{"type":"title","v":1,"title":"","updatedAt":"2026-09-16T03:15:11.632Z","pad":" "}
{"type":"session","version":3,"id":"01a0a836-148f-7000-b55a-4d7e94378dee","timestamp":"2026-09-16T03:15:11.632Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"1b036061","parentId":null,"timestamp":"2026-09-16T03:15:11.919Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"ffd78b87","parentId":"1b036061","timestamp":"2026-09-16T03:15:11.920Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"04d4e9a9","parentId":"ffd78b87","timestamp":"2026-09-16T03:15:11.923Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n\n\n\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n\n\n\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n\n\n\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n\n\n§ Context\n# Goal\nSupport W2b RCA-first for releases#49/#267. Root C:/Users/decid/Documents/projects/spt-core; own source tree .worktrees/49-267-refresh-discriminator at c180eb16 including gated rig50876f70. Parent owns instrumentation, execution, interpretation and all edits.\n# Constraints\nRead-only; skip formatters, linters, builds and all tests. No product remedy from inference. Never touch other lanes. Existing gated Windows observations already reproduce stopped ACKs and replacement write-poison; do not re-confirm. Candidate pending-input replay vs outbound forwarding must be distinguished with parent probes. Do NOT alter by:Some promotion exclusion.\n# Contract\nReturn concise paths/line ranges plus falsifiable claims; label inference. No files written. Actual source is attach.rs::serve_attach (controlworker names in an earlier summary were wrong). Parent probes pending_input, calls, and reader state while rig remains byte-unchanged.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `RefreshBlockingMap`. Currently visible peers:\n- `RefreshCoverageMap` — scout (sub, running)\n- `Main` — main (main, running)\n22 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n summary: string;\n files: { path: string; description: string; }[];\n architecture: string;\n report?: string;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\nRead .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs::handle_attach_request and serve_attach, brain.rs subordinate attach/subscribe/write methods, and narrow broker handler paths those calls hit. Not tests/docs or broad review.\n# Change\nInvestigate blocking boundaries in reconstructed worker, especially pinned seed followed by retained duplicate Request. Map whether each call writes only, waits for replies, or reads/discards interleaved events. Use LSP for symbol references/definitions where available (root source same base for these symbols); never trust hidden worktree empty LSP results.\n# Acceptance\nReturn actual dependency chain, request/reply identities and maximum 5 concrete probe recommendations distinguishing pending replay versus request handling versus egress block. No remedy claimed proven. Skip all validation commands.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"74aefd6c","parentId":"04d4e9a9","timestamp":"2026-09-16T03:15:12.009Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nRead .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs::handle_attach_request and serve_attach, brain.rs subordinate attach/subscribe/write methods, and narrow broker handler paths those calls hit. Not tests/docs or broad review.\n# Change\nInvestigate blocking boundaries in reconstructed worker, especially pinned seed followed by retained duplicate Request. Map whether each call writes only, waits for replies, or reads/discards interleaved events. Use LSP for symbol references/definitions where available (root source same base for these symbols); never trust hidden worktree empty LSP results.\n# Acceptance\nReturn actual dependency chain, request/reply identities and maximum 5 concrete probe recommendations distinguishing pending replay versus request handling versus egress block. No remedy claimed proven. Skip all validation commands."}],"attribution":"agent","timestamp":1789528511929}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_vaf8IgksDMZZG2W67ioUURw2|fc_00817a6e65e8f156016aaa09c26bb487d187d694866cd537e3","toolName":"read","startedAt":"2026-09-16T03:15:14.932Z","args":{"path":"skill://diagnose"},"intent":"Reading diagnosis instructions"},"id":"55786f17","parentId":"74aefd6c","timestamp":"2026-09-16T03:15:14.932Z"}
{"type":"message","id":"18c61b73","parentId":"55786f17","timestamp":"2026-09-16T03:15:14.933Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_vaf8IgksDMZZG2W67ioUURw2|fc_00817a6e65e8f156016aaa09c26bb487d187d694866cd537e3","name":"read","arguments":{"i":"Reading diagnosis instructions","path":"skill://diagnose"},"intent":"Reading diagnosis instructions"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1708,"output":26,"cacheRead":8448,"cacheWrite":0,"totalTokens":10182,"cost":{"input":0.01708,"output":0.0013000000000000002,"cacheRead":0.008447999999999999,"cacheWrite":0,"total":0.026827999999999998}},"stopReason":"toolUse","timestamp":1789528512008,"responseId":"resp_00817a6e65e8f156016aaa09c092a887d1ad4eee394495aecc","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09c26bb487d187d694866cd537e3","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading diagnosis instructions\",\"path\":\"skill://diagnose\"}","call_id":"call_vaf8IgksDMZZG2W67ioUURw2","internal_chat_message_metadata_passthrough":{"create_time":1789528512.804899,"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":2919.6376999998465,"ttft":2438.23659999948,"completedAt":1789528514931,"contextSnapshot":{"promptTokens":10156,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"credential_pin","id":"6695e43a","parentId":"18c61b73","timestamp":"2026-09-16T03:15:14.933Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"69f4aa64","parentId":"6695e43a","timestamp":"2026-09-16T03:15:14.996Z","message":{"role":"toolResult","toolCallId":"call_vaf8IgksDMZZG2W67ioUURw2|fc_00817a6e65e8f156016aaa09c26bb487d187d694866cd537e3","toolName":"read","content":[{"type":"text","text":"---\nname: diagnose\ndescription: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n---\n\n# Diagnose\n\nA discipline for hard bugs. Skip phases only when explicitly justified.\n\nWhen exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.\n\n## Phase 1 — Build a feedback loop\n\n**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.\n\nSpend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**\n\n### Ways to construct one — try them in roughly this order\n\n1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.\n2. **Curl / HTTP script** against a running dev server.\n3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.\n4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.\n5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.\n6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.\n7. **Property / fuzz loop.** If the bug is \"sometimes wrong output\", run 1000 random inputs and look for the failure mode.\n8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate \"boot at state X, check, repeat\" so you can `git bisect run` it.\n9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.\n10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.\n\nBuild the right feedback loop, and the bug is 90% fixed.\n\n### Iterate on the loop itself\n\nTreat the loop as a product. Once you have _a_ loop, ask:\n\n- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)\n- Can I make the signal sharper? (Assert on the specific symptom, not \"didn't crash\".)\n- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)\n\nA 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.\n\n### Non-deterministic bugs\n\nThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.\n\n### When you genuinely cannot build a loop\n\nStop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.\n\nDo not proceed to Phase 2 until you have a loop you believe in.\n\n## Phase 2 — Reproduce\n\nRun the loop. Watch the bug appear.\n\nConfirm:\n\n- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.\n- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).\n- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.\n\nDo not proceed until you reproduce the bug.\n\n## Phase 3 — Hypothesise\n\nGenerate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.\n\nEach hypothesis must be **falsifiable**: state the prediction it makes.\n\n> Format: \"If is the cause, then will make the bug disappear / will make it worse.\"\n\nIf you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.\n\n**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly (\"we just deployed a change to #3\"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.\n\n## Phase 4 — Instrument\n\nEach probe must map to a specific prediction from Phase 3. **Change one variable at a time.**\n\nTool preference:\n\n1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.\n2. **Targeted logs** at the boundaries that distinguish hypotheses.\n3. Never \"log everything and grep\".\n\n**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.\n\n**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.\n\n## Phase 5 — Fix + regression test\n\nWrite the regression test **before the fix** — but only if there is a **correct seam** for it.\n\nA correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.\n\n**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.\n\nIf a correct seam exists:\n\n1. Turn the minimised repro into a failing test at that seam.\n2. Watch it fail.\n3. Apply the fix.\n4. Watch it pass.\n5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.\n\n## Phase 6 — Cleanup + post-mortem\n\nRequired before declaring done:\n\n- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)\n- [ ] Regression test passes (or absence of seam is documented)\n- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)\n- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)\n- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns\n\n**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started."}],"details":{"resolvedPath":"C:\\Users\\decid\\.agents\\skills\\diagnose\\SKILL.md","contentType":"text/markdown","totalLines":117,"displayContent":{"text":"---\r\nname: diagnose\r\ndescription: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\r\n---\r\n\r\n# Diagnose\r\n\r\nA discipline for hard bugs. Skip phases only when explicitly justified.\r\n\r\nWhen exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.\r\n\r\n## Phase 1 — Build a feedback loop\r\n\r\n**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.\r\n\r\nSpend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**\r\n\r\n### Ways to construct one — try them in roughly this order\r\n\r\n1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.\r\n2. **Curl / HTTP script** against a running dev server.\r\n3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.\r\n4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.\r\n5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.\r\n6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.\r\n7. **Property / fuzz loop.** If the bug is \"sometimes wrong output\", run 1000 random inputs and look for the failure mode.\r\n8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate \"boot at state X, check, repeat\" so you can `git bisect run` it.\r\n9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.\r\n10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.\r\n\r\nBuild the right feedback loop, and the bug is 90% fixed.\r\n\r\n### Iterate on the loop itself\r\n\r\nTreat the loop as a product. Once you have _a_ loop, ask:\r\n\r\n- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)\r\n- Can I make the signal sharper? (Assert on the specific symptom, not \"didn't crash\".)\r\n- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)\r\n\r\nA 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.\r\n\r\n### Non-deterministic bugs\r\n\r\nThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.\r\n\r\n### When you genuinely cannot build a loop\r\n\r\nStop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.\r\n\r\nDo not proceed to Phase 2 until you have a loop you believe in.\r\n\r\n## Phase 2 — Reproduce\r\n\r\nRun the loop. Watch the bug appear.\r\n\r\nConfirm:\r\n\r\n- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.\r\n- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).\r\n- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.\r\n\r\nDo not proceed until you reproduce the bug.\r\n\r\n## Phase 3 — Hypothesise\r\n\r\nGenerate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.\r\n\r\nEach hypothesis must be **falsifiable**: state the prediction it makes.\r\n\r\n> Format: \"If is the cause, then will make the bug disappear / will make it worse.\"\r\n\r\nIf you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.\r\n\r\n**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly (\"we just deployed a change to #3\"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.\r\n\r\n## Phase 4 — Instrument\r\n\r\nEach probe must map to a specific prediction from Phase 3. **Change one variable at a time.**\r\n\r\nTool preference:\r\n\r\n1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.\r\n2. **Targeted logs** at the boundaries that distinguish hypotheses.\r\n3. Never \"log everything and grep\".\r\n\r\n**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.\r\n\r\n**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.\r\n\r\n## Phase 5 — Fix + regression test\r\n\r\nWrite the regression test **before the fix** — but only if there is a **correct seam** for it.\r\n\r\nA correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.\r\n\r\n**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.\r\n\r\nIf a correct seam exists:\r\n\r\n1. Turn the minimised repro into a failing test at that seam.\r\n2. Watch it fail.\r\n3. Apply the fix.\r\n4. Watch it pass.\r\n5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.\r\n\r\n## Phase 6 — Cleanup + post-mortem\r\n\r\nRequired before declaring done:\r\n\r\n- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)\r\n- [ ] Regression test passes (or absence of seam is documented)\r\n- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)\r\n- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)\r\n- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns\r\n\r\n**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117]},"meta":{"source":{"type":"internal","value":"skill://diagnose"}}},"isError":false,"timestamp":1789528514995}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_onV7cUireUw5K21gBnn1KS4F|fc_00817a6e65e8f156016aaa09c9858487d18be4d1f18e5ad6d3","toolName":"grep","startedAt":"2026-09-16T03:15:21.588Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs"},"intent":"Locating attach blocking boundaries"},"id":"1a1892ec","parentId":"69f4aa64","timestamp":"2026-09-16T03:15:21.588Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_9nOI8f1KB78K5zZxFapcJReL|fc_00817a6e65e8f156016aaa09c9859487d1b57d037303425d10","toolName":"grep","startedAt":"2026-09-16T03:15:21.589Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs"},"intent":"Locating brain client methods"},"id":"42c080ee","parentId":"1a1892ec","timestamp":"2026-09-16T03:15:21.589Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_475iBSEIQYRUzz1h4Y6dMUQF|fc_00817a6e65e8f156016aaa09c9859887d1822ac8627e5b8201","toolName":"read","startedAt":"2026-09-16T03:15:21.589Z","args":{"path":"xd://"},"intent":"Discovering symbol navigation tools"},"id":"9e3d7653","parentId":"42c080ee","timestamp":"2026-09-16T03:15:21.589Z"}
{"type":"message","id":"11b8dc30","parentId":"9e3d7653","timestamp":"2026-09-16T03:15:21.589Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_onV7cUireUw5K21gBnn1KS4F|fc_00817a6e65e8f156016aaa09c9858487d18be4d1f18e5ad6d3","name":"grep","arguments":{"i":"Locating attach blocking boundaries","pattern":"handle_attach_request|serve_attach|pending_input|seed|pub .*fn|async fn","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating attach blocking boundaries"},{"type":"toolCall","id":"call_9nOI8f1KB78K5zZxFapcJReL|fc_00817a6e65e8f156016aaa09c9859487d1b57d037303425d10","name":"grep","arguments":{"i":"Locating brain client methods","pattern":"attach|subscribe|write|fn .*read|struct","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating brain client methods"},{"type":"toolCall","id":"call_475iBSEIQYRUzz1h4Y6dMUQF|fc_00817a6e65e8f156016aaa09c9859887d1822ac8627e5b8201","name":"read","arguments":{"i":"Discovering symbol navigation tools","path":"xd://"},"intent":"Discovering symbol navigation tools"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1851,"output":185,"cacheRead":9984,"cacheWrite":0,"totalTokens":12020,"cost":{"input":0.018510000000000002,"output":0.009250000000000001,"cacheRead":0.009984,"cacheWrite":0,"total":0.037744}},"stopReason":"toolUse","timestamp":1789528515091,"responseId":"resp_00817a6e65e8f156016aaa09c346d487d19322e40c8f68a5dc","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09c9858487d18be4d1f18e5ad6d3","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating attach blocking boundaries\",\"pattern\":\"handle_attach_request|serve_attach|pending_input|seed|pub .*fn|async fn\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_onV7cUireUw5K21gBnn1KS4F","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09c9859487d1b57d037303425d10","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating brain client methods\",\"pattern\":\"attach|subscribe|write|fn .*read|struct\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_9nOI8f1KB78K5zZxFapcJReL","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09c9859887d1822ac8627e5b8201","type":"function_call","status":"completed","arguments":"{\"i\":\"Discovering symbol navigation tools\",\"path\":\"xd://\"}","call_id":"call_475iBSEIQYRUzz1h4Y6dMUQF","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":6495.45650000032,"ttft":6463.200600000098,"completedAt":1789528521587,"contextSnapshot":{"promptTokens":11835,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"1c3dfedc","parentId":"11b8dc30","timestamp":"2026-09-16T03:15:21.590Z","message":{"role":"toolResult","toolCallId":"call_475iBSEIQYRUzz1h4Y6dMUQF|fc_00817a6e65e8f156016aaa09c9859887d1822ac8627e5b8201","toolName":"read","content":[{"type":"text","text":"xd:// 1 mounted tool devices.\nxd://spt_checkpoint After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for docs + JSON schema; write the JSON args object to xd:// to execute. Active top-level tools accept the same dispatch."}],"details":{"contentType":"text/plain","totalLines":4,"displayContent":{"text":"xd:// 1 mounted tool devices.\nxd://spt_checkpoint After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for docs + JSON schema; write the JSON args object to xd:// to execute. Active top-level tools accept the same dispatch.","startLine":1,"lineNumbers":[1,2,3,4]},"meta":{"source":{"type":"internal","value":"xd://"}}},"isError":false,"timestamp":1789528521590}}
{"type":"message","id":"9e530031","parentId":"1c3dfedc","timestamp":"2026-09-16T03:15:21.597Z","message":{"role":"toolResult","toolCallId":"call_onV7cUireUw5K21gBnn1KS4F|fc_00817a6e65e8f156016aaa09c9858487d18be4d1f18e5ad6d3","toolName":"grep","content":[{"type":"text","text":" 58|// [impl->REQ-ATTACH-CLIENT-STALE]\n*59|pub fn attach_client_policy() -> Vec {\n 60| vec![\n 61| AttachClientPolicy {\n 62| minimum_version: \"0.63.0\".into(),\n...\n 115|// [impl->REQ-ER-RC-INTENT-LOCKS]\n*116|pub fn classify_rc_lock(\n 117| is_engine_room: bool,\n 118| from_this_node: bool,\n 119| intent: AttachIntent,\n...\n 251|// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n*252|pub fn read_controller_event_resuming(\n 253| brain: &mut Brain,\n 254| session_id: u64,\n 255| gen: u64,\n...\n 265|/// unbounded frame read.\n*266|pub fn read_controller_event_resuming_until(\n 267| brain: &mut Brain,\n 268| session_id: u64,\n 269| gen: u64,\n...\n 349|/// One attach `Request` — the SINGLE handling path for both a wire-arriving\n*350|/// record and the dispatcher's durable-opener seed (ADR-0038 B; one\n 351|/// implementation so the two entries cannot drift):\n 352|///\n 353|/// - Unsolicited-inbound gate (ADR-0009) under the transport-proven origin;\n...\n 366|#[allow(clippy::too_many_arguments)]\n*367|fn handle_attach_request(\n 368| brain: &mut Brain,\n 369| wire: &mut Brain,\n 370| stream_id: u64,\n...\n 459|///\n*460|/// `seed_request` is the broker-pinned opener Request (ADR-0038 B): after the\n 461|/// bounded ring rolls, the wire replay no longer carries the stream's Request\n 462|/// record — a reconstruction that waited for one would idle forever. The\n 463|/// dispatcher hands the durable opener here and it is handled EXACTLY like a\n...\n 472|#[allow(clippy::too_many_arguments)]\n*473|pub fn serve_attach(\n 474| brain: &mut Brain,\n 475| broker_name: &str,\n 476| stream_id: u64,\n...\n 480| remote_session: Option,\n*481| seed_request: Option,\n 482|) -> io::Result {\n 483| brain.net_stream_subscribe(stream_id, net_from_seq)?;\n 484| // TWO-CONN SPLIT (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT): the wire FORWARDS\n...\n 514| let mut role: Option = None;\n*515| let mut pending_input: Vec<(u64, Vec)> = Vec::new();\n 516| // Temporary W2b discriminator: paired boundaries, never payload contents.\n 517| let w2b_trace = std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\");\n 518| macro_rules! w2b_probe {\n...\n 522| now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n*523| pending_input.len(), $label);\n 524| }\n 525| let result = $call;\n 526| if w2b_trace {\n...\n 528| now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n*529| pending_input.len(), $label);\n 530| }\n 531| result\n 532| }};\n...\n 549|\n*550| // Durable-opener seed (ADR-0038 B): process the dispatcher-pinned Request\n 551| // BEFORE the event loop, through the exact wire-Request path — a rolled\n*552| // ring can no longer replay it. Non-Request seeds are ignored (the opener\n 553| // of an attach stream is always its Request).\n 554| if let Some(AttachRecord::Request {\n 555| session_id,\n...\n 562| client,\n*563| }) = seed_request\n 564| {\n*565| if let Some(out) = w2b_probe!(\"seed_request\", handle_attach_request(\n 566| brain,\n 567| &mut wire,\n 568| stream_id,\n...\n 638| now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n*639| pending_input.len(), kind, role);\n 640| }\n 641| match event {\n 642| // ── Wire → session: requests, input, resize. ───────────────────\n...\n 663| } => {\n*664| if let Some(out) = w2b_probe!(\"replayed_request\", handle_attach_request(\n 665| brain,\n 666| &mut wire,\n 667| stream_id,\n...\n 710| // controller confirmation, discarded on busy/viewer.\n*711| None => pending_input.push((op_id, bytes)),\n 712| // A viewer never reaches here (intent gate).\n 713| Some(ServeRole::Viewer) => {}\n 714| }\n...\n 783| // minted ops carry the `rc` tag).\n*784| let pending_count = pending_input.len();\n 785| if w2b_trace {\n 786| eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter=pending_flush\",\n 787| now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count);\n 788| }\n*789| for (index, (op, b)) in pending_input.drain(..).enumerate() {\n 790| if w2b_trace {\n 791| eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} bytes={} enter=pending_send_effect\",\n 792| now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index, op, b.len());\n...\n 802| eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit=pending_flush\",\n*803| now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_input.len());\n 804| }\n 805| }\n 806| O::Viewer => {\n...\n 809| // keeps it awake (Gap B). Discard any racing input.\n*810| pending_input.clear();\n 811| }\n 812| O::BusyControlled { .. } => {\n 813| // A different operator controls it — refuse (no PTY input\n...\n 978|// [impl->REQ-INST-8]\n*979|pub fn request_attach(\n 980| brain: &mut Brain,\n 981| conn_id: u64,\n 982| session_id: u64,\n...\n 998|#[allow(clippy::too_many_arguments)]\n*999|pub fn request_attach_endpoint(\n 1000| brain: &mut Brain,\n 1001| conn_id: u64,\n 1002| session_id: u64,\n...\n 1051|// [impl->REQ-RCVIEW-1]\n*1052|pub fn send_attach_resize(\n 1053| brain: &mut Brain,\n 1054| stream_id: u64,\n 1055| rows: u16,\n...\n 1072|// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*1073|pub fn send_seal_ceremony_code(\n 1074| brain: &mut Brain,\n 1075| stream_id: u64,\n 1076| ceremony_id: u64,\n...\n 1096|// [impl->REQ-INST-8]\n*1097|pub fn send_attach_input(\n 1098| brain: &mut Brain,\n 1099| stream_id: u64,\n 1100| bytes: &[u8],"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\attach.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":28,"fileCount":1,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs","count":28}],"truncated":false,"displayContent":" 58│// [impl->REQ-ATTACH-CLIENT-STALE]\n *59│pub fn attach_client_policy() -> Vec {\n 60│ vec![\n 61│ AttachClientPolicy {\n 62│ minimum_version: \"0.63.0\".into(),\n │...\n 115│// [impl->REQ-ER-RC-INTENT-LOCKS]\n *116│pub fn classify_rc_lock(\n 117│ is_engine_room: bool,\n 118│ from_this_node: bool,\n 119│ intent: AttachIntent,\n │...\n 251│// [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n *252│pub fn read_controller_event_resuming(\n 253│ brain: &mut Brain,\n 254│ session_id: u64,\n 255│ gen: u64,\n │...\n 265│/// unbounded frame read.\n *266│pub fn read_controller_event_resuming_until(\n 267│ brain: &mut Brain,\n 268│ session_id: u64,\n 269│ gen: u64,\n │...\n 349│/// One attach `Request` — the SINGLE handling path for both a wire-arriving\n *350│/// record and the dispatcher's durable-opener seed (ADR-0038 B; one\n 351│/// implementation so the two entries cannot drift):\n 352│///\n 353│/// - Unsolicited-inbound gate (ADR-0009) under the transport-proven origin;\n │...\n 366│#[allow(clippy::too_many_arguments)]\n *367│fn handle_attach_request(\n 368│ brain: &mut Brain,\n 369│ wire: &mut Brain,\n 370│ stream_id: u64,\n │...\n 459│///\n *460│/// `seed_request` is the broker-pinned opener Request (ADR-0038 B): after the\n 461│/// bounded ring rolls, the wire replay no longer carries the stream's Request\n 462│/// record — a reconstruction that waited for one would idle forever. The\n 463│/// dispatcher hands the durable opener here and it is handled EXACTLY like a\n │...\n 472│#[allow(clippy::too_many_arguments)]\n *473│pub fn serve_attach(\n 474│ brain: &mut Brain,\n 475│ broker_name: &str,\n 476│ stream_id: u64,\n │...\n 480│ remote_session: Option,\n *481│ seed_request: Option,\n 482│) -> io::Result {\n 483│ brain.net_stream_subscribe(stream_id, net_from_seq)?;\n 484│ // TWO-CONN SPLIT (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT): the wire FORWARDS\n │...\n 514│ let mut role: Option = None;\n *515│ let mut pending_input: Vec<(u64, Vec)> = Vec::new();\n 516│ // Temporary W2b discriminator: paired boundaries, never payload contents.\n 517│ let w2b_trace = std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\");\n 518│ macro_rules! w2b_probe {\n │...\n 522│ now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n *523│ pending_input.len(), $label);\n 524│ }\n 525│ let result = $call;\n 526│ if w2b_trace {\n │...\n 528│ now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n *529│ pending_input.len(), $label);\n 530│ }\n 531│ result\n 532│ }};\n │...\n 549│\n *550│ // Durable-opener seed (ADR-0038 B): process the dispatcher-pinned Request\n 551│ // BEFORE the event loop, through the exact wire-Request path — a rolled\n *552│ // ring can no longer replay it. Non-Request seeds are ignored (the opener\n 553│ // of an attach stream is always its Request).\n 554│ if let Some(AttachRecord::Request {\n 555│ session_id,\n │...\n 562│ client,\n *563│ }) = seed_request\n 564│ {\n *565│ if let Some(out) = w2b_probe!(\"seed_request\", handle_attach_request(\n 566│ brain,\n 567│ &mut wire,\n 568│ stream_id,\n │...\n 638│ now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n *639│ pending_input.len(), kind, role);\n 640│ }\n 641│ match event {\n 642│ // ── Wire → session: requests, input, resize. ───────────────────\n │...\n 663│ } => {\n *664│ if let Some(out) = w2b_probe!(\"replayed_request\", handle_attach_request(\n 665│ brain,\n 666│ &mut wire,\n 667│ stream_id,\n │...\n 710│ // controller confirmation, discarded on busy/viewer.\n *711│ None => pending_input.push((op_id, bytes)),\n 712│ // A viewer never reaches here (intent gate).\n 713│ Some(ServeRole::Viewer) => {}\n 714│ }\n │...\n 783│ // minted ops carry the `rc` tag).\n *784│ let pending_count = pending_input.len();\n 785│ if w2b_trace {\n 786│ eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter=pending_flush\",\n 787│ now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count);\n 788│ }\n *789│ for (index, (op, b)) in pending_input.drain(..).enumerate() {\n 790│ if w2b_trace {\n 791│ eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} bytes={} enter=pending_send_effect\",\n 792│ now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index, op, b.len());\n │...\n 802│ eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit=pending_flush\",\n *803│ now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_input.len());\n 804│ }\n 805│ }\n 806│ O::Viewer => {\n │...\n 809│ // keeps it awake (Gap B). Discard any racing input.\n *810│ pending_input.clear();\n 811│ }\n 812│ O::BusyControlled { .. } => {\n 813│ // A different operator controls it — refuse (no PTY input\n │...\n 978│// [impl->REQ-INST-8]\n *979│pub fn request_attach(\n 980│ brain: &mut Brain,\n 981│ conn_id: u64,\n 982│ session_id: u64,\n │...\n 998│#[allow(clippy::too_many_arguments)]\n *999│pub fn request_attach_endpoint(\n 1000│ brain: &mut Brain,\n 1001│ conn_id: u64,\n 1002│ session_id: u64,\n │...\n 1051│// [impl->REQ-RCVIEW-1]\n*1052│pub fn send_attach_resize(\n 1053│ brain: &mut Brain,\n 1054│ stream_id: u64,\n 1055│ rows: u16,\n │...\n 1072│// [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*1073│pub fn send_seal_ceremony_code(\n 1074│ brain: &mut Brain,\n 1075│ stream_id: u64,\n 1076│ ceremony_id: u64,\n │...\n 1096│// [impl->REQ-INST-8]\n*1097│pub fn send_attach_input(\n 1098│ brain: &mut Brain,\n 1099│ stream_id: u64,\n 1100│ bytes: &[u8],"},"isError":false,"timestamp":1789528521596}}
{"type":"message","id":"96faef35","parentId":"9e530031","timestamp":"2026-09-16T03:15:21.606Z","message":{"role":"toolResult","toolCallId":"call_9nOI8f1KB78K5zZxFapcJReL|fc_00817a6e65e8f156016aaa09c9859487d1b57d037303425d10","toolName":"grep","content":[{"type":"text","text":"*1|//! The brain (B2) — the restartable logic half that attaches to the broker.\n 2|//!\n 3|//! The brain holds all the volatile logic; it may be killed and restarted at\n 4|//! any moment (a routine self-update swaps it; a crash kills it). It connects to\n...\n 16|//! - **Gapless, exactly-once resume.** The brain tracks `next_seq` — the next\n*17|//! output sequence it still needs. On handoff it `subscribe`s from that cursor;\n 18|//! the broker replays buffered output from there. [`Brain::read_event_until`] accepts\n 19|//! only the contiguous next `seq` (advancing the cursor), silently drops an\n 20|//! already-seen `seq` (a replay duplicate), and treats a forward gap as a hard\n...\n 33|\n*34|use crate::codec::{read_frame, write_frame};\n 35|use crate::frame::{Envelope, Role};\n 36|use crate::effect::MintedOp;\n 37|use crate::msg::{\n...\n 43| NetStatusReply, NetStreamData, NetStreamEof, NetStreamOpenReq, NetStreamOpened, NetStreamSendReq,\n*44| NetStreamSubscribeReq, NetStreamsReply, NetStreamOpenerReply, NetStreamOpenerReq, NetStreamRetireReq, NetStreamRetired, NetStreamUnsubscribeReq, NetStreamUnsubscribed, OutputEvent, MetMember, PairCodeSubmit, PairJoinReply, PairJoinReq, PairMeetReq, ResizeReq,\n 45| SessionsReply, SizeEvent, SpawnConflict, SpawnReq, Spawned, StreamLifetime, SubscribeOutcome,\n 46| SubscribeReq, SubscribedReply, ViewerEvictedEvent,\n 47| KIND_ADAPTER_APPLY, KIND_APPLIED, KIND_BRAIN_RESTART, KIND_BROKER_IMAGE, KIND_BROKER_IMAGE_REPLY, KIND_STALL_EVICTS, KIND_STALL_EVICTS_REPLY, KIND_VIEWER_EVICTED,\n...\n 59| KIND_SPAWN_CONFLICT, KIND_SPAWN_FRESH,\n*60| KIND_SUBSCRIBE, KIND_SUBSCRIBED, KIND_UNSUBSCRIBE, UnsubscribeReq,\n 61| BringUpReq, BroughtUpReply, KIND_BRING_UP, KIND_BROUGHT_UP,\n 62| SealCeremonyReq, SealCeremonyReply, KIND_SEAL_CEREMONY, KIND_SEAL_CEREMONY_REPLY,\n 63| SealEnrollReq, KIND_SEAL_ENROLL,\n...\n 66|};\n*67|use spt_net::net::attach::AttachIntent;\n 68|use crate::transport::{send_hello, LocalSocketTransport};\n 69|\n 70|/// Wall-clock now in epoch milliseconds — the source for `gen_start` (matches\n...\n 78|\n*79|/// The brain's durable state across a handoff: enough to re-attach gaplessly and\n 80|/// advance the generation. `gen_start_ms` is recorded for observability but is\n 81|/// **deliberately not authoritative on restart** — [`Brain::handoff`] sets a\n 82|/// fresh `gen_start` from `now()` (2.4).\n...\n 85|/// frame is **retired from the production path**: a brain the broker's supervisor\n*86|/// respawns reconstructs continuity by querying the broker\n 87|/// ([`Brain::resume_sessions`] over the broker's cursor-of-record), never this\n 88|/// message. `BrainState` / [`Brain::handoff`] / [`Brain::snapshot`] stay `pub`\n 89|/// solely because the integration tests (separate test target — `#[cfg(test)]`\n...\n 92|#[derive(Debug, Clone)]\n*93|pub struct BrainState {\n 94| /// The session the brain was driving.\n 95| pub session_id: u64,\n 96| /// The generation counter (incremented on each handoff).\n...\n 132| /// the operator should be shown, and — on an admit or an already-live — the\n*133| /// session to attach to. The detail is carried VERBATIM: the client did not\n 134| /// decide this refusal and must not re-word it.\n 135| // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n 136| BroughtUp {\n...\n 139| session_id: u64,\n*140| /// The single-use admit ticket to present on the attach that seats this\n 141| /// caller (admits only). Opaque here by design: the client carries it,\n 142| /// the broker decides it.\n 143| admit: Option,\n...\n 155| /// Broker→controller-serve: open the seal-ceremony overlay (WAX-SEAL W2).\n*156| /// The serve loop forwards it onto the attach wire as\n 157| /// `AttachRecord::SealCeremony`.\n 158| // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n 159| SealCeremonyOpen {\n...\n 188| Exit { session_id: u64, code: Option },\n*189| /// The resolved controller/viewer role of a [`Brain::attach_as`] subscribe\n 190| /// (REQ-RCVIEW-1 / REQ-KICK-1). The serving brain wakes (controller-only),\n 191| /// stays wake-neutral (viewer), or refuses the operator (busy).\n 192| Subscribed {\n...\n 195| /// The broker's operator-facing sentence about this seat, when it has\n*196| /// one (releases#102). Relayed onto the attach stream by `serve_attach`\n 197| /// — it is for the human at the controls, not for this hop.\n 198| // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\n 199| note: Option,\n...\n 212| /// (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). DISTINCT from a session-exit EOF: the\n*213| /// serving brain re-subscribes from the current ring floor (skip-to-live)\n*214| /// rather than tearing the attach down.\n 215| ViewerEvicted { session_id: u64 },\n 216| /// An idempotent effect is durably applied (or was deduped — `applied_now`\n 217| /// distinguishes). The exactly-once ack for a [`Brain::send_effect`] (B5).\n...\n 251| /// A stream's read side finished cleanly; `next_seq` is the completeness\n*252| /// check (the subscriber's cursor must equal it to have missed nothing).\n 253| NetStreamEof { stream_id: u64, next_seq: u64 },\n 254| /// A contiguous conn-liveness event (the presence cursor has advanced past\n 255| /// it) — connected/disconnected on the broker's conn table (D4c).\n...\n 287|/// thread does blocking [`read_frame`] on the [`RecvHalf`] and forwards each\n*288|/// framed result down a channel; the main thread writes on the [`SendHalf`] and\n 289|/// reads with [`Receiver::recv_timeout`]. Blocking reads work on both OSes; the\n 290|/// channel supplies the deadline. On a timeout the pump bubbles out to a\n 291|/// supervised restart (a fresh [`Brain`] → fresh split → fresh reader thread);\n...\n 296| Whole(Stream),\n*297| /// The pump carrier: writes go out [`SendHalf`]; framed reads arrive over\n 298| /// `frames` from the reader thread (`_reader`, named `pump-ipc-reader`).\n 299| Split {\n 300| send: SendHalf,\n...\n 319|/// silent unless `SPT_PUMP_TRACE=1` explicitly opts in (the e2e rigs do — the\n*320|/// marker is their pump-construction witness; a user terminal never does).\n 321|// [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n 322|#[derive(Clone, Copy, PartialEq, Eq, Debug)]\n 323|pub enum PumpTrace {\n...\n 366| /// `pump-ipc-reader` thread (blocking [`read_frame`] → channel) and keep the\n*367| /// [`SendHalf`] for writes. The reader logs spawn/exit per `trace` so a\n 368| /// leaked (parked) reader is diagnosable in the field (KH 7.6) WITHOUT\n 369| /// writing into a display surface an interactive client owns\n 370| /// (REQ-RC-DISPLAY-SOLE-WRITER — see [`PumpTrace`]).\n...\n 372| // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n*373| fn split_with_reader(stream: Stream, trace: PumpTrace) -> BrainConn {\n 374| let (mut recv, send) = stream.split();\n 375| let (tx, frames) = mpsc::channel();\n 376| let reader = thread::Builder::new()\n...\n 408|\n*409|/// A live brain attached to a broker.\n*410|pub struct Brain {\n 411| conn: BrainConn,\n 412| generation: u64,\n 413| gen_start_ms: u64,\n...\n 417| /// Per-net-stream resume cursors (D4b) — the stream-read siblings of\n*418| /// `next_seq`, set by [`Brain::net_stream_subscribe`] and advanced by\n 419| /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n*420| /// Durability across a handoff is the logic layer's job (a re-attaching\n*421| /// brain queries `net-streams` and re-subscribes from its durable cursors).\n 422| net_cursors: std::collections::HashMap,\n 423| /// The presence resume cursor (D4c) — the conn-liveness sibling of\n*424| /// `net_cursors`, set by [`Brain::net_presence_subscribe`] and advanced by\n 425| /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n*426| /// `None` until subscribed (or the first event arrives).\n 427| presence_cursor: Option,\n 428| /// Per-session **resume** output cursors (restoration D4-2): the multi-session\n 429| /// continuity state a cold-started brain rebuilds from the broker via\n...\n 446| /// (KNOWN-HAZARDS — a blocked brain-IPC read must never wedge the pump). The\n*447| /// two facts are coupled at construction: `Some` ⇔ [`BrainConn::Split`].\n 448| io_timeout: Option,\n*449| /// #6 (ADR-0031): a COLD attach (`from_seq == 0`, set by [`Brain::attach`] /\n*450| /// [`Brain::attach_as`]) receives a synthesized clean-screen REPAINT as its\n 451| /// first `KIND_OUTPUT` frame, at pseudo-seq `broker.next_seq - 1` — NOT seq 0.\n 452| /// When `true`, the strict legacy `next_seq` path adopts that first frame's seq\n 453| /// as the baseline (accept-and-seed) instead of reject-gapping it, then reverts\n...\n 495| /// unless a rig opts in — a client's stderr is a terminal it must not\n*496| /// write to from a background thread).\n 497| // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n 498| // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n 499| pub fn cold_start_pump(\n...\n 522| /// from `prior`, but stamp `gen_start = now()` (NOT `prior.gen_start_ms` —\n*523| /// the 2.4 invariant), and re-subscribe to the session from the cursor for a\n 524| /// gapless resume.\n 525| ///\n*526| /// The eager `subscribe` IS the resume mechanism — every standalone handoff\n 527| /// caller (the brain-only update engine, `idempotent`/`daemon_e2e`/`handoff`\n*528| /// integration tests) replays output through it with no later `attach`. So it\n*529| /// stays. The P1c controller-writer reorder (a `serve_attach` re-serve that\n*530| /// ALSO subscribes from 0 over this same socket → two racing\n*531| /// `controller_writer`s) is fixed in the BROKER, not by dropping this\n*532| /// subscribe: the epoch gate ([`OutputLog::become_controller`]) guarantees a\n*533| /// single live writer per connection, and the seeded `session_cursors` below\n 534| /// routes the consumer through the dedup-below + snap-above path so any\n 535| /// at-least-once boundary re-send is tolerated, never a fatal reject-gap\n 536| /// ([`REQ-HAZARD-CONTROLLER-WRITER-REORDER`]).\n...\n 563| };\n*564| brain.subscribe(prior.session_id, prior.next_seq)?;\n 565| Ok(brain)\n 566| }\n 567|\n...\n 589| /// Snapshot durable state for a future handoff. **Test-only (restoration\n*590| /// D4-3)** — the production path reconstructs from the broker, never a\n 591| /// snapshot frame; see [`BrainState`].\n 592| pub fn snapshot(&self) -> BrainState {\n 593| BrainState {\n...\n 600|\n*601| /// Spawn a session under a broker PTY; the broker auto-subscribes this\n 602| /// connection. Reads until the `spawned` reply (consuming any output that\n 603| /// races ahead).\n 604| pub fn spawn_session(&mut self, req: SpawnReq) -> io::Result {\n...\n 612| /// The verb is the entrance the engine room did not have: with no session\n*613| /// hosted there was nothing to subscribe to, so the code an operator typed\n*614| /// reached no gate and the attach refused client-side. The gate still runs\n 615| /// DAEMON-SIDE — the adversary here is an agent on this box that can speak\n 616| /// this same IPC — so nothing about the answer is decided in this process.\n 617| ///\n...\n 668| /// `subnet`, through the TOTP human-presence ceremony at `endpoint`'s\n*669| /// attached controller (WAX-SEAL W2, releases#21).\n 670| ///\n 671| /// BLOCKS for the ceremony's human-scale duration — the broker holds the\n 672| /// reply until the human at the overlay admits, fails out, or cancels;\n 673| /// dropping this connection mid-wait aborts the ceremony cleanly (no\n*674| /// partial record, nothing spent). With no capable controller attached\n 675| /// the reply is an immediate `SEAL_NO_CEREMONY_SURFACE` refusal instead\n 676| /// (operator ruling 4: no pending state, no timeout queue).\n 677| ///\n...\n 907|\n*908| /// Inject input **idempotently**: the write carries the durable `op_id` so a\n 909| /// replay after a brain crash is deduped at the broker (exactly-once, B5).\n 910| /// `op_id` must come from a durable source and be reused verbatim on replay —\n 911| /// the same logical effect must always carry the same id, so the broker's\n...\n 926| /// [`KIND_APPLIED`] ack (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The operator/rc\n*927| /// attach path is fire-and-forward — `op_id` is for dedup only and the ack is\n*928| /// discarded by `serve_attach` — and it can flood N input frames on ONE\n 929| /// brain↔broker conn without returning to read. With no ack the broker's\n*930| /// per-conn handler never writes back while servicing that flood, so the return\n 931| /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n 932| /// broker still dedups by `(session, op_id)` at its applied-set.\n 933| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n...\n 982| /// request (ADR-0045 decision 6). Deliberately NOT [`Brain::kill_session`]:\n*983| /// that one runs `require_session()` on THIS connection's attached session,\n*984| /// which means attaching first — and under the ADR-0044 lease ladder an\n*985| /// attach is a controller claim with a generation bump behind it. Teardown\n*986| /// claims no controller, so it needs no attach and can be issued on a bare\n 987| /// probe connection.\n 988| ///\n 989| /// Fire-and-forward: the broker sends no reply. The caller's postcondition\n...\n 1011| /// A session `Exit` before the needle is found is an error (the child died).\n*1012| pub fn read_output_until(&mut self, needle: &[u8], buf: &mut Vec) -> io::Result {\n 1013| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 1014| let deadline = self.call_deadline();\n 1015| loop {\n...\n 1049| // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1050| pub fn reply_read_deadline(&self) -> Option {\n 1051| peer_reply_deadline(self.io_timeout, Instant::now())\n 1052| }\n 1053|\n...\n 1062| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1063| pub fn read_event_until(&mut self, deadline: Option) -> io::Result {\n 1064| loop {\n 1065| let env = self.read_frame_until(deadline)?;\n 1066| match env.kind.as_str() {\n...\n 1108| //\n*1109| // #6 (ADR-0031): a COLD attach's FIRST output frame is a\n 1110| // clean-screen repaint at pseudo-seq `broker.next_seq - 1` (a\n 1111| // forward jump from the requested `from_seq == 0`). Adopt that seq\n 1112| // as the baseline instead of reject-gapping it — the repaint IS\n 1113| // the complete current screen, nothing prior is owed. Consumed\n*1114| // once per (cold) attach; every subsequent LIVE frame then takes\n 1115| // the strict reject-gap below (a b4 drop still re-fetches — B2).\n 1116| if self.baseline_next_output {\n 1117| self.next_seq = ev.seq;\n...\n 1386| /// broker-IPC-CARRIER desync (the carrier ops — `net_open_stream` /\n*1387| /// `net_stream_subscribe` / `net_stream_send` — keep their raw `TimedOut`).\n 1388| /// Abandoning the peer's stream is safe: the exactly-once seq cursor stays\n 1389| /// contiguous, and a late reply on the dropped stream id matches nothing (the\n 1390| /// leg loops treat it as noise) — the desync the old blanket-poison feared\n...\n 1392| // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1393| pub fn read_peer_reply_until(&mut self, deadline: Option) -> io::Result {\n 1394| self.read_event_until(deadline)\n 1395| .map_err(reclassify_peer_reply_err)\n 1396| }\n...\n 1398| /// Attach this (freshly-connected) brain to an **existing** broker session's\n*1399| /// output from `from_seq`, e.g. a dedicated digest-feed subscriber that did\n 1400| /// not spawn the session itself. Sets the resume cursor + session, then\n*1401| /// subscribes (the broker replays from `from_seq`, then streams live). Unlike\n 1402| /// [`Brain::handoff`] this does not touch the generation — it is a *second*\n 1403| /// reader of a session another brain drives, not a logic handoff.\n*1404| pub fn attach(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n 1405| self.session_id = Some(session_id);\n 1406| self.next_seq = from_seq;\n*1407| // #6 (ADR-0031): a COLD attach receives a clean-screen repaint at pseudo-seq\n 1408| // `broker.next_seq - 1`, not seq 0 — baseline the strict cursor on it.\n 1409| self.baseline_next_output = from_seq == 0;\n 1410| // A resume-mode brain (non-empty map) routes this session's output through\n...\n 1412| // (D4-2b); a legacy brain (empty map) uses the `next_seq` set above. The\n*1413| // resume-mode dedup-cursor reset for an explicit re-subscribe lives in\n*1414| // `subscribe_with` (P1c, shared by `attach`/`attach_as`).\n*1415| self.subscribe(session_id, from_seq)\n 1416| }\n 1417|\n 1418| /// Attach under the W2.5 controller/viewer model (REQ-RCVIEW-1): send a\n*1419| /// role-aware subscribe with `intent` + the operator identity `by` (the\n*1420| /// handshake-proven origin for a remote attach). The broker resolves the role\n*1421| /// and replies a [`BrokerEvent::Subscribed`] the caller (a [`serve_attach`]\n 1422| /// loop) reads to learn whether it became controller / viewer / was refused.\n*1423| /// Like [`Brain::attach`] this is a second reader, not a logic handoff (the\n 1424| /// generation is untouched).\n 1425| ///\n*1426| /// [`serve_attach`]: crate::attach::serve_attach\n*1427| pub fn attach_as(\n 1428| &mut self,\n 1429| session_id: u64,\n 1430| from_seq: u64,\n...\n 1434| ) -> io::Result<()> {\n*1435| self.attach_as_coded(session_id, from_seq, intent, gen, by, None, false)\n 1436| }\n 1437|\n*1438| /// [`Brain::attach_as`] carrying a bring-up code (ADR-0052 decision 2) — the\n 1439| /// engine room's seat resolver demands one from any connection that does not\n 1440| /// already hold its controls, and this is the only path that can present it.\n 1441| ///\n*1442| /// Every other attach is [`Brain::attach_as`] itself, i.e. `None`: a brain's\n 1443| /// own resume, a viewer, a digest feed. That is not a shortcut — none of them\n 1444| /// has a human at a keyboard to read a code off, so `None` is the truthful\n 1445| /// answer, and for the one gated endpoint it is a refusal rather than a pass.\n 1446| /// `seal_ceremony` is the W2 capability bit carried from the wire\n*1447| /// `AttachRecord::Request` — `true` only when the attaching CLIENT declared\n 1448| /// it can run the seal-ceremony overlay; the broker records it on the\n 1449| /// controller seat (REQ-SEAL-NO-CEREMONY-SURFACE). Every non-serve caller\n 1450| /// passes `false` (no human viewport behind them).\n...\n 1452| #[allow(clippy::too_many_arguments)]\n*1453| pub fn attach_as_coded(\n 1454| &mut self,\n 1455| session_id: u64,\n 1456| from_seq: u64,\n...\n 1464| self.next_seq = from_seq;\n*1465| // #6 (ADR-0031): a COLD attach (`from_seq == 0` — the `rc` / `endpoint run\n*1466| // --attach` case) gets a clean-screen repaint at pseudo-seq\n 1467| // `broker.next_seq - 1` as its first frame; baseline the strict cursor on it\n 1468| // (accept-then-strict). A resume-from-floor re-fetch (`from_seq > 0`) leaves\n 1469| // this false → raw-ring replay + strict reject-gap unchanged (B2).\n 1470| self.baseline_next_output = from_seq == 0;\n*1471| self.subscribe_with(\n 1472| session_id,\n 1473| from_seq,\n 1474| intent,\n...\n 1481|\n*1482| /// Re-subscribe a VIEWER from the LIVE TAIL after a broker eviction —\n 1483| /// skip-to-live (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). The viewer overflowed its\n 1484| /// bounded subscription queue (it forwards slower than the drain fans out) and\n 1485| /// the broker evicted it (correct session-protection); rather than dying it\n...\n 1495| /// which accepts the jump and snaps. VIEWER-only → B2-safe (a viewer never\n*1496| /// advances `delivered_through` / is not authoritative). The subscribe is sent\n*1497| /// FIRST (a cold brain's empty-map skips `subscribe_with`'s `from_seq` reset),\n 1498| /// THEN the cursor is armed, so neither path stamps `MAX`.\n 1499| // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n*1500| pub fn attach_skip_to_live(&mut self, session_id: u64, by: Option<&str>) -> io::Result<()> {\n 1501| self.session_id = Some(session_id);\n*1502| self.subscribe_with(session_id, u64::MAX, AttachIntent::Viewer, 0, by.map(str::to_string), None, false)?;\n 1503| self.session_cursors.insert(session_id, 0);\n 1504| self.next_seq = 0;\n 1505| Ok(())\n...\n 1507|\n*1508| /// Arm SNAP-ABOVE at the INITIAL viewer attach — a `rc --view` VIEWER must\n 1509| /// tolerate a **PRE-eviction** forward Output gap. Under a hard flood this\n 1510| /// serving brain can fall behind the live ring and read a `seq` past its\n 1511| /// cursor because the ring rolled the intervening frames OUT between reads,\n...\n 1515| /// ([`Brain::read_event_until`]), which FATALS the forward gap →\n*1516| /// `serve_attach` returns → forwarding stops → the operator sees nothing\n*1517| /// (a_journaled / p0_paste / attach.rs:1071 wedged_viewer, Linux forkpty;\n 1518| /// MASKED on Windows ConPTY, which floods slower so the ring never rolls far\n*1519| /// enough to gap a still-subscribed viewer).\n 1520| ///\n*1521| /// Mirrors [`Brain::attach_skip_to_live`] but seeds the snap-above cursor at\n 1522| /// the requested `from_seq` (the viewer asked from there — dedup BELOW it,\n*1523| /// snap ABOVE a forward gap) and subscribes from `from_seq`, NOT the MAX\n*1524| /// skip-replay, because this is the FIRST attach rather than a post-eviction\n*1525| /// re-subscribe. The two viewer-survival mechanisms COMPOSE: this tolerates\n*1526| /// pre-eviction ring-roll gaps WHILE subscribed; [`Brain::attach_skip_to_live`]\n*1527| /// recovers POST-eviction (re-subscribe from the floor). VIEWER-only →\n 1528| /// B2-SAFE (a viewer never advances `delivered_through` / is not authoritative\n 1529| /// — the CONTROLLER keeps the strict reject-gap for exactly-once resume). The\n*1530| /// subscribe is sent FIRST (a cold brain's empty map skips `subscribe_with`'s\n 1531| /// `from_seq` reset), THEN the cursor is armed.\n 1532| // [impl->REQ-HAZARD-VIEWER-RING-ROLL-SNAP]\n*1533| pub fn attach_as_viewer_snap(\n 1534| &mut self,\n 1535| session_id: u64,\n 1536| from_seq: u64,\n...\n 1540| self.next_seq = from_seq;\n*1541| self.subscribe_with(session_id, from_seq, AttachIntent::Viewer, 0, by.map(str::to_string), None, false)?;\n 1542| self.session_cursors.insert(session_id, from_seq);\n 1543| Ok(())\n 1544| }\n...