{
  "summary": "One-cell native recipe located. Requires candidate spt.exe plus Cargo-built refresh_rig_fixture.exe/test harness, Python 3 and PowerShell 7; no mock adapter build. Existing native launcher already bounds the rig at 220s (Rust watchdog 230s). Existing pool controller is preserved with provenance. Fresh hertz-307-ack-jitter target is absent; generic local-lane.py explicitly refuses cold pools, so it is not a drop-in cold-build admission wrapper. No commands, builds, tests, pool actions or lifecycle actions executed.",
  "files": [
    {
      "path": "crates/spt-daemon/tests/refresh_freeze.rs",
      "description": "Windows-only real integration cell; binary/env pins, config, native launch and receipt assertions (lines 1-163)."
    },
    {
      "path": "crates/spt-daemon/tests/support/refresh_freeze/launch-v2.ps1",
      "description": "Native wrapper parameters, absolute/fresh output requirements, Add-Type launch-v2.cs; lines 1-116."
    },
    {
      "path": "crates/spt-daemon/tests/support/refresh_freeze/launch-v2.cs",
      "description": "Birth-contained process ownership and native deadline/exit handling; lines 521-614."
    },
    {
      "path": "crates/spt-daemon/tests/support/refresh_freeze/rig.py",
      "description": "Fresh-home/source-hash guards, independent producer, environment scrub, dynamically created adapter/source fixtures; lines 247-293 and 383-399."
    },
    {
      "path": "crates/spt-daemon/tests/fixtures/refresh_rig_fixture.rs",
      "description": "Only external socket-name fixture; requires absolute explicit SPT_HOME and prints home/broker/seed names."
    },
    {
      "path": ".spt/preserved/307/gate-228/driver.ps1",
      "description": "Prior real invocation: minimal spt/xtask prebuild and nextest exact cell with ci-windows, retries=0, no-capture; lines 34-76."
    },
    {
      "path": ".github/ci/local-lane.py",
      "description": "Existing warm-pool allocated lane driver with resource sampling, lane lock, census, bounded producers and receipts; not usable unchanged for absent/cold target."
    },
    {
      "path": ".github/ci/ws272-w0.py",
      "description": "Reusable existing identity scrub, lane serialization, golden preflight and disk meter; preflight checks golden workflow only."
    },
    {
      "path": ".github/ci/reap-census.ps1",
      "description": "start=census only; end/prerelink=reap plus census. Roots driven by GITHUB_WORKSPACE/CARGO_TARGET_DIR/RUNNER_TEMP; not blanket machine cleanup."
    },
    {
      "path": ".spt/preserved/302/todlando-step3-field/pool-controller.exe",
      "description": "Existing standalone xtask copy suitable for claim/release from caller's own worktree; file located, not executed or rehashed."
    },
    {
      "path": ".spt/preserved/302/todlando-step3-field/pool-controller-provenance.json",
      "description": "Recorded SHA256 2ec9a1f93ce4d52454c49a5c01593e6a292ca75286dc5798d26a0ed6858e01bf; restricted purpose pool claim/release, not candidate subject/docs generator."
    },
    {
      "path": "docs/GOLDEN-CI.md",
      "description": "Quiet-window and process-parent attribution rules, lines 26-53."
    },
    {
      "path": "AGENTS.md",
      "description": "Binding source-tree/pool relation, claim-last-writer-wins warning, sequential takeover and teardown rules, lines 38-41."
    }
  ],
  "architecture": "Cargo harness hashes selected candidate, emits fresh config/argv/environment files, starts PowerShell native launcher; launcher assigns suspended Python to owned kill-on-close Job before resume. Python creates isolated executable/home/adapter/producer, exercises real refresh and writes observation/receipt.json. Rust asserts native teardown and observable PASS. Pool/admission wrappers are separate: native process-tree admission is containment, not quiet/resource admission.",
  "report": "EXACT ONE-CELL RECIPE FOR MAIN (instructions only; not executed)\n\nLet Tree = C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-307-ack-jitter; Target = Tree\\target; Controller = C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\302\\todlando-step3-field\\pool-controller.exe; Out = a NEW absolute preserved output directory (e.g. .spt\\preserved\\307\\ack-jitter-repin\\live-<unique>). Run from Tree, under Main's existing admitted/supervised driver, not an ephemeral claim-only shell.\n\n1. Before any producer: obtain quiet/resource admission; record source identity and controller hash. Remove inherited CARGO_TARGET_DIR/SPT_POOL_UNCHECKED and stale SPT_REFRESH_RIG_* selection variables, scrub perch identity (OWL_SESSION_ID, SPT_AGENT_ID, SPT_ENDPOINT_ID, SPT_SESSION_NAME, SPT_ADAPTER, SPT_HOST_PID, SPT_INJECT_VERIFY_ECHO; ws272-w0.py:40-59), remove inherited attach deadline/watchdog overrides. Set CARGO_TARGET_DIR=Target explicitly. Set private temp and GITHUB_WORKSPACE=Tree if using census; NEVER root census at shared repository root containing sibling worktrees.\n2. Existing controller claim (cwd Tree): & $Controller pool-claim --pool $Target --label hertz-307-ack-jitter [--holder-pid <long-lived-own-driver-pid>]. No cargo bootstrap needed for controller. Own-tree pool needs no --foreign-pool. Claim from persistent driver so advisory holder survives individual cargo invocations (xtask main.rs:3277-3345). Claim itself is last-writer-wins, NOT a live-lane safety check; inspect custody before takeover (AGENTS.md:40).\n3. Minimal explicit product prebuild: cargo build -p spt --bin spt. The integration test's Cargo build supplies refresh_rig_fixture.exe via env!(CARGO_BIN_EXE_refresh_rig_fixture); declared in crates/spt-daemon/Cargo.toml:45-47. If prebuilding all minimum inputs separately: cargo build -p spt-daemon --bin refresh_rig_fixture, plus the nextest list/build for the exact test. No xtask rebuild, mock-session/mock-shell, notify adapter, or workspace-wide build is a prerequisite. rig.py:383-397 creates evidencerig manifests and copies spt.exe as psychebin.exe itself.\n4. Set SPT_REFRESH_RIG_PYTHON='C:\\Program Files\\Python312\\python.exe'; SPT_REFRESH_RIG_SPT=Target\\debug\\spt.exe; SPT_REFRESH_RIG_EXPECTED_SHA256=(Get-FileHash -Algorithm SHA256 candidate).Hash.ToLower(); SPT_REFