{"type":"title","v":1,"title":"","updatedAt":"2026-09-22T01:14:10.331Z","pad":" "}
{"type":"session","version":3,"id":"01a0c6ad-701e-7000-8964-d1ca9c1d5391","timestamp":"2026-09-22T01:14:10.331Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"b604b36a","parentId":null,"timestamp":"2026-09-22T01:14:10.440Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"024ee61d","parentId":"b604b36a","timestamp":"2026-09-22T01:14:10.441Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"264a44c1","parentId":"024ee61d","timestamp":"2026-09-22T01:14:10.448Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n\n\n\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n\n\n\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n\n\n\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n\n\n§ Context\n# Goal\nH3 documentation-only census for Doyle: update IR-95 landed sync remedy b33aedca PR238, and register OTHER fixed-iteration polling bounds around brain IPC. Do not fix code.\n# Constraints\nRead-only research. Skip all formatters, linters, builds, tests and validation commands. Snapshot is current origin/main cd0e4216ef034955e4ea5fa38ede62f11acd1075, checked out in C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register. Use this tree, not moving main. Never inspect agent/context files beyond supplied rules. Main owns docs edits and CI receipts.\n# Contract\nReturn exhaustive scoped site table: repo-relative path, line of loop, containing function/test, bound spelling/count, sleep cadence, IPC operation, and whether cold-connect retry vs connected-brain RPC readiness poll. Include helper call chains (with explicit locations) where necessary. Distinguish adjacent non-Brain transport/file/process polls and fixed-count workload/assertion repetitions as EXCLUDED, not defects. Enumerate source/module boundaries covered and search predicates. No global blindness/rate claims; register sites without proposing fixes. May use attached tools and filesystem read-only helpers to collect full population, but code intelligence references must use LSP if available.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `H3SourceTestCensus`. Currently visible peers:\n- `H3IntegrationCensus` — scout (sub, running)\n- `Main` — main (main, running)\n46 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n summary: string;\n files: { path: string; description: string; }[];\n architecture: string;\n report?: string;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\nAll crates/*/src/**/*.rs test modules in fixed worktree. Excludes crates/*/tests integration files (other scout owns). Do not confuse production helpers outside cfg(test) with test-module sites.\n# Change\nCensus fixed-iteration polls around brain IPC in cfg(test)/#[test] modules, including local helpers used by tests. Search all for-range spellings, bounded counters and retry combinators, inspect surrounding module boundaries and actual operation. Initial root search suggests applyhost.rs cold_connect_retry and livehost.rs cold_start test loops. brain.rs fixed two-frame read loops are likely fixed assertions not readiness retries; adjudicate. Production applyhost/dispatch/pump/brainproc connect helpers must be separated as out-of-scope production, not counted merely because test modules exist in same file.\n# Acceptance\nReturn full named-site table, literal bounds/sleeps/IPC operations, file coverage and search predicates. Explicitly list plausible exclusions and why. Do not modify files; skip tests/build/lint/format/validation commands.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"b3139ea1","parentId":"264a44c1","timestamp":"2026-09-22T01:14:10.535Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nAll crates/*/src/**/*.rs test modules in fixed worktree. Excludes crates/*/tests integration files (other scout owns). Do not confuse production helpers outside cfg(test) with test-module sites.\n# Change\nCensus fixed-iteration polls around brain IPC in cfg(test)/#[test] modules, including local helpers used by tests. Search all for-range spellings, bounded counters and retry combinators, inspect surrounding module boundaries and actual operation. Initial root search suggests applyhost.rs cold_connect_retry and livehost.rs cold_start test loops. brain.rs fixed two-frame read loops are likely fixed assertions not readiness retries; adjudicate. Production applyhost/dispatch/pump/brainproc connect helpers must be separated as out-of-scope production, not counted merely because test modules exist in same file.\n# Acceptance\nReturn full named-site table, literal bounds/sleeps/IPC operations, file coverage and search predicates. Explicitly list plausible exclusions and why. Do not modify files; skip tests/build/lint/format/validation commands."}],"attribution":"agent","timestamp":1790039650451}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_MazDpT1piP01N3SZZ7ayopdj|fc_03665577bed2f92d016ab1d665c0fc87d298a701a9327d6169","toolName":"grep","startedAt":"2026-09-22T01:14:16.232Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Finding source polling loops"},"id":"f60aeb0d","parentId":"b3139ea1","timestamp":"2026-09-22T01:14:16.232Z"}
{"type":"message","id":"8cb3d398","parentId":"f60aeb0d","timestamp":"2026-09-22T01:14:16.233Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_MazDpT1piP01N3SZZ7ayopdj|fc_03665577bed2f92d016ab1d665c0fc87d298a701a9327d6169","name":"grep","arguments":{"i":"Finding source polling loops","pattern":"for\\s+.*\\s+in\\s+|while\\s+|retry|attempt","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":null},"intent":"Finding source polling loops"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1833,"output":89,"cacheRead":8448,"cacheWrite":0,"totalTokens":10370,"cost":{"input":0.018330000000000003,"output":0.00445,"cacheRead":0.008447999999999999,"cacheWrite":0,"total":0.031228}},"stopReason":"toolUse","timestamp":1790039650533,"responseId":"resp_03665577bed2f92d016ab1d663358c87d2bec0556d3add86fa","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d665c0fc87d298a701a9327d6169","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding source polling loops\",\"pattern\":\"for\\\\s+.*\\\\s+in\\\\s+|while\\\\s+|retry|attempt\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_MazDpT1piP01N3SZZ7ayopdj","internal_chat_message_metadata_passthrough":{"create_time":1790039651.661416,"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":5697.142400000244,"ttft":3244.8730999995023,"completedAt":1790039656231,"contextSnapshot":{"promptTokens":10281,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"credential_pin","id":"c441aff6","parentId":"8cb3d398","timestamp":"2026-09-22T01:14:16.234Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"f61703b9","parentId":"c441aff6","timestamp":"2026-09-22T01:14:16.306Z","message":{"role":"toolResult","toolCallId":"call_MazDpT1piP01N3SZZ7ayopdj|fc_03665577bed2f92d016ab1d665c0fc87d298a701a9327d6169","toolName":"grep","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## access.rs\n 89|//! **classifies** as `agent`. Both are the safe reading of their own field —\n*90|//! abstaining declines to name a subject, while classifying as `agent` declines\n 91|//! to admit an unvouched invocation to a `user`-qualified rule. The five\n 92|//! no-sender families pass `None` for both and are unchanged.\n 93|//!\n...\n 133|/// the warning as much as a named one — it admitted a peer the agent never named\n*134|/// at all — while same-node, a reply, and a posture that simply is not refusing\n 135|/// anyone are the three ratified non-warning cases.\n 136|// [impl->REQ-TRUST-WARNING]\n 137|pub fn warrants_trust_warning(reason: PassReason, receiver_holds_monic: bool) -> bool {\n...\n 302| ];\n*303| for r in warns {\n 304| assert!(\n 305| warrants_trust_warning(r, false),\n 306| \"{r:?} admitted an unclassified peer — it must warn\"\n...\n 312| }\n*313| for r in never {\n*314| for holds in [true, false] {\n 315| assert!(\n 316| !warrants_trust_warning(r, holds),\n 317| \"{r:?} must never warn (holds_monic={holds})\"\n...\n 395| );\n*396| for other in [\n 397| surface::RC_ATTACH,\n 398| surface::MSG,\n 399| surface::SUSPEND,\n...\n 649| // [unit->REQ-ACL-FAIL-CLOSED] ADR-0053: a corrupt store refuses unsolicited\n*650| // traffic on every surface — the flip of ADR-0009's fail-open ruling — while\n 651| // the reply exemption survives, because correlation state is a separate file\n 652| // the degrade never touches.\n 653| #[test]\n...\n 666|\n*667| for sf in surface::v1() {\n 668| assert_eq!(\n 669| access_check(\"ling\", \"bb22\", sf, InboundClass::Unsolicited),\n 670| AccessDecision::Deny,\n*671| \"{sf} must refuse while the store is unreadable\"\n 672| );\n 673| }\n 674| assert_eq!(\n...\n 888| // access-chain class and therefore are not represented in this table.\n*889| for class in [InboundClass::Reply, InboundClass::Unsolicited] {\n 890| assert_eq!(\n 891| classify_engine_room_inbound(Posture::Offline, surface::MSG, class),\n 892| InboundLock::Offline,\n...\n 899| // local controller out of the endpoint it exists to attach.\n*900| for s in [surface::RC_VIEW, surface::RC_ATTACH] {\n*901| for posture in [Posture::Online, Posture::Offline] {\n 902| assert_eq!(\n 903| classify_engine_room_inbound(posture, s, InboundClass::Unsolicited),\n 904| InboundLock::Pass,\n...\n 946| // A lock installed in the wrapper instead of the shared body would leave\n*947| // that family open while every test above stayed green, so this pins the\n 948| // reachability rather than the rule: a proven sender buys no passage, and a\n 949| // stamped sender is not a way around the loopback carve-out either.\n 950| #[test]\n...\n 958|\n*959| for sender in [None, Some(\"someone\"), Some(er)] {\n 960| assert_eq!(\n 961| access_check_with_sender(\n 962| er,\n...\n 1137|\n*1138| for reason in [\n 1139| PassReason::SameNode,\n 1140| PassReason::ReplyExemption,\n 1141| PassReason::ExplicitEntry,\n## activity.rs\n 41|/// with no wake marker. Covers the paths a marker cannot describe — a flip that\n*42|/// happened while the daemon was down, a relink, an N-1 CLI that drops no marker.\n 43|const SWEEP: Duration = Duration::from_secs(2);\n 44|\n 45|/// The flip wake-marker filename (under `identity/`, beside the sync pull\n...\n 121| seen.clear();\n*122| for o in observed {\n 123| seen.insert(\n 124| (o.owner.clone(), o.shell_id.clone()),\n 125| (o.token.clone(), o.idle, o.since_ms),\n...\n 139| let mut out = Vec::new();\n*140| for owner in perch::list_self_perch_ids(owlery) {\n 141| // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 142| // stream to carry the frame — same reason an offline instance is skipped.\n 143| // [impl->REQ-HAZARD-SHELL-STALE-ONLINE]\n...\n 159| let (idle, since) = perch::read_activity_at(&owner_perch);\n*160| for (shell_id, token) in linked {\n 161| out.push(LinkObservation {\n 162| owner: owner.clone(),\n 163| shell_id,\n...\n 192| let pushes = plan_pushes(seen, &observed);\n*193| for o in &pushes {\n 194| push_activity(drive_socket, o, now_ms);\n 195| }\n 196| remember(seen, &observed);\n...\n 216| let mut last_sweep: Option = None;\n*217| while !stop.load(Ordering::SeqCst) {\n 218| let flipped = take_flip_observation(&marker);\n 219| let due = flipped\n 220| || last_sweep\n...\n 420| remember(&mut seen, &observed);\n*421| for _ in 0..3 {\n 422| let again = observe_links(&owlery);\n 423| assert!(\n 424| plan_pushes(&seen, &again).is_empty(),\n## answerop.rs\n 125| // The rule did not land. The consumption is NOT saved either — dropping\n*126| // the knock store write is what leaves the record armed for a retry,\n 127| // and a consumed record beside a missing rule would be the one state\n 128| // that can never heal.\n 129| return None;\n## applyhost.rs\n 34|//! `apply_brain_only` handoff, the regression that re-attached a CLI-side\n*35|//! subscriber while the live brain kept running the OLD code.\n 36|//!\n 37|//! New code runs **immediately** — the supervised respawn lands on the new\n 38|//! executable, no manual bounce, no logon. Readiness-gated promotion +\n...\n 270| // reached `ready`. Writing `applied` here is the optimism the design indicts\n*271| // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n 272| // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n 273| // carrying the last-known-good `rollback_binary` (the aside we just created)\n 274| // so the broker's supervisor, a different process from this CLI, can promote\n...\n 322| // brain cycle — that is the whole point).\n*323| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 324|\n 325| swap_and_record(cache, exe_path, version, &artifact)?;\n 326|\n...\n 331| // level. This replaces the old in-process `apply_brain_only` handoff (the\n*332| // regression: it re-attached a CLI-side subscriber while the live brain kept\n 333| // running the OLD code). `classify` already gated this as brain-only, so the\n 334| // broker never moves; only the brain restarts.\n 335| //\n...\n 345| \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\n*346| and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\n 347| predates the restart verb needs a one-time manual daemon restart to run the new code)\"\n 348| )),\n 349| }\n...\n 364|pub fn refresh_brain(broker_name: &str) -> Result {\n*365| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366| brain\n 367| .request_brain_restart()\n 368| .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n...\n 449|\n*450|/// Connect a brain to the broker, retrying through startup races — the channel\n 451|/// the planned brain-restart trigger (ADR-0018 D3-3) rides after the binary\n 452|/// swap. It does NOT attach to a session: the broker holds every hosted endpoint\n 453|/// across the brain cycle, so apply never touches one. `Err` means the broker\n 454|/// never answered (a dead broker fails the apply with the seat untouched).\n*455|fn connect_retry(broker_name: &str) -> io::Result {\n 456| let mut last = io::Error::other(\"broker never answered\");\n*457| for _ in 0..300 {\n 458| match Brain::cold_start(broker_name, now_ms()) {\n 459| Ok(b) => return Ok(b),\n 460| Err(e) => last = e,\n...\n 555|\n*556| fn cold_connect_retry(broker_name: &str) -> Brain {\n*557| for _ in 0..300 {\n 558| if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559| return b;\n 560| }\n...\n 824| // No signal wired: accepted, not honored.\n*825| let mut b = cold_connect_retry(&name);\n 826| assert!(\n 827| !b.request_brain_restart().expect(\"verb round-trips\"),\n 828| \"a broker with no supervisor wired must ack honored=false\"\n...\n 833| assert!(broker.set_brain_restart(Arc::clone(&signal)), \"first wire wins\");\n*834| let mut b2 = cold_connect_retry(&name);\n 835| assert!(\n 836| b2.request_brain_restart().expect(\"verb round-trips\"),\n 837| \"a broker with a supervisor wired must ack honored=true\"\n...\n 905| // A hosted endpoint that must survive the apply.\n*906| let mut seat = cold_connect_retry(&name);\n 907| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 908| let child_pid = broker.session_pid(sid);\n 909| drop(seat); // the seat brain detaches; the broker keeps the child\n...\n 942| // binary + records the open trial and returns AppliedDaemonless. RED without\n*943| // the daemonless path: apply_staged would block on connect_retry against a\n 944| // dead socket (300×10ms) and then fail — never landing the bytes. Proves the\n 945| // swap no longer depends on a live broker to hand off to.\n 946| #[test]\n...\n 1036|\n*1037| let mut seat = cold_connect_retry(&name);\n 1038| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 1039| let child_pid = broker.session_pid(sid);\n 1040| drop(seat);\n...\n 1077| // [unit->REQ-UPD-6] Broker-touching debug/update-set payloads are accepted\n*1078| // as staged candidates, but apply refuses them typed while the broker-held\n 1079| // runtime is live. The first broker-touching flow is refusal-only; it does\n 1080| // not auto-suspend or cycle hosted work.\n 1081| #[test]\n## attach.rs\n 80|/// The control surface an attach request gates against: a read-only viewer is\n*81|/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\n 82|/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\n 83|/// endpoint without also handing over its keyboard.\n 84|// [impl->REQ-ACL-RC-VIEW-SPLIT]\n...\n 91|\n*92|/// What the engine room's structural locks say about one attach attempt\n 93|/// (ADR-0052 §3).\n 94|#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 95|pub enum EngineRoomLock {\n...\n 488| // Keep wire forwards on a separate broker connection: its handler may wait\n*489| // for network egress while `brain` receives session and stream events. This\n 490| // split fixed the historical inline-controller-replay/forwarding cycle\n 491| // (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT). Controller replay now has its own\n 492| // writer, but it still shares `brain`'s return carrier with handler replies.\n...\n 611| } if sid == stream_id => {\n*612| for rec in decoder.push(&bytes) {\n 613| match rec {\n 614| AttachRecord::Request {\n 615| session_id,\n...\n 750| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n*751| for (op, b) in pending_input.drain(..) {\n 752| brain.send_effect_no_ack(MintedOp::new(Minter::Rc, op), &b)?;\n 753| }\n 754| }\n...\n 791| }\n*792| // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\n 793| // broker-authored records forwarded onto the attach wire for the\n 794| // controller's rc to render. Additive record kinds — pushed only\n 795| // to a controller that declared the capability, so an N-1 rc\n...\n 1120|\n*1121| for from_this_node in [true, false] {\n 1122| assert_eq!(\n 1123| classify_rc_lock(true, from_this_node, Viewer),\n 1124| EngineRoomLock::NoViewport,\n...\n 1148| // Every other endpoint is untouched by all of it.\n*1149| for intent in [Viewer, Control, Take] {\n*1150| for from_this_node in [true, false] {\n 1151| assert_eq!(\n 1152| classify_rc_lock(false, from_this_node, intent),\n 1153| EngineRoomLock::Pass\n## attachment.rs\n 32|//! lock-across-effect discipline, KH 7.12/5.16). The push itself is best-effort\n*33|//! with NO retry loop: a downed daemon holds no slot, and the next edge or the\n 34|//! next [`SWEEP`] re-covers — the frame carries current state, so nothing is lost\n 35|//! by a failed write. It **inherits the drive-control path's existing IPC bound**\n 36|//! (see [`crate::drivehub::attach_write`]); no new deadline is minted here.\n...\n 59|/// with no edge signal. Covers what an edge flag cannot describe — a link\n*60|/// established while nothing was attaching, a relink, a daemon that missed the\n 61|/// edge — and it is what makes a dropped push self-heal.\n 62|const SWEEP: Duration = Duration::from_secs(2);\n 63|\n...\n 142| }\n*143| for node in &self.viewer_nodes {\n 144| *counts.entry(node.as_str()).or_default() += 1;\n 145| }\n 146| counts\n...\n 163| let mut moved: Vec<&str> = Vec::new();\n*164| for node in before.keys().chain(after.keys()) {\n 165| if before.get(node).copied().unwrap_or(0) != after.get(node).copied().unwrap_or(0)\n 166| && !moved.contains(node)\n 167| {\n...\n 200| Link,\n*201| /// The owner's attachment moved while the link stayed put. This is the only\n 202| /// kind that may name a changed node.\n 203| State,\n 204|}\n...\n 256| seen.clear();\n*257| for o in observed {\n 258| seen.insert(\n 259| (o.owner.clone(), o.shell_id.clone()),\n 260| (o.token.clone(), o.attach.clone()),\n...\n 282| let mut out = Vec::new();\n*283| for owner in owners {\n 284| let attach = &attachments[owner];\n 285| // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 286| // stream to carry the frame — same reason an offline instance is skipped.\n...\n 297| .collect();\n*298| for (shell_id, token) in linked {\n 299| out.push(AttachObservation {\n 300| owner: owner.clone(),\n 301| shell_id,\n...\n 310|/// Push one owed frame into the shell's attachment slot. Best-effort with NO\n*311|/// retry loop: a downed daemon holds no slot, and the next edge or sweep\n 312|/// re-pushes — the frame is current-state-carrying, so nothing is lost by a\n 313|/// failed write.\n 314|// [impl->REQ-ATTACH-LINK-PUSH]\n...\n 345| let pushes = plan_attach_pushes(seen, &observed);\n*346| for push in &pushes {\n 347| push_attach(drive_socket, push);\n 348| }\n 349| remember(seen, &observed);\n...\n 358|pub struct AwayState {\n*359| /// When the endpoint became unattached (epoch ms), or `None` while someone\n 360| /// is attached.\n 361| pub unattached_since: Option,\n 362| /// Whether the away notice has already fired for THIS unattached stretch.\n...\n 408| let mut owed = Vec::new();\n*409| for endpoint in endpoints {\n 410| let state = mem.entry(endpoint.clone()).or_default();\n 411| if attachments[endpoint].is_unattached() {\n 412| let since = *state.unattached_since.get_or_insert(now_ms);\n...\n 482| let mut last_sweep: Option = None;\n*483| while !stop.load(Ordering::SeqCst) {\n 484| let edged = take_attach_observation();\n 485| let due = edged\n 486| || last_sweep\n...\n 496| // that agent happens to own a shell.\n*497| for action in plan_away(&mut away, now_ms(), &attachments) {\n 498| deliver_away_notice(&action);\n 499| }\n 500| last_sweep = Some(Instant::now());\n...\n 542| // establishment, so \"first sight\" is itself an emit trigger — a binary that\n*543| // starts while nobody is attached must not wait for an attachment that may\n 544| // never come. And nothing CHANGED for that link, so it names no node.\n 545| #[test]\n 546| fn an_unseen_link_owes_a_link_push_with_no_changed_node() {\n...\n 564| remember(&mut seen, &before);\n*565| // The attachment ALSO moved while the link was down; the relink push\n 566| // carries the current state and claims no edge.\n 567| let after = vec![obs(\"ana\", \"sh-0\", \"t2\", attach(None, &[\"node-c\"]))];\n 568| let pushes = plan_attach_pushes(&seen, &after);\n...\n 730| plan_away(&mut mem, t0 + AWAY_AFTER.as_millis() as u64 + 2, &live).is_empty(),\n*731| \"the return is an edge too — it does not repeat while someone watches\"\n 732| );\n 733|\n 734| // the latch cleared, so the NEXT unattached stretch can go away again\n## autostart.rs\n 20|\n*21|/// How long to keep retrying a launch whose broker round-trip failed — the\n 22|/// replay thread starts alongside the broker's serve thread, so the very first\n 23|/// connect can race the accept loop up. Bounded and short: a genuine launch\n 24|/// failure (dead adapter binary, bad template) fails again instantly and we\n*25|/// move on after the last attempt.\n 26|const LAUNCH_ATTEMPTS: u32 = 3;\n 27|const LAUNCH_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(750);\n 28|\n...\n 56| Launched,\n*57| /// The launch was attempted and failed after its retries.\n 58| Failed,\n 59|}\n 60|\n...\n 90| let node_label = spt_store::hostlabel::node_fill_label(None);\n*91| for entry in entries {\n 92| // A saved default naming the reserved id is skipped, LOUDLY, and this\n 93| // arm is not redundant with the refusal at save. A record written\n 94| // before that refusal existed is already on disk on real nodes, and a\n...\n 141| let mut launched = false;\n*142| for attempt in 1..=LAUNCH_ATTEMPTS {\n 143| match crate::harnesshost::launch_harness_brokered_in(\n 144| broker_name,\n 145| &entry.id,\n...\n 171| last_err = e;\n*172| if attempt < LAUNCH_ATTEMPTS {\n 173| std::thread::sleep(LAUNCH_RETRY_DELAY);\n 174| }\n 175| }\n...\n 241| writer.call_count() > 1,\n*242| \"fixture must exercise write_all's short-write retry\"\n 243| );\n 244| assert_eq!(\n 245| writer.joined(),\n...\n 297| // Must return promptly — the skip happens before the bogus socket is\n*298| // ever dialed, so no retry loop, no launch, no hang.\n 299| replay_bounded(Duration::from_secs(10));\n 300| });\n 301| }\n## bootstrap_firewall.rs\n 83|/// F-A1-1 (releases#304 W2, HFENDULEAM field leg 2026-09-12) was a verify whose\n*84|/// WRITES HAD ALREADY LANDED while the command was still walking the store: the\n 85|/// event log timestamped them ~2.5-3.2 s before the command returned, and the\n 86|/// only way to learn that was to read the Windows event log by hand. Nothing in\n 87|/// the product could say which leg spent the budget, or whether the child was\n...\n 189| let mut err = String::new();\n*190| for _ in 0..2 {\n 191| let (is_stdout, bytes) = rx.recv_timeout(deadline.saturating_duration_since(Instant::now()))\n 192| .map_err(|_| format!(\"{program}: firewall output did not complete\"))?;\n 193| let bytes = bytes.map_err(|error| format!(\"{program}: reading output: {error}\"))?;\n...\n 301|\n*302| for value in [\"1\", \"\", \"0\", \"false\"] {\n 303| OptOut::set(value);\n 304| let error = mutation_permitted().expect_err(\n 305| \"an exported SPT_INSTALL_NO_FIREWALL must disable mutation regardless of value\",\n...\n 352|\n*353| /// Observation is read-only and must stay available while mutation is disabled,\n 354| /// but it still refuses arguments the broker did not actually supply. Neither\n 355| /// case reaches a platform command.\n 356| // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n...\n 361|\n*362| for opted_out in [false, true] {\n 363| if opted_out {\n 364| OptOut::set(\"1\");\n 365| } else {\n...\n 409|\n*410| for required in [\n 411| \"$ErrorActionPreference = 'Stop'\",\n 412| \"Import-Module NetSecurity\",\n 413| \"spt-core-bootstrap-inbound-tcp\",\n## brain.rs\n 176| },\n*177| /// Broker→controller-serve: one ceremony attempt's verdict for the\n 178| /// overlay (`refused` re-prompts; the rest close it). Forwarded as\n 179| /// `AttachRecord::SealCeremonyResult`.\n 180| // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n...\n 677| ///\n*678| /// Verification, the attempt ledger, and the mint all run DAEMON-SIDE —\n 679| /// the adversary here is an agent on this box that can speak this same\n 680| /// IPC, so nothing about the answer is decided in this process. An N-1\n 681| /// broker that predates the verb answers unknown-kind, surfaced as a LOUD\n...\n 739| /// never as a reply to this frame (the serve loop must keep pumping\n*740| /// output while the gate decides).\n 741| // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n 742| // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n 743| pub fn seal_ceremony_code(\n...\n 929| /// brain↔broker conn without returning to read. With no ack the broker's\n*930| /// per-conn handler never writes back while servicing that flood, so the return\n 931| /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n 932| /// broker still dedups by `(session, op_id)` at its applied-set.\n 933| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n...\n 1412| // (D4-2b); a legacy brain (empty map) uses the `next_seq` set above. The\n*1413| // resume-mode dedup-cursor reset for an explicit re-subscribe lives in\n 1414| // `subscribe_with` (P1c, shared by `attach`/`attach_as`).\n 1415| self.subscribe(session_id, from_seq)\n 1416| }\n...\n 1546| /// Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the\n*1547| /// broker for **every** hosted session and re-attach **each** in resume mode\n 1548| /// from the broker's per-session delivered cursor (`resume_seq`). This is the\n 1549| /// production replacement for the retired single-session `BrainState` handoff\n 1550| /// frame — a brain the supervisor respawns (crash *or* update) reconstructs\n...\n 1598| let mut resumed = Vec::with_capacity(total);\n*1599| for info in reply.sessions {\n 1600| // Seed the dedup cursor at the broker's resume point BEFORE the subscribe\n 1601| // replay starts arriving, then re-attach (Viewer) from there.\n 1602| self.session_cursors\n...\n 1636| let mut resumed = Vec::with_capacity(reply.sessions.len());\n*1637| for info in reply.sessions {\n 1638| self.session_cursors\n 1639| .insert(info.session_id, info.resume_seq);\n 1640| resumed.push(info.session_id);\n...\n 1941| /// held meet `session_id`. The daemon dials the HELD address (no re-search)\n*1942| /// and runs the ceremony. A wrong-code retry calls this again with the SAME\n 1943| /// session id (ceremony only). The code never persists.\n 1944| // [impl->REQ-JOIN-TWO-PHASE]\n 1945| pub fn pair_submit_code(&mut self, session_id: u64, code: &str) -> io::Result {\n...\n 2134| /// List the streams the broker holds (D4b) — how a re-attaching brain\n*2135| /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n 2136| pub fn net_streams(&mut self) -> io::Result {\n 2137| self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n 2138| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n...\n 2403| /// setting the local cursor (D4c) — gapless, exactly-once presence resume:\n*2404| /// events produced while no brain was attached replay from the cursor.\n 2405| // [impl->REQ-EP-4]\n 2406| pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407| self.presence_cursor = Some(from_seq);\n...\n 2453| /// adopts the whole block — traceability tag included — and leaves the\n*2454| /// function undocumented while `traceable-reqs` still counts that tag as\n 2455| /// present. That is a green that survives the regression.\n 2456| ///\n 2457| /// (The tag is named in words rather than written out here: the checker reads\n...\n 2577| /// — the poison signal the pump escalates to a supervised restart (NEVER a\n*2578| /// per-peer retry). A `Disconnected` channel means the reader thread exited\n 2579| /// (the conn hung up); surface it as `UnexpectedEof`.\n 2580| // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n 2581| // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n...\n 2825| let server_thread = thread::spawn(move || {\n*2826| while let Ok(env) = frames.recv() {\n 2827| if write_frame(&mut send, &env).is_err() {\n 2828| break;\n 2829| }\n...\n 2913| let deadline = brain.call_deadline();\n*2914| for seq in 0u64..=2 {\n 2915| stub.feed\n 2916| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 2917| .unwrap();\n...\n 2956| let deadline = brain.call_deadline();\n*2957| for seq in 3u64..=5 {\n 2958| stub.feed\n 2959| .send(output_envelope(sid, seq, format!(\"r{seq}\").as_bytes()))\n 2960| .unwrap();\n...\n 3028| let deadline = brain.call_deadline();\n*3029| for seq in 0u64..=1 {\n 3030| stub.feed\n 3031| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 3032| .unwrap();\n...\n 3198| let deadline = brain.call_deadline();\n*3199| for _ in 0..2 {\n 3200| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3201| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3202| other => panic!(\"expected Output, got {other:?}\"),\n...\n 3253| // The ring rolled between reads: the next Output frame carries a seq far\n*3254| // ABOVE the cursor (4504 while cursor is 100 — the legacy path would fatal\n 3255| // `output gap: got 4504 want 100`). Snap-above must ACCEPT it.\n 3256| stub.feed.send(output_envelope(sid, 4504, b\"ROLLED\")).unwrap();\n 3257| let deadline = brain.call_deadline();\n...\n 3278| let deadline = brain.call_deadline();\n*3279| for _ in 0..2 {\n 3280| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3281| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3282| other => panic!(\"expected Output, got {other:?}\"),\n## brainproc.rs\n 44|/// A run at least this long counts as healthy and resets the backoff floor.\n*45|/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n 46|/// brain has this long to signal `ready` for its generation before the window\n 47|/// elapses (the \"up but useless\" alive-never-ready rollback path).\n 48|const SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n*49|/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n 50|/// **exits before** signaling ready is respawned this many consecutive times\n 51|/// (a transient first-boot hiccup should not abandon a good binary) before the\n 52|/// supervisor auto-rolls-back to the last-known-good binary. Matched to the\n...\n 114| Crash,\n*115| /// A respawn the broker itself initiated for a binary swap (wired in D3-3).\n 116| Update,\n 117|}\n 118|\n...\n 201| let name = broker_socket_name();\n*202| let mut brain = connect_retry(&name, BRAIN_CONNECT_TRIES)?;\n 203| // The broker hands {generation, start-reason} at spawn (ADR-0018 V2): the\n 204| // generation is broker-owned custody of the KH-2.4 counter (no longer the\n 205| // brain→brain BrainState.generation, which retires in D4), and the reason is\n...\n 227| // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n*228| // paid for that twice: four cells burned a full 30s readiness budget while\n 229| // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n 230| // (blocked broker reply-read vs the first-call whole-exe hash) could not be\n 231| // separated from the log at all. `activity_link_push_e2e` then failed again\n...\n 446|\n*447|/// Connect to the broker, retrying briefly while it finishes binding.\n*448|fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449| let mut last: Option = None;\n*450| for _ in 0..tries {\n 451| match Brain::cold_start(name, now_ms()) {\n 452| Ok(b) => return Ok(b),\n 453| Err(e) => {\n...\n 514|/// `current_exe`/read stays `None` for the process lifetime — no per-tick\n*515|/// retry, the breadcrumb simply omits the field). Restoration D7-1: the\n 516|/// `exe_hash` breadcrumb that proves *which bytes* a brain generation is\n 517|/// running. The once-per-process capture is load-bearing TWICE\n 518|/// (REGISTRY-LIFECYCLE R1): the pre-fix per-tick re-read hashed 30+ MiB every\n...\n 594|/// deterministically with a scripted ready/no-ready + a capturing notif sink,\n*595|/// while production binds the real `spt_home` + relcache + notif sender\n 596|/// ([`ProductionTrialEnv`]). Every method is **best-effort / fail-safe**: a\n 597|/// missing record reads as \"no pending trial\", an absent ready file as\n 598|/// \"not ready\" — the broker's supervisor thread never panics (a panic there\n...\n 756|/// (epoch.rs) holds at this `EpochSource::load`. **Do NOT fire broker-side notifs\n*757|/// while a brain is live:** concurrent `EpochSource` read-modify-write across the\n 758|/// two processes mints duplicate epochs (KH 4.8 lost-update). The forward fix for\n 759|/// any future broker-side live-notif is cross-process serialization (a file\n 760|/// lock), not relaxing this rule.\n...\n 765|/// logged, never fatal. Dismissal consumes NO epoch, so — unlike producing a\n*766|/// notif — it is safe to call brain-side while the swap is live.\n 767|// [impl->REQ-NOTIF-SEAM-DISMISS]\n 768|fn dismiss_update_notifs_on_apply() {\n 769| let Ok(store) = spt_store::notif::NotifStore::open() else {\n...\n 772| };\n*773| for (subnet, _) in &crate::notif::NotifSurfacePolicy::load().subnets {\n*774| for key in [\n 775| crate::notif::NOTIF_KEY_UPDATE_STAGED,\n 776| crate::notif::NOTIF_KEY_ROLLBACK,\n 777| ] {\n...\n 793| let owlery = spt_store::perch::owlery_dir();\n*794| for (subnet, _) in &policy.subnets {\n 795| if let Err(e) = crate::notif::produce_rollback_notif(\n 796| quarantine_version,\n 797| running_version,\n...\n 814| let mut slept = Duration::ZERO;\n*815| while slept < backoff && !stop.load(Ordering::Relaxed) {\n 816| thread::sleep(TICK.min(backoff.saturating_sub(slept)));\n 817| slept += TICK;\n 818| }\n...\n 853|/// NOT a promote: the W2 stall-evict only BOUNDS the false-promote window to\n*854|/// `BRAIN_WRITE_DEADLINE`, so a new brain can signal ready while the OLD generation's\n 855|/// local controller conn is still wedged (the 22:47 apply \"promoted\" onto a frozen\n 856|/// control plane). So readiness is LATCHED (`ready_seen` — a candidate that stamped\n 857|/// ready then exited is not demoted, preserving the ready-then-exit-still-promotes\n...\n 863|/// `BRAIN_WRITE_DEADLINE` (15 s) < [`SUPERVISE_HEALTHY_RUN`] (30 s) — and a cleanly-\n*864|/// closed old conn drains at once. `child.try_wait()` is consulted only while\n 865|/// NOT-yet-ready, so a ready-then-exited candidate still promotes once drained.\n 866|fn run_trial(\n 867| child: &mut Child,\n...\n 922| }\n*923| // Only watch for a pre-ready exit while the candidate has NOT reached ready;\n 924| // once ready-seen we are waiting on the OLD gen to drain, and a ready-then-\n 925| // exited child still promotes (the exit is a normal later respawn).\n 926| if !ready_seen {\n...\n 929| Ok(None) => {}\n*930| // A wait error: treat as a pre-ready exit (fail toward retry, never\n 931| // a panic in the supervisor thread).\n 932| Err(e) => {\n 933| spt_proto::emit_line_err!(\"BRAIN_TRIAL_WAIT_FAIL: {e}\");\n## broker.rs\n 23|//! last-seen `seq + 1`; the broker replays the ring from there, then streams\n*24|//! live. The brain dedups by `seq`. Output produced *while no brain was\n 25|//! attached* sits in the ring and is replayed on the next subscribe — so a\n 26|//! brain restart loses nothing.\n 27|//!\n...\n 221|/// blocked). The brain aggregates every session + psyche + WAN feed, so its drain\n*222|/// is bursty; 15 s tolerates a normal burst-stall while still bounding the wedge.\n*223|/// A slow-but-DRAINING brain never trips it — the clock only advances while a write\n 224|/// is genuinely in flight past the deadline (see [`ControllerSink::write_blocked_since`]).\n 225|// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n 226|const BRAIN_WRITE_DEADLINE: Duration = Duration::from_secs(15);\n...\n 250|/// by the holder's PROGRESS (see `phase_wedge_ceiling`) and not by a clock.\n*251|/// Poll slice while waiting on a racing wake's session to appear.\n 252|const WAKE_DEDUP_POLL: Duration = Duration::from_millis(50);\n 253|\n 254|/// What a held wake claim knows about its holder's PROGRESS (#235).\n...\n 296|/// holds generation N+1, and the old holder finally completes and drops. A\n*297|/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298|/// is still in flight, so the next duplicate wake sails through the gate —\n 299|/// re-opening, one wake later, exactly the double-create this guard exists to\n 300|/// close. Pure over the map so the no-op is a unit.\n...\n 312|/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\n*313|/// on a slow-but-live holder is latency, while the cost of taking over from one\n 314|/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\n 315|/// detector, never a performance budget.\n 316|fn phase_wedge_ceiling(phase: &str) -> Duration {\n...\n 350|/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\n*351|/// down + retry, waiting for the racer's session to register), for as long as that\n 352|/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\n 353|/// endpoint, are `Claim`. Pure so the truth table is a unit.\n 354|///\n...\n 400|/// it would be a lie — exactly when:\n*401|/// - its PTY child (the client-tree root) probes DEAD while the table record\n 402|/// survives (a wedged/missed exit-wait), OR\n 403|/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\n 404|/// forks a harness client chain under the wrapper by construction), PAST\n 405|/// the boot grace, whose wrapper has NO live descendants — the deployah\n*406|/// wedge shape: the launcher shell idles on while the harness underneath\n 407|/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\n 408|/// `shutdown` said NO_EDGE about the same corpse.\n 409|///\n...\n 487| // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\n*488| // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\n 489| // handle to it stays open — and this broker holds `Arc`, hence\n 490| // that handle, for exactly the sessions it is asked about. A reaped root\n 491| // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\n...\n 496| // about the process, not about a handle the caller holds, and Linux demotes\n*497| // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\n 498| // implies unix implies no handle problem — the two conditions cannot both\n 499| // fail. Routing to `None` here instead would have DISABLED zombie detection\n 500| // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\n...\n 598|/// The coordinator-image read gate (F-025 amendment): a recorded\n*599|/// `(generation, version)` answers only while its generation is STILL the\n 600|/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601|/// reported — rather than the version of a process that no longer exists, so the\n 602|/// surface never outlives the process it describes (the stale-record class that\n...\n 615|/// doyle non-negotiable = W1's \"never park forever\"): the inject worker holds the\n*616|/// floor — buffering operator input — only while a binary's response to one\n 617|/// `{type:event}` is in flight. If no `{commit}` arrives within this window the\n 618|/// worker FLUSHES the buffer, RELEASES the floor, FAULTS the binary (terminate, no\n 619|/// respawn → idle inbound then SPOOLS, never raw-injected), and never re-opens. A wedged or\n...\n 744|\n*745|/// Total delivery attempts per sequence: the first drive + ONE re-drive on an\n 746|/// echo-verify miss (doyle ruling A layer 2: \"re-drive once; on a second miss, LOUD\n*747|/// spool\"). 2 = one initial + one retry.\n 748|const INJECT_REDRIVE_ATTEMPTS: u32 = 2;\n 749|\n 750|/// Chunk size for the paced text write (Layer 3, the ruling's named fallback where\n...\n 866| /// a channel that stays Full for [`CONTROLLER_WRITE_DEADLINE`] PAST this stamp\n*867| /// evicts the stalled controller (bounded wedge preserved), while a slow-but-\n 868| /// alive controller just drops the chunk + falls behind the ring (resume-from-\n 869| /// floor). Seeded `now` at [`OutputLog::become_controller`].\n 870| last_ok: Instant,\n...\n 958| dropped: u64,\n*959| /// The `seq` range assigned while delivery was suppressed, `(first, last)` —\n 960| /// the watermark source for the commit/abort sync frame\n 961| /// (REQ-RC-RESIZE-PRESENTATION-BARRIER leg 3).\n 962| suppressed: Option<(u64, u64)>,\n...\n 965|impl ResizeTransition {\n*966| /// Record one seq assigned while this transition suppressed delivery.\n 967| fn note_suppressed(&mut self, seq: u64) {\n 968| self.suppressed = Some(match self.suppressed {\n 969| Some((first, _)) => (first, seq),\n...\n 1003|/// an isolated bounded queue + writer thread, evicted on overflow). Every\n*1004|/// controller send and viewer `try_send` happens while the enclosing\n 1005|/// `Mutex` is held, so frames reach each sink in strict `seq` order.\n 1006|struct OutputLog {\n 1007| session_id: u64,\n...\n 1178|/// `controlled:false` and no later edge re-stamps, so the endpoint reads uncontrolled\n*1179|/// forever while driven. This DIVERGENCE-GATED re-assert (on the `KIND_SESSIONS` poll,\n 1180|/// bounded by the reconcile cadence) writes ONLY on a real difference — no fsync storm.\n 1181|/// Best-effort: an unbound / corrupt / perch-less endpoint has nowhere to converge yet.\n 1182|///\n## codec.rs\n 9|//! The frame *codec* is deliberately transport-agnostic: it is the byte-level\n*10|//! contract, while [`crate::transport`] owns the OS-specific connection.\n 11|// [impl->REQ-DAEMON-2]\n 12|\n 13|use std::io::{self, Read, Write};\n## config.rs\n 696| seeded.save_to(&DaemonConfig::default_path()).unwrap();\n*697| for id in [\"gw\", \"worker\"] {\n 698| DaemonConfig::upsert_startup_endpoint(StartupEndpoint {\n 699| id: id.to_string(),\n 700| adapter: \"cc\".to_string(),\n## conn.rs\n 46|//! synchronous return IS the completion handshake); (4) the retired half is\n*47|//! parked in a graveyard slot — never dropped while the watchdog might still\n 48|//! touch the raw handle (drop = `CloseHandle`, and a recycled handle value\n 49|//! must never see a late `CancelIoEx`), and never re-gated; (5) on Windows the\n 50|//! pipe is then severed (`DisconnectNamedPipe` — the server end forces the\n...\n 227|struct Dog {\n*228| /// `Some((op_id, deadline))` while a write is in flight.\n 229| inflight: Option<(u64, Instant)>,\n 230| /// Raised by [`BrokerConn::drop`]; the watchdog exits.\n 231| shutdown: bool,\n...\n 459| };\n*460| // Sleep toward the deadline while THIS op stays in flight.\n 461| let fired = loop {\n 462| if d.shutdown {\n 463| return;\n...\n 492| d = recover(&self.dog);\n*493| while matches!(d.inflight, Some((cur, _)) if cur == op) && !d.shutdown {\n 494| let (g, _) = self\n 495| .dog_cv\n 496| .wait_timeout(d, Duration::from_millis(100))\n...\n 671| // released. Clear the arm BEFORE deciding health, so the watchdog\n*672| // never severs while the op is formally in flight.\n 673| {\n 674| let mut d = recover(&inner.dog);\n 675| d.inflight = None;\n...\n 836| const N: u64 = 32;\n*837| for round in 0..N {\n 838| let (conn, mut client, mut recv) = make_duplex_with_log(Arc::clone(&log));\n 839| conn.describe(\"role=brain\");\n*840| for seq in 0..4 {\n 841| let request = Envelope::new(\"poll\", serde_json::json!([round, seq]));\n 842| write_frame(&mut client, &request).unwrap();\n 843| let received = crate::codec::read_frame(&mut recv).unwrap();\n...\n 881| assert_eq!(lines.len(), 3, \"role event, retirement and poisoned close survive\");\n*882| for line in lines.iter() {\n 883| assert!(line.contains(&format!(\"conn={id}\")));\n 884| assert!(line.contains(\"role=brain controller session=7\"));\n 885| assert!(line.contains(&format!(\"first_write_wall_ms={}\", start.wall_ms)));\n...\n 922| // Attribution parity: every field present on BOTH tokens.\n*923| for (name, line) in [(\"POISONED\", &poisoned), (\"RETIRED\", &retired)] {\n 924| assert!(\n 925| line.contains(&format!(\"conn={}\", conn.id())),\n 926| \"{name} carries the stable conn id: {line}\"\n...\n 950| // observable; loop until the failure surfaces (bounded).\n*951| for _ in 0..200 {\n 952| match conn.write(&env) {\n 953| Err(e) => {\n 954| organic = Some(e);\n...\n 980|\n*981| for i in 0..100 {\n 982| a.describe(&format!(\"fact-{i}-padding-padding-padding\"));\n 983| }\n 984| let label = recover(&a.inner.label).clone();\n## crc_swap.rs\n 52|) -> std::io::Result<()> {\n*53| for entry in std::fs::read_dir(dir)? {\n 54| let entry = entry?;\n 55| let path = entry.path();\n 56| if path.is_dir() {\n...\n 131| // [impl->REQ-CRC-SWAP-OLD-DISPLACE]\n*132| for swap in plan {\n 133| if swap.target.exists() {\n 134| gc_stale_old(&swap.target);\n 135| }\n...\n 138| // Phase 1 — stage every new file beside its target.\n*139| for swap in plan {\n 140| if let Some(parent) = swap.target.parent() {\n 141| std::fs::create_dir_all(parent)?;\n 142| }\n...\n 151| let mut committed: Vec<(&Path, Option)> = Vec::new();\n*152| for swap in plan {\n 153| let target = swap.target.as_path();\n 154| let displaced = if target.exists() {\n 155| // DISPLACE: rename the original ASIDE to a fresh, non-colliding name so a\n...\n 181| // retries it, never a brick).\n*182| for (_, displaced) in &committed {\n 183| if let Some(old) = displaced {\n 184| let _ = std::fs::remove_file(old);\n 185| }\n...\n 205| }\n*206| for n in 1u64.. {\n 207| let candidate = sibling(target, &format!(\"old-{n}\"));\n 208| if !candidate.exists() {\n 209| return candidate;\n...\n 229| };\n*230| for entry in entries.flatten() {\n 231| if let Some(name) = entry.file_name().to_str() {\n 232| if name == base || name.starts_with(&dashed) {\n 233| let _ = std::fs::remove_file(entry.path());\n...\n 262|) {\n*263| for (target, displaced) in committed.iter().rev() {\n 264| let _ = rename(target, &new_path(target));\n 265| if let Some(old) = displaced {\n 266| let _ = rename(old, target);\n...\n 272|fn cleanup_new(plan: &[PlannedSwap]) {\n*273| for swap in plan {\n 274| let _ = std::fs::remove_file(new_path(&swap.target));\n 275| }\n 276|}\n...\n 303| fn walk(dir: &Path, found: &mut bool) {\n*304| for entry in fs::read_dir(dir).unwrap() {\n 305| let path = entry.unwrap().path();\n 306| if path.is_dir() {\n 307| walk(&path, found);\n...\n 661| stranded_old.exists() && fs::read(&stranded_old).unwrap() == b\"LAST-GOOD-V1\",\n*662| \"the last-good `.old` is NOT GC'd while the target was missing — survives \\\n 663| to be swept next run (never a no-binary double-fault window)\"\n 664| );\n 665| }\n## daemon.rs\n 36|const START_TIMEOUT: Duration = Duration::from_secs(5);\n*37|/// Poll cadence while waiting for the spawned daemon to come up.\n 38|const START_POLL: Duration = Duration::from_millis(25);\n 39|\n 40|/// The per-machine broker/brain daemon process.\n...\n 131| // [impl->REQ-HAZARD-STALE-INDEX-LOCK]\n*132| for lock in spt_store::branchstore::sweep_stale_index_locks(\n 133| &spt_store::contextstore::seed_git_dir(&spt_store::perch::tracked_dir()),\n 134| spt_store::branchstore::STALE_LOCK_AGE,\n 135| ) {\n...\n 150| }\n*151| for name in &att.detached {\n 152| // Plain prose (no Markdown markers): spt-daemon can't import the\n 153| // bin-local helpfmt renderer, so this one source string is authored\n 154| // marker-free rather than rendered. The `SUBNET_DETACHED:{name}`\n...\n 200| // at boot — REQ-DAEMON-9) is transient and retried, but a broken\n*201| // identity is not, so we only arm the retry when identity is sound.\n 202| let node_hex: Option = spt_store::nodeid::load_or_create()\n 203| .ok()\n 204| .map(|i| i.public_key().to_hex());\n...\n 207| } else {\n*208| spt_proto::emit_line_err!(\"NODE_KEY_FAIL: identity unavailable — broker runs net-less, no retry\");\n 209| None\n 210| };\n 211|\n...\n 242| let broker = Arc::clone(&broker);\n*243| thread::spawn(move || net_retry_attach(broker));\n 244| }\n 245| // The ATTACHMENT observer (releases#44 / releases#45): it runs\n 246| // in the BROKER because attachment truth is broker MEMORY —\n...\n 555| // Re-runs on every successful bind, including the REQ-DAEMON-9\n*556| // self-heal retry — the port is new each time.\n 557| if let Some(port) = host.bound_port() {\n 558| crate::firewall::verify_and_record_self(port);\n 559| }\n...\n 570|/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\n*571|/// up) keeps retrying `try_start_net` with capped backoff and, on success,\n 572|/// ATTACHES the host to the live broker (`OnceLock`, so exactly once). The node\n 573|/// becomes reachable without a manual restart. Runs until net binds — the\n 574|/// network always arrives eventually after boot. The net consumers are no longer\n...\n 577|// [impl->REQ-DAEMON-9]\n*578|fn net_retry_attach(broker: Arc) {\n 579| let mut backoff = NET_RETRY_FIRST;\n 580| loop {\n 581| thread::sleep(backoff);\n...\n 583| if broker.attach_net(host) {\n*584| spt_proto::emit_line_err!(\"NET_ATTACHED: net endpoint bound on retry — brain starts the consumers\");\n 585| }\n 586| return;\n 587| }\n*588| backoff = net_retry_backoff(backoff);\n*589| spt_proto::emit_line_err!(\"NET_BIND_RETRY: net still unavailable, retrying in {}s\", backoff.as_secs());\n 590| }\n 591|}\n 592|\n...\n 595|\n*596|/// The net self-heal backoff ladder (REQ-DAEMON-9): double each retry, capped\n 597|/// at [`NET_RETRY_CAP`]. Pure for tests.\n*598|fn net_retry_backoff(cur: Duration) -> Duration {\n 599| (cur * 2).min(NET_RETRY_CAP)\n 600|}\n 601|\n...\n 620| let mut waited = Duration::ZERO;\n*621| while waited < START_TIMEOUT {\n 622| if is_running() {\n 623| return Ok(());\n 624| }\n...\n 712| // RE-DECIDE under the lock: the winner may have already brought the daemon\n*713| // up, and the operator's stop may have landed while we queued.\n 714| match ensure_decision(is_running(), spt_store::daemon_inhibit::stop_inhibited()) {\n 715| EnsureOutcome::AlreadyRunning => return Ok(EnsureOutcome::AlreadyRunning),\n 716| EnsureOutcome::DeclinedStopInhibited => {\n...