\n 1546| /// Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the\n*1547| /// broker for **every** hosted session and re-attach **each** in resume mode\n 1548| /// from the broker's per-session delivered cursor (`resume_seq`). This is the\n 1549| /// production replacement for the retired single-session `BrainState` handoff\n*1550| /// frame — a brain the supervisor respawns (crash *or* update) reconstructs\n 1551| /// all session continuity by querying the persistent side, never a brain→brain\n*1552| /// message. Returns the ids re-attached (empty when the broker hosts none —\n 1553| /// the supervised daemon brain's no-op-today case).\n 1554| ///\n 1555| /// Each session is seeded into [`Self::session_cursors`] at its `resume_seq`,\n...\n 1561| ///\n*1562| /// Each session is re-attached as a **VIEWER**, never a controller: a caller that\n 1563| /// DRAINS the resumed output (`Brain::read_event_until`) gets output-continuity from its\n 1564| /// cursor; a viewer never seizes/stall-evicts a controller slot (UPDATE-WEDGE-2,\n 1565| /// REQ-BRAIN-RESUME-NO-CONTROL-STEAL). Genuinely daemon-brain-driven sessions (the\n*1566| /// live-agent adapter future) will re-attach as Control on a drained carrier; that\n 1567| /// set is empty today.\n 1568| ///\n 1569| /// NOT INSTRUMENTED, deliberately: this method has NO production caller (the\n...\n 1573| /// from one that means \"no resume happened\", which is worse than no\n*1574| /// instrumentation at all. The attach-intent breadcrumbs live at the choosers\n 1575| /// the daemon actually executes; see `ATTACH_INTENT_CHOSEN`.\n 1576| ///\n 1577| /// ⚠️ DEADLOCK WARNING — the CALLER MUST DRAIN this conn (UPDATE-WEDGE round 3,\n*1578| /// REQ-BRAIN-RESUME-NO-CONN-DEADLOCK). This subscribes the sessions onto THIS conn.\n 1579| /// A NON-DRAINING consumer will SELF-DEADLOCK: an actively-streaming session backs\n*1580| /// the conn up, the broker-side subscriber writer blocks holding the conn's single\n*1581| /// `SharedSend` mutex ACROSS a blocking `write_frame` (broker.rs\n*1582| /// `viewer_writer`/`controller_writer`), the dispatch reply path (`send_frame`) needs\n 1583| /// that same lock, so any request/reply the non-draining consumer issues is starved\n 1584| /// (dead-peer-independent — the v0.30.4 field re-wedge). The supervised daemon brain\n 1585| /// is exactly such a non-draining consumer (its `run_brain` heartbeat reads this conn\n...\n 1588| /// guard), so it MUST call [`Self::resume_session_cursors`] (cursor-only, NO\n*1589| /// subscribe) instead. This subscribing method stays for a DRAINING caller (the\n 1590| /// resume int tests today; the forward live-agent-adapter / Option-B drained carrier).\n 1591| // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 1592| // [impl->REQ-DAEMON-2]\n...\n 1599| for info in reply.sessions {\n*1600| // Seed the dedup cursor at the broker's resume point BEFORE the subscribe\n*1601| // replay starts arriving, then re-attach (Viewer) from there.\n 1602| self.session_cursors\n 1603| .insert(info.session_id, info.resume_seq);\n 1604| // THE decision, bound ONCE: the same value is both logged below and passed\n*1605| // to `subscribe_with`, so the breadcrumb cannot drift from the attach it\n 1606| // describes. A separately-written label would still read `viewer` on the\n 1607| // day this choice becomes conditional (the live-agent-adapter Control set\n 1608| // this method is kept for) — that is the re-derivation this binding exists\n...\n 1611| let intent = AttachIntent::Viewer;\n*1612| self.subscribe_with(info.session_id, info.resume_seq, intent, 0, None, None, false)?;\n 1613| resumed.push(info.session_id);\n 1614| }\n 1615| Ok(resumed)\n...\n 1619| /// every hosted session and seed [`Self::session_cursors`] at each `resume_seq`,\n*1620| /// returning the re-attached ids — but DO **NOT** subscribe. This is the safe resume\n 1621| /// the daemon `run_brain` heartbeat uses in place of [`Self::resume_sessions`]:\n 1622| /// carrying only request/reply on the brain's conn (no UNDRAINED subscription) makes\n*1623| /// the `SharedSend` self-deadlock structurally impossible (UPDATE-WEDGE round 3,\n 1624| /// REQ-BRAIN-RESUME-NO-CONN-DEADLOCK — see the deadlock warning on\n 1625| /// [`Self::resume_sessions`]). The daemon brain drives no broker PTY session\n 1626| /// (brainproc.rs:184) and nothing on its side consumes session output (§3 guard), so\n*1627| /// the observation cursor is all it needs; no attach also means no controller steal\n 1628| /// (REQ-BRAIN-RESUME-NO-CONTROL-STEAL, a fortiori). Rides the brain-swap ⇒ seamless.\n 1629| /// When genuinely daemon-brain-driven sessions land (the live-agent adapter future),\n*1630| /// attach THOSE on a DEDICATED drained carrier (Option B, deferred) — never on this\n 1631| /// request/reply conn.\n 1632| // [impl->REQ-BRAIN-RESUME-NO-CONN-DEADLOCK]\n 1633| // [impl->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n...\n 1645| /// The per-session resume cursor (the next seq still needed for a session\n*1646| /// re-attached by [`Brain::resume_sessions`]) — observability / tests.\n 1647| pub fn session_cursor(&self, session_id: u64) -> Option {\n 1648| self.session_cursors.get(&session_id).copied()\n 1649| }\n...\n 1654| /// `delivered_through` (the broker advances it only on contiguous controller\n*1655| /// writes — b4 `contiguous_advance` — and freezes it at the drop, exactly where\n 1656| /// this reader stalls). So a controller re-subscribing from here RE-FETCHES the\n 1657| /// dropped frames exactly-once (IFF the ring still holds them, i.e.\n 1658| /// `tail - delivered_through <= cap_chunks`; the ring trim is\n*1659| /// `delivered_through`-blind, broker.rs). Drives the serve_attach controller\n 1660| /// gap-resume — no mid-stream `KIND_SESSIONS` round-trip (which would re-fatal\n 1661| /// on the same gap and discard Output).\n 1662| // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n...\n 1733|\n*1734| fn read_broker_image_until(\n 1735| &mut self,\n 1736| deadline: Option,\n 1737| ) -> io::Result> {\n...\n 1826|\n*1827| /// Query the broker's brain-subscriber stall-evict tally (LIFECYCLE-TRUTH W2\n 1828| /// observability rider, REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): `(count,\n 1829| /// last_ms)` — how many controllers were stall-evicted for a suspended/black-holed\n 1830| /// brain conn since boot, and when the most recent fired. `None` when the broker\n...\n 2032| /// op id: the singleton is idempotent by reuse, and there is no network leg\n*2033| /// a crash-replay could double. Identical from `request_attach` up — the\n 2034| /// one-pump invariant lives at the transport leaf, not here.\n 2035| // [impl->REQ-RC-1]\n 2036| pub fn net_dial_loopback(&mut self) -> io::Result {\n...\n 2065| /// connection — on conn loss the broker FINs it toward the target and\n*2066| /// terminal-retires the row. RC attach/view openers use this; inter-brain\n 2067| /// streams stay `Durable`.\n 2068| // [impl->REQ-STREAM-LEASE-CLASSES]\n 2069| pub fn net_open_stream_classed(\n...\n 2096| /// Write bytes to a held stream over the broker (D4b). With `op_id` the\n*2097| /// write is exactly-once and this blocks for the `net-sent` ack (returned);\n*2098| /// without one it is a direct fire-and-forget write (`None` returned).\n*2099| /// `finish` closes the send side after the write.\n 2100| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n 2101| pub fn net_stream_send(\n 2102| &mut self,\n...\n 2133|\n*2134| /// List the streams the broker holds (D4b) — how a re-attaching brain\n 2135| /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n 2136| pub fn net_streams(&mut self) -> io::Result {\n 2137| self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n...\n 2195|\n*2196| /// Release this connection's subscriber SEAT on a stream (ADR-0040\n 2197| /// decision 5, REQ-SEAT-LIFETIME-BOUNDED): the broker removes the seat,\n*2198| /// stops and joins its writer thread; the local read cursor drops with it.\n 2199| /// Idempotent + best-effort at every caller (`removed=false` for no seat /\n 2200| /// someone else's seat / no such stream; an older broker answers `error` —\n 2201| /// KH-2.3, the conn-close sweep remains the backstop).\n 2202| // [impl->REQ-SEAT-LIFETIME-BOUNDED]\n*2203| pub fn net_stream_unsubscribe(&mut self, stream_id: u64) -> io::Result {\n 2204| // Drop the cursor FIRST — even an error reply (older broker) must not\n 2205| // leave a cursor for a subscription the caller has abandoned.\n 2206| self.net_cursors.remove(&stream_id);\n...\n 2208| KIND_NET_STREAM_UNSUBSCRIBE,\n*2209| serde_json::to_value(NetStreamUnsubscribeReq { stream_id })\n*2210| .expect(\"NetStreamUnsubscribeReq serializes\"),\n 2211| )?;\n 2212| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2213| let deadline = self.call_deadline();\n...\n 2216| BrokerEvent::Other(env) if env.kind == KIND_NET_STREAM_UNSUBSCRIBED => {\n*2217| let reply: NetStreamUnsubscribed = serde_json::from_value(env.payload)\n 2218| .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 2219| return Ok(reply.removed);\n 2220| }\n...\n 2293| /// to reach an spt-hosted endpoint (broker holds its PTY, no relay). The\n*2294| /// broker resolves endpoint→session atomically and writes the bytes (a\n 2295| /// pre-rendered `` envelope). Returns `(delivered, spool_deferred)`:\n 2296| /// `delivered=true` = broker injected via translation binary; `spool_deferred=true`\n 2297| /// = caller should spool deferred (active window), `false` = spool non-deferred\n...\n 2358| &mut self,\n*2359| reply: &spt_net::net::attach::InputPathReply,\n 2360| ) -> io::Result<()> {\n 2361| self.send(crate::msg::KIND_USER_INPUT_PATHS_REPLY,\n 2362| serde_json::to_value(reply).map_err(io::Error::other)?)\n...\n 2379|\n*2380| /// (Re)subscribe to a stream's buffered reads from `from_seq`, setting the\n*2381| /// local cursor (gapless, exactly-once resume — the PTY `subscribe`\n 2382| /// discipline on a QUIC stream, D4b).\n 2383| // [impl->REQ-DAEMON-2]\n*2384| pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {\n 2385| self.net_cursors.insert(stream_id, from_seq);\n 2386| self.send(\n 2387| KIND_NET_STREAM_SUBSCRIBE,\n...\n 2396| /// The next stream-read sequence still needed for `stream_id` (the durable\n*2397| /// state a handed-off brain carries to resubscribe gaplessly).\n 2398| pub fn net_cursor(&self, stream_id: u64) -> Option {\n 2399| self.net_cursors.get(&stream_id).copied()\n 2400| }\n 2401|\n*2402| /// (Re)subscribe to the broker's conn-liveness event log from `from_seq`,\n 2403| /// setting the local cursor (D4c) — gapless, exactly-once presence resume:\n*2404| /// events produced while no brain was attached replay from the cursor.\n 2405| // [impl->REQ-EP-4]\n*2406| pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407| self.presence_cursor = Some(from_seq);\n 2408| self.send(\n 2409| KIND_NET_PRESENCE_SUBSCRIBE,\n...\n 2415| /// The next presence sequence still needed (the durable state a handed-off\n*2416| /// brain carries to resubscribe gaplessly).\n 2417| pub fn presence_cursor(&self) -> Option {\n 2418| self.presence_cursor\n 2419| }\n 2420|\n*2421| /// PUMP-TRUTH W2 (REQ-PUMP-PEER-ISOLATION): subscribe the pump's DEDICATED\n 2422| /// event carrier to presence in TAIL-FOLLOW mode — no history replay, and the\n 2423| /// cursor BASELINES on the first live event rather than gap-checking from a\n 2424| /// fixed floor. The pump has no durable cursor to resume (a supervised restart\n...\n 2428| /// old events can never hand this carrier a below-cursor gap that would falsely\n*2429| /// trip the dead-broker restart. Contrast [`Self::net_presence_subscribe`]\n 2430| /// (REQ-EP-4) which gap-checks from the durable cursor so a real lost liveness\n 2431| /// event IS caught. Subscribe BEFORE the first submit so no outcome is missed.\n 2432| // [impl->REQ-PUMP-PEER-ISOLATION]\n*2433| pub fn net_presence_subscribe_tail(&mut self) -> io::Result<()> {\n 2434| self.presence_cursor = None; // baseline on the first live event (no floor)\n 2435| self.send(\n 2436| KIND_NET_PRESENCE_SUBSCRIBE,\n...\n 2441|\n*2442| /// The intent [`Self::subscribe`] — and therefore [`Self::attach`] — takes.\n 2443| ///\n 2444| /// Named rather than written inline so a CALLER can log the intent it is about\n*2445| /// to take without SPELLING IT A SECOND TIME. `attach` has no intent parameter,\n 2446| /// so a caller-side literal would be a copy of a decision made in here, and it\n 2447| /// would keep reading `control` on the day this stops being Control. One\n*2448| /// source: this const is passed to `subscribe_with` below and logged by the\n 2449| /// caller (`shellchan`'s ATTACH_INTENT_CHOSEN).\n 2450| ///\n*2451| /// Placed ABOVE `subscribe`'s own doc block on purpose: a `///` run is a doc\n 2452| /// ATTRIBUTE, so an item inserted between that block and the function silently\n 2453| /// adopts the whole block — traceability tag included — and leaves the\n 2454| /// function undocumented while `traceable-reqs` still counts that tag as\n...\n 2461|\n*2462| /// Re-attach to a session's output from `from_seq` as a LOCAL CONTROLLER\n 2463| /// (intent `Control`, identity `None`) — the legacy single-session serve\n*2464| /// [`Brain::attach`] path.\n 2465| ///\n*2466| /// CAUTION — a `None`-identity Control attach does NOT \"never displace\":\n*2467| /// `resolve_subscribe` (broker.rs) silently re-takes a FREE or SAME-LOCAL\n 2468| /// (`None==None`) controller slot via `become_controller` (only a\n 2469| /// DIFFERENT-REMOTE incumbent falls back to a silent viewer — the gate-#7\n 2470| /// cross-operator guard). That silent re-take fires NO `Displaced` notice and\n...\n 2474| /// (only an actively-producing stolen session blocks long enough to evict).\n*2475| /// That is correct for `attach` (a serve loop that WILL drive the session), but\n*2476| /// it is why a brain-respawn must NOT resume-re-attach as Control — it would\n 2477| /// silently STEAL every local/free controller (incl. the operator's local\n 2478| /// `spt rc`) it never drains, freezing the session\n*2479| /// (REQ-BRAIN-RESUME-NO-CONTROL-STEAL). [`Brain::resume_sessions`] re-attaches\n 2480| /// as Viewer instead; Control is reserved for sessions the daemon brain drives.\n 2481| // [doc->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n*2482| fn subscribe(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n*2483| self.subscribe_with(session_id, from_seq, Self::SUBSCRIBE_INTENT, 0, None, None, false)\n 2484| }\n 2485|\n 2486| /// Release this connection's controller/viewer role on `session_id`\n*2487| /// (REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n 2488| /// the viewport ends so the broker clears `driven_by` / `viewer_count`\n 2489| /// promptly. Best-effort: a dropped connection clears the role anyway.\n 2490| pub fn detach_session(&mut self, session_id: u64) -> io::Result<()> {\n...\n 2500| KIND_UNSUBSCRIBE,\n*2501| serde_json::to_value(UnsubscribeReq { session_id, gen })\n*2502| .expect(\"UnsubscribeReq serializes\"),\n 2503| )\n 2504| }\n 2505|\n*2506| /// The role-aware subscribe (REQ-RCVIEW-1): `intent` selects viewer/control/\n 2507| /// take, `by` carries the operator identity (`Some(node)` remote, `None`\n 2508| /// local). The broker replies the resolved [`SubscribeOutcome`] as a\n 2509| /// [`BrokerEvent::Subscribed`].\n 2510| #[allow(clippy::too_many_arguments)]\n*2511| fn subscribe_with(\n 2512| &mut self,\n 2513| session_id: u64,\n 2514| from_seq: u64,\n...\n 2521| // P1c (operator-stream boundary, kitsubito RACEDIAG): a resume-mode brain\n*2522| // (seeded map) that subscribes from `from_seq` must RESET this session's\n 2523| // dedup cursor to `from_seq` — the broker's replay from `from_seq` is then\n 2524| // re-delivered (and the operator's render cursor dedups the overlap),\n 2525| // never lost. WHY THIS, NOT just `read_event`'s `or_insert`: on a re-serve,\n*2526| // `serve_attach` may CONSUME a handoff-replay frame at the K boundary\n*2527| // BEFORE it is `attached` (the frame is dropped by the `if attached` gate\n*2528| // but the snap-above cursor still advanced past K); `attach_as(sid, 0)`\n*2529| // then re-subscribes from 0, and without this reset the broker's re-send of\n 2530| // seq K arrives below the advanced cursor and is deduped → seq K never\n 2531| // reaches the operator viewport → a forward gap. Resetting to `from_seq`\n*2532| // makes the re-subscribe re-deliver everything from its floor. A cold-start\n 2533| // brain (empty map — e.g. the production dispatch serve brain) keeps the\n 2534| // legacy `next_seq` path; this only arms in resume mode.\n 2535| // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n...\n 2556| match &mut self.conn {\n*2557| BrainConn::Whole(stream) => write_frame(stream, &env),\n*2558| BrainConn::Split { send, .. } => write_frame(send, &env),\n 2559| }\n 2560| }\n 2561|\n...\n 2581| // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n*2582| fn read_frame_until(&mut self, deadline: Option) -> io::Result {\n 2583| match &mut self.conn {\n 2584| // Absent stays absent: no fabricated default bound on the blocking\n 2585| // read (the absent-is-not-zero shape, releases#201).\n...\n 2727| // carriers are indistinguishable at a call site (both a `&mut Brain`), so a\n*2728| // caller who reaches for the default constructor must be told which one to\n 2729| // build instead, not merely that this one is wrong.\n 2730| //\n 2731| // `brain_with_stub` is the cold-start (Whole) carrier - the default any\n*2732| // caller reaches for first, and the exact construction that must be refused.\n 2733| #[test]\n*2734| fn an_unbounded_carrier_is_refused_and_the_message_names_the_constructor() {\n 2735| let (brain, _stub) = brain_with_stub();\n 2736| assert!(\n 2737| brain.reply_read_deadline().is_none(),\n...\n 2746| msg.contains(\"cold_start_pump\"),\n*2747| \"the refusal must name the constructor that fixes it - a caller should \\\n 2748| not have to read brain.rs to learn what a bounded carrier is: {msg:?}\"\n 2749| );\n 2750| assert!(\n...\n 2786| /// the test drives frame-by-frame. NO broker logic, NO PTY, NO network: the\n*2787| /// stub only completes the hello handshake, DRAINS anything the brain writes\n*2788| /// (subscribe frames), and writes whatever envelopes the test feeds it. This is\n*2789| /// the brain's REAL `read_event` / `attach_skip_to_live` dedup state machine\n 2790| /// exercised end-to-end over the real codec — the cheapest harness that still\n 2791| /// drives the production paths (the integration tests in `tests/` use a real\n 2792| /// broker; here we isolate the brain's dedup decision).\n*2793| struct StubBroker {\n*2794| /// Push an envelope for the stub to write to the brain.\n 2795| feed: SyncSender,\n*2796| /// Server thread handle (drains brain writes + writes fed frames).\n 2797| _server: JoinHandle<()>,\n 2798| }\n 2799|\n...\n 2801| /// connects (cold_start sends the hello), the stub recv_hello's it, then loops:\n*2802| /// it owns the server `Stream` and writes any envelope the test feeds via `feed`.\n*2803| /// (We never need to READ the brain's writes for these tests — the subscribe\n*2804| /// `attach_skip_to_live` sends is harmlessly left in the OS socket buffer; the\n 2805| /// frames are tiny. We drop the recv half so it does not hold resources.)\n 2806| fn brain_with_stub() -> (Brain, StubBroker) {\n 2807| let name = unique_name();\n...\n 2818|\n*2819| // Split: the stub writes fed frames through the send half; the recv half is\n*2820| // dropped (we never read the brain's subscribe frames — they sit in the\n 2821| // socket buffer, which is fine for these tiny, low-volume tests).\n 2822| let (recv, mut send) = server.split();\n 2823| drop(recv);\n...\n 2826| while let Ok(env) = frames.recv() {\n*2827| if write_frame(&mut send, &env).is_err() {\n 2828| break;\n 2829| }\n 2830| }\n...\n 2843| /// `next_seq` reject-gap dedup: it accepts the contiguous seq 0, then REJECTS a\n*2844| /// forward jump as an `output gap`. This is the behavior `attach_skip_to_live`\n 2845| /// must FLIP — proving the next test isn't vacuously green.\n 2846| ///\n 2847| /// Non-vacuous: if the legacy path ever stopped rejecting forward gaps, this\n...\n 2878|\n*2879| /// KEYSTONE — the brain-level primitive the `serve_attach` controller\n 2880| /// gap-resume (REQ-HAZARD-CONTROLLER-GAP-RESUME) is built on: a CONTROLLER on\n 2881| /// the strict legacy reject-gap path (empty `session_cursors`) that FATALS a b4\n 2882| /// drop-don't-block output-gap can RECOVER by re-subscribing from\n...\n 2885| /// frames exactly-once. This drives the stub MANUALLY — it does NOT exercise the\n*2886| /// `read_controller_event_resuming` helper's auto-resubscribe (that is the int\n 2887| /// test); it pins the primitive that helper relies on.\n 2888| ///\n 2889| /// Mutations caught (the resume contract, end to end):\n...\n 2891| /// returned anything else (e.g. a stale or off-by-one cursor) the resume\n*2892| /// re-subscribe would request the wrong seq and the re-fetch (step 3) would\n 2893| /// either re-gap or dedup-drop the floor frame → RED.\n 2894| /// - The cursor must NOT advance on a gap: if the legacy reject-gap path\n 2895| /// advanced `next_seq` past the gap (instead of freezing at `want`), the\n...\n 2898| /// - A re-fetch from the floor must be ACCEPTED, not re-rejected: if the\n*2899| /// re-subscribe left the strict cursor mis-seeded, the replayed floor frame\n 2900| /// (seq 3) would itself read as a gap or a dup → step 3 RED.\n 2901| // [unit->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n 2902| #[test]\n...\n 2906|\n*2907| // (1) CONTROLLER attach on the strict legacy path: empty `session_cursors`,"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\brain.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":200,"fileCount":1,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs","count":200}],"truncated":true,"perFileLimitReached":200,"displayContent":" *1│//! The brain (B2) — the restartable logic half that attaches to the broker.\n 2│//!\n 3│//! The brain holds all the volatile logic; it may be killed and restarted at\n 4│//! any moment (a routine self-update swaps it; a crash kills it). It connects to\n │...\n 16│//! - **Gapless, exactly-once resume.** The brain tracks `next_seq` — the next\n *17│//! output sequence it still needs. On handoff it `subscribe`s from that cursor;\n 18│//! the broker replays buffered output from there. [`Brain::read_event_until`] accepts\n 19│//! only the contiguous next `seq` (advancing the cursor), silently drops an\n 20│//! already-seen `seq` (a replay duplicate), and treats a forward gap as a hard\n │...\n 33│\n *34│use crate::codec::{read_frame, write_frame};\n 35│use crate::frame::{Envelope, Role};\n 36│use crate::effect::MintedOp;\n 37│use crate::msg::{\n │...\n 43│ NetStatusReply, NetStreamData, NetStreamEof, NetStreamOpenReq, NetStreamOpened, NetStreamSendReq,\n *44│ NetStreamSubscribeReq, NetStreamsReply, NetStreamOpenerReply, NetStreamOpenerReq, NetStreamRetireReq, NetStreamRetired, NetStreamUnsubscribeReq, NetStreamUnsubscribed, OutputEvent, MetMember, PairCodeSubmit, PairJoinReply, PairJoinReq, PairMeetReq, ResizeReq,\n 45│ SessionsReply, SizeEvent, SpawnConflict, SpawnReq, Spawned, StreamLifetime, SubscribeOutcome,\n 46│ SubscribeReq, SubscribedReply, ViewerEvictedEvent,\n 47│ KIND_ADAPTER_APPLY, KIND_APPLIED, KIND_BRAIN_RESTART, KIND_BROKER_IMAGE, KIND_BROKER_IMAGE_REPLY, KIND_STALL_EVICTS, KIND_STALL_EVICTS_REPLY, KIND_VIEWER_EVICTED,\n │...\n 59│ KIND_SPAWN_CONFLICT, KIND_SPAWN_FRESH,\n *60│ KIND_SUBSCRIBE, KIND_SUBSCRIBED, KIND_UNSUBSCRIBE, UnsubscribeReq,\n 61│ BringUpReq, BroughtUpReply, KIND_BRING_UP, KIND_BROUGHT_UP,\n 62│ SealCeremonyReq, SealCeremonyReply, KIND_SEAL_CEREMONY, KIND_SEAL_CEREMONY_REPLY,\n 63│ SealEnrollReq, KIND_SEAL_ENROLL,\n │...\n 66│};\n *67│use spt_net::net::attach::AttachIntent;\n 68│use crate::transport::{send_hello, LocalSocketTransport};\n 69│\n 70│/// Wall-clock now in epoch milliseconds — the source for `gen_start` (matches\n │...\n 78│\n *79│/// The brain's durable state across a handoff: enough to re-attach gaplessly and\n 80│/// advance the generation. `gen_start_ms` is recorded for observability but is\n 81│/// **deliberately not authoritative on restart** — [`Brain::handoff`] sets a\n 82│/// fresh `gen_start` from `now()` (2.4).\n │...\n 85│/// frame is **retired from the production path**: a brain the broker's supervisor\n *86│/// respawns reconstructs continuity by querying the broker\n 87│/// ([`Brain::resume_sessions`] over the broker's cursor-of-record), never this\n 88│/// message. `BrainState` / [`Brain::handoff`] / [`Brain::snapshot`] stay `pub`\n 89│/// solely because the integration tests (separate test target — `#[cfg(test)]`\n │...\n 92│#[derive(Debug, Clone)]\n *93│pub struct BrainState {\n 94│ /// The session the brain was driving.\n 95│ pub session_id: u64,\n 96│ /// The generation counter (incremented on each handoff).\n │...\n 132│ /// the operator should be shown, and — on an admit or an already-live — the\n *133│ /// session to attach to. The detail is carried VERBATIM: the client did not\n 134│ /// decide this refusal and must not re-word it.\n 135│ // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n 136│ BroughtUp {\n │...\n 139│ session_id: u64,\n *140│ /// The single-use admit ticket to present on the attach that seats this\n 141│ /// caller (admits only). Opaque here by design: the client carries it,\n 142│ /// the broker decides it.\n 143│ admit: Option,\n │...\n 155│ /// Broker→controller-serve: open the seal-ceremony overlay (WAX-SEAL W2).\n *156│ /// The serve loop forwards it onto the attach wire as\n 157│ /// `AttachRecord::SealCeremony`.\n 158│ // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n 159│ SealCeremonyOpen {\n │...\n 188│ Exit { session_id: u64, code: Option },\n *189│ /// The resolved controller/viewer role of a [`Brain::attach_as`] subscribe\n 190│ /// (REQ-RCVIEW-1 / REQ-KICK-1). The serving brain wakes (controller-only),\n 191│ /// stays wake-neutral (viewer), or refuses the operator (busy).\n 192│ Subscribed {\n │...\n 195│ /// The broker's operator-facing sentence about this seat, when it has\n *196│ /// one (releases#102). Relayed onto the attach stream by `serve_attach`\n 197│ /// — it is for the human at the controls, not for this hop.\n 198│ // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\n 199│ note: Option,\n │...\n 212│ /// (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). DISTINCT from a session-exit EOF: the\n *213│ /// serving brain re-subscribes from the current ring floor (skip-to-live)\n *214│ /// rather than tearing the attach down.\n 215│ ViewerEvicted { session_id: u64 },\n 216│ /// An idempotent effect is durably applied (or was deduped — `applied_now`\n 217│ /// distinguishes). The exactly-once ack for a [`Brain::send_effect`] (B5).\n │...\n 251│ /// A stream's read side finished cleanly; `next_seq` is the completeness\n *252│ /// check (the subscriber's cursor must equal it to have missed nothing).\n 253│ NetStreamEof { stream_id: u64, next_seq: u64 },\n 254│ /// A contiguous conn-liveness event (the presence cursor has advanced past\n 255│ /// it) — connected/disconnected on the broker's conn table (D4c).\n │...\n 287│/// thread does blocking [`read_frame`] on the [`RecvHalf`] and forwards each\n *288│/// framed result down a channel; the main thread writes on the [`SendHalf`] and\n 289│/// reads with [`Receiver::recv_timeout`]. Blocking reads work on both OSes; the\n 290│/// channel supplies the deadline. On a timeout the pump bubbles out to a\n 291│/// supervised restart (a fresh [`Brain`] → fresh split → fresh reader thread);\n │...\n 296│ Whole(Stream),\n *297│ /// The pump carrier: writes go out [`SendHalf`]; framed reads arrive over\n 298│ /// `frames` from the reader thread (`_reader`, named `pump-ipc-reader`).\n 299│ Split {\n 300│ send: SendHalf,\n │...\n 319│/// silent unless `SPT_PUMP_TRACE=1` explicitly opts in (the e2e rigs do — the\n *320│/// marker is their pump-construction witness; a user terminal never does).\n 321│// [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n 322│#[derive(Clone, Copy, PartialEq, Eq, Debug)]\n 323│pub enum PumpTrace {\n │...\n 366│ /// `pump-ipc-reader` thread (blocking [`read_frame`] → channel) and keep the\n *367│ /// [`SendHalf`] for writes. The reader logs spawn/exit per `trace` so a\n 368│ /// leaked (parked) reader is diagnosable in the field (KH 7.6) WITHOUT\n 369│ /// writing into a display surface an interactive client owns\n 370│ /// (REQ-RC-DISPLAY-SOLE-WRITER — see [`PumpTrace`]).\n │...\n 372│ // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n *373│ fn split_with_reader(stream: Stream, trace: PumpTrace) -> BrainConn {\n 374│ let (mut recv, send) = stream.split();\n 375│ let (tx, frames) = mpsc::channel();\n 376│ let reader = thread::Builder::new()\n │...\n 408│\n *409│/// A live brain attached to a broker.\n *410│pub struct Brain {\n 411│ conn: BrainConn,\n 412│ generation: u64,\n 413│ gen_start_ms: u64,\n │...\n 417│ /// Per-net-stream resume cursors (D4b) — the stream-read siblings of\n *418│ /// `next_seq`, set by [`Brain::net_stream_subscribe`] and advanced by\n 419│ /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n *420│ /// Durability across a handoff is the logic layer's job (a re-attaching\n *421│ /// brain queries `net-streams` and re-subscribes from its durable cursors).\n 422│ net_cursors: std::collections::HashMap,\n 423│ /// The presence resume cursor (D4c) — the conn-liveness sibling of\n *424│ /// `net_cursors`, set by [`Brain::net_presence_subscribe`] and advanced by\n 425│ /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n *426│ /// `None` until subscribed (or the first event arrives).\n 427│ presence_cursor: Option,\n 428│ /// Per-session **resume** output cursors (restoration D4-2): the multi-session\n 429│ /// continuity state a cold-started brain rebuilds from the broker via\n │...\n 446│ /// (KNOWN-HAZARDS — a blocked brain-IPC read must never wedge the pump). The\n *447│ /// two facts are coupled at construction: `Some` ⇔ [`BrainConn::Split`].\n 448│ io_timeout: Option,\n *449│ /// #6 (ADR-0031): a COLD attach (`from_seq == 0`, set by [`Brain::attach`] /\n *450│ /// [`Brain::attach_as`]) receives a synthesized clean-screen REPAINT as its\n 451│ /// first `KIND_OUTPUT` frame, at pseudo-seq `broker.next_seq - 1` — NOT seq 0.\n 452│ /// When `true`, the strict legacy `next_seq` path adopts that first frame's seq\n 453│ /// as the baseline (accept-and-seed) instead of reject-gapping it, then reverts\n │...\n 495│ /// unless a rig opts in — a client's stderr is a terminal it must not\n *496│ /// write to from a background thread).\n 497│ // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n 498│ // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n 499│ pub fn cold_start_pump(\n │...\n 522│ /// from `prior`, but stamp `gen_start = now()` (NOT `prior.gen_start_ms` —\n *523│ /// the 2.4 invariant), and re-subscribe to the session from the cursor for a\n 524│ /// gapless resume.\n 525│ ///\n *526│ /// The eager `subscribe` IS the resume mechanism — every standalone handoff\n 527│ /// caller (the brain-only update engine, `idempotent`/`daemon_e2e`/`handoff`\n *528│ /// integration tests) replays output through it with no later `attach`. So it\n *529│ /// stays. The P1c controller-writer reorder (a `serve_attach` re-serve that\n *530│ /// ALSO subscribes from 0 over this same socket → two racing\n *531│ /// `controller_writer`s) is fixed in the BROKER, not by dropping this\n *532│ /// subscribe: the epoch gate ([`OutputLog::become_controller`]) guarantees a\n *533│ /// single live writer per connection, and the seeded `session_cursors` below\n 534│ /// routes the consumer through the dedup-below + snap-above path so any\n 535│ /// at-least-once boundary re-send is tolerated, never a fatal reject-gap\n 536│ /// ([`REQ-HAZARD-CONTROLLER-WRITER-REORDER`]).\n │...\n 563│ };\n *564│ brain.subscribe(prior.session_id, prior.next_seq)?;\n 565│ Ok(brain)\n 566│ }\n 567│\n │...\n 589│ /// Snapshot durable state for a future handoff. **Test-only (restoration\n *590│ /// D4-3)** — the production path reconstructs from the broker, never a\n 591│ /// snapshot frame; see [`BrainState`].\n 592│ pub fn snapshot(&self) -> BrainState {\n 593│ BrainState {\n │...\n 600│\n *601│ /// Spawn a session under a broker PTY; the broker auto-subscribes this\n 602│ /// connection. Reads until the `spawned` reply (consuming any output that\n 603│ /// races ahead).\n 604│ pub fn spawn_session(&mut self, req: SpawnReq) -> io::Result {\n │...\n 612│ /// The verb is the entrance the engine room did not have: with no session\n *613│ /// hosted there was nothing to subscribe to, so the code an operator typed\n *614│ /// reached no gate and the attach refused client-side. The gate still runs\n 615│ /// DAEMON-SIDE — the adversary here is an agent on this box that can speak\n 616│ /// this same IPC — so nothing about the answer is decided in this process.\n 617│ ///\n │...\n 668│ /// `subnet`, through the TOTP human-presence ceremony at `endpoint`'s\n *669│ /// attached controller (WAX-SEAL W2, releases#21).\n 670│ ///\n 671│ /// BLOCKS for the ceremony's human-scale duration — the broker holds the\n 672│ /// reply until the human at the overlay admits, fails out, or cancels;\n 673│ /// dropping this connection mid-wait aborts the ceremony cleanly (no\n *674│ /// partial record, nothing spent). With no capable controller attached\n 675│ /// the reply is an immediate `SEAL_NO_CEREMONY_SURFACE` refusal instead\n 676│ /// (operator ruling 4: no pending state, no timeout queue).\n 677│ ///\n │...\n 907│\n *908│ /// Inject input **idempotently**: the write carries the durable `op_id` so a\n 909│ /// replay after a brain crash is deduped at the broker (exactly-once, B5).\n 910│ /// `op_id` must come from a durable source and be reused verbatim on replay —\n 911│ /// the same logical effect must always carry the same id, so the broker's\n │...\n 926│ /// [`KIND_APPLIED`] ack (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The operator/rc\n *927│ /// attach path is fire-and-forward — `op_id` is for dedup only and the ack is\n *928│ /// discarded by `serve_attach` — and it can flood N input frames on ONE\n 929│ /// brain↔broker conn without returning to read. With no ack the broker's\n *930│ /// per-conn handler never writes back while servicing that flood, so the return\n 931│ /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n 932│ /// broker still dedups by `(session, op_id)` at its applied-set.\n 933│ // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n │...\n 982│ /// request (ADR-0045 decision 6). Deliberately NOT [`Brain::kill_session`]:\n *983│ /// that one runs `require_session()` on THIS connection's attached session,\n *984│ /// which means attaching first — and under the ADR-0044 lease ladder an\n *985│ /// attach is a controller claim with a generation bump behind it. Teardown\n *986│ /// claims no controller, so it needs no attach and can be issued on a bare\n 987│ /// probe connection.\n 988│ ///\n 989│ /// Fire-and-forward: the broker sends no reply. The caller's postcondition\n │...\n 1011│ /// A session `Exit` before the needle is found is an error (the child died).\n*1012│ pub fn read_output_until(&mut self, needle: &[u8], buf: &mut Vec) -> io::Result {\n 1013│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 1014│ let deadline = self.call_deadline();\n 1015│ loop {\n │...\n 1049│ // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1050│ pub fn reply_read_deadline(&self) -> Option {\n 1051│ peer_reply_deadline(self.io_timeout, Instant::now())\n 1052│ }\n 1053│\n │...\n 1062│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1063│ pub fn read_event_until(&mut self, deadline: Option) -> io::Result {\n 1064│ loop {\n 1065│ let env = self.read_frame_until(deadline)?;\n 1066│ match env.kind.as_str() {\n │...\n 1108│ //\n*1109│ // #6 (ADR-0031): a COLD attach's FIRST output frame is a\n 1110│ // clean-screen repaint at pseudo-seq `broker.next_seq - 1` (a\n 1111│ // forward jump from the requested `from_seq == 0`). Adopt that seq\n 1112│ // as the baseline instead of reject-gapping it — the repaint IS\n 1113│ // the complete current screen, nothing prior is owed. Consumed\n*1114│ // once per (cold) attach; every subsequent LIVE frame then takes\n 1115│ // the strict reject-gap below (a b4 drop still re-fetches — B2).\n 1116│ if self.baseline_next_output {\n 1117│ self.next_seq = ev.seq;\n │...\n 1386│ /// broker-IPC-CARRIER desync (the carrier ops — `net_open_stream` /\n*1387│ /// `net_stream_subscribe` / `net_stream_send` — keep their raw `TimedOut`).\n 1388│ /// Abandoning the peer's stream is safe: the exactly-once seq cursor stays\n 1389│ /// contiguous, and a late reply on the dropped stream id matches nothing (the\n 1390│ /// leg loops treat it as noise) — the desync the old blanket-poison feared\n │...\n 1392│ // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1393│ pub fn read_peer_reply_until(&mut self, deadline: Option) -> io::Result {\n 1394│ self.read_event_until(deadline)\n 1395│ .map_err(reclassify_peer_reply_err)\n 1396│ }\n │...\n 1398│ /// Attach this (freshly-connected) brain to an **existing** broker session's\n*1399│ /// output from `from_seq`, e.g. a dedicated digest-feed subscriber that did\n 1400│ /// not spawn the session itself. Sets the resume cursor + session, then\n*1401│ /// subscribes (the broker replays from `from_seq`, then streams live). Unlike\n 1402│ /// [`Brain::handoff`] this does not touch the generation — it is a *second*\n 1403│ /// reader of a session another brain drives, not a logic handoff.\n*1404│ pub fn attach(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n 1405│ self.session_id = Some(session_id);\n 1406│ self.next_seq = from_seq;\n*1407│ // #6 (ADR-0031): a COLD attach receives a clean-screen repaint at pseudo-seq\n 1408│ // `broker.next_seq - 1`, not seq 0 — baseline the strict cursor on it.\n 1409│ self.baseline_next_output = from_seq == 0;\n 1410│ // A resume-mode brain (non-empty map) routes this session's output through\n │...\n 1412│ // (D4-2b); a legacy brain (empty map) uses the `next_seq` set above. The\n*1413│ // resume-mode dedup-cursor reset for an explicit re-subscribe lives in\n*1414│ // `subscribe_with` (P1c, shared by `attach`/`attach_as`).\n*1415│ self.subscribe(session_id, from_seq)\n 1416│ }\n 1417│\n 1418│ /// Attach under the W2.5 controller/viewer model (REQ-RCVIEW-1): send a\n*1419│ /// role-aware subscribe with `intent` + the operator identity `by` (the\n*1420│ /// handshake-proven origin for a remote attach). The broker resolves the role\n*1421│ /// and replies a [`BrokerEvent::Subscribed`] the caller (a [`serve_attach`]\n 1422│ /// loop) reads to learn whether it became controller / viewer / was refused.\n*1423│ /// Like [`Brain::attach`] this is a second reader, not a logic handoff (the\n 1424│ /// generation is untouched).\n 1425│ ///\n*1426│ /// [`serve_attach`]: crate::attach::serve_attach\n*1427│ pub fn attach_as(\n 1428│ &mut self,\n 1429│ session_id: u64,\n 1430│ from_seq: u64,\n │...\n 1434│ ) -> io::Result<()> {\n*1435│ self.attach_as_coded(session_id, from_seq, intent, gen, by, None, false)\n 1436│ }\n 1437│\n*1438│ /// [`Brain::attach_as`] carrying a bring-up code (ADR-0052 decision 2) — the\n 1439│ /// engine room's seat resolver demands one from any connection that does not\n 1440│ /// already hold its controls, and this is the only path that can present it.\n 1441│ ///\n*1442│ /// Every other attach is [`Brain::attach_as`] itself, i.e. `None`: a brain's\n 1443│ /// own resume, a viewer, a digest feed. That is not a shortcut — none of them\n 1444│ /// has a human at a keyboard to read a code off, so `None` is the truthful\n 1445│ /// answer, and for the one gated endpoint it is a refusal rather than a pass.\n 1446│ /// `seal_ceremony` is the W2 capability bit carried from the wire\n*1447│ /// `AttachRecord::Request` — `true` only when the attaching CLIENT declared\n 1448│ /// it can run the seal-ceremony overlay; the broker records it on the\n 1449│ /// controller seat (REQ-SEAL-NO-CEREMONY-SURFACE). Every non-serve caller\n 1450│ /// passes `false` (no human viewport behind them).\n │...\n 1452│ #[allow(clippy::too_many_arguments)]\n*1453│ pub fn attach_as_coded(\n 1454│ &mut self,\n 1455│ session_id: u64,\n 1456│ from_seq: u64,\n │...\n 1464│ self.next_seq = from_seq;\n*1465│ // #6 (ADR-0031): a COLD attach (`from_seq == 0` — the `rc` / `endpoint run\n*1466│ // --attach` case) gets a clean-screen repaint at pseudo-seq\n 1467│ // `broker.next_seq - 1` as its first frame; baseline the strict cursor on it\n 1468│ // (accept-then-strict). A resume-from-floor re-fetch (`from_seq > 0`) leaves\n 1469│ // this false → raw-ring replay + strict reject-gap unchanged (B2).\n 1470│ self.baseline_next_output = from_seq == 0;\n*1471│ self.subscribe_with(\n 1472│ session_id,\n 1473│ from_seq,\n 1474│ intent,\n │...\n 1481│\n*1482│ /// Re-subscribe a VIEWER from the LIVE TAIL after a broker eviction —\n 1483│ /// skip-to-live (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT). The viewer overflowed its\n 1484│ /// bounded subscription queue (it forwards slower than the drain fans out) and\n 1485│ /// the broker evicted it (correct session-protection); rather than dying it\n │...\n 1495│ /// which accepts the jump and snaps. VIEWER-only → B2-safe (a viewer never\n*1496│ /// advances `delivered_through` / is not authoritative). The subscribe is sent\n*1497│ /// FIRST (a cold brain's empty-map skips `subscribe_with`'s `from_seq` reset),\n 1498│ /// THEN the cursor is armed, so neither path stamps `MAX`.\n 1499│ // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n*1500│ pub fn attach_skip_to_live(&mut self, session_id: u64, by: Option<&str>) -> io::Result<()> {\n 1501│ self.session_id = Some(session_id);\n*1502│ self.subscribe_with(session_id, u64::MAX, AttachIntent::Viewer, 0, by.map(str::to_string), None, false)?;\n 1503│ self.session_cursors.insert(session_id, 0);\n 1504│ self.next_seq = 0;\n 1505│ Ok(())\n │...\n 1507│\n*1508│ /// Arm SNAP-ABOVE at the INITIAL viewer attach — a `rc --view` VIEWER must\n 1509│ /// tolerate a **PRE-eviction** forward Output gap. Under a hard flood this\n 1510│ /// serving brain can fall behind the live ring and read a `seq` past its\n 1511│ /// cursor because the ring rolled the intervening frames OUT between reads,\n │...\n 1515│ /// ([`Brain::read_event_until`]), which FATALS the forward gap →\n*1516│ /// `serve_attach` returns → forwarding stops → the operator sees nothing\n*1517│ /// (a_journaled / p0_paste / attach.rs:1071 wedged_viewer, Linux forkpty;\n 1518│ /// MASKED on Windows ConPTY, which floods slower so the ring never rolls far\n*1519│ /// enough to gap a still-subscribed viewer).\n 1520│ ///\n*1521│ /// Mirrors [`Brain::attach_skip_to_live`] but seeds the snap-above cursor at\n 1522│ /// the requested `from_seq` (the viewer asked from there — dedup BELOW it,\n*1523│ /// snap ABOVE a forward gap) and subscribes from `from_seq`, NOT the MAX\n*1524│ /// skip-replay, because this is the FIRST attach rather than a post-eviction\n*1525│ /// re-subscribe. The two viewer-survival mechanisms COMPOSE: this tolerates\n*1526│ /// pre-eviction ring-roll gaps WHILE subscribed; [`Brain::attach_skip_to_live`]\n*1527│ /// recovers POST-eviction (re-subscribe from the floor). VIEWER-only →\n 1528│ /// B2-SAFE (a viewer never advances `delivered_through` / is not authoritative\n 1529│ /// — the CONTROLLER keeps the strict reject-gap for exactly-once resume). The\n*1530│ /// subscribe is sent FIRST (a cold brain's empty map skips `subscribe_with`'s\n 1531│ /// `from_seq` reset), THEN the cursor is armed.\n 1532│ // [impl->REQ-HAZARD-VIEWER-RING-ROLL-SNAP]\n*1533│ pub fn attach_as_viewer_snap(\n 1534│ &mut self,\n 1535│ session_id: u64,\n 1536│ from_seq: u64,\n │...\n 1540│ self.next_seq = from_seq;\n*1541│ self.subscribe_with(session_id, from_seq, AttachIntent::Viewer, 0, by.map(str::to_string), None, false)?;\n 1542│ self.session_cursors.insert(session_id, from_seq);\n 1543│ Ok(())\n 1544│ }\n │...\n 1546│ /// Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the\n*1547│ /// broker for **every** hosted session and re-attach **each** in resume mode\n 1548│ /// from the broker's per-session delivered cursor (`resume_seq`). This is the\n 1549│ /// production replacement for the retired single-session `BrainState` handoff\n*1550│ /// frame — a brain the supervisor respawns (crash *or* update) reconstructs\n 1551│ /// all session continuity by querying the persistent side, never a brain→brain\n*1552│ /// message. Returns the ids re-attached (empty when the broker hosts none —\n 1553│ /// the supervised daemon brain's no-op-today case).\n 1554│ ///\n 1555│ /// Each session is seeded into [`Self::session_cursors`] at its `resume_seq`,\n │...\n 1561│ ///\n*1562│ /// Each session is re-attached as a **VIEWER**, never a controller: a caller that\n 1563│ /// DRAINS the resumed output (`Brain::read_event_until`) gets output-continuity from its\n 1564│ /// cursor; a viewer never seizes/stall-evicts a controller slot (UPDATE-WEDGE-2,\n 1565│ /// REQ-BRAIN-RESUME-NO-CONTROL-STEAL). Genuinely daemon-brain-driven sessions (the\n*1566│ /// live-agent adapter future) will re-attach as Control on a drained carrier; that\n 1567│ /// set is empty today.\n 1568│ ///\n 1569│ /// NOT INSTRUMENTED, deliberately: this method has NO production caller (the\n │...\n 1573│ /// from one that means \"no resume happened\", which is worse than no\n*1574│ /// instrumentation at all. The attach-intent breadcrumbs live at the choosers\n 1575│ /// the daemon actually executes; see `ATTACH_INTENT_CHOSEN`.\n 1576│ ///\n 1577│ /// ⚠️ DEADLOCK WARNING — the CALLER MUST DRAIN this conn (UPDATE-WEDGE round 3,\n*1578│ /// REQ-BRAIN-RESUME-NO-CONN-DEADLOCK). This subscribes the sessions onto THIS conn.\n 1579│ /// A NON-DRAINING consumer will SELF-DEADLOCK: an actively-streaming session backs\n*1580│ /// the conn up, the broker-side subscriber writer blocks holding the conn's single\n*1581│ /// `SharedSend` mutex ACROSS a blocking `write_frame` (broker.rs\n*1582│ /// `viewer_writer`/`controller_writer`), the dispatch reply path (`send_frame`) needs\n 1583│ /// that same lock, so any request/reply the non-draining consumer issues is starved\n 1584│ /// (dead-peer-independent — the v0.30.4 field re-wedge). The supervised daemon brain\n 1585│ /// is exactly such a non-draining consumer (its `run_brain` heartbeat reads this conn\n │...\n 1588│ /// guard), so it MUST call [`Self::resume_session_cursors`] (cursor-only, NO\n*1589│ /// subscribe) instead. This subscribing method stays for a DRAINING caller (the\n 1590│ /// resume int tests today; the forward live-agent-adapter / Option-B drained carrier).\n 1591│ // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 1592│ // [impl->REQ-DAEMON-2]\n │...\n 1599│ for info in reply.sessions {\n*1600│ // Seed the dedup cursor at the broker's resume point BEFORE the subscribe\n*1601│ // replay starts arriving, then re-attach (Viewer) from there.\n 1602│ self.session_cursors\n 1603│ .insert(info.session_id, info.resume_seq);\n 1604│ // THE decision, bound ONCE: the same value is both logged below and passed\n*1605│ // to `subscribe_with`, so the breadcrumb cannot drift from the attach it\n 1606│ // describes. A separately-written label would still read `viewer` on the\n 1607│ // day this choice becomes conditional (the live-agent-adapter Control set\n 1608│ // this method is kept for) — that is the re-derivation this binding exists\n │...\n 1611│ let intent = AttachIntent::Viewer;\n*1612│ self.subscribe_with(info.session_id, info.resume_seq, intent, 0, None, None, false)?;\n 1613│ resumed.push(info.session_id);\n 1614│ }\n 1615│ Ok(resumed)\n │...\n 1619│ /// every hosted session and seed [`Self::session_cursors`] at each `resume_seq`,\n*1620│ /// returning the re-attached ids — but DO **NOT** subscribe. This is the safe resume\n 1621│ /// the daemon `run_brain` heartbeat uses in place of [`Self::resume_sessions`]:\n 1622│ /// carrying only request/reply on the brain's conn (no UNDRAINED subscription) makes\n*1623│ /// the `SharedSend` self-deadlock structurally impossible (UPDATE-WEDGE round 3,\n 1624│ /// REQ-BRAIN-RESUME-NO-CONN-DEADLOCK — see the deadlock warning on\n 1625│ /// [`Self::resume_sessions`]). The daemon brain drives no broker PTY session\n 1626│ /// (brainproc.rs:184) and nothing on its side consumes session output (§3 guard), so\n*1627│ /// the observation cursor is all it needs; no attach also means no controller steal\n 1628│ /// (REQ-BRAIN-RESUME-NO-CONTROL-STEAL, a fortiori). Rides the brain-swap ⇒ seamless.\n 1629│ /// When genuinely daemon-brain-driven sessions land (the live-agent adapter future),\n*1630│ /// attach THOSE on a DEDICATED drained carrier (Option B, deferred) — never on this\n 1631│ /// request/reply conn.\n 1632│ // [impl->REQ-BRAIN-RESUME-NO-CONN-DEADLOCK]\n 1633│ // [impl->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n │...\n 1645│ /// The per-session resume cursor (the next seq still needed for a session\n*1646│ /// re-attached by [`Brain::resume_sessions`]) — observability / tests.\n 1647│ pub fn session_cursor(&self, session_id: u64) -> Option {\n 1648│ self.session_cursors.get(&session_id).copied()\n 1649│ }\n │...\n 1654│ /// `delivered_through` (the broker advances it only on contiguous controller\n*1655│ /// writes — b4 `contiguous_advance` — and freezes it at the drop, exactly where\n 1656│ /// this reader stalls). So a controller re-subscribing from here RE-FETCHES the\n 1657│ /// dropped frames exactly-once (IFF the ring still holds them, i.e.\n 1658│ /// `tail - delivered_through <= cap_chunks`; the ring trim is\n*1659│ /// `delivered_through`-blind, broker.rs). Drives the serve_attach controller\n 1660│ /// gap-resume — no mid-stream `KIND_SESSIONS` round-trip (which would re-fatal\n 1661│ /// on the same gap and discard Output).\n 1662│ // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n │...\n 1733│\n*1734│ fn read_broker_image_until(\n 1735│ &mut self,\n 1736│ deadline: Option,\n 1737│ ) -> io::Result> {\n │...\n 1826│\n*1827│ /// Query the broker's brain-subscriber stall-evict tally (LIFECYCLE-TRUTH W2\n 1828│ /// observability rider, REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): `(count,\n 1829│ /// last_ms)` — how many controllers were stall-evicted for a suspended/black-holed\n 1830│ /// brain conn since boot, and when the most recent fired. `None` when the broker\n │...\n 2032│ /// op id: the singleton is idempotent by reuse, and there is no network leg\n*2033│ /// a crash-replay could double. Identical from `request_attach` up — the\n 2034│ /// one-pump invariant lives at the transport leaf, not here.\n 2035│ // [impl->REQ-RC-1]\n 2036│ pub fn net_dial_loopback(&mut self) -> io::Result {\n │...\n 2065│ /// connection — on conn loss the broker FINs it toward the target and\n*2066│ /// terminal-retires the row. RC attach/view openers use this; inter-brain\n 2067│ /// streams stay `Durable`.\n 2068│ // [impl->REQ-STREAM-LEASE-CLASSES]\n 2069│ pub fn net_open_stream_classed(\n │...\n 2096│ /// Write bytes to a held stream over the broker (D4b). With `op_id` the\n*2097│ /// write is exactly-once and this blocks for the `net-sent` ack (returned);\n*2098│ /// without one it is a direct fire-and-forget write (`None` returned).\n*2099│ /// `finish` closes the send side after the write.\n 2100│ // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n 2101│ pub fn net_stream_send(\n 2102│ &mut self,\n │...\n 2133│\n*2134│ /// List the streams the broker holds (D4b) — how a re-attaching brain\n 2135│ /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n 2136│ pub fn net_streams(&mut self) -> io::Result {\n 2137│ self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n │...\n 2195│\n*2196│ /// Release this connection's subscriber SEAT on a stream (ADR-0040\n 2197│ /// decision 5, REQ-SEAT-LIFETIME-BOUNDED): the broker removes the seat,\n*2198│ /// stops and joins its writer thread; the local read cursor drops with it.\n 2199│ /// Idempotent + best-effort at every caller (`removed=false` for no seat /\n 2200│ /// someone else's seat / no such stream; an older broker answers `error` —\n 2201│ /// KH-2.3, the conn-close sweep remains the backstop).\n 2202│ // [impl->REQ-SEAT-LIFETIME-BOUNDED]\n*2203│ pub fn net_stream_unsubscribe(&mut self, stream_id: u64) -> io::Result {\n 2204│ // Drop the cursor FIRST — even an error reply (older broker) must not\n 2205│ // leave a cursor for a subscription the caller has abandoned.