02:43:48.751Z"}
{"type":"message","id":"5ab845be","parentId":"d89a6b2c","timestamp":"2026-09-11T02:43:48.752Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Reading close 32/33**"},{"type":"toolCall","id":"call_P5jWKGZt06wtuuC2rbdcufKC|fc_074aee81620ae383016aa36ae257f487d1a9319c14fabb7913","name":"grep","arguments":{"i":"Finding closure-specific source locations","pattern":"placement|module_banner|traceable-reqs.*v|empty.*help|help.*empty|STACK|stack-size|stack_size|swarm.*pin|patch_pin|targeted.*update|per-block|CI SUCCESS|CI.*verdict|co.author|doyle only","path":".github/ci/ci-notify.sh;.github/workflows/ci.yml;.github/workflows/golden.yml;crates/xtask/src/main.rs;.cargo;traceable-reqs.toml;docs/GOLDEN-CI.md;docs/RELEASE-RUNBOOK.md","case":false,"gitignore":true,"skip":0},"intent":"Finding closure-specific source locations"},{"type":"toolCall","id":"call_Nl8BtcxodFC5UY8BkbBpKgy5|fc_074aee81620ae383016aa36ae2580887d1bcea457834c5e352","name":"read","arguments":{"i":"Reading current pool ownership implementation","path":"crates/spt-poolguard/src/lib.rs:367-443"},"intent":"Reading current pool ownership implementation"},{"type":"toolCall","id":"call_zMCHqQmQVnoRJAHnWG2E0Mue|fc_074aee81620ae383016aa36ae2581087d18f3291c074d8e678","name":"read","arguments":{"i":"Reading claim write and guard boundaries","path":"crates/xtask/src/main.rs:3020-3130"},"intent":"Reading claim write and guard boundaries"},{"type":"toolCall","id":"call_j39AMk6DJgnXs9rBCFX1uyje|fc_074aee81620ae383016aa36ae2581887d1a2cd5feebac94c32","name":"read","arguments":{"i":"Reading floor execution placement","path":".github/workflows/golden.yml:593-640,703-744"},"intent":"Reading floor execution placement"},{"type":"toolCall","id":"call_E99TJHPcm04v5zWfKHNBZYwc|fc_074aee81620ae383016aa36ae2582087d19ed59d627eb86798","name":"grep","arguments":{"i":"Finding rider reconciliation record","pattern":"CI-RIDER LANE STATE|1275e47|bf8c4a2|IR-37|IR-32|IR-33","path":"docs/INFRA-REGISTER.md:5000-5782","case":true,"gitignore":true,"skip":0},"intent":"Finding rider reconciliation record"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":15797,"output":374,"cacheRead":81152,"cacheWrite":0,"totalTokens":97323,"reasoningTokens":15,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094616180,"responseId":"resp_074aee81620ae383016aa36ad6116087d19a5139981673e7f6","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_074aee81620ae383016aa36ad71c1887d1aaf44f19006a2c88","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo2ri0rlYusWzP4x7z3zkcXIWKy1yJOhtv1QEj1yH1Vs7jKB9ZmnF8yW5DXE7qjYaehe96J2R0mXAB1XwTxQ2MHHSATQuWDITUKKAufag942xung3lTI5jP6pO00F26RJSM7dbEEVcLlsefRipuSmSWXxHOUicISCFhvRz6BED53fP1km3cKcwOeJhJJ0frnruPW-jKpB9TMD_lVA3zRZxW3Eo2QrQz-ZjK8CV2aret9DWq5ceOZQG1hp-OHanAgrnv97FCbSfgqWNp9dQOSSLwV17y8Aqj6dGf79gsQjF83QpG7E4J-OpzwGqpmAOSHxS6tWFoxQWNymIl_L4Yan-3eX0flTPFdJHSeWEsP82_a48B0KVWchcOF0Jf2sHkUK3thSPbd8thFajLod3cM54AMEFrBIybTV6dQV7khB7CSwSshs3jz-2o8Tyb4kWygMYsBoyHzEmf_6vN4l-brbSMEeIP-racIjAG1rIfJHVPwKNGx52--ZjEewDa-_y7vT1bWvYqlq8sxOygjMVHvwetoz07KpQf7jHPr4VfNoAlwJMi7Hj4pLpPgRWwvH_745_qMdpvtiGKgjqEXA9Yqyezq3z4WeZJePhGAraJKKly1qX9jnyx3u_qSxjUHWkMDlXvI5cU8gmESaWesjswUr4THXjLO3RYx_EGPwMHxfXbDjFTcdZYXPMJPNobDApdCGf2Fgg7hpaaF5o02TiCB8UGGMhxm3A12txk2s_aUMrgaoyV_stK_nX8qJKTg1SP9wj63nEW9RyrL7WxbIWmYYoAhPlhhmQxp2rOJ1k2QMlWV2AxM6Gdj4qTvpXY0YS_XBC72RSJJfv-T_M_sqz46VoRAAhIKIOjXIYjmBLf-wCZpDWNptdEW9bxWPTqSE8qA7cBhcvoE2XCC2ZKS9iVCkRr-E1qQfvIYKnpTCSVYod1ylrAR307n6OWBPE36OQfSOw0a0E8ZTipopojqhYwx4AtxDu3OEBZAHdTuGW9POyVngLUy3xukq2qjA6DOcSIfqpOnzFezOvExA2CCjAQYzlBCyypotGzZFdaTfFdf2cI-2_wfyojcJg8L_J0XsNNoAanYw202mXNxIFo2VN4NP9gAgHzKIBp4HxFdTDjPhIT7R10IJGBI_7qAKnzE425PA24o8UDZtzeoI211oSF6bNRCskHi2Tlk47XTJ2LJAuKObvmabN_Wu1xZTIR9sWWD2w3aoDSBr7ON1Thyd2c-OcN0AZ0c1uRHVrj_i5NGZlH18RmdVCjt3sNE9fJeABCF8iSDmm85mXoOPfIDLH0i2IWiHaGg307W-iDuT5BO-5zLhctQmhBFA926p4OdQwQLrGzNK","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"summary":[{"type":"summary_text","text":"**Reading close 32/33**"}],"metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ae257f487d1a9319c14fabb7913","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding closure-specific source locations\",\"pattern\":\"placement|module_banner|traceable-reqs.*v|empty.*help|help.*empty|STACK|stack-size|stack_size|swarm.*pin|patch_pin|targeted.*update|per-block|CI SUCCESS|CI.*verdict|co.author|doyle only\",\"path\":\".github/ci/ci-notify.sh;.github/workflows/ci.yml;.github/workflows/golden.yml;crates/xtask/src/main.rs;.cargo;traceable-reqs.toml;docs/GOLDEN-CI.md;docs/RELEASE-RUNBOOK.md\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_P5jWKGZt06wtuuC2rbdcufKC","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ae2580887d1bcea457834c5e352","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading current pool ownership implementation\",\"path\":\"crates/spt-poolguard/src/lib.rs:367-443\"}","call_id":"call_Nl8BtcxodFC5UY8BkbBpKgy5","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ae2581087d18f3291c074d8e678","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading claim write and guard boundaries\",\"path\":\"crates/xtask/src/main.rs:3020-3130\"}","call_id":"call_zMCHqQmQVnoRJAHnWG2E0Mue","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ae2581887d1a2cd5feebac94c32","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading floor execution placement\",\"path\":\".github/workflows/golden.yml:593-640,703-744\"}","call_id":"call_j39AMk6DJgnXs9rBCFX1uyje","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36ae2582087d19ed59d627eb86798","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding rider reconciliation record\",\"pattern\":\"CI-RIDER LANE STATE|1275e47|bf8c4a2|IR-37|IR-32|IR-33\",\"path\":\"docs/INFRA-REGISTER.md:5000-5782\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_E99TJHPcm04v5zWfKHNBZYwc","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":12568.653500000015,"ttft":1279.0142999999225,"completedAt":1789094628749,"contextSnapshot":{"promptTokens":96949,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_E99TJHPcm04v5zWfKHNBZYwc|fc_074aee81620ae383016aa36ae2582087d19ed59d627eb86798","toolName":"grep","startedAt":"2026-09-11T02:43:48.752Z","args":{"path":"docs/INFRA-REGISTER.md:5000-5782"},"intent":"Finding rider reconciliation record"},"id":"8a5d18e9","parentId":"5ab845be","timestamp":"2026-09-11T02:43:48.752Z"}
{"type":"message","id":"2d999005","parentId":"8a5d18e9","timestamp":"2026-09-11T02:43:48.766Z","message":{"role":"toolResult","toolCallId":"call_E99TJHPcm04v5zWfKHNBZYwc|fc_074aee81620ae383016aa36ae2582087d19ed59d627eb86798","toolName":"grep","content":[{"type":"text","text":"No matches found"}],"details":{"scopePath":"docs/INFRA-REGISTER.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":0,"fileCount":0,"files":[],"truncated":false},"isError":false,"useless":true,"timestamp":1789094628766}}
{"type":"message","id":"82e96323","parentId":"2d999005","timestamp":"2026-09-11T02:43:48.793Z","message":{"role":"toolResult","toolCallId":"call_Nl8BtcxodFC5UY8BkbBpKgy5|fc_074aee81620ae383016aa36ae2580887d1bcea457834c5e352","toolName":"read","content":[{"type":"text","text":"// [impl->REQ-POOL-LANE-IDENTITY]\npub fn git_lane_state(repo: &Path, claim: &LaneClaim) -> LaneState {\n    // THE REPO-IDENTITY WITNESS, FIRST, AND EVERY ANSWER HANGS OFF IT. Only a\n    // claimed base object present HERE can show that the repository being read\n    // is the one the lane lives in. Without it — a pre-identity claim, a branch\n    // recorded with no anchor, a stranger's repo, no git at all — every answer\n    // below would be a coincidence, and the dangerous coincidence is cheap: a\n    // branch absent from a DIFFERENT repository is absent for a reason that has\n    // nothing to do with the lane finishing. Caught by its own test, which read\n    // `Settled: branch no longer exists` out of a directory that was not a\n    // repository at all.\n    let anchored = claim\n        .base\n        .as_ref()\n        .is_some_and(|b| git_ok(repo, &[\"cat-file\", \"-e\", &format!(\"{b}^{{commit}}\")]));\n    if !anchored {\n        return LaneState::Unknown;\n    }\n    let tip = match &claim.branch {\n        Some(branch) => {\n            // FULLY QUALIFIED: a claim names a local branch, and a bare name\n            // would also resolve a tag or a path of the same spelling, which is\n            // a different object answering for the lane.\n            let git_ref = format!(\"refs/heads/{branch}\");\n            let Some(tip) = git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", &git_ref]) else {\n                return LaneState::Settled {\n                    reason: format!(\"lane branch {branch} no longer exists\"),\n                };\n            };\n            match claim.base.as_ref().map(|b| git_ancestry(repo, b, &tip)) {\n                // The branch still carries the work that claimed it.\n                None | Some(Some(true)) => {}\n                Some(Some(false)) => {\n                    return LaneState::Settled {\n                        reason: format!(\n                            \"branch {branch} no longer carries the claimed base {} — the \\\n                             branch name was re-pointed onto other work, which is the \\\n                             branch-level twin of a recycled pid\",\n                            short(claim.base.as_deref().unwrap_or_default())\n                        ),\n                    }\n                }\n                // The question failed rather than answered. A guess here would\n                // be a takeover bought with a broken probe.\n                Some(None) => return LaneState::Unknown,\n            }\n            tip\n        }\n        // A detached rig claims on its base sha alone, which is a lane identity\n        // too — it is the work, named directly.\n        None => match &claim.base {\n            Some(base) => base.clone(),\n            None => return LaneState::Unknown,\n        },\n    };\n    let Some((head_name, head)) = integration_head(repo) else {\n        return LaneState::Unknown;\n    };\n    match git_ancestry(repo, &tip, &head) {\n        Some(true) => LaneState::Settled {\n            reason: format!(\n                \"lane tip {} is contained in {head_name} — the lane landed\",\n                short(&tip)\n            ),\n        },\n        Some(false) => LaneState::InFlight {\n            reason: format!(\n                \"lane tip {} is NOT contained in {head_name} — the lane has not landed\",\n                short(&tip)\n            ),\n        },\n        None => LaneState::Unknown,\n    }\n}\n\n/// The ref a lane is measured as landed against, first that resolves.\nfn integration_head(repo: &Path) -> Option<(String, String)> {\n    [\"origin/main\", \"main\"]\n        .into_iter()\n        .find_map(|r| git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", r]).map(|s| (r.into(), s)))\n}\n\n[Showing lines 366-446 of 1538. Use :447 to continue]"}],"details":{"truncation":{"content":"// [impl->REQ-POOL-LANE-IDENTITY]\r\npub fn git_lane_state(repo: &Path, claim: &LaneClaim) -> LaneState {\r\n    // THE REPO-IDENTITY WITNESS, FIRST, AND EVERY ANSWER HANGS OFF IT. Only a\r\n    // claimed base object present HERE can show that the repository being read\r\n    // is the one the lane lives in. Without it — a pre-identity claim, a branch\r\n    // recorded with no anchor, a stranger's repo, no git at all — every answer\r\n    // below would be a coincidence, and the dangerous coincidence is cheap: a\r\n    // branch absent from a DIFFERENT repository is absent for a reason that has\r\n    // nothing to do with the lane finishing. Caught by its own test, which read\r\n    // `Settled: branch no longer exists` out of a directory that was not a\r\n    // repository at all.\r\n    let anchored = claim\r\n        .base\r\n        .as_ref()\r\n        .is_some_and(|b| git_ok(repo, &[\"cat-file\", \"-e\", &format!(\"{b}^{{commit}}\")]));\r\n    if !anchored {\r\n        return LaneState::Unknown;\r\n    }\r\n    let tip = match &claim.branch {\r\n        Some(branch) => {\r\n            // FULLY QUALIFIED: a claim names a local branch, and a bare name\r\n            // would also resolve a tag or a path of the same spelling, which is\r\n            // a different object answering for the lane.\r\n            let git_ref = format!(\"refs/heads/{branch}\");\r\n            let Some(tip) = git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", &git_ref]) else {\r\n                return LaneState::Settled {\r\n                    reason: format!(\"lane branch {branch} no longer exists\"),\r\n                };\r\n            };\r\n            match claim.base.as_ref().map(|b| git_ancestry(repo, b, &tip)) {\r\n                // The branch still carries the work that claimed it.\r\n                None | Some(Some(true)) => {}\r\n                Some(Some(false)) => {\r\n                    return LaneState::Settled {\r\n                        reason: format!(\r\n                            \"branch {branch} no longer carries the claimed base {} — the \\\r\n                             branch name was re-pointed onto other work, which is the \\\r\n                             branch-level twin of a recycled pid\",\r\n                            short(claim.base.as_deref().unwrap_or_default())\r\n                        ),\r\n                    }\r\n                }\r\n                // The question failed rather than answered. A guess here would\r\n                // be a takeover bought with a broken probe.\r\n                Some(None) => return LaneState::Unknown,\r\n            }\r\n            tip\r\n        }\r\n        // A detached rig claims on its base sha alone, which is a lane identity\r\n        // too — it is the work, named directly.\r\n        None => match &claim.base {\r\n            Some(base) => base.clone(),\r\n            None => return LaneState::Unknown,\r\n        },\r\n    };\r\n    let Some((head_name, head)) = integration_head(repo) else {\r\n        return LaneState::Unknown;\r\n    };\r\n    match git_ancestry(repo, &tip, &head) {\r\n        Some(true) => LaneState::Settled {\r\n            reason: format!(\r\n                \"lane tip {} is contained in {head_name} — the lane landed\",\r\n                short(&tip)\r\n            ),\r\n        },\r\n        Some(false) => LaneState::InFlight {\r\n            reason: format!(\r\n                \"lane tip {} is NOT contained in {head_name} — the lane has not landed\",\r\n                short(&tip)\r\n            ),\r\n        },\r\n        None => LaneState::Unknown,\r\n    }\r\n}\r\n\r\n/// The ref a lane is measured as landed against, first that resolves.\r\nfn integration_head(repo: &Path) -> Option<(String, String)> {\r\n    [\"origin/main\", \"main\"]\r\n        .into_iter()\r\n        .find_map(|r| git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", r]).map(|s| (r.into(), s)))\r\n}\r","truncated":true,"truncatedBy":"lines","totalLines":1173,"totalBytes":3777,"outputLines":81,"outputBytes":3777,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1538,"displayContent":{"text":"// [impl->REQ-POOL-LANE-IDENTITY]\r\npub fn git_lane_state(repo: &Path, claim: &LaneClaim) -> LaneState {\r\n    // THE REPO-IDENTITY WITNESS, FIRST, AND EVERY ANSWER HANGS OFF IT. Only a\r\n    // claimed base object present HERE can show that the repository being read\r\n    // is the one the lane lives in. Without it — a pre-identity claim, a branch\r\n    // recorded with no anchor, a stranger's repo, no git at all — every answer\r\n    // below would be a coincidence, and the dangerous coincidence is cheap: a\r\n    // branch absent from a DIFFERENT repository is absent for a reason that has\r\n    // nothing to do with the lane finishing. Caught by its own test, which read\r\n    // `Settled: branch no longer exists` out of a directory that was not a\r\n    // repository at all.\r\n    let anchored = claim\r\n        .base\r\n        .as_ref()\r\n        .is_some_and(|b| git_ok(repo, &[\"cat-file\", \"-e\", &format!(\"{b}^{{commit}}\")]));\r\n    if !anchored {\r\n        return LaneState::Unknown;\r\n    }\r\n    let tip = match &claim.branch {\r\n        Some(branch) => {\r\n            // FULLY QUALIFIED: a claim names a local branch, and a bare name\r\n            // would also resolve a tag or a path of the same spelling, which is\r\n            // a different object answering for the lane.\r\n            let git_ref = format!(\"refs/heads/{branch}\");\r\n            let Some(tip) = git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", &git_ref]) else {\r\n                return LaneState::Settled {\r\n                    reason: format!(\"lane branch {branch} no longer exists\"),\r\n                };\r\n            };\r\n            match claim.base.as_ref().map(|b| git_ancestry(repo, b, &tip)) {\r\n                // The branch still carries the work that claimed it.\r\n                None | Some(Some(true)) => {}\r\n                Some(Some(false)) => {\r\n                    return LaneState::Settled {\r\n                        reason: format!(\r\n                            \"branch {branch} no longer carries the claimed base {} — the \\\r\n                             branch name was re-pointed onto other work, which is the \\\r\n                             branch-level twin of a recycled pid\",\r\n                            short(claim.base.as_deref().unwrap_or_default())\r\n                        ),\r\n                    }\r\n                }\r\n                // The question failed rather than answered. A guess here would\r\n                // be a takeover bought with a broken probe.\r\n                Some(None) => return LaneState::Unknown,\r\n            }\r\n            tip\r\n        }\r\n        // A detached rig claims on its base sha alone, which is a lane identity\r\n        // too — it is the work, named directly.\r\n        None => match &claim.base {\r\n            Some(base) => base.clone(),\r\n            None => return LaneState::Unknown,\r\n        },\r\n    };\r\n    let Some((head_name, head)) = integration_head(repo) else {\r\n        return LaneState::Unknown;\r\n    };\r\n    match git_ancestry(repo, &tip, &head) {\r\n        Some(true) => LaneState::Settled {\r\n            reason: format!(\r\n                \"lane tip {} is contained in {head_name} — the lane landed\",\r\n                short(&tip)\r\n            ),\r\n        },\r\n        Some(false) => LaneState::InFlight {\r\n            reason: format!(\r\n                \"lane tip {} is NOT contained in {head_name} — the lane has not landed\",\r\n                short(&tip)\r\n            ),\r\n        },\r\n        None => LaneState::Unknown,\r\n    }\r\n}\r\n\r\n/// The ref a lane is measured as landed against, first that resolves.\r\nfn integration_head(repo: &Path) -> Option<(String, String)> {\r\n    [\"origin/main\", \"main\"]\r\n        .into_iter()\r\n        .find_map(|r| git_out(repo, &[\"rev-parse\", \"--verify\", \"--quiet\", r]).map(|s| (r.into(), s)))\r\n}\r","startLine":366,"lineNumbers":[366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446]},"fileSize":68960,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-poolguard\\src\\lib.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1538,"totalBytes":3777,"outputLines":81,"outputBytes":3777,"shownRange":{"start":366,"end":446},"nextOffset":447}}},"isError":false,"timestamp":1789094628793}}
{"type":"message","id":"8888ac30","parentId":"82e96323","timestamp":"2026-09-11T02:43:48.815Z","message":{"role":"toolResult","toolCallId":"call_zMCHqQmQVnoRJAHnWG2E0Mue|fc_074aee81620ae383016aa36ae2581087d18f3291c074d8e678","toolName":"read","content":[{"type":"text","text":"mod phase_a_profile_tests {\n…\n    fn the_checked_in_config_is_in_parity() {\n…\n    }\n}\n\n// ------------------------------------------------------- build-cache pool claim\n\n/// `xtask pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--foreign-pool]`\n///\n/// The CLAIM half of the build-cache pool guard (releases#103). Enforcement is\n/// a build script and is pure mechanism; the claim is the one part that is\n/// discipline, and it is written HERE, at lane start, rather than by any build.\n///\n/// WHY A LANE AND NOT A BUILD. The harm this guards is INTERLEAVING — one\n/// lane's artifacts invalidated by another between that lane's own steps — not\n/// simultaneity, which cargo's own `.cargo-lock` already prevents. So the\n/// holder must be a process that OUTLIVES a `cargo` invocation: the agent\n/// session or gate rig that owns the lane. Defaulting to this process would\n/// record an `xtask` that exits in milliseconds, and every later crossing would\n/// read the lane as finished — the silent-guard shape this design refused. So\n/// the default holder is this process's PARENT (the shell/session that ran the\n/// claim), and `--holder-pid` names one explicitly.\n///\n/// The birth stamp rides the claim because a pid alone is unsound across a\n/// reboot: a recycled pid would read as a live lane forever.\nfn pool_claim(args: &[String]) {\n    let pool = flag(args, \"--pool\").unwrap_or_else(|| {\n        eprintln!(\n            \"usage: xtask pool-claim --pool <dir> --label <lane> \\\n             [--holder-pid <pid>] [--foreign-pool]\"\n        );\n        std::process::exit(2);\n    });\n    let label = flag(args, \"--label\").unwrap_or_else(|| {\n        eprintln!(\"a claim needs a --label: it is what the refusal line names\");\n        std::process::exit(2);\n    });\n    let foreign_pool = args.iter().any(|arg| arg == \"--foreign-pool\");\n    let pid = match flag(args, \"--holder-pid\") {\n        Some(p) => p.parse::<u32>().unwrap_or_else(|_| {\n            eprintln!(\"--holder-pid must be a pid\");\n            std::process::exit(2);\n        }),\n        None => spt_poolguard::default_holder_pid(),\n    };\n    let started_at = spt_procident::process_started_at(pid);\n    if started_at.is_none() {\n        // Not fatal: a platform with no identity oracle still gets a claim, it\n        // just cannot prove pid reuse later. Said out loud rather than assumed.\n        eprintln!(\n            \"note: no birth stamp readable for pid {pid} — the claim cannot detect              a recycled pid on this platform\"\n        );\n    }\n    let pool = Path::new(&pool);\n    let tree = std::env::current_dir().expect(\"cwd\");\n    let tree_root = git_line(&tree, &[\"rev-parse\", \"--show-toplevel\"])\n        .map(PathBuf::from)\n        .unwrap_or_else(|| {\n            eprintln!(\n                \"pool claim refused: cwd {} is not inside a readable git worktree; \\\n                 lane identity cannot be harvested safely\",\n                tree.display()\n            );\n            std::process::exit(2);\n        });\n    let pool_path = absolute_pool(&tree, pool);\n    let pool_tree = pool_worktree(&pool_path).unwrap_or_else(|| {\n        eprintln!(\n            \"pool claim refused: --pool {} is not inside a readable git worktree (cwd {}). \\\n             Run pool-claim from the worktree that contains the pool\",\n            pool_path.display(),\n            tree.display()\n        );\n        std::process::exit(2);\n    });\n    // [impl->REQ-POOL-CLAIM-TREE-MATCH]\n    if !claim_trees_match(&tree_root, &pool_tree) {\n        if !foreign_pool {\n            eprintln!(\n                \"pool claim refused: --pool {} belongs to worktree {}, but cwd {} belongs to {}. \\\n                 Run pool-claim from the worktree that contains the pool, or pass --foreign-pool \\\n                 for a deliberate sequential takeover\",\n                pool_path.display(),\n                pool_tree.display(),\n                tree.display(),\n                tree_root.display()\n            );\n            std::process::exit(2);\n        }\n        eprintln!(\n            \"foreign pool takeover requested: claiming {} for cwd worktree {} \\\n             (pool worktree {})\",\n            pool_path.display(),\n            tree_root.display(),\n            pool_tree.display()\n        );\n    }\n    // THE LANE'S OWN IDENTITY, which is what the finished question is actually\n    // about. A detached rig has no branch and claims on its base sha alone.\n    let branch = git_line(&tree_root, &[\"symbolic-ref\", \"--quiet\", \"--short\", \"HEAD\"]);\n    let base = git_line(&tree_root, &[\"rev-parse\", \"HEAD\"]);\n    if base.is_none() {\n        eprintln!(\n            \"note: no git identity readable in {} — this claim can only be judged by its \\\n             holder pid, which is the predicate that reads a cleared agent session as a \\\n             finished lane\",\n            tree.display()\n        );\n    }\n    let owner = spt_poolguard::PoolOwner {\n        owner_tree: tree.to_string_lossy().to_string(),\n        lane: Some(spt_poolguard::LaneClaim {\n            label: label.clone(),\n            pid,\n            started_at,\n            branch: branch.clone(),\n            base: base.clone(),\n        }),\n    };\n…\n}\n\n[Showing lines 3019-3133 of 3565. Use :3134 to continue]"}],"details":{"truncation":{"content":"    }\r\n}\r\n\r\n// ------------------------------------------------------- build-cache pool claim\r\n\r\n/// `xtask pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--foreign-pool]`\r\n///\r\n/// The CLAIM half of the build-cache pool guard (releases#103). Enforcement is\r\n/// a build script and is pure mechanism; the claim is the one part that is\r\n/// discipline, and it is written HERE, at lane start, rather than by any build.\r\n///\r\n/// WHY A LANE AND NOT A BUILD. The harm this guards is INTERLEAVING — one\r\n/// lane's artifacts invalidated by another between that lane's own steps — not\r\n/// simultaneity, which cargo's own `.cargo-lock` already prevents. So the\r\n/// holder must be a process that OUTLIVES a `cargo` invocation: the agent\r\n/// session or gate rig that owns the lane. Defaulting to this process would\r\n/// record an `xtask` that exits in milliseconds, and every later crossing would\r\n/// read the lane as finished — the silent-guard shape this design refused. So\r\n/// the default holder is this process's PARENT (the shell/session that ran the\r\n/// claim), and `--holder-pid` names one explicitly.\r\n///\r\n/// The birth stamp rides the claim because a pid alone is unsound across a\r\n/// reboot: a recycled pid would read as a live lane forever.\r\nfn pool_claim(args: &[String]) {\r\n    let pool = flag(args, \"--pool\").unwrap_or_else(|| {\r\n        eprintln!(\r\n            \"usage: xtask pool-claim --pool <dir> --label <lane> \\\r\n             [--holder-pid <pid>] [--foreign-pool]\"\r\n        );\r\n        std::process::exit(2);\r\n    });\r\n    let label = flag(args, \"--label\").unwrap_or_else(|| {\r\n        eprintln!(\"a claim needs a --label: it is what the refusal line names\");\r\n        std::process::exit(2);\r\n    });\r\n    let foreign_pool = args.iter().any(|arg| arg == \"--foreign-pool\");\r\n    let pid = match flag(args, \"--holder-pid\") {\r\n        Some(p) => p.parse::<u32>().unwrap_or_else(|_| {\r\n            eprintln!(\"--holder-pid must be a pid\");\r\n            std::process::exit(2);\r\n        }),\r\n        None => spt_poolguard::default_holder_pid(),\r\n    };\r\n    let started_at = spt_procident::process_started_at(pid);\r\n    if started_at.is_none() {\r\n        // Not fatal: a platform with no identity oracle still gets a claim, it\r\n        // just cannot prove pid reuse later. Said out loud rather than assumed.\r\n        eprintln!(\r\n            \"note: no birth stamp readable for pid {pid} — the claim cannot detect              a recycled pid on this platform\"\r\n        );\r\n    }\r\n    let pool = Path::new(&pool);\r\n    let tree = std::env::current_dir().expect(\"cwd\");\r\n    let tree_root = git_line(&tree, &[\"rev-parse\", \"--show-toplevel\"])\r\n        .map(PathBuf::from)\r\n        .unwrap_or_else(|| {\r\n            eprintln!(\r\n                \"pool claim refused: cwd {} is not inside a readable git worktree; \\\r\n                 lane identity cannot be harvested safely\",\r\n                tree.display()\r\n            );\r\n            std::process::exit(2);\r\n        });\r\n    let pool_path = absolute_pool(&tree, pool);\r\n    let pool_tree = pool_worktree(&pool_path).unwrap_or_else(|| {\r\n        eprintln!(\r\n            \"pool claim refused: --pool {} is not inside a readable git worktree (cwd {}). \\\r\n             Run pool-claim from the worktree that contains the pool\",\r\n            pool_path.display(),\r\n            tree.display()\r\n        );\r\n        std::process::exit(2);\r\n    });\r\n    // [impl->REQ-POOL-CLAIM-TREE-MATCH]\r\n    if !claim_trees_match(&tree_root, &pool_tree) {\r\n        if !foreign_pool {\r\n            eprintln!(\r\n                \"pool claim refused: --pool {} belongs to worktree {}, but cwd {} belongs to {}. \\\r\n                 Run pool-claim from the worktree that contains the pool, or pass --foreign-pool \\\r\n                 for a deliberate sequential takeover\",\r\n                pool_path.display(),\r\n                pool_tree.display(),\r\n                tree.display(),\r\n                tree_root.display()\r\n            );\r\n            std::process::exit(2);\r\n        }\r\n        eprintln!(\r\n            \"foreign pool takeover requested: claiming {} for cwd worktree {} \\\r\n             (pool worktree {})\",\r\n            pool_path.display(),\r\n            tree_root.display(),\r\n            pool_tree.display()\r\n        );\r\n    }\r\n    // THE LANE'S OWN IDENTITY, which is what the finished question is actually\r\n    // about. A detached rig has no branch and claims on its base sha alone.\r\n    let branch = git_line(&tree_root, &[\"symbolic-ref\", \"--quiet\", \"--short\", \"HEAD\"]);\r\n    let base = git_line(&tree_root, &[\"rev-parse\", \"HEAD\"]);\r\n    if base.is_none() {\r\n        eprintln!(\r\n            \"note: no git identity readable in {} — this claim can only be judged by its \\\r\n             holder pid, which is the predicate that reads a cleared agent session as a \\\r\n             finished lane\",\r\n            tree.display()\r\n        );\r\n    }\r\n    let owner = spt_poolguard::PoolOwner {\r\n        owner_tree: tree.to_string_lossy().to_string(),\r\n        lane: Some(spt_poolguard::LaneClaim {\r\n            label: label.clone(),\r\n            pid,\r\n            started_at,\r\n            branch: branch.clone(),\r\n            base: base.clone(),\r","truncated":true,"truncatedBy":"lines","totalLines":547,"totalBytes":5197,"outputLines":115,"outputBytes":5197,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3565,"displayContent":{"text":"mod phase_a_profile_tests {\n…\n    fn the_checked_in_config_is_in_parity() {\n…\n    }\r\n}\r\n\r\n// ------------------------------------------------------- build-cache pool claim\r\n\r\n/// `xtask pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--foreign-pool]`\r\n///\r\n/// The CLAIM half of the build-cache pool guard (releases#103). Enforcement is\r\n/// a build script and is pure mechanism; the claim is the one part that is\r\n/// discipline, and it is written HERE, at lane start, rather than by any build.\r\n///\r\n/// WHY A LANE AND NOT A BUILD. The harm this guards is INTERLEAVING — one\r\n/// lane's artifacts invalidated by another between that lane's own steps — not\r\n/// simultaneity, which cargo's own `.cargo-lock` already prevents. So the\r\n/// holder must be a process that OUTLIVES a `cargo` invocation: the agent\r\n/// session or gate rig that owns the lane. Defaulting to this process would\r\n/// record an `xtask` that exits in milliseconds, and every later crossing would\r\n/// read the lane as finished — the silent-guard shape this design refused. So\r\n/// the default holder is this process's PARENT (the shell/session that ran the\r\n/// claim), and `--holder-pid` names one explicitly.\r\n///\r\n/// The birth stamp rides the claim because a pid alone is unsound across a\r\n/// reboot: a recycled pid would read as a live lane forever.\r\nfn pool_claim(args: &[String]) {\r\n    let pool = flag(args, \"--pool\").unwrap_or_else(|| {\r\n        eprintln!(\r\n            \"usage: xtask pool-claim --pool <dir> --label <lane> \\\r\n             [--holder-pid <pid>] [--foreign-pool]\"\r\n        );\r\n        std::process::exit(2);\r\n    });\r\n    let label = flag(args, \"--label\").unwrap_or_else(|| {\r\n        eprintln!(\"a claim needs a --label: it is what the refusal line names\");\r\n        std::process::exit(2);\r\n    });\r\n    let foreign_pool = args.iter().any(|arg| arg == \"--foreign-pool\");\r\n    let pid = match flag(args, \"--holder-pid\") {\r\n        Some(p) => p.parse::<u32>().unwrap_or_else(|_| {\r\n            eprintln!(\"--holder-pid must be a pid\");\r\n            std::process::exit(2);\r\n        }),\r\n        None => spt_poolguard::default_holder_pid(),\r\n    };\r\n    let started_at = spt_procident::process_started_at(pid);\r\n    if started_at.is_none() {\r\n        // Not fatal: a platform with no identity oracle still gets a claim, it\r\n        // just cannot prove pid reuse later. Said out loud rather than assumed.\r\n        eprintln!(\r\n            \"note: no birth stamp readable for pid {pid} — the claim cannot detect              a recycled pid on this platform\"\r\n        );\r\n    }\r\n    let pool = Path::new(&pool);\r\n    let tree = std::env::current_dir().expect(\"cwd\");\r\n    let tree_root = git_line(&tree, &[\"rev-parse\", \"--show-toplevel\"])\r\n        .map(PathBuf::from)\r\n        .unwrap_or_else(|| {\r\n            eprintln!(\r\n                \"pool claim refused: cwd {} is not inside a readable git worktree; \\\r\n                 lane identity cannot be harvested safely\",\r\n                tree.display()\r\n            );\r\n            std::process::exit(2);\r\n        });\r\n    let pool_path = absolute_pool(&tree, pool);\r\n    let pool_tree = pool_worktree(&pool_path).unwrap_or_else(|| {\r\n        eprintln!(\r\n            \"pool claim refused: --pool {} is not inside a readable git worktree (cwd {}). \\\r\n             Run pool-claim from the worktree that contains the pool\",\r\n            pool_path.display(),\r\n            tree.display()\r\n        );\r\n        std::process::exit(2);\r\n    });\r\n    // [impl->REQ-POOL-CLAIM-TREE-MATCH]\r\n    if !claim_trees_match(&tree_root, &pool_tree) {\r\n        if !foreign_pool {\r\n            eprintln!(\r\n                \"pool claim refused: --pool {} belongs to worktree {}, but cwd {} belongs to {}. \\\r\n                 Run pool-claim from the worktree that contains the pool, or pass --foreign-pool \\\r\n                 for a deliberate sequential takeover\",\r\n                pool_path.display(),\r\n                pool_tree.display(),\r\n                tree.display(),\r\n                tree_root.display()\r\n            );\r\n            std::process::exit(2);\r\n        }\r\n        eprintln!(\r\n            \"foreign pool takeover requested: claiming {} for cwd worktree {} \\\r\n             (pool worktree {})\",\r\n            pool_path.display(),\r\n            tree_root.display(),\r\n            pool_tree.display()\r\n        );\r\n    }\r\n    // THE LANE'S OWN IDENTITY, which is what the finished question is actually\r\n    // about. A detached rig has no branch and claims on its base sha alone.\r\n    let branch = git_line(&tree_root, &[\"symbolic-ref\", \"--quiet\", \"--short\", \"HEAD\"]);\r\n    let base = git_line(&tree_root, &[\"rev-parse\", \"HEAD\"]);\r\n    if base.is_none() {\r\n        eprintln!(\r\n            \"note: no git identity readable in {} — this claim can only be judged by its \\\r\n             holder pid, which is the predicate that reads a cleared agent session as a \\\r\n             finished lane\",\r\n            tree.display()\r\n        );\r\n    }\r\n    let owner = spt_poolguard::PoolOwner {\r\n        owner_tree: tree.to_string_lossy().to_string(),\r\n        lane: Some(spt_poolguard::LaneClaim {\r\n            label: label.clone(),\r\n            pid,\r\n            started_at,\r\n            branch: branch.clone(),\r\n            base: base.clone(),\r\n        }),\n    };\n…\n}","startLine":2946,"lineNumbers":[2946,null,3012,null,3019,3020,3021,3022,3023,3024,3025,3026,3027,3028,3029,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3044,3045,3046,3047,3048,3049,3050,3051,3052,3053,3054,3055,3056,3057,3058,3059,3060,3061,3062,3063,3064,3065,3066,3067,3068,3069,3070,3071,3072,3073,3074,3075,3076,3077,3078,3079,3080,3081,3082,3083,3084,3085,3086,3087,3088,3089,3090,3091,3092,3093,3094,3095,3096,3097,3098,3099,3100,3101,3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112,3113,3114,3115,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,null,3150]},"fileSize":151917,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3565,"totalBytes":5197,"outputLines":115,"outputBytes":5197,"shownRange":{"start":3019,"end":3133},"nextOffset":3134}}},"isError":false,"timestamp":1789094628814}}