\n 970|\n*971|/// One CreateProcessW attempt: spawn `program args…` detached, inheriting NO\n 972|/// handles, with `extra_flags` OR'd onto the base detached flags. The single\n 973|/// FFI primitive shared by [`detached_no_inherit_env`] and the daemon's job-neutral\n 974|/// launcher ladder ([`launch_daemon_job_neutral`]).\n...\n 998|\n*999|/// Mark one handle inheritable, the precondition for naming it in a\n 1000|/// `PROC_THREAD_ATTRIBUTE_HANDLE_LIST`: a handle in the list that is not\n 1001|/// inheritable fails `CreateProcessW` outright.\n 1002|#[cfg(windows)]\n...\n 1054| let mut vars: Vec<(OsString, OsString)> = std::env::vars_os().collect();\n*1055| for k in remove {\n 1056| vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1057| }\n*1058| for (k, v) in extra {\n 1059| vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1060| vars.push((OsString::from(k), OsString::from(v)));\n 1061| }\n## deelevate.rs\n 81|/// (still carrying `SPT_HOME`) sees no daemon and prints `DAEMON_NOT_RUNNING`\n*82|/// while the orphaned daemon serves the wrong home.\n 83|// [impl->REQ-HAZARD-ELEVATED-DAEMON-SPAWN]\n 84|pub fn apply_env_overrides(block: &[u16], overrides: &[(String, String)]) -> Vec {\n 85| const NUL: u16 = 0;\n...\n 89| let mut cur: Vec = Vec::new();\n*90| for &u in block {\n 91| if u == NUL {\n 92| if cur.is_empty() {\n 93| break;\n...\n 106| };\n*107| for (k, v) in overrides {\n 108| let key = k.to_ascii_uppercase();\n 109| entries.retain(|e| name_of(e) != key);\n 110| entries.push(format!(\"{k}={v}\").encode_utf16().collect());\n...\n 112| let mut out: Vec = Vec::new();\n*113| for e in &entries {\n 114| out.extend_from_slice(e);\n 115| out.push(NUL);\n\n[Showing lines 1-1056 of 1351 (50.0KB limit). Use :1057 to continue]"}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":236,"fileCount":20,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/access.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/activity.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/answerop.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/attachment.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/autostart.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bin/xlate_choreo_fixture.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/linux.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/windows.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/codec.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/config.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/conn.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/crc_swap.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/deelevate.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/access.rs","count":15},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/activity.rs","count":7},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/answerop.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs","count":17},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs","count":9},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/attachment.rs","count":17},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/autostart.rs","count":8},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bin/xlate_choreo_fixture.rs","count":4},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/linux.rs","count":19},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/windows.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/codec.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/config.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/conn.rs","count":11},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/crc_swap.rs","count":11},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/deelevate.rs","count":9}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## access.rs\n 89│//! **classifies** as `agent`. Both are the safe reading of their own field —\n *90│//! abstaining declines to name a subject, while classifying as `agent` declines\n 91│//! to admit an unvouched invocation to a `user`-qualified rule. The five\n 92│//! no-sender families pass `None` for both and are unchanged.\n 93│//!\n │...\n 133│/// the warning as much as a named one — it admitted a peer the agent never named\n *134│/// at all — while same-node, a reply, and a posture that simply is not refusing\n 135│/// anyone are the three ratified non-warning cases.\n 136│// [impl->REQ-TRUST-WARNING]\n 137│pub fn warrants_trust_warning(reason: PassReason, receiver_holds_monic: bool) -> bool {\n │...\n 302│ ];\n *303│ for r in warns {\n 304│ assert!(\n 305│ warrants_trust_warning(r, false),\n 306│ \"{r:?} admitted an unclassified peer — it must warn\"\n │...\n 312│ }\n *313│ for r in never {\n *314│ for holds in [true, false] {\n 315│ assert!(\n 316│ !warrants_trust_warning(r, holds),\n 317│ \"{r:?} must never warn (holds_monic={holds})\"\n │...\n 395│ );\n *396│ for other in [\n 397│ surface::RC_ATTACH,\n 398│ surface::MSG,\n 399│ surface::SUSPEND,\n │...\n 649│ // [unit->REQ-ACL-FAIL-CLOSED] ADR-0053: a corrupt store refuses unsolicited\n *650│ // traffic on every surface — the flip of ADR-0009's fail-open ruling — while\n 651│ // the reply exemption survives, because correlation state is a separate file\n 652│ // the degrade never touches.\n 653│ #[test]\n │...\n 666│\n *667│ for sf in surface::v1() {\n 668│ assert_eq!(\n 669│ access_check(\"ling\", \"bb22\", sf, InboundClass::Unsolicited),\n 670│ AccessDecision::Deny,\n *671│ \"{sf} must refuse while the store is unreadable\"\n 672│ );\n 673│ }\n 674│ assert_eq!(\n │...\n 888│ // access-chain class and therefore are not represented in this table.\n *889│ for class in [InboundClass::Reply, InboundClass::Unsolicited] {\n 890│ assert_eq!(\n 891│ classify_engine_room_inbound(Posture::Offline, surface::MSG, class),\n 892│ InboundLock::Offline,\n │...\n 899│ // local controller out of the endpoint it exists to attach.\n *900│ for s in [surface::RC_VIEW, surface::RC_ATTACH] {\n *901│ for posture in [Posture::Online, Posture::Offline] {\n 902│ assert_eq!(\n 903│ classify_engine_room_inbound(posture, s, InboundClass::Unsolicited),\n 904│ InboundLock::Pass,\n │...\n 946│ // A lock installed in the wrapper instead of the shared body would leave\n *947│ // that family open while every test above stayed green, so this pins the\n 948│ // reachability rather than the rule: a proven sender buys no passage, and a\n 949│ // stamped sender is not a way around the loopback carve-out either.\n 950│ #[test]\n │...\n 958│\n *959│ for sender in [None, Some(\"someone\"), Some(er)] {\n 960│ assert_eq!(\n 961│ access_check_with_sender(\n 962│ er,\n │...\n 1137│\n*1138│ for reason in [\n 1139│ PassReason::SameNode,\n 1140│ PassReason::ReplyExemption,\n 1141│ PassReason::ExplicitEntry,\n## activity.rs\n 41│/// with no wake marker. Covers the paths a marker cannot describe — a flip that\n *42│/// happened while the daemon was down, a relink, an N-1 CLI that drops no marker.\n 43│const SWEEP: Duration = Duration::from_secs(2);\n 44│\n 45│/// The flip wake-marker filename (under `identity/`, beside the sync pull\n │...\n 121│ seen.clear();\n*122│ for o in observed {\n 123│ seen.insert(\n 124│ (o.owner.clone(), o.shell_id.clone()),\n 125│ (o.token.clone(), o.idle, o.since_ms),\n │...\n 139│ let mut out = Vec::new();\n*140│ for owner in perch::list_self_perch_ids(owlery) {\n 141│ // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 142│ // stream to carry the frame — same reason an offline instance is skipped.\n 143│ // [impl->REQ-HAZARD-SHELL-STALE-ONLINE]\n │...\n 159│ let (idle, since) = perch::read_activity_at(&owner_perch);\n*160│ for (shell_id, token) in linked {\n 161│ out.push(LinkObservation {\n 162│ owner: owner.clone(),\n 163│ shell_id,\n │...\n 192│ let pushes = plan_pushes(seen, &observed);\n*193│ for o in &pushes {\n 194│ push_activity(drive_socket, o, now_ms);\n 195│ }\n 196│ remember(seen, &observed);\n │...\n 216│ let mut last_sweep: Option = None;\n*217│ while !stop.load(Ordering::SeqCst) {\n 218│ let flipped = take_flip_observation(&marker);\n 219│ let due = flipped\n 220│ || last_sweep\n │...\n 420│ remember(&mut seen, &observed);\n*421│ for _ in 0..3 {\n 422│ let again = observe_links(&owlery);\n 423│ assert!(\n 424│ plan_pushes(&seen, &again).is_empty(),\n## answerop.rs\n 125│ // The rule did not land. The consumption is NOT saved either — dropping\n*126│ // the knock store write is what leaves the record armed for a retry,\n 127│ // and a consumed record beside a missing rule would be the one state\n 128│ // that can never heal.\n 129│ return None;\n## applyhost.rs\n 34│//! `apply_brain_only` handoff, the regression that re-attached a CLI-side\n *35│//! subscriber while the live brain kept running the OLD code.\n 36│//!\n 37│//! New code runs **immediately** — the supervised respawn lands on the new\n 38│//! executable, no manual bounce, no logon. Readiness-gated promotion +\n │...\n 270│ // reached `ready`. Writing `applied` here is the optimism the design indicts\n *271│ // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n 272│ // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n 273│ // carrying the last-known-good `rollback_binary` (the aside we just created)\n 274│ // so the broker's supervisor, a different process from this CLI, can promote\n │...\n 322│ // brain cycle — that is the whole point).\n *323│ let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 324│\n 325│ swap_and_record(cache, exe_path, version, &artifact)?;\n 326│\n │...\n 331│ // level. This replaces the old in-process `apply_brain_only` handoff (the\n *332│ // regression: it re-attached a CLI-side subscriber while the live brain kept\n 333│ // running the OLD code). `classify` already gated this as brain-only, so the\n 334│ // broker never moves; only the brain restarts.\n 335│ //\n │...\n 345│ \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\n *346│ and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\n 347│ predates the restart verb needs a one-time manual daemon restart to run the new code)\"\n 348│ )),\n 349│ }\n │...\n 364│pub fn refresh_brain(broker_name: &str) -> Result {\n *365│ let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366│ brain\n 367│ .request_brain_restart()\n 368│ .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n │...\n 449│\n *450│/// Connect a brain to the broker, retrying through startup races — the channel\n 451│/// the planned brain-restart trigger (ADR-0018 D3-3) rides after the binary\n 452│/// swap. It does NOT attach to a session: the broker holds every hosted endpoint\n 453│/// across the brain cycle, so apply never touches one. `Err` means the broker\n 454│/// never answered (a dead broker fails the apply with the seat untouched).\n *455│fn connect_retry(broker_name: &str) -> io::Result {\n 456│ let mut last = io::Error::other(\"broker never answered\");\n *457│ for _ in 0..300 {\n 458│ match Brain::cold_start(broker_name, now_ms()) {\n 459│ Ok(b) => return Ok(b),\n 460│ Err(e) => last = e,\n │...\n 555│\n *556│ fn cold_connect_retry(broker_name: &str) -> Brain {\n *557│ for _ in 0..300 {\n 558│ if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559│ return b;\n 560│ }\n │...\n 824│ // No signal wired: accepted, not honored.\n *825│ let mut b = cold_connect_retry(&name);\n 826│ assert!(\n 827│ !b.request_brain_restart().expect(\"verb round-trips\"),\n 828│ \"a broker with no supervisor wired must ack honored=false\"\n │...\n 833│ assert!(broker.set_brain_restart(Arc::clone(&signal)), \"first wire wins\");\n *834│ let mut b2 = cold_connect_retry(&name);\n 835│ assert!(\n 836│ b2.request_brain_restart().expect(\"verb round-trips\"),\n 837│ \"a broker with a supervisor wired must ack honored=true\"\n │...\n 905│ // A hosted endpoint that must survive the apply.\n *906│ let mut seat = cold_connect_retry(&name);\n 907│ let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 908│ let child_pid = broker.session_pid(sid);\n 909│ drop(seat); // the seat brain detaches; the broker keeps the child\n │...\n 942│ // binary + records the open trial and returns AppliedDaemonless. RED without\n *943│ // the daemonless path: apply_staged would block on connect_retry against a\n 944│ // dead socket (300×10ms) and then fail — never landing the bytes. Proves the\n 945│ // swap no longer depends on a live broker to hand off to.\n 946│ #[test]\n │...\n 1036│\n*1037│ let mut seat = cold_connect_retry(&name);\n 1038│ let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 1039│ let child_pid = broker.session_pid(sid);\n 1040│ drop(seat);\n │...\n 1077│ // [unit->REQ-UPD-6] Broker-touching debug/update-set payloads are accepted\n*1078│ // as staged candidates, but apply refuses them typed while the broker-held\n 1079│ // runtime is live. The first broker-touching flow is refusal-only; it does\n 1080│ // not auto-suspend or cycle hosted work.\n 1081│ #[test]\n## attach.rs\n 80│/// The control surface an attach request gates against: a read-only viewer is\n *81│/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\n 82│/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\n 83│/// endpoint without also handing over its keyboard.\n 84│// [impl->REQ-ACL-RC-VIEW-SPLIT]\n │...\n 91│\n *92│/// What the engine room's structural locks say about one attach attempt\n 93│/// (ADR-0052 §3).\n 94│#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 95│pub enum EngineRoomLock {\n │...\n 488│ // Keep wire forwards on a separate broker connection: its handler may wait\n *489│ // for network egress while `brain` receives session and stream events. This\n 490│ // split fixed the historical inline-controller-replay/forwarding cycle\n 491│ // (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT). Controller replay now has its own\n 492│ // writer, but it still shares `brain`'s return carrier with handler replies.\n │...\n 611│ } if sid == stream_id => {\n *612│ for rec in decoder.push(&bytes) {\n 613│ match rec {\n 614│ AttachRecord::Request {\n 615│ session_id,\n │...\n 750│ // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n *751│ for (op, b) in pending_input.drain(..) {\n 752│ brain.send_effect_no_ack(MintedOp::new(Minter::Rc, op), &b)?;\n 753│ }\n 754│ }\n │...\n 791│ }\n *792│ // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\n 793│ // broker-authored records forwarded onto the attach wire for the\n 794│ // controller's rc to render. Additive record kinds — pushed only\n 795│ // to a controller that declared the capability, so an N-1 rc\n │...\n 1120│\n*1121│ for from_this_node in [true, false] {\n 1122│ assert_eq!(\n 1123│ classify_rc_lock(true, from_this_node, Viewer),\n 1124│ EngineRoomLock::NoViewport,\n │...\n 1148│ // Every other endpoint is untouched by all of it.\n*1149│ for intent in [Viewer, Control, Take] {\n*1150│ for from_this_node in [true, false] {\n 1151│ assert_eq!(\n 1152│ classify_rc_lock(false, from_this_node, intent),\n 1153│ EngineRoomLock::Pass\n## attachment.rs\n 32│//! lock-across-effect discipline, KH 7.12/5.16). The push itself is best-effort\n *33│//! with NO retry loop: a downed daemon holds no slot, and the next edge or the\n 34│//! next [`SWEEP`] re-covers — the frame carries current state, so nothing is lost\n 35│//! by a failed write. It **inherits the drive-control path's existing IPC bound**\n 36│//! (see [`crate::drivehub::attach_write`]); no new deadline is minted here.\n │...\n 59│/// with no edge signal. Covers what an edge flag cannot describe — a link\n *60│/// established while nothing was attaching, a relink, a daemon that missed the\n 61│/// edge — and it is what makes a dropped push self-heal.\n 62│const SWEEP: Duration = Duration::from_secs(2);\n 63│\n │...\n 142│ }\n*143│ for node in &self.viewer_nodes {\n 144│ *counts.entry(node.as_str()).or_default() += 1;\n 145│ }\n 146│ counts\n │...\n 163│ let mut moved: Vec<&str> = Vec::new();\n*164│ for node in before.keys().chain(after.keys()) {\n 165│ if before.get(node).copied().unwrap_or(0) != after.get(node).copied().unwrap_or(0)\n 166│ && !moved.contains(node)\n 167│ {\n │...\n 200│ Link,\n*201│ /// The owner's attachment moved while the link stayed put. This is the only\n 202│ /// kind that may name a changed node.\n 203│ State,\n 204│}\n │...\n 256│ seen.clear();\n*257│ for o in observed {\n 258│ seen.insert(\n 259│ (o.owner.clone(), o.shell_id.clone()),\n 260│ (o.token.clone(), o.attach.clone()),\n │...\n 282│ let mut out = Vec::new();\n*283│ for owner in owners {\n 284│ let attach = &attachments[owner];\n 285│ // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 286│ // stream to carry the frame — same reason an offline instance is skipped.\n │...\n 297│ .collect();\n*298│ for (shell_id, token) in linked {\n 299│ out.push(AttachObservation {\n 300│ owner: owner.clone(),\n 301│ shell_id,\n │...\n 310│/// Push one owed frame into the shell's attachment slot. Best-effort with NO\n*311│/// retry loop: a downed daemon holds no slot, and the next edge or sweep\n 312│/// re-pushes — the frame is current-state-carrying, so nothing is lost by a\n 313│/// failed write.\n 314│// [impl->REQ-ATTACH-LINK-PUSH]\n │...\n 345│ let pushes = plan_attach_pushes(seen, &observed);\n*346│ for push in &pushes {\n 347│ push_attach(drive_socket, push);\n 348│ }\n 349│ remember(seen, &observed);\n │...\n 358│pub struct AwayState {\n*359│ /// When the endpoint became unattached (epoch ms), or `None` while someone\n 360│ /// is attached.\n 361│ pub unattached_since: Option,\n 362│ /// Whether the away notice has already fired for THIS unattached stretch.\n │...\n 408│ let mut owed = Vec::new();\n*409│ for endpoint in endpoints {\n 410│ let state = mem.entry(endpoint.clone()).or_default();\n 411│ if attachments[endpoint].is_unattached() {\n 412│ let since = *state.unattached_since.get_or_insert(now_ms);\n │...\n 482│ let mut last_sweep: Option = None;\n*483│ while !stop.load(Ordering::SeqCst) {\n 484│ let edged = take_attach_observation();\n 485│ let due = edged\n 486│ || last_sweep\n │...\n 496│ // that agent happens to own a shell.\n*497│ for action in plan_away(&mut away, now_ms(), &attachments) {\n 498│ deliver_away_notice(&action);\n 499│ }\n 500│ last_sweep = Some(Instant::now());\n │...\n 542│ // establishment, so \"first sight\" is itself an emit trigger — a binary that\n*543│ // starts while nobody is attached must not wait for an attachment that may\n 544│ // never come. And nothing CHANGED for that link, so it names no node.\n 545│ #[test]\n 546│ fn an_unseen_link_owes_a_link_push_with_no_changed_node() {\n │...\n 564│ remember(&mut seen, &before);\n*565│ // The attachment ALSO moved while the link was down; the relink push\n 566│ // carries the current state and claims no edge.\n 567│ let after = vec![obs(\"ana\", \"sh-0\", \"t2\", attach(None, &[\"node-c\"]))];\n 568│ let pushes = plan_attach_pushes(&seen, &after);\n │...\n 730│ plan_away(&mut mem, t0 + AWAY_AFTER.as_millis() as u64 + 2, &live).is_empty(),\n*731│ \"the return is an edge too — it does not repeat while someone watches\"\n 732│ );\n 733│\n 734│ // the latch cleared, so the NEXT unattached stretch can go away again\n## autostart.rs\n 20│\n *21│/// How long to keep retrying a launch whose broker round-trip failed — the\n 22│/// replay thread starts alongside the broker's serve thread, so the very first\n 23│/// connect can race the accept loop up. Bounded and short: a genuine launch\n 24│/// failure (dead adapter binary, bad template) fails again instantly and we\n *25│/// move on after the last attempt.\n 26│const LAUNCH_ATTEMPTS: u32 = 3;\n 27│const LAUNCH_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(750);\n 28│\n │...\n 56│ Launched,\n *57│ /// The launch was attempted and failed after its retries.\n 58│ Failed,\n 59│}\n 60│\n │...\n 90│ let node_label = spt_store::hostlabel::node_fill_label(None);\n *91│ for entry in entries {\n 92│ // A saved default naming the reserved id is skipped, LOUDLY, and this\n 93│ // arm is not redundant with the refusal at save. A record written\n 94│ // before that refusal existed is already on disk on real nodes, and a\n │...\n 141│ let mut launched = false;\n*142│ for attempt in 1..=LAUNCH_ATTEMPTS {\n 143│ match crate::harnesshost::launch_harness_brokered_in(\n 144│ broker_name,\n 145│ &entry.id,\n │...\n 171│ last_err = e;\n*172│ if attempt < LAUNCH_ATTEMPTS {\n 173│ std::thread::sleep(LAUNCH_RETRY_DELAY);\n 174│ }\n 175│ }\n │...\n 241│ writer.call_count() > 1,\n*242│ \"fixture must exercise write_all's short-write retry\"\n 243│ );\n 244│ assert_eq!(\n 245│ writer.joined(),\n │...\n 297│ // Must return promptly — the skip happens before the bogus socket is\n*298│ // ever dialed, so no retry loop, no launch, no hang.\n 299│ replay_bounded(Duration::from_secs(10));\n 300│ });\n 301│ }\n## bootstrap_firewall.rs\n 83│/// F-A1-1 (releases#304 W2, HFENDULEAM field leg 2026-09-12) was a verify whose\n *84│/// WRITES HAD ALREADY LANDED while the command was still walking the store: the\n 85│/// event log timestamped them ~2.5-3.2 s before the command returned, and the\n 86│/// only way to learn that was to read the Windows event log by hand. Nothing in\n 87│/// the product could say which leg spent the budget, or whether the child was\n │...\n 189│ let mut err = String::new();\n*190│ for _ in 0..2 {\n 191│ let (is_stdout, bytes) = rx.recv_timeout(deadline.saturating_duration_since(Instant::now()))\n 192│ .map_err(|_| format!(\"{program}: firewall output did not complete\"))?;\n 193│ let bytes = bytes.map_err(|error| format!(\"{program}: reading output: {error}\"))?;\n │...\n 301│\n*302│ for value in [\"1\", \"\", \"0\", \"false\"] {\n 303│ OptOut::set(value);\n 304│ let error = mutation_permitted().expect_err(\n 305│ \"an exported SPT_INSTALL_NO_FIREWALL must disable mutation regardless of value\",\n │...\n 352│\n*353│ /// Observation is read-only and must stay available while mutation is disabled,\n 354│ /// but it still refuses arguments the broker did not actually supply. Neither\n 355│ /// case reaches a platform command.\n 356│ // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n │...\n 361│\n*362│ for opted_out in [false, true] {\n 363│ if opted_out {\n 364│ OptOut::set(\"1\");\n 365│ } else {\n │...\n 409│\n*410│ for required in [\n 411│ \"$ErrorActionPreference = 'Stop'\",\n 412│ \"Import-Module NetSecurity\",\n 413│ \"spt-core-bootstrap-inbound-tcp\",\n## brain.rs\n 176│ },\n *177│ /// Broker→controller-serve: one ceremony attempt's verdict for the\n 178│ /// overlay (`refused` re-prompts; the rest close it). Forwarded as\n 179│ /// `AttachRecord::SealCeremonyResult`.\n 180│ // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n │...\n 677│ ///\n *678│ /// Verification, the attempt ledger, and the mint all run DAEMON-SIDE —\n 679│ /// the adversary here is an agent on this box that can speak this same\n 680│ /// IPC, so nothing about the answer is decided in this process. An N-1\n 681│ /// broker that predates the verb answers unknown-kind, surfaced as a LOUD\n │...\n 739│ /// never as a reply to this frame (the serve loop must keep pumping\n *740│ /// output while the gate decides).\n 741│ // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n 742│ // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n 743│ pub fn seal_ceremony_code(\n │...\n 929│ /// brain↔broker conn without returning to read. With no ack the broker's\n *930│ /// per-conn handler never writes back while servicing that flood, so the return\n 931│ /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n 932│ /// broker still dedups by `(session, op_id)` at its applied-set.\n 933│ // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n │...\n 1412│ // (D4-2b); a legacy brain (empty map) uses the `next_seq` set above. The\n*1413│ // resume-mode dedup-cursor reset for an explicit re-subscribe lives in\n 1414│ // `subscribe_with` (P1c, shared by `attach`/`attach_as`).\n 1415│ self.subscribe(session_id, from_seq)\n 1416│ }\n │...\n 1546│ /// Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the\n*1547│ /// broker for **every** hosted session and re-attach **each** in resume mode\n 1548│ /// from the broker's per-session delivered cursor (`resume_seq`). This is the\n 1549│ /// production replacement for the retired single-session `BrainState` handoff\n 1550│ /// frame — a brain the supervisor respawns (crash *or* update) reconstructs\n │...\n 1598│ let mut resumed = Vec::with_capacity(total);\n*1599│ for info in reply.sessions {\n 1600│ // Seed the dedup cursor at the broker's resume point BEFORE the subscribe\n 1601│ // replay starts arriving, then re-attach (Viewer) from there.\n 1602│ self.session_cursors\n │...\n 1636│ let mut resumed = Vec::with_capacity(reply.sessions.len());\n*1637│ for info in reply.sessions {\n 1638│ self.session_cursors\n 1639│ .insert(info.session_id, info.resume_seq);\n 1640│ resumed.push(info.session_id);\n │...\n 1941│ /// held meet `session_id`. The daemon dials the HELD address (no re-search)\n*1942│ /// and runs the ceremony. A wrong-code retry calls this again with the SAME\n 1943│ /// session id (ceremony only). The code never persists.\n 1944│ // [impl->REQ-JOIN-TWO-PHASE]\n 1945│ pub fn pair_submit_code(&mut self, session_id: u64, code: &str) -> io::Result {\n │...\n 2134│ /// List the streams the broker holds (D4b) — how a re-attaching brain\n*2135│ /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n 2136│ pub fn net_streams(&mut self) -> io::Result {\n 2137│ self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n 2138│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n │...\n 2403│ /// setting the local cursor (D4c) — gapless, exactly-once presence resume:\n*2404│ /// events produced while no brain was attached replay from the cursor.\n 2405│ // [impl->REQ-EP-4]\n 2406│ pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407│ self.presence_cursor = Some(from_seq);\n │...\n 2453│ /// adopts the whole block — traceability tag included — and leaves the\n*2454│ /// function undocumented while `traceable-reqs` still counts that tag as\n 2455│ /// present. That is a green that survives the regression.\n 2456│ ///\n 2457│ /// (The tag is named in words rather than written out here: the checker reads\n │...\n 2577│ /// — the poison signal the pump escalates to a supervised restart (NEVER a\n*2578│ /// per-peer retry). A `Disconnected` channel means the reader thread exited\n 2579│ /// (the conn hung up); surface it as `UnexpectedEof`.\n 2580│ // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n 2581│ // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n │...\n 2825│ let server_thread = thread::spawn(move || {\n*2826│ while let Ok(env) = frames.recv() {\n 2827│ if write_frame(&mut send, &env).is_err() {\n 2828│ break;\n 2829│ }\n │...\n 2913│ let deadline = brain.call_deadline();\n*2914│ for seq in 0u64..=2 {\n 2915│ stub.feed\n 2916│ .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 2917│ .unwrap();\n │...\n 2956│ let deadline = brain.call_deadline();\n*2957│ for seq in 3u64..=5 {\n 2958│ stub.feed\n 2959│ .send(output_envelope(sid, seq, format!(\"r{seq}\").as_bytes()))\n 2960│ .unwrap();\n │...\n 3028│ let deadline = brain.call_deadline();\n*3029│ for seq in 0u64..=1 {\n 3030│ stub.feed\n 3031│ .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 3032│ .unwrap();\n │...\n 3198│ let deadline = brain.call_deadline();\n*3199│ for _ in 0..2 {\n 3200│ match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3201│ BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3202│ other => panic!(\"expected Output, got {other:?}\"),\n │...\n 3253│ // The ring rolled between reads: the next Output frame carries a seq far\n*3254│ // ABOVE the cursor (4504 while cursor is 100 — the legacy path would fatal\n 3255│ // `output gap: got 4504 want 100`). Snap-above must ACCEPT it.\n 3256│ stub.feed.send(output_envelope(sid, 4504, b\"ROLLED\")).unwrap();\n 3257│ let deadline = brain.call_deadline();\n │...\n 3278│ let deadline = brain.call_deadline();\n*3279│ for _ in 0..2 {\n 3280│ match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3281│ BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3282│ other => panic!(\"expected Output, got {other:?}\"),\n## brainproc.rs\n 44│/// A run at least this long counts as healthy and resets the backoff floor.\n *45│/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n 46│/// brain has this long to signal `ready` for its generation before the window\n 47│/// elapses (the \"up but useless\" alive-never-ready rollback path).\n 48│const SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n *49│/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n 50│/// **exits before** signaling ready is respawned this many consecutive times\n 51│/// (a transient first-boot hiccup should not abandon a good binary) before the\n 52│/// supervisor auto-rolls-back to the last-known-good binary. Matched to the\n │...\n 114│ Crash,\n*115│ /// A respawn the broker itself initiated for a binary swap (wired in D3-3).\n 116│ Update,\n 117│}\n 118│\n │...\n 201│ let name = broker_socket_name();\n*202│ let mut brain = connect_retry(&name, BRAIN_CONNECT_TRIES)?;\n 203│ // The broker hands {generation, start-reason} at spawn (ADR-0018 V2): the\n 204│ // generation is broker-owned custody of the KH-2.4 counter (no longer the\n 205│ // brain→brain BrainState.generation, which retires in D4), and the reason is\n │...\n 227│ // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n*228│ // paid for that twice: four cells burned a full 30s readiness budget while\n 229│ // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n 230│ // (blocked broker reply-read vs the first-call whole-exe hash) could not be\n 231│ // separated from the log at all. `activity_link_push_e2e` then failed again\n │...\n 446│\n*447│/// Connect to the broker, retrying briefly while it finishes binding.\n*448│fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449│ let mut last: Option = None;\n*450│ for _ in 0..tries {\n 451│ match Brain::cold_start(name, now_ms()) {\n 452│ Ok(b) => return Ok(b),\n 453│ Err(e) => {\n │...\n 514│/// `current_exe`/read stays `None` for the process lifetime — no per-tick\n*515│/// retry, the breadcrumb simply omits the field). Restoration D7-1: the\n 516│/// `exe_hash` breadcrumb that proves *which bytes* a brain generation is\n 517│/// running. The once-per-process capture is load-bearing TWICE\n 518│/// (REGISTRY-LIFECYCLE R1): the pre-fix per-tick re-read hashed 30+ MiB every\n │...\n 594│/// deterministically with a scripted ready/no-ready + a capturing notif sink,\n*595│/// while production binds the real `spt_home` + relcache + notif sender\n 596│/// ([`ProductionTrialEnv`]). Every method is **best-effort / fail-safe**: a\n 597│/// missing record reads as \"no pending trial\", an absent ready file as\n 598│/// \"not ready\" — the broker's supervisor thread never panics (a panic there\n │...\n 756│/// (epoch.rs) holds at this `EpochSource::load`. **Do NOT fire broker-side notifs\n*757│/// while a brain is live:** concurrent `EpochSource` read-modify-write across the\n 758│/// two processes mints duplicate epochs (KH 4.8 lost-update). The forward fix for\n 759│/// any future broker-side live-notif is cross-process serialization (a file\n 760│/// lock), not relaxing this rule.\n │...\n 765│/// logged, never fatal. Dismissal consumes NO epoch, so — unlike producing a\n*766│/// notif — it is safe to call brain-side while the swap is live.\n 767│// [impl->REQ-NOTIF-SEAM-DISMISS]\n 768│fn dismiss_update_notifs_on_apply() {\n 769│ let Ok(store) = spt_store::notif::NotifStore::open() else {\n │...\n 772│ };\n*773│ for (subnet, _) in &crate::notif::NotifSurfacePolicy::load().subnets {\n*774│ for key in [\n 775│ crate::notif::NOTIF_KEY_UPDATE_STAGED,\n 776│ crate::notif::NOTIF_KEY_ROLLBACK,\n 777│ ] {\n │...\n 793│ let owlery = spt_store::perch::owlery_dir();\n*794│ for (subnet, _) in &policy.subnets {\n 795│ if let Err(e) = crate::notif::produce_rollback_notif(\n 796│ quarantine_version,\n 797│ running_version,\n │...\n 814│ let mut slept = Duration::ZERO;\n*815│ while slept < backoff && !stop.load(Ordering::Relaxed) {\n 816│ thread::sleep(TICK.min(backoff.saturating_sub(slept)));\n 817│ slept += TICK;\n 818│ }\n │...\n 853│/// NOT a promote: the W2 stall-evict only BOUNDS the false-promote window to\n*854│/// `BRAIN_WRITE_DEADLINE`, so a new brain can signal ready while the OLD generation's\n 855│/// local controller conn is still wedged (the 22:47 apply \"promoted\" onto a frozen\n 856│/// control plane). So readiness is LATCHED (`ready_seen` — a candidate that stamped\n 857│/// ready then exited is not demoted, preserving the ready-then-exit-still-promotes\n │...\n 863│/// `BRAIN_WRITE_DEADLINE` (15 s) < [`SUPERVISE_HEALTHY_RUN`] (30 s) — and a cleanly-\n*864│/// closed old conn drains at once. `child.try_wait()` is consulted only while\n 865│/// NOT-yet-ready, so a ready-then-exited candidate still promotes once drained.\n 866│fn run_trial(\n 867│ child: &mut Child,\n │...\n 922│ }\n*923│ // Only watch for a pre-ready exit while the candidate has NOT reached ready;\n 924│ // once ready-seen we are waiting on the OLD gen to drain, and a ready-then-\n 925│ // exited child still promotes (the exit is a normal later respawn).\n 926│ if !ready_seen {\n │...\n 929│ Ok(None) => {}\n*930│ // A wait error: treat as a pre-ready exit (fail toward retry, never\n 931│ // a panic in the supervisor thread).\n 932│ Err(e) => {\n 933│ spt_proto::emit_line_err!(\"BRAIN_TRIAL_WAIT_FAIL: {e}\");\n## broker.rs\n 23│//! last-seen `seq + 1`; the broker replays the ring from there, then streams\n *24│//! live. The brain dedups by `seq`. Output produced *while no brain was\n 25│//! attached* sits in the ring and is replayed on the next subscribe — so a\n 26│//! brain restart loses nothing.\n 27│//!\n │...\n 221│/// blocked). The brain aggregates every session + psyche + WAN feed, so its drain\n *222│/// is bursty; 15 s tolerates a normal burst-stall while still bounding the wedge.\n *223│/// A slow-but-DRAINING brain never trips it — the clock only advances while a write\n 224│/// is genuinely in flight past the deadline (see [`ControllerSink::write_blocked_since`]).\n 225│// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n 226│const BRAIN_WRITE_DEADLINE: Duration = Duration::from_secs(15);\n │...\n 250│/// by the holder's PROGRESS (see `phase_wedge_ceiling`) and not by a clock.\n *251│/// Poll slice while waiting on a racing wake's session to appear.\n 252│const WAKE_DEDUP_POLL: Duration = Duration::from_millis(50);\n 253│\n 254│/// What a held wake claim knows about its holder's PROGRESS (#235).\n │...\n 296│/// holds generation N+1, and the old holder finally completes and drops. A\n *297│/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298│/// is still in flight, so the next duplicate wake sails through the gate —\n 299│/// re-opening, one wake later, exactly the double-create this guard exists to\n 300│/// close. Pure over the map so the no-op is a unit.\n │...\n 312│/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\n *313│/// on a slow-but-live holder is latency, while the cost of taking over from one\n 314│/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\n 315│/// detector, never a performance budget.\n 316│fn phase_wedge_ceiling(phase: &str) -> Duration {\n │...\n 350│/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\n *351│/// down + retry, waiting for the racer's session to register), for as long as that\n 352│/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\n 353│/// endpoint, are `Claim`. Pure so the truth table is a unit.\n 354│///\n │...\n 400│/// it would be a lie — exactly when:\n *401│/// - its PTY child (the client-tree root) probes DEAD while the table record\n 402│/// survives (a wedged/missed exit-wait), OR\n 403│/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\n 404│/// forks a harness client chain under the wrapper by construction), PAST\n 405│/// the boot grace, whose wrapper has NO live descendants — the deployah\n *406│/// wedge shape: the launcher shell idles on while the harness underneath\n 407│/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\n 408│/// `shutdown` said NO_EDGE about the same corpse.\n 409│///\n │...\n 487│ // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\n *488│ // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\n 489│ // handle to it stays open — and this broker holds `Arc`, hence\n 490│ // that handle, for exactly the sessions it is asked about. A reaped root\n 491│ // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\n │...\n 496│ // about the process, not about a handle the caller holds, and Linux demotes\n *497│ // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\n 498│ // implies unix implies no handle problem — the two conditions cannot both\n 499│ // fail. Routing to `None` here instead would have DISABLED zombie detection\n 500│ // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\n │...\n 598│/// The coordinator-image read gate (F-025 amendment): a recorded\n *599│/// `(generation, version)` answers only while its generation is STILL the\n 600│/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601│/// reported — rather than the version of a process that no longer exists, so the\n 602│/// surface never outlives the process it describes (the stale-record class that\n │...\n 615│/// doyle non-negotiable = W1's \"never park forever\"): the inject worker holds the\n *616│/// floor — buffering operator input — only while a binary's response to one\n 617│/// `{type:event}` is in flight. If no `{commit}` arrives within this window the\n 618│/// worker FLUSHES the buffer, RELEASES the floor, FAULTS the binary (terminate, no\n 619│/// respawn → idle inbound then SPOOLS, never raw-injected), and never re-opens. A wedged or\n │...\n 744│\n *745│/// Total delivery attempts per sequence: the first drive + ONE re-drive on an\n 746│/// echo-verify miss (doyle ruling A layer 2: \"re-drive once; on a second miss, LOUD\n *747│/// spool\"). 2 = one initial + one retry.\n 748│const INJECT_REDRIVE_ATTEMPTS: u32 = 2;\n 749│\n 750│/// Chunk size for the paced text write (Layer 3, the ruling's named fallback where\n │...\n 866│ /// a channel that stays Full for [`CONTROLLER_WRITE_DEADLINE`] PAST this stamp\n *867│ /// evicts the stalled controller (bounded wedge preserved), while a slow-but-\n 868│ /// alive controller just drops the chunk + falls behind the ring (resume-from-\n 869│ /// floor). Seeded `now` at [`OutputLog::become_controller`].\n 870│ last_ok: Instant,\n │...\n 958│ dropped: u64,\n *959│ /// The `seq` range assigned while delivery was suppressed, `(first, last)` —\n 960│ /// the watermark source for the commit/abort sync frame\n 961│ /// (REQ-RC-RESIZE-PRESENTATION-BARRIER leg 3).\n 962│ suppressed: Option<(u64, u64)>,\n │...\n 965│impl ResizeTransition {\n *966│ /// Record one seq assigned while this transition suppressed delivery.\n 967│ fn note_suppressed(&mut self, seq: u64) {\n 968│ self.suppressed = Some(match self.suppressed {\n 969│ Some((first, _)) => (first, seq),\n │...\n 1003│/// an isolated bounded queue + writer thread, evicted on overflow). Every\n*1004│/// controller send and viewer `try_send` happens while the enclosing\n 1005│/// `Mutex` is held, so frames reach each sink in strict `seq` order.\n 1006│struct OutputLog {\n 1007│ session_id: u64,\n │...\n 1178│/// `controlled:false` and no later edge re-stamps, so the endpoint reads uncontrolled\n*1179│/// forever while driven. This DIVERGENCE-GATED re-assert (on the `KIND_SESSIONS` poll,\n 1180│/// bounded by the reconcile cadence) writes ONLY on a real difference — no fsync storm.\n 1181│/// Best-effort: an unbound / corrupt / perch-less endpoint has nowhere to converge yet.\n 1182│///\n## codec.rs\n 9│//! The frame *codec* is deliberately transport-agnostic: it is the byte-level\n*10│//! contract, while [`crate::transport`] owns the OS-specific connection.\n 11│// [impl->REQ-DAEMON-2]\n 12│\n 13│use std::io::{self, Read, Write};\n## config.rs\n 696│ seeded.save_to(&DaemonConfig::default_path()).unwrap();\n*697│ for id in [\"gw\", \"worker\"] {\n 698│ DaemonConfig::upsert_startup_endpoint(StartupEndpoint {\n 699│ id: id.to_string(),\n 700│ adapter: \"cc\".to_string(),\n## conn.rs\n 46│//! synchronous return IS the completion handshake); (4) the retired half is\n *47│//! parked in a graveyard slot — never dropped while the watchdog might still\n 48│//! touch the raw handle (drop = `CloseHandle`, and a recycled handle value\n 49│//! must never see a late `CancelIoEx`), and never re-gated; (5) on Windows the\n 50│//! pipe is then severed (`DisconnectNamedPipe` — the server end forces the\n │...\n 227│struct Dog {\n*228│ /// `Some((op_id, deadline))` while a write is in flight.\n 229│ inflight: Option<(u64, Instant)>,\n 230│ /// Raised by [`BrokerConn::drop`]; the watchdog exits.\n 231│ shutdown: bool,\n │...\n 459│ };\n*460│ // Sleep toward the deadline while THIS op stays in flight.\n 461│ let fired = loop {\n 462│ if d.shutdown {\n 463│ return;\n │...\n 492│ d = recover(&self.dog);\n*493│ while matches!(d.inflight, Some((cur, _)) if cur == op) && !d.shutdown {\n 494│ let (g, _) = self\n 495│ .dog_cv\n 496│ .wait_timeout(d, Duration::from_millis(100))\n │...\n 671│ // released. Clear the arm BEFORE deciding health, so the watchdog\n*672│ // never severs while the op is formally in flight.\n 673│ {\n 674│ let mut d = recover(&inner.dog);\n 675│ d.inflight = None;\n │...\n 836│ const N: u64 = 32;\n*837│ for round in 0..N {\n 838│ let (conn, mut client, mut recv) = make_duplex_with_log(Arc::clone(&log));\n 839│ conn.describe(\"role=brain\");\n*840│ for seq in 0..4 {\n 841│ let request = Envelope::new(\"poll\", serde_json::json!([round, seq]));\n 842│ write_frame(&mut client, &request).unwrap();\n 843│ let received = crate::codec::read_frame(&mut recv).unwrap();\n │...\n 881│ assert_eq!(lines.len(), 3, \"role event, retirement and poisoned close survive\");\n*882│ for line in lines.iter() {\n 883│ assert!(line.contains(&format!(\"conn={id}\")));\n 884│ assert!(line.contains(\"role=brain controller session=7\"));\n 885│ assert!(line.contains(&format!(\"first_write_wall_ms={}\", start.wall_ms)));\n │...\n 922│ // Attribution parity: every field present on BOTH tokens.\n*923│ for (name, line) in [(\"POISONED\", &poisoned), (\"RETIRED\", &retired)] {\n 924│ assert!(\n 925│ line.contains(&format!(\"conn={}\", conn.id())),\n 926│ \"{name} carries the stable conn id: {line}\"\n │...\n 950│ // observable; loop until the failure surfaces (bounded).\n*951│ for _ in 0..200 {\n 952│ match conn.write(&env) {\n 953│ Err(e) => {\n 954│ organic = Some(e);\n │...\n 980│\n*981│ for i in 0..100 {\n 982│ a.describe(&format!(\"fact-{i}-padding-padding-padding\"));\n 983│ }\n 984│ let label = recover(&a.inner.label).clone();\n## crc_swap.rs\n 52│) -> std::io::Result<()> {\n *53│ for entry in std::fs::read_dir(dir)? {\n 54│ let entry = entry?;\n 55│ let path = entry.path();\n 56│ if path.is_dir() {\n │...\n 131│ // [impl->REQ-CRC-SWAP-OLD-DISPLACE]\n*132│ for swap in plan {\n 133│ if swap.target.exists() {\n 134│ gc_stale_old(&swap.target);\n 135│ }\n │...\n 138│ // Phase 1 — stage every new file beside its target.\n*139│ for swap in plan {\n 140│ if let Some(parent) = swap.target.parent() {\n 141│ std::fs::create_dir_all(parent)?;\n 142│ }\n │...\n 151│ let mut committed: Vec<(&Path, Option)> = Vec::new();\n*152│ for swap in plan {\n 153│ let target = swap.target.as_path();\n 154│ let displaced = if target.exists() {\n 155│ // DISPLACE: rename the original ASIDE to a fresh, non-colliding name so a\n │...\n 181│ // retries it, never a brick).\n*182│ for (_, displaced) in &committed {\n 183│ if let Some(old) = displaced {\n 184│ let _ = std::fs::remove_file(old);\n 185│ }\n │...\n 205│ }\n*206│ for n in 1u64.. {\n 207│ let candidate = sibling(target, &format!(\"old-{n}\"));\n 208│ if !candidate.exists() {\n 209│ return candidate;\n │...\n 229│ };\n*230│ for entry in entries.flatten() {\n 231│ if let Some(name) = entry.file_name().to_str() {\n 232│ if name == base || name.starts_with(&dashed) {\n 233│ let _ = std::fs::remove_file(entry.path());\n │...\n 262│) {\n*263│ for (target, displaced) in committed.iter().rev() {\n 264│ let _ = rename(target, &new_path(target));\n 265│ if let Some(old) = displaced {\n 266│ let _ = rename(old, target);\n │...\n 272│fn cleanup_new(plan: &[PlannedSwap]) {\n*273│ for swap in plan {\n 274│ let _ = std::fs::remove_file(new_path(&swap.target));\n 275│ }\n 276│}\n │...\n 303│ fn walk(dir: &Path, found: &mut bool) {\n*304│ for entry in fs::read_dir(dir).unwrap() {\n 305│ let path = entry.unwrap().path();\n 306│ if path.is_dir() {\n 307│ walk(&path, found);\n │...\n 661│ stranded_old.exists() && fs::read(&stranded_old).unwrap() == b\"LAST-GOOD-V1\",\n*662│ \"the last-good `.old` is NOT GC'd while the target was missing — survives \\\n 663│ to be swept next run (never a no-binary double-fault window)\"\n 664│ );\n 665│ }\n## daemon.rs\n 36│const START_TIMEOUT: Duration = Duration::from_secs(5);\n *37│/// Poll cadence while waiting for the spawned daemon to come up.\n 38│const START_POLL: Duration = Duration::from_millis(25);\n 39│\n 40│/// The per-machine broker/brain daemon process.\n │...\n 131│ // [impl->REQ-HAZARD-STALE-INDEX-LOCK]\n *132│ for lock in spt_store::branchstore::sweep_stale_index_locks(\n 133│ &spt_store::contextstore::seed_git_dir(&spt_store::perch::tracked_dir()),\n 134│ spt_store::branchstore::STALE_LOCK_AGE,\n 135│ ) {\n │...\n 150│ }\n *151│ for name in &att.detached {\n 152│ // Plain prose (no Markdown markers): spt-daemon can't import the\n 153│ // bin-local helpfmt renderer, so this one source string is authored\n 154│ // marker-free rather than rendered. The `SUBNET_DETACHED:{name}`\n │...\n 200│ // at boot — REQ-DAEMON-9) is transient and retried, but a broken\n *201│ // identity is not, so we only arm the retry when identity is sound.\n 202│ let node_hex: Option = spt_store::nodeid::load_or_create()\n 203│ .ok()\n 204│ .map(|i| i.public_key().to_hex());\n │...\n 207│ } else {\n *208│ spt_proto::emit_line_err!(\"NODE_KEY_FAIL: identity unavailable — broker runs net-less, no retry\");\n 209│ None\n 210│ };\n 211│\n │...\n 242│ let broker = Arc::clone(&broker);\n *243│ thread::spawn(move || net_retry_attach(broker));\n 244│ }\n 245│ // The ATTACHMENT observer (releases#44 / releases#45): it runs\n 246│ // in the BROKER because attachment truth is broker MEMORY —\n │...\n 555│ // Re-runs on every successful bind, including the REQ-DAEMON-9\n *556│ // self-heal retry — the port is new each time.\n 557│ if let Some(port) = host.bound_port() {\n 558│ crate::firewall::verify_and_record_self(port);\n 559│ }\n │...\n 570│/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\n *571│/// up) keeps retrying `try_start_net` with capped backoff and, on success,\n 572│/// ATTACHES the host to the live broker (`OnceLock`, so exactly once). The node\n 573│/// becomes reachable without a manual restart. Runs until net binds — the\n 574│/// network always arrives eventually after boot. The net consumers are no longer\n │...\n 577│// [impl->REQ-DAEMON-9]\n *578│fn net_retry_attach(broker: Arc) {\n 579│ let mut backoff = NET_RETRY_FIRST;\n 580│ loop {\n 581│ thread::sleep(backoff);\n │...\n 583│ if broker.attach_net(host) {\n *584│ spt_proto::emit_line_err!(\"NET_ATTACHED: net endpoint bound on retry — brain starts the consumers\");\n 585│ }\n 586│ return;\n 587│ }\n *588│ backoff = net_retry_backoff(backoff);\n *589│ spt_proto::emit_line_err!(\"NET_BIND_RETRY: net still unavailable, retrying in {}s\", backoff.as_secs());\n 590│ }\n 591│}\n 592│\n │...\n 595│\n *596│/// The net self-heal backoff ladder (REQ-DAEMON-9): double each retry, capped\n 597│/// at [`NET_RETRY_CAP`]. Pure for tests.\n *598│fn net_retry_backoff(cur: Duration) -> Duration {\n 599│ (cur * 2).min(NET_RETRY_CAP)\n 600│}\n 601│\n │...\n 620│ let mut waited = Duration::ZERO;\n *621│ while waited < START_TIMEOUT {\n 622│ if is_running() {\n 623│ return Ok(());\n 624│ }\n │...\n 712│ // RE-DECIDE under the lock: the winner may have already brought the daemon\n *713│ // up, and the operator's stop may have landed while we queued.\n 714│ match ensure_decision(is_running(), spt_store::daemon_inhibit::stop_inhibited()) {\n 715│ EnsureOutcome::AlreadyRunning => return Ok(EnsureOutcome::AlreadyRunning),\n 716│ EnsureOutcome::DeclinedStopInhibited => {\n │...\n 970│\n *971│/// One CreateProcessW attempt: spawn `program args…` detached, inheriting NO\n 972│/// handles, with `extra_flags` OR'd onto the base detached flags. The single\n 973│/// FFI primitive shared by [`detached_no_inherit_env`] and the daemon's job-neutral\n 974│/// launcher ladder ([`launch_daemon_job_neutral`]).\n │...\n 998│\n *999│/// Mark one handle inheritable, the precondition for naming it in a\n 1000│/// `PROC_THREAD_ATTRIBUTE_HANDLE_LIST`: a handle in the list that is not\n 1001│/// inheritable fails `CreateProcessW` outright.\n 1002│#[cfg(windows)]\n │...\n 1054│ let mut vars: Vec<(OsString, OsString)> = std::env::vars_os().collect();\n*1055│ for k in remove {\n 1056│ vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1057│ }\n*1058│ for (k, v) in extra {\n 1059│ vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1060│ vars.push((OsString::from(k), OsString::from(v)));\n 1061│ }\n## deelevate.rs\n 81│/// (still carrying `SPT_HOME`) sees no daemon and prints `DAEMON_NOT_RUNNING`\n *82│/// while the orphaned daemon serves the wrong home.\n 83│// [impl->REQ-HAZARD-ELEVATED-DAEMON-SPAWN]\n 84│pub fn apply_env_overrides(block: &[u16], overrides: &[(String, String)]) -> Vec {\n 85│ const NUL: u16 = 0;\n │...\n 89│ let mut cur: Vec = Vec::new();\n *90│ for &u in block {\n 91│ if u == NUL {\n 92│ if cur.is_empty() {\n 93│ break;\n │...\n 106│ };\n*107│ for (k, v) in overrides {\n 108│ let key = k.to_ascii_uppercase();\n 109│ entries.retain(|e| name_of(e) != key);\n 110│ entries.push(format!(\"{k}={v}\").encode_utf16().collect());\n │...\n 112│ let mut out: Vec = Vec::new();\n*113│ for e in &entries {\n 114│ out.extend_from_slice(e);\n 115│ out.push(NUL);\n 116│ }\n │...\n 716│ let mut n = 0usize;\n*717│ while !(*p.add(n) == 0 && *p.add(n + 1) == 0) {\n 718│ n += 1;\n 719│ }\n 720│ // n indexes the last entry's terminating NUL; +2 includes it and the\n │...\n 729│ quote_windows_arg(&mut cmdline, program);\n*730│ for a in args {\n 731│ cmdline.push(' ');\n 732│ quote_windows_arg(&mut cmdline, a);\n 733│ }\n │...\n 766│ // may reject the flag (restricted flag set → 87) or the job may forbid\n*767│ // breakaway (5) — retry WITHOUT it so the de-elevation never fails on it.\n 768│ let mut call = |flags: u32| -> (i32, io::Error) {\n 769│ cmdline_w.copy_from_slice(&cmdline_w0);\n 770│ let ok = unsafe {\n │...\n 827│ let mut v: Vec = Vec::new();\n*828│ for e in entries {\n 829│ v.extend(e.encode_utf16());\n 830│ v.push(0);\n 831│ }\n │...\n 839│ let mut cur: Vec = Vec::new();\n*840│ for &u in block {\n 841│ if u == 0 {\n 842│ if cur.is_empty() {\n 843│ break;\n\n## bin/\n### xlate_choreo_fixture.rs\n 53│\n *54│ for line in stdin.lock().lines() {\n 55│ let Ok(line) = line else { break }; // stdin closed (EOF) → exit (no-zombie).\n 56│ let trimmed = line.trim();\n 57│ if trimmed.is_empty() {\n │...\n 75│ // [int->REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH]\n *76│ // Optional per-test argv path: record this generation's identity while alive.