\n 2206│ self.net_cursors.remove(&stream_id);\n │...\n 2208│ KIND_NET_STREAM_UNSUBSCRIBE,\n*2209│ serde_json::to_value(NetStreamUnsubscribeReq { stream_id })\n*2210│ .expect(\"NetStreamUnsubscribeReq serializes\"),\n 2211│ )?;\n 2212│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2213│ let deadline = self.call_deadline();\n │...\n 2216│ BrokerEvent::Other(env) if env.kind == KIND_NET_STREAM_UNSUBSCRIBED => {\n*2217│ let reply: NetStreamUnsubscribed = serde_json::from_value(env.payload)\n 2218│ .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 2219│ return Ok(reply.removed);\n 2220│ }\n │...\n 2293│ /// to reach an spt-hosted endpoint (broker holds its PTY, no relay). The\n*2294│ /// broker resolves endpoint→session atomically and writes the bytes (a\n 2295│ /// pre-rendered `` envelope). Returns `(delivered, spool_deferred)`:\n 2296│ /// `delivered=true` = broker injected via translation binary; `spool_deferred=true`\n 2297│ /// = caller should spool deferred (active window), `false` = spool non-deferred\n │...\n 2358│ &mut self,\n*2359│ reply: &spt_net::net::attach::InputPathReply,\n 2360│ ) -> io::Result<()> {\n 2361│ self.send(crate::msg::KIND_USER_INPUT_PATHS_REPLY,\n 2362│ serde_json::to_value(reply).map_err(io::Error::other)?)\n │...\n 2379│\n*2380│ /// (Re)subscribe to a stream's buffered reads from `from_seq`, setting the\n*2381│ /// local cursor (gapless, exactly-once resume — the PTY `subscribe`\n 2382│ /// discipline on a QUIC stream, D4b).\n 2383│ // [impl->REQ-DAEMON-2]\n*2384│ pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {\n 2385│ self.net_cursors.insert(stream_id, from_seq);\n 2386│ self.send(\n 2387│ KIND_NET_STREAM_SUBSCRIBE,\n │...\n 2396│ /// The next stream-read sequence still needed for `stream_id` (the durable\n*2397│ /// state a handed-off brain carries to resubscribe gaplessly).\n 2398│ pub fn net_cursor(&self, stream_id: u64) -> Option {\n 2399│ self.net_cursors.get(&stream_id).copied()\n 2400│ }\n 2401│\n*2402│ /// (Re)subscribe to the broker's conn-liveness event log from `from_seq`,\n 2403│ /// setting the local cursor (D4c) — gapless, exactly-once presence resume:\n*2404│ /// events produced while no brain was attached replay from the cursor.\n 2405│ // [impl->REQ-EP-4]\n*2406│ pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407│ self.presence_cursor = Some(from_seq);\n 2408│ self.send(\n 2409│ KIND_NET_PRESENCE_SUBSCRIBE,\n │...\n 2415│ /// The next presence sequence still needed (the durable state a handed-off\n*2416│ /// brain carries to resubscribe gaplessly).\n 2417│ pub fn presence_cursor(&self) -> Option {\n 2418│ self.presence_cursor\n 2419│ }\n 2420│\n*2421│ /// PUMP-TRUTH W2 (REQ-PUMP-PEER-ISOLATION): subscribe the pump's DEDICATED\n 2422│ /// event carrier to presence in TAIL-FOLLOW mode — no history replay, and the\n 2423│ /// cursor BASELINES on the first live event rather than gap-checking from a\n 2424│ /// fixed floor. The pump has no durable cursor to resume (a supervised restart\n │...\n 2428│ /// old events can never hand this carrier a below-cursor gap that would falsely\n*2429│ /// trip the dead-broker restart. Contrast [`Self::net_presence_subscribe`]\n 2430│ /// (REQ-EP-4) which gap-checks from the durable cursor so a real lost liveness\n 2431│ /// event IS caught. Subscribe BEFORE the first submit so no outcome is missed.\n 2432│ // [impl->REQ-PUMP-PEER-ISOLATION]\n*2433│ pub fn net_presence_subscribe_tail(&mut self) -> io::Result<()> {\n 2434│ self.presence_cursor = None; // baseline on the first live event (no floor)\n 2435│ self.send(\n 2436│ KIND_NET_PRESENCE_SUBSCRIBE,\n │...\n 2441│\n*2442│ /// The intent [`Self::subscribe`] — and therefore [`Self::attach`] — takes.\n 2443│ ///\n 2444│ /// Named rather than written inline so a CALLER can log the intent it is about\n*2445│ /// to take without SPELLING IT A SECOND TIME. `attach` has no intent parameter,\n 2446│ /// so a caller-side literal would be a copy of a decision made in here, and it\n 2447│ /// would keep reading `control` on the day this stops being Control. One\n*2448│ /// source: this const is passed to `subscribe_with` below and logged by the\n 2449│ /// caller (`shellchan`'s ATTACH_INTENT_CHOSEN).\n 2450│ ///\n*2451│ /// Placed ABOVE `subscribe`'s own doc block on purpose: a `///` run is a doc\n 2452│ /// ATTRIBUTE, so an item inserted between that block and the function silently\n 2453│ /// adopts the whole block — traceability tag included — and leaves the\n 2454│ /// function undocumented while `traceable-reqs` still counts that tag as\n │...\n 2461│\n*2462│ /// Re-attach to a session's output from `from_seq` as a LOCAL CONTROLLER\n 2463│ /// (intent `Control`, identity `None`) — the legacy single-session serve\n*2464│ /// [`Brain::attach`] path.\n 2465│ ///\n*2466│ /// CAUTION — a `None`-identity Control attach does NOT \"never displace\":\n*2467│ /// `resolve_subscribe` (broker.rs) silently re-takes a FREE or SAME-LOCAL\n 2468│ /// (`None==None`) controller slot via `become_controller` (only a\n 2469│ /// DIFFERENT-REMOTE incumbent falls back to a silent viewer — the gate-#7\n 2470│ /// cross-operator guard). That silent re-take fires NO `Displaced` notice and\n │...\n 2474│ /// (only an actively-producing stolen session blocks long enough to evict).\n*2475│ /// That is correct for `attach` (a serve loop that WILL drive the session), but\n*2476│ /// it is why a brain-respawn must NOT resume-re-attach as Control — it would\n 2477│ /// silently STEAL every local/free controller (incl. the operator's local\n 2478│ /// `spt rc`) it never drains, freezing the session\n*2479│ /// (REQ-BRAIN-RESUME-NO-CONTROL-STEAL). [`Brain::resume_sessions`] re-attaches\n 2480│ /// as Viewer instead; Control is reserved for sessions the daemon brain drives.\n 2481│ // [doc->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n*2482│ fn subscribe(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n*2483│ self.subscribe_with(session_id, from_seq, Self::SUBSCRIBE_INTENT, 0, None, None, false)\n 2484│ }\n 2485│\n 2486│ /// Release this connection's controller/viewer role on `session_id`\n*2487│ /// (REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n 2488│ /// the viewport ends so the broker clears `driven_by` / `viewer_count`\n 2489│ /// promptly. Best-effort: a dropped connection clears the role anyway.\n 2490│ pub fn detach_session(&mut self, session_id: u64) -> io::Result<()> {\n │...\n 2500│ KIND_UNSUBSCRIBE,\n*2501│ serde_json::to_value(UnsubscribeReq { session_id, gen })\n*2502│ .expect(\"UnsubscribeReq serializes\"),\n 2503│ )\n 2504│ }\n 2505│\n*2506│ /// The role-aware subscribe (REQ-RCVIEW-1): `intent` selects viewer/control/\n 2507│ /// take, `by` carries the operator identity (`Some(node)` remote, `None`\n 2508│ /// local). The broker replies the resolved [`SubscribeOutcome`] as a\n 2509│ /// [`BrokerEvent::Subscribed`].\n 2510│ #[allow(clippy::too_many_arguments)]\n*2511│ fn subscribe_with(\n 2512│ &mut self,\n 2513│ session_id: u64,\n 2514│ from_seq: u64,\n │...\n 2521│ // P1c (operator-stream boundary, kitsubito RACEDIAG): a resume-mode brain\n*2522│ // (seeded map) that subscribes from `from_seq` must RESET this session's\n 2523│ // dedup cursor to `from_seq` — the broker's replay from `from_seq` is then\n 2524│ // re-delivered (and the operator's render cursor dedups the overlap),\n 2525│ // never lost. WHY THIS, NOT just `read_event`'s `or_insert`: on a re-serve,\n*2526│ // `serve_attach` may CONSUME a handoff-replay frame at the K boundary\n*2527│ // BEFORE it is `attached` (the frame is dropped by the `if attached` gate\n*2528│ // but the snap-above cursor still advanced past K); `attach_as(sid, 0)`\n*2529│ // then re-subscribes from 0, and without this reset the broker's re-send of\n 2530│ // seq K arrives below the advanced cursor and is deduped → seq K never\n 2531│ // reaches the operator viewport → a forward gap. Resetting to `from_seq`\n*2532│ // makes the re-subscribe re-deliver everything from its floor. A cold-start\n 2533│ // brain (empty map — e.g. the production dispatch serve brain) keeps the\n 2534│ // legacy `next_seq` path; this only arms in resume mode.\n 2535│ // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n │...\n 2556│ match &mut self.conn {\n*2557│ BrainConn::Whole(stream) => write_frame(stream, &env),\n*2558│ BrainConn::Split { send, .. } => write_frame(send, &env),\n 2559│ }\n 2560│ }\n 2561│\n │...\n 2581│ // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n*2582│ fn read_frame_until(&mut self, deadline: Option) -> io::Result {\n 2583│ match &mut self.conn {\n 2584│ // Absent stays absent: no fabricated default bound on the blocking\n 2585│ // read (the absent-is-not-zero shape, releases#201).\n │...\n 2727│ // carriers are indistinguishable at a call site (both a `&mut Brain`), so a\n*2728│ // caller who reaches for the default constructor must be told which one to\n 2729│ // build instead, not merely that this one is wrong.\n 2730│ //\n 2731│ // `brain_with_stub` is the cold-start (Whole) carrier - the default any\n*2732│ // caller reaches for first, and the exact construction that must be refused.\n 2733│ #[test]\n*2734│ fn an_unbounded_carrier_is_refused_and_the_message_names_the_constructor() {\n 2735│ let (brain, _stub) = brain_with_stub();\n 2736│ assert!(\n 2737│ brain.reply_read_deadline().is_none(),\n │...\n 2746│ msg.contains(\"cold_start_pump\"),\n*2747│ \"the refusal must name the constructor that fixes it - a caller should \\\n 2748│ not have to read brain.rs to learn what a bounded carrier is: {msg:?}\"\n 2749│ );\n 2750│ assert!(\n │...\n 2786│ /// the test drives frame-by-frame. NO broker logic, NO PTY, NO network: the\n*2787│ /// stub only completes the hello handshake, DRAINS anything the brain writes\n*2788│ /// (subscribe frames), and writes whatever envelopes the test feeds it. This is\n*2789│ /// the brain's REAL `read_event` / `attach_skip_to_live` dedup state machine\n 2790│ /// exercised end-to-end over the real codec — the cheapest harness that still\n 2791│ /// drives the production paths (the integration tests in `tests/` use a real\n 2792│ /// broker; here we isolate the brain's dedup decision).\n*2793│ struct StubBroker {\n*2794│ /// Push an envelope for the stub to write to the brain.\n 2795│ feed: SyncSender,\n*2796│ /// Server thread handle (drains brain writes + writes fed frames).\n 2797│ _server: JoinHandle<()>,\n 2798│ }\n 2799│\n │...\n 2801│ /// connects (cold_start sends the hello), the stub recv_hello's it, then loops:\n*2802│ /// it owns the server `Stream` and writes any envelope the test feeds via `feed`.\n*2803│ /// (We never need to READ the brain's writes for these tests — the subscribe\n*2804│ /// `attach_skip_to_live` sends is harmlessly left in the OS socket buffer; the\n 2805│ /// frames are tiny. We drop the recv half so it does not hold resources.)\n 2806│ fn brain_with_stub() -> (Brain, StubBroker) {\n 2807│ let name = unique_name();\n │...\n 2818│\n*2819│ // Split: the stub writes fed frames through the send half; the recv half is\n*2820│ // dropped (we never read the brain's subscribe frames — they sit in the\n 2821│ // socket buffer, which is fine for these tiny, low-volume tests).\n 2822│ let (recv, mut send) = server.split();\n 2823│ drop(recv);\n │...\n 2826│ while let Ok(env) = frames.recv() {\n*2827│ if write_frame(&mut send, &env).is_err() {\n 2828│ break;\n 2829│ }\n 2830│ }\n │...\n 2843│ /// `next_seq` reject-gap dedup: it accepts the contiguous seq 0, then REJECTS a\n*2844│ /// forward jump as an `output gap`. This is the behavior `attach_skip_to_live`\n 2845│ /// must FLIP — proving the next test isn't vacuously green.\n 2846│ ///\n 2847│ /// Non-vacuous: if the legacy path ever stopped rejecting forward gaps, this\n │...\n 2878│\n*2879│ /// KEYSTONE — the brain-level primitive the `serve_attach` controller\n 2880│ /// gap-resume (REQ-HAZARD-CONTROLLER-GAP-RESUME) is built on: a CONTROLLER on\n 2881│ /// the strict legacy reject-gap path (empty `session_cursors`) that FATALS a b4\n 2882│ /// drop-don't-block output-gap can RECOVER by re-subscribing from\n │...\n 2885│ /// frames exactly-once. This drives the stub MANUALLY — it does NOT exercise the\n*2886│ /// `read_controller_event_resuming` helper's auto-resubscribe (that is the int\n 2887│ /// test); it pins the primitive that helper relies on.\n 2888│ ///\n 2889│ /// Mutations caught (the resume contract, end to end):\n │...\n 2891│ /// returned anything else (e.g. a stale or off-by-one cursor) the resume\n*2892│ /// re-subscribe would request the wrong seq and the re-fetch (step 3) would\n 2893│ /// either re-gap or dedup-drop the floor frame → RED.\n 2894│ /// - The cursor must NOT advance on a gap: if the legacy reject-gap path\n 2895│ /// advanced `next_seq` past the gap (instead of freezing at `want`), the\n │...\n 2898│ /// - A re-fetch from the floor must be ACCEPTED, not re-rejected: if the\n*2899│ /// re-subscribe left the strict cursor mis-seeded, the replayed floor frame\n 2900│ /// (seq 3) would itself read as a gap or a dup → step 3 RED.\n 2901│ // [unit->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n 2902│ #[test]\n │...\n 2906│\n*2907│ // (1) CONTROLLER attach on the strict legacy path: empty `session_cursors`,"},"isError":false,"timestamp":1789528521605}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_oMD1oEw5Z6kTAKftYrx2mMWJ|fc_00817a6e65e8f156016aaa09d15dd087d19e6fd7fe586be345","toolName":"read","startedAt":"2026-09-16T03:15:29.468Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:367-920"},"intent":"Reading request and serve implementation"},"id":"d122142f","parentId":"96faef35","timestamp":"2026-09-16T03:15:29.468Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_L7j6ipy7F6Bqfa0mPujNvotX|fc_00817a6e65e8f156016aaa09d15de487d1b2d74ffa2618de8e","toolName":"read","startedAt":"2026-09-16T03:15:29.469Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:900-978,1453-1480,2096-2133,2511-2615"},"intent":"Reading brain blocking primitives"},"id":"456f0ebd","parentId":"d122142f","timestamp":"2026-09-16T03:15:29.469Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_pqT6Fn6pjJ7VDcUFJlWRPvme|fc_00817a6e65e8f156016aaa09d15dec87d1b4fc687272b507eb","toolName":"grep","startedAt":"2026-09-16T03:15:29.469Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs"},"intent":"Locating broker handler branches"},"id":"930fbf76","parentId":"456f0ebd","timestamp":"2026-09-16T03:15:29.469Z"}
{"type":"message","id":"501207d1","parentId":"930fbf76","timestamp":"2026-09-16T03:15:29.469Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_oMD1oEw5Z6kTAKftYrx2mMWJ|fc_00817a6e65e8f156016aaa09d15dd087d19e6fd7fe586be345","name":"read","arguments":{"i":"Reading request and serve implementation","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:367-920"},"intent":"Reading request and serve implementation"},{"type":"toolCall","id":"call_L7j6ipy7F6Bqfa0mPujNvotX|fc_00817a6e65e8f156016aaa09d15de487d1b2d74ffa2618de8e","name":"read","arguments":{"i":"Reading brain blocking primitives","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:900-978,1453-1480,2096-2133,2511-2615"},"intent":"Reading brain blocking primitives"},{"type":"toolCall","id":"call_pqT6Fn6pjJ7VDcUFJlWRPvme|fc_00817a6e65e8f156016aaa09d15dec87d1b4fc687272b507eb","name":"grep","arguments":{"i":"Locating broker handler branches","pattern":"KIND_SUBSCRIBE =>|KIND_NET_STREAM_SEND =>|KIND_NET_STREAM_SUBSCRIBE =>|KIND_INPUT =>|KIND_SESSION|fn resolve_subscribe","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating broker handler branches"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":15561,"output":216,"cacheRead":11648,"cacheWrite":0,"totalTokens":27425,"cost":{"input":0.15561000000000003,"output":0.0108,"cacheRead":0.011647999999999999,"cacheWrite":0,"total":0.17805800000000002}},"stopReason":"toolUse","timestamp":1789528521621,"responseId":"resp_00817a6e65e8f156016aaa09c9f6cc87d1af561e9c65b767c7","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09d15dd087d19e6fd7fe586be345","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading request and serve implementation\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:367-920\"}","call_id":"call_oMD1oEw5Z6kTAKftYrx2mMWJ","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09d15de487d1b2d74ffa2618de8e","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading brain blocking primitives\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:900-978,1453-1480,2096-2133,2511-2615\"}","call_id":"call_L7j6ipy7F6Bqfa0mPujNvotX","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09d15dec87d1b4fc687272b507eb","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating broker handler branches\",\"pattern\":\"KIND_SUBSCRIBE =>|KIND_NET_STREAM_SEND =>|KIND_NET_STREAM_SUBSCRIBE =>|KIND_INPUT =>|KIND_SESSION|fn resolve_subscribe\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_pqT6Fn6pjJ7VDcUFJlWRPvme","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":7842.836600000039,"ttft":7781.892799999565,"completedAt":1789528529464,"contextSnapshot":{"promptTokens":27209,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"5bea46d6","parentId":"501207d1","timestamp":"2026-09-16T03:15:29.501Z","message":{"role":"toolResult","toolCallId":"call_pqT6Fn6pjJ7VDcUFJlWRPvme|fc_00817a6e65e8f156016aaa09d15dec87d1b4fc687272b507eb","toolName":"grep","content":[{"type":"text","text":" 71| KIND_NET_STREAM_UNSUBSCRIBE, KIND_NET_STREAM_UNSUBSCRIBED,\n*72| KIND_MET_MEMBER, KIND_PAIR_CODE_SUBMIT, KIND_PAIR_JOIN, KIND_PAIR_JOINED, KIND_PAIR_MEET, KIND_RESIZE, KIND_SESSIONS, KIND_SESSIONS_REPLY, KIND_SPAWN,\n 73| BringUpReq, BroughtUpReply, BRING_UP_ADMITTED, BRING_UP_ADMIT_PREFIX, BRING_UP_ALREADY_LIVE, BRING_UP_REFUSED, KIND_BRING_UP, KIND_BROUGHT_UP,\n 74| SealCeremonyReq, SealCeremonyReply, SealCeremonyOpenEvent, SealCeremonyCodeReq, SealCeremonyResultEvent,\n 75| KIND_SEAL_CEREMONY, KIND_SEAL_CEREMONY_REPLY, KIND_SEAL_CEREMONY_OPEN, KIND_SEAL_CEREMONY_CODE, KIND_SEAL_CEREMONY_RESULT,\n...\n 211|/// write — the brain subscriber suspended / black-holed — before a take/reattach\n*212|/// or the `KIND_SESSIONS` reap stall-evicts it (LIFECYCLE-TRUTH W2,\n 213|/// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE). Distinct from and 3× longer than\n 214|/// [`CONTROLLER_WRITE_DEADLINE`] on PURPOSE (doyle ruling Q1): that 5 s bound\n 215|/// protects the fan-out against ONE per-client conn falling behind and is\n...\n 469|/// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\n*470|/// KIND_SESSIONS reply use the additive `SessionInfo` fields, so the CLI\n 471|/// preflight and the broker gate consult the SAME authority.\n 472|/// PURE resolution of the two liveness probes for [`session_is_zombie`], so the\n 473|/// NO-SNAPSHOT arm is unit-testable WITHOUT a platform that lacks a process\n...\n 1042| /// **survives `detach_if`** — a dead brain leaves its resume point behind, and\n*1043| /// a cold-starting brain reads it (via `KIND_SESSIONS` → `resume_seq`) instead\n 1044| /// of replaying the whole ring from 0. **Viewer writes NEVER move it**\n 1045| /// (REQ-RCVIEW-1: the brain-resume cursor tracks the controller only).\n 1046| ///\n...\n 1146|/// no-session truth (the exit-waiter reap) BUMPS, and a poll-derived stamp\n*1147|/// write VALIDATES against — so a `KIND_SESSIONS` snapshot taken PRE-reap can\n 1148|/// never relatch `controlled=true` after the reap cleared it (the session is\n 1149|/// gone; no later poll would ever heal the latch). The `write` mutex\n 1150|/// serializes the validate-then-write pair against the bump-then-clear pair —\n...\n 1178|/// `controlled:false` and no later edge re-stamps, so the endpoint reads uncontrolled\n*1179|/// forever while driven. This DIVERGENCE-GATED re-assert (on the `KIND_SESSIONS` poll,\n 1180|/// bounded by the reconcile cadence) writes ONLY on a real difference — no fsync storm.\n 1181|/// Best-effort: an unbound / corrupt / perch-less endpoint has nowhere to converge yet.\n 1182|///\n...\n 2780| /// THREAD has EXITED — the record-vs-truth honesty step, run on the authoritative\n*2781| /// `KIND_SESSIONS` poll BEFORE `controller_by`/`has_controller` are read. The\n 2782| /// writer exits when a socket write fails (a severed / keepalive-killed controller\n 2783| /// conn) or its `tx` drops; while it is parked on `rx.recv()` (a LIVE but idle\n 2784| /// controller) it is NOT finished, so a live controller is never touched (the\n...\n 2816| // writer is BLOCKED (not exited) on a suspended brain conn past\n*2817| // BRAIN_WRITE_DEADLINE is also reaped here, so the honest `KIND_SESSIONS`\n 2818| // truth + the off-lock converge_perch_stamps release its stale `driven_by`\n 2819| // stamp even when nobody take/reattaches. Deferred stamp: the reap runs in\n 2820| // the multi-session snapshot closure (no I/O under the shared sessions lock).\n...\n 2868| /// the tally surfaces on `daemon status`). The take/reattach path and the\n*2869| /// `KIND_SESSIONS` reap call this so a suspended brain subscriber can never hold\n 2870| /// control on an idle session (the output-driven [`mark_controller_gone`] never\n 2871| /// fires without new output). Returns true iff it evicted. `stamp` selects whether\n 2872| /// the perch re-stamp happens inline (the take/reattach path, which already stamps\n...\n 2982| #[cfg(test)]\n*2983| fn resolve_subscribe(\n 2984| &mut self,\n 2985| sub: SharedSend,\n 2986| from_seq: u64,\n...\n 2999| #[allow(clippy::too_many_arguments)]\n*3000| fn resolve_subscribe_gated(\n 3001| &mut self,\n 3002| sub: SharedSend,\n 3003| from_seq: u64,\n...\n 3082| #[cfg(test)]\n*3083| fn resolve_subscribe_inner(\n 3084| &mut self,\n 3085| sub: SharedSend,\n 3086| from_seq: u64,\n...\n 3115| #[allow(clippy::too_many_arguments)]\n*3116| fn resolve_subscribe_inner_gated(\n 3117| &mut self,\n 3118| sub: SharedSend,\n 3119| from_seq: u64,\n...\n 3411| /// * controller Disconnected: the writer is already gone — the next append\n*3412| /// or the KIND_SESSIONS liveness reap detaches the row, unchanged.\n 3413| ///\n 3414| /// `last_ok` is re-armed here regardless of outcome: the suppressed window\n 3415| /// attempted no handoff, so its width must never count toward the\n...\n 3691| // the endpoint's stamp generation UNDER the stamp-write serial, then\n*3692| // clear. A KIND_SESSIONS poll that snapshotted this session PRE-reap now\n 3693| // fails its generation check and can never relatch `controlled=true`\n 3694| // onto the perch of a session that no longer exists (the emphasys C3\n 3695| // poll-vs-reap window: no later poll would ever heal the latch).\n...\n 3744| /// The next seq a re-attaching controller still needs (the persisted resume\n*3745| /// cursor surfaced in `KIND_SESSIONS` → `resume_seq`). W1: read from the\n 3746| /// atomic the controller writer thread advances.\n 3747| fn delivered_through(&self) -> u64 {\n 3748| self.delivered_through.load(Ordering::Acquire)\n...\n 5833| /// drains through the REAL logical paths (a take's `stall_evict_controller`\n*5834| /// or a `KIND_SESSIONS` reap), exactly like a production stall-evict.\n 5835| /// Returns false if the session doesn't exist or the seed can't be built.\n 5836| /// `#[doc(hidden)]` — test support, not a product surface.\n 5837| // [impl->REQ-UPDATE-PROMOTE-DRAINED]\n...\n 5999| /// closed old conn is simply absent → `false` at once (the normal fast promote).\n*6000| /// Follows the established sessions→log lock order (KIND_SESSIONS reap); reads\n 6001| /// only `write_blocked_since` under each log lock, never any I/O.\n 6002| // [impl->REQ-UPDATE-PROMOTE-DRAINED]\n 6003| pub fn any_local_controller_wedged(&self) -> bool {\n...\n 6147| }\n*6148| KIND_SUBSCRIBE => match self.dispatch_subscribe(env, &send) {\n 6149| Ok(id) => my_subs.push(id),\n 6150| Err(msg) => send_error(&send, &msg),\n 6151| },\n...\n 6156| }\n*6157| KIND_INPUT => {\n 6158| if let Err(msg) = self.dispatch_input(env, &send) {\n 6159| send_error(&send, &msg);\n 6160| }\n...\n 6233| },\n*6234| KIND_NET_STREAM_SEND => {\n 6235| if let Err(msg) = self.dispatch_net_stream_send(env, &send) {\n 6236| send_error(&send, &msg);\n 6237| }\n...\n 6262| }\n*6263| KIND_SESSIONS => {\n 6264| // Clone the row facts out from under the sessions lock, then\n 6265| // read each log's cursor under the log lock alone — never\n 6266| // both locks at once (the dispatch_subscribe discipline).\n...\n 6376| let frame = Envelope::new(\n*6377| KIND_SESSIONS_REPLY,\n 6378| serde_json::to_value(reply).expect(\"SessionsReply serializes\"),\n 6379| );\n 6380| send_frame(&send, &frame);\n...\n 6399| }\n*6400| KIND_NET_STREAM_SUBSCRIBE => match self.dispatch_net_stream_subscribe(env, &send) {\n 6401| Ok(id) => my_stream_subs.push(id),\n 6402| Err(msg) => send_error(&send, &msg),\n 6403| },\n...\n 8550| // Reap the dead session from the table FIRST (ADR-0041 decision 4\n*8551| // ordering): once removed, no NEW KIND_SESSIONS snapshot can see\n 8552| // this session at all. Clearing before removal left a window where\n 8553| // a poll snapshotted AFTER the generation bump — same generation,\n 8554| // controller slot still occupied in the log — and legitimately\n...\n 11832| // Resume from the cursor-of-record, exactly as a cold-starting brain does\n*11833| // (KIND_SESSIONS resume_seq = delivered_through).\n 11834| let (send2, mut client2, _recv2) = controller_socket_pair();\n 11835| let resume_from = log.delivered_through.load(Ordering::Acquire);\n 11836| log.become_controller(Arc::clone(&send2), None, resume_from, 0);\n...\n 13112|\n*13113| // [unit->REQ-CONTROLLER-LIVENESS-REAP] B-2: the KIND_SESSIONS lazy-reap clears a\n 13114| // controller whose WRITER THREAD has EXITED (a severed / keepalive-killed conn\n 13115| // whose writer failed a write, or a detach dropped by a prior B-1 poison wedge) —\n 13116| // so `controller_by`/`has_controller` report honest truth and the existing\n...\n 13442|\n*13443| // [unit->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE] the KIND_SESSIONS reap catches a\n 13444| // BLOCKED (not exited) writer too: a controller whose writer is parked-but-wedged\n 13445| // past the deadline is reaped so the off-lock converge clears its stale driven_by\n 13446| // even when nobody take/reattaches. Pre-W2 reap only caught an EXITED writer, so a"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\broker.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":28,"fileCount":1,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","count":28}],"truncated":false,"displayContent":" 71│ KIND_NET_STREAM_UNSUBSCRIBE, KIND_NET_STREAM_UNSUBSCRIBED,\n *72│ KIND_MET_MEMBER, KIND_PAIR_CODE_SUBMIT, KIND_PAIR_JOIN, KIND_PAIR_JOINED, KIND_PAIR_MEET, KIND_RESIZE, KIND_SESSIONS, KIND_SESSIONS_REPLY, KIND_SPAWN,\n 73│ BringUpReq, BroughtUpReply, BRING_UP_ADMITTED, BRING_UP_ADMIT_PREFIX, BRING_UP_ALREADY_LIVE, BRING_UP_REFUSED, KIND_BRING_UP, KIND_BROUGHT_UP,\n 74│ SealCeremonyReq, SealCeremonyReply, SealCeremonyOpenEvent, SealCeremonyCodeReq, SealCeremonyResultEvent,\n 75│ KIND_SEAL_CEREMONY, KIND_SEAL_CEREMONY_REPLY, KIND_SEAL_CEREMONY_OPEN, KIND_SEAL_CEREMONY_CODE, KIND_SEAL_CEREMONY_RESULT,\n │...\n 211│/// write — the brain subscriber suspended / black-holed — before a take/reattach\n *212│/// or the `KIND_SESSIONS` reap stall-evicts it (LIFECYCLE-TRUTH W2,\n 213│/// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE). Distinct from and 3× longer than\n 214│/// [`CONTROLLER_WRITE_DEADLINE`] on PURPOSE (doyle ruling Q1): that 5 s bound\n 215│/// protects the fan-out against ONE per-client conn falling behind and is\n │...\n 469│/// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\n *470│/// KIND_SESSIONS reply use the additive `SessionInfo` fields, so the CLI\n 471│/// preflight and the broker gate consult the SAME authority.\n 472│/// PURE resolution of the two liveness probes for [`session_is_zombie`], so the\n 473│/// NO-SNAPSHOT arm is unit-testable WITHOUT a platform that lacks a process\n │...\n 1042│ /// **survives `detach_if`** — a dead brain leaves its resume point behind, and\n *1043│ /// a cold-starting brain reads it (via `KIND_SESSIONS` → `resume_seq`) instead\n 1044│ /// of replaying the whole ring from 0. **Viewer writes NEVER move it**\n 1045│ /// (REQ-RCVIEW-1: the brain-resume cursor tracks the controller only).\n 1046│ ///\n │...\n 1146│/// no-session truth (the exit-waiter reap) BUMPS, and a poll-derived stamp\n *1147│/// write VALIDATES against — so a `KIND_SESSIONS` snapshot taken PRE-reap can\n 1148│/// never relatch `controlled=true` after the reap cleared it (the session is\n 1149│/// gone; no later poll would ever heal the latch). The `write` mutex\n 1150│/// serializes the validate-then-write pair against the bump-then-clear pair —\n │...\n 1178│/// `controlled:false` and no later edge re-stamps, so the endpoint reads uncontrolled\n *1179│/// forever while driven. This DIVERGENCE-GATED re-assert (on the `KIND_SESSIONS` poll,\n 1180│/// bounded by the reconcile cadence) writes ONLY on a real difference — no fsync storm.\n 1181│/// Best-effort: an unbound / corrupt / perch-less endpoint has nowhere to converge yet.\n 1182│///\n │...\n 2780│ /// THREAD has EXITED — the record-vs-truth honesty step, run on the authoritative\n *2781│ /// `KIND_SESSIONS` poll BEFORE `controller_by`/`has_controller` are read. The\n 2782│ /// writer exits when a socket write fails (a severed / keepalive-killed controller\n 2783│ /// conn) or its `tx` drops; while it is parked on `rx.recv()` (a LIVE but idle\n 2784│ /// controller) it is NOT finished, so a live controller is never touched (the\n │...\n 2816│ // writer is BLOCKED (not exited) on a suspended brain conn past\n *2817│ // BRAIN_WRITE_DEADLINE is also reaped here, so the honest `KIND_SESSIONS`\n 2818│ // truth + the off-lock converge_perch_stamps release its stale `driven_by`\n 2819│ // stamp even when nobody take/reattaches. Deferred stamp: the reap runs in\n 2820│ // the multi-session snapshot closure (no I/O under the shared sessions lock).\n │...\n 2868│ /// the tally surfaces on `daemon status`). The take/reattach path and the\n *2869│ /// `KIND_SESSIONS` reap call this so a suspended brain subscriber can never hold\n 2870│ /// control on an idle session (the output-driven [`mark_controller_gone`] never\n 2871│ /// fires without new output). Returns true iff it evicted. `stamp` selects whether\n 2872│ /// the perch re-stamp happens inline (the take/reattach path, which already stamps\n │...\n 2982│ #[cfg(test)]\n *2983│ fn resolve_subscribe(\n 2984│ &mut self,\n 2985│ sub: SharedSend,\n 2986│ from_seq: u64,\n │...\n 2999│ #[allow(clippy::too_many_arguments)]\n *3000│ fn resolve_subscribe_gated(\n 3001│ &mut self,\n 3002│ sub: SharedSend,\n 3003│ from_seq: u64,\n │...\n 3082│ #[cfg(test)]\n *3083│ fn resolve_subscribe_inner(\n 3084│ &mut self,\n 3085│ sub: SharedSend,\n 3086│ from_seq: u64,\n │...\n 3115│ #[allow(clippy::too_many_arguments)]\n *3116│ fn resolve_subscribe_inner_gated(\n 3117│ &mut self,\n 3118│ sub: SharedSend,\n 3119│ from_seq: u64,\n │...\n 3411│ /// * controller Disconnected: the writer is already gone — the next append\n *3412│ /// or the KIND_SESSIONS liveness reap detaches the row, unchanged.\n 3413│ ///\n 3414│ /// `last_ok` is re-armed here regardless of outcome: the suppressed window\n 3415│ /// attempted no handoff, so its width must never count toward the\n │...\n 3691│ // the endpoint's stamp generation UNDER the stamp-write serial, then\n *3692│ // clear. A KIND_SESSIONS poll that snapshotted this session PRE-reap now\n 3693│ // fails its generation check and can never relatch `controlled=true`\n 3694│ // onto the perch of a session that no longer exists (the emphasys C3\n 3695│ // poll-vs-reap window: no later poll would ever heal the latch).\n │...\n 3744│ /// The next seq a re-attaching controller still needs (the persisted resume\n *3745│ /// cursor surfaced in `KIND_SESSIONS` → `resume_seq`). W1: read from the\n 3746│ /// atomic the controller writer thread advances.\n 3747│ fn delivered_through(&self) -> u64 {\n 3748│ self.delivered_through.load(Ordering::Acquire)\n │...\n 5833│ /// drains through the REAL logical paths (a take's `stall_evict_controller`\n *5834│ /// or a `KIND_SESSIONS` reap), exactly like a production stall-evict.\n 5835│ /// Returns false if the session doesn't exist or the seed can't be built.\n 5836│ /// `#[doc(hidden)]` — test support, not a product surface.\n 5837│ // [impl->REQ-UPDATE-PROMOTE-DRAINED]\n │...\n 5999│ /// closed old conn is simply absent → `false` at once (the normal fast promote).\n *6000│ /// Follows the established sessions→log lock order (KIND_SESSIONS reap); reads\n 6001│ /// only `write_blocked_since` under each log lock, never any I/O.\n 6002│ // [impl->REQ-UPDATE-PROMOTE-DRAINED]\n 6003│ pub fn any_local_controller_wedged(&self) -> bool {\n │...\n 6147│ }\n *6148│ KIND_SUBSCRIBE => match self.dispatch_subscribe(env, &send) {\n 6149│ Ok(id) => my_subs.push(id),\n 6150│ Err(msg) => send_error(&send, &msg),\n 6151│ },\n │...\n 6156│ }\n *6157│ KIND_INPUT => {\n 6158│ if let Err(msg) = self.dispatch_input(env, &send) {\n 6159│ send_error(&send, &msg);\n 6160│ }\n │...\n 6233│ },\n *6234│ KIND_NET_STREAM_SEND => {\n 6235│ if let Err(msg) = self.dispatch_net_stream_send(env, &send) {\n 6236│ send_error(&send, &msg);\n 6237│ }\n │...\n 6262│ }\n *6263│ KIND_SESSIONS => {\n 6264│ // Clone the row facts out from under the sessions lock, then\n 6265│ // read each log's cursor under the log lock alone — never\n 6266│ // both locks at once (the dispatch_subscribe discipline).\n │...\n 6376│ let frame = Envelope::new(\n *6377│ KIND_SESSIONS_REPLY,\n 6378│ serde_json::to_value(reply).expect(\"SessionsReply serializes\"),\n 6379│ );\n 6380│ send_frame(&send, &frame);\n │...\n 6399│ }\n *6400│ KIND_NET_STREAM_SUBSCRIBE => match self.dispatch_net_stream_subscribe(env, &send) {\n 6401│ Ok(id) => my_stream_subs.push(id),\n 6402│ Err(msg) => send_error(&send, &msg),\n 6403│ },\n │...\n 8550│ // Reap the dead session from the table FIRST (ADR-0041 decision 4\n *8551│ // ordering): once removed, no NEW KIND_SESSIONS snapshot can see\n 8552│ // this session at all. Clearing before removal left a window where\n 8553│ // a poll snapshotted AFTER the generation bump — same generation,\n 8554│ // controller slot still occupied in the log — and legitimately\n │...\n 11832│ // Resume from the cursor-of-record, exactly as a cold-starting brain does\n*11833│ // (KIND_SESSIONS resume_seq = delivered_through).\n 11834│ let (send2, mut client2, _recv2) = controller_socket_pair();\n 11835│ let resume_from = log.delivered_through.load(Ordering::Acquire);\n 11836│ log.become_controller(Arc::clone(&send2), None, resume_from, 0);\n │...\n 13112│\n*13113│ // [unit->REQ-CONTROLLER-LIVENESS-REAP] B-2: the KIND_SESSIONS lazy-reap clears a\n 13114│ // controller whose WRITER THREAD has EXITED (a severed / keepalive-killed conn\n 13115│ // whose writer failed a write, or a detach dropped by a prior B-1 poison wedge) —\n 13116│ // so `controller_by`/`has_controller` report honest truth and the existing\n │...\n 13442│\n*13443│ // [unit->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE] the KIND_SESSIONS reap catches a\n 13444│ // BLOCKED (not exited) writer too: a controller whose writer is parked-but-wedged\n 13445│ // past the deadline is reaped so the off-lock converge clears its stale driven_by\n 13446│ // even when nobody take/reattaches. Pre-W2 reap only caught an EXITED writer, so a"},"isError":false,"timestamp":1789528529500}}
{"type":"message","id":"7f2e7781","parentId":"5bea46d6","timestamp":"2026-09-16T03:15:29.538Z","message":{"role":"toolResult","toolCallId":"call_oMD1oEw5Z6kTAKftYrx2mMWJ|fc_00817a6e65e8f156016aaa09d15dd087d19e6fd7fe586be345","toolName":"read","content":[{"type":"text","text":"#[allow(clippy::too_many_arguments)]\nfn handle_attach_request(\n brain: &mut Brain,\n wire: &mut Brain,\n stream_id: u64,\n endpoint: &str,\n origin_node: &str,\n remote_session: Option,\n session_id: u64,\n from_seq: u64,\n req_intent: AttachIntent,\n req_gen: u64,\n req_code: Option,\n req_seal_ceremony: bool,\n intent: &mut AttachIntent,\n attached_session: &mut Option,\n attached: &mut bool,\n serve_gen: &mut u64,\n) -> io::Result> {\n if access_check(\n endpoint,\n origin_node,\n attach_surface(req_intent),\n InboundClass::Unsolicited,\n )\n .is_deny()\n {\n wire.net_stream_send(stream_id, &[], None, true)?;\n return Ok(Some(AttachServeOutcome::Refused));\n }\n let sid = remote_session.unwrap_or(session_id);\n *intent = req_intent;\n *attached_session = Some(sid);\n // The DISPATCHED intent, read off the same binding the arms below branch on —\n // the arm IS the decision, so logging `req_intent` here names it once for both\n // arms rather than twice inside them. Wildcard-free: a new `AttachIntent`\n // variant must fail to compile rather than log as one of today's three.\n let intent_lbl = match req_intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // Daemon stderr sink, joinable to the broker's SUBSCRIBE_DECISION on `session`.\n // ids/counters only — never PTY bytes, and never the bring-up code, which is a\n // secret riding the same request.\n spt_proto::emit_line_err!(\n \"ATTACH_INTENT_CHOSEN: site=serve_dispatch session={sid} intent={intent_lbl} \\\n from_seq={from_seq} gen={req_gen} coded={}\",\n req_code.is_some()\n );\n if req_intent == AttachIntent::Viewer {\n brain.attach_as_viewer_snap(sid, from_seq, Some(origin_node))?;\n } else {\n // The bring-up code rides the driving attach only: a viewer never takes\n // controls, so there is nothing for a code to buy on that path.\n // [impl->REQ-ER-BRINGUP-TOTP-GATE]\n brain.attach_as_coded(\n sid,\n from_seq,\n req_intent,\n req_gen,\n Some(origin_node),\n req_code.as_deref(),\n // The W2 seal-ceremony capability the CLIENT declared, recorded on\n // the controller seat so a mint knows whether this viewport can\n // host the overlay (REQ-SEAL-NO-CEREMONY-SURFACE).\n req_seal_ceremony,\n )?;\n *serve_gen = req_gen;\n }\n *attached = true;\n Ok(None)\n}\n\n/// Serve one attach stream against this brain's broker, blocking until the\n/// session exits, the operator detaches, or the gate refuses.\n///\n/// `origin_node` MUST be the handshake-proven remote id from the broker's\n/// stream table (`NetStreamInfo::remote_id_hex`) — never payload bytes\n/// (REQ-HAZARD-WAN-ORIGIN-AUTH). `endpoint` names the endpoint whose session\n/// is being attached, for the gate. `net_from_seq` is this brain's resume\n/// cursor on the attach stream (0 cold — also the safe post-restart choice:\n/// the replayed `Request`/`Input` records re-gate and dedup at the PTY\n/// journal, and re-pumped output dedups at the operator's render cursor).\n///\n/// `remote_session` is `Some(sid)` ONLY on the cross-node leg (#4,\n/// REQ-RC-CROSS-NODE-ATTACH): the dispatcher has ALREADY resolved endpoint→our\n/// session id ([`resolve_local_session`]) BEFORE this serve loop subscribed, so\n/// the wire's placeholder `session_id` (0) is overridden here with the resolved\n/// id. It is passed down — never re-queried mid-loop — because a `sessions()`\n/// round-trip inside the event loop would swallow interleaved attach records\n/// (`Input`/`Subscribed`) the loop must see. `None` = the local path, which uses\n/// the wire `session_id`.\n///\n/// `seed_request` is the broker-pinned opener Request (ADR-0038 B): after the\n/// bounded ring rolls, the wire replay no longer carries the stream's Request\n/// record — a reconstruction that waited for one would idle forever. The\n/// dispatcher hands the durable opener here and it is handled EXACTLY like a\n/// wire-arriving Request (same gate, same subscribe); a Request that then\n/// replays from the ring anyway re-runs the same-identity re-take, which is\n/// silent and idempotent (the successor-re-take parity the fix must keep).\n// [impl->REQ-INST-8]\n// [impl->REQ-HAZARD-WAN-ORIGIN-AUTH]\n// [impl->REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT]\n// [impl->REQ-RC-CROSS-NODE-ATTACH]\n// [impl->REQ-STREAM-OPENER-DURABLE]\n#[allow(clippy::too_many_arguments)]\npub fn serve_attach(\n brain: &mut Brain,\n broker_name: &str,\n stream_id: u64,\n endpoint: &str,\n origin_node: &str,\n net_from_seq: u64,\n remote_session: Option,\n seed_request: Option,\n) -> io::Result {\n brain.net_stream_subscribe(stream_id, net_from_seq)?;\n // TWO-CONN SPLIT (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT): the wire FORWARDS\n // (session Output / Size / Exit / Displaced / detach-finish onto the operator\n // stream) ride a SEPARATE broker connection from `brain`. `brain` RECEIVES\n // session output (broker→serve) — including the controller's synchronous,\n // inline, multi-frame ring replay (`become_controller`), which holds the\n // broker's single-threaded per-conn handler for the whole replay. If the\n // forwards rode `brain` too, that stuck handler could not read them →\n // serve→broker backs up while broker→serve replay backs up → mutual IPC\n // backpressure DEADLOCK, and the operator receives ZERO bytes (the bug: an\n // attach to an ALREADY-PRODUCING endpoint-run harness, non-empty ring). The\n // two directions on independent single-threaded handlers cannot block each\n // other. `send_stream` is stream_id-keyed (conn-agnostic), so forwarding from\n // a second conn is correct. Order is preserved: this one serve thread reads\n // every Output in seq order on `brain` and forwards it in that same order on\n // `wire`. (DEEPER ROOT, post-v0.12.1 follow-up: the CONTROLLER replay is a\n // SYNCHRONOUS inline write, while VIEWERS use the async dedicated-writer-\n // thread + bounded-channel pattern (`add_viewer`/`viewer_writer`); unifying\n // the controller onto that async path would remove the inline-replay block at\n // the source, but it touches the authoritative cursor-advancing path.)\n let mut wire = Brain::cold_start(broker_name, now_ms())?;\n let mut decoder = AttachDecoder::new();\n let mut attached = false;\n // The Request's intent — gates wire input (a viewer's keystrokes never reach\n // the PTY) independent of the broker's later role reply (no IPC-ordering\n // race on the input gate).\n let mut intent = AttachIntent::Control;\n // The broker-confirmed role (arrives as `Subscribed`). `None` until then:\n // controller input that races ahead of the reply is BUFFERED, not dropped\n // (the replayed-input-after-restart case) and not leaked to the PTY before\n // we know we control the session (the busy-refuse case).\n let mut role: Option = None;\n let mut pending_input: Vec<(u64, Vec)> = Vec::new();\n // Temporary W2b discriminator: paired boundaries, never payload contents.\n let w2b_trace = std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\");\n macro_rules! w2b_probe {\n ($label:literal, $call:expr) => {{\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter={}\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n pending_input.len(), $label);\n }\n let result = $call;\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit={}\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n pending_input.len(), $label);\n }\n result\n }};\n }\n // The attached session — captured from the Request so the terminal paths can\n // explicitly release this worker's role (clearing driven_by / viewer_count\n // promptly, not only on connection drop).\n let mut attached_session: Option = None;\n // This worker's attach GENERATION (ADR-0038 Amendment fix 6) — set when\n // its Request lands; every terminal release carries it so a STALE worker\n // (an older generation) can never clear a replacement controller.\n let mut serve_gen: u64 = 0;\n // Recovered from the pinned Request, not from the serving daemon's version.\n // [impl->REQ-ATTACH-CLIENT-STALE]\n let mut client_identity = None;\n // Last skip-to-live re-subscribe (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT): bounds the\n // evict→resubscribe rate so a hopelessly-behind viewer under flood sees\n // intermittent live bursts, never a CPU spin.\n let mut last_resubscribe: Option = None;\n\n // Durable-opener seed (ADR-0038 B): process the dispatcher-pinned Request\n // BEFORE the event loop, through the exact wire-Request path — a rolled\n // ring can no longer replay it. Non-Request seeds are ignored (the opener\n // of an attach stream is always its Request).\n if let Some(AttachRecord::Request {\n session_id,\n from_seq,\n intent: req_intent,\n endpoint_id: _,\n gen: req_gen,\n code: req_code,\n seal_ceremony: req_seal_ceremony,\n client,\n }) = seed_request\n {\n if let Some(out) = w2b_probe!(\"seed_request\", handle_attach_request(\n brain,\n &mut wire,\n stream_id,\n endpoint,\n origin_node,\n remote_session,\n session_id,\n from_seq,\n req_intent,\n req_gen,\n req_code,\n req_seal_ceremony,\n &mut intent,\n &mut attached_session,\n &mut attached,\n &mut serve_gen,\n ))? {\n return Ok(out);\n }\n client_identity = client;\n }\n\n // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n // Stream lifetime is subscriber-owned; any silence bound belongs per read, not per call.\n let deadline: Option = None;\n loop {\n // The CONTROLLER resumes-from-floor on a b4 drop-don't-block output-gap\n // (RE-FETCH from delivered_through, NOT snap — B2: a controller is\n // authoritative). A VIEWER never reaches the reject-gap (its serve-brain is\n // snap-above armed at attach, REQ-HAZARD-VIEWER-RING-ROLL-SNAP). Before a\n // role resolves no Output flows, so a plain read is correct then.\n // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n let event = w2b_probe!(\"read_event\", match (role, attached_session) {\n (Some(ServeRole::Controller), Some(sid)) => {\n match read_controller_event_resuming(brain, sid, serve_gen, Some(origin_node)) {\n Ok(ev) => ev,\n Err(e)\n if e.get_ref()\n .is_some_and(|inner| inner.is::()) =>\n {\n // Irrecoverable: the dropped frames rolled out of the ring.\n // SURFACE a marked truncation to the operator (never a\n // silent skip = B2 lie, never a spin), then end cleanly.\n // Graceful continuation is deferred\n // (REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND).\n let notice =\n b\"\\r\\n[spt: output truncated -- controller fell behind the live ring, frames lost]\\r\\n\";\n let line = ndjson::encode_line(&AttachRecord::Output {\n seq: brain.controller_resume_floor(),\n data_b64: encode_bytes(notice),\n });\n let _ = wire.net_stream_send(stream_id, &line, None, true);\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n return Err(e);\n }\n Err(e) => {\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n return Err(e);\n }\n }\n }\n _ => brain.read_event_until(deadline)?,\n });\n if w2b_trace {\n let kind = match &event {\n BrokerEvent::NetStreamData { .. } => \"NetStreamData\",\n BrokerEvent::Subscribed { .. } => \"Subscribed\",\n BrokerEvent::Output { .. } => \"Output\",\n BrokerEvent::Applied { .. } => \"Applied\",\n _ => \"Other\",\n };\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} event={} role={:?}\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\n pending_input.len(), kind, role);\n }\n match event {\n // ── Wire → session: requests, input, resize. ───────────────────\n BrokerEvent::NetStreamData {\n stream_id: sid,\n bytes,\n ..\n } if sid == stream_id => {\n for rec in decoder.push(&bytes) {\n match rec {\n AttachRecord::Request {\n session_id,\n from_seq,\n intent: req_intent,\n // The dispatcher already resolved endpoint_id→session\n // (passed as remote_session) BEFORE this loop; ignore\n // the wire copy here (a mid-loop re-resolve would swallow\n // interleaved attach records — see remote_session docs).\n endpoint_id: _,\n gen: req_gen,\n code: req_code,\n seal_ceremony: req_seal_ceremony,\n client,\n } => {\n if let Some(out) = w2b_probe!(\"replayed_request\", handle_attach_request(\n brain,\n &mut wire,\n stream_id,\n endpoint,\n origin_node,\n remote_session,\n session_id,\n from_seq,\n req_intent,\n req_gen,\n req_code,\n req_seal_ceremony,\n &mut intent,\n &mut attached_session,\n &mut attached,\n &mut serve_gen,\n ))? {\n return Ok(out);\n }\n client_identity = client;\n }\n AttachRecord::Input { data_b64, op_id }\n if attached && intent != AttachIntent::Viewer =>\n {\n let bytes = decode_bytes(&data_b64)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n match role {\n // Confirmed controller — exactly-once at the PTY\n // (the operator-minted id rides the B5 journal). NO-ACK\n // (REQ-HAZARD-INPUT-ACK-BACKPRESSURE): this path is\n // fire-and-forward (the ack is discarded here) and can\n // flood N input frames on this one conn; an acked write\n // back would fill the return direction and deadlock the\n // broker's per-conn handler. Dedup still holds at the\n // broker (op_id applied-set).\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n Some(ServeRole::Controller) => {\n // The op_id is operator-minted (rc attach OpMinter),\n // so it carries the `rc` journal tag (ADR-0034).\n w2b_probe!(\"live_input\", brain.send_effect_no_ack(\n MintedOp::new(Minter::Rc, op_id),\n &bytes,\n ))?\n }\n // Outcome not yet known — buffer; flushed on a\n // controller confirmation, discarded on busy/viewer.\n None => pending_input.push((op_id, bytes)),\n // A viewer never reaches here (intent gate).\n Some(ServeRole::Viewer) => {}\n }\n }\n AttachRecord::Resize { rows, cols }\n if attached && intent != AttachIntent::Viewer =>\n {\n // Controller → PTY resize (controller-EXCLUSIVE; the\n // broker rejects it on a viewer's stream). A viewer's\n // Resize is dropped here by the intent gate too.\n let _ = brain.resize(rows, cols);\n }\n // The ceremony presentation from the controller's\n // overlay (WAX-SEAL W2): the PRESENTED CODE, never a\n // verdict — forwarded to the broker, which decides\n // everything. Controller-only (the intent gate): a\n // viewer has no overlay to answer from.\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n AttachRecord::SealCeremonyCode {\n ceremony_id,\n code,\n signature_hex,\n enroll_pubkey_hex,\n enroll_backend_kind,\n } if attached && intent != AttachIntent::Viewer => {\n // The SIGNET W2 additive fields — a FIDO2 proof\n // or `E` enroll facts — forward VERBATIM: still\n // never a verdict, the broker decides everything.\n // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n let facts = enroll_pubkey_hex\n .as_deref()\n .zip(enroll_backend_kind.as_deref());\n brain.seal_ceremony_code(\n ceremony_id,\n code.as_deref(),\n signature_hex.as_deref(),\n facts,\n )?;\n }\n AttachRecord::InputPathsReply { reply }\n if attached && role == Some(ServeRole::Controller) =>\n {\n brain.complete_input_paths(&reply)?;\n }\n // Input/Resize before Request, a viewer's input/resize,\n // or target-direction records echoed back: noise — ignore.\n _ => {}\n }\n }\n }\n\n // ── Broker → loop: the resolved controller/viewer role. ─────────\n BrokerEvent::Subscribed { outcome, note, .. } => {\n use crate::msg::SubscribeOutcome as O;\n match outcome {\n O::Controller | O::TookControl => {\n role = Some(ServeRole::Controller);\n // Relay the broker's seat sentence to the human before\n // any session output, so the grant is read as a fact\n // about the attach and not as something the session\n // said. Controller-only: a viewer took no seat, and a\n // refused attach gets its own refusal path.\n // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\n if let Some(text) = note {\n let line = ndjson::encode_line(&AttachRecord::Notice { text });\n w2b_probe!(\"seat_notice\", wire.net_stream_send(stream_id, &line, None, false))?;\n }\n // A driver attached — the wake edge (controller-only;\n // idempotent on an already-active seat).\n w2b_probe!(\"wake\", feed_rest(endpoint, crate::resting::RestEvent::Wake));\n // Flush any input that raced ahead of the reply (operator-\n // minted ops carry the `rc` tag).\n let pending_count = pending_input.len();\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter=pending_flush\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count);\n }\n for (index, (op, b)) in pending_input.drain(..).enumerate() {\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} bytes={} enter=pending_send_effect\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index, op, b.len());\n }\n let sent = brain.send_effect(MintedOp::new(Minter::Rc, op), &b);\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} ok={} exit=pending_send_effect\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index - 1, op, sent.is_ok());\n }\n sent?;\n }\n if w2b_trace {\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit=pending_flush\",\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_input.len());\n }\n }\n O::Viewer => {\n role = Some(ServeRole::Viewer);\n // Wake-neutral: a viewer never wakes the endpoint, never\n // keeps it awake (Gap B). Discard any racing input.