[.worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md#5592]
1:# Infra register — CI / build-pipeline debt
…
1255:## BUILT / RETIRED
…
6419:### IR-106 — a red set HANDED OVER in a message was reported as a POPULATION: both members verified, their lines and modes corrected, and the count still wrong by half
…
6421:- **Status:** OPEN as a discipline line; the instance is closed (the run that refuted it is on file).
…
6424:- **Instance (2026-09-11, #304 W1 product lane).** todlando was handed a red set naming TWO cells in
…
6429:  `node_routing_reserves_facets_without_registry_fallback` (:1011, 302 vs 200). A post-run sweep
6430:  mapping every single-segment node-root literal to its enclosing fn closed the population at four,
6431:  by enumeration; two further cells touch a root and pass for stated reasons.
6432:- **Why the verification is what hides it.** Checking a member answers "is this one real". It cannot
6433:  answer "is this all of them": no amount of per-member rigour turns a received list into an
6434:  enumeration, and correcting a handed-down set FEELS more rigorous than enumerating it.
6435:- **Mirror instance one window later, other direction (hertz, same lane).** His enumeration was
6436:  SOUND (every node-root literal in the module mapped to its enclosing fn) but its SCOPE was
6437:  inherited from the one file he happened to be resolving; the merge also brought
6438:  `bootstrap_firewall.rs` (+4) and `bootstrap_firewall/windows.rs` (+2), so his whole-suite count was
6439:  short by six (predicted 981, measured 987). Same family: a sound instrument pointed at the wrong
6440:  population.
6441:- **Rule.** Before any COUNT enters a prediction, a START or an END, run the enumerating predicate
6442:  YOURSELF, with a tool that can express the population you are claiming (an unfiltered run; a grep
6443:  whose root is the crate, not the file you have open). A set received in a message is a lead.
6444:- **Kin:** [[IR-100]] (a census counts what its filter could not answer for, separately from a no),
6445:  [[IR-101]] (a per-lane green is silent about the population it did not select), [[IR-105]] (a
6446:  from-a-model assertion is refuted only by a run), memory "a predicate without its tool is not evidence".
6447:- **Ripe when:** now, a line in the window protocol, not a build. Fold into the START/END template
6448:  beside the census. · **Size:** one entry, one clause; no code.
6449:
6450:### IR-107 — a rig that redirects TMP INSIDE the checkout puts every tempdir fixture under a git toplevel, and cells whose premise is "outside any repo" resolve THIS repo's remote
6451:
6452:- **Status:** RIG FIXED in hertz's lane (base now under `AppData/Local/Temp/hertz-304-rig/<label>`;
6453:  `HERTZ_RIG_TMP_IN_REPO=1` restores the old placement on purpose as the negative control). Recorded
6454:  2026-09-11 11:20Z (doyle, from hertz's and todlando's measurements); corrected 11:35Z on hertz's
6455:  read. The A/B COMPLETED in window 7 at cba18cd5: arm A (base outside any repo) 2 run / 2 passed;
6456:  arm B (base inside the checkout) 2 run / 2 FAILED at :1404 and :842 with the strings below, the two
6457:  bases recorded and differing. Window 6's arm B was the non-measurement described below.
6458:- **Instance.** hertz's first unfiltered `spt-daemon --lib` at 69438c01 redded two cells that neither
6459:  lane touches and that todlando's unfiltered run had passed 8 minutes earlier on the same bytes and
6460:  box: `registryhost::tests::recent_projects_for_dedups_newest_first_excludes_spt_internal` (:1404,
6461:  got `["github-com-bigscreenvr-spt-bs-core"]`) and `projwriter::tests::batched_complexity_counters_hold`
6462:  (:842, got `Some("spt-bs-core")`). Both fixtures require a directory outside any repo.
6463:- **Mechanism, measured with a control.** `lane_run.py` set TMP/TEMP/TMPDIR/RUNNER_TEMP to
6464:  `EVID/temp/<label>` inside the spt-core checkout; `git -C <that dir> rev-parse --show-toplevel`
6465:  answers the checkout (remote `BigscreenVR/spt-bs-core`), while the same probe from the default TMP
6466:  answers "not a git repository". `project_id_for_dir` is REMOTE-URL FIRST: `slug(remote)` and
6467:  `display_from_url(remote)` are the two observed strings exactly, and the folder-name fallback could
6468:  not have produced either (candidate folder names: 304-product, hertz-304, spt-core). So git got as
6469:  far as step ONE of the derivation. The first mechanism offered ("any in-repo cwd") was killed by one
6470:  datum: ci.yml:143 runs `kind(lib)` unfiltered on this runner with an in-repo cwd and passed at
6471:  6a7dd6b7. The variable was the FIXTURE's location, never the process cwd.
6472:- **Instrument defects in this lane today, all hertz's, all closed:** (window 5) `cargo ... | tail;
6473:  echo $?` reports tail's status (memory "render-not-read-pipefail") — the compile gate was in fact
6474:  green, so that reading was VOID evidence rather than a masked red; the same construct one command
6475:  later printed 0 over a checker [must] finding, a true exit 1 — the hazard is that an exit read
6476:  through a pipe certifies nothing, not that it hides reds. (window 4 START gate, 10:26Z) a negative
6477:  control that returned at the refusal branch vouched for nothing about the send arm, which then
6478:  crashed on a NameError on the first real launch (memory "make a new rig red on purpose",
6479:  refinement). (window 8, premise lane, 12:14Z) a FOURTH void-exit instance in one day — `$?` and `${PIPESTATUS[0]}` both read a later command, a backgrounded python traceback surfaced as exit 0; every verdict rests on the producer's own recorded exit file or cargo's Finished line. Also: the window driver crashed at its END on a stale dict key AFTER json.dump had written the report — report-before-print is load-bearing and was right by accident; ordered the other way six measured arms evaporate at the summary line. (Linux cells lane, 12:46Z) fifth and sixth: a python driver died on a SyntaxError while the shell reported exit 0 (exposed only by STALE red logs from the previous sha), and a census script stalled mid-run while its ssh reported exit 0. Both caugh…
6480:- **Third instrument defect, same window (hertz, 11:25Z):** a mutation driver's revert check was
6481:  `git hash-object` plus `git diff --quiet`, and BOTH normalize line endings; `git checkout --`
6482:  re-materialized docshost.rs as CRLF, the LF-written anchors then counted 0, and the driver REFUSED
6483:  at arm 5 = w6-rdrop (the guard working: nothing written; rdrop and lib-full were measured in window
6484:  7: rdrop RED at :683 with left Some(59827), lib-full 988/988) while the oid check reported an identical blob over
6485:  bytes that had just changed. An oid check cannot see an eol rewrite; a revert proof records bytes,
6486:  crlf and bare-lf counts beside the oids. Also: an arm whose switch reaches only the CHILD env while
6487:  the base is chosen from the PARENT's ran the control arm's conditions and passed for its reason (a
6488:  non-measurement, not a refutation) - the driver now refuses to call it a measurement if the two
6489:  bases match.
6490:- **Rule.** A rig's TMP resolves OUTSIDE every git toplevel, and the rig proves it once per box with
6491:  `rev-parse --show-toplevel` expecting "not a git repository". A test whose premise is "no repo
6492:  here" names that premise in its first assertion so the failure reads as environment, not product.
6493:- **Kin:** [[IR-100]], [[IR-101]] (per-lane green silent about the unselected population; these two
6494:  cells were invisible to the stock 21-name producer for the whole lane), [[IR-106]].
6495:- **Ripe when:** now for the rig (done). The assertion-premise clause for the two cells rides a
6496:  SEPARATE follow-up lane after W1 closes (ruled 11:35Z: neither #304 lane touches registryhost.rs or
6497:  projwriter.rs, and a comment in two untouched modules does not widen the integration diff);
6498:  hertz's rig also writes its admission record under a stale sha tag (`admission-61bfd85c.json`),
6499:  the same family as a reused artifact path — fix in that lane. Consequence already paid: the
6500:  window-5 and window-6 admission census records were silently OVERWRITTEN by the later windows
6501:  writing the same path, so those two ENDs stand on the transcript alone, not on a record. · **Size:** one env line in the rig
6502:  (done); two comment lines in tests; one filename in the rig.
6503:
6504:- **Instances 9-11, all 2026-09-12, #304 W-2 (one night, three different surfaces).** NINTH (doyle's gate leg, 03:20Z): `cargo ... | tail` over non-interactive ssh to kitsubito returned 0 while cargo was off PATH in the non-login shell — already named in releases#304 comment 5643115673 and filed here for the count. TENTH (hertz, 05:30Z, while writing register entries about instruments that lie): `traceable-reqs check 2>&1 | tail -20; echo "CHECK_EXIT=$?"` printed `CHECK_EXIT=0` — tail's exit over a checker that exits 1, i.e. a 312-finding red read as clean. He re-ran it only because the register had made him suspicious of his own zero, which is the entry doing its job and not a skill. ELEVENTH (todlando, 05:20Z, a NEW surface — the harness itself): `cargo ne…
6505:
6506:- **Linux consumer recurrence (todlando, 2026-09-13, #304 at `b8482445`).**
6507:  My first consumer driver put `RUNNER_TEMP` under the checkout's preserved-evidence
6508:  directory, then exported its child sandbox as TEMP/TMP/TMPDIR. Phase A ran 3417 cells:
6509:  3414 passed (2 leaky), 3 failed, 1 skipped, exit 100. The two daemon premise
6510:  assertions named this exact fault; `spt-store::project::tests::derivation_ladder`
6511:  also derived the enclosing repository rather than its fixture folder. **That
6512:  attempt is VOID, not a candidate regression.** The temp-root Git probe returned
6513:  the enclosing checkout (exit 0); the replacement `/tmp/spt-consumer-304-b8482445-valid-*`
6514:  root and every exported temp path returned "not a git repository" (exit 128).
6515:  The replacement driver enforces that boundary before launching any producer.
6516:  On unchanged candidate bytes, valid Phase A then ran 3417/3417 passed (1 leaky),
6517:  1 skipped, exit 0; no main delta or source edit was needed. Original raw,
6518:  `temp-premise-correction.json`, and the valid `attempt2/` receipts remain under
6519:  `.spt/preserved/304-handoff/consumer-linux/`. This repeats the existing rule;
6520:  preserving evidence inside the repository never licenses putting fixtures there.
6521:
6522:- **Live-agent identity environment recurrence — Windows consumer (2026-09-13, #304).**
6523:  Doyle reported in `5E3WTZ3N` that his live session's `OWL_SESSION_ID` reached the
6524:  test driver: Windows consumer attempt 1 is **VOID, not a candidate regression**.
6525:  Recorded by hertz from that report, not from an independent rerun. The current
6526:  phase was to drain before a full scrubbed rerun; no corrected Windows result or
6527:  BOX CLEAR is claimed here. A.2 remains held and the preparation clock unstarted.