\n 77│ if v.get(\"type\").and_then(|t| t.as_str()) == Some(\"init\") {\n 78│ if let Some(path) = &generation_log {\n 79│ let pid = std::process::id();\n │...\n 140│ // adapter restores flow at the end of its sequence just the same; this keeps\n*141│ // the `ctrl+s` chord (and its real 0x13 mapping + floor exercise) intact while\n 142│ // making the payload's arrival observable, per the test-specialist's latitude.\n 143│ emit(&mut out, r#\"{\"key\":\"ctrl+q\"}\"#);\n 144│ emit(&mut out, r#\"{\"commit\":true}\"#);\n │...\n 162│ let mut s = String::from(\"HEADSTART \");\n*163│ for i in 0..12 {\n 164│ s.push_str(&format!(\"line-{i:02}-payload-body-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\\n\"));\n 165│ }\n 166│ s.push_str(\"TAILEND\");\n\n## bootstrap_firewall/\n### linux.rs\n 77│ let mut enabled = None;\n *78│ for line in text.lines().map(str::trim) {\n 79│ match line {\n 80│ \"ENABLED=yes\" => enabled = Some(true),\n 81│ \"ENABLED=no\" => enabled = Some(false),\n │...\n 246│ let mut rules = Vec::new();\n *247│ for line in text.lines().map(str::trim) {\n 248│ if line.is_empty() || line == \"Status: active\"\n 249│ || line.split_whitespace().collect::>() == [\"To\", \"Action\", \"From\"]\n 250│ || line.chars().all(|c| c == '-' || c.is_whitespace())\n │...\n 290│fn ufw_preflight(rules: &[UfwRule], port: u16) -> Result<(), String> {\n *291│ for rule in rules {\n 292│ if owned(&rule.comment) {\n 293│ ufw_scope(rule)?;\n 294│ } else if rule.comment.starts_with(OWNER) {\n │...\n 311│ let mut count = 0;\n *312│ for rule in &rules {\n 313│ if !owned(&rule.comment) {\n 314│ if rule.comment.starts_with(OWNER) {\n 315│ return Err(\"unrecognized UFW bootstrap ownership comment\".into());\n │...\n 365│ .filter(|rule| rule.comment.starts_with(OWNER)).collect();\n *366│ for rule in &rules {\n 367│ if !owned(&rule.comment) {\n 368│ return Err(\"unrecognized UFW bootstrap comment; cleanup left it untouched\".into());\n 369│ }\n │...\n 372│ rules.sort_by_key(|rule| std::cmp::Reverse(rule.number));\n *373│ for rule in rules {\n 374│ // Numbered UFW deletion has no stable handle. Re-observe the exact\n 375│ // comment and scope immediately before each deletion, descending so our\n 376│ // own deletions cannot retarget subsequent numbers.\n │...\n 437│ }\n *438│ for line in lines {\n 439│ let (key, value) = line.trim().split_once(':')\n 440│ .ok_or_else(|| \"unrecognized firewalld policy scope output\".to_string())?;\n 441│ if fields.insert(key, value.trim()).is_some() {\n │...\n 444│ }\n *445│ for (field, required) in [\n 446│ (\"priority\", \"-32768\"), (\"target\", \"CONTINUE\"),\n 447│ (\"ingress-zones\", \"ANY\"), (\"egress-zones\", \"HOST\"),\n 448│ (\"services\", \"\"), (\"protocols\", \"\"), (\"masquerade\", \"no\"),\n │...\n 507│ if let Some(saved) = saved {\n *508│ for port in saved.ports {\n 509│ command(\"firewall-cmd\", &[\n 510│ \"--permanent\", &policy_arg, &format!(\"--remove-port={port}/tcp\"),\n 511│ ])?;\n │...\n 517│ if let Some(live) = live {\n *518│ for port in live.ports {\n 519│ command(\"firewall-cmd\", &[&policy_arg, &format!(\"--remove-port={port}/tcp\")])?;\n 520│ }\n 521│ if !firewalld_policy()?.ports.is_empty() {\n │...\n 579│ let mut rules = Vec::new();\n *580│ for rule in snapshot.iter().filter_map(|entry| entry.get(\"rule\")) {\n 581│ let comment = rule[\"comment\"].as_str().unwrap_or(\"\");\n 582│ if !comment.starts_with(OWNER) {\n 583│ continue;\n │...\n 644│ }\n *645│ for rule in nft_owned(&nft_snapshot()?)? {\n 646│ command(\"nft\", &[\n 647│ \"delete\", \"rule\", &rule.family, &rule.table, &rule.chain,\n 648│ \"handle\", &rule.handle.to_string(),\n │...\n 785│ let two = marker(Path::new(\"/opt/spt/bin/spt\"));\n *786│ for identity in [&one, &two] {\n 787│ let digest = identity\n 788│ .strip_prefix(OWNER)\n 789│ .unwrap_or_else(|| panic!(\"identity carries the ownership prefix: {identity}\"));\n │...\n 832│\n *833│ for body in [\n 834│ \"5470/tcp ALLOW IN 192.168.1.0/24\",\n 835│ \"5470/tcp ALLOW IN Anywhere on eth0\",\n 836│ \"5470/tcp DENY IN Anywhere\",\n │...\n 841│\n *842│ for body in [\"5470 ALLOW IN Anywhere\", \"5470/udp ALLOW IN Anywhere\", \"0/tcp ALLOW IN Anywhere\"] {\n 843│ let error = ufw_scope(&ufw(body)).unwrap_err();\n 844│ assert!(error.contains(\"not a single TCP port\"), \"{body} => {error}\");\n 845│ }\n │...\n 889│ nat[\"chain\"][\"type\"] = json!(\"nat\");\n *890│ for chain in [ipv4_only, ipv6_only, device, devices, nat] {\n 891│ let error = refusal(nft_input(std::slice::from_ref(&chain)));\n 892│ assert!(error.contains(\"one unrestricted inet/filter input base chain\"), \"{chain} => {error}\");\n 893│ }\n │...\n 925│ let iifname = json!({\"match\": {\"op\": \"==\", \"left\": {\"meta\": {\"key\": \"iifname\"}}, \"right\": \"eth0\"}});\n *926│ for (expr, needle) in [\n 927│ (json!([dport(5470), iifname, {\"accept\": null}]), \"unsupported predicates/actions\"),\n 928│ (json!([dport(5470), {\"drop\": null}]), \"unsupported predicates/actions\"),\n 929│ (json!([dport(5470)]), \"unsupported predicates/actions\"),\n │...\n 953│ // writes into, and nft is the fallback rather than a peer.\n *954│ for (ufw, firewalld, nft_present, expected) in [\n 955│ (true, true, true, \"ufw\"),\n 956│ (true, true, false, \"ufw\"),\n 957│ (true, false, true, \"ufw\"),\n │...\n 1022│ // administrator's allowance for the same port would silently adopt it.\n*1023│ for body in [\"5470/tcp ALLOW IN Anywhere\", \"5470 ALLOW IN Anywhere\"] {\n 1024│ let theirs = ufw_commented(1, body, \"administrator web\");\n 1025│ let error = refusal(ufw_preflight(&[theirs], 5470));\n 1026│ assert!(error.contains(\"unowned rule for port 5470\"), \"{body} => {error}\");\n### windows.rs\n 36│/// HFENDULEAM under the product's own invocation mode, raw element 1 reads back as\n *37│/// \"Enforced\" while the published specification names the same code Full. Comparing\n 38│/// the rendered text refused the SUCCESS VALUE ITSELF and no firewall state could\n 39│/// satisfy the arm. The code is documentation-sourced; the rendering is not, and this\n 40│/// constant deliberately carries no name for it.\n │...\n 65│# SPELLING: measured on HFENDULEAM under this very invocation mode (powershell.exe\n *66│# 5.1.26100.8875), raw element UInt16 1 reads back as the string \"Enforced\", while the\n 67│# verdict compared against \"Full\" -- so the success value itself was refused and no host\n 68│# state could satisfy the arm. The repair is this ACCESSOR, not a cast: casting the\n 69│# adapted value throws on \"Enforced\". CimInstanceProperties is the unadapted CIM view.\n │...\n 351│/// address, has NO LAN to admit, and an empty remote set would render a rule\n *352│/// admitting nothing while reading like a written half.\n 353│#[derive(Debug, Clone, PartialEq, Eq)]\n 354│enum LanScope {\n 355│ /// At least one literal prefix, lowest first, deduplicated.\n │...\n 697│ prefix_length: u8,\n *698│ /// `Preferred` for an address in service; `Tentative`, `Duplicate`,\n 699│ /// `Deprecated` and `Invalid` are addresses the host will not route from.\n 700│ #[serde(rename = \"addressState\")]\n 701│ address_state: String,\n │...\n 802│ // its own happy path the moment the query began enumerating the name set.\n *803│ for spec in &want {\n 804│ if state.active.iter().filter(|rule| rule.name == spec.name).count() > 1 {\n 805│ return Err(format!(\"Ambiguous duplicate bootstrap rules named {}\", spec.name));\n 806│ }\n │...\n 817│ // with a policy-owned name: creating another local rule cannot repair it.\n *818│ for rule in &state.active {\n 819│ if rule.source_type != \"Local\" {\n 820│ return Err(format!(\n 821│ \"Bootstrap rule {} is effective but its source store is {}, not Local: admission that does not come from the persistent store does not survive a reboot\",\n │...\n 832│ }\n *833│ for rule in &state.active {\n 834│ // [impl->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n 835│ if rule.primary_status != PRIMARY_STATUS_OK\n 836│ || !rule.enforcement.contains(&ENFORCEMENT_SUCCESS)\n │...\n 1082│\n*1083│ for rejected in [\"spt.exe\", \"relative\\\\spt.exe\", \"C:\\\\spt\\\\spt\\0.exe\"] {\n 1084│ let error = binder_text(Path::new(rejected))\n 1085│ .expect_err(\"a relative or NUL-bearing path is not a binder identity\");\n 1086│ assert!(\n │...\n 1101│ let composed = script(\"Remove-Owned\");\n*1102│ for required in [\n 1103│ \"$ErrorActionPreference = 'Stop'\",\n 1104│ \"Import-Module NetSecurity\",\n 1105│ RULE_NAME_TAILNET,\n │...\n 1300│ // NetSecurity renders it back.\n*1301│ for (written, read_back) in [\n 1302│ (\"192.168.1.0/24\", \"192.168.1.0/255.255.255.0\"),\n 1303│ (\"100.64.0.0/10\", \"100.64.0.0/255.192.0.0\"),\n 1304│ ] {\n │...\n 1336│\n*1337│ for different in [\n 1338│ \"192.168.1.99\", // a single host inside the prefix: narrower\n 1339│ \"192.168.1.0/25\", // half of it\n 1340│ \"192.168.0.0/16\", // wider\n │...\n 1422│\n*1423│ for missing in 0..want.len() {\n 1424│ let mut half = full.clone();\n 1425│ let dropped = half.remove(missing);\n 1426│ assert!(\n │...\n 1434│ /// Each half is matched against ITS OWN name. A rule wearing one half's\n*1435│ /// name while carrying the other's scope satisfies neither.\n 1436│ // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n 1437│ #[test]\n 1438│ fn a_half_carrying_the_other_halfs_scope_does_not_satisfy_the_pair() {\n │...\n 1514│ /// OMITTED rather than written with an empty remote set, and the verdict says\n*1515│ /// why -- an empty-remote rule would admit nothing while reading, in every\n 1516│ /// later census, exactly like a written half.\n 1517│ // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n 1518│ #[test]\n │...\n 1537│ error.contains(\"Elevation cannot repair\"),\n*1538│ \"and says what will not fix it, since the retry path offers elevation: {error}\"\n 1539│ );\n 1540│ }\n 1541│\n │...\n 1594│\n*1595│ for source in [\"Dynamic\", \"GroupPolicy\", \"\"] {\n 1596│ let mut transient = full.clone();\n 1597│ transient[1].source_type = source.to_string();\n 1598│ let error = decide(&Snapshot { active: transient, addresses: one_lan_census() }, \"c:/spt/spt.exe\", 5470)\n │...\n 1653│ assert_eq!(rendered.matches(\"New-NetFirewallRule\").count(), 2, \"one call per half\");\n*1654│ for spec in &want {\n 1655│ assert!(rendered.contains(spec.name), \"the render names {}\", spec.name);\n 1656│ }\n 1657│ assert!(rendered.contains(\"-RemoteAddress 100.64.0.0/10\"), \"the tailnet scope is written\");\n │...\n 1674│ let mut calls = rendered.split(\"New-NetFirewallRule\").skip(1);\n*1675│ for spec in &want {\n 1676│ let call = calls\n 1677│ .next()\n 1678│ .expect(\"each admission half must have a create call\");\n │...\n 1705│ // dropped by a refactor, or reached after a short-circuit. A token cell\n*1706│ // passing while a verdict cell fails is exactly the gap this block covers.\n 1707│ //\n 1708│ // TWO ROUNDS OF OVERLAP TRIMMING have already removed everything a sibling\n 1709│ // owns; the owners are named at each site so nothing comes back as \"missing\":\n │...\n 1737│\n*1738│ for wrong in [\n 1739│ \"192.168.1.99\", // narrower: one host inside the derived prefix\n 1740│ \"0.0.0.0/0\", // wider: the whole internet\n 1741│ \"not-an-address\" // malformed: no network at all","truncation":{"content":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## access.rs\n 89|//! **classifies** as `agent`. Both are the safe reading of their own field —\n*90|//! abstaining declines to name a subject, while classifying as `agent` declines\n 91|//! to admit an unvouched invocation to a `user`-qualified rule. The five\n 92|//! no-sender families pass `None` for both and are unchanged.\n 93|//!\n...\n 133|/// the warning as much as a named one — it admitted a peer the agent never named\n*134|/// at all — while same-node, a reply, and a posture that simply is not refusing\n 135|/// anyone are the three ratified non-warning cases.\n 136|// [impl->REQ-TRUST-WARNING]\n 137|pub fn warrants_trust_warning(reason: PassReason, receiver_holds_monic: bool) -> bool {\n...\n 302| ];\n*303| for r in warns {\n 304| assert!(\n 305| warrants_trust_warning(r, false),\n 306| \"{r:?} admitted an unclassified peer — it must warn\"\n...\n 312| }\n*313| for r in never {\n*314| for holds in [true, false] {\n 315| assert!(\n 316| !warrants_trust_warning(r, holds),\n 317| \"{r:?} must never warn (holds_monic={holds})\"\n...\n 395| );\n*396| for other in [\n 397| surface::RC_ATTACH,\n 398| surface::MSG,\n 399| surface::SUSPEND,\n...\n 649| // [unit->REQ-ACL-FAIL-CLOSED] ADR-0053: a corrupt store refuses unsolicited\n*650| // traffic on every surface — the flip of ADR-0009's fail-open ruling — while\n 651| // the reply exemption survives, because correlation state is a separate file\n 652| // the degrade never touches.\n 653| #[test]\n...\n 666|\n*667| for sf in surface::v1() {\n 668| assert_eq!(\n 669| access_check(\"ling\", \"bb22\", sf, InboundClass::Unsolicited),\n 670| AccessDecision::Deny,\n*671| \"{sf} must refuse while the store is unreadable\"\n 672| );\n 673| }\n 674| assert_eq!(\n...\n 888| // access-chain class and therefore are not represented in this table.\n*889| for class in [InboundClass::Reply, InboundClass::Unsolicited] {\n 890| assert_eq!(\n 891| classify_engine_room_inbound(Posture::Offline, surface::MSG, class),\n 892| InboundLock::Offline,\n...\n 899| // local controller out of the endpoint it exists to attach.\n*900| for s in [surface::RC_VIEW, surface::RC_ATTACH] {\n*901| for posture in [Posture::Online, Posture::Offline] {\n 902| assert_eq!(\n 903| classify_engine_room_inbound(posture, s, InboundClass::Unsolicited),\n 904| InboundLock::Pass,\n...\n 946| // A lock installed in the wrapper instead of the shared body would leave\n*947| // that family open while every test above stayed green, so this pins the\n 948| // reachability rather than the rule: a proven sender buys no passage, and a\n 949| // stamped sender is not a way around the loopback carve-out either.\n 950| #[test]\n...\n 958|\n*959| for sender in [None, Some(\"someone\"), Some(er)] {\n 960| assert_eq!(\n 961| access_check_with_sender(\n 962| er,\n...\n 1137|\n*1138| for reason in [\n 1139| PassReason::SameNode,\n 1140| PassReason::ReplyExemption,\n 1141| PassReason::ExplicitEntry,\n## activity.rs\n 41|/// with no wake marker. Covers the paths a marker cannot describe — a flip that\n*42|/// happened while the daemon was down, a relink, an N-1 CLI that drops no marker.\n 43|const SWEEP: Duration = Duration::from_secs(2);\n 44|\n 45|/// The flip wake-marker filename (under `identity/`, beside the sync pull\n...\n 121| seen.clear();\n*122| for o in observed {\n 123| seen.insert(\n 124| (o.owner.clone(), o.shell_id.clone()),\n 125| (o.token.clone(), o.idle, o.since_ms),\n...\n 139| let mut out = Vec::new();\n*140| for owner in perch::list_self_perch_ids(owlery) {\n 141| // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 142| // stream to carry the frame — same reason an offline instance is skipped.\n 143| // [impl->REQ-HAZARD-SHELL-STALE-ONLINE]\n...\n 159| let (idle, since) = perch::read_activity_at(&owner_perch);\n*160| for (shell_id, token) in linked {\n 161| out.push(LinkObservation {\n 162| owner: owner.clone(),\n 163| shell_id,\n...\n 192| let pushes = plan_pushes(seen, &observed);\n*193| for o in &pushes {\n 194| push_activity(drive_socket, o, now_ms);\n 195| }\n 196| remember(seen, &observed);\n...\n 216| let mut last_sweep: Option = None;\n*217| while !stop.load(Ordering::SeqCst) {\n 218| let flipped = take_flip_observation(&marker);\n 219| let due = flipped\n 220| || last_sweep\n...\n 420| remember(&mut seen, &observed);\n*421| for _ in 0..3 {\n 422| let again = observe_links(&owlery);\n 423| assert!(\n 424| plan_pushes(&seen, &again).is_empty(),\n## answerop.rs\n 125| // The rule did not land. The consumption is NOT saved either — dropping\n*126| // the knock store write is what leaves the record armed for a retry,\n 127| // and a consumed record beside a missing rule would be the one state\n 128| // that can never heal.\n 129| return None;\n## applyhost.rs\n 34|//! `apply_brain_only` handoff, the regression that re-attached a CLI-side\n*35|//! subscriber while the live brain kept running the OLD code.\n 36|//!\n 37|//! New code runs **immediately** — the supervised respawn lands on the new\n 38|//! executable, no manual bounce, no logon. Readiness-gated promotion +\n...\n 270| // reached `ready`. Writing `applied` here is the optimism the design indicts\n*271| // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n 272| // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n 273| // carrying the last-known-good `rollback_binary` (the aside we just created)\n 274| // so the broker's supervisor, a different process from this CLI, can promote\n...\n 322| // brain cycle — that is the whole point).\n*323| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 324|\n 325| swap_and_record(cache, exe_path, version, &artifact)?;\n 326|\n...\n 331| // level. This replaces the old in-process `apply_brain_only` handoff (the\n*332| // regression: it re-attached a CLI-side subscriber while the live brain kept\n 333| // running the OLD code). `classify` already gated this as brain-only, so the\n 334| // broker never moves; only the brain restarts.\n 335| //\n...\n 345| \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\n*346| and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\n 347| predates the restart verb needs a one-time manual daemon restart to run the new code)\"\n 348| )),\n 349| }\n...\n 364|pub fn refresh_brain(broker_name: &str) -> Result {\n*365| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366| brain\n 367| .request_brain_restart()\n 368| .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n...\n 449|\n*450|/// Connect a brain to the broker, retrying through startup races — the channel\n 451|/// the planned brain-restart trigger (ADR-0018 D3-3) rides after the binary\n 452|/// swap. It does NOT attach to a session: the broker holds every hosted endpoint\n 453|/// across the brain cycle, so apply never touches one. `Err` means the broker\n 454|/// never answered (a dead broker fails the apply with the seat untouched).\n*455|fn connect_retry(broker_name: &str) -> io::Result {\n 456| let mut last = io::Error::other(\"broker never answered\");\n*457| for _ in 0..300 {\n 458| match Brain::cold_start(broker_name, now_ms()) {\n 459| Ok(b) => return Ok(b),\n 460| Err(e) => last = e,\n...\n 555|\n*556| fn cold_connect_retry(broker_name: &str) -> Brain {\n*557| for _ in 0..300 {\n 558| if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559| return b;\n 560| }\n...\n 824| // No signal wired: accepted, not honored.\n*825| let mut b = cold_connect_retry(&name);\n 826| assert!(\n 827| !b.request_brain_restart().expect(\"verb round-trips\"),\n 828| \"a broker with no supervisor wired must ack honored=false\"\n...\n 833| assert!(broker.set_brain_restart(Arc::clone(&signal)), \"first wire wins\");\n*834| let mut b2 = cold_connect_retry(&name);\n 835| assert!(\n 836| b2.request_brain_restart().expect(\"verb round-trips\"),\n 837| \"a broker with a supervisor wired must ack honored=true\"\n...\n 905| // A hosted endpoint that must survive the apply.\n*906| let mut seat = cold_connect_retry(&name);\n 907| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 908| let child_pid = broker.session_pid(sid);\n 909| drop(seat); // the seat brain detaches; the broker keeps the child\n...\n 942| // binary + records the open trial and returns AppliedDaemonless. RED without\n*943| // the daemonless path: apply_staged would block on connect_retry against a\n 944| // dead socket (300×10ms) and then fail — never landing the bytes. Proves the\n 945| // swap no longer depends on a live broker to hand off to.\n 946| #[test]\n...\n 1036|\n*1037| let mut seat = cold_connect_retry(&name);\n 1038| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 1039| let child_pid = broker.session_pid(sid);\n 1040| drop(seat);\n...\n 1077| // [unit->REQ-UPD-6] Broker-touching debug/update-set payloads are accepted\n*1078| // as staged candidates, but apply refuses them typed while the broker-held\n 1079| // runtime is live. The first broker-touching flow is refusal-only; it does\n 1080| // not auto-suspend or cycle hosted work.\n 1081| #[test]\n## attach.rs\n 80|/// The control surface an attach request gates against: a read-only viewer is\n*81|/// `RC_VIEW`, while Control/Take — the intents that can drive the terminal —\n 82|/// gate as `RC_ATTACH`. Splitting them lets an operator publish a view of an\n 83|/// endpoint without also handing over its keyboard.\n 84|// [impl->REQ-ACL-RC-VIEW-SPLIT]\n...\n 91|\n*92|/// What the engine room's structural locks say about one attach attempt\n 93|/// (ADR-0052 §3).\n 94|#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 95|pub enum EngineRoomLock {\n...\n 488| // Keep wire forwards on a separate broker connection: its handler may wait\n*489| // for network egress while `brain` receives session and stream events. This\n 490| // split fixed the historical inline-controller-replay/forwarding cycle\n 491| // (REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT). Controller replay now has its own\n 492| // writer, but it still shares `brain`'s return carrier with handler replies.\n...\n 611| } if sid == stream_id => {\n*612| for rec in decoder.push(&bytes) {\n 613| match rec {\n 614| AttachRecord::Request {\n 615| session_id,\n...\n 750| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n*751| for (op, b) in pending_input.drain(..) {\n 752| brain.send_effect_no_ack(MintedOp::new(Minter::Rc, op), &b)?;\n 753| }\n 754| }\n...\n 791| }\n*792| // Seal-ceremony overlay open / per-attempt verdict (WAX-SEAL W2):\n 793| // broker-authored records forwarded onto the attach wire for the\n 794| // controller's rc to render. Additive record kinds — pushed only\n 795| // to a controller that declared the capability, so an N-1 rc\n...\n 1120|\n*1121| for from_this_node in [true, false] {\n 1122| assert_eq!(\n 1123| classify_rc_lock(true, from_this_node, Viewer),\n 1124| EngineRoomLock::NoViewport,\n...\n 1148| // Every other endpoint is untouched by all of it.\n*1149| for intent in [Viewer, Control, Take] {\n*1150| for from_this_node in [true, false] {\n 1151| assert_eq!(\n 1152| classify_rc_lock(false, from_this_node, intent),\n 1153| EngineRoomLock::Pass\n## attachment.rs\n 32|//! lock-across-effect discipline, KH 7.12/5.16). The push itself is best-effort\n*33|//! with NO retry loop: a downed daemon holds no slot, and the next edge or the\n 34|//! next [`SWEEP`] re-covers — the frame carries current state, so nothing is lost\n 35|//! by a failed write. It **inherits the drive-control path's existing IPC bound**\n 36|//! (see [`crate::drivehub::attach_write`]); no new deadline is minted here.\n...\n 59|/// with no edge signal. Covers what an edge flag cannot describe — a link\n*60|/// established while nothing was attaching, a relink, a daemon that missed the\n 61|/// edge — and it is what makes a dropped push self-heal.\n 62|const SWEEP: Duration = Duration::from_secs(2);\n 63|\n...\n 142| }\n*143| for node in &self.viewer_nodes {\n 144| *counts.entry(node.as_str()).or_default() += 1;\n 145| }\n 146| counts\n...\n 163| let mut moved: Vec<&str> = Vec::new();\n*164| for node in before.keys().chain(after.keys()) {\n 165| if before.get(node).copied().unwrap_or(0) != after.get(node).copied().unwrap_or(0)\n 166| && !moved.contains(node)\n 167| {\n...\n 200| Link,\n*201| /// The owner's attachment moved while the link stayed put. This is the only\n 202| /// kind that may name a changed node.\n 203| State,\n 204|}\n...\n 256| seen.clear();\n*257| for o in observed {\n 258| seen.insert(\n 259| (o.owner.clone(), o.shell_id.clone()),\n 260| (o.token.clone(), o.attach.clone()),\n...\n 282| let mut out = Vec::new();\n*283| for owner in owners {\n 284| let attach = &attachments[owner];\n 285| // DERIVED, not recorded (REQ-HAZARD-SHELL-STALE-ONLINE): a corpse holds no\n 286| // stream to carry the frame — same reason an offline instance is skipped.\n...\n 297| .collect();\n*298| for (shell_id, token) in linked {\n 299| out.push(AttachObservation {\n 300| owner: owner.clone(),\n 301| shell_id,\n...\n 310|/// Push one owed frame into the shell's attachment slot. Best-effort with NO\n*311|/// retry loop: a downed daemon holds no slot, and the next edge or sweep\n 312|/// re-pushes — the frame is current-state-carrying, so nothing is lost by a\n 313|/// failed write.\n 314|// [impl->REQ-ATTACH-LINK-PUSH]\n...\n 345| let pushes = plan_attach_pushes(seen, &observed);\n*346| for push in &pushes {\n 347| push_attach(drive_socket, push);\n 348| }\n 349| remember(seen, &observed);\n...\n 358|pub struct AwayState {\n*359| /// When the endpoint became unattached (epoch ms), or `None` while someone\n 360| /// is attached.\n 361| pub unattached_since: Option,\n 362| /// Whether the away notice has already fired for THIS unattached stretch.\n...\n 408| let mut owed = Vec::new();\n*409| for endpoint in endpoints {\n 410| let state = mem.entry(endpoint.clone()).or_default();\n 411| if attachments[endpoint].is_unattached() {\n 412| let since = *state.unattached_since.get_or_insert(now_ms);\n...\n 482| let mut last_sweep: Option = None;\n*483| while !stop.load(Ordering::SeqCst) {\n 484| let edged = take_attach_observation();\n 485| let due = edged\n 486| || last_sweep\n...\n 496| // that agent happens to own a shell.\n*497| for action in plan_away(&mut away, now_ms(), &attachments) {\n 498| deliver_away_notice(&action);\n 499| }\n 500| last_sweep = Some(Instant::now());\n...\n 542| // establishment, so \"first sight\" is itself an emit trigger — a binary that\n*543| // starts while nobody is attached must not wait for an attachment that may\n 544| // never come. And nothing CHANGED for that link, so it names no node.\n 545| #[test]\n 546| fn an_unseen_link_owes_a_link_push_with_no_changed_node() {\n...\n 564| remember(&mut seen, &before);\n*565| // The attachment ALSO moved while the link was down; the relink push\n 566| // carries the current state and claims no edge.\n 567| let after = vec![obs(\"ana\", \"sh-0\", \"t2\", attach(None, &[\"node-c\"]))];\n 568| let pushes = plan_attach_pushes(&seen, &after);\n...\n 730| plan_away(&mut mem, t0 + AWAY_AFTER.as_millis() as u64 + 2, &live).is_empty(),\n*731| \"the return is an edge too — it does not repeat while someone watches\"\n 732| );\n 733|\n 734| // the latch cleared, so the NEXT unattached stretch can go away again\n## autostart.rs\n 20|\n*21|/// How long to keep retrying a launch whose broker round-trip failed — the\n 22|/// replay thread starts alongside the broker's serve thread, so the very first\n 23|/// connect can race the accept loop up. Bounded and short: a genuine launch\n 24|/// failure (dead adapter binary, bad template) fails again instantly and we\n*25|/// move on after the last attempt.\n 26|const LAUNCH_ATTEMPTS: u32 = 3;\n 27|const LAUNCH_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(750);\n 28|\n...\n 56| Launched,\n*57| /// The launch was attempted and failed after its retries.\n 58| Failed,\n 59|}\n 60|\n...\n 90| let node_label = spt_store::hostlabel::node_fill_label(None);\n*91| for entry in entries {\n 92| // A saved default naming the reserved id is skipped, LOUDLY, and this\n 93| // arm is not redundant with the refusal at save. A record written\n 94| // before that refusal existed is already on disk on real nodes, and a\n...\n 141| let mut launched = false;\n*142| for attempt in 1..=LAUNCH_ATTEMPTS {\n 143| match crate::harnesshost::launch_harness_brokered_in(\n 144| broker_name,\n 145| &entry.id,\n...\n 171| last_err = e;\n*172| if attempt < LAUNCH_ATTEMPTS {\n 173| std::thread::sleep(LAUNCH_RETRY_DELAY);\n 174| }\n 175| }\n...\n 241| writer.call_count() > 1,\n*242| \"fixture must exercise write_all's short-write retry\"\n 243| );\n 244| assert_eq!(\n 245| writer.joined(),\n...\n 297| // Must return promptly — the skip happens before the bogus socket is\n*298| // ever dialed, so no retry loop, no launch, no hang.\n 299| replay_bounded(Duration::from_secs(10));\n 300| });\n 301| }\n## bootstrap_firewall.rs\n 83|/// F-A1-1 (releases#304 W2, HFENDULEAM field leg 2026-09-12) was a verify whose\n*84|/// WRITES HAD ALREADY LANDED while the command was still walking the store: the\n 85|/// event log timestamped them ~2.5-3.2 s before the command returned, and the\n 86|/// only way to learn that was to read the Windows event log by hand. Nothing in\n 87|/// the product could say which leg spent the budget, or whether the child was\n...\n 189| let mut err = String::new();\n*190| for _ in 0..2 {\n 191| let (is_stdout, bytes) = rx.recv_timeout(deadline.saturating_duration_since(Instant::now()))\n 192| .map_err(|_| format!(\"{program}: firewall output did not complete\"))?;\n 193| let bytes = bytes.map_err(|error| format!(\"{program}: reading output: {error}\"))?;\n...\n 301|\n*302| for value in [\"1\", \"\", \"0\", \"false\"] {\n 303| OptOut::set(value);\n 304| let error = mutation_permitted().expect_err(\n 305| \"an exported SPT_INSTALL_NO_FIREWALL must disable mutation regardless of value\",\n...\n 352|\n*353| /// Observation is read-only and must stay available while mutation is disabled,\n 354| /// but it still refuses arguments the broker did not actually supply. Neither\n 355| /// case reaches a platform command.\n 356| // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n...\n 361|\n*362| for opted_out in [false, true] {\n 363| if opted_out {\n 364| OptOut::set(\"1\");\n 365| } else {\n...\n 409|\n*410| for required in [\n 411| \"$ErrorActionPreference = 'Stop'\",\n 412| \"Import-Module NetSecurity\",\n 413| \"spt-core-bootstrap-inbound-tcp\",\n## brain.rs\n 176| },\n*177| /// Broker→controller-serve: one ceremony attempt's verdict for the\n 178| /// overlay (`refused` re-prompts; the rest close it). Forwarded as\n 179| /// `AttachRecord::SealCeremonyResult`.\n 180| // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n...\n 677| ///\n*678| /// Verification, the attempt ledger, and the mint all run DAEMON-SIDE —\n 679| /// the adversary here is an agent on this box that can speak this same\n 680| /// IPC, so nothing about the answer is decided in this process. An N-1\n 681| /// broker that predates the verb answers unknown-kind, surfaced as a LOUD\n...\n 739| /// never as a reply to this frame (the serve loop must keep pumping\n*740| /// output while the gate decides).\n 741| // [impl->REQ-SEAL-CEREMONY-RC-CLIENT]\n 742| // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n 743| pub fn seal_ceremony_code(\n...\n 929| /// brain↔broker conn without returning to read. With no ack the broker's\n*930| /// per-conn handler never writes back while servicing that flood, so the return\n 931| /// direction can't fill and deadlock the handler. Exactly-once is preserved: the\n 932| /// broker still dedups by `(session, op_id)` at its applied-set.\n 933| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n...\n 1412| // (D4-2b); a legacy brain (empty map) uses the `next_seq` set above. The\n*1413| // resume-mode dedup-cursor reset for an explicit re-subscribe lives in\n 1414| // `subscribe_with` (P1c, shared by `attach`/`attach_as`).\n 1415| self.subscribe(session_id, from_seq)\n 1416| }\n...\n 1546| /// Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the\n*1547| /// broker for **every** hosted session and re-attach **each** in resume mode\n 1548| /// from the broker's per-session delivered cursor (`resume_seq`). This is the\n 1549| /// production replacement for the retired single-session `BrainState` handoff\n 1550| /// frame — a brain the supervisor respawns (crash *or* update) reconstructs\n...\n 1598| let mut resumed = Vec::with_capacity(total);\n*1599| for info in reply.sessions {\n 1600| // Seed the dedup cursor at the broker's resume point BEFORE the subscribe\n 1601| // replay starts arriving, then re-attach (Viewer) from there.\n 1602| self.session_cursors\n...\n 1636| let mut resumed = Vec::with_capacity(reply.sessions.len());\n*1637| for info in reply.sessions {\n 1638| self.session_cursors\n 1639| .insert(info.session_id, info.resume_seq);\n 1640| resumed.push(info.session_id);\n...\n 1941| /// held meet `session_id`. The daemon dials the HELD address (no re-search)\n*1942| /// and runs the ceremony. A wrong-code retry calls this again with the SAME\n 1943| /// session id (ceremony only). The code never persists.\n 1944| // [impl->REQ-JOIN-TWO-PHASE]\n 1945| pub fn pair_submit_code(&mut self, session_id: u64, code: &str) -> io::Result {\n...\n 2134| /// List the streams the broker holds (D4b) — how a re-attaching brain\n*2135| /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n 2136| pub fn net_streams(&mut self) -> io::Result {\n 2137| self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n 2138| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n...\n 2403| /// setting the local cursor (D4c) — gapless, exactly-once presence resume:\n*2404| /// events produced while no brain was attached replay from the cursor.\n 2405| // [impl->REQ-EP-4]\n 2406| pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407| self.presence_cursor = Some(from_seq);\n...\n 2453| /// adopts the whole block — traceability tag included — and leaves the\n*2454| /// function undocumented while `traceable-reqs` still counts that tag as\n 2455| /// present. That is a green that survives the regression.\n 2456| ///\n 2457| /// (The tag is named in words rather than written out here: the checker reads\n...\n 2577| /// — the poison signal the pump escalates to a supervised restart (NEVER a\n*2578| /// per-peer retry). A `Disconnected` channel means the reader thread exited\n 2579| /// (the conn hung up); surface it as `UnexpectedEof`.\n 2580| // [impl->REQ-HAZARD-PUMP-IPC-DEADLINE]\n 2581| // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n...\n 2825| let server_thread = thread::spawn(move || {\n*2826| while let Ok(env) = frames.recv() {\n 2827| if write_frame(&mut send, &env).is_err() {\n 2828| break;\n 2829| }\n...\n 2913| let deadline = brain.call_deadline();\n*2914| for seq in 0u64..=2 {\n 2915| stub.feed\n 2916| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 2917| .unwrap();\n...\n 2956| let deadline = brain.call_deadline();\n*2957| for seq in 3u64..=5 {\n 2958| stub.feed\n 2959| .send(output_envelope(sid, seq, format!(\"r{seq}\").as_bytes()))\n 2960| .unwrap();\n...\n 3028| let deadline = brain.call_deadline();\n*3029| for seq in 0u64..=1 {\n 3030| stub.feed\n 3031| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 3032| .unwrap();\n...\n 3198| let deadline = brain.call_deadline();\n*3199| for _ in 0..2 {\n 3200| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3201| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3202| other => panic!(\"expected Output, got {other:?}\"),\n...\n 3253| // The ring rolled between reads: the next Output frame carries a seq far\n*3254| // ABOVE the cursor (4504 while cursor is 100 — the legacy path would fatal\n 3255| // `output gap: got 4504 want 100`). Snap-above must ACCEPT it.\n 3256| stub.feed.send(output_envelope(sid, 4504, b\"ROLLED\")).unwrap();\n 3257| let deadline = brain.call_deadline();\n...\n 3278| let deadline = brain.call_deadline();\n*3279| for _ in 0..2 {\n 3280| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3281| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3282| other => panic!(\"expected Output, got {other:?}\"),\n## brainproc.rs\n 44|/// A run at least this long counts as healthy and resets the backoff floor.\n*45|/// Reused as the per-attempt **trial window** (ADR-0018 Q7, D6-2): a candidate\n 46|/// brain has this long to signal `ready` for its generation before the window\n 47|/// elapses (the \"up but useless\" alive-never-ready rollback path).\n 48|const SUPERVISE_HEALTHY_RUN: Duration = Duration::from_secs(30);\n*49|/// The readiness-trial retry budget (ADR-0018 Q7, D6-2): a candidate that\n 50|/// **exits before** signaling ready is respawned this many consecutive times\n 51|/// (a transient first-boot hiccup should not abandon a good binary) before the\n 52|/// supervisor auto-rolls-back to the last-known-good binary. Matched to the\n...\n 114| Crash,\n*115| /// A respawn the broker itself initiated for a binary swap (wired in D3-3).\n 116| Update,\n 117|}\n 118|\n...\n 201| let name = broker_socket_name();\n*202| let mut brain = connect_retry(&name, BRAIN_CONNECT_TRIES)?;\n 203| // The broker hands {generation, start-reason} at spawn (ADR-0018 V2): the\n 204| // generation is broker-owned custody of the KH-2.4 counter (no longer the\n 205| // brain→brain BrainState.generation, which retires in D4), and the reason is\n...\n 227| // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n*228| // paid for that twice: four cells burned a full 30s readiness budget while\n 229| // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n 230| // (blocked broker reply-read vs the first-call whole-exe hash) could not be\n 231| // separated from the log at all. `activity_link_push_e2e` then failed again\n...\n 446|\n*447|/// Connect to the broker, retrying briefly while it finishes binding.\n*448|fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449| let mut last: Option = None;\n*450| for _ in 0..tries {\n 451| match Brain::cold_start(name, now_ms()) {\n 452| Ok(b) => return Ok(b),\n 453| Err(e) => {\n...\n 514|/// `current_exe`/read stays `None` for the process lifetime — no per-tick\n*515|/// retry, the breadcrumb simply omits the field). Restoration D7-1: the\n 516|/// `exe_hash` breadcrumb that proves *which bytes* a brain generation is\n 517|/// running. The once-per-process capture is load-bearing TWICE\n 518|/// (REGISTRY-LIFECYCLE R1): the pre-fix per-tick re-read hashed 30+ MiB every\n...\n 594|/// deterministically with a scripted ready/no-ready + a capturing notif sink,\n*595|/// while production binds the real `spt_home` + relcache + notif sender\n 596|/// ([`ProductionTrialEnv`]). Every method is **best-effort / fail-safe**: a\n 597|/// missing record reads as \"no pending trial\", an absent ready file as\n 598|/// \"not ready\" — the broker's supervisor thread never panics (a panic there\n...\n 756|/// (epoch.rs) holds at this `EpochSource::load`. **Do NOT fire broker-side notifs\n*757|/// while a brain is live:** concurrent `EpochSource` read-modify-write across the\n 758|/// two processes mints duplicate epochs (KH 4.8 lost-update). The forward fix for\n 759|/// any future broker-side live-notif is cross-process serialization (a file\n 760|/// lock), not relaxing this rule.\n...\n 765|/// logged, never fatal. Dismissal consumes NO epoch, so — unlike producing a\n*766|/// notif — it is safe to call brain-side while the swap is live.\n 767|// [impl->REQ-NOTIF-SEAM-DISMISS]\n 768|fn dismiss_update_notifs_on_apply() {\n 769| let Ok(store) = spt_store::notif::NotifStore::open() else {\n...\n 772| };\n*773| for (subnet, _) in &crate::notif::NotifSurfacePolicy::load().subnets {\n*774| for key in [\n 775| crate::notif::NOTIF_KEY_UPDATE_STAGED,\n 776| crate::notif::NOTIF_KEY_ROLLBACK,\n 777| ] {\n...\n 793| let owlery = spt_store::perch::owlery_dir();\n*794| for (subnet, _) in &policy.subnets {\n 795| if let Err(e) = crate::notif::produce_rollback_notif(\n 796| quarantine_version,\n 797| running_version,\n...\n 814| let mut slept = Duration::ZERO;\n*815| while slept < backoff && !stop.load(Ordering::Relaxed) {\n 816| thread::sleep(TICK.min(backoff.saturating_sub(slept)));\n 817| slept += TICK;\n 818| }\n...\n 853|/// NOT a promote: the W2 stall-evict only BOUNDS the false-promote window to\n*854|/// `BRAIN_WRITE_DEADLINE`, so a new brain can signal ready while the OLD generation's\n 855|/// local controller conn is still wedged (the 22:47 apply \"promoted\" onto a frozen\n 856|/// control plane). So readiness is LATCHED (`ready_seen` — a candidate that stamped\n 857|/// ready then exited is not demoted, preserving the ready-then-exit-still-promotes\n...\n 863|/// `BRAIN_WRITE_DEADLINE` (15 s) < [`SUPERVISE_HEALTHY_RUN`] (30 s) — and a cleanly-\n*864|/// closed old conn drains at once. `child.try_wait()` is consulted only while\n 865|/// NOT-yet-ready, so a ready-then-exited candidate still promotes once drained.\n 866|fn run_trial(\n 867| child: &mut Child,\n...\n 922| }\n*923| // Only watch for a pre-ready exit while the candidate has NOT reached ready;\n 924| // once ready-seen we are waiting on the OLD gen to drain, and a ready-then-\n 925| // exited child still promotes (the exit is a normal later respawn).\n 926| if !ready_seen {\n...\n 929| Ok(None) => {}\n*930| // A wait error: treat as a pre-ready exit (fail toward retry, never\n 931| // a panic in the supervisor thread).\n 932| Err(e) => {\n 933| spt_proto::emit_line_err!(\"BRAIN_TRIAL_WAIT_FAIL: {e}\");\n## broker.rs\n 23|//! last-seen `seq + 1`; the broker replays the ring from there, then streams\n*24|//! live. The brain dedups by `seq`. Output produced *while no brain was\n 25|//! attached* sits in the ring and is replayed on the next subscribe — so a\n 26|//! brain restart loses nothing.\n 27|//!\n...\n 221|/// blocked). The brain aggregates every session + psyche + WAN feed, so its drain\n*222|/// is bursty; 15 s tolerates a normal burst-stall while still bounding the wedge.\n*223|/// A slow-but-DRAINING brain never trips it — the clock only advances while a write\n 224|/// is genuinely in flight past the deadline (see [`ControllerSink::write_blocked_since`]).\n 225|// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n 226|const BRAIN_WRITE_DEADLINE: Duration = Duration::from_secs(15);\n...\n 250|/// by the holder's PROGRESS (see `phase_wedge_ceiling`) and not by a clock.\n*251|/// Poll slice while waiting on a racing wake's session to appear.\n 252|const WAKE_DEDUP_POLL: Duration = Duration::from_millis(50);\n 253|\n 254|/// What a held wake claim knows about its holder's PROGRESS (#235).\n...\n 296|/// holds generation N+1, and the old holder finally completes and drops. A\n*297|/// generation-blind remove would free the NEW claimant's claim while its spawn\n 298|/// is still in flight, so the next duplicate wake sails through the gate —\n 299|/// re-opening, one wake later, exactly the double-create this guard exists to\n 300|/// close. Pure over the map so the no-op is a unit.\n...\n 312|/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\n*313|/// on a slow-but-live holder is latency, while the cost of taking over from one\n 314|/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\n 315|/// detector, never a performance budget.\n 316|fn phase_wedge_ceiling(phase: &str) -> Duration {\n...\n 350|/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\n*351|/// down + retry, waiting for the racer's session to register), for as long as that\n 352|/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\n 353|/// endpoint, are `Claim`. Pure so the truth table is a unit.\n 354|///\n...\n 400|/// it would be a lie — exactly when:\n*401|/// - its PTY child (the client-tree root) probes DEAD while the table record\n 402|/// survives (a wedged/missed exit-wait), OR\n 403|/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\n 404|/// forks a harness client chain under the wrapper by construction), PAST\n 405|/// the boot grace, whose wrapper has NO live descendants — the deployah\n*406|/// wedge shape: the launcher shell idles on while the harness underneath\n 407|/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\n 408|/// `shutdown` said NO_EDGE about the same corpse.\n 409|///\n...\n 487| // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\n*488| // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\n 489| // handle to it stays open — and this broker holds `Arc`, hence\n 490| // that handle, for exactly the sessions it is asked about. A reaped root\n 491| // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\n...\n 496| // about the process, not about a handle the caller holds, and Linux demotes\n*497| // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\n 498| // implies unix implies no handle problem — the two conditions cannot both\n 499| // fail. Routing to `None` here instead would have DISABLED zombie detection\n 500| // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\n...\n 598|/// The coordinator-image read gate (F-025 amendment): a recorded\n*599|/// `(generation, version)` answers only while its generation is STILL the\n 600|/// supervised one. A record left behind by a replaced brain reports `None` — not\n 601|/// reported — rather than the version of a process that no longer exists, so the\n 602|/// surface never outlives the process it describes (the stale-record class that\n...\n 615|/// doyle non-negotiable = W1's \"never park forever\"): the inject worker holds the\n*616|/// floor — buffering operator input — only while a binary's response to one\n 617|/// `{type:event}` is in flight. If no `{commit}` arrives within this window the\n 618|/// worker FLUSHES the buffer, RELEASES the floor, FAULTS the binary (terminate, no\n 619|/// respawn → idle inbound then SPOOLS, never raw-injected), and never re-opens. A wedged or\n...\n 744|\n*745|/// Total delivery attempts per sequence: the first drive + ONE re-drive on an\n 746|/// echo-verify miss (doyle ruling A layer 2: \"re-drive once; on a second miss, LOUD\n*747|/// spool\"). 2 = one initial + one retry.\n 748|const INJECT_REDRIVE_ATTEMPTS: u32 = 2;\n 749|\n 750|/// Chunk size for the paced text write (Layer 3, the ruling's named fallback where\n...\n 866| /// a channel that stays Full for [`CONTROLLER_WRITE_DEADLINE`] PAST this stamp\n*867| /// evicts the stalled controller (bounded wedge preserved), while a slow-but-\n 868| /// alive controller just drops the chunk + falls behind the ring (resume-from-\n 869| /// floor). Seeded `now` at [`OutputLog::become_controller`].\n 870| last_ok: Instant,\n...\n 958| dropped: u64,\n*959| /// The `seq` range assigned while delivery was suppressed, `(first, last)` —\n 960| /// the watermark source for the commit/abort sync frame\n 961| /// (REQ-RC-RESIZE-PRESENTATION-BARRIER leg 3).\n 962| suppressed: Option<(u64, u64)>,\n...\n 965|impl ResizeTransition {\n*966| /// Record one seq assigned while this transition suppressed delivery.\n 967| fn note_suppressed(&mut self, seq: u64) {\n 968| self.suppressed = Some(match self.suppressed {\n 969| Some((first, _)) => (first, seq),\n...\n 1003|/// an isolated bounded queue + writer thread, evicted on overflow). Every\n*1004|/// controller send and viewer `try_send` happens while the enclosing\n 1005|/// `Mutex` is held, so frames reach each sink in strict `seq` order.\n 1006|struct OutputLog {\n 1007| session_id: u64,\n...\n 1178|/// `controlled:false` and no later edge re-stamps, so the endpoint reads uncontrolled\n*1179|/// forever while driven. This DIVERGENCE-GATED re-assert (on the `KIND_SESSIONS` poll,\n 1180|/// bounded by the reconcile cadence) writes ONLY on a real difference — no fsync storm.\n 1181|/// Best-effort: an unbound / corrupt / perch-less endpoint has nowhere to converge yet.\n 1182|///\n## codec.rs\n 9|//! The frame *codec* is deliberately transport-agnostic: it is the byte-level\n*10|//! contract, while [`crate::transport`] owns the OS-specific connection.\n 11|// [impl->REQ-DAEMON-2]\n 12|\n 13|use std::io::{self, Read, Write};\n## config.rs\n 696| seeded.save_to(&DaemonConfig::default_path()).unwrap();\n*697| for id in [\"gw\", \"worker\"] {\n 698| DaemonConfig::upsert_startup_endpoint(StartupEndpoint {\n 699| id: id.to_string(),\n 700| adapter: \"cc\".to_string(),\n## conn.rs\n 46|//! synchronous return IS the completion handshake); (4) the retired half is\n*47|//! parked in a graveyard slot — never dropped while the watchdog might still\n 48|//! touch the raw handle (drop = `CloseHandle`, and a recycled handle value\n 49|//! must never see a late `CancelIoEx`), and never re-gated; (5) on Windows the\n 50|//! pipe is then severed (`DisconnectNamedPipe` — the server end forces the\n...\n 227|struct Dog {\n*228| /// `Some((op_id, deadline))` while a write is in flight.\n 229| inflight: Option<(u64, Instant)>,\n 230| /// Raised by [`BrokerConn::drop`]; the watchdog exits.\n 231| shutdown: bool,\n...\n 459| };\n*460| // Sleep toward the deadline while THIS op stays in flight.\n 461| let fired = loop {\n 462| if d.shutdown {\n 463| return;\n...\n 492| d = recover(&self.dog);\n*493| while matches!(d.inflight, Some((cur, _)) if cur == op) && !d.shutdown {\n 494| let (g, _) = self\n 495| .dog_cv\n 496| .wait_timeout(d, Duration::from_millis(100))\n...\n 671| // released. Clear the arm BEFORE deciding health, so the watchdog\n*672| // never severs while the op is formally in flight.\n 673| {\n 674| let mut d = recover(&inner.dog);\n 675| d.inflight = None;\n...\n 836| const N: u64 = 32;\n*837| for round in 0..N {\n 838| let (conn, mut client, mut recv) = make_duplex_with_log(Arc::clone(&log));\n 839| conn.describe(\"role=brain\");\n*840| for seq in 0..4 {\n 841| let request = Envelope::new(\"poll\", serde_json::json!([round, seq]));\n 842| write_frame(&mut client, &request).unwrap();\n 843| let received = crate::codec::read_frame(&mut recv).unwrap();\n...\n 881| assert_eq!(lines.len(), 3, \"role event, retirement and poisoned close survive\");\n*882| for line in lines.iter() {\n 883| assert!(line.contains(&format!(\"conn={id}\")));\n 884| assert!(line.contains(\"role=brain controller session=7\"));\n 885| assert!(line.contains(&format!(\"first_write_wall_ms={}\", start.wall_ms)));\n...\n 922| // Attribution parity: every field present on BOTH tokens.\n*923| for (name, line) in [(\"POISONED\", &poisoned), (\"RETIRED\", &retired)] {\n 924| assert!(\n 925| line.contains(&format!(\"conn={}\", conn.id())),\n 926| \"{name} carries the stable conn id: {line}\"\n...\n 950| // observable; loop until the failure surfaces (bounded).\n*951| for _ in 0..200 {\n 952| match conn.write(&env) {\n 953| Err(e) => {\n 954| organic = Some(e);\n...\n 980|\n*981| for i in 0..100 {\n 982| a.describe(&format!(\"fact-{i}-padding-padding-padding\"));\n 983| }\n 984| let label = recover(&a.inner.label).clone();\n## crc_swap.rs\n 52|) -> std::io::Result<()> {\n*53| for entry in std::fs::read_dir(dir)? {\n 54| let entry = entry?;\n 55| let path = entry.path();\n 56| if path.is_dir() {\n...\n 131| // [impl->REQ-CRC-SWAP-OLD-DISPLACE]\n*132| for swap in plan {\n 133| if swap.target.exists() {\n 134| gc_stale_old(&swap.target);\n 135| }\n...\n 138| // Phase 1 — stage every new file beside its target.\n*139| for swap in plan {\n 140| if let Some(parent) = swap.target.parent() {\n 141| std::fs::create_dir_all(parent)?;\n 142| }\n...\n 151| let mut committed: Vec<(&Path, Option)> = Vec::new();\n*152| for swap in plan {\n 153| let target = swap.target.as_path();\n 154| let displaced = if target.exists() {\n 155| // DISPLACE: rename the original ASIDE to a fresh, non-colliding name so a\n...\n 181| // retries it, never a brick).\n*182| for (_, displaced) in &committed {\n 183| if let Some(old) = displaced {\n 184| let _ = std::fs::remove_file(old);\n 185| }\n...\n 205| }\n*206| for n in 1u64.. {\n 207| let candidate = sibling(target, &format!(\"old-{n}\"));\n 208| if !candidate.exists() {\n 209| return candidate;\n...\n 229| };\n*230| for entry in entries.flatten() {\n 231| if let Some(name) = entry.file_name().to_str() {\n 232| if name == base || name.starts_with(&dashed) {\n 233| let _ = std::fs::remove_file(entry.path());\n...\n 262|) {\n*263| for (target, displaced) in committed.iter().rev() {\n 264| let _ = rename(target, &new_path(target));\n 265| if let Some(old) = displaced {\n 266| let _ = rename(old, target);\n...\n 272|fn cleanup_new(plan: &[PlannedSwap]) {\n*273| for swap in plan {\n 274| let _ = std::fs::remove_file(new_path(&swap.target));\n 275| }\n 276|}\n...\n 303| fn walk(dir: &Path, found: &mut bool) {\n*304| for entry in fs::read_dir(dir).unwrap() {\n 305| let path = entry.unwrap().path();\n 306| if path.is_dir() {\n 307| walk(&path, found);\n...\n 661| stranded_old.exists() && fs::read(&stranded_old).unwrap() == b\"LAST-GOOD-V1\",\n*662| \"the last-good `.old` is NOT GC'd while the target was missing — survives \\\n 663| to be swept next run (never a no-binary double-fault window)\"\n 664| );\n 665| }\n## daemon.rs\n 36|const START_TIMEOUT: Duration = Duration::from_secs(5);\n*37|/// Poll cadence while waiting for the spawned daemon to come up.\n 38|const START_POLL: Duration = Duration::from_millis(25);\n 39|\n 40|/// The per-machine broker/brain daemon process.\n...\n 131| // [impl->REQ-HAZARD-STALE-INDEX-LOCK]\n*132| for lock in spt_store::branchstore::sweep_stale_index_locks(\n 133| &spt_store::contextstore::seed_git_dir(&spt_store::perch::tracked_dir()),\n 134| spt_store::branchstore::STALE_LOCK_AGE,\n 135| ) {\n...\n 150| }\n*151| for name in &att.detached {\n 152| // Plain prose (no Markdown markers): spt-daemon can't import the\n 153| // bin-local helpfmt renderer, so this one source string is authored\n 154| // marker-free rather than rendered. The `SUBNET_DETACHED:{name}`\n...\n 200| // at boot — REQ-DAEMON-9) is transient and retried, but a broken\n*201| // identity is not, so we only arm the retry when identity is sound.\n 202| let node_hex: Option = spt_store::nodeid::load_or_create()\n 203| .ok()\n 204| .map(|i| i.public_key().to_hex());\n...\n 207| } else {\n*208| spt_proto::emit_line_err!(\"NODE_KEY_FAIL: identity unavailable — broker runs net-less, no retry\");\n 209| None\n 210| };\n 211|\n...\n 242| let broker = Arc::clone(&broker);\n*243| thread::spawn(move || net_retry_attach(broker));\n 244| }\n 245| // The ATTACHMENT observer (releases#44 / releases#45): it runs\n 246| // in the BROKER because attachment truth is broker MEMORY —\n...\n 555| // Re-runs on every successful bind, including the REQ-DAEMON-9\n*556| // self-heal retry — the port is new each time.\n 557| if let Some(port) = host.bound_port() {\n 558| crate::firewall::verify_and_record_self(port);\n 559| }\n...\n 570|/// net-less (NET_BIND_FAIL at boot — typically the autostart racing the network\n*571|/// up) keeps retrying `try_start_net` with capped backoff and, on success,\n 572|/// ATTACHES the host to the live broker (`OnceLock`, so exactly once). The node\n 573|/// becomes reachable without a manual restart. Runs until net binds — the\n 574|/// network always arrives eventually after boot. The net consumers are no longer\n...\n 577|// [impl->REQ-DAEMON-9]\n*578|fn net_retry_attach(broker: Arc) {\n 579| let mut backoff = NET_RETRY_FIRST;\n 580| loop {\n 581| thread::sleep(backoff);\n...\n 583| if broker.attach_net(host) {\n*584| spt_proto::emit_line_err!(\"NET_ATTACHED: net endpoint bound on retry — brain starts the consumers\");\n 585| }\n 586| return;\n 587| }\n*588| backoff = net_retry_backoff(backoff);\n*589| spt_proto::emit_line_err!(\"NET_BIND_RETRY: net still unavailable, retrying in {}s\", backoff.as_secs());\n 590| }\n 591|}\n 592|\n...\n 595|\n*596|/// The net self-heal backoff ladder (REQ-DAEMON-9): double each retry, capped\n 597|/// at [`NET_RETRY_CAP`]. Pure for tests.\n*598|fn net_retry_backoff(cur: Duration) -> Duration {\n 599| (cur * 2).min(NET_RETRY_CAP)\n 600|}\n 601|\n...\n 620| let mut waited = Duration::ZERO;\n*621| while waited < START_TIMEOUT {\n 622| if is_running() {\n 623| return Ok(());\n 624| }\n...\n 712| // RE-DECIDE under the lock: the winner may have already brought the daemon\n*713| // up, and the operator's stop may have landed while we queued.\n 714| match ensure_decision(is_running(), spt_store::daemon_inhibit::stop_inhibited()) {\n 715| EnsureOutcome::AlreadyRunning => return Ok(EnsureOutcome::AlreadyRunning),\n 716| EnsureOutcome::DeclinedStopInhibited => {\n...\n 970|\n*971|/// One CreateProcessW attempt: spawn `program args…` detached, inheriting NO\n 972|/// handles, with `extra_flags` OR'd onto the base detached flags. The single\n 973|/// FFI primitive shared by [`detached_no_inherit_env`] and the daemon's job-neutral\n 974|/// launcher ladder ([`launch_daemon_job_neutral`]).\n...\n 998|\n*999|/// Mark one handle inheritable, the precondition for naming it in a\n 1000|/// `PROC_THREAD_ATTRIBUTE_HANDLE_LIST`: a handle in the list that is not\n 1001|/// inheritable fails `CreateProcessW` outright.\n 1002|#[cfg(windows)]\n...\n 1054| let mut vars: Vec<(OsString, OsString)> = std::env::vars_os().collect();\n*1055| for k in remove {\n 1056| vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1057| }\n*1058| for (k, v) in extra {\n 1059| vars.retain(|(ek, _)| !ek.to_string_lossy().eq_ignore_ascii_case(k));\n 1060| vars.push((OsString::from(k), OsString::from(v)));\n 1061| }\n## deelevate.rs\n 81|/// (still carrying `SPT_HOME`) sees no daemon and prints `DAEMON_NOT_RUNNING`\n*82|/// while the orphaned daemon serves the wrong home.\n 83|// [impl->REQ-HAZARD-ELEVATED-DAEMON-SPAWN]\n 84|pub fn apply_env_overrides(block: &[u16], overrides: &[(String, String)]) -> Vec {\n 85| const NUL: u16 = 0;\n...\n 89| let mut cur: Vec = Vec::new();\n*90| for &u in block {\n 91| if u == NUL {\n 92| if cur.is_empty() {\n 93| break;\n...\n 106| };\n*107| for (k, v) in overrides {\n 108| let key = k.to_ascii_uppercase();\n 109| entries.retain(|e| name_of(e) != key);\n 110| entries.push(format!(\"{k}={v}\").encode_utf16().collect());\n...\n 112| let mut out: Vec = Vec::new();\n*113| for e in &entries {\n 114| out.extend_from_slice(e);\n 115| out.push(NUL);","truncated":true,"truncatedBy":"bytes","totalLines":1351,"totalBytes":64819,"outputLines":1056,"outputBytes":51200,"lastLinePartial":false,"firstLineExceedsLimit":false},"meta":{"truncation":{"direction":"head","truncatedBy":"bytes","totalLines":1351,"totalBytes":64819,"outputLines":1056,"outputBytes":51200,"shownRange":{"start":1,"end":1056},"nextOffset":1057}}},"isError":false,"timestamp":1790039656305}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_htIj31OrPRpSTVSUBB8Y0FgI|fc_03665577bed2f92d016ab1d66c027c87d28fde80d83fa8d247","toolName":"glob","startedAt":"2026-09-22T01:14:22.700Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src"},"intent":"Listing crate source boundaries"},"id":"394d1863","parentId":"f61703b9","timestamp":"2026-09-22T01:14:22.700Z"}