\n pending_input.clear();\n }\n O::BusyControlled { .. } => {\n // A different operator controls it — refuse (no PTY input\n // ever reached it; the buffer is discarded). The rc\n // renders the busy guidance client-side from driven_by.\n wire.net_stream_send(stream_id, &[], None, true)?;\n return Ok(AttachServeOutcome::Refused);\n }\n }\n // Both roles use the same transport. A future viewer-specific\n // policy reaches a surviving viewer after daemon reconstruction.\n // Old clients omitted identity and receive no advisory at all.\n // [impl->REQ-ATTACH-CLIENT-STALE]\n if let Some(client) = client_identity.as_ref() {\n let policies = attach_client_policy()\n .into_iter()\n .filter(|policy| policy.affects(client, intent))\n .collect();\n let line = ndjson::encode_line(&AttachRecord::ClientPolicy { policies });\n w2b_probe!(\"client_policy\", wire.net_stream_send(stream_id, &line, None, false))?;\n }\n }\n BrokerEvent::Other(env)\n if attached\n && role == Some(ServeRole::Controller)\n && env.kind == crate::msg::KIND_USER_INPUT_PATHS =>\n {\n let request = serde_json::from_value(env.payload)\n .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;\n let line = ndjson::encode_line(&AttachRecord::InputPaths { request });\n wire.net_stream_send(stream_id, &line, None, false)?;\n }\n // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\n // broker-authored records forwarded onto the attach wire for the\n // controller's rc to render. Additive record kinds — pushed only\n // to a controller that declared the capability, so an N-1 rc\n // never receives them (REQ-SEAL-NO-CEREMONY-SURFACE refuses at\n // the mint instead).\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n BrokerEvent::SealCeremonyOpen {\n ceremony_id,\n content_b64,\n subnet,\n destination,\n payload_to_sign_b64,\n fido2_node,\n offer_enroll,\n ..\n } if attached => {\n let line = ndjson::encode_line(&AttachRecord::SealCeremony {\n ceremony_id,\n content_b64,\n subnet,\n destination,\n payload_to_sign_b64,\n fido2_node,\n offer_enroll,\n });\n wire.net_stream_send(stream_id, &line, None, false)?;\n }\n BrokerEvent::SealCeremonyResult {\n ceremony_id,\n outcome,\n detail,\n ..\n } if attached => {\n let line = ndjson::encode_line(&AttachRecord::SealCeremonyResult {\n ceremony_id,\n outcome,\n detail,\n });\n wire.net_stream_send(stream_id, &line, None, false)?;\n }\n // Viewer letterbox feed: the current PTY size (on attach + resize).\n BrokerEvent::Size { rows, cols, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Size { rows, cols });\n w2b_probe!(\"size_forward\", wire.net_stream_send(stream_id, &line, None, false))?;\n }\n // This controller was kicked by a different operator's `--take`.\n BrokerEvent::Displaced { by, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Displaced { by });\n wire.net_stream_send(stream_id, &line, None, true)?;\n // No dormant edge: the endpoint stays driven by the taker (whose\n // own serve loop already fired the wake).\n return Ok(AttachServeOutcome::Displaced);\n }\n\n // This VIEWER overflowed its broker subscription queue and was evicted\n // (it forwards slower than the drain fans out under flood). SKIP TO\n // LIVE — re-subscribe from the current ring floor — instead of tearing\n // the attach down: DISTINCT from a session-exit EOF. Rate-limited\n // (RESUBSCRIBE_INTERVAL) so a hopelessly-behind viewer under sustained\n // flood sees intermittent LIVE bursts, never an evict→resubscribe CPU\n // spin. The next live Output carries a forward seq jump; the operator's\n // render cursor snaps to it (tail -f reconnect). VIEWER-only → B2-safe.\n // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n BrokerEvent::ViewerEvicted { session_id: sid }\n if attached && Some(sid) == attached_session =>\n {\n if let Some(prev) = last_resubscribe {\n let since = prev.elapsed();\n if since < RESUBSCRIBE_INTERVAL {\n std::thread::sleep(RESUBSCRIBE_INTERVAL - since);\n }\n }\n brain.attach_skip_to_live(sid, Some(origin_node))?;\n last_resubscribe = Some(Instant::now());\n }\n\n // The operator closed its send side: the viewport is over.\n BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\n wire.net_stream_send(stream_id, &[], None, true)?;\n // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\n…\n }\n…\n }\n }\n}\n\n[Showing lines 366-923 of 1207. Use :924 to continue]"}],"details":{"truncation":{"content":"#[allow(clippy::too_many_arguments)]\r\nfn handle_attach_request(\r\n brain: &mut Brain,\r\n wire: &mut Brain,\r\n stream_id: u64,\r\n endpoint: &str,\r\n origin_node: &str,\r\n remote_session: Option,\r\n session_id: u64,\r\n from_seq: u64,\r\n req_intent: AttachIntent,\r\n req_gen: u64,\r\n req_code: Option,\r\n req_seal_ceremony: bool,\r\n intent: &mut AttachIntent,\r\n attached_session: &mut Option,\r\n attached: &mut bool,\r\n serve_gen: &mut u64,\r\n) -> io::Result> {\r\n if access_check(\r\n endpoint,\r\n origin_node,\r\n attach_surface(req_intent),\r\n InboundClass::Unsolicited,\r\n )\r\n .is_deny()\r\n {\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n return Ok(Some(AttachServeOutcome::Refused));\r\n }\r\n let sid = remote_session.unwrap_or(session_id);\r\n *intent = req_intent;\r\n *attached_session = Some(sid);\r\n // The DISPATCHED intent, read off the same binding the arms below branch on —\r\n // the arm IS the decision, so logging `req_intent` here names it once for both\r\n // arms rather than twice inside them. Wildcard-free: a new `AttachIntent`\r\n // variant must fail to compile rather than log as one of today's three.\r\n let intent_lbl = match req_intent {\r\n AttachIntent::Viewer => \"viewer\",\r\n AttachIntent::Control => \"control\",\r\n AttachIntent::Take => \"take\",\r\n };\r\n // Daemon stderr sink, joinable to the broker's SUBSCRIBE_DECISION on `session`.\r\n // ids/counters only — never PTY bytes, and never the bring-up code, which is a\r\n // secret riding the same request.\r\n spt_proto::emit_line_err!(\r\n \"ATTACH_INTENT_CHOSEN: site=serve_dispatch session={sid} intent={intent_lbl} \\\r\n from_seq={from_seq} gen={req_gen} coded={}\",\r\n req_code.is_some()\r\n );\r\n if req_intent == AttachIntent::Viewer {\r\n brain.attach_as_viewer_snap(sid, from_seq, Some(origin_node))?;\r\n } else {\r\n // The bring-up code rides the driving attach only: a viewer never takes\r\n // controls, so there is nothing for a code to buy on that path.\r\n // [impl->REQ-ER-BRINGUP-TOTP-GATE]\r\n brain.attach_as_coded(\r\n sid,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n Some(origin_node),\r\n req_code.as_deref(),\r\n // The W2 seal-ceremony capability the CLIENT declared, recorded on\r\n // the controller seat so a mint knows whether this viewport can\r\n // host the overlay (REQ-SEAL-NO-CEREMONY-SURFACE).\r\n req_seal_ceremony,\r\n )?;\r\n *serve_gen = req_gen;\r\n }\r\n *attached = true;\r\n Ok(None)\r\n}\r\n\r\n/// Serve one attach stream against this brain's broker, blocking until the\r\n/// session exits, the operator detaches, or the gate refuses.\r\n///\r\n/// `origin_node` MUST be the handshake-proven remote id from the broker's\r\n/// stream table (`NetStreamInfo::remote_id_hex`) — never payload bytes\r\n/// (REQ-HAZARD-WAN-ORIGIN-AUTH). `endpoint` names the endpoint whose session\r\n/// is being attached, for the gate. `net_from_seq` is this brain's resume\r\n/// cursor on the attach stream (0 cold — also the safe post-restart choice:\r\n/// the replayed `Request`/`Input` records re-gate and dedup at the PTY\r\n/// journal, and re-pumped output dedups at the operator's render cursor).\r\n///\r\n/// `remote_session` is `Some(sid)` ONLY on the cross-node leg (#4,\r\n/// REQ-RC-CROSS-NODE-ATTACH): the dispatcher has ALREADY resolved endpoint→our\r\n/// session id ([`resolve_local_session`]) BEFORE this serve loop subscribed, so\r\n/// the wire's placeholder `session_id` (0) is overridden here with the resolved\r\n/// id. It is passed down — never re-queried mid-loop — because a `sessions()`\r\n/// round-trip inside the event loop would swallow interleaved attach records\r\n/// (`Input`/`Subscribed`) the loop must see. `None` = the local path, which uses\r\n/// the wire `session_id`.\r\n///\r\n/// `seed_request` is the broker-pinned opener Request (ADR-0038 B): after the\r\n/// bounded ring rolls, the wire replay no longer carries the stream's Request\r\n/// record — a reconstruction that waited for one would idle forever. The\r\n/// dispatcher hands the durable opener here and it is handled EXACTLY like a\r\n/// wire-arriving Request (same gate, same subscribe); a Request that then\r\n/// replays from the ring anyway re-runs the same-identity re-take, which is\r\n/// silent and idempotent (the successor-re-take parity the fix must keep).\r\n// [impl->REQ-INST-8]\r\n// [impl->REQ-HAZARD-WAN-ORIGIN-AUTH]\r\n// [impl->REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT]\r\n// [impl->REQ-RC-CROSS-NODE-ATTACH]\r\n// [impl->REQ-STREAM-OPENER-DURABLE]\r\n#[allow(clippy::too_many_arguments)]\r\npub fn serve_attach(\r\n brain: &mut Brain,\r\n broker_name: &str,\r\n stream_id: u64,\r\n endpoint: &str,\r\n origin_node: &str,\r\n net_from_seq: u64,\r\n remote_session: Option,\r\n seed_request: Option,\r\n) -> io::Result {\r\n brain.net_stream_subscribe(stream_id, net_from_seq)?;\r\n // TWO-CONN SPLIT (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT): the wire FORWARDS\r\n // (session Output / Size / Exit / Displaced / detach-finish onto the operator\r\n // stream) ride a SEPARATE broker connection from `brain`. `brain` RECEIVES\r\n // session output (broker→serve) — including the controller's synchronous,\r\n // inline, multi-frame ring replay (`become_controller`), which holds the\r\n // broker's single-threaded per-conn handler for the whole replay. If the\r\n // forwards rode `brain` too, that stuck handler could not read them →\r\n // serve→broker backs up while broker→serve replay backs up → mutual IPC\r\n // backpressure DEADLOCK, and the operator receives ZERO bytes (the bug: an\r\n // attach to an ALREADY-PRODUCING endpoint-run harness, non-empty ring). The\r\n // two directions on independent single-threaded handlers cannot block each\r\n // other. `send_stream` is stream_id-keyed (conn-agnostic), so forwarding from\r\n // a second conn is correct. Order is preserved: this one serve thread reads\r\n // every Output in seq order on `brain` and forwards it in that same order on\r\n // `wire`. (DEEPER ROOT, post-v0.12.1 follow-up: the CONTROLLER replay is a\r\n // SYNCHRONOUS inline write, while VIEWERS use the async dedicated-writer-\r\n // thread + bounded-channel pattern (`add_viewer`/`viewer_writer`); unifying\r\n // the controller onto that async path would remove the inline-replay block at\r\n // the source, but it touches the authoritative cursor-advancing path.)\r\n let mut wire = Brain::cold_start(broker_name, now_ms())?;\r\n let mut decoder = AttachDecoder::new();\r\n let mut attached = false;\r\n // The Request's intent — gates wire input (a viewer's keystrokes never reach\r\n // the PTY) independent of the broker's later role reply (no IPC-ordering\r\n // race on the input gate).\r\n let mut intent = AttachIntent::Control;\r\n // The broker-confirmed role (arrives as `Subscribed`). `None` until then:\r\n // controller input that races ahead of the reply is BUFFERED, not dropped\r\n // (the replayed-input-after-restart case) and not leaked to the PTY before\r\n // we know we control the session (the busy-refuse case).\r\n let mut role: Option = None;\r\n let mut pending_input: Vec<(u64, Vec)> = Vec::new();\r\n // Temporary W2b discriminator: paired boundaries, never payload contents.\r\n let w2b_trace = std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\");\r\n macro_rules! w2b_probe {\r\n ($label:literal, $call:expr) => {{\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter={}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), $label);\r\n }\r\n let result = $call;\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit={}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), $label);\r\n }\r\n result\r\n }};\r\n }\r\n // The attached session — captured from the Request so the terminal paths can\r\n // explicitly release this worker's role (clearing driven_by / viewer_count\r\n // promptly, not only on connection drop).\r\n let mut attached_session: Option = None;\r\n // This worker's attach GENERATION (ADR-0038 Amendment fix 6) — set when\r\n // its Request lands; every terminal release carries it so a STALE worker\r\n // (an older generation) can never clear a replacement controller.\r\n let mut serve_gen: u64 = 0;\r\n // Recovered from the pinned Request, not from the serving daemon's version.\r\n // [impl->REQ-ATTACH-CLIENT-STALE]\r\n let mut client_identity = None;\r\n // Last skip-to-live re-subscribe (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT): bounds the\r\n // evict→resubscribe rate so a hopelessly-behind viewer under flood sees\r\n // intermittent live bursts, never a CPU spin.\r\n let mut last_resubscribe: Option = None;\r\n\r\n // Durable-opener seed (ADR-0038 B): process the dispatcher-pinned Request\r\n // BEFORE the event loop, through the exact wire-Request path — a rolled\r\n // ring can no longer replay it. Non-Request seeds are ignored (the opener\r\n // of an attach stream is always its Request).\r\n if let Some(AttachRecord::Request {\r\n session_id,\r\n from_seq,\r\n intent: req_intent,\r\n endpoint_id: _,\r\n gen: req_gen,\r\n code: req_code,\r\n seal_ceremony: req_seal_ceremony,\r\n client,\r\n }) = seed_request\r\n {\r\n if let Some(out) = w2b_probe!(\"seed_request\", handle_attach_request(\r\n brain,\r\n &mut wire,\r\n stream_id,\r\n endpoint,\r\n origin_node,\r\n remote_session,\r\n session_id,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n req_code,\r\n req_seal_ceremony,\r\n &mut intent,\r\n &mut attached_session,\r\n &mut attached,\r\n &mut serve_gen,\r\n ))? {\r\n return Ok(out);\r\n }\r\n client_identity = client;\r\n }\r\n\r\n // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\r\n // Stream lifetime is subscriber-owned; any silence bound belongs per read, not per call.\r\n let deadline: Option = None;\r\n loop {\r\n // The CONTROLLER resumes-from-floor on a b4 drop-don't-block output-gap\r\n // (RE-FETCH from delivered_through, NOT snap — B2: a controller is\r\n // authoritative). A VIEWER never reaches the reject-gap (its serve-brain is\r\n // snap-above armed at attach, REQ-HAZARD-VIEWER-RING-ROLL-SNAP). Before a\r\n // role resolves no Output flows, so a plain read is correct then.\r\n // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n let event = w2b_probe!(\"read_event\", match (role, attached_session) {\r\n (Some(ServeRole::Controller), Some(sid)) => {\r\n match read_controller_event_resuming(brain, sid, serve_gen, Some(origin_node)) {\r\n Ok(ev) => ev,\r\n Err(e)\r\n if e.get_ref()\r\n .is_some_and(|inner| inner.is::()) =>\r\n {\r\n // Irrecoverable: the dropped frames rolled out of the ring.\r\n // SURFACE a marked truncation to the operator (never a\r\n // silent skip = B2 lie, never a spin), then end cleanly.\r\n // Graceful continuation is deferred\r\n // (REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND).\r\n let notice =\r\n b\"\\r\\n[spt: output truncated -- controller fell behind the live ring, frames lost]\\r\\n\";\r\n let line = ndjson::encode_line(&AttachRecord::Output {\r\n seq: brain.controller_resume_floor(),\r\n data_b64: encode_bytes(notice),\r\n });\r\n let _ = wire.net_stream_send(stream_id, &line, None, true);\r\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\r\n return Err(e);\r\n }\r\n Err(e) => {\r\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\r\n return Err(e);\r\n }\r\n }\r\n }\r\n _ => brain.read_event_until(deadline)?,\r\n });\r\n if w2b_trace {\r\n let kind = match &event {\r\n BrokerEvent::NetStreamData { .. } => \"NetStreamData\",\r\n BrokerEvent::Subscribed { .. } => \"Subscribed\",\r\n BrokerEvent::Output { .. } => \"Output\",\r\n BrokerEvent::Applied { .. } => \"Applied\",\r\n _ => \"Other\",\r\n };\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} event={} role={:?}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), kind, role);\r\n }\r\n match event {\r\n // ── Wire → session: requests, input, resize. ───────────────────\r\n BrokerEvent::NetStreamData {\r\n stream_id: sid,\r\n bytes,\r\n ..\r\n } if sid == stream_id => {\r\n for rec in decoder.push(&bytes) {\r\n match rec {\r\n AttachRecord::Request {\r\n session_id,\r\n from_seq,\r\n intent: req_intent,\r\n // The dispatcher already resolved endpoint_id→session\r\n // (passed as remote_session) BEFORE this loop; ignore\r\n // the wire copy here (a mid-loop re-resolve would swallow\r\n // interleaved attach records — see remote_session docs).\r\n endpoint_id: _,\r\n gen: req_gen,\r\n code: req_code,\r\n seal_ceremony: req_seal_ceremony,\r\n client,\r\n } => {\r\n if let Some(out) = w2b_probe!(\"replayed_request\", handle_attach_request(\r\n brain,\r\n &mut wire,\r\n stream_id,\r\n endpoint,\r\n origin_node,\r\n remote_session,\r\n session_id,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n req_code,\r\n req_seal_ceremony,\r\n &mut intent,\r\n &mut attached_session,\r\n &mut attached,\r\n &mut serve_gen,\r\n ))? {\r\n return Ok(out);\r\n }\r\n client_identity = client;\r\n }\r\n AttachRecord::Input { data_b64, op_id }\r\n if attached && intent != AttachIntent::Viewer =>\r\n {\r\n let bytes = decode_bytes(&data_b64)\r\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n match role {\r\n // Confirmed controller — exactly-once at the PTY\r\n // (the operator-minted id rides the B5 journal). NO-ACK\r\n // (REQ-HAZARD-INPUT-ACK-BACKPRESSURE): this path is\r\n // fire-and-forward (the ack is discarded here) and can\r\n // flood N input frames on this one conn; an acked write\r\n // back would fill the return direction and deadlock the\r\n // broker's per-conn handler. Dedup still holds at the\r\n // broker (op_id applied-set).\r\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\r\n Some(ServeRole::Controller) => {\r\n // The op_id is operator-minted (rc attach OpMinter),\r\n // so it carries the `rc` journal tag (ADR-0034).\r\n w2b_probe!(\"live_input\", brain.send_effect_no_ack(\r\n MintedOp::new(Minter::Rc, op_id),\r\n &bytes,\r\n ))?\r\n }\r\n // Outcome not yet known — buffer; flushed on a\r\n // controller confirmation, discarded on busy/viewer.\r\n None => pending_input.push((op_id, bytes)),\r\n // A viewer never reaches here (intent gate).\r\n Some(ServeRole::Viewer) => {}\r\n }\r\n }\r\n AttachRecord::Resize { rows, cols }\r\n if attached && intent != AttachIntent::Viewer =>\r\n {\r\n // Controller → PTY resize (controller-EXCLUSIVE; the\r\n // broker rejects it on a viewer's stream). A viewer's\r\n // Resize is dropped here by the intent gate too.\r\n let _ = brain.resize(rows, cols);\r\n }\r\n // The ceremony presentation from the controller's\r\n // overlay (WAX-SEAL W2): the PRESENTED CODE, never a\r\n // verdict — forwarded to the broker, which decides\r\n // everything. Controller-only (the intent gate): a\r\n // viewer has no overlay to answer from.\r\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\r\n AttachRecord::SealCeremonyCode {\r\n ceremony_id,\r\n code,\r\n signature_hex,\r\n enroll_pubkey_hex,\r\n enroll_backend_kind,\r\n } if attached && intent != AttachIntent::Viewer => {\r\n // The SIGNET W2 additive fields — a FIDO2 proof\r\n // or `E` enroll facts — forward VERBATIM: still\r\n // never a verdict, the broker decides everything.\r\n // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\r\n let facts = enroll_pubkey_hex\r\n .as_deref()\r\n .zip(enroll_backend_kind.as_deref());\r\n brain.seal_ceremony_code(\r\n ceremony_id,\r\n code.as_deref(),\r\n signature_hex.as_deref(),\r\n facts,\r\n )?;\r\n }\r\n AttachRecord::InputPathsReply { reply }\r\n if attached && role == Some(ServeRole::Controller) =>\r\n {\r\n brain.complete_input_paths(&reply)?;\r\n }\r\n // Input/Resize before Request, a viewer's input/resize,\r\n // or target-direction records echoed back: noise — ignore.\r\n _ => {}\r\n }\r\n }\r\n }\r\n\r\n // ── Broker → loop: the resolved controller/viewer role. ─────────\r\n BrokerEvent::Subscribed { outcome, note, .. } => {\r\n use crate::msg::SubscribeOutcome as O;\r\n match outcome {\r\n O::Controller | O::TookControl => {\r\n role = Some(ServeRole::Controller);\r\n // Relay the broker's seat sentence to the human before\r\n // any session output, so the grant is read as a fact\r\n // about the attach and not as something the session\r\n // said. Controller-only: a viewer took no seat, and a\r\n // refused attach gets its own refusal path.\r\n // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\r\n if let Some(text) = note {\r\n let line = ndjson::encode_line(&AttachRecord::Notice { text });\r\n w2b_probe!(\"seat_notice\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n // A driver attached — the wake edge (controller-only;\r\n // idempotent on an already-active seat).\r\n w2b_probe!(\"wake\", feed_rest(endpoint, crate::resting::RestEvent::Wake));\r\n // Flush any input that raced ahead of the reply (operator-\r\n // minted ops carry the `rc` tag).\r\n let pending_count = pending_input.len();\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter=pending_flush\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count);\r\n }\r\n for (index, (op, b)) in pending_input.drain(..).enumerate() {\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} bytes={} enter=pending_send_effect\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index, op, b.len());\r\n }\r\n let sent = brain.send_effect(MintedOp::new(Minter::Rc, op), &b);\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} ok={} exit=pending_send_effect\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index - 1, op, sent.is_ok());\r\n }\r\n sent?;\r\n }\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit=pending_flush\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_input.len());\r\n }\r\n }\r\n O::Viewer => {\r\n role = Some(ServeRole::Viewer);\r\n // Wake-neutral: a viewer never wakes the endpoint, never\r\n // keeps it awake (Gap B). Discard any racing input.\r\n pending_input.clear();\r\n }\r\n O::BusyControlled { .. } => {\r\n // A different operator controls it — refuse (no PTY input\r\n // ever reached it; the buffer is discarded). The rc\r\n // renders the busy guidance client-side from driven_by.\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n return Ok(AttachServeOutcome::Refused);\r\n }\r\n }\r\n // Both roles use the same transport. A future viewer-specific\r\n // policy reaches a surviving viewer after daemon reconstruction.\r\n // Old clients omitted identity and receive no advisory at all.\r\n // [impl->REQ-ATTACH-CLIENT-STALE]\r\n if let Some(client) = client_identity.as_ref() {\r\n let policies = attach_client_policy()\r\n .into_iter()\r\n .filter(|policy| policy.affects(client, intent))\r\n .collect();\r\n let line = ndjson::encode_line(&AttachRecord::ClientPolicy { policies });\r\n w2b_probe!(\"client_policy\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n }\r\n BrokerEvent::Other(env)\r\n if attached\r\n && role == Some(ServeRole::Controller)\r\n && env.kind == crate::msg::KIND_USER_INPUT_PATHS =>\r\n {\r\n let request = serde_json::from_value(env.payload)\r\n .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;\r\n let line = ndjson::encode_line(&AttachRecord::InputPaths { request });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\r\n // broker-authored records forwarded onto the attach wire for the\r\n // controller's rc to render. Additive record kinds — pushed only\r\n // to a controller that declared the capability, so an N-1 rc\r\n // never receives them (REQ-SEAL-NO-CEREMONY-SURFACE refuses at\r\n // the mint instead).\r\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\r\n BrokerEvent::SealCeremonyOpen {\r\n ceremony_id,\r\n content_b64,\r\n subnet,\r\n destination,\r\n payload_to_sign_b64,\r\n fido2_node,\r\n offer_enroll,\r\n ..\r\n } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::SealCeremony {\r\n ceremony_id,\r\n content_b64,\r\n subnet,\r\n destination,\r\n payload_to_sign_b64,\r\n fido2_node,\r\n offer_enroll,\r\n });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n BrokerEvent::SealCeremonyResult {\r\n ceremony_id,\r\n outcome,\r\n detail,\r\n ..\r\n } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::SealCeremonyResult {\r\n ceremony_id,\r\n outcome,\r\n detail,\r\n });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n // Viewer letterbox feed: the current PTY size (on attach + resize).\r\n BrokerEvent::Size { rows, cols, .. } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::Size { rows, cols });\r\n w2b_probe!(\"size_forward\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n // This controller was kicked by a different operator's `--take`.\r\n BrokerEvent::Displaced { by, .. } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::Displaced { by });\r\n wire.net_stream_send(stream_id, &line, None, true)?;\r\n // No dormant edge: the endpoint stays driven by the taker (whose\r\n // own serve loop already fired the wake).\r\n return Ok(AttachServeOutcome::Displaced);\r\n }\r\n\r\n // This VIEWER overflowed its broker subscription queue and was evicted\r\n // (it forwards slower than the drain fans out under flood). SKIP TO\r\n // LIVE — re-subscribe from the current ring floor — instead of tearing\r\n // the attach down: DISTINCT from a session-exit EOF. Rate-limited\r\n // (RESUBSCRIBE_INTERVAL) so a hopelessly-behind viewer under sustained\r\n // flood sees intermittent LIVE bursts, never an evict→resubscribe CPU\r\n // spin. The next live Output carries a forward seq jump; the operator's\r\n // render cursor snaps to it (tail -f reconnect). VIEWER-only → B2-safe.\r\n // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\r\n BrokerEvent::ViewerEvicted { session_id: sid }\r\n if attached && Some(sid) == attached_session =>\r\n {\r\n if let Some(prev) = last_resubscribe {\r\n let since = prev.elapsed();\r\n if since < RESUBSCRIBE_INTERVAL {\r\n std::thread::sleep(RESUBSCRIBE_INTERVAL - since);\r\n }\r\n }\r\n brain.attach_skip_to_live(sid, Some(origin_node))?;\r\n last_resubscribe = Some(Instant::now());\r\n }\r\n\r\n // The operator closed its send side: the viewport is over.\r\n BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\r","truncated":true,"truncatedBy":"lines","totalLines":842,"totalBytes":29918,"outputLines":558,"outputBytes":29918,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1207,"displayContent":{"text":"#[allow(clippy::too_many_arguments)]\r\nfn handle_attach_request(\r\n brain: &mut Brain,\r\n wire: &mut Brain,\r\n stream_id: u64,\r\n endpoint: &str,\r\n origin_node: &str,\r\n remote_session: Option,\r\n session_id: u64,\r\n from_seq: u64,\r\n req_intent: AttachIntent,\r\n req_gen: u64,\r\n req_code: Option,\r\n req_seal_ceremony: bool,\r\n intent: &mut AttachIntent,\r\n attached_session: &mut Option,\r\n attached: &mut bool,\r\n serve_gen: &mut u64,\r\n) -> io::Result> {\r\n if access_check(\r\n endpoint,\r\n origin_node,\r\n attach_surface(req_intent),\r\n InboundClass::Unsolicited,\r\n )\r\n .is_deny()\r\n {\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n return Ok(Some(AttachServeOutcome::Refused));\r\n }\r\n let sid = remote_session.unwrap_or(session_id);\r\n *intent = req_intent;\r\n *attached_session = Some(sid);\r\n // The DISPATCHED intent, read off the same binding the arms below branch on —\r\n // the arm IS the decision, so logging `req_intent` here names it once for both\r\n // arms rather than twice inside them. Wildcard-free: a new `AttachIntent`\r\n // variant must fail to compile rather than log as one of today's three.\r\n let intent_lbl = match req_intent {\r\n AttachIntent::Viewer => \"viewer\",\r\n AttachIntent::Control => \"control\",\r\n AttachIntent::Take => \"take\",\r\n };\r\n // Daemon stderr sink, joinable to the broker's SUBSCRIBE_DECISION on `session`.\r\n // ids/counters only — never PTY bytes, and never the bring-up code, which is a\r\n // secret riding the same request.\r\n spt_proto::emit_line_err!(\r\n \"ATTACH_INTENT_CHOSEN: site=serve_dispatch session={sid} intent={intent_lbl} \\\r\n from_seq={from_seq} gen={req_gen} coded={}\",\r\n req_code.is_some()\r\n );\r\n if req_intent == AttachIntent::Viewer {\r\n brain.attach_as_viewer_snap(sid, from_seq, Some(origin_node))?;\r\n } else {\r\n // The bring-up code rides the driving attach only: a viewer never takes\r\n // controls, so there is nothing for a code to buy on that path.\r\n // [impl->REQ-ER-BRINGUP-TOTP-GATE]\r\n brain.attach_as_coded(\r\n sid,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n Some(origin_node),\r\n req_code.as_deref(),\r\n // The W2 seal-ceremony capability the CLIENT declared, recorded on\r\n // the controller seat so a mint knows whether this viewport can\r\n // host the overlay (REQ-SEAL-NO-CEREMONY-SURFACE).\r\n req_seal_ceremony,\r\n )?;\r\n *serve_gen = req_gen;\r\n }\r\n *attached = true;\r\n Ok(None)\r\n}\r\n\r\n/// Serve one attach stream against this brain's broker, blocking until the\r\n/// session exits, the operator detaches, or the gate refuses.\r\n///\r\n/// `origin_node` MUST be the handshake-proven remote id from the broker's\r\n/// stream table (`NetStreamInfo::remote_id_hex`) — never payload bytes\r\n/// (REQ-HAZARD-WAN-ORIGIN-AUTH). `endpoint` names the endpoint whose session\r\n/// is being attached, for the gate. `net_from_seq` is this brain's resume\r\n/// cursor on the attach stream (0 cold — also the safe post-restart choice:\r\n/// the replayed `Request`/`Input` records re-gate and dedup at the PTY\r\n/// journal, and re-pumped output dedups at the operator's render cursor).\r\n///\r\n/// `remote_session` is `Some(sid)` ONLY on the cross-node leg (#4,\r\n/// REQ-RC-CROSS-NODE-ATTACH): the dispatcher has ALREADY resolved endpoint→our\r\n/// session id ([`resolve_local_session`]) BEFORE this serve loop subscribed, so\r\n/// the wire's placeholder `session_id` (0) is overridden here with the resolved\r\n/// id. It is passed down — never re-queried mid-loop — because a `sessions()`\r\n/// round-trip inside the event loop would swallow interleaved attach records\r\n/// (`Input`/`Subscribed`) the loop must see. `None` = the local path, which uses\r\n/// the wire `session_id`.\r\n///\r\n/// `seed_request` is the broker-pinned opener Request (ADR-0038 B): after the\r\n/// bounded ring rolls, the wire replay no longer carries the stream's Request\r\n/// record — a reconstruction that waited for one would idle forever. The\r\n/// dispatcher hands the durable opener here and it is handled EXACTLY like a\r\n/// wire-arriving Request (same gate, same subscribe); a Request that then\r\n/// replays from the ring anyway re-runs the same-identity re-take, which is\r\n/// silent and idempotent (the successor-re-take parity the fix must keep).\r\n// [impl->REQ-INST-8]\r\n// [impl->REQ-HAZARD-WAN-ORIGIN-AUTH]\r\n// [impl->REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT]\r\n// [impl->REQ-RC-CROSS-NODE-ATTACH]\r\n// [impl->REQ-STREAM-OPENER-DURABLE]\r\n#[allow(clippy::too_many_arguments)]\r\npub fn serve_attach(\r\n brain: &mut Brain,\r\n broker_name: &str,\r\n stream_id: u64,\r\n endpoint: &str,\r\n origin_node: &str,\r\n net_from_seq: u64,\r\n remote_session: Option,\r\n seed_request: Option,\r\n) -> io::Result {\r\n brain.net_stream_subscribe(stream_id, net_from_seq)?;\r\n // TWO-CONN SPLIT (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT): the wire FORWARDS\r\n // (session Output / Size / Exit / Displaced / detach-finish onto the operator\r\n // stream) ride a SEPARATE broker connection from `brain`. `brain` RECEIVES\r\n // session output (broker→serve) — including the controller's synchronous,\r\n // inline, multi-frame ring replay (`become_controller`), which holds the\r\n // broker's single-threaded per-conn handler for the whole replay. If the\r\n // forwards rode `brain` too, that stuck handler could not read them →\r\n // serve→broker backs up while broker→serve replay backs up → mutual IPC\r\n // backpressure DEADLOCK, and the operator receives ZERO bytes (the bug: an\r\n // attach to an ALREADY-PRODUCING endpoint-run harness, non-empty ring). The\r\n // two directions on independent single-threaded handlers cannot block each\r\n // other. `send_stream` is stream_id-keyed (conn-agnostic), so forwarding from\r\n // a second conn is correct. Order is preserved: this one serve thread reads\r\n // every Output in seq order on `brain` and forwards it in that same order on\r\n // `wire`. (DEEPER ROOT, post-v0.12.1 follow-up: the CONTROLLER replay is a\r\n // SYNCHRONOUS inline write, while VIEWERS use the async dedicated-writer-\r\n // thread + bounded-channel pattern (`add_viewer`/`viewer_writer`); unifying\r\n // the controller onto that async path would remove the inline-replay block at\r\n // the source, but it touches the authoritative cursor-advancing path.)\r\n let mut wire = Brain::cold_start(broker_name, now_ms())?;\r\n let mut decoder = AttachDecoder::new();\r\n let mut attached = false;\r\n // The Request's intent — gates wire input (a viewer's keystrokes never reach\r\n // the PTY) independent of the broker's later role reply (no IPC-ordering\r\n // race on the input gate).\r\n let mut intent = AttachIntent::Control;\r\n // The broker-confirmed role (arrives as `Subscribed`). `None` until then:\r\n // controller input that races ahead of the reply is BUFFERED, not dropped\r\n // (the replayed-input-after-restart case) and not leaked to the PTY before\r\n // we know we control the session (the busy-refuse case).\r\n let mut role: Option = None;\r\n let mut pending_input: Vec<(u64, Vec)> = Vec::new();\r\n // Temporary W2b discriminator: paired boundaries, never payload contents.\r\n let w2b_trace = std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\");\r\n macro_rules! w2b_probe {\r\n ($label:literal, $call:expr) => {{\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter={}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), $label);\r\n }\r\n let result = $call;\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit={}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), $label);\r\n }\r\n result\r\n }};\r\n }\r\n // The attached session — captured from the Request so the terminal paths can\r\n // explicitly release this worker's role (clearing driven_by / viewer_count\r\n // promptly, not only on connection drop).\r\n let mut attached_session: Option = None;\r\n // This worker's attach GENERATION (ADR-0038 Amendment fix 6) — set when\r\n // its Request lands; every terminal release carries it so a STALE worker\r\n // (an older generation) can never clear a replacement controller.\r\n let mut serve_gen: u64 = 0;\r\n // Recovered from the pinned Request, not from the serving daemon's version.\r\n // [impl->REQ-ATTACH-CLIENT-STALE]\r\n let mut client_identity = None;\r\n // Last skip-to-live re-subscribe (REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT): bounds the\r\n // evict→resubscribe rate so a hopelessly-behind viewer under flood sees\r\n // intermittent live bursts, never a CPU spin.\r\n let mut last_resubscribe: Option = None;\r\n\r\n // Durable-opener seed (ADR-0038 B): process the dispatcher-pinned Request\r\n // BEFORE the event loop, through the exact wire-Request path — a rolled\r\n // ring can no longer replay it. Non-Request seeds are ignored (the opener\r\n // of an attach stream is always its Request).\r\n if let Some(AttachRecord::Request {\r\n session_id,\r\n from_seq,\r\n intent: req_intent,\r\n endpoint_id: _,\r\n gen: req_gen,\r\n code: req_code,\r\n seal_ceremony: req_seal_ceremony,\r\n client,\r\n }) = seed_request\r\n {\r\n if let Some(out) = w2b_probe!(\"seed_request\", handle_attach_request(\r\n brain,\r\n &mut wire,\r\n stream_id,\r\n endpoint,\r\n origin_node,\r\n remote_session,\r\n session_id,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n req_code,\r\n req_seal_ceremony,\r\n &mut intent,\r\n &mut attached_session,\r\n &mut attached,\r\n &mut serve_gen,\r\n ))? {\r\n return Ok(out);\r\n }\r\n client_identity = client;\r\n }\r\n\r\n // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\r\n // Stream lifetime is subscriber-owned; any silence bound belongs per read, not per call.\r\n let deadline: Option = None;\r\n loop {\r\n // The CONTROLLER resumes-from-floor on a b4 drop-don't-block output-gap\r\n // (RE-FETCH from delivered_through, NOT snap — B2: a controller is\r\n // authoritative). A VIEWER never reaches the reject-gap (its serve-brain is\r\n // snap-above armed at attach, REQ-HAZARD-VIEWER-RING-ROLL-SNAP). Before a\r\n // role resolves no Output flows, so a plain read is correct then.\r\n // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\r\n let event = w2b_probe!(\"read_event\", match (role, attached_session) {\r\n (Some(ServeRole::Controller), Some(sid)) => {\r\n match read_controller_event_resuming(brain, sid, serve_gen, Some(origin_node)) {\r\n Ok(ev) => ev,\r\n Err(e)\r\n if e.get_ref()\r\n .is_some_and(|inner| inner.is::()) =>\r\n {\r\n // Irrecoverable: the dropped frames rolled out of the ring.\r\n // SURFACE a marked truncation to the operator (never a\r\n // silent skip = B2 lie, never a spin), then end cleanly.\r\n // Graceful continuation is deferred\r\n // (REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND).\r\n let notice =\r\n b\"\\r\\n[spt: output truncated -- controller fell behind the live ring, frames lost]\\r\\n\";\r\n let line = ndjson::encode_line(&AttachRecord::Output {\r\n seq: brain.controller_resume_floor(),\r\n data_b64: encode_bytes(notice),\r\n });\r\n let _ = wire.net_stream_send(stream_id, &line, None, true);\r\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\r\n return Err(e);\r\n }\r\n Err(e) => {\r\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\r\n return Err(e);\r\n }\r\n }\r\n }\r\n _ => brain.read_event_until(deadline)?,\r\n });\r\n if w2b_trace {\r\n let kind = match &event {\r\n BrokerEvent::NetStreamData { .. } => \"NetStreamData\",\r\n BrokerEvent::Subscribed { .. } => \"Subscribed\",\r\n BrokerEvent::Output { .. } => \"Output\",\r\n BrokerEvent::Applied { .. } => \"Applied\",\r\n _ => \"Other\",\r\n };\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} event={} role={:?}\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id,\r\n pending_input.len(), kind, role);\r\n }\r\n match event {\r\n // ── Wire → session: requests, input, resize. ───────────────────\r\n BrokerEvent::NetStreamData {\r\n stream_id: sid,\r\n bytes,\r\n ..\r\n } if sid == stream_id => {\r\n for rec in decoder.push(&bytes) {\r\n match rec {\r\n AttachRecord::Request {\r\n session_id,\r\n from_seq,\r\n intent: req_intent,\r\n // The dispatcher already resolved endpoint_id→session\r\n // (passed as remote_session) BEFORE this loop; ignore\r\n // the wire copy here (a mid-loop re-resolve would swallow\r\n // interleaved attach records — see remote_session docs).\r\n endpoint_id: _,\r\n gen: req_gen,\r\n code: req_code,\r\n seal_ceremony: req_seal_ceremony,\r\n client,\r\n } => {\r\n if let Some(out) = w2b_probe!(\"replayed_request\", handle_attach_request(\r\n brain,\r\n &mut wire,\r\n stream_id,\r\n endpoint,\r\n origin_node,\r\n remote_session,\r\n session_id,\r\n from_seq,\r\n req_intent,\r\n req_gen,\r\n req_code,\r\n req_seal_ceremony,\r\n &mut intent,\r\n &mut attached_session,\r\n &mut attached,\r\n &mut serve_gen,\r\n ))? {\r\n return Ok(out);\r\n }\r\n client_identity = client;\r\n }\r\n AttachRecord::Input { data_b64, op_id }\r\n if attached && intent != AttachIntent::Viewer =>\r\n {\r\n let bytes = decode_bytes(&data_b64)\r\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n match role {\r\n // Confirmed controller — exactly-once at the PTY\r\n // (the operator-minted id rides the B5 journal). NO-ACK\r\n // (REQ-HAZARD-INPUT-ACK-BACKPRESSURE): this path is\r\n // fire-and-forward (the ack is discarded here) and can\r\n // flood N input frames on this one conn; an acked write\r\n // back would fill the return direction and deadlock the\r\n // broker's per-conn handler. Dedup still holds at the\r\n // broker (op_id applied-set).\r\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\r\n Some(ServeRole::Controller) => {\r\n // The op_id is operator-minted (rc attach OpMinter),\r\n // so it carries the `rc` journal tag (ADR-0034).\r\n w2b_probe!(\"live_input\", brain.send_effect_no_ack(\r\n MintedOp::new(Minter::Rc, op_id),\r\n &bytes,\r\n ))?\r\n }\r\n // Outcome not yet known — buffer; flushed on a\r\n // controller confirmation, discarded on busy/viewer.\r\n None => pending_input.push((op_id, bytes)),\r\n // A viewer never reaches here (intent gate).\r\n Some(ServeRole::Viewer) => {}\r\n }\r\n }\r\n AttachRecord::Resize { rows, cols }\r\n if attached && intent != AttachIntent::Viewer =>\r\n {\r\n // Controller → PTY resize (controller-EXCLUSIVE; the\r\n // broker rejects it on a viewer's stream). A viewer's\r\n // Resize is dropped here by the intent gate too.\r\n let _ = brain.resize(rows, cols);\r\n }\r\n // The ceremony presentation from the controller's\r\n // overlay (WAX-SEAL W2): the PRESENTED CODE, never a\r\n // verdict — forwarded to the broker, which decides\r\n // everything. Controller-only (the intent gate): a\r\n // viewer has no overlay to answer from.\r\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\r\n AttachRecord::SealCeremonyCode {\r\n ceremony_id,\r\n code,\r\n signature_hex,\r\n enroll_pubkey_hex,\r\n enroll_backend_kind,\r\n } if attached && intent != AttachIntent::Viewer => {\r\n // The SIGNET W2 additive fields — a FIDO2 proof\r\n // or `E` enroll facts — forward VERBATIM: still\r\n // never a verdict, the broker decides everything.\r\n // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\r\n let facts = enroll_pubkey_hex\r\n .as_deref()\r\n .zip(enroll_backend_kind.as_deref());\r\n brain.seal_ceremony_code(\r\n ceremony_id,\r\n code.as_deref(),\r\n signature_hex.as_deref(),\r\n facts,\r\n )?;\r\n }\r\n AttachRecord::InputPathsReply { reply }\r\n if attached && role == Some(ServeRole::Controller) =>\r\n {\r\n brain.complete_input_paths(&reply)?;\r\n }\r\n // Input/Resize before Request, a viewer's input/resize,\r\n // or target-direction records echoed back: noise — ignore.\r\n _ => {}\r\n }\r\n }\r\n }\r\n\r\n // ── Broker → loop: the resolved controller/viewer role. ─────────\r\n BrokerEvent::Subscribed { outcome, note, .. } => {\r\n use crate::msg::SubscribeOutcome as O;\r\n match outcome {\r\n O::Controller | O::TookControl => {\r\n role = Some(ServeRole::Controller);\r\n // Relay the broker's seat sentence to the human before\r\n // any session output, so the grant is read as a fact\r\n // about the attach and not as something the session\r\n // said. Controller-only: a viewer took no seat, and a\r\n // refused attach gets its own refusal path.\r\n // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\r\n if let Some(text) = note {\r\n let line = ndjson::encode_line(&AttachRecord::Notice { text });\r\n w2b_probe!(\"seat_notice\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n // A driver attached — the wake edge (controller-only;\r\n // idempotent on an already-active seat).\r\n w2b_probe!(\"wake\", feed_rest(endpoint, crate::resting::RestEvent::Wake));\r\n // Flush any input that raced ahead of the reply (operator-\r\n // minted ops carry the `rc` tag).\r\n let pending_count = pending_input.len();\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} enter=pending_flush\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count);\r\n }\r\n for (index, (op, b)) in pending_input.drain(..).enumerate() {\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} bytes={} enter=pending_send_effect\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index, op, b.len());\r\n }\r\n let sent = brain.send_effect(MintedOp::new(Minter::Rc, op), &b);\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} remaining={} op={} ok={} exit=pending_send_effect\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_count - index - 1, op, sent.is_ok());\r\n }\r\n sent?;\r\n }\r\n if w2b_trace {\r\n eprintln!(\"[DEBUG-w2b] ms={} pid={} thread={:?} stream={} pending={} exit=pending_flush\",\r\n now_ms(), std::process::id(), std::thread::current().id(), stream_id, pending_input.len());\r\n }\r\n }\r\n O::Viewer => {\r\n role = Some(ServeRole::Viewer);\r\n // Wake-neutral: a viewer never wakes the endpoint, never\r\n // keeps it awake (Gap B). Discard any racing input.\r\n pending_input.clear();\r\n }\r\n O::BusyControlled { .. } => {\r\n // A different operator controls it — refuse (no PTY input\r\n // ever reached it; the buffer is discarded). The rc\r\n // renders the busy guidance client-side from driven_by.\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n return Ok(AttachServeOutcome::Refused);\r\n }\r\n }\r\n // Both roles use the same transport. A future viewer-specific\r\n // policy reaches a surviving viewer after daemon reconstruction.\r\n // Old clients omitted identity and receive no advisory at all.\r\n // [impl->REQ-ATTACH-CLIENT-STALE]\r\n if let Some(client) = client_identity.as_ref() {\r\n let policies = attach_client_policy()\r\n .into_iter()\r\n .filter(|policy| policy.affects(client, intent))\r\n .collect();\r\n let line = ndjson::encode_line(&AttachRecord::ClientPolicy { policies });\r\n w2b_probe!(\"client_policy\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n }\r\n BrokerEvent::Other(env)\r\n if attached\r\n && role == Some(ServeRole::Controller)\r\n && env.kind == crate::msg::KIND_USER_INPUT_PATHS =>\r\n {\r\n let request = serde_json::from_value(env.payload)\r\n .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;\r\n let line = ndjson::encode_line(&AttachRecord::InputPaths { request });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\r\n // broker-authored records forwarded onto the attach wire for the\r\n // controller's rc to render. Additive record kinds — pushed only\r\n // to a controller that declared the capability, so an N-1 rc\r\n // never receives them (REQ-SEAL-NO-CEREMONY-SURFACE refuses at\r\n // the mint instead).\r\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\r\n BrokerEvent::SealCeremonyOpen {\r\n ceremony_id,\r\n content_b64,\r\n subnet,\r\n destination,\r\n payload_to_sign_b64,\r\n fido2_node,\r\n offer_enroll,\r\n ..\r\n } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::SealCeremony {\r\n ceremony_id,\r\n content_b64,\r\n subnet,\r\n destination,\r\n payload_to_sign_b64,\r\n fido2_node,\r\n offer_enroll,\r\n });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n BrokerEvent::SealCeremonyResult {\r\n ceremony_id,\r\n outcome,\r\n detail,\r\n ..\r\n } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::SealCeremonyResult {\r\n ceremony_id,\r\n outcome,\r\n detail,\r\n });\r\n wire.net_stream_send(stream_id, &line, None, false)?;\r\n }\r\n // Viewer letterbox feed: the current PTY size (on attach + resize).\r\n BrokerEvent::Size { rows, cols, .. } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::Size { rows, cols });\r\n w2b_probe!(\"size_forward\", wire.net_stream_send(stream_id, &line, None, false))?;\r\n }\r\n // This controller was kicked by a different operator's `--take`.\r\n BrokerEvent::Displaced { by, .. } if attached => {\r\n let line = ndjson::encode_line(&AttachRecord::Displaced { by });\r\n wire.net_stream_send(stream_id, &line, None, true)?;\r\n // No dormant edge: the endpoint stays driven by the taker (whose\r\n // own serve loop already fired the wake).\r\n return Ok(AttachServeOutcome::Displaced);\r\n }\r\n\r\n // This VIEWER overflowed its broker subscription queue and was evicted\r\n // (it forwards slower than the drain fans out under flood). SKIP TO\r\n // LIVE — re-subscribe from the current ring floor — instead of tearing\r\n // the attach down: DISTINCT from a session-exit EOF. Rate-limited\r\n // (RESUBSCRIBE_INTERVAL) so a hopelessly-behind viewer under sustained\r\n // flood sees intermittent LIVE bursts, never an evict→resubscribe CPU\r\n // spin. The next live Output carries a forward seq jump; the operator's\r\n // render cursor snaps to it (tail -f reconnect). VIEWER-only → B2-safe.\r\n // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\r\n BrokerEvent::ViewerEvicted { session_id: sid }\r\n if attached && Some(sid) == attached_session =>\r\n {\r\n if let Some(prev) = last_resubscribe {\r\n let since = prev.elapsed();\r\n if since < RESUBSCRIBE_INTERVAL {\r\n std::thread::sleep(RESUBSCRIBE_INTERVAL - since);\r\n }\r\n }\r\n brain.attach_skip_to_live(sid, Some(origin_node))?;\r\n last_resubscribe = Some(Instant::now());\r\n }\r\n\r\n // The operator closed its send side: the viewport is over.\r\n BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\r\n wire.net_stream_send(stream_id, &[], None, true)?;\r\n // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\r\n…\n }\n…\n }\n }\n}","startLine":366,"lineNumbers":[366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,null,937,null,966,967,968]},"fileSize":60886,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\attach.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1207,"totalBytes":29918,"outputLines":558,"outputBytes":29918,"shownRange":{"start":366,"end":923},"nextOffset":924}}},"isError":false,"timestamp":1789528529537}}
