{
  "summary": "The same held controller attach stream is a better and narrower owner-side authority seam than a standalone signed WEB receipt: it lets owner rc authorize against its own locally initiated control viewport without inventing adapter tokens or broadening ServeFor.",
  "files": [
    {
      "path": ".worktrees/300-input-acceptance/crates/spt/src/rc.rs",
      "description": "pump 2878–2888 already receives controller bool; inbound records at 3117–3120 are filtered by exact established stream_id. It needs locally fixed canonical endpoint context, not a remote-supplied audience. attach_viewport 2568 has endpoint_id and intent; establish_attach 2293 binds stream to target."
    },
    {
      "path": ".worktrees/300-input-acceptance/crates/spt-daemon/src/attach.rs",
      "description": "serve_attach 698–739 holds broker-confirmed role; Controller/TookControl is the only permitted forwarding path for the new receipt record. Viewer/Busy must not forward."
    },
    {
      "path": ".worktrees/300-input-acceptance/crates/spt-net/src/net/attach.rs",
      "description": "AttachRecord is the existing typed, authenticated stream conversation. Additive record(s) can carry receipt-bound paths/payload and registration outcome; old clients skip unknown kinds."
    },
    {
      "path": ".worktrees/300-input-acceptance/crates/spt-daemon/src/servehost.rs",
      "description": "ServeRequest::AddScoped 53; apply arm 209–214 registers reference and scopes it under the existing registry operation. Public call 355 and call_with_timeout 363 provide existing local daemon registration transport."
    }
  ],
  "architecture": "Receiver broker captures payload and its live controller sink atomically at receipt; that specific sink carries the core request to serve_attach and the same rc stream. Owner rc admits it only on its locally established non-viewer stream and registers for the local canonical endpoint target through AddScoped. Outcome returns over that stream. Existing WEB fetch and legacy MSG_OUT-based ServeFor remain unchanged.",
  "report": "Recommended over the standalone receipt-signature proposal. This adds an actual owner-side conjunct: the user on this node opened this control viewport to this endpoint/peer. A remote node cannot ask arbitrary owner WEB streams to invoke it; the return request must arrive on the locally held outgoing attach conversation.\n\nConcrete restrictions:\n- rc's pump has controller: bool already (2878–2888). Require it; a Viewer stream must refuse/ignore the serving request without touching the registry.\n- Ingress already matches BrokerEvent::NetStreamData.stream_id against the established stream_id (3117). Keep this exact stream custody; no unrelated inbound request may select a local rc by claimed ID.\n- Pass the locally resolved canonical endpoint into pump. Set AddScoped audience from that context, never from record-provided audience/node. Set TTL to fixed 24h locally.\n- Require receipt payload/path binding; broker sends data captured at the USER_INPUT receipt, not a later current-seat sample. Core's own-delivery exclusion and dedup happen before/with that captured receipt as assigned to Main.\n- Receiver must enqueue through the receipt-captured controller sink rather than resampling the latest controller while asynchronous work executes. serve_attach must forward only its confirmed Controller/TookControl role (698–702); any response must correlate to the pending receipt and same stream/session, not a bare endpoint supplied by rc.\n- Missing local file must return a silent-skip outcome, not the existing logged SERVE_FOR_MISSING failure. Other unavailable/refused outcomes must remain distinguishable to receiver without blocking input processing.\n- Existing AddScoped's local call can block up to its configured transport timeout; don't put slow registration or reciprocal blocking broker calls on a critical read loop if that starves the attach stream. This is a coupling to account for, not a reason to add a separate authorization family.\n- Handoff/detach after receipt can end the channel: rc returns on Displaced (3164–3165). A failed request must not be redirected to a successor controller; success already registered remains receipt-bound and audience scoped. No inferred grace/token mechanism.\n\nCeiling: owner still trusts the receiving core to describe the USER_INPUT faithfully; it cannot reconstruct semantic acceptance from terminal bytes. However that trust is now restricted to the endpoint/peer the owner locally chose to control, rather than any subnet peer able to sign its own claim. That directly addresses the standalone receipt's missing owner-local authority.\n\nNo validation or state-changing commands executed; this is source-only follow-up to Main's proposed mechanism."
}