6528:  **Same mechanism, different input:** TMP placement changes a fixture's repository
6529:  context; inherited session identity changes its caller context. In both cases
6530:  the harness environment is part of the subject, not neutral launch plumbing.
6531:  A clean checkout and pinned executable do not establish the intended test premise.
6532:  **Rule:** construct the producer's child environment from its declared test/CI
6533:  contract, removing inherited live-session identity inputs as a set before launch.
6534:  Verify the effective environment handed to the actual test producer after all
6535:  wrapper/sandbox setup; record names and presence/absence, never identity values.
6536:  Fixtures that test identity must supply their own explicit fixture identity.
6537:  Keep the live agent's own environment and lifecycle intact; this is test-driver
6538:  isolation, not permission to evade a guard on real operational commands.
6539:  Preserve the invalid attempt's logs and verdict separately from the corrected
6540:  run; an environment-premise failure does not authorize a product patch.
6541:  **Kin:** [[IR-22]] records the earlier identity-inheritance failure and its
6542:  one-variable-at-a-time diagnostic trap; [[IR-122]] distinguishes a real rig's
6543:  intentional live-session refusal from an isolated test's contaminated premise.
6544:
6545:### IR-108 — four brainproc unit cells leak a process on every run; two others leak by ordering
6546:
6547:- **Status:** OPEN, product-side backlog candidate (not #304's). Recorded 2026-09-11 11:35Z (doyle)
6548:  from three unfiltered `spt-daemon --lib` runs on identical bytes on HFENDULEAM (todlando 10:52Z at
6549:  3e7eaf67; hertz 11:00Z at 69438c01 and 11:27Z at cba18cd5), all green.
6550:- **Cell-shaped (leak 3 of 3):** `brainproc::tests::clear_before_spawn_defeats_exact_generation_stale_file`,
6551:  `ready_but_old_gen_never_drains_does_not_promote_rolls_back`, `stale_generation_minus_one_ready_never_promotes`,
6552:  `trial_kills_alive_never_ready_candidate_before_rollback`. **Run-shaped:**
6553:  `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (2 of 3),
6554:  `livehost::tests::legacy_psyche_sweep_guard_is_id_specific_and_fail_safe` (1 of 3).
6555:- **Why it matters:** nextest's LEAK is a child that outlives the test; on a shared box that is a
6556:  process census entry with no owner and a pool handle that can pin a worktree (memory
6557:  worktree-pin-holder-triage). Every post-census this cycle read zero survivors, so the leaks reap
6558:  themselves within the run's teardown; the hazard is the window between.
6559:- **Count is PER RUN, not a set (corrected 12:28Z, doyle, on todlando's fold-lane read):** at 61d3459f (fold/304-w2-admission, 992/992) FOUR leaked — brainproc x3 (clear_before_spawn, ready_but_old_gen, stale_generation_minus_one) + broker windows_session_is_zombie — and `trial_kills_alive_never_ready_candidate_before_rollback` RAN (PASS 0.559s, 116/992) and did NOT leak. So "brainproc x4 cell-shaped" is 3-of-4 cell-shaped across four runs on three trees; the fourth is run-shaped. A leaky set carried from one END to the next without re-deriving is the inherited-claim habit (IR-106) at its mildest.
6560:- **Discriminator before any fix:** run each cell alone with `--success-output immediate` and read what
6561:  child it spawns and why it is not waited; a cell-shaped leak is a missing wait or kill in the
6562:  fixture, a run-shaped one is teardown ordering.
6563:- **Kin:** [[IR-100]], memory "e2e leaked daemons shared box", "rig ownership reap only your own".
6564:- **Ripe when:** next product wave that touches brainproc, or a findings-backlog sweep. · **Size:**
6565:  four fixture waits; unknown for the two run-shaped.
6566:
6567:### IR-109 — a manifest `[placement] module_banner = "accept"` block LOOSENS the local checker to zero; CI's pinned checker is structurally blind to placement, so the loosening is invisible until the pin moves
6568:
6569:- **Status:** OPEN, RATIFIED 12:33Z (doyle, releases#304) as a TRANSITIONAL policy for the #304 head: the 0.4.1 pin stays (a tightening for every new tag), the accept key exempts only the 312 legacy banner tags, and this entry is the retirement ticket. Recorded 2026-09-11 12:10Z (doyle) from hertz's A/B/C and 0.2.0 arms; the commit's "agreed" is corrected by the ruling, not by rewriting a measured sha.
6570:- **Instance.** 33936943 "chore(traceability): enable agreed placement policy" (07:38Z, trailer todlando, on
6571:  feat/304-remote-friction-product and test/304-remote-friction, NOT on main) adds `[placement] enforce = "on"`,
6572:  `module_banner = "accept"`. The word "agreed" is UNRATIFIED: todlando cannot evidence it (his session that
6573:  wrote it is gone) and doyle did not rule it.
6574:- **Measured, same binary 0.4.1, same tree 4b54a95d, manifest the only variable:** as-is exit 1 / 312
6575:  misplaced_tag; block added exit 0 / 0; `enforce = "on"` alone exit 1 / 312. `module_banner` is the sole
6576:  load-bearing key; enforce is the default already. CI-pinned 0.2.0 (golden.yml WANT=0.2.0) at the same sha:
6577:  exit 0 / 0 — the `misplaced_tag` kind does not exist in that version; placement lives only in its `review`
6578:  subcommand, which `check` never reaches. asm-304 (0c05e722, 0.4.1 + the block): exit 0, bought by the key.
6579:- **Why it matters.** AGENTS.md rule 1: tags sit on the evidence, never at file tops to satisfy coverage. The
6580:  312 are banner tags that violate it; the accept key retires them by policy rather than by moving one tag, and
6581:  the gate that CI actually runs cannot see either state.
6582:- **Rule.** A checker config change that lowers a finding count is a loosening and is ruled on the record
6583:  before it rides; "agreed" in a commit message is not a ruling. The honest statement of a zero under such a
6584:  config names the config ("zero under a manifest that accepts module banners").
6585:- **Kin:** memory checker-version-must-match-ci-pin (live instance), [[IR-104]].
6586:- **CORRECTED 12:24Z (doyle):** the pin HAS moved on the W1 lane ancestry — 71caedd4 "ci: pin traceable-reqs to v0.4.1" (10:11Z) sits under 697eb398 (not on main), so ci.yml:253 and golden.yml:1424 both read WANT=0.4.1 at the integration head while origin/main reads WANT=0.2.0 at ci.yml:253 and golden.yml:1414. The accept key is therefore LIVE at the assembled golden gate today, not dormant: asm-304 reads 0 [must] under 0.4.1 because of the key. A lane off 697eb398 reads nine further [must] (code-stage tags in docs prose: F-035-CONFLICT, PUMP-W2-DESIGN, DEBUG-CONVERGE-PLAN, INFRA-REGISTER) that the assembly does not: measured at F-035-CONFLICT:47, 697eb398 carries the bracketed tags and origin/main carries them with brackets elided ("so the checker" clause),…
6587:- **Ripe when:** now — the key rides #304 only as a labelled hole named in the golden hand-off; retire by relocating the 312 tags and deleting the key in a lane of its own. · **Size:** 312 tag moves; the key.
6588:
6589:### IR-110 — the gater ruled a wave from origin/main's manifest while the milestone's own product lane already carried the surface; a second implementation was built to its W-1 END before the first was noticed
6590:
6591:- **Status:** OPEN, STOP LINE on #304 W2 (comment 5634187958). Recorded 2026-09-11 12:10Z (doyle, own instance).
6592:- **Instance.** feat/304-remote-friction-product @3e7eaf67 implements #297 TCP admission under
6593:  REQ-WEB-LAN-BOOTSTRAP-FIREWALL (bootstrap_firewall.rs + windows.rs + linux.rs, lanhost/servehost/serveverb/cli
6594:  call sites, docs-site section, ADR-0059 "Amendment 2" at d71df7aa): program-scoped Windows effector, all
6595:  profiles, no remote restriction, zero tests in the module (six guard-level cells arrive with hertz 7b098cc2,
6596:  none on scope). doyle deactivated its int stage the same morning and then ruled W2 fork (i) and let four
6597:  REQ-LAN-BOOTSTRAP-* ids mint from ORIGIN/MAIN's manifest, where the id is absent (0 occurrences). todlando
6598:  built build/304-w2-bootstrap-tcp @fe427497: a second, tested (E4 red at the bound-port assertion, 5/5, 981==981)
6599:  netsh implementation, port+remote scoped, never program, a second "## Amendment 2" in the same ADR file.
6600:  He found the collision at his W-1 END by reading the product lane, and touched nothing.
6601:- **Mechanism.** IR-106 from the gater's chair: the population enumerated (main's manifest) was not the
6602:  population the claim was about (the milestone head's). The tell was available all morning — the gater's own
6603:  deactivation note names the id — and a grep of the assembly worktree (asm-304) instead of the main checkout
6604:  would have returned 1.
6605:- **Consequence.** The two texts disagree on a FACT (which rule shape admits TCP over the tailnet on this box;
6606:  W-0 measured program scope admitting nothing for UDP only), both amendments share a heading, and an
6607:  assembled head would run both start paths and write two rule sets.
6608:- **Rule.** Before minting or activating any id for a milestone wave, enumerate the ASSEMBLY head's manifest
6609:  (asm-<milestone>), not main's; a wave that "closes" a surface names the id it closes and greps the milestone
6610:  head for it first. A fork ruling states the tree it enumerated.
6611:- **Kin:** [[IR-106]], [[IR-107]] (same day, same class in three chairs).
6612:- **Ripe when:** now — W-2a discriminating measurement in flight (arms A-D on the installed 5470 listener from
6613:  kitsubito), then the fold ruling (one id, one ADR section, the tested decision seam + cells attached to the
6614:  surviving effector). · **Size:** one measurement; one fold commit on the W2 lane; the ADR merge is a content
6615:  decision, not a merge decision.
6616:- **Labelled hole (12:14Z):** bootstrap_firewall/linux.rs (676 lines) has ZERO #[test]; all six cells sit in bootstrap_firewall.rs and windows.rs. Under cfg the Linux arm is invisible to this box's unit lane, so the surviving id's unit stage reads green over an untested Linux backend set. Closed by a hertz cells lane run on kitsubito against ufw_scope / owned / backend (queued 12:14Z; ten cells red-first at be99017f, 12:41Z). RULE learned there: `ci.yml` lint runs clippy `--all-targets -D warnings` on kitsubito ONLY, and `--all-targets` lints cells as hard as product — a Linux-only red that no Windows gate sees caught todlando's `needless_borrow` (linux.rs:293, fixed be99017f) and hertz's own `cloned_ref_to_slice_refs` (linux.rs:891, test module) one hour ap…
6617:
6618:### IR-111 — the installed product's own inbound UDP rule reads Duplicate / Inactive in ActiveStore, shadowed by the fallback rule; a by-name probe reads it green
6619:
6620:- **Status:** OPEN, product-side backlog candidate (REQ-INBOUND-WINDOWS-RULE-BINDER-PATH-MATCH family). Recorded
6621:  2026-09-11 12:14Z (doyle) from an unelevated `Get-NetFirewallRule` read of both stores on HFENDULEAM.