{"type":"message","id":"ca1170df","parentId":"394d1863","timestamp":"2026-09-22T01:14:22.701Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_htIj31OrPRpSTVSUBB8Y0FgI|fc_03665577bed2f92d016ab1d66c027c87d28fde80d83fa8d247","name":"glob","arguments":{"i":"Listing crate source boundaries","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src","hidden":false,"gitignore":true,"limit":100},"intent":"Listing crate source boundaries"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":14356,"output":62,"cacheRead":10112,"cacheWrite":0,"totalTokens":24530,"cost":{"input":0.14356000000000002,"output":0.0031000000000000003,"cacheRead":0.010112,"cacheWrite":0,"total":0.15677200000000002}},"stopReason":"toolUse","timestamp":1790039656369,"responseId":"resp_03665577bed2f92d016ab1d668be4487d284d5a65277b8b5d9","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d66c027c87d28fde80d83fa8d247","type":"function_call","status":"completed","arguments":"{\"i\":\"Listing crate source boundaries\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src\",\"hidden\":false,\"gitignore\":true,\"limit\":100}","call_id":"call_htIj31OrPRpSTVSUBB8Y0FgI","internal_chat_message_metadata_passthrough":{"create_time":1790039657.092441,"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"glob","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":6329.850800000131,"ttft":3658.030700000003,"completedAt":1790039662699,"contextSnapshot":{"promptTokens":24468,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"e35b30bd","parentId":"ca1170df","timestamp":"2026-09-22T01:14:22.722Z","message":{"role":"toolResult","toolCallId":"call_htIj31OrPRpSTVSUBB8Y0FgI|fc_03665577bed2f92d016ab1d66c027c87d28fde80d83fa8d247","toolName":"glob","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/\n## xtask/src/\n## spt/src/\n## spt-store/src/\n## spt-daemon/src/\n## spt-term/src/\n## spt-test-support/src/\n## spt-runtime/src/\n## spt-net/src/\n## spt-msg/src/\n## spt-proto/src/\n## spt-live/src/\n## spt-procident/src/\n## spt-poolguard/src/"}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","fileCount":13,"files":[".worktrees/318-h3-infra-register/crates/xtask/src/",".worktrees/318-h3-infra-register/crates/spt/src/",".worktrees/318-h3-infra-register/crates/spt-store/src/",".worktrees/318-h3-infra-register/crates/spt-daemon/src/",".worktrees/318-h3-infra-register/crates/spt-term/src/",".worktrees/318-h3-infra-register/crates/spt-test-support/src/",".worktrees/318-h3-infra-register/crates/spt-runtime/src/",".worktrees/318-h3-infra-register/crates/spt-net/src/",".worktrees/318-h3-infra-register/crates/spt-msg/src/",".worktrees/318-h3-infra-register/crates/spt-proto/src/",".worktrees/318-h3-infra-register/crates/spt-live/src/",".worktrees/318-h3-infra-register/crates/spt-procident/src/",".worktrees/318-h3-infra-register/crates/spt-poolguard/src/"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1790039662721}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_af7rEgzWgX61zVJ0191pnj20|fc_03665577bed2f92d016ab1d670abc487d2912e2500508a696a","toolName":"grep","startedAt":"2026-09-22T01:14:27.582Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Finding bounded range loops"},"id":"5e27c6a2","parentId":"e35b30bd","timestamp":"2026-09-22T01:14:27.582Z"}
{"type":"message","id":"350eceac","parentId":"5e27c6a2","timestamp":"2026-09-22T01:14:27.583Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_af7rEgzWgX61zVJ0191pnj20|fc_03665577bed2f92d016ab1d670abc487d2912e2500508a696a","name":"grep","arguments":{"i":"Finding bounded range loops","pattern":"^\\s*for\\s+.*\\s+in\\s+.*\\.\\.|^\\s*while\\s+.*[<>=]|\\.take\\(|retry\\(|Retry::","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":null},"intent":"Finding bounded range loops"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":316,"output":110,"cacheRead":24320,"cacheWrite":0,"totalTokens":24746,"cost":{"input":0.00316,"output":0.0055000000000000005,"cacheRead":0.024319999999999998,"cacheWrite":0,"total":0.032979999999999995}},"stopReason":"toolUse","timestamp":1790039662779,"responseId":"resp_03665577bed2f92d016ab1d66f0a1c87d2859f0cea342e211f","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d670abc487d2912e2500508a696a","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding bounded range loops\",\"pattern\":\"^\\\\s*for\\\\s+.*\\\\s+in\\\\s+.*\\\\.\\\\.|^\\\\s*while\\\\s+.*[<>=]|\\\\.take\\\\(|retry\\\\(|Retry::\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_af7rEgzWgX61zVJ0191pnj20","internal_chat_message_metadata_passthrough":{"create_time":1790039663.236189,"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":4801.234799999744,"ttft":1956.7484000008553,"completedAt":1790039667581,"contextSnapshot":{"promptTokens":24636,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"9bf50d81","parentId":"350eceac","timestamp":"2026-09-22T01:14:27.633Z","message":{"role":"toolResult","toolCallId":"call_af7rEgzWgX61zVJ0191pnj20|fc_03665577bed2f92d016ab1d670abc487d2912e2500508a696a","toolName":"grep","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## activity.rs\n 420| remember(&mut seen, &observed);\n*421| for _ in 0..3 {\n 422| let again = observe_links(&owlery);\n 423| assert!(\n 424| plan_pushes(&seen, &again).is_empty(),\n## applyhost.rs\n 322| // brain cycle — that is the whole point).\n*323| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 324|\n 325| swap_and_record(cache, exe_path, version, &artifact)?;\n 326|\n...\n 364|pub fn refresh_brain(broker_name: &str) -> Result {\n*365| let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366| brain\n 367| .request_brain_restart()\n 368| .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n...\n 454|/// never answered (a dead broker fails the apply with the seat untouched).\n*455|fn connect_retry(broker_name: &str) -> io::Result {\n 456| let mut last = io::Error::other(\"broker never answered\");\n*457| for _ in 0..300 {\n 458| match Brain::cold_start(broker_name, now_ms()) {\n 459| Ok(b) => return Ok(b),\n 460| Err(e) => last = e,\n...\n 504| self.broker.stop();\n*505| if let Some(h) = self.handle.take() {\n 506| let _ = h.join();\n 507| }\n 508| }\n...\n 555|\n*556| fn cold_connect_retry(broker_name: &str) -> Brain {\n*557| for _ in 0..300 {\n 558| if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559| return b;\n 560| }\n...\n 824| // No signal wired: accepted, not honored.\n*825| let mut b = cold_connect_retry(&name);\n 826| assert!(\n 827| !b.request_brain_restart().expect(\"verb round-trips\"),\n 828| \"a broker with no supervisor wired must ack honored=false\"\n...\n 833| assert!(broker.set_brain_restart(Arc::clone(&signal)), \"first wire wins\");\n*834| let mut b2 = cold_connect_retry(&name);\n 835| assert!(\n 836| b2.request_brain_restart().expect(\"verb round-trips\"),\n 837| \"a broker with a supervisor wired must ack honored=true\"\n...\n 839| assert!(\n*840| signal.take(),\n 841| \"the verb must raise the planned-restart signal the supervisor consumes\"\n 842| );\n 843| }\n...\n 869| assert!(\n*870| signal.take(),\n 871| \"refresh must raise the planned-restart signal the supervisor consumes\"\n 872| );\n 873| }\n...\n 905| // A hosted endpoint that must survive the apply.\n*906| let mut seat = cold_connect_retry(&name);\n 907| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 908| let child_pid = broker.session_pid(sid);\n 909| drop(seat); // the seat brain detaches; the broker keeps the child\n...\n 1036|\n*1037| let mut seat = cold_connect_retry(&name);\n 1038| let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 1039| let child_pid = broker.session_pid(sid);\n 1040| drop(seat);\n## attach.rs\n 750| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n*751| for (op, b) in pending_input.drain(..) {\n 752| brain.send_effect_no_ack(MintedOp::new(Minter::Rc, op), &b)?;\n 753| }\n 754| }\n## autostart.rs\n 141| let mut launched = false;\n*142| for attempt in 1..=LAUNCH_ATTEMPTS {\n 143| match crate::harnesshost::launch_harness_brokered_in(\n 144| broker_name,\n 145| &entry.id,\n## bootstrap_firewall.rs\n 156| let mut child = command.spawn().map_err(|error| format!(\"{program}: {error}\"))?;\n*157| let stdout = child.stdout.take().expect(\"piped stdout\");\n*158| let stderr = child.stderr.take().expect(\"piped stderr\");\n 159| let (tx, rx) = std::sync::mpsc::channel();\n 160| let err_tx = tx.clone();\n 161| std::thread::spawn(move || {\n 162| let mut bytes = Vec::new();\n*163| let result = stdout.take(LIMIT + 1).read_to_end(&mut bytes).map(|_| bytes);\n 164| let _ = tx.send((true, result));\n 165| });\n 166| std::thread::spawn(move || {\n 167| let mut bytes = Vec::new();\n*168| let result = stderr.take(LIMIT + 1).read_to_end(&mut bytes).map(|_| bytes);\n 169| let _ = err_tx.send((false, result));\n 170| });\n 171| let status = loop {\n...\n 189| let mut err = String::new();\n*190| for _ in 0..2 {\n 191| let (is_stdout, bytes) = rx.recv_timeout(deadline.saturating_duration_since(Instant::now()))\n 192| .map_err(|_| format!(\"{program}: firewall output did not complete\"))?;\n 193| let bytes = bytes.map_err(|error| format!(\"{program}: reading output: {error}\"))?;\n...\n 272| fn drop(&mut self) {\n*273| match self.0.take() {\n 274| Some(value) => std::env::set_var(OPT_OUT, value),\n 275| None => std::env::remove_var(OPT_OUT),\n 276| }\n## brain.rs\n 2825| let server_thread = thread::spawn(move || {\n*2826| while let Ok(env) = frames.recv() {\n 2827| if write_frame(&mut send, &env).is_err() {\n 2828| break;\n 2829| }\n...\n 2913| let deadline = brain.call_deadline();\n*2914| for seq in 0u64..=2 {\n 2915| stub.feed\n 2916| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 2917| .unwrap();\n...\n 2956| let deadline = brain.call_deadline();\n*2957| for seq in 3u64..=5 {\n 2958| stub.feed\n 2959| .send(output_envelope(sid, seq, format!(\"r{seq}\").as_bytes()))\n 2960| .unwrap();\n...\n 3028| let deadline = brain.call_deadline();\n*3029| for seq in 0u64..=1 {\n 3030| stub.feed\n 3031| .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 3032| .unwrap();\n...\n 3198| let deadline = brain.call_deadline();\n*3199| for _ in 0..2 {\n 3200| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3201| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3202| other => panic!(\"expected Output, got {other:?}\"),\n...\n 3278| let deadline = brain.call_deadline();\n*3279| for _ in 0..2 {\n 3280| match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3281| BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3282| other => panic!(\"expected Output, got {other:?}\"),\n## brainproc.rs\n 201| let name = broker_socket_name();\n*202| let mut brain = connect_retry(&name, BRAIN_CONNECT_TRIES)?;\n 203| // The broker hands {generation, start-reason} at spawn (ADR-0018 V2): the\n 204| // generation is broker-owned custody of the KH-2.4 counter (no longer the\n 205| // brain→brain BrainState.generation, which retires in D4), and the reason is\n...\n 447|/// Connect to the broker, retrying briefly while it finishes binding.\n*448|fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449| let mut last: Option = None;\n*450| for _ in 0..tries {\n 451| match Brain::cold_start(name, now_ms()) {\n 452| Ok(b) => return Ok(b),\n 453| Err(e) => {\n...\n 814| let mut slept = Duration::ZERO;\n*815| while slept < backoff && !stop.load(Ordering::Relaxed) {\n 816| thread::sleep(TICK.min(backoff.saturating_sub(slept)));\n 817| slept += TICK;\n 818| }\n...\n 1114| // crash — stamp it `update`.\n*1115| if restart.take() {\n 1116| spt_proto::emit_line_err!(\"BRAIN_UPDATE_RESTART: planned restart — cycling brain onto the swapped binary\");\n 1117| let _ = child.kill();\n 1118| let _ = child.wait();\n...\n 2419| );\n*2420| for _ in 0..5 {\n 2421| assert_eq!(\n 2422| current_exe_hash(),\n 2423| first,\n## broker.rs\n 1306| let mut still_since = Instant::now();\n*1307| while Instant::now() < cap {\n 1308| thread::sleep(RESIZE_QUIESCE_POLL);\n 1309| let now = recover_log(log).high_water();\n 1310| if now != last {\n...\n 1532| self.ring.push_back((seq, bytes.to_vec()));\n*1533| while self.ring.len() > self.cap_chunks {\n 1534| self.ring.pop_front();\n 1535| }\n 1536| // ACROSS A RESIZE the WHOLE presentation is barriered, not just the parse\n...\n 2235| let mut eligible = false;\n*2236| while std::time::Instant::now() < deadline {\n 2237| if crate::inject::is_spt_hosted_no_relay(id, &owlery) {\n 2238| eligible = true;\n 2239| break;\n...\n 2600| let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\n*2601| if let Some(old) = self.controller.take() {\n 2602| old.send.lifecycle_event(\n 2603| \"controller-replaced\",\n 2604| &format!(\"session={} new_conn={}\", self.session_id, sub.id()),\n...\n 2755| let conn = self.controller.as_ref().map(|c| c.send.id());\n*2756| if self.controller.take().is_some() {\n 2757| // ONLY ON THE REAL TRANSITION (releases#49/#267 Q1). The epoch-guarded\n 2758| // no-op above returns without taking anything, and a line there would\n 2759| // report a closure that did not happen — which is exactly the confusion\n...\n 3342| fn commit_resize(&mut self, rows: u16, cols: u16) {\n*3343| let torn_down = match self.transition.take() {\n 3344| Some(t) => {\n 3345| let suppressed = t.suppressed;\n 3346| let deferred = self.replay_held(t, (rows, cols));\n...\n 3375| fn abort_resize(&mut self) {\n*3376| let Some(mut t) = self.transition.take() else {\n 3377| return;\n 3378| };\n 3379| let (from, from_epoch) = (t.from, t.from_epoch);\n...\n 3793| }\n*3794| while let Ok(frame) = rx.recv() {\n 3795| if !matches!(send.write(&frame), Ok(ConnWrite::Done)) {\n 3796| return;\n 3797| }\n...\n 3990| let emit_revoke_if_marked = |send: &SharedSend| {\n*3991| let by = revoked_by.lock().ok().and_then(|mut g| g.take());\n 3992| if let Some(by) = by {\n 3993| let _ = send.write(&displaced_envelope(sid, &by));\n 3994| send.lifecycle_event(\n...\n 4054| }\n*4055| while let Ok(msg) = rx.recv() {\n 4056| // `watermark` distinguishes the two advance shapes below: a live Output\n 4057| // steps the cursor CONTIGUOUSLY (gap-freeze, b4/B2), a transition Sync\n 4058| // JUMPS it past the whole suppressed range as-if-written\n...\n 4346|) {\n*4347| while let Ok(record) = rx.recv() {\n 4348| record.write_to(session.as_ref(), &deliveries);\n 4349| }\n 4350|}\n...\n 5103| let mut integrity_lost = false;\n*5104| for attempt in 1..=INJECT_REDRIVE_ATTEMPTS {\n 5105| // Layer 1: settle-gate before the first byte of EVERY delivery on an echoing\n 5106| // PTY (re-arm — a mid-session `/clear` re-creates the reader-reattach race),\n 5107| // and always before a RE-DRIVE (only reached on a swallowed head, so re-confirm\n...\n 8598| let mut stable_since = Instant::now();\n*8599| while Instant::now() < cap {\n 8600| thread::sleep(Duration::from_millis(50));\n 8601| let now_b = hs.drain.bytes_forwarded();\n 8602| if now_b != last {\n...\n 11072| let mut kinds = Vec::new();\n*11073| while kinds.len() < 4 {\n 11074| kinds.push(read_frame(&mut client).expect(\"frame\").kind);\n 11075| }\n 11076| assert_eq!(\n...\n 11234| // controller no longer throttles the drain or the viewer fan-out.\n*11235| for i in 0..50u32 {\n 11236| let evict = log.append(format!(\"chunk-{i}\").as_bytes());\n 11237| assert_eq!(\n 11238| evict, None,\n...\n 11379| assert!(!input.delivery_matches(text.as_bytes()));\n*11380| while let Ok(record) = rx.try_recv() {\n 11381| record.write_to(&InputCustodySurface, &input.deliveries);\n 11382| }\n 11383| assert!(input.delivery_matches(text.as_bytes()));\n...\n 11392| assert!(input.enqueue(b\"direct controller C:/other\".to_vec()));\n*11393| while let Ok(record) = rx.try_recv() {\n 11394| record.write_to(&InputCustodySurface, &input.deliveries);\n 11395| }\n 11396| assert!(input.delivery_matches(text.as_bytes()));\n...\n 11451| let deliveries = DeliveryBytes::default();\n*11452| while let Ok(record) = rx.recv() {\n 11453| record.write_to(&surface, &deliveries);\n 11454| }\n 11455|\n...\n 11482| // The first DEPTH enqueues fit (accepted, no backpressure yet).\n*11483| for i in 0..DEPTH {\n 11484| assert!(w.enqueue(vec![i as u8]), \"enqueue {i} fits within the bound\");\n 11485| }\n 11486| assert!(\n...\n 12248| let mut over = OutputLog::new(3, 2, String::new(), (24, 80));\n*12249| for i in 0..2 {\n 12250| over.append(&[b'0' + i]);\n 12251| }\n 12252| over.ring.push_back((1, b\"c\".to_vec())); // seq valid + monotonic, but len 3 > cap 2 → over-cap ONLY\n## conn.rs\n 492| d = recover(&self.dog);\n*493| while matches!(d.inflight, Some((cur, _)) if cur == op) && !d.shutdown {\n 494| let (g, _) = self\n 495| .dog_cv\n 496| .wait_timeout(d, Duration::from_millis(100))\n...\n 657| // ── Check out the half + arm the watchdog, then write OUT of locks. ──\n*658| let mut half = g.half.take().expect(\"gate half present at checkout\");\n 659| let op = inner.op_seq.fetch_add(1, Ordering::Relaxed) + 1;\n 660| {\n 661| let mut d = recover(&inner.dog);\n...\n 724| let mut g = recover(&self.inner.gate);\n*725| g.half = self.half.take();\n 726| drop(g);\n 727| self.inner.gate_cv.notify_all();\n 728| }\n...\n 737| let mut g = recover(&self.inner.gate);\n*738| let half = g.half.take().expect(\"pin: gate half present\");\n 739| TestGatePin {\n 740| inner: Arc::clone(&self.inner),\n 741| half: Some(half),\n...\n 766| }\n*767| if let Some(dog) = self.dog.take() {\n 768| let _ = dog.join();\n 769| }\n 770| // Halves (gate or graveyard) drop AFTER the watchdog is gone — no raw\n...\n 836| const N: u64 = 32;\n*837| for round in 0..N {\n 838| let (conn, mut client, mut recv) = make_duplex_with_log(Arc::clone(&log));\n 839| conn.describe(\"role=brain\");\n*840| for seq in 0..4 {\n 841| let request = Envelope::new(\"poll\", serde_json::json!([round, seq]));\n 842| write_frame(&mut client, &request).unwrap();\n 843| let received = crate::codec::read_frame(&mut recv).unwrap();\n...\n 950| // observable; loop until the failure surfaces (bounded).\n*951| for _ in 0..200 {\n 952| match conn.write(&env) {\n 953| Err(e) => {\n 954| organic = Some(e);\n...\n 980|\n*981| for i in 0..100 {\n 982| a.describe(&format!(\"fact-{i}-padding-padding-padding\"));\n 983| }\n 984| let label = recover(&a.inner.label).clone();\n## crc_swap.rs\n 205| }\n*206| for n in 1u64.. {\n 207| let candidate = sibling(target, &format!(\"old-{n}\"));\n 208| if !candidate.exists() {\n 209| return candidate;\n## daemon.rs\n 620| let mut waited = Duration::ZERO;\n*621| while waited < START_TIMEOUT {\n 622| if is_running() {\n 623| return Ok(());\n 624| }\n...\n 2284| } else if c == '\"' {\n*2285| for _ in 0..(backslashes * 2 + 1) {\n 2286| out.push('\\\\');\n 2287| }\n 2288| backslashes = 0;\n...\n 2290| } else {\n*2291| for _ in 0..backslashes {\n 2292| out.push('\\\\');\n 2293| }\n 2294| backslashes = 0;\n...\n 2297| }\n*2298| for _ in 0..(backslashes * 2) {\n 2299| out.push('\\\\');\n 2300| }\n 2301| out.push('\"');\n...\n 2928| let deadline = Instant::now() + Duration::from_secs(10);\n*2929| while !spt_store::proc::provably_gone(child.pid()) && Instant::now() < deadline {\n 2930| thread::sleep(Duration::from_millis(50));\n 2931| }\n 2932| assert!(\n...\n 2987| let mut reaped = false;\n*2988| while Instant::now() < deadline {\n 2989| if matches!(child.wait_ms(200), Ok(Some(_))) {\n 2990| reaped = true;\n 2991| break;\n...\n 3413| let mut found = None;\n*3414| while Instant::now() < deadline {\n 3415| if let Ok(s) = std::fs::read_to_string(&pidfile) {\n 3416| if let Ok(p) = s.trim().parse::() {\n 3417| if p != 0 {\n...\n 3432| let mut still_alive = true;\n*3433| for _ in 0..25 {\n 3434| std::thread::sleep(Duration::from_millis(40));\n 3435| if !is_process_alive(gc) {\n 3436| still_alive = false;\n...\n 3515| });\n*3516| for _ in 0..400 {\n 3517| if is_running() {\n 3518| break;\n 3519| }\n## deelevate.rs\n 716| let mut n = 0usize;\n*717| while !(*p.add(n) == 0 && *p.add(n + 1) == 0) {\n 718| n += 1;\n 719| }\n 720| // n indexes the last entry's terminating NUL; +2 includes it and the\n## digest.rs\n 403| TimelineItem::Activity { .. } => {\n*404| if let Some(b) = pending.take() {\n 405| out.push(b);\n 406| }\n 407| out.push(it);\n## digesthub.rs\n 239| // write failure) or the hub drops the sender.\n*240| while let Ok(up) = rx.recv() {\n 241| if up.version <= req.from_version {\n 242| continue;\n 243| }\n## dispatch.rs\n 899| let mut last = io::Error::other(\"broker never answered\");\n*900| for _ in 0..300 {\n 901| match Brain::cold_start(broker_name, now_ms()) {\n 902| Ok(b) => return Ok(b),\n 903| Err(e) => last = e,\n...\n 2919| let mut queued = 2usize; // the two above\n*2920| for i in 0..RATE_LIMIT_DEFAULT * 2 {\n 2921| let mut r = rec.clone();\n 2922| r.id = format!(\"k-{i}\");\n 2923| r.target = format!(\"t{i}\");\n...\n 3244| let mut claimed = 0usize;\n*3245| for _row in 0..50 {\n 3246| if !pool_has_room(active) {\n 3247| break; // the loop's cold-table break\n 3248| }\n## docshost.rs\n 149| let mut i = 0;\n*150| while i < bytes.len() {\n 151| if bytes[i] == b'%' {\n 152| let hex = bytes.get(i + 1..i + 3)?;\n 153| let s = std::str::from_utf8(hex).ok()?;\n## drivehub.rs\n 549| .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n*550| let frame = hub.take(&req.owner, &req.shell_id, &req.token);\n 551| let activity = hub.take_activity(&req.owner, &req.shell_id, &req.token);\n 552| let attach = hub.take_attach(&req.owner, &req.shell_id, &req.token);\n 553| let res = DriveResult {\n...\n 991| assert_eq!(\n*992| hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 993| Some(\"frame-2\"),\n 994| \"the latest write supersedes the earlier one\"\n 995| );\n...\n 1004| assert_eq!(\n*1005| hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1006| Some(\"frame\")\n 1007| );\n 1008| assert_eq!(\n*1009| hub.take(\"doyle\", \"mock-shell-0\", \"tok\"),\n 1010| None,\n 1011| \"the frame is drained exactly once\"\n 1012| );\n...\n 1025| assert_eq!(\n*1026| hub.take(\"doyle\", \"mock-shell-0\", \"new-token\"),\n 1027| None,\n 1028| \"a frame stamped under the dead link generation is never served\"\n 1029| );\n...\n 1045| assert!(!hub.has_slot(\"doyle\", \"mock-shell-0\"));\n*1046| assert_eq!(hub.take(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1047| }\n 1048|\n 1049| // ---- the SECOND slot class: activity (ADR-0048) ----\n...\n 1063| assert_eq!(\n*1064| hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1065| Some(\"drive-frame\"),\n 1066| \"the activity write did not displace the pending drive command\"\n 1067| );\n...\n 1079| assert_eq!(\n*1080| hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1081| Some(\"drive-frame\"),\n 1082| \"the drive command survived the later activity push\"\n 1083| );\n...\n 1145| assert!(!hub.has_activity_slot(\"doyle\", \"mock-shell-0\"));\n*1146| assert_eq!(hub.take(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1147| assert_eq!(hub.take_activity(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1148| }\n 1149|\n...\n 1197| assert_eq!(\n*1198| hub.take(\"owner\", \"shell-0\", \"tok\").as_deref(),\n 1199| Some(\"drive-frame\")\n 1200| );\n 1201| assert_eq!(\n...\n 1374| thread::spawn(move || {\n*1375| while let Ok(mut conn) = listener.accept() {\n 1376| let _ = recv_hello(&mut conn, Role::Brain);\n 1377| // …and then, like an N-1 router's `_ => {}`, nothing at all.\n 1378| thread::sleep(std::time::Duration::from_secs(30));\n...\n 1493| assert_eq!(\n*1494| hub.take(\"doyle\", \"mock-shell-0\", \"tok-a\").as_deref(),\n 1495| Some(\"for-doyle\")\n 1496| );\n 1497| assert_eq!(\n*1498| hub.take(\"perri\", \"mock-shell-0\", \"tok-b\").as_deref(),\n 1499| Some(\"for-perri\")\n 1500| );\n 1501| }\n## effect.rs\n 787| ) {\n*788| for op in 0..total {\n 789| if crash == Some((op, Window::BeforeIntent)) {\n 790| return; // crashed before recording intent for this op\n 791| }\n...\n 997| assert_eq!(j.applied_count() as u64, TOTAL, \"applied-set holds all ops\");\n*998| for op in 0..TOTAL {\n 999| assert!(j.is_applied(k(1, op)), \"op {op} recorded applied\");\n 1000| }\n 1001| assert!(\n...\n 1237|\n*1238| let out = with_tracing_retry(mint, run).expect(\"the retry self-heals\");\n 1239| assert_eq!(out, \"healed\");\n 1240|\n 1241| let ops = minted.borrow();\n...\n 1262|\n*1263| let err = with_tracing_retry(mint, run).expect_err(\"both attempts fail\");\n 1264| let msg = err.to_string();\n 1265| assert_eq!(\n 1266| msg, RETRY_EXHAUSTED_PUBLIC,\n...\n 1292|\n*1293| let out = with_tracing_retry(mint, run).unwrap();\n 1294| assert_eq!(out, \"done\");\n 1295| assert_eq!(mint_calls.get(), 1, \"no retry: mint called once\");\n 1296| assert_eq!(run_calls.get(), 1, \"no retry: run called once\");\n...\n 1313|\n*1314| let err = with_tracing_retry(mint, run).expect_err(\"a non-marker error propagates\");\n 1315| assert_eq!(\n 1316| err.to_string(),\n 1317| other,\n\n## bin/\n### xlate_choreo_fixture.rs\n 162| let mut s = String::from(\"HEADSTART \");\n*163| for i in 0..12 {\n 164| s.push_str(&format!(\"line-{i:02}-payload-body-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\\n\"));\n 165| }\n 166| s.push_str(\"TAILEND\");\n\n## bootstrap_firewall/\n### windows.rs\n 1422|\n*1423| for missing in 0..want.len() {\n 1424| let mut half = full.clone();\n 1425| let dropped = half.remove(missing);\n 1426| assert!(\n\nShowing files 1-20 of 126+. Use skip=20 for the next page, or narrow paths/pattern."}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":101,"fileCount":20,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/activity.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/autostart.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bin/xlate_choreo_fixture.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/windows.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/conn.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/crc_swap.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/deelevate.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/digest.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/digesthub.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/dispatch.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/docshost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/drivehub.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/effect.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/activity.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs","count":13},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/autostart.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bin/xlate_choreo_fixture.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/bootstrap_firewall/windows.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/conn.rs","count":9},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/crc_swap.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs","count":9},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/deelevate.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/digest.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/digesthub.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/dispatch.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/docshost.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/drivehub.rs","count":13},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/effect.rs","count":6}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## activity.rs\n 420│ remember(&mut seen, &observed);\n*421│ for _ in 0..3 {\n 422│ let again = observe_links(&owlery);\n 423│ assert!(\n 424│ plan_pushes(&seen, &again).is_empty(),\n## applyhost.rs\n 322│ // brain cycle — that is the whole point).\n *323│ let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 324│\n 325│ swap_and_record(cache, exe_path, version, &artifact)?;\n 326│\n │...\n 364│pub fn refresh_brain(broker_name: &str) -> Result {\n *365│ let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n 366│ brain\n 367│ .request_brain_restart()\n 368│ .map_err(|e| format!(\"brain-restart trigger: {e}\"))\n │...\n 454│/// never answered (a dead broker fails the apply with the seat untouched).\n *455│fn connect_retry(broker_name: &str) -> io::Result {\n 456│ let mut last = io::Error::other(\"broker never answered\");\n *457│ for _ in 0..300 {\n 458│ match Brain::cold_start(broker_name, now_ms()) {\n 459│ Ok(b) => return Ok(b),\n 460│ Err(e) => last = e,\n │...\n 504│ self.broker.stop();\n *505│ if let Some(h) = self.handle.take() {\n 506│ let _ = h.join();\n 507│ }\n 508│ }\n │...\n 555│\n *556│ fn cold_connect_retry(broker_name: &str) -> Brain {\n *557│ for _ in 0..300 {\n 558│ if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559│ return b;\n 560│ }\n │...\n 824│ // No signal wired: accepted, not honored.\n *825│ let mut b = cold_connect_retry(&name);\n 826│ assert!(\n 827│ !b.request_brain_restart().expect(\"verb round-trips\"),\n 828│ \"a broker with no supervisor wired must ack honored=false\"\n │...\n 833│ assert!(broker.set_brain_restart(Arc::clone(&signal)), \"first wire wins\");\n *834│ let mut b2 = cold_connect_retry(&name);\n 835│ assert!(\n 836│ b2.request_brain_restart().expect(\"verb round-trips\"),\n 837│ \"a broker with a supervisor wired must ack honored=true\"\n │...\n 839│ assert!(\n *840│ signal.take(),\n 841│ \"the verb must raise the planned-restart signal the supervisor consumes\"\n 842│ );\n 843│ }\n │...\n 869│ assert!(\n *870│ signal.take(),\n 871│ \"refresh must raise the planned-restart signal the supervisor consumes\"\n 872│ );\n 873│ }\n │...\n 905│ // A hosted endpoint that must survive the apply.\n *906│ let mut seat = cold_connect_retry(&name);\n 907│ let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 908│ let child_pid = broker.session_pid(sid);\n 909│ drop(seat); // the seat brain detaches; the broker keeps the child\n │...\n 1036│\n*1037│ let mut seat = cold_connect_retry(&name);\n 1038│ let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n 1039│ let child_pid = broker.session_pid(sid);\n 1040│ drop(seat);\n## attach.rs\n 750│ // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n*751│ for (op, b) in pending_input.drain(..) {\n 752│ brain.send_effect_no_ack(MintedOp::new(Minter::Rc, op), &b)?;\n 753│ }\n 754│ }\n## autostart.rs\n 141│ let mut launched = false;\n*142│ for attempt in 1..=LAUNCH_ATTEMPTS {\n 143│ match crate::harnesshost::launch_harness_brokered_in(\n 144│ broker_name,\n 145│ &entry.id,\n## bootstrap_firewall.rs\n 156│ let mut child = command.spawn().map_err(|error| format!(\"{program}: {error}\"))?;\n*157│ let stdout = child.stdout.take().expect(\"piped stdout\");\n*158│ let stderr = child.stderr.take().expect(\"piped stderr\");\n 159│ let (tx, rx) = std::sync::mpsc::channel();\n 160│ let err_tx = tx.clone();\n 161│ std::thread::spawn(move || {\n 162│ let mut bytes = Vec::new();\n*163│ let result = stdout.take(LIMIT + 1).read_to_end(&mut bytes).map(|_| bytes);\n 164│ let _ = tx.send((true, result));\n 165│ });\n 166│ std::thread::spawn(move || {\n 167│ let mut bytes = Vec::new();\n*168│ let result = stderr.take(LIMIT + 1).read_to_end(&mut bytes).map(|_| bytes);\n 169│ let _ = err_tx.send((false, result));\n 170│ });\n 171│ let status = loop {\n │...\n 189│ let mut err = String::new();\n*190│ for _ in 0..2 {\n 191│ let (is_stdout, bytes) = rx.recv_timeout(deadline.saturating_duration_since(Instant::now()))\n 192│ .map_err(|_| format!(\"{program}: firewall output did not complete\"))?;\n 193│ let bytes = bytes.map_err(|error| format!(\"{program}: reading output: {error}\"))?;\n │...\n 272│ fn drop(&mut self) {\n*273│ match self.0.take() {\n 274│ Some(value) => std::env::set_var(OPT_OUT, value),\n 275│ None => std::env::remove_var(OPT_OUT),\n 276│ }\n## brain.rs\n 2825│ let server_thread = thread::spawn(move || {\n*2826│ while let Ok(env) = frames.recv() {\n 2827│ if write_frame(&mut send, &env).is_err() {\n 2828│ break;\n 2829│ }\n │...\n 2913│ let deadline = brain.call_deadline();\n*2914│ for seq in 0u64..=2 {\n 2915│ stub.feed\n 2916│ .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 2917│ .unwrap();\n │...\n 2956│ let deadline = brain.call_deadline();\n*2957│ for seq in 3u64..=5 {\n 2958│ stub.feed\n 2959│ .send(output_envelope(sid, seq, format!(\"r{seq}\").as_bytes()))\n 2960│ .unwrap();\n │...\n 3028│ let deadline = brain.call_deadline();\n*3029│ for seq in 0u64..=1 {\n 3030│ stub.feed\n 3031│ .send(output_envelope(sid, seq, format!(\"c{seq}\").as_bytes()))\n 3032│ .unwrap();\n │...\n 3198│ let deadline = brain.call_deadline();\n*3199│ for _ in 0..2 {\n 3200│ match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3201│ BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3202│ other => panic!(\"expected Output, got {other:?}\"),\n │...\n 3278│ let deadline = brain.call_deadline();\n*3279│ for _ in 0..2 {\n 3280│ match brain.read_event_until(deadline).expect(\"subsequent live frames\") {\n 3281│ BrokerEvent::Output { seq, bytes, .. } => accepted.push((seq, bytes)),\n 3282│ other => panic!(\"expected Output, got {other:?}\"),\n## brainproc.rs\n 201│ let name = broker_socket_name();\n *202│ let mut brain = connect_retry(&name, BRAIN_CONNECT_TRIES)?;\n 203│ // The broker hands {generation, start-reason} at spawn (ADR-0018 V2): the\n 204│ // generation is broker-owned custody of the KH-2.4 counter (no longer the\n 205│ // brain→brain BrainState.generation, which retires in D4), and the reason is\n │...\n 447│/// Connect to the broker, retrying briefly while it finishes binding.\n *448│fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449│ let mut last: Option = None;\n *450│ for _ in 0..tries {\n 451│ match Brain::cold_start(name, now_ms()) {\n 452│ Ok(b) => return Ok(b),\n 453│ Err(e) => {\n │...\n 814│ let mut slept = Duration::ZERO;\n *815│ while slept < backoff && !stop.load(Ordering::Relaxed) {\n 816│ thread::sleep(TICK.min(backoff.saturating_sub(slept)));\n 817│ slept += TICK;\n 818│ }\n │...\n 1114│ // crash — stamp it `update`.\n*1115│ if restart.take() {\n 1116│ spt_proto::emit_line_err!(\"BRAIN_UPDATE_RESTART: planned restart — cycling brain onto the swapped binary\");\n 1117│ let _ = child.kill();\n 1118│ let _ = child.wait();\n │...\n 2419│ );\n*2420│ for _ in 0..5 {\n 2421│ assert_eq!(\n 2422│ current_exe_hash(),\n 2423│ first,\n## broker.rs\n 1306│ let mut still_since = Instant::now();\n *1307│ while Instant::now() < cap {\n 1308│ thread::sleep(RESIZE_QUIESCE_POLL);\n 1309│ let now = recover_log(log).high_water();\n 1310│ if now != last {\n │...\n 1532│ self.ring.push_back((seq, bytes.to_vec()));\n *1533│ while self.ring.len() > self.cap_chunks {\n 1534│ self.ring.pop_front();\n 1535│ }\n 1536│ // ACROSS A RESIZE the WHOLE presentation is barriered, not just the parse\n │...\n 2235│ let mut eligible = false;\n *2236│ while std::time::Instant::now() < deadline {\n 2237│ if crate::inject::is_spt_hosted_no_relay(id, &owlery) {\n 2238│ eligible = true;\n 2239│ break;\n │...\n 2600│ let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\n *2601│ if let Some(old) = self.controller.take() {\n 2602│ old.send.lifecycle_event(\n 2603│ \"controller-replaced\",\n 2604│ &format!(\"session={} new_conn={}\", self.session_id, sub.id()),\n │...\n 2755│ let conn = self.controller.as_ref().map(|c| c.send.id());\n *2756│ if self.controller.take().is_some() {\n 2757│ // ONLY ON THE REAL TRANSITION (releases#49/#267 Q1). The epoch-guarded\n 2758│ // no-op above returns without taking anything, and a line there would\n 2759│ // report a closure that did not happen — which is exactly the confusion\n │...\n 3342│ fn commit_resize(&mut self, rows: u16, cols: u16) {\n *3343│ let torn_down = match self.transition.take() {\n 3344│ Some(t) => {\n 3345│ let suppressed = t.suppressed;\n 3346│ let deferred = self.replay_held(t, (rows, cols));\n │...\n 3375│ fn abort_resize(&mut self) {\n *3376│ let Some(mut t) = self.transition.take() else {\n 3377│ return;\n 3378│ };\n 3379│ let (from, from_epoch) = (t.from, t.from_epoch);\n │...\n 3793│ }\n *3794│ while let Ok(frame) = rx.recv() {\n 3795│ if !matches!(send.write(&frame), Ok(ConnWrite::Done)) {\n 3796│ return;\n 3797│ }\n │...\n 3990│ let emit_revoke_if_marked = |send: &SharedSend| {\n *3991│ let by = revoked_by.lock().ok().and_then(|mut g| g.take());\n 3992│ if let Some(by) = by {\n 3993│ let _ = send.write(&displaced_envelope(sid, &by));\n 3994│ send.lifecycle_event(\n │...\n 4054│ }\n *4055│ while let Ok(msg) = rx.recv() {\n 4056│ // `watermark` distinguishes the two advance shapes below: a live Output\n 4057│ // steps the cursor CONTIGUOUSLY (gap-freeze, b4/B2), a transition Sync\n 4058│ // JUMPS it past the whole suppressed range as-if-written\n │...\n 4346│) {\n *4347│ while let Ok(record) = rx.recv() {\n 4348│ record.write_to(session.as_ref(), &deliveries);\n 4349│ }\n 4350│}\n │...\n 5103│ let mut integrity_lost = false;\n *5104│ for attempt in 1..=INJECT_REDRIVE_ATTEMPTS {\n 5105│ // Layer 1: settle-gate before the first byte of EVERY delivery on an echoing\n 5106│ // PTY (re-arm — a mid-session `/clear` re-creates the reader-reattach race),\n 5107│ // and always before a RE-DRIVE (only reached on a swallowed head, so re-confirm\n │...\n 8598│ let mut stable_since = Instant::now();\n *8599│ while Instant::now() < cap {\n 8600│ thread::sleep(Duration::from_millis(50));\n 8601│ let now_b = hs.drain.bytes_forwarded();\n 8602│ if now_b != last {\n │...\n 11072│ let mut kinds = Vec::new();\n*11073│ while kinds.len() < 4 {\n 11074│ kinds.push(read_frame(&mut client).expect(\"frame\").kind);\n 11075│ }\n 11076│ assert_eq!(\n │...\n 11234│ // controller no longer throttles the drain or the viewer fan-out.\n*11235│ for i in 0..50u32 {\n 11236│ let evict = log.append(format!(\"chunk-{i}\").as_bytes());\n 11237│ assert_eq!(\n 11238│ evict, None,\n │...\n 11379│ assert!(!input.delivery_matches(text.as_bytes()));\n*11380│ while let Ok(record) = rx.try_recv() {\n 11381│ record.write_to(&InputCustodySurface, &input.deliveries);\n 11382│ }\n 11383│ assert!(input.delivery_matches(text.as_bytes()));\n │...\n 11392│ assert!(input.enqueue(b\"direct controller C:/other\".to_vec()));\n*11393│ while let Ok(record) = rx.try_recv() {\n 11394│ record.write_to(&InputCustodySurface, &input.deliveries);\n 11395│ }\n 11396│ assert!(input.delivery_matches(text.as_bytes()));\n │...\n 11451│ let deliveries = DeliveryBytes::default();\n*11452│ while let Ok(record) = rx.recv() {\n 11453│ record.write_to(&surface, &deliveries);\n 11454│ }\n 11455│\n │...\n 11482│ // The first DEPTH enqueues fit (accepted, no backpressure yet).\n*11483│ for i in 0..DEPTH {\n 11484│ assert!(w.enqueue(vec![i as u8]), \"enqueue {i} fits within the bound\");\n 11485│ }\n 11486│ assert!(\n │...\n 12248│ let mut over = OutputLog::new(3, 2, String::new(), (24, 80));\n*12249│ for i in 0..2 {\n 12250│ over.append(&[b'0' + i]);\n 12251│ }\n 12252│ over.ring.push_back((1, b\"c\".to_vec())); // seq valid + monotonic, but len 3 > cap 2 → over-cap ONLY\n## conn.rs\n 492│ d = recover(&self.dog);\n*493│ while matches!(d.inflight, Some((cur, _)) if cur == op) && !d.shutdown {\n 494│ let (g, _) = self\n 495│ .dog_cv\n 496│ .wait_timeout(d, Duration::from_millis(100))\n │...\n 657│ // ── Check out the half + arm the watchdog, then write OUT of locks. ──\n*658│ let mut half = g.half.take().expect(\"gate half present at checkout\");\n 659│ let op = inner.op_seq.fetch_add(1, Ordering::Relaxed) + 1;\n 660│ {\n 661│ let mut d = recover(&inner.dog);\n │...\n 724│ let mut g = recover(&self.inner.gate);\n*725│ g.half = self.half.take();\n 726│ drop(g);\n 727│ self.inner.gate_cv.notify_all();\n 728│ }\n │...\n 737│ let mut g = recover(&self.inner.gate);\n*738│ let half = g.half.take().expect(\"pin: gate half present\");\n 739│ TestGatePin {\n 740│ inner: Arc::clone(&self.inner),\n 741│ half: Some(half),\n │...\n 766│ }\n*767│ if let Some(dog) = self.dog.take() {\n 768│ let _ = dog.join();\n 769│ }\n 770│ // Halves (gate or graveyard) drop AFTER the watchdog is gone — no raw\n │...\n 836│ const N: u64 = 32;\n*837│ for round in 0..N {\n 838│ let (conn, mut client, mut recv) = make_duplex_with_log(Arc::clone(&log));\n 839│ conn.describe(\"role=brain\");\n*840│ for seq in 0..4 {\n 841│ let request = Envelope::new(\"poll\", serde_json::json!([round, seq]));\n 842│ write_frame(&mut client, &request).unwrap();\n 843│ let received = crate::codec::read_frame(&mut recv).unwrap();\n │...\n 950│ // observable; loop until the failure surfaces (bounded).\n*951│ for _ in 0..200 {\n 952│ match conn.write(&env) {\n 953│ Err(e) => {\n 954│ organic = Some(e);\n │...\n 980│\n*981│ for i in 0..100 {\n 982│ a.describe(&format!(\"fact-{i}-padding-padding-padding\"));\n 983│ }\n 984│ let label = recover(&a.inner.label).clone();\n## crc_swap.rs\n 205│ }\n*206│ for n in 1u64.. {\n 207│ let candidate = sibling(target, &format!(\"old-{n}\"));\n 208│ if !candidate.exists() {\n 209│ return candidate;\n## daemon.rs\n 620│ let mut waited = Duration::ZERO;\n *621│ while waited < START_TIMEOUT {\n 622│ if is_running() {\n 623│ return Ok(());\n 624│ }\n │...\n 2284│ } else if c == '\"' {\n*2285│ for _ in 0..(backslashes * 2 + 1) {\n 2286│ out.push('\\\\');\n 2287│ }\n 2288│ backslashes = 0;\n │...\n 2290│ } else {\n*2291│ for _ in 0..backslashes {\n 2292│ out.push('\\\\');\n 2293│ }\n 2294│ backslashes = 0;\n │...\n 2297│ }\n*2298│ for _ in 0..(backslashes * 2) {\n 2299│ out.push('\\\\');\n 2300│ }\n 2301│ out.push('\"');\n │...\n 2928│ let deadline = Instant::now() + Duration::from_secs(10);\n*2929│ while !spt_store::proc::provably_gone(child.pid()) && Instant::now() < deadline {\n 2930│ thread::sleep(Duration::from_millis(50));\n 2931│ }\n 2932│ assert!(\n │...\n 2987│ let mut reaped = false;\n*2988│ while Instant::now() < deadline {\n 2989│ if matches!(child.wait_ms(200), Ok(Some(_))) {\n 2990│ reaped = true;\n 2991│ break;\n │...\n 3413│ let mut found = None;\n*3414│ while Instant::now() < deadline {\n 3415│ if let Ok(s) = std::fs::read_to_string(&pidfile) {\n 3416│ if let Ok(p) = s.trim().parse::() {\n 3417│ if p != 0 {\n │...\n 3432│ let mut still_alive = true;\n*3433│ for _ in 0..25 {\n 3434│ std::thread::sleep(Duration::from_millis(40));\n 3435│ if !is_process_alive(gc) {\n 3436│ still_alive = false;\n │...\n 3515│ });\n*3516│ for _ in 0..400 {\n 3517│ if is_running() {\n 3518│ break;\n 3519│ }\n## deelevate.rs\n 716│ let mut n = 0usize;\n*717│ while !(*p.add(n) == 0 && *p.add(n + 1) == 0) {\n 718│ n += 1;\n 719│ }\n 720│ // n indexes the last entry's terminating NUL; +2 includes it and the\n## digest.rs\n 403│ TimelineItem::Activity { .. } => {\n*404│ if let Some(b) = pending.take() {\n 405│ out.push(b);\n 406│ }\n 407│ out.push(it);\n## digesthub.rs\n 239│ // write failure) or the hub drops the sender.\n*240│ while let Ok(up) = rx.recv() {\n 241│ if up.version <= req.from_version {\n 242│ continue;\n 243│ }\n## dispatch.rs\n 899│ let mut last = io::Error::other(\"broker never answered\");\n *900│ for _ in 0..300 {\n 901│ match Brain::cold_start(broker_name, now_ms()) {\n 902│ Ok(b) => return Ok(b),\n 903│ Err(e) => last = e,\n │...\n 2919│ let mut queued = 2usize; // the two above\n*2920│ for i in 0..RATE_LIMIT_DEFAULT * 2 {\n 2921│ let mut r = rec.clone();\n 2922│ r.id = format!(\"k-{i}\");\n 2923│ r.target = format!(\"t{i}\");\n │...\n 3244│ let mut claimed = 0usize;\n*3245│ for _row in 0..50 {\n 3246│ if !pool_has_room(active) {\n 3247│ break; // the loop's cold-table break\n 3248│ }\n## docshost.rs\n 149│ let mut i = 0;\n*150│ while i < bytes.len() {\n 151│ if bytes[i] == b'%' {\n 152│ let hex = bytes.get(i + 1..i + 3)?;\n 153│ let s = std::str::from_utf8(hex).ok()?;\n## drivehub.rs\n 549│ .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n *550│ let frame = hub.take(&req.owner, &req.shell_id, &req.token);\n 551│ let activity = hub.take_activity(&req.owner, &req.shell_id, &req.token);\n 552│ let attach = hub.take_attach(&req.owner, &req.shell_id, &req.token);\n 553│ let res = DriveResult {\n │...\n 991│ assert_eq!(\n *992│ hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 993│ Some(\"frame-2\"),\n 994│ \"the latest write supersedes the earlier one\"\n 995│ );\n │...\n 1004│ assert_eq!(\n*1005│ hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1006│ Some(\"frame\")\n 1007│ );\n 1008│ assert_eq!(\n*1009│ hub.take(\"doyle\", \"mock-shell-0\", \"tok\"),\n 1010│ None,\n 1011│ \"the frame is drained exactly once\"\n 1012│ );\n │...\n 1025│ assert_eq!(\n*1026│ hub.take(\"doyle\", \"mock-shell-0\", \"new-token\"),\n 1027│ None,\n 1028│ \"a frame stamped under the dead link generation is never served\"\n 1029│ );\n │...\n 1045│ assert!(!hub.has_slot(\"doyle\", \"mock-shell-0\"));\n*1046│ assert_eq!(hub.take(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1047│ }\n 1048│\n 1049│ // ---- the SECOND slot class: activity (ADR-0048) ----\n │...\n 1063│ assert_eq!(\n*1064│ hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1065│ Some(\"drive-frame\"),\n 1066│ \"the activity write did not displace the pending drive command\"\n 1067│ );\n │...\n 1079│ assert_eq!(\n*1080│ hub.take(\"doyle\", \"mock-shell-0\", \"tok\").as_deref(),\n 1081│ Some(\"drive-frame\"),\n 1082│ \"the drive command survived the later activity push\"\n 1083│ );\n │...\n 1145│ assert!(!hub.has_activity_slot(\"doyle\", \"mock-shell-0\"));\n*1146│ assert_eq!(hub.take(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1147│ assert_eq!(hub.take_activity(\"doyle\", \"mock-shell-0\", \"tok\"), None);\n 1148│ }\n 1149│\n │...\n 1197│ assert_eq!(\n*1198│ hub.take(\"owner\", \"shell-0\", \"tok\").as_deref(),\n 1199│ Some(\"drive-frame\")\n 1200│ );\n 1201│ assert_eq!(\n │...\n 1374│ thread::spawn(move || {\n*1375│ while let Ok(mut conn) = listener.accept() {\n 1376│ let _ = recv_hello(&mut conn, Role::Brain);\n 1377│ // …and then, like an N-1 router's `_ => {}`, nothing at all.\n 1378│ thread::sleep(std::time::Duration::from_secs(30));\n │...\n 1493│ assert_eq!(\n*1494│ hub.take(\"doyle\", \"mock-shell-0\", \"tok-a\").as_deref(),\n 1495│ Some(\"for-doyle\")\n 1496│ );\n 1497│ assert_eq!(\n*1498│ hub.take(\"perri\", \"mock-shell-0\", \"tok-b\").as_deref(),\n 1499│ Some(\"for-perri\")\n 1500│ );\n 1501│ }\n## effect.rs\n 787│ ) {\n *788│ for op in 0..total {\n 789│ if crash == Some((op, Window::BeforeIntent)) {\n 790│ return; // crashed before recording intent for this op\n 791│ }\n │...\n 997│ assert_eq!(j.applied_count() as u64, TOTAL, \"applied-set holds all ops\");\n *998│ for op in 0..TOTAL {\n 999│ assert!(j.is_applied(k(1, op)), \"op {op} recorded applied\");\n 1000│ }\n 1001│ assert!(\n │...\n 1237│\n*1238│ let out = with_tracing_retry(mint, run).expect(\"the retry self-heals\");\n 1239│ assert_eq!(out, \"healed\");\n 1240│\n 1241│ let ops = minted.borrow();\n │...\n 1262│\n*1263│ let err = with_tracing_retry(mint, run).expect_err(\"both attempts fail\");\n 1264│ let msg = err.to_string();\n 1265│ assert_eq!(\n 1266│ msg, RETRY_EXHAUSTED_PUBLIC,\n │...\n 1292│\n*1293│ let out = with_tracing_retry(mint, run).unwrap();\n 1294│ assert_eq!(out, \"done\");\n 1295│ assert_eq!(mint_calls.get(), 1, \"no retry: mint called once\");\n 1296│ assert_eq!(run_calls.get(), 1, \"no retry: run called once\");\n │...\n 1313│\n*1314│ let err = with_tracing_retry(mint, run).expect_err(\"a non-marker error propagates\");\n 1315│ assert_eq!(\n 1316│ err.to_string(),\n 1317│ other,\n\n## bin/\n### xlate_choreo_fixture.rs\n 162│ let mut s = String::from(\"HEADSTART \");\n*163│ for i in 0..12 {\n 164│ s.push_str(&format!(\"line-{i:02}-payload-body-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\\n\"));\n 165│ }\n 166│ s.push_str(\"TAILEND\");\n\n## bootstrap_firewall/\n### windows.rs\n 1422│\n*1423│ for missing in 0..want.len() {\n 1424│ let mut half = full.clone();\n 1425│ let dropped = half.remove(missing);\n 1426│ assert!("},"isError":false,"timestamp":1790039667633}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_gDB7s3dCLqwINKJpXfDvK1SJ|fc_03665577bed2f92d016ab1d675a58c87d294fab8462c71d08f","toolName":"grep","startedAt":"2026-09-22T01:14:32.655Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Paging bounded range census"},"id":"6f2a0f3b","parentId":"9bf50d81","timestamp":"2026-09-22T01:14:32.655Z"}