{"type":"message","id":"86448568","parentId":"7f2e7781","timestamp":"2026-09-16T03:15:29.543Z","message":{"role":"toolResult","toolCallId":"call_L7j6ipy7F6Bqfa0mPujNvotX|fc_00817a6e65e8f156016aaa09d15de487d1b2d74ffa2618de8e","toolName":"read","content":[{"type":"text","text":" pub fn send_input(&mut self, bytes: &[u8]) -> io::Result<()> {\n…\n self.send(\n…\n serde_json::to_value(InputReq {\n…\n op_id: None,\n minter: None,\n ack: true,\n })\n .expect(\"InputReq serializes\"),\n )\n }\n\n /// Inject input **idempotently**: the write carries the durable `op_id` so a\n /// replay after a brain crash is deduped at the broker (exactly-once, B5).\n /// `op_id` must come from a durable source and be reused verbatim on replay —\n /// the same logical effect must always carry the same id, so the broker's\n /// applied-set recognizes the re-drive. The broker answers with a\n /// [`BrokerEvent::Applied`] for `(session, op_id)`.\n ///\n /// ACKED (`ack=true`): the caller waits on the [`BrokerEvent::Applied`] one at a\n /// time (the `shellchan` spool-delivery drain). For the fire-and-forward\n /// operator/rc path — which never reads the ack and can send a FLOOD on one\n /// conn — use [`Brain::send_effect_no_ack`] to avoid the ack-backpressure\n /// deadlock (REQ-HAZARD-INPUT-ACK-BACKPRESSURE).\n // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n pub fn send_effect(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n self.send_effect_inner(op, bytes, true)\n }\n\n /// Inject input idempotently like [`Brain::send_effect`] but request NO\n /// [`KIND_APPLIED`] ack (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The operator/rc\n /// attach path is fire-and-forward — `op_id` is for dedup only and the ack is\n /// discarded by `serve_attach` — and it can flood N input frames on ONE\n /// brain↔broker conn without returning to read. With no ack the broker's\n /// per-conn handler never writes back while servicing that flood, so the return\n /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n /// broker still dedups by `(session, op_id)` at its applied-set.\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n pub fn send_effect_no_ack(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n self.send_effect_inner(op, bytes, false)\n }\n\n /// Shared body for [`Brain::send_effect`] / [`Brain::send_effect_no_ack`]: the\n /// only difference is whether the broker replies a `KIND_APPLIED` ack. The\n /// [`MintedOp`] carries both the durable seq and its minter tag (ADR-0034), so\n /// the wire's `op_id`/`minter` fields are stamped together — an unstamped op is\n /// uncompilable. The broker's `KIND_APPLIED` still echoes the bare `seq`.\n fn send_effect_inner(&mut self, op: MintedOp, bytes: &[u8], ack: bool) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_INPUT,\n serde_json::to_value(InputReq {\n session_id: sid,\n data_b64: encode_bytes(bytes),\n op_id: Some(op.seq),\n minter: Some(op.minter),\n ack,\n })\n .expect(\"InputReq serializes\"),\n )\n }\n\n /// Resize the current session's PTY.\n pub fn resize(&mut self, rows: u16, cols: u16) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_RESIZE,\n serde_json::to_value(ResizeReq {\n session_id: sid,\n rows,\n cols,\n })\n .expect(\"ResizeReq serializes\"),\n )\n }\n\n /// Terminate the current session's child.\n pub fn kill_session(&mut self) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_KILL,\n serde_json::to_value(KillReq { session_id: sid }).expect(\"KillReq serializes\"),\n )\n }\n…\n pub fn attach_as_coded(\n &mut self,\n session_id: u64,\n from_seq: u64,\n intent: AttachIntent,\n gen: u64,\n by: Option<&str>,\n code: Option<&str>,\n seal_ceremony: bool,\n ) -> io::Result<()> {\n self.session_id = Some(session_id);\n self.next_seq = from_seq;\n // #6 (ADR-0031): a COLD attach (`from_seq == 0` — the `rc` / `endpoint run\n // --attach` case) gets a clean-screen repaint at pseudo-seq\n // `broker.next_seq - 1` as its first frame; baseline the strict cursor on it\n // (accept-then-strict). A resume-from-floor re-fetch (`from_seq > 0`) leaves\n // this false → raw-ring replay + strict reject-gap unchanged (B2).\n self.baseline_next_output = from_seq == 0;\n self.subscribe_with(\n session_id,\n from_seq,\n intent,\n gen,\n by.map(str::to_string),\n code.map(str::to_string),\n seal_ceremony,\n )\n }\n…\n /// Write bytes to a held stream over the broker (D4b). With `op_id` the\n /// write is exactly-once and this blocks for the `net-sent` ack (returned);\n /// without one it is a direct fire-and-forget write (`None` returned).\n /// `finish` closes the send side after the write.\n // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n pub fn net_stream_send(\n &mut self,\n stream_id: u64,\n bytes: &[u8],\n op: Option,\n finish: bool,\n ) -> io::Result> {\n self.send(\n KIND_NET_STREAM_SEND,\n serde_json::to_value(NetStreamSendReq {\n stream_id,\n data_b64: encode_bytes(bytes),\n op_id: op.map(|o| o.seq),\n minter: op.map(|o| o.minter),\n finish,\n })\n .expect(\"NetStreamSendReq serializes\"),\n )?;\n if op.is_none() {\n return Ok(None);\n }\n let want_seq = op.map(|o| o.seq);\n // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n let deadline = self.call_deadline();\n loop {\n match self.read_event_until(deadline)? {\n BrokerEvent::NetSent(ev) if Some(ev.op_id) == want_seq => return Ok(Some(ev)),\n BrokerEvent::Error { message } => return Err(io::Error::other(message)),\n _ => continue,\n }\n }\n }\n\n…\n fn subscribe_with(\n &mut self,\n session_id: u64,\n from_seq: u64,\n intent: AttachIntent,\n gen: u64,\n by: Option,\n code: Option,\n seal_ceremony: bool,\n ) -> io::Result<()> {\n // P1c (operator-stream boundary, kitsubito RACEDIAG): a resume-mode brain\n // (seeded map) that subscribes from `from_seq` must RESET this session's\n // dedup cursor to `from_seq` — the broker's replay from `from_seq` is then\n // re-delivered (and the operator's render cursor dedups the overlap),\n // never lost. WHY THIS, NOT just `read_event`'s `or_insert`: on a re-serve,\n // `serve_attach` may CONSUME a handoff-replay frame at the K boundary\n // BEFORE it is `attached` (the frame is dropped by the `if attached` gate\n // but the snap-above cursor still advanced past K); `attach_as(sid, 0)`\n // then re-subscribes from 0, and without this reset the broker's re-send of\n // seq K arrives below the advanced cursor and is deduped → seq K never\n // reaches the operator viewport → a forward gap. Resetting to `from_seq`\n // makes the re-subscribe re-deliver everything from its floor. A cold-start\n // brain (empty map — e.g. the production dispatch serve brain) keeps the\n // legacy `next_seq` path; this only arms in resume mode.\n // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n if !self.session_cursors.is_empty() {\n self.session_cursors.insert(session_id, from_seq);\n }\n self.send(\n KIND_SUBSCRIBE,\n serde_json::to_value(SubscribeReq {\n session_id,\n from_seq,\n intent,\n by,\n gen,\n code,\n seal_ceremony,\n })\n .expect(\"SubscribeReq serializes\"),\n )\n }\n\n fn send(&mut self, kind: &str, payload: serde_json::Value) -> io::Result<()> {\n let env = Envelope::new(kind, payload);\n match &mut self.conn {\n BrainConn::Whole(stream) => write_frame(stream, &env),\n BrainConn::Split { send, .. } => write_frame(send, &env),\n }\n }\n\n /// Read one framed [`Envelope`], bounded by an optional wall-clock\n /// `deadline`. The carrier dispatch (REQ-HAZARD-PUMP-IPC-DEADLINE):\n ///\n /// - [`BrainConn::Whole`] — the ordinary blocking client. `None` is the\n /// ordinary blocking [`read_frame`]. `Some(deadline)` is REFUSED BY NAME\n /// (releases#190): this carrier reads the frame inline, so there is no\n /// thread to hand a deadline to and a timeout would have to abandon a\n /// half-read frame — a desynced carrier, which is exactly why the pump\n /// carrier was SPLIT instead of given a socket timeout. Pre-fix this arm\n /// dropped the parameter on the floor, so a caller that asked for a\n /// bounded read silently got an unbounded one; the defect was the\n /// silence, not the missing timeout.\n /// - [`BrainConn::Split`] — the pump carrier: the reader thread already owns\n /// the blocking read, so a bounded read is just [`Receiver::recv_timeout`]\n /// on the remaining budget. A `Timeout` surfaces [`io::ErrorKind::TimedOut`]\n /// — the poison signal the pump escalates to a supervised restart (NEVER a\n /// per-peer retry). A `Disconnected` channel means the reader thread exited\n /// (the conn hung up); surface it as `UnexpectedEof`.\n // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n fn read_frame_until(&mut self, deadline: Option) -> io::Result {\n match &mut self.conn {\n // Absent stays absent: no fabricated default bound on the blocking\n // read (the absent-is-not-zero shape, releases#201).\n BrainConn::Whole(stream) if deadline.is_none() => read_frame(stream),\n BrainConn::Whole(_) => Err(io::Error::new(\n io::ErrorKind::Unsupported,\n \"brain IPC read deadline cannot be honored on the blocking (Whole) \\\n carrier — it reads the frame inline, so a timeout would abandon a \\\n half-read frame and desync the conn. Build the client with \\\n `Brain::cold_start_pump` (the Split reader-thread carrier), which \\\n bounds every read; or pass no deadline to read unbounded on purpose\",\n )),\n BrainConn::Split { frames, .. } => match deadline {\n Some(dl) => {\n // Total-wait bound: each recv is the REMAINING budget to the\n // call's entry deadline, so unrelated frames dripping in\n // cannot reset it (the per-read-timeout wedge the ruling\n // forbids). A non-positive remaining → recv_timeout(ZERO),\n // which still drains an already-queued frame before timing out.\n let remaining = dl.saturating_duration_since(Instant::now());\n match frames.recv_timeout(remaining) {\n Ok(framed) => framed,\n Err(RecvTimeoutError::Timeout) => Err(io::Error::new(\n io::ErrorKind::TimedOut,\n \"brain IPC read deadline elapsed\",\n )),\n Err(RecvTimeoutError::Disconnected) => Err(io::Error::new(\n io::ErrorKind::UnexpectedEof,\n \"brain IPC reader thread ended (conn closed)\",\n )),\n }\n }\n None => frames.recv().map_err(|_| {\n…\n })?,\n },\n }\n }"}],"details":{"displayContent":{"text":" pub fn send_input(&mut self, bytes: &[u8]) -> io::Result<()> {\n…\n self.send(\n…\n serde_json::to_value(InputReq {\n…\n op_id: None,\n minter: None,\n ack: true,\n })\n .expect(\"InputReq serializes\"),\n )\n }\n\n /// Inject input **idempotently**: the write carries the durable `op_id` so a\n /// replay after a brain crash is deduped at the broker (exactly-once, B5).\n /// `op_id` must come from a durable source and be reused verbatim on replay —\n /// the same logical effect must always carry the same id, so the broker's\n /// applied-set recognizes the re-drive. The broker answers with a\n /// [`BrokerEvent::Applied`] for `(session, op_id)`.\n ///\n /// ACKED (`ack=true`): the caller waits on the [`BrokerEvent::Applied`] one at a\n /// time (the `shellchan` spool-delivery drain). For the fire-and-forward\n /// operator/rc path — which never reads the ack and can send a FLOOD on one\n /// conn — use [`Brain::send_effect_no_ack`] to avoid the ack-backpressure\n /// deadlock (REQ-HAZARD-INPUT-ACK-BACKPRESSURE).\n // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n pub fn send_effect(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n self.send_effect_inner(op, bytes, true)\n }\n\n /// Inject input idempotently like [`Brain::send_effect`] but request NO\n /// [`KIND_APPLIED`] ack (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The operator/rc\n /// attach path is fire-and-forward — `op_id` is for dedup only and the ack is\n /// discarded by `serve_attach` — and it can flood N input frames on ONE\n /// brain↔broker conn without returning to read. With no ack the broker's\n /// per-conn handler never writes back while servicing that flood, so the return\n /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n /// broker still dedups by `(session, op_id)` at its applied-set.\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n pub fn send_effect_no_ack(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n self.send_effect_inner(op, bytes, false)\n }\n\n /// Shared body for [`Brain::send_effect`] / [`Brain::send_effect_no_ack`]: the\n /// only difference is whether the broker replies a `KIND_APPLIED` ack. The\n /// [`MintedOp`] carries both the durable seq and its minter tag (ADR-0034), so\n /// the wire's `op_id`/`minter` fields are stamped together — an unstamped op is\n /// uncompilable. The broker's `KIND_APPLIED` still echoes the bare `seq`.\n fn send_effect_inner(&mut self, op: MintedOp, bytes: &[u8], ack: bool) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_INPUT,\n serde_json::to_value(InputReq {\n session_id: sid,\n data_b64: encode_bytes(bytes),\n op_id: Some(op.seq),\n minter: Some(op.minter),\n ack,\n })\n .expect(\"InputReq serializes\"),\n )\n }\n\n /// Resize the current session's PTY.\n pub fn resize(&mut self, rows: u16, cols: u16) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_RESIZE,\n serde_json::to_value(ResizeReq {\n session_id: sid,\n rows,\n cols,\n })\n .expect(\"ResizeReq serializes\"),\n )\n }\n\n /// Terminate the current session's child.\n pub fn kill_session(&mut self) -> io::Result<()> {\n let sid = self.require_session()?;\n self.send(\n KIND_KILL,\n serde_json::to_value(KillReq { session_id: sid }).expect(\"KillReq serializes\"),\n )\n }\n…\n pub fn attach_as_coded(\n &mut self,\n session_id: u64,\n from_seq: u64,\n intent: AttachIntent,\n gen: u64,\n by: Option<&str>,\n code: Option<&str>,\n seal_ceremony: bool,\n ) -> io::Result<()> {\n self.session_id = Some(session_id);\n self.next_seq = from_seq;\n // #6 (ADR-0031): a COLD attach (`from_seq == 0` — the `rc` / `endpoint run\n // --attach` case) gets a clean-screen repaint at pseudo-seq\n // `broker.next_seq - 1` as its first frame; baseline the strict cursor on it\n // (accept-then-strict). A resume-from-floor re-fetch (`from_seq > 0`) leaves\n // this false → raw-ring replay + strict reject-gap unchanged (B2).\n self.baseline_next_output = from_seq == 0;\n self.subscribe_with(\n session_id,\n from_seq,\n intent,\n gen,\n by.map(str::to_string),\n code.map(str::to_string),\n seal_ceremony,\n )\n }\n…\n /// Write bytes to a held stream over the broker (D4b). With `op_id` the\n /// write is exactly-once and this blocks for the `net-sent` ack (returned);\n /// without one it is a direct fire-and-forget write (`None` returned).\n /// `finish` closes the send side after the write.\n // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n pub fn net_stream_send(\n &mut self,\n stream_id: u64,\n bytes: &[u8],\n op: Option,\n finish: bool,\n ) -> io::Result> {\n self.send(\n KIND_NET_STREAM_SEND,\n serde_json::to_value(NetStreamSendReq {\n stream_id,\n data_b64: encode_bytes(bytes),\n op_id: op.map(|o| o.seq),\n minter: op.map(|o| o.minter),\n finish,\n })\n .expect(\"NetStreamSendReq serializes\"),\n )?;\n if op.is_none() {\n return Ok(None);\n }\n let want_seq = op.map(|o| o.seq);\n // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n let deadline = self.call_deadline();\n loop {\n match self.read_event_until(deadline)? {\n BrokerEvent::NetSent(ev) if Some(ev.op_id) == want_seq => return Ok(Some(ev)),\n BrokerEvent::Error { message } => return Err(io::Error::other(message)),\n _ => continue,\n }\n }\n }\n\n…\n fn subscribe_with(\n &mut self,\n session_id: u64,\n from_seq: u64,\n intent: AttachIntent,\n gen: u64,\n by: Option,\n code: Option,\n seal_ceremony: bool,\n ) -> io::Result<()> {\n // P1c (operator-stream boundary, kitsubito RACEDIAG): a resume-mode brain\n // (seeded map) that subscribes from `from_seq` must RESET this session's\n // dedup cursor to `from_seq` — the broker's replay from `from_seq` is then\n // re-delivered (and the operator's render cursor dedups the overlap),\n // never lost. WHY THIS, NOT just `read_event`'s `or_insert`: on a re-serve,\n // `serve_attach` may CONSUME a handoff-replay frame at the K boundary\n // BEFORE it is `attached` (the frame is dropped by the `if attached` gate\n // but the snap-above cursor still advanced past K); `attach_as(sid, 0)`\n // then re-subscribes from 0, and without this reset the broker's re-send of\n // seq K arrives below the advanced cursor and is deduped → seq K never\n // reaches the operator viewport → a forward gap. Resetting to `from_seq`\n // makes the re-subscribe re-deliver everything from its floor. A cold-start\n // brain (empty map — e.g. the production dispatch serve brain) keeps the\n // legacy `next_seq` path; this only arms in resume mode.\n // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n if !self.session_cursors.is_empty() {\n self.session_cursors.insert(session_id, from_seq);\n }\n self.send(\n KIND_SUBSCRIBE,\n serde_json::to_value(SubscribeReq {\n session_id,\n from_seq,\n intent,\n by,\n gen,\n code,\n seal_ceremony,\n })\n .expect(\"SubscribeReq serializes\"),\n )\n }\n\n fn send(&mut self, kind: &str, payload: serde_json::Value) -> io::Result<()> {\n let env = Envelope::new(kind, payload);\n match &mut self.conn {\n BrainConn::Whole(stream) => write_frame(stream, &env),\n BrainConn::Split { send, .. } => write_frame(send, &env),\n }\n }\n\n /// Read one framed [`Envelope`], bounded by an optional wall-clock\n /// `deadline`. The carrier dispatch (REQ-HAZARD-PUMP-IPC-DEADLINE):\n ///\n /// - [`BrainConn::Whole`] — the ordinary blocking client. `None` is the\n /// ordinary blocking [`read_frame`]. `Some(deadline)` is REFUSED BY NAME\n /// (releases#190): this carrier reads the frame inline, so there is no\n /// thread to hand a deadline to and a timeout would have to abandon a\n /// half-read frame — a desynced carrier, which is exactly why the pump\n /// carrier was SPLIT instead of given a socket timeout. Pre-fix this arm\n /// dropped the parameter on the floor, so a caller that asked for a\n /// bounded read silently got an unbounded one; the defect was the\n /// silence, not the missing timeout.\n /// - [`BrainConn::Split`] — the pump carrier: the reader thread already owns\n /// the blocking read, so a bounded read is just [`Receiver::recv_timeout`]\n /// on the remaining budget. A `Timeout` surfaces [`io::ErrorKind::TimedOut`]\n /// — the poison signal the pump escalates to a supervised restart (NEVER a\n /// per-peer retry). A `Disconnected` channel means the reader thread exited\n /// (the conn hung up); surface it as `UnexpectedEof`.\n // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n fn read_frame_until(&mut self, deadline: Option) -> io::Result {\n match &mut self.conn {\n // Absent stays absent: no fabricated default bound on the blocking\n // read (the absent-is-not-zero shape, releases#201).\n BrainConn::Whole(stream) if deadline.is_none() => read_frame(stream),\n BrainConn::Whole(_) => Err(io::Error::new(\n io::ErrorKind::Unsupported,\n \"brain IPC read deadline cannot be honored on the blocking (Whole) \\\n carrier — it reads the frame inline, so a timeout would abandon a \\\n half-read frame and desync the conn. Build the client with \\\n `Brain::cold_start_pump` (the Split reader-thread carrier), which \\\n bounds every read; or pass no deadline to read unbounded on purpose\",\n )),\n BrainConn::Split { frames, .. } => match deadline {\n Some(dl) => {\n // Total-wait bound: each recv is the REMAINING budget to the\n // call's entry deadline, so unrelated frames dripping in\n // cannot reset it (the per-read-timeout wedge the ruling\n // forbids). A non-positive remaining → recv_timeout(ZERO),\n // which still drains an already-queued frame before timing out.\n let remaining = dl.saturating_duration_since(Instant::now());\n match frames.recv_timeout(remaining) {\n Ok(framed) => framed,\n Err(RecvTimeoutError::Timeout) => Err(io::Error::new(\n io::ErrorKind::TimedOut,\n \"brain IPC read deadline elapsed\",\n )),\n Err(RecvTimeoutError::Disconnected) => Err(io::Error::new(\n io::ErrorKind::UnexpectedEof,\n \"brain IPC reader thread ended (conn closed)\",\n )),\n }\n }\n None => frames.recv().map_err(|_| {\n…\n })?,\n },\n }\n }","startLine":893,"lineNumbers":[893,null,895,null,897,null,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,null,1453,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,null,2096,2097,2098,2099,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2110,2111,2112,2113,2114,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,null,2511,2512,2513,2514,2515,2516,2517,2518,2519,2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533,2534,2535,2536,2537,2538,2539,2540,2541,2542,2543,2544,2545,2546,2547,2548,2549,2550,2551,2552,2553,2554,2555,2556,2557,2558,2559,2560,2561,2562,2563,2564,2565,2566,2567,2568,2569,2570,2571,2572,2573,2574,2575,2576,2577,2578,2579,2580,2581,2582,2583,2584,2585,2586,2587,2588,2589,2590,2591,2592,2593,2594,2595,2596,2597,2598,2599,2600,2601,2602,2603,2604,2605,2606,2607,2608,2609,2610,2611,2612,2613,2614,2615,null,2620,2621,2622,2623]},"fileSize":171079,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\brain.rs"}}},"isError":false,"timestamp":1789528529542}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_qYcrhajoHbP0y85OE100nyk0|fc_00817a6e65e8f156016aaa09db480487d1b4a19b9274c19ba9","toolName":"grep","startedAt":"2026-09-16T03:15:39.353Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs"},"intent":"Locating broker dispatch definitions"},"id":"9ad3bf1c","parentId":"86448568","timestamp":"2026-09-16T03:15:39.353Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_b88e8iekpAP91KvuloRfjQts|fc_00817a6e65e8f156016aaa09db481887d18f88010cf075bcfb","toolName":"read","startedAt":"2026-09-16T03:15:39.353Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:252-348,924-974"},"intent":"Reading event decode and recovery"},"id":"a5f9d416","parentId":"9ad3bf1c","timestamp":"2026-09-16T03:15:39.353Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_rILPQfiSgDgSn4OJZgPnREPz|fc_00817a6e65e8f156016aaa09db482087d18fda0f9af7c19cc8","toolName":"read","startedAt":"2026-09-16T03:15:39.353Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1063-1210,1250-1308,2384-2395,460-492"},"intent":"Reading brain event identities"},"id":"4500e01a","parentId":"a5f9d416","timestamp":"2026-09-16T03:15:39.353Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_dGoomPc41WDkFbnlNlb4QZMX|fc_00817a6e65e8f156016aaa09db482887d1b300e317d4b28102","toolName":"grep","startedAt":"2026-09-16T03:15:39.353Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs"},"intent":"Locating reconstructed worker creation"},"id":"69e29604","parentId":"4500e01a","timestamp":"2026-09-16T03:15:39.353Z"}
{"type":"message","id":"a85c0688","parentId":"69e29604","timestamp":"2026-09-16T03:15:39.353Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_qYcrhajoHbP0y85OE100nyk0|fc_00817a6e65e8f156016aaa09db480487d1b4a19b9274c19ba9","name":"grep","arguments":{"i":"Locating broker dispatch definitions","pattern":"fn dispatch_(subscribe|input|net_stream_send|net_stream_subscribe)|fn send_frame|fn become_controller|fn controller_writer|fn add_viewer","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating broker dispatch definitions"},{"type":"toolCall","id":"call_b88e8iekpAP91KvuloRfjQts|fc_00817a6e65e8f156016aaa09db481887d18f88010cf075bcfb","name":"read","arguments":{"i":"Reading event decode and recovery","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:252-348,924-974"},"intent":"Reading event decode and recovery"},{"type":"toolCall","id":"call_rILPQfiSgDgSn4OJZgPnREPz|fc_00817a6e65e8f156016aaa09db482087d18fda0f9af7c19cc8","name":"read","arguments":{"i":"Reading brain event identities","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1063-1210,1250-1308,2384-2395,460-492"},"intent":"Reading brain event identities"},{"type":"toolCall","id":"call_dGoomPc41WDkFbnlNlb4QZMX|fc_00817a6e65e8f156016aaa09db482887d1b300e317d4b28102","name":"grep","arguments":{"i":"Locating reconstructed worker creation","pattern":"serve_attach\\(|cold_start_pump|cold_start\\(","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating reconstructed worker creation"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":12048,"output":287,"cacheRead":27008,"cacheWrite":0,"totalTokens":39343,"cost":{"input":0.12048,"output":0.01435,"cacheRead":0.027007999999999997,"cacheWrite":0,"total":0.161838}},"stopReason":"toolUse","timestamp":1789528529706,"responseId":"resp_00817a6e65e8f156016aaa09d1ead487d18c6eeb4fd4f8cd05","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09db480487d1b4a19b9274c19ba9","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating broker dispatch definitions\",\"pattern\":\"fn dispatch_(subscribe|input|net_stream_send|net_stream_subscribe)|fn send_frame|fn become_controller|fn controller_writer|fn add_viewer\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_qYcrhajoHbP0y85OE100nyk0","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09db481887d18f88010cf075bcfb","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading event decode and recovery\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs:252-348,924-974\"}","call_id":"call_b88e8iekpAP91KvuloRfjQts","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09db482087d18fda0f9af7c19cc8","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading brain event identities\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1063-1210,1250-1308,2384-2395,460-492\"}","call_id":"call_rILPQfiSgDgSn4OJZgPnREPz","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09db482887d1b300e317d4b28102","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating reconstructed worker creation\",\"pattern\":\"serve_attach\\\\(|cold_start_pump|cold_start\\\\(\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_dGoomPc41WDkFbnlNlb4QZMX","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":9644.050800000317,"ttft":9608.677500000224,"completedAt":1789528539351,"contextSnapshot":{"promptTokens":39056,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"f862dcf3","parentId":"a85c0688","timestamp":"2026-09-16T03:15:39.381Z","message":{"role":"toolResult","toolCallId":"call_dGoomPc41WDkFbnlNlb4QZMX|fc_00817a6e65e8f156016aaa09db482887d1b300e317d4b28102","toolName":"grep","content":[{"type":"text","text":" 900| for _ in 0..300 {\n*901| match Brain::cold_start(broker_name, now_ms()) {\n 902| Ok(b) => return Ok(b),\n 903| Err(e) => last = e,\n 904| }\n...\n 1208| // [impl->REQ-STREAM-OPENER-DURABLE]\n*1209| Some(endpoint) => match serve_attach(\n 1210| &mut brain,\n 1211| broker_name,\n 1212| stream_id,\n...\n 2158|fn broker_session_idle(endpoint: &str) -> Option {\n*2159| let mut brain = Brain::cold_start(&crate::endpoint::broker_socket_name(), now_ms()).ok()?;\n 2160| let hosted = brain\n 2161| .sessions()\n 2162| .ok()?"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\dispatch.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":3,"fileCount":1,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs","count":3}],"truncated":false,"displayContent":" 900│ for _ in 0..300 {\n *901│ match Brain::cold_start(broker_name, now_ms()) {\n 902│ Ok(b) => return Ok(b),\n 903│ Err(e) => last = e,\n 904│ }\n │...\n 1208│ // [impl->REQ-STREAM-OPENER-DURABLE]\n*1209│ Some(endpoint) => match serve_attach(\n 1210│ &mut brain,\n 1211│ broker_name,\n 1212│ stream_id,\n │...\n 2158│fn broker_session_idle(endpoint: &str) -> Option {\n*2159│ let mut brain = Brain::cold_start(&crate::endpoint::broker_socket_name(), now_ms()).ok()?;\n 2160│ let hosted = brain\n 2161│ .sessions()\n 2162│ .ok()?"},"isError":false,"timestamp":1789528539380}}
{"type":"message","id":"5e3d84ed","parentId":"f862dcf3","timestamp":"2026-09-16T03:15:39.383Z","message":{"role":"toolResult","toolCallId":"call_b88e8iekpAP91KvuloRfjQts|fc_00817a6e65e8f156016aaa09db481887d18f88010cf075bcfb","toolName":"read","content":[{"type":"text","text":"pub fn read_controller_event_resuming(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n) -> io::Result {\n read_controller_event_resuming_until(brain, session_id, gen, by, None)\n}\n\n/// Deadline-aware form of [`read_controller_event_resuming`].\n///\n/// Production callers pass no deadline through the wrapper above. Timed observers\n/// use this form so a quiet controller cannot hide their wall-clock bound inside an\n/// unbounded frame read.\npub fn read_controller_event_resuming_until(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n deadline: Option,\n) -> io::Result {\n let mut last_resume_floor: Option = None;\n let mut swallow_resume_ack = false;\n loop {\n match brain.read_event_until(deadline) {\n // Our own re-subscribe's Subscribed reply: swallow it (role is already\n // resolved) so it cannot mask a repeated gap as forward progress.\n Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\n swallow_resume_ack = false;\n continue;\n }\n Ok(ev) => return Ok(ev),\n Err(e) if is_output_gap(&e) => {\n let floor = brain.controller_resume_floor();\n if last_resume_floor == Some(floor) {\n // No progress across two resumes → the ring rolled past the\n // floor → the dropped frames are gone.\n return Err(io::Error::other(ControllerIrrecoverablyBehind { floor }));\n }\n last_resume_floor = Some(floor);\n // RE-FETCH from the frozen delivered_through (same operator `by` →\n // a silent re-take, no Displaced); the broker replays the dropped\n // frames from the ring.\n // No bring-up code here, and none is needed: this re-subscribe\n // arrives on the connection that already holds the seat, which is\n // exactly the exemption `engineroom::bringup_required` names — a\n // controller must not lose a gated endpoint's controls for having\n // fallen behind its own output.\n // THE decision, bound ONCE and passed: the same value is logged and\n // handed to `attach_as`, so the breadcrumb cannot drift from the\n // attach it describes. A separately-written label would still read\n // `control` on the day this choice becomes conditional.\n let intent = AttachIntent::Control;\n // Wildcard-free on purpose: a new `AttachIntent` variant must fail to\n // compile here rather than silently log as one of today's three.\n let intent_lbl = match intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // Emitted BEFORE the re-subscribe, on the daemon stderr sink, joinable\n // to the broker's SUBSCRIBE_DECISION on `session`. ids/counters only —\n // never PTY bytes. This is the same-conn different-floor re-take: the\n // caller's own writer is dropped by the broker's fallthrough, so when\n // a controller loses its seat with no Displaced event, THIS line is\n // what says the re-take was our own and names the floor it re-took at.\n spt_proto::emit_line_err!(\n \"ATTACH_INTENT_CHOSEN: site=gap_resume session={session_id} \\\n intent={intent_lbl} from_seq={floor} gen={gen}\"\n );\n brain.attach_as(session_id, floor, intent, gen, by)?;\n swallow_resume_ack = true;\n }\n Err(e) => return Err(e),\n }\n }\n}\n\n/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n/// its own session table, so a remote operator — which cannot know our local\n/// session id — names the endpoint and we map it here, never trusting a wire\n/// `session_id` it could not have. `None` ⇒ no live session under that endpoint\n/// (a stale registry row routed us an attach for something gone → the caller\n/// refuses cleanly, D6).\n// [impl->REQ-RC-CROSS-NODE-ATTACH]\npub(crate) fn resolve_local_session(brain: &mut Brain, endpoint: &str) -> Option {\n brain.sessions().ok().and_then(|reply| {\n reply\n .sessions\n .into_iter()\n .find(|s| s.endpoint == endpoint)\n .map(|s| s.session_id)\n })\n}\n\n…\npub fn serve_attach(\n…\n) -> io::Result {\n…\n loop {\n…\n match event {\n…\n BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\n…\n // info.json, carrying the current driven_by through), THEN release\n // the role over IPC so the broker's driven_by=None is the LAST\n // write — otherwise a concurrent resting RMW restores the stale\n // marker (the clear-race the broker-single-writer model averts).\n if role == Some(ServeRole::Controller) {\n // The driver detached — the endpoint rests warm (controller-\n // only; a viewer leaving is wake-neutral).\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n if let Some(sid) = attached_session {\n let _ = brain.detach_session_gen(sid, Some(serve_gen)); // release ONLY our generation\n }\n return Ok(AttachServeOutcome::Detached);\n }\n\n // ── Session → wire: output and exit. ────────────────────────────\n BrokerEvent::Output { seq, bytes, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Output {\n seq,\n data_b64: encode_bytes(&bytes),\n });\n // Unjournaled by design (see module docs): `seq` rides inside\n // the record, and the operator's render cursor is the dedup.\n w2b_probe!(\"output_forward\", wire.net_stream_send(stream_id, &line, None, false))?;\n }\n BrokerEvent::Exit { code, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Exit { code });\n wire.net_stream_send(stream_id, &line, None, true)?;\n if role == Some(ServeRole::Controller) {\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n return Ok(AttachServeOutcome::Exited(code));\n }\n\n BrokerEvent::Error { message } => {\n if role == Some(ServeRole::Controller) {\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n return Err(io::Error::other(message));\n }\n // Applied/NetSent acks and unrelated events: not ours to handle.\n _ => {}\n }\n }\n}\n\n/// Operator-side: open an attach stream on a dialed connection and send the\n/// [`AttachRecord::Request`]. Returns the stream id the caller then consumes\n/// ([`AttachRecord::Output`] frames, deduped by `seq`) and writes\n/// ([`AttachRecord::Input`] with operator-minted op ids). `open_op` is the\n/// durable id for the exactly-once stream open (safe to block for its ack —"}],"details":{"displayContent":{"text":"pub fn read_controller_event_resuming(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n) -> io::Result {\n read_controller_event_resuming_until(brain, session_id, gen, by, None)\n}\n\n/// Deadline-aware form of [`read_controller_event_resuming`].\n///\n/// Production callers pass no deadline through the wrapper above. Timed observers\n/// use this form so a quiet controller cannot hide their wall-clock bound inside an\n/// unbounded frame read.\npub fn read_controller_event_resuming_until(\n brain: &mut Brain,\n session_id: u64,\n gen: u64,\n by: Option<&str>,\n deadline: Option,\n) -> io::Result {\n let mut last_resume_floor: Option = None;\n let mut swallow_resume_ack = false;\n loop {\n match brain.read_event_until(deadline) {\n // Our own re-subscribe's Subscribed reply: swallow it (role is already\n // resolved) so it cannot mask a repeated gap as forward progress.\n Ok(BrokerEvent::Subscribed { .. }) if swallow_resume_ack => {\n swallow_resume_ack = false;\n continue;\n }\n Ok(ev) => return Ok(ev),\n Err(e) if is_output_gap(&e) => {\n let floor = brain.controller_resume_floor();\n if last_resume_floor == Some(floor) {\n // No progress across two resumes → the ring rolled past the\n // floor → the dropped frames are gone.\n return Err(io::Error::other(ControllerIrrecoverablyBehind { floor }));\n }\n last_resume_floor = Some(floor);\n // RE-FETCH from the frozen delivered_through (same operator `by` →\n // a silent re-take, no Displaced); the broker replays the dropped\n // frames from the ring.\n // No bring-up code here, and none is needed: this re-subscribe\n // arrives on the connection that already holds the seat, which is\n // exactly the exemption `engineroom::bringup_required` names — a\n // controller must not lose a gated endpoint's controls for having\n // fallen behind its own output.\n // THE decision, bound ONCE and passed: the same value is logged and\n // handed to `attach_as`, so the breadcrumb cannot drift from the\n // attach it describes. A separately-written label would still read\n // `control` on the day this choice becomes conditional.\n let intent = AttachIntent::Control;\n // Wildcard-free on purpose: a new `AttachIntent` variant must fail to\n // compile here rather than silently log as one of today's three.\n let intent_lbl = match intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // Emitted BEFORE the re-subscribe, on the daemon stderr sink, joinable\n // to the broker's SUBSCRIBE_DECISION on `session`. ids/counters only —\n // never PTY bytes. This is the same-conn different-floor re-take: the\n // caller's own writer is dropped by the broker's fallthrough, so when\n // a controller loses its seat with no Displaced event, THIS line is\n // what says the re-take was our own and names the floor it re-took at.\n spt_proto::emit_line_err!(\n \"ATTACH_INTENT_CHOSEN: site=gap_resume session={session_id} \\\n intent={intent_lbl} from_seq={floor} gen={gen}\"\n );\n brain.attach_as(session_id, floor, intent, gen, by)?;\n swallow_resume_ack = true;\n }\n Err(e) => return Err(e),\n }\n }\n}\n\n/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n/// its own session table, so a remote operator — which cannot know our local\n/// session id — names the endpoint and we map it here, never trusting a wire\n/// `session_id` it could not have. `None` ⇒ no live session under that endpoint\n/// (a stale registry row routed us an attach for something gone → the caller\n/// refuses cleanly, D6).\n// [impl->REQ-RC-CROSS-NODE-ATTACH]\npub(crate) fn resolve_local_session(brain: &mut Brain, endpoint: &str) -> Option {\n brain.sessions().ok().and_then(|reply| {\n reply\n .sessions\n .into_iter()\n .find(|s| s.endpoint == endpoint)\n .map(|s| s.session_id)\n })\n}\n\n…\npub fn serve_attach(\n…\n) -> io::Result {\n…\n loop {\n…\n match event {\n…\n BrokerEvent::NetStreamEof { stream_id: sid, .. } if sid == stream_id => {\n…\n // info.json, carrying the current driven_by through), THEN release\n // the role over IPC so the broker's driven_by=None is the LAST\n // write — otherwise a concurrent resting RMW restores the stale\n // marker (the clear-race the broker-single-writer model averts).\n if role == Some(ServeRole::Controller) {\n // The driver detached — the endpoint rests warm (controller-\n // only; a viewer leaving is wake-neutral).\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n if let Some(sid) = attached_session {\n let _ = brain.detach_session_gen(sid, Some(serve_gen)); // release ONLY our generation\n }\n return Ok(AttachServeOutcome::Detached);\n }\n\n // ── Session → wire: output and exit. ────────────────────────────\n BrokerEvent::Output { seq, bytes, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Output {\n seq,\n data_b64: encode_bytes(&bytes),\n });\n // Unjournaled by design (see module docs): `seq` rides inside\n // the record, and the operator's render cursor is the dedup.\n w2b_probe!(\"output_forward\", wire.net_stream_send(stream_id, &line, None, false))?;\n }\n BrokerEvent::Exit { code, .. } if attached => {\n let line = ndjson::encode_line(&AttachRecord::Exit { code });\n wire.net_stream_send(stream_id, &line, None, true)?;\n if role == Some(ServeRole::Controller) {\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n return Ok(AttachServeOutcome::Exited(code));\n }\n\n BrokerEvent::Error { message } => {\n if role == Some(ServeRole::Controller) {\n feed_rest(endpoint, crate::resting::RestEvent::Detach);\n }\n return Err(io::Error::other(message));\n }\n // Applied/NetSent acks and unrelated events: not ours to handle.\n _ => {}\n }\n }\n}\n\n/// Operator-side: open an attach stream on a dialed connection and send the\n/// [`AttachRecord::Request`]. Returns the stream id the caller then consumes\n/// ([`AttachRecord::Output`] frames, deduped by `seq`) and writes\n/// ([`AttachRecord::Input`] with operator-minted op ids). `open_op` is the\n/// durable id for the exactly-once stream open (safe to block for its ack —","startLine":252,"lineNumbers":[252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,null,473,null,482,null,591,null,641,null,921,null,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974]},"fileSize":60886,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\attach.rs"}}},"isError":false,"timestamp":1789528539383}}
{"type":"message","id":"ebd662bd","parentId":"5e3d84ed","timestamp":"2026-09-16T03:15:39.385Z","message":{"role":"toolResult","toolCallId":"call_qYcrhajoHbP0y85OE100nyk0|fc_00817a6e65e8f156016aaa09db480487d1b4a19b9274c19ba9","toolName":"grep","content":[{"type":"text","text":" 2591|\n*2592| fn become_controller(&mut self, sub: SharedSend, by: Option, from_seq: u64, attach_gen: u64) {\n 2593| // Drop the prior controller sink first (its writer's live loop ends when\n 2594| // tx drops), and bump the generation so (a) an in-flight deadline-evict\n 2595| // for the old controller can't unseat this one and (b) a prior writer\n...\n 2907| /// live queue. The drain thread fans live frames in via `try_send`.\n*2908| fn add_viewer(&mut self, sub: SharedSend, from_seq: u64, by: Option<&str>) {\n 2909| let vid = self.next_viewer_id;\n 2910| self.next_viewer_id += 1;\n 2911| // Attribution (F-039 legs b+d): viewer role fact + attach record.\n...\n 3954|#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\n*3955|fn controller_writer(\n 3956| sid: u64,\n 3957| send: SharedSend,\n 3958| initial: Vec<(u64, Vec)>,\n...\n 8749| /// self-kick guard.\n*8750| fn dispatch_subscribe(&self, env: Envelope, send: &SharedSend) -> Result {\n 8751| let req: SubscribeReq = serde_json::from_value(env.payload)\n 8752| .map_err(|e| format!(\"bad subscribe payload: {e}\"))?;\n 8753| // Clone the log Arc out from under the sessions lock, then resolve under\n...\n 8845| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*8846| fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8847| let req: InputReq =\n 8848| serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n 8849| let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n...\n 9085| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*9086| fn dispatch_input_paths_reply(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 9087| let reply: spt_net::net::attach::InputPathReply = serde_json::from_value(env.payload)\n 9088| .map_err(|e| format!(\"bad input paths reply: {e}\"))?;\n 9089| let books: Vec<_> = {\n...\n 9825| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*9826| fn dispatch_net_stream_send(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 9827| let req: NetStreamSendReq = serde_json::from_value(env.payload)\n 9828| .map_err(|e| format!(\"bad net-stream-send payload: {e}\"))?;\n 9829| let bytes =\n...\n 9963| // [impl->REQ-DAEMON-2]\n*9964| fn dispatch_net_stream_subscribe(\n 9965| &self,\n 9966| env: Envelope,\n 9967| send: &SharedSend,\n...\n 10256|// [impl->REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]\n*10257|fn send_frame(send: &SharedSend, frame: &Envelope) {\n 10258| let _ = send.write(frame);\n 10259|}\n 10260|"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\broker.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":9,"fileCount":1,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs","count":9}],"truncated":false,"displayContent":" 2591│\n *2592│ fn become_controller(&mut self, sub: SharedSend, by: Option, from_seq: u64, attach_gen: u64) {\n 2593│ // Drop the prior controller sink first (its writer's live loop ends when\n 2594│ // tx drops), and bump the generation so (a) an in-flight deadline-evict\n 2595│ // for the old controller can't unseat this one and (b) a prior writer\n │...\n 2907│ /// live queue. The drain thread fans live frames in via `try_send`.\n *2908│ fn add_viewer(&mut self, sub: SharedSend, from_seq: u64, by: Option<&str>) {\n 2909│ let vid = self.next_viewer_id;\n 2910│ self.next_viewer_id += 1;\n 2911│ // Attribution (F-039 legs b+d): viewer role fact + attach record.\n │...\n 3954│#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\n *3955│fn controller_writer(\n 3956│ sid: u64,\n 3957│ send: SharedSend,\n 3958│ initial: Vec<(u64, Vec)>,\n │...\n 8749│ /// self-kick guard.\n *8750│ fn dispatch_subscribe(&self, env: Envelope, send: &SharedSend) -> Result {\n 8751│ let req: SubscribeReq = serde_json::from_value(env.payload)\n 8752│ .map_err(|e| format!(\"bad subscribe payload: {e}\"))?;\n 8753│ // Clone the log Arc out from under the sessions lock, then resolve under\n │...\n 8845│ // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n *8846│ fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 8847│ let req: InputReq =\n 8848│ serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n 8849│ let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n │...\n 9085│ // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n *9086│ fn dispatch_input_paths_reply(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 9087│ let reply: spt_net::net::attach::InputPathReply = serde_json::from_value(env.payload)\n 9088│ .map_err(|e| format!(\"bad input paths reply: {e}\"))?;\n 9089│ let books: Vec<_> = {\n │...\n 9825│ // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n *9826│ fn dispatch_net_stream_send(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n 9827│ let req: NetStreamSendReq = serde_json::from_value(env.payload)\n 9828│ .map_err(|e| format!(\"bad net-stream-send payload: {e}\"))?;\n 9829│ let bytes =\n │...\n 9963│ // [impl->REQ-DAEMON-2]\n *9964│ fn dispatch_net_stream_subscribe(\n 9965│ &self,\n 9966│ env: Envelope,\n 9967│ send: &SharedSend,\n │...\n 10256│// [impl->REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]\n*10257│fn send_frame(send: &SharedSend, frame: &Envelope) {\n 10258│ let _ = send.write(frame);\n 10259│}\n 10260│"},"isError":false,"timestamp":1789528539384}}
{"type":"message","id":"5a447fc8","parentId":"ebd662bd","timestamp":"2026-09-16T03:15:39.390Z","message":{"role":"toolResult","toolCallId":"call_rILPQfiSgDgSn4OJZgPnREPz|fc_00817a6e65e8f156016aaa09db482087d18fda0f9af7c19cc8","toolName":"read","content":[{"type":"text","text":"pub struct Brain {\n…\n}\n\nimpl Brain {\n /// Cold start: connect, handshake, fresh generation 0, `gen_start = now`.\n /// The ordinary blocking carrier ([`BrainConn::Whole`]) — every client\n /// except the peer pump, which uses [`Brain::cold_start_pump`].\n pub fn cold_start(name: &str, now_ms: u64) -> io::Result {\n let mut conn = LocalSocketTransport::connect(name)?;\n send_hello(&mut conn, Role::Brain)?;\n Ok(Brain {\n conn: BrainConn::Whole(conn),\n generation: 0,\n gen_start_ms: now_ms,\n session_id: None,\n next_seq: 0,\n net_cursors: std::collections::HashMap::new(),\n presence_cursor: None,\n session_cursors: std::collections::HashMap::new(),\n io_timeout: None,\n baseline_next_output: false,\n })\n }\n\n /// Cold start in **PUMP mode**: connect, handshake, then SPLIT the stream\n /// into the reader-thread carrier ([`BrainConn::Split`]) and arm a per-IPC-\n /// call deadline of `io_timeout`. This is the peer pump's dedicated client —\n /// every reply read is bounded ([`Brain::read_event_until`] via\n /// [`Brain::call_deadline`]) so a black-holed peer can never wedge the\n /// single-threaded pump. The split is done at CONSTRUCTION (not flipped on a\n /// live `Whole` after the fact — moving the `Stream` out by value to split it\n /// is impossible behind `&mut self`), so a pump brain is split-and-bounded\n /// for its whole life and a non-pump brain never pays the reader thread.\n /// `trace` picks the reader's lifecycle-marker sink (REQ-RC-DISPLAY-SOLE-\n…\n pub fn read_event_until(&mut self, deadline: Option) -> io::Result {\n loop {\n let env = self.read_frame_until(deadline)?;\n match env.kind.as_str() {\n KIND_OUTPUT => {\n let ev: OutputEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n // A **resume-mode** brain (the per-session map is populated by\n // `resume_sessions`) routes EVERY session through the map —\n // including a freshly-spawned or first-seen one, which seeds\n // itself at its first `seq` via `entry().or_insert` (D4-2b,\n // doyle amendment 5: this closes the mixed-mode gap where N≥2\n // fresh spawns would otherwise share the single `next_seq` and\n // silently drop the later sessions' seq-0 output). The broker's\n // `Mutex`-held wire order guarantees first-sight of a\n // new session IS seq 0, so the seed == 0 for a spawn; a resumed\n // session already holds its `resume_seq` seed (the `entry`\n // returns it, so the boundary-dedup still applies). Discipline:\n // **dedup-below + snap-above, NO reject-gap** — drop an\n // already-delivered seq (the at-least-once boundary re-send),\n // accept-and-snap everything `>= cursor` (the contiguous case\n // AND a post-eviction ring-floor jump, which the broker's\n // non-reordering replay makes the only legitimate forward jump).\n if !self.session_cursors.is_empty() {\n let cursor = self.session_cursors.entry(ev.session_id).or_insert(ev.seq);\n if ev.seq < *cursor {\n // Replay duplicate / boundary re-send — dedup. A FLAGGED\n // backward frame (a replayed old sync frame) dedups the\n // same way: NEVER a backward baseline — a rewind would\n // re-accept replayed frames (the wire-flag ruling's\n // forward-only pin, REQ-RC-RESIZE-PRESENTATION-BARRIER).\n continue;\n }\n *cursor = ev.seq + 1;\n let bytes = decode_bytes(&ev.data_b64)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Output {\n session_id: ev.session_id,\n seq: ev.seq,\n bytes,\n });\n }\n // Legacy single-session path (map empty — a pure spawn/drive\n // seat): strict accept-next / drop-dup / reject-gap on the one\n // `next_seq` cursor, byte-for-byte unchanged.\n //\n // #6 (ADR-0031): a COLD attach's FIRST output frame is a\n // clean-screen repaint at pseudo-seq `broker.next_seq - 1` (a\n // forward jump from the requested `from_seq == 0`). Adopt that seq\n // as the baseline instead of reject-gapping it — the repaint IS\n // the complete current screen, nothing prior is owed. Consumed\n // once per (cold) attach; every subsequent LIVE frame then takes\n // the strict reject-gap below (a b4 drop still re-fetches — B2).\n if self.baseline_next_output {\n self.next_seq = ev.seq;\n self.baseline_next_output = false;\n }\n if ev.seq < self.next_seq {\n // Already processed — a replay duplicate; dedup. A FLAGGED\n // backward frame dedups identically (forward-only pin: a\n // backward baseline would rewind the cursor under replayed\n // frames and exactly-once dies).\n continue;\n }\n if ev.seq > self.next_seq {\n // A FLAGGED forward jump is the broker declaring \"this\n // synthesized frame SUPERSEDES everything before its seq\"\n // (the resize commit/abort sync frame, a below-floor resume\n // repaint — REQ-RC-RESIZE-PRESENTATION-BARRIER, doyle\n // wire-flag ruling 2026-07-21). Accept + baseline: B2-sound,\n // not a B2 exception — the supersession is explicit and\n // broker-authored, nothing is silently skipped. An UNFLAGGED\n // jump keeps the strict reject-gap byte-for-byte (a b4 drop\n // still re-fetches from the floor).\n // [impl->REQ-RC-RESIZE-PRESENTATION-BARRIER]\n if !ev.sync {\n return Err(io::Error::new(\n io::ErrorKind::InvalidData,\n format!(\"output gap: got seq {} want {}\", ev.seq, self.next_seq),\n ));\n }\n }\n self.next_seq = ev.seq + 1;\n let bytes = decode_bytes(&ev.data_b64)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Output {\n session_id: ev.session_id,\n seq: ev.seq,\n bytes,\n });\n }\n KIND_SPAWN_CONFLICT => {\n let ev: SpawnConflict = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SpawnConflict {\n endpoint: ev.endpoint,\n session_id: ev.session_id,\n });\n }\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n KIND_BROUGHT_UP => {\n let ev: BroughtUpReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::BroughtUp {\n outcome: ev.outcome,\n detail: ev.detail,\n session_id: ev.session_id,\n admit: ev.admit,\n });\n }\n // [impl->REQ-SEAL-CEREMONY-TOTP]\n KIND_SEAL_CEREMONY_REPLY => {\n let ev: SealCeremonyReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyDone {\n outcome: ev.outcome,\n detail: ev.detail,\n token: ev.token,\n });\n }\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n KIND_SEAL_CEREMONY_OPEN => {\n let ev: SealCeremonyOpenEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyOpen {\n session_id: ev.session_id,\n ceremony_id: ev.ceremony_id,\n content_b64: ev.content_b64,\n subnet: ev.subnet,\n destination: ev.destination,\n payload_to_sign_b64: ev.payload_to_sign_b64,\n fido2_node: ev.fido2_node,\n offer_enroll: ev.offer_enroll,\n });\n }\n KIND_SEAL_CEREMONY_RESULT => {\n let ev: SealCeremonyResultEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyResult {\n session_id: ev.session_id,\n ceremony_id: ev.ceremony_id,\n outcome: ev.outcome,\n detail: ev.detail,\n });\n }\n KIND_SPAWNED => {\n let ev: Spawned = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n…\n }\n…\n // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n KIND_VIEWER_EVICTED => {\n let ev: ViewerEvictedEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::ViewerEvicted {\n session_id: ev.session_id,\n });\n }\n KIND_APPLIED => {\n let ev: AppliedEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Applied {\n session_id: ev.session_id,\n op_id: ev.op_id,\n applied_now: ev.applied_now,\n });\n }\n KIND_NET_STATUS_REPLY => {\n let ev: NetStatusReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStatus(ev));\n }\n KIND_NET_DIALED => {\n let ev: NetDialed = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetDialed(ev));\n }\n // The bare ack for a non-blocking submit-dial (PUMP-TRUTH W2) —\n // null payload; the dial's outcome rides the presence stream.\n // [impl->REQ-PUMP-PEER-ISOLATION]\n KIND_NET_DIAL_SUBMITTED => return Ok(BrokerEvent::NetDialSubmitted),\n KIND_NET_STREAM_OPENED => {\n let ev: NetStreamOpened = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStreamOpened(ev));\n }\n KIND_NET_SENT => {\n let ev: NetSent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetSent(ev));\n }\n KIND_NET_STREAMS_REPLY => {\n let ev: NetStreamsReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStreams(ev));\n }\n KIND_SESSIONS_REPLY => {\n let ev: SessionsReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Sessions(ev));\n }\n KIND_PAIR_JOINED => {\n let ev: PairJoinReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::PairJoined(ev));\n }\n KIND_MET_MEMBER => {\n let ev: MetMember = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n…\n }\n…\n }\n }\n }\n…\n pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {\n self.net_cursors.insert(stream_id, from_seq);\n self.send(\n KIND_NET_STREAM_SUBSCRIBE,\n serde_json::to_value(NetStreamSubscribeReq {\n stream_id,\n from_seq,\n })\n .expect(\"NetStreamSubscribeReq serializes\"),\n )\n }\n\n…\n}"}],"details":{"displayContent":{"text":"pub struct Brain {\n…\n}\n\nimpl Brain {\n /// Cold start: connect, handshake, fresh generation 0, `gen_start = now`.\n /// The ordinary blocking carrier ([`BrainConn::Whole`]) — every client\n /// except the peer pump, which uses [`Brain::cold_start_pump`].\n pub fn cold_start(name: &str, now_ms: u64) -> io::Result {\n let mut conn = LocalSocketTransport::connect(name)?;\n send_hello(&mut conn, Role::Brain)?;\n Ok(Brain {\n conn: BrainConn::Whole(conn),\n generation: 0,\n gen_start_ms: now_ms,\n session_id: None,\n next_seq: 0,\n net_cursors: std::collections::HashMap::new(),\n presence_cursor: None,\n session_cursors: std::collections::HashMap::new(),\n io_timeout: None,\n baseline_next_output: false,\n })\n }\n\n /// Cold start in **PUMP mode**: connect, handshake, then SPLIT the stream\n /// into the reader-thread carrier ([`BrainConn::Split`]) and arm a per-IPC-\n /// call deadline of `io_timeout`. This is the peer pump's dedicated client —\n /// every reply read is bounded ([`Brain::read_event_until`] via\n /// [`Brain::call_deadline`]) so a black-holed peer can never wedge the\n /// single-threaded pump. The split is done at CONSTRUCTION (not flipped on a\n /// live `Whole` after the fact — moving the `Stream` out by value to split it\n /// is impossible behind `&mut self`), so a pump brain is split-and-bounded\n /// for its whole life and a non-pump brain never pays the reader thread.\n /// `trace` picks the reader's lifecycle-marker sink (REQ-RC-DISPLAY-SOLE-\n…\n pub fn read_event_until(&mut self, deadline: Option) -> io::Result {\n loop {\n let env = self.read_frame_until(deadline)?;\n match env.kind.as_str() {\n KIND_OUTPUT => {\n let ev: OutputEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n // A **resume-mode** brain (the per-session map is populated by\n // `resume_sessions`) routes EVERY session through the map —\n // including a freshly-spawned or first-seen one, which seeds\n // itself at its first `seq` via `entry().or_insert` (D4-2b,\n // doyle amendment 5: this closes the mixed-mode gap where N≥2\n // fresh spawns would otherwise share the single `next_seq` and\n // silently drop the later sessions' seq-0 output). The broker's\n // `Mutex`-held wire order guarantees first-sight of a\n // new session IS seq 0, so the seed == 0 for a spawn; a resumed\n // session already holds its `resume_seq` seed (the `entry`\n // returns it, so the boundary-dedup still applies). Discipline:\n // **dedup-below + snap-above, NO reject-gap** — drop an\n // already-delivered seq (the at-least-once boundary re-send),\n // accept-and-snap everything `>= cursor` (the contiguous case\n // AND a post-eviction ring-floor jump, which the broker's\n // non-reordering replay makes the only legitimate forward jump).\n if !self.session_cursors.is_empty() {\n let cursor = self.session_cursors.entry(ev.session_id).or_insert(ev.seq);\n if ev.seq < *cursor {\n // Replay duplicate / boundary re-send — dedup. A FLAGGED\n // backward frame (a replayed old sync frame) dedups the\n // same way: NEVER a backward baseline — a rewind would\n // re-accept replayed frames (the wire-flag ruling's\n // forward-only pin, REQ-RC-RESIZE-PRESENTATION-BARRIER).\n continue;\n }\n *cursor = ev.seq + 1;\n let bytes = decode_bytes(&ev.data_b64)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Output {\n session_id: ev.session_id,\n seq: ev.seq,\n bytes,\n });\n }\n // Legacy single-session path (map empty — a pure spawn/drive\n // seat): strict accept-next / drop-dup / reject-gap on the one\n // `next_seq` cursor, byte-for-byte unchanged.\n //\n // #6 (ADR-0031): a COLD attach's FIRST output frame is a\n // clean-screen repaint at pseudo-seq `broker.next_seq - 1` (a\n // forward jump from the requested `from_seq == 0`). Adopt that seq\n // as the baseline instead of reject-gapping it — the repaint IS\n // the complete current screen, nothing prior is owed. Consumed\n // once per (cold) attach; every subsequent LIVE frame then takes\n // the strict reject-gap below (a b4 drop still re-fetches — B2).\n if self.baseline_next_output {\n self.next_seq = ev.seq;\n self.baseline_next_output = false;\n }\n if ev.seq < self.next_seq {\n // Already processed — a replay duplicate; dedup. A FLAGGED\n // backward frame dedups identically (forward-only pin: a\n // backward baseline would rewind the cursor under replayed\n // frames and exactly-once dies).\n continue;\n }\n if ev.seq > self.next_seq {\n // A FLAGGED forward jump is the broker declaring \"this\n // synthesized frame SUPERSEDES everything before its seq\"\n // (the resize commit/abort sync frame, a below-floor resume\n // repaint — REQ-RC-RESIZE-PRESENTATION-BARRIER, doyle\n // wire-flag ruling 2026-07-21). Accept + baseline: B2-sound,\n // not a B2 exception — the supersession is explicit and\n // broker-authored, nothing is silently skipped. An UNFLAGGED\n // jump keeps the strict reject-gap byte-for-byte (a b4 drop\n // still re-fetches from the floor).\n // [impl->REQ-RC-RESIZE-PRESENTATION-BARRIER]\n if !ev.sync {\n return Err(io::Error::new(\n io::ErrorKind::InvalidData,\n format!(\"output gap: got seq {} want {}\", ev.seq, self.next_seq),\n ));\n }\n }\n self.next_seq = ev.seq + 1;\n let bytes = decode_bytes(&ev.data_b64)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Output {\n session_id: ev.session_id,\n seq: ev.seq,\n bytes,\n });\n }\n KIND_SPAWN_CONFLICT => {\n let ev: SpawnConflict = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SpawnConflict {\n endpoint: ev.endpoint,\n session_id: ev.session_id,\n });\n }\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n KIND_BROUGHT_UP => {\n let ev: BroughtUpReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::BroughtUp {\n outcome: ev.outcome,\n detail: ev.detail,\n session_id: ev.session_id,\n admit: ev.admit,\n });\n }\n // [impl->REQ-SEAL-CEREMONY-TOTP]\n KIND_SEAL_CEREMONY_REPLY => {\n let ev: SealCeremonyReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyDone {\n outcome: ev.outcome,\n detail: ev.detail,\n token: ev.token,\n });\n }\n // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n KIND_SEAL_CEREMONY_OPEN => {\n let ev: SealCeremonyOpenEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyOpen {\n session_id: ev.session_id,\n ceremony_id: ev.ceremony_id,\n content_b64: ev.content_b64,\n subnet: ev.subnet,\n destination: ev.destination,\n payload_to_sign_b64: ev.payload_to_sign_b64,\n fido2_node: ev.fido2_node,\n offer_enroll: ev.offer_enroll,\n });\n }\n KIND_SEAL_CEREMONY_RESULT => {\n let ev: SealCeremonyResultEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::SealCeremonyResult {\n session_id: ev.session_id,\n ceremony_id: ev.ceremony_id,\n outcome: ev.outcome,\n detail: ev.detail,\n });\n }\n KIND_SPAWNED => {\n let ev: Spawned = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n…\n }\n…\n // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n KIND_VIEWER_EVICTED => {\n let ev: ViewerEvictedEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::ViewerEvicted {\n session_id: ev.session_id,\n });\n }\n KIND_APPLIED => {\n let ev: AppliedEvent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Applied {\n session_id: ev.session_id,\n op_id: ev.op_id,\n applied_now: ev.applied_now,\n });\n }\n KIND_NET_STATUS_REPLY => {\n let ev: NetStatusReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStatus(ev));\n }\n KIND_NET_DIALED => {\n let ev: NetDialed = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetDialed(ev));\n }\n // The bare ack for a non-blocking submit-dial (PUMP-TRUTH W2) —\n // null payload; the dial's outcome rides the presence stream.\n // [impl->REQ-PUMP-PEER-ISOLATION]\n KIND_NET_DIAL_SUBMITTED => return Ok(BrokerEvent::NetDialSubmitted),\n KIND_NET_STREAM_OPENED => {\n let ev: NetStreamOpened = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStreamOpened(ev));\n }\n KIND_NET_SENT => {\n let ev: NetSent = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetSent(ev));\n }\n KIND_NET_STREAMS_REPLY => {\n let ev: NetStreamsReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::NetStreams(ev));\n }\n KIND_SESSIONS_REPLY => {\n let ev: SessionsReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::Sessions(ev));\n }\n KIND_PAIR_JOINED => {\n let ev: PairJoinReply = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n return Ok(BrokerEvent::PairJoined(ev));\n }\n KIND_MET_MEMBER => {\n let ev: MetMember = serde_json::from_value(env.payload)\n .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n…\n }\n…\n }\n }\n }\n…\n pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {\n self.net_cursors.insert(stream_id, from_seq);\n self.send(\n KIND_NET_STREAM_SUBSCRIBE,\n serde_json::to_value(NetStreamSubscribeReq {\n stream_id,\n from_seq,\n })\n .expect(\"NetStreamSubscribeReq serializes\"),\n )\n }\n\n…\n}","startLine":410,"lineNumbers":[410,null,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,null,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,null,1215,null,1250,1251,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1289,1290,1291,1292,1293,1294,1295,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,null,1310,null,1376,1377,1378,null,2384,2385,2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,null,2629]},"fileSize":171079,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\brain.rs"}}},"isError":false,"timestamp":1789528539389}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_WkSBiB5h0KDtYmJBGNLpt0Ky|fc_00817a6e65e8f156016aaa09ec17b887d18378d56308c44e58","toolName":"read","startedAt":"2026-09-16T03:15:56.157Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:8750-8840,8846-9000,9826-9878,9964-10005"},"intent":"Reading broker request execution"},"id":"b5093626","parentId":"5a447fc8","timestamp":"2026-09-16T03:15:56.157Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Y0GOicYr798zKYjH1PsmGojS|fc_00817a6e65e8f156016aaa09ec17c887d1ba502624c2e75b57","toolName":"read","startedAt":"2026-09-16T03:15:56.157Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:2592-2678,3000-3081,3116-3280"},"intent":"Reading controller reseat execution"},"id":"aed1f548","parentId":"b5093626","timestamp":"2026-09-16T03:15:56.157Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_pCNp00ycsIxK7WXALJlv27c3|fc_00817a6e65e8f156016aaa09ec17d087d187824671c994621f","toolName":"read","startedAt":"2026-09-16T03:15:56.157Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs:1100-1228"},"intent":"Reading dispatch worker setup"},"id":"ce8fdbb1","parentId":"aed1f548","timestamp":"2026-09-16T03:15:56.157Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_58g6vcbI2yeowqxIyHEXHBlW|fc_00817a6e65e8f156016aaa09ec17d487d1b9d2699ab3017a7a","toolName":"grep","startedAt":"2026-09-16T03:15:56.158Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src"},"intent":"Locating send and network boundaries"},"id":"0bd7d17a","parentId":"ce8fdbb1","timestamp":"2026-09-16T03:15:56.158Z"}
{"type":"message","id":"dea82dba","parentId":"0bd7d17a","timestamp":"2026-09-16T03:15:56.158Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_WkSBiB5h0KDtYmJBGNLpt0Ky|fc_00817a6e65e8f156016aaa09ec17b887d18378d56308c44e58","name":"read","arguments":{"i":"Reading broker request execution","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:8750-8840,8846-9000,9826-9878,9964-10005"},"intent":"Reading broker request execution"},{"type":"toolCall","id":"call_Y0GOicYr798zKYjH1PsmGojS|fc_00817a6e65e8f156016aaa09ec17c887d1ba502624c2e75b57","name":"read","arguments":{"i":"Reading controller reseat execution","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:2592-2678,3000-3081,3116-3280"},"intent":"Reading controller reseat execution"},{"type":"toolCall","id":"call_pCNp00ycsIxK7WXALJlv27c3|fc_00817a6e65e8f156016aaa09ec17d087d187824671c994621f","name":"read","arguments":{"i":"Reading dispatch worker setup","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs:1100-1228"},"intent":"Reading dispatch worker setup"},{"type":"toolCall","id":"call_58g6vcbI2yeowqxIyHEXHBlW|fc_00817a6e65e8f156016aaa09ec17d487d1b9d2699ab3017a7a","name":"grep","arguments":{"i":"Locating send and network boundaries","pattern":"struct SharedSend|impl SharedSend|fn write\\(|fn send_stream\\(|fn subscribe_stream\\(","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src","case":true,"gitignore":false,"skip":0},"intent":"Locating send and network boundaries"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":6109,"output":262,"cacheRead":38912,"cacheWrite":0,"totalTokens":45283,"cost":{"input":0.061090000000000005,"output":0.0131,"cacheRead":0.038911999999999995,"cacheWrite":0,"total":0.11310200000000001}},"stopReason":"toolUse","timestamp":1789528539434,"responseId":"resp_00817a6e65e8f156016aaa09dbb4b487d180e752aced367157","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09ec17b887d18378d56308c44e58","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading broker request execution\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:8750-8840,8846-9000,9826-9878,9964-10005\"}","call_id":"call_WkSBiB5h0KDtYmJBGNLpt0Ky","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09ec17c887d1ba502624c2e75b57","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading controller reseat execution\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:2592-2678,3000-3081,3116-3280\"}","call_id":"call_Y0GOicYr798zKYjH1PsmGojS","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09ec17d087d187824671c994621f","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading dispatch worker setup\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/dispatch.rs:1100-1228\"}","call_id":"call_pCNp00ycsIxK7WXALJlv27c3","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09ec17d487d1b9d2699ab3017a7a","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating send and network boundaries\",\"pattern\":\"struct SharedSend|impl SharedSend|fn write\\\\(|fn send_stream\\\\(|fn subscribe_stream\\\\(\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_58g6vcbI2yeowqxIyHEXHBlW","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":16720.31779999938,"ttft":16685.80209999997,"completedAt":1789528556155,"contextSnapshot":{"promptTokens":45021,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"291b3e56","parentId":"dea82dba","timestamp":"2026-09-16T03:15:56.196Z","message":{"role":"toolResult","toolCallId":"call_pCNp00ycsIxK7WXALJlv27c3|fc_00817a6e65e8f156016aaa09ec17d087d187824671c994621f","toolName":"read","content":[{"type":"text","text":" let mut brain = match connect(broker_name) {\n Ok(b) => b,\n Err(e) => {\n return WorkerReport {\n outcome: DispatchOutcome::Failed(e.to_string()),\n family: Some(family),\n endpoint,\n }\n }\n };\n\n let outcome = match family {\n StreamFamily::Sync => {\n let cs = match ContextStore::open_or_init() {\n Ok(cs) => cs,\n Err(e) => {\n return WorkerReport {\n outcome: DispatchOutcome::Failed(e.to_string()),\n family: Some(family),\n endpoint,\n }\n }\n };\n let policy = SyncPolicy::load();\n match serve_sync(\n &mut brain,\n stream_id,\n origin,\n 0,\n &cs,\n &policy,\n &paths.scratch,\n ) {\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\n Err(e) => DispatchOutcome::Failed(e.to_string()),\n }\n }\n StreamFamily::Update => {\n let cache = ReleaseCache::open(&paths.releases);\n let roster = RosterStore::load();\n match serve_update(&mut brain, stream_id, origin, 0, &cache, &roster) {\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\n Err(e) => DispatchOutcome::Failed(e.to_string()),\n }\n }\n StreamFamily::Notif => serve_notif_feed(&mut brain, stream_id, origin),\n // [impl->REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED]\n StreamFamily::Seal => serve_seal_feed(&mut brain, stream_id, origin),\n StreamFamily::WanMsg => serve_wan_feed(&mut brain, stream_id, origin, paths, registry),\n // [impl->REQ-KNOCK-VERBS]\n StreamFamily::Knock => serve_knock_feed(&mut brain, stream_id, origin),\n // [impl->REQ-FORK-CONTROL-SURFACE]\n StreamFamily::Fork => serve_fork_feed(&mut brain, stream_id, origin),\n // [impl->REQ-UNLISTED-PRESENCE-PROBE]\n StreamFamily::Presence => serve_presence_feed(&mut brain, stream_id, origin),\n // [impl->REQ-KNOCK-REDEEM-WIRE]\n StreamFamily::Redeem => serve_redeem_feed(&mut brain, stream_id, origin),\n // [impl->REQ-KNOCK-ANSWER-RECEIPT]\n StreamFamily::Answer => serve_answer_feed(&mut brain, stream_id, origin),\n StreamFamily::Registry => serve_registry_feed(&mut brain, stream_id, origin, registry),\n StreamFamily::Attach => {\n // The gate subject is the session's OWNING endpoint, resolved\n // from the broker's table (the spawn's label) — never from wire\n // bytes. An unlabeled or unknown session refuses, fail-closed.\n //\n // Cross-node leg (#4, REQ-RC-CROSS-NODE-ATTACH): a REMOTE operator\n // cannot know our local session id, so it names the ENDPOINT. When the\n // Request carries `endpoint_id`, THAT is the gate subject — but only if\n // we actually host a live session for it (D5 session-presence gate;\n // D6: a stale registry row that named a gone endpoint resolves to no\n // session → refuse cleanly, never a false attach). The endpoint id is\n // WHICH endpoint the operator asks for (client-supplied, like the rest\n // family's `endpoint`); the origin subject stays the handshake identity.\n // The LOCAL path sends no endpoint_id and its session_id → endpoint\n // mapping is unchanged.\n // `endpoint` is the gate subject; `remote_session` carries the\n // dispatcher-resolved session id on the cross-node leg (resolved HERE,\n // before serve_attach subscribes — never mid-serve, which would swallow\n // interleaved attach records) and `None` on the local path.\n let (endpoint, remote_session) = match line\n .get(\"endpoint_id\")\n .and_then(|v| v.as_str())\n .filter(|e| !e.is_empty())\n {\n Some(ep) => match crate::attach::resolve_local_session(&mut brain, ep) {\n Some(sid) => (Some(ep.to_string()), Some(sid)),\n None => (None, None),\n },\n None => {\n let session_id = line.get(\"session_id\").and_then(|v| v.as_u64());\n let endpoint = session_id.and_then(|sid| {\n brain.sessions().ok().and_then(|reply| {\n reply\n .sessions\n .iter()\n .find(|s| s.session_id == sid && !s.endpoint.is_empty())\n .map(|s| s.endpoint.clone())\n })\n });\n (endpoint, None)\n }\n };\n match endpoint {\n // Seed the serve loop with the DURABLE opener Request\n // (ADR-0038 B): after a ring roll the wire replay no longer\n // carries the Request record, so the serve would idle forever\n // waiting for one. The pinned opener IS that record — hand it\n // over so reconstruction resumes the same operator stream.\n // Subscribe from the ring FLOOR: a rolled ring's chunk 0 is\n // gone, and a below-floor cursor trips the brain's gap check.\n // [impl->REQ-STREAM-OPENER-DURABLE]\n Some(endpoint) => match serve_attach(\n &mut brain,\n broker_name,\n stream_id,\n &endpoint,\n origin,\n floor_seq,\n remote_session,\n serde_json::from_value(line.clone()).ok(),\n ) {\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\n Err(e) => DispatchOutcome::Failed(e.to_string()),\n },\n None => {\n // Refuse politely: finish our send side, claim stays.\n let _ = brain.net_stream_send(stream_id, &[], None, true);\n DispatchOutcome::Served(\"attach refused: unlabeled/unknown session\".into())\n }\n }\n }\n // One node-prefixed URL served for a peer's loopback listener. The\n // subject (the served entry's registering endpoint) is resolved on\n // the owner from its own registry; the origin it is gated against is\n…\n };\n\n[Showing lines 1099-1231 of 3631. Use :1232 to continue]"}],"details":{"truncation":{"content":" Ok(b) => b,\r\n Err(e) => {\r\n return WorkerReport {\r\n outcome: DispatchOutcome::Failed(e.to_string()),\r\n family: Some(family),\r\n endpoint,\r\n }\r\n }\r\n };\r\n\r\n let outcome = match family {\r\n StreamFamily::Sync => {\r\n let cs = match ContextStore::open_or_init() {\r\n Ok(cs) => cs,\r\n Err(e) => {\r\n return WorkerReport {\r\n outcome: DispatchOutcome::Failed(e.to_string()),\r\n family: Some(family),\r\n endpoint,\r\n }\r\n }\r\n };\r\n let policy = SyncPolicy::load();\r\n match serve_sync(\r\n &mut brain,\r\n stream_id,\r\n origin,\r\n 0,\r\n &cs,\r\n &policy,\r\n &paths.scratch,\r\n ) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n }\r\n }\r\n StreamFamily::Update => {\r\n let cache = ReleaseCache::open(&paths.releases);\r\n let roster = RosterStore::load();\r\n match serve_update(&mut brain, stream_id, origin, 0, &cache, &roster) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n }\r\n }\r\n StreamFamily::Notif => serve_notif_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED]\r\n StreamFamily::Seal => serve_seal_feed(&mut brain, stream_id, origin),\r\n StreamFamily::WanMsg => serve_wan_feed(&mut brain, stream_id, origin, paths, registry),\r\n // [impl->REQ-KNOCK-VERBS]\r\n StreamFamily::Knock => serve_knock_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-FORK-CONTROL-SURFACE]\r\n StreamFamily::Fork => serve_fork_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-UNLISTED-PRESENCE-PROBE]\r\n StreamFamily::Presence => serve_presence_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-KNOCK-REDEEM-WIRE]\r\n StreamFamily::Redeem => serve_redeem_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-KNOCK-ANSWER-RECEIPT]\r\n StreamFamily::Answer => serve_answer_feed(&mut brain, stream_id, origin),\r\n StreamFamily::Registry => serve_registry_feed(&mut brain, stream_id, origin, registry),\r\n StreamFamily::Attach => {\r\n // The gate subject is the session's OWNING endpoint, resolved\r\n // from the broker's table (the spawn's label) — never from wire\r\n // bytes. An unlabeled or unknown session refuses, fail-closed.\r\n //\r\n // Cross-node leg (#4, REQ-RC-CROSS-NODE-ATTACH): a REMOTE operator\r\n // cannot know our local session id, so it names the ENDPOINT. When the\r\n // Request carries `endpoint_id`, THAT is the gate subject — but only if\r\n // we actually host a live session for it (D5 session-presence gate;\r\n // D6: a stale registry row that named a gone endpoint resolves to no\r\n // session → refuse cleanly, never a false attach). The endpoint id is\r\n // WHICH endpoint the operator asks for (client-supplied, like the rest\r\n // family's `endpoint`); the origin subject stays the handshake identity.\r\n // The LOCAL path sends no endpoint_id and its session_id → endpoint\r\n // mapping is unchanged.\r\n // `endpoint` is the gate subject; `remote_session` carries the\r\n // dispatcher-resolved session id on the cross-node leg (resolved HERE,\r\n // before serve_attach subscribes — never mid-serve, which would swallow\r\n // interleaved attach records) and `None` on the local path.\r\n let (endpoint, remote_session) = match line\r\n .get(\"endpoint_id\")\r\n .and_then(|v| v.as_str())\r\n .filter(|e| !e.is_empty())\r\n {\r\n Some(ep) => match crate::attach::resolve_local_session(&mut brain, ep) {\r\n Some(sid) => (Some(ep.to_string()), Some(sid)),\r\n None => (None, None),\r\n },\r\n None => {\r\n let session_id = line.get(\"session_id\").and_then(|v| v.as_u64());\r\n let endpoint = session_id.and_then(|sid| {\r\n brain.sessions().ok().and_then(|reply| {\r\n reply\r\n .sessions\r\n .iter()\r\n .find(|s| s.session_id == sid && !s.endpoint.is_empty())\r\n .map(|s| s.endpoint.clone())\r\n })\r\n });\r\n (endpoint, None)\r\n }\r\n };\r\n match endpoint {\r\n // Seed the serve loop with the DURABLE opener Request\r\n // (ADR-0038 B): after a ring roll the wire replay no longer\r\n // carries the Request record, so the serve would idle forever\r\n // waiting for one. The pinned opener IS that record — hand it\r\n // over so reconstruction resumes the same operator stream.\r\n // Subscribe from the ring FLOOR: a rolled ring's chunk 0 is\r\n // gone, and a below-floor cursor trips the brain's gap check.\r\n // [impl->REQ-STREAM-OPENER-DURABLE]\r\n Some(endpoint) => match serve_attach(\r\n &mut brain,\r\n broker_name,\r\n stream_id,\r\n &endpoint,\r\n origin,\r\n floor_seq,\r\n remote_session,\r\n serde_json::from_value(line.clone()).ok(),\r\n ) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n },\r\n None => {\r\n // Refuse politely: finish our send side, claim stays.\r\n let _ = brain.net_stream_send(stream_id, &[], None, true);\r\n DispatchOutcome::Served(\"attach refused: unlabeled/unknown session\".into())\r\n }\r\n }\r\n }\r\n // One node-prefixed URL served for a peer's loopback listener. The\r\n // subject (the served entry's registering endpoint) is resolved on\r\n // the owner from its own registry; the origin it is gated against is\r","truncated":true,"truncatedBy":"lines","totalLines":2533,"totalBytes":6760,"outputLines":133,"outputBytes":6760,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":3631,"displayContent":{"text":" let mut brain = match connect(broker_name) {\n Ok(b) => b,\r\n Err(e) => {\r\n return WorkerReport {\r\n outcome: DispatchOutcome::Failed(e.to_string()),\r\n family: Some(family),\r\n endpoint,\r\n }\r\n }\r\n };\r\n\r\n let outcome = match family {\r\n StreamFamily::Sync => {\r\n let cs = match ContextStore::open_or_init() {\r\n Ok(cs) => cs,\r\n Err(e) => {\r\n return WorkerReport {\r\n outcome: DispatchOutcome::Failed(e.to_string()),\r\n family: Some(family),\r\n endpoint,\r\n }\r\n }\r\n };\r\n let policy = SyncPolicy::load();\r\n match serve_sync(\r\n &mut brain,\r\n stream_id,\r\n origin,\r\n 0,\r\n &cs,\r\n &policy,\r\n &paths.scratch,\r\n ) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n }\r\n }\r\n StreamFamily::Update => {\r\n let cache = ReleaseCache::open(&paths.releases);\r\n let roster = RosterStore::load();\r\n match serve_update(&mut brain, stream_id, origin, 0, &cache, &roster) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n }\r\n }\r\n StreamFamily::Notif => serve_notif_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED]\r\n StreamFamily::Seal => serve_seal_feed(&mut brain, stream_id, origin),\r\n StreamFamily::WanMsg => serve_wan_feed(&mut brain, stream_id, origin, paths, registry),\r\n // [impl->REQ-KNOCK-VERBS]\r\n StreamFamily::Knock => serve_knock_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-FORK-CONTROL-SURFACE]\r\n StreamFamily::Fork => serve_fork_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-UNLISTED-PRESENCE-PROBE]\r\n StreamFamily::Presence => serve_presence_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-KNOCK-REDEEM-WIRE]\r\n StreamFamily::Redeem => serve_redeem_feed(&mut brain, stream_id, origin),\r\n // [impl->REQ-KNOCK-ANSWER-RECEIPT]\r\n StreamFamily::Answer => serve_answer_feed(&mut brain, stream_id, origin),\r\n StreamFamily::Registry => serve_registry_feed(&mut brain, stream_id, origin, registry),\r\n StreamFamily::Attach => {\r\n // The gate subject is the session's OWNING endpoint, resolved\r\n // from the broker's table (the spawn's label) — never from wire\r\n // bytes. An unlabeled or unknown session refuses, fail-closed.\r\n //\r\n // Cross-node leg (#4, REQ-RC-CROSS-NODE-ATTACH): a REMOTE operator\r\n // cannot know our local session id, so it names the ENDPOINT. When the\r\n // Request carries `endpoint_id`, THAT is the gate subject — but only if\r\n // we actually host a live session for it (D5 session-presence gate;\r\n // D6: a stale registry row that named a gone endpoint resolves to no\r\n // session → refuse cleanly, never a false attach). The endpoint id is\r\n // WHICH endpoint the operator asks for (client-supplied, like the rest\r\n // family's `endpoint`); the origin subject stays the handshake identity.\r\n // The LOCAL path sends no endpoint_id and its session_id → endpoint\r\n // mapping is unchanged.\r\n // `endpoint` is the gate subject; `remote_session` carries the\r\n // dispatcher-resolved session id on the cross-node leg (resolved HERE,\r\n // before serve_attach subscribes — never mid-serve, which would swallow\r\n // interleaved attach records) and `None` on the local path.\r\n let (endpoint, remote_session) = match line\r\n .get(\"endpoint_id\")\r\n .and_then(|v| v.as_str())\r\n .filter(|e| !e.is_empty())\r\n {\r\n Some(ep) => match crate::attach::resolve_local_session(&mut brain, ep) {\r\n Some(sid) => (Some(ep.to_string()), Some(sid)),\r\n None => (None, None),\r\n },\r\n None => {\r\n let session_id = line.get(\"session_id\").and_then(|v| v.as_u64());\r\n let endpoint = session_id.and_then(|sid| {\r\n brain.sessions().ok().and_then(|reply| {\r\n reply\r\n .sessions\r\n .iter()\r\n .find(|s| s.session_id == sid && !s.endpoint.is_empty())\r\n .map(|s| s.endpoint.clone())\r\n })\r\n });\r\n (endpoint, None)\r\n }\r\n };\r\n match endpoint {\r\n // Seed the serve loop with the DURABLE opener Request\r\n // (ADR-0038 B): after a ring roll the wire replay no longer\r\n // carries the Request record, so the serve would idle forever\r\n // waiting for one. The pinned opener IS that record — hand it\r\n // over so reconstruction resumes the same operator stream.\r\n // Subscribe from the ring FLOOR: a rolled ring's chunk 0 is\r\n // gone, and a below-floor cursor trips the brain's gap check.\r\n // [impl->REQ-STREAM-OPENER-DURABLE]\r\n Some(endpoint) => match serve_attach(\r\n &mut brain,\r\n broker_name,\r\n stream_id,\r\n &endpoint,\r\n origin,\r\n floor_seq,\r\n remote_session,\r\n serde_json::from_value(line.clone()).ok(),\r\n ) {\r\n Ok(out) => DispatchOutcome::Served(format!(\"{out:?}\")),\r\n Err(e) => DispatchOutcome::Failed(e.to_string()),\r\n },\r\n None => {\r\n // Refuse politely: finish our send side, claim stays.\r\n let _ = brain.net_stream_send(stream_id, &[], None, true);\r\n DispatchOutcome::Served(\"attach refused: unlabeled/unknown session\".into())\r\n }\r\n }\r\n }\r\n // One node-prefixed URL served for a peer's loopback listener. The\r\n // subject (the served entry's registering endpoint) is resolved on\r\n // the owner from its own registry; the origin it is gated against is\r\n…\n };","startLine":1098,"lineNumbers":[1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,null,1283]},"fileSize":171439,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\dispatch.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":3631,"totalBytes":6760,"outputLines":133,"outputBytes":6760,"shownRange":{"start":1099,"end":1231},"nextOffset":1232}}},"isError":false,"timestamp":1789528556194}}
{"type":"message","id":"c16723a1","parentId":"291b3e56","timestamp":"2026-09-16T03:15:56.304Z","message":{"role":"toolResult","toolCallId":"call_Y0GOicYr798zKYjH1PsmGojS|fc_00817a6e65e8f156016aaa09ec17c887d1ba502624c2e75b57","toolName":"read","content":[{"type":"text","text":" fn become_controller(&mut self, sub: SharedSend, by: Option, from_seq: u64, attach_gen: u64) {\n // Drop the prior controller sink first (its writer's live loop ends when\n // tx drops), and bump the generation so (a) an in-flight deadline-evict\n // for the old controller can't unseat this one and (b) a prior writer\n // still flushing its initial batch returns before its next frame.\n // Attribution (F-039 legs b+d): the replaced conn's record names its\n // successor, and the new conn accretes the controller role fact.\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\n let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\n if let Some(old) = self.controller.take() {\n old.send.lifecycle_event(\n \"controller-replaced\",\n &format!(\"session={} new_conn={}\", self.session_id, sub.id()),\n );\n }\n sub.describe(&format!(\n \"controller session={} endpoint={} by={}\",\n self.session_id,\n if self.endpoint.is_empty() { \"-\" } else { &self.endpoint },\n by.as_deref().unwrap_or(\"local\")\n ));\n sub.lifecycle_event(\n \"controller-attach\",\n &format!(\"session={} from_seq={from_seq}\", self.session_id),\n );\n self.controller = None;\n let epoch = self.controller_epoch.fetch_add(1, Ordering::AcqRel) + 1;\n // #6 (ADR-0031): a COLD attach's initial batch is a single synthesized clean\n // repaint of the CURRENT SCREEN (at pseudo-seq `next_seq - 1`) instead of the\n // raw ring — replaying an alt-screen TUI's raw ring into a fresh terminal is\n // exactly the corruption #6/#7/#8 report. A resume BELOW the presentation\n // floor gets the same repaint shape (a raw replay across a transition\n // boundary is suppressed mixed-geometry corruption,\n // REQ-RC-RESIZE-PRESENTATION-BARRIER); an at/above-floor resume keeps the\n // raw-ring exactly-once re-fetch untouched (B2). Either way the\n // batch is owned by the writer thread (never pushed through the live channel —\n // it must not block the drain); live frames stream raw + in-order afterwards.\n // `initial_sync`: a repaint batch rides the wire flag (it supersedes\n // everything before its pseudo-seq — the strict consumer baselines the\n // jump); a raw-ring batch stays unflagged (contiguous, exactly-once B2).\n let (initial, initial_sync): (Vec<(u64, Vec)>, bool) =\n match self.repaint_initial(from_seq) {\n Some(repaint) => {\n // OBS RIDER Tap B (repaint): the synthesized clean-screen\n // controller repaint bytes (debug-gated, default OFF).\n spt_store::obstap::tap(self.session_id, \"repaint\", &repaint.1);\n (vec![repaint], true)\n }\n None => (\n self.ring\n .iter()\n .filter(|(s, _)| *s >= from_seq)\n .cloned()\n .collect(),\n false,\n ),\n };\n let (tx, rx) = sync_channel::(CONTROLLER_CHANNEL_DEPTH);\n let writer_send = Arc::clone(&sub);\n let dt = Arc::clone(&self.delivered_through);\n let epoch_gate = Arc::clone(&self.controller_epoch);\n let sid = self.session_id;\n // W2 decouple: the writer publishes its in-flight-write window here so a\n // stall-evict can distinguish a wedged writer from an idle one.\n let write_blocked_since = Arc::new(Mutex::new(None));\n let writer_blocked = Arc::clone(&write_blocked_since);\n // Lease-revoke marker (ADR-0044): shared with the writer so a\n // distinct-lease Take can hand it the terminal Displaced duty.\n let revoked_by = Arc::new(Mutex::new(None));\n let writer_revoked = Arc::clone(&revoked_by);\n let writer = thread::spawn(move || {\n controller_writer(\n sid,\n writer_send,\n initial,\n initial_sync,\n rx,\n dt,\n epoch,\n epoch_gate,\n writer_blocked,\n writer_revoked,\n )\n });\n self.controller = Some(ControllerSink {\n tx,\n send: sub,\n…\n });\n…\n }\n…\n fn resolve_subscribe_gated(\n &mut self,\n sub: SharedSend,\n from_seq: u64,\n intent: AttachIntent,\n by: Option,\n gen: u64,\n code: Option,\n ticket: AdmitTicket,\n seal_ceremony: bool,\n ) -> (SubscribeOutcome, Option) {\n // OBS RIDER leg 1 (ALWAYS-ON pin): one structured breadcrumb per subscribe\n // decision — ids/generations only, never PTY bytes. Rides the daemon stderr\n // sink (F-039 shape) → daemon.stderr.log. The incumbent snapshot is captured\n // BEFORE the decision runs (become_controller overwrites the controller slot\n // inside the inner call); a supersession is derivable downstream as\n // old_by present ∧ req_gen > old_gen ∧ decision ∈ {controller, took}.\n let conn = sub.id();\n let by_lbl = by.as_deref().unwrap_or(\"local\").to_string();\n let old_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n let old_by = self.controller_by().map(|s| s.to_string());\n let intent_lbl = match intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // The inner kernel returns the decision LABEL alongside the outcome: the\n // ADR-0047 `idempotent` vocabulary is additive to the BREADCRUMB only —\n // `SubscribeOutcome` is a wire type (`subscribed_envelope`), so an\n // idempotent replay still answers `Controller` on the wire and an N-1\n // brain/rc needs no tolerance for a variant it has never seen.\n // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n let mut seat_cred = None;\n let (outcome, decision) = self.resolve_subscribe_inner_gated(\n sub,\n from_seq,\n intent,\n by,\n gen,\n code,\n ticket,\n &mut seat_cred,\n );\n // AFTER the ladder, never before it — the take path revokes empowerments\n // as it seats the taker, so a grant written at the gate is revoked by\n // the very attach that earned it.\n // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\n let seat_note = self.settle_engine_room_seat(seat_cred, &outcome);\n // Stamp the W2 seal-ceremony capability onto the seat this subscribe\n // seated (conn-keyed, so a refused/viewer outcome touches nothing).\n // [impl->REQ-SEAL-NO-CEREMONY-SURFACE]\n if matches!(\n outcome,\n SubscribeOutcome::Controller | SubscribeOutcome::TookControl\n ) {\n self.stamp_controller_seal_ceremony(conn, seal_ceremony);\n }\n spt_proto::emit_line_err!(\n \"SUBSCRIBE_DECISION: session={} endpoint={} by={} conn={} intent={} \\\n old_by={} old_gen={} req_gen={} decision={}\",\n self.session_id,\n if self.endpoint.is_empty() { \"-\" } else { &self.endpoint },\n by_lbl,\n conn,\n intent_lbl,\n old_by.as_deref().unwrap_or(\"-\"),\n old_gen,\n gen,\n decision,\n );\n (outcome, seat_note)\n }\n\n /// The W2.5 subscribe decision kernel — wrapped by\n /// [`OutputLog::resolve_subscribe`], which emits the always-on decision\n /// breadcrumb around it. See that wrapper for the field/observability contract.\n ///\n /// Returns the wire [`SubscribeOutcome`] AND the breadcrumb decision label;\n /// they are deliberately not 1:1 (`idempotent` is a label over a `Controller`\n /// outcome — ADR-0047 decision 3's additive vocabulary).\n /// The no-admit spelling of the inner kernel (see\n /// [`resolve_subscribe`](Self::resolve_subscribe) for why it stays).\n…\n fn resolve_subscribe_inner_gated(\n &mut self,\n sub: SharedSend,\n from_seq: u64,\n intent: AttachIntent,\n by: Option,\n gen: u64,\n code: Option,\n ticket: AdmitTicket,\n seat_cred: &mut Option,\n ) -> (SubscribeOutcome, &'static str) {\n // The engine room's structural locks come FIRST — before the viewer cap,\n // before the lease ladder — because they are about who may hold this\n // seat at all, not about who currently does. Enforced HERE and not at\n // the wire edge: the adversary in this threat model is an agent on this\n // node, which can speak the broker's own IPC and skip `serve_attach`\n // entirely. The seat resolver is the one door every attach comes through.\n // [impl->REQ-ER-RC-INTENT-LOCKS]\n match self.engine_room_refusal(intent, by.as_deref(), code.as_deref(), sub.id(), ticket) {\n SeatGate::Refused(outcome, label) => return (outcome, label),\n SeatGate::Proceed(cred) => *seat_cred = cred,\n }\n if intent == AttachIntent::Viewer {\n if self.viewers.len() >= MAX_VIEWERS {\n // Soft cap reached — refuse the viewer (bounds thread count).\n return (\n SubscribeOutcome::BusyControlled {\n by: \"viewer cap reached\".to_string(),\n },\n \"busy\",\n );\n }\n self.add_viewer(sub, from_seq, by.as_deref());\n self.stamp_viewer_count();\n return (SubscribeOutcome::Viewer, \"viewer\");\n }\n // Control or Take.\n // W2 decouple (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): a controller WEDGED\n // on a suspended/black-holed brain conn past BRAIN_WRITE_DEADLINE is\n // stall-evicted HERE — the take/reattach self-heals against broker truth\n // without waiting for new output (the output-driven mark_controller_gone\n // never fires on an idle session). Inline stamp: this path already writes the\n // perch under the log lock via become_controller. After the evict the slot\n // reads free and the normal free/take logic below runs.\n self.stall_evict_controller(Instant::now(), StampMode::Inline);\n if self.controller.is_none() {\n // Free endpoint → become controller (nothing to displace).\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n let same_identity = self.controller_by() == by.as_deref();\n if same_identity {\n // The GENERATION LADDER over the (by, nonzero attach_gen) LOGICAL\n // LEASE (ADR-0044 decision 1 + the 2026-07-18 ladder ruling over\n // the ADR-0038 fix-6 generation): node identity alone is NEVER a\n // lease — two same-node viewports are DISTINCT controllers,\n // discriminated by their generations; within one identity the\n // generation stays the LIFECYCLE discriminator.\n // gen == incumbent (nonzero) → the SAME lease re-served after a\n // dispatcher restart — the fix-6 successor, silent (gate #7).\n // gen < incumbent (nonzero) → a REPLAYED stale Request (an\n // unfinished backlog row whose viewport died raw) — refused\n // busy; the ladder never runs backwards.\n // gen > incumbent (nonzero) → the LIVE replacement viewport,\n // Control or Take alike: loud+fenced SUPERSESSION via the full\n // W2 revoke (terminal Displaced + fence moves with the slot) —\n // never the silent sink swap that left the incumbent\n // input-capable but blind (the hertz split-brain), and never a\n // Busy that locks the replacement out behind a stale-replay\n // worker serving a zombie stream (the redispatch_stall T6\n // post-restart lockout).\n // 0 on either side → local / N-1 legacy re-take, preserved.\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n let incumbent_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n let incumbent_conn = self.controller.as_ref().map(|c| c.send.id());\n // IDEMPOTENT REPLAY — the new leaf INSIDE the equal-generation rung\n // (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY). Same identity,\n // same NONZERO generation, and the SAME CONNECTION as the incumbent\n // seat means this is a replay of the establish we already honored, not\n // a successor: the seat and its writer are PRESERVED, no\n // `controller-replaced` fires, and no second initial batch is\n // synthesized. Field bill (hertz v0.39.4 bug 4, pinned on an\n // authorized same-seam `daemon refresh`): post-cycle dispatcher replay\n // served ONE held attach twice on ONE conn 15 ms apart; the equal-gen\n // rung classified it \"same lease, silent re-take\" — correct — but\n // re-take was `become_controller`, which unconditionally drops the\n // prior seat. Designed for a DEAD seat after a dispatcher restart, it\n // fired against the same LIVE conn: the lease killed its own writer\n // (channel-closed) and the rc viewport froze until a manual\n // detach + re-attach. \"spt update freezes every attached PTY.\"\n //\n // Equal generation on a DIFFERENT conn keeps today's silent swap — that\n // is the designed ADR-0038 fix-6 successor (the old seat is dead and the\n // lease is being re-served on a fresh carrier), and it must not regress.\n // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n //\n // The key includes `from_seq` because core itself re-subscribes on the\n // SAME conn with the SAME generation for a legitimate reason: the\n // controller GAP RESUME (REQ-HAZARD-CONTROLLER-GAP-RESUME,\n // `read_controller_event_resuming`) re-fetches dropped frames from its\n // frozen `delivered_through` floor. That request is NOT a replay of the\n // establish — it asks for different bytes — and suppressing it would\n // leave the gap unhealed and surface a false truncation. A replayed\n // establish carries the from_seq it was first honored with; a re-fetch\n // carries the floor it has since reached.\n let incumbent_from = self.controller.as_ref().map_or(0, |c| c.establish_from_seq);\n if gen != 0\n && incumbent_gen == gen\n && incumbent_conn == Some(sub.id())\n && incumbent_from == from_seq\n {\n return (SubscribeOutcome::Controller, \"idempotent\");\n }\n if gen == 0 || incumbent_gen == 0 || gen == incumbent_gen {\n // Same lease (or legacy) that is NOT a replay of the establish:\n // a different conn (the fix-6 successor) or the SAME conn asking\n // from a different floor (the gap-resume re-fetch above). Silent\n // re-take either way, NEVER Displaced.\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n if gen < incumbent_gen {\n return (\n SubscribeOutcome::BusyControlled {\n by: self.controller_by().unwrap_or_default().to_string(),\n },\n \"busy\",\n );\n }\n // Strictly newer gen — loud+fenced supersession on BOTH intents.\n self.mark_revoked(by.as_deref().unwrap_or(\"\"));\n self.become_controller(sub, by, from_seq, gen);\n return match intent {\n AttachIntent::Take => (SubscribeOutcome::TookControl, \"took\"),\n _ => (SubscribeOutcome::Controller, \"controller\"),\n };\n }\n if by.is_none() {\n // The LOCAL brain re-attaching while a REMOTE controls — never steal;\n // fall back to a silent viewer (gate #7 for the local-resume path).\n // `by` is None on this arm by construction, so the sink retains no node.\n self.add_viewer(sub, from_seq, None);\n self.stamp_viewer_count();\n return (SubscribeOutcome::Viewer, \"viewer\");\n }\n if self.controller_by().is_none() {\n // A remote takes an UNDRIVEN session (only the local spawner held the\n // slot) — silent control, no loud displace (there is no remote driver\n // to notify).\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n // A DIFFERENT remote controls it.\n match intent {\n AttachIntent::Take => {\n // Loud displace of a distinct-lease incumbent — the terminal\n // Displaced rides the OLD writer's EXIT (mark_revoked), never a\n // droppable try_send into its live queue: off the dispatch\n // thread (the incumbent may be exactly the wedged one), and\n // authoritative even when the queue is Full (ADR-0044\n // decision 2 — the try_send this replaces silently dropped the\n // notice while become_controller still swapped the sink).\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n self.mark_revoked(by.as_deref().unwrap_or(\"\"));\n…\n }\n…\n }\n }"}],"details":{"displayContent":{"text":" fn become_controller(&mut self, sub: SharedSend, by: Option, from_seq: u64, attach_gen: u64) {\n // Drop the prior controller sink first (its writer's live loop ends when\n // tx drops), and bump the generation so (a) an in-flight deadline-evict\n // for the old controller can't unseat this one and (b) a prior writer\n // still flushing its initial batch returns before its next frame.\n // Attribution (F-039 legs b+d): the replaced conn's record names its\n // successor, and the new conn accretes the controller role fact.\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\n let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\n if let Some(old) = self.controller.take() {\n old.send.lifecycle_event(\n \"controller-replaced\",\n &format!(\"session={} new_conn={}\", self.session_id, sub.id()),\n );\n }\n sub.describe(&format!(\n \"controller session={} endpoint={} by={}\",\n self.session_id,\n if self.endpoint.is_empty() { \"-\" } else { &self.endpoint },\n by.as_deref().unwrap_or(\"local\")\n ));\n sub.lifecycle_event(\n \"controller-attach\",\n &format!(\"session={} from_seq={from_seq}\", self.session_id),\n );\n self.controller = None;\n let epoch = self.controller_epoch.fetch_add(1, Ordering::AcqRel) + 1;\n // #6 (ADR-0031): a COLD attach's initial batch is a single synthesized clean\n // repaint of the CURRENT SCREEN (at pseudo-seq `next_seq - 1`) instead of the\n // raw ring — replaying an alt-screen TUI's raw ring into a fresh terminal is\n // exactly the corruption #6/#7/#8 report. A resume BELOW the presentation\n // floor gets the same repaint shape (a raw replay across a transition\n // boundary is suppressed mixed-geometry corruption,\n // REQ-RC-RESIZE-PRESENTATION-BARRIER); an at/above-floor resume keeps the\n // raw-ring exactly-once re-fetch untouched (B2). Either way the\n // batch is owned by the writer thread (never pushed through the live channel —\n // it must not block the drain); live frames stream raw + in-order afterwards.\n // `initial_sync`: a repaint batch rides the wire flag (it supersedes\n // everything before its pseudo-seq — the strict consumer baselines the\n // jump); a raw-ring batch stays unflagged (contiguous, exactly-once B2).\n let (initial, initial_sync): (Vec<(u64, Vec)>, bool) =\n match self.repaint_initial(from_seq) {\n Some(repaint) => {\n // OBS RIDER Tap B (repaint): the synthesized clean-screen\n // controller repaint bytes (debug-gated, default OFF).\n spt_store::obstap::tap(self.session_id, \"repaint\", &repaint.1);\n (vec![repaint], true)\n }\n None => (\n self.ring\n .iter()\n .filter(|(s, _)| *s >= from_seq)\n .cloned()\n .collect(),\n false,\n ),\n };\n let (tx, rx) = sync_channel::(CONTROLLER_CHANNEL_DEPTH);\n let writer_send = Arc::clone(&sub);\n let dt = Arc::clone(&self.delivered_through);\n let epoch_gate = Arc::clone(&self.controller_epoch);\n let sid = self.session_id;\n // W2 decouple: the writer publishes its in-flight-write window here so a\n // stall-evict can distinguish a wedged writer from an idle one.\n let write_blocked_since = Arc::new(Mutex::new(None));\n let writer_blocked = Arc::clone(&write_blocked_since);\n // Lease-revoke marker (ADR-0044): shared with the writer so a\n // distinct-lease Take can hand it the terminal Displaced duty.\n let revoked_by = Arc::new(Mutex::new(None));\n let writer_revoked = Arc::clone(&revoked_by);\n let writer = thread::spawn(move || {\n controller_writer(\n sid,\n writer_send,\n initial,\n initial_sync,\n rx,\n dt,\n epoch,\n epoch_gate,\n writer_blocked,\n writer_revoked,\n )\n });\n self.controller = Some(ControllerSink {\n tx,\n send: sub,\n…\n });\n…\n }\n…\n fn resolve_subscribe_gated(\n &mut self,\n sub: SharedSend,\n from_seq: u64,\n intent: AttachIntent,\n by: Option,\n gen: u64,\n code: Option,\n ticket: AdmitTicket,\n seal_ceremony: bool,\n ) -> (SubscribeOutcome, Option) {\n // OBS RIDER leg 1 (ALWAYS-ON pin): one structured breadcrumb per subscribe\n // decision — ids/generations only, never PTY bytes. Rides the daemon stderr\n // sink (F-039 shape) → daemon.stderr.log. The incumbent snapshot is captured\n // BEFORE the decision runs (become_controller overwrites the controller slot\n // inside the inner call); a supersession is derivable downstream as\n // old_by present ∧ req_gen > old_gen ∧ decision ∈ {controller, took}.\n let conn = sub.id();\n let by_lbl = by.as_deref().unwrap_or(\"local\").to_string();\n let old_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n let old_by = self.controller_by().map(|s| s.to_string());\n let intent_lbl = match intent {\n AttachIntent::Viewer => \"viewer\",\n AttachIntent::Control => \"control\",\n AttachIntent::Take => \"take\",\n };\n // The inner kernel returns the decision LABEL alongside the outcome: the\n // ADR-0047 `idempotent` vocabulary is additive to the BREADCRUMB only —\n // `SubscribeOutcome` is a wire type (`subscribed_envelope`), so an\n // idempotent replay still answers `Controller` on the wire and an N-1\n // brain/rc needs no tolerance for a variant it has never seen.\n // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n let mut seat_cred = None;\n let (outcome, decision) = self.resolve_subscribe_inner_gated(\n sub,\n from_seq,\n intent,\n by,\n gen,\n code,\n ticket,\n &mut seat_cred,\n );\n // AFTER the ladder, never before it — the take path revokes empowerments\n // as it seats the taker, so a grant written at the gate is revoked by\n // the very attach that earned it.\n // [impl->REQ-ENGINEROOM-ADMIN-BRINGUP-EMPOWERS]\n let seat_note = self.settle_engine_room_seat(seat_cred, &outcome);\n // Stamp the W2 seal-ceremony capability onto the seat this subscribe\n // seated (conn-keyed, so a refused/viewer outcome touches nothing).\n // [impl->REQ-SEAL-NO-CEREMONY-SURFACE]\n if matches!(\n outcome,\n SubscribeOutcome::Controller | SubscribeOutcome::TookControl\n ) {\n self.stamp_controller_seal_ceremony(conn, seal_ceremony);\n }\n spt_proto::emit_line_err!(\n \"SUBSCRIBE_DECISION: session={} endpoint={} by={} conn={} intent={} \\\n old_by={} old_gen={} req_gen={} decision={}\",\n self.session_id,\n if self.endpoint.is_empty() { \"-\" } else { &self.endpoint },\n by_lbl,\n conn,\n intent_lbl,\n old_by.as_deref().unwrap_or(\"-\"),\n old_gen,\n gen,\n decision,\n );\n (outcome, seat_note)\n }\n\n /// The W2.5 subscribe decision kernel — wrapped by\n /// [`OutputLog::resolve_subscribe`], which emits the always-on decision\n /// breadcrumb around it. See that wrapper for the field/observability contract.\n ///\n /// Returns the wire [`SubscribeOutcome`] AND the breadcrumb decision label;\n /// they are deliberately not 1:1 (`idempotent` is a label over a `Controller`\n /// outcome — ADR-0047 decision 3's additive vocabulary).\n /// The no-admit spelling of the inner kernel (see\n /// [`resolve_subscribe`](Self::resolve_subscribe) for why it stays).\n…\n fn resolve_subscribe_inner_gated(\n &mut self,\n sub: SharedSend,\n from_seq: u64,\n intent: AttachIntent,\n by: Option,\n gen: u64,\n code: Option,\n ticket: AdmitTicket,\n seat_cred: &mut Option,\n ) -> (SubscribeOutcome, &'static str) {\n // The engine room's structural locks come FIRST — before the viewer cap,\n // before the lease ladder — because they are about who may hold this\n // seat at all, not about who currently does. Enforced HERE and not at\n // the wire edge: the adversary in this threat model is an agent on this\n // node, which can speak the broker's own IPC and skip `serve_attach`\n // entirely. The seat resolver is the one door every attach comes through.\n // [impl->REQ-ER-RC-INTENT-LOCKS]\n match self.engine_room_refusal(intent, by.as_deref(), code.as_deref(), sub.id(), ticket) {\n SeatGate::Refused(outcome, label) => return (outcome, label),\n SeatGate::Proceed(cred) => *seat_cred = cred,\n }\n if intent == AttachIntent::Viewer {\n if self.viewers.len() >= MAX_VIEWERS {\n // Soft cap reached — refuse the viewer (bounds thread count).\n return (\n SubscribeOutcome::BusyControlled {\n by: \"viewer cap reached\".to_string(),\n },\n \"busy\",\n );\n }\n self.add_viewer(sub, from_seq, by.as_deref());\n self.stamp_viewer_count();\n return (SubscribeOutcome::Viewer, \"viewer\");\n }\n // Control or Take.\n // W2 decouple (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): a controller WEDGED\n // on a suspended/black-holed brain conn past BRAIN_WRITE_DEADLINE is\n // stall-evicted HERE — the take/reattach self-heals against broker truth\n // without waiting for new output (the output-driven mark_controller_gone\n // never fires on an idle session). Inline stamp: this path already writes the\n // perch under the log lock via become_controller. After the evict the slot\n // reads free and the normal free/take logic below runs.\n self.stall_evict_controller(Instant::now(), StampMode::Inline);\n if self.controller.is_none() {\n // Free endpoint → become controller (nothing to displace).\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n let same_identity = self.controller_by() == by.as_deref();\n if same_identity {\n // The GENERATION LADDER over the (by, nonzero attach_gen) LOGICAL\n // LEASE (ADR-0044 decision 1 + the 2026-07-18 ladder ruling over\n // the ADR-0038 fix-6 generation): node identity alone is NEVER a\n // lease — two same-node viewports are DISTINCT controllers,\n // discriminated by their generations; within one identity the\n // generation stays the LIFECYCLE discriminator.\n // gen == incumbent (nonzero) → the SAME lease re-served after a\n // dispatcher restart — the fix-6 successor, silent (gate #7).\n // gen < incumbent (nonzero) → a REPLAYED stale Request (an\n // unfinished backlog row whose viewport died raw) — refused\n // busy; the ladder never runs backwards.\n // gen > incumbent (nonzero) → the LIVE replacement viewport,\n // Control or Take alike: loud+fenced SUPERSESSION via the full\n // W2 revoke (terminal Displaced + fence moves with the slot) —\n // never the silent sink swap that left the incumbent\n // input-capable but blind (the hertz split-brain), and never a\n // Busy that locks the replacement out behind a stale-replay\n // worker serving a zombie stream (the redispatch_stall T6\n // post-restart lockout).\n // 0 on either side → local / N-1 legacy re-take, preserved.\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n let incumbent_gen = self.controller.as_ref().map_or(0, |c| c.attach_gen);\n let incumbent_conn = self.controller.as_ref().map(|c| c.send.id());\n // IDEMPOTENT REPLAY — the new leaf INSIDE the equal-generation rung\n // (ADR-0047 decision 3, REQ-ATTACH-IDEMPOTENT-REPLAY). Same identity,\n // same NONZERO generation, and the SAME CONNECTION as the incumbent\n // seat means this is a replay of the establish we already honored, not\n // a successor: the seat and its writer are PRESERVED, no\n // `controller-replaced` fires, and no second initial batch is\n // synthesized. Field bill (hertz v0.39.4 bug 4, pinned on an\n // authorized same-seam `daemon refresh`): post-cycle dispatcher replay\n // served ONE held attach twice on ONE conn 15 ms apart; the equal-gen\n // rung classified it \"same lease, silent re-take\" — correct — but\n // re-take was `become_controller`, which unconditionally drops the\n // prior seat. Designed for a DEAD seat after a dispatcher restart, it\n // fired against the same LIVE conn: the lease killed its own writer\n // (channel-closed) and the rc viewport froze until a manual\n // detach + re-attach. \"spt update freezes every attached PTY.\"\n //\n // Equal generation on a DIFFERENT conn keeps today's silent swap — that\n // is the designed ADR-0038 fix-6 successor (the old seat is dead and the\n // lease is being re-served on a fresh carrier), and it must not regress.\n // [impl->REQ-ATTACH-IDEMPOTENT-REPLAY]\n //\n // The key includes `from_seq` because core itself re-subscribes on the\n // SAME conn with the SAME generation for a legitimate reason: the\n // controller GAP RESUME (REQ-HAZARD-CONTROLLER-GAP-RESUME,\n // `read_controller_event_resuming`) re-fetches dropped frames from its\n // frozen `delivered_through` floor. That request is NOT a replay of the\n // establish — it asks for different bytes — and suppressing it would\n // leave the gap unhealed and surface a false truncation. A replayed\n // establish carries the from_seq it was first honored with; a re-fetch\n // carries the floor it has since reached.\n let incumbent_from = self.controller.as_ref().map_or(0, |c| c.establish_from_seq);\n if gen != 0\n && incumbent_gen == gen\n && incumbent_conn == Some(sub.id())\n && incumbent_from == from_seq\n {\n return (SubscribeOutcome::Controller, \"idempotent\");\n }\n if gen == 0 || incumbent_gen == 0 || gen == incumbent_gen {\n // Same lease (or legacy) that is NOT a replay of the establish:\n // a different conn (the fix-6 successor) or the SAME conn asking\n // from a different floor (the gap-resume re-fetch above). Silent\n // re-take either way, NEVER Displaced.\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n if gen < incumbent_gen {\n return (\n SubscribeOutcome::BusyControlled {\n by: self.controller_by().unwrap_or_default().to_string(),\n },\n \"busy\",\n );\n }\n // Strictly newer gen — loud+fenced supersession on BOTH intents.\n self.mark_revoked(by.as_deref().unwrap_or(\"\"));\n self.become_controller(sub, by, from_seq, gen);\n return match intent {\n AttachIntent::Take => (SubscribeOutcome::TookControl, \"took\"),\n _ => (SubscribeOutcome::Controller, \"controller\"),\n };\n }\n if by.is_none() {\n // The LOCAL brain re-attaching while a REMOTE controls — never steal;\n // fall back to a silent viewer (gate #7 for the local-resume path).\n // `by` is None on this arm by construction, so the sink retains no node.\n self.add_viewer(sub, from_seq, None);\n self.stamp_viewer_count();\n return (SubscribeOutcome::Viewer, \"viewer\");\n }\n if self.controller_by().is_none() {\n // A remote takes an UNDRIVEN session (only the local spawner held the\n // slot) — silent control, no loud displace (there is no remote driver\n // to notify).\n self.become_controller(sub, by, from_seq, gen);\n return (SubscribeOutcome::Controller, \"controller\");\n }\n // A DIFFERENT remote controls it.\n match intent {\n AttachIntent::Take => {\n // Loud displace of a distinct-lease incumbent — the terminal\n // Displaced rides the OLD writer's EXIT (mark_revoked), never a\n // droppable try_send into its live queue: off the dispatch\n // thread (the incumbent may be exactly the wedged one), and\n // authoritative even when the queue is Full (ADR-0044\n // decision 2 — the try_send this replaces silently dropped the\n // notice while become_controller still swapped the sink).\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n self.mark_revoked(by.as_deref().unwrap_or(\"\"));\n…\n }\n…\n }\n }","startLine":2592,"lineNumbers":[2592,2593,2594,2595,2596,2597,2598,2599,2600,2601,2602,2603,2604,2605,2606,2607,2608,2609,2610,2611,2612,2613,2614,2615,2616,2617,2618,2619,2620,2621,2622,2623,2624,2625,2626,2627,2628,2629,2630,2631,2632,2633,2634,2635,2636,2637,2638,2639,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,2669,2670,2671,2672,2673,2674,2675,2676,2677,2678,null,2689,null,2695,null,3000,3001,3002,3003,3004,3005,3006,3007,3008,3009,3010,3011,3012,3013,3014,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026,3027,3028,3029,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3044,3045,3046,3047,3048,3049,3050,3051,3052,3053,3054,3055,3056,3057,3058,3059,3060,3061,3062,3063,3064,3065,3066,3067,3068,3069,3070,3071,3072,3073,3074,3075,3076,3077,3078,3079,3080,3081,null,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3147,3148,3149,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172,3173,3174,3175,3176,3177,3178,3179,3180,3181,3182,3183,3184,3185,3186,3187,3188,3189,3190,3191,3192,3193,3194,3195,3196,3197,3198,3199,3200,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217,3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233,3234,3235,3236,3237,3238,3239,3240,3241,3242,3243,3244,3245,3246,3247,3248,3249,3250,3251,3252,3253,3254,3255,3256,3257,3258,3259,3260,3261,3262,3263,3264,3265,3266,3267,3268,3269,3270,3271,3272,3273,3274,3275,3276,3277,3278,3279,3280,null,3283,null,3290,3291]},"fileSize":877537,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\broker.rs"}}},"isError":false,"timestamp":1789528556302}}