6622:- **Instance.** ActiveStore: `spt-core inbound UDP` (Program = installed spt.exe, Profile Any, UDP, Remote Any)
6623:  Enabled=True, **Enforcement=Duplicate, PrimaryStatus=Inactive**; `spt-fallback inbound UDP` (same program,
6624:  Profile Any) Enforcement=ProfileInactive Enforced, Status OK. PersistentStore shows both as
6625:  Enforcement=NotApplicable, Status OK — the persistent view cannot see the shadowing at all.
6626:- **Why it matters.** The product's reconcile and the `inbound_block_hint` probe key on the product rule's NAME.
6627:  The rule that is doing the work is the other one; delete or repoint the fallback and the product rule may
6628:  become the enforced one with no change in what the name probe reports, or the reverse. Kin to the W1
6629:  effector's own comment ("never certify a rule which ActiveStore reports as ignored or ineffective") — the
6630:  UDP side never reads ActiveStore.
6631:- **Also seen, same read:** ~26 enforced program-scoped Private rules naming target/debug and actions-runner
6632:  test binaries (spt_net-*, spt_daemon-*, spt.exe), Proto TCP+UDP, LPort Any, Remote Any — the rig-rule
6633:  population the hfenduleam program-scope memory describes; none admits the tailnet.
6634:- **Rule.** A rule probe that certifies anything reads ActiveStore EnforcementStatus, not PersistentStore
6635:  presence and not the name.
6636:- **Kin:** [[IR-110]], memory hfenduleam-program-scoped-firewall-rules-do-not-admit-tailnet.
6637:- **Ripe when:** the next inbound-rule wave, or when the W1 CIM two-store query is generalised to the UDP side.
6638:  · **Size:** one ActiveStore read in the probe; one dedupe decision.
6639:
6640:### IR-112 — bare `cargo test -p spt-daemon --lib` reds two process-global cells on Linux at a sha where nextest is green; libtest is not a sound gate for this crate
6641:
6642:- **Status:** OPEN, rig rule (CI unaffected: `ci.yml` runs `kind(lib)` under nextest). Recorded 2026-09-11 12:46Z
6643:  (doyle) from hertz's Linux cells lane END on kitsubito.
6644:- **Instance.** At 697eb398 on kitsubito: `cargo nextest list -p spt-daemon --lib` = 989 ids; `cargo test -p
6645:  spt-daemon --lib` = 989 run, 987 passed, **2 FAILED, exit 101**:
6646:  `answerop::tests::an_approval_notifies_a_plain_knocker_with_no_pre_authorization` (answerop.rs:324, "expected
6647:  exactly one courtesy: [] left: 0 right: 1") and
6648:  `brainproc::tests::the_ready_breadcrumb_tells_a_computed_hash_from_a_cached_one` (brainproc.rs:2347, "the FIRST
6649:  ready write in a process pays for the digest"). Both PASS under nextest with the identical filter, exit 0.
6650:- **Mechanism.** Process-per-test vs one shared libtest process: both cells read process-global state (the
6651:  brainproc one says so in its own panic text); under libtest a sibling's write is visible. IR-108's leaky-cell
6652:  class, measured on Linux. Kin memory bystander-test-reads-process-global, daemon-lib-tests-deadlock-on-live-host.
6653:- **Rule.** A gate or rig over spt-daemon's lib runs NEXTEST; a `cargo test --lib` red on this crate is a rig
6654:  fault until discriminated under nextest with the same filter. Count agreement (list == run) says nothing about
6655:  exit agreement — check both.
6656:- **Kin:** [[IR-108]], [[IR-100]].
6657:- **Ripe when:** a sweep makes those two cells hermetic (the fix belongs to the cells, not the gate). · **Size:**
6658:  two fixtures.
6659:
6660:### IR-113 — a killed mutation arm does not unwind: the subject stays mutated and the NEXT arm measures a tree nobody declared; and a mutation that reds on a compile error is a void arm that "it compiled" cannot detect
6661:
6662:- **Status:** OPEN, rig rule for every mutation driver. Recorded 2026-09-11 13:05Z (doyle) from todlando's FOLD-1b
6663:  window (fold/304-w2-admission, windows.rs).
6664:- **Instance.** A first M1 injected an early return through a struct literal naming a helper that does not exist —
6665:  a mutation that would red on E0425, not at the cell's assertion, i.e. a void red-first arm. The job was stopped
6666:  mid-run; the driver's restore is its LAST line, so the kill left the MUTATED file on disk: working oid d8ddfdf3
6667:  against pristine 1f475a80, two residue markers present. Caught only because the next act was an oid compare, not
6668:  the next arm. Restored and re-measured identical (residue 0, 786 == 786 lines). Second half: clippy on the
6669:  mutated tree exited 0, so "it compiled" would not have exposed the void arm either.
6670:- **Mechanism.** Mutate → run → restore is not transactional; any exit before the last line (kill, timeout, crash,
6671:  nextest hang) strands the mutation. A void arm is one whose red is not AT the assertion the prediction named.
6672:- **Rule.** (1) A mutation driver restores in a finally/trap path, and every arm BEGINS by asserting the subject's
6673:  oid equals the declared pristine oid — the previous arm's revert is proven at the next arm's start, not trusted.
6674:  (2) A red-first arm is accepted only when the artifact names the predicted assertion line; a compile-error red,
6675:  a panic elsewhere, or a red at a different line is VOID, not a pass and not a fail. (3) Mutations are one-token
6676:  edits with an anchor count asserted at 1; an arm that did not change the file voids itself loudly.
6677:- **Kin:** [[IR-107]] (revert proven by oid AND byte shape), memory scripted-edit-zero-match-refusal,
6678:  make-a-new-rig-red-on-purpose.
6679:- **Ripe when:** now — the rule is cheap and the drivers exist; every lane's driver adopts it at its next edit. ·
6680:  **Size:** a trap/finally and one oid compare per arm.
6681:
6682:### IR-114 — three hands wrote one firewall rule set inside ninety seconds under two directors; every census was true at its instant and false a minute later
6683:
6684:- **Status:** OPEN, procedure ruled 2026-09-12 00:50Z (doyle) on todlando's reconciliation; recorded 00:52Z.
6685:- **Instance.** #304 W-2a arms on HFENDULEAM: ~00:44Z todlando asked the operator to delete spt-w2a-C so B would stand alone; ~00:45Z the operator said "C down" and todlando's census read B present / C absent (true then); 00:45:05Z liam ADDED C at doyle's direction (doyle had been idle 11 h and did not know the operator's window); 00:46:14Z liam DELETED B at doyle's direction; 00:49:09Z todlando re-measured C present / B absent. Nobody was wrong; the population was not stable. Every fetch todlando reported had an adjacent census and stands; a long background census that straddled the writes returned no spt-w2a rows at all and is UNMEASURED. Separately, doyle's drop-log arm crossed liam's revert in flight: three fetches ran with logging already off — a void a…
6686:- **Mechanism.** Two directors (operator, gater) each driving a different elevated hand against the same shared host state, neither seeing the other's window; a census taken as a separate earlier step and carried forward.
6687:- **Rule.** For any arm on shared host state: ONE WRITER; the census is taken BY THE FETCHER in the SAME command as the fetch, before and after; the prediction names the exact expected population (an unexpected row is a red); every write is announced with its UTC time to every party; a director resuming after a gap re-measures the population before issuing a write. Kin: memory verify-the-subject-not-just-the-measurement, name-the-file-and-sha.
6688:- **Also measured tonight (todlando):** 'spt-core daemon' (proto Any, Private, remote Any, program = the listener's exe) covers the Private-classified Tailscale interface while TCP 5470 times out from kitsubito and the LAN address answers 200 with ICMP alive — so W-0 measured the tailnet ACL, not program scoping, and DESIRED_PROGRAM=false's cited justification is VOID (the constant may still be right; its citation is not). The shape question moves to a throwaway port and listener over the LAN (arm E).
6689:- **Ripe when:** now — the rule costs nothing. · **Size:** procedure.
6690:
6691:### IR-115 — a firewall census whose port test is DENIED reads every rule as port=Any and counts port-scoped rules as blanket; a `netsh show rule` without `verbose` omits Program and reads every rule as program=Any; a control count that merges two agents' reads is nobody's control
6692:
6693:- **Status:** OPEN, mechanisms recorded 2026-09-12 01:14Z (doyle) from todlando's and liam's own corrections during #304 arm E.
6694:- **Instances.** (1) todlando's first census A ("26 blanket rules") and B ("occupied LocalPort set: EMPTY"): `Get-NetFirewallPortFilter -All` returns "Access is denied" unelevated, the probe swallowed the denial, every rule read as port=Any, and B's positive control (the hand rule carries LocalPort 5470) is what caught it. (2) His replacement pass: `netsh advfirewall firewall show rule name=all` without `verbose` prints no Program line, so it reported 417 blankets and ZERO rules naming spt.exe — provably false, caught by the same control. The third pass (`dir=in verbose`) passed both controls (port-5470 rows = 1, spt.exe rows = 7) and was the census used. (3) doyle's fetcher: first census predicate listed port-covering and program-covering rules as two separ…
6695:- **Mechanism.** A denied or under-scoped read does not error; it returns the permissive default for the field it could not see, so the census reads MORE admits than exist and a shape question gets decided on a phantom population. Kin: memory a-predicate-without-its-tool-is-not-evidence, verdict-from-probe-competence, zero-match-filter-reads-as-absent.
6696:- **Rule.** A firewall census names its tool and privilege and carries two positive controls in the SAME dump: one rule known to carry a specific LocalPort, one known to name a specific Program. A census that cannot see both has not seen the population. The reaching predicate is port-covers AND program-covers AND LocalIP-covers AND profile-covers, one set. Every loopback and remote read records its curl exit code. Counts are per agent; a merged count is restated per agent or discarded.
6697:- **Ripe when:** now — the rule costs one grep. · **Size:** procedure.
6698:
6699:- **Addendum 2026-09-12 03:20Z (doyle, #304 W-2 A5/A4): the Windows Firewall event log is DIRECTION-BLIND, so a rig that keys "written" or "removed" on it cannot fail in the direction it claims.** Population controlled over one read (2011x48 / 2052x6 / 2097x6, a 400-event re-read of the same window returning the identical six): id 2052 fires on creates AND deletes in the observed population, id 2097 is create-specific, and NOTHING observed is delete-specific. The CENSUS carries the sign; the log carries only the instant. The same read established a MEASURED gap (zero events between A5's end and A4's start) and that nothing commits after the client dies — both usable, neither a direction. Kin: the firewall status fields do not discriminate either, since an ad…
6700:
6701:### IR-116 — a watchdog that calls a killer and then echoes success reports a kill it never made; `pkill` is absent in msys, so the guard logged "stopped" while the arm it guarded ran on
6702:
6703:- **Status:** OPEN, mechanism recorded 2026-09-12 01:24Z (todlando) from his own guard during #304 FOLD-2's Windows arm at 7357ea32; doyle asked for the line.
6704:- **Instance.** todlando armed a watchdog to stop a test arm before it reached `cargo test --workspace --lib`, because spt-daemon lib tests deadlock on a live host. Shape: `if grep -q "CLIPPY_EXIT=" log; then pkill -f "bash /tmp/arms.sh" 2>/dev/null; echo "GUARD: arms.sh stopped after clippy at $(date -u)"`. It printed `GUARD: arms.sh stopped after clippy at 01:24:06Z`. Nothing was stopped: `pkill` does not exist in this msys/Git-Bash environment (`command not found`, exit 127), `2>/dev/null` ate the message, and the `echo` was never gated on the killer's exit. The arm ran on into its compile phase and was found by tailing the build log, not by the guard — whose only output was a green.
6705:- **Mechanism.** Two defects stack, and either alone would have been caught by the other: a missing binary, and a success line that cannot fail. Same family as IR-107 seen from the other side — there a trailing command's exit was mistaken for the producer's; here no exit was consulted at all. The aggravating factor is WHERE it lives: a guard is written while thinking about the hazard it guards, not about the guard, and a guard that never fires looks identical to a guard that works. Kin: memory watchdog-reports-a-kill-it-never-made, verdict-from-exit-not-from-silence, a-predicate-without-its-tool-is-not-evidence.
6706:- **Rule.** A watchdog asserts the POST-STATE and never echoes after the call: `kill …; sleep 1; if still_running; then echo "GUARD FAILED"; exit 1; fi`. On msys use `kill -9 <pid>` with a pid you resolved yourself, or `taskkill //PID <p> //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.
6707:- **Second-order, and it bit me inside this very entry.** `git checkout -- <file>` restores from the INDEX, not HEAD. Having staged a first draft, I "reverted" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.
6708:- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).
6709:- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{"message":"Successfully stopped task: bn74vtqn0"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the …
6710:- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.
6711:
6712:### IR-117 — a predicate that cannot fail: pre-registered outcomes whose branches are not mutually exclusive, and a requirement titled with the TASK instead of the INVARIANT
6713:
6714:- **Status:** OPEN, mechanism recorded 2026-09-12 03:48Z (hertz, both instances his own; doyle ruled the second).
6715:- **Instance 1 — the outcome set.** For the #304 W-2 packet capture hertz pre-registered four outcomes, of which (a) was "SYN retransmission despite the RST" and (b) was "above the wire in the Windows client path". The capture showed five SYNs at a flat ~511 ms, each RST'd in 18-25 us and each ignored — which is (a)'s packet shape with (b)'s locus. The two branches were the same answer told at two altitudes, so EITHER could have been declared "confirmed" and neither could have been refuted by the actual result. Pre-registration defends against fitting the story to the data; it does nothing against branches that cannot both be false.
6716:- **Instance 2 — the requirement title.** hertz drafted `REQ-NET-WINDOWS-REFUSAL-BUDGET` titled "enumerate the spt paths that treat connection-refused as a fast negative on Windows". doyle refused it: that is the TASK, not the invariant. A requirement stated as a task is discharged by DOING the task — it would have gone green the instant the enumeration was written, whether or not one path was fixed, and would have had nothing to say about the NEXT connect bound anyone adds. The accepted title states a product invariant ("classified by its error kind, never by elapsed time; every connect bound documented against the measured floor"), which new code can violate.
6717:- **Mechanism.** Both are the same defect at different altitudes: an instrument whose every reachable outcome is a pass. Kin on the outcome side: memory discriminator-question, refuse-mechanism-until-something-discriminates, one-sample-is-not-a-negative. Kin on the requirement side: the activation model itself (a stage that cannot go red is not coverage), gate-against-documented-design.
6718:- **Rule.** Before registering an outcome set, name for EACH branch an observation that would refute it; if two branches share a refuter, they are one branch and the set is unfinished. Before adding a `REQ-*`, state it as something CODE can violate, never as work a person can complete — if the only way to make it red is to not write a document, it is a task and belongs in a lane, not the registry. Corollary from the same ruling: a measured constant may NOT enter product code as a threshold. The requirement forbids the interpretation (time as a proxy for error kind); it does not bless the number, which was measured on our machines and not on a user's.
6719:- **Ripe when:** now — both checks are one sentence each at authoring time. · **Size:** procedure.
6720:
6721:### IR-118 — an instrument read mid-flight, or through a filter that cannot match, returns a COMPLETE-LOOKING wrong answer with no error
6722:
6723:- **Status:** OPEN, two instances one hour apart, 2026-09-12 (hertz); doyle asked for the filter line beside IR-117.
6724:- **Instance 1 — the capture read in flight, and it would have inverted the verdict.** `tcpdump -w /tmp/hz-cap.pcap` was still running when the packets were wanted. The file was **8192 bytes** live and **11933 bytes** after `kill -TERM` flushed it; the 3741-byte tail WAS the four SYN retransmissions. Reading the live file would have yielded a well-formed pcap showing one SYN and one prompt RST — i.e. the pre-registered outcome (b), the WRONG answer, assembled entirely from the RIGHT answer's own evidence, with no truncation error and a plausible packet count. The tell was available and nearly missed: a block-aligned size (8192) is a flush boundary, not a record.
6725:- **Instance 2 — the filter that cannot match, class instance 2.** Censusing Windows TCP settings, hertz piped `netsh int tcp show supplemental template=internet` through `Select-String -Pattern 'Template|Initial RTO|Max SYN|Retransmissions'`. It returned ONE line — the header — because none of those words appear in the table's rows (which read `Minimum RTO (msec)`, `Initial Congestion Window (MSS)`, …). Had it been trusted it would have reported "no retransmission settings exposed", which is the identical clean zero a CORRECT filter over an empty template returns. Recovered only by re-running the command raw.
6726:- **Mechanism.** In both cases the instrument succeeded, exited 0, and returned a well-formed artefact that under-reports its population — a partial buffer and a non-matching pattern are indistinguishable from a complete capture and an empty table. Neither failure can be detected from the artefact alone; both need a second read of a different kind. Kin: memory zero-match-filter-reads-as-absent, count-predicate-needs-its-own-positive-control, verdict-from-probe-competence, absence-needs-sibling-probe.
6727:- **Rule.** Terminate a `-w` capture and confirm the writer is gone BEFORE reading it, and quote the writer's own census (`N packets captured / N received by filter / 0 dropped by kernel`) beside the packet list; a block-aligned file size is evidence you are mid-flush. For any filtered dump, either carry a positive control the filter MUST match, or dump raw once and read the filter against the real field names — a filtered census that returns only its header has measured nothing.
6728:- **Ripe when:** now — both rules cost one extra command. · **Size:** procedure.
6729:
6730:### IR-119 — a control that only had to prove a ROUTE served a real directory; and a rig is not torn down until its last process is gone, whatever the analysis says
6731:
6732:- **Status:** OPEN, mechanisms recorded 2026-09-12 05:46Z (doyle) from hertz's unprompted self-disclosure. The security remedy is an OPERATOR item, filed on releases#304 comment **5643876746** (rotate the kitsubito self-hosted runner's registration credential); this entry carries only the reusable mechanisms.
6733:- **Instance.** The accepted-connection control for the W-2 packet capture was `python3 -m http.server 29472 --bind 0.0.0.0` with **cwd `/home/reavus`** — the self-hosted runner account's home — for **1 h 59 m 54 s**. The off-box bind was REQUIRED (the peer dialled from another machine); the working directory was the whole defect. An empty temp dir returns the identical HTTP 200 and proves exactly as much. `http.server` builds its index from `os.listdir` and filters nothing, so 20 dotfiles including the runner credential files were listed and fetchable; mode 0600 did not protect one of them, because the server ran AS that user. kitsubito's posture was separately verified as RSTing with **no** host filter (ufw inactive, nft input policy accept on both tables)…
6734:- **Mechanism.** A route control and a file server are the SAME COMMAND, so the cheapest way to answer "can the peer reach this port" silently publishes whatever directory the shell was sitting in, and the excess is invisible in the result — the 200 looks identical either way. Same family as a pattern-kill that matches its own ssh line: a tool doing more than the measurement asked for.
6735:- **Second mechanism, and it is why two hours passed rather than two minutes.** The author tore down the CAPTURE, named the outcome, and stopped — treating "the verdict is named" as "the leg is finished". **Naming an outcome is a milestone in the ANALYSIS, never in the RIG.** A rig is torn down when its last process is gone, and the artefact you are proud of is not the only thing you left running. Found only because a stale wake line replayed his own teardown list back to him two hours later.
6736:- **Rule.** (1) A control that proves a route binds an EMPTY throwaway directory, never a home, a repo or a working dir, and it goes down in the SAME breath as the capture it controls. (2) Every rig's teardown is a list of PROCESSES asserted gone against a live positive control, never a list of conclusions. (3) A teardown note written BEFORE a ruling does not license deleting the ruling's cited evidence: `/tmp/hz-cap.pcap` and `/tmp/hz-cap.log` were KEPT by ruling, twice, because they are the primary record of a posted verdict.
6737:- **Evidence quality worth copying.** The window was MEASURED (1 h 59 m 54 s), not estimated; the served-request record was complete (2 requests, both ours, `GET /`, no descent, no file fetch) and its LIMIT was stated rather than implied — a server log is evidence about requests SERVED, never about the network. An independent wire instrument (the pcap, 0 dropped by kernel) covered **4.4%** of the window, and that figure is the capture PROCESS LIFETIME: reading the 2.08 s packet span as the coverage would have understated the evidence 150-fold, because a running capture with no packets is still observing.
6738:- **Kin:** [[IR-116]] (assert the post-state, never an echo), [[IR-118]] (an instrument complete about what it measures and silent about the rest), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry.
6739:- **Ripe when:** now — both rules are one line each in any rig. · **Size:** procedure.
6740:
6741:### IR-120 — a claim named for the one axis nobody varied: six readings over two routes and two libraries, all on ONE box, reported as a property of the platform
6742:
6743:- **Status:** OPEN, mechanism recorded 2026-09-12 05:47Z (doyle); the instance is liam's, refuted by hertz's own arm and conceded by its author.