{"type":"message","id":"d6438f6b","parentId":"6f2a0f3b","timestamp":"2026-09-22T01:14:32.656Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_gDB7s3dCLqwINKJpXfDvK1SJ|fc_03665577bed2f92d016ab1d675a58c87d294fab8462c71d08f","name":"grep","arguments":{"i":"Paging bounded range census","pattern":"^\\s*for\\s+.*\\s+in\\s+.*\\.\\.|^\\s*while\\s+.*[<>=]|\\.take\\(|retry\\(|Retry::","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":20},"intent":"Paging bounded range census"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":7221,"output":110,"cacheRead":24448,"cacheWrite":0,"totalTokens":31779,"cost":{"input":0.07221000000000001,"output":0.0055000000000000005,"cacheRead":0.024447999999999998,"cacheWrite":0,"total":0.10215800000000001}},"stopReason":"toolUse","timestamp":1790039667685,"responseId":"resp_03665577bed2f92d016ab1d673f09887d297844103168946b0","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d675a58c87d294fab8462c71d08f","type":"function_call","status":"completed","arguments":"{\"i\":\"Paging bounded range census\",\"pattern\":\"^\\\\s*for\\\\s+.*\\\\s+in\\\\s+.*\\\\.\\\\.|^\\\\s*while\\\\s+.*[<>=]|\\\\.take\\\\(|retry\\\\(|Retry::\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":20}","call_id":"call_gDB7s3dCLqwINKJpXfDvK1SJ","internal_chat_message_metadata_passthrough":{"create_time":1790039668.095756,"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":4961.35339999944,"ttft":1980.266899999231,"completedAt":1790039672655,"contextSnapshot":{"promptTokens":31669,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"f3c64033","parentId":"d6438f6b","timestamp":"2026-09-22T01:14:32.717Z","message":{"role":"toolResult","toolCallId":"call_gDB7s3dCLqwINKJpXfDvK1SJ|fc_03665577bed2f92d016ab1d675a58c87d294fab8462c71d08f","toolName":"grep","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## inputreceipt.rs\n 369| let mut first = None;\n*370| for _ in 0..PENDING_RECEIPTS {\n 371| let request = book.begin(\"s\", \"read /input\", 7, 100).unwrap().unwrap();\n 372| first.get_or_insert_with(|| request.receipt_id.clone());\n 373| book.complete(\n## lanhost.rs\n 748| let mut held = LAN.lock().map_err(|_| \"LAN_BOOTSTRAP_POISONED\".to_string())?;\n*749| match held.take() {\n 750| Some(listener) => {\n 751| // Dropping the sender would also end the loop; sending is the\n 752| // explicit spelling, and a failed send means the loop already ended.\n## lifecycle.rs\n 2166| let mut left = period;\n*2167| while left > Duration::ZERO {\n 2168| if stop.load(Ordering::Relaxed) {\n 2169| return;\n 2170| }\n...\n 2616|\n*2617| for i in 1..=9 {\n 2618| host.note_outcome(PsycheKind::Turn, &killed);\n 2619| assert!(\n 2620| stamp().is_none(),\n...\n 2704|\n*2705| for _ in 0..3 {\n 2706| host.note_outcome(PsycheKind::Ingest, &broken);\n 2707| // A HEALTHY turn between every broken ingest.\n 2708| host.note_outcome(PsycheKind::Turn, &PsycheOutcome::Ok);\n...\n 2957| let mut ever_stamped = false;\n*2958| for _ in 0..12 {\n 2959| host.note_outcome(PsycheKind::Turn, &fail);\n 2960| if read_info(&perch_path).unwrap().psyche_host_error.is_some() {\n 2961| ever_stamped = true;\n...\n 3826|\n*3827| for _ in 0..3 {\n 3828| // Arm the echo gate so the fire (turn + commune-sync) runs this tick.\n 3829| let gate = perch::resolve_edge_echo_file(\"doyle\", ParentHint::Infer);\n 3830| if let Some(p) = gate.parent() {\n...\n 3886| let mut first_since: Option = None;\n*3887| for _ in 0..3 {\n 3888| let gate = perch::resolve_edge_echo_file(\"doyle\", ParentHint::Infer);\n 3889| if let Some(p) = gate.parent() {\n 3890| std::fs::create_dir_all(p).unwrap();\n## livehost.rs\n 1266| }\n*1267| for n in 1u64.. {\n 1268| let candidate = live_bin.with_file_name(format!(\".live-bin.old-{n}\"));\n 1269| if !candidate.exists() {\n 1270| return candidate;\n...\n 1448| let mut left = LIVE_RECONCILE_INTERVAL_MS;\n*1449| while left > 0 && !stop.load(Ordering::SeqCst) {\n 1450| let step = left.min(100);\n 1451| std::thread::sleep(Duration::from_millis(step));\n 1452| left -= step;\n...\n 1483| recv_hello(&mut conn, Role::Brain).unwrap();\n*1484| for _ in 0..N {\n 1485| assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1486| write_frame(&mut conn, &Envelope::new(\n 1487| crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n...\n 1506| let mut poll = SessionPoll::default();\n*1507| for _ in 0..N {\n 1508| assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n 1509| }\n 1510| assert_eq!(poll.query(&name), None, \"failure is not an empty session census\");\n...\n 1564| let deadline = Instant::now() + bound;\n*1565| while Instant::now() < deadline {\n 1566| if pred() {\n 1567| return true;\n 1568| }\n...\n 2243| let mut b = None;\n*2244| for _ in 0..200 {\n 2245| if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n 2246| b = Some(c);\n 2247| break;\n...\n 2533| let mut removed = false;\n*2534| for _ in 0..100 {\n 2535| if std::fs::remove_dir_all(&self_perch).is_ok() {\n 2536| removed = true;\n 2537| break;\n## nethost.rs\n 229| // Then live frames, same halt discipline.\n*230| while let Ok(frame) = rx.recv() {\n 231| if writer_sub.write(&frame).is_err() {\n 232| poison(\"live write failed\");\n 233| break;\n...\n 256| drop(self.tx);\n*257| if let Some(writer) = self.writer.take() {\n 258| let _ = writer.join();\n 259| }\n 260| }\n...\n 473| if self.retentive_cap == 0 {\n*474| while self.ring.len() > self.cap_chunks {\n 475| self.ring.pop_front();\n 476| }\n 477| }\n...\n 495| fn drop_seat(&mut self, fail: SeatFail) {\n*496| if let Some(seat) = self.subscriber.take() {\n 497| seat.sub.lifecycle_event(\n 498| \"stream-sub-halt\",\n 499| &format!(\"stream={} reason={fail:?}\", self.stream_id),\n...\n 515| let mut out = Vec::new();\n*516| while let Some((_, chunk)) = self.ring.pop_front() {\n 517| out.extend_from_slice(&chunk);\n 518| }\n 519| (out, self.finished)\n...\n 617| if self.subscriber.as_ref().is_some_and(|cur| cur.is(sub)) {\n*618| self.subscriber.take()\n 619| } else {\n 620| None\n 621| }\n...\n 726| self.ring.push_back(ev.clone());\n*727| while self.ring.len() > self.cap_events {\n 728| self.ring.pop_front();\n 729| }\n 730| if let Some(seat) = &self.subscriber {\n...\n 735| if let Err(fail) = seat.enqueue(frame) {\n*736| if let Some(seat) = self.subscriber.take() {\n 737| seat.sub\n 738| .lifecycle_event(\"presence-sub-halt\", &format!(\"reason={fail:?}\"));\n 739| }\n...\n 1081| tokio::spawn(async move {\n*1082| while let Ok((send, recv)) = conn.accept_bi().await {\n 1083| // Accepted rows register Durable: the lifetime class is OPENER-side\n 1084| // (ADR-0040 decision 6) — the target experiences a ConnectionBound\n 1085| // teardown as an ordinary FIN, never as a class of its own row.\n...\n 1340| runtime.spawn(async move {\n*1341| while let Some(incoming) = ep.accept().await {\n 1342| let sh = Arc::clone(&sh);\n 1343| let rate = Arc::clone(&rate);\n 1344| let membership = accept_membership.clone();\n...\n 2053| log.ring.clear();\n*2054| log.subscriber.take()\n 2055| };\n 2056| if let Some(seat) = seat {\n 2057| seat.dismiss();\n...\n 2086| // protect (contrast the unsubscribe verb's take_seat_if).\n*2087| let seat = entry.log.lock().unwrap().subscriber.take();\n 2088| if let Some(seat) = seat {\n 2089| seat.dismiss();\n 2090| }\n...\n 2307| pub fn freeze_transport_for_test(&self) {\n*2308| for _ in 0..4 {\n 2309| self.runtime.spawn(async {\n 2310| loop {\n 2311| std::thread::sleep(Duration::from_millis(50));\n...\n 2459| // The acceptor's loop registers the inbound connection (async — poll).\n*2460| for _ in 0..400 {\n 2461| if b.conn_count() == 1 {\n 2462| break;\n 2463| }\n...\n 2520| let mut crossed = false;\n*2521| for _ in 0..400 {\n 2522| if host\n 2523| .stream_infos()\n 2524| .iter()\n...\n 2595| ret.set_retentive(3);\n*2596| for i in 0..8u8 {\n 2597| ret.append(&[i]);\n 2598| }\n 2599| let (bytes, finished) = ret.drain();\n...\n 2607| let mut ord = StreamLog::new(2, 3);\n*2608| for i in 0..8u8 {\n 2609| ord.append(&[i]);\n 2610| }\n 2611| assert_eq!(ord.drain().0, vec![5, 6, 7], \"ordinary keeps only the last cap chunks\");\n...\n 2649| let mut peak = 0usize;\n*2650| for _ in 0..200 {\n 2651| if let Some(d) = host.ring_len(shell) {\n 2652| peak = peak.max(d);\n 2653| }\n...\n 2671| let mut finished = false;\n*2672| for _ in 0..2000 {\n 2673| if let Some((mut bytes, fin)) = host.drain_stream(shell) {\n 2674| got.append(&mut bytes);\n 2675| if fin {\n...\n 2741| assert_eq!(log.opener_line().as_deref(), Some(want), \"split line reassembled + pinned\");\n*2742| for i in 0..64u32 {\n 2743| log.append(format!(\"{{\\\"kind\\\":\\\"input\\\",\\\"n\\\":{i}}}\\n\").as_bytes());\n 2744| }\n 2745| assert!(log.floor_seq() > 0, \"the bounded ring rolled: seq 0 evicted\");\n## pairhost.rs\n 179| fn drop(&mut self) {\n*180| if let Some(stop) = self.stop.take() {\n 181| let _ = stop.send(());\n 182| }\n 183| // Only the join is polled here; listener destructors run in their\n...\n 550| // prompts for a code (REQ-JOIN-DIAGNOSTICS).\n*551| sweep_then_final_retry(\n 552| probe,\n 553| SEARCH_DEADLINE,\n 554| start,\n...\n 1226| let start = std::time::Instant::now() - Duration::from_secs(100);\n*1227| let got = sweep_then_final_retry(\n 1228| probe,\n 1229| Duration::from_secs(75),\n 1230| start,\n...\n 1251| let start = std::time::Instant::now() - Duration::from_secs(100);\n*1252| let got = sweep_then_final_retry(\n 1253| probe,\n 1254| Duration::from_secs(75),\n 1255| start,\n## projwriter.rs\n 655| let mut left = poll.as_millis() as u64;\n*656| while left > 0 && !stop.load(Ordering::SeqCst) {\n 657| let step = left.min(100);\n 658| std::thread::sleep(Duration::from_millis(step));\n 659| left -= step;\n...\n 1114| // Wait for the boot cycle to settle.\n*1115| while stats().map(|s| s.pending_refresh || s.generated_ms == 0).unwrap_or(true) {\n 1116| assert!(Instant::now() < deadline, \"boot cycle never settled\");\n 1117| std::thread::sleep(Duration::from_millis(25));\n 1118| }\n...\n 1121| // The burst: 10 endpoint events land inside one debounce window.\n*1122| for i in 0..10 {\n 1123| spt_store::projinval::nudge(&InvalScope::Endpoint {\n 1124| id: format!(\"b{}\", (i % 3) + 1),\n 1125| cwd: None,\n## propagate.rs\n 503| UpdRecord::Done { upd_id: xid, .. } if xid == upd_id => {\n*504| drop(file.take()); // flush before reading back\n 505| let artifact = std::fs::read(&artifact_path).unwrap_or_default();\n 506| let _ = std::fs::remove_file(&artifact_path);\n*507| let offer = signed.take().ok_or_else(|| {\n 508| io::Error::other(\"peer sent Done before any Offer\")\n 509| })?;\n 510| // The full per-node front door on the real bytes:\n## reap.rs\n 250| fn wait_exit(child: &mut Child) -> bool {\n*251| for _ in 0..250 {\n 252| if matches!(child.try_wait(), Ok(Some(_))) {\n 253| return true;\n 254| }\n...\n 264| fn wait_dead(pid: u32) -> bool {\n*265| for _ in 0..250 {\n 266| if !is_process_alive(pid) {\n 267| return true;\n 268| }\n...\n 280| fn wait_pid_file(p: &Path) -> Option {\n*281| for _ in 0..250 {\n 282| if let Ok(s) = std::fs::read_to_string(p) {\n 283| if let Ok(pid) = s.trim().parse::() {\n 284| if pid != 0 {\n## redeemop.rs\n 840| let mut s = KnockStore::load_checked().unwrap();\n*841| for i in 0..RATE_LIMIT_DEFAULT {\n 842| assert!(s.admit_arrival(ORIGIN, NOW + i as u64, RATE_LIMIT_DEFAULT));\n 843| }\n 844| s.save().unwrap();\n## registryhost.rs\n 1324| std::fs::write(&tmp, bytes)?;\n*1325| for attempt in 0..5 {\n 1326| match std::fs::rename(&tmp, path) {\n 1327| Ok(()) => return Ok(()),\n 1328| Err(_) if attempt < 4 => {\n...\n 1446| let mut entries: Vec = Vec::new();\n*1447| for i in 0..50 {\n 1448| entries.push(ledger_entry(&format!(\"a{i}\"), \"/w/alpha\"));\n 1449| }\n*1450| for i in 0..10 {\n 1451| entries.push(ledger_entry(&format!(\"o{i}\"), \"/o/owlery/hall-a\"));\n 1452| }\n 1453| entries.push(ledger_entry(\"p1\", \"/w/proj\"));\n...\n 1478| let mut entries: Vec = Vec::new();\n*1479| for i in 0..12 {\n*1480| for r in 0..2 {\n 1481| entries.push(ledger_entry(&format!(\"s{i}-{r}\"), &format!(\"/w/p{i:02}\")));\n 1482| }\n 1483| }\n## release.rs\n 244| let mut i = 0;\n*245| while i < N {\n 246| out[i] = SUPPORTED_PLATFORMS[i].triple;\n 247| i += 1;\n 248| }\n## seedmap.rs\n 176| .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n*177| write_frame(&mut conn, &result_frame(reg.take(req.parent_pid)))?;\n 178| }\n 179| // Serving exposure is mutated only here in the daemon, never by\n 180| // the CLI or the read-only HTTP listener.\n...\n 453| });\n*454| for _ in 0..400 {\n 455| if ping(&name).is_ok() {\n 456| return SeedServer { name, stopped: false };\n 457| }\n...\n 483| // take a beat to vanish on some platforms — poll briefly.\n*484| for _ in 0..400 {\n 485| if ping(&name).is_err() {\n 486| return;\n 487| }\n## seedproofx.rs\n 842| let mut out = Vec::new();\n*843| for _ in 0..n {\n 844| let subnet = r.utf8()?;\n 845| let seed = r.field()?.to_vec();\n 846| let epoch = r.u64()?;\n...\n 912| fn u32(&mut self) -> Option {\n*913| Some(u32::from_be_bytes(self.take(4)?.try_into().ok()?))\n 914| }\n 915| fn u64(&mut self) -> Option {\n*916| Some(u64::from_be_bytes(self.take(8)?.try_into().ok()?))\n 917| }\n 918| fn field(&mut self) -> Option<&'a [u8]> {\n 919| let n = self.u32()? as usize;\n*920| self.take(n)\n 921| }\n 922| fn utf8(&mut self) -> Option {\n 923| Some(std::str::from_utf8(self.field()?).ok()?.to_string())\n...\n 933| let mut entries = Vec::new();\n*934| for _ in 0..n {\n 935| let pubkey_hex = r.utf8()?;\n 936| let subnet = r.utf8()?;\n 937| let label = r.utf8()?;\n...\n 958| let mut tombstones = Vec::new();\n*959| for _ in 0..tn {\n 960| let pubkey_hex = r.utf8()?;\n 961| let subnet = r.utf8()?;\n 962| let stamp = r.utf8()?;\n## servehost.rs\n 615|\n*616| for ask in 1..=2 {\n 617| let answer = apply_at(&home, ServeRequest::LanStatus, ask).unwrap();\n 618| match answer {\n 619| ServeResult::LanStopped { ref code } => assert_eq!(\n## servicehost.rs\n 871| let mut left = delay_ms;\n*872| while left > 0 && !stop.load(Ordering::SeqCst) {\n 873| let step = left.min(50);\n 874| std::thread::sleep(Duration::from_millis(step));\n 875| left -= step;\n...\n 1470| let deadline = Instant::now() + Duration::from_millis(service.stop_grace_ms);\n*1471| while Instant::now() < deadline {\n 1472| if !set.contains(option) {\n 1473| let _ = std::fs::remove_file(&marker);\n 1474| return QuiesceOutcome::Cooperative;\n...\n 1557| let mut buf = Vec::new();\n*1558| f.take(STATUS_ADVISORY_CAP).read_to_end(&mut buf).ok()?;\n 1559| let text = String::from_utf8_lossy(&buf);\n 1560| let line = text.lines().next().unwrap_or_default().trim().to_string();\n 1561| (!line.is_empty()).then_some(line)\n...\n 2023| let mut last = ExitAction::Relaunch { delay_ms: 0 };\n*2024| for _ in 0..p.startup_fault_after {\n 2025| last = on_exit(&p, &mut c, 0);\n 2026| }\n 2027| assert_eq!(last, ExitAction::Latch(Latch::StartupFault));\n...\n 2043| let mut last = ExitAction::Relaunch { delay_ms: 0 };\n*2044| for _ in 0..p.give_up_after {\n 2045| last = on_exit(&p, &mut c, long);\n 2046| }\n 2047| assert_eq!(\n...\n 2288| let deadline = Instant::now() + WAIT_BACKSTOP;\n*2289| while Instant::now() < deadline {\n 2290| if pred() {\n 2291| return true;\n 2292| }\n...\n 3394| let deadline = Instant::now() + WAIT_BACKSTOP;\n*3395| while Instant::now() < deadline {\n 3396| if marker.exists() {\n 3397| return Some(set.is_held(\"a\"));\n 3398| }\n...\n 3977| let listener = LocalSocketTransport::bind(&name).expect(\"bind\");\n*3978| while let Ok(mut conn) = listener.accept() {\n 3979| std::thread::spawn(move || {\n 3980| // Handshake, read the request — then behave like a daemon\n 3981| // that does not know this kind and loops on: no reply, no\n## shelldisc.rs\n 171| .map(|(name, node)| {\n*172| let short: String = node.chars().take(8).collect();\n 173| format!(\"{name} (on node {short}…)\")\n 174| })\n 175| .collect()\n\n## pairhost/\n### meet_runtime_tests.rs\n 133| // would not establish the resource's retirement execution context.\n*134| drop(self.listener.take());\n 135| if let Some(observation) = &self.observation {\n 136| observation.record(\"retire\", &self.name, self.step);\n 137| }\n...\n 189| let mut peak_age = 0;\n*190| while Instant::now() < deadline {\n 191| peak_age = peak_age.max(host.net_canary_age_ms());\n 192| std::thread::sleep(Duration::from_millis(5));\n 193| }\n\n## pump/\n### health.rs\n 800| h.set_targets((1..=7).map(|i| format!(\"p{i}\")), 1_000);\n*801| for i in 1..=7 {\n 802| h.note_connected(&format!(\"p{i}\"), (1..=i).map(|j| format!(\"p{j}\")), 2_000);\n 803| }\n 804| assert_eq!(h.live_peers, 7, \"seven targets, seven connections\");\n...\n 1045| let mut h = PumpHealth::load_from(&path);\n*1046| for _ in 0..3 {\n 1047| h.note_registry_admit(None);\n 1048| }\n 1049| assert_eq!(h.last_registry_admit_ms, Some(1_000), \"None keeps the last-good stamp\");\n### mod.rs\n 864| let mut any = false;\n*865| for i in 0..workers.len() {\n 866| let wake = workers[i].poll_wake();\n 867| flags[i] = due(last[i], wake, now, workers[i].cadence());\n 868| any |= flags[i];\n...\n 875|fn pre_rounds(workers: &mut [&mut dyn PumpWorker], due_flags: &[bool], ctx: &RoundCtx) {\n*876| for i in 0..workers.len() {\n 877| if due_flags[i] {\n 878| workers[i].pre_round(ctx);\n 879| }\n...\n 1138|fn mark_ran(last: &mut [Option], due_flags: &[bool], now: Instant) {\n*1139| for i in 0..last.len() {\n 1140| if due_flags[i] {\n 1141| last[i] = Some(now);\n 1142| }\n...\n 1587| let mut last = io::Error::other(\"broker never answered\");\n*1588| for _ in 0..300 {\n 1589| // Stderr trace: the pump runs INSIDE the daemon, whose stderr is the\n 1590| // persistent log — the KH 7.6 leaked-reader diagnosability stays\n 1591| // unconditional here (REQ-RC-DISPLAY-SOLE-WRITER gates only surfaces\n...\n 1697| let mut slept = Duration::ZERO;\n*1698| while slept < backoff && !stop.load(Ordering::Relaxed) {\n 1699| thread::sleep(TICK.min(backoff - slept));\n 1700| slept += TICK;\n 1701| }\n...\n 1913| // (the production closure builds a PeerIo here; the kernel is the same).\n*1914| for _ in 0..2 {\n 1915| run_due(&due_flags, |i| {\n 1916| log.borrow_mut().push(format!(\"step:{i}\"));\n 1917| Ok(())\n...\n 2114| let mut s = s3;\n*2115| for _ in 0..16 {\n 2116| s = next_peer_backoff(Some(s), now);\n 2117| }\n 2118| assert_eq!(s.backoff, PEER_BACKOFF_CAP, \"saturates at the 5-minute cap\");\n...\n 2262| assert_eq!(b, base * 4, \"and keeps doubling\");\n*2263| for _ in 0..16 {\n 2264| b = next_backoff(b, fast, base);\n 2265| }\n 2266| assert_eq!(b, SUPERVISE_BACKOFF_CAP, \"saturates at the 5-minute cap\");\n\nShowing files 21-40 of 126+. Use skip=40 for the next page, or narrow paths/pattern."}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":85,"fileCount":20,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/inputreceipt.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/lanhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/lifecycle.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/nethost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/pairhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/pairhost/meet_runtime_tests.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/projwriter.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/propagate.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/pump/health.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/pump/mod.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/reap.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/redeemop.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/registryhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/release.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/seedmap.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/seedproofx.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/servehost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/servicehost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/shelldisc.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/inputreceipt.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/lanhost.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/lifecycle.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs","count":7},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/nethost.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/pairhost.rs","count":4},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/pairhost/meet_runtime_tests.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/projwriter.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/propagate.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/pump/health.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/pump/mod.rs","count":8},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/reap.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/redeemop.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/registryhost.rs","count":5},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/release.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/seedmap.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/seedproofx.rs","count":6},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/servehost.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/servicehost.rs","count":8},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/shelldisc.rs","count":1}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## inputreceipt.rs\n 369│ let mut first = None;\n*370│ for _ in 0..PENDING_RECEIPTS {\n 371│ let request = book.begin(\"s\", \"read /input\", 7, 100).unwrap().unwrap();\n 372│ first.get_or_insert_with(|| request.receipt_id.clone());\n 373│ book.complete(\n## lanhost.rs\n 748│ let mut held = LAN.lock().map_err(|_| \"LAN_BOOTSTRAP_POISONED\".to_string())?;\n*749│ match held.take() {\n 750│ Some(listener) => {\n 751│ // Dropping the sender would also end the loop; sending is the\n 752│ // explicit spelling, and a failed send means the loop already ended.\n## lifecycle.rs\n 2166│ let mut left = period;\n*2167│ while left > Duration::ZERO {\n 2168│ if stop.load(Ordering::Relaxed) {\n 2169│ return;\n 2170│ }\n │...\n 2616│\n*2617│ for i in 1..=9 {\n 2618│ host.note_outcome(PsycheKind::Turn, &killed);\n 2619│ assert!(\n 2620│ stamp().is_none(),\n │...\n 2704│\n*2705│ for _ in 0..3 {\n 2706│ host.note_outcome(PsycheKind::Ingest, &broken);\n 2707│ // A HEALTHY turn between every broken ingest.\n 2708│ host.note_outcome(PsycheKind::Turn, &PsycheOutcome::Ok);\n │...\n 2957│ let mut ever_stamped = false;\n*2958│ for _ in 0..12 {\n 2959│ host.note_outcome(PsycheKind::Turn, &fail);\n 2960│ if read_info(&perch_path).unwrap().psyche_host_error.is_some() {\n 2961│ ever_stamped = true;\n │...\n 3826│\n*3827│ for _ in 0..3 {\n 3828│ // Arm the echo gate so the fire (turn + commune-sync) runs this tick.\n 3829│ let gate = perch::resolve_edge_echo_file(\"doyle\", ParentHint::Infer);\n 3830│ if let Some(p) = gate.parent() {\n │...\n 3886│ let mut first_since: Option = None;\n*3887│ for _ in 0..3 {\n 3888│ let gate = perch::resolve_edge_echo_file(\"doyle\", ParentHint::Infer);\n 3889│ if let Some(p) = gate.parent() {\n 3890│ std::fs::create_dir_all(p).unwrap();\n## livehost.rs\n 1266│ }\n*1267│ for n in 1u64.. {\n 1268│ let candidate = live_bin.with_file_name(format!(\".live-bin.old-{n}\"));\n 1269│ if !candidate.exists() {\n 1270│ return candidate;\n │...\n 1448│ let mut left = LIVE_RECONCILE_INTERVAL_MS;\n*1449│ while left > 0 && !stop.load(Ordering::SeqCst) {\n 1450│ let step = left.min(100);\n 1451│ std::thread::sleep(Duration::from_millis(step));\n 1452│ left -= step;\n │...\n 1483│ recv_hello(&mut conn, Role::Brain).unwrap();\n*1484│ for _ in 0..N {\n 1485│ assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1486│ write_frame(&mut conn, &Envelope::new(\n 1487│ crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n │...\n 1506│ let mut poll = SessionPoll::default();\n*1507│ for _ in 0..N {\n 1508│ assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n 1509│ }\n 1510│ assert_eq!(poll.query(&name), None, \"failure is not an empty session census\");\n │...\n 1564│ let deadline = Instant::now() + bound;\n*1565│ while Instant::now() < deadline {\n 1566│ if pred() {\n 1567│ return true;\n 1568│ }\n │...\n 2243│ let mut b = None;\n*2244│ for _ in 0..200 {\n 2245│ if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n 2246│ b = Some(c);\n 2247│ break;\n │...\n 2533│ let mut removed = false;\n*2534│ for _ in 0..100 {\n 2535│ if std::fs::remove_dir_all(&self_perch).is_ok() {\n 2536│ removed = true;\n 2537│ break;\n## nethost.rs\n 229│ // Then live frames, same halt discipline.\n *230│ while let Ok(frame) = rx.recv() {\n 231│ if writer_sub.write(&frame).is_err() {\n 232│ poison(\"live write failed\");\n 233│ break;\n │...\n 256│ drop(self.tx);\n *257│ if let Some(writer) = self.writer.take() {\n 258│ let _ = writer.join();\n 259│ }\n 260│ }\n │...\n 473│ if self.retentive_cap == 0 {\n *474│ while self.ring.len() > self.cap_chunks {\n 475│ self.ring.pop_front();\n 476│ }\n 477│ }\n │...\n 495│ fn drop_seat(&mut self, fail: SeatFail) {\n *496│ if let Some(seat) = self.subscriber.take() {\n 497│ seat.sub.lifecycle_event(\n 498│ \"stream-sub-halt\",\n 499│ &format!(\"stream={} reason={fail:?}\", self.stream_id),\n │...\n 515│ let mut out = Vec::new();\n *516│ while let Some((_, chunk)) = self.ring.pop_front() {\n 517│ out.extend_from_slice(&chunk);\n 518│ }\n 519│ (out, self.finished)\n │...\n 617│ if self.subscriber.as_ref().is_some_and(|cur| cur.is(sub)) {\n *618│ self.subscriber.take()\n 619│ } else {\n 620│ None\n 621│ }\n │...\n 726│ self.ring.push_back(ev.clone());\n *727│ while self.ring.len() > self.cap_events {\n 728│ self.ring.pop_front();\n 729│ }\n 730│ if let Some(seat) = &self.subscriber {\n │...\n 735│ if let Err(fail) = seat.enqueue(frame) {\n *736│ if let Some(seat) = self.subscriber.take() {\n 737│ seat.sub\n 738│ .lifecycle_event(\"presence-sub-halt\", &format!(\"reason={fail:?}\"));\n 739│ }\n │...\n 1081│ tokio::spawn(async move {\n*1082│ while let Ok((send, recv)) = conn.accept_bi().await {\n 1083│ // Accepted rows register Durable: the lifetime class is OPENER-side\n 1084│ // (ADR-0040 decision 6) — the target experiences a ConnectionBound\n 1085│ // teardown as an ordinary FIN, never as a class of its own row.\n │...\n 1340│ runtime.spawn(async move {\n*1341│ while let Some(incoming) = ep.accept().await {\n 1342│ let sh = Arc::clone(&sh);\n 1343│ let rate = Arc::clone(&rate);\n 1344│ let membership = accept_membership.clone();\n │...\n 2053│ log.ring.clear();\n*2054│ log.subscriber.take()\n 2055│ };\n 2056│ if let Some(seat) = seat {\n 2057│ seat.dismiss();\n │...\n 2086│ // protect (contrast the unsubscribe verb's take_seat_if).\n*2087│ let seat = entry.log.lock().unwrap().subscriber.take();\n 2088│ if let Some(seat) = seat {\n 2089│ seat.dismiss();\n 2090│ }\n │...\n 2307│ pub fn freeze_transport_for_test(&self) {\n*2308│ for _ in 0..4 {\n 2309│ self.runtime.spawn(async {\n 2310│ loop {\n 2311│ std::thread::sleep(Duration::from_millis(50));\n │...\n 2459│ // The acceptor's loop registers the inbound connection (async — poll).\n*2460│ for _ in 0..400 {\n 2461│ if b.conn_count() == 1 {\n 2462│ break;\n 2463│ }\n │...\n 2520│ let mut crossed = false;\n*2521│ for _ in 0..400 {\n 2522│ if host\n 2523│ .stream_infos()\n 2524│ .iter()\n │...\n 2595│ ret.set_retentive(3);\n*2596│ for i in 0..8u8 {\n 2597│ ret.append(&[i]);\n 2598│ }\n 2599│ let (bytes, finished) = ret.drain();\n │...\n 2607│ let mut ord = StreamLog::new(2, 3);\n*2608│ for i in 0..8u8 {\n 2609│ ord.append(&[i]);\n 2610│ }\n 2611│ assert_eq!(ord.drain().0, vec![5, 6, 7], \"ordinary keeps only the last cap chunks\");\n │...\n 2649│ let mut peak = 0usize;\n*2650│ for _ in 0..200 {\n 2651│ if let Some(d) = host.ring_len(shell) {\n 2652│ peak = peak.max(d);\n 2653│ }\n │...\n 2671│ let mut finished = false;\n*2672│ for _ in 0..2000 {\n 2673│ if let Some((mut bytes, fin)) = host.drain_stream(shell) {\n 2674│ got.append(&mut bytes);\n 2675│ if fin {\n │...\n 2741│ assert_eq!(log.opener_line().as_deref(), Some(want), \"split line reassembled + pinned\");\n*2742│ for i in 0..64u32 {\n 2743│ log.append(format!(\"{{\\\"kind\\\":\\\"input\\\",\\\"n\\\":{i}}}\\n\").as_bytes());\n 2744│ }\n 2745│ assert!(log.floor_seq() > 0, \"the bounded ring rolled: seq 0 evicted\");\n## pairhost.rs\n 179│ fn drop(&mut self) {\n *180│ if let Some(stop) = self.stop.take() {\n 181│ let _ = stop.send(());\n 182│ }\n 183│ // Only the join is polled here; listener destructors run in their\n │...\n 550│ // prompts for a code (REQ-JOIN-DIAGNOSTICS).\n *551│ sweep_then_final_retry(\n 552│ probe,\n 553│ SEARCH_DEADLINE,\n 554│ start,\n │...\n 1226│ let start = std::time::Instant::now() - Duration::from_secs(100);\n*1227│ let got = sweep_then_final_retry(\n 1228│ probe,\n 1229│ Duration::from_secs(75),\n 1230│ start,\n │...\n 1251│ let start = std::time::Instant::now() - Duration::from_secs(100);\n*1252│ let got = sweep_then_final_retry(\n 1253│ probe,\n 1254│ Duration::from_secs(75),\n 1255│ start,\n## projwriter.rs\n 655│ let mut left = poll.as_millis() as u64;\n *656│ while left > 0 && !stop.load(Ordering::SeqCst) {\n 657│ let step = left.min(100);\n 658│ std::thread::sleep(Duration::from_millis(step));\n 659│ left -= step;\n │...\n 1114│ // Wait for the boot cycle to settle.\n*1115│ while stats().map(|s| s.pending_refresh || s.generated_ms == 0).unwrap_or(true) {\n 1116│ assert!(Instant::now() < deadline, \"boot cycle never settled\");\n 1117│ std::thread::sleep(Duration::from_millis(25));\n 1118│ }\n │...\n 1121│ // The burst: 10 endpoint events land inside one debounce window.\n*1122│ for i in 0..10 {\n 1123│ spt_store::projinval::nudge(&InvalScope::Endpoint {\n 1124│ id: format!(\"b{}\", (i % 3) + 1),\n 1125│ cwd: None,\n## propagate.rs\n 503│ UpdRecord::Done { upd_id: xid, .. } if xid == upd_id => {\n*504│ drop(file.take()); // flush before reading back\n 505│ let artifact = std::fs::read(&artifact_path).unwrap_or_default();\n 506│ let _ = std::fs::remove_file(&artifact_path);\n*507│ let offer = signed.take().ok_or_else(|| {\n 508│ io::Error::other(\"peer sent Done before any Offer\")\n 509│ })?;\n 510│ // The full per-node front door on the real bytes:\n## reap.rs\n 250│ fn wait_exit(child: &mut Child) -> bool {\n*251│ for _ in 0..250 {\n 252│ if matches!(child.try_wait(), Ok(Some(_))) {\n 253│ return true;\n 254│ }\n │...\n 264│ fn wait_dead(pid: u32) -> bool {\n*265│ for _ in 0..250 {\n 266│ if !is_process_alive(pid) {\n 267│ return true;\n 268│ }\n │...\n 280│ fn wait_pid_file(p: &Path) -> Option {\n*281│ for _ in 0..250 {\n 282│ if let Ok(s) = std::fs::read_to_string(p) {\n 283│ if let Ok(pid) = s.trim().parse::() {\n 284│ if pid != 0 {\n## redeemop.rs\n 840│ let mut s = KnockStore::load_checked().unwrap();\n*841│ for i in 0..RATE_LIMIT_DEFAULT {\n 842│ assert!(s.admit_arrival(ORIGIN, NOW + i as u64, RATE_LIMIT_DEFAULT));\n 843│ }\n 844│ s.save().unwrap();\n## registryhost.rs\n 1324│ std::fs::write(&tmp, bytes)?;\n*1325│ for attempt in 0..5 {\n 1326│ match std::fs::rename(&tmp, path) {\n 1327│ Ok(()) => return Ok(()),\n 1328│ Err(_) if attempt < 4 => {\n │...\n 1446│ let mut entries: Vec = Vec::new();\n*1447│ for i in 0..50 {\n 1448│ entries.push(ledger_entry(&format!(\"a{i}\"), \"/w/alpha\"));\n 1449│ }\n*1450│ for i in 0..10 {\n 1451│ entries.push(ledger_entry(&format!(\"o{i}\"), \"/o/owlery/hall-a\"));\n 1452│ }\n 1453│ entries.push(ledger_entry(\"p1\", \"/w/proj\"));\n │...\n 1478│ let mut entries: Vec = Vec::new();\n*1479│ for i in 0..12 {\n*1480│ for r in 0..2 {\n 1481│ entries.push(ledger_entry(&format!(\"s{i}-{r}\"), &format!(\"/w/p{i:02}\")));\n 1482│ }\n 1483│ }\n## release.rs\n 244│ let mut i = 0;\n*245│ while i < N {\n 246│ out[i] = SUPPORTED_PLATFORMS[i].triple;\n 247│ i += 1;\n 248│ }\n## seedmap.rs\n 176│ .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n*177│ write_frame(&mut conn, &result_frame(reg.take(req.parent_pid)))?;\n 178│ }\n 179│ // Serving exposure is mutated only here in the daemon, never by\n 180│ // the CLI or the read-only HTTP listener.\n │...\n 453│ });\n*454│ for _ in 0..400 {\n 455│ if ping(&name).is_ok() {\n 456│ return SeedServer { name, stopped: false };\n 457│ }\n │...\n 483│ // take a beat to vanish on some platforms — poll briefly.\n*484│ for _ in 0..400 {\n 485│ if ping(&name).is_err() {\n 486│ return;\n 487│ }\n## seedproofx.rs\n 842│ let mut out = Vec::new();\n*843│ for _ in 0..n {\n 844│ let subnet = r.utf8()?;\n 845│ let seed = r.field()?.to_vec();\n 846│ let epoch = r.u64()?;\n │...\n 912│ fn u32(&mut self) -> Option {\n*913│ Some(u32::from_be_bytes(self.take(4)?.try_into().ok()?))\n 914│ }\n 915│ fn u64(&mut self) -> Option {\n*916│ Some(u64::from_be_bytes(self.take(8)?.try_into().ok()?))\n 917│ }\n 918│ fn field(&mut self) -> Option<&'a [u8]> {\n 919│ let n = self.u32()? as usize;\n*920│ self.take(n)\n 921│ }\n 922│ fn utf8(&mut self) -> Option {\n 923│ Some(std::str::from_utf8(self.field()?).ok()?.to_string())\n │...\n 933│ let mut entries = Vec::new();\n*934│ for _ in 0..n {\n 935│ let pubkey_hex = r.utf8()?;\n 936│ let subnet = r.utf8()?;\n 937│ let label = r.utf8()?;\n │...\n 958│ let mut tombstones = Vec::new();\n*959│ for _ in 0..tn {\n 960│ let pubkey_hex = r.utf8()?;\n 961│ let subnet = r.utf8()?;\n 962│ let stamp = r.utf8()?;\n## servehost.rs\n 615│\n*616│ for ask in 1..=2 {\n 617│ let answer = apply_at(&home, ServeRequest::LanStatus, ask).unwrap();\n 618│ match answer {\n 619│ ServeResult::LanStopped { ref code } => assert_eq!(\n## servicehost.rs\n 871│ let mut left = delay_ms;\n *872│ while left > 0 && !stop.load(Ordering::SeqCst) {\n 873│ let step = left.min(50);\n 874│ std::thread::sleep(Duration::from_millis(step));\n 875│ left -= step;\n │...\n 1470│ let deadline = Instant::now() + Duration::from_millis(service.stop_grace_ms);\n*1471│ while Instant::now() < deadline {\n 1472│ if !set.contains(option) {\n 1473│ let _ = std::fs::remove_file(&marker);\n 1474│ return QuiesceOutcome::Cooperative;\n │...\n 1557│ let mut buf = Vec::new();\n*1558│ f.take(STATUS_ADVISORY_CAP).read_to_end(&mut buf).ok()?;\n 1559│ let text = String::from_utf8_lossy(&buf);\n 1560│ let line = text.lines().next().unwrap_or_default().trim().to_string();\n 1561│ (!line.is_empty()).then_some(line)\n │...\n 2023│ let mut last = ExitAction::Relaunch { delay_ms: 0 };\n*2024│ for _ in 0..p.startup_fault_after {\n 2025│ last = on_exit(&p, &mut c, 0);\n 2026│ }\n 2027│ assert_eq!(last, ExitAction::Latch(Latch::StartupFault));\n │...\n 2043│ let mut last = ExitAction::Relaunch { delay_ms: 0 };\n*2044│ for _ in 0..p.give_up_after {\n 2045│ last = on_exit(&p, &mut c, long);\n 2046│ }\n 2047│ assert_eq!(\n │...\n 2288│ let deadline = Instant::now() + WAIT_BACKSTOP;\n*2289│ while Instant::now() < deadline {\n 2290│ if pred() {\n 2291│ return true;\n 2292│ }\n │...\n 3394│ let deadline = Instant::now() + WAIT_BACKSTOP;\n*3395│ while Instant::now() < deadline {\n 3396│ if marker.exists() {\n 3397│ return Some(set.is_held(\"a\"));\n 3398│ }\n │...\n 3977│ let listener = LocalSocketTransport::bind(&name).expect(\"bind\");\n*3978│ while let Ok(mut conn) = listener.accept() {\n 3979│ std::thread::spawn(move || {\n 3980│ // Handshake, read the request — then behave like a daemon\n 3981│ // that does not know this kind and loops on: no reply, no\n## shelldisc.rs\n 171│ .map(|(name, node)| {\n*172│ let short: String = node.chars().take(8).collect();\n 173│ format!(\"{name} (on node {short}…)\")\n 174│ })\n 175│ .collect()\n\n## pairhost/\n### meet_runtime_tests.rs\n 133│ // would not establish the resource's retirement execution context.\n*134│ drop(self.listener.take());\n 135│ if let Some(observation) = &self.observation {\n 136│ observation.record(\"retire\", &self.name, self.step);\n 137│ }\n │...\n 189│ let mut peak_age = 0;\n*190│ while Instant::now() < deadline {\n 191│ peak_age = peak_age.max(host.net_canary_age_ms());\n 192│ std::thread::sleep(Duration::from_millis(5));\n 193│ }\n\n## pump/\n### health.rs\n 800│ h.set_targets((1..=7).map(|i| format!(\"p{i}\")), 1_000);\n *801│ for i in 1..=7 {\n 802│ h.note_connected(&format!(\"p{i}\"), (1..=i).map(|j| format!(\"p{j}\")), 2_000);\n 803│ }\n 804│ assert_eq!(h.live_peers, 7, \"seven targets, seven connections\");\n │...\n 1045│ let mut h = PumpHealth::load_from(&path);\n*1046│ for _ in 0..3 {\n 1047│ h.note_registry_admit(None);\n 1048│ }\n 1049│ assert_eq!(h.last_registry_admit_ms, Some(1_000), \"None keeps the last-good stamp\");\n### mod.rs\n 864│ let mut any = false;\n *865│ for i in 0..workers.len() {\n 866│ let wake = workers[i].poll_wake();\n 867│ flags[i] = due(last[i], wake, now, workers[i].cadence());\n 868│ any |= flags[i];\n │...\n 875│fn pre_rounds(workers: &mut [&mut dyn PumpWorker], due_flags: &[bool], ctx: &RoundCtx) {\n *876│ for i in 0..workers.len() {\n 877│ if due_flags[i] {\n 878│ workers[i].pre_round(ctx);\n 879│ }\n │...\n 1138│fn mark_ran(last: &mut [Option], due_flags: &[bool], now: Instant) {\n*1139│ for i in 0..last.len() {\n 1140│ if due_flags[i] {\n 1141│ last[i] = Some(now);\n 1142│ }\n │...\n 1587│ let mut last = io::Error::other(\"broker never answered\");\n*1588│ for _ in 0..300 {\n 1589│ // Stderr trace: the pump runs INSIDE the daemon, whose stderr is the\n 1590│ // persistent log — the KH 7.6 leaked-reader diagnosability stays\n 1591│ // unconditional here (REQ-RC-DISPLAY-SOLE-WRITER gates only surfaces\n │...\n 1697│ let mut slept = Duration::ZERO;\n*1698│ while slept < backoff && !stop.load(Ordering::Relaxed) {\n 1699│ thread::sleep(TICK.min(backoff - slept));\n 1700│ slept += TICK;\n 1701│ }\n │...\n 1913│ // (the production closure builds a PeerIo here; the kernel is the same).\n*1914│ for _ in 0..2 {\n 1915│ run_due(&due_flags, |i| {\n 1916│ log.borrow_mut().push(format!(\"step:{i}\"));\n 1917│ Ok(())\n │...\n 2114│ let mut s = s3;\n*2115│ for _ in 0..16 {\n 2116│ s = next_peer_backoff(Some(s), now);\n 2117│ }\n 2118│ assert_eq!(s.backoff, PEER_BACKOFF_CAP, \"saturates at the 5-minute cap\");\n │...\n 2262│ assert_eq!(b, base * 4, \"and keeps doubling\");\n*2263│ for _ in 0..16 {\n 2264│ b = next_backoff(b, fast, base);\n 2265│ }\n 2266│ assert_eq!(b, SUPERVISE_BACKOFF_CAP, \"saturates at the 5-minute cap\");"},"isError":false,"timestamp":1790039672716}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_dwwfmgrKgS6qIm89z17flyso|fc_03665577bed2f92d016ab1d67aa81087d29ecd4582721dc86c","toolName":"grep","startedAt":"2026-09-22T01:14:37.305Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Locating Brain IPC consumers"},"id":"3e72ef20","parentId":"f3c64033","timestamp":"2026-09-22T01:14:37.305Z"}
{"type":"message","id":"8695c94f","parentId":"3e72ef20","timestamp":"2026-09-22T01:14:37.306Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_dwwfmgrKgS6qIm89z17flyso|fc_03665577bed2f92d016ab1d67aa81087d29ecd4582721dc86c","name":"grep","arguments":{"i":"Locating Brain IPC consumers","pattern":"Brain::|\\bBrain\\b|cold_start\\(|\\.sessions\\(|\\.net_peers\\(|\\.net_streams\\(","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":0},"intent":"Locating Brain IPC consumers"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":6261,"output":97,"cacheRead":31488,"cacheWrite":0,"totalTokens":37846,"cost":{"input":0.06261,"output":0.00485,"cacheRead":0.031487999999999995,"cacheWrite":0,"total":0.09894799999999998}},"stopReason":"toolUse","timestamp":1790039672772,"responseId":"resp_03665577bed2f92d016ab1d678f8ac87d2aff6540d24af8107","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d67aa81087d29ecd4582721dc86c","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating Brain IPC consumers\",\"pattern\":\"Brain::|\\\\bBrain\\\\b|cold_start\\\\(|\\\\.sessions\\\\(|\\\\.net_peers\\\\(|\\\\.net_streams\\\\(\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_dwwfmgrKgS6qIm89z17flyso","internal_chat_message_metadata_passthrough":{"create_time":1790039673.113569,"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":4532.241500001401,"ttft":1906.700300000608,"completedAt":1790039677305,"contextSnapshot":{"promptTokens":37749,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"37447a9e","parentId":"8695c94f","timestamp":"2026-09-22T01:14:37.351Z","message":{"role":"toolResult","toolCallId":"call_dwwfmgrKgS6qIm89z17flyso|fc_03665577bed2f92d016ab1d67aa81087d29ecd4582721dc86c","toolName":"grep","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## applyhost.rs\n 28|//! half-swapped seat.\n*29|//! 4. **Trigger a brain-PROCESS restart** ([`Brain::request_brain_restart`],\n 30|//! ADR-0018 D3-3): the broker signals its supervisor to cycle the brain\n 31|//! child onto the just-swapped binary with `start-reason=update`. No hosted\n 32|//! endpoint terminates or suspends (REQ-UPD-3, absolute for this class — the\n...\n 46|\n*47|use crate::brain::{now_ms, Brain};\n 48|use crate::relcache::{AppliedRecord, ReleaseCache, StagedUpdate};\n 49|use crate::release::{current_platform, VerifyPolicy};\n 50|use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdateClass};\n...\n 354|/// broker and raise the same supervisor brain-restart signal the post-swap\n*355|/// apply rides ([`Brain::request_brain_restart`], ADR-0018 D3-3) — brain stop →\n 356|/// respawn → readiness trial → promote, broker + every hosted PTY untouched by\n 357|/// construction. The recovery verb for wedged brain-held state that previously\n 358|/// needed a full daemon bounce. Nothing is verified, staged, or renamed: the\n...\n 454|/// never answered (a dead broker fails the apply with the seat untouched).\n*455|fn connect_retry(broker_name: &str) -> io::Result {\n 456| let mut last = io::Error::other(\"broker never answered\");\n 457| for _ in 0..300 {\n*458| match Brain::cold_start(broker_name, now_ms()) {\n 459| Ok(b) => return Ok(b),\n 460| Err(e) => last = e,\n 461| }\n...\n 555|\n*556| fn cold_connect_retry(broker_name: &str) -> Brain {\n 557| for _ in 0..300 {\n*558| if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559| return b;\n 560| }\n 561| std::thread::sleep(Duration::from_millis(10));\n...\n 566| // [int->REQ-UPDATE-RUNNING-IMAGE-SURFACE] the running broker self-reports its\n*567| // COMPILED image version over IPC: a Brain connected to a live broker gets back\n 568| // Some(the broker's own CARGO_PKG_VERSION) — the KIND_BROKER_IMAGE dispatch +\n 569| // reply round-trip end to end (the new-broker leg; the old-broker→None leg rides\n 570| // the router's `unknown command kind` default, caught client-side as None).\n...\n 576| let _broker = served_broker(&name);\n*577| let mut brain = Brain::cold_start_pump(\n 578| &name,\n 579| now_ms(),\n 580| Duration::from_secs(2),\n## attach.rs\n 9|//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\n*10|//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\n 11|//! operator-minted `op_id` — exactly-once at the PTY write through the B5\n 12|//! journal (a replayed input record cannot double-type);\n 13|//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\n...\n 17|//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\n*18|//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\n 19|//! and *discards* everything interleaved — inside a full-duplex pump loop that\n 20|//! eats the operator's `Input` records (both sides starve; found the hard way\n 21|//! in `tests/attach.rs`). Idempotency holds without it because each direction\n...\n 141|\n*142|use crate::brain::{now_ms, Brain, BrokerEvent};\n 143|use crate::effect::{MintedOp, Minter};\n 144|use crate::msg::{decode_bytes, encode_bytes};\n 145|\n...\n 236|/// resume). So instead it RE-FETCHES: re-subscribe from\n*237|/// [`Brain::controller_resume_floor`] (`= delivered_through`, frozen at the drop by\n 238|/// `contiguous_advance`) and the broker replays the dropped frames from the ring.\n 239|///\n 240|/// Exactly-once holds IFF the ring still retains the floor (`tail - delivered_through\n...\n 256|pub fn read_controller_event_resuming(\n*257| brain: &mut Brain,\n 258| session_id: u64,\n 259| gen: u64,\n 260| by: Option<&str>,\n...\n 270|pub fn read_controller_event_resuming_until(\n*271| brain: &mut Brain,\n 272| session_id: u64,\n 273| gen: u64,\n 274| by: Option<&str>,\n...\n 334|/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n*335|/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n 336|/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n 337|/// its own session table, so a remote operator — which cannot know our local\n 338|/// session id — names the endpoint and we map it here, never trusting a wire\n...\n 342|// [impl->REQ-RC-CROSS-NODE-ATTACH]\n*343|pub(crate) fn resolve_local_session(brain: &mut Brain, endpoint: &str) -> Option {\n*344| brain.sessions().ok().and_then(|reply| {\n 345| reply\n 346| .sessions\n 347| .into_iter()\n...\n 371|fn handle_attach_request(\n*372| brain: &mut Brain,\n*373| wire: &mut Brain,\n 374| stream_id: u64,\n 375| endpoint: &str,\n 376| origin_node: &str,\n...\n 477|pub fn serve_attach(\n*478| brain: &mut Brain,\n 479| broker_name: &str,\n 480| stream_id: u64,\n 481| endpoint: &str,\n...\n 496| // is keyed by stream_id, not by the broker connection carrying the request.\n*497| let mut wire = Brain::cold_start(broker_name, now_ms())?;\n 498| let mut decoder = AttachDecoder::new();\n 499| let mut attached = false;\n 500| // The Request's intent — gates wire input (a viewer's keystrokes never reach\n...\n 928|pub fn request_attach(\n*929| brain: &mut Brain,\n 930| conn_id: u64,\n 931| session_id: u64,\n 932| from_seq: u64,\n...\n 950|pub fn request_attach_endpoint(\n*951| brain: &mut Brain,\n 952| conn_id: u64,\n 953| session_id: u64,\n 954| from_seq: u64,\n...\n 1003|pub fn send_attach_resize(\n*1004| brain: &mut Brain,\n 1005| stream_id: u64,\n 1006| rows: u16,\n 1007| cols: u16,\n...\n 1024|pub fn send_seal_ceremony_code(\n*1025| brain: &mut Brain,\n 1026| stream_id: u64,\n 1027| ceremony_id: u64,\n 1028| code: Option<&str>,\n...\n 1048|pub fn send_attach_input(\n*1049| brain: &mut Brain,\n 1050| stream_id: u64,\n 1051| bytes: &[u8],\n 1052| wire_op: u64,\n## brain.rs\n 13|//! state — a rehydrated `gen_start` would fire time-based discriminators on\n*14|//! the new generation. [`Brain::handoff`] takes the prior state by value yet\n 15|//! ignores its `gen_start_ms`.\n 16|//! - **Gapless, exactly-once resume.** The brain tracks `next_seq` — the next\n 17|//! output sequence it still needs. On handoff it `subscribe`s from that cursor;\n*18|//! the broker replays buffered output from there. [`Brain::read_event_until`] accepts\n 19|//! only the contiguous next `seq` (advancing the cursor), silently drops an\n 20|//! already-seen `seq` (a replay duplicate), and treats a forward gap as a hard\n 21|//! error — so a lost chunk can never pass silently.\n...\n 80|/// advance the generation. `gen_start_ms` is recorded for observability but is\n*81|/// **deliberately not authoritative on restart** — [`Brain::handoff`] sets a\n 82|/// fresh `gen_start` from `now()` (2.4).\n 83|///\n 84|/// **Test-only continuity (restoration D4-3, ADR-0018 Q6).** This brain→brain\n...\n 86|/// respawns reconstructs continuity by querying the broker\n*87|/// ([`Brain::resume_sessions`] over the broker's cursor-of-record), never this\n*88|/// message. `BrainState` / [`Brain::handoff`] / [`Brain::snapshot`] stay `pub`\n 89|/// solely because the integration tests (separate test target — `#[cfg(test)]`\n 90|/// would hide them) still drive the handoff-frame shape directly; there is **no\n 91|/// non-test caller** (KNOWN-HAZARDS 2.4 grep-clean close-out).\n...