{"type":"message","id":"f2efba76","parentId":"c16723a1","timestamp":"2026-09-16T03:15:56.315Z","message":{"role":"toolResult","toolCallId":"call_WkSBiB5h0KDtYmJBGNLpt0Ky|fc_00817a6e65e8f156016aaa09ec17b887d18378d56308c44e58","toolName":"read","content":[{"type":"text","text":" fn dispatch_subscribe(&self, env: Envelope, send: &SharedSend) -> Result {\n let req: SubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad subscribe payload: {e}\"))?;\n // Clone the log Arc out from under the sessions lock, then resolve under\n // the log lock — never hold both locks at once.\n //\n // NOTE (REQ-HAZARD-RC-ATTACH-FAILFAST): a `session.try_wait()` dead-child\n // fast-detect MUST NOT live here — `try_wait` locks the same child mutex\n // the per-session exit-waiter holds for the WHOLE life of a live child\n // (`PtySession::wait`, broker.rs exit-waiter), so it deadlocks every live\n // attach. The dead-not-reaped case needs no fast-detect: the exit-waiter\n // already broadcasts an `Exit` frame to all attached sinks on reap, and a\n // post-removal subscribe gets a prompt \"no such session\" error — both\n // non-silent. The rc-side status-gate (a) + first-event backstop (b) cover\n // the rest.\n let log = {\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n Arc::clone(&h.log)\n };\n // A bring-up this broker just admitted seats its controller without\n // re-presenting the code, ONCE, for the session it spawned. The reason\n // is a race, not a discount: the bounded wait for the harness can\n // outlive the ±1 TOTP window, so the same gate that admitted a code\n // moments ago can refuse it here — gate-admits-then-attach-refuses,\n // which is the defect this wave closes, rebuilt one seam later.\n //\n // Read off the presented SECRET, not off this connection: the subscribe\n // that seats an rc attach is sent by the dispatcher's own conn, never\n // the one that asked for the bring-up (dispatch.rs `connect` →\n // attach.rs `attach_as_coded`), so a conn-keyed admit could never be\n // redeemed. The ticket rides the code field the operator's code already\n // rides, which is the one pipe that does cross this seam.\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n let ticket = self.redeem_bringup_admit(req.code.as_deref(), req.session_id);\n let (outcome, seat_note) = recover_log(&log).resolve_subscribe_gated(\n Arc::clone(send),\n req.from_seq,\n req.intent,\n req.by,\n req.gen,\n // The bring-up code the operator presented, for the ONE endpoint whose\n // seat resolver demands one (ADR-0052 decision 2).\n // [impl->REQ-ER-BRINGUP-TOTP-GATE]\n req.code,\n ticket,\n // The W2 seal-ceremony capability this client declared.\n // [impl->REQ-SEAL-NO-CEREMONY-SURFACE]\n req.seal_ceremony,\n );\n send_frame(\n send,\n &subscribed_envelope(req.session_id, outcome, seat_note),\n );\n Ok(req.session_id)\n }\n\n /// Release this connection's controller/viewer role on a session\n /// (REQ-RCVIEW-1): clears the controller slot iff this is the controller\n /// (re-stamping `driven_by`) and removes any viewer rows it owns\n /// (re-stamping `viewer_count`). The explicit detach a `serve_attach` worker\n /// sends when its viewport ends, so the markers clear promptly. Idempotent —\n /// a no-op if a newer controller already took over, or the session is gone.\n fn dispatch_unsubscribe(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: UnsubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad unsubscribe payload: {e}\"))?;\n let log = {\n let sessions = recover(&self.sessions);\n match sessions.get(&req.session_id) {\n Some(h) => Arc::clone(&h.log),\n None => {\n spt_proto::emit_line_err!(\"DBG unsubscribe: no session {}\", req.session_id);\n return Ok(());\n }\n }\n };\n recover_log(&log).detach_if_gen(send, req.gen);\n // A controller that detaches cleanly mid-ceremony aborts it — the\n // requester is answered cancelled instead of waiting on an overlay\n // nobody hosts (REQ-SEAL-CEREMONY-ESC-CANCEL's involuntary arm).\n self.abort_ceremonies_for_conn(send.id());\n Ok(())\n }\n\n /// Inject input bytes into a session's PTY.\n ///\n /// With an `op_id` the write is routed through the broker-owned\n /// [`EffectJournal`] for exactly-once delivery: a replay of the same\n /// `(session_id, op_id)` after a brain crash is deduped (the PTY is not\n…\n fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: InputReq =\n serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n // Clone the input-writer Arc (and the translation handle, if any) out from\n // under the sessions lock so the ENQUEUE happens without holding the table\n // lock (mirrors dispatch_subscribe). The enqueue is non-blocking, so the\n // dispatch thread is never parked here even when the harness has stalled\n // (P0 / REQ-HAZARD-PTY-INPUT-WRITER-WEDGE).\n let (input, translation, log) = {\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n (Arc::clone(&h.input), h.translation.clone(), Arc::clone(&h.log))\n };\n // RC-ORIGIN INPUT FENCE (ADR-0044 decision 3, the required defense):\n // an rc-tagged input must come from the ACTIVE controller lease's\n // originating conn — the same conn-identity gate resize has always had\n // — so a displaced viewport can never keep typing into the PTY, no\n // matter whether its Displaced notice was delivered, delayed, or lost.\n // SCOPED to `Minter::Rc`: shell/system injection (`Minter::Shell`,\n // legacy/untagged senders) legitimately writes from non-controller\n // conns and is untouched. The error frame this surfaces terminates the\n // stale serve worker's loop — defense in depth on the same terminal\n // signal. In-memory check only (no I/O under the log lock).\n // [impl->REQ-INPUT-CONTROLLER-FENCE]\n if rc_input_rejected(req.minter, recover_log(&log).is_controller(send)) {\n return Err(format!(\n \"input is controller-exclusive: this rc lease was displaced on \\\n session {} (a newer controller holds the slot)\",\n req.session_id\n ));\n }\n // Layer C: when a (non-faulted) translation binary is attached, fire a\n // CONTENT-FREE `{type:input}` ping so the binary can track operator idleness\n // — best-effort, never carries the keystroke bytes (doyle gate #1, privacy).\n if let Some(tr) = &translation {\n if !tr.faulted.load(Ordering::Relaxed) {\n let _ = tr.child.send(&ToBinary::Input);\n }\n }\n // Layer C: if an injected sequence is mid-flight, the operator's keystrokes\n // BUFFER in the inject floor and are flushed to the PTY after the sequence\n // commits — so a stash/restore choreography can't be clobbered. Returns\n // true when buffered (the caller must NOT write the PTY now).\n let buffered = |bytes: &[u8]| -> bool {\n translation\n .as_ref()\n .is_some_and(|tr| lock_floor(&tr.floor).buffer_if_held(bytes))\n };\n match req.op_id {\n Some(op) => {\n // Materialize the minter at the decode seam: an untagged (older)\n // sender ⇒ Legacy; a live producer stamped its real tag (ADR-0034).\n let minter = req.minter.unwrap_or(Minter::Legacy);\n let key = EffectKey {\n class: req.session_id,\n minter,\n op,\n };\n let outcome = self\n .journal\n .apply_once(key, EffectKind::PtyWrite, || {\n // Buffer-or-ENQUEUE INSIDE the journal effect so the op is\n // still recorded applied + acked (dedup-safe) whether the byte\n // buffers (inject floor held), enqueues, or is dropped under\n // backpressure. The effect is now the non-blocking enqueue —\n // PtyWrite is ephemeral, so Applied-at-enqueue is sound\n // (V0.13.0-P0 design); the ack means \"accepted + ordered + will\n // land,\" and rc does not gate on landing.\n if !buffered(&bytes) {\n input.enqueue(bytes.clone());\n }\n Ok(())\n })\n .map_err(|e| format!(\"input enqueue failed: {e}\"))?;\n // Ack exactly-once — but ONLY when the caller requested it\n // (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The fire-and-forward\n // operator/rc path sends `ack=false`: writing the ack back onto the\n // same brain↔broker conn it is flooding with input fills the return\n // direction and deadlocks the per-conn handler (the wedge). With no\n // ack the handler never writes back while servicing the flood, so it\n // always drains. The acked path (`shellchan`, one-at-a-time) still\n // gets its `KIND_APPLIED`. Dedup is unaffected either way (the\n // applied-set is the exactly-once anchor, not the ack frame).\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n if req.ack {\n send_frame(\n send,\n &applied_envelope(req.session_id, op, outcome == Outcome::Applied),\n );\n }\n Ok(())\n }\n None => {\n if !buffered(&bytes) {\n input.enqueue(bytes);\n }\n Ok(())\n }\n }\n }\n\n /// Attempt a BOUNDED eager respawn of a FAULTED translation binary (F029 C-1,\n /// REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH) and return the endpoint's live\n /// translation (the rebuilt one on success, or the existing faulted/`None` one\n /// when we give up). Called from the inbound path when it observes `tr.faulted`.\n ///\n /// This is the seam that replaces ADR-0022's original never-respawn-on-fault\n /// permanent death. It reuses [`build_translation`] (exactly as the adapter-apply\n /// restart does) from the session's stored argv, sharing the SAME respawn\n /// give-up counter with the new worker (so a healthy `{commit}` resets the whole\n /// budget). The rebuild happens OFF the sessions lock (spawn + Init); the swap is\n /// re-locked. When the give-up budget is exhausted the binary stays dead and the\n /// caller SPOOLS (loud) — the bound the never-respawn rule existed to enforce,\n /// now finite-and-recoverable instead of permanent.\n // [impl->REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH]\n fn respawn_faulted_translation(&self, endpoint: &str) -> Option> {\n // Snapshot the argv + input writer + shared respawn counter + output log under\n // the lock (the log tap feeds the W5-A settle-gate + echo-verify).\n let (argv, input, respawns, log) = {\n let map = recover(&self.sessions);\n let h = map.values().find(|h| h.endpoint == endpoint)?;\n (\n h.translation_argv.clone()?,\n Arc::clone(&h.input),\n Arc::clone(&h.translation_respawns),\n Arc::clone(&h.log),\n )\n };\n // Bounded give-up: stop respawning once the budget is spent. The binary then\n // stays faulted → idle inbound SPOOLS (loud), never silently. `budget == 0`\n // (test override) reproduces ADR-0022's original permanent death.\n let budget = translate_respawn_budget();\n if respawns.load(Ordering::Relaxed) >= budget {\n spt_proto::emit_line_err!(\n \"TRANSLATION_RESPAWN_GIVEUP:{endpoint}: respawn budget ({budget}) exhausted — binary stays faulted; idle inbound spools until an adapter-apply / session restart\"\n );\n // Return the current (faulted) translation so the caller spools.\n let map = recover(&self.sessions);\n return map\n .values()\n .find(|h| h.endpoint == endpoint)\n .and_then(|h| h.translation.clone());\n }\n // Build the replacement OFF-lock, sharing the SAME respawn counter so the new\n // worker resets it on its first healthy commit.\n let rebuilt = build_translation(&argv, endpoint, &input, Arc::clone(&respawns), &log);\n if rebuilt.is_some() {\n let n = respawns.fetch_add(1, Ordering::Relaxed) + 1;\n // Heal the perch fault surface on a successful respawn (cleared here so a\n // recovered session shows clean; re-stamped if the new binary faults too).\n let perch = resolve_perch_path(endpoint, ParentHint::Infer);\n let _ = spt_store::info::set_translation_fault(&perch, None);\n…\n }\n…\n }\n…\n fn dispatch_net_stream_send(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: NetStreamSendReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-stream-send payload: {e}\"))?;\n let bytes =\n decode_bytes(&req.data_b64).map_err(|e| format!(\"bad net-stream-send base64: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n match req.op_id {\n None => host\n .send_stream(req.stream_id, &bytes, req.finish)\n .map_err(|e| e.to_string()),\n Some(op) => {\n let minter = req.minter.unwrap_or(Minter::Legacy);\n let key = EffectKey {\n class: NET_EFFECT_SESSION,\n minter,\n op,\n };\n let outcome = self\n .journal\n .apply_once(key, EffectKind::NetSend, || {\n host.send_stream(req.stream_id, &bytes, req.finish)\n })\n .map_err(|e| format!(\"net-stream-send failed: {e}\"))?;\n let frame = Envelope::new(\n KIND_NET_SENT,\n serde_json::to_value(NetSent {\n stream_id: req.stream_id,\n op_id: op,\n applied_now: outcome == Outcome::Applied,\n })\n .expect(\"NetSent serializes\"),\n );\n send_frame(send, &frame);\n Ok(())\n }\n }\n }\n\n /// List every stream the broker holds (D4b) — the query a re-attaching\n /// brain uses to find streams that arrived while it was down.\n fn dispatch_net_streams(&self, send: &SharedSend) -> Result<(), String> {\n let host = self.net.get().ok_or(\"net disabled\")?;\n // SERVER-SIDE eligibility filter (ADR-0040 decision 2): locally-\n // initiated rows never cross the IPC — the dispatcher only ever\n // skipped them client-side, and serializing the full local history\n // every 100ms poll was the O(history) enumeration cost of KH 7.44.\n // [impl->REQ-STREAM-INFOS-SERVER-FILTER]\n let frame = Envelope::new(\n KIND_NET_STREAMS_REPLY,\n serde_json::to_value(NetStreamsReply {\n streams: host.dispatch_stream_infos(),\n })\n .expect(\"NetStreamsReply serializes\"),\n );\n…\n }\n…\n fn dispatch_net_stream_subscribe(\n &self,\n env: Envelope,\n send: &SharedSend,\n ) -> Result {\n let req: NetStreamSubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-stream-subscribe payload: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n host.subscribe_stream(req.stream_id, Arc::clone(send), req.from_seq)\n .map_err(|e| e.to_string())?;\n Ok(req.stream_id)\n }\n\n /// Attach a brain to the conn-liveness event log from a cursor (D4c) — the\n /// PresenceChannel broker seam: gapless resume over connection presence,\n /// same discipline as a stream subscribe.\n // [impl->REQ-EP-4]\n fn dispatch_net_presence_subscribe(\n &self,\n env: Envelope,\n send: &SharedSend,\n ) -> Result<(), String> {\n let req: NetPresenceSubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-presence-subscribe payload: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n host.subscribe_presence(Arc::clone(send), req.from_seq);\n Ok(())\n }\n\n /// Terminate a session's child. The exit waiter emits the `exit` frame and\n /// reaps the session once the child is dead.\n fn dispatch_kill(&self, env: Envelope) -> Result<(), String> {\n let req: KillReq =\n serde_json::from_value(env.payload).map_err(|e| format!(\"bad kill payload: {e}\"))?;\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n h.session.kill().map_err(|e| format!(\"kill failed: {e}\"))\n }\n\n /// Tear a session down by REQUEST key — the endpoint-teardown primitive"}],"details":{"displayContent":{"text":" fn dispatch_subscribe(&self, env: Envelope, send: &SharedSend) -> Result {\n let req: SubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad subscribe payload: {e}\"))?;\n // Clone the log Arc out from under the sessions lock, then resolve under\n // the log lock — never hold both locks at once.\n //\n // NOTE (REQ-HAZARD-RC-ATTACH-FAILFAST): a `session.try_wait()` dead-child\n // fast-detect MUST NOT live here — `try_wait` locks the same child mutex\n // the per-session exit-waiter holds for the WHOLE life of a live child\n // (`PtySession::wait`, broker.rs exit-waiter), so it deadlocks every live\n // attach. The dead-not-reaped case needs no fast-detect: the exit-waiter\n // already broadcasts an `Exit` frame to all attached sinks on reap, and a\n // post-removal subscribe gets a prompt \"no such session\" error — both\n // non-silent. The rc-side status-gate (a) + first-event backstop (b) cover\n // the rest.\n let log = {\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n Arc::clone(&h.log)\n };\n // A bring-up this broker just admitted seats its controller without\n // re-presenting the code, ONCE, for the session it spawned. The reason\n // is a race, not a discount: the bounded wait for the harness can\n // outlive the ±1 TOTP window, so the same gate that admitted a code\n // moments ago can refuse it here — gate-admits-then-attach-refuses,\n // which is the defect this wave closes, rebuilt one seam later.\n //\n // Read off the presented SECRET, not off this connection: the subscribe\n // that seats an rc attach is sent by the dispatcher's own conn, never\n // the one that asked for the bring-up (dispatch.rs `connect` →\n // attach.rs `attach_as_coded`), so a conn-keyed admit could never be\n // redeemed. The ticket rides the code field the operator's code already\n // rides, which is the one pipe that does cross this seam.\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n let ticket = self.redeem_bringup_admit(req.code.as_deref(), req.session_id);\n let (outcome, seat_note) = recover_log(&log).resolve_subscribe_gated(\n Arc::clone(send),\n req.from_seq,\n req.intent,\n req.by,\n req.gen,\n // The bring-up code the operator presented, for the ONE endpoint whose\n // seat resolver demands one (ADR-0052 decision 2).\n // [impl->REQ-ER-BRINGUP-TOTP-GATE]\n req.code,\n ticket,\n // The W2 seal-ceremony capability this client declared.\n // [impl->REQ-SEAL-NO-CEREMONY-SURFACE]\n req.seal_ceremony,\n );\n send_frame(\n send,\n &subscribed_envelope(req.session_id, outcome, seat_note),\n );\n Ok(req.session_id)\n }\n\n /// Release this connection's controller/viewer role on a session\n /// (REQ-RCVIEW-1): clears the controller slot iff this is the controller\n /// (re-stamping `driven_by`) and removes any viewer rows it owns\n /// (re-stamping `viewer_count`). The explicit detach a `serve_attach` worker\n /// sends when its viewport ends, so the markers clear promptly. Idempotent —\n /// a no-op if a newer controller already took over, or the session is gone.\n fn dispatch_unsubscribe(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: UnsubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad unsubscribe payload: {e}\"))?;\n let log = {\n let sessions = recover(&self.sessions);\n match sessions.get(&req.session_id) {\n Some(h) => Arc::clone(&h.log),\n None => {\n spt_proto::emit_line_err!(\"DBG unsubscribe: no session {}\", req.session_id);\n return Ok(());\n }\n }\n };\n recover_log(&log).detach_if_gen(send, req.gen);\n // A controller that detaches cleanly mid-ceremony aborts it — the\n // requester is answered cancelled instead of waiting on an overlay\n // nobody hosts (REQ-SEAL-CEREMONY-ESC-CANCEL's involuntary arm).\n self.abort_ceremonies_for_conn(send.id());\n Ok(())\n }\n\n /// Inject input bytes into a session's PTY.\n ///\n /// With an `op_id` the write is routed through the broker-owned\n /// [`EffectJournal`] for exactly-once delivery: a replay of the same\n /// `(session_id, op_id)` after a brain crash is deduped (the PTY is not\n…\n fn dispatch_input(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: InputReq =\n serde_json::from_value(env.payload).map_err(|e| format!(\"bad input payload: {e}\"))?;\n let bytes = decode_bytes(&req.data_b64).map_err(|e| format!(\"bad input base64: {e}\"))?;\n // Clone the input-writer Arc (and the translation handle, if any) out from\n // under the sessions lock so the ENQUEUE happens without holding the table\n // lock (mirrors dispatch_subscribe). The enqueue is non-blocking, so the\n // dispatch thread is never parked here even when the harness has stalled\n // (P0 / REQ-HAZARD-PTY-INPUT-WRITER-WEDGE).\n let (input, translation, log) = {\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n (Arc::clone(&h.input), h.translation.clone(), Arc::clone(&h.log))\n };\n // RC-ORIGIN INPUT FENCE (ADR-0044 decision 3, the required defense):\n // an rc-tagged input must come from the ACTIVE controller lease's\n // originating conn — the same conn-identity gate resize has always had\n // — so a displaced viewport can never keep typing into the PTY, no\n // matter whether its Displaced notice was delivered, delayed, or lost.\n // SCOPED to `Minter::Rc`: shell/system injection (`Minter::Shell`,\n // legacy/untagged senders) legitimately writes from non-controller\n // conns and is untouched. The error frame this surfaces terminates the\n // stale serve worker's loop — defense in depth on the same terminal\n // signal. In-memory check only (no I/O under the log lock).\n // [impl->REQ-INPUT-CONTROLLER-FENCE]\n if rc_input_rejected(req.minter, recover_log(&log).is_controller(send)) {\n return Err(format!(\n \"input is controller-exclusive: this rc lease was displaced on \\\n session {} (a newer controller holds the slot)\",\n req.session_id\n ));\n }\n // Layer C: when a (non-faulted) translation binary is attached, fire a\n // CONTENT-FREE `{type:input}` ping so the binary can track operator idleness\n // — best-effort, never carries the keystroke bytes (doyle gate #1, privacy).\n if let Some(tr) = &translation {\n if !tr.faulted.load(Ordering::Relaxed) {\n let _ = tr.child.send(&ToBinary::Input);\n }\n }\n // Layer C: if an injected sequence is mid-flight, the operator's keystrokes\n // BUFFER in the inject floor and are flushed to the PTY after the sequence\n // commits — so a stash/restore choreography can't be clobbered. Returns\n // true when buffered (the caller must NOT write the PTY now).\n let buffered = |bytes: &[u8]| -> bool {\n translation\n .as_ref()\n .is_some_and(|tr| lock_floor(&tr.floor).buffer_if_held(bytes))\n };\n match req.op_id {\n Some(op) => {\n // Materialize the minter at the decode seam: an untagged (older)\n // sender ⇒ Legacy; a live producer stamped its real tag (ADR-0034).\n let minter = req.minter.unwrap_or(Minter::Legacy);\n let key = EffectKey {\n class: req.session_id,\n minter,\n op,\n };\n let outcome = self\n .journal\n .apply_once(key, EffectKind::PtyWrite, || {\n // Buffer-or-ENQUEUE INSIDE the journal effect so the op is\n // still recorded applied + acked (dedup-safe) whether the byte\n // buffers (inject floor held), enqueues, or is dropped under\n // backpressure. The effect is now the non-blocking enqueue —\n // PtyWrite is ephemeral, so Applied-at-enqueue is sound\n // (V0.13.0-P0 design); the ack means \"accepted + ordered + will\n // land,\" and rc does not gate on landing.\n if !buffered(&bytes) {\n input.enqueue(bytes.clone());\n }\n Ok(())\n })\n .map_err(|e| format!(\"input enqueue failed: {e}\"))?;\n // Ack exactly-once — but ONLY when the caller requested it\n // (REQ-HAZARD-INPUT-ACK-BACKPRESSURE). The fire-and-forward\n // operator/rc path sends `ack=false`: writing the ack back onto the\n // same brain↔broker conn it is flooding with input fills the return\n // direction and deadlocks the per-conn handler (the wedge). With no\n // ack the handler never writes back while servicing the flood, so it\n // always drains. The acked path (`shellchan`, one-at-a-time) still\n // gets its `KIND_APPLIED`. Dedup is unaffected either way (the\n // applied-set is the exactly-once anchor, not the ack frame).\n // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n if req.ack {\n send_frame(\n send,\n &applied_envelope(req.session_id, op, outcome == Outcome::Applied),\n );\n }\n Ok(())\n }\n None => {\n if !buffered(&bytes) {\n input.enqueue(bytes);\n }\n Ok(())\n }\n }\n }\n\n /// Attempt a BOUNDED eager respawn of a FAULTED translation binary (F029 C-1,\n /// REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH) and return the endpoint's live\n /// translation (the rebuilt one on success, or the existing faulted/`None` one\n /// when we give up). Called from the inbound path when it observes `tr.faulted`.\n ///\n /// This is the seam that replaces ADR-0022's original never-respawn-on-fault\n /// permanent death. It reuses [`build_translation`] (exactly as the adapter-apply\n /// restart does) from the session's stored argv, sharing the SAME respawn\n /// give-up counter with the new worker (so a healthy `{commit}` resets the whole\n /// budget). The rebuild happens OFF the sessions lock (spawn + Init); the swap is\n /// re-locked. When the give-up budget is exhausted the binary stays dead and the\n /// caller SPOOLS (loud) — the bound the never-respawn rule existed to enforce,\n /// now finite-and-recoverable instead of permanent.\n // [impl->REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH]\n fn respawn_faulted_translation(&self, endpoint: &str) -> Option> {\n // Snapshot the argv + input writer + shared respawn counter + output log under\n // the lock (the log tap feeds the W5-A settle-gate + echo-verify).\n let (argv, input, respawns, log) = {\n let map = recover(&self.sessions);\n let h = map.values().find(|h| h.endpoint == endpoint)?;\n (\n h.translation_argv.clone()?,\n Arc::clone(&h.input),\n Arc::clone(&h.translation_respawns),\n Arc::clone(&h.log),\n )\n };\n // Bounded give-up: stop respawning once the budget is spent. The binary then\n // stays faulted → idle inbound SPOOLS (loud), never silently. `budget == 0`\n // (test override) reproduces ADR-0022's original permanent death.\n let budget = translate_respawn_budget();\n if respawns.load(Ordering::Relaxed) >= budget {\n spt_proto::emit_line_err!(\n \"TRANSLATION_RESPAWN_GIVEUP:{endpoint}: respawn budget ({budget}) exhausted — binary stays faulted; idle inbound spools until an adapter-apply / session restart\"\n );\n // Return the current (faulted) translation so the caller spools.\n let map = recover(&self.sessions);\n return map\n .values()\n .find(|h| h.endpoint == endpoint)\n .and_then(|h| h.translation.clone());\n }\n // Build the replacement OFF-lock, sharing the SAME respawn counter so the new\n // worker resets it on its first healthy commit.\n let rebuilt = build_translation(&argv, endpoint, &input, Arc::clone(&respawns), &log);\n if rebuilt.is_some() {\n let n = respawns.fetch_add(1, Ordering::Relaxed) + 1;\n // Heal the perch fault surface on a successful respawn (cleared here so a\n // recovered session shows clean; re-stamped if the new binary faults too).\n let perch = resolve_perch_path(endpoint, ParentHint::Infer);\n let _ = spt_store::info::set_translation_fault(&perch, None);\n…\n }\n…\n }\n…\n fn dispatch_net_stream_send(&self, env: Envelope, send: &SharedSend) -> Result<(), String> {\n let req: NetStreamSendReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-stream-send payload: {e}\"))?;\n let bytes =\n decode_bytes(&req.data_b64).map_err(|e| format!(\"bad net-stream-send base64: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n match req.op_id {\n None => host\n .send_stream(req.stream_id, &bytes, req.finish)\n .map_err(|e| e.to_string()),\n Some(op) => {\n let minter = req.minter.unwrap_or(Minter::Legacy);\n let key = EffectKey {\n class: NET_EFFECT_SESSION,\n minter,\n op,\n };\n let outcome = self\n .journal\n .apply_once(key, EffectKind::NetSend, || {\n host.send_stream(req.stream_id, &bytes, req.finish)\n })\n .map_err(|e| format!(\"net-stream-send failed: {e}\"))?;\n let frame = Envelope::new(\n KIND_NET_SENT,\n serde_json::to_value(NetSent {\n stream_id: req.stream_id,\n op_id: op,\n applied_now: outcome == Outcome::Applied,\n })\n .expect(\"NetSent serializes\"),\n );\n send_frame(send, &frame);\n Ok(())\n }\n }\n }\n\n /// List every stream the broker holds (D4b) — the query a re-attaching\n /// brain uses to find streams that arrived while it was down.\n fn dispatch_net_streams(&self, send: &SharedSend) -> Result<(), String> {\n let host = self.net.get().ok_or(\"net disabled\")?;\n // SERVER-SIDE eligibility filter (ADR-0040 decision 2): locally-\n // initiated rows never cross the IPC — the dispatcher only ever\n // skipped them client-side, and serializing the full local history\n // every 100ms poll was the O(history) enumeration cost of KH 7.44.\n // [impl->REQ-STREAM-INFOS-SERVER-FILTER]\n let frame = Envelope::new(\n KIND_NET_STREAMS_REPLY,\n serde_json::to_value(NetStreamsReply {\n streams: host.dispatch_stream_infos(),\n })\n .expect(\"NetStreamsReply serializes\"),\n );\n…\n }\n…\n fn dispatch_net_stream_subscribe(\n &self,\n env: Envelope,\n send: &SharedSend,\n ) -> Result {\n let req: NetStreamSubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-stream-subscribe payload: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n host.subscribe_stream(req.stream_id, Arc::clone(send), req.from_seq)\n .map_err(|e| e.to_string())?;\n Ok(req.stream_id)\n }\n\n /// Attach a brain to the conn-liveness event log from a cursor (D4c) — the\n /// PresenceChannel broker seam: gapless resume over connection presence,\n /// same discipline as a stream subscribe.\n // [impl->REQ-EP-4]\n fn dispatch_net_presence_subscribe(\n &self,\n env: Envelope,\n send: &SharedSend,\n ) -> Result<(), String> {\n let req: NetPresenceSubscribeReq = serde_json::from_value(env.payload)\n .map_err(|e| format!(\"bad net-presence-subscribe payload: {e}\"))?;\n let host = self.net.get().ok_or(\"net disabled\")?;\n host.subscribe_presence(Arc::clone(send), req.from_seq);\n Ok(())\n }\n\n /// Terminate a session's child. The exit waiter emits the `exit` frame and\n /// reaps the session once the child is dead.\n fn dispatch_kill(&self, env: Envelope) -> Result<(), String> {\n let req: KillReq =\n serde_json::from_value(env.payload).map_err(|e| format!(\"bad kill payload: {e}\"))?;\n let sessions = recover(&self.sessions);\n let h = sessions\n .get(&req.session_id)\n .ok_or_else(|| format!(\"no such session {}\", req.session_id))?;\n h.session.kill().map_err(|e| format!(\"kill failed: {e}\"))\n }\n\n /// Tear a session down by REQUEST key — the endpoint-teardown primitive","startLine":8750,"lineNumbers":[8750,8751,8752,8753,8754,8755,8756,8757,8758,8759,8760,8761,8762,8763,8764,8765,8766,8767,8768,8769,8770,8771,8772,8773,8774,8775,8776,8777,8778,8779,8780,8781,8782,8783,8784,8785,8786,8787,8788,8789,8790,8791,8792,8793,8794,8795,8796,8797,8798,8799,8800,8801,8802,8803,8804,8805,8806,8807,8808,8809,8810,8811,8812,8813,8814,8815,8816,8817,8818,8819,8820,8821,8822,8823,8824,8825,8826,8827,8828,8829,8830,8831,8832,8833,8834,8835,8836,8837,8838,8839,8840,null,8846,8847,8848,8849,8850,8851,8852,8853,8854,8855,8856,8857,8858,8859,8860,8861,8862,8863,8864,8865,8866,8867,8868,8869,8870,8871,8872,8873,8874,8875,8876,8877,8878,8879,8880,8881,8882,8883,8884,8885,8886,8887,8888,8889,8890,8891,8892,8893,8894,8895,8896,8897,8898,8899,8900,8901,8902,8903,8904,8905,8906,8907,8908,8909,8910,8911,8912,8913,8914,8915,8916,8917,8918,8919,8920,8921,8922,8923,8924,8925,8926,8927,8928,8929,8930,8931,8932,8933,8934,8935,8936,8937,8938,8939,8940,8941,8942,8943,8944,8945,8946,8947,8948,8949,8950,8951,8952,8953,8954,8955,8956,8957,8958,8959,8960,8961,8962,8963,8964,8965,8966,8967,8968,8969,8970,8971,8972,8973,8974,8975,8976,8977,8978,8979,8980,8981,8982,8983,8984,8985,8986,8987,8988,8989,8990,8991,8992,8993,8994,8995,8996,8997,8998,8999,9000,null,9002,null,9014,null,9826,9827,9828,9829,9830,9831,9832,9833,9834,9835,9836,9837,9838,9839,9840,9841,9842,9843,9844,9845,9846,9847,9848,9849,9850,9851,9852,9853,9854,9855,9856,9857,9858,9859,9860,9861,9862,9863,9864,9865,9866,9867,9868,9869,9870,9871,9872,9873,9874,9875,9876,9877,9878,9879,null,9882,null,9964,9965,9966,9967,9968,9969,9970,9971,9972,9973,9974,9975,9976,9977,9978,9979,9980,9981,9982,9983,9984,9985,9986,9987,9988,9989,9990,9991,9992,9993,9994,9995,9996,9997,9998,9999,10000,10001,10002,10003,10004,10005]},"fileSize":877537,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\broker.rs"}}},"isError":false,"timestamp":1789528556315}}
{"type":"message","id":"76c545d8","parentId":"f2efba76","timestamp":"2026-09-16T03:15:56.317Z","message":{"role":"toolResult","toolCallId":"call_58g6vcbI2yeowqxIyHEXHBlW|fc_00817a6e65e8f156016aaa09ec17d487d1b9d2699ab3017a7a","toolName":"grep","content":[{"type":"text","text":"# .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/\n## conn.rs\n 598| /// Bounded framed write. See [`Self::write_gated`].\n*599| pub(crate) fn write(&self, env: &Envelope) -> io::Result {\n 600| self.write_gated(env, || true)\n 601| }\n 602|\n## crc_swap.rs\n 285| /// Write `bytes` to `path`, creating parent dirs. Test helper.\n*286| fn write(path: &Path, bytes: &[u8]) {\n 287| if let Some(parent) = path.parent() {\n 288| fs::create_dir_all(parent).unwrap();\n 289| }\n## drivehub.rs\n 370| // [impl->REQ-SHELL-3]\n*371| pub fn write(&self, owner: &str, shell_id: &str, token: &str, frame: &str) {\n 372| write_slot(&self.map, owner, shell_id, token, frame);\n 373| }\n 374|\n...\n 1252| impl Write for Scripted {\n*1253| fn write(&mut self, buf: &[u8]) -> io::Result {\n 1254| self.written.write(buf)\n 1255| }\n 1256| fn flush(&mut self) -> io::Result<()> {\n## nethost.rs\n 1887| // [impl->REQ-DAEMON-2]\n*1888| pub fn send_stream(&self, stream_id: u64, bytes: &[u8], finish: bool) -> io::Result<()> {\n 1889| let entry = {\n 1890| let streams = self.shared.streams.lock().unwrap();\n 1891| Arc::clone(streams.get(&stream_id).ok_or_else(|| {\n...\n 2162| // [impl->REQ-DAEMON-2]\n*2163| pub(crate) fn subscribe_stream(\n 2164| &self,\n 2165| stream_id: u64,\n 2166| sub: SharedSend,"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":6,"fileCount":4,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/conn.rs",".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/crc_swap.rs",".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/drivehub.rs",".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/conn.rs","count":1},{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/crc_swap.rs","count":1},{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/drivehub.rs","count":2},{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs","count":2}],"truncated":false,"displayContent":"# .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/\n## conn.rs\n 598│ /// Bounded framed write. See [`Self::write_gated`].\n*599│ pub(crate) fn write(&self, env: &Envelope) -> io::Result {\n 600│ self.write_gated(env, || true)\n 601│ }\n 602│\n## crc_swap.rs\n 285│ /// Write `bytes` to `path`, creating parent dirs. Test helper.\n*286│ fn write(path: &Path, bytes: &[u8]) {\n 287│ if let Some(parent) = path.parent() {\n 288│ fs::create_dir_all(parent).unwrap();\n 289│ }\n## drivehub.rs\n 370│ // [impl->REQ-SHELL-3]\n *371│ pub fn write(&self, owner: &str, shell_id: &str, token: &str, frame: &str) {\n 372│ write_slot(&self.map, owner, shell_id, token, frame);\n 373│ }\n 374│\n │...\n 1252│ impl Write for Scripted {\n*1253│ fn write(&mut self, buf: &[u8]) -> io::Result {\n 1254│ self.written.write(buf)\n 1255│ }\n 1256│ fn flush(&mut self) -> io::Result<()> {\n## nethost.rs\n 1887│ // [impl->REQ-DAEMON-2]\n*1888│ pub fn send_stream(&self, stream_id: u64, bytes: &[u8], finish: bool) -> io::Result<()> {\n 1889│ let entry = {\n 1890│ let streams = self.shared.streams.lock().unwrap();\n 1891│ Arc::clone(streams.get(&stream_id).ok_or_else(|| {\n │...\n 2162│ // [impl->REQ-DAEMON-2]\n*2163│ pub(crate) fn subscribe_stream(\n 2164│ &self,\n 2165│ stream_id: u64,\n 2166│ sub: SharedSend,"},"isError":false,"timestamp":1789528556317}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Loojvp74fC5m0peRZXoDU3x8|fc_00817a6e65e8f156016aaa09fbd4cc87d1b15b5bcddb8f0343","toolName":"read","startedAt":"2026-09-16T03:16:11.973Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs:1888-1960,2163-2210"},"intent":"Reading narrow network waits"},"id":"b82d337e","parentId":"76c545d8","timestamp":"2026-09-16T03:16:11.973Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_K5gWw8wlc0OoP4EfNuDoyuhY|fc_00817a6e65e8f156016aaa09fbd4dc87d18e457d40047ef98d","toolName":"read","startedAt":"2026-09-16T03:16:11.973Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/conn.rs:598-738"},"intent":"Reading connection write bounds"},"id":"fe8486a7","parentId":"b82d337e","timestamp":"2026-09-16T03:16:11.973Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_zJNdhV4aOZBfL7gzMDrbuSUw|fc_00817a6e65e8f156016aaa09fbd4e887d18e6237aa60cd5c19","toolName":"read","startedAt":"2026-09-16T03:16:11.973Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:3955-4038"},"intent":"Reading controller writer ordering"},"id":"9f4682e9","parentId":"fe8486a7","timestamp":"2026-09-16T03:16:11.973Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_tOZjPcxjAlAumHonHFZR2h2s|fc_00817a6e65e8f156016aaa09fbd4ec87d180830f4a554e0f9e","toolName":"grep","startedAt":"2026-09-16T03:16:11.973Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1200-1250;.worktrees/49-267-refresh-discriminator/crates/spt…"},"intent":"Locating exact protocol fields"},"id":"fec661a1","parentId":"9f4682e9","timestamp":"2026-09-16T03:16:11.973Z"}
{"type":"message","id":"4a2761a9","parentId":"fec661a1","timestamp":"2026-09-16T03:16:11.973Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_Loojvp74fC5m0peRZXoDU3x8|fc_00817a6e65e8f156016aaa09fbd4cc87d1b15b5bcddb8f0343","name":"read","arguments":{"i":"Reading narrow network waits","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs:1888-1960,2163-2210"},"intent":"Reading narrow network waits"},{"type":"toolCall","id":"call_K5gWw8wlc0OoP4EfNuDoyuhY|fc_00817a6e65e8f156016aaa09fbd4dc87d18e457d40047ef98d","name":"read","arguments":{"i":"Reading connection write bounds","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/conn.rs:598-738"},"intent":"Reading connection write bounds"},{"type":"toolCall","id":"call_zJNdhV4aOZBfL7gzMDrbuSUw|fc_00817a6e65e8f156016aaa09fbd4e887d18e6237aa60cd5c19","name":"read","arguments":{"i":"Reading controller writer ordering","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:3955-4038"},"intent":"Reading controller writer ordering"},{"type":"toolCall","id":"call_tOZjPcxjAlAumHonHFZR2h2s|fc_00817a6e65e8f156016aaa09fbd4ec87d180830f4a554e0f9e","name":"grep","arguments":{"i":"Locating exact protocol fields","pattern":"struct SubscribedReply|struct SubscribeReq|struct InputReq|struct AppliedEvent|fn sessions\\(|KIND_SUBSCRIBED =>|pub fn write_frame","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1200-1250;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1650-1733;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating exact protocol fields"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10398,"output":321,"cacheRead":44928,"cacheWrite":0,"totalTokens":55647,"cost":{"input":0.10398,"output":0.016050000000000002,"cacheRead":0.044927999999999996,"cacheWrite":0,"total":0.164958}},"stopReason":"toolUse","timestamp":1789528556386,"responseId":"resp_00817a6e65e8f156016aaa09ec97bc87d19742a682e6aeada5","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_00817a6e65e8f156016aaa09fbd4cc87d1b15b5bcddb8f0343","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading narrow network waits\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs:1888-1960,2163-2210\"}","call_id":"call_Loojvp74fC5m0peRZXoDU3x8","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09fbd4dc87d18e457d40047ef98d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading connection write bounds\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/conn.rs:598-738\"}","call_id":"call_K5gWw8wlc0OoP4EfNuDoyuhY","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09fbd4e887d18e6237aa60cd5c19","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading controller writer ordering\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/broker.rs:3955-4038\"}","call_id":"call_zJNdhV4aOZBfL7gzMDrbuSUw","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa09fbd4ec87d180830f4a554e0f9e","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating exact protocol fields\",\"pattern\":\"struct SubscribedReply|struct SubscribeReq|struct InputReq|struct AppliedEvent|fn sessions\\\\(|KIND_SUBSCRIBED =>|pub fn write_frame\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1200-1250;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs:1650-1733;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_tOZjPcxjAlAumHonHFZR2h2s","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":15583.566999999806,"ttft":15492.854199999943,"completedAt":1789528571971,"contextSnapshot":{"promptTokens":55326,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"5a5b91d6","parentId":"4a2761a9","timestamp":"2026-09-16T03:16:11.994Z","message":{"role":"toolResult","toolCallId":"call_K5gWw8wlc0OoP4EfNuDoyuhY|fc_00817a6e65e8f156016aaa09fbd4dc87d18e457d40047ef98d","toolName":"read","content":[{"type":"text","text":"impl BrokerConn {\n…\n\n /// Bounded framed write. See [`Self::write_gated`].\n pub(crate) fn write(&self, env: &Envelope) -> io::Result {\n self.write_gated(env, || true)\n }\n\n /// Bounded framed write with a pre-write gate closure, run AFTER the\n /// serialized gate is acquired and BEFORE any byte is written — the same\n /// serialization point the old epoch-check-under-`send.lock()` had, so a\n /// superseded controller writer still bails atomically with respect to\n /// its successor's writes (P1c, REQ-HAZARD-CONTROLLER-WRITER-REORDER).\n /// `pre` returning false → `Ok(ConnWrite::Superseded)`, nothing written.\n pub(crate) fn write_gated(\n &self,\n env: &Envelope,\n pre: impl FnOnce() -> bool,\n ) -> io::Result {\n let inner = &*self.inner;\n let deadline = Instant::now() + inner.bound;\n\n // ── Acquire the gate, bounded by the SAME absolute deadline. ──\n let mut g = recover(&inner.gate);\n loop {\n if inner.poisoned.load(Ordering::Acquire) {\n return Err(poisoned_err());\n }\n if g.half.is_some() {\n break;\n }\n let now = Instant::now();\n if now >= deadline {\n // The write we queued behind is stuck past OUR whole bound:\n // that op is the wedge. Abort it out of band and fail — the\n // watchdog's own deadline (armed at that op's entry) is also\n // in flight; both paths converge on the same idempotent\n // poison/cancel.\n drop(g);\n inner.timed_out.store(true, Ordering::Release);\n inner.poison_and_cancel(None);\n return Err(timeout_err());\n }\n let (g2, _) = inner\n .gate_cv\n .wait_timeout(g, deadline - now)\n .unwrap_or_else(|p| p.into_inner());\n g = g2;\n }\n\n if !pre() {\n return Ok(ConnWrite::Superseded);\n }\n\n // The gate serializes first-write initialization. Save the instant\n // BEFORE I/O so a later failure still names when this conn went active.\n // [impl->REQ-CONN-HEALTHY-LIFECYCLE-BOUNDED]\n if inner.first_write.get().is_none() {\n let _ = inner.first_write.set(LogTime::now());\n inner.lifecycle_log.healthy(true);\n }\n\n // ── Check out the half + arm the watchdog, then write OUT of locks. ──\n let mut half = g.half.take().expect(\"gate half present at checkout\");\n let op = inner.op_seq.fetch_add(1, Ordering::Relaxed) + 1;\n {\n let mut d = recover(&inner.dog);\n d.inflight = Some((op, deadline));\n inner.dog_cv.notify_all();\n }\n drop(g);\n\n let res = write_frame(&mut half, env);\n\n // Completion handshake: `write_frame` has returned, so the OS op —\n // canceled or not — reported completion and the frame buffer is\n // released. Clear the arm BEFORE deciding health, so the watchdog\n // never severs while the op is formally in flight.\n {\n let mut d = recover(&inner.dog);\n d.inflight = None;\n inner.dog_cv.notify_all();\n }\n\n let mut g = recover(&inner.gate);\n if res.is_ok() && !inner.poisoned.load(Ordering::Acquire) {\n g.half = Some(half);\n drop(g);\n inner.gate_cv.notify_all();\n return Ok(ConnWrite::Done);\n }\n\n // ── Retire: poison the whole conn, abort the read side so\n // `handle_conn` reaches EOF cleanup, sever, and park the half in the\n // graveyard (its handle must outlive any late raw abort; never\n // re-gated, never reused — a timed-out length-prefixed frame may be\n // partially written). ──\n drop(g);\n inner.poison_and_cancel(res.as_ref().err());\n inner.sever();\n *recover(&inner.graveyard) = Some(half);\n inner.gate_cv.notify_all();\n // A DEADLINE retirement (the watchdog aborted OUR op, or the conn was\n // already deadline-poisoned) surfaces as TimedOut — the caller can\n // count the wedge (W2 stall-evict tally). An organic I/O failure\n // (peer death) keeps its own error.\n if inner.timed_out.load(Ordering::Acquire) {\n return Err(timeout_err());\n }\n Err(match res {\n Err(e) => e,\n Ok(()) => poisoned_err(),\n })\n }\n}\n\n/// TEST-ONLY determinism lever: holds the serialized write gate (the half is\n/// checked out) so every writer parks AT THE GATE until the pin drops — the\n/// round-4 analog of pinning the old `Mutex` across a registration\n/// window (the P1c epoch-gate keystone unit relies on it).\n#[cfg(test)]\npub(crate) struct TestGatePin {\n inner: Arc,\n half: Option,\n}\n\n#[cfg(test)]\nimpl Drop for TestGatePin {\n fn drop(&mut self) {\n let mut g = recover(&self.inner.gate);\n g.half = self.half.take();\n drop(g);\n self.inner.gate_cv.notify_all();\n }\n}\n\n#[cfg(test)]\nimpl BrokerConn {\n /// Check the half out of the gate without arming the watchdog — writers\n /// queue behind the gate (bounded by their own deadlines) until the\n /// returned pin drops. Test-only; never a production path.\n pub(crate) fn pin_gate_for_test(&self) -> TestGatePin {\n let mut g = recover(&self.inner.gate);\n let half = g.half.take().expect(\"pin: gate half present\");\n TestGatePin {\n inner: Arc::clone(&self.inner),\n half: Some(half),\n }\n }\n}\n\n[Showing lines 597-741 of 1000. Use :742 to continue]"}],"details":{"truncation":{"content":"\r\n /// Bounded framed write. See [`Self::write_gated`].