6744:- **Instance.** The ~2.05 s Windows refused-connect latency was filed as "the WINDOWS refusal latency" on six readings that varied ROUTE (loopback, LAN hop to Linux) and LIBRARY (curl, .NET TcpClient) and held HOST constant — every one on HFENDULEAM. Route- and library-independence were measured; "Windows" was the name of the box. A per-host WFP callout, endpoint agent or filter driver swallowing RSTs would have produced exactly those six readings on exactly those two routes and generalised nothing. Settled only by going to get the missing axis: a second Windows box (Win10 19045 against the first's Win11 26200) read 2077.3 ms, inside 30 ms of the band. The claim survived; it was not ENTITLED to until then.
6745:- **The control the claim also lacked.** Nothing in the record distinguished "Windows pays 2 s" from "TCP to a closed port costs 2 s" or "curl reports refusals slowly" — because every reading was Windows, the word could not be earned from them, only assumed for want of an alternative. The Linux arm supplied it: closed port and open port within **66 microseconds** of each other on the same libraries, so the refusal costs ~0 there and cannot be told from an open port by latency at all. With that control "Windows" is measured; without it, it was a label.
6746:- **Mechanism.** Breadth along the axes you happened to vary reads as generality. The check is cheap and nobody runs it: write the claim's subject noun, ask which axis that noun names, then ask whether that axis was varied. Second instance from the same author in one night (a PowerShell-edition confound priced as the product's cost), and a sibling shape in the same leg: "the box was quiet" inferred from the absence of ANNOUNCED work, when silence is exactly what an unannounced three-minute recursive grep produces — quiet was never measured for that window either.
6747:- **Rule.** A claim names its population and its varied axes in the same sentence, and the axis in the claim's NOUN must be one of the varied ones. One host is a host, not a platform; one edition is an edition, not a cost. A quantity claimed as a property of a class carries a NEGATIVE CONTROL from outside that class, or it is a label. Corollary already ruled: a constant measured only on our boxes does not enter product code as a threshold — see [[IR-117]].
6748:- **Kin:** memory verified-members-are-not-an-enumerated-population, one-sample-is-not-a-negative, tool-claim-must-name-its-environment, absence-needs-sibling-probe, windows-client-refused-connect-costs-2s.
6749:- **Ripe when:** now — it is a sentence-shape check at authoring time. · **Size:** procedure.
6750:
6751:### IR-121 — one declaration command expands every right-hand side before assigning any name, so a dependent id silently binds the CALLER'S GLOBAL and two arms collapse onto one artifact path; and `cat -A` behind msys `sed` is not a byte reader
6752:
6753:- **Status:** OPEN, mechanisms recorded 2026-09-12 09:05Z. Instance 1 found by hertz in todlando's driver and confirmed by doyle; repaired as a separately pinned revision (v6 `dcfb732a…` → v7 `927eafb9…`) per the standing rule that a demonstrated execution incompatibility gets a new hash and renewed verification rather than an in-place accommodation. Instance 2 is todlando's own, found while reading the repair site.
6754:- **Instance 1 — the id that looked right.** `trial()` opened with `local arm="$1" n="$2" id="$arm-$n"`. A single declaration command expands EVERY right-hand side before assigning any of its names, so `$arm` was still unset when `id` was built — but `$n` was **not** empty, because the caller is `for n in 1 2 3; do trial a "$n"; done` and `n` is a GLOBAL at that point. The id therefore read `-1`, not the empty-ish `-` that would have been noticed: a plausible, consistently-formed, wrong identity. Both arms produced `-1,-2,-3`, so every per-trial artifact keyed on id — captures, stop captures, census tags, portfields snapshots, cpu brackets — collided, and **Arm B overwrote Arm A in place** with nothing downstream able to tell them apart. `arm` itself was cor…
6755:- **The audit the one fix does not discharge.** A predicate was written over the whole delivered set — any `local`/`declare`/`typeset`/`export`/`readonly` whose later right-hand side references a name assigned earlier in the SAME command — with a positive control broken on purpose (plain `local`, `declare`, and the `${name}` brace form: 3 arms) and a negative control of the same declarations split (0 hits). v6 = 2 hits, both that one line; v7 = 0; v5 = the same single site. Stated over-report: the predicate does not split on `;`, so two correct statements on one physical line read as a dependency — the real site was confirmed not to be that shape. The PowerShell and Python helpers got their own predicates (zero multi-target assignments across four `.ps1`, pr…
6756:- **Instance 2 — the byte reader that was not one.** The repair site was first read with `sed -n '869,880p' file | cat -A`, which printed `$` at every line end — i.e. LF. The file is CRLF throughout (measured: 1117 CR = 1117 LF = 1117 CRLF). msys `sed` reads in text mode and drops the CRs, so `cat -A` faithfully rendered bytes that `sed` had already removed. The project's own rule ("after any scripted edit, verify the BYTES") was followed and still defeated, because the verification ran downstream of a text-mode filter.
6757:- **Third consequence of instance 1, and the worse half of it (hertz, measured independently; re-measured here).** The bad id does not only collide the arms — it begins with a DASH, so every artifact is named `-1.out`, `-2.err`, `-1.stop.out`. Measured in a throwaway dir: `sha256sum *.out` over such a population exits 1 with `unknown option -- 1` and hashes NOTHING (control: the same command over `a-1.out` alone exits 0 and hashes it); `grep -c x -1.out` exits 2 having measured nothing; `sha256sum ./*.out` is the repair. That is the LOUD form. The dangerous form is the one hertz's own detector took: it returned a clean EMPTY snapshot — "0 artifacts altered" — in the arm that was supposed to be red, because its glob handed the dashes to a tool that consumed t…
6758:- **Mechanism.** Both are a wrong answer with no error: a declaration whose dependency is satisfied by an unrelated variable that happens to exist, and a byte census whose bytes were filtered before they were counted. Neither is detectable from its own output — the id is well-formed, the `cat -A` dump is honest about what reached it.
6759:- **Fourth instance, in the very commit that recorded this entry (todlando, self-reported).** The amendment above was applied with a Python text-mode read (`open(p).read()`, universal newlines) and written back with `newline='
6760:'`. This register carried **two lone CR bytes** - `
6761:
6762:- **Instances 9-11` and `
6763:
6764:- **Addendum 2026-09-12 03:20Z` - present since at least `7cdcf5da`. Universal newlines translated each bare CR into a newline, so the commit silently rewrote two lines belonging to OTHER entries (net: 2 stray CRs removed, 2 blank lines added; markdown-harmless, still undeclared). Caught by reading the commit's own diff rather than trusting the insertion count: a one-bullet append that reports **5 insertions, 2 deletions** is telling you it touched something else. A text-mode read is a WRITE hazard, not only a measurement hazard - edit a file whose byte shape you have not measured in binary, and review the diff, never the intent.
6765:- **Rule.** (1) A declaration that depends on a name is its OWN statement; never share a `local` with the name it reads. (2) Derive an identity used as an artifact key ONLY after its parts are assigned, and guard it against its expected shape — a key that can go wrong silently overwrites evidence rather than failing. (3) A negative control for an id scheme must carry the caller's real variable environment: with the caller's global `n` absent, this defect reads as the harmless `-` and is easy to dismiss. (4) Read bytes with a byte reader — `python3` on the raw file, or `od`/`xxd` — never through msys `sed`, `grep`, or any text-mode filter; if a CR/LF count is the claim, count CR and LF bytes and state both.
6766:- **Kin:** [[IR-118]] (a complete-looking wrong answer from an instrument that succeeded), memory count-predicate-needs-its-own-positive-control, make-a-new-rig-red-on-purpose, scripted-edit-zero-match-refusal, render-not-read-pipefail, windows-firewall-census-clean-zeros.
6767:- **Ripe when:** now — (1) and (4) are habits, (2) is three lines in any rig. · **Size:** procedure.
6768:
6769:### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released
6770:
6771:- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**
6772:- **The refusal.** `DAEMON_STOP_REFUSED: a broker-stopping command is never run by an spt endpoint ($OWL_SESSION_ID is set). ... No flag overrides this, --force included.` The guard keys on the CALLER'S SESSION ENV, so it fires identically no matter which rig step reaches it and no matter what `SPT_HOME` the command targets.
6773:- **Not a new fault, and not an accident.** `readiness-r4-as-read.md:107-109` already states it: v9 DELIBERATELY leaves `OWL_SESSION_ID` set, the refusal is expected to recur, and it is "reported, never worked around silently." The rig chooses a loud known refusal over an unproven workaround — that choice is right, and it is the reason this entry is about the leftover, not about the refusal.
6774:- **What it actually costs.** Cleanup completes with `steps_failed=1` and the isolated daemon SURVIVES. Measured in instance 2: supervisor `daemon run --detached` and its child `daemon brain --generation 0 --start-reason cold`, born 331 ms apart, both executing `<worktree>/target/release/spt.exe`. They hold the SUBJECT exe open inside a pool `pool_release` has already returned, so the next build into that pool can fail on a locked `spt.exe` — a red belonging to neither lane. See memory [[live-agents-lock-target-debug-spt-exe]], [[shared-target-two-live-trees]].
6775:- **The counterfactual the refusal does NOT license (doyle, correcting hertz in this instance).** That the guard refused does not prove the isolated-target command *would have* stopped the resident broker. The guard reads the env, not the routing; establishing what the command would have reached needs routing evidence nobody has gathered. State the refusal, never the averted disaster.
6776:- **Disposal, and it is the same four-field procedure both times** (`readiness-r4-as-read.md:110-118`): identify on pid, `CreationDate`, exact `ExecutablePath` and `CommandLine` — a bare pid match is unsound because pid reuse on this box is measured, see [[pid-reuse-across-reboot]]. The supervisor must still equal `<isolated-home>/daemon.pid`, and the brain's parent must be that supervisor. Then a fresh authorization NAMING THE NEW PIDS (the prior one is pid-specific and spent), supervisor first so the brain cannot respawn, `Stop-Process -Id` alone — never a tree kill, an image-name kill, or any action against the resident node daemon, which is a DIFFERENT binary under `AppData\Local\spt-core\bin\`. Post-state ASSERTED, not announced, or it is [[watchdog-rep…
6777:- **Mechanism.** A cleanup step that is structurally unrunnable in the environment the rig always runs in. It cannot be fixed by retrying, it never fails loudly enough to block the run, and its residue lands in a shared build pool rather than in the run's own directory — so the cost is paid by whoever builds next, not by the run that caused it.
6778:- **Rule (scoped by doyle 2026-09-12 — a bare pid-file kill is NOT approved as sufficient).** A rig that starts a daemon owns stopping it by a route that works from the rig's own environment, and `<isolated-home>/daemon.pid` is the pid SOURCE, never the authorization. Any rig cleanup that terminates a process must, at the moment of acting: re-read creation time, exact `ExecutablePath`, `CommandLine` and isolated-home association FRESH; confirm the supervisor still equals the pid file and the brain's parent is that supervisor; stop SUPERVISOR-FIRST so no child respawns; and report failure EXPLICITLY rather than escalating scope. Any mismatch or unreadable identity STOPS the action. No PID-only automation and no product-guard bypass is approved. A cleanup step…
6779:- **Kin:** [[IR-42]] (pool enforcement speaks at the next build, not at claim time), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry, e2e-leaked-daemons-shared-box, no-machinewide-killon-shared-runner.
6780:- **Ripe when:** before the next field run. NOT a one-line change: the stop route is small, but the identity re-verification, supervisor-first ordering and explicit failure reporting above are part of the fix and are what make it safe. · **Size:** small.
6781:
6782:### IR-123 — a helper that LOGS cannot also RETURN through stdout: `record` tees, so `face=$(face_report ...)` captures the log block and the acceptance gate can never pass
6783:
6784:- **Status:** OPEN, mechanism recorded 2026-09-13 (hertz, found by exercising the D2 successor; confirmed by doyle from a direct source read of frozen r10). **Frozen r10 is PRESERVED as-is**; the return channel is corrected in its successor only.
6785:- **Instance.** `record()` is `echo "$1" | tee -a "$R/findings.txt"` — it writes to the log AND to stdout, deliberately, so a live operator sees the run. `face_report()` calls `record` twice (a FACE_COUNTS line and a FACE= line) and then `echo`es the face as its return value. The single caller reads it as `setup_face=$(face_report "$SETUP_OUT" "$SETUP_ERR" "SETUP" bootstrap)`, so the captured value is **the whole tee'd log block with the face appended**, and `[ "$setup_face" != reconciled ]` is true no matter what the product printed. The Arm-B acceptance gate — rc 0 AND face reconciled AND pair written, all three required — is therefore **unpassable on the ACCEPTED path**.
6786:- **Why no rig run caught it.** The stub cases that reached this line were REFUSALS, whose expected outcome is exactly the branch the defect forces (exit 3, Arm B held). A gate that always refuses looks identical to a gate that correctly refused a refusal. The accepted path had no arm at all until the D2 successor's control ran one with `LAN_FIREWALL_RECONCILED`, exit 0 and a pair measured present — see memory `setup-suppresses-failing-arm`.
6787:- **The same shape, twice more, in the successor's own new code** (both caught by the same control, both mine): `D2_T1_VALID=$(d2_validate_at t1)` captured the validator's tee'd log ahead of its verdict; and `local point="$1" doc="$R/d2-$point.json"` rebuilt [[IR-121]]'s declaration-ordering defect, so three documents present on disk all read `NO_DOCUMENT`. The precedent for the fix was already in the same file: r10's own `handoff_request` comment records that `spec=$(handoff_request ...)` was broken by exactly this tee and was repaired by setting parent globals and returning nothing on stdout.
6788:- **Scope of what this does and does not invalidate (doyle).** It does NOT invalidate r10's observed product refusal: the named rule reported `[5, 20]` and positive reconciliation was independently absent. It DOES invalidate any claim that the frozen rig could have admitted a successful setup — that path was never reachable.
6789:- **Mechanism.** A dual-purpose channel: the same stream carries human-readable logging and a machine-read value, so any helper that logs before returning hands its caller both. It fails silently and in the direction that looks conservative (a gate that refuses), which is why it survives review and why refusal-only exercises confirm it.
6790:- **Rule.** A function that calls `record` (or any logger that writes to stdout) **returns nothing on stdout**: it sets a named global, or writes its value to a file the caller reads. Every acceptance gate is exercised on BOTH paths — an accepting arm with real positive evidence and a refusing arm — because an acceptance test alone cannot distinguish a working gate from one that accepts everything, and a refusal test alone cannot distinguish a working gate from one that refuses everything.
6791:- **Kin:** [[IR-121]] (a wrong value with no error, same file), [[IR-118]], memory setup-suppresses-failing-arm, make-a-new-rig-red-on-purpose, every-return-arm-is-a-copy, zero-match-filter-reads-as-absent.
6792:- **Ripe when:** now — the successor already carries the fix at its call sites and in its own helper; the register entry is the part that outlives this lane. · **Size:** procedure.
6793:
6794:### IR-124 — a cleanup that runs `serve lan --stop` UNCONDITIONALLY creates the daemon it exists to remove, when the setup it is cleaning up after never ran
6795:
6796:- **Status:** OPEN, measured once in the field. D2 field run `20260913T041410Z`, driver `2e3aec1b`, recorded by hertz 2026-09-13 at doyle's direction. Archive `.spt/preserved/hertz-fp-driver-review/d2/field-run-20260913T041410Z/` (72 files, manifest `defa5d29…`). **This is a RIG defect. It is mine — I wrote the driver — and doyle's admission review missed the unconditional stop path as well; both are recorded because a review that misses a path is part of the mechanism, not an aside.**
6797:- **Instance.** The elevated setup was **DECLINED and NOT STARTED** by liam at 04:18:55Z — measured, unambiguous, and the right call: his leg was ready at 04:18:35Z against a hard 04:19:10Z expiry and he refused rather than race the teardown. Nothing ran, nothing mutated. The driver then entered cleanup and executed its own unconditional `env SPT_INSTALL_NO_FIREWALL=1 SPT_HOME=<isolated-home> <exe> serve lan --stop`, which dispatched through the daemon (`ensure_running`, `serveverb.rs:191`) and **CREATED** a supervisor (`daemon run --detached`, Windows PID 45944, `04:19:18.0312050Z`) and a brain (`daemon brain --generation 0 --start-reason cold`, PID 22524, `04:19:19.7696380Z`, parent 45944). `fp-home-d2`, measured ABSENT at the 04:13:58Z at-launch recheck, …
6798:- **Why the hold could not stop it.** doyle held the elevated teardown for exactly this reason and liam held all commands. But this stop is **internal to the running driver**, not a handoff, so no authorization gate reached it: the only levers were killing the driver or editing a running script, and both are forbidden. **A guard that only governs dispatched work does not govern a step the subject performs itself.**
6799:- **The pre-dispatch markers named the mechanism and did not prevent it.** `daemon_may_run — serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running` was set BEFORE the setup was requested. The driver correctly refused to infer absence from its own expectation — and then triggered the very mechanism the marker warned about, from the cleanup path, on the branch where the warning did not apply.
6800:- **Three things kept apart, because collapsing any two misstates the run.** (1) Liam's testimony: NOT_STARTED, no mutation — still true, he created none of it. (2) The driver's conservative verdict: `CLEANUP=PENDING`, `residual_state=UNREADABLE`, `residue=UNMEASURED` — an honest refusal to claim clean, not a contradiction of liam. (3) An **actually observed** residual, created by the driver itself. That third thing is a measurement; the first two are testimony and abstention.
6801:- **Mechanism.** A teardown verb that is also a *start* verb. `serve lan --stop` must reach the daemon to ask it to stop, so invoking it when no daemon exists starts one. Cleanup paths are written for the case where setup succeeded, and are reached on every path including the ones where setup never happened; the branch nobody exercises is the branch where cleanup has nothing to clean.
6802:- **Rule.** A cleanup step whose command can CREATE the resource it removes must be **conditional on evidence that the resource exists** — not on the state markers, which say "may exist" by design, and not on the fact that cleanup was entered. Where the existence check is itself unavailable, the step is SKIPPED and reported as skipped, because an unnecessary teardown that spawns is strictly worse than a labelled gap. Exercise every cleanup path from the **setup-never-ran** state, not only from the setup-succeeded state.
6803:- **Kin:** [[IR-122]] (the other half: the stop that *cannot* run leaves a daemon; this is the stop that *should not* run and makes one), memory setup-suppresses-failing-arm, gate-against-documented-design, remedy-must-run-from-refusal-state.
6804:- **Ripe when:** before any repeat field run — a repeat under this driver reproduces the residue. · **Size:** small.
6805:
6806:### IR-125 — the driver's own executable sweep reported ZERO processes on the pinned exe while `Win32_Process` showed TWO, at the same instant
6807:
6808:- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). **A FALSE-NEGATIVE SWEEP, not a false CLEAR** (doyle's classification, and the distinction is load-bearing): the ledger's actual verdict was `residual_state=UNREADABLE` / `CLEANUP=PENDING`, which was correct, and the sweep line is explicitly labelled evidence-only in the driver's own output.
6809:- **Instance.** `SUBJECT_EXE_PROBE=OK running_the_pinned_executable=0 enum_total=618` — the probe enumerated 618 processes and concluded none was running the pinned executable. A `Win32_Process` read moments later returned **two**, both with `ExecutablePath` exactly `…\.worktrees\304-w2-repr\target\release\spt.exe`: PIDs 45944 and 22524. An independent sweep by path, not by pid, agreed: `count=2`.
6810:- **Why it matters despite being labelled evidence-only.** The line reads as a clean box to anyone skimming, and it is the only line in the run that speaks to "is anything of ours still running" in plain terms. It was contradicted only because a native read was performed for a different reason. Had the ledger's verdict logic depended on it, this is a false CLEAR.
6811:- **Candidate cause, NOT diagnosed** (deferred by doyle until cleanup was complete, and still open): the probe's raw path comparison. The Win32 `ExecutablePath` is backslashed Windows form; the driver's pinned `$EXE` is forward-slashed msys-friendly form. A literal comparison between those two spellings of the same file fails for every process. **Unconfirmed** — it is a candidate because it fits, not because it has been measured.
6812:- **Mechanism.** A predicate that can only ever return "no" reports a clean zero over a large, healthy-looking enumeration. `enum_total=618` is what makes it convincing: the instrument demonstrably ran and demonstrably saw the machine, and still could not see the thing it was looking for. Same family as the two other instrument-versus-reality mismatches in this lane, and all three were invisible to stubs.
6813:- **Rule.** A sweep that reports zero carries its own **positive control** — in the same run, the same predicate must find something known present, or the zero is UNMEASURED rather than absent. Where a predicate compares paths across the msys/Windows boundary, normalise both sides and prove the normalisation on a known-matching pair; never compare two spellings of a path and call a non-match an absence.
6814:- **Kin:** memory count-predicate-needs-its-own-positive-control, zero-match-filter-reads-as-absent, windows-firewall-census-clean-zeros, verdict-from-probe-competence, [[IR-118]].
6815:- **Ripe when:** with IR-124, before a repeat field run. · **Size:** small.