\n 188| Exit { session_id: u64, code: Option },\n*189| /// The resolved controller/viewer role of a [`Brain::attach_as`] subscribe\n 190| /// (REQ-RCVIEW-1 / REQ-KICK-1). The serving brain wakes (controller-only),\n 191| /// stays wake-neutral (viewer), or refuses the operator (busy).\n 192| Subscribed {\n...\n 216| /// An idempotent effect is durably applied (or was deduped — `applied_now`\n*217| /// distinguishes). The exactly-once ack for a [`Brain::send_effect`] (B5).\n 218| Applied {\n 219| session_id: u64,\n 220| op_id: u64,\n...\n 228| /// (PUMP-TRUTH W2, REQ-PUMP-PEER-ISOLATION) — the bare ack for\n*229| /// [`Brain::submit_dial`]. The dial's real outcome rides the presence stream\n 230| /// ([`Self::NetPresence`]), not this frame.\n 231| NetDialSubmitted,\n 232| /// A stream open durably landed — fresh or deduped (D4b).\n...\n 262|\n*263|/// The outcome of the two-phase join's MEET phase ([`Brain::pair_meet`],\n 264|/// REQ-JOIN-TWO-PHASE): a member was found (its real address is held under the\n 265|/// session id), or the meet failed before any code was needed (rendered for the\n 266|/// operator without ever prompting for a code).\n...\n 290|/// channel supplies the deadline. On a timeout the pump bubbles out to a\n*291|/// supervised restart (a fresh [`Brain`] → fresh split → fresh reader thread);\n 292|/// the old reader, parked in `read_frame`, is abandoned (KH 7.6 leak watch — the\n 293|/// old conn's drop eventually errors its read and the thread exits).\n 294|enum BrainConn {\n...\n 302| /// The reader-thread handle — held so the thread is owned, not detached\n*303| /// silently. On a supervised restart the whole [`Brain`] drops; this\n 304| /// handle drops with it (the thread, blocked in `read_frame`, is\n 305| /// abandoned and exits when the old conn closes — KH 7.6).\n 306| _reader: JoinHandle<()>,\n...\n 384| let was_err = framed.is_err();\n*385| // Receiver gone (Brain dropped) → stop reading.\n 386| if tx.send(framed).is_err() {\n 387| break;\n 388| }\n...\n 409|/// A live brain attached to a broker.\n*410|pub struct Brain {\n 411| conn: BrainConn,\n 412| generation: u64,\n 413| gen_start_ms: u64,\n...\n 417| /// Per-net-stream resume cursors (D4b) — the stream-read siblings of\n*418| /// `next_seq`, set by [`Brain::net_stream_subscribe`] and advanced by\n*419| /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n 420| /// Durability across a handoff is the logic layer's job (a re-attaching\n 421| /// brain queries `net-streams` and re-subscribes from its durable cursors).\n 422| net_cursors: std::collections::HashMap,\n 423| /// The presence resume cursor (D4c) — the conn-liveness sibling of\n*424| /// `net_cursors`, set by [`Brain::net_presence_subscribe`] and advanced by\n*425| /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n 426| /// `None` until subscribed (or the first event arrives).\n 427| presence_cursor: Option,\n 428| /// Per-session **resume** output cursors (restoration D4-2): the multi-session\n 429| /// continuity state a cold-started brain rebuilds from the broker via\n*430| /// [`Brain::resume_sessions`], replacing the retired single-session\n 431| /// `BrainState` handoff. A session present here is in **resume mode** — its\n 432| /// `KIND_OUTPUT` dedup is **dedup-below + snap-above, NO reject-gap** (seeded\n 433| /// at the broker's `resume_seq`): drop `seq < cursor` (the at-least-once\n...\n 440| /// When `Some`, every reply read is bounded by this per-call deadline budget\n*441| /// — set only by [`Brain::cold_start_pump`], which also splits the carrier\n 442| /// into the reader-thread form so the deadline can be honored over a channel\n 443| /// (`recv_timeout`). `None` (default) = the ordinary blocking client — a\n 444| /// brain-IPC read waits forever, which is correct everywhere EXCEPT the\n...\n 448| io_timeout: Option,\n*449| /// #6 (ADR-0031): a COLD attach (`from_seq == 0`, set by [`Brain::attach`] /\n## brainproc.rs\n 32|\n*33|use crate::brain::{now_ms, Brain};\n 34|use crate::endpoint::{brain_ready_path, broker_socket_name};\n 35|use crate::relcache::{AppliedRecord, ReleaseCache};\n 36|\n...\n 64|/// the broker tell its OWN supervised brain apart from every other client that\n*65|/// says `Role::Brain` (the CLI's `Brain::cold_start`, the drive/tunnel/service\n 66|/// control clients). A client can only satisfy it by echoing the generation the\n 67|/// supervisor handed the child on its argv, which no other client is given.\n 68|/// Process-global rather than [`crate::broker::Broker`] state because the\n...\n 180|/// **D2-1 — net consumers run here.** The inbound dispatcher + outbound peer\n*181|/// pump are pure IPC clients (each `Brain::cold_start`s its own connection; no\n 182|/// shared `Arc`), so they belong with the restartable brain, not the\n 183|/// broker — a brain respawn re-spawns them from the swapped binary. They are\n 184|/// meaningful only once the broker-owned NetHost is up, so we gate on the\n...\n 218| // `spt update apply` — is running, stamped with the generation the broker\n*219| // handed us so it can tell us apart from every other Role::Brain client.\n 220| // Sourced from this binary's own build constant, never from disk. The\n 221| // announce is a round-trip, so an OLDER broker's `unknown command kind`\n 222| // error is consumed here rather than left on the conn for a later query.\n...\n 407| // [impl->REQ-UPDATE-TRIAL-DRAIN-DRIVE]\n*408| let _ = brain.sessions();\n 409| let _ = write_ready(generation);\n 410| }\n 411|}\n...\n 424|/// the brain child (restoration D2-1):** both are standalone IPC clients\n*425|/// (`Brain::cold_start`, no shared `Arc`), so they belong with the\n 426|/// restartable brain. Each mints its own registry + stop flag and connects\n 427|/// independently; when the brain process exits these in-process threads die with\n 428|/// it, and the respawned brain re-spawns them from the current binary. Mirrors\n...\n 447|/// Connect to the broker, retrying briefly while it finishes binding.\n*448|fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449| let mut last: Option = None;\n 450| for _ in 0..tries {\n*451| match Brain::cold_start(name, now_ms()) {\n 452| Ok(b) => return Ok(b),\n 453| Err(e) => {\n 454| last = Some(e);\n...\n 906| // also not evidence that the\n*907| // heartbeat's drain-driving `brain.sessions()` call completed: this says\n 908| // the gate was consulted, never that the reap ran.\n 909| // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n 910| if !not_drained_reported {\n## broker.rs\n 588|/// whole reason the surface is trustworthy. The connection role cannot do this\n*589|/// job: the broker admits every client as `Role::Brain`, and the loudest\n*590|/// impostor is the CLI's own `Brain::cold_start`, which is by definition running\n 591|/// the freshly-installed version — accepting on role would report a healthy\n 592|/// version as the coordinator's on exactly the node whose coordinator is stale.\n 593|// [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n...\n 6073| // Version handshake: this connection must be a brain (2.3).\n*6074| recv_hello(&mut recv, Role::Brain)?;\n 6075|\n 6076| let mut my_subs: Vec = Vec::new();\n 6077| let mut my_stream_subs: Vec = Vec::new();\n...\n 6425|\n*6426| // Brain gone: abort any seal ceremony this conn was a party to —\n 6427| // requester (nobody left to answer) or controller (no human left at\n 6428| // the overlay) — BEFORE the roles detach, so the other party is\n 6429| // answered promptly rather than waiting on a corpse.\n...\n 6431| self.abort_ceremonies_for_conn(send.id());\n*6432| // Brain gone: detach as subscriber but leave the sessions running.\n 6433| // Clone the log Arcs out from under the sessions lock FIRST (ADR-0038\n 6434| // Amendment fix 8, KH 7.12 kin): `detach_if` re-stamps info.json\n 6435| // (`viewer_count`/`driven_by`) and emits a lifecycle record — file +\n...\n 6876| /// the requester rides its stored conn from\n*6877| /// [`dispatch_seal_ceremony_code`] — the requester's `Brain::seal_ceremony`\n 6878| /// blocks CLIENT-side, this dispatch thread does not.\n 6879| ///\n 6880| /// No surface → an IMMEDIATE `SEAL_NO_CEREMONY_SURFACE` refusal telling\n...\n 9375| /// currently runs — the discriminator the connection role cannot provide:\n*9376| /// `recv_hello(.., Role::Brain)` admits every client, the CLI's own\n*9377| /// `Brain::cold_start` included, and that client is ALWAYS freshly installed,\n 9378| /// so accepting on role would report the healthy CLI version as the\n 9379| /// coordinator's on precisely the node whose coordinator is stale. Only the\n 9380| /// supervised child is handed a generation (on its argv, ADR-0018 V2), so\n...\n 10330| // discriminator (F-025 amendment). Role cannot identify the coordinator —\n*10331| // every client hellos as `Role::Brain`, the CLI's own `Brain::cold_start`\n 10332| // included — so the generation the supervisor handed the child is the gate,\n 10333| // and a client that holds none can never pass it.\n 10334| #[test]\n...\n 11552| // (the SESSIONS class — sessions/pair_holds) RECOVERS from a poison instead of\n*11553| // panicking. Brain-only self-update keeps the broker + this lock alive; a panic\n 11554| // under it during attach churn would poison it permanently → EVERY subsequent\n 11555| // attach (serve/dispatch locks sessions) panics its reply thread and deadlines\n 11556| // (\"brain IPC read deadline elapsed\") forever. `recover` (the fix) hands back a\n...\n 15447| // The spawn dials this broker as a CLIENT (harnesshost →\n*15448| // Brain::cold_start), so the accept loop has to be up for the\n 15449| // bring-up to be able to bring anything up.\n 15450| std::thread::spawn(move || {\n 15451| let _ = serving.serve();\n## daemon.rs\n 437|\n*438| // Brain process supervisor (ADR-0018 Q2/Q3 — broker/brain process\n 439| // restoration): the broker is the always-up per-machine anchor; it spawns\n 440| // `spt daemon brain` as a supervised child and respawns it on exit. D3-3\n 441| // makes an update a *planned* restart on this same path: the supervisor's\n## deadline.rs\n 4|//! (alarms) must survive a brain swap: the supervisor respawns a fresh brain\n*5|//! (`Brain::cold_start`) and the outgoing brain is gone before the new one starts\n 6|//! (D3-3), so continuity cannot ride a brain→brain frame — it must come from the\n 7|//! persistent side (disk), exactly as D4 moved session continuity to the broker.\n 8|//!\n## digesthub.rs\n 21|//! handshake as the broker / seed-control IPC (a transient `spt` CLI connects as a\n*22|//! [`Role::Brain`] logic client). **Local addressing only** — the qualified\n 23|//! `[subnet:]id@node` cross-node form is a later milestone (rejected by the CLI\n 24|//! before it ever reaches here).\n 25|// [impl->REQ-TERM-4]\n...\n 188|fn handle_conn(mut conn: C, hub: &DigestHub) -> io::Result<()> {\n*189| recv_hello(&mut conn, Role::Brain)?;\n 190| loop {\n 191| let env = match read_frame(&mut conn) {\n 192| Ok(e) => e,\n...\n 259| let mut conn = LocalSocketTransport::connect(name)?;\n*260| send_hello(&mut conn, Role::Brain)?;\n 261| Ok(conn)\n 262|}\n 263|\n## digestlink.rs\n 31|use crate::access::{access_check, surface, InboundClass};\n*32|use crate::brain::{Brain, BrokerEvent};\n 33|use crate::digest::DigestOverride;\n 34|use crate::effect::MintedOp;\n 35|\n...\n 67|/// A brain-IPC read is bounded ONLY on the pump carrier (`BrainConn::Split`,\n*68|/// built by [`Brain::cold_start_pump`]): the blocking `Whole` carrier reads the\n 69|/// frame inline, so there is no thread to hand a deadline to and a timeout would\n 70|/// have to abandon a half-read frame — a desynced carrier, which is precisely\n 71|/// why that arm has no deadline and must not grow one.\n...\n 73|/// Since releases#190 the read PRIMITIVE enforces what this comment used to only\n*74|/// warn: `Brain::read_frame_until` refuses a deadline on a `Whole` carrier by\n 75|/// name (REQ-IPC-DEADLINE-UNHONORABLE-REFUSED). This verb keeps its own refusal\n 76|/// because it fires BEFORE a single byte goes on the wire, where the operator can\n 77|/// still be told which carrier to build — the primitive's refusal arrives mid-verb,\n...\n 103|pub fn serve_digest_pull(\n*104| brain: &mut Brain,\n 105| stream_id: u64,\n 106| origin_node: &str,\n 107|) -> io::Result {\n...\n 208|///\n*209|/// **`brain` MUST be a pump-mode carrier** ([`Brain::cold_start_pump`]) — see\n 210|/// [`crate::brain::refuse_unbounded_carrier`]. The silence budget is the brain's own\n*211|/// [`Brain::reply_read_deadline`], so one wire has one notion of \"a peer that\n 212|/// has gone quiet\"; a test shortens it by constructing the brain with a short\n 213|/// `io_timeout` rather than by passing a budget in here.\n 214|// [impl->REQ-DIGEST-CROSS-NODE-PULL]\n 215|pub fn request_digest_pull(\n*216| brain: &mut Brain,\n 217| conn_id: u64,\n 218| endpoint: &str,\n 219| window_turns: Option,\n## dispatch.rs\n 80|use crate::attach::serve_attach;\n*81|use crate::brain::{Brain, BrokerEvent};\n 82|use crate::notifsync::{apply_notif_feed, NotifPolicy};\n 83|use crate::sealsync::{apply_seal_feed, SealApplyVerdict};\n 84|use crate::propagate::serve_update;\n...\n 728| }\n*729| let reply = brain.net_streams()?;\n 730| for s in reply.streams {\n 731| // Claim only peer-initiated rows with bytes (a QUIC stream is\n 732| // invisible until its first write anyway — gotcha #6 — but the\n...\n 897|/// Connect a fresh brain IPC client (retrying through broker startup).\n*898|fn connect(broker_name: &str) -> io::Result {\n 899| let mut last = io::Error::other(\"broker never answered\");\n 900| for _ in 0..300 {\n*901| match Brain::cold_start(broker_name, now_ms()) {\n 902| Ok(b) => return Ok(b),\n 903| Err(e) => last = e,\n 904| }\n...\n 1188| let endpoint = session_id.and_then(|sid| {\n*1189| brain.sessions().ok().and_then(|reply| {\n 1190| reply\n 1191| .sessions\n 1192| .iter()\n...\n 1327|fn serve_registry_feed(\n*1328| brain: &mut Brain,\n 1329| stream_id: u64,\n 1330| origin: &str,\n 1331| registry: &RegistryHost,\n...\n 1492|// [impl->REQ-PRES-1]\n*1493|fn serve_notif_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1494| let store = match NotifStore::open() {\n 1495| Ok(s) => s,\n 1496| Err(e) => return DispatchOutcome::Failed(e.to_string()),\n...\n 1569|// [impl->REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED]\n*1570|fn serve_seal_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1571| let policy = NotifPolicy::load();\n 1572| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n 1573| return DispatchOutcome::Failed(e.to_string());\n...\n 1689|// [impl->REQ-KNOCK-FLOOD]\n*1690|fn serve_knock_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1691| use spt_net::net::knockmsg::{KnockDecoder, KnockReply};\n 1692|\n 1693| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n...\n 1745|// [impl->REQ-HAZARD-WAN-ORIGIN-AUTH]\n*1746|fn serve_fork_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1747| use spt_net::net::forkmsg::ForkDecoder;\n 1748|\n 1749| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n...\n 1794|// [impl->REQ-KNOCK-REDEEM-WIRE]\n*1795|fn serve_redeem_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1796| use spt_net::net::redeemmsg::RedeemDecoder;\n 1797|\n 1798| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n...\n 1844|// [impl->REQ-KNOCK-ANSWER-RECEIPT]\n*1845|fn serve_answer_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1846| use spt_net::net::answermsg::AnswerDecoder;\n 1847|\n 1848| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n...\n 1986|// [impl->REQ-HAZARD-PROBE-CONTEXT-ISOLATION]\n*1987|fn serve_presence_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1988| use spt_net::net::presencemsg::PresenceDecoder;\n 1989|\n 1990| if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n...\n 2158|fn broker_session_idle(endpoint: &str) -> Option {\n*2159| let mut brain = Brain::cold_start(&crate::endpoint::broker_socket_name(), now_ms()).ok()?;\n 2160| let hosted = brain\n*2161| .sessions()\n 2162| .ok()?\n 2163| .sessions\n 2164| .iter()\n...\n 2200|fn serve_wan_feed(\n*2201| brain: &mut Brain,\n 2202| stream_id: u64,\n 2203| origin: &str,\n 2204| paths: &DispatchPaths,\n## docshost.rs\n 12|//! runtime is `current_thread` with I/O only (no timers), and the proxy's\n*13|//! deadlines live in the pump-mode [`crate::brain::Brain`] it drives, so the\n 14|//! blocking fetch belongs off the runtime. The response head comes back over a\n 15|//! oneshot; the body arrives chunk by chunk over a bounded channel and is\n 16|//! streamed to the browser as it lands ([`ChannelBody`]) — never buffered\n## drivehub.rs\n 44|//! handshake as the digest / broker / seed-control IPC (a transient `spt` CLI\n*45|//! connects as a [`Role::Brain`] logic client). **Local addressing only** —\n 46|//! cross-node drive over the ephemeral Iroh link is a later task (never spooled,\n 47|//! same drop-on-offline semantics).\n 48|// [impl->REQ-SHELL-3]\n...\n 516|fn handle_conn(mut conn: C, hub: &DriveHub) -> io::Result<()> {\n*517| recv_hello(&mut conn, Role::Brain)?;\n 518| loop {\n 519| let env = match read_frame(&mut conn) {\n 520| Ok(e) => e,\n...\n 849| let mut conn = LocalSocketTransport::connect(name)?;\n*850| send_hello(&mut conn, Role::Brain)?;\n 851| Ok(conn)\n 852|}\n 853|\n...\n 1263| let mut buf = Vec::new();\n*1264| send_hello(&mut buf, Role::Brain).expect(\"hello encodes\");\n 1265| for f in frames {\n 1266| write_frame(&mut buf, f).expect(\"frame encodes\");\n 1267| }\n...\n 1375| while let Ok(mut conn) = listener.accept() {\n*1376| let _ = recv_hello(&mut conn, Role::Brain);\n 1377| // …and then, like an N-1 router's `_ => {}`, nothing at all.\n 1378| thread::sleep(std::time::Duration::from_secs(30));\n 1379| }\n## effect.rs\n 252|/// exactly-once dedup is load-bearing, so they are never wrapped (the retry is\n*253|/// placed at the caller sites, never below `Brain::net_open_stream`).\n 254|///\n 255|/// `mint` yields a fresh same-minter [`MintedOp`] per call and may itself fail\n 256|/// (e.g. `EpochSource::next_epoch` IO) — that error propagates untouched. `run`\n## frame.rs\n 40| /// The restartable logic layer that attaches over the IPC.\n*41| Brain,\n 42|}\n 43|\n 44|/// The first frame a connecting peer sends. Intentionally minimal and\n...\n 198| let hello: Hello = serde_json::from_str(&newer_hello_wire).unwrap();\n*199| assert_eq!(accept_hello(&hello, Role::Brain), Ok(()));\n 200| }\n 201|\n 202| // [unit->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n...\n 207| protocol_version: MIN_COMPATIBLE_VERSION - 1,\n*208| role: Role::Brain,\n 209| };\n 210| assert!(matches!(\n*211| accept_hello(&hello, Role::Brain),\n 212| Err(HandshakeError::IncompatibleVersion { .. })\n 213| ));\n 214| }\n...\n 220| assert!(matches!(\n*221| accept_hello(&hello, Role::Brain),\n 222| Err(HandshakeError::UnexpectedRole { .. })\n 223| ));\n 224| }\n## harnesshost.rs\n 36|\n*37|use crate::brain::{now_ms, Brain};\n 38|use crate::msg::SpawnReq;\n 39|\n 40|/// Default PTY geometry for a freshly brought-up harness, before an attach\n...\n 318| launch_phase(endpoint_id, t0, \"connecting\", &format!(\"program={program}\"));\n*319| let mut brain = match Brain::cold_start(broker_name, now_ms()) {\n 320| Ok(brain) => {\n 321| launch_phase(endpoint_id, t0, \"connected\", \"\");\n 322| brain\n...\n 410| let mut brain =\n*411| Brain::cold_start(broker_name, now_ms()).map_err(|e| format!(\"broker connect: {e}\"))?;\n 412| match brain\n 413| .spawn_session_fresh_pid(SpawnReq {\n 414| program: program.clone(),\n## inject.rs\n 25|\n*26|use crate::brain::{now_ms, Brain};\n 27|use crate::endpoint::broker_socket_name;\n 28|\n 29|/// Whether `target` is an spt-hosted endpoint whose PTY the broker holds, with NO\n...\n 88| bytes.push('\\n');\n*89| let outcome = match Brain::cold_start(&broker_socket_name(), now_ms()) {\n 90| Ok(mut brain) => brain.inject_endpoint(target, bytes.as_bytes(), native).ok(),\n 91| Err(_) => None,\n 92| };\n## lib.rs\n 205|pub use attach::{request_attach, send_attach_input, serve_attach, AttachServeOutcome};\n*206|pub use brain::{Brain, BrainState, BrokerEvent};\n 207|pub use broker::Broker;\n 208|pub use config::{DaemonConfig, RelayChoice};\n 209|pub use consent::{decide as decide_consent, most_recently_active, ConsentDecision, ConsentTarget};\n## lifecycle.rs\n 715| /// manifest — the W3d apply's manifest-refresh step, after the CRC swap. The\n*716| /// next psyche spawn / echo commune reads the new content. Brain-parity: the\n 717| /// brain thread, PTY, broker session, and output log are untouched; only these\n 718| /// two cells' contents change. (W3c)\n 719| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n...\n 834| /// (the brain pulling an on-disk swap); this direct entry exists for tests and\n*835| /// any in-process caller. Brain-parity: nothing else cycles. (W3c)\n 836| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 837| pub fn refresh_manifest(&self, new: Manifest, install_dir: Option<&Path>) {\n 838| self.cell.refresh(new, install_dir);\n## linkhost.rs\n 45|use crate::access::{access_check, surface, InboundClass};\n*46|use crate::brain::{Brain, BrokerEvent};\n 47|use crate::consent::ConsentTarget;\n 48|use crate::effect::MintedOp;\n 49|use crate::grants::{self, EscalationAsk, GrantDecision};\n...\n 776|pub fn serve_shell_link(\n*777| brain: &mut Brain,\n 778| stream_id: u64,\n 779| origin_node: &str,\n 780| owlery: &Path,\n...\n 1006|pub fn request_shell_link(\n*1007| brain: &mut Brain,\n 1008| conn_id: u64,\n 1009| owner: &str,\n 1010| shell_ref: &str,\n## livehost.rs\n 37|\n*38|use crate::brain::{now_ms, Brain};\n 39|use crate::brainproc::StartReason;\n 40|use crate::config::DaemonConfig;\n 41|use crate::lifecycle::BrainLifecycle;\n...\n 1006|struct SessionPoll {\n*1007| brain: Option,\n 1008| retry: bool,\n 1009| #[cfg(debug_assertions)]\n 1010| query_error: Option,\n...\n 1020| let reason = if self.retry { \"previous-query-error\" } else { \"initial-query\" };\n*1021| match Brain::cold_start(broker_name, now_ms()) {\n 1022| Ok(brain) => {\n 1023| spt_proto::emit_line_err!(\n 1024| \"BRAIN_CONN_OPEN: caller=livehost-session-query reason={reason} \\\n...\n 1042| }\n*1043| match self.brain.as_mut().expect(\"connected session census\").sessions() {\n 1044| Ok(reply) => Some(\n 1045| reply.sessions.into_iter().map(|s| s.endpoint)\n 1046| .chain(reply.bringing_up)\n...\n 1393| // reap-driver in ISOLATION. This loop's own `SessionPoll::query`\n*1394| // → `brain.sessions()` (every LIVE_RECONCILE_INTERVAL_MS) would OTHERWISE\n 1395| // drive the same broker reap and mask the fix (todlando 2026-07-09). Setting\n 1396| // it faithfully REPRODUCES THE FIELD'S livehost-silent update-trial condition\n 1397| // (PIN Q2: the trial-brain livehost's first reconcile tick landed around the\n...\n 1482| accepted += 1;\n*1483| recv_hello(&mut conn, Role::Brain).unwrap();\n 1484| for _ in 0..N {\n 1485| assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1486| write_frame(&mut conn, &Envelope::new(\n...\n 1498| accepted += 1;\n*1499| recv_hello(&mut conn, Role::Brain).unwrap();\n 1500| assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1501| write_frame(&mut conn, &Envelope::new(\n 1502| crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n...\n 2244| for _ in 0..200 {\n*2245| if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n 2246| b = Some(c);\n 2247| break;\n 2248| }\n...\n 2271|\n*2272| let session_set = |brain: &mut Brain| -> BTreeSet {\n 2273| brain\n*2274| .sessions()\n 2275| .unwrap()\n 2276| .sessions\n 2277| .into_iter()\n...\n 2424| assert_eq!(first.len(), 1);\n*2425| // Brain \"restart\": drop the table (threads die with the process), the\n 2426| // perch stays online on disk.\n 2427| first.stop_host(\"doyle\");\n 2428| drop(first);\n\nShowing files 1-20 of 50+. Use skip=20 for the next page, or narrow paths/pattern."}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":129,"fileCount":20,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/deadline.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/digesthub.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/digestlink.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/dispatch.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/docshost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/drivehub.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/effect.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/frame.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/harnesshost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/inject.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/lib.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/lifecycle.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/linkhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs","count":9},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/attach.rs","count":18},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","count":20},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brainproc.rs","count":9},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/broker.rs","count":11},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/daemon.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/deadline.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/digesthub.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/digestlink.rs","count":7},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/dispatch.rs","count":16},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/docshost.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/drivehub.rs","count":5},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/effect.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/frame.rs","count":5},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/harnesshost.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/inject.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/lib.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/lifecycle.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/linkhost.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs","count":11}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/318-h3-infra-register/crates/spt-daemon/src/\n## applyhost.rs\n 28│//! half-swapped seat.\n *29│//! 4. **Trigger a brain-PROCESS restart** ([`Brain::request_brain_restart`],\n 30│//! ADR-0018 D3-3): the broker signals its supervisor to cycle the brain\n 31│//! child onto the just-swapped binary with `start-reason=update`. No hosted\n 32│//! endpoint terminates or suspends (REQ-UPD-3, absolute for this class — the\n │...\n 46│\n *47│use crate::brain::{now_ms, Brain};\n 48│use crate::relcache::{AppliedRecord, ReleaseCache, StagedUpdate};\n 49│use crate::release::{current_platform, VerifyPolicy};\n 50│use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdateClass};\n │...\n 354│/// broker and raise the same supervisor brain-restart signal the post-swap\n*355│/// apply rides ([`Brain::request_brain_restart`], ADR-0018 D3-3) — brain stop →\n 356│/// respawn → readiness trial → promote, broker + every hosted PTY untouched by\n 357│/// construction. The recovery verb for wedged brain-held state that previously\n 358│/// needed a full daemon bounce. Nothing is verified, staged, or renamed: the\n │...\n 454│/// never answered (a dead broker fails the apply with the seat untouched).\n*455│fn connect_retry(broker_name: &str) -> io::Result {\n 456│ let mut last = io::Error::other(\"broker never answered\");\n 457│ for _ in 0..300 {\n*458│ match Brain::cold_start(broker_name, now_ms()) {\n 459│ Ok(b) => return Ok(b),\n 460│ Err(e) => last = e,\n 461│ }\n │...\n 555│\n*556│ fn cold_connect_retry(broker_name: &str) -> Brain {\n 557│ for _ in 0..300 {\n*558│ if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n 559│ return b;\n 560│ }\n 561│ std::thread::sleep(Duration::from_millis(10));\n │...\n 566│ // [int->REQ-UPDATE-RUNNING-IMAGE-SURFACE] the running broker self-reports its\n*567│ // COMPILED image version over IPC: a Brain connected to a live broker gets back\n 568│ // Some(the broker's own CARGO_PKG_VERSION) — the KIND_BROKER_IMAGE dispatch +\n 569│ // reply round-trip end to end (the new-broker leg; the old-broker→None leg rides\n 570│ // the router's `unknown command kind` default, caught client-side as None).\n │...\n 576│ let _broker = served_broker(&name);\n*577│ let mut brain = Brain::cold_start_pump(\n 578│ &name,\n 579│ now_ms(),\n 580│ Duration::from_secs(2),\n## attach.rs\n 9│//! (fire-and-forget sends; `Output.seq` carries the dedup authority);\n *10│//! - inbound [`AttachRecord::Input`] → [`Brain::send_effect`] with the\n 11│//! operator-minted `op_id` — exactly-once at the PTY write through the B5\n 12│//! journal (a replayed input record cannot double-type);\n 13│//! - session `Exit` → [`AttachRecord::Exit`] + stream finish.\n │...\n 17│//! Stream sends here are deliberately **unjournaled** (`op_id: None`): a\n *18│//! journaled [`Brain::net_stream_send`] blocks reading events until its ack\n 19│//! and *discards* everything interleaved — inside a full-duplex pump loop that\n 20│//! eats the operator's `Input` records (both sides starve; found the hard way\n 21│//! in `tests/attach.rs`). Idempotency holds without it because each direction\n │...\n 141│\n *142│use crate::brain::{now_ms, Brain, BrokerEvent};\n 143│use crate::effect::{MintedOp, Minter};\n 144│use crate::msg::{decode_bytes, encode_bytes};\n 145│\n │...\n 236│/// resume). So instead it RE-FETCHES: re-subscribe from\n *237│/// [`Brain::controller_resume_floor`] (`= delivered_through`, frozen at the drop by\n 238│/// `contiguous_advance`) and the broker replays the dropped frames from the ring.\n 239│///\n 240│/// Exactly-once holds IFF the ring still retains the floor (`tail - delivered_through\n │...\n 256│pub fn read_controller_event_resuming(\n *257│ brain: &mut Brain,\n 258│ session_id: u64,\n 259│ gen: u64,\n 260│ by: Option<&str>,\n │...\n 270│pub fn read_controller_event_resuming_until(\n *271│ brain: &mut Brain,\n 272│ session_id: u64,\n 273│ gen: u64,\n 274│ by: Option<&str>,\n │...\n 334│/// Resolve an endpoint label to THIS node's local broker session id (the spawn's\n *335│/// endpoint label in `brain.sessions()`). The server-side half of the cross-node\n 336│/// attach (#4, REQ-RC-CROSS-NODE-ATTACH): the owning node is authoritative for\n 337│/// its own session table, so a remote operator — which cannot know our local\n 338│/// session id — names the endpoint and we map it here, never trusting a wire\n │...\n 342│// [impl->REQ-RC-CROSS-NODE-ATTACH]\n *343│pub(crate) fn resolve_local_session(brain: &mut Brain, endpoint: &str) -> Option {\n *344│ brain.sessions().ok().and_then(|reply| {\n 345│ reply\n 346│ .sessions\n 347│ .into_iter()\n │...\n 371│fn handle_attach_request(\n *372│ brain: &mut Brain,\n *373│ wire: &mut Brain,\n 374│ stream_id: u64,\n 375│ endpoint: &str,\n 376│ origin_node: &str,\n │...\n 477│pub fn serve_attach(\n *478│ brain: &mut Brain,\n 479│ broker_name: &str,\n 480│ stream_id: u64,\n 481│ endpoint: &str,\n │...\n 496│ // is keyed by stream_id, not by the broker connection carrying the request.\n *497│ let mut wire = Brain::cold_start(broker_name, now_ms())?;\n 498│ let mut decoder = AttachDecoder::new();\n 499│ let mut attached = false;\n 500│ // The Request's intent — gates wire input (a viewer's keystrokes never reach\n │...\n 928│pub fn request_attach(\n *929│ brain: &mut Brain,\n 930│ conn_id: u64,\n 931│ session_id: u64,\n 932│ from_seq: u64,\n │...\n 950│pub fn request_attach_endpoint(\n *951│ brain: &mut Brain,\n 952│ conn_id: u64,\n 953│ session_id: u64,\n 954│ from_seq: u64,\n │...\n 1003│pub fn send_attach_resize(\n*1004│ brain: &mut Brain,\n 1005│ stream_id: u64,\n 1006│ rows: u16,\n 1007│ cols: u16,\n │...\n 1024│pub fn send_seal_ceremony_code(\n*1025│ brain: &mut Brain,\n 1026│ stream_id: u64,\n 1027│ ceremony_id: u64,\n 1028│ code: Option<&str>,\n │...\n 1048│pub fn send_attach_input(\n*1049│ brain: &mut Brain,\n 1050│ stream_id: u64,\n 1051│ bytes: &[u8],\n 1052│ wire_op: u64,\n## brain.rs\n 13│//! state — a rehydrated `gen_start` would fire time-based discriminators on\n *14│//! the new generation. [`Brain::handoff`] takes the prior state by value yet\n 15│//! ignores its `gen_start_ms`.\n 16│//! - **Gapless, exactly-once resume.** The brain tracks `next_seq` — the next\n 17│//! output sequence it still needs. On handoff it `subscribe`s from that cursor;\n *18│//! the broker replays buffered output from there. [`Brain::read_event_until`] accepts\n 19│//! only the contiguous next `seq` (advancing the cursor), silently drops an\n 20│//! already-seen `seq` (a replay duplicate), and treats a forward gap as a hard\n 21│//! error — so a lost chunk can never pass silently.\n │...\n 80│/// advance the generation. `gen_start_ms` is recorded for observability but is\n *81│/// **deliberately not authoritative on restart** — [`Brain::handoff`] sets a\n 82│/// fresh `gen_start` from `now()` (2.4).\n 83│///\n 84│/// **Test-only continuity (restoration D4-3, ADR-0018 Q6).** This brain→brain\n │...\n 86│/// respawns reconstructs continuity by querying the broker\n *87│/// ([`Brain::resume_sessions`] over the broker's cursor-of-record), never this\n *88│/// message. `BrainState` / [`Brain::handoff`] / [`Brain::snapshot`] stay `pub`\n 89│/// solely because the integration tests (separate test target — `#[cfg(test)]`\n 90│/// would hide them) still drive the handoff-frame shape directly; there is **no\n 91│/// non-test caller** (KNOWN-HAZARDS 2.4 grep-clean close-out).\n │...\n 188│ Exit { session_id: u64, code: Option },\n*189│ /// The resolved controller/viewer role of a [`Brain::attach_as`] subscribe\n 190│ /// (REQ-RCVIEW-1 / REQ-KICK-1). The serving brain wakes (controller-only),\n 191│ /// stays wake-neutral (viewer), or refuses the operator (busy).\n 192│ Subscribed {\n │...\n 216│ /// An idempotent effect is durably applied (or was deduped — `applied_now`\n*217│ /// distinguishes). The exactly-once ack for a [`Brain::send_effect`] (B5).\n 218│ Applied {\n 219│ session_id: u64,\n 220│ op_id: u64,\n │...\n 228│ /// (PUMP-TRUTH W2, REQ-PUMP-PEER-ISOLATION) — the bare ack for\n*229│ /// [`Brain::submit_dial`]. The dial's real outcome rides the presence stream\n 230│ /// ([`Self::NetPresence`]), not this frame.\n 231│ NetDialSubmitted,\n 232│ /// A stream open durably landed — fresh or deduped (D4b).\n │...\n 262│\n*263│/// The outcome of the two-phase join's MEET phase ([`Brain::pair_meet`],\n 264│/// REQ-JOIN-TWO-PHASE): a member was found (its real address is held under the\n 265│/// session id), or the meet failed before any code was needed (rendered for the\n 266│/// operator without ever prompting for a code).\n │...\n 290│/// channel supplies the deadline. On a timeout the pump bubbles out to a\n*291│/// supervised restart (a fresh [`Brain`] → fresh split → fresh reader thread);\n 292│/// the old reader, parked in `read_frame`, is abandoned (KH 7.6 leak watch — the\n 293│/// old conn's drop eventually errors its read and the thread exits).\n 294│enum BrainConn {\n │...\n 302│ /// The reader-thread handle — held so the thread is owned, not detached\n*303│ /// silently. On a supervised restart the whole [`Brain`] drops; this\n 304│ /// handle drops with it (the thread, blocked in `read_frame`, is\n 305│ /// abandoned and exits when the old conn closes — KH 7.6).\n 306│ _reader: JoinHandle<()>,\n │...\n 384│ let was_err = framed.is_err();\n*385│ // Receiver gone (Brain dropped) → stop reading.\n 386│ if tx.send(framed).is_err() {\n 387│ break;\n 388│ }\n │...\n 409│/// A live brain attached to a broker.\n*410│pub struct Brain {\n 411│ conn: BrainConn,\n 412│ generation: u64,\n 413│ gen_start_ms: u64,\n │...\n 417│ /// Per-net-stream resume cursors (D4b) — the stream-read siblings of\n*418│ /// `next_seq`, set by [`Brain::net_stream_subscribe`] and advanced by\n*419│ /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n 420│ /// Durability across a handoff is the logic layer's job (a re-attaching\n 421│ /// brain queries `net-streams` and re-subscribes from its durable cursors).\n 422│ net_cursors: std::collections::HashMap,\n 423│ /// The presence resume cursor (D4c) — the conn-liveness sibling of\n*424│ /// `net_cursors`, set by [`Brain::net_presence_subscribe`] and advanced by\n*425│ /// [`Brain::read_event_until`] under the same accept/dedup/gap discipline.\n 426│ /// `None` until subscribed (or the first event arrives).\n 427│ presence_cursor: Option,\n 428│ /// Per-session **resume** output cursors (restoration D4-2): the multi-session\n 429│ /// continuity state a cold-started brain rebuilds from the broker via\n*430│ /// [`Brain::resume_sessions`], replacing the retired single-session\n 431│ /// `BrainState` handoff. A session present here is in **resume mode** — its\n 432│ /// `KIND_OUTPUT` dedup is **dedup-below + snap-above, NO reject-gap** (seeded\n 433│ /// at the broker's `resume_seq`): drop `seq < cursor` (the at-least-once\n │...\n 440│ /// When `Some`, every reply read is bounded by this per-call deadline budget\n*441│ /// — set only by [`Brain::cold_start_pump`], which also splits the carrier\n 442│ /// into the reader-thread form so the deadline can be honored over a channel\n 443│ /// (`recv_timeout`). `None` (default) = the ordinary blocking client — a\n 444│ /// brain-IPC read waits forever, which is correct everywhere EXCEPT the\n │...\n 448│ io_timeout: Option,\n*449│ /// #6 (ADR-0031): a COLD attach (`from_seq == 0`, set by [`Brain::attach`] /\n## brainproc.rs\n 32│\n *33│use crate::brain::{now_ms, Brain};\n 34│use crate::endpoint::{brain_ready_path, broker_socket_name};\n 35│use crate::relcache::{AppliedRecord, ReleaseCache};\n 36│\n │...\n 64│/// the broker tell its OWN supervised brain apart from every other client that\n *65│/// says `Role::Brain` (the CLI's `Brain::cold_start`, the drive/tunnel/service\n 66│/// control clients). A client can only satisfy it by echoing the generation the\n 67│/// supervisor handed the child on its argv, which no other client is given.\n 68│/// Process-global rather than [`crate::broker::Broker`] state because the\n │...\n 180│/// **D2-1 — net consumers run here.** The inbound dispatcher + outbound peer\n*181│/// pump are pure IPC clients (each `Brain::cold_start`s its own connection; no\n 182│/// shared `Arc`), so they belong with the restartable brain, not the\n 183│/// broker — a brain respawn re-spawns them from the swapped binary. They are\n 184│/// meaningful only once the broker-owned NetHost is up, so we gate on the\n │...\n 218│ // `spt update apply` — is running, stamped with the generation the broker\n*219│ // handed us so it can tell us apart from every other Role::Brain client.\n 220│ // Sourced from this binary's own build constant, never from disk. The\n 221│ // announce is a round-trip, so an OLDER broker's `unknown command kind`\n 222│ // error is consumed here rather than left on the conn for a later query.\n │...\n 407│ // [impl->REQ-UPDATE-TRIAL-DRAIN-DRIVE]\n*408│ let _ = brain.sessions();\n 409│ let _ = write_ready(generation);\n 410│ }\n 411│}\n │...\n 424│/// the brain child (restoration D2-1):** both are standalone IPC clients\n*425│/// (`Brain::cold_start`, no shared `Arc`), so they belong with the\n 426│/// restartable brain. Each mints its own registry + stop flag and connects\n 427│/// independently; when the brain process exits these in-process threads die with\n 428│/// it, and the respawned brain re-spawns them from the current binary. Mirrors\n │...\n 447│/// Connect to the broker, retrying briefly while it finishes binding.\n*448│fn connect_retry(name: &str, tries: u32) -> io::Result {\n 449│ let mut last: Option = None;\n 450│ for _ in 0..tries {\n*451│ match Brain::cold_start(name, now_ms()) {\n 452│ Ok(b) => return Ok(b),\n 453│ Err(e) => {\n 454│ last = Some(e);\n │...\n 906│ // also not evidence that the\n*907│ // heartbeat's drain-driving `brain.sessions()` call completed: this says\n 908│ // the gate was consulted, never that the reap ran.\n 909│ // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n 910│ if !not_drained_reported {\n## broker.rs\n 588│/// whole reason the surface is trustworthy. The connection role cannot do this\n *589│/// job: the broker admits every client as `Role::Brain`, and the loudest\n *590│/// impostor is the CLI's own `Brain::cold_start`, which is by definition running\n 591│/// the freshly-installed version — accepting on role would report a healthy\n 592│/// version as the coordinator's on exactly the node whose coordinator is stale.\n 593│// [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n │...\n 6073│ // Version handshake: this connection must be a brain (2.3).\n *6074│ recv_hello(&mut recv, Role::Brain)?;\n 6075│\n 6076│ let mut my_subs: Vec = Vec::new();\n 6077│ let mut my_stream_subs: Vec = Vec::new();\n │...\n 6425│\n *6426│ // Brain gone: abort any seal ceremony this conn was a party to —\n 6427│ // requester (nobody left to answer) or controller (no human left at\n 6428│ // the overlay) — BEFORE the roles detach, so the other party is\n 6429│ // answered promptly rather than waiting on a corpse.\n │...\n 6431│ self.abort_ceremonies_for_conn(send.id());\n *6432│ // Brain gone: detach as subscriber but leave the sessions running.\n 6433│ // Clone the log Arcs out from under the sessions lock FIRST (ADR-0038\n 6434│ // Amendment fix 8, KH 7.12 kin): `detach_if` re-stamps info.json\n 6435│ // (`viewer_count`/`driven_by`) and emits a lifecycle record — file +\n │...\n 6876│ /// the requester rides its stored conn from\n *6877│ /// [`dispatch_seal_ceremony_code`] — the requester's `Brain::seal_ceremony`\n 6878│ /// blocks CLIENT-side, this dispatch thread does not.\n 6879│ ///\n 6880│ /// No surface → an IMMEDIATE `SEAL_NO_CEREMONY_SURFACE` refusal telling\n │...\n 9375│ /// currently runs — the discriminator the connection role cannot provide:\n *9376│ /// `recv_hello(.., Role::Brain)` admits every client, the CLI's own\n *9377│ /// `Brain::cold_start` included, and that client is ALWAYS freshly installed,\n 9378│ /// so accepting on role would report the healthy CLI version as the\n 9379│ /// coordinator's on precisely the node whose coordinator is stale. Only the\n 9380│ /// supervised child is handed a generation (on its argv, ADR-0018 V2), so\n │...\n 10330│ // discriminator (F-025 amendment). Role cannot identify the coordinator —\n*10331│ // every client hellos as `Role::Brain`, the CLI's own `Brain::cold_start`\n 10332│ // included — so the generation the supervisor handed the child is the gate,\n 10333│ // and a client that holds none can never pass it.\n 10334│ #[test]\n │...\n 11552│ // (the SESSIONS class — sessions/pair_holds) RECOVERS from a poison instead of\n*11553│ // panicking. Brain-only self-update keeps the broker + this lock alive; a panic\n 11554│ // under it during attach churn would poison it permanently → EVERY subsequent\n 11555│ // attach (serve/dispatch locks sessions) panics its reply thread and deadlines\n 11556│ // (\"brain IPC read deadline elapsed\") forever. `recover` (the fix) hands back a\n │...\n 15447│ // The spawn dials this broker as a CLIENT (harnesshost →\n*15448│ // Brain::cold_start), so the accept loop has to be up for the\n 15449│ // bring-up to be able to bring anything up.\n 15450│ std::thread::spawn(move || {\n 15451│ let _ = serving.serve();\n## daemon.rs\n 437│\n*438│ // Brain process supervisor (ADR-0018 Q2/Q3 — broker/brain process\n 439│ // restoration): the broker is the always-up per-machine anchor; it spawns\n 440│ // `spt daemon brain` as a supervised child and respawns it on exit. D3-3\n 441│ // makes an update a *planned* restart on this same path: the supervisor's\n## deadline.rs\n 4│//! (alarms) must survive a brain swap: the supervisor respawns a fresh brain\n*5│//! (`Brain::cold_start`) and the outgoing brain is gone before the new one starts\n 6│//! (D3-3), so continuity cannot ride a brain→brain frame — it must come from the\n 7│//! persistent side (disk), exactly as D4 moved session continuity to the broker.\n 8│//!\n## digesthub.rs\n 21│//! handshake as the broker / seed-control IPC (a transient `spt` CLI connects as a\n *22│//! [`Role::Brain`] logic client). **Local addressing only** — the qualified\n 23│//! `[subnet:]id@node` cross-node form is a later milestone (rejected by the CLI\n 24│//! before it ever reaches here).\n 25│// [impl->REQ-TERM-4]\n │...\n 188│fn handle_conn(mut conn: C, hub: &DigestHub) -> io::Result<()> {\n*189│ recv_hello(&mut conn, Role::Brain)?;\n 190│ loop {\n 191│ let env = match read_frame(&mut conn) {\n 192│ Ok(e) => e,\n │...\n 259│ let mut conn = LocalSocketTransport::connect(name)?;\n*260│ send_hello(&mut conn, Role::Brain)?;\n 261│ Ok(conn)\n 262│}\n 263│\n## digestlink.rs\n 31│use crate::access::{access_check, surface, InboundClass};\n *32│use crate::brain::{Brain, BrokerEvent};\n 33│use crate::digest::DigestOverride;\n 34│use crate::effect::MintedOp;\n 35│\n │...\n 67│/// A brain-IPC read is bounded ONLY on the pump carrier (`BrainConn::Split`,\n *68│/// built by [`Brain::cold_start_pump`]): the blocking `Whole` carrier reads the\n 69│/// frame inline, so there is no thread to hand a deadline to and a timeout would\n 70│/// have to abandon a half-read frame — a desynced carrier, which is precisely\n 71│/// why that arm has no deadline and must not grow one.\n │...\n 73│/// Since releases#190 the read PRIMITIVE enforces what this comment used to only\n *74│/// warn: `Brain::read_frame_until` refuses a deadline on a `Whole` carrier by\n 75│/// name (REQ-IPC-DEADLINE-UNHONORABLE-REFUSED). This verb keeps its own refusal\n 76│/// because it fires BEFORE a single byte goes on the wire, where the operator can\n 77│/// still be told which carrier to build — the primitive's refusal arrives mid-verb,\n │...\n 103│pub fn serve_digest_pull(\n*104│ brain: &mut Brain,\n 105│ stream_id: u64,\n 106│ origin_node: &str,\n 107│) -> io::Result {\n │...\n 208│///\n*209│/// **`brain` MUST be a pump-mode carrier** ([`Brain::cold_start_pump`]) — see\n 210│/// [`crate::brain::refuse_unbounded_carrier`]. The silence budget is the brain's own\n*211│/// [`Brain::reply_read_deadline`], so one wire has one notion of \"a peer that\n 212│/// has gone quiet\"; a test shortens it by constructing the brain with a short\n 213│/// `io_timeout` rather than by passing a budget in here.\n 214│// [impl->REQ-DIGEST-CROSS-NODE-PULL]\n 215│pub fn request_digest_pull(\n*216│ brain: &mut Brain,\n 217│ conn_id: u64,\n 218│ endpoint: &str,\n 219│ window_turns: Option,\n## dispatch.rs\n 80│use crate::attach::serve_attach;\n *81│use crate::brain::{Brain, BrokerEvent};\n 82│use crate::notifsync::{apply_notif_feed, NotifPolicy};\n 83│use crate::sealsync::{apply_seal_feed, SealApplyVerdict};\n 84│use crate::propagate::serve_update;\n │...\n 728│ }\n *729│ let reply = brain.net_streams()?;\n 730│ for s in reply.streams {\n 731│ // Claim only peer-initiated rows with bytes (a QUIC stream is\n 732│ // invisible until its first write anyway — gotcha #6 — but the\n │...\n 897│/// Connect a fresh brain IPC client (retrying through broker startup).\n *898│fn connect(broker_name: &str) -> io::Result {\n 899│ let mut last = io::Error::other(\"broker never answered\");\n 900│ for _ in 0..300 {\n *901│ match Brain::cold_start(broker_name, now_ms()) {\n 902│ Ok(b) => return Ok(b),\n 903│ Err(e) => last = e,\n 904│ }\n │...\n 1188│ let endpoint = session_id.and_then(|sid| {\n*1189│ brain.sessions().ok().and_then(|reply| {\n 1190│ reply\n 1191│ .sessions\n 1192│ .iter()\n │...\n 1327│fn serve_registry_feed(\n*1328│ brain: &mut Brain,\n 1329│ stream_id: u64,\n 1330│ origin: &str,\n 1331│ registry: &RegistryHost,\n │...\n 1492│// [impl->REQ-PRES-1]\n*1493│fn serve_notif_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1494│ let store = match NotifStore::open() {\n 1495│ Ok(s) => s,\n 1496│ Err(e) => return DispatchOutcome::Failed(e.to_string()),\n │...\n 1569│// [impl->REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED]\n*1570│fn serve_seal_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1571│ let policy = NotifPolicy::load();\n 1572│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n 1573│ return DispatchOutcome::Failed(e.to_string());\n │...\n 1689│// [impl->REQ-KNOCK-FLOOD]\n*1690│fn serve_knock_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1691│ use spt_net::net::knockmsg::{KnockDecoder, KnockReply};\n 1692│\n 1693│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n │...\n 1745│// [impl->REQ-HAZARD-WAN-ORIGIN-AUTH]\n*1746│fn serve_fork_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1747│ use spt_net::net::forkmsg::ForkDecoder;\n 1748│\n 1749│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n │...\n 1794│// [impl->REQ-KNOCK-REDEEM-WIRE]\n*1795│fn serve_redeem_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1796│ use spt_net::net::redeemmsg::RedeemDecoder;\n 1797│\n 1798│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n │...\n 1844│// [impl->REQ-KNOCK-ANSWER-RECEIPT]\n*1845│fn serve_answer_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1846│ use spt_net::net::answermsg::AnswerDecoder;\n 1847│\n 1848│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n │...\n 1986│// [impl->REQ-HAZARD-PROBE-CONTEXT-ISOLATION]\n*1987│fn serve_presence_feed(brain: &mut Brain, stream_id: u64, origin: &str) -> DispatchOutcome {\n 1988│ use spt_net::net::presencemsg::PresenceDecoder;\n 1989│\n 1990│ if let Err(e) = brain.net_stream_subscribe(stream_id, 0) {\n │...\n 2158│fn broker_session_idle(endpoint: &str) -> Option {\n*2159│ let mut brain = Brain::cold_start(&crate::endpoint::broker_socket_name(), now_ms()).ok()?;\n 2160│ let hosted = brain\n*2161│ .sessions()\n 2162│ .ok()?\n 2163│ .sessions\n 2164│ .iter()\n │...\n 2200│fn serve_wan_feed(\n*2201│ brain: &mut Brain,\n 2202│ stream_id: u64,\n 2203│ origin: &str,\n 2204│ paths: &DispatchPaths,\n## docshost.rs\n 12│//! runtime is `current_thread` with I/O only (no timers), and the proxy's\n*13│//! deadlines live in the pump-mode [`crate::brain::Brain`] it drives, so the\n 14│//! blocking fetch belongs off the runtime. The response head comes back over a\n 15│//! oneshot; the body arrives chunk by chunk over a bounded channel and is\n 16│//! streamed to the browser as it lands ([`ChannelBody`]) — never buffered\n## drivehub.rs\n 44│//! handshake as the digest / broker / seed-control IPC (a transient `spt` CLI\n *45│//! connects as a [`Role::Brain`] logic client). **Local addressing only** —\n 46│//! cross-node drive over the ephemeral Iroh link is a later task (never spooled,\n 47│//! same drop-on-offline semantics).\n 48│// [impl->REQ-SHELL-3]\n │...\n 516│fn handle_conn(mut conn: C, hub: &DriveHub) -> io::Result<()> {\n *517│ recv_hello(&mut conn, Role::Brain)?;\n 518│ loop {\n 519│ let env = match read_frame(&mut conn) {\n 520│ Ok(e) => e,\n │...\n 849│ let mut conn = LocalSocketTransport::connect(name)?;\n *850│ send_hello(&mut conn, Role::Brain)?;\n 851│ Ok(conn)\n 852│}\n 853│\n │...\n 1263│ let mut buf = Vec::new();\n*1264│ send_hello(&mut buf, Role::Brain).expect(\"hello encodes\");\n 1265│ for f in frames {\n 1266│ write_frame(&mut buf, f).expect(\"frame encodes\");\n 1267│ }\n │...\n 1375│ while let Ok(mut conn) = listener.accept() {\n*1376│ let _ = recv_hello(&mut conn, Role::Brain);\n 1377│ // …and then, like an N-1 router's `_ => {}`, nothing at all.\n 1378│ thread::sleep(std::time::Duration::from_secs(30));\n 1379│ }\n## effect.rs\n 252│/// exactly-once dedup is load-bearing, so they are never wrapped (the retry is\n*253│/// placed at the caller sites, never below `Brain::net_open_stream`).\n 254│///\n 255│/// `mint` yields a fresh same-minter [`MintedOp`] per call and may itself fail\n 256│/// (e.g. `EpochSource::next_epoch` IO) — that error propagates untouched. `run`\n## frame.rs\n 40│ /// The restartable logic layer that attaches over the IPC.\n *41│ Brain,\n 42│}\n 43│\n 44│/// The first frame a connecting peer sends. Intentionally minimal and\n │...\n 198│ let hello: Hello = serde_json::from_str(&newer_hello_wire).unwrap();\n*199│ assert_eq!(accept_hello(&hello, Role::Brain), Ok(()));\n 200│ }\n 201│\n 202│ // [unit->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n │...\n 207│ protocol_version: MIN_COMPATIBLE_VERSION - 1,\n*208│ role: Role::Brain,\n 209│ };\n 210│ assert!(matches!(\n*211│ accept_hello(&hello, Role::Brain),\n 212│ Err(HandshakeError::IncompatibleVersion { .. })\n 213│ ));\n 214│ }\n │...\n 220│ assert!(matches!(\n*221│ accept_hello(&hello, Role::Brain),\n 222│ Err(HandshakeError::UnexpectedRole { .. })\n 223│ ));\n 224│ }\n## harnesshost.rs\n 36│\n *37│use crate::brain::{now_ms, Brain};\n 38│use crate::msg::SpawnReq;\n 39│\n 40│/// Default PTY geometry for a freshly brought-up harness, before an attach\n │...\n 318│ launch_phase(endpoint_id, t0, \"connecting\", &format!(\"program={program}\"));\n*319│ let mut brain = match Brain::cold_start(broker_name, now_ms()) {\n 320│ Ok(brain) => {\n 321│ launch_phase(endpoint_id, t0, \"connected\", \"\");\n 322│ brain\n │...\n 410│ let mut brain =\n*411│ Brain::cold_start(broker_name, now_ms()).map_err(|e| format!(\"broker connect: {e}\"))?;\n 412│ match brain\n 413│ .spawn_session_fresh_pid(SpawnReq {\n 414│ program: program.clone(),\n## inject.rs\n 25│\n*26│use crate::brain::{now_ms, Brain};\n 27│use crate::endpoint::broker_socket_name;\n 28│\n 29│/// Whether `target` is an spt-hosted endpoint whose PTY the broker holds, with NO\n │...\n 88│ bytes.push('\\n');\n*89│ let outcome = match Brain::cold_start(&broker_socket_name(), now_ms()) {\n 90│ Ok(mut brain) => brain.inject_endpoint(target, bytes.as_bytes(), native).ok(),\n 91│ Err(_) => None,\n 92│ };\n## lib.rs\n 205│pub use attach::{request_attach, send_attach_input, serve_attach, AttachServeOutcome};\n*206│pub use brain::{Brain, BrainState, BrokerEvent};\n 207│pub use broker::Broker;\n 208│pub use config::{DaemonConfig, RelayChoice};\n 209│pub use consent::{decide as decide_consent, most_recently_active, ConsentDecision, ConsentTarget};\n## lifecycle.rs\n 715│ /// manifest — the W3d apply's manifest-refresh step, after the CRC swap. The\n*716│ /// next psyche spawn / echo commune reads the new content. Brain-parity: the\n 717│ /// brain thread, PTY, broker session, and output log are untouched; only these\n 718│ /// two cells' contents change. (W3c)\n 719│ // [impl->REQ-ADAPTER-LIVE-UPDATE]\n │...\n 834│ /// (the brain pulling an on-disk swap); this direct entry exists for tests and\n*835│ /// any in-process caller. Brain-parity: nothing else cycles. (W3c)\n 836│ // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 837│ pub fn refresh_manifest(&self, new: Manifest, install_dir: Option<&Path>) {\n 838│ self.cell.refresh(new, install_dir);\n## linkhost.rs\n 45│use crate::access::{access_check, surface, InboundClass};\n *46│use crate::brain::{Brain, BrokerEvent};\n 47│use crate::consent::ConsentTarget;\n 48│use crate::effect::MintedOp;\n 49│use crate::grants::{self, EscalationAsk, GrantDecision};\n │...\n 776│pub fn serve_shell_link(\n *777│ brain: &mut Brain,\n 778│ stream_id: u64,\n 779│ origin_node: &str,\n 780│ owlery: &Path,\n │...\n 1006│pub fn request_shell_link(\n*1007│ brain: &mut Brain,\n 1008│ conn_id: u64,\n 1009│ owner: &str,\n 1010│ shell_ref: &str,\n## livehost.rs\n 37│\n *38│use crate::brain::{now_ms, Brain};\n 39│use crate::brainproc::StartReason;\n 40│use crate::config::DaemonConfig;\n 41│use crate::lifecycle::BrainLifecycle;\n │...\n 1006│struct SessionPoll {\n*1007│ brain: Option,\n 1008│ retry: bool,\n 1009│ #[cfg(debug_assertions)]\n 1010│ query_error: Option,\n │...\n 1020│ let reason = if self.retry { \"previous-query-error\" } else { \"initial-query\" };\n*1021│ match Brain::cold_start(broker_name, now_ms()) {\n 1022│ Ok(brain) => {\n 1023│ spt_proto::emit_line_err!(\n 1024│ \"BRAIN_CONN_OPEN: caller=livehost-session-query reason={reason} \\\n │...\n 1042│ }\n*1043│ match self.brain.as_mut().expect(\"connected session census\").sessions() {\n 1044│ Ok(reply) => Some(\n 1045│ reply.sessions.into_iter().map(|s| s.endpoint)\n 1046│ .chain(reply.bringing_up)\n │...\n 1393│ // reap-driver in ISOLATION. This loop's own `SessionPoll::query`\n*1394│ // → `brain.sessions()` (every LIVE_RECONCILE_INTERVAL_MS) would OTHERWISE\n 1395│ // drive the same broker reap and mask the fix (todlando 2026-07-09). Setting\n 1396│ // it faithfully REPRODUCES THE FIELD'S livehost-silent update-trial condition\n 1397│ // (PIN Q2: the trial-brain livehost's first reconcile tick landed around the\n │...\n 1482│ accepted += 1;\n*1483│ recv_hello(&mut conn, Role::Brain).unwrap();\n 1484│ for _ in 0..N {\n 1485│ assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1486│ write_frame(&mut conn, &Envelope::new(\n │...\n 1498│ accepted += 1;\n*1499│ recv_hello(&mut conn, Role::Brain).unwrap();\n 1500│ assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n 1501│ write_frame(&mut conn, &Envelope::new(\n 1502│ crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n │...\n 2244│ for _ in 0..200 {\n*2245│ if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n 2246│ b = Some(c);\n 2247│ break;\n 2248│ }\n │...\n 2271│\n*2272│ let session_set = |brain: &mut Brain| -> BTreeSet {\n 2273│ brain\n*2274│ .sessions()\n 2275│ .unwrap()\n 2276│ .sessions\n 2277│ .into_iter()\n │...\n 2424│ assert_eq!(first.len(), 1);\n*2425│ // Brain \"restart\": drop the table (threads die with the process), the\n 2426│ // perch stays online on disk.\n 2427│ first.stop_host(\"doyle\");\n 2428│ drop(first);"},"isError":false,"timestamp":1790039677350}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_cNETvfVyVnO2OVcItnIL5Z8P|fc_03665577bed2f92d016ab1d686f42087d2bd8661c89b20f64e","toolName":"grep","startedAt":"2026-09-22T01:14:47.020Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Paging remaining bounded loops"},"id":"82e386e3","parentId":"37447a9e","timestamp":"2026-09-22T01:14:47.020Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_f0yUbhUIAima7b5Gs88nflac|fc_03665577bed2f92d016ab1d686f43487d29437d1501925a94c","toolName":"read","startedAt":"2026-09-22T01:14:47.021Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs:450-565,805-820,875-891,1010-1038"},"intent":"Reading test cold connects"},"id":"451dfd56","parentId":"82e386e3","timestamp":"2026-09-22T01:14:47.021Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_y2YxhGQKSejCSyhl5ikU2EsY|fc_03665577bed2f92d016ab1d686f44087d2bdd129877b81c86f","toolName":"read","startedAt":"2026-09-22T01:14:47.021Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs:1458-1518,1548-1577,2200-2315,2516-2548"},"intent":"Reading livehost test polls"},"id":"ee46a5a4","parentId":"451dfd56","timestamp":"2026-09-22T01:14:47.021Z"}