{"type":"message","id":"762ceac3","parentId":"8888ac30","timestamp":"2026-09-11T02:43:48.818Z","message":{"role":"toolResult","toolCallId":"call_j39AMk6DJgnXs9rBCFX1uyje|fc_074aee81620ae383016aa36ae2581887d1a2cd5feebac94c32","toolName":"read","content":[{"type":"text","text":"      - name: Reap leaked workspace daemons before docs-drift build (Windows exe-lock guard)\n…\n      # The generated CLI reference must equal the binary's own --help, and\n      # every link in the curated llms.txt must resolve (agents cache links).\n      # The schema gate (checked_in_schema_is_current) already rides the\n      # normal test sweep.\n      # IR-46 / IR-73: reread immediately before the docs build; start headroom is stale.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK docs floor (Linux)\n        if: runner.os == 'Linux'\n        shell: bash\n        run: |\n          set -euo pipefail\n          floor_bytes=$((32 * 1024 * 1024 * 1024))\n          drive=$(df -P \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $1 }')\n          free_bytes=$(df -PB1 \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $4 }')\n          verdict=PASS\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n          printf 'FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n            exit 1\n          fi\n      # [int->REQ-DOCS-5]\n      - name: Docs drift gate (CLI ref + llms links) — linux\n        if: runner.os == 'Linux'\n        shell: bash\n        run: bash .github/bench/wrap.sh xtask-check -- cargo run -p xtask -- check\n      # IR-46 / IR-73: fresh native read, not the job-start value.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK docs floor (Windows)\n        if: runner.os == 'Windows'\n        shell: pwsh\n        run: |\n          $floorBytes = 32GB\n          $drive = (Get-Item $env:GITHUB_WORKSPACE).PSDrive\n          $freeBytes = [int64]$drive.Free\n          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n          Write-Host \"FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n          if ($freeBytes -lt $floorBytes) {\n            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n            exit 1\n          }\n      - name: Docs drift gate (CLI ref + llms links) — windows\n        if: runner.os == 'Windows'\n        shell: pwsh\n        run: .github/bench/wrap.ps1 -Step \"xtask-check\" -Command \"cargo run -p xtask -- check\"\n\n      # The book build stays CI-gated after docs-publish.yml's retirement\n…\n      # The runner default (`bash -e`) reads grep's status, which is the question asked.\n…\n      - name: Dormancy budget (real adapter seats, when installed) — windows\n…\n        run: |\n…\n            # terminator (the first tagged-run failure mode here).\n            Write-Output \"claude not installed on this runner - shell numbers only\"\n          }\n\n      # IR-46 / IR-59: measure the live end footprint even on failure, BEFORE teardown.\n      # This is an instantaneous floor assertion, not a sustained-floor claim.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK end floor (Windows)\n        if: always() && runner.os == 'Windows'\n        shell: pwsh\n        run: |\n          $floorBytes = 32GB\n          $drive = (Get-Item $env:GITHUB_WORKSPACE).PSDrive\n          $freeBytes = [int64]$drive.Free\n          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n          if ($freeBytes -lt $floorBytes) {\n            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n            exit 1\n          }\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK end floor (Linux)\n        if: always() && runner.os == 'Linux'\n        shell: bash\n        run: |\n          set -euo pipefail\n          floor_bytes=$((32 * 1024 * 1024 * 1024))\n          drive=$(df -P \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $1 }')\n          free_bytes=$(df -PB1 \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $4 }')\n          verdict=PASS\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n            exit 1\n          fi\n\n      # ---- Load-flake cause-side leg 1: POST-JOB REAP + END census ----\n      # [impl->REQ-CI-POSTJOB-DAEMON-REAP]\n      #\n      # THIS IS THE CAUSE-SIDE FIX, and it has to live HERE — inside the job — for a reason\n…\n      # is clean, strict becomes the default, and this wave does not close on warn-only."}],"details":{"displayContent":{"text":"      - name: Reap leaked workspace daemons before docs-drift build (Windows exe-lock guard)\n…\n      # The generated CLI reference must equal the binary's own --help, and\n      # every link in the curated llms.txt must resolve (agents cache links).\n      # The schema gate (checked_in_schema_is_current) already rides the\n      # normal test sweep.\n      # IR-46 / IR-73: reread immediately before the docs build; start headroom is stale.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK docs floor (Linux)\n        if: runner.os == 'Linux'\n        shell: bash\n        run: |\n          set -euo pipefail\n          floor_bytes=$((32 * 1024 * 1024 * 1024))\n          drive=$(df -P \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $1 }')\n          free_bytes=$(df -PB1 \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $4 }')\n          verdict=PASS\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n          printf 'FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n            exit 1\n          fi\n      # [int->REQ-DOCS-5]\n      - name: Docs drift gate (CLI ref + llms links) — linux\n        if: runner.os == 'Linux'\n        shell: bash\n        run: bash .github/bench/wrap.sh xtask-check -- cargo run -p xtask -- check\n      # IR-46 / IR-73: fresh native read, not the job-start value.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK docs floor (Windows)\n        if: runner.os == 'Windows'\n        shell: pwsh\n        run: |\n          $floorBytes = 32GB\n          $drive = (Get-Item $env:GITHUB_WORKSPACE).PSDrive\n          $freeBytes = [int64]$drive.Free\n          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n          Write-Host \"FLOOR_DOCS job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n          if ($freeBytes -lt $floorBytes) {\n            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n            exit 1\n          }\n      - name: Docs drift gate (CLI ref + llms links) — windows\n        if: runner.os == 'Windows'\n        shell: pwsh\n        run: .github/bench/wrap.ps1 -Step \"xtask-check\" -Command \"cargo run -p xtask -- check\"\n\n      # The book build stays CI-gated after docs-publish.yml's retirement\n…\n      # The runner default (`bash -e`) reads grep's status, which is the question asked.\n…\n      - name: Dormancy budget (real adapter seats, when installed) — windows\n…\n        run: |\n…\n            # terminator (the first tagged-run failure mode here).\n            Write-Output \"claude not installed on this runner - shell numbers only\"\n          }\n\n      # IR-46 / IR-59: measure the live end footprint even on failure, BEFORE teardown.\n      # This is an instantaneous floor assertion, not a sustained-floor claim.\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK end floor (Windows)\n        if: always() && runner.os == 'Windows'\n        shell: pwsh\n        run: |\n          $floorBytes = 32GB\n          $drive = (Get-Item $env:GITHUB_WORKSPACE).PSDrive\n          $freeBytes = [int64]$drive.Free\n          $verdict = if ($freeBytes -lt $floorBytes) { \"RED\" } else { \"PASS\" }\n          Write-Host \"FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=$freeBytes floor_bytes=$floorBytes verdict=$verdict sample=INSTANT\"\n          if ($freeBytes -lt $floorBytes) {\n            Write-Error \"RESOURCE=disk drive=$($drive.Root) free_bytes=$freeBytes floor_bytes=$floorBytes\"\n            exit 1\n          }\n      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n      - name: DISK end floor (Linux)\n        if: always() && runner.os == 'Linux'\n        shell: bash\n        run: |\n          set -euo pipefail\n          floor_bytes=$((32 * 1024 * 1024 * 1024))\n          drive=$(df -P \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $1 }')\n          free_bytes=$(df -PB1 \"$GITHUB_WORKSPACE\" | awk 'NR == 2 { print $4 }')\n          verdict=PASS\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then verdict=RED; fi\n          printf 'FLOOR_END job=${{ github.job }} runner=${{ runner.os }} free_bytes=%s floor_bytes=%s verdict=%s sample=INSTANT\\n' \\\n            \"$free_bytes\" \"$floor_bytes\" \"$verdict\"\n          if [ \"$free_bytes\" -lt \"$floor_bytes\" ]; then\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n            exit 1\n          fi\n\n      # ---- Load-flake cause-side leg 1: POST-JOB REAP + END census ----\n      # [impl->REQ-CI-POSTJOB-DAEMON-REAP]\n      #\n      # THIS IS THE CAUSE-SIDE FIX, and it has to live HERE — inside the job — for a reason\n…\n      # is clean, strict becomes the default, and this wave does not close on warn-only.","startLine":587,"lineNumbers":[587,null,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,null,650,null,690,null,693,null,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,null,760]},"fileSize":87519,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.github\\workflows\\golden.yml"}}},"isError":false,"timestamp":1789094628817}}
{"type":"message","id":"166717b4","parentId":"762ceac3","timestamp":"2026-09-11T02:43:48.894Z","message":{"role":"toolResult","toolCallId":"call_P5jWKGZt06wtuuC2rbdcufKC|fc_074aee81620ae383016aa36ae257f487d1a9319c14fabb7913","toolName":"grep","content":[{"type":"text","text":"# traceable-reqs.toml\n 178|title = \"Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` carries only parent_pid + session_id (+ optional cwd), no --adapter — a pure \\\"a harness session exists at this pid\\\" record; --adapter becomes an OPTIONAL override across the whole api group (an explicit name[:profile] for adapter dev, never required). Omitted, listen/poll resolve the owning adapter/profile AT BIND as a pure read against the live registry — never a seed-time snapshot that can ...\n*179|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated v0.9.0 W1-W2 (LiveAgent/listen): doc = CONTEXT.md §171/§177-181 (adapter-agnostic seed + bind-time resolution) + docs-site harness-contract/api.md + docs/MANIFEST.md SessionStart hook. impl = adapter-agnostic Seed (seed.rs drops adapter) + cmd_seed + --adapter Option across the api group (api/mod.rs ApiArgs/Ctx/resolve_ctx_manifest) + bind-time resolution in cmd_listen (explicit override else resolve::resolve_bind_adapter) feeding both the i...\n 180|\n 181|# ───────────────────────────── Endpoints / Shells ───────────────────────────\n 182|[[requirements]]\n...\n 459|id = \"REQ-UPD-6\"\n*460|title = \"Platform-targeted update sets and debug rollout: signed multi-platform update metadata, recipient platform selection, channel-scoped monotonic counters, debug-channel opt-in via release-key overlay, local staging plus pull-based peer propagation, and maintainer-only convergence tooling (ADR-0016)\"\n 461|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated 2026-06-06: first slice = signed update-set metadata + verification, platform artifact selection, cache/propagation/apply compatibility, maintainer xtask helpers. int activated M8-D4 (decision 19): xtask debug-converge watcher per docs/DEBUG-CONVERGE-PLAN.md — status-only query on the update wire + loopback convergence test\n 462|[[requirements]]\n 463|id = \"REQ-UPD-7\"\n...\n 472|title = \"`gh_release` adapter [update] avenue (optional signing): an adapter declares `[update] avenue = \\\"gh_release\\\", repo = \\\"user/repo\\\"` (+ optional `asset`, default `adapter.spt`; + optional Ed25519 `signing_key`); spt-core's ripple compares the repo's LATEST GitHub release version against the installed adapter version and, when newer, auto-updates by fetching the release `.spt` archive (the REQ-INSTALL-9 `--release` fetch primitive) → verifies the `.spt` against `signing_key` if declared, else ...\n*473|required_stages = [\"doc\", \"impl\", \"unit\"]  # activate v0.8.0: doc = CONTEXT.md \"adapter update declaration\" gh_release avenue + docs/MANIFEST.md [update] gh_release block (the <asset>.sig keyed-verify convention). impl = UpdateAvenue::GhRelease variant + `asset` field + gh_release required-fields validation (repo required; asset/signing_key optional) (manifest.rs) + GhRelease→Pointer register mode (registry.rs) + plan_adapter_update stays PURE (gh_release → Skipped::GhReleaseManaged, no fetch) + spt_...\n 474|\n 475|# ───────────────────────────── Terminal wrapper / frontend ──────────────────\n 476|[[requirements]]\n...\n 499|# End-state target [doc, impl, unit, int]; activated per-wave as evidence lands\n*500|# (rule 2: traceable-reqs check EXIT=0 every commit — stages match evidence, never\n 501|# pre-activated). doc landed with the MANIFEST [digest] section; int landed Wave 4 E2E.\n 502|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]\n 503|[[requirements]]\n...\n 582|id = \"REQ-PICK-FIDELITY-AUDIT\"\n*583|title = \"AN ASSEMBLY PICK MUST BE AUDITED FOR FIDELITY ON ITS CHANGED-LINE SET, AND THE COUNT AND DIGEST ARMS MUST BE REPORTED AS SEPARATE VERDICTS BECAUSE THEY FAIL IN OPPOSITE DIRECTIONS. MEASURED on the TURNKEY #212 assembly (IR-57): a cherry-pick's conflict resolution silently dropped exactly two lines and the assembled head did not compile, while every instrument in the assembly path reported success -- the pick completed with no conflict remaining, traceable-reqs check returned 797/797 exit 0 becau...\n 584|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED at build start (todlando, 2026-08-29), IR-57 tooling rider. doc = docs/instruments/ir57/STATUS.md, carried as a stage rather than a courtesy because an instrument nobody can find is reported as absent by whoever needed it; impl = the xtask pick-audit verb and its changed-line/classify/exit-code core; unit = both verdict classes driven end to end against real temp repositories, plus the pairing and exit-contract arms. int stays inactive: the integrati...\n 585|\n 586|[[requirements]]\n 587|id = \"REQ-DISK-FLOOR-PREFLIGHT\"\n*588|title = \"A RIG OR GATE RUN MUST RECORD FREE SPACE AT RUN START, AND REFUSE TO START UNDER A FLOOR. MEASURED (IR-59): a full volume reds as a LINKER defect that names no disk -- LNK1318 Unexpected PDB error with a varying parenthesised code, beside LNK4209 debugging information corrupt, and once as a traceable-reqs check PANIC carrying os error 112, so even a REGISTRY red can be the disk's. Nothing in any of those failure texts says disk, two agents spent hours on a mechanism for one of them, and neither ...\n 589|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED at build start (todlando, 2026-08-29), IR-59 log-the-floor rider. doc = docs/instruments/ir59/STATUS.md; impl = the xtask disk-floor verb, its line shape and its floor predicate; unit = the printed keys pinned as text, both floor arms, print-only mode, and a real read against a real directory. int stays inactive: the integration subject is a gate run under a genuinely low volume, which is the incident this exists to make interpretable rather than a c...\n 590|\n 591|[[requirements]]\n 592|id = \"REQ-POOL-GC-ORPHAN-RECLAIM\"\n*593|title = \"BUILD-CACHE POOLS ARE RECLAIMABLE ON EVIDENCE, NOT ON AGE OR NAME. Cargo never GCs a target directory and pools OUTLIVE the lanes that made them: this box carried gate-target-h1 at 17.5 GB with ZERO links pointing at it -- unreachable, unowned, and un-reclaimable by any mechanism that existed, because nothing recorded whose it was. The ownership stamp supplies the missing facts, so a sweep can classify rather than guess: IN USE (a lane holder live by the process-table-plus-birth-stamp predicate)...\n 594|required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 leg 2 (hertz, 2026-08-02), releases#103. Classification is pure and unit-covered in spt-poolguard; the sweep/reap shell is xtask pool-sweep. gate-target-h1 was this requirement's motivating row and was reaped by hand under the same discipline before the code existed.\n 595|\n 596|[[requirements]]\n...\n 619|id = \"REQ-KICK-1\"\n*620|title = \"Explicit, loud controller displacement: `spt rc kick <target>` / `--take` (Take intent) kicks the incumbent controller and becomes controller; the displaced controller receives a LOUD `Displaced{by}` notice and is FULLY DETACHED (not demoted to a viewer). A default attach to a controlled endpoint is NEVER a silent displace (it is the Control busy-refusal). An old (N-1) rc omits intent → Control, so it can drive a free endpoint but CANNOT `--take` — it can never silently steal, and gets a cle...\n 621|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated M12-W2.5 (int: cross-daemon displace → displaced controller observes the loud notice + detach, the taker becomes controller)\n 622|# --- Added 2026-06-17 (v0.10.0 picker-status slice, operator-flagged + doyle dispatch); rule 3 register-before-satisfy ---\n 623|[[requirements]]\n...\n 786|title = \"Non-interactive install path: the install path doubles as every adapter's pack-in on-demand install (no second mechanism); sha256-verified fetch; user-PATH registration. HISTORY: 'the canonical one-liner' — since THE-FORKENING (ADR-0036) the canonical path is gh + the spt install verb (itself non-interactive, REQ-INSTALL-BOOTSTRAP-VERB); the scripts this REQ's evidence attests remain as the hermetic CI fixture + air-gap fallback, still non-interactive by construction (doyle-ratified 2026-07-14).\"\n*787|required_stages = [\"impl\", \"int\"]  # activated M6-D2: install.sh/install.ps1 non-interactive by construction (zero prompts; env knobs only — pipeable `curl|sh` / `irm|iex` cannot take args); SPT_INSTALL_ASSET_BASE is the CI/air-gap fetch override; sha256 verified against the release SHA256SUMS, mismatch refuses before placement. int = oneliner_e2e on both runners incl. the tamper-refusal negative rung\n 788|[[requirements]]\n 789|id = \"REQ-INSTALL-9\"\n 790|title = \"Adapter add from a GitHub release archive: `spt adapter add --release <user/repo> [--tag <tag>] [--asset <name>]` fetches a `.spt` tar asset over HTTPS+GitHub trust, extracts it to the durable adapters/_github home, and registers the root — ships built binaries source-free and versioned (the distribution path for an adapter whose dev repo is a monorepo subdir, where --github root-only clone does not fit)\"\n...\n 797|id = \"REQ-INSTALL-11\"\n*798|title = \"Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.spt`-shipped binary (dropped to adapters/_github/<safe>/ by --release/--github acquisition, or kept in the source_dir under copy-mode where only manifest+strings/ are copied to adapters/<name>) runs without any PATH placement — a bare-name template token (e.g. `claude-spt-digest ...`) is rewritten to <install_dir>/<program>(.exe on Windows) when that file exists, else left bare for the PATH fallb...\n 799|required_stages = [\"doc\", \"impl\", \"unit\"]  # activate v0.8.0: doc = CONTEXT.md model-level-facts install-dir-resolution bullet + docs/MANIFEST.md [session.<role>] install-dir note. impl = a resolution helper in spt-runtime (beside run_bounded_command) rewriting a command template's first token to the install-dir-absolute path when present (Windows .exe suffix; PATH fallback when absent), applied at the [digest] extractor exec site + the [session.psyche_init] runner exec site (perri's two; install_dir = A...\n 800|[[requirements]]\n 801|id = \"REQ-INSTALL-12\"\n...\n 1280|id = \"REQ-INSTALL-7\"\n*1281|title = \"Windows inbound reachability: the install path RECONCILES the product inbound-UDP firewall rule onto the binder it places — create when missing, REPOINT when the rule names a different image, and report which it did — and the daemon self-detects blocked inbound and renders it as the no-connection state in subnet status + the coming-online banner (covers user-scope installs that skip the elevated leg — never a silent NO_SEED_HOLDER dead-end) (M8 root cause 3). AMENDED BY REPLACEMENT (releas...\n*1282|required_stages = [\"doc\", \"impl\", \"unit\"]  # activated M8-D3: install.ps1 firewall leg (elevated = netsh add rule [delete-first idempotence; netsh not New-NetFirewallRule for PS5.1 hardened boxes]; unelevated = prints the exact elevated command; SPT_INSTALL_NO_FIREWALL gates CI) + the render half: cli inbound_block_hint — a BOUNDED netsh probe (KH 5.3, 3s) for the named rule, rendered in subnet status + the coming-online banner only when the rule is ABSENT (a failed probe says nothing, never alarms). P...\n 1283|[[requirements]]\n 1284|id = \"REQ-INSTALL-8\"\n 1285|title = \"OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install leg; daemon starts at boot pre-login, user universe per KH 5.7, systemctl --user managed); Windows scheduled task at-logon (interactive session, no stored credentials); a node is reachable after reboot without any manual spt invocation (M8 decision 17)\"\n...\n 1319|id = \"REQ-DAEMON-9\"\n*1320|title = \"Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed — e.g. the systemd unit autostarted before the network/DNS stack was ready, `Failed to create an address lookup service`) must SELF-HEAL — retry the net bring-up in the background with capped backoff and, on success, attach net to the broker + spawn the dispatcher/peer-pump (which today are gated on `net_up` at boot and so never start, leaving the node silently unreachable until a manual restart — kitsubi...\n 1321|required_stages = [\"impl\", \"unit\"]  # activate v0.3.1. impl = Broker.net → OnceLock<NetHost> + attach_net(); Daemon::run factors spawn_net_consumers(), fast-path attaches at boot, slow-path spawns a background NetHost::start retry supervisor (capped backoff) that attaches + spawns consumers on success (NET_BIND_RETRY/NET_ATTACHED logs); cmd_daemon_status renders net-less as 'no connection' + treats a heartbeat older than daemon start as 'no tick yet' not a giant age; install.sh unit gains network-onlin...\n 1322|# --- Added 2026-06-16 (v0.8.1): perri's v0.8.0 dogfood surfaced a harness-hosted live agent that goes ONLINE but never gets a Psyche on a net-less/unpaired node (boot-race); rule 3 register-before-satisfy, rule 5 activate per wave as evidence lands ---\n 1323|[[requirements]]\n...\n 1401|title = \"The `spt endpoint run` picker shows project history for FRESH endpoints (operator-raised v0.12.0 real-harness finding). Symptom: a fresh endpoint shows no project history in the picker. ROOT TBD — investigate the project-history loader (v0.10.0 PICKER-2, picker/data.rs) before fixing: distinguish a real loader bug from 'fresh = no history yet' semantics. (v0.12.1)\"\n*1402|required_stages = [\"impl\", \"unit\"]  # ACTIVATED v0.12.1 Wave 3 P1 (todlando; doyle ruling Option A, operator looped in). FINDING: NOT a loader bug — the branch-enumeration loader (project_history_for) is correct. SEMANTICS gap: \"project history\" = projects with COMMITTED context, so a FRESH endpoint (no context branch yet) is excluded from the Project category (model.rs:533) even when created/running IN the current project. RULING: an endpoint belongs to a project if CREATED there (cwd origin) OR has c...\n 1403|[[requirements]]\n 1404|id = \"REQ-PICKER-ONLINE-ACTION\"\n 1405|title = \"The `spt endpoint run` picker shows the correct action for an ALREADY-ONLINE endpoint — Attach, NOT 'Start now' (operator-raised v0.12.0 real-harness finding). Symptom: the picker offers 'Start now' for endpoints that are already online. ROOT TBD — investigate the status→action mapping (v0.10.0 PICKER-1 four-state status, picker/model.rs): is it reading live/online state correctly, or rendering stale/wedged broker state (i.e. partly a symptom of the broker wedge / status=online latch)? Fix...\n...\n 1409|title = \"`spt endpoint list` always merges this node's LOCAL (unadvertised) perches into the view; the `--local` flag is REMOVED (operator decision 2026-06-17). Rationale: `spt whoami` is a thin alias of `endpoint list` — a just-online agent running `whoami` must see its OWN perch, or it gets an omitted-self view ('chaos'). FIX: drop the `--local` flag + its `--detail` conflict test + the v0.10.0 REQ-PICKER-5 hint line (cli.rs:1678) + cmd_list_local; the bare list merges local perches into the subnet v...\n*1410|required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED v0.12.1 Wave 4 E1 (todlando). doc = CONTEXT.md \"endpoint list always merges local perches\" note. impl = cmd_endpoint_list always appends print_local_section (LOCAL roster) after SELF pin + subnet groups; the `--local` flag + its conflicts_with + cmd_list_local + the two `--local` hint lines are REMOVED; cmd_whoami calls the 2-arg cmd_endpoint_list. unit = local_section_always_renders_local_perches (pure render_local_section: an unadvertised perch —...\n 1411|[[requirements]]\n 1412|id = \"REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT\"\n 1413|title = \"A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY output. KEYSTONE — the operator's central 'attach shows no output' symptom, reproduced on the real dummy-harness fixture (v0.12.1 Wave 1) with NO death and NO wedge: bringup succeeds (online, harness pid alive + heartbeating, psyche hosted), the attach CONNECTS (PUMP_IPC_READER spawned, no RC_FAIL, holds the full window) — but receives EXACTLY 0 bytes over 10s of the harness's flushed [sessio...\n...\n 1418|id = \"REQ-CLI-HELP-MARKDOWN\"\n*1419|title = \"`spt --help` (and every subcommand --help) renders the inline Markdown authored in the clap doc-comments as terminal styling, never as literal markers: `**bold**` → ANSI bold, `` `code` `` → ANSI cyan, `[text](url)` → `text`. The markers are STRIPPED either way — a raw `**` or backtick must NEVER reach the user (the operator-reported v0.12.0 defect: help text reads `**ctrl-b**` and stray backticks verbatim). Color/bold escapes are emitted ONLY when the help is going to a real terminal AN...\n*1420|required_stages = [\"impl\", \"unit\"]  # activated v0.12.1: impl = spt/src/helpfmt.rs render() (pure marker transform: bold/code/link, ANSI-CSI passthrough, line-bounded, unmatched-literal) + stdout_color() decision (IsTerminal && NO_COLOR unset && CLICOLOR!=0, CLICOLOR_FORCE overrides) + emit_clap_error() intercepting clap ErrorKind::DisplayHelp / DisplayHelpOnMissingArgumentOrSubcommand at cli::run try_get_matches_mut, plus bare_invocation render_help() path. unit = bold→ansi & code→ansi (color) vs st...\n 1421|\n 1422|# ───────────────────────────── v0.12.2 daemon-start no-window regression ──────────────────\n 1423|[[requirements]]\n...\n 1521|title = \"An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC is lost — do NOT rely on the detach signal (same lesson as REQ-HAZARD-HOSTED-LIVENESS-RECONCILE B2): the reconcile loop clears `driven_by` when the endpoint has no live controller/session. Today a wedged or lost pump never delivers the detach, so the endpoint stays latched CONTROLLED forever. Composes with W1 (the wedge no longer blocks the detach) and rides the same pull-primary reconcile substr...\n*1522|required_stages = [\"impl\", \"unit\", \"int\"]  # ACTIVATED v0.13.0 W5 (repro-first, todlando). SCOPE landed = Gap B (no-session self-heal): reconcile_hosted_liveness, when it offlines a sessionless controllable perch (B2 keystone), ALSO clears a stale driven_by (set_driven_by None) — an OFFLINE endpoint can no longer render phantom CONTROLLED. RACE-FREE (no live session ⇒ no controller to re-stamp concurrently). impl = livehost.rs reconcile_hosted_liveness Gap-B clear + the additive SessionInfo.controlle...\n 1523|\n 1524|# ── KH 7.15's CLIENT-SIDE half: the reader refuses on a stamp whose writer is dead ──\n 1525|[[requirements]]\n 1526|id = \"REQ-RC-DRIVER-READ-LIVENESS\"\n*1527|title = \"The rc client's busy-refuse reads a LIVE driver, never a stale stamp (kin to REQ-HAZARD-DRIVEN-BY-SELFHEAL / KH 7.15, observed from the CLIENT side; instrumented x20 2026-08-19, doyle-ruled same day). MECHANISM, measured not inferred: `driven_by` is broker-owned and EVERY clear of it lives in the daemon (broker stamp_reaped, converge_perch_stamps, the livehost reconcile belt), while the write that makes a stopped perch read `offline` is `terminal_normalize` — run SYNCHRONOUSLY in the `spt endp...\n 1528|required_stages = [\"impl\", \"unit\"]  # ACTIVATED with the ER bring-up residual fix (todlando 2026-08-19, doyle BUILD-GO). No int by ruling: the fix must make the EXISTING bring-up cell's offline arm green unchanged.\n 1529|\n 1530|# ── W5 follow-up: the idle wedged-REMOTE-controller latch (A2, repro-proven, deferred) ──\n...\n 1533|title = \"An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delivers the detach) AND whose session is IDLE (no output) stays latched ONLINE+CONTROLLED forever: the W1 drain-evict only fires on OUTPUT (CONTROLLER_WRITE_DEADLINE on a backed-up write), a clean disconnect self-heals via detach_if→clear_controller, but an idle session with a half-open/wedged controller connection produces neither signal. PROVED repr...\n*1534|required_stages = [\"int\"]  # W2 ACTIVATED on build/daemon-lifecycle-w2 (todlando 2026-07-22) — INSTRUMENT-FIRST: int is the measurement leg (with its clean-FIN sibling probe); impl/unit activate only if the measurement shows the heal is absent (doyle dispatch, outcome (b)). MEASURED 2026-07-22, crates/spt-daemon/tests/transport_death_eof.rs, OUTCOME (a): on REAL QUIC (two brokers, BindScope::Loopback + a real net_dial — NOT the in-process duplex, which has no idle timeout) a no-FIN transport death DO...\n 1535|\n 1536|# ── W7 (operator /diagnose 2026-06-19): rc Backspace key forwards the wrong byte ──\n 1537|[[requirements]]\n\n# .github/\n\n## ci/\n### ci-notify.sh\n 27|# unannounced. Silence from this informant is therefore ambiguous by\n*28|# construction; it is a convenience layer over polling, never a replacement for\n 29|# a receiver's own check.\n 30|# ============================================================================\n 31|#\n...\n 33|# daemon, a missing `spt`, an unreachable recipient, a WEDGED send — none of these\n*34|# may ever red a CI run. The gate's verdict is the gate's; this script only\n 35|# reports it.\n 36|#\n 37|# The time half is not theoretical (2026-07-27, this script's debut run and its\n...\n 129|compose_body() {\n*130|  echo \"CI $verdict — ${GITHUB_REPOSITORY##*/} @ ${GITHUB_REF_NAME:-<unknown ref>}\"\n 131|  [ -n \"$PR_NUMBER\" ] && echo \"PR: #$PR_NUMBER\"\n 132|  echo \"sha: $(printf '%.12s' \"$GITHUB_SHA\")\"\n 133|  [ -n \"$failing\" ] && echo \"failing: $failing\"\n...\n 179|\n*180|echo \"ci-notify: verdict $verdict${failing:+ (failing: $failing)}${cancelled:+ (cancelled: $cancelled)}\"\n 181|\n 182|# --- recipients ------------------------------------------------------------\n 183|# doyle always (he gates and merges). Plus a best-effort trailer parse off the\n*184|# head commit: this project's commits end `Co-authored by: <agent>` — note the\n 185|# SPACE. That spelling is this repo's agent-name convention (CLAUDE.md), and it\n 186|# is the only one matched on purpose: git's standard hyphenated\n*187|# `Co-authored-by: Some Human <addr>` names a person or a tool, not a perch, so\n 188|# matching it would mint junk recipients (a real commit on this branch's history\n 189|# yields \"OpenAICodex\" that way). Absent or unparseable => skipped, never an error.\n 190|FROM_LABEL=\"CI-$(printf '%s' \"$RUNNER_NAME\" | tr '[:lower:]' '[:upper:]' | tr -cs '[:alnum:]' '-')\"\n...\n 193|trailer=\"$(git log -1 --pretty=%B 2>/dev/null |\n*194|  sed -n 's/^Co-authored by:[[:space:]]*\\([^<]*\\).*$/\\1/Ip' |\n 195|  tail -n 1 |\n 196|  sed 's/[[:space:]]*$//; s/^[[:space:]]*//')\"\n 197|if [ -n \"$trailer\" ] && [ \"$trailer\" != \"doyle\" ]; then\n...\n 199|else\n*200|  echo \"ci-notify: no distinct co-author trailer on the head commit — doyle only\"\n 201|fi\n 202|\n 203|# --- send ------------------------------------------------------------------\n\n## workflows/\n### golden.yml\n 353|      # healthy run looks like.\n*354|      - name: CI notifier verdict selftest\n 355|        if: runner.os == 'Linux'\n 356|        shell: bash\n 357|        run: bash .github/ci/ci-notify-selftest.sh\n...