6816:
6817:### IR-126 — the experimental budget CONTAINED its own read-only preflight, leaving 128 s of a 300 s window for the elevated leg, and the leg was correctly declined
6818:
6819:- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). Boundary NOT moved for that run — doyle refused the change mid-flight and was right to; this entry is the scheduling review he asked to be preserved.
6820:- **Measured, from the run's own timestamps.** Run start `04:14:10Z` · pre-setup absence census `04:16:23Z` · handoff request written `04:17:02Z`. So **172 s of the 300 s experimental budget went to in-budget read-only preflight** — CI axis queried by name across five statuses, ancestry census, six-instrument hashing, subject identity, 5470 guard baseline, pre-setup absence census — and the driver printed the remainder itself: `HANDOFF_WAIT bounded to 128s`.
6821:- **The consequence, and it is not hypothetical.** Liam's leg script was ready at `04:18:35Z`. Setup alone had measured ~9 s, plus four PowerShell stamps, plus a t1 capture of unmeasured duration, against 35 s of remaining clock. He DECLINED without mutation, which was the correct call and the one the instruction asked for. **The window was consumed before the work it existed for could start.**
6822:- **Two overruns recorded beside it, as observations and not as permissions.** Experimental activity ended at **306 s of the 300 s budget** (the deadline exits through the EXIT trap, so cleanup is never skipped, but the boundary was crossed). The driver was still running after its 180 s cleanup reporting bound had elapsed; it exited by `04:23:54Z`. Neither overrun was authorised, taken as an extension, or used to do more work.
6823:- **Mechanism.** A budget defined from process start, over a phase order that puts every read-only admission check inside it, gives the elevated leg whatever is left rather than what it needs. The preflight cost is not waste — those checks are why the run was admissible — but charging them to the same clock makes the window's usable size an accident of how slow the host's firewall enumeration is that minute.
6824:- **Rule.** Bound the ELEVATED LEG on its own clock, sized from its measured duration, and start it when the leg is dispatched. Admission checks get a separate bound. A driver that cannot guarantee a usable handoff window should REFUSE TO DISPATCH rather than dispatch a leg that cannot finish — an operator declining at the deadline is the correct outcome of a wrong window, not a failure of the operator.
6825:- **Kin:** [[IR-122]], memory your-cadence-can-be-the-blocker, reap-step-duration-is-not-the-window, twohost-run-window-discipline.
6826:- **Ripe when:** with IR-124 — a repeat field run under the current budget shape reproduces the squeeze. · **Size:** small.
6827:
6828:### IR-127 — a nested value-type assignment can leave the native job limit unset while the instrument logs the requested flag and a successful setter
6829:
6830:- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.
6831:- **Instance.** The containment probe assigned `$info.BasicLimitInformation.LimitFlags = 0x2000`, logged the requested KILL_ON_JOB_CLOSE flag and `SetInformationJobObject=True`, read both owned processes as job members, closed the handle, and found both still alive. The nested field is a struct: PowerShell changed a copy, not the value subsequently marshalled. The offline discriminator measured `nested_assignment_flags=0`; modifying the nested value and assigning the whole value back measured `whole_value_assignment_flags=8192`.
6832:- **Correction and evidence.** The corrected probe assigns the whole nested value, calls `QueryInformationJobObject`, and refuses unless the kernel's flags equal the requested flags. Readback `0x2000` then preceded both members being measured GONE after close. Initial invalid arm and corrected measurement are preserved separately under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/` (`M3/` and `instrument-repair-20260913T104354Z/M3/`); the latter's `results.txt` carries the offline discriminator.
6833:- **Rule.** Mutating a nested interop value requires assigning that value back to its owner. Successful native setters establish only that the submitted value was accepted: read the effective configuration back and compare it before granting the operation authority. Requested flags are not observed flags.
6834:- **Kin:** [[IR-116]] (a successful call is not a post-state), [[IR-118]] (a complete-looking wrong answer).
6835:- **Ripe when:** any PowerShell/native configuration probe is authored or changed. **Size:** whole-value assignment plus checked native readback; retain the positive and negative discriminator.
6836:
6837:### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached
6838:
6839:- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.
6840:- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.
6841:- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.
6842:- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.
6843:- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.
6844:- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).
6845:- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.
6846:
6847:### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict
6848:
6849:- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.
6850:- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.
6851:- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.
6852:- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.
6853:- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.
6854:- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).
6855:- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.
6856:
6857:### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached
6858:
6859:- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.
6860:- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.
6861:- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.
6862:- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.
6863:- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.
6864:- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).
6865:- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.
6866:
6867:### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists
6868:
6869:- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.
6870:- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.
6871:- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.
6872:- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.
6873:- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.
6874:- **Scrub qualification.** The fresh-child receipt recorded `before_names=["SPT_ENDPOINT_ID","SPT_RELEASE_SEED"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.
6875:- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).
6876:- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.
6877:
6878:### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission
6879:
6880:- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.
6881:- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.
6882:- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.
6883:- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.
6884:- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.
6885:- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.
6886:- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).
6887:- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.
6888:
6889:### IR-133 — a live capture cannot be read with read-only sharing, and daemon stderr belongs to the owned home
6890:
6891:- **Status:** Corrected in the r9 rig instrument; genuine fifth-window promotion completed with exit **0**, owned shutdown and final provenance. The subsequent field attempt failed its separate setup-handoff deadline, not this promotion read. Fourth #297 preparation measured by hertz on 2026-09-14; sharing failure localized by doyle in `R2VK8FQN`, run-identity binding ruled in `ANR522S5`, successor accepted in `GV3R6QUV`.
6892:- **Instance.** Fourteen admission leaves and genuine staging passed. The candidate applied daemonlessly, transitioned `applied-pending` → `applied`, brought up broker **14704** and brain **45220**, published the pinned generation-zero readiness record and emitted `BRAIN_PROMOTED` before the instrument stopped its owned job. The instrument returned only `OWNED_PROMOTION_READINESS_FAILED`. Six provisioning/promotion native jobs ended `CONFIRMED_GONE`, active counts zero; all nineteen signing-private files were absent. No field, GO or D3 occurred. Original receipt: `.spt/preserved/hertz-fp-driver-review/d2/W8TQ3MZC-FINAL-REFUSAL.json`.
6893:- **Mechanism.** The loop used `File.ReadAllText` on a capture held open for **Write**, with **Read** sharing, by the run-scoped launcher. Windows checks sharing in both directions: the new reader's default **Read** sharing excludes the existing writer, causing `IOException`, `0x80070020`. A completed step hid this defect because its writer had already closed. Changing only the writer's sharing does not repair the reader.
6894:- **Wrong source behind the exception.** The launcher's stderr capture was zero bytes; the daemon redirects stderr to `SPT_HOME/logs/daemon.stderr.log`. Reading the empty capture with compatible sharing would merely reach the later marker timeout. Read the actual owned-home log with `FileStream(Open, Read, FileShare.ReadWrite | FileShare.Delete)`, matching the existing native launcher's `ReadText` pattern; release each read handle before the next poll.
6895:- **Run binding.** A promotion marker counts only after the exact brain header naming the measured membership PID and readiness generation, and before another process header. Markers before that header, without it, or under another PID/generation refuse. A rolled `.1` can contribute only when absent before this owned launch and appearing during it, with the same header binding; preexisting backups cannot prove this run.
6896:- **Failure evidence.** Attach the instrument's constant assertion name and call-site line to its exception. Before cleanup can replace the active error, retain that name, source line, exception type and HResult. Non-assert exceptions have a null assertion name. Never serialize exception messages or environment values.
6897:- **Qualification.** Thirteen controls passed against `provision-promote-R2VK8FQN.ps1`: a live-held writer reproduces `0x80070020` with `ReadAllText`, the shared reader returns its exact bytes while the writer remains open, header/PID/generation/ordering and rolled-history boundaries refuse stale evidence, the actual rollback guard still refuses, and diagnostics omit a message canary. Proof: `R2VK8FQN-live-held-controls/result.json` beneath the receipt directory. No product invocations, rig mutations or fleet terminations.
6898:- **Live verification.** `provision-R2VK8FQN/promotion-complete.json` records `PROMOTION_COMPLETE`; the supervised promotion exited **0** after **12.9 s**. The real candidate passed the shared-log, PID/generation marker, final membership, durable-state and owned-shutdown checks. Its later field ledger remains a separate failed observation contract; successful provisioning does not turn that ledger green.
6899:- **Kin:** [[IR-132]] (instrument census refusal), [[IR-130]] and [[IR-131]] (phase labels lose the failing predicate). **Ripe when:** polling any live writer or accepting logs as run-specific evidence.
6900:
6901:### IR-134 — request latency consumes the elevated capture's execution budget, then a late terminal receipt leaves completed work unmeasured
6902:
6903:- **Status:** Instrument correction qualified without a sixth field window. Doyle accepted the execution-clock repair in principle under `HHDKCRH5`, then identified its still-insufficient receipt budget; the derived-window successor follows ruling `P9RLK4VU` and accepted arithmetic `KZG4IN37`. Candidate/packet/nonce/driver/runner repinning remains one future amendment, separate from field authorization. Fifth #297 field run `20260914T063552Z` remains failed and immutable. Its candidate's independent **PRODUCT RED** finding (`M5XKQ2DN`) is unchanged.
6904:- **Measured sequence.** Setup request `06:41:26Z`, elevated setup `06:43:18Z`–`06:43:24Z`, refused capture launcher `06:43:25Z`–`06:43:26Z`, receipt about `06:43:27Z`. The driver had written the capture deadline from request time: 112 seconds of handoff delay left the launcher's `deadline - now - 5` allocation at **−4 seconds**. No native t1 capture ran. The handoff expired before the receipt; cleanup reread its nonce and exit but retained the earlier `timestamp_order=UNMEASURED`, withholding mutation despite subsequently available terminal stamps.
6905:- **Clock correction.** The executor initializes `setup-start.utc`, `elevated-leg-start.epoch` and `d2-t1.deadline` immediately before `run_exactly`, from one UTC observation, with **CreateNew** writes. The independent allocation is **120 seconds**: the existing 90-second capture ceiling, 9 measured seconds around a refused capture, 5-second termination reserve and 16-second margin. Nine seconds is not a measurement of a successful capture. PREPARE initializes nothing; notification latency consumes only the separately bounded handoff. No preparation or activity window is reset or extended.
6906:- **Terminal evidence correction.** On handoff expiry, cleanup makes one final nonce/exit observation and, if terminal, rereads the six stamps before deciding whether completion is proven. A late observation preserves `handoff_wait=EXPIRED` and the original timeout exit separately from `setup_terminal_exit`; it never resumes activity or treats lateness as timely acceptance. Missing, duplicate or wrong nonce evidence and missing or reversed stamps remain unproven. An exceeded leg clock refuses the capture contract independently of terminal completion.