{"type":"message","id":"a7136930","parentId":"ee46a5a4","timestamp":"2026-09-22T01:14:47.021Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_cNETvfVyVnO2OVcItnIL5Z8P|fc_03665577bed2f92d016ab1d686f42087d2bd8661c89b20f64e","name":"grep","arguments":{"i":"Paging remaining bounded loops","pattern":"^\\s*for\\s+.*\\s+in\\s+.*\\.\\.|^\\s*while\\s+.*[<>=]|\\.take\\(|retry\\(|Retry::","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":40},"intent":"Paging remaining bounded loops"},{"type":"toolCall","id":"call_f0yUbhUIAima7b5Gs88nflac|fc_03665577bed2f92d016ab1d686f43487d29437d1501925a94c","name":"read","arguments":{"i":"Reading test cold connects","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs:450-565,805-820,875-891,1010-1038"},"intent":"Reading test cold connects"},{"type":"toolCall","id":"call_y2YxhGQKSejCSyhl5ikU2EsY|fc_03665577bed2f92d016ab1d686f44087d2bdd129877b81c86f","name":"read","arguments":{"i":"Reading livehost test polls","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs:1458-1518,1548-1577,2200-2315,2516-2548"},"intent":"Reading livehost test polls"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":9880,"output":270,"cacheRead":37632,"cacheWrite":0,"totalTokens":47782,"cost":{"input":0.09880000000000001,"output":0.0135,"cacheRead":0.037632,"cacheWrite":0,"total":0.149932}},"stopReason":"toolUse","timestamp":1790039677398,"responseId":"resp_03665577bed2f92d016ab1d67da6b487d29ae65aaded29c80e","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_03665577bed2f92d016ab1d686f42087d2bd8661c89b20f64e","type":"function_call","status":"completed","arguments":"{\"i\":\"Paging remaining bounded loops\",\"pattern\":\"^\\\\s*for\\\\s+.*\\\\s+in\\\\s+.*\\\\.\\\\.|^\\\\s*while\\\\s+.*[<>=]|\\\\.take\\\\(|retry\\\\(|Retry::\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":40}","call_id":"call_cNETvfVyVnO2OVcItnIL5Z8P","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d686f43487d29437d1501925a94c","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading test cold connects\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs:450-565,805-820,875-891,1010-1038\"}","call_id":"call_f0yUbhUIAima7b5Gs88nflac","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"read","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d686f44087d2bdd129877b81c86f","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading livehost test polls\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs:1458-1518,1548-1577,2200-2315,2516-2548\"}","call_id":"call_y2YxhGQKSejCSyhl5ikU2EsY","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"read","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":9620.0625,"ttft":9590.337600000203,"completedAt":1790039687019,"contextSnapshot":{"promptTokens":47512,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"3848d9b4","parentId":"a7136930","timestamp":"2026-09-22T01:14:47.102Z","message":{"role":"toolResult","toolCallId":"call_y2YxhGQKSejCSyhl5ikU2EsY|fc_03665577bed2f92d016ab1d686f44087d2bdd129877b81c86f","toolName":"read","content":[{"type":"text","text":"#[cfg(test)]\nmod tests {\n use super::*;\n use crate::test_home::with_home;\n use std::time::{Duration, Instant};\n\n // [unit->REQ-CONN-HEALTHY-LIFECYCLE-BOUNDED]\n #[test]\n fn session_poll_reuses_healthy_carrier_and_reopens_after_query_error() {\n use crate::codec::{read_frame, write_frame};\n use crate::frame::{Envelope, Role};\n use crate::transport::{recv_hello, DaemonTransport, LocalSocketTransport};\n use std::sync::atomic::AtomicU32;\n\n static SEQ: AtomicU32 = AtomicU32::new(0);\n let name = format!(\n \"spt-livehost-poll-{}-{}\", std::process::id(),\n SEQ.fetch_add(1, Ordering::Relaxed)\n );\n let listener = LocalSocketTransport::bind(&name).unwrap();\n const N: usize = 16;\n let server = std::thread::spawn(move || {\n let mut accepted = 0;\n let mut conn = listener.accept().unwrap();\n accepted += 1;\n recv_hello(&mut conn, Role::Brain).unwrap();\n for _ in 0..N {\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n )).unwrap();\n }\n // A malformed reply is a query error even while the transport is\n // still alive. It must retire, not leave a desynchronized cache.\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": false})\n )).unwrap();\n assert!(read_frame(&mut conn).is_err(), \"failed query closes old carrier\");\n let mut conn = listener.accept().unwrap();\n accepted += 1;\n recv_hello(&mut conn, Role::Brain).unwrap();\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n )).unwrap();\n accepted\n });\n let mut poll = SessionPoll::default();\n for _ in 0..N {\n assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n }\n assert_eq!(poll.query(&name), None, \"failure is not an empty session census\");\n assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n drop(poll);\n assert_eq!(server.join().unwrap(), 2, \"one healthy carrier plus one recovery\");\n }\n\n // A no-op Psyche summarizer command: spawns + exits 0 (we never depend on its\n // output — the daemon online-stamp is what hosts it, not the pid).\n #[cfg(windows)]\n…\n fn seed_live_perch(id: &str, adapter: &str, status: &str) {\n…\n }\n\n /// A fast-pulse config so the driver loop ticks quickly in tests.\n fn fast_cfg() -> DaemonConfig {\n DaemonConfig {\n pulse_period: Duration::from_millis(15),\n ..DaemonConfig::default()\n }\n }\n\n fn registered_now() -> Vec<(AdapterRecord, Manifest)> {\n spt_runtime::registry::registered(&perch::adapters_dir())\n }\n\n /// Poll a predicate up to `bound`, sleeping 20ms between checks.\n fn wait_until(bound: Duration, mut pred: impl FnMut() -> bool) -> bool {\n let deadline = Instant::now() + bound;\n while Instant::now() < deadline {\n if pred() {\n return true;\n }\n std::thread::sleep(Duration::from_millis(20));\n }\n pred()\n }\n\n // [unit->REQ-HAZARD-HOSTED-LIVENESS-RECONCILE] the B2 pull keystone: an\n // spt-hosted (controllable==Some(true)) online perch with NO live broker session\n // is marked OFFLINE (the status=online latch cleared); one WITH a session stays\n // online; a harness-hosted relay (controllable==Some(false)) and a legacy\n…\n fn reconcile_converges_a_dead_relay_and_spares_a_live_or_unproven_one() {\n with_home(|_| {\n…\n assert!(\n !spt_store::liveness::is_perch_alive(&perch::resolve_perch_path(\n…\n )),\n \"the single liveness resolver now reads it dead — ready/alive/address agree\"\n );\n\n for spared in [\"relay-live\", \"relay-unproven\"] {\n let (status, rest, ready, address) = projection(spared);\n assert_eq!(\n status.as_deref(),\n Some(STATUS_ONLINE),\n \"{spared}: a relay that is not PROVABLY gone stays online\"\n );\n assert_eq!(rest.as_deref(), Some(\"active\"), \"{spared}: rest intent untouched\");\n assert!(ready, \"{spared}: ready marker preserved\");\n assert!(address, \"{spared}: relay address preserved\");\n }\n });\n }\n\n // [int->REQ-HAZARD-HOSTED-LIVENESS-RECONCILE] real broker session lifecycle:\n // an spt-hosted perch with a LIVE broker session stays online across a pull\n // reconcile; when its broker session is KILLED + reaped, the next pull\n // reconcile clears the status=online latch and marks the perch offline.\n #[test]\n fn pull_reconcile_offlines_perch_when_broker_session_dies() {\n use crate::msg::SpawnReq;\n with_home(|_| {\n // The spt-hosted perch on disk (online-latched, controllable).\n let perch = perch::resolve_perch_path(\"wallb\", ParentHint::Infer);\n std::fs::create_dir_all(&perch).unwrap();\n let mut rec =\n spt_store::info::InfoJson::new(\"wallb\", \"t\", std::process::id(), \"sid\", \"live_agent\");\n rec.controllable = Some(true);\n spt_store::info::write_info(&perch, &rec).unwrap();\n spt_store::info::set_status(&perch, STATUS_ONLINE).unwrap();\n\n // A real broker hosting a session LABELLED `wallb`.\n let name = format!(\"spt-b2-livecheck-{}.sock\", std::process::id());\n let broker = crate::broker::Broker::bind(&name).unwrap();\n let b2 = Arc::clone(&broker);\n std::thread::spawn(move || {\n let _ = b2.serve();\n });\n let mut brain = {\n let mut b = None;\n for _ in 0..200 {\n if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n b = Some(c);\n break;\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n b.expect(\"connect to test broker\")\n };\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n brain\n .spawn_session(SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: \"wallb\".to_string(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n })\n .unwrap();\n\n let session_set = |brain: &mut Brain| -> BTreeSet {\n brain\n .sessions()\n .unwrap()\n .sessions\n .into_iter()\n .map(|s| s.endpoint)\n .filter(|e| !e.is_empty())\n .collect()\n };\n let status = |id: &str| {\n spt_store::info::read_info(&perch::resolve_perch_path(id, ParentHint::Infer))\n .and_then(|i| i.status)\n };\n\n // Session LIVE → reconcile leaves it online.\n let live = session_set(&mut brain);\n assert!(live.contains(\"wallb\"), \"broker hosts the session\");\n assert!(reconcile_hosted_liveness(&perch::owlery_dir(), &live).is_empty());\n assert_eq!(status(\"wallb\").as_deref(), Some(STATUS_ONLINE));\n\n // Kill the session; wait for the exit-waiter to reap it from the table.\n brain.kill_session().unwrap();\n assert!(\n wait_until(Duration::from_secs(5), || !session_set(&mut brain).contains(\"wallb\")),\n \"killed session leaves the broker table\"\n );\n\n // Now the pull reconcile clears the latch → offline.\n let live2 = session_set(&mut brain);\n let offlined = reconcile_hosted_liveness(&perch::owlery_dir(), &live2);\n assert_eq!(offlined, vec![\"wallb\".to_string()], \"dead-session perch offlined\");\n assert_eq!(\n status(\"wallb\").as_deref(),\n Some(spt_store::liveness::STATUS_OFFLINE),\n \"the status=online latch is cleared once the broker session is gone\"\n );\n });\n }\n\n // [unit->REQ-DAEMON-1] (a) FIRST-HOST scan: an online live endpoint on disk is\n // hosted by the reconcile — the Psyche is spawned AND the config-paced pulse\n // driver actually runs (it stamps last_active_ms on the Self perch each tick).\n #[test]\n…\n fn reconcile_keeps_driver_on_transient_read_fail_unhosts_on_dir_gone() {\n with_home(|_| {\n…\n run();\n assert_eq!(set.len(), 1, \"hosted while online\");\n\n // TRANSIENT read failure: info.json gone, but the perch DIR remains.\n let self_perch = perch::resolve_perch_path(\"doyle\", ParentHint::Infer);\n std::fs::remove_file(self_perch.join(\"info.json\")).unwrap();\n run();\n assert_eq!(\n set.len(),\n 1,\n \"a transient read failure (dir present) must NOT un-host — driver kept\"\n );\n\n // DEFINITIVE: the perch dir is gone (torn down) → un-host. The fast-pulse\n // driver holds perch files open between pulses; on Windows that\n // transiently blocks dir removal (os err 32) — retry past the µs window\n // (production teardown stops the host first, so this race is test-only).\n let mut removed = false;\n for _ in 0..100 {\n if std::fs::remove_dir_all(&self_perch).is_ok() {\n removed = true;\n break;\n }\n std::thread::sleep(std::time::Duration::from_millis(20));\n }\n assert!(removed, \"could not remove the perch dir for the torn-down case\");\n run();\n assert!(set.is_empty(), \"a gone perch dir un-hosts the driver\");\n });\n }\n\n // [unit->REQ-PSYCHE-LEGACY-RESIDENT-SWEEP] the PURE positive-match guard: the real\n // `-psyche` legacy wrapper (matching exe basename AND a cmdline carrying\n…\n}"}],"details":{"displayContent":{"text":"#[cfg(test)]\nmod tests {\n use super::*;\n use crate::test_home::with_home;\n use std::time::{Duration, Instant};\n\n // [unit->REQ-CONN-HEALTHY-LIFECYCLE-BOUNDED]\n #[test]\n fn session_poll_reuses_healthy_carrier_and_reopens_after_query_error() {\n use crate::codec::{read_frame, write_frame};\n use crate::frame::{Envelope, Role};\n use crate::transport::{recv_hello, DaemonTransport, LocalSocketTransport};\n use std::sync::atomic::AtomicU32;\n\n static SEQ: AtomicU32 = AtomicU32::new(0);\n let name = format!(\n \"spt-livehost-poll-{}-{}\", std::process::id(),\n SEQ.fetch_add(1, Ordering::Relaxed)\n );\n let listener = LocalSocketTransport::bind(&name).unwrap();\n const N: usize = 16;\n let server = std::thread::spawn(move || {\n let mut accepted = 0;\n let mut conn = listener.accept().unwrap();\n accepted += 1;\n recv_hello(&mut conn, Role::Brain).unwrap();\n for _ in 0..N {\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n )).unwrap();\n }\n // A malformed reply is a query error even while the transport is\n // still alive. It must retire, not leave a desynchronized cache.\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": false})\n )).unwrap();\n assert!(read_frame(&mut conn).is_err(), \"failed query closes old carrier\");\n let mut conn = listener.accept().unwrap();\n accepted += 1;\n recv_hello(&mut conn, Role::Brain).unwrap();\n assert_eq!(read_frame(&mut conn).unwrap().kind, crate::msg::KIND_SESSIONS);\n write_frame(&mut conn, &Envelope::new(\n crate::msg::KIND_SESSIONS_REPLY, serde_json::json!({\"sessions\": []})\n )).unwrap();\n accepted\n });\n let mut poll = SessionPoll::default();\n for _ in 0..N {\n assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n }\n assert_eq!(poll.query(&name), None, \"failure is not an empty session census\");\n assert_eq!(poll.query(&name), Some(BTreeSet::new()));\n drop(poll);\n assert_eq!(server.join().unwrap(), 2, \"one healthy carrier plus one recovery\");\n }\n\n // A no-op Psyche summarizer command: spawns + exits 0 (we never depend on its\n // output — the daemon online-stamp is what hosts it, not the pid).\n #[cfg(windows)]\n…\n fn seed_live_perch(id: &str, adapter: &str, status: &str) {\n…\n }\n\n /// A fast-pulse config so the driver loop ticks quickly in tests.\n fn fast_cfg() -> DaemonConfig {\n DaemonConfig {\n pulse_period: Duration::from_millis(15),\n ..DaemonConfig::default()\n }\n }\n\n fn registered_now() -> Vec<(AdapterRecord, Manifest)> {\n spt_runtime::registry::registered(&perch::adapters_dir())\n }\n\n /// Poll a predicate up to `bound`, sleeping 20ms between checks.\n fn wait_until(bound: Duration, mut pred: impl FnMut() -> bool) -> bool {\n let deadline = Instant::now() + bound;\n while Instant::now() < deadline {\n if pred() {\n return true;\n }\n std::thread::sleep(Duration::from_millis(20));\n }\n pred()\n }\n\n // [unit->REQ-HAZARD-HOSTED-LIVENESS-RECONCILE] the B2 pull keystone: an\n // spt-hosted (controllable==Some(true)) online perch with NO live broker session\n // is marked OFFLINE (the status=online latch cleared); one WITH a session stays\n // online; a harness-hosted relay (controllable==Some(false)) and a legacy\n…\n fn reconcile_converges_a_dead_relay_and_spares_a_live_or_unproven_one() {\n with_home(|_| {\n…\n assert!(\n !spt_store::liveness::is_perch_alive(&perch::resolve_perch_path(\n…\n )),\n \"the single liveness resolver now reads it dead — ready/alive/address agree\"\n );\n\n for spared in [\"relay-live\", \"relay-unproven\"] {\n let (status, rest, ready, address) = projection(spared);\n assert_eq!(\n status.as_deref(),\n Some(STATUS_ONLINE),\n \"{spared}: a relay that is not PROVABLY gone stays online\"\n );\n assert_eq!(rest.as_deref(), Some(\"active\"), \"{spared}: rest intent untouched\");\n assert!(ready, \"{spared}: ready marker preserved\");\n assert!(address, \"{spared}: relay address preserved\");\n }\n });\n }\n\n // [int->REQ-HAZARD-HOSTED-LIVENESS-RECONCILE] real broker session lifecycle:\n // an spt-hosted perch with a LIVE broker session stays online across a pull\n // reconcile; when its broker session is KILLED + reaped, the next pull\n // reconcile clears the status=online latch and marks the perch offline.\n #[test]\n fn pull_reconcile_offlines_perch_when_broker_session_dies() {\n use crate::msg::SpawnReq;\n with_home(|_| {\n // The spt-hosted perch on disk (online-latched, controllable).\n let perch = perch::resolve_perch_path(\"wallb\", ParentHint::Infer);\n std::fs::create_dir_all(&perch).unwrap();\n let mut rec =\n spt_store::info::InfoJson::new(\"wallb\", \"t\", std::process::id(), \"sid\", \"live_agent\");\n rec.controllable = Some(true);\n spt_store::info::write_info(&perch, &rec).unwrap();\n spt_store::info::set_status(&perch, STATUS_ONLINE).unwrap();\n\n // A real broker hosting a session LABELLED `wallb`.\n let name = format!(\"spt-b2-livecheck-{}.sock\", std::process::id());\n let broker = crate::broker::Broker::bind(&name).unwrap();\n let b2 = Arc::clone(&broker);\n std::thread::spawn(move || {\n let _ = b2.serve();\n });\n let mut brain = {\n let mut b = None;\n for _ in 0..200 {\n if let Ok(c) = Brain::cold_start(&name, now_ms()) {\n b = Some(c);\n break;\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n b.expect(\"connect to test broker\")\n };\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n brain\n .spawn_session(SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: \"wallb\".to_string(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n })\n .unwrap();\n\n let session_set = |brain: &mut Brain| -> BTreeSet {\n brain\n .sessions()\n .unwrap()\n .sessions\n .into_iter()\n .map(|s| s.endpoint)\n .filter(|e| !e.is_empty())\n .collect()\n };\n let status = |id: &str| {\n spt_store::info::read_info(&perch::resolve_perch_path(id, ParentHint::Infer))\n .and_then(|i| i.status)\n };\n\n // Session LIVE → reconcile leaves it online.\n let live = session_set(&mut brain);\n assert!(live.contains(\"wallb\"), \"broker hosts the session\");\n assert!(reconcile_hosted_liveness(&perch::owlery_dir(), &live).is_empty());\n assert_eq!(status(\"wallb\").as_deref(), Some(STATUS_ONLINE));\n\n // Kill the session; wait for the exit-waiter to reap it from the table.\n brain.kill_session().unwrap();\n assert!(\n wait_until(Duration::from_secs(5), || !session_set(&mut brain).contains(\"wallb\")),\n \"killed session leaves the broker table\"\n );\n\n // Now the pull reconcile clears the latch → offline.\n let live2 = session_set(&mut brain);\n let offlined = reconcile_hosted_liveness(&perch::owlery_dir(), &live2);\n assert_eq!(offlined, vec![\"wallb\".to_string()], \"dead-session perch offlined\");\n assert_eq!(\n status(\"wallb\").as_deref(),\n Some(spt_store::liveness::STATUS_OFFLINE),\n \"the status=online latch is cleared once the broker session is gone\"\n );\n });\n }\n\n // [unit->REQ-DAEMON-1] (a) FIRST-HOST scan: an online live endpoint on disk is\n // hosted by the reconcile — the Psyche is spawned AND the config-paced pulse\n // driver actually runs (it stamps last_active_ms on the Self perch each tick).\n #[test]\n…\n fn reconcile_keeps_driver_on_transient_read_fail_unhosts_on_dir_gone() {\n with_home(|_| {\n…\n run();\n assert_eq!(set.len(), 1, \"hosted while online\");\n\n // TRANSIENT read failure: info.json gone, but the perch DIR remains.\n let self_perch = perch::resolve_perch_path(\"doyle\", ParentHint::Infer);\n std::fs::remove_file(self_perch.join(\"info.json\")).unwrap();\n run();\n assert_eq!(\n set.len(),\n 1,\n \"a transient read failure (dir present) must NOT un-host — driver kept\"\n );\n\n // DEFINITIVE: the perch dir is gone (torn down) → un-host. The fast-pulse\n // driver holds perch files open between pulses; on Windows that\n // transiently blocks dir removal (os err 32) — retry past the µs window\n // (production teardown stops the host first, so this race is test-only).\n let mut removed = false;\n for _ in 0..100 {\n if std::fs::remove_dir_all(&self_perch).is_ok() {\n removed = true;\n break;\n }\n std::thread::sleep(std::time::Duration::from_millis(20));\n }\n assert!(removed, \"could not remove the perch dir for the torn-down case\");\n run();\n assert!(set.is_empty(), \"a gone perch dir un-hosts the driver\");\n });\n }\n\n // [unit->REQ-PSYCHE-LEGACY-RESIDENT-SWEEP] the PURE positive-match guard: the real\n // `-psyche` legacy wrapper (matching exe basename AND a cmdline carrying\n…\n}","startLine":1458,"lineNumbers":[1458,1459,1460,1461,1462,1463,1464,1465,1466,1467,1468,1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507,1508,1509,1510,1511,1512,1513,1514,1515,1516,1517,1518,null,1541,null,1548,1549,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1575,1576,1577,null,2124,2125,null,2196,2197,null,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,2210,2211,2212,2213,2214,2215,2216,2217,2218,2219,2220,2221,2222,2223,2224,2225,2226,2227,2228,2229,2230,2231,2232,2233,2234,2235,2236,2237,2238,2239,2240,2241,2242,2243,2244,2245,2246,2247,2248,2249,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2263,2264,2265,2266,2267,2268,2269,2270,2271,2272,2273,2274,2275,2276,2277,2278,2279,2280,2281,2282,2283,2284,2285,2286,2287,2288,2289,2290,2291,2292,2293,2294,2295,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2306,2307,2308,2309,2310,2311,2312,2313,2314,2315,null,2497,2498,null,2516,2517,2518,2519,2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533,2534,2535,2536,2537,2538,2539,2540,2541,2542,2543,2544,2545,2546,2547,2548,null,2957]},"fileSize":151661,"meta":{"source":{"type":"path","value":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/livehost.rs"}}},"isError":false,"timestamp":1790039687100}}
{"type":"message","id":"68aaf523","parentId":"3848d9b4","timestamp":"2026-09-22T01:14:47.112Z","message":{"role":"toolResult","toolCallId":"call_f0yUbhUIAima7b5Gs88nflac|fc_03665577bed2f92d016ab1d686f43487d29437d1501925a94c","toolName":"read","content":[{"type":"text","text":"/// Connect a brain to the broker, retrying through startup races — the channel\n/// the planned brain-restart trigger (ADR-0018 D3-3) rides after the binary\n/// swap. It does NOT attach to a session: the broker holds every hosted endpoint\n/// across the brain cycle, so apply never touches one. `Err` means the broker\n/// never answered (a dead broker fails the apply with the seat untouched).\nfn connect_retry(broker_name: &str) -> io::Result {\n let mut last = io::Error::other(\"broker never answered\");\n for _ in 0..300 {\n match Brain::cold_start(broker_name, now_ms()) {\n Ok(b) => return Ok(b),\n Err(e) => last = e,\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n Err(last)\n}\n\n#[cfg(test)]\nmod tests {\n use super::*;\n use crate::broker::Broker;\n use crate::msg::SpawnReq;\n use crate::release::{\n current_platform, sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet,\n UpdateArtifactMetadata, UpdateSetMetadata,\n };\n use crate::update::BROKER_RESOURCE_ABI;\n use ed25519_dalek::{Signer, SigningKey};\n use std::sync::atomic::{AtomicU32, Ordering};\n use std::sync::Arc;\n\n static SEQ: AtomicU32 = AtomicU32::new(0);\n fn unique_name() -> String {\n let n = SEQ.fetch_add(1, Ordering::Relaxed);\n format!(\"spt-daemon-d7b-{}-{}.sock\", std::process::id(), n)\n }\n\n /// A live broker serving on `name`, plus its serve thread, wrapped in an RAII guard\n /// that gracefully [`Broker::stop`]s + JOINS the serve thread on drop (C1). Without\n /// it every test broker leaked its serve thread + all accepted-conn handler threads\n /// — the load population that starved the seed stop barrier under full-suite load.\n /// Derefs to `Arc` so callers use it exactly like the bare Arc they held before.\n struct ServedBroker {\n broker: Arc,\n handle: Option>,\n }\n impl std::ops::Deref for ServedBroker {\n type Target = Arc;\n fn deref(&self) -> &Arc {\n &self.broker\n }\n }\n impl Drop for ServedBroker {\n fn drop(&mut self) {\n self.broker.stop();\n if let Some(h) = self.handle.take() {\n let _ = h.join();\n }\n }\n }\n\n fn served_broker(name: &str) -> ServedBroker {\n let broker = Broker::bind(name).expect(\"bind broker\");\n let serve = Arc::clone(&broker);\n let handle = std::thread::spawn(move || {\n let _ = serve.serve();\n });\n ServedBroker {\n broker,\n handle: Some(handle),\n }\n }\n\n // [unit->REQ-UPDATE-APPLY-ALREADY-APPLIED] the pure already-applied classifier:\n // apply must short-circuit (never reach the binary-aside rename) when the staged\n // version is already the promoted image OR a still-open trial already landed it;\n // a genuinely newer staged version proceeds.\n #[test]\n fn staged_already_applied_classifies_up_to_date_vs_newer() {\n // First-ever apply: nothing applied, no state → proceed.\n assert!(!staged_already_applied(None, None, 8));\n // A newer version is staged than what's applied → proceed (apply it).\n assert!(!staged_already_applied(None, Some(5), 8));\n // The staged version is already the promoted, running image → no-op.\n assert!(staged_already_applied(None, Some(8), 8));\n // An even-newer image is already applied → no-op (never downgrade-rename).\n assert!(staged_already_applied(None, Some(9), 8));\n // A still-open trial already landed this version's bytes on disk → no-op\n // (re-applying would re-rename an already-swapped exe = the os-error-5).\n let pending = AppliedRecord::AppliedPending {\n version: 8,\n rollback_binary: \"spt.old-7\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(7),\n };\n assert!(staged_already_applied(Some(&pending), None, 8));\n // A trial for an OLDER version does not mask a genuinely newer stage.\n let old_pending = AppliedRecord::AppliedPending {\n version: 5,\n rollback_binary: \"spt.old-4\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(4),\n };\n assert!(!staged_already_applied(Some(&old_pending), None, 8));\n }\n\n fn cold_connect_retry(broker_name: &str) -> Brain {\n for _ in 0..300 {\n if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n return b;\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n panic!(\"brain cold-start could not connect\");\n }\n\n…\n fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n…\n let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n assert!(\n matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n \"matching-platform single applies, got {out:?}\"\n );\n assert_eq!(std::fs::read(&exe).unwrap(), b\"CROSS-OS BYTES\");\n }\n\n // [unit->REQ-HAZARD-BROKER-PROCESS-ISOLATION] [unit->REQ-UPD-3] the planned\n // brain-restart verb (D3-3): a broker WITH a supervisor signal wired raises\n // it on `KIND_BRAIN_RESTART` and acks `honored: true`; a bare broker (no\n // supervisor — the test/no-daemon shape) accepts the verb but acks\n // `honored: false`. This is the broker half of the apply trigger that\n // replaces the in-process handoff.\n #[test]\n fn brain_restart_verb_raises_the_supervisor_signal() {\n…\n }\n…\n fn echo_spawn_req() -> SpawnReq {\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: String::new(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n }\n }\n…\n fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n…\n // A still-open trial that already landed this version's bytes marks it applied.\n let (cache, keys) = stage(dir.path(), 9, b\"V9\", BROKER_RESOURCE_ABI);\n cache\n .record_applied_state(&AppliedRecord::AppliedPending {\n version: 9,\n rollback_binary: \"spt-binary.old-8\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(8),\n })\n .unwrap();\n let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n assert!(\n matches!(out, ApplyStagedOutcome::AlreadyApplied { version: 9, .. }),\n \"got {out:?}\"\n );\n assert_eq!(std::fs::read(&exe).unwrap(), b\"OLD\", \"seat untouched\");\n }\n\n // [unit->REQ-UPD-6] apply-time re-verification handles platform-targeted\n // update sets by selecting the local target triple's artifact before\n // swapping the executable.\n #[test]\n fn apply_staged_update_set_selects_local_platform_artifact() {\n let dir = tempfile::tempdir().unwrap();\n let name = unique_name();\n let broker = served_broker(&name);\n\n let mut seat = cold_connect_retry(&name);\n let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n…\n }\n…\n}"}],"details":{"displayContent":{"text":"/// Connect a brain to the broker, retrying through startup races — the channel\n/// the planned brain-restart trigger (ADR-0018 D3-3) rides after the binary\n/// swap. It does NOT attach to a session: the broker holds every hosted endpoint\n/// across the brain cycle, so apply never touches one. `Err` means the broker\n/// never answered (a dead broker fails the apply with the seat untouched).\nfn connect_retry(broker_name: &str) -> io::Result {\n let mut last = io::Error::other(\"broker never answered\");\n for _ in 0..300 {\n match Brain::cold_start(broker_name, now_ms()) {\n Ok(b) => return Ok(b),\n Err(e) => last = e,\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n Err(last)\n}\n\n#[cfg(test)]\nmod tests {\n use super::*;\n use crate::broker::Broker;\n use crate::msg::SpawnReq;\n use crate::release::{\n current_platform, sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet,\n UpdateArtifactMetadata, UpdateSetMetadata,\n };\n use crate::update::BROKER_RESOURCE_ABI;\n use ed25519_dalek::{Signer, SigningKey};\n use std::sync::atomic::{AtomicU32, Ordering};\n use std::sync::Arc;\n\n static SEQ: AtomicU32 = AtomicU32::new(0);\n fn unique_name() -> String {\n let n = SEQ.fetch_add(1, Ordering::Relaxed);\n format!(\"spt-daemon-d7b-{}-{}.sock\", std::process::id(), n)\n }\n\n /// A live broker serving on `name`, plus its serve thread, wrapped in an RAII guard\n /// that gracefully [`Broker::stop`]s + JOINS the serve thread on drop (C1). Without\n /// it every test broker leaked its serve thread + all accepted-conn handler threads\n /// — the load population that starved the seed stop barrier under full-suite load.\n /// Derefs to `Arc` so callers use it exactly like the bare Arc they held before.\n struct ServedBroker {\n broker: Arc,\n handle: Option>,\n }\n impl std::ops::Deref for ServedBroker {\n type Target = Arc;\n fn deref(&self) -> &Arc {\n &self.broker\n }\n }\n impl Drop for ServedBroker {\n fn drop(&mut self) {\n self.broker.stop();\n if let Some(h) = self.handle.take() {\n let _ = h.join();\n }\n }\n }\n\n fn served_broker(name: &str) -> ServedBroker {\n let broker = Broker::bind(name).expect(\"bind broker\");\n let serve = Arc::clone(&broker);\n let handle = std::thread::spawn(move || {\n let _ = serve.serve();\n });\n ServedBroker {\n broker,\n handle: Some(handle),\n }\n }\n\n // [unit->REQ-UPDATE-APPLY-ALREADY-APPLIED] the pure already-applied classifier:\n // apply must short-circuit (never reach the binary-aside rename) when the staged\n // version is already the promoted image OR a still-open trial already landed it;\n // a genuinely newer staged version proceeds.\n #[test]\n fn staged_already_applied_classifies_up_to_date_vs_newer() {\n // First-ever apply: nothing applied, no state → proceed.\n assert!(!staged_already_applied(None, None, 8));\n // A newer version is staged than what's applied → proceed (apply it).\n assert!(!staged_already_applied(None, Some(5), 8));\n // The staged version is already the promoted, running image → no-op.\n assert!(staged_already_applied(None, Some(8), 8));\n // An even-newer image is already applied → no-op (never downgrade-rename).\n assert!(staged_already_applied(None, Some(9), 8));\n // A still-open trial already landed this version's bytes on disk → no-op\n // (re-applying would re-rename an already-swapped exe = the os-error-5).\n let pending = AppliedRecord::AppliedPending {\n version: 8,\n rollback_binary: \"spt.old-7\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(7),\n };\n assert!(staged_already_applied(Some(&pending), None, 8));\n // A trial for an OLDER version does not mask a genuinely newer stage.\n let old_pending = AppliedRecord::AppliedPending {\n version: 5,\n rollback_binary: \"spt.old-4\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(4),\n };\n assert!(!staged_already_applied(Some(&old_pending), None, 8));\n }\n\n fn cold_connect_retry(broker_name: &str) -> Brain {\n for _ in 0..300 {\n if let Ok(b) = Brain::cold_start(broker_name, now_ms()) {\n return b;\n }\n std::thread::sleep(Duration::from_millis(10));\n }\n panic!(\"brain cold-start could not connect\");\n }\n\n…\n fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n…\n let out = apply_staged(&cache, &keys, &exe, &name).expect(\"ok\");\n assert!(\n matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n \"matching-platform single applies, got {out:?}\"\n );\n assert_eq!(std::fs::read(&exe).unwrap(), b\"CROSS-OS BYTES\");\n }\n\n // [unit->REQ-HAZARD-BROKER-PROCESS-ISOLATION] [unit->REQ-UPD-3] the planned\n // brain-restart verb (D3-3): a broker WITH a supervisor signal wired raises\n // it on `KIND_BRAIN_RESTART` and acks `honored: true`; a bare broker (no\n // supervisor — the test/no-daemon shape) accepts the verb but acks\n // `honored: false`. This is the broker half of the apply trigger that\n // replaces the in-process handoff.\n #[test]\n fn brain_restart_verb_raises_the_supervisor_signal() {\n…\n }\n…\n fn echo_spawn_req() -> SpawnReq {\n #[cfg(unix)]\n let (program, args) = (\"cat\".to_string(), Vec::::new());\n #[cfg(windows)]\n let (program, args) = (\"findstr\".to_string(), vec![\".\".to_string()]);\n SpawnReq {\n program,\n args,\n rows: 24,\n cols: 80,\n endpoint: String::new(),\n cwd: None,\n env: Default::default(),\n translation_binary: None,\n adapter: String::new(),\n install_dir: None,\n }\n }\n…\n fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n…\n // A still-open trial that already landed this version's bytes marks it applied.\n let (cache, keys) = stage(dir.path(), 9, b\"V9\", BROKER_RESOURCE_ABI);\n cache\n .record_applied_state(&AppliedRecord::AppliedPending {\n version: 9,\n rollback_binary: \"spt-binary.old-8\".to_string(),\n candidate_started_ms: 0,\n prior_version: Some(8),\n })\n .unwrap();\n let out = apply_staged_daemonless(&cache, &keys, &exe).expect(\"ok\");\n assert!(\n matches!(out, ApplyStagedOutcome::AlreadyApplied { version: 9, .. }),\n \"got {out:?}\"\n );\n assert_eq!(std::fs::read(&exe).unwrap(), b\"OLD\", \"seat untouched\");\n }\n\n // [unit->REQ-UPD-6] apply-time re-verification handles platform-targeted\n // update sets by selecting the local target triple's artifact before\n // swapping the executable.\n #[test]\n fn apply_staged_update_set_selects_local_platform_artifact() {\n let dir = tempfile::tempdir().unwrap();\n let name = unique_name();\n let broker = served_broker(&name);\n\n let mut seat = cold_connect_retry(&name);\n let sid = seat.spawn_session(echo_spawn_req()).expect(\"spawn\");\n…\n }\n…\n}","startLine":450,"lineNumbers":[450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,null,761,null,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,null,843,null,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,null,986,null,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,null,1053,null,1204]},"fileSize":55910,"meta":{"source":{"type":"path","value":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/applyhost.rs"}}},"isError":false,"timestamp":1790039687111}}
{"type":"message","id":"163b29a9","parentId":"68aaf523","timestamp":"2026-09-22T01:14:47.119Z","message":{"role":"toolResult","toolCallId":"call_cNETvfVyVnO2OVcItnIL5Z8P|fc_03665577bed2f92d016ab1d686f42087d2bd8661c89b20f64e","toolName":"grep","content":[{"type":"text","text":"# .worktrees/318-h3-infra-register/crates/\n\n## spt-daemon/src/\n### shellhost.rs\n 842| let deadline = std::time::Instant::now() + window;\n*843| while std::time::Instant::now() < deadline {\n 844| if process.is_some_and(|(pid, birth)| {\n 845| spt_store::liveness::relay_liveness(Some(pid), birth) == RelayLiveness::Gone\n 846| }) {\n...\n 868| let mut survived = true;\n*869| for _ in 0..40 {\n 870| spt_store::proc::reap_if_child(p);\n 871| if process.is_some_and(|(pid, birth)| {\n 872| spt_store::liveness::relay_liveness(Some(pid), birth) == RelayLiveness::Gone\n...\n 1573| let shell = shell_section(\"definitely-not-a-real-program-xyz --link {link_token}\");\n*1574| for _ in 0..2 {\n 1575| assert!(launch_shell(owlery, \"doyle\", &id, \"mock-shell\", None, &shell).is_err());\n 1576| assert_eq!(\n 1577| std::fs::read_to_string(perch.join(shellinfo::SHELL_LAUNCH_FILE)).unwrap(),\n### shellwake.rs\n 333| let mut left = backoff_ms(params, failures);\n*334| while left > 0 && !stop.load(Ordering::SeqCst) {\n 335| let step = left.min(50);\n 336| std::thread::sleep(Duration::from_millis(step));\n 337| left -= step;\n...\n 474| // [impl->REQ-OPID-TRACING-RETRY]\n*475| let outcome = crate::effect::with_tracing_retry(\n 476| // The wake-forward rest op's seq source is a fresh `now_ms()` — its OWN\n 477| // minting source, distinct from shellchan's spool-row counter (doyle ruling:\n 478| // the tag names the seq source, not the subsystem), so it stamps `wake`.\n...\n 1032| let mut left = RECONCILE_INTERVAL_MS;\n*1033| while left > 0 && !stop.load(Ordering::SeqCst) {\n 1034| let step = left.min(100);\n 1035| std::thread::sleep(Duration::from_millis(step));\n 1036| left -= step;\n...\n 1931| let mut spawn_gave_up = false;\n*1932| while std::time::Instant::now() < deadline {\n 1933| // Read-and-PARSE, not `exists()`: the file appears before the write\n 1934| // lands, so an exists-gate can hand the next line an empty string.\n 1935| // Through the SHARED parse — a whole-content `trim().parse()` here\n...\n 1974| let mut child_dead = false;\n*1975| while std::time::Instant::now() < deadline {\n 1976| if !spt_store::proc::is_process_alive(waker_pid) {\n 1977| child_dead = true;\n 1978| break;\n### stderrlog.rs\n 80| // clobbers an un-shifted file).\n*81| for n in (1..keep.saturating_sub(1)).rev() {\n 82| let _ = std::fs::rename(rolled_path(dir, n), rolled_path(dir, n + 1));\n 83| }\n 84| let current = dir.join(STDERR_LOG_BASENAME);\n### sync.rs\n 450| // Close our handle before git reads the bundle.\n*451| if let Some(mut f) = file.take() {\n 452| f.flush()?;\n 453| }\n 454| if total == 0 {\n### translation.rs\n 269| .stdout\n*270| .take()\n 271| .expect(\"stdout piped at spawn\");\n*272| let stdin = child.stdin.take().expect(\"stdin piped at spawn\");\n 273| let reader = thread::spawn(move || {\n 274| let buf = BufReader::new(stdout);\n 275| for line in buf.lines() {\n...\n 322| fn close_stdin(&self) {\n*323| let _ = self.stdin.lock().unwrap().take();\n 324| }\n 325|\n 326| /// Bounded reap (doyle gate #2): close stdin (EOF), give the child\n### wan.rs\n 1527|\n*1528| for _ in 0..5 {\n 1529| warn_via_fallback(\n 1530| &msg,\n 1531| \"aa11bb22\",\n...\n 1557|\n*1558| for _ in 0..3 {\n 1559| warn_via_fallback(\n 1560| &msg,\n 1561| \"aa11bb22\",\n### webproxy.rs\n 95| let mut cx = std::task::Context::from_waker(waker);\n*96| while let std::task::Poll::Ready(Some(Ok(frame))) =\n 97| std::pin::Pin::new(&mut body).poll_frame(&mut cx)\n 98| {\n 99| if let Ok(data) = frame.into_data() {\n...\n 237| let mut buf = vec![0u8; CHUNK_BYTES];\n*238| while remaining > 0 {\n 239| let want = remaining.min(CHUNK_BYTES as u64) as usize;\n 240| let n = file.read(&mut buf[..want])?;\n 241| if n == 0 {\n...\n 597| let fail = |head_tx: &mut Option>, why: String| {\n*598| match head_tx.take() {\n 599| Some(tx) => {\n 600| let _ = tx.send(ProxyHead::unavailable(&target.node_label, &why));\n 601| }\n...\n 627| WebRecord::WebReply { status, headers } => {\n*628| if let Some(tx) = head_tx.take() {\n 629| let _ = tx.send(ProxyHead { status, headers, inline: None });\n 630| }\n 631| }\n...\n 653| WebRecord::WebErr { message, refused } => {\n*654| match head_tx.take() {\n 655| Some(tx) => {\n 656| let _ = tx.send(ProxyHead::for_err(&target.node_label, &message, refused));\n 657| }\n### webserve.rs\n 1085| assert_eq!(body(get(home.path(), \"/local/f/shared/nested/item.txt\")), b\"child\");\n*1086| for path in [\"/local/f/shared/../secret.txt\", \"/local/f/shared/%2e%2e/secret.txt\", \"/local/f/shared/%5c..%5csecret.txt\", \"/local/f/shared/c:/secret.txt\", \"/local/f/shared/%00\", \"/local/f/shared/%zz\", \"/local/f/shared%2fnested/item.txt\"] {\n 1087| assert_eq!(get(home.path(), path).status(), StatusCode::BAD_REQUEST, \"{path}\");\n 1088| }\n 1089| std::fs::write(source.join(\"nested/item.txt\"), b\"edited child\").unwrap();\n\n## spt-live/src/\n### inject.rs\n 61| }\n*62| let mut s: String = line.chars().take(SUMMARY_CAP).collect();\n 63| s.push('…');\n 64| s\n 65|}\n### turn.rs\n 115| let mut cut = start;\n*116| while cut < trimmed.len() && !trimmed.is_char_boundary(cut) {\n 117| cut += 1;\n 118| }\n 119| let tail: String = trimmed[cut..]\n\n## spt-msg/src/\n### deliver.rs\n 307| let mut got = None;\n*308| for _ in 0..200 {\n 309| if let Some(m) = listener.check_message() {\n 310| got = Some(m);\n 311| break;\n...\n 357| // The relay's live channel received NOTHING across the poll window.\n*358| for _ in 0..40 {\n 359| assert!(\n 360| listener.check_message().is_none(),\n 361| \"active_only must never reach a relay's live poll channel (never-wake)\"\n### listener.rs\n 226| let mut got = None;\n*227| for _ in 0..200 {\n 228| if let Some(m) = listener.check_message() {\n 229| got = Some(m);\n 230| break;\n### ready.rs\n 349| let mut got = None;\n*350| for _ in 0..25 {\n 351| if let Some(m) = agent.recv() {\n 352| got = Some(m);\n 353| break;\n\n## spt-net/src/net/\n### codeseal.rs\n 527|\n*528| for i in 0..envelope.len() {\n 529| let mut bad = envelope.clone();\n 530| bad[i] ^= 0x01;\n 531| let recoded = format!(\n### ndjson.rs\n 63| // Split off complete lines; keep the tail.\n*64| while let Some(pos) = self.buf.iter().position(|b| *b == b'\\n') {\n 65| let rest = self.buf.split_off(pos + 1);\n 66| let line = std::mem::replace(&mut self.buf, rest);\n 67| if let Ok(rec) = serde_json::from_slice::(&line[..pos]) {\n### registry.rs\n 904|pub fn key_prefix(node: &str) -> String {\n*905| node.chars().take(8).collect()\n 906|}\n 907|\n 908|impl SubnetRegistry {\n\n### mesh/\n#### seedproof.rs\n 295| let mut proofs = Vec::with_capacity(count);\n*296| for _ in 0..count {\n 297| if pos + 8 + PROOF_TAG_LEN > rest.len() {\n 298| return None;\n 299| }\n...\n 324| let mut subnets = Vec::with_capacity(count.min(64));\n*325| for _ in 0..count {\n 326| if pos + 4 > rest.len() {\n 327| return None;\n 328| }\n\n### pairing/\n#### meet.rs\n 299| let mut last = MeetError::Protocol(\"rendezvous window empty\".into());\n*300| while let Some(joined) = probes.join_next().await {\n 301| match joined {\n 302| Ok(Ok(real_addr)) => {\n 303| probes.abort_all();\n#### totp.rs\n 200| let mut diff = 0u8;\n*201| for i in 0..a.len() {\n 202| diff |= a[i] ^ b[i];\n 203| }\n 204| diff == 0\n#### wire.rs\n 845|fn dec_roster(c: &mut Cursor) -> Result<(Vec, Vec), PairWireError> {\n*846| let member_count = u32::from_be_bytes(c.take(4)?.try_into().expect(\"took 4\"));\n 847| let mut roster = Vec::new();\n*848| for _ in 0..member_count {\n 849| let pubkey_hex = dec_utf8(c.field()?, \"roster pubkey\")?;\n 850| let label = dec_utf8(c.field()?, \"roster label\")?;\n 851| let machine_id = dec_utf8(c.field()?, \"roster machine_id\")?;\n...\n 872| }\n*873| let tomb_count = u32::from_be_bytes(c.take(4)?.try_into().expect(\"took 4\"));\n 874| let mut tombstones = Vec::new();\n*875| for _ in 0..tomb_count {\n 876| let pubkey_hex = dec_utf8(c.field()?, \"tombstone pubkey\")?;\n 877| let stamp = dec_utf8(c.field()?, \"tombstone stamp\")?;\n 878| tombstones.push(Tombstone {\n...\n 1011| let seed: [u8; TOTP_SEED_LEN] = c\n*1012| .take(TOTP_SEED_LEN)?\n 1013| .try_into()\n 1014| .expect(\"took TOTP_SEED_LEN\");\n 1015| let epoch = c.u64()?;\n...\n 1092| fn u8(&mut self) -> Result {\n*1093| Ok(self.take(1)?[0])\n 1094| }\n 1095|\n 1096| fn u64(&mut self) -> Result {\n*1097| let b = self.take(8)?;\n 1098| Ok(u64::from_be_bytes(b.try_into().expect(\"took 8\")))\n 1099| }\n 1100|\n...\n 1102| fn field(&mut self) -> Result<&'a [u8], PairWireError> {\n*1103| let len = u32::from_be_bytes(self.take(4)?.try_into().expect(\"took 4\")) as usize;\n 1104| if len > MAX_FRAME {\n 1105| return Err(PairWireError::Protocol(\"field length out of range\".into()));\n 1106| }\n*1107| self.take(len)\n 1108| }\n 1109|\n 1110| fn tag(&mut self) -> Result<[u8; TAG_LEN], PairWireError> {\n*1111| Ok(self.take(TAG_LEN)?.try_into().expect(\"took TAG_LEN\"))\n 1112| }\n 1113|\n 1114| /// Unread bytes left in the frame (the optional-trailing-fields probe).\n\nShowing files 41-60 of 126+. Use skip=60 for the next page, or narrow paths/pattern."