\n 1052|      - uses: actions/checkout@v5\n*1053|      # IR-46: retain the reviewed post-checkout placement; sample is an INSTANT.\n 1054|      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n 1055|      - name: DISK start floor\n 1056|        shell: bash\n...\n 1429|          fi\n*1430|          ./traceable-reqs --version\n 1431|        env:\n 1432|          # Cross-org private repo: the default repo-scoped GITHUB_TOKEN cannot\n 1433|          # read BigscreenVR/traceable-reqs. Supply a PAT with read access to it\n...\n 1483|      # The head commit (not the PR merge commit) — the script reads its\n*1484|      # `Co-authored by:` trailer to find the second recipient.\n 1485|      - uses: actions/checkout@v5\n 1486|        with:\n 1487|          ref: ${{ github.event.pull_request.head.sha || github.sha }}\n\n# crates/xtask/src/\n## main.rs\n 47|            // A lapsed load-bearing pin is knowable before any of that is spent.\n*48|            check_load_bearing_patch_pins();\n 49|            gen(true);\n 50|            scan_published_docs_for_internal_codes();\n 51|            check_llms_links();\n...\n 1046|// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN]\n*1047|fn check_load_bearing_patch_pins() {\n 1048|    let root = repo_root();\n 1049|    let manifest = std::fs::read_to_string(root.join(\"Cargo.toml\"))\n 1050|        .expect(\"Cargo.toml (the [patch.crates-io] stanzas)\");\n...\n 1182|#[cfg(test)]\n*1183|mod patch_pin_tests {\n 1184|    const REV: &str = \"89a2200d54a4e3cab2f46cc75ebff49a1fb07614\";\n 1185|\n 1186|    fn manifest_with_pin() -> String {\n...\n 2726|        let hits = forbidden_codes_in(text);\n*2727|        assert!(hits.is_empty(), \"clean help must pass, got: {hits:?}\");\n 2728|    }\n 2729|}\n 2730|\n\n# docs/\n## RELEASE-RUNBOOK.md\n 304|\n*305|   Do not stack a thin release PR on the ruled golden tip. Its tag would point\n 306|   at a commit no golden run tested—the exact unvalidated-release-commit failure\n 307|   the dedicated-PR rule intended to prevent. The dedicated release PR form is\n 308|   therefore retired under golden CI; its release-shape gate is preserved as a\n...\n 502|   the NEWEST sha's run plus any run that had already begun; an intermediate\n*503|   sha's thin-CI verdict may simply not exist, and its absence is supersession,\n 504|   not evidence of anything about that sha. A started run's record IS preserved,\n 505|   and it is still not the same claim as the record being authoritative.\n 506|   **Preservation is not deference.** (Filed as IR-41 in\n...\n 598|   primary seed is stored in the **machine-scope** `SPT_RELEASE_SEED` variable,\n*599|   and the operator has ruled that placement deliberate and permanent. Publish\n 600|   there with the raw-env form — run `release-publish` **without**\n 601|   `SPT_RELEASE_SEED_CMD` set, so `xtask` falls back to reading\n 602|   `SPT_RELEASE_SEED` — and **do not remove the variable.** This is a recorded\n\nSkipped missing paths: .cargo\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".github/ci/ci-notify.sh, .github/workflows/ci.yml, .github/workflows/golden.yml, crates/xtask/src/main.rs, traceable-reqs.toml, docs/GOLDEN-CI.md, docs/RELEASE-RUNBOOK.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":39,"fileCount":5,"files":[".github/ci/ci-notify.sh",".github/workflows/golden.yml","crates/xtask/src/main.rs","traceable-reqs.toml","docs/RELEASE-RUNBOOK.md"],"fileMatches":[{"path":".github/ci/ci-notify.sh","count":8},{"path":".github/workflows/golden.yml","count":4},{"path":"crates/xtask/src/main.rs","count":4},{"path":"traceable-reqs.toml","count":20},{"path":"docs/RELEASE-RUNBOOK.md","count":3}],"truncated":true,"perFileLimitReached":20,"displayContent":"# traceable-reqs.toml\n  178│title = \"Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` carries only parent_pid + session_id (+ optional cwd), no --adapter — a pure \\\"a harness session exists at this pid\\\" record; --adapter becomes an OPTIONAL override across the whole api group (an explicit name[:profile] for adapter dev, never required). Omitted, listen/poll resolve the owning adapter/profile AT BIND as a pure read against the live registry — never a seed-time snapshot that can ...\n *179│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated v0.9.0 W1-W2 (LiveAgent/listen): doc = CONTEXT.md §171/§177-181 (adapter-agnostic seed + bind-time resolution) + docs-site harness-contract/api.md + docs/MANIFEST.md SessionStart hook. impl = adapter-agnostic Seed (seed.rs drops adapter) + cmd_seed + --adapter Option across the api group (api/mod.rs ApiArgs/Ctx/resolve_ctx_manifest) + bind-time resolution in cmd_listen (explicit override else resolve::resolve_bind_adapter) feeding both the i...\n  180│\n  181│# ───────────────────────────── Endpoints / Shells ───────────────────────────\n  182│[[requirements]]\n     │...\n  459│id = \"REQ-UPD-6\"\n *460│title = \"Platform-targeted update sets and debug rollout: signed multi-platform update metadata, recipient platform selection, channel-scoped monotonic counters, debug-channel opt-in via release-key overlay, local staging plus pull-based peer propagation, and maintainer-only convergence tooling (ADR-0016)\"\n  461│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated 2026-06-06: first slice = signed update-set metadata + verification, platform artifact selection, cache/propagation/apply compatibility, maintainer xtask helpers. int activated M8-D4 (decision 19): xtask debug-converge watcher per docs/DEBUG-CONVERGE-PLAN.md — status-only query on the update wire + loopback convergence test\n  462│[[requirements]]\n  463│id = \"REQ-UPD-7\"\n     │...\n  472│title = \"`gh_release` adapter [update] avenue (optional signing): an adapter declares `[update] avenue = \\\"gh_release\\\", repo = \\\"user/repo\\\"` (+ optional `asset`, default `adapter.spt`; + optional Ed25519 `signing_key`); spt-core's ripple compares the repo's LATEST GitHub release version against the installed adapter version and, when newer, auto-updates by fetching the release `.spt` archive (the REQ-INSTALL-9 `--release` fetch primitive) → verifies the `.spt` against `signing_key` if declared, else ...\n *473│required_stages = [\"doc\", \"impl\", \"unit\"]  # activate v0.8.0: doc = CONTEXT.md \"adapter update declaration\" gh_release avenue + docs/MANIFEST.md [update] gh_release block (the <asset>.sig keyed-verify convention). impl = UpdateAvenue::GhRelease variant + `asset` field + gh_release required-fields validation (repo required; asset/signing_key optional) (manifest.rs) + GhRelease→Pointer register mode (registry.rs) + plan_adapter_update stays PURE (gh_release → Skipped::GhReleaseManaged, no fetch) + spt_...\n  474│\n  475│# ───────────────────────────── Terminal wrapper / frontend ──────────────────\n  476│[[requirements]]\n     │...\n  499│# End-state target [doc, impl, unit, int]; activated per-wave as evidence lands\n *500│# (rule 2: traceable-reqs check EXIT=0 every commit — stages match evidence, never\n  501│# pre-activated). doc landed with the MANIFEST [digest] section; int landed Wave 4 E2E.\n  502│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]\n  503│[[requirements]]\n     │...\n  582│id = \"REQ-PICK-FIDELITY-AUDIT\"\n *583│title = \"AN ASSEMBLY PICK MUST BE AUDITED FOR FIDELITY ON ITS CHANGED-LINE SET, AND THE COUNT AND DIGEST ARMS MUST BE REPORTED AS SEPARATE VERDICTS BECAUSE THEY FAIL IN OPPOSITE DIRECTIONS. MEASURED on the TURNKEY #212 assembly (IR-57): a cherry-pick's conflict resolution silently dropped exactly two lines and the assembled head did not compile, while every instrument in the assembly path reported success -- the pick completed with no conflict remaining, traceable-reqs check returned 797/797 exit 0 becau...\n  584│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED at build start (todlando, 2026-08-29), IR-57 tooling rider. doc = docs/instruments/ir57/STATUS.md, carried as a stage rather than a courtesy because an instrument nobody can find is reported as absent by whoever needed it; impl = the xtask pick-audit verb and its changed-line/classify/exit-code core; unit = both verdict classes driven end to end against real temp repositories, plus the pairing and exit-contract arms. int stays inactive: the integrati...\n  585│\n  586│[[requirements]]\n  587│id = \"REQ-DISK-FLOOR-PREFLIGHT\"\n *588│title = \"A RIG OR GATE RUN MUST RECORD FREE SPACE AT RUN START, AND REFUSE TO START UNDER A FLOOR. MEASURED (IR-59): a full volume reds as a LINKER defect that names no disk -- LNK1318 Unexpected PDB error with a varying parenthesised code, beside LNK4209 debugging information corrupt, and once as a traceable-reqs check PANIC carrying os error 112, so even a REGISTRY red can be the disk's. Nothing in any of those failure texts says disk, two agents spent hours on a mechanism for one of them, and neither ...\n  589│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED at build start (todlando, 2026-08-29), IR-59 log-the-floor rider. doc = docs/instruments/ir59/STATUS.md; impl = the xtask disk-floor verb, its line shape and its floor predicate; unit = the printed keys pinned as text, both floor arms, print-only mode, and a real read against a real directory. int stays inactive: the integration subject is a gate run under a genuinely low volume, which is the incident this exists to make interpretable rather than a c...\n  590│\n  591│[[requirements]]\n  592│id = \"REQ-POOL-GC-ORPHAN-RECLAIM\"\n *593│title = \"BUILD-CACHE POOLS ARE RECLAIMABLE ON EVIDENCE, NOT ON AGE OR NAME. Cargo never GCs a target directory and pools OUTLIVE the lanes that made them: this box carried gate-target-h1 at 17.5 GB with ZERO links pointing at it -- unreachable, unowned, and un-reclaimable by any mechanism that existed, because nothing recorded whose it was. The ownership stamp supplies the missing facts, so a sweep can classify rather than guess: IN USE (a lane holder live by the process-table-plus-birth-stamp predicate)...\n  594│required_stages = [\"impl\", \"unit\"]  # ACTIVATED BAROMETER H3 leg 2 (hertz, 2026-08-02), releases#103. Classification is pure and unit-covered in spt-poolguard; the sweep/reap shell is xtask pool-sweep. gate-target-h1 was this requirement's motivating row and was reaped by hand under the same discipline before the code existed.\n  595│\n  596│[[requirements]]\n     │...\n  619│id = \"REQ-KICK-1\"\n *620│title = \"Explicit, loud controller displacement: `spt rc kick <target>` / `--take` (Take intent) kicks the incumbent controller and becomes controller; the displaced controller receives a LOUD `Displaced{by}` notice and is FULLY DETACHED (not demoted to a viewer). A default attach to a controlled endpoint is NEVER a silent displace (it is the Control busy-refusal). An old (N-1) rc omits intent → Control, so it can drive a free endpoint but CANNOT `--take` — it can never silently steal, and gets a cle...\n  621│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"]  # activated M12-W2.5 (int: cross-daemon displace → displaced controller observes the loud notice + detach, the taker becomes controller)\n  622│# --- Added 2026-06-17 (v0.10.0 picker-status slice, operator-flagged + doyle dispatch); rule 3 register-before-satisfy ---\n  623│[[requirements]]\n     │...\n  786│title = \"Non-interactive install path: the install path doubles as every adapter's pack-in on-demand install (no second mechanism); sha256-verified fetch; user-PATH registration. HISTORY: 'the canonical one-liner' — since THE-FORKENING (ADR-0036) the canonical path is gh + the spt install verb (itself non-interactive, REQ-INSTALL-BOOTSTRAP-VERB); the scripts this REQ's evidence attests remain as the hermetic CI fixture + air-gap fallback, still non-interactive by construction (doyle-ratified 2026-07-14).\"\n *787│required_stages = [\"impl\", \"int\"]  # activated M6-D2: install.sh/install.ps1 non-interactive by construction (zero prompts; env knobs only — pipeable `curl|sh` / `irm|iex` cannot take args); SPT_INSTALL_ASSET_BASE is the CI/air-gap fetch override; sha256 verified against the release SHA256SUMS, mismatch refuses before placement. int = oneliner_e2e on both runners incl. the tamper-refusal negative rung\n  788│[[requirements]]\n  789│id = \"REQ-INSTALL-9\"\n  790│title = \"Adapter add from a GitHub release archive: `spt adapter add --release <user/repo> [--tag <tag>] [--asset <name>]` fetches a `.spt` tar asset over HTTPS+GitHub trust, extracts it to the durable adapters/_github home, and registers the root — ships built binaries source-free and versioned (the distribution path for an adapter whose dev repo is a monorepo subdir, where --github root-only clone does not fit)\"\n     │...\n  797│id = \"REQ-INSTALL-11\"\n *798│title = \"Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.spt`-shipped binary (dropped to adapters/_github/<safe>/ by --release/--github acquisition, or kept in the source_dir under copy-mode where only manifest+strings/ are copied to adapters/<name>) runs without any PATH placement — a bare-name template token (e.g. `claude-spt-digest ...`) is rewritten to <install_dir>/<program>(.exe on Windows) when that file exists, else left bare for the PATH fallb...\n  799│required_stages = [\"doc\", \"impl\", \"unit\"]  # activate v0.8.0: doc = CONTEXT.md model-level-facts install-dir-resolution bullet + docs/MANIFEST.md [session.<role>] install-dir note. impl = a resolution helper in spt-runtime (beside run_bounded_command) rewriting a command template's first token to the install-dir-absolute path when present (Windows .exe suffix; PATH fallback when absent), applied at the [digest] extractor exec site + the [session.psyche_init] runner exec site (perri's two; install_dir = A...\n  800│[[requirements]]\n  801│id = \"REQ-INSTALL-12\"\n     │...\n 1280│id = \"REQ-INSTALL-7\"\n*1281│title = \"Windows inbound reachability: the install path RECONCILES the product inbound-UDP firewall rule onto the binder it places — create when missing, REPOINT when the rule names a different image, and report which it did — and the daemon self-detects blocked inbound and renders it as the no-connection state in subnet status + the coming-online banner (covers user-scope installs that skip the elevated leg — never a silent NO_SEED_HOLDER dead-end) (M8 root cause 3). AMENDED BY REPLACEMENT (releas...\n*1282│required_stages = [\"doc\", \"impl\", \"unit\"]  # activated M8-D3: install.ps1 firewall leg (elevated = netsh add rule [delete-first idempotence; netsh not New-NetFirewallRule for PS5.1 hardened boxes]; unelevated = prints the exact elevated command; SPT_INSTALL_NO_FIREWALL gates CI) + the render half: cli inbound_block_hint — a BOUNDED netsh probe (KH 5.3, 3s) for the named rule, rendered in subnet status + the coming-online banner only when the rule is ABSENT (a failed probe says nothing, never alarms). P...\n 1283│[[requirements]]\n 1284│id = \"REQ-INSTALL-8\"\n 1285│title = \"OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install leg; daemon starts at boot pre-login, user universe per KH 5.7, systemctl --user managed); Windows scheduled task at-logon (interactive session, no stored credentials); a node is reachable after reboot without any manual spt invocation (M8 decision 17)\"\n     │...\n 1319│id = \"REQ-DAEMON-9\"\n*1320│title = \"Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed — e.g. the systemd unit autostarted before the network/DNS stack was ready, `Failed to create an address lookup service`) must SELF-HEAL — retry the net bring-up in the background with capped backoff and, on success, attach net to the broker + spawn the dispatcher/peer-pump (which today are gated on `net_up` at boot and so never start, leaving the node silently unreachable until a manual restart — kitsubi...\n 1321│required_stages = [\"impl\", \"unit\"]  # activate v0.3.1. impl = Broker.net → OnceLock<NetHost> + attach_net(); Daemon::run factors spawn_net_consumers(), fast-path attaches at boot, slow-path spawns a background NetHost::start retry supervisor (capped backoff) that attaches + spawns consumers on success (NET_BIND_RETRY/NET_ATTACHED logs); cmd_daemon_status renders net-less as 'no connection' + treats a heartbeat older than daemon start as 'no tick yet' not a giant age; install.sh unit gains network-onlin...\n 1322│# --- Added 2026-06-16 (v0.8.1): perri's v0.8.0 dogfood surfaced a harness-hosted live agent that goes ONLINE but never gets a Psyche on a net-less/unpaired node (boot-race); rule 3 register-before-satisfy, rule 5 activate per wave as evidence lands ---\n 1323│[[requirements]]\n     │...\n 1401│title = \"The `spt endpoint run` picker shows project history for FRESH endpoints (operator-raised v0.12.0 real-harness finding). Symptom: a fresh endpoint shows no project history in the picker. ROOT TBD — investigate the project-history loader (v0.10.0 PICKER-2, picker/data.rs) before fixing: distinguish a real loader bug from 'fresh = no history yet' semantics. (v0.12.1)\"\n*1402│required_stages = [\"impl\", \"unit\"]  # ACTIVATED v0.12.1 Wave 3 P1 (todlando; doyle ruling Option A, operator looped in). FINDING: NOT a loader bug — the branch-enumeration loader (project_history_for) is correct. SEMANTICS gap: \"project history\" = projects with COMMITTED context, so a FRESH endpoint (no context branch yet) is excluded from the Project category (model.rs:533) even when created/running IN the current project. RULING: an endpoint belongs to a project if CREATED there (cwd origin) OR has c...\n 1403│[[requirements]]\n 1404│id = \"REQ-PICKER-ONLINE-ACTION\"\n 1405│title = \"The `spt endpoint run` picker shows the correct action for an ALREADY-ONLINE endpoint — Attach, NOT 'Start now' (operator-raised v0.12.0 real-harness finding). Symptom: the picker offers 'Start now' for endpoints that are already online. ROOT TBD — investigate the status→action mapping (v0.10.0 PICKER-1 four-state status, picker/model.rs): is it reading live/online state correctly, or rendering stale/wedged broker state (i.e. partly a symptom of the broker wedge / status=online latch)? Fix...\n     │...\n 1409│title = \"`spt endpoint list` always merges this node's LOCAL (unadvertised) perches into the view; the `--local` flag is REMOVED (operator decision 2026-06-17). Rationale: `spt whoami` is a thin alias of `endpoint list` — a just-online agent running `whoami` must see its OWN perch, or it gets an omitted-self view ('chaos'). FIX: drop the `--local` flag + its `--detail` conflict test + the v0.10.0 REQ-PICKER-5 hint line (cli.rs:1678) + cmd_list_local; the bare list merges local perches into the subnet v...\n*1410│required_stages = [\"doc\", \"impl\", \"unit\"]  # ACTIVATED v0.12.1 Wave 4 E1 (todlando). doc = CONTEXT.md \"endpoint list always merges local perches\" note. impl = cmd_endpoint_list always appends print_local_section (LOCAL roster) after SELF pin + subnet groups; the `--local` flag + its conflicts_with + cmd_list_local + the two `--local` hint lines are REMOVED; cmd_whoami calls the 2-arg cmd_endpoint_list. unit = local_section_always_renders_local_perches (pure render_local_section: an unadvertised perch —...\n 1411│[[requirements]]\n 1412│id = \"REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT\"\n 1413│title = \"A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY output. KEYSTONE — the operator's central 'attach shows no output' symptom, reproduced on the real dummy-harness fixture (v0.12.1 Wave 1) with NO death and NO wedge: bringup succeeds (online, harness pid alive + heartbeating, psyche hosted), the attach CONNECTS (PUMP_IPC_READER spawned, no RC_FAIL, holds the full window) — but receives EXACTLY 0 bytes over 10s of the harness's flushed [sessio...\n     │...\n 1418│id = \"REQ-CLI-HELP-MARKDOWN\"\n*1419│title = \"`spt --help` (and every subcommand --help) renders the inline Markdown authored in the clap doc-comments as terminal styling, never as literal markers: `**bold**` → ANSI bold, `` `code` `` → ANSI cyan, `[text](url)` → `text`. The markers are STRIPPED either way — a raw `**` or backtick must NEVER reach the user (the operator-reported v0.12.0 defect: help text reads `**ctrl-b**` and stray backticks verbatim). Color/bold escapes are emitted ONLY when the help is going to a real terminal AN...\n*1420│required_stages = [\"impl\", \"unit\"]  # activated v0.12.1: impl = spt/src/helpfmt.rs render() (pure marker transform: bold/code/link, ANSI-CSI passthrough, line-bounded, unmatched-literal) + stdout_color() decision (IsTerminal && NO_COLOR unset && CLICOLOR!=0, CLICOLOR_FORCE overrides) + emit_clap_error() intercepting clap ErrorKind::DisplayHelp / DisplayHelpOnMissingArgumentOrSubcommand at cli::run try_get_matches_mut, plus bare_invocation render_help() path. unit = bold→ansi & code→ansi (color) vs st...\n 1421│\n 1422│# ───────────────────────────── v0.12.2 daemon-start no-window regression ──────────────────\n 1423│[[requirements]]\n     │...\n 1521│title = \"An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC is lost — do NOT rely on the detach signal (same lesson as REQ-HAZARD-HOSTED-LIVENESS-RECONCILE B2): the reconcile loop clears `driven_by` when the endpoint has no live controller/session. Today a wedged or lost pump never delivers the detach, so the endpoint stays latched CONTROLLED forever. Composes with W1 (the wedge no longer blocks the detach) and rides the same pull-primary reconcile substr...\n*1522│required_stages = [\"impl\", \"unit\", \"int\"]  # ACTIVATED v0.13.0 W5 (repro-first, todlando). SCOPE landed = Gap B (no-session self-heal): reconcile_hosted_liveness, when it offlines a sessionless controllable perch (B2 keystone), ALSO clears a stale driven_by (set_driven_by None) — an OFFLINE endpoint can no longer render phantom CONTROLLED. RACE-FREE (no live session ⇒ no controller to re-stamp concurrently). impl = livehost.rs reconcile_hosted_liveness Gap-B clear + the additive SessionInfo.controlle...\n 1523│\n 1524│# ── KH 7.15's CLIENT-SIDE half: the reader refuses on a stamp whose writer is dead ──\n 1525│[[requirements]]\n 1526│id = \"REQ-RC-DRIVER-READ-LIVENESS\"\n*1527│title = \"The rc client's busy-refuse reads a LIVE driver, never a stale stamp (kin to REQ-HAZARD-DRIVEN-BY-SELFHEAL / KH 7.15, observed from the CLIENT side; instrumented x20 2026-08-19, doyle-ruled same day). MECHANISM, measured not inferred: `driven_by` is broker-owned and EVERY clear of it lives in the daemon (broker stamp_reaped, converge_perch_stamps, the livehost reconcile belt), while the write that makes a stopped perch read `offline` is `terminal_normalize` — run SYNCHRONOUSLY in the `spt endp...\n 1528│required_stages = [\"impl\", \"unit\"]  # ACTIVATED with the ER bring-up residual fix (todlando 2026-08-19, doyle BUILD-GO). No int by ruling: the fix must make the EXISTING bring-up cell's offline arm green unchanged.\n 1529│\n 1530│# ── W5 follow-up: the idle wedged-REMOTE-controller latch (A2, repro-proven, deferred) ──\n     │...\n 1533│title = \"An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delivers the detach) AND whose session is IDLE (no output) stays latched ONLINE+CONTROLLED forever: the W1 drain-evict only fires on OUTPUT (CONTROLLER_WRITE_DEADLINE on a backed-up write), a clean disconnect self-heals via detach_if→clear_controller, but an idle session with a half-open/wedged controller connection produces neither signal. PROVED repr...\n*1534│required_stages = [\"int\"]  # W2 ACTIVATED on build/daemon-lifecycle-w2 (todlando 2026-07-22) — INSTRUMENT-FIRST: int is the measurement leg (with its clean-FIN sibling probe); impl/unit activate only if the measurement shows the heal is absent (doyle dispatch, outcome (b)). MEASURED 2026-07-22, crates/spt-daemon/tests/transport_death_eof.rs, OUTCOME (a): on REAL QUIC (two brokers, BindScope::Loopback + a real net_dial — NOT the in-process duplex, which has no idle timeout) a no-FIN transport death DO...\n 1535│\n 1536│# ── W7 (operator /diagnose 2026-06-19): rc Backspace key forwards the wrong byte ──\n 1537│[[requirements]]\n\n# .github/\n\n## ci/\n### ci-notify.sh\n  27│# unannounced. Silence from this informant is therefore ambiguous by\n *28│# construction; it is a convenience layer over polling, never a replacement for\n  29│# a receiver's own check.\n  30│# ============================================================================\n  31│#\n    │...\n  33│# daemon, a missing `spt`, an unreachable recipient, a WEDGED send — none of these\n *34│# may ever red a CI run. The gate's verdict is the gate's; this script only\n  35│# reports it.\n  36│#\n  37│# The time half is not theoretical (2026-07-27, this script's debut run and its\n    │...\n 129│compose_body() {\n*130│  echo \"CI $verdict — ${GITHUB_REPOSITORY##*/} @ ${GITHUB_REF_NAME:-<unknown ref>}\"\n 131│  [ -n \"$PR_NUMBER\" ] && echo \"PR: #$PR_NUMBER\"\n 132│  echo \"sha: $(printf '%.12s' \"$GITHUB_SHA\")\"\n 133│  [ -n \"$failing\" ] && echo \"failing: $failing\"\n    │...\n 179│\n*180│echo \"ci-notify: verdict $verdict${failing:+ (failing: $failing)}${cancelled:+ (cancelled: $cancelled)}\"\n 181│\n 182│# --- recipients ------------------------------------------------------------\n 183│# doyle always (he gates and merges). Plus a best-effort trailer parse off the\n*184│# head commit: this project's commits end `Co-authored by: <agent>` — note the\n 185│# SPACE. That spelling is this repo's agent-name convention (CLAUDE.md), and it\n 186│# is the only one matched on purpose: git's standard hyphenated\n*187│# `Co-authored-by: Some Human <addr>` names a person or a tool, not a perch, so\n 188│# matching it would mint junk recipients (a real commit on this branch's history\n 189│# yields \"OpenAICodex\" that way). Absent or unparseable => skipped, never an error.\n 190│FROM_LABEL=\"CI-$(printf '%s' \"$RUNNER_NAME\" | tr '[:lower:]' '[:upper:]' | tr -cs '[:alnum:]' '-')\"\n    │...\n 193│trailer=\"$(git log -1 --pretty=%B 2>/dev/null |\n*194│  sed -n 's/^Co-authored by:[[:space:]]*\\([^<]*\\).*$/\\1/Ip' |\n 195│  tail -n 1 |\n 196│  sed 's/[[:space:]]*$//; s/^[[:space:]]*//')\"\n 197│if [ -n \"$trailer\" ] && [ \"$trailer\" != \"doyle\" ]; then\n    │...\n 199│else\n*200│  echo \"ci-notify: no distinct co-author trailer on the head commit — doyle only\"\n 201│fi\n 202│\n 203│# --- send ------------------------------------------------------------------\n\n## workflows/\n### golden.yml\n  353│      # healthy run looks like.\n *354│      - name: CI notifier verdict selftest\n  355│        if: runner.os == 'Linux'\n  356│        shell: bash\n  357│        run: bash .github/ci/ci-notify-selftest.sh\n     │...\n 1052│      - uses: actions/checkout@v5\n*1053│      # IR-46: retain the reviewed post-checkout placement; sample is an INSTANT.\n 1054│      # [int->REQ-CI-FREE-SPACE-PREFLIGHT]\n 1055│      - name: DISK start floor\n 1056│        shell: bash\n     │...\n 1429│          fi\n*1430│          ./traceable-reqs --version\n 1431│        env:\n 1432│          # Cross-org private repo: the default repo-scoped GITHUB_TOKEN cannot\n 1433│          # read BigscreenVR/traceable-reqs. Supply a PAT with read access to it\n     │...\n 1483│      # The head commit (not the PR merge commit) — the script reads its\n*1484│      # `Co-authored by:` trailer to find the second recipient.\n 1485│      - uses: actions/checkout@v5\n 1486│        with:\n 1487│          ref: ${{ github.event.pull_request.head.sha || github.sha }}\n\n# crates/xtask/src/\n## main.rs\n   47│            // A lapsed load-bearing pin is knowable before any of that is spent.\n  *48│            check_load_bearing_patch_pins();\n   49│            gen(true);\n   50│            scan_published_docs_for_internal_codes();\n   51│            check_llms_links();\n     │...\n 1046│// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN]\n*1047│fn check_load_bearing_patch_pins() {\n 1048│    let root = repo_root();\n 1049│    let manifest = std::fs::read_to_string(root.join(\"Cargo.toml\"))\n 1050│        .expect(\"Cargo.toml (the [patch.crates-io] stanzas)\");\n     │...\n 1182│#[cfg(test)]\n*1183│mod patch_pin_tests {\n 1184│    const REV: &str = \"89a2200d54a4e3cab2f46cc75ebff49a1fb07614\";\n 1185│\n 1186│    fn manifest_with_pin() -> String {\n     │...\n 2726│        let hits = forbidden_codes_in(text);\n*2727│        assert!(hits.is_empty(), \"clean help must pass, got: {hits:?}\");\n 2728│    }\n 2729│}\n 2730│\n\n# docs/\n## RELEASE-RUNBOOK.md\n 304│\n*305│   Do not stack a thin release PR on the ruled golden tip. Its tag would point\n 306│   at a commit no golden run tested—the exact unvalidated-release-commit failure\n 307│   the dedicated-PR rule intended to prevent. The dedicated release PR form is\n 308│   therefore retired under golden CI; its release-shape gate is preserved as a\n    │...\n 502│   the NEWEST sha's run plus any run that had already begun; an intermediate\n*503│   sha's thin-CI verdict may simply not exist, and its absence is supersession,\n 504│   not evidence of anything about that sha. A started run's record IS preserved,\n 505│   and it is still not the same claim as the record being authoritative.\n 506│   **Preservation is not deference.** (Filed as IR-41 in\n    │...\n 598│   primary seed is stored in the **machine-scope** `SPT_RELEASE_SEED` variable,\n*599│   and the operator has ruled that placement deliberate and permanent. Publish\n 600│   there with the raw-env form — run `release-publish` **without**\n 601│   `SPT_RELEASE_SEED_CMD` set, so `xtask` falls back to reading\n 602│   `SPT_RELEASE_SEED` — and **do not remove the variable.** This is a recorded","missingPaths":[".cargo"],"linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789094628893}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_MVq7q7YDsFn56H1XL0CtIpDX|fc_074aee81620ae383016aa36aec9de087d18a181df6c8d6279d","toolName":"grep","startedAt":"2026-09-11T02:43:59.053Z","args":{"path":"docs/INFRA-REGISTER.md"},"intent":"Recovering rider reconciliation location"},"id":"9d331bac","parentId":"166717b4","timestamp":"2026-09-11T02:43:59.053Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_iJzbGEfXsGn95e6h3O1QvJ4H|fc_074aee81620ae383016aa36aec9df087d1a9c63045a889da1d","toolName":"read","startedAt":"2026-09-11T02:43:59.053Z","args":{"path":".github/workflows/golden.yml:1404-1431"},"intent":"Reading traceability version and policy"},"id":"4cea62dd","parentId":"9d331bac","timestamp":"2026-09-11T02:43:59.053Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_PHZxflL5MFz3TbOD7i5DFxxo|fc_074aee81620ae383016aa36aec9e0487d1a0deb1452f8abc9c","toolName":"read","startedAt":"2026-09-11T02:43:59.053Z","args":{"path":"crates/xtask/src/main.rs:3130-3158"},"intent":"Reading claim final write"},"id":"bba85c43","parentId":"4cea62dd","timestamp":"2026-09-11T02:43:59.053Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Ssk7kmmLEE2reTGyUU5Vf6pG|fc_074aee81620ae383016aa36aec9e0c87d1af37af0bc240c90e","toolName":"grep","startedAt":"2026-09-11T02:43:59.053Z","args":{"path":"crates/xtask/src/main.rs:140-420;crates/spt/build.rs;crates/spt/src/main.rs;traceable-reqs.toml:1-80"},"intent":"Locating generator and stack safeguards"},"id":"51a0e072","parentId":"bba85c43","timestamp":"2026-09-11T02:43:59.053Z"}
{"type":"message","id":"97f1d8f0","parentId":"51a0e072","timestamp":"2026-09-11T02:43:59.054Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Searching the full register**"},{"type":"toolCall","id":"call_MVq7q7YDsFn56H1XL0CtIpDX|fc_074aee81620ae383016aa36aec9de087d18a181df6c8d6279d","name":"grep","arguments":{"i":"Recovering rider reconciliation location","pattern":"CI-RIDER LANE STATE|LANE STATE|1275e47|bf8c4a2","path":"docs/INFRA-REGISTER.md","case":true,"gitignore":true,"skip":0},"intent":"Recovering rider reconciliation location"},{"type":"toolCall","id":"call_iJzbGEfXsGn95e6h3O1QvJ4H|fc_074aee81620ae383016aa36aec9df087d1a9c63045a889da1d","name":"read","arguments":{"i":"Reading traceability version and policy","path":".github/workflows/golden.yml:1404-1431"},"intent":"Reading traceability version and policy"},{"type":"toolCall","id":"call_PHZxflL5MFz3TbOD7i5DFxxo|fc_074aee81620ae383016aa36aec9e0487d1a0deb1452f8abc9c","name":"read","arguments":{"i":"Reading claim final write","path":"crates/xtask/src/main.rs:3130-3158"},"intent":"Reading claim final write"},{"type":"toolCall","id":"call_Ssk7kmmLEE2reTGyUU5Vf6pG|fc_074aee81620ae383016aa36aec9e0c87d1af37af0bc240c90e","name":"grep","arguments":{"i":"Locating generator and stack safeguards","pattern":"fn gen\\(|help_output|is_empty|STACK|stack","path":"crates/xtask/src/main.rs:140-420;crates/spt/build.rs;crates/spt/src/main.rs;traceable-reqs.toml:1-80","case":false,"gitignore":true,"skip":0},"intent":"Locating generator and stack safeguards"},{"type":"toolCall","id":"call_frKARecsmLuyHJzPUaf0wqp2|fc_074aee81620ae383016aa36aec9e1487d19b795b5487b8de87","name":"read","arguments":{"i":"Reading network probe branches","path":".github/workflows/golden.yml:1096-1145,1264-1315"},"intent":"Reading network probe branches"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":11023,"output":296,"cacheRead":96768,"cacheWrite":0,"totalTokens":108087,"reasoningTokens":13,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094628943,"responseId":"resp_074aee81620ae383016aa36ae2d7e887d1aaf3ebad8fa17750","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_074aee81620ae383016aa36ae3c4b887d19acc708f4845fe2b","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo2rs5iWbzNZVUZ1HxdnChXLahgga-VJvJUs6XKIv9V9WA0qxGtrN_ZUvMh7MiNnWMrC8OTO0ZSoMuGgEVSu6uPLb6EHnCnvCULG-PTGwyCrlkf1e0zCm_nRbYW0UtceoItrsJqwb6AMjRsBEkDuinr_StFMM_spVVbe_tl1rzmHaSR6e4xAJWLYfudkPwwcq3XZpkeHGQ3-cXeuWm1-6mWhpv0oJTuq1GPMsE0cAoUudTAHffEJCv_ZJrNmyXPef0726_usxAwj81iEpmhBR0mJ7nwV-LFKk9C0uJXt3Y04Njb0UuAHd84UbmkQzupQr6Ez369K3lGD-WDB-15lKWiV3Kcu97bQmdzsNUUfdelnGJVzkK77qIb-1vmGzZqEt2vfGLu1BR2gl1M9OmsrKXlsWHd_SIsUtwE8vN1WdruGMXMm6Jhpc5ZNRxlHMGMY42b2bOEwXT-mn1Bv7lcL8k-F-1GIhpdTceQcEITXOSzqrbo5wcL7ZF1n7dJ6TA6NLSevTf2n9OweAbSQwj3w5V7hv4pgZ4zMeEHhBqLoNgLoJn7kMNrComlPw2Vzn4MJO3aipcHtuUVBGnmgKz43hvqvnUycphRTj9qOzhwEap0ge1IV-bHyxr0SowtNdBpTwVy3ZA-fujMkFUuksXvEAcQfUGsAC8csPAuUTOhejeujcYlr63A-EMnVDq9spmcZUeNvOgeRi12PVgma22ahdOsq9jwWFCCrJjCHbqFoBivYCx-nrO_gyoZzS589Gszgll8U1cqye6xSONoA-HvJ0EZBaiRh6vvS-FOXEAwybGsa-QuSLBuckuZAB_7S_OKLgc6rPz92KTva6uyHWCGFXnPeaG7xiFdTMAlUGm5JPRukGDpgMF0iqoOSZhSVXaJ06MFWXkivRY75IjIqYFCC9q95STAjzvURPlFubbwqbAjGuRiK-QePGR76RpWYnUAESfdiTTt6Sh1fNKWqYKgP7RoGTHVFu_-r2yNbe_OJovTraFGfvKckyugLZAIOxxId9qfDFYaimVW0aEKv8AADzmKIJYNXavTQoabwLDOB07ZokAK7teRt7Rdp6NN_hcWBKMpUs7INMcsXuCqjoXBXWnnVR0WrwAkrGsXnzxRhmN9jmlD_rY5uNS6Jd7RaggM-Wl5DLoBp2dRyTjGhO4CefSLy8nPZtMLXr8n_i2Mt3ZxMDtAowup98rg72uoJKa09Z8dUYcRXkdCBCdNpUw0micMLpXZemgsHVtGRyhoU-WV423PBlE5JKQl8hnIu8NBKD7FCQ_PaQ5OpxQveU_T4GkAKkXYVm5BXl39arzCxGklsHaKrDao6joBxL6GUunyZBsNpsnfHqzopsxUeKOvKoOM6xug==","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"summary":[{"type":"summary_text","text":"**Searching the full register**"}],"metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36aec9de087d18a181df6c8d6279d","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering rider reconciliation location\",\"pattern\":\"CI-RIDER LANE STATE|LANE STATE|1275e47|bf8c4a2\",\"path\":\"docs/INFRA-REGISTER.md\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_MVq7q7YDsFn56H1XL0CtIpDX","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36aec9df087d1a9c63045a889da1d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading traceability version and policy\",\"path\":\".github/workflows/golden.yml:1404-1431\"}","call_id":"call_iJzbGEfXsGn95e6h3O1QvJ4H","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36aec9e0487d1a0deb1452f8abc9c","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading claim final write\",\"path\":\"crates/xtask/src/main.rs:3130-3158\"}","call_id":"call_PHZxflL5MFz3TbOD7i5DFxxo","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36aec9e0c87d1af37af0bc240c90e","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating generator and stack safeguards\",\"pattern\":\"fn gen\\\\(|help_output|is_empty|STACK|stack\",\"path\":\"crates/xtask/src/main.rs:140-420;crates/spt/build.rs;crates/spt/src/main.rs;traceable-reqs.toml:1-80\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_Ssk7kmmLEE2reTGyUU5Vf6pG","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36aec9e1487d19b795b5487b8de87","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading network probe branches\",\"path\":\".github/workflows/golden.yml:1096-1145,1264-1315\"}","call_id":"call_frKARecsmLuyHJzPUaf0wqp2","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":10108.31569999922,"ttft":1176.3174000000581,"completedAt":1789094639051,"contextSnapshot":{"promptTokens":107791,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_frKARecsmLuyHJzPUaf0wqp2|fc_074aee81620ae383016aa36aec9e1487d19b795b5487b8de87","toolName":"read","startedAt":"2026-09-11T02:43:59.054Z","args":{"path":".github/workflows/golden.yml:1096-1145,1264-1315"},"intent":"Reading network probe branches"},"id":"d4abe2d0","parentId":"97f1d8f0","timestamp":"2026-09-11T02:43:59.054Z"}