6907:- **No-field proof.** `.spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/` preserves the actual extracted predecessor/successor predicates, emitted PowerShell initializer, nine receipt/product controls, five clock/ledger controls and clock results. The predecessor retained UNMEASURED after receipt publication; the successor recovered ordered completion without overwriting timeout. The actual initializer refused a second initialization without changing any clock bytes. With the measured 112-second notification delay and capture at leg-start +7, the old allocation is −4 seconds and the new allocation is 90 seconds. No product, firewall, signing or field operation was invoked.
6908:- **The outer-clock blocker, not fixed by the inner clock.** A receipt follows execution: **112 + 120 = 232 seconds** cannot fit the retained 120-second setup handoff. Keeping a 300-second activity window and refusing every GO would be a correct refusal of the wrong shape, not an executable field design. `P9RLK4VU` therefore re-derives future activity as **630 seconds**: pre-dispatch **74** (54 observed +20 margin), setup handoff **240** (112 latency +120 leg +8 margin), post-receipt probes **200**, t2 **100**, final transition **16**. Only setup supersedes the prior 120-second handoff cap; other handoffs retain it.
6909:- **Measured basis and explicit allowance.** The fifth timeline records portfields calls at up to **45 seconds**, census **46 seconds**, and t3 **25 seconds**; the earlier `20260913T041410Z` capture also took 25 seconds. Two analogous portfields calls plus census give **136 seconds**; another **64 seconds** is a labelled allowance for identity capture, D1 and bookkeeping, not a claimed complete post-receipt measurement. T2 receives a **90-second native ceiling**, **5-second launcher reporting reserve** and **5-second shell/reporting margin**. The post-receipt probe deadline cannot spend t2's allocation; t2 cannot spend the final transition reserve.
6910:- **Derived-window controls.** `P9RLK4VU-controls/result.json` records **16 passing controls**, executing extracted real Bash predicates and the wait loop against a virtual wall clock. The complete 630-second window and the measured 54-second pre-dispatch cost pass; 555 seconds remaining fails against the 556-second dispatch requirement, while 556 fits. The actual gate refuses before GO/mutation markers. A receipt after 112-second latency plus 120-second execution fits the new setup allowance; PREPARE and cleanup retain their 120-second caps. Published request and phase deadlines still truncate waits. Preparation remains **600 seconds** and cleanup remains **180 seconds including its 30-second ledger reserve**; an observation deadline cannot override cleanup…
6911:- **Separate product finding.** Candidate `b8482445` logged one `verify-query` completed at **2650 ms**, followed by a second pre-write snapshot killed at **3027 ms** under its **3000 ms** budget; no reconcile-write ran. The budget **starts before spawn and includes output collection** (`run_ps_inner`, source timing supplied by doyle in `IRXYIJHS`); spawn is not outside this clock. The successor ledger records this query kill separately from handoff/capture failure. Fifth-window cleanup was subsequently closed on existing measurements as **NOTHING_TO_REMOVE**; its original PENDING ledger was not rewritten.
6912:- **Kin:** [[IR-126]] (execution receives leftover scheduling time), [[IR-124]] (cleanup must not race unproven setup). **Rule:** measure execution from execution, preserve timeout and late completion as separate facts, and do not let an instrumentation repair erase a product failure.
6913:
6914:### IR-135 — checker pin and runner installation can disagree, and the repair path disguises that version mismatch as an authentication failure
6915:
6916:- **Status:** CI precheck remedy implemented in the IR-135 lane; workflow execution awaits integration. Measured by doyle in S4 golden `34946493637`, 2026-09-15; filed by hertz from `3HHHPWCR`. The immediate box mismatch was repaired by hand-install.
6917:- **Instance and mechanism.** The #304 candidate carried `71caedd4`, setting `WANT=0.4.1` in `golden.yml`/`ci.yml`, while kitsubito's `~/.local/bin/traceable-reqs` was **0.2.0**. The install step's mismatch path attempted a private clone without a provisioned `TRACEABLE_REQS_TOKEN` and exited **128 before any check**. The visible failure named authentication, not the wanted and installed versions. A checked-in pin is not evidence that the runner can supply it; the fallback requires a second, independently missing prerequisite.
6918:- **Implemented remedy (QD54OM7S).** Both workflows run an explicit pin/runner precheck and use `.github/ci/traceable-reqs.sh` as the single pin/install owner. It reports the actual version and native version exit; matching requires literal equality and exit zero. A mismatch without `TRACEABLE_REQS_TOKEN` refuses before clone/build, naming the version disagreement and missing credential separately. With a token present, source repair remains available and native clone failure is preserved; token presence never claims access. The installed version is checked before coverage. On kitsubito, eight isolated shell controls passed: matching precheck/install without a token, stale/missing/failing/lookalike versions refused, authenticated repair admission, and clone …
6919:- **Kin:** [[IR-104]] (the checker version changes what counts as evidence), [[IR-109]] (the #304 pin is already live). **Ripe when:** the next checker pin or golden-intake/install-step change. **Size:** a version diagnostic and intake assertion; credential provisioning is separate operator work.
6920:
6921:### IR-136 — a broker bound under the seed socket's name is not seed control, so a URL-minting rig can omit the very listener contract the product queries
6922:
6923:- **Status:** Instance fixed in S5 **`ddd7fc7f070667524578c282894dd44a2e36062f`**, test-only atop S4; S5 golden34957614641 passed, including both twohost roles. Shared fixture-composition remedy implemented and Linux-verified in the IR-136 lane. Origin: doyle's S4 golden `34946493637` twohost helper red, 2026-09-15.
6924:- **Mechanism.** Role B hosted broker IPC under an invented name, with neither `seedmap::serve_seed_control` nor a docs listener. `REQ-WEB-URL-BOUND-PORT` requires `serve_for` to ask the canonical seed-control plane for `DocsStatus` before publishing a URL; the missing plane returned `DOCS_PORT_DISCOVERY_FAILED: Connection refused (os error 111)`. Merely renaming a Broker to `seed_socket_name()` does not provide that protocol: `serve_request` is dispatched by seed control, not Broker. The docs-server fixture had already encountered the same trap. The last green twohost run predated this bound-port contract.
6925:- **Discriminator and scope.** Todlando's unchanged-S4 Linux fixture failed at the exact discovery seam without seed control/listener (**native 101**) and returned `Registered` at the actual bound port **33319** when those fixtures were added (**native 0**); both arms retained the invented B broker name. Evidence: `.spt/preserved/304-web-helper-rca/linux/`. S5 gives B distinct canonical broker/seed sockets, real seed control, a broker-backed ephemeral docs listener, and a discovered-port equality precondition. Helper expectations stay unchanged. A's helper cell relays B's returned URL and does not query its own DocsStatus; its existing broker-on-seed-name path is not this failure. The seven unopted-in Windows passes do not exercise the role-gated twohost bod…
6926:<!-- [doc->REQ-SERVING-FIXTURE-CONTROL-PLANE] -->
6927:- **Shared remedy (P2Y2GWUP).** `crates/spt-daemon/tests/support/serving.rs` provides `ServingFixture`, included by both `docs_server_e2e` and `twohost_web` rather than exported as product surface. `start` composes the distinct canonical broker and real seed control, waits for seed readiness, binds broker-backed docs on port0, and asserts that seed-control `DocsStatus` returns that actual port. The caller supplies its private home, journal and optional NetHost; socket spelling is no longer a caller choice. `stop` stops and joins both IPC accept loops. The docs listener remains process-lifetime under the existing production interface, so tests require process-per-test isolation and one broker-backed listener per process.
6928:- **Negative-state coverage retained.** The docs fixture uses the separate `control` stage only to distinguish absent control (offline fallback permitted) from running control without a listener (fallback refused); its normal serving case uses the same complete constructor as role B. Role A's seed-named proxy Broker and the standalone docs-less listener remain intentionally separate: neither is the owner's URL-minting control plane. No default/configured port substitutes for discovery, and no production protocol changes.
6929:- **Shared-fixture proof (2026-09-15).** Kitsubito, private tree/target, jobs2: targeted clippy with `-D warnings` **0**; nextest, both migrated binaries, one test thread and zero retries **0**. All **3 docs cases** exercised their real bodies: absent-vs-unbound discovery, HTTP published-surface/security checks through the complete fixture, and the standalone docs-less pointer. The other **7 twohost cases** returned through their unopted role gate; these are compile coverage, not a new cross-host execution claim. Traceable0.4.1: **920complete/0findings**. Raw exits/output/hashes: `.spt/preserved/hertz-ir136-fixture/linux-v2/`; the initial wrapper PATH failure started no cargo and is preserved separately.
6930:- **Ripe when:** another URL-producing fixture is added. Use the shared complete constructor rather than rebuilding its three planes independently; use the partial stage only when missing-listener behavior is the test subject.
6931:
6932:### IR-137 — a redirected Start-Process child can share the tool call's console lifetime and die when that call returns
6933:
6934:- **Status:** RETIRED, 2026-09-15, doyle ruling `YPLFG3CG`: **no tracked callsite; discipline recorded + receipt**. This closes a Windows ad-hoc rig-craft item, not a CI or candidate defect; no helper or product change.
6935:- **Mechanism and rule.** `Start-Process` with redirected output from a PowerShell tool call was observed to end with **`STATUS_CONTROL_C_EXIT`** when the tool call ended: a returned child PID did not establish detachment. The reported detached form uses a **hidden window without redirects**. Where a child must outlive the call, qualify its survival after the caller returns and give it a durable output path of its own; do not treat process creation or a hidden window alone as lifetime evidence.
6936:- **Origin clarified (YPLFG3CG).** Claude Code PowerShell tool host, 2026-09-15T07:17Z, #304 S3 Windows attempt-2 launch A: redirected `Start-Process pwsh` PID47560; `rustc` exited `0xc000013a` seconds after the tool returned, driver receipt contained only its start line and no refusal file. The same driver relaunched with `-WindowStyle Hidden -PassThru` and no redirects (PID37536) ran25minutes to exit0. There is no tracked failing launcher to repair; the existing tracked g6 launcher already uses the reported good shape.
6937:- **Discipline and receipt.** [Windows ad-hoc rig launch discipline](GOLDEN-CI.md#windows-ad-hoc-rigs-that-outlive-the-tool-call) states the shape, child-owned durable output and post-return PID/birth/output qualification. Preserved harmless-child receipt: `.spt/preserved/hertz-ir137-caller-return/receipt.json`, SHA256 **`e1c9b207544e6313eac5421ebb692786ec18b3a165756b451bff3a704899b178`**. Both valid arms survived under **OMP**, wrote post-return events and exited0; an initial observer-handshake timeout is excluded. All3probe children ended and native handles closed. This does not reproduce the **Claude Code** failure; the host boundary stays explicit. Reopen only for a newly owned callsite or contrary evidence, not to build an unused helper.