}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":44,"fileCount":20,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/shellhost.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/shellwake.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/stderrlog.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/sync.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/translation.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/wan.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/webproxy.rs",".worktrees/318-h3-infra-register/crates/spt-daemon/src/webserve.rs",".worktrees/318-h3-infra-register/crates/spt-live/src/inject.rs",".worktrees/318-h3-infra-register/crates/spt-live/src/turn.rs",".worktrees/318-h3-infra-register/crates/spt-msg/src/deliver.rs",".worktrees/318-h3-infra-register/crates/spt-msg/src/listener.rs",".worktrees/318-h3-infra-register/crates/spt-msg/src/ready.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/codeseal.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/mesh/seedproof.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/ndjson.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/meet.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/totp.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/wire.rs",".worktrees/318-h3-infra-register/crates/spt-net/src/net/registry.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/shellhost.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/shellwake.rs","count":5},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/stderrlog.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/sync.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/translation.rs","count":3},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/wan.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/webproxy.rs","count":5},{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/webserve.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-live/src/inject.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-live/src/turn.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-msg/src/deliver.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-msg/src/listener.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-msg/src/ready.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/codeseal.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/mesh/seedproof.rs","count":2},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/ndjson.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/meet.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/totp.rs","count":1},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/pairing/wire.rs","count":10},{"path":".worktrees/318-h3-infra-register/crates/spt-net/src/net/registry.rs","count":1}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# .worktrees/318-h3-infra-register/crates/\n\n## spt-daemon/src/\n### shellhost.rs\n 842│ let deadline = std::time::Instant::now() + window;\n *843│ while std::time::Instant::now() < deadline {\n 844│ if process.is_some_and(|(pid, birth)| {\n 845│ spt_store::liveness::relay_liveness(Some(pid), birth) == RelayLiveness::Gone\n 846│ }) {\n │...\n 868│ let mut survived = true;\n *869│ for _ in 0..40 {\n 870│ spt_store::proc::reap_if_child(p);\n 871│ if process.is_some_and(|(pid, birth)| {\n 872│ spt_store::liveness::relay_liveness(Some(pid), birth) == RelayLiveness::Gone\n │...\n 1573│ let shell = shell_section(\"definitely-not-a-real-program-xyz --link {link_token}\");\n*1574│ for _ in 0..2 {\n 1575│ assert!(launch_shell(owlery, \"doyle\", &id, \"mock-shell\", None, &shell).is_err());\n 1576│ assert_eq!(\n 1577│ std::fs::read_to_string(perch.join(shellinfo::SHELL_LAUNCH_FILE)).unwrap(),\n### shellwake.rs\n 333│ let mut left = backoff_ms(params, failures);\n *334│ while left > 0 && !stop.load(Ordering::SeqCst) {\n 335│ let step = left.min(50);\n 336│ std::thread::sleep(Duration::from_millis(step));\n 337│ left -= step;\n │...\n 474│ // [impl->REQ-OPID-TRACING-RETRY]\n *475│ let outcome = crate::effect::with_tracing_retry(\n 476│ // The wake-forward rest op's seq source is a fresh `now_ms()` — its OWN\n 477│ // minting source, distinct from shellchan's spool-row counter (doyle ruling:\n 478│ // the tag names the seq source, not the subsystem), so it stamps `wake`.\n │...\n 1032│ let mut left = RECONCILE_INTERVAL_MS;\n*1033│ while left > 0 && !stop.load(Ordering::SeqCst) {\n 1034│ let step = left.min(100);\n 1035│ std::thread::sleep(Duration::from_millis(step));\n 1036│ left -= step;\n │...\n 1931│ let mut spawn_gave_up = false;\n*1932│ while std::time::Instant::now() < deadline {\n 1933│ // Read-and-PARSE, not `exists()`: the file appears before the write\n 1934│ // lands, so an exists-gate can hand the next line an empty string.\n 1935│ // Through the SHARED parse — a whole-content `trim().parse()` here\n │...\n 1974│ let mut child_dead = false;\n*1975│ while std::time::Instant::now() < deadline {\n 1976│ if !spt_store::proc::is_process_alive(waker_pid) {\n 1977│ child_dead = true;\n 1978│ break;\n### stderrlog.rs\n 80│ // clobbers an un-shifted file).\n*81│ for n in (1..keep.saturating_sub(1)).rev() {\n 82│ let _ = std::fs::rename(rolled_path(dir, n), rolled_path(dir, n + 1));\n 83│ }\n 84│ let current = dir.join(STDERR_LOG_BASENAME);\n### sync.rs\n 450│ // Close our handle before git reads the bundle.\n*451│ if let Some(mut f) = file.take() {\n 452│ f.flush()?;\n 453│ }\n 454│ if total == 0 {\n### translation.rs\n 269│ .stdout\n*270│ .take()\n 271│ .expect(\"stdout piped at spawn\");\n*272│ let stdin = child.stdin.take().expect(\"stdin piped at spawn\");\n 273│ let reader = thread::spawn(move || {\n 274│ let buf = BufReader::new(stdout);\n 275│ for line in buf.lines() {\n │...\n 322│ fn close_stdin(&self) {\n*323│ let _ = self.stdin.lock().unwrap().take();\n 324│ }\n 325│\n 326│ /// Bounded reap (doyle gate #2): close stdin (EOF), give the child\n### wan.rs\n 1527│\n*1528│ for _ in 0..5 {\n 1529│ warn_via_fallback(\n 1530│ &msg,\n 1531│ \"aa11bb22\",\n │...\n 1557│\n*1558│ for _ in 0..3 {\n 1559│ warn_via_fallback(\n 1560│ &msg,\n 1561│ \"aa11bb22\",\n### webproxy.rs\n 95│ let mut cx = std::task::Context::from_waker(waker);\n *96│ while let std::task::Poll::Ready(Some(Ok(frame))) =\n 97│ std::pin::Pin::new(&mut body).poll_frame(&mut cx)\n 98│ {\n 99│ if let Ok(data) = frame.into_data() {\n │...\n 237│ let mut buf = vec![0u8; CHUNK_BYTES];\n*238│ while remaining > 0 {\n 239│ let want = remaining.min(CHUNK_BYTES as u64) as usize;\n 240│ let n = file.read(&mut buf[..want])?;\n 241│ if n == 0 {\n │...\n 597│ let fail = |head_tx: &mut Option>, why: String| {\n*598│ match head_tx.take() {\n 599│ Some(tx) => {\n 600│ let _ = tx.send(ProxyHead::unavailable(&target.node_label, &why));\n 601│ }\n │...\n 627│ WebRecord::WebReply { status, headers } => {\n*628│ if let Some(tx) = head_tx.take() {\n 629│ let _ = tx.send(ProxyHead { status, headers, inline: None });\n 630│ }\n 631│ }\n │...\n 653│ WebRecord::WebErr { message, refused } => {\n*654│ match head_tx.take() {\n 655│ Some(tx) => {\n 656│ let _ = tx.send(ProxyHead::for_err(&target.node_label, &message, refused));\n 657│ }\n### webserve.rs\n 1085│ assert_eq!(body(get(home.path(), \"/local/f/shared/nested/item.txt\")), b\"child\");\n*1086│ for path in [\"/local/f/shared/../secret.txt\", \"/local/f/shared/%2e%2e/secret.txt\", \"/local/f/shared/%5c..%5csecret.txt\", \"/local/f/shared/c:/secret.txt\", \"/local/f/shared/%00\", \"/local/f/shared/%zz\", \"/local/f/shared%2fnested/item.txt\"] {\n 1087│ assert_eq!(get(home.path(), path).status(), StatusCode::BAD_REQUEST, \"{path}\");\n 1088│ }\n 1089│ std::fs::write(source.join(\"nested/item.txt\"), b\"edited child\").unwrap();\n\n## spt-live/src/\n### inject.rs\n 61│ }\n*62│ let mut s: String = line.chars().take(SUMMARY_CAP).collect();\n 63│ s.push('…');\n 64│ s\n 65│}\n### turn.rs\n 115│ let mut cut = start;\n*116│ while cut < trimmed.len() && !trimmed.is_char_boundary(cut) {\n 117│ cut += 1;\n 118│ }\n 119│ let tail: String = trimmed[cut..]\n\n## spt-msg/src/\n### deliver.rs\n 307│ let mut got = None;\n*308│ for _ in 0..200 {\n 309│ if let Some(m) = listener.check_message() {\n 310│ got = Some(m);\n 311│ break;\n │...\n 357│ // The relay's live channel received NOTHING across the poll window.\n*358│ for _ in 0..40 {\n 359│ assert!(\n 360│ listener.check_message().is_none(),\n 361│ \"active_only must never reach a relay's live poll channel (never-wake)\"\n### listener.rs\n 226│ let mut got = None;\n*227│ for _ in 0..200 {\n 228│ if let Some(m) = listener.check_message() {\n 229│ got = Some(m);\n 230│ break;\n### ready.rs\n 349│ let mut got = None;\n*350│ for _ in 0..25 {\n 351│ if let Some(m) = agent.recv() {\n 352│ got = Some(m);\n 353│ break;\n\n## spt-net/src/net/\n### codeseal.rs\n 527│\n*528│ for i in 0..envelope.len() {\n 529│ let mut bad = envelope.clone();\n 530│ bad[i] ^= 0x01;\n 531│ let recoded = format!(\n### ndjson.rs\n 63│ // Split off complete lines; keep the tail.\n*64│ while let Some(pos) = self.buf.iter().position(|b| *b == b'\\n') {\n 65│ let rest = self.buf.split_off(pos + 1);\n 66│ let line = std::mem::replace(&mut self.buf, rest);\n 67│ if let Ok(rec) = serde_json::from_slice::(&line[..pos]) {\n### registry.rs\n 904│pub fn key_prefix(node: &str) -> String {\n*905│ node.chars().take(8).collect()\n 906│}\n 907│\n 908│impl SubnetRegistry {\n\n### mesh/\n#### seedproof.rs\n 295│ let mut proofs = Vec::with_capacity(count);\n*296│ for _ in 0..count {\n 297│ if pos + 8 + PROOF_TAG_LEN > rest.len() {\n 298│ return None;\n 299│ }\n │...\n 324│ let mut subnets = Vec::with_capacity(count.min(64));\n*325│ for _ in 0..count {\n 326│ if pos + 4 > rest.len() {\n 327│ return None;\n 328│ }\n\n### pairing/\n#### meet.rs\n 299│ let mut last = MeetError::Protocol(\"rendezvous window empty\".into());\n*300│ while let Some(joined) = probes.join_next().await {\n 301│ match joined {\n 302│ Ok(Ok(real_addr)) => {\n 303│ probes.abort_all();\n#### totp.rs\n 200│ let mut diff = 0u8;\n*201│ for i in 0..a.len() {\n 202│ diff |= a[i] ^ b[i];\n 203│ }\n 204│ diff == 0\n#### wire.rs\n 845│fn dec_roster(c: &mut Cursor) -> Result<(Vec, Vec), PairWireError> {\n *846│ let member_count = u32::from_be_bytes(c.take(4)?.try_into().expect(\"took 4\"));\n 847│ let mut roster = Vec::new();\n *848│ for _ in 0..member_count {\n 849│ let pubkey_hex = dec_utf8(c.field()?, \"roster pubkey\")?;\n 850│ let label = dec_utf8(c.field()?, \"roster label\")?;\n 851│ let machine_id = dec_utf8(c.field()?, \"roster machine_id\")?;\n │...\n 872│ }\n *873│ let tomb_count = u32::from_be_bytes(c.take(4)?.try_into().expect(\"took 4\"));\n 874│ let mut tombstones = Vec::new();\n *875│ for _ in 0..tomb_count {\n 876│ let pubkey_hex = dec_utf8(c.field()?, \"tombstone pubkey\")?;\n 877│ let stamp = dec_utf8(c.field()?, \"tombstone stamp\")?;\n 878│ tombstones.push(Tombstone {\n │...\n 1011│ let seed: [u8; TOTP_SEED_LEN] = c\n*1012│ .take(TOTP_SEED_LEN)?\n 1013│ .try_into()\n 1014│ .expect(\"took TOTP_SEED_LEN\");\n 1015│ let epoch = c.u64()?;\n │...\n 1092│ fn u8(&mut self) -> Result {\n*1093│ Ok(self.take(1)?[0])\n 1094│ }\n 1095│\n 1096│ fn u64(&mut self) -> Result {\n*1097│ let b = self.take(8)?;\n 1098│ Ok(u64::from_be_bytes(b.try_into().expect(\"took 8\")))\n 1099│ }\n 1100│\n │...\n 1102│ fn field(&mut self) -> Result<&'a [u8], PairWireError> {\n*1103│ let len = u32::from_be_bytes(self.take(4)?.try_into().expect(\"took 4\")) as usize;\n 1104│ if len > MAX_FRAME {\n 1105│ return Err(PairWireError::Protocol(\"field length out of range\".into()));\n 1106│ }\n*1107│ self.take(len)\n 1108│ }\n 1109│\n 1110│ fn tag(&mut self) -> Result<[u8; TAG_LEN], PairWireError> {\n*1111│ Ok(self.take(TAG_LEN)?.try_into().expect(\"took TAG_LEN\"))\n 1112│ }\n 1113│\n 1114│ /// Unread bytes left in the frame (the optional-trailing-fields probe)."},"isError":false,"timestamp":1790039687119}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_x5g12c44WM333GCRegdvkY2R|fc_03665577bed2f92d016ab1d69706b487d2bc8473e46655c934","toolName":"grep","startedAt":"2026-09-22T01:15:03.095Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt/src/**/*.rs"},"intent":"Searching remaining crate loop forms"},"id":"43f3ae8e","parentId":"163b29a9","timestamp":"2026-09-22T01:15:03.095Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_wPQAiHpFmXAlPXlv1Mm2cebY|fc_03665577bed2f92d016ab1d69706c887d28f577de764db5a72","toolName":"grep","startedAt":"2026-09-22T01:15:03.096Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs"},"intent":"Paging bounded loop inventory"},"id":"ee19c116","parentId":"43f3ae8e","timestamp":"2026-09-22T01:15:03.096Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ZHud1ZixMRBzzPoZqfopy5oz|fc_03665577bed2f92d016ab1d69706d087d2ae7203c5f7a97774","toolName":"grep","startedAt":"2026-09-22T01:15:03.096Z","args":{"path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs:2700-3300"},"intent":"Locating consumer module boundaries"},"id":"e3a63f31","parentId":"ee19c116","timestamp":"2026-09-22T01:15:03.096Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_tgwfgZmvvYv8c0xABYtlroMV|fc_03665577bed2f92d016ab1d69706d487d28c51b963bbfdd518","toolName":"read","startedAt":"2026-09-22T01:15:03.096Z","args":{"path":"xd://"},"intent":"Inspecting available intelligence devices"},"id":"c9ac3e2d","parentId":"e3a63f31","timestamp":"2026-09-22T01:15:03.096Z"}
{"type":"message","id":"1f9131dc","parentId":"c9ac3e2d","timestamp":"2026-09-22T01:15:03.096Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Narrowing the pattern**"},{"type":"toolCall","id":"call_x5g12c44WM333GCRegdvkY2R|fc_03665577bed2f92d016ab1d69706b487d2bc8473e46655c934","name":"grep","arguments":{"i":"Searching remaining crate loop forms","pattern":"^\\s*for\\s+.*\\s+in\\s+.*\\.\\.|^\\s*while\\s+.*[<>=]|\\bretry\\b|\\battempts?\\s*[+<>=]|repeat_with|\\.take_while\\(","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt/src/**/*.rs","case":true,"gitignore":true,"skip":null},"intent":"Searching remaining crate loop forms"},{"type":"toolCall","id":"call_wPQAiHpFmXAlPXlv1Mm2cebY|fc_03665577bed2f92d016ab1d69706c887d28f577de764db5a72","name":"grep","arguments":{"i":"Paging bounded loop inventory","pattern":"^\\s*for\\s+.*\\s+in\\s+.*\\.\\.|^\\s*while\\s+.*[<>=]|\\.take\\(|retry\\(|Retry::","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs","case":true,"gitignore":true,"skip":60},"intent":"Paging bounded loop inventory"},{"type":"toolCall","id":"call_ZHud1ZixMRBzzPoZqfopy5oz|fc_03665577bed2f92d016ab1d69706d087d2ae7203c5f7a97774","name":"grep","arguments":{"i":"Locating consumer module boundaries","pattern":"Brain::cold_start|\\bmod tests\\b|fn .*\\(","path":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs:2700-3300","case":true,"gitignore":true,"skip":null},"intent":"Locating consumer module boundaries"},{"type":"toolCall","id":"call_tgwfgZmvvYv8c0xABYtlroMV|fc_03665577bed2f92d016ab1d69706d487d28c51b963bbfdd518","name":"read","arguments":{"i":"Inspecting available intelligence devices","path":"xd://"},"intent":"Inspecting available intelligence devices"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":8000,"output":376,"cacheRead":47360,"cacheWrite":0,"totalTokens":55736,"reasoningTokens":13,"cost":{"input":0.08,"output":0.0188,"cacheRead":0.04736,"cacheWrite":0,"total":0.14616}},"stopReason":"toolUse","timestamp":1790039687192,"responseId":"resp_03665577bed2f92d016ab1d6877c5487d2808d993cec800ca8","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_03665577bed2f92d016ab1d68bc4c487d2845939c05a4a21a6","type":"reasoning","content":[],"encrypted_content":"gAAAAABqsdaX-cGc9tM9GyIl5UmY6nv2AvjcUH8D9GnWuyYmsaPB5b8pthk_U0Qh6JNaYHjPLKfM9ucdg_3SAzi6GrMEaAm4y_JRHXsaj5eAKM3UwWHoqnB9SLdw938R_SrrkYdRFRgVIy9xZdiw95km0vodhJ3EoSpN79NhsYQAK-fPArMVMrUTf9g-7eLxOxhGKzq0iy3hqhRFPsKAHGpXuBuXanUHHWOVmhHUw9l8qNSlE23OTxFfmI0epw3dQzaN8keFr2FeXVDU4AMrCsnn9o0AwzSc4CuUuwPpPFxcL-sH_zYMAgnZwn_mf7GT1PZO0yvOQuhXtEWnMH7nU7MxOAQDecHSFMA5wl1AqvfDORhISRBSCzVXm9CNphyQqwJ0pThlF4W0CwXU5_LGGTJtjFt_URMoOl18-2CDnOhdc8SxfxZADs-GCww38r-NKdb0UejPj18v5lI3YbctyPKUqLWYAclHozM6zpw9LO2xhmwi2yHIr-1VpXntAS5-mDDRlkcKM7V3eP4tne3-7kQfaqHzirl0Y-3G9wbpuKDjR3N7zpS92mP2qhISgNHJ_ReuT_TJWeNchPPm3A9EVgcigdrPAwK8XfbTP4OaYoEjsLAFIrJl-YEUt-6v-ukqWvFRtyt7dCCOKDVIbDpbWOscST3ouHL889q7r0EENI3Df4f3nf3nwD0SyIt8cXXeDfGN13PhQZIUzsDt5E6Dca8KC3VHF3OVyJw12NK8HQdYuisWYWG_DY_qamHoCTdAgtP13UqKfWuEt_j3XY6Xtm4g1BkslGdbm1xKz0Mi_nl1Ujk8KmPP1q_Wgpm1vKa-VzAIdlqqWWSsin28xlXpZw91z56faTzfyenn5k4sNdKLy1b_PBOrbXVq23LV1jz4OrtB_WpsWe1WrODWLfhKfuQsMTrHB8HgxT_3rMnGxz7WR9cNFouu2PZV7BDT9ut-YYOBzqmmpoN70cgCHxQ_g1Lwbxr5_95daJkmzj7NoDW49wBm6LSaVGpGuaJlS_bk9gav--ZsF_QdF3QXBk5iAzcAv6AU1G1IDtSC60Gw9sDiZNiM0wdC14EY9rGNN7OjU9Y85Zen4FEVSq28PWhPwUMA61TWAkmaS6byRzP5JL2aQTXO1r6lwumsMac9zZKHuYRJxjH8q2RovMmMLVRkwFku7Q5aQzYyjclu6PlzfUWPm2nwuNVnzyADlKUaqNvBlLIHiliECX5dehKXsBL-nWWCohOx1M5WLYG0sOES1bUqtYKz0EHt5K7z4OOgbgVloz3CJXvn5eKW5eWAyRQmEan0NifutgQclhXJKL-pMg5ZTQ7d4VOxQAfrSV1BExT-rVBoLzozTc7iML011WPBH1S0ZdDcVb38bQ==","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"summary":[{"type":"summary_text","text":"**Narrowing the pattern**"}],"metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d69706b487d2bc8473e46655c934","type":"function_call","status":"completed","arguments":"{\"i\":\"Searching remaining crate loop forms\",\"pattern\":\"^\\\\s*for\\\\s+.*\\\\s+in\\\\s+.*\\\\.\\\\.|^\\\\s*while\\\\s+.*[<>=]|\\\\bretry\\\\b|\\\\battempts?\\\\s*[+<>=]|repeat_with|\\\\.take_while\\\\(\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_x5g12c44WM333GCRegdvkY2R","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d69706c887d28f577de764db5a72","type":"function_call","status":"completed","arguments":"{\"i\":\"Paging bounded loop inventory\",\"pattern\":\"^\\\\s*for\\\\s+.*\\\\s+in\\\\s+.*\\\\.\\\\.|^\\\\s*while\\\\s+.*[<>=]|\\\\.take\\\\(|retry\\\\(|Retry::\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/*/src/**/*.rs\",\"case\":true,\"gitignore\":true,\"skip\":60}","call_id":"call_wPQAiHpFmXAlPXlv1Mm2cebY","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d69706d087d2ae7203c5f7a97774","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating consumer module boundaries\",\"pattern\":\"Brain::cold_start|\\\\bmod tests\\\\b|fn .*\\\\(\",\"path\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs:2700-3300\",\"case\":true,\"gitignore\":true,\"skip\":null}","call_id":"call_ZHud1ZixMRBzzPoZqfopy5oz","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"grep","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}},{"id":"fc_03665577bed2f92d016ab1d69706d487d28c51b963bbfdd518","type":"function_call","status":"completed","arguments":"{\"i\":\"Inspecting available intelligence devices\",\"path\":\"xd://\"}","call_id":"call_tgwfgZmvvYv8c0xABYtlroMV","internal_chat_message_metadata_passthrough":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"},"name":"read","metadata":{"turn_id":"d88f4b38-f348-4b46-97c2-c630ee6305d9"}}]},"duration":15895.196100000292,"ttft":4593.906500000507,"completedAt":1790039703094,"contextSnapshot":{"promptTokens":55360,"nonMessageTokens":10392,"compactionEpoch":0}}}
{"type":"message","id":"0a2f392e","parentId":"1f9131dc","timestamp":"2026-09-22T01:15:03.097Z","message":{"role":"toolResult","toolCallId":"call_tgwfgZmvvYv8c0xABYtlroMV|fc_03665577bed2f92d016ab1d69706d487d28c51b963bbfdd518","toolName":"read","content":[{"type":"text","text":"xd:// 1 mounted tool devices.\nxd://spt_checkpoint After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for docs + JSON schema; write the JSON args object to xd:// to execute. Active top-level tools accept the same dispatch."}],"details":{"contentType":"text/plain","totalLines":4,"displayContent":{"text":"xd:// 1 mounted tool devices.\nxd://spt_checkpoint After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for docs + JSON schema; write the JSON args object to xd:// to execute. Active top-level tools accept the same dispatch.","startLine":1,"lineNumbers":[1,2,3,4]},"meta":{"source":{"type":"internal","value":"xd://"}}},"isError":false,"timestamp":1790039703097}}
{"type":"message","id":"d0fe2bd2","parentId":"0a2f392e","timestamp":"2026-09-22T01:15:03.131Z","message":{"role":"toolResult","toolCallId":"call_ZHud1ZixMRBzzPoZqfopy5oz|fc_03665577bed2f92d016ab1d69706d087d2ae7203c5f7a97774","toolName":"grep","content":[{"type":"text","text":" 71|/// the epoch-ms stamping used elsewhere in the tree; no date dependency).\n*72|pub fn now_ms() -> u64 {\n 73| SystemTime::now()\n 74| .duration_since(UNIX_EPOCH)\n 75| .map(|d| d.as_millis() as u64)\n...\n 335| /// subtrees and re-introduce markers into terminals spt does not own).\n*336| pub fn from_env() -> Self {\n 337| if std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\") {\n 338| PumpTrace::Stderr\n 339| } else {\n...\n 358|// [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n*359|pub fn diag_trace_enabled() -> bool {\n 360| static ENABLED: std::sync::OnceLock = std::sync::OnceLock::new();\n 361| *ENABLED.get_or_init(|| PumpTrace::from_env() == PumpTrace::Stderr)\n 362|}\n...\n 372| // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n*373| fn split_with_reader(stream: Stream, trace: PumpTrace) -> BrainConn {\n 374| let (mut recv, send) = stream.split();\n 375| let (tx, frames) = mpsc::channel();\n 376| let reader = thread::Builder::new()\n...\n 440| /// When `Some`, every reply read is bounded by this per-call deadline budget\n*441| /// — set only by [`Brain::cold_start_pump`], which also splits the carrier\n 442| /// into the reader-thread form so the deadline can be honored over a channel\n 443| /// (`recv_timeout`). `None` (default) = the ordinary blocking client — a\n 444| /// brain-IPC read waits forever, which is correct everywhere EXCEPT the\n...\n 464| /// The ordinary blocking carrier ([`BrainConn::Whole`]) — every client\n*465| /// except the peer pump, which uses [`Brain::cold_start_pump`].\n*466| pub fn cold_start(name: &str, now_ms: u64) -> io::Result {\n 467| let mut conn = LocalSocketTransport::connect(name)?;\n 468| send_hello(&mut conn, Role::Brain)?;\n 469| Ok(Brain {\n...\n 498| // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n*499| pub fn cold_start_pump(\n 500| name: &str,\n 501| now_ms: u64,\n 502| io_timeout: Duration,\n...\n 538| /// **Test-only (restoration D4-3).** The production resume path is\n*539| /// [`Brain::cold_start`] + [`Brain::resume_sessions`] (broker cursor-of-record),\n 540| /// never this brain→brain frame; `handoff` survives only for the integration\n 541| /// tests. See [`BrainState`].\n 542| // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n*543| pub fn handoff(name: &str, prior: BrainState, now_ms: u64) -> io::Result {\n 544| let mut conn = LocalSocketTransport::connect(name)?;\n 545| send_hello(&mut conn, Role::Brain)?;\n 546| // DEFENSE-IN-DEPTH (P1c): seed the dedup cursor at the resume point so\n...\n 569| /// start time, never a rehydrated value.\n*570| pub fn gen_start_ms(&self) -> u64 {\n 571| self.gen_start_ms\n 572| }\n 573|\n 574| /// The generation counter (0 on cold start, +1 per handoff).\n*575| pub fn generation(&self) -> u64 {\n 576| self.generation\n 577| }\n 578|\n 579| /// The next output sequence still needed (the resume cursor).\n*580| pub fn next_seq(&self) -> u64 {\n 581| self.next_seq\n 582| }\n 583|\n 584| /// The session id the brain is driving, if any.\n*585| pub fn session_id(&self) -> Option {\n 586| self.session_id\n 587| }\n 588|\n...\n 591| /// snapshot frame; see [`BrainState`].\n*592| pub fn snapshot(&self) -> BrainState {\n 593| BrainState {\n 594| session_id: self.session_id.expect(\"snapshot before a session exists\"),\n 595| generation: self.generation,\n...\n 603| /// races ahead).\n*604| pub fn spawn_session(&mut self, req: SpawnReq) -> io::Result {\n 605| self.spawn_session_pid(req)\n 606| .map(|(session_id, _)| session_id)\n 607| }\n...\n 627| // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n*628| pub fn bring_up(&mut self, endpoint: &str, code: Option<&str>) -> io::Result {\n 629| let req = BringUpReq {\n 630| endpoint: endpoint.to_string(),\n 631| code: code.map(str::to_string),\n...\n 688| // [impl->REQ-SEAL-CEREMONY-TOTP]\n*689| pub fn seal_ceremony(\n 690| &mut self,\n 691| endpoint: &str,\n 692| subnet: &str,\n...\n 742| // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n*743| pub fn seal_ceremony_code(\n 744| &mut self,\n 745| ceremony_id: u64,\n 746| code: Option<&str>,\n...\n 770| // [impl->REQ-SEAL-ENROLL-VERB]\n*771| pub fn seal_enroll(\n 772| &mut self,\n 773| endpoint: &str,\n 774| subnet: &str,\n...\n 829| /// session) or route the frames it reads for other sessions, not drop them.\n*830| pub fn spawn_session_pid(&mut self, req: SpawnReq) -> io::Result<(u64, Option)> {\n 831| self.send(\n 832| KIND_SPAWN,\n 833| serde_json::to_value(req).expect(\"SpawnReq serializes\"),\n...\n 862| // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\n*863| pub fn spawn_session_fresh_pid(&mut self, req: SpawnReq) -> io::Result {\n 864| self.send(\n 865| KIND_SPAWN_FRESH,\n 866| serde_json::to_value(req).expect(\"SpawnReq serializes\"),\n...\n 892| /// sequenced injection), use [`Brain::send_effect`].\n*893| pub fn send_input(&mut self, bytes: &[u8]) -> io::Result<()> {\n 894| let sid = self.require_session()?;\n 895| self.send(\n 896| KIND_INPUT,\n...\n 920| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*921| pub fn send_effect(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n 922| self.send_effect_inner(op, bytes, true)\n 923| }\n 924|\n...\n 933| // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n*934| pub fn send_effect_no_ack(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n 935| self.send_effect_inner(op, bytes, false)\n 936| }\n 937|\n...\n 942| /// uncompilable. The broker's `KIND_APPLIED` still echoes the bare `seq`.\n*943| fn send_effect_inner(&mut self, op: MintedOp, bytes: &[u8], ack: bool) -> io::Result<()> {\n 944| let sid = self.require_session()?;\n 945| self.send(\n 946| KIND_INPUT,\n...\n 958| /// Resize the current session's PTY.\n*959| pub fn resize(&mut self, rows: u16, cols: u16) -> io::Result<()> {\n 960| let sid = self.require_session()?;\n 961| self.send(\n 962| KIND_RESIZE,\n...\n 972| /// Terminate the current session's child.\n*973| pub fn kill_session(&mut self) -> io::Result<()> {\n 974| let sid = self.require_session()?;\n 975| self.send(\n 976| KIND_KILL,\n...\n 993| // [impl->REQ-ENDPOINT-TEARDOWN-AUTHORITY]\n*994| pub fn teardown_session(\n 995| &mut self,\n 996| session_id: Option,\n 997| endpoint: &str,\n...\n 1011| /// A session `Exit` before the needle is found is an error (the child died).\n*1012| pub fn read_output_until(&mut self, needle: &[u8], buf: &mut Vec) -> io::Result {\n 1013| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 1014| let deadline = self.call_deadline();\n 1015| loop {\n...\n 1040| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1041| pub fn call_deadline(&self) -> Option {\n 1042| self.io_timeout.map(|d| Instant::now() + d)\n 1043| }\n 1044|\n...\n 1049| // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1050| pub fn reply_read_deadline(&self) -> Option {\n 1051| peer_reply_deadline(self.io_timeout, Instant::now())\n 1052| }\n 1053|\n...\n 1062| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1063| pub fn read_event_until(&mut self, deadline: Option) -> io::Result {\n 1064| loop {\n 1065| let env = self.read_frame_until(deadline)?;\n 1066| match env.kind.as_str() {\n...\n 1392| // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1393| pub fn read_peer_reply_until(&mut self, deadline: Option) -> io::Result {\n 1394| self.read_event_until(deadline)\n 1395| .map_err(reclassify_peer_reply_err)\n 1396| }\n...\n 1403| /// reader of a session another brain drives, not a logic handoff.\n*1404| pub fn attach(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n 1405| self.session_id = Some(session_id);\n 1406| self.next_seq = from_seq;\n 1407| // #6 (ADR-0031): a COLD attach receives a clean-screen repaint at pseudo-seq\n...\n 1426| /// [`serve_attach`]: crate::attach::serve_attach\n*1427| pub fn attach_as(\n 1428| &mut self,\n 1429| session_id: u64,\n 1430| from_seq: u64,\n...\n 1452| #[allow(clippy::too_many_arguments)]\n*1453| pub fn attach_as_coded(\n 1454| &mut self,\n 1455| session_id: u64,\n 1456| from_seq: u64,\n...\n 1499| // [impl->REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT]\n*1500| pub fn attach_skip_to_live(&mut self, session_id: u64, by: Option<&str>) -> io::Result<()> {\n 1501| self.session_id = Some(session_id);\n 1502| self.subscribe_with(session_id, u64::MAX, AttachIntent::Viewer, 0, by.map(str::to_string), None, false)?;\n 1503| self.session_cursors.insert(session_id, 0);\n...\n 1532| // [impl->REQ-HAZARD-VIEWER-RING-ROLL-SNAP]\n*1533| pub fn attach_as_viewer_snap(\n 1534| &mut self,\n 1535| session_id: u64,\n 1536| from_seq: u64,\n...\n 1594| // [doc->REQ-BRAIN-RESUME-NO-CONN-DEADLOCK]\n*1595| pub fn resume_sessions(&mut self) -> io::Result> {\n 1596| let reply = self.sessions()?;\n 1597| let total = reply.sessions.len();\n 1598| let mut resumed = Vec::with_capacity(total);\n...\n 1633| // [impl->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n*1634| pub fn resume_session_cursors(&mut self) -> io::Result> {\n 1635| let reply = self.sessions()?;\n 1636| let mut resumed = Vec::with_capacity(reply.sessions.len());\n 1637| for info in reply.sessions {\n...\n 1646| /// re-attached by [`Brain::resume_sessions`]) — observability / tests.\n*1647| pub fn session_cursor(&self, session_id: u64) -> Option {\n 1648| self.session_cursors.get(&session_id).copied()\n 1649| }\n 1650|\n...\n 1662| // [impl->REQ-HAZARD-CONTROLLER-GAP-RESUME]\n*1663| pub fn controller_resume_floor(&self) -> u64 {\n 1664| self.next_seq\n 1665| }\n 1666|\n...\n 1670| // [impl->REQ-RC-HITCH-DISCRIMINATOR]\n*1671| pub fn net_reactor_diag(&mut self) -> io::Result {\n 1672| refuse_unbounded_carrier(self, \"reactor diagnostics\")?;\n 1673| self.send(crate::msg::KIND_NET_REACTOR_DIAG, serde_json::Value::Null)?;\n 1674| let deadline = self.call_deadline();\n...\n 1689| // [impl->REQ-DAEMON-2]\n*1690| pub fn net_status(&mut self) -> io::Result {\n 1691| self.send(KIND_NET_STATUS, serde_json::Value::Null)?;\n 1692| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 1693| let deadline = self.call_deadline();\n...\n 1715| // [impl->REQ-STATUS-LIVE-SUPERVISOR-PID]\n*1716| pub fn broker_image(&mut self) -> io::Result> {\n 1717| self.send(KIND_BROKER_IMAGE, serde_json::Value::Null)?;\n 1718| let deadline = self.call_deadline();\n 1719| self.read_broker_image_until(deadline)\n...\n 1725| /// extend the total wait. `None` explicitly requests an unbounded read.\n*1726| pub fn broker_image_until(\n 1727| &mut self,\n 1728| deadline: Option,\n 1729| ) -> io::Result> {\n...\n 1733|\n*1734| fn read_broker_image_until(\n 1735| &mut self,\n 1736| deadline: Option,\n 1737| ) -> io::Result> {\n...\n 1754| /// Version-only projection of [`broker_image`](Self::broker_image).\n*1755| pub fn broker_image_version(&mut self) -> io::Result> {\n 1756| self.broker_image_version_until(None)\n 1757| }\n 1758|\n...\n 1760| /// [`broker_image_until`](Self::broker_image_until).\n*1761| pub fn broker_image_version_until(\n 1762| &mut self,\n 1763| deadline: Option,\n 1764| ) -> io::Result> {\n...\n 1777| // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*1778| pub fn announce_coordinator_image(&mut self, generation: u64) -> io::Result {\n 1779| let payload = serde_json::to_value(CoordinatorImageAnnounce {\n 1780| // spt-daemon's CARGO_PKG_VERSION == the workspace version THIS brain\n 1781| // binary was compiled at — the running image, never a disk read.\n...\n 1809| // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*1810| pub fn coordinator_image_version(&mut self) -> io::Result> {\n 1811| self.send(KIND_COORDINATOR_IMAGE, serde_json::Value::Null)?;\n 1812| let deadline = self.call_deadline();\n 1813| loop {\n...\n 1834| // [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n*1835| pub fn stall_evicts(&mut self) -> io::Result> {\n 1836| self.send(KIND_STALL_EVICTS, serde_json::Value::Null)?;\n 1837| let deadline = self.call_deadline();\n 1838| loop {\n...\n 1859| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n*1860| pub fn adapter_apply(&mut self, req: &AdapterApplyReq) -> io::Result<()> {\n 1861| self.send(\n 1862| KIND_ADAPTER_APPLY,\n 1863| serde_json::to_value(req).expect(\"AdapterApplyReq serializes\"),\n...\n 1885| // [impl->REQ-SUBNET-2]\n*1886| pub fn pair_join(\n 1887| &mut self,\n 1888| subnet: &str,\n 1889| code: &str,\n...\n 1918| // [impl->REQ-JOIN-TWO-PHASE] [impl->REQ-JOIN-DIAGNOSTICS]\n*1919| pub fn pair_meet(&mut self, subnet: &str, verbose: bool) -> io::Result {\n 1920| self.send(\n 1921| KIND_PAIR_MEET,\n 1922| serde_json::to_value(PairMeetReq {\n...\n 1944| // [impl->REQ-JOIN-TWO-PHASE]\n*1945| pub fn pair_submit_code(&mut self, session_id: u64, code: &str) -> io::Result {\n 1946| self.send(\n 1947| KIND_PAIR_CODE_SUBMIT,\n 1948| serde_json::to_value(PairCodeSubmit {\n...\n 1970| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*1971| pub fn net_dial(\n 1972| &mut self,\n 1973| addr: serde_json::Value,\n 1974| op: Option,\n...\n 2005| // [impl->REQ-PUMP-PEER-ISOLATION]\n*2006| pub fn submit_dial(&mut self, addr: serde_json::Value) -> io::Result<()> {\n 2007| self.send(\n 2008| KIND_NET_DIAL_SUBMIT,\n 2009| serde_json::to_value(NetDialReq {\n...\n 2035| // [impl->REQ-RC-1]\n*2036| pub fn net_dial_loopback(&mut self) -> io::Result {\n 2037| self.send(KIND_NET_DIAL_LOOPBACK, serde_json::Value::Null)?;\n 2038| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2039| let deadline = self.call_deadline();\n...\n 2054| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*2055| pub fn net_open_stream(\n 2056| &mut self,\n 2057| conn_id: u64,\n 2058| op: Option,\n...\n 2068| // [impl->REQ-STREAM-LEASE-CLASSES]\n*2069| pub fn net_open_stream_classed(\n 2070| &mut self,\n 2071| conn_id: u64,\n 2072| op: Option,\n...\n 2100| // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n*2101| pub fn net_stream_send(\n 2102| &mut self,\n 2103| stream_id: u64,\n 2104| bytes: &[u8],\n...\n 2135| /// finds streams (incl. peer-initiated ones) that arrived while it was down.\n*2136| pub fn net_streams(&mut self) -> io::Result {\n 2137| self.send(KIND_NET_STREAMS, serde_json::Value::Null)?;\n 2138| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2139| let deadline = self.call_deadline();\n...\n 2155| // [impl->REQ-REDISPATCH-FINISHED-RETIRE]\n*2156| pub fn net_stream_retire(&mut self, stream_id: u64) -> io::Result {\n 2157| self.net_stream_retire_with(stream_id, false)\n 2158| }\n 2159|\n...\n 2167| // [impl->REQ-ONEWAY-STREAM-TERMINAL]\n*2168| pub fn net_stream_retire_terminal(&mut self, stream_id: u64) -> io::Result {\n 2169| self.net_stream_retire_with(stream_id, true)\n 2170| }\n 2171|\n*2172| fn net_stream_retire_with(&mut self, stream_id: u64, terminal: bool) -> io::Result {\n 2173| self.send(\n 2174| KIND_NET_STREAM_RETIRE,\n 2175| serde_json::to_value(NetStreamRetireReq {\n...\n 2202| // [impl->REQ-SEAT-LIFETIME-BOUNDED]\n*2203| pub fn net_stream_unsubscribe(&mut self, stream_id: u64) -> io::Result {\n 2204| // Drop the cursor FIRST — even an error reply (older broker) must not\n 2205| // leave a cursor for a subscription the caller has abandoned.\n 2206| self.net_cursors.remove(&stream_id);\n...\n 2233| // [impl->REQ-STREAM-OPENER-DURABLE]\n*2234| pub fn net_stream_opener(&mut self, stream_id: u64) -> io::Result>> {\n 2235| self.send(\n 2236| KIND_NET_STREAM_OPENER,\n 2237| serde_json::to_value(NetStreamOpenerReq { stream_id })\n...\n 2273| // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*2274| pub fn request_brain_restart(&mut self) -> io::Result {\n 2275| self.send(KIND_BRAIN_RESTART, serde_json::Value::Null)?;\n 2276| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2277| let deadline = self.call_deadline();\n...\n 2302| // [impl->REQ-MSG-DELIVERY-AXES]\n*2303| pub fn inject_endpoint(\n 2304| &mut self,\n 2305| endpoint: &str,\n 2306| bytes: &[u8],\n...\n 2334| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2335| pub fn report_user_input(\n 2336| &mut self,\n 2337| report: crate::msg::UserInputReport,\n 2338| ) -> io::Result {\n...\n 2356| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2357| pub fn complete_input_paths(\n 2358| &mut self,\n 2359| reply: &spt_net::net::attach::InputPathReply,\n 2360| ) -> io::Result<()> {\n...\n 2366| /// dispatcher's session→endpoint resolution (D9-1).\n*2367| pub fn sessions(&mut self) -> io::Result {\n 2368| self.send(KIND_SESSIONS, serde_json::Value::Null)?;\n 2369| // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 2370| let deadline = self.call_deadline();\n...\n 2383| // [impl->REQ-DAEMON-2]\n*2384| pub fn net_stream_subscribe(&mut self, stream_id: u64, from_seq: u64) -> io::Result<()> {\n 2385| self.net_cursors.insert(stream_id, from_seq);\n 2386| self.send(\n 2387| KIND_NET_STREAM_SUBSCRIBE,\n...\n 2397| /// state a handed-off brain carries to resubscribe gaplessly).\n*2398| pub fn net_cursor(&self, stream_id: u64) -> Option {\n 2399| self.net_cursors.get(&stream_id).copied()\n 2400| }\n 2401|\n...\n 2405| // [impl->REQ-EP-4]\n*2406| pub fn net_presence_subscribe(&mut self, from_seq: u64) -> io::Result<()> {\n 2407| self.presence_cursor = Some(from_seq);\n 2408| self.send(\n 2409| KIND_NET_PRESENCE_SUBSCRIBE,\n...\n 2416| /// brain carries to resubscribe gaplessly).\n*2417| pub fn presence_cursor(&self) -> Option {\n 2418| self.presence_cursor\n 2419| }\n 2420|\n...\n 2432| // [impl->REQ-PUMP-PEER-ISOLATION]\n*2433| pub fn net_presence_subscribe_tail(&mut self) -> io::Result<()> {\n 2434| self.presence_cursor = None; // baseline on the first live event (no floor)\n 2435| self.send(\n 2436| KIND_NET_PRESENCE_SUBSCRIBE,\n...\n 2481| // [doc->REQ-BRAIN-RESUME-NO-CONTROL-STEAL]\n*2482| fn subscribe(&mut self, session_id: u64, from_seq: u64) -> io::Result<()> {\n 2483| self.subscribe_with(session_id, from_seq, Self::SUBSCRIBE_INTENT, 0, None, None, false)\n 2484| }\n 2485|\n...\n 2489| /// promptly. Best-effort: a dropped connection clears the role anyway.\n*2490| pub fn detach_session(&mut self, session_id: u64) -> io::Result<()> {\n 2491| self.detach_session_gen(session_id, None)\n 2492| }\n 2493|\n...\n 2497| // [impl->REQ-SERVE-OWNERSHIP-GENERATION]\n*2498| pub fn detach_session_gen(&mut self, session_id: u64, gen: Option) -> io::Result<()> {\n 2499| self.send(\n 2500| KIND_UNSUBSCRIBE,\n 2501| serde_json::to_value(UnsubscribeReq { session_id, gen })\n...\n 2510| #[allow(clippy::too_many_arguments)]\n*2511| fn subscribe_with(\n 2512| &mut self,\n 2513| session_id: u64,\n 2514| from_seq: u64,\n...\n 2553|\n*2554| fn send(&mut self, kind: &str, payload: serde_json::Value) -> io::Result<()> {\n 2555| let env = Envelope::new(kind, payload);\n 2556| match &mut self.conn {\n 2557| BrainConn::Whole(stream) => write_frame(stream, &env),\n...\n 2581| // [impl->REQ-IPC-DEADLINE-UNHONORABLE-REFUSED]\n*2582| fn read_frame_until(&mut self, deadline: Option) -> io::Result {\n 2583| match &mut self.conn {\n 2584| // Absent stays absent: no fabricated default bound on the blocking\n 2585| // read (the absent-is-not-zero shape, releases#201).\n...\n 2591| half-read frame and desync the conn. Build the client with \\\n*2592| `Brain::cold_start_pump` (the Split reader-thread carrier), which \\\n 2593| bounds every read; or pass no deadline to read unbounded on purpose\",\n 2594| )),\n 2595| BrainConn::Split { frames, .. } => match deadline {\n...\n 2624|\n*2625| fn require_session(&self) -> io::Result {\n 2626| self.session_id\n 2627| .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, \"no active session\"))\n 2628| }\n...\n 2653|// [impl->REQ-WAN-REPLY-BOUND]\n*2654|pub(crate) fn refuse_unbounded_carrier(brain: &Brain, verb: &str) -> io::Result<()> {\n 2655| if brain.reply_read_deadline().is_none() {\n 2656| return Err(io::Error::other(format!(\n*2657| \"{verb} needs a pump-mode brain (Brain::cold_start_pump): a blocking \\\n 2658| carrier cannot time out a peer that accepts the stream and then \\\n 2659| never answers - its reads do not IGNORE a deadline, they REFUSE one\"\n 2660| )));\n...\n 2668|// [impl->REQ-PUMP-DIAL-FASTFAIL]\n*2669|pub(crate) fn peer_reply_deadline(io_timeout: Option, now: Instant) -> Option {\n 2670| io_timeout.map(|d| now + d.min(PEER_REPLY_READ_BUDGET))\n 2671|}\n 2672|\n...\n 2679|// [impl->REQ-PUMP-DIAL-FASTFAIL]\n*2680|pub(crate) fn reclassify_peer_reply_err(e: io::Error) -> io::Error {\n 2681| if e.kind() == io::ErrorKind::TimedOut {\n 2682| // NON-poison kind (Other) => peer_outcome's ordinary per-peer drop arm.\n 2683| io::Error::other(format!(\n...\n 2691|/// Whether `haystack` contains the contiguous `needle`.\n*2692|fn contains(haystack: &[u8], needle: &[u8]) -> bool {\n 2693| if needle.is_empty() {\n 2694| return true;\n 2695| }\n...\n 2699|#[cfg(test)]\n*2700|mod tests {\n 2701| use super::*;\n 2702| use crate::msg::{output_envelope, sync_output_envelope};\n 2703| use crate::transport::DaemonTransport;\n...\n 2711| #[test]\n*2712| fn peer_reply_deadline_caps_below_carrier_deadline() {\n 2713| let now = Instant::now();\n 2714| // Pump mode, 30s carrier: reply-read capped to the 10s budget.\n 2715| let d = peer_reply_deadline(Some(Duration::from_secs(30)), now).expect(\"pump = Some\");\n...\n 2733| #[test]\n*2734| fn an_unbounded_carrier_is_refused_and_the_message_names_the_constructor() {\n 2735| let (brain, _stub) = brain_with_stub();\n 2736| assert!(\n 2737| brain.reply_read_deadline().is_none(),\n...\n 2761| #[test]\n*2762| fn reclassify_peer_reply_maps_timeout_off_poison() {\n 2763| let t = reclassify_peer_reply_err(io::Error::new(io::ErrorKind::TimedOut, \"silent peer\"));\n 2764| assert_ne!(t.kind(), io::ErrorKind::TimedOut, \"no longer the poison kind\");\n 2765| assert_eq!(t.kind(), io::ErrorKind::Other);\n...\n 2775| /// Unique namespaced socket name per test (parallel test threads never collide).\n*2776| fn unique_name() -> String {\n 2777| static SEQ: AtomicU32 = AtomicU32::new(0);\n 2778| format!(\n 2779| \"spt-daemon-brain-ut-{}-{}.sock\",\n...\n 2805| /// frames are tiny. We drop the recv half so it does not hold resources.)\n*2806| fn brain_with_stub() -> (Brain, StubBroker) {\n 2807| let name = unique_name();\n 2808| let listener = LocalSocketTransport::bind(&name).expect(\"bind stub listener\");\n 2809|\n...\n 2812| let brain_handle =\n*2813| thread::spawn(move || Brain::cold_start(&connect_name, 1).expect(\"brain cold_start\"));\n 2814|\n 2815| let mut server = listener.accept().expect(\"accept the brain\");\n 2816| crate::transport::recv_hello(&mut server, Role::Brain).expect(\"stub recv_hello\");\n...\n 2850| #[test]\n*2851| fn cold_brain_still_rejects_a_forward_output_gap() {\n 2852| let sid = 1u64;\n 2853| let (mut brain, stub) = brain_with_stub();\n 2854|\n...\n 2902| #[test]\n*2903| fn controller_resume_from_floor_refetches_after_a_gap() {\n 2904| let sid = 1u64;\n 2905| let (mut brain, stub) = brain_with_stub();\n 2906|\n...\n 3019| #[test]\n*3020| fn a_flagged_sync_frame_baselines_forward_never_backward_on_both_paths() {\n 3021| let sid = 1u64;\n 3022|\n 3023| // ── LEGACY strict path ──────────────────────────────────────────────\n...\n 3104| #[test]\n*3105| fn an_old_broker_wire_without_the_sync_key_keeps_every_legacy_path() {\n 3106| let sid = 1u64;\n 3107| // The absent key deserializes to false (the resume_seq additive shape).\n 3108| let old: OutputEvent = serde_json::from_str(\n...\n 3156| #[test]\n*3157| fn skip_to_live_accepts_a_forward_seq_jump_via_snap_above() {\n 3158| let sid = 1u64;\n 3159| let (mut brain, stub) = brain_with_stub();\n 3160|\n...\n 3235| #[test]\n*3236| fn viewer_snap_attach_accepts_a_forward_output_gap() {\n 3237| const FROM: u64 = 100;\n 3238| let sid = 1u64;\n 3239| let (mut brain, stub) = brain_with_stub();"}],"details":{"scopePath":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","searchPath":"C:/Users/decid/Documents/projects/spt-core/.worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":105,"fileCount":1,"files":[".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs"],"fileMatches":[{"path":".worktrees/318-h3-infra-register/crates/spt-daemon/src/brain.rs","count":105}],"truncated":false,"displayContent":" 71│/// the epoch-ms stamping used elsewhere in the tree; no date dependency).\n *72│pub fn now_ms() -> u64 {\n 73│ SystemTime::now()\n 74│ .duration_since(UNIX_EPOCH)\n 75│ .map(|d| d.as_millis() as u64)\n │...\n 335│ /// subtrees and re-introduce markers into terminals spt does not own).\n *336│ pub fn from_env() -> Self {\n 337│ if std::env::var(\"SPT_PUMP_TRACE\").as_deref() == Ok(\"1\") {\n 338│ PumpTrace::Stderr\n 339│ } else {\n │...\n 358│// [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n *359│pub fn diag_trace_enabled() -> bool {\n 360│ static ENABLED: std::sync::OnceLock = std::sync::OnceLock::new();\n 361│ *ENABLED.get_or_init(|| PumpTrace::from_env() == PumpTrace::Stderr)\n 362│}\n │...\n 372│ // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n *373│ fn split_with_reader(stream: Stream, trace: PumpTrace) -> BrainConn {\n 374│ let (mut recv, send) = stream.split();\n 375│ let (tx, frames) = mpsc::channel();\n 376│ let reader = thread::Builder::new()\n │...\n 440│ /// When `Some`, every reply read is bounded by this per-call deadline budget\n *441│ /// — set only by [`Brain::cold_start_pump`], which also splits the carrier\n 442│ /// into the reader-thread form so the deadline can be honored over a channel\n 443│ /// (`recv_timeout`). `None` (default) = the ordinary blocking client — a\n 444│ /// brain-IPC read waits forever, which is correct everywhere EXCEPT the\n │...\n 464│ /// The ordinary blocking carrier ([`BrainConn::Whole`]) — every client\n *465│ /// except the peer pump, which uses [`Brain::cold_start_pump`].\n *466│ pub fn cold_start(name: &str, now_ms: u64) -> io::Result {\n 467│ let mut conn = LocalSocketTransport::connect(name)?;\n 468│ send_hello(&mut conn, Role::Brain)?;\n 469│ Ok(Brain {\n │...\n 498│ // [impl->REQ-RC-DISPLAY-SOLE-WRITER]\n *499│ pub fn cold_start_pump(\n 500│ name: &str,\n 501│ now_ms: u64,\n 502│ io_timeout: Duration,\n │...\n 538│ /// **Test-only (restoration D4-3).** The production resume path is\n *539│ /// [`Brain::cold_start`] + [`Brain::resume_sessions`] (broker cursor-of-record),\n 540│ /// never this brain→brain frame; `handoff` survives only for the integration\n 541│ /// tests. See [`BrainState`].\n 542│ // [impl->REQ-HAZARD-CONTROLLER-WRITER-REORDER]\n *543│ pub fn handoff(name: &str, prior: BrainState, now_ms: u64) -> io::Result {\n 544│ let mut conn = LocalSocketTransport::connect(name)?;\n 545│ send_hello(&mut conn, Role::Brain)?;\n 546│ // DEFENSE-IN-DEPTH (P1c): seed the dedup cursor at the resume point so\n │...\n 569│ /// start time, never a rehydrated value.\n *570│ pub fn gen_start_ms(&self) -> u64 {\n 571│ self.gen_start_ms\n 572│ }\n 573│\n 574│ /// The generation counter (0 on cold start, +1 per handoff).\n *575│ pub fn generation(&self) -> u64 {\n 576│ self.generation\n 577│ }\n 578│\n 579│ /// The next output sequence still needed (the resume cursor).\n *580│ pub fn next_seq(&self) -> u64 {\n 581│ self.next_seq\n 582│ }\n 583│\n 584│ /// The session id the brain is driving, if any.\n *585│ pub fn session_id(&self) -> Option {\n 586│ self.session_id\n 587│ }\n 588│\n │...\n 591│ /// snapshot frame; see [`BrainState`].\n *592│ pub fn snapshot(&self) -> BrainState {\n 593│ BrainState {\n 594│ session_id: self.session_id.expect(\"snapshot before a session exists\"),\n 595│ generation: self.generation,\n │...\n 603│ /// races ahead).\n *604│ pub fn spawn_session(&mut self, req: SpawnReq) -> io::Result {\n 605│ self.spawn_session_pid(req)\n 606│ .map(|(session_id, _)| session_id)\n 607│ }\n │...\n 627│ // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n *628│ pub fn bring_up(&mut self, endpoint: &str, code: Option<&str>) -> io::Result {\n 629│ let req = BringUpReq {\n 630│ endpoint: endpoint.to_string(),\n 631│ code: code.map(str::to_string),\n │...\n 688│ // [impl->REQ-SEAL-CEREMONY-TOTP]\n *689│ pub fn seal_ceremony(\n 690│ &mut self,\n 691│ endpoint: &str,\n 692│ subnet: &str,\n │...\n 742│ // [impl->REQ-SEAL-FIDO2-RC-CLIENT]\n *743│ pub fn seal_ceremony_code(\n 744│ &mut self,\n 745│ ceremony_id: u64,\n 746│ code: Option<&str>,\n │...\n 770│ // [impl->REQ-SEAL-ENROLL-VERB]\n *771│ pub fn seal_enroll(\n 772│ &mut self,\n 773│ endpoint: &str,\n 774│ subnet: &str,\n │...\n 829│ /// session) or route the frames it reads for other sessions, not drop them.\n *830│ pub fn spawn_session_pid(&mut self, req: SpawnReq) -> io::Result<(u64, Option)> {\n 831│ self.send(\n 832│ KIND_SPAWN,\n 833│ serde_json::to_value(req).expect(\"SpawnReq serializes\"),\n │...\n 862│ // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\n *863│ pub fn spawn_session_fresh_pid(&mut self, req: SpawnReq) -> io::Result {\n 864│ self.send(\n 865│ KIND_SPAWN_FRESH,\n 866│ serde_json::to_value(req).expect(\"SpawnReq serializes\"),\n │...\n 892│ /// sequenced injection), use [`Brain::send_effect`].\n *893│ pub fn send_input(&mut self, bytes: &[u8]) -> io::Result<()> {\n 894│ let sid = self.require_session()?;\n 895│ self.send(\n 896│ KIND_INPUT,\n │...\n 920│ // [impl->REQ-HAZARD-RESTART-IDEMPOTENT]\n *921│ pub fn send_effect(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n 922│ self.send_effect_inner(op, bytes, true)\n 923│ }\n 924│\n │...\n 933│ // [impl->REQ-HAZARD-INPUT-ACK-BACKPRESSURE]\n *934│ pub fn send_effect_no_ack(&mut self, op: MintedOp, bytes: &[u8]) -> io::Result<()> {\n 935│ self.send_effect_inner(op, bytes, false)\n 936│ }\n 937│\n │...\n 942│ /// uncompilable. The broker's `KIND_APPLIED` still echoes the bare `seq`.\n *943│ fn send_effect_inner(&mut self, op: MintedOp, bytes: &[u8], ack: bool) -> io::Result<()> {\n 944│ let sid = self.require_session()?;\n 945│ self.send(\n 946│ KIND_INPUT,\n │...\n 958│ /// Resize the current session's PTY.\n *959│ pub fn resize(&mut self, rows: u16, cols: u16) -> io::Result<()> {\n 960│ let sid = self.require_session()?;\n 961│ self.send(\n 962│ KIND_RESIZE,\n │...\n 972│ /// Terminate the current session's child.\n *973│ pub fn kill_session(&mut self) -> io::Result<()> {\n 974│ let sid = self.require_session()?;\n 975│ self.send(\n 976│ KIND_KILL,\n │...\n 993│ // [impl->REQ-ENDPOINT-TEARDOWN-AUTHORITY]\n *994│ pub fn teardown_session(\n 995│ &mut self,\n 996│ session_id: Option,\n 997│ endpoint: &str,\n │...\n 1011│ /// A session `Exit` before the needle is found is an error (the child died).\n*1012│ pub fn read_output_until(&mut self, needle: &[u8], buf: &mut Vec) -> io::Result {\n 1013│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n 1014│ let deadline = self.call_deadline();\n 1015│ loop {\n │...\n 1040│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1041│ pub fn call_deadline(&self) -> Option {\n 1042│ self.io_timeout.map(|d| Instant::now() + d)\n 1043│ }\n 1044│\n │...\n 1049│ // [impl->REQ-PUMP-DIAL-FASTFAIL]\n*1050│ pub fn reply_read_deadline(&self) -> Option {\n 1051│ peer_reply_deadline(self.io_timeout, Instant::now())\n 1052│ }\n 1053│\n │...\n 1062│ // [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\n*1063│ pub fn read_event_until(&mut self, deadline: Option) -> io::Result