{"type":"message","id":"1ed02a6a","parentId":"d4abe2d0","timestamp":"2026-09-11T02:43:59.062Z","message":{"role":"toolResult","toolCallId":"call_MVq7q7YDsFn56H1XL0CtIpDX|fc_074aee81620ae383016aa36aec9de087d18a181df6c8d6279d","toolName":"grep","content":[{"type":"text","text":" 170|print both legs) had their FIRST EXERCISE here, discharging the \"unexercised until a golden run\"\n*171|caveat at the CI-RIDER LANE STATE foot section. IR-35's re-measure rode the batch (`c65b838`).\n 172|Owlery-noun thin lane SCOPED and dispatched to hertz for the next batch (class A only, two sites;\n 173|class B on-disk rename is an explicit non-goal — see IR-40's kin discipline for why the boundary is\n 174|written into the brief rather than left to judgement).\n...\n 180|### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n*181|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n*182|  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n 183|  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n*184|  success/NO-REPLY/UNAVAILABLE, always exit 0 — instrument, not gate). NOTE `bf8c4a2` is NOT\n 185|  single-purpose: it also corrects the free-space preflight floor read\n 186|  (`REQ-CI-FREE-SPACE-PREFLIGHT`, the ci-runner-has-no-warm-target shape) — no 1:1 commit→IR map\n 187|  for this commit · **Origin:** golden/bench-wiring red triage 2026-08-02 (ex releases#126)\n...\n 247|### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n*248|- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n*249|  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n 250|  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n 251|- **What/why, three parts that land together:**\n 252|  1. **xtask check leg:** assert Cargo.lock resolves swarm-discovery to git rev\n...\n 367|  · **Origin:** BAROMETER (ex releases#121); re-confirmed on the #125 fix lane\n*368|  (builder's Windows clippy vs kitsubito's rust-1.96.0 lints); see [[CI-RIDER LANE STATE]]\n 369|- **What/why:** a Windows-clean lane can land a lint that only reds on the Linux leg — toolchain\n 370|  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n 371|  leg. Natural companion to IR-4's toolchain-version print step.\n...\n 380|  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n*381|  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n 382|\n 383|### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n 384|- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n...\n 2877|\n*2878|### CI-RIDER LANE STATE — LANDED 2026-08-04 (post-v0.53.0 merge queue); history below kept for its mechanisms\n 2879|- **RESOLVED:** the lane rebased clean onto the post-tag queue and landed ff-only as\n*2880|  `2b33a47`/`2a7b016`/`d63f4ce`/`19d7f79` (content byte-identical to `1275e47..bf8c4a2` by lane-diff\n 2881|  blob hash). IR-1 and IR-4 are BUILT AND LANDED; IR-9's measurement half is landed with its trigger\n 2882|  now armed — the toolchain print reports runner-account versions on the NEXT GOLDEN RUN, which is\n 2883|  when doyle's 2026-08-03 ruling (decide from runner-account versions, never the interactive prior)\n...\n 2885|  remain unexercised until that run — the landing does not change that caveat.\n*2886|- **As recorded pre-landing (2026-08-04, doyle):** `ci/locksmith-riders` was at `bf8c4a2` with FOUR\n 2887|  commits not contained in `origin/main` and not present in LOCKSMITH's golden head `b7b00c3`. The\n 2888|  worktree `.worktrees/hertz-ci-riders` was clean, so the work existed and was simply unlanded:\n*2889|  `1275e47` (xtask: assert a load-bearing patch pin is still in force, both ways it lapses) ·\n 2890|  `49d4805` (docs/ci: a lock-touching lane reads edges, not just the package set) ·\n 2891|  `8ed006b` (ci/golden: print the toolchain that judged the run, both legs) ·\n*2892|  `bf8c4a2` (ci/golden: measure the link before rendezvous, read the floor after the checkout that\n 2893|  clears it — the floor read AFTER its own reclaim is [[ci-runner-has-no-warm-target]]'s shape).\n 2894|- **Why it is recorded rather than quietly re-dispatched:** [[IR-1]]/[[IR-4]]/[[IR-9]] were carried\n 2895|  as DISPATCHED, which is now false in BOTH directions — the work is further along than dispatched,\n...\n 2902|  that day or read off the commits:\n*2903|  `1275e47` → `REQ-CI-LOAD-BEARING-PATCH-PIN` ([[IR-4]] part 1, the mechanical pin guard in xtask) ·\n 2904|  `49d4805` → `REQ-LOCK-TOUCHING-LANE-PROCEDURE` ([[IR-4]] part 2, procedure in docs/GOLDEN-CI.md) ·\n 2905|  `8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT` ([[IR-4]] part 3, carrying [[IR-9]]) ·\n*2906|  `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE` ([[IR-1]], the network axis).\n 2907|- **CORRECTION TO THE GATER'S EARLIER WORDING, from the builder:** `8ed006b` does NOT discharge\n 2908|  [[IR-9]] — it discharges IR-9's MEASUREMENT half only. IR-9's other half (align the two boxes, or\n 2909|  declare one authoritative clippy leg) is held by doyle's own 2026-08-03 ruling: decide once the\n...\n 2920|- **[[IR-5]]/[[IR-6]] CONDITIONAL RIDERS: CONDITION NOT MET — the answer is NO and it closes the\n*2921|  question for this lane.** Measured file set `6d291e0..bf8c4a2`: `.gitattributes`,\n 2922|  `.github/bench/link-probe.ps1`, `.github/bench/link-probe.sh`, `.github/workflows/golden.yml`,\n 2923|  `crates/xtask/src/main.rs`, `crates/xtask/tests/bench_row_parity.rs`, `docs/GOLDEN-CI.md`,\n 2924|  `traceable-reqs.toml`. Nothing under `.github/ci/`, where the nextest-summary readers and"}],"details":{"scopePath":"docs/INFRA-REGISTER.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":16,"fileCount":1,"files":["docs/INFRA-REGISTER.md"],"fileMatches":[{"path":"docs/INFRA-REGISTER.md","count":16}],"truncated":false,"displayContent":"  170│print both legs) had their FIRST EXERCISE here, discharging the \"unexercised until a golden run\"\n *171│caveat at the CI-RIDER LANE STATE foot section. IR-35's re-measure rode the batch (`c65b838`).\n  172│Owlery-noun thin lane SCOPED and dispatched to hertz for the next batch (class A only, two sites;\n  173│class B on-disk rename is an explicit non-goal — see IR-40's kin discipline for why the boundary is\n  174│written into the brief rather than left to judgement).\n     │...\n  180│### IR-1 — Quiet predicate needs a network axis (tailscale RTT probe)\n *181│- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n *182│  carried by `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE`, mapping CONFIRMED by builder hertz 2026-08-03\n  183│  (by content: tailscale ping ×5, med/max RTT rows into the bench ledger, three arms\n *184│  success/NO-REPLY/UNAVAILABLE, always exit 0 — instrument, not gate). NOTE `bf8c4a2` is NOT\n  185│  single-purpose: it also corrects the free-space preflight floor read\n  186│  (`REQ-CI-FREE-SPACE-PREFLIGHT`, the ci-runner-has-no-warm-target shape) — no 1:1 commit→IR map\n  187│  for this commit · **Origin:** golden/bench-wiring red triage 2026-08-02 (ex releases#126)\n     │...\n  247│### IR-4 — Lock-pin guard + lock-procedure rule + toolchain print (three riders, one lane)\n *248│- **Status:** open, LANE EXISTS UNLANDED — see [[CI-RIDER LANE STATE]] at the foot of this file;\n *249│  candidate commits `1275e47` + `49d4805` + `8ed006b`, mapping NOT yet confirmed by its builder ·\n  250│  **Origin:** releases#125 fix-lane intake hold (ex releases#129 + riders)\n  251│- **What/why, three parts that land together:**\n  252│  1. **xtask check leg:** assert Cargo.lock resolves swarm-discovery to git rev\n     │...\n  367│  · **Origin:** BAROMETER (ex releases#121); re-confirmed on the #125 fix lane\n *368│  (builder's Windows clippy vs kitsubito's rust-1.96.0 lints); see [[CI-RIDER LANE STATE]]\n  369│- **What/why:** a Windows-clean lane can land a lint that only reds on the Linux leg — toolchain\n  370│  skew makes local clippy evidence non-transferable. Align versions or declare the authoritative\n  371│  leg. Natural companion to IR-4's toolchain-version print step.\n     │...\n  380│  2026-08-03. GREENLIT with #132 and **DISPATCHED to hertz 2026-08-03**; that dispatch delivered\n *381│  the measurement half (landed via [[CI-RIDER LANE STATE]], first exercised on run 30971976024).\n  382│\n  383│### IR-10 — Wave gate runs the CONSUMERS of any predicate it changes\n  384│- **Status:** open · **Origin:** BAROMETER gate craft (ex releases#119)\n     │...\n 2877│\n*2878│### CI-RIDER LANE STATE — LANDED 2026-08-04 (post-v0.53.0 merge queue); history below kept for its mechanisms\n 2879│- **RESOLVED:** the lane rebased clean onto the post-tag queue and landed ff-only as\n*2880│  `2b33a47`/`2a7b016`/`d63f4ce`/`19d7f79` (content byte-identical to `1275e47..bf8c4a2` by lane-diff\n 2881│  blob hash). IR-1 and IR-4 are BUILT AND LANDED; IR-9's measurement half is landed with its trigger\n 2882│  now armed — the toolchain print reports runner-account versions on the NEXT GOLDEN RUN, which is\n 2883│  when doyle's 2026-08-03 ruling (decide from runner-account versions, never the interactive prior)\n     │...\n 2885│  remain unexercised until that run — the landing does not change that caveat.\n*2886│- **As recorded pre-landing (2026-08-04, doyle):** `ci/locksmith-riders` was at `bf8c4a2` with FOUR\n 2887│  commits not contained in `origin/main` and not present in LOCKSMITH's golden head `b7b00c3`. The\n 2888│  worktree `.worktrees/hertz-ci-riders` was clean, so the work existed and was simply unlanded:\n*2889│  `1275e47` (xtask: assert a load-bearing patch pin is still in force, both ways it lapses) ·\n 2890│  `49d4805` (docs/ci: a lock-touching lane reads edges, not just the package set) ·\n 2891│  `8ed006b` (ci/golden: print the toolchain that judged the run, both legs) ·\n*2892│  `bf8c4a2` (ci/golden: measure the link before rendezvous, read the floor after the checkout that\n 2893│  clears it — the floor read AFTER its own reclaim is [[ci-runner-has-no-warm-target]]'s shape).\n 2894│- **Why it is recorded rather than quietly re-dispatched:** [[IR-1]]/[[IR-4]]/[[IR-9]] were carried\n 2895│  as DISPATCHED, which is now false in BOTH directions — the work is further along than dispatched,\n     │...\n 2902│  that day or read off the commits:\n*2903│  `1275e47` → `REQ-CI-LOAD-BEARING-PATCH-PIN` ([[IR-4]] part 1, the mechanical pin guard in xtask) ·\n 2904│  `49d4805` → `REQ-LOCK-TOUCHING-LANE-PROCEDURE` ([[IR-4]] part 2, procedure in docs/GOLDEN-CI.md) ·\n 2905│  `8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT` ([[IR-4]] part 3, carrying [[IR-9]]) ·\n*2906│  `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE` ([[IR-1]], the network axis).\n 2907│- **CORRECTION TO THE GATER'S EARLIER WORDING, from the builder:** `8ed006b` does NOT discharge\n 2908│  [[IR-9]] — it discharges IR-9's MEASUREMENT half only. IR-9's other half (align the two boxes, or\n 2909│  declare one authoritative clippy leg) is held by doyle's own 2026-08-03 ruling: decide once the\n     │...\n 2920│- **[[IR-5]]/[[IR-6]] CONDITIONAL RIDERS: CONDITION NOT MET — the answer is NO and it closes the\n*2921│  question for this lane.** Measured file set `6d291e0..bf8c4a2`: `.gitattributes`,\n 2922│  `.github/bench/link-probe.ps1`, `.github/bench/link-probe.sh`, `.github/workflows/golden.yml`,\n 2923│  `crates/xtask/src/main.rs`, `crates/xtask/tests/bench_row_parity.rs`, `docs/GOLDEN-CI.md`,\n 2924│  `traceable-reqs.toml`. Nothing under `.github/ci/`, where the nextest-summary readers and"},"isError":false,"timestamp":1789094639061}}
{"type":"message","id":"6552b476","parentId":"1ed02a6a","timestamp":"2026-09-11T02:43:59.064Z","message":{"role":"toolResult","toolCallId":"call_iJzbGEfXsGn95e6h3O1QvJ4H|fc_074aee81620ae383016aa36aec9df087d1a9c63045a889da1d","toolName":"read","content":[{"type":"text","text":"      - name: DISK start floor\n…\n        run: |\n…\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\n            exit 1\n          fi\n      - name: Install traceable-reqs\n        # Source-pinned, self-healing (M6-D2): kitsubito cannot run the release\n        # asset (it needs GLIBC 2.39; kitsubito's Ubuntu 22.04 has 2.35) — so\n        # the job itself builds the pinned tag once and caches it in\n        # ~/.local/bin, rebuilding only when the pin moves. v0.1.2 =\n        # shell/PowerShell tag scanning (the M6 installer scripts carry\n        # impl-stage REQ-INSTALL evidence).\n        run: |\n          WANT=0.2.0\n          BIN=\"$HOME/.local/bin/traceable-reqs\"\n          if [ -x \"$BIN\" ] && \"$BIN\" --version | grep -q \" $WANT\\$\"; then\n            ln -sf \"$BIN\" ./traceable-reqs\n          else\n            # Build OUTSIDE the checkout: a clone inside it gets adopted by\n            # the spt-core cargo workspace and refuses to build.\n            SRC=\"$RUNNER_TEMP/tr-src\"\n            rm -rf \"$SRC\"\n            git clone --depth 1 --branch \"v$WANT\" \\\n              \"https://x-access-token:${GH_TOKEN}@github.com/BigscreenVR/traceable-reqs\" \"$SRC\"\n            cargo build --release --manifest-path \"$SRC/rust/Cargo.toml\"\n            mkdir -p \"$HOME/.local/bin\"\n            cp \"$SRC/rust/target/release/traceable-reqs\" \"$BIN\"\n            ln -sf \"$BIN\" ./traceable-reqs\n          fi\n          ./traceable-reqs --version\n        env:\n          # Cross-org private repo: the default repo-scoped GITHUB_TOKEN cannot\n          # read BigscreenVR/traceable-reqs. Supply a PAT with read access to it\n          # as the TRACEABLE_REQS_TOKEN repo secret. See README/CI notes.\n          GH_TOKEN: ${{ secrets.TRACEABLE_REQS_TOKEN }}\n\n[Showing lines 1403-1434 of 1499. Use :1435 to continue]"}],"details":{"truncation":{"content":"            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\r\n            exit 1\r\n          fi\r\n      - name: Install traceable-reqs\r\n        # Source-pinned, self-healing (M6-D2): kitsubito cannot run the release\r\n        # asset (it needs GLIBC 2.39; kitsubito's Ubuntu 22.04 has 2.35) — so\r\n        # the job itself builds the pinned tag once and caches it in\r\n        # ~/.local/bin, rebuilding only when the pin moves. v0.1.2 =\r\n        # shell/PowerShell tag scanning (the M6 installer scripts carry\r\n        # impl-stage REQ-INSTALL evidence).\r\n        run: |\r\n          WANT=0.2.0\r\n          BIN=\"$HOME/.local/bin/traceable-reqs\"\r\n          if [ -x \"$BIN\" ] && \"$BIN\" --version | grep -q \" $WANT\\$\"; then\r\n            ln -sf \"$BIN\" ./traceable-reqs\r\n          else\r\n            # Build OUTSIDE the checkout: a clone inside it gets adopted by\r\n            # the spt-core cargo workspace and refuses to build.\r\n            SRC=\"$RUNNER_TEMP/tr-src\"\r\n            rm -rf \"$SRC\"\r\n            git clone --depth 1 --branch \"v$WANT\" \\\r\n              \"https://x-access-token:${GH_TOKEN}@github.com/BigscreenVR/traceable-reqs\" \"$SRC\"\r\n            cargo build --release --manifest-path \"$SRC/rust/Cargo.toml\"\r\n            mkdir -p \"$HOME/.local/bin\"\r\n            cp \"$SRC/rust/target/release/traceable-reqs\" \"$BIN\"\r\n            ln -sf \"$BIN\" ./traceable-reqs\r\n          fi\r\n          ./traceable-reqs --version\r\n        env:\r\n          # Cross-org private repo: the default repo-scoped GITHUB_TOKEN cannot\r\n          # read BigscreenVR/traceable-reqs. Supply a PAT with read access to it\r\n          # as the TRACEABLE_REQS_TOKEN repo secret. See README/CI notes.\r","truncated":true,"truncatedBy":"lines","totalLines":97,"totalBytes":1733,"outputLines":32,"outputBytes":1733,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1499,"displayContent":{"text":"      - name: DISK start floor\n…\n        run: |\n…\n            echo \"::error title=Insufficient free disk::RESOURCE=disk drive=$drive free_bytes=$free_bytes floor_bytes=$floor_bytes\"\r\n            exit 1\r\n          fi\r\n      - name: Install traceable-reqs\r\n        # Source-pinned, self-healing (M6-D2): kitsubito cannot run the release\r\n        # asset (it needs GLIBC 2.39; kitsubito's Ubuntu 22.04 has 2.35) — so\r\n        # the job itself builds the pinned tag once and caches it in\r\n        # ~/.local/bin, rebuilding only when the pin moves. v0.1.2 =\r\n        # shell/PowerShell tag scanning (the M6 installer scripts carry\r\n        # impl-stage REQ-INSTALL evidence).\r\n        run: |\r\n          WANT=0.2.0\r\n          BIN=\"$HOME/.local/bin/traceable-reqs\"\r\n          if [ -x \"$BIN\" ] && \"$BIN\" --version | grep -q \" $WANT\\$\"; then\r\n            ln -sf \"$BIN\" ./traceable-reqs\r\n          else\r\n            # Build OUTSIDE the checkout: a clone inside it gets adopted by\r\n            # the spt-core cargo workspace and refuses to build.\r\n            SRC=\"$RUNNER_TEMP/tr-src\"\r\n            rm -rf \"$SRC\"\r\n            git clone --depth 1 --branch \"v$WANT\" \\\r\n              \"https://x-access-token:${GH_TOKEN}@github.com/BigscreenVR/traceable-reqs\" \"$SRC\"\r\n            cargo build --release --manifest-path \"$SRC/rust/Cargo.toml\"\r\n            mkdir -p \"$HOME/.local/bin\"\r\n            cp \"$SRC/rust/target/release/traceable-reqs\" \"$BIN\"\r\n            ln -sf \"$BIN\" ./traceable-reqs\r\n          fi\r\n          ./traceable-reqs --version\r\n        env:\r\n          # Cross-org private repo: the default repo-scoped GITHUB_TOKEN cannot\r\n          # read BigscreenVR/traceable-reqs. Supply a PAT with read access to it\r\n          # as the TRACEABLE_REQS_TOKEN repo secret. See README/CI notes.\r\n          GH_TOKEN: ${{ secrets.TRACEABLE_REQS_TOKEN }}","startLine":1391,"lineNumbers":[1391,null,1393,null,1403,1404,1405,1406,1407,1408,1409,1410,1411,1412,1413,1414,1415,1416,1417,1418,1419,1420,1421,1422,1423,1424,1425,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435]},"fileSize":87519,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.github\\workflows\\golden.yml"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1499,"totalBytes":1733,"outputLines":32,"outputBytes":1733,"shownRange":{"start":1403,"end":1434},"nextOffset":1435}}},"isError":false,"timestamp":1789094639064}}
{"type":"message","id":"bd1f4a28","parentId":"6552b476","timestamp":"2026-09-11T02:43:59.066Z","message":{"role":"toolResult","toolCallId":"call_PHZxflL5MFz3TbOD7i5DFxxo|fc_074aee81620ae383016aa36aec9e0487d1a0deb1452f8abc9c","toolName":"read","content":[{"type":"text","text":"fn pool_claim(args: &[String]) {\n…\n    let owner = spt_poolguard::PoolOwner {\n…\n        lane: Some(spt_poolguard::LaneClaim {\n            label: label.clone(),\n            pid,\n            started_at,\n            branch: branch.clone(),\n            base: base.clone(),\n        }),\n    };\n    spt_poolguard::write_owner(&spt_poolguard::owner_path(pool), &owner)\n        .expect(\"write the pool claim\");\n    println!(\n        \"pool {} claimed for lane {label} by {} (branch {}, base {}; advisory holder pid {pid}{})\",\n        pool.display(),\n        tree.display(),\n        branch.as_deref().unwrap_or(\"<detached>\"),\n        base.as_deref()\n            .map(|b| b.chars().take(12).collect::<String>())\n            .unwrap_or_else(|| \"<none>\".into()),\n        started_at\n            .map(|b| format!(\", born {b}\"))\n            .unwrap_or_default()\n    );\n}\n\nfn absolute_pool(cwd: &Path, pool: &Path) -> PathBuf {\n    if pool.is_absolute() {\n        pool.to_path_buf()\n    } else {\n        cwd.join(pool)\n    }\n}\n\n/// Resolve the worktree that actually contains the pool. The pool itself need\n/// not exist yet, so probe from its nearest existing ancestor.\n\n[Showing lines 3129-3161 of 3565. Use :3162 to continue]"}],"details":{"truncation":{"content":"            label: label.clone(),\r\n            pid,\r\n            started_at,\r\n            branch: branch.clone(),\r\n            base: base.clone(),\r\n        }),\r\n    };\r\n    spt_poolguard::write_owner(&spt_poolguard::owner_path(pool), &owner)\r\n        .expect(\"write the pool claim\");\r\n    println!(\r\n        \"pool {} claimed for lane {label} by {} (branch {}, base {}; advisory holder pid {pid}{})\",\r\n        pool.display(),\r\n        tree.display(),\r\n        branch.as_deref().unwrap_or(\"<detached>\"),\r\n        base.as_deref()\r\n            .map(|b| b.chars().take(12).collect::<String>())\r\n            .unwrap_or_else(|| \"<none>\".into()),\r\n        started_at\r\n            .map(|b| format!(\", born {b}\"))\r\n            .unwrap_or_default()\r\n    );\r\n}\r\n\r\nfn absolute_pool(cwd: &Path, pool: &Path) -> PathBuf {\r\n    if pool.is_absolute() {\r\n        pool.to_path_buf()\r\n    } else {\r\n        cwd.join(pool)\r\n    }\r\n}\r\n\r\n/// Resolve the worktree that actually contains the pool. The pool itself need\r\n/// not exist yet, so probe from its nearest existing ancestor.\r","truncated":true,"truncatedBy":"lines","totalLines":437,"totalBytes":1059,"outputLines":33,"outputBytes":1059,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3565,"displayContent":{"text":"fn pool_claim(args: &[String]) {\n…\n    let owner = spt_poolguard::PoolOwner {\n…\n        lane: Some(spt_poolguard::LaneClaim {\n            label: label.clone(),\r\n            pid,\r\n            started_at,\r\n            branch: branch.clone(),\r\n            base: base.clone(),\r\n        }),\r\n    };\r\n    spt_poolguard::write_owner(&spt_poolguard::owner_path(pool), &owner)\r\n        .expect(\"write the pool claim\");\r\n    println!(\r\n        \"pool {} claimed for lane {label} by {} (branch {}, base {}; advisory holder pid {pid}{})\",\r\n        pool.display(),\r\n        tree.display(),\r\n        branch.as_deref().unwrap_or(\"<detached>\"),\r\n        base.as_deref()\r\n            .map(|b| b.chars().take(12).collect::<String>())\r\n            .unwrap_or_else(|| \"<none>\".into()),\r\n        started_at\r\n            .map(|b| format!(\", born {b}\"))\r\n            .unwrap_or_default()\r\n    );\r\n}\r\n\r\nfn absolute_pool(cwd: &Path, pool: &Path) -> PathBuf {\r\n    if pool.is_absolute() {\r\n        pool.to_path_buf()\r\n    } else {\r\n        cwd.join(pool)\r\n    }\r\n}\r\n\r\n/// Resolve the worktree that actually contains the pool. The pool itself need\r\n/// not exist yet, so probe from its nearest existing ancestor.\r","startLine":3042,"lineNumbers":[3042,null,3126,null,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3147,3148,3149,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161]},"fileSize":151917,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3565,"totalBytes":1059,"outputLines":33,"outputBytes":1059,"shownRange":{"start":3129,"end":3161},"nextOffset":3162}}},"isError":false,"timestamp":1789094639065}}
{"type":"message","id":"726540c2","parentId":"bd1f4a28","timestamp":"2026-09-11T02:43:59.068Z","message":{"role":"toolResult","toolCallId":"call_frKARecsmLuyHJzPUaf0wqp2|fc_074aee81620ae383016aa36aec9e1487d19b795b5487b8de87","toolName":"read","content":[{"type":"text","text":"      - name: Build spt binary (toast rung)\n…\n      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n      - name: Link health probe — peer hfenduleam (tailscale RTT)\n        if: always()\n        shell: bash\n        run: bash .github/bench/link-probe.sh hfenduleam\n      - name: Two-host ladder — role B (seed-holder/server)\n        shell: bash\n        run: bash .github/bench/wrap.sh twohost-ladder-b -- cargo test -p spt-daemon --test twohost -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"b\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.68.35.65\" # hfenduleam (tailscale)\n          SPT_TWO_HOST_WAIT_SECS: \"900\"\n          SPT_TWO_HOST_NOTIFY_BIN: ${{ github.workspace }}/.adapter-notify/target/debug/notify-shell\n      # WEBSERVE W1 (releases#249): cross-node serving cells on the real rig —\n      # this host OWNS the files, hfenduleam fetches them through its own\n      # loopback listener. Its own bin, its own ports (+20), after the ladder.\n      # [int->REQ-WEB-CROSS-NODE-PROXY]\n      # THE INBOUND PROBE, before the ceremony (releases#272). A golden run spent\n      # 900 s on EACH half discovering that B's datagrams never reached A: the\n      # Windows host is BlockInbound on every profile and no rule covered the\n      # test binary, so every QUIC dial died on its 10 s bound -- 75 of them,\n      # cadenced at exactly 12.00 s, never one ADMIT. At B a dropped datagram is\n      # indistinguishable from a delivered one, so it was triaged as product,\n      # then as rig, before it was measured as box.\n      #\n      # SEPARATE INVOCATION, not a filter inside the ceremony run: within one\n      # `cargo test` the cells are threads and nothing orders them, so only a\n      # step boundary puts this FIRST.\n      #\n      # SAME BINARY, not a shell probe: the Windows rule is PER-EXECUTABLE, so an\n      # allow rule naming pwsh or python says nothing about twohost_web-<hash>.exe\n      # -- a shell probe would pass the moment the PROBER was allowed and certify\n      # the failure it exists to catch. The assertion lives on A, which is the\n      # only side that can see arrival.\n      - name: Two-host inbound probe — role B (sender)\n        shell: bash\n        run: cargo test -p spt-daemon --test twohost_web two_host_inbound_probe -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"b\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.68.35.65\" # hfenduleam (tailscale)\n          # DELIBERATELY NOT THE CEREMONY'S 900. This budget bounds RENDEZVOUS\n          # skew (how long a half waits for the other to reach its own step),\n          # not pairing, so a blocked link costs 300 s ONCE here instead of 900\n          # per cell per half below. Set explicitly because from_env's default\n          # is invisible at the step, and the step beside it says 900.\n          SPT_TWO_HOST_WAIT_SECS: \"300\"\n…\n      - name: Build spt binary (toast rung)\n…\n      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n      - name: Link health probe — peer kitsubito (tailscale RTT)\n        if: always()\n        shell: pwsh\n        run: .github/bench/link-probe.ps1 -Peer kitsubito\n      - name: Two-host ladder — role A (joiner/driver)\n        shell: pwsh\n        run: .github/bench/wrap.ps1 -Step \"twohost-ladder-a\" -Command \"cargo test -p spt-daemon --test twohost -- --nocapture\"\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"a\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.98.197.12\" # kitsubito (tailscale)\n          SPT_TWO_HOST_WAIT_SECS: \"900\"\n          SPT_TWO_HOST_NOTIFY_BIN: ${{ github.workspace }}\\.adapter-notify\\target\\debug\\notify-shell.exe\n      # WEBSERVE W1 (releases#249): the requester half of the cross-node\n      # serving cells — three cells, each its own listener + broker, fetching\n      # kitsubito's files through this host's loopback. After the ladder.\n      # [int->REQ-WEB-CROSS-NODE-PROXY]\n      # THE INBOUND PROBE, before the ceremony (releases#272). A golden run spent\n      # 900 s on EACH half discovering that B's datagrams never reached A: the\n      # Windows host is BlockInbound on every profile and no rule covered the\n      # test binary, so every QUIC dial died on its 10 s bound -- 75 of them,\n      # cadenced at exactly 12.00 s, never one ADMIT. At B a dropped datagram is\n      # indistinguishable from a delivered one, so it was triaged as product,\n      # then as rig, before it was measured as box.\n      #\n      # SEPARATE INVOCATION, not a filter inside the ceremony run: within one\n      # `cargo test` the cells are threads and nothing orders them, so only a\n      # step boundary puts this FIRST.\n      #\n      # SAME BINARY, not a shell probe: the Windows rule is PER-EXECUTABLE, so an\n      # allow rule naming pwsh or python says nothing about twohost_web-<hash>.exe\n      # -- a shell probe would pass the moment the PROBER was allowed and certify\n      # the failure it exists to catch. The assertion lives on A, which is the\n      # only side that can see arrival.\n      - name: Two-host inbound probe — role A (receipt asserted here)\n        shell: pwsh\n        run: cargo test -p spt-daemon --test twohost_web two_host_inbound_probe -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"a\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.98.197.12\" # kitsubito (tailscale)\n          # DELIBERATELY NOT THE CEREMONY'S 900. This budget bounds RENDEZVOUS\n          # skew (how long a half waits for the other to reach its own step),\n          # not pairing, so a blocked link costs 300 s ONCE here instead of 900\n          # per cell per half below. Set explicitly because from_env's default\n          # is invisible at the step, and the step beside it says 900.\n          SPT_TWO_HOST_WAIT_SECS: \"300\"\n      - name: Two-host web serving — role A (requester)\n        shell: pwsh\n…\n          SPT_TWO_HOST_WAIT_SECS: \"900\""}],"details":{"displayContent":{"text":"      - name: Build spt binary (toast rung)\n…\n      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n      - name: Link health probe — peer hfenduleam (tailscale RTT)\n        if: always()\n        shell: bash\n        run: bash .github/bench/link-probe.sh hfenduleam\n      - name: Two-host ladder — role B (seed-holder/server)\n        shell: bash\n        run: bash .github/bench/wrap.sh twohost-ladder-b -- cargo test -p spt-daemon --test twohost -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"b\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.68.35.65\" # hfenduleam (tailscale)\n          SPT_TWO_HOST_WAIT_SECS: \"900\"\n          SPT_TWO_HOST_NOTIFY_BIN: ${{ github.workspace }}/.adapter-notify/target/debug/notify-shell\n      # WEBSERVE W1 (releases#249): cross-node serving cells on the real rig —\n      # this host OWNS the files, hfenduleam fetches them through its own\n      # loopback listener. Its own bin, its own ports (+20), after the ladder.\n      # [int->REQ-WEB-CROSS-NODE-PROXY]\n      # THE INBOUND PROBE, before the ceremony (releases#272). A golden run spent\n      # 900 s on EACH half discovering that B's datagrams never reached A: the\n      # Windows host is BlockInbound on every profile and no rule covered the\n      # test binary, so every QUIC dial died on its 10 s bound -- 75 of them,\n      # cadenced at exactly 12.00 s, never one ADMIT. At B a dropped datagram is\n      # indistinguishable from a delivered one, so it was triaged as product,\n      # then as rig, before it was measured as box.\n      #\n      # SEPARATE INVOCATION, not a filter inside the ceremony run: within one\n      # `cargo test` the cells are threads and nothing orders them, so only a\n      # step boundary puts this FIRST.\n      #\n      # SAME BINARY, not a shell probe: the Windows rule is PER-EXECUTABLE, so an\n      # allow rule naming pwsh or python says nothing about twohost_web-<hash>.exe\n      # -- a shell probe would pass the moment the PROBER was allowed and certify\n      # the failure it exists to catch. The assertion lives on A, which is the\n      # only side that can see arrival.\n      - name: Two-host inbound probe — role B (sender)\n        shell: bash\n        run: cargo test -p spt-daemon --test twohost_web two_host_inbound_probe -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"b\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.68.35.65\" # hfenduleam (tailscale)\n          # DELIBERATELY NOT THE CEREMONY'S 900. This budget bounds RENDEZVOUS\n          # skew (how long a half waits for the other to reach its own step),\n          # not pairing, so a blocked link costs 300 s ONCE here instead of 900\n          # per cell per half below. Set explicitly because from_env's default\n          # is invisible at the step, and the step beside it says 900.\n          SPT_TWO_HOST_WAIT_SECS: \"300\"\n…\n      - name: Build spt binary (toast rung)\n…\n      # [impl->REQ-CI-LINK-HEALTH-PROBE]\n      - name: Link health probe — peer kitsubito (tailscale RTT)\n        if: always()\n        shell: pwsh\n        run: .github/bench/link-probe.ps1 -Peer kitsubito\n      - name: Two-host ladder — role A (joiner/driver)\n        shell: pwsh\n        run: .github/bench/wrap.ps1 -Step \"twohost-ladder-a\" -Command \"cargo test -p spt-daemon --test twohost -- --nocapture\"\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"a\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.98.197.12\" # kitsubito (tailscale)\n          SPT_TWO_HOST_WAIT_SECS: \"900\"\n          SPT_TWO_HOST_NOTIFY_BIN: ${{ github.workspace }}\\.adapter-notify\\target\\debug\\notify-shell.exe\n      # WEBSERVE W1 (releases#249): the requester half of the cross-node\n      # serving cells — three cells, each its own listener + broker, fetching\n      # kitsubito's files through this host's loopback. After the ladder.\n      # [int->REQ-WEB-CROSS-NODE-PROXY]\n      # THE INBOUND PROBE, before the ceremony (releases#272). A golden run spent\n      # 900 s on EACH half discovering that B's datagrams never reached A: the\n      # Windows host is BlockInbound on every profile and no rule covered the\n      # test binary, so every QUIC dial died on its 10 s bound -- 75 of them,\n      # cadenced at exactly 12.00 s, never one ADMIT. At B a dropped datagram is\n      # indistinguishable from a delivered one, so it was triaged as product,\n      # then as rig, before it was measured as box.\n      #\n      # SEPARATE INVOCATION, not a filter inside the ceremony run: within one\n      # `cargo test` the cells are threads and nothing orders them, so only a\n      # step boundary puts this FIRST.\n      #\n      # SAME BINARY, not a shell probe: the Windows rule is PER-EXECUTABLE, so an\n      # allow rule naming pwsh or python says nothing about twohost_web-<hash>.exe\n      # -- a shell probe would pass the moment the PROBER was allowed and certify\n      # the failure it exists to catch. The assertion lives on A, which is the\n      # only side that can see arrival.\n      - name: Two-host inbound probe — role A (receipt asserted here)\n        shell: pwsh\n        run: cargo test -p spt-daemon --test twohost_web two_host_inbound_probe -- --nocapture\n        env:\n          SPT_TWO_HOST: \"1\"\n          SPT_TWO_HOST_ROLE: \"a\"\n          SPT_TWO_HOST_SECRET: \"rig-twohost-ci\"\n          SPT_TWO_HOST_PEER_IP: \"100.98.197.12\" # kitsubito (tailscale)\n          # DELIBERATELY NOT THE CEREMONY'S 900. This budget bounds RENDEZVOUS\n          # skew (how long a half waits for the other to reach its own step),\n          # not pairing, so a blocked link costs 300 s ONCE here instead of 900\n          # per cell per half below. Set explicitly because from_env's default\n          # is invisible at the step, and the step beside it says 900.\n          SPT_TWO_HOST_WAIT_SECS: \"300\"\n      - name: Two-host web serving — role A (requester)\n        shell: pwsh\n…\n          SPT_TWO_HOST_WAIT_SECS: \"900\"","startLine":1089,"lineNumbers":[1089,null,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,null,1257,null,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1289,1290,1291,1292,1293,1294,1295,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,null,1322]},"fileSize":87519,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.github\\workflows\\golden.yml"}}},"isError":false,"timestamp":1789094639067}}