\r\n pub(crate) fn write(&self, env: &Envelope) -> io::Result {\r\n self.write_gated(env, || true)\r\n }\r\n\r\n /// Bounded framed write with a pre-write gate closure, run AFTER the\r\n /// serialized gate is acquired and BEFORE any byte is written — the same\r\n /// serialization point the old epoch-check-under-`send.lock()` had, so a\r\n /// superseded controller writer still bails atomically with respect to\r\n /// its successor's writes (P1c, REQ-HAZARD-CONTROLLER-WRITER-REORDER).\r\n /// `pre` returning false → `Ok(ConnWrite::Superseded)`, nothing written.\r\n pub(crate) fn write_gated(\r\n &self,\r\n env: &Envelope,\r\n pre: impl FnOnce() -> bool,\r\n ) -> io::Result {\r\n let inner = &*self.inner;\r\n let deadline = Instant::now() + inner.bound;\r\n\r\n // ── Acquire the gate, bounded by the SAME absolute deadline. ──\r\n let mut g = recover(&inner.gate);\r\n loop {\r\n if inner.poisoned.load(Ordering::Acquire) {\r\n return Err(poisoned_err());\r\n }\r\n if g.half.is_some() {\r\n break;\r\n }\r\n let now = Instant::now();\r\n if now >= deadline {\r\n // The write we queued behind is stuck past OUR whole bound:\r\n // that op is the wedge. Abort it out of band and fail — the\r\n // watchdog's own deadline (armed at that op's entry) is also\r\n // in flight; both paths converge on the same idempotent\r\n // poison/cancel.\r\n drop(g);\r\n inner.timed_out.store(true, Ordering::Release);\r\n inner.poison_and_cancel(None);\r\n return Err(timeout_err());\r\n }\r\n let (g2, _) = inner\r\n .gate_cv\r\n .wait_timeout(g, deadline - now)\r\n .unwrap_or_else(|p| p.into_inner());\r\n g = g2;\r\n }\r\n\r\n if !pre() {\r\n return Ok(ConnWrite::Superseded);\r\n }\r\n\r\n // The gate serializes first-write initialization. Save the instant\r\n // BEFORE I/O so a later failure still names when this conn went active.\r\n // [impl->REQ-CONN-HEALTHY-LIFECYCLE-BOUNDED]\r\n if inner.first_write.get().is_none() {\r\n let _ = inner.first_write.set(LogTime::now());\r\n inner.lifecycle_log.healthy(true);\r\n }\r\n\r\n // ── Check out the half + arm the watchdog, then write OUT of locks. ──\r\n let mut half = g.half.take().expect(\"gate half present at checkout\");\r\n let op = inner.op_seq.fetch_add(1, Ordering::Relaxed) + 1;\r\n {\r\n let mut d = recover(&inner.dog);\r\n d.inflight = Some((op, deadline));\r\n inner.dog_cv.notify_all();\r\n }\r\n drop(g);\r\n\r\n let res = write_frame(&mut half, env);\r\n\r\n // Completion handshake: `write_frame` has returned, so the OS op —\r\n // canceled or not — reported completion and the frame buffer is\r\n // released. Clear the arm BEFORE deciding health, so the watchdog\r\n // never severs while the op is formally in flight.\r\n {\r\n let mut d = recover(&inner.dog);\r\n d.inflight = None;\r\n inner.dog_cv.notify_all();\r\n }\r\n\r\n let mut g = recover(&inner.gate);\r\n if res.is_ok() && !inner.poisoned.load(Ordering::Acquire) {\r\n g.half = Some(half);\r\n drop(g);\r\n inner.gate_cv.notify_all();\r\n return Ok(ConnWrite::Done);\r\n }\r\n\r\n // ── Retire: poison the whole conn, abort the read side so\r\n // `handle_conn` reaches EOF cleanup, sever, and park the half in the\r\n // graveyard (its handle must outlive any late raw abort; never\r\n // re-gated, never reused — a timed-out length-prefixed frame may be\r\n // partially written). ──\r\n drop(g);\r\n inner.poison_and_cancel(res.as_ref().err());\r\n inner.sever();\r\n *recover(&inner.graveyard) = Some(half);\r\n inner.gate_cv.notify_all();\r\n // A DEADLINE retirement (the watchdog aborted OUR op, or the conn was\r\n // already deadline-poisoned) surfaces as TimedOut — the caller can\r\n // count the wedge (W2 stall-evict tally). An organic I/O failure\r\n // (peer death) keeps its own error.\r\n if inner.timed_out.load(Ordering::Acquire) {\r\n return Err(timeout_err());\r\n }\r\n Err(match res {\r\n Err(e) => e,\r\n Ok(()) => poisoned_err(),\r\n })\r\n }\r\n}\r\n\r\n/// TEST-ONLY determinism lever: holds the serialized write gate (the half is\r\n/// checked out) so every writer parks AT THE GATE until the pin drops — the\r\n/// round-4 analog of pinning the old `Mutex` across a registration\r\n/// window (the P1c epoch-gate keystone unit relies on it).\r\n#[cfg(test)]\r\npub(crate) struct TestGatePin {\r\n inner: Arc,\r\n half: Option,\r\n}\r\n\r\n#[cfg(test)]\r\nimpl Drop for TestGatePin {\r\n fn drop(&mut self) {\r\n let mut g = recover(&self.inner.gate);\r\n g.half = self.half.take();\r\n drop(g);\r\n self.inner.gate_cv.notify_all();\r\n }\r\n}\r\n\r\n#[cfg(test)]\r\nimpl BrokerConn {\r\n /// Check the half out of the gate without arming the watchdog — writers\r\n /// queue behind the gate (bounded by their own deadlines) until the\r\n /// returned pin drops. Test-only; never a production path.\r\n pub(crate) fn pin_gate_for_test(&self) -> TestGatePin {\r\n let mut g = recover(&self.inner.gate);\r\n let half = g.half.take().expect(\"pin: gate half present\");\r\n TestGatePin {\r\n inner: Arc::clone(&self.inner),\r\n half: Some(half),\r","truncated":true,"truncatedBy":"lines","totalLines":404,"totalBytes":5842,"outputLines":145,"outputBytes":5842,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1000,"displayContent":{"text":"impl BrokerConn {\n…\n\r\n /// Bounded framed write. See [`Self::write_gated`].\r\n pub(crate) fn write(&self, env: &Envelope) -> io::Result {\r\n self.write_gated(env, || true)\r\n }\r\n\r\n /// Bounded framed write with a pre-write gate closure, run AFTER the\r\n /// serialized gate is acquired and BEFORE any byte is written — the same\r\n /// serialization point the old epoch-check-under-`send.lock()` had, so a\r\n /// superseded controller writer still bails atomically with respect to\r\n /// its successor's writes (P1c, REQ-HAZARD-CONTROLLER-WRITER-REORDER).\r\n /// `pre` returning false → `Ok(ConnWrite::Superseded)`, nothing written.\r\n pub(crate) fn write_gated(\r\n &self,\r\n env: &Envelope,\r\n pre: impl FnOnce() -> bool,\r\n ) -> io::Result {\r\n let inner = &*self.inner;\r\n let deadline = Instant::now() + inner.bound;\r\n\r\n // ── Acquire the gate, bounded by the SAME absolute deadline. ──\r\n let mut g = recover(&inner.gate);\r\n loop {\r\n if inner.poisoned.load(Ordering::Acquire) {\r\n return Err(poisoned_err());\r\n }\r\n if g.half.is_some() {\r\n break;\r\n }\r\n let now = Instant::now();\r\n if now >= deadline {\r\n // The write we queued behind is stuck past OUR whole bound:\r\n // that op is the wedge. Abort it out of band and fail — the\r\n // watchdog's own deadline (armed at that op's entry) is also\r\n // in flight; both paths converge on the same idempotent\r\n // poison/cancel.\r\n drop(g);\r\n inner.timed_out.store(true, Ordering::Release);\r\n inner.poison_and_cancel(None);\r\n return Err(timeout_err());\r\n }\r\n let (g2, _) = inner\r\n .gate_cv\r\n .wait_timeout(g, deadline - now)\r\n .unwrap_or_else(|p| p.into_inner());\r\n g = g2;\r\n }\r\n\r\n if !pre() {\r\n return Ok(ConnWrite::Superseded);\r\n }\r\n\r\n // The gate serializes first-write initialization. Save the instant\r\n // BEFORE I/O so a later failure still names when this conn went active.\r\n // [impl->REQ-CONN-HEALTHY-LIFECYCLE-BOUNDED]\r\n if inner.first_write.get().is_none() {\r\n let _ = inner.first_write.set(LogTime::now());\r\n inner.lifecycle_log.healthy(true);\r\n }\r\n\r\n // ── Check out the half + arm the watchdog, then write OUT of locks. ──\r\n let mut half = g.half.take().expect(\"gate half present at checkout\");\r\n let op = inner.op_seq.fetch_add(1, Ordering::Relaxed) + 1;\r\n {\r\n let mut d = recover(&inner.dog);\r\n d.inflight = Some((op, deadline));\r\n inner.dog_cv.notify_all();\r\n }\r\n drop(g);\r\n\r\n let res = write_frame(&mut half, env);\r\n\r\n // Completion handshake: `write_frame` has returned, so the OS op —\r\n // canceled or not — reported completion and the frame buffer is\r\n // released. Clear the arm BEFORE deciding health, so the watchdog\r\n // never severs while the op is formally in flight.\r\n {\r\n let mut d = recover(&inner.dog);\r\n d.inflight = None;\r\n inner.dog_cv.notify_all();\r\n }\r\n\r\n let mut g = recover(&inner.gate);\r\n if res.is_ok() && !inner.poisoned.load(Ordering::Acquire) {\r\n g.half = Some(half);\r\n drop(g);\r\n inner.gate_cv.notify_all();\r\n return Ok(ConnWrite::Done);\r\n }\r\n\r\n // ── Retire: poison the whole conn, abort the read side so\r\n // `handle_conn` reaches EOF cleanup, sever, and park the half in the\r\n // graveyard (its handle must outlive any late raw abort; never\r\n // re-gated, never reused — a timed-out length-prefixed frame may be\r\n // partially written). ──\r\n drop(g);\r\n inner.poison_and_cancel(res.as_ref().err());\r\n inner.sever();\r\n *recover(&inner.graveyard) = Some(half);\r\n inner.gate_cv.notify_all();\r\n // A DEADLINE retirement (the watchdog aborted OUR op, or the conn was\r\n // already deadline-poisoned) surfaces as TimedOut — the caller can\r\n // count the wedge (W2 stall-evict tally). An organic I/O failure\r\n // (peer death) keeps its own error.\r\n if inner.timed_out.load(Ordering::Acquire) {\r\n return Err(timeout_err());\r\n }\r\n Err(match res {\r\n Err(e) => e,\r\n Ok(()) => poisoned_err(),\r\n })\r\n }\r\n}\r\n\r\n/// TEST-ONLY determinism lever: holds the serialized write gate (the half is\r\n/// checked out) so every writer parks AT THE GATE until the pin drops — the\r\n/// round-4 analog of pinning the old `Mutex` across a registration\r\n/// window (the P1c epoch-gate keystone unit relies on it).\r\n#[cfg(test)]\r\npub(crate) struct TestGatePin {\r\n inner: Arc,\r\n half: Option,\r\n}\r\n\r\n#[cfg(test)]\r\nimpl Drop for TestGatePin {\r\n fn drop(&mut self) {\r\n let mut g = recover(&self.inner.gate);\r\n g.half = self.half.take();\r\n drop(g);\r\n self.inner.gate_cv.notify_all();\r\n }\r\n}\r\n\r\n#[cfg(test)]\r\nimpl BrokerConn {\r\n /// Check the half out of the gate without arming the watchdog — writers\r\n /// queue behind the gate (bounded by their own deadlines) until the\r\n /// returned pin drops. Test-only; never a production path.\r\n pub(crate) fn pin_gate_for_test(&self) -> TestGatePin {\r\n let mut g = recover(&self.inner.gate);\r\n let half = g.half.take().expect(\"pin: gate half present\");\r\n TestGatePin {\r\n inner: Arc::clone(&self.inner),\r\n half: Some(half),\r\n }\n }\n}","startLine":523,"lineNumbers":[523,null,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744]},"fileSize":43321,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\conn.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1000,"totalBytes":5842,"outputLines":145,"outputBytes":5842,"shownRange":{"start":597,"end":741},"nextOffset":742}}},"isError":false,"timestamp":1789528571993}}
{"type":"message","id":"adc40753","parentId":"5a5b91d6","timestamp":"2026-09-16T03:16:11.999Z","message":{"role":"toolResult","toolCallId":"call_zJNdhV4aOZBfL7gzMDrbuSUw|fc_00817a6e65e8f156016aaa09fbd4e887d18e6237aa60cd5c19","toolName":"read","content":[{"type":"text","text":"#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\nfn controller_writer(\n sid: u64,\n send: SharedSend,\n initial: Vec<(u64, Vec)>,\n // Whether `initial` is a synthesized repaint batch (rides the wire-flag —\n // the consumer baselines its pseudo-seq jump) vs a raw ring slice\n // (unflagged, contiguous). REQ-RC-RESIZE-PRESENTATION-BARRIER.\n initial_sync: bool,\n rx: Receiver,\n delivered_through: Arc,\n epoch: u64,\n controller_epoch: Arc,\n write_blocked_since: Arc>>,\n // The ADR-0044 revoke marker (see [`ControllerSink::revoked_by`]): when a\n // distinct-lease Take set it, this writer's EXIT emits the terminal\n // Displaced as its final frame.\n revoked_by: Arc>>,\n) {\n // W2 decouple (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): mark the exact window a\n // BLOCKING socket write is in flight, so a reader can tell a WEDGED writer (brain\n // conn suspended) from a merely idle one and stall-evict it. Set BEFORE the write,\n // cleared AFTER — the mutex is never held across `write_frame` (that would just\n // move the wedge onto the mutex).\n let mark_blocked = |on: bool| {\n if let Ok(mut g) = write_blocked_since.lock() {\n *g = if on { Some(Instant::now()) } else { None };\n }\n };\n // Terminal-revoke duty (ADR-0044 decision 2, REQ-CONTROLLER-LEASE-IDENTITY):\n // on a revoked exit, the writer's LAST act is the bounded Displaced write —\n // behind everything it already committed (order preserved), independent of\n // the live queue's fullness. A write the conn cannot take retires it via\n // the per-write watchdog (poison + sever) — the closed conn ends the serve\n // worker, which is the same terminal signal for the incumbent's rc. Silent\n // (same-lease) replacements never set the marker, so gate-#7 stays silent.\n let emit_revoke_if_marked = |send: &SharedSend| {\n let by = revoked_by.lock().ok().and_then(|mut g| g.take());\n if let Some(by) = by {\n let _ = send.write(&displaced_envelope(sid, &by));\n send.lifecycle_event(\n \"writer-exit\",\n &format!(\"role=controller session={sid} reason=lease-revoked taken_by={by}\"),\n );\n return true;\n }\n false\n };\n for (seq, bytes) in &initial {\n let frame = if initial_sync {\n sync_output_envelope(sid, *seq, bytes)\n } else {\n output_envelope(sid, *seq, bytes)\n };\n // P1c: a SUPERSEDED writer (a newer `become_controller` bumped the shared\n // epoch past ours) must write NOTHING further — otherwise its owned\n // initial batch races the new writer on the same socket and reorders the\n // seq stream. The gate closure runs AFTER the conn's serialized write\n // gate is acquired and BEFORE any byte is written — the same\n // serialization point the old epoch-check-under-`send.lock()` had: both\n // writers serialize on the one conn gate, and `become_controller` bumps\n // the epoch BEFORE spawning the new writer, so whichever superseded\n // writer next holds the gate observes the bump and bails before\n // committing — no check-then-block-then-write window. (A frame the\n // stale writer committed BEFORE the bump is irreducible at the broker;\n // fix #1 removes the contradictory double-take that produced it.)\n // Round-4: the write itself is bounded + cancelable — a non-draining\n // consumer poisons + retires the physical conn at the deadline instead\n // of wedging this thread in the OS write forever.\n // [impl->REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]\n mark_blocked(true);\n let outcome =\n send.write_gated(&frame, || controller_epoch.load(Ordering::Acquire) == epoch);\n mark_blocked(false);\n match outcome {\n Ok(ConnWrite::Done) => {}\n Ok(ConnWrite::Superseded) => {\n // A revoked writer superseded mid-initial-batch still owes the\n // terminal Displaced (ADR-0044). [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n if emit_revoke_if_marked(&send) {\n return;\n }\n // Bounded writer-exit record (F-039 leg d).\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\n send.lifecycle_event(\n \"writer-exit\",\n &format!(\"role=controller session={sid} reason=superseded\"),\n );\n…\n }\n…\n }\n…\n }\n…\n}\n\n[Showing lines 3954-4041 of 16852. Use :4042 to continue]"}],"details":{"truncation":{"content":"#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\r\nfn controller_writer(\r\n sid: u64,\r\n send: SharedSend,\r\n initial: Vec<(u64, Vec)>,\r\n // Whether `initial` is a synthesized repaint batch (rides the wire-flag —\r\n // the consumer baselines its pseudo-seq jump) vs a raw ring slice\r\n // (unflagged, contiguous). REQ-RC-RESIZE-PRESENTATION-BARRIER.\r\n initial_sync: bool,\r\n rx: Receiver,\r\n delivered_through: Arc,\r\n epoch: u64,\r\n controller_epoch: Arc,\r\n write_blocked_since: Arc>>,\r\n // The ADR-0044 revoke marker (see [`ControllerSink::revoked_by`]): when a\r\n // distinct-lease Take set it, this writer's EXIT emits the terminal\r\n // Displaced as its final frame.\r\n revoked_by: Arc>>,\r\n) {\r\n // W2 decouple (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): mark the exact window a\r\n // BLOCKING socket write is in flight, so a reader can tell a WEDGED writer (brain\r\n // conn suspended) from a merely idle one and stall-evict it. Set BEFORE the write,\r\n // cleared AFTER — the mutex is never held across `write_frame` (that would just\r\n // move the wedge onto the mutex).\r\n let mark_blocked = |on: bool| {\r\n if let Ok(mut g) = write_blocked_since.lock() {\r\n *g = if on { Some(Instant::now()) } else { None };\r\n }\r\n };\r\n // Terminal-revoke duty (ADR-0044 decision 2, REQ-CONTROLLER-LEASE-IDENTITY):\r\n // on a revoked exit, the writer's LAST act is the bounded Displaced write —\r\n // behind everything it already committed (order preserved), independent of\r\n // the live queue's fullness. A write the conn cannot take retires it via\r\n // the per-write watchdog (poison + sever) — the closed conn ends the serve\r\n // worker, which is the same terminal signal for the incumbent's rc. Silent\r\n // (same-lease) replacements never set the marker, so gate-#7 stays silent.\r\n let emit_revoke_if_marked = |send: &SharedSend| {\r\n let by = revoked_by.lock().ok().and_then(|mut g| g.take());\r\n if let Some(by) = by {\r\n let _ = send.write(&displaced_envelope(sid, &by));\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=lease-revoked taken_by={by}\"),\r\n );\r\n return true;\r\n }\r\n false\r\n };\r\n for (seq, bytes) in &initial {\r\n let frame = if initial_sync {\r\n sync_output_envelope(sid, *seq, bytes)\r\n } else {\r\n output_envelope(sid, *seq, bytes)\r\n };\r\n // P1c: a SUPERSEDED writer (a newer `become_controller` bumped the shared\r\n // epoch past ours) must write NOTHING further — otherwise its owned\r\n // initial batch races the new writer on the same socket and reorders the\r\n // seq stream. The gate closure runs AFTER the conn's serialized write\r\n // gate is acquired and BEFORE any byte is written — the same\r\n // serialization point the old epoch-check-under-`send.lock()` had: both\r\n // writers serialize on the one conn gate, and `become_controller` bumps\r\n // the epoch BEFORE spawning the new writer, so whichever superseded\r\n // writer next holds the gate observes the bump and bails before\r\n // committing — no check-then-block-then-write window. (A frame the\r\n // stale writer committed BEFORE the bump is irreducible at the broker;\r\n // fix #1 removes the contradictory double-take that produced it.)\r\n // Round-4: the write itself is bounded + cancelable — a non-draining\r\n // consumer poisons + retires the physical conn at the deadline instead\r\n // of wedging this thread in the OS write forever.\r\n // [impl->REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]\r\n mark_blocked(true);\r\n let outcome =\r\n send.write_gated(&frame, || controller_epoch.load(Ordering::Acquire) == epoch);\r\n mark_blocked(false);\r\n match outcome {\r\n Ok(ConnWrite::Done) => {}\r\n Ok(ConnWrite::Superseded) => {\r\n // A revoked writer superseded mid-initial-batch still owes the\r\n // terminal Displaced (ADR-0044). [impl->REQ-CONTROLLER-LEASE-IDENTITY]\r\n if emit_revoke_if_marked(&send) {\r\n return;\r\n }\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=superseded\"),\r\n );\r","truncated":true,"truncatedBy":"lines","totalLines":12899,"totalBytes":4804,"outputLines":88,"outputBytes":4804,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":16852,"displayContent":{"text":"#[allow(clippy::too_many_arguments)] // per-writer thread-handoff channels (W2 added the blocked-since signal); a struct would obscure the call\r\nfn controller_writer(\r\n sid: u64,\r\n send: SharedSend,\r\n initial: Vec<(u64, Vec)>,\r\n // Whether `initial` is a synthesized repaint batch (rides the wire-flag —\r\n // the consumer baselines its pseudo-seq jump) vs a raw ring slice\r\n // (unflagged, contiguous). REQ-RC-RESIZE-PRESENTATION-BARRIER.\r\n initial_sync: bool,\r\n rx: Receiver,\r\n delivered_through: Arc,\r\n epoch: u64,\r\n controller_epoch: Arc,\r\n write_blocked_since: Arc>>,\r\n // The ADR-0044 revoke marker (see [`ControllerSink::revoked_by`]): when a\r\n // distinct-lease Take set it, this writer's EXIT emits the terminal\r\n // Displaced as its final frame.\r\n revoked_by: Arc>>,\r\n) {\r\n // W2 decouple (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE): mark the exact window a\r\n // BLOCKING socket write is in flight, so a reader can tell a WEDGED writer (brain\r\n // conn suspended) from a merely idle one and stall-evict it. Set BEFORE the write,\r\n // cleared AFTER — the mutex is never held across `write_frame` (that would just\r\n // move the wedge onto the mutex).\r\n let mark_blocked = |on: bool| {\r\n if let Ok(mut g) = write_blocked_since.lock() {\r\n *g = if on { Some(Instant::now()) } else { None };\r\n }\r\n };\r\n // Terminal-revoke duty (ADR-0044 decision 2, REQ-CONTROLLER-LEASE-IDENTITY):\r\n // on a revoked exit, the writer's LAST act is the bounded Displaced write —\r\n // behind everything it already committed (order preserved), independent of\r\n // the live queue's fullness. A write the conn cannot take retires it via\r\n // the per-write watchdog (poison + sever) — the closed conn ends the serve\r\n // worker, which is the same terminal signal for the incumbent's rc. Silent\r\n // (same-lease) replacements never set the marker, so gate-#7 stays silent.\r\n let emit_revoke_if_marked = |send: &SharedSend| {\r\n let by = revoked_by.lock().ok().and_then(|mut g| g.take());\r\n if let Some(by) = by {\r\n let _ = send.write(&displaced_envelope(sid, &by));\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=lease-revoked taken_by={by}\"),\r\n );\r\n return true;\r\n }\r\n false\r\n };\r\n for (seq, bytes) in &initial {\r\n let frame = if initial_sync {\r\n sync_output_envelope(sid, *seq, bytes)\r\n } else {\r\n output_envelope(sid, *seq, bytes)\r\n };\r\n // P1c: a SUPERSEDED writer (a newer `become_controller` bumped the shared\r\n // epoch past ours) must write NOTHING further — otherwise its owned\r\n // initial batch races the new writer on the same socket and reorders the\r\n // seq stream. The gate closure runs AFTER the conn's serialized write\r\n // gate is acquired and BEFORE any byte is written — the same\r\n // serialization point the old epoch-check-under-`send.lock()` had: both\r\n // writers serialize on the one conn gate, and `become_controller` bumps\r\n // the epoch BEFORE spawning the new writer, so whichever superseded\r\n // writer next holds the gate observes the bump and bails before\r\n // committing — no check-then-block-then-write window. (A frame the\r\n // stale writer committed BEFORE the bump is irreducible at the broker;\r\n // fix #1 removes the contradictory double-take that produced it.)\r\n // Round-4: the write itself is bounded + cancelable — a non-draining\r\n // consumer poisons + retires the physical conn at the deadline instead\r\n // of wedging this thread in the OS write forever.\r\n // [impl->REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]\r\n mark_blocked(true);\r\n let outcome =\r\n send.write_gated(&frame, || controller_epoch.load(Ordering::Acquire) == epoch);\r\n mark_blocked(false);\r\n match outcome {\r\n Ok(ConnWrite::Done) => {}\r\n Ok(ConnWrite::Superseded) => {\r\n // A revoked writer superseded mid-initial-batch still owes the\r\n // terminal Displaced (ADR-0044). [impl->REQ-CONTROLLER-LEASE-IDENTITY]\r\n if emit_revoke_if_marked(&send) {\r\n return;\r\n }\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=superseded\"),\r\n );\r\n…\n }\n…\n }\n…\n }\n…\n}","startLine":3954,"lineNumbers":[3954,3955,3956,3957,3958,3959,3960,3961,3962,3963,3964,3965,3966,3967,3968,3969,3970,3971,3972,3973,3974,3975,3976,3977,3978,3979,3980,3981,3982,3983,3984,3985,3986,3987,3988,3989,3990,3991,3992,3993,3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004,4005,4006,4007,4008,4009,4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,4024,4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040,4041,null,4043,null,4052,null,4054,null,4128]},"fileSize":877537,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\broker.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":16852,"totalBytes":4804,"outputLines":88,"outputBytes":4804,"shownRange":{"start":3954,"end":4041},"nextOffset":4042}}},"isError":false,"timestamp":1789528571999}}
{"type":"message","id":"049ed76a","parentId":"adc40753","timestamp":"2026-09-16T03:16:12.017Z","message":{"role":"toolResult","toolCallId":"call_Loojvp74fC5m0peRZXoDU3x8|fc_00817a6e65e8f156016aaa09fbd4cc87d1b15b5bcddb8f0343","toolName":"read","content":[{"type":"text","text":" pub fn send_stream(&self, stream_id: u64, bytes: &[u8], finish: bool) -> io::Result<()> {\n let entry = {\n let streams = self.shared.streams.lock().unwrap();\n Arc::clone(streams.get(&stream_id).ok_or_else(|| {\n io::Error::new(\n io::ErrorKind::NotFound,\n format!(\"no such stream {stream_id}\"),\n )\n })?)\n };\n // Serve-lease gate (ADR-0038 Amendment fix 4): a stream whose\n // subscriber POISONED has its lease canceled — refusing the send here\n // is what terminates the paired serve/wire worker at its next\n // forward instead of leaving an orphan forwarding leg running.\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n if entry.log.lock().unwrap().lease.is_canceled() {\n return Err(io::Error::other(format!(\n \"stream {stream_id} lease canceled (subscriber poisoned) — serve leg terminated\"\n )));\n }\n let bytes = bytes.to_vec();\n // Bounded (REQ-HAZARD-BROKER-QUIC-DEADLINE): `write_all` / `finish` on a\n // black-holed QUIC stream blocks on flow-control the dead peer never grants.\n // Loopback (in-process) never hangs, so the bound is a no-op for it.\n self.bounded_block_on(async move {\n let mut send = entry.send.lock().await;\n if !bytes.is_empty() {\n send.write_all(&bytes).await?;\n }\n if finish {\n send.finish().await?;\n }\n Ok(())\n })\n }\n\n /// A stream's serve lease (ADR-0038 Amendment fix 4) — the cancellation\n /// handle the DAEMON-LIFECYCLE C2 work consumes. `None` = no such stream.\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n pub fn stream_lease(&self, stream_id: u64) -> Option> {\n let streams = self.shared.streams.lock().unwrap();\n streams\n .get(&stream_id)\n .map(|e| Arc::clone(&e.log.lock().unwrap().lease))\n }\n\n /// Every held stream's info — the query a re-attaching brain uses to find\n /// streams (including peer-initiated ones that arrived while it was down).\n /// Retired rows are hidden (ADR-0038 A): their exchange is over, and this\n /// enumeration is exactly what a future dispatcher generation would replay.\n pub fn stream_infos(&self) -> Vec {\n self.stream_infos_filtered(true)\n }\n\n /// The DISPATCH enumeration (ADR-0040 decision 2,\n /// REQ-STREAM-INFOS-SERVER-FILTER): `stream_infos` with\n /// `initiated_locally` rows excluded SERVER-SIDE, before any clone or\n /// serialization — the wire (`net-streams`) serves this, so the\n /// dispatcher's every-100ms poll never pays O(local history) IPC merely\n /// to skip its own node's rows client-side. The dispatcher keeps its\n /// client-side guard (double-filter harmless, N-1 compatible both ways).\n /// In-process introspection (tests, the loopback-pair diff) keeps the\n /// unfiltered [`Self::stream_infos`].\n // [impl->REQ-STREAM-INFOS-SERVER-FILTER]\n pub fn dispatch_stream_infos(&self) -> Vec {\n self.stream_infos_filtered(false)\n }\n\n fn stream_infos_filtered(&self, include_local: bool) -> Vec {\n let streams = self.shared.streams.lock().unwrap();\n streams\n .iter()\n .filter(|(_, e)| !e.retired.load(std::sync::atomic::Ordering::SeqCst))\n .filter(|(_, e)| include_local || !e.initiated_locally)\n .map(|(id, e)| {\n…\n })\n .collect()\n }\n…\n pub(crate) fn subscribe_stream(\n &self,\n stream_id: u64,\n sub: SharedSend,\n from_seq: u64,\n ) -> io::Result<()> {\n let log = {\n let streams = self.shared.streams.lock().unwrap();\n let e = streams.get(&stream_id).ok_or_else(|| {\n io::Error::new(\n io::ErrorKind::NotFound,\n format!(\"no such stream {stream_id}\"),\n )\n })?;\n Arc::clone(&e.log)\n };\n // Install the seat WITH its replay snapshot in one atomic critical\n // section (ADR-0038 Amendment fix 3, gate follow-up): the snapshot\n // handoff is a memory move; the seat's writer thread performs every\n // conn write outside the mutex, replay first, live after — so a\n // producer appending concurrently can never slot a live frame into\n // the middle of the replay (the \"got seq 134 want 6\" re-serve red).\n // A replay write failure poisons the seat writer-side; the next\n // producer enqueue halt-and-removes it (the T1 discipline).\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n log.lock().unwrap().begin_attach(Arc::clone(&sub), from_seq)?;\n Ok(())\n }\n\n /// Explicitly release `sub`'s subscriber seat on a stream (ADR-0040\n /// decision 5, REQ-SEAT-LIFETIME-BOUNDED — the `net-stream-unsubscribe`\n /// verb's engine): identity-checked take under the log lock (a caller can\n /// only release its OWN seat, never a newer subscriber's — the detach_if\n /// discipline), then the seat's writer thread is stopped AND JOINED\n /// outside every lock. Idempotent; `false` = no seat / someone else's\n /// seat / no such stream (all tolerated).\n // [impl->REQ-SEAT-LIFETIME-BOUNDED]\n pub(crate) fn unsubscribe_stream(&self, stream_id: u64, sub: &SharedSend) -> bool {\n let log = {\n let streams = self.shared.streams.lock().unwrap();\n streams.get(&stream_id).map(|e| Arc::clone(&e.log))\n };\n let Some(log) = log else {\n return false;\n };\n let seat = log.lock().unwrap().take_seat_if(sub);\n match seat {\n Some(seat) => {\n…\n }\n…\n }\n }"}],"details":{"displayContent":{"text":" pub fn send_stream(&self, stream_id: u64, bytes: &[u8], finish: bool) -> io::Result<()> {\n let entry = {\n let streams = self.shared.streams.lock().unwrap();\n Arc::clone(streams.get(&stream_id).ok_or_else(|| {\n io::Error::new(\n io::ErrorKind::NotFound,\n format!(\"no such stream {stream_id}\"),\n )\n })?)\n };\n // Serve-lease gate (ADR-0038 Amendment fix 4): a stream whose\n // subscriber POISONED has its lease canceled — refusing the send here\n // is what terminates the paired serve/wire worker at its next\n // forward instead of leaving an orphan forwarding leg running.\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n if entry.log.lock().unwrap().lease.is_canceled() {\n return Err(io::Error::other(format!(\n \"stream {stream_id} lease canceled (subscriber poisoned) — serve leg terminated\"\n )));\n }\n let bytes = bytes.to_vec();\n // Bounded (REQ-HAZARD-BROKER-QUIC-DEADLINE): `write_all` / `finish` on a\n // black-holed QUIC stream blocks on flow-control the dead peer never grants.\n // Loopback (in-process) never hangs, so the bound is a no-op for it.\n self.bounded_block_on(async move {\n let mut send = entry.send.lock().await;\n if !bytes.is_empty() {\n send.write_all(&bytes).await?;\n }\n if finish {\n send.finish().await?;\n }\n Ok(())\n })\n }\n\n /// A stream's serve lease (ADR-0038 Amendment fix 4) — the cancellation\n /// handle the DAEMON-LIFECYCLE C2 work consumes. `None` = no such stream.\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n pub fn stream_lease(&self, stream_id: u64) -> Option> {\n let streams = self.shared.streams.lock().unwrap();\n streams\n .get(&stream_id)\n .map(|e| Arc::clone(&e.log.lock().unwrap().lease))\n }\n\n /// Every held stream's info — the query a re-attaching brain uses to find\n /// streams (including peer-initiated ones that arrived while it was down).\n /// Retired rows are hidden (ADR-0038 A): their exchange is over, and this\n /// enumeration is exactly what a future dispatcher generation would replay.\n pub fn stream_infos(&self) -> Vec {\n self.stream_infos_filtered(true)\n }\n\n /// The DISPATCH enumeration (ADR-0040 decision 2,\n /// REQ-STREAM-INFOS-SERVER-FILTER): `stream_infos` with\n /// `initiated_locally` rows excluded SERVER-SIDE, before any clone or\n /// serialization — the wire (`net-streams`) serves this, so the\n /// dispatcher's every-100ms poll never pays O(local history) IPC merely\n /// to skip its own node's rows client-side. The dispatcher keeps its\n /// client-side guard (double-filter harmless, N-1 compatible both ways).\n /// In-process introspection (tests, the loopback-pair diff) keeps the\n /// unfiltered [`Self::stream_infos`].\n // [impl->REQ-STREAM-INFOS-SERVER-FILTER]\n pub fn dispatch_stream_infos(&self) -> Vec {\n self.stream_infos_filtered(false)\n }\n\n fn stream_infos_filtered(&self, include_local: bool) -> Vec {\n let streams = self.shared.streams.lock().unwrap();\n streams\n .iter()\n .filter(|(_, e)| !e.retired.load(std::sync::atomic::Ordering::SeqCst))\n .filter(|(_, e)| include_local || !e.initiated_locally)\n .map(|(id, e)| {\n…\n })\n .collect()\n }\n…\n pub(crate) fn subscribe_stream(\n &self,\n stream_id: u64,\n sub: SharedSend,\n from_seq: u64,\n ) -> io::Result<()> {\n let log = {\n let streams = self.shared.streams.lock().unwrap();\n let e = streams.get(&stream_id).ok_or_else(|| {\n io::Error::new(\n io::ErrorKind::NotFound,\n format!(\"no such stream {stream_id}\"),\n )\n })?;\n Arc::clone(&e.log)\n };\n // Install the seat WITH its replay snapshot in one atomic critical\n // section (ADR-0038 Amendment fix 3, gate follow-up): the snapshot\n // handoff is a memory move; the seat's writer thread performs every\n // conn write outside the mutex, replay first, live after — so a\n // producer appending concurrently can never slot a live frame into\n // the middle of the replay (the \"got seq 134 want 6\" re-serve red).\n // A replay write failure poisons the seat writer-side; the next\n // producer enqueue halt-and-removes it (the T1 discipline).\n // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n log.lock().unwrap().begin_attach(Arc::clone(&sub), from_seq)?;\n Ok(())\n }\n\n /// Explicitly release `sub`'s subscriber seat on a stream (ADR-0040\n /// decision 5, REQ-SEAT-LIFETIME-BOUNDED — the `net-stream-unsubscribe`\n /// verb's engine): identity-checked take under the log lock (a caller can\n /// only release its OWN seat, never a newer subscriber's — the detach_if\n /// discipline), then the seat's writer thread is stopped AND JOINED\n /// outside every lock. Idempotent; `false` = no seat / someone else's\n /// seat / no such stream (all tolerated).\n // [impl->REQ-SEAT-LIFETIME-BOUNDED]\n pub(crate) fn unsubscribe_stream(&self, stream_id: u64, sub: &SharedSend) -> bool {\n let log = {\n let streams = self.shared.streams.lock().unwrap();\n streams.get(&stream_id).map(|e| Arc::clone(&e.log))\n };\n let Some(log) = log else {\n return false;\n };\n let seat = log.lock().unwrap().take_seat_if(sub);\n match seat {\n Some(seat) => {\n…\n }\n…\n }\n }","startLine":1888,"lineNumbers":[1888,1889,1890,1891,1892,1893,1894,1895,1896,1897,1898,1899,1900,1901,1902,1903,1904,1905,1906,1907,1908,1909,1910,1911,1912,1913,1914,1915,1916,1917,1918,1919,1920,1921,1922,1923,1924,1925,1926,1927,1928,1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940,1941,1942,1943,1944,1945,1946,1947,1948,1949,1950,1951,1952,1953,1954,1955,1956,1957,1958,1959,1960,1961,1962,null,1974,1975,1976,null,2163,2164,2165,2166,2167,2168,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2181,2182,2183,2184,2185,2186,2187,2188,2189,2190,2191,2192,2193,2194,2195,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,2210,null,2214,null,2216,2217]},"fileSize":160950,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\nethost.rs"}}},"isError":false,"timestamp":1789528572017}}
{"type":"message","id":"669304fc","parentId":"049ed76a","timestamp":"2026-09-16T03:16:12.077Z","message":{"role":"toolResult","toolCallId":"call_tOZjPcxjAlAumHonHFZR2h2s|fc_00817a6e65e8f156016aaa09fbd4ec87d180830f4a554e0f9e","toolName":"grep","content":[{"type":"text","text":"# .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/\n## msg.rs\n 603|#[derive(Debug, Clone, Serialize, Deserialize)]\n*604|pub struct SubscribeReq {\n 605| /// Target session.\n 606| pub session_id: u64,\n 607| /// Lowest output sequence the subscriber still needs (replay floor).\n...\n 675|#[derive(Debug, Clone, Serialize, Deserialize)]\n*676|pub struct SubscribedReply {\n 677| /// The session the subscribe targeted.\n 678| pub session_id: u64,\n 679| /// The resolved role.\n...\n 747|#[derive(Debug, Clone, Serialize, Deserialize)]\n*748|pub struct InputReq {\n 749| /// Target session.\n 750| pub session_id: u64,\n 751| /// The raw input bytes, base64-encoded.\n...\n 859|#[derive(Debug, Clone, Serialize, Deserialize)]\n*860|pub struct AppliedEvent {\n 861| /// The session the effect targeted.\n 862| pub session_id: u64,\n 863| /// The durable op id of the effect.\n## brain.rs\n 1223| }\n*1224| KIND_SUBSCRIBED => {\n 1225| let ev: SubscribedReply = serde_json::from_value(env.payload)\n 1226| .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 1227| return Ok(BrokerEvent::Subscribed {\n## codec.rs\n 21|/// Serialize and write one [`Envelope`] as a length-prefixed JSON frame.\n*22|pub fn write_frame(w: &mut W, env: &Envelope) -> io::Result<()> {\n 23| let body =\n 24| serde_json::to_vec(env).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 25| if body.len() > MAX_FRAME_BYTES {"}],"details":{"scopePath":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs, .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs, .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":6,"fileCount":3,"files":[".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs",".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs",".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs"],"fileMatches":[{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs","count":4},{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs","count":1},{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs","count":1}],"truncated":false,"displayContent":"# .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/\n## msg.rs\n 603│#[derive(Debug, Clone, Serialize, Deserialize)]\n*604│pub struct SubscribeReq {\n 605│ /// Target session.\n 606│ pub session_id: u64,\n 607│ /// Lowest output sequence the subscriber still needs (replay floor).\n │...\n 675│#[derive(Debug, Clone, Serialize, Deserialize)]\n*676│pub struct SubscribedReply {\n 677│ /// The session the subscribe targeted.\n 678│ pub session_id: u64,\n 679│ /// The resolved role.\n │...\n 747│#[derive(Debug, Clone, Serialize, Deserialize)]\n*748│pub struct InputReq {\n 749│ /// Target session.\n 750│ pub session_id: u64,\n 751│ /// The raw input bytes, base64-encoded.\n │...\n 859│#[derive(Debug, Clone, Serialize, Deserialize)]\n*860│pub struct AppliedEvent {\n 861│ /// The session the effect targeted.\n 862│ pub session_id: u64,\n 863│ /// The durable op id of the effect.\n## brain.rs\n 1223│ }\n*1224│ KIND_SUBSCRIBED => {\n 1225│ let ev: SubscribedReply = serde_json::from_value(env.payload)\n 1226│ .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 1227│ return Ok(BrokerEvent::Subscribed {\n## codec.rs\n 21│/// Serialize and write one [`Envelope`] as a length-prefixed JSON frame.\n*22│pub fn write_frame(w: &mut W, env: &Envelope) -> io::Result<()> {\n 23│ let body =\n 24│ serde_json::to_vec(env).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n 25│ if body.len() > MAX_FRAME_BYTES {"},"isError":false,"timestamp":1789528572075}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_i9f8N8bO77DDSDVEjYXDuW9V|fc_00817a6e65e8f156016aaa0a0498e087d18d8993467b1e1070","toolName":"grep","startedAt":"2026-09-16T03:16:20.674Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemo…"},"intent":"Locating reply and stream seat code"},"id":"758c79ea","parentId":"669304fc","timestamp":"2026-09-16T03:16:20.674Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_fM1X0bptYDrtEgYdi84v0I3O|fc_00817a6e65e8f156016aaa0a0498f087d18ec3206162ae5c4f","toolName":"read","startedAt":"2026-09-16T03:16:20.674Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs:676-690,860-870"},"intent":"Reading reply schema and codec"},"id":"27395aee","parentId":"758c79ea","timestamp":"2026-09-16T03:16:20.674Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_0yMQ4XtnNXQE9TEoh8zesLeB|fc_00817a6e65e8f156016aaa0a0498f887d1b57ad4b19f0683d6","toolName":"read","startedAt":"2026-09-16T03:16:20.675Z","args":{"path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs:22-37"},"intent":"Reading framing write behavior"},"id":"24c4eed3","parentId":"27395aee","timestamp":"2026-09-16T03:16:20.675Z"}
{"type":"message","id":"0faeabe0","parentId":"24c4eed3","timestamp":"2026-09-16T03:16:20.675Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Locating begin-attach sessions**"},{"type":"toolCall","id":"call_i9f8N8bO77DDSDVEjYXDuW9V|fc_00817a6e65e8f156016aaa0a0498e087d18d8993467b1e1070","name":"grep","arguments":{"i":"Locating reply and stream seat code","pattern":"pub fn sessions|fn begin_attach|fn bounded_block_on|fn feed_rest","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs","case":true,"gitignore":false,"skip":0},"intent":"Locating reply and stream seat code"},{"type":"toolCall","id":"call_fM1X0bptYDrtEgYdi84v0I3O|fc_00817a6e65e8f156016aaa0a0498f087d18ec3206162ae5c4f","name":"read","arguments":{"i":"Reading reply schema and codec","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs:676-690,860-870"},"intent":"Reading reply schema and codec"},{"type":"toolCall","id":"call_0yMQ4XtnNXQE9TEoh8zesLeB|fc_00817a6e65e8f156016aaa0a0498f887d1b57ad4b19f0683d6","name":"read","arguments":{"i":"Reading framing write behavior","path":".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs:22-37"},"intent":"Reading framing write behavior"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":4934,"output":243,"cacheRead":55168,"cacheWrite":0,"totalTokens":60345,"reasoningTokens":15,"cost":{"input":0.04934,"output":0.012150000000000001,"cacheRead":0.055167999999999995,"cacheWrite":0,"total":0.116658}},"stopReason":"toolUse","timestamp":1789528572118,"responseId":"resp_00817a6e65e8f156016aaa09fc52dc87d1b475d14db0ec120c","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_00817a6e65e8f156016aaa09fd5ac087d18601383f5f008dd0","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqgoE_hFmVYD7j7Ip23ZO1BDtaTJkOLThOLmVaMoLBtwxRLSljtB_c1FgwOCsPciW1alRxikMF2hF3vIFjtX2lqaH94GGPmoTSBkX19M1G5bq-3DMBsbJwKG2Cl2Lwvx7NBEgjjYA20oy5fr_OPssQKINIAqQ_sw75Z_3gNvxjPsFOdh30TvF5NTKZHQuZz56E-4V2cZE6L4ilNFa3lQCNBj2ApqztTWW1MwgFfvj55ToY5XShWKJW2R8PdDE1LMb9FvOdfrvarGrBaRabUjz_ZtzYZnuZLLagrdjxI041eWM-xd3wCHZLvFCUU8cc_iM8f04wnF1tsSx8Ropb2mIe66f55_WVmeoeCgPqQvBT2yAgVDKkXnDTak45b1jxXWkkGw4aA94mbV0FVgzxuQLksTygyM1ppS4rXkDk-OWLuLKA9w0e848s-ADYq7Fj7Jry-v_bOIB1KZ8PtlvMXyG7j1x6TGFx_wXTaK6qgl57FffjZr1DrSFzkstDwctjdHcQ8Br78srjwzFx8VXo1WOkddKm8weJuSVU4RtZONMr8S8EK2MnzVYBn3NkmYyhp5UFlU6OIGhRTzbv7LM2h952yBMyyikgO-bA0YeqQhgFspyl8RIulqz_RhOwC0Ai9TzEls_PCZ-NeCDySBf-ukWbBDIHcIDDia5nJbEkmgCYuMwi70203R497LTaHWieDWKG9UTr8YQjm-PkGgEyj0itARouOyPVD5dW1SJ5l8en6ET1XktekwONQl5EKJ5BzQtrx6sFVz1Csf0Spsa2FcTNRIQjLcSsmtg_TP2Oo8We3CHZ1W6Y4V7BMrW-M5WzVAQRxBSwHldfUg3KIsMajNSAGTibxRZE3dW5ZeACYQR_HXr8qqpsFel-SjQ3uMv7uO4iYicjCII4C2BcM3i5sWulEI2xTdSx4biboNocHWiI0KWWFCZQoRvhvbdUk2zdflKtkgKi42oMxtq1MoRNA12kIzuIOa-C4JJFqV1iZwbDuzmoh2sqU052uuAm3TcFSPlK0UCQTTeg0gCyNcQzNikIuowX80_GKRs_G46vcFGkh5hkhwn4sZ1qFmmthBnIA7TsJclEgohP_g6Ah85rqMBXXj4JVVBeKPHE8JvlS2x-VMdUmkoUym9ZNtRkCWrWTMTI0MB6bbMzMWuzG6V2hWkMQFOo8AbVuC9mBrs1pJRvyUlHZRZSHjIIEDPslZ9QHi1ysWKf8rn3IJPO5fx-m5Td8o-RZZu3aJT4IknbxaXca2YgUBmEvw2V_DRHKQmyuePor-BfyDYtP0U-AvsgzvRyQXqoMaKYgqWitVG4ZvlW6qRel-DuykAA_YZuXUjB30XP_2cZYf9DcGtcJMwXDBFrhbAgtGW-BoqWpmUrHoM9eQP-z0=","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"summary":[{"type":"summary_text","text":"**Locating begin-attach sessions**"}],"metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa0a0498e087d18d8993467b1e1070","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating reply and stream seat code\",\"pattern\":\"pub fn sessions|fn begin_attach|fn bounded_block_on|fn feed_rest\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/brain.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/nethost.rs;.worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/attach.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_i9f8N8bO77DDSDVEjYXDuW9V","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"grep","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa0a0498f087d18ec3206162ae5c4f","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading reply schema and codec\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/msg.rs:676-690,860-870\"}","call_id":"call_fM1X0bptYDrtEgYdi84v0I3O","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}},{"id":"fc_00817a6e65e8f156016aaa0a0498f887d1b57ad4b19f0683d6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading framing write behavior\",\"path\":\".worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/codec.rs:22-37\"}","call_id":"call_0yMQ4XtnNXQE9TEoh8zesLeB","internal_chat_message_metadata_passthrough":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"},"name":"read","metadata":{"turn_id":"dc17e487-b76a-4428-9d63-80f6ae63587f"}}]},"duration":8552.153400000185,"ttft":1263.8014000002295,"completedAt":1789528580671,"contextSnapshot":{"promptTokens":60102,"nonMessageTokens":10304,"compactionEpoch":0}}}
{"type":"message","id":"95ce741f","parentId":"0faeabe0","timestamp":"2026-09-16T03:16:20.702Z","message":{"role":"toolResult","toolCallId":"call_0yMQ4XtnNXQE9TEoh8zesLeB|fc_00817a6e65e8f156016aaa0a0498f887d1b57ad4b19f0683d6","toolName":"read","content":[{"type":"text","text":"/// Serialize and write one [`Envelope`] as a length-prefixed JSON frame.\npub fn write_frame(w: &mut W, env: &Envelope) -> io::Result<()> {\n let body =\n serde_json::to_vec(env).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n if body.len() > MAX_FRAME_BYTES {\n return Err(io::Error::new(\n io::ErrorKind::InvalidData,\n format!(\"frame too large: {} bytes\", body.len()),\n ));\n }\n let len = body.len() as u32;\n w.write_all(&len.to_be_bytes())?;\n w.write_all(&body)?;\n w.flush()?;\n Ok(())\n}\n\n/// Read one length-prefixed JSON frame and decode it into an [`Envelope`].\n/// Rejects an oversized length prefix before allocating. A clean EOF on the\n/// length prefix surfaces as [`io::ErrorKind::UnexpectedEof`] (peer hung up).\n\n[Showing lines 21-40 of 96. Use :41 to continue]"}],"details":{"truncation":{"content":"/// Serialize and write one [`Envelope`] as a length-prefixed JSON frame.\r\npub fn write_frame(w: &mut W, env: &Envelope) -> io::Result<()> {\r\n let body =\r\n serde_json::to_vec(env).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n if body.len() > MAX_FRAME_BYTES {\r\n return Err(io::Error::new(\r\n io::ErrorKind::InvalidData,\r\n format!(\"frame too large: {} bytes\", body.len()),\r\n ));\r\n }\r\n let len = body.len() as u32;\r\n w.write_all(&len.to_be_bytes())?;\r\n w.write_all(&body)?;\r\n w.flush()?;\r\n Ok(())\r\n}\r\n\r\n/// Read one length-prefixed JSON frame and decode it into an [`Envelope`].\r\n/// Rejects an oversized length prefix before allocating. A clean EOF on the\r\n/// length prefix surfaces as [`io::ErrorKind::UnexpectedEof`] (peer hung up).\r","truncated":true,"truncatedBy":"lines","totalLines":76,"totalBytes":828,"outputLines":20,"outputBytes":828,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":96,"displayContent":{"text":"/// Serialize and write one [`Envelope`] as a length-prefixed JSON frame.\r\npub fn write_frame(w: &mut W, env: &Envelope) -> io::Result<()> {\r\n let body =\r\n serde_json::to_vec(env).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n if body.len() > MAX_FRAME_BYTES {\r\n return Err(io::Error::new(\r\n io::ErrorKind::InvalidData,\r\n format!(\"frame too large: {} bytes\", body.len()),\r\n ));\r\n }\r\n let len = body.len() as u32;\r\n w.write_all(&len.to_be_bytes())?;\r\n w.write_all(&body)?;\r\n w.flush()?;\r\n Ok(())\r\n}\r\n\r\n/// Read one length-prefixed JSON frame and decode it into an [`Envelope`].\r\n/// Rejects an oversized length prefix before allocating. A clean EOF on the\r\n/// length prefix surfaces as [`io::ErrorKind::UnexpectedEof`] (peer hung up).\r","startLine":21,"lineNumbers":[21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40]},"fileSize":3862,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\codec.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":96,"totalBytes":828,"outputLines":20,"outputBytes":828,"shownRange":{"start":21,"end":40},"nextOffset":41}}},"isError":false,"timestamp":1789528580701}}
{"type":"message","id":"285aa1c4","parentId":"95ce741f","timestamp":"2026-09-16T03:16:20.717Z","message":{"role":"toolResult","toolCallId":"call_fM1X0bptYDrtEgYdi84v0I3O|fc_00817a6e65e8f156016aaa0a0498f087d18ec3206162ae5c4f","toolName":"read","content":[{"type":"text","text":"pub struct SubscribedReply {\n /// The session the subscribe targeted.\n pub session_id: u64,\n /// The resolved role.\n #[serde(flatten)]\n pub outcome: SubscribeOutcome,\n /// An operator-facing sentence about the seat that was just taken, when the\n /// broker has one to say (releases#102: an admin-TOTP bring-up empowered\n /// this seat for its anchor subnet).\n ///\n /// A FIELD rather than a new [`SubscribeOutcome`] variant, and\n /// `serde(default)` so an N-1 rc parses a reply carrying one and ignores it:\n /// the role a subscribe resolved to is unchanged, and inventing a variant\n /// for a sentence would make every reader tolerate a role it has no handling\n /// for. `skip_serializing_if` keeps the ordinary reply byte-identical to the\n…\n}\n…\npub struct AppliedEvent {\n /// The session the effect targeted.\n pub session_id: u64,\n /// The durable op id of the effect.\n pub op_id: u64,\n /// Whether the effect ran on this delivery (`true`) or was deduped because it\n /// had already landed (`false`). Informational — both mean \"durably applied\".\n #[serde(default)]\n pub applied_now: bool,\n}\n"}],"details":{"displayContent":{"text":"pub struct SubscribedReply {\n /// The session the subscribe targeted.\n pub session_id: u64,\n /// The resolved role.\n #[serde(flatten)]\n pub outcome: SubscribeOutcome,\n /// An operator-facing sentence about the seat that was just taken, when the\n /// broker has one to say (releases#102: an admin-TOTP bring-up empowered\n /// this seat for its anchor subnet).\n ///\n /// A FIELD rather than a new [`SubscribeOutcome`] variant, and\n /// `serde(default)` so an N-1 rc parses a reply carrying one and ignores it:\n /// the role a subscribe resolved to is unchanged, and inventing a variant\n /// for a sentence would make every reader tolerate a role it has no handling\n /// for. `skip_serializing_if` keeps the ordinary reply byte-identical to the\n…\n}\n…\npub struct AppliedEvent {\n /// The session the effect targeted.\n pub session_id: u64,\n /// The durable op id of the effect.\n pub op_id: u64,\n /// Whether the effect ran on this delivery (`true`) or was deduped because it\n /// had already landed (`false`). Informational — both mean \"durably applied\".\n #[serde(default)]\n pub applied_now: bool,\n}\n","startLine":676,"lineNumbers":[676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,null,700,null,860,861,862,863,864,865,866,867,868,869,870]},"fileSize":119647,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\49-267-refresh-discriminator\\crates\\spt-daemon\\src\\msg.rs"}}},"isError":false,"timestamp":1789528580717}}
{"type":"message","id":"c3db4cdb","parentId":"285aa1c4","timestamp":"2026-09-16T03:16:20.727Z","message":{"role":"toolResult","toolCallId":"call_i9f8N8bO77DDSDVEjYXDuW9V|fc_00817a6e65e8f156016aaa0a0498e087d18d8993467b1e1070","toolName":"grep","content":[{"type":"text","text":"# .worktrees/49-267-refresh-discriminator/crates/spt-daemon/src/\n## brain.rs\n 2366| /// dispatcher's session→endpoint resolution (D9-1).\n*2367| pub fn sessions(&mut self) -> io::Result {\n 2368| self.send(KIND_SESSIONS, serde_json::Value::Null)?;\n 2369| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2370| let deadline = self.call_deadline();\n## nethost.rs\n 544| // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n*545| fn begin_attach(&mut self, sub: SharedSend, from_seq: u64) -> io::Result {\n 546| if let Some(prior) = &self.subscriber {\n 547| // No-reinstall-until-gone applies to the POISON class only\n 548| // (REQ-DISPATCH-FALLBACK-CIRCUIT): a wedged writer may sit in a\n...\n 744| // [impl->REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE]\n*745| fn begin_attach(&mut self, sub: SharedSend, from_seq: u64) -> io::Result {\n 746| if let Some(prior) = &self.subscriber {\n 747| // Poison-class only (see StreamLog::begin_attach): a healthy\n 748| // prior presence subscriber is displaced by the newer brain.\n...\n 1468| // [impl->REQ-HAZARD-BROKER-QUIC-DEADLINE]\n*1469| fn bounded_block_on