{"type":"message","id":"01f92660","parentId":"726540c2","timestamp":"2026-09-11T02:43:59.099Z","message":{"role":"toolResult","toolCallId":"call_Ssk7kmmLEE2reTGyUU5Vf6pG|fc_074aee81620ae383016aa36aec9e0c87d1af37af0bc240c90e","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## xtask/src/\n### main.rs\n 248|    let base = match cargo_target_dir {\n*249|        Some(dir) if !dir.is_empty() => {\n 250|            let p = Path::new(dir);\n 251|            if p.is_absolute() {\n 252|                p.to_path_buf()\n...\n 276|\n*277|fn gen(check: bool) {\n 278|    let root = repo_root();\n 279|    let bin = spt_bin(&root);\n 280|    gen_one(\n\n## spt/src/\n### main.rs\n 71|\n*72|/// The stack the CLI itself runs on.\n 73|///\n 74|/// clap's derive-built `Command` tree is constructed recursively at the top of\n 75|/// EVERY invocation — before argument one is looked at — and that construction's\n*76|/// cost scales with the argument population. The main thread's stack is not ours\n 77|/// to size (on Windows it is fixed in the PE header at link time, 1 MiB by\n 78|/// default); a thread we spawn is. Measured on this tree, on the debug profile:\n 79|/// THREE additional arguments anywhere in it — root or a nested subcommand seat,\n 80|/// the ceiling is the same either way — were enough to make every invocation die\n*81|/// with a stack overflow, `--version` included. 16 MiB is not a tuned number; it\n 82|/// is far enough above the observed cost that the argument population stops\n 83|/// being a budget the next lane has to fit under.\n*84|// [impl->REQ-CLI-STACK-HEADROOM]\n*85|const CLI_STACK_BYTES: usize = 16 * 1024 * 1024;\n 86|\n 87|/// The code a panic unwinding out of `main` leaves behind. MEASURED on this\n 88|/// binary (panic injected at the top of `cli::run`, `spt whoami` → 101), not\n...\n 92|\n*93|/// Run the CLI on a stack we sized, answering EXACTLY what it answered from the\n 94|/// main thread: the inner code on a normal return, and [`PANIC_EXIT`] on a panic.\n 95|///\n 96|/// **The normal return EXITS FROM THE SPAWNED THREAD**, and that is the whole\n...\n 124|/// function with a panicking body, rather than a second spelling of it.\n*125|// [impl->REQ-CLI-STACK-HEADROOM]\n*126|fn run_on_sized_stack(f: fn() -> i32) -> i32 {\n 127|    match std::thread::Builder::new()\n 128|        .name(\"spt-cli\".to_string())\n*129|        .stack_size(CLI_STACK_BYTES)\n 130|        .spawn(move || {\n 131|            let code = f();\n 132|            std::process::exit(code);\n...\n 147|        Err(e) => {\n*148|            eprintln!(\"CLI_STACK_FALLBACK: {e} — running on the main thread's smaller stack\");\n 149|            f()\n 150|        }\n 151|    }\n...\n 203|    // de-elevation drop must happen while still root and before anything\n*204|    // touches state. Only the CLI itself moves. [impl->REQ-CLI-STACK-HEADROOM]\n*205|    let code = run_on_sized_stack(cli::run);\n 206|    std::process::exit(code);\n 207|}\n 208|\n...\n 237|\n*238|    // [unit->REQ-CLI-STACK-HEADROOM] The wrapper's whole risk is fidelity: moving\n 239|    // the CLI off the main thread must not change what the process answers. This\n 240|    // drives the SAME function `main` calls (`cli::run` is passed to it as a\n 241|    // plain `fn` pointer, exactly like this body), so it cannot pass while the\n...\n 248|    // it in-process would end the test binary, not the assertion. That arm's\n*249|    // evidence lives in `tests/cli_stack_smoke.rs`, which drives the REAL\n 250|    // binary: `--version` and `--help` cover a zero return with output, and the\n 251|    // retired-verb refusal covers a NONZERO code arriving by return. Between\n 252|    // them the two exit shapes this function can produce are both witnessed;\n...\n 260|    #[test]\n*261|    fn the_sized_stack_wrapper_maps_a_panic_to_the_main_thread_code() {\n 262|        fn panics() -> i32 {\n*263|            panic!(\"sized-stack wrapper fidelity probe\");\n 264|        }\n 265|\n 266|        // A panic answers what a panic unwinding out of `main` answered: 101,\n...\n 269|        // is also what makes this the one arm a unit can still observe.\n*270|        assert_eq!(super::run_on_sized_stack(panics), super::PANIC_EXIT);\n 271|        // ...and 101 is not a code any ordinary return produces here, so the\n 272|        // assertion above discriminates rather than agreeing with everything.\n 273|        assert_ne!(super::PANIC_EXIT, 0);\n\nSkipped missing paths: crates/spt/build.rs"}],"details":{"scopePath":"crates/xtask/src/main.rs, crates/spt/src/main.rs, traceable-reqs.toml","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":19,"fileCount":2,"files":["crates/xtask/src/main.rs","crates/spt/src/main.rs"],"fileMatches":[{"path":"crates/xtask/src/main.rs","count":2},{"path":"crates/spt/src/main.rs","count":17}],"truncated":false,"displayContent":"# crates/\n\n## xtask/src/\n### main.rs\n 248│    let base = match cargo_target_dir {\n*249│        Some(dir) if !dir.is_empty() => {\n 250│            let p = Path::new(dir);\n 251│            if p.is_absolute() {\n 252│                p.to_path_buf()\n    │...\n 276│\n*277│fn gen(check: bool) {\n 278│    let root = repo_root();\n 279│    let bin = spt_bin(&root);\n 280│    gen_one(\n\n## spt/src/\n### main.rs\n  71│\n *72│/// The stack the CLI itself runs on.\n  73│///\n  74│/// clap's derive-built `Command` tree is constructed recursively at the top of\n  75│/// EVERY invocation — before argument one is looked at — and that construction's\n *76│/// cost scales with the argument population. The main thread's stack is not ours\n  77│/// to size (on Windows it is fixed in the PE header at link time, 1 MiB by\n  78│/// default); a thread we spawn is. Measured on this tree, on the debug profile:\n  79│/// THREE additional arguments anywhere in it — root or a nested subcommand seat,\n  80│/// the ceiling is the same either way — were enough to make every invocation die\n *81│/// with a stack overflow, `--version` included. 16 MiB is not a tuned number; it\n  82│/// is far enough above the observed cost that the argument population stops\n  83│/// being a budget the next lane has to fit under.\n *84│// [impl->REQ-CLI-STACK-HEADROOM]\n *85│const CLI_STACK_BYTES: usize = 16 * 1024 * 1024;\n  86│\n  87│/// The code a panic unwinding out of `main` leaves behind. MEASURED on this\n  88│/// binary (panic injected at the top of `cli::run`, `spt whoami` → 101), not\n    │...\n  92│\n *93│/// Run the CLI on a stack we sized, answering EXACTLY what it answered from the\n  94│/// main thread: the inner code on a normal return, and [`PANIC_EXIT`] on a panic.\n  95│///\n  96│/// **The normal return EXITS FROM THE SPAWNED THREAD**, and that is the whole\n    │...\n 124│/// function with a panicking body, rather than a second spelling of it.\n*125│// [impl->REQ-CLI-STACK-HEADROOM]\n*126│fn run_on_sized_stack(f: fn() -> i32) -> i32 {\n 127│    match std::thread::Builder::new()\n 128│        .name(\"spt-cli\".to_string())\n*129│        .stack_size(CLI_STACK_BYTES)\n 130│        .spawn(move || {\n 131│            let code = f();\n 132│            std::process::exit(code);\n    │...\n 147│        Err(e) => {\n*148│            eprintln!(\"CLI_STACK_FALLBACK: {e} — running on the main thread's smaller stack\");\n 149│            f()\n 150│        }\n 151│    }\n    │...\n 203│    // de-elevation drop must happen while still root and before anything\n*204│    // touches state. Only the CLI itself moves. [impl->REQ-CLI-STACK-HEADROOM]\n*205│    let code = run_on_sized_stack(cli::run);\n 206│    std::process::exit(code);\n 207│}\n 208│\n    │...\n 237│\n*238│    // [unit->REQ-CLI-STACK-HEADROOM] The wrapper's whole risk is fidelity: moving\n 239│    // the CLI off the main thread must not change what the process answers. This\n 240│    // drives the SAME function `main` calls (`cli::run` is passed to it as a\n 241│    // plain `fn` pointer, exactly like this body), so it cannot pass while the\n    │...\n 248│    // it in-process would end the test binary, not the assertion. That arm's\n*249│    // evidence lives in `tests/cli_stack_smoke.rs`, which drives the REAL\n 250│    // binary: `--version` and `--help` cover a zero return with output, and the\n 251│    // retired-verb refusal covers a NONZERO code arriving by return. Between\n 252│    // them the two exit shapes this function can produce are both witnessed;\n    │...\n 260│    #[test]\n*261│    fn the_sized_stack_wrapper_maps_a_panic_to_the_main_thread_code() {\n 262│        fn panics() -> i32 {\n*263│            panic!(\"sized-stack wrapper fidelity probe\");\n 264│        }\n 265│\n 266│        // A panic answers what a panic unwinding out of `main` answered: 101,\n    │...\n 269│        // is also what makes this the one arm a unit can still observe.\n*270│        assert_eq!(super::run_on_sized_stack(panics), super::PANIC_EXIT);\n 271│        // ...and 101 is not a code any ordinary return produces here, so the\n 272│        // assertion above discriminates rather than agreeing with everything.\n 273│        assert_ne!(super::PANIC_EXIT, 0);","missingPaths":["crates/spt/build.rs"]},"isError":false,"timestamp":1789094639099}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_C8WYTYSM88aFdqftD3f9mfE8|fc_074aee81620ae383016aa36af78b1c87d1936eb9c64c3e4dd5","toolName":"read","startedAt":"2026-09-11T02:44:09.972Z","args":{"path":"crates/xtask/src/main.rs:277-385"},"intent":"Reading generator refusal implementation"},"id":"67ab40ff","parentId":"01f92660","timestamp":"2026-09-11T02:44:09.972Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Ts124bGve4GuGTdV7ieMDwWw|fc_074aee81620ae383016aa36af78b2c87d1bcd9711b58c20f56","toolName":"grep","startedAt":"2026-09-11T02:44:09.972Z","args":{"path":"docs/GOLDEN-CI.md;docs/INFRA-REGISTER.md:1-179;crates/spt/tests/cli_stack_smoke.rs"},"intent":"Finding documented closure evidence"},"id":"e085068d","parentId":"67ab40ff","timestamp":"2026-09-11T02:44:09.972Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_sVFjeGBKUqu9RRpfKDHbmBjK|fc_074aee81620ae383016aa36af78b3887d1bb7f216ff8859097","toolName":"read","startedAt":"2026-09-11T02:44:09.972Z","args":{"path":"docs/INFRA-REGISTER.md:2878-2932"},"intent":"Reading rider conditional resolution"},"id":"d29c344e","parentId":"e085068d","timestamp":"2026-09-11T02:44:09.972Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_avxcssLR2Dpei4TvCH9sfStZ|fc_074aee81620ae383016aa36af78b4487d1a31ef5d3af6e5139","toolName":"grep","startedAt":"2026-09-11T02:44:09.973Z","args":{"path":"crates/xtask/src/main.rs:2870-3020;crates/spt-store/src/info.rs"},"intent":"Checking remaining preventive closure sites"},"id":"069aff5c","parentId":"d29c344e","timestamp":"2026-09-11T02:44:09.973Z"}
{"type":"message","id":"6d21fff5","parentId":"069aff5c","timestamp":"2026-09-11T02:44:09.973Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Verifying entry 32**"},{"type":"toolCall","id":"call_C8WYTYSM88aFdqftD3f9mfE8|fc_074aee81620ae383016aa36af78b1c87d1936eb9c64c3e4dd5","name":"read","arguments":{"i":"Reading generator refusal implementation","path":"crates/xtask/src/main.rs:277-385"},"intent":"Reading generator refusal implementation"},{"type":"toolCall","id":"call_Ts124bGve4GuGTdV7ieMDwWw|fc_074aee81620ae383016aa36af78b2c87d1bcd9711b58c20f56","name":"grep","arguments":{"i":"Finding documented closure evidence","pattern":"IR-32|IR-33|REQ-CLI-STACK-HEADROOM|REQ-LOCK-TOUCHING-LANE-PROCEDURE|consumer|CONSUMER","path":"docs/GOLDEN-CI.md;docs/INFRA-REGISTER.md:1-179;crates/spt/tests/cli_stack_smoke.rs","case":false,"gitignore":true,"skip":0},"intent":"Finding documented closure evidence"},{"type":"toolCall","id":"call_sVFjeGBKUqu9RRpfKDHbmBjK|fc_074aee81620ae383016aa36af78b3887d1bb7f216ff8859097","name":"read","arguments":{"i":"Reading rider conditional resolution","path":"docs/INFRA-REGISTER.md:2878-2932"},"intent":"Reading rider conditional resolution"},{"type":"toolCall","id":"call_avxcssLR2Dpei4TvCH9sfStZ|fc_074aee81620ae383016aa36af78b4487d1a31ef5d3af6e5139","name":"grep","arguments":{"i":"Checking remaining preventive closure sites","pattern":"CRLF|crlf|the_checked_in_config_is_in_parity|serializ.*ALL|never lose","path":"crates/xtask/src/main.rs:2870-3020;crates/spt-store/src/info.rs","case":false,"gitignore":true,"skip":0},"intent":"Checking remaining preventive closure sites"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":5910,"output":300,"cacheRead":107648,"cacheWrite":0,"totalTokens":113858,"reasoningTokens":30,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094639153,"responseId":"resp_074aee81620ae383016aa36aed185487d1ad10342a20640c40","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_074aee81620ae383016aa36aee8df887d1a0be8cf5145cbf74","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo2r3FCohf1XQBLsARK0R1bCK_XHqf-URBRTAE66oELE9YTdtdeB4nNejT0ewPgLwSOVSmWAVs-MOWKLXyItVnXogKTXY0fMaUNZ6E97r6h-JgfLE7FqDEYbEXprlpsI0y5SWBZ9TY3UzVOChLD5vsna892EMJB7xusdp_evbEeeWw4jU6JoDsMR4eDTjOfuJJ0KN-RZqcLrtXL8UbAZWdIUCFFsYm0o0Umfs-H17StlkM5qz0_J6LHonsgubPqN_mcKZwBioLW69slHBBsYSoC1x_W-QDsOF0vS8Phg0ODLnDWzhRuKJP2_aBhvYwP6W8-ZLe8Fo3qvdCjtgys5Gf8kZuqn-MMlWIVLVlbsb90Pa0JDt0pkKXnoxBmLNZRkolCBhHuOSjck61-bmixXVQpqmekdyO-jBaI5z0g6LZeMEDiYbnav69Y9AbQ1FbuPAodvsKhSKrHOVY_T_wXIaFKDTmaOjAWTMA4hH-6ELtF6UemoFZpo4wnM9qENjn8nCF_1c7DfifwLN0QJuxpTLQ3LohK54J1JU0lx9MRMC-n2YJtcvrLo3p5yLqzCWWnc7JJ50zsmaY2FNVZzjbmapE1qCKzWsg7bIFbNORKAxnir6EntB7LpMhJTvViX-1WHIjoMs_uNR2e2dxMCRd-DeHoMcGR5fWtoHi-fbc3YDLrb09wCtGsdi454lLw_8dMdkWxGfwb4M1VaRAYo1lGisdECpjeiVEXWn4AXmUiT6BQlsQte_nhrPlJh0euPIV75W9za9GYTYKA5WnsS_i-raaEOfa6uaoiPV7HAE_dH-nVTFoDymtnxTqvMefr0mI7k7DvxtAWoPMr8A9ZHgH6gjH_XeaS5nn2CaIt5aLpYJkVKb_4VvtwInneYLwEKY_UHPOjnsSiI3x5uEBFnEF1TDiiRrJHX70T_0LH5cbU2MF_zxnoR-9nKZk-kUochuGMCUCfNBuXAYYDPe4fDhqxJ_fPAMb3K7o9meLdG4qvKhqfOQOeEXhbmIGD_Jd5Gm9-DGQ_bDmYk5rplelMrKHvAIT1WXnu43JooI5rXG_Wadr-hsNKQKbQSbulGmGdktUakk0f6pPtA7TaRUgXgm6GjIQLzuwbzU5AeoZ1QtNYZBmdCFXNxliHGyBaP4meV7IBU2laAS37wetooWxCft_2AoodHX4XMVSd7046UzLjNgyxGwJzT0l4TP-7xYsykoNVjHQDSZH9aiAcasRLrMjK-jygkqKTqY3sS_T10sQgeR6_9OqLJ1qMiGALs-LZCCjRSkFL0F85hvH-xQIDiuxlAhhUffGLICG5Vs2qb2EHLPG7v2Wi_Lut0Ip0h0dj3t_zwe9Fpopn0_68h3FwChgTZH1lL8rBo-Mwlr5bV4UsBtp4GNnI7dXuWAKxfQe2qRfSDjaGIH","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"summary":[{"type":"summary_text","text":"**Verifying entry 32**"}],"metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36af78b1c87d1936eb9c64c3e4dd5","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading generator refusal implementation\",\"path\":\"crates/xtask/src/main.rs:277-385\"}","call_id":"call_C8WYTYSM88aFdqftD3f9mfE8","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36af78b2c87d1bcd9711b58c20f56","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding documented closure evidence\",\"pattern\":\"IR-32|IR-33|REQ-CLI-STACK-HEADROOM|REQ-LOCK-TOUCHING-LANE-PROCEDURE|consumer|CONSUMER\",\"path\":\"docs/GOLDEN-CI.md;docs/INFRA-REGISTER.md:1-179;crates/spt/tests/cli_stack_smoke.rs\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_Ts124bGve4GuGTdV7ieMDwWw","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36af78b3887d1bb7f216ff8859097","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading rider conditional resolution\",\"path\":\"docs/INFRA-REGISTER.md:2878-2932\"}","call_id":"call_sVFjeGBKUqu9RRpfKDHbmBjK","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36af78b4487d1a31ef5d3af6e5139","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking remaining preventive closure sites\",\"pattern\":\"CRLF|crlf|the_checked_in_config_is_in_parity|serializ.*ALL|never lose\",\"path\":\"crates/xtask/src/main.rs:2870-3020;crates/spt-store/src/info.rs\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_avxcssLR2Dpei4TvCH9sfStZ","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":10816.85300000012,"ttft":1755.354400000535,"completedAt":1789094649970,"contextSnapshot":{"promptTokens":113558,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"message","id":"a3c5f54a","parentId":"6d21fff5","timestamp":"2026-09-11T02:44:09.985Z","message":{"role":"toolResult","toolCallId":"call_C8WYTYSM88aFdqftD3f9mfE8|fc_074aee81620ae383016aa36af78b1c87d1936eb9c64c3e4dd5","toolName":"read","content":[{"type":"text","text":"\nfn gen(check: bool) {\n    let root = repo_root();\n    let bin = spt_bin(&root);\n    gen_one(\n        &root,\n        \"docs-site/src/cli/reference.md\",\n        &cli_reference(&bin),\n        \"the binary's --help\",\n        check,\n    );\n    // [impl->REQ-DOCS-CHANGELOG-PAGE] the changelog half is a returning seam\n    // (below); this edge is where its Err becomes the operator's exit code.\n    if let Err(e) = gen_changelog(&root, check) {\n        eprintln!(\"{e}\");\n        std::process::exit(1);\n    }\n}\n\n/// Write the generated changelog page from `<root>/CHANGELOG.md`, or diff it\n/// and REPORT drift when `check`.\n///\n/// Root-parameterised and returning, unlike [`gen_one`]: a seam that reads\n/// `repo_root()` and exits on drift can only be witnessed by an operator\n/// running the command, so the drift half would ship untested by construction.\n/// The exit lives at the CLI edge in [`gen`] instead, leaving what an operator\n/// sees unchanged.\n// [impl->REQ-DOCS-CHANGELOG-PAGE]\nfn gen_changelog(root: &Path, check: bool) -> Result<(), String> {\n    let relative = \"docs-site/src/changelog.md\";\n    let source = root.join(\"CHANGELOG.md\");\n    let changelog = std::fs::read_to_string(&source)\n        .map_err(|e| format!(\"xtask: read {}: {e}\", source.display()))?;\n    let generated = changelog_page(&changelog);\n    let path = root.join(relative);\n    if check {\n        let on_disk = std::fs::read_to_string(&path)\n            .map_err(|e| {\n                format!(\n                    \"xtask check: read checked-in {relative}: {e} \\\n                     (run `cargo run -p xtask -- gen`)\"\n                )\n            })?\n            .replace(\"\\r\\n\", \"\\n\");\n        if on_disk != generated {\n            return Err(format!(\n                \"xtask check: {relative} drifted from CHANGELOG.md — \\\n                 run `cargo run -p xtask -- gen` and commit\"\n            ));\n        }\n    } else {\n        std::fs::write(&path, &generated)\n            .map_err(|e| format!(\"xtask gen: write {relative}: {e}\"))?;\n        eprintln!(\"xtask gen: wrote {}\", path.display());\n    }\n    Ok(())\n}\n\n/// Write one generated page, or diff it and exit 1 when `check`.\n///\n/// The two pages differ only in what they are generated FROM, so the write and\n/// the drift diff live here once: a second page copied from the first is how\n/// the check half gets forgotten on the page that needed it.\nfn gen_one(root: &Path, relative: &str, generated: &str, source: &str, check: bool) {\n    let path = root.join(relative);\n    if check {\n        let on_disk = std::fs::read_to_string(&path)\n            .unwrap_or_else(|_| panic!(\"checked-in {relative} (run `cargo run -p xtask -- gen`)\"))\n            .replace(\"\\r\\n\", \"\\n\");\n        if on_disk != generated {\n            eprintln!(\n                \"xtask check: {relative} drifted from {source} — \\\n                 run `cargo run -p xtask -- gen` and commit\"\n            );\n            std::process::exit(1);\n        }\n    } else {\n        std::fs::write(&path, generated).unwrap_or_else(|e| panic!(\"write {relative}: {e}\"));\n        eprintln!(\"xtask gen: wrote {}\", path.display());\n    }\n}\n\n// ------------------------------------------------ public-help token gate\n\n/// Capture an internal-code token starting at `s[0]`: the run of\n/// `[A-Za-z0-9-]` plus `#` (so `REQ-MSG-5`, `ADR-0019`, `M8-W5`, and\n/// `releases#22` are returned whole).\nfn capture_code(s: &str) -> String {\n    s.chars()\n        .take_while(|c| c.is_ascii_alphanumeric() || *c == '-' || *c == '#')\n        .collect()\n}\n\n/// Internal tracker/decision codes that must never appear in generated public\n/// documentation. Pure: returns each `(line_number, token)` so the gate reports\n/// precisely. Classes: `REQ-<UPPER>`, `ADR-<digit>`, `F-<digit>`,\n/// `M<digit…>-W<digit…>`, and `releases#<digit>` — each only at a LEFT word\n/// boundary, so a plain word like `UTF-8` never trips the `F-` rule and `PERF-X`\n/// never trips anything.\n// [impl->REQ-DOCS-NO-INTERNAL-CODES]\nfn forbidden_codes_in(text: &str) -> Vec<(usize, String)> {\n    // Line number (1-based) for a byte offset.\n    let mut line_starts = vec![0usize];\n    for (i, c) in text.char_indices() {\n        if c == '\\n' {\n            line_starts.push(i + 1);\n        }\n    }\n    let line_of = |idx: usize| line_starts.partition_point(|&s| s <= idx);\n    forbidden_code_spans(text)\n        .into_iter()\n        .map(|(start, end)| (line_of(start), text[start..end].to_owned()))\n        .collect()\n}\n\n[Showing lines 276-388 of 3565. Use :389 to continue]"}],"details":{"truncation":{"content":"\r\nfn gen(check: bool) {\r\n    let root = repo_root();\r\n    let bin = spt_bin(&root);\r\n    gen_one(\r\n        &root,\r\n        \"docs-site/src/cli/reference.md\",\r\n        &cli_reference(&bin),\r\n        \"the binary's --help\",\r\n        check,\r\n    );\r\n    // [impl->REQ-DOCS-CHANGELOG-PAGE] the changelog half is a returning seam\r\n    // (below); this edge is where its Err becomes the operator's exit code.\r\n    if let Err(e) = gen_changelog(&root, check) {\r\n        eprintln!(\"{e}\");\r\n        std::process::exit(1);\r\n    }\r\n}\r\n\r\n/// Write the generated changelog page from `<root>/CHANGELOG.md`, or diff it\r\n/// and REPORT drift when `check`.\r\n///\r\n/// Root-parameterised and returning, unlike [`gen_one`]: a seam that reads\r\n/// `repo_root()` and exits on drift can only be witnessed by an operator\r\n/// running the command, so the drift half would ship untested by construction.\r\n/// The exit lives at the CLI edge in [`gen`] instead, leaving what an operator\r\n/// sees unchanged.\r\n// [impl->REQ-DOCS-CHANGELOG-PAGE]\r\nfn gen_changelog(root: &Path, check: bool) -> Result<(), String> {\r\n    let relative = \"docs-site/src/changelog.md\";\r\n    let source = root.join(\"CHANGELOG.md\");\r\n    let changelog = std::fs::read_to_string(&source)\r\n        .map_err(|e| format!(\"xtask: read {}: {e}\", source.display()))?;\r\n    let generated = changelog_page(&changelog);\r\n    let path = root.join(relative);\r\n    if check {\r\n        let on_disk = std::fs::read_to_string(&path)\r\n            .map_err(|e| {\r\n                format!(\r\n                    \"xtask check: read checked-in {relative}: {e} \\\r\n                     (run `cargo run -p xtask -- gen`)\"\r\n                )\r\n            })?\r\n            .replace(\"\\r\\n\", \"\\n\");\r\n        if on_disk != generated {\r\n            return Err(format!(\r\n                \"xtask check: {relative} drifted from CHANGELOG.md — \\\r\n                 run `cargo run -p xtask -- gen` and commit\"\r\n            ));\r\n        }\r\n    } else {\r\n        std::fs::write(&path, &generated)\r\n            .map_err(|e| format!(\"xtask gen: write {relative}: {e}\"))?;\r\n        eprintln!(\"xtask gen: wrote {}\", path.display());\r\n    }\r\n    Ok(())\r\n}\r\n\r\n/// Write one generated page, or diff it and exit 1 when `check`.\r\n///\r\n/// The two pages differ only in what they are generated FROM, so the write and\r\n/// the drift diff live here once: a second page copied from the first is how\r\n/// the check half gets forgotten on the page that needed it.\r\nfn gen_one(root: &Path, relative: &str, generated: &str, source: &str, check: bool) {\r\n    let path = root.join(relative);\r\n    if check {\r\n        let on_disk = std::fs::read_to_string(&path)\r\n            .unwrap_or_else(|_| panic!(\"checked-in {relative} (run `cargo run -p xtask -- gen`)\"))\r\n            .replace(\"\\r\\n\", \"\\n\");\r\n        if on_disk != generated {\r\n            eprintln!(\r\n                \"xtask check: {relative} drifted from {source} — \\\r\n                 run `cargo run -p xtask -- gen` and commit\"\r\n            );\r\n            std::process::exit(1);\r\n        }\r\n    } else {\r\n        std::fs::write(&path, generated).unwrap_or_else(|e| panic!(\"write {relative}: {e}\"));\r\n        eprintln!(\"xtask gen: wrote {}\", path.display());\r\n    }\r\n}\r\n\r\n// ------------------------------------------------ public-help token gate\r\n\r\n/// Capture an internal-code token starting at `s[0]`: the run of\r\n/// `[A-Za-z0-9-]` plus `#` (so `REQ-MSG-5`, `ADR-0019`, `M8-W5`, and\r\n/// `releases#22` are returned whole).\r\nfn capture_code(s: &str) -> String {\r\n    s.chars()\r\n        .take_while(|c| c.is_ascii_alphanumeric() || *c == '-' || *c == '#')\r\n        .collect()\r\n}\r\n\r\n/// Internal tracker/decision codes that must never appear in generated public\r\n/// documentation. Pure: returns each `(line_number, token)` so the gate reports\r\n/// precisely. Classes: `REQ-<UPPER>`, `ADR-<digit>`, `F-<digit>`,\r\n/// `M<digit…>-W<digit…>`, and `releases#<digit>` — each only at a LEFT word\r\n/// boundary, so a plain word like `UTF-8` never trips the `F-` rule and `PERF-X`\r\n/// never trips anything.\r\n// [impl->REQ-DOCS-NO-INTERNAL-CODES]\r\nfn forbidden_codes_in(text: &str) -> Vec<(usize, String)> {\r\n    // Line number (1-based) for a byte offset.\r\n    let mut line_starts = vec![0usize];\r\n    for (i, c) in text.char_indices() {\r\n        if c == '\\n' {\r\n            line_starts.push(i + 1);\r\n        }\r\n    }\r\n    let line_of = |idx: usize| line_starts.partition_point(|&s| s <= idx);\r\n    forbidden_code_spans(text)\r\n        .into_iter()\r\n        .map(|(start, end)| (line_of(start), text[start..end].to_owned()))\r\n        .collect()\r","truncated":true,"truncatedBy":"lines","totalLines":3290,"totalBytes":4592,"outputLines":113,"outputBytes":4592,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3565,"displayContent":{"text":"\r\nfn gen(check: bool) {\r\n    let root = repo_root();\r\n    let bin = spt_bin(&root);\r\n    gen_one(\r\n        &root,\r\n        \"docs-site/src/cli/reference.md\",\r\n        &cli_reference(&bin),\r\n        \"the binary's --help\",\r\n        check,\r\n    );\r\n    // [impl->REQ-DOCS-CHANGELOG-PAGE] the changelog half is a returning seam\r\n    // (below); this edge is where its Err becomes the operator's exit code.\r\n    if let Err(e) = gen_changelog(&root, check) {\r\n        eprintln!(\"{e}\");\r\n        std::process::exit(1);\r\n    }\r\n}\r\n\r\n/// Write the generated changelog page from `<root>/CHANGELOG.md`, or diff it\r\n/// and REPORT drift when `check`.\r\n///\r\n/// Root-parameterised and returning, unlike [`gen_one`]: a seam that reads\r\n/// `repo_root()` and exits on drift can only be witnessed by an operator\r\n/// running the command, so the drift half would ship untested by construction.\r\n/// The exit lives at the CLI edge in [`gen`] instead, leaving what an operator\r\n/// sees unchanged.\r\n// [impl->REQ-DOCS-CHANGELOG-PAGE]\r\nfn gen_changelog(root: &Path, check: bool) -> Result<(), String> {\r\n    let relative = \"docs-site/src/changelog.md\";\r\n    let source = root.join(\"CHANGELOG.md\");\r\n    let changelog = std::fs::read_to_string(&source)\r\n        .map_err(|e| format!(\"xtask: read {}: {e}\", source.display()))?;\r\n    let generated = changelog_page(&changelog);\r\n    let path = root.join(relative);\r\n    if check {\r\n        let on_disk = std::fs::read_to_string(&path)\r\n            .map_err(|e| {\r\n                format!(\r\n                    \"xtask check: read checked-in {relative}: {e} \\\r\n                     (run `cargo run -p xtask -- gen`)\"\r\n                )\r\n            })?\r\n            .replace(\"\\r\\n\", \"\\n\");\r\n        if on_disk != generated {\r\n            return Err(format!(\r\n                \"xtask check: {relative} drifted from CHANGELOG.md — \\\r\n                 run `cargo run -p xtask -- gen` and commit\"\r\n            ));\r\n        }\r\n    } else {\r\n        std::fs::write(&path, &generated)\r\n            .map_err(|e| format!(\"xtask gen: write {relative}: {e}\"))?;\r\n        eprintln!(\"xtask gen: wrote {}\", path.display());\r\n    }\r\n    Ok(())\r\n}\r\n\r\n/// Write one generated page, or diff it and exit 1 when `check`.\r\n///\r\n/// The two pages differ only in what they are generated FROM, so the write and\r\n/// the drift diff live here once: a second page copied from the first is how\r\n/// the check half gets forgotten on the page that needed it.\r\nfn gen_one(root: &Path, relative: &str, generated: &str, source: &str, check: bool) {\r\n    let path = root.join(relative);\r\n    if check {\r\n        let on_disk = std::fs::read_to_string(&path)\r\n            .unwrap_or_else(|_| panic!(\"checked-in {relative} (run `cargo run -p xtask -- gen`)\"))\r\n            .replace(\"\\r\\n\", \"\\n\");\r\n        if on_disk != generated {\r\n            eprintln!(\r\n                \"xtask check: {relative} drifted from {source} — \\\r\n                 run `cargo run -p xtask -- gen` and commit\"\r\n            );\r\n            std::process::exit(1);\r\n        }\r\n    } else {\r\n        std::fs::write(&path, generated).unwrap_or_else(|e| panic!(\"write {relative}: {e}\"));\r\n        eprintln!(\"xtask gen: wrote {}\", path.display());\r\n    }\r\n}\r\n\r\n// ------------------------------------------------ public-help token gate\r\n\r\n/// Capture an internal-code token starting at `s[0]`: the run of\r\n/// `[A-Za-z0-9-]` plus `#` (so `REQ-MSG-5`, `ADR-0019`, `M8-W5`, and\r\n/// `releases#22` are returned whole).\r\nfn capture_code(s: &str) -> String {\r\n    s.chars()\r\n        .take_while(|c| c.is_ascii_alphanumeric() || *c == '-' || *c == '#')\r\n        .collect()\r\n}\r\n\r\n/// Internal tracker/decision codes that must never appear in generated public\r\n/// documentation. Pure: returns each `(line_number, token)` so the gate reports\r\n/// precisely. Classes: `REQ-<UPPER>`, `ADR-<digit>`, `F-<digit>`,\r\n/// `M<digit…>-W<digit…>`, and `releases#<digit>` — each only at a LEFT word\r\n/// boundary, so a plain word like `UTF-8` never trips the `F-` rule and `PERF-X`\r\n/// never trips anything.\r\n// [impl->REQ-DOCS-NO-INTERNAL-CODES]\r\nfn forbidden_codes_in(text: &str) -> Vec<(usize, String)> {\r\n    // Line number (1-based) for a byte offset.\r\n    let mut line_starts = vec![0usize];\r\n    for (i, c) in text.char_indices() {\r\n        if c == '\\n' {\r\n            line_starts.push(i + 1);\r\n        }\r\n    }\r\n    let line_of = |idx: usize| line_starts.partition_point(|&s| s <= idx);\r\n    forbidden_code_spans(text)\r\n        .into_iter()\r\n        .map(|(start, end)| (line_of(start), text[start..end].to_owned()))\r\n        .collect()\r\n}","startLine":276,"lineNumbers":[276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389]},"fileSize":151917,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3565,"totalBytes":4592,"outputLines":113,"outputBytes":4592,"shownRange":{"start":276,"end":388},"nextOffset":389}}},"isError":false,"timestamp":1789094649985}}
{"type":"message","id":"41e75a15","parentId":"a3c5f54a","timestamp":"2026-09-11T02:44:09.988Z","message":{"role":"toolResult","toolCallId":"call_sVFjeGBKUqu9RRpfKDHbmBjK|fc_074aee81620ae383016aa36af78b3887d1bb7f216ff8859097","toolName":"read","content":[{"type":"text","text":"### IR-52 — docs-site CLI reference renders SHALLOW; help text below the rendered depth is outside the drift gate, unit-held per-REQ or held by nothing\n- **THIRD INSTANCE, observed 2026-08-24 (todlando, WAX-SEAL #21 W4; not acted on):** the new\n…\n- **Kin:** the REQ-CLI-SURFACE-SECTION-SITED pinned walk (the per-REQ closure shape this\n…\n\n### CI-RIDER LANE STATE — LANDED 2026-08-04 (post-v0.53.0 merge queue); history below kept for its mechanisms\n- **RESOLVED:** the lane rebased clean onto the post-tag queue and landed ff-only as\n  `2b33a47`/`2a7b016`/`d63f4ce`/`19d7f79` (content byte-identical to `1275e47..bf8c4a2` by lane-diff\n  blob hash). IR-1 and IR-4 are BUILT AND LANDED; IR-9's measurement half is landed with its trigger\n  now armed — the toolchain print reports runner-account versions on the NEXT GOLDEN RUN, which is\n  when doyle's 2026-08-03 ruling (decide from runner-account versions, never the interactive prior)\n  becomes executable. The two golden-only steps (link probe both boxes, toolchain print both legs)\n  remain unexercised until that run — the landing does not change that caveat.\n- **As recorded pre-landing (2026-08-04, doyle):** `ci/locksmith-riders` was at `bf8c4a2` with FOUR\n  commits not contained in `origin/main` and not present in LOCKSMITH's golden head `b7b00c3`. The\n  worktree `.worktrees/hertz-ci-riders` was clean, so the work existed and was simply unlanded:\n  `1275e47` (xtask: assert a load-bearing patch pin is still in force, both ways it lapses) ·\n  `49d4805` (docs/ci: a lock-touching lane reads edges, not just the package set) ·\n  `8ed006b` (ci/golden: print the toolchain that judged the run, both legs) ·\n  `bf8c4a2` (ci/golden: measure the link before rendezvous, read the floor after the checkout that\n  clears it — the floor read AFTER its own reclaim is [[ci-runner-has-no-warm-target]]'s shape).\n- **Why it is recorded rather than quietly re-dispatched:** [[IR-1]]/[[IR-4]]/[[IR-9]] were carried\n  as DISPATCHED, which is now false in BOTH directions — the work is further along than dispatched,\n  and it also did not ship. The cause was the same agent outage that cost `#123` its build, and the\n  operator's standing rule from that drop applies here too: an outage must not be able to remove\n  work from a batch silently. Board requests got a drop comment; register entries get this.\n- **MAPPING CONFIRMED BY ITS BUILDER 2026-08-04, by REQ id rather than by recollection** — hertz\n  noted first that its own context had been cleared between building the lane and answering, and\n  declined to testify from memory about the original instrument. Everything here is either measured\n  that day or read off the commits:\n  `1275e47` → `REQ-CI-LOAD-BEARING-PATCH-PIN` ([[IR-4]] part 1, the mechanical pin guard in xtask) ·\n  `49d4805` → `REQ-LOCK-TOUCHING-LANE-PROCEDURE` ([[IR-4]] part 2, procedure in docs/GOLDEN-CI.md) ·\n  `8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT` ([[IR-4]] part 3, carrying [[IR-9]]) ·\n  `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE` ([[IR-1]], the network axis).\n- **CORRECTION TO THE GATER'S EARLIER WORDING, from the builder:** `8ed006b` does NOT discharge\n  [[IR-9]] — it discharges IR-9's MEASUREMENT half only. IR-9's other half (align the two boxes, or\n  declare one authoritative clippy leg) is held by doyle's own 2026-08-03 ruling: decide once the\n  step reports RUNNER-ACCOUNT versions, never on the interactive-account prior. IR-9 therefore stays\n  OPEN with its trigger now REACHABLE, which is a different state from \"waiting\".\n- **Gate evidence, instrument NAMED:** `cargo nextest run -p xtask` in `.worktrees/hertz-ci-riders`\n  on hfenduleam, box quiet with no runs in flight — 34 run, 34 passed, 0 skipped. Nextest rather\n  than bare `cargo test`, per [[IR-25]]. ⚠ **What that does NOT cover, stated by the builder rather\n  than discovered later:** the two golden steps the lane ADDS (link probe on both boxes, toolchain\n  print on both legs) cannot be exercised outside a golden run. The probe's three arms\n  (five-sample success, no-reply, absent-CLI) were exercised on the real boxes at commit time, and\n  that is reported as a CLAIM RECORDED AT COMMIT TIME, not as a re-verification — the kitsubito arm\n  could not be re-checked from here. This is why the lane wants a golden rather than a quiet ff.\n- **[[IR-5]]/[[IR-6]] CONDITIONAL RIDERS: CONDITION NOT MET — the answer is NO and it closes the\n  question for this lane.** Measured file set `6d291e0..bf8c4a2`: `.gitattributes`,\n  `.github/bench/link-probe.ps1`, `.github/bench/link-probe.sh`, `.github/workflows/golden.yml`,\n  `crates/xtask/src/main.rs`, `crates/xtask/tests/bench_row_parity.rs`, `docs/GOLDEN-CI.md`,\n  `traceable-reqs.toml`. Nothing under `.github/ci/`, where the nextest-summary readers and\n  count-reporting scripts live. IR-5: no consumer of nextest output touched. IR-6: no EXISTING gate\n  output changed — though the NEW output was voluntarily written to IR-6's rule (the LINK line\n  prints `samples=N/M` and the individual rtts, membership beside the count, in both shells). That\n  SHRINKS IR-6's future scope by two lines; it does not discharge it.\n- **Three mechanisms lifted from this lane's REQ titles, worth more than the lane:**\n  (a) **An instrument must not be able to RED the run, and each shell breaks that differently** —\n  bash: `| head` under `pipefail` SIGPIPEs the producer to 141, so a print step reds (trim with\n  parameter expansion instead); pwsh under GitHub's wrapper: a MISSING COMMAND is a terminating\n  error, so rustup's absence must be TESTED with `Get-Command`, never caught. One requirement, two\n  constructions, and neither is portable reasoning about the other.\n  (b) **A negative-control mutation must be COUNTED before it is trusted** — the absent-CLI arm was\n…\n  the failure. Both med and max rows ride the ledger.\n…\n\n\n[Showing lines 2877-2935 of 5781. Use :2936 to continue]"}],"details":{"truncation":{"content":"\r\n### CI-RIDER LANE STATE — LANDED 2026-08-04 (post-v0.53.0 merge queue); history below kept for its mechanisms\r\n- **RESOLVED:** the lane rebased clean onto the post-tag queue and landed ff-only as\r\n  `2b33a47`/`2a7b016`/`d63f4ce`/`19d7f79` (content byte-identical to `1275e47..bf8c4a2` by lane-diff\r\n  blob hash). IR-1 and IR-4 are BUILT AND LANDED; IR-9's measurement half is landed with its trigger\r\n  now armed — the toolchain print reports runner-account versions on the NEXT GOLDEN RUN, which is\r\n  when doyle's 2026-08-03 ruling (decide from runner-account versions, never the interactive prior)\r\n  becomes executable. The two golden-only steps (link probe both boxes, toolchain print both legs)\r\n  remain unexercised until that run — the landing does not change that caveat.\r\n- **As recorded pre-landing (2026-08-04, doyle):** `ci/locksmith-riders` was at `bf8c4a2` with FOUR\r\n  commits not contained in `origin/main` and not present in LOCKSMITH's golden head `b7b00c3`. The\r\n  worktree `.worktrees/hertz-ci-riders` was clean, so the work existed and was simply unlanded:\r\n  `1275e47` (xtask: assert a load-bearing patch pin is still in force, both ways it lapses) ·\r\n  `49d4805` (docs/ci: a lock-touching lane reads edges, not just the package set) ·\r\n  `8ed006b` (ci/golden: print the toolchain that judged the run, both legs) ·\r\n  `bf8c4a2` (ci/golden: measure the link before rendezvous, read the floor after the checkout that\r\n  clears it — the floor read AFTER its own reclaim is [[ci-runner-has-no-warm-target]]'s shape).\r\n- **Why it is recorded rather than quietly re-dispatched:** [[IR-1]]/[[IR-4]]/[[IR-9]] were carried\r\n  as DISPATCHED, which is now false in BOTH directions — the work is further along than dispatched,\r\n  and it also did not ship. The cause was the same agent outage that cost `#123` its build, and the\r\n  operator's standing rule from that drop applies here too: an outage must not be able to remove\r\n  work from a batch silently. Board requests got a drop comment; register entries get this.\r\n- **MAPPING CONFIRMED BY ITS BUILDER 2026-08-04, by REQ id rather than by recollection** — hertz\r\n  noted first that its own context had been cleared between building the lane and answering, and\r\n  declined to testify from memory about the original instrument. Everything here is either measured\r\n  that day or read off the commits:\r\n  `1275e47` → `REQ-CI-LOAD-BEARING-PATCH-PIN` ([[IR-4]] part 1, the mechanical pin guard in xtask) ·\r\n  `49d4805` → `REQ-LOCK-TOUCHING-LANE-PROCEDURE` ([[IR-4]] part 2, procedure in docs/GOLDEN-CI.md) ·\r\n  `8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT` ([[IR-4]] part 3, carrying [[IR-9]]) ·\r\n  `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE` ([[IR-1]], the network axis).\r\n- **CORRECTION TO THE GATER'S EARLIER WORDING, from the builder:** `8ed006b` does NOT discharge\r\n  [[IR-9]] — it discharges IR-9's MEASUREMENT half only. IR-9's other half (align the two boxes, or\r\n  declare one authoritative clippy leg) is held by doyle's own 2026-08-03 ruling: decide once the\r\n  step reports RUNNER-ACCOUNT versions, never on the interactive-account prior. IR-9 therefore stays\r\n  OPEN with its trigger now REACHABLE, which is a different state from \"waiting\".\r\n- **Gate evidence, instrument NAMED:** `cargo nextest run -p xtask` in `.worktrees/hertz-ci-riders`\r\n  on hfenduleam, box quiet with no runs in flight — 34 run, 34 passed, 0 skipped. Nextest rather\r\n  than bare `cargo test`, per [[IR-25]]. ⚠ **What that does NOT cover, stated by the builder rather\r\n  than discovered later:** the two golden steps the lane ADDS (link probe on both boxes, toolchain\r\n  print on both legs) cannot be exercised outside a golden run. The probe's three arms\r\n  (five-sample success, no-reply, absent-CLI) were exercised on the real boxes at commit time, and\r\n  that is reported as a CLAIM RECORDED AT COMMIT TIME, not as a re-verification — the kitsubito arm\r\n  could not be re-checked from here. This is why the lane wants a golden rather than a quiet ff.\r\n- **[[IR-5]]/[[IR-6]] CONDITIONAL RIDERS: CONDITION NOT MET — the answer is NO and it closes the\r\n  question for this lane.** Measured file set `6d291e0..bf8c4a2`: `.gitattributes`,\r\n  `.github/bench/link-probe.ps1`, `.github/bench/link-probe.sh`, `.github/workflows/golden.yml`,\r\n  `crates/xtask/src/main.rs`, `crates/xtask/tests/bench_row_parity.rs`, `docs/GOLDEN-CI.md`,\r\n  `traceable-reqs.toml`. Nothing under `.github/ci/`, where the nextest-summary readers and\r\n  count-reporting scripts live. IR-5: no consumer of nextest output touched. IR-6: no EXISTING gate\r\n  output changed — though the NEW output was voluntarily written to IR-6's rule (the LINK line\r\n  prints `samples=N/M` and the individual rtts, membership beside the count, in both shells). That\r\n  SHRINKS IR-6's future scope by two lines; it does not discharge it.\r\n- **Three mechanisms lifted from this lane's REQ titles, worth more than the lane:**\r\n  (a) **An instrument must not be able to RED the run, and each shell breaks that differently** —\r\n  bash: `| head` under `pipefail` SIGPIPEs the producer to 141, so a print step reds (trim with\r\n  parameter expansion instead); pwsh under GitHub's wrapper: a MISSING COMMAND is a terminating\r\n  error, so rustup's absence must be TESTED with `Get-Command`, never caught. One requirement, two\r\n  constructions, and neither is portable reasoning about the other.\r\n  (b) **A negative-control mutation must be COUNTED before it is trusted** — the absent-CLI arm was\r","truncated":true,"truncatedBy":"lines","totalLines":2905,"totalBytes":5525,"outputLines":59,"outputBytes":5525,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":5781,"displayContent":{"text":"### IR-52 — docs-site CLI reference renders SHALLOW; help text below the rendered depth is outside the drift gate, unit-held per-REQ or held by nothing\n- **THIRD INSTANCE, observed 2026-08-24 (todlando, WAX-SEAL #21 W4; not acted on):** the new\n…\n- **Kin:** the REQ-CLI-SURFACE-SECTION-SITED pinned walk (the per-REQ closure shape this\n…\n\r\n### CI-RIDER LANE STATE — LANDED 2026-08-04 (post-v0.53.0 merge queue); history below kept for its mechanisms\r\n- **RESOLVED:** the lane rebased clean onto the post-tag queue and landed ff-only as\r\n  `2b33a47`/`2a7b016`/`d63f4ce`/`19d7f79` (content byte-identical to `1275e47..bf8c4a2` by lane-diff\r\n  blob hash). IR-1 and IR-4 are BUILT AND LANDED; IR-9's measurement half is landed with its trigger\r\n  now armed — the toolchain print reports runner-account versions on the NEXT GOLDEN RUN, which is\r\n  when doyle's 2026-08-03 ruling (decide from runner-account versions, never the interactive prior)\r\n  becomes executable. The two golden-only steps (link probe both boxes, toolchain print both legs)\r\n  remain unexercised until that run — the landing does not change that caveat.\r\n- **As recorded pre-landing (2026-08-04, doyle):** `ci/locksmith-riders` was at `bf8c4a2` with FOUR\r\n  commits not contained in `origin/main` and not present in LOCKSMITH's golden head `b7b00c3`. The\r\n  worktree `.worktrees/hertz-ci-riders` was clean, so the work existed and was simply unlanded:\r\n  `1275e47` (xtask: assert a load-bearing patch pin is still in force, both ways it lapses) ·\r\n  `49d4805` (docs/ci: a lock-touching lane reads edges, not just the package set) ·\r\n  `8ed006b` (ci/golden: print the toolchain that judged the run, both legs) ·\r\n  `bf8c4a2` (ci/golden: measure the link before rendezvous, read the floor after the checkout that\r\n  clears it — the floor read AFTER its own reclaim is [[ci-runner-has-no-warm-target]]'s shape).\r\n- **Why it is recorded rather than quietly re-dispatched:** [[IR-1]]/[[IR-4]]/[[IR-9]] were carried\r\n  as DISPATCHED, which is now false in BOTH directions — the work is further along than dispatched,\r\n  and it also did not ship. The cause was the same agent outage that cost `#123` its build, and the\r\n  operator's standing rule from that drop applies here too: an outage must not be able to remove\r\n  work from a batch silently. Board requests got a drop comment; register entries get this.\r\n- **MAPPING CONFIRMED BY ITS BUILDER 2026-08-04, by REQ id rather than by recollection** — hertz\r\n  noted first that its own context had been cleared between building the lane and answering, and\r\n  declined to testify from memory about the original instrument. Everything here is either measured\r\n  that day or read off the commits:\r\n  `1275e47` → `REQ-CI-LOAD-BEARING-PATCH-PIN` ([[IR-4]] part 1, the mechanical pin guard in xtask) ·\r\n  `49d4805` → `REQ-LOCK-TOUCHING-LANE-PROCEDURE` ([[IR-4]] part 2, procedure in docs/GOLDEN-CI.md) ·\r\n  `8ed006b` → `REQ-CI-TOOLCHAIN-VERSION-PRINT` ([[IR-4]] part 3, carrying [[IR-9]]) ·\r\n  `bf8c4a2` → `REQ-CI-LINK-HEALTH-PROBE` ([[IR-1]], the network axis).\r\n- **CORRECTION TO THE GATER'S EARLIER WORDING, from the builder:** `8ed006b` does NOT discharge\r\n  [[IR-9]] — it discharges IR-9's MEASUREMENT half only. IR-9's other half (align the two boxes, or\r\n  declare one authoritative clippy leg) is held by doyle's own 2026-08-03 ruling: decide once the\r\n  step reports RUNNER-ACCOUNT versions, never on the interactive-account prior. IR-9 therefore stays\r\n  OPEN with its trigger now REACHABLE, which is a different state from \"waiting\".\r\n- **Gate evidence, instrument NAMED:** `cargo nextest run -p xtask` in `.worktrees/hertz-ci-riders`\r\n  on hfenduleam, box quiet with no runs in flight — 34 run, 34 passed, 0 skipped. Nextest rather\r\n  than bare `cargo test`, per [[IR-25]]. ⚠ **What that does NOT cover, stated by the builder rather\r\n  than discovered later:** the two golden steps the lane ADDS (link probe on both boxes, toolchain\r\n  print on both legs) cannot be exercised outside a golden run. The probe's three arms\r\n  (five-sample success, no-reply, absent-CLI) were exercised on the real boxes at commit time, and\r\n  that is reported as a CLAIM RECORDED AT COMMIT TIME, not as a re-verification — the kitsubito arm\r\n  could not be re-checked from here. This is why the lane wants a golden rather than a quiet ff.\r\n- **[[IR-5]]/[[IR-6]] CONDITIONAL RIDERS: CONDITION NOT MET — the answer is NO and it closes the\r\n  question for this lane.** Measured file set `6d291e0..bf8c4a2`: `.gitattributes`,\r\n  `.github/bench/link-probe.ps1`, `.github/bench/link-probe.sh`, `.github/workflows/golden.yml`,\r\n  `crates/xtask/src/main.rs`, `crates/xtask/tests/bench_row_parity.rs`, `docs/GOLDEN-CI.md`,\r\n  `traceable-reqs.toml`. Nothing under `.github/ci/`, where the nextest-summary readers and\r\n  count-reporting scripts live. IR-5: no consumer of nextest output touched. IR-6: no EXISTING gate\r\n  output changed — though the NEW output was voluntarily written to IR-6's rule (the LINK line\r\n  prints `samples=N/M` and the individual rtts, membership beside the count, in both shells). That\r\n  SHRINKS IR-6's future scope by two lines; it does not discharge it.\r\n- **Three mechanisms lifted from this lane's REQ titles, worth more than the lane:**\r\n  (a) **An instrument must not be able to RED the run, and each shell breaks that differently** —\r\n  bash: `| head` under `pipefail` SIGPIPEs the producer to 141, so a print step reds (trim with\r\n  parameter expansion instead); pwsh under GitHub's wrapper: a MISSING COMMAND is a terminating\r\n  error, so rustup's absence must be TESTED with `Get-Command`, never caught. One requirement, two\r\n  constructions, and neither is portable reasoning about the other.\r\n  (b) **A negative-control mutation must be COUNTED before it is trusted** — the absent-CLI arm was\r\n…\n  the failure. Both med and max rows ride the ledger.\n…\n","startLine":2839,"lineNumbers":[2839,2840,null,2874,null,2877,2878,2879,2880,2881,2882,2883,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,2902,2903,2904,2905,2906,2907,2908,2909,2910,2911,2912,2913,2914,2915,2916,2917,2918,2919,2920,2921,2922,2923,2924,2925,2926,2927,2928,2929,2930,2931,2932,2933,2934,2935,null,2940,null,2944]},"fileSize":501961,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":5781,"totalBytes":5525,"outputLines":59,"outputBytes":5525,"shownRange":{"start":2877,"end":2935},"nextOffset":2936}}},"isError":false,"timestamp":1789094649988}}
{"type":"message","id":"9d2305f1","parentId":"41e75a15","timestamp":"2026-09-11T02:44:10.003Z","message":{"role":"toolResult","toolCallId":"call_avxcssLR2Dpei4TvCH9sfStZ|fc_074aee81620ae383016aa36af78b4487d1a31ef5d3af6e5139","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## xtask/src/\n### main.rs\n 3011|    #[test]\n*3012|    fn the_checked_in_config_is_in_parity() {\n 3013|        let cfg = include_str!(\"../../../.config/nextest.toml\");\n 3014|        let missing = phase_a_overrides_missing_from_ci_windows(cfg);\n 3015|        assert!(\n\n## spt-store/src/\n### info.rs\n 106|    /// any success, exactly as it behaved before), and `skip_serializing_if` so a\n*107|    /// stamp with no standing latches serializes BYTE-IDENTICALLY to the pre-#115\n 108|    /// shape. Neither this struct nor [`InfoJson`] uses `deny_unknown_fields`, so an\n 109|    /// older binary reading a newer record ignores the key and parses.\n 110|    #[serde(default, skip_serializing_if = \"BTreeMap::is_empty\")]\n...\n 785|/// empty map for a stamp with no recoverable latch state (that is the pre-#115\n*786|/// shape, and it serializes byte-identically to it).\n 787|///\n 788|/// This is the SOLE writer of the field — deliberately one seam rather than a\n 789|/// reason-only sibling, because a second writer could land a stamp whose slot\n...\n 872|/// (created once, never renamed; advisory, auto-released on fd drop / process exit).\n*873|/// Serializes ALL info.json writers so a whole-record write and a locked RMW can never\n 874|/// lose each other's update (REQ-HAZARD-INFO-RMW-LOST-UPDATE). See [`mutate_info`] for\n 875|/// why the lock is on a constant sentinel inode, not on `info.json` (which is renamed on\n 876|/// every write). The perch directory must already exist.\n...\n 1983|    // [unit->REQ-HAZARD-INFO-RMW-LOST-UPDATE] a locked RMW (the daemon's status stamp)\n*1984|    // racing a full whole-record write (bind establishing the perch) must NEVER lose the\n 1985|    // full write's fields. The lost update: a record carrying the stamp (status=online)\n 1986|    // while MISSING the bind fields (state=live_agent) — the RMW read a pre-bind snapshot,\n 1987|    // the bind wrote the full record, then the RMW wrote its stale snapshot back + the"}],"details":{"scopePath":"crates/xtask/src/main.rs, crates/spt-store/src/info.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":5,"fileCount":2,"files":["crates/xtask/src/main.rs","crates/spt-store/src/info.rs"],"fileMatches":[{"path":"crates/xtask/src/main.rs","count":1},{"path":"crates/spt-store/src/info.rs","count":4}],"truncated":false,"displayContent":"# crates/\n\n## xtask/src/\n### main.rs\n 3011│    #[test]\n*3012│    fn the_checked_in_config_is_in_parity() {\n 3013│        let cfg = include_str!(\"../../../.config/nextest.toml\");\n 3014│        let missing = phase_a_overrides_missing_from_ci_windows(cfg);\n 3015│        assert!(\n\n## spt-store/src/\n### info.rs\n  106│    /// any success, exactly as it behaved before), and `skip_serializing_if` so a\n *107│    /// stamp with no standing latches serializes BYTE-IDENTICALLY to the pre-#115\n  108│    /// shape. Neither this struct nor [`InfoJson`] uses `deny_unknown_fields`, so an\n  109│    /// older binary reading a newer record ignores the key and parses.\n  110│    #[serde(default, skip_serializing_if = \"BTreeMap::is_empty\")]\n     │...\n  785│/// empty map for a stamp with no recoverable latch state (that is the pre-#115\n *786│/// shape, and it serializes byte-identically to it).\n  787│///\n  788│/// This is the SOLE writer of the field — deliberately one seam rather than a\n  789│/// reason-only sibling, because a second writer could land a stamp whose slot\n     │...\n  872│/// (created once, never renamed; advisory, auto-released on fd drop / process exit).\n *873│/// Serializes ALL info.json writers so a whole-record write and a locked RMW can never\n  874│/// lose each other's update (REQ-HAZARD-INFO-RMW-LOST-UPDATE). See [`mutate_info`] for\n  875│/// why the lock is on a constant sentinel inode, not on `info.json` (which is renamed on\n  876│/// every write). The perch directory must already exist.\n     │...\n 1983│    // [unit->REQ-HAZARD-INFO-RMW-LOST-UPDATE] a locked RMW (the daemon's status stamp)\n*1984│    // racing a full whole-record write (bind establishing the perch) must NEVER lose the\n 1985│    // full write's fields. The lost update: a record carrying the stamp (status=online)\n 1986│    // while MISSING the bind fields (state=live_agent) — the RMW read a pre-bind snapshot,\n 1987│    // the bind wrote the full record, then the RMW wrote its stale snapshot back + the"},"isError":false,"timestamp":1789094650002}}
{"type":"message","id":"94a063b1","parentId":"9d2305f1","timestamp":"2026-09-11T02:44:10.005Z","message":{"role":"toolResult","toolCallId":"call_Ts124bGve4GuGTdV7ieMDwWw|fc_074aee81620ae383016aa36af78b2c87d1bcd9711b58c20f56","toolName":"grep","content":[{"type":"text","text":"# docs/\n## GOLDEN-CI.md\n 98|\n*99|<!-- [doc->REQ-LOCK-TOUCHING-LANE-PROCEDURE] -->\n 100|\n 101|A lane that changes `Cargo.lock` moves one crate on purpose and proves it moved only that. Four steps, in order.\n 102|\n...\n 104|\n*105|**2. Read the diff twice — blocks, then edges.** Count the changed `[[package]]` blocks, then diff each surviving block's dependency lines. The second read is the one that pays. At `acaaa4f` the package set was identical — no block added, none removed, not one `name` or `version` line in the diff — while eight blocks had their `windows-sys` edge moved from 0.61.2 to 0.59.0 (consumer counts 18→10 and 5→13, with both version blocks still present, so a version-presence check also reads clean). Tha...\n 106|\n 107|**3. Two resolutions that disagree are evidence about toolchains, not dependencies.** If re-resolving the same manifests locally produces a different lock than the one on the branch, stop and compare toolchains against CI — golden prints `cargo`, `rustc`, and `clippy` versions on both OS legs for exactly this comparison. Ship a lock after the versions are reconciled, not by picking the diff that looks tidier.\n 108|\n## INFRA-REGISTER.md\n 79|surface). Composed: IR-14/26/27/49 as ONE between-milestone pool/worktree audit slot (window\n*80|open now); IR-11 + IR-33(a) as next-intake small riders; IR-59's log-the-floor half + IR-57's\n 81|scripted audit stand as the next intake's tooling pair. IR-54 evidence noted: the #242 cut's\n 82|unshaped-head intake miss (self-caught by deployah, shape-on-top `e4f52047`, 8th consecutive\n 83|shape-inside-candidate) is another construction-not-discipline datum. No entries retired.\n\n# crates/spt/tests/\n## cli_stack_smoke.rs\n 1|//! The cheapest possible assertion that the binary can still build its own\n*2|//! argument tree — and the one that would have caught IR-33 in the profile\n*3|//! where IR-33 lives.\n 4|//!\n 5|//! clap constructs the derive-built `Command` tree at the top of EVERY\n 6|//! invocation, before any of our code runs, and that construction's cost scales\n...\n 23|//! inside a ceiling the debug binary has already hit.\n*24|// [int->REQ-CLI-STACK-HEADROOM]\n 25|\n 26|use std::process::Command;\n 27|\n...\n 33|\n*34|// [int->REQ-CLI-STACK-HEADROOM]\n 35|#[test]\n 36|fn the_debug_binary_renders_its_own_help_and_lists_its_commands() {\n 37|    let out = Command::new(env!(\"CARGO_BIN_EXE_spt\"))\n...\n 44|\n*45|    // The IR-33 face precisely: no output, and an exit code that is neither 0\n 46|    // nor any code this binary chooses (Windows STATUS_STACK_OVERFLOW surfaces\n 47|    // as -1073741571; a Unix SIGSEGV leaves no code at all).\n 48|    assert!(\n...\n 73|/// and `--version` is the one that proves the cause is upstream of any command.\n*74|// [int->REQ-CLI-STACK-HEADROOM]\n 75|#[test]\n 76|fn the_debug_binary_answers_version_which_costs_nothing_but_the_tree() {\n 77|    let out = Command::new(env!(\"CARGO_BIN_EXE_spt\"))\n...\n 106|/// them both codes the wrapper can produce are witnessed.\n*107|// [int->REQ-CLI-STACK-HEADROOM]\n 108|// [int->REQ-USHER-LIFECYCLE-VERBS]\n 109|#[test]\n 110|fn a_nonzero_code_chosen_by_our_code_arrives_by_return() {\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":"docs/GOLDEN-CI.md, docs/INFRA-REGISTER.md, crates/spt/tests/cli_stack_smoke.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":10,"fileCount":3,"files":["docs/GOLDEN-CI.md","docs/INFRA-REGISTER.md","crates/spt/tests/cli_stack_smoke.rs"],"fileMatches":[{"path":"docs/GOLDEN-CI.md","count":2},{"path":"docs/INFRA-REGISTER.md","count":1},{"path":"crates/spt/tests/cli_stack_smoke.rs","count":7}],"truncated":true,"displayContent":"# docs/\n## GOLDEN-CI.md\n  98│\n *99│<!-- [doc->REQ-LOCK-TOUCHING-LANE-PROCEDURE] -->\n 100│\n 101│A lane that changes `Cargo.lock` moves one crate on purpose and proves it moved only that. Four steps, in order.\n 102│\n    │...\n 104│\n*105│**2. Read the diff twice — blocks, then edges.** Count the changed `[[package]]` blocks, then diff each surviving block's dependency lines. The second read is the one that pays. At `acaaa4f` the package set was identical — no block added, none removed, not one `name` or `version` line in the diff — while eight blocks had their `windows-sys` edge moved from 0.61.2 to 0.59.0 (consumer counts 18→10 and 5→13, with both version blocks still present, so a version-presence check also reads clean). Tha...\n 106│\n 107│**3. Two resolutions that disagree are evidence about toolchains, not dependencies.** If re-resolving the same manifests locally produces a different lock than the one on the branch, stop and compare toolchains against CI — golden prints `cargo`, `rustc`, and `clippy` versions on both OS legs for exactly this comparison. Ship a lock after the versions are reconciled, not by picking the diff that looks tidier.\n 108│\n## INFRA-REGISTER.md\n 79│surface). Composed: IR-14/26/27/49 as ONE between-milestone pool/worktree audit slot (window\n*80│open now); IR-11 + IR-33(a) as next-intake small riders; IR-59's log-the-floor half + IR-57's\n 81│scripted audit stand as the next intake's tooling pair. IR-54 evidence noted: the #242 cut's\n 82│unshaped-head intake miss (self-caught by deployah, shape-on-top `e4f52047`, 8th consecutive\n 83│shape-inside-candidate) is another construction-not-discipline datum. No entries retired.\n\n# crates/spt/tests/\n## cli_stack_smoke.rs\n   1│//! The cheapest possible assertion that the binary can still build its own\n  *2│//! argument tree — and the one that would have caught IR-33 in the profile\n  *3│//! where IR-33 lives.\n   4│//!\n   5│//! clap constructs the derive-built `Command` tree at the top of EVERY\n   6│//! invocation, before any of our code runs, and that construction's cost scales\n    │...\n  23│//! inside a ceiling the debug binary has already hit.\n *24│// [int->REQ-CLI-STACK-HEADROOM]\n  25│\n  26│use std::process::Command;\n  27│\n    │...\n  33│\n *34│// [int->REQ-CLI-STACK-HEADROOM]\n  35│#[test]\n  36│fn the_debug_binary_renders_its_own_help_and_lists_its_commands() {\n  37│    let out = Command::new(env!(\"CARGO_BIN_EXE_spt\"))\n    │...\n  44│\n *45│    // The IR-33 face precisely: no output, and an exit code that is neither 0\n  46│    // nor any code this binary chooses (Windows STATUS_STACK_OVERFLOW surfaces\n  47│    // as -1073741571; a Unix SIGSEGV leaves no code at all).\n  48│    assert!(\n    │...\n  73│/// and `--version` is the one that proves the cause is upstream of any command.\n *74│// [int->REQ-CLI-STACK-HEADROOM]\n  75│#[test]\n  76│fn the_debug_binary_answers_version_which_costs_nothing_but_the_tree() {\n  77│    let out = Command::new(env!(\"CARGO_BIN_EXE_spt\"))\n    │...\n 106│/// them both codes the wrapper can produce are witnessed.\n*107│// [int->REQ-CLI-STACK-HEADROOM]\n 108│// [int->REQ-USHER-LIFECYCLE-VERBS]\n 109│#[test]\n 110│fn a_nonzero_code_chosen_by_our_code_arrives_by_return() {","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789094650005}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_VktxFHMzU10KeDMQbUYZ56Wl|fc_074aee81620ae383016aa36afb5f8087d1827f06fd61c6d514","toolName":"grep","startedAt":"2026-09-11T02:44:13.928Z","args":{"path":"crates/xtask/src/main.rs:100-240"},"intent":"Locating help producer guard"},"id":"98a71c8c","parentId":"94a063b1","timestamp":"2026-09-11T02:44:13.928Z"}
{"type":"message","id":"43e16663","parentId":"98a71c8c","timestamp":"2026-09-11T02:44:13.929Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Locating IR32 cli_reference**"},{"type":"toolCall","id":"call_VktxFHMzU10KeDMQbUYZ56Wl|fc_074aee81620ae383016aa36afb5f8087d1827f06fd61c6d514","name":"grep","arguments":{"i":"Locating help producer guard","pattern":"fn cli_reference|fn help|empty|status.success","path":"crates/xtask/src/main.rs:100-240","case":false,"gitignore":true,"skip":0},"intent":"Locating help producer guard"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":4860,"output":77,"cacheRead":113408,"cacheWrite":0,"totalTokens":118345,"reasoningTokens":11,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094650079,"responseId":"resp_074aee81620ae383016aa36af807e087d1939843617208e512","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_074aee81620ae383016aa36af8f33487d191b7509fd70bf529","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo2r7fqTFeFSJtOfldvFFvszg0YKeN4oZ0J6qZUXZMvl1C1406dd6FTQhzUVg2z-HsKjBHvz9C-AUzm9Grgo3HJ5WmgGbyV1JlopZPv0-ocJguTCf3M6kg3sGqON3Mtr73tHZUfBNpq7A4y9UCKboiwlqqp-8uMd1GoUppwwxeMTNmIsm7NsY9CaCwA6psFGl3SlJJLpvWu9LDq-0V_wdRaLs3cr28A7ku1jJMwS2jzYOOcCsIlyZgr9bCniJyu2iupOOCgQSQpJeDSuhX_SkP_bajOgUebT9PKJXszoZfvRd0hWZw3K2vb4KMnOCsdrpvM00MBkXby6IlDgCLu8p0Wpf_7kce1v_oEPoGR7zRtHQzWWLxy2uXYbCY0vTTSCSvzeUw4Vnx4W34hK8sX7reKo0gakwC6KZltbxZzF4s-oMmSDWEbXsJBiMILFb-gvlvAbPZMKJZBEf3UjIUSe18iAI-JEZFDgsN4jbsc5_hTW1nLXyvAx8A-KzWLJDN1OZ2ivhULWL2L6UCe6fIlBfRsFpmLxd4hUFus_k5CMxCe6AQWgGza1ucChq1irIHTiwk8jInbpefEEgQ0kTXpZYTTBO07ptz6xalMcWrUfGa54_24GtCuEtqq9YR6MabY1zGxg0EyxIAyBJ0JBMhB1YsqU59CIaiCzO1pIiaUiquwsAilY-vb-DRXgOyQSGJF5Xqd07MI7XFzYlpEww-xHhMZujUZK9_OpyNFCjtT2SRq5feRSwleOqYHwDLgrcipWNFv8lan8z-OnzGLY7fXVaJ6yAJU6-2beW1k6LKI5veQZR2a_Al8lgCK2oOF2FU_3HYkv3ac8j6PE4WULAPeVZdIhMSCsdVEUc5s3YCc88MkG0cZLOzGDMkZ6uBuXrDSVfTqmuFD5JqGKICQAIVl3egkAKUm7uJIPKdLylFpEj4PZAOH7tMX_rtKzAU2JNdNIzb_uweIj38Cn7NrYQUyY03rZLtiv9DFhltN8xA4efxrdCTojFJzID0yf4m5y1Bmrqxb64KbNB-SD3tTws6T4GdK4tFjbIWtKZIeJWDGC2DwyqRTnsOSrop1up6ODs_2yHCaK6IAMSLEhdUbp-h3EF3LsH7IV9z-YKYK_k2Q64GLxvMWlW3Uv3RrTYFZH4fK-xyLwJcPOTJoAjjmot_R1cmwlcZJ6-sYs0ffboqBl5hJJR6GiQ8wG1WhgAHPOOASe5dt4HN32YpxOPFDzRgVtbFTMrYLH1-kVB9IMclW0jXAsgIxP3FetS-QpnoPXPHT9mKO8Coy7xqQqmJ1bJuF9hPoKbPt88_-X7l8UrA9Fg3xZYm4vTQ9fb8srAQg3z28qCRqvy","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"summary":[{"type":"summary_text","text":"**Locating IR32 cli_reference**"}],"metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36afb5f8087d1827f06fd61c6d514","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating help producer guard\",\"pattern\":\"fn cli_reference|fn help|empty|status.success\",\"path\":\"crates/xtask/src/main.rs:100-240\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_VktxFHMzU10KeDMQbUYZ56Wl","internal_chat_message_metadata_passthrough":{"create_time":1789094648.300892,"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"grep","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":3845.4835999999195,"ttft":1224.0245000002906,"completedAt":1789094653926,"contextSnapshot":{"promptTokens":118268,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"message","id":"9d63ca37","parentId":"43e16663","timestamp":"2026-09-11T02:44:13.943Z","message":{"role":"toolResult","toolCallId":"call_VktxFHMzU10KeDMQbUYZ56Wl|fc_074aee81620ae383016aa36afb5f8087d1827f06fd61c6d514","toolName":"grep","content":[{"type":"text","text":" 120|            // `Options:` ends the command listing for good.\n*121|            if line.trim().is_empty() {\n 122|                in_block = false;\n 123|                continue;\n 124|            }\n...\n 146|// [impl->REQ-DOCS-5]\n*147|fn cli_reference(bin: &Path) -> String {\n 148|    let mut out = String::from(\n 149|        \"# CLI reference\\n\\n\\\n 150|         > **Generated** from the `spt` binary's own `--help` output \\\n...\n 168|/// loop level, and a third level would have needed a third copy (IR-52).\n*169|fn help_args(path: &[String]) -> Vec<String> {\n 170|    let mut args: Vec<String> = Vec::new();\n 171|    for (i, seg) in path.iter().enumerate() {\n 172|        args.push(seg.clone());"}],"details":{"scopePath":"crates/xtask/src/main.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":3,"fileCount":1,"files":["crates/xtask/src/main.rs"],"fileMatches":[{"path":"crates/xtask/src/main.rs","count":3}],"truncated":false,"displayContent":" 120│            // `Options:` ends the command listing for good.\n*121│            if line.trim().is_empty() {\n 122│                in_block = false;\n 123│                continue;\n 124│            }\n    │...\n 146│// [impl->REQ-DOCS-5]\n*147│fn cli_reference(bin: &Path) -> String {\n 148│    let mut out = String::from(\n 149│        \"# CLI reference\\n\\n\\\n 150│         > **Generated** from the `spt` binary's own `--help` output \\\n    │...\n 168│/// loop level, and a third level would have needed a third copy (IR-52).\n*169│fn help_args(path: &[String]) -> Vec<String> {\n 170│    let mut args: Vec<String> = Vec::new();\n 171│    for (i, seg) in path.iter().enumerate() {\n 172│        args.push(seg.clone());"},"isError":false,"timestamp":1789094653941}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Wt0sXRWg7kB1zaUVF70XoB1L|fc_074aee81620ae383016aa36afd7a4c87d1bd4419c68df027a6","toolName":"read","startedAt":"2026-09-11T02:44:16.805Z","args":{"path":"crates/xtask/src/main.rs:82-112,147-225"},"intent":"Reading help capture contract"},"id":"43003924","parentId":"9d63ca37","timestamp":"2026-09-11T02:44:16.805Z"}
{"type":"message","id":"cc764a53","parentId":"43003924","timestamp":"2026-09-11T02:44:16.806Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_Wt0sXRWg7kB1zaUVF70XoB1L|fc_074aee81620ae383016aa36afd7a4c87d1bd4419c68df027a6","name":"read","arguments":{"i":"Reading help capture contract","path":"crates/xtask/src/main.rs:82-112,147-225"},"intent":"Reading help capture contract"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":415,"output":39,"cacheRead":118144,"cacheWrite":0,"totalTokens":118598,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094653965,"responseId":"resp_074aee81620ae383016aa36afbec2887d1b75d2fd13623ea23","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_074aee81620ae383016aa36afd7a4c87d1bd4419c68df027a6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading help capture contract\",\"path\":\"crates/xtask/src/main.rs:82-112,147-225\"}","call_id":"call_Wt0sXRWg7kB1zaUVF70XoB1L","internal_chat_message_metadata_passthrough":{"create_time":1789094652.183205,"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"read","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":2836.5870999991894,"ttft":1865.6349999997765,"completedAt":1789094656803,"contextSnapshot":{"promptTokens":118559,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"message","id":"4393d873","parentId":"cc764a53","timestamp":"2026-09-11T02:44:16.823Z","message":{"role":"toolResult","toolCallId":"call_Wt0sXRWg7kB1zaUVF70XoB1L|fc_074aee81620ae383016aa36afd7a4c87d1bd4419c68df027a6","toolName":"read","content":[{"type":"text","text":"fn main() {\n…\n    match cmd {\n…\n        \"debug-rollout\" => debug_rollout(&args[1..]),\n        \"debug-converge\" => debug_converge(&args[1..]),\n        _ => {\n            eprintln!(\n                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--foreign-pool]|pool-sweep [--root <dir>] [--reap] [--include-owned]|pool-release --pool <dir>|release-keygen <key-id>|release-sign …|release-publish …|debug-keygen <key-id>|debug-pin …|debug-rollout …|debug-converge --version <u64> …>\"\n            );\n            std::process::exit(2);\n        }\n    }\n}\n\n// ---------------------------------------------------------------- CLI ref\n\n/// Run the workspace `spt` binary with `args` + `--help`, normalized to the\n/// `spt` name (Windows prints `spt.exe`, which would make the generated\n/// reference platform-dependent).\nfn help_for(bin: &Path, args: &[&str]) -> String {\n    let mut cmd = Command::new(bin);\n    cmd.args(args).arg(\"--help\");\n    let out = cmd.output().expect(\"run spt --help\");\n    let text = String::from_utf8_lossy(&out.stdout);\n    text.replace(\"spt.exe\", \"spt\").replace(\"\\r\\n\", \"\\n\")\n}\n\n/// Parse the command-list block(s) of a clap help text into subcommand\n/// names. Nested helps carry clap's flat `Commands:` heading; the root help\n/// renders two grouped blocks (`User commands:` / `Agent commands:`).\nfn subcommands(help: &str) -> Vec<String> {\n    let mut cmds = Vec::new();\n    let mut in_block = false;\n    for line in help.lines() {\n…\n    }\n…\n}\n…\nfn cli_reference(bin: &Path) -> String {\n    let mut out = String::from(\n        \"# CLI reference\\n\\n\\\n         > **Generated** from the `spt` binary's own `--help` output \\\n         (`cargo run -p xtask -- gen`) and drift-gated in CI — this page \\\n         cannot disagree with the binary. Do not edit by hand.\\n\\n\",\n    );\n    let root_help = help_for(bin, &[]);\n    out.push_str(\"## spt\\n\\n```text\\n\");\n    out.push_str(&root_help);\n    out.push_str(\"```\\n\");\n    for cmd in subcommands(&root_help) {\n        push_command_tree(bin, &mut out, &[cmd]);\n    }\n    out\n}\n\n/// The argv that renders help for one command path — with the `api`\n/// stand-in adapter injected where the path passes through `spt api` (clap\n/// requires `--adapter` even for subcommand help). ONE spelling for every\n/// depth: before the recursion this hardcode existed once per hand-written\n/// loop level, and a third level would have needed a third copy (IR-52).\nfn help_args(path: &[String]) -> Vec<String> {\n    let mut args: Vec<String> = Vec::new();\n    for (i, seg) in path.iter().enumerate() {\n        args.push(seg.clone());\n        if i == 0 && seg == \"api\" {\n            args.push(\"--adapter\".into());\n            args.push(\"x\".into());\n        }\n    }\n    args\n}\n\n/// Emit `path`'s help at its depth-derived heading, then recurse into every\n/// subcommand the help lists — the FULL command tree (IR-52's durable\n/// remedy, SIGNET W1): any help below a fixed rendering depth was invisible\n/// to the docs-drift gate, so a deep help edit or regression shipped\n/// unpublished and ungated unless some REQ's unit happened to pin it. With\n/// the recursion, published depth == tree depth by construction, and the\n/// committed reference's deepest sections make a depth regression a drift\n/// red.\n// [impl->REQ-DOCS-5]\nfn push_command_tree(bin: &Path, out: &mut String, path: &[String]) {\n    let args = help_args(path);\n    let argv: Vec<&str> = args.iter().map(String::as_str).collect();\n    let help = help_for(bin, &argv);\n    let hashes = \"#\".repeat(path.len() + 1);\n    out.push_str(&format!(\n        \"\\n{hashes} spt {}\\n\\n```text\\n{help}```\\n\",\n        path.join(\" \")\n    ));\n    for sub in subcommands(&help) {\n        let mut child = path.to_vec();\n        child.push(sub);\n        push_command_tree(bin, out, &child);\n    }\n}\n\n#[cfg(test)]\nmod cli_reference_tests {\n    use super::help_args;\n\n    fn path(segs: &[&str]) -> Vec<String> {\n        segs.iter().map(|s| s.to_string()).collect()\n    }\n\n    // [unit->REQ-DOCS-5] the api stand-in adapter injects at EVERY depth the\n    // path passes through `spt api` — the one spelling that replaced the\n    // per-loop-level hardcodes (IR-52: a third level would have needed a\n    // third copy) — and only when `api` is the ROOT verb, never for a\n    // same-named deeper segment.\n    #[test]\n    fn api_standin_injects_once_at_any_depth_and_only_for_the_root_verb() {\n        assert_eq!(help_args(&path(&[\"seal\"])), path(&[\"seal\"]));\n        assert_eq!(\n            help_args(&path(&[\"api\"])),\n            path(&[\"api\", \"--adapter\", \"x\"])\n        );\n…\n    }\n}"}],"details":{"displayContent":{"text":"fn main() {\n…\n    match cmd {\n…\n        \"debug-rollout\" => debug_rollout(&args[1..]),\n        \"debug-converge\" => debug_converge(&args[1..]),\n        _ => {\n            eprintln!(\n                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--foreign-pool]|pool-sweep [--root <dir>] [--reap] [--include-owned]|pool-release --pool <dir>|release-keygen <key-id>|release-sign …|release-publish …|debug-keygen <key-id>|debug-pin …|debug-rollout …|debug-converge --version <u64> …>\"\n            );\n            std::process::exit(2);\n        }\n    }\n}\n\n// ---------------------------------------------------------------- CLI ref\n\n/// Run the workspace `spt` binary with `args` + `--help`, normalized to the\n/// `spt` name (Windows prints `spt.exe`, which would make the generated\n/// reference platform-dependent).\nfn help_for(bin: &Path, args: &[&str]) -> String {\n    let mut cmd = Command::new(bin);\n    cmd.args(args).arg(\"--help\");\n    let out = cmd.output().expect(\"run spt --help\");\n    let text = String::from_utf8_lossy(&out.stdout);\n    text.replace(\"spt.exe\", \"spt\").replace(\"\\r\\n\", \"\\n\")\n}\n\n/// Parse the command-list block(s) of a clap help text into subcommand\n/// names. Nested helps carry clap's flat `Commands:` heading; the root help\n/// renders two grouped blocks (`User commands:` / `Agent commands:`).\nfn subcommands(help: &str) -> Vec<String> {\n    let mut cmds = Vec::new();\n    let mut in_block = false;\n    for line in help.lines() {\n…\n    }\n…\n}\n…\nfn cli_reference(bin: &Path) -> String {\n    let mut out = String::from(\n        \"# CLI reference\\n\\n\\\n         > **Generated** from the `spt` binary's own `--help` output \\\n         (`cargo run -p xtask -- gen`) and drift-gated in CI — this page \\\n         cannot disagree with the binary. Do not edit by hand.\\n\\n\",\n    );\n    let root_help = help_for(bin, &[]);\n    out.push_str(\"## spt\\n\\n```text\\n\");\n    out.push_str(&root_help);\n    out.push_str(\"```\\n\");\n    for cmd in subcommands(&root_help) {\n        push_command_tree(bin, &mut out, &[cmd]);\n    }\n    out\n}\n\n/// The argv that renders help for one command path — with the `api`\n/// stand-in adapter injected where the path passes through `spt api` (clap\n/// requires `--adapter` even for subcommand help). ONE spelling for every\n/// depth: before the recursion this hardcode existed once per hand-written\n/// loop level, and a third level would have needed a third copy (IR-52).\nfn help_args(path: &[String]) -> Vec<String> {\n    let mut args: Vec<String> = Vec::new();\n    for (i, seg) in path.iter().enumerate() {\n        args.push(seg.clone());\n        if i == 0 && seg == \"api\" {\n            args.push(\"--adapter\".into());\n            args.push(\"x\".into());\n        }\n    }\n    args\n}\n\n/// Emit `path`'s help at its depth-derived heading, then recurse into every\n/// subcommand the help lists — the FULL command tree (IR-52's durable\n/// remedy, SIGNET W1): any help below a fixed rendering depth was invisible\n/// to the docs-drift gate, so a deep help edit or regression shipped\n/// unpublished and ungated unless some REQ's unit happened to pin it. With\n/// the recursion, published depth == tree depth by construction, and the\n/// committed reference's deepest sections make a depth regression a drift\n/// red.\n// [impl->REQ-DOCS-5]\nfn push_command_tree(bin: &Path, out: &mut String, path: &[String]) {\n    let args = help_args(path);\n    let argv: Vec<&str> = args.iter().map(String::as_str).collect();\n    let help = help_for(bin, &argv);\n    let hashes = \"#\".repeat(path.len() + 1);\n    out.push_str(&format!(\n        \"\\n{hashes} spt {}\\n\\n```text\\n{help}```\\n\",\n        path.join(\" \")\n    ));\n    for sub in subcommands(&help) {\n        let mut child = path.to_vec();\n        child.push(sub);\n        push_command_tree(bin, out, &child);\n    }\n}\n\n#[cfg(test)]\nmod cli_reference_tests {\n    use super::help_args;\n\n    fn path(segs: &[&str]) -> Vec<String> {\n        segs.iter().map(|s| s.to_string()).collect()\n    }\n\n    // [unit->REQ-DOCS-5] the api stand-in adapter injects at EVERY depth the\n    // path passes through `spt api` — the one spelling that replaced the\n    // per-loop-level hardcodes (IR-52: a third level would have needed a\n    // third copy) — and only when `api` is the ROOT verb, never for a\n    // same-named deeper segment.\n    #[test]\n    fn api_standin_injects_once_at_any_depth_and_only_for_the_root_verb() {\n        assert_eq!(help_args(&path(&[\"seal\"])), path(&[\"seal\"]));\n        assert_eq!(\n            help_args(&path(&[\"api\"])),\n            path(&[\"api\", \"--adapter\", \"x\"])\n        );\n…\n    }\n}","startLine":38,"lineNumbers":[38,null,41,null,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,null,139,null,141,null,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,null,239,240]},"fileSize":151917,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs"}}},"isError":false,"timestamp":1789094656822}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ItiLSNCbVvyHuY8jotWUOJY3|fc_074aee81620ae383016aa36b03ef9887d19c5a41e39dc0dcd3","toolName":"yield","startedAt":"2026-09-11T02:46:20.465Z"},"id":"e90f0fe7","parentId":"4393d873","timestamp":"2026-09-11T02:46:20.465Z"}
{"type":"message","id":"58b2ac65","parentId":"e90f0fe7","timestamp":"2026-09-11T02:46:20.466Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Checking trigger evidence**"},{"type":"toolCall","id":"call_ItiLSNCbVvyHuY8jotWUOJY3|fc_074aee81620ae383016aa36b03ef9887d19c5a41e39dc0dcd3","name":"yield","arguments":{"type":null,"data":{"summary":"Exhaustive read-only sweep: 50 assigned entries (IR-1–49 plus IR-54), including headingless IR-31. Strong stale-status findings: IR-1/4 landed and exercised; IR-26 build-side identity is present but claim-side remedy remains missing; IR-29 first face landed but later faces remain; IR-33 sized-stack implementation exists; IR-46 ruled floor tokens are implemented but acceptance receipts remain distinct. No tests, measurements, edits, or board mutations performed.","files":[{"path":"docs/INFRA-REGISTER.md:180-2725","description":"All assigned bodies read; 49 numbered entries plus IR-54, with IR-31 beginning at the second Status paragraph inside IR-30."},{"path":".github/workflows/golden.yml","description":"Verified current link probes, toolchain print, START/END/DOCS disk assertions, and traceable-reqs pin still 0.2.0."},{"path":"crates/xtask/src/main.rs","description":"Verified load-bearing patch check, unguarded help-output generation, current pool-claim tree-match guard and unconditional incumbent overwrite."},{"path":"crates/spt-poolguard/src/lib.rs:367-443","description":"Verified anchored lane identity and ancestry-only settled predicate; no patch-id fallback."},{"path":"crates/spt/src/main.rs:72-205","description":"Verified CLI runs on 16 MiB owned thread stack; existing cli_stack_smoke integration evidence source identified."},{"path":"crates/spt-store/src/info.rs:872-876","description":"IR-44 preservation-overclaim remains verbatim."},{"path":".github/ci/ci-notify.sh:129-130,182-200","description":"IR-40 bare CI verdict wording and IR-47 quiet absent-coauthor branch remain."}],"architecture":"The register mixes original status headers, later corrections, and independent residual mechanisms. Treat implementation, exercised acceptance, historical specimens, and current release receipts as separate evidence objects. Pool enforcement executes in the arriving tree; claim writes remain a separate path. Disk tokens are instantaneous observations, not sustained headroom.","report":"## Scope and decision vocabulary\nExactly 50 rows: IR-1 through IR-49, plus IR-54. IR-50 begins at line 2726 and is excluded. IR-31 is the headingless second Status paragraph after IR-30's Linux-face resolution, through line 2068. Trigger means the entry's stated ripeness event, including a historically documented firing; UNKNOWN never means disproved. CLOSE for already-built/retired entries means preserve their established disposition, not a new claim based on v0.69.0 green. Source reads below were not executions.\n\n| IR | Current entry status | Trigger | Recommended disposition and evidence |\n|---|---|---|---|\n| 1 | Open / lane unlanded | FIRED | CLOSE stale header: reconciliation at 2878–2906 explicitly identifies landed commits; register 169–171 records first golden exercise; current golden.yml 1096/1264 invokes both link probes. Original 4–7 ms negative is not a universal network acquittal. |\n| 2 | RETIRED; incremental remains ON | UNKNOWN for reopen threshold | CARRY retired decision, flag returned disk pressure. New 14.3 vs 32 GiB red weakens historical ample-disk rationale but does not by itself establish the required recurring floor-red threshold or causal ON/OFF timing. No automatic flip or new causal claim. |\n| 3 | Open | UNKNOWN | CARRY: release facts do not demonstrate endpoint-churn wakeup instrumentation or the specific lifecycle trigger. No retirement from battery/build success. |\n| 4 | Open / lane unlanded | FIRED | CLOSE stale header: same landed reconciliation as IR-1; xtask main.rs 47–49 executes patch-pin check; 1047+ implementation; GOLDEN-CI 99–109 carries targeted update/block+edge/toolchain procedure; golden 276/304 prints toolchain. Register first-exercise receipt covers golden steps. |\n| 5 | Open / conditional | UNKNOWN now; NOT FIRED on original rider | COMPOSE next count-consuming rig task. Foot reconciliation 2920–2928 explicitly says original condition NOT MET, contradicting header's unreported condition. 121/3167 counts are receipts, not proof a summary parser was needed or built. |\n| 6 | Open / conditional | FIRED historically; latest extent UNKNOWN | COMPOSE gate-output work; original rider condition NOT MET, with only its new LINK rows voluntarily compliant. Current count receipts do not prove estate-wide membership enumeration. |\n| 7 | Open / hertz fixup linked | FIRED (queued lane) | CARRY linked daemon-leak lane; hertz offline/unacknowledged brief is not a landing. No source/acceptance proof of in-job launch replacement in supplied release facts. |\n| 8 | BUILT | FIRED / satisfied | CLOSE unchanged: established two-platform unreadable-path UNPROVEN verdict and Linux kill-failure evidence stand. |\n| 9 | Pin landed / BUILT | FIRED / satisfied | CLOSE unchanged: 35968156 pin plus documented runner-account/version-print and tested-cut evidence stand. |\n| 10 | Open | FIRED historically | COMPOSE runbook/checklist follow-through. Runbook work demonstrably occurred (IR-54/28); no verified consumer-population checklist fulfilment here. |\n| 11 | Open | UNKNOWN for implementation wave | COMPOSE next rig-tooling rider; cleanup is a use of holder discipline, not evidence --headless became a column. |\n| 12 | BUILT narrowed blind arm; kin note retired | FIRED / satisfied | CLOSE: preserve existing missing-assets fix plus 2026-09-06 stale-binary mutation result. Original rig cause remains unproven; prebuild rule survives independently. |\n| 13 | BUILT | FIRED / satisfied | CLOSE unchanged on documented mutation-specific fulfilment, not latest green. |\n| 14 | Open; 08-30 audit/rule completed | FIRED (operator cleanup) | CARRY structural residue, annotate new cleanup. 38 clean merged trees removed without removing dirty/unmerged/retained evidence; separate checkout/orphan hygiene from target-byte reclaim. Old count tables are dated specimens, not current inventory. |\n| 15 | BUILT | FIRED / satisfied | CLOSE unchanged: authenticated death oracle and both repins documented. Original specimen remains cause-unidentified; green rerun did not identify it. |\n| 16 | BUILT | FIRED / satisfied | CLOSE unchanged on checked returns/named loss/loud refusal fulfilment; keep already-exited Windows exception and dropped rename reasoning. |\n| 17 | Open; Windows population remains | FIRED historically; new matching sighting UNKNOWN | CARRY linked hardening/instrumented family. Known sync-cell red and unavailable earlier PR logs are not identified resident-service/grandchild sightings. Preserve Linux member's separately named closure and remaining Windows uncertainty. |\n| 18 | BUILT; deferred (b) work embedded | FIRED / satisfied for named lane | CLOSE existing authenticated-teardown disposition only; do not silently erase deferred shared breadcrumb-read/cleanliness-consolidation work. Record explicitly whether parent retains/re-homes those residuals; original specimen's killer remains unidentified. |\n| 19 | RETIRED intentional main-push policy | FIRED / satisfied | CLOSE unchanged. Full main-push unit execution is expected; 3167-pass receipt does not revive classifier defect. |\n| 20 | Open / hertz fixup linked | FIRED (hardening lane queued) | CARRY: stop stderr discrimination and load-bearing perch-pid caution remain; scoped greens do not prove explicit stop did anything. |\n| 21 | BUILT | FIRED / satisfied | CLOSE unchanged: explicit cross-package prebuilds, binedge check and shared missing-fixture precondition documented. Keep same-package/cross-package distinction. |\n| 22 | Open | FIRED historically (hygiene wave) | COMPOSE diagnostic-set remedy with test hygiene; no all-markers diagnostic proof supplied. Generic env scrubbing does not satisfy the diagnostic half. |\n| 23 | BUILT | FIRED / satisfied | CLOSE unchanged: TempDir staging plus declared parallel bare-cargo exercise recorded. |\n| 24 | BUILT | FIRED / satisfied | CLOSE unchanged on named TerminateJobObject loss and ordinary-exited TerminateProcess discrimination. Historical wrong path already corrected in status. |\n| 25 | Open | FIRED historically (CI/rig waves) | CARRY fragility; compose rig rule/hardening. Sanctioned nextest avoids in-process interference but does not retire marginal tests. Do not attribute latest unknown PR red to this family. |\n| 26 | Open / built but uncommitted (stale) | FIRED; cleanup shrank old-reader population | CARRY with status replacement. Body already says committed 8ce40d9/98cfafe; current poolguard has anchored git identity and precedence. However xtask 3134 writes owner directly after constructing claim: no incumbent lane adjudication or displaced record. Latest 38-tree removal mitigates old enforcers, not current claim-path loss. |\n| 27 | Open | FIRED (cleanup/audit slot) | CARRY post-teardown trigger gap. Existing pool-sweep detection was already shipped; new reclaim does not prove automatic post-removal sweep or link+pool lifecycle coupling. Distinguish real target dirs from junction pairs; no blanket claim latest cleanup exercised both shapes. |\n| 28 | BUILT | FIRED / satisfied | CLOSE unchanged: mechanical commit-range/changelog accounting required by PR #176. Latest release success alone is not the evidence. |\n| 29 | Open / first fix authored-unlanded (stale) | FIRED (many twohost windows) | CARRY residual faces with corrected status. IR-30 explicitly records 17bbbd8 landed v0.54.0. Later terminal-cadence seal face and emitted-token requirement must not disappear under first-face closure. Six-draw margin series remains closed/unrecoverable. |\n| 30 | Open for family sightings only | UNKNOWN whether latest red matches family | CARRY. Instruments already landed; classify known sync red only from its own frame. Earlier PR red lacks logs and remains unclassified. 121 battery / 3167 units / release build cannot close intermittent family. |\n| 31 | Open; headingless | FIRED (disk-floor recurrence/rig work) | COMPOSE aggregate lane-disk accounting with existing floor work; CARRY structural capacity debt. Root target 62.32 GiB + CI debug 59.70 GiB reclamation addresses bytes; later net 4.22 GiB cleanup is separate. No observation proves aggregate-aware admission/reservation or finished-lane disposal automation. |\n| 32 | Open | FIRED (docs/xtask wave) | COMPOSE generator refusal; source confirms still open: help_for 100–108 ignores child exit and accepts empty stdout; cli_reference inserts it; gen_one writes unconditionally. Stack mitigation does not repair producer self-agreement. |\n| 33 | Open; old 3-arg ceiling | FIRED historically | CARRY only acceptance/status reconciliation, not stale remedy proposal: main.rs 72–205 implements 16 MiB CLI thread; cli_stack_smoke.rs has real binary help/version/nonzero-return contracts. Source presence establishes changed mechanism, not current named debug execution receipt or measured new margin. Mark implementation present; require existing lane/acceptance receipt before declaring full closure. |\n| 34 | Open / hertz fixup linked | FIRED (nextest-config waves) | CARRY linked fixture/config disposition. A single non-leaky run carries no closure information; no delivered lane proof. |\n| 35 | Open rate home | FIRED historically; remeasure-after-landing UNKNOWN | CARRY. Need operator rate ruling plus landed package and correctly deduped new rate. 3167 unit passes is one population, not replacement for historical execution series; no new ratio derived. |\n| 36 | BUILT | FIRED / satisfied | CLOSE unchanged on existing owning/tree-killing helper and diagnostic/death proof. Preserve documented clone-count distinction rather than recounting. |\n| 37 | Upstream released; consume outstanding | FIRED (upstream release) | COMPOSE consume lane, do not close: current golden.yml 1413 pins WANT=0.2.0, not required 0.4.0. Upstream release is not downstream adoption; placement config/acceptance still owed. |\n| 38 | BUILT | FIRED / satisfied | CLOSE existing test-leak fix; cleanup corroborates importance of independent CWD-holder population, not a new all-holders closure. |\n| 39 | BUILT | FIRED / satisfied | CLOSE unchanged on shared missing-fixture refusal and package-correct recipe evidence. |\n| 40 | Open, resume recency + notify scope | FIRED for workflow window; arm-A implementation UNKNOWN | CARRY / COMPOSE scope-wording rider. ci-notify.sh 130 still prints bare CI $verdict. Latest 3167 passes followed by 14.3 GiB floor red is decisive receipt-scope example: workload success != job/run success. SHIP at known-red a9e786b2 is authorization, not green; release build success is another object. Brief delivered to offline hertz != acknowledged/accepted. |\n| 41 | Open; documentation corrected | FIRED (CI/runbook work) | CARRY policy decision; docs acceptance already complete, concurrency-key change is not required without ruling. No supplied evidence latest missing PR logs resulted from queued supersession; do not manufacture that explanation. |\n| 42 | BUILT documentation correction | FIRED / satisfied historically | CLOSE existing incumbent-enforcement clarification but flag wording drift: current pool_claim can refuse wrong-tree/unreadable-tree claims (main.rs 3075–3110). 'Never refuses' is now too broad; it still does not adjudicate incumbent lane ownership, so preserve that precise distinction. |\n| 43 | Open observation; mechanism unmeasured | UNKNOWN | CARRY transport-bound question. Latest sync red not identified as NoReply 60/30-second specimen; no attribution by timing overlap. |\n| 44 | Open | UNKNOWN for specific info.rs touch | COMPOSE next info.rs touch; exact false-preservation sentence still at 873–875. Serialization is not preservation; no proof remedy landed. |\n| 45 | RETIRED | FIRED / satisfied | CLOSE unchanged: temp-root path chain answered disk hermeticity only; third-node runtime ingress is not exonerated by it. |\n| 46 | Open; ruled/composed WEBSERVE rider | FIRED | CARRY acceptance reconciliation, mark source implementation present. golden START/END/DOCS raw-byte tokens exist; END always() before teardown, sample=INSTANT, 32 GiB unchanged. Latest unit-pass then disk-floor-red is honest workload-versus-resource separation, not product failure. Need per-job actual START/END and relevant golden/DOCS receipts before full ruled-remedy close; neither cleanup nor release-build green substitutes. |\n| 47 | Open; patch stashed | FIRED (golden/workflow rider window) | COMPOSE notification warning: ci-notify.sh 197–200 still merges absent/unparseable and doyle-only into quiet info. Source is enough to reject closure; no need to recover stash just to carry. |\n| 48 | Open preventive control | UNKNOWN for exact parity-cell touch | CARRY / COMPOSE next parity change. main.rs 3012 uses checked-in config; inspected parity test region supplies no LF/CRLF fixture-pair control. Current CRLF tolerance is not its own regression proof. |\n| 49 | Open ancestry-only takeover defect | FIRED (shared cleanup audit slot); takeover request UNKNOWN | CARRY; current git_lane_state 424–438 remains ancestry-only, no patch-id fallback. Removing clean merged worktrees/pools may remove affected claims/readers but does not fix future cherry-picked member takeover. Manual cleanup classification is not guard semantics. |\n| 54 | BUILT | FIRED / satisfied | CLOSE unchanged on PR #176's intake/never-executed-cells/lock-property changes. Release counter105/tag16df0e41 and known-red candidate remain explicit distinct receipts; do not flatten into tested==released green. |\n\n## Load-bearing deltas for parent edits\n1. Correct stale state, not merely append another contradictory note: IR-1/4 unlanded headers contradicted by their own landed reconciliation and first-exercise record; IR-5/6 original conditional answer is explicitly NO, not unknown. IR-26 is no longer uncommitted, IR-29's original fix no longer unlanded, IR-33's old stack mechanism has shipped source, and IR-46's ruled source exists.\n2. Operator cleanup: IR-14/26/27/49 should receive one consistently scoped event, not four closures. Removing 38 clean merged worktrees shrinks the stale-arriving-enforcer population and reconciles checkout residue. It does not establish a durable teardown trigger, incumbent guard at claim time, patch-id settled predicate, or future pool safety. No dirty/unmerged/retained evidence was removed. 62.32 GiB root target and 59.70 GiB CI debug reclamation are cache-byte mitigations; net 4.22 GiB later cleanup is a distinct event/meter. Do not add unlike values into a claimed single net-free reading.\n3. IR-40/46: preserve receipt types. 121 scoped battery pass; push-CI Windows 3167 unit pass followed by 14.3/32 GiB resource red; earlier PR unit-red logs unavailable/unclassified; golden known sync cell red under explicit SHIP; release build succeeded; v0.69.0 counter105 published at16df0e41. None logically substitutes for another. Cleanup does not establish cause of the earlier PR red, and passing workload before end-floor RED is not proof disk caused that workload or the prior red.\n4. IR-37 has a concrete unfulfilled downstream obligation: current golden installer still requests traceable-reqs 0.2.0. Upstream closed-through-release wording must not become spt-core closed.\n5. IR-32 remains a source-demonstrable hole despite stack and recursive-doc improvements. IR-42's old universal 'claim never refuses' sentence is now false because a different, tree-match refusal was added; incumbent ownership enforcement is still absent. Keep these distinctions visible.\n6. No new family membership, rate, cause, or acceptance execution was inferred from source presence, temporal overlap, unavailable logs, or green receipts. Existing built/retired verdicts above stand on their recorded evidence; no validation suite was run."},"error":null}}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1579,"output":4082,"cacheRead":118400,"cacheWrite":0,"totalTokens":124061,"reasoningTokens":56,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789094656848,"responseId":"resp_074aee81620ae383016aa36afec19887d1a99cc51c8c9f254d","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_074aee81620ae383016aa36aff9ee087d1b95415b17509cea2","type":"reasoning","content":[],"encrypted_content":"gAAAAABqo2sDzZGCZl6zAyTMPlQ2cve42cIzIWRGwdUUuK_kpQG5We96TZLL23ahsPxXe_M0O48Oz2hGIJQFlMXK8loPEvkKRzlJfscDfcMXhO5DeVGGeeBYv2y2nWUm90YElN8CsLJKausSRCpn9xkYpz9UEm9ZNUjw_idT7bwUB0o1Ch8lZRZrKt0EiHcmC7XeVhPjlw3jzWEZhJYv22vbVD7dZ2VCm3-LILNbfzoDtiqwq9vtd_FDgHRpeq1mmsbz3oludufqAu0juL0LV2nFff2sH0lTjitKnZhfXzJ-Au0E914F9IFsxlL_KO5T3LmVYKrd0sm7yoBt_TIh44PPzjWbR4UmkJ7zsS2xp4Y-WIBc8GNDzoKA9ZVsMxoJ2y4K5_-aeAr4sddbRSn8odV842893ct4-xA9iZutzQ3AtJIr2iDSETAyng4PalozbLz0hrg6m7neNGxxHSzbSxqdGJl66mvROt3OHWGxScCC7mZBlYSLTCsVwcnHZVOvVKmDihlS8_fh2xnhKmrV2bXxKfdLYLrlzTtTU9ztBbUCpPTdLVNbSzxT15az8U6SSNlzAbAx-uhrTvSNjN9dIQTk3Cd1kW9wVzuP6tbTrG6WFrJB398sEjYpgs9ulQMVSbJet9IzZq3m6VjtyACndxRhGfJRWuhTW-v8-lRS6VXbFuHB58sVYZZVwbdUrR5onYvmsnSRmzPTgKKYMKI02MHr_UZpYN9IJzM9Nk164dqpS1Ht0K9eDeh5mvijETqtpxV9RZEdrvP0QYIcWKZ8iUvBn6Zzzg7_jP-ew9ldgYoA1gR1ZmgIsWAJi8YNcR_JAyKoPuFg67SJj21MORuCIAlZeCCq5ID8YpZF94MFhSOtF7XPb1o-ungHTHjDhG9Q3xfhVQjtqMNiv2oRfIydzJhe5ExebG0oaupGez9JQ7U75yjp-mWVUAGoN8H40ejEWnIOUCzYeorgO2NKflSxxo8t0KjEv93j6KwfLUWJvrqjflL2SmGXmcLttoy1rxLmEjNhLEJxUofvCaEQIXt7qRK9oAzwqXSJech1avbaV8rjzanjGaH1f1dSf0wsDwltao_XjqF_jHnCsoVdXErvTEyBQNXR-J00HvX0xqRTOzn8gPu7c6tf4Enp2u-6pIDApQ9pK1uL6AjJvN0Ye0kTWOr9VOb8U9knohQw3k-LrxqocSQgP3c-xrbbWpLtzINnxCry4_tBQovaQv_GgoRfZThIYR5yiCIW54Czw2fkfLUibErZ4_c0vNnRD8pTPvKmAmQZ8WkXPzORjtFSVD182lZiWiAvvWwrRrZaH9v8MuAHgYG1D_lKiiTKD8v4pxUd-A4qWUKRJ2SOaa5nvw1kaW-j8uh2KJrXRTe867GJQXyCHt_W4rJ1KFKyRFmfE-hOdNtE7nD_XttB99PTYFYj46xpj7P1gVHIxFVoc7hQiwPVg9h399xAwRWpNPfGZ2Giih4hv8p5EiuDiV1jZ7w6wGoHda8ZOyYXaDkQM7sbEywx8UWd2Yu6phqkW5m4OFZBzmem__4WB9x8QSkSVVOlEutNh65xBvTmIyP9PuBpFud_GKGs-F9xXnuZjkSjcZ3lMyPu6ftwm1GLmhQ57YSbVzSThmwMaHJOlmOcQoDS7k70n6AL6U54r6YIlHVR29dmP4oh5pCJRR95AGAGXQ0jdtZD1ZlSLubszQ==","internal_chat_message_metadata_passthrough":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"summary":[{"type":"summary_text","text":"**Checking trigger evidence**"}],"metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}},{"id":"fc_074aee81620ae383016aa36b03ef9887d19c5a41e39dc0dcd3","type":"function_call","status":"completed","arguments":"{\"type\":null,\"data\":{\"summary\":\"Exhaustive read-only sweep: 50 assigned entries (IR-1–49 plus IR-54), including headingless IR-31. Strong stale-status findings: IR-1/4 landed and exercised; IR-26 build-side identity is present but claim-side remedy remains missing; IR-29 first face landed but later faces remain; IR-33 sized-stack implementation exists; IR-46 ruled floor tokens are implemented but acceptance receipts remain distinct. No tests, measurements, edits, or board mutations performed.\",\"files\":[{\"path\":\"docs/INFRA-REGISTER.md:180-2725\",\"description\":\"All assigned bodies read; 49 numbered entries plus IR-54, with IR-31 beginning at the second Status paragraph inside IR-30.\"},{\"path\":\".github/workflows/golden.yml\",\"description\":\"Verified current link probes, toolchain print, START/END/DOCS disk assertions, and traceable-reqs pin still 0.2.0.\"},{\"path\":\"crates/xtask/src/main.rs\",\"description\":\"Verified load-bearing patch check, unguarded help-output generation, current pool-claim tree-match guard and unconditional incumbent overwrite.\"},{\"path\":\"crates/spt-poolguard/src/lib.rs:367-443\",\"description\":\"Verified anchored lane identity and ancestry-only settled predicate; no patch-id fallback.\"},{\"path\":\"crates/spt/src/main.rs:72-205\",\"description\":\"Verified CLI runs on 16 MiB owned thread stack; existing cli_stack_smoke integration evidence source identified.\"},{\"path\":\"crates/spt-store/src/info.rs:872-876\",\"description\":\"IR-44 preservation-overclaim remains verbatim.\"},{\"path\":\".github/ci/ci-notify.sh:129-130,182-200\",\"description\":\"IR-40 bare CI verdict wording and IR-47 quiet absent-coauthor branch remain.\"}],\"architecture\":\"The register mixes original status headers, later corrections, and independent residual mechanisms. Treat implementation, exercised acceptance, historical specimens, and current release receipts as separate evidence objects. Pool enforcement executes in the arriving tree; claim writes remain a separate path. Disk tokens are instantaneous observations, not sustained headroom.\",\"report\":\"## Scope and decision vocabulary\\nExactly 50 rows: IR-1 through IR-49, plus IR-54. IR-50 begins at line 2726 and is excluded. IR-31 is the headingless second Status paragraph after IR-30's Linux-face resolution, through line 2068. Trigger means the entry's stated ripeness event, including a historically documented firing; UNKNOWN never means disproved. CLOSE for already-built/retired entries means preserve their established disposition, not a new claim based on v0.69.0 green. Source reads below were not executions.\\n\\n| IR | Current entry status | Trigger | Recommended disposition and evidence |\\n|---|---|---|---|\\n| 1 | Open / lane unlanded | FIRED | CLOSE stale header: reconciliation at 2878–2906 explicitly identifies landed commits; register 169–171 records first golden exercise; current golden.yml 1096/1264 invokes both link probes. Original 4–7 ms negative is not a universal network acquittal. |\\n| 2 | RETIRED; incremental remains ON | UNKNOWN for reopen threshold | CARRY retired decision, flag returned disk pressure. New 14.3 vs 32 GiB red weakens historical ample-disk rationale but does not by itself establish the required recurring floor-red threshold or causal ON/OFF timing. No automatic flip or new causal claim. |\\n| 3 | Open | UNKNOWN | CARRY: release facts do not demonstrate endpoint-churn wakeup instrumentation or the specific lifecycle trigger. No retirement from battery/build success. |\\n| 4 | Open / lane unlanded | FIRED | CLOSE stale header: same landed reconciliation as IR-1; xtask main.rs 47–49 executes patch-pin check; 1047+ implementation; GOLDEN-CI 99–109 carries targeted update/block+edge/toolchain procedure; golden 276/304 prints toolchain. Register first-exercise receipt covers golden steps. |\\n| 5 | Open / conditional | UNKNOWN now; NOT FIRED on original rider | COMPOSE next count-consuming rig task. Foot reconciliation 2920–2928 explicitly says original condition NOT MET, contradicting header's unreported condition. 121/3167 counts are receipts, not proof a summary parser was needed or built. |\\n| 6 | Open / conditional | FIRED historically; latest extent UNKNOWN | COMPOSE gate-output work; original rider condition NOT MET, with only its new LINK rows voluntarily compliant. Current count receipts do not prove estate-wide membership enumeration. |\\n| 7 | Open / hertz fixup linked | FIRED (queued lane) | CARRY linked daemon-leak lane; hertz offline/unacknowledged brief is not a landing. No source/acceptance proof of in-job launch replacement in supplied release facts. |\\n| 8 | BUILT | FIRED / satisfied | CLOSE unchanged: established two-platform unreadable-path UNPROVEN verdict and Linux kill-failure evidence stand. |\\n| 9 | Pin landed / BUILT | FIRED / satisfied | CLOSE unchanged: 35968156 pin plus documented runner-account/version-print and tested-cut evidence stand. |\\n| 10 | Open | FIRED historically | COMPOSE runbook/checklist follow-through. Runbook work demonstrably occurred (IR-54/28); no verified consumer-population checklist fulfilment here. |\\n| 11 | Open | UNKNOWN for implementation wave | COMPOSE next rig-tooling rider; cleanup is a use of holder discipline, not evidence --headless became a column. |\\n| 12 | BUILT narrowed blind arm; kin note retired | FIRED / satisfied | CLOSE: preserve existing missing-assets fix plus 2026-09-06 stale-binary mutation result. Original rig cause remains unproven; prebuild rule survives independently. |\\n| 13 | BUILT | FIRED / satisfied | CLOSE unchanged on documented mutation-specific fulfilment, not latest green. |\\n| 14 | Open; 08-30 audit/rule completed | FIRED (operator cleanup) | CARRY structural residue, annotate new cleanup. 38 clean merged trees removed without removing dirty/unmerged/retained evidence; separate checkout/orphan hygiene from target-byte reclaim. Old count tables are dated specimens, not current inventory. |\\n| 15 | BUILT | FIRED / satisfied | CLOSE unchanged: authenticated death oracle and both repins documented. Original specimen remains cause-unidentified; green rerun did not identify it. |\\n| 16 | BUILT | FIRED / satisfied | CLOSE unchanged on checked returns/named loss/loud refusal fulfilment; keep already-exited Windows exception and dropped rename reasoning. |\\n| 17 | Open; Windows population remains | FIRED historically; new matching sighting UNKNOWN | CARRY linked hardening/instrumented family. Known sync-cell red and unavailable earlier PR logs are not identified resident-service/grandchild sightings. Preserve Linux member's separately named closure and remaining Windows uncertainty. |\\n| 18 | BUILT; deferred (b) work embedded | FIRED / satisfied for named lane | CLOSE existing authenticated-teardown disposition only; do not silently erase deferred shared breadcrumb-read/cleanliness-consolidation work. Record explicitly whether parent retains/re-homes those residuals; original specimen's killer remains unidentified. |\\n| 19 | RETIRED intentional main-push policy | FIRED / satisfied | CLOSE unchanged. Full main-push unit execution is expected; 3167-pass receipt does not revive classifier defect. |\\n| 20 | Open / hertz fixup linked | FIRED (hardening lane queued) | CARRY: stop stderr discrimination and load-bearing perch-pid caution remain; scoped greens do not prove explicit stop did anything. |\\n| 21 | BUILT | FIRED / satisfied | CLOSE unchanged: explicit cross-package prebuilds, binedge check and shared missing-fixture precondition documented. Keep same-package/cross-package distinction. |\\n| 22 | Open | FIRED historically (hygiene wave) | COMPOSE diagnostic-set remedy with test hygiene; no all-markers diagnostic proof supplied. Generic env scrubbing does not satisfy the diagnostic half. |\\n| 23 | BUILT | FIRED / satisfied | CLOSE unchanged: TempDir staging plus declared parallel bare-cargo exercise recorded. |\\n| 24 | BUILT | FIRED / satisfied | CLOSE unchanged on named TerminateJobObject loss and ordinary-exited TerminateProcess discrimination. Historical wrong path already corrected in status. |\\n| 25 | Open | FIRED historically (CI/rig waves) | CARRY fragility; compose rig rule/hardening. Sanctioned nextest avoids in-process interference but does not retire marginal tests. Do not attribute latest unknown PR red to this family. |\\n| 26 | Open / built but uncommitted (stale) | FIRED; cleanup shrank old-reader population | CARRY with status replacement. Body already says committed 8ce40d9/98cfafe; current poolguard has anchored git identity and precedence. However xtask 3134 writes owner directly after constructing claim: no incumbent lane adjudication or displaced record. Latest 38-tree removal mitigates old enforcers, not current claim-path loss. |\\n| 27 | Open | FIRED (cleanup/audit slot) | CARRY post-teardown trigger gap. Existing pool-sweep detection was already shipped; new reclaim does not prove automatic post-removal sweep or link+pool lifecycle coupling. Distinguish real target dirs from junction pairs; no blanket claim latest cleanup exercised both shapes. |\\n| 28 | BUILT | FIRED / satisfied | CLOSE unchanged: mechanical commit-range/changelog accounting required by PR #176. Latest release success alone is not the evidence. |\\n| 29 | Open / first fix authored-unlanded (stale) | FIRED (many twohost windows) | CARRY residual faces with corrected status. IR-30 explicitly records 17bbbd8 landed v0.54.0. Later terminal-cadence seal face and emitted-token requirement must not disappear under first-face closure. Six-draw margin series remains closed/unrecoverable. |\\n| 30 | Open for family sightings only | UNKNOWN whether latest red matches family | CARRY. Instruments already landed; classify known sync red only from its own frame. Earlier PR red lacks logs and remains unclassified. 121 battery / 3167 units / release build cannot close intermittent family. |\\n| 31 | Open; headingless | FIRED (disk-floor recurrence/rig work) | COMPOSE aggregate lane-disk accounting with existing floor work; CARRY structural capacity debt. Root target 62.32 GiB + CI debug 59.70 GiB reclamation addresses bytes; later net 4.22 GiB cleanup is separate. No observation proves aggregate-aware admission/reservation or finished-lane disposal automation. |\\n| 32 | Open | FIRED (docs/xtask wave) | COMPOSE generator refusal; source confirms still open: help_for 100–108 ignores child exit and accepts empty stdout; cli_reference inserts it; gen_one writes unconditionally. Stack mitigation does not repair producer self-agreement. |\\n| 33 | Open; old 3-arg ceiling | FIRED historically | CARRY only acceptance/status reconciliation, not stale remedy proposal: main.rs 72–205 implements 16 MiB CLI thread; cli_stack_smoke.rs has real binary help/version/nonzero-return contracts. Source presence establishes changed mechanism, not current named debug execution receipt or measured new margin. Mark implementation present; require existing lane/acceptance receipt before declaring full closure. |\\n| 34 | Open / hertz fixup linked | FIRED (nextest-config waves) | CARRY linked fixture/config disposition. A single non-leaky run carries no closure information; no delivered lane proof. |\\n| 35 | Open rate home | FIRED historically; remeasure-after-landing UNKNOWN | CARRY. Need operator rate ruling plus landed package and correctly deduped new rate. 3167 unit passes is one population, not replacement for historical execution series; no new ratio derived. |\\n| 36 | BUILT | FIRED / satisfied | CLOSE unchanged on existing owning/tree-killing helper and diagnostic/death proof. Preserve documented clone-count distinction rather than recounting. |\\n| 37 | Upstream released; consume outstanding | FIRED (upstream release) | COMPOSE consume lane, do not close: current golden.yml 1413 pins WANT=0.2.0, not required 0.4.0. Upstream release is not downstream adoption; placement config/acceptance still owed. |\\n| 38 | BUILT | FIRED / satisfied | CLOSE existing test-leak fix; cleanup corroborates importance of independent CWD-holder population, not a new all-holders closure. |\\n| 39 | BUILT | FIRED / satisfied | CLOSE unchanged on shared missing-fixture refusal and package-correct recipe evidence. |\\n| 40 | Open, resume recency + notify scope | FIRED for workflow window; arm-A implementation UNKNOWN | CARRY / COMPOSE scope-wording rider. ci-notify.sh 130 still prints bare CI $verdict. Latest 3167 passes followed by 14.3 GiB floor red is decisive receipt-scope example: workload success != job/run success. SHIP at known-red a9e786b2 is authorization, not green; release build success is another object. Brief delivered to offline hertz != acknowledged/accepted. |\\n| 41 | Open; documentation corrected | FIRED (CI/runbook work) | CARRY policy decision; docs acceptance already complete, concurrency-key change is not required without ruling. No supplied evidence latest missing PR logs resulted from queued supersession; do not manufacture that explanation. |\\n| 42 | BUILT documentation correction | FIRED / satisfied historically | CLOSE existing incumbent-enforcement clarification but flag wording drift: current pool_claim can refuse wrong-tree/unreadable-tree claims (main.rs 3075–3110). 'Never refuses' is now too broad; it still does not adjudicate incumbent lane ownership, so preserve that precise distinction. |\\n| 43 | Open observation; mechanism unmeasured | UNKNOWN | CARRY transport-bound question. Latest sync red not identified as NoReply 60/30-second specimen; no attribution by timing overlap. |\\n| 44 | Open | UNKNOWN for specific info.rs touch | COMPOSE next info.rs touch; exact false-preservation sentence still at 873–875. Serialization is not preservation; no proof remedy landed. |\\n| 45 | RETIRED | FIRED / satisfied | CLOSE unchanged: temp-root path chain answered disk hermeticity only; third-node runtime ingress is not exonerated by it. |\\n| 46 | Open; ruled/composed WEBSERVE rider | FIRED | CARRY acceptance reconciliation, mark source implementation present. golden START/END/DOCS raw-byte tokens exist; END always() before teardown, sample=INSTANT, 32 GiB unchanged. Latest unit-pass then disk-floor-red is honest workload-versus-resource separation, not product failure. Need per-job actual START/END and relevant golden/DOCS receipts before full ruled-remedy close; neither cleanup nor release-build green substitutes. |\\n| 47 | Open; patch stashed | FIRED (golden/workflow rider window) | COMPOSE notification warning: ci-notify.sh 197–200 still merges absent/unparseable and doyle-only into quiet info. Source is enough to reject closure; no need to recover stash just to carry. |\\n| 48 | Open preventive control | UNKNOWN for exact parity-cell touch | CARRY / COMPOSE next parity change. main.rs 3012 uses checked-in config; inspected parity test region supplies no LF/CRLF fixture-pair control. Current CRLF tolerance is not its own regression proof. |\\n| 49 | Open ancestry-only takeover defect | FIRED (shared cleanup audit slot); takeover request UNKNOWN | CARRY; current git_lane_state 424–438 remains ancestry-only, no patch-id fallback. Removing clean merged worktrees/pools may remove affected claims/readers but does not fix future cherry-picked member takeover. Manual cleanup classification is not guard semantics. |\\n| 54 | BUILT | FIRED / satisfied | CLOSE unchanged on PR #176's intake/never-executed-cells/lock-property changes. Release counter105/tag16df0e41 and known-red candidate remain explicit distinct receipts; do not flatten into tested==released green. |\\n\\n## Load-bearing deltas for parent edits\\n1. Correct stale state, not merely append another contradictory note: IR-1/4 unlanded headers contradicted by their own landed reconciliation and first-exercise record; IR-5/6 original conditional answer is explicitly NO, not unknown. IR-26 is no longer uncommitted, IR-29's original fix no longer unlanded, IR-33's old stack mechanism has shipped source, and IR-46's ruled source exists.\\n2. Operator cleanup: IR-14/26/27/49 should receive one consistently scoped event, not four closures. Removing 38 clean merged worktrees shrinks the stale-arriving-enforcer population and reconciles checkout residue. It does not establish a durable teardown trigger, incumbent guard at claim time, patch-id settled predicate, or future pool safety. No dirty/unmerged/retained evidence was removed. 62.32 GiB root target and 59.70 GiB CI debug reclamation are cache-byte mitigations; net 4.22 GiB later cleanup is a distinct event/meter. Do not add unlike values into a claimed single net-free reading.\\n3. IR-40/46: preserve receipt types. 121 scoped battery pass; push-CI Windows 3167 unit pass followed by 14.3/32 GiB resource red; earlier PR unit-red logs unavailable/unclassified; golden known sync cell red under explicit SHIP; release build succeeded; v0.69.0 counter105 published at16df0e41. None logically substitutes for another. Cleanup does not establish cause of the earlier PR red, and passing workload before end-floor RED is not proof disk caused that workload or the prior red.\\n4. IR-37 has a concrete unfulfilled downstream obligation: current golden installer still requests traceable-reqs 0.2.0. Upstream closed-through-release wording must not become spt-core closed.\\n5. IR-32 remains a source-demonstrable hole despite stack and recursive-doc improvements. IR-42's old universal 'claim never refuses' sentence is now false because a different, tree-match refusal was added; incumbent ownership enforcement is still absent. Keep these distinctions visible.\\n6. No new family membership, rate, cause, or acceptance execution was inferred from source presence, temporal overlap, unavailable logs, or green receipts. Existing built/retired verdicts above stand on their recorded evidence; no validation suite was run.\"},\"error\":null}","call_id":"call_ItiLSNCbVvyHuY8jotWUOJY3","internal_chat_message_metadata_passthrough":{"create_time":1789094655.0004,"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"},"name":"yield","metadata":{"turn_id":"f5cbe7f5-fa32-4ab2-9bdd-99a865d41029"}}]},"duration":123611.6372999996,"ttft":1126.7320999996737,"completedAt":1789094780463,"contextSnapshot":{"promptTokens":119979,"nonMessageTokens":10400,"compactionEpoch":0}}}
{"type":"message","id":"6f2088b3","parentId":"58b2ac65","timestamp":"2026-09-11T02:46:20.470Z","message":{"role":"toolResult","toolCallId":"call_ItiLSNCbVvyHuY8jotWUOJY3|fc_074aee81620ae383016aa36b03ef9887d19c5a41e39dc0dcd3","toolName":"yield","content":[{"type":"text","text":"Result submitted."}],"details":{"data":{"summary":"Exhaustive read-only sweep: 50 assigned entries (IR-1–49 plus IR-54), including headingless IR-31. Strong stale-status findings: IR-1/4 landed and exercised; IR-26 build-side identity is present but claim-side remedy remains missing; IR-29 first face landed but later faces remain; IR-33 sized-stack implementation exists; IR-46 ruled floor tokens are implemented but acceptance receipts remain distinct. No tests, measurements, edits, or board mutations performed.","files":[{"path":"docs/INFRA-REGISTER.md:180-2725","description":"All assigned bodies read; 49 numbered entries plus IR-54, with IR-31 beginning at the second Status paragraph inside IR-30."},{"path":".github/workflows/golden.yml","description":"Verified current link probes, toolchain print, START/END/DOCS disk assertions, and traceable-reqs pin still 0.2.0."},{"path":"crates/xtask/src/main.rs","description":"Verified load-bearing patch check, unguarded help-output generation, current pool-claim tree-match guard and unconditional incumbent overwrite."},{"path":"crates/spt-poolguard/src/lib.rs:367-443","description":"Verified anchored lane identity and ancestry-only settled predicate; no patch-id fallback."},{"path":"crates/spt/src/main.rs:72-205","description":"Verified CLI runs on 16 MiB owned thread stack; existing cli_stack_smoke integration evidence source identified."},{"path":"crates/spt-store/src/info.rs:872-876","description":"IR-44 preservation-overclaim remains verbatim."},{"path":".github/ci/ci-notify.sh:129-130,182-200","description":"IR-40 bare CI verdict wording and IR-47 quiet absent-coauthor branch remain."}],"architecture":"The register mixes original status headers, later corrections, and independent residual mechanisms. Treat implementation, exercised acceptance, historical specimens, and current release receipts as separate evidence objects. Pool enforcement executes in the arriving tree; claim writes remain a separate path. Disk tokens are instantaneous observations, not sustained headroom.","report":"## Scope and decision vocabulary\nExactly 50 rows: IR-1 through IR-49, plus IR-54. IR-50 begins at line 2726 and is excluded. IR-31 is the headingless second Status paragraph after IR-30's Linux-face resolution, through line 2068. Trigger means the entry's stated ripeness event, including a historically documented firing; UNKNOWN never means disproved. CLOSE for already-built/retired entries means preserve their established disposition, not a new claim based on v0.69.0 green. Source reads below were not executions.\n\n| IR | Current entry status | Trigger | Recommended disposition and evidence |\n|---|---|---|---|\n| 1 | Open / lane unlanded | FIRED | CLOSE stale header: reconciliation at 2878–2906 explicitly identifies landed commits; register 169–171 records first golden exercise; current golden.yml 1096/1264 invokes both link probes. Original 4–7 ms negative is not a universal network acquittal. |\n| 2 | RETIRED; incremental remains ON | UNKNOWN for reopen threshold | CARRY retired decision, flag returned disk pressure. New 14.3 vs 32 GiB red weakens historical ample-disk rationale but does not by itself establish the required recurring floor-red threshold or causal ON/OFF timing. No automatic flip or new causal claim. |\n| 3 | Open | UNKNOWN | CARRY: release facts do not demonstrate endpoint-churn wakeup instrumentation or the specific lifecycle trigger. No retirement from battery/build success. |\n| 4 | Open / lane unlanded | FIRED | CLOSE stale header: same landed reconciliation as IR-1; xtask main.rs 47–49 executes patch-pin check; 1047+ implementation; GOLDEN-CI 99–109 carries targeted update/block+edge/toolchain procedure; golden 276/304 prints toolchain. Register first-exercise receipt covers golden steps. |\n| 5 | Open / conditional | UNKNOWN now; NOT FIRED on original rider | COMPOSE next count-consuming rig task. Foot reconciliation 2920–2928 explicitly says original condition NOT MET, contradicting header's unreported condition. 121/3167 counts are receipts, not proof a summary parser was needed or built. |\n| 6 | Open / conditional | FIRED historically; latest extent UNKNOWN | COMPOSE gate-output work; original rider condition NOT MET, with only its new LINK rows voluntarily compliant. Current count receipts do not prove estate-wide membership enumeration. |\n| 7 | Open / hertz fixup linked | FIRED (queued lane) | CARRY linked daemon-leak lane; hertz offline/unacknowledged brief is not a landing. No source/acceptance proof of in-job launch replacement in supplied release facts. |\n| 8 | BUILT | FIRED / satisfied | CLOSE unchanged: established two-platform unreadable-path UNPROVEN verdict and Linux kill-failure evidence stand. |\n| 9 | Pin landed / BUILT | FIRED / satisfied | CLOSE unchanged: 35968156 pin plus documented runner-account/version-print and tested-cut evidence stand. |\n| 10 | Open | FIRED historically | COMPOSE runbook/checklist follow-through. Runbook work demonstrably occurred (IR-54/28); no verified consumer-population checklist fulfilment here. |\n| 11 | Open | UNKNOWN for implementation wave | COMPOSE next rig-tooling rider; cleanup is a use of holder discipline, not evidence --headless became a column. |\n| 12 | BUILT narrowed blind arm; kin note retired | FIRED / satisfied | CLOSE: preserve existing missing-assets fix plus 2026-09-06 stale-binary mutation result. Original rig cause remains unproven; prebuild rule survives independently. |\n| 13 | BUILT | FIRED / satisfied | CLOSE unchanged on documented mutation-specific fulfilment, not latest green. |\n| 14 | Open; 08-30 audit/rule completed | FIRED (operator cleanup) | CARRY structural residue, annotate new cleanup. 38 clean merged trees removed without removing dirty/unmerged/retained evidence; separate checkout/orphan hygiene from target-byte reclaim. Old count tables are dated specimens, not current inventory. |\n| 15 | BUILT | FIRED / satisfied | CLOSE unchanged: authenticated death oracle and both repins documented. Original specimen remains cause-unidentified; green rerun did not identify it. |\n| 16 | BUILT | FIRED / satisfied | CLOSE unchanged on checked returns/named loss/loud refusal fulfilment; keep already-exited Windows exception and dropped rename reasoning. |\n| 17 | Open; Windows population remains | FIRED historically; new matching sighting UNKNOWN | CARRY linked hardening/instrumented family. Known sync-cell red and unavailable earlier PR logs are not identified resident-service/grandchild sightings. Preserve Linux member's separately named closure and remaining Windows uncertainty. |\n| 18 | BUILT; deferred (b) work embedded | FIRED / satisfied for named lane | CLOSE existing authenticated-teardown disposition only; do not silently erase deferred shared breadcrumb-read/cleanliness-consolidation work. Record explicitly whether parent retains/re-homes those residuals; original specimen's killer remains unidentified. |\n| 19 | RETIRED intentional main-push policy | FIRED / satisfied | CLOSE unchanged. Full main-push unit execution is expected; 3167-pass receipt does not revive classifier defect. |\n| 20 | Open / hertz fixup linked | FIRED (hardening lane queued) | CARRY: stop stderr discrimination and load-bearing perch-pid caution remain; scoped greens do not prove explicit stop did anything. |\n| 21 | BUILT | FIRED / satisfied | CLOSE unchanged: explicit cross-package prebuilds, binedge check and shared missing-fixture precondition documented. Keep same-package/cross-package distinction. |\n| 22 | Open | FIRED historically (hygiene wave) | COMPOSE diagnostic-set remedy with test hygiene; no all-markers diagnostic proof supplied. Generic env scrubbing does not satisfy the diagnostic half. |\n| 23 | BUILT | FIRED / satisfied | CLOSE unchanged: TempDir staging plus declared parallel bare-cargo exercise recorded. |\n| 24 | BUILT | FIRED / satisfied | CLOSE unchanged on named TerminateJobObject loss and ordinary-exited TerminateProcess discrimination. Historical wrong path already corrected in status. |\n| 25 | Open | FIRED historically (CI/rig waves) | CARRY fragility; compose rig rule/hardening. Sanctioned nextest avoids in-process interference but does not retire marginal tests. Do not attribute latest unknown PR red to this family. |\n| 26 | Open / built but uncommitted (stale) | FIRED; cleanup shrank old-reader population | CARRY with status replacement. Body already says committed 8ce40d9/98cfafe; current poolguard has anchored git identity and precedence. However xtask 3134 writes owner directly after constructing claim: no incumbent lane adjudication or displaced record. Latest 38-tree removal mitigates old enforcers, not current claim-path loss. |\n| 27 | Open | FIRED (cleanup/audit slot) | CARRY post-teardown trigger gap. Existing pool-sweep detection was already shipped; new reclaim does not prove automatic post-removal sweep or link+pool lifecycle coupling. Distinguish real target dirs from junction pairs; no blanket claim latest cleanup exercised both shapes. |\n| 28 | BUILT | FIRED / satisfied | CLOSE unchanged: mechanical commit-range/changelog accounting required by PR #176. Latest release success alone is not the evidence. |\n| 29 | Open / first fix authored-unlanded (stale) | FIRED (many twohost windows) | CARRY residual faces with corrected status. IR-30 explicitly records 17bbbd8 landed v0.54.0. Later terminal-cadence seal face and emitted-token requirement must not disappear under first-face closure. Six-draw margin series remains closed/unrecoverable. |\n| 30 | Open for family sightings only | UNKNOWN whether latest red matches family | CARRY. Instruments already landed; classify known sync red only from its own frame. Earlier PR red lacks logs and remains unclassified. 121 battery / 3167 units / release build cannot close intermittent family. |\n| 31 | Open; headingless | FIRED (disk-floor recurrence/rig work) | COMPOSE aggregate lane-disk accounting with existing floor work; CARRY structural capacity debt. Root target 62.32 GiB + CI debug 59.70 GiB reclamation addresses bytes; later net 4.22 GiB cleanup is separate. No observation proves aggregate-aware admission/reservation or finished-lane disposal automation. |\n| 32 | Open | FIRED (docs/xtask wave) | COMPOSE generator refusal; source confirms still open: help_for 100–108 ignores child exit and accepts empty stdout; cli_reference inserts it; gen_one writes unconditionally. Stack mitigation does not repair producer self-agreement. |\n| 33 | Open; old 3-arg ceiling | FIRED historically | CARRY only acceptance/status reconciliation, not stale remedy proposal: main.rs 72–205 implements 16 MiB CLI thread; cli_stack_smoke.rs has real binary help/version/nonzero-return contracts. Source presence establishes changed mechanism, not current named debug execution receipt or measured new margin. Mark implementation present; require existing lane/acceptance receipt before declaring full closure. |\n| 34 | Open / hertz fixup linked | FIRED (nextest-config waves) | CARRY linked fixture/config disposition. A single non-leaky run carries no closure information; no delivered lane proof. |\n| 35 | Open rate home | FIRED historically; remeasure-after-landing UNKNOWN | CARRY. Need operator rate ruling plus landed package and correctly deduped new rate. 3167 unit passes is one population, not replacement for historical execution series; no new ratio derived. |\n| 36 | BUILT | FIRED / satisfied | CLOSE unchanged on existing owning/tree-killing helper and diagnostic/death proof. Preserve documented clone-count distinction rather than recounting. |\n| 37 | Upstream released; consume outstanding | FIRED (upstream release) | COMPOSE consume lane, do not close: current golden.yml 1413 pins WANT=0.2.0, not required 0.4.0. Upstream release is not downstream adoption; placement config/acceptance still owed. |\n| 38 | BUILT | FIRED / satisfied | CLOSE existing test-leak fix; cleanup corroborates importance of independent CWD-holder population, not a new all-holders closure. |\n| 39 | BUILT | FIRED / satisfied | CLOSE unchanged on shared missing-fixture refusal and package-correct recipe evidence. |\n| 40 | Open, resume recency + notify scope | FIRED for workflow window; arm-A implementation UNKNOWN | CARRY / COMPOSE scope-wording rider. ci-notify.sh 130 still prints bare CI $verdict. Latest 3167 passes followed by 14.3 GiB floor red is decisive receipt-scope example: workload success != job/run success. SHIP at known-red a9e786b2 is authorization, not green; release build success is another object. Brief delivered to offline hertz != acknowledged/accepted. |\n| 41 | Open; documentation corrected | FIRED (CI/runbook work) | CARRY policy decision; docs acceptance already complete, concurrency-key change is not required without ruling. No supplied evidence latest missing PR logs resulted from queued supersession; do not manufacture that explanation. |\n| 42 | BUILT documentation correction | FIRED / satisfied historically | CLOSE existing incumbent-enforcement clarification but flag wording drift: current pool_claim can refuse wrong-tree/unreadable-tree claims (main.rs 3075–3110). 'Never refuses' is now too broad; it still does not adjudicate incumbent lane ownership, so preserve that precise distinction. |\n| 43 | Open observation; mechanism unmeasured | UNKNOWN | CARRY transport-bound question. Latest sync red not identified as NoReply 60/30-second specimen; no attribution by timing overlap. |\n| 44 | Open | UNKNOWN for specific info.rs touch | COMPOSE next info.rs touch; exact false-preservation sentence still at 873–875. Serialization is not preservation; no proof remedy landed. |\n| 45 | RETIRED | FIRED / satisfied | CLOSE unchanged: temp-root path chain answered disk hermeticity only; third-node runtime ingress is not exonerated by it. |\n| 46 | Open; ruled/composed WEBSERVE rider | FIRED | CARRY acceptance reconciliation, mark source implementation present. golden START/END/DOCS raw-byte tokens exist; END always() before teardown, sample=INSTANT, 32 GiB unchanged. Latest unit-pass then disk-floor-red is honest workload-versus-resource separation, not product failure. Need per-job actual START/END and relevant golden/DOCS receipts before full ruled-remedy close; neither cleanup nor release-build green substitutes. |\n| 47 | Open; patch stashed | FIRED (golden/workflow rider window) | COMPOSE notification warning: ci-notify.sh 197–200 still merges absent/unparseable and doyle-only into quiet info. Source is enough to reject closure; no need to recover stash just to carry. |\n| 48 | Open preventive control | UNKNOWN for exact parity-cell touch | CARRY / COMPOSE next parity change. main.rs 3012 uses checked-in config; inspected parity test region supplies no LF/CRLF fixture-pair control. Current CRLF tolerance is not its own regression proof. |\n| 49 | Open ancestry-only takeover defect | FIRED (shared cleanup audit slot); takeover request UNKNOWN | CARRY; current git_lane_state 424–438 remains ancestry-only, no patch-id fallback. Removing clean merged worktrees/pools may remove affected claims/readers but does not fix future cherry-picked member takeover. Manual cleanup classification is not guard semantics. |\n| 54 | BUILT | FIRED / satisfied | CLOSE unchanged on PR #176's intake/never-executed-cells/lock-property changes. Release counter105/tag16df0e41 and known-red candidate remain explicit distinct receipts; do not flatten into tested==released green. |\n\n## Load-bearing deltas for parent edits\n1. Correct stale state, not merely append another contradictory note: IR-1/4 unlanded headers contradicted by their own landed reconciliation and first-exercise record; IR-5/6 original conditional answer is explicitly NO, not unknown. IR-26 is no longer uncommitted, IR-29's original fix no longer unlanded, IR-33's old stack mechanism has shipped source, and IR-46's ruled source exists.\n2. Operator cleanup: IR-14/26/27/49 should receive one consistently scoped event, not four closures. Removing 38 clean merged worktrees shrinks the stale-arriving-enforcer population and reconciles checkout residue. It does not establish a durable teardown trigger, incumbent guard at claim time, patch-id settled predicate, or future pool safety. No dirty/unmerged/retained evidence was removed. 62.32 GiB root target and 59.70 GiB CI debug reclamation are cache-byte mitigations; net 4.22 GiB later cleanup is a distinct event/meter. Do not add unlike values into a claimed single net-free reading.\n3. IR-40/46: preserve receipt types. 121 scoped battery pass; push-CI Windows 3167 unit pass followed by 14.3/32 GiB resource red; earlier PR unit-red logs unavailable/unclassified; golden known sync cell red under explicit SHIP; release build succeeded; v0.69.0 counter105 published at16df0e41. None logically substitutes for another. Cleanup does not establish cause of the earlier PR red, and passing workload before end-floor RED is not proof disk caused that workload or the prior red.\n4. IR-37 has a concrete unfulfilled downstream obligation: current golden installer still requests traceable-reqs 0.2.0. Upstream closed-through-release wording must not become spt-core closed.\n5. IR-32 remains a source-demonstrable hole despite stack and recursive-doc improvements. IR-42's old universal 'claim never refuses' sentence is now false because a different, tree-match refusal was added; incumbent ownership enforcement is still absent. Keep these distinctions visible.\n6. No new family membership, rate, cause, or acceptance execution was inferred from source presence, temporal overlap, unavailable logs, or green receipts. Existing built/retired verdicts above stand on their recorded evidence; no validation suite was run."},"status":"success"},"isError":false,"timestamp":1789094780467}}
{"type":"custom","customType":"session_exit","data":{"reason":"dispose","kind":"normal","recordedAt":"2026-09-11T02:53:21.003Z"},"id":"abfddab0","parentId":"6f2088b3","timestamp":"2026-09-11T02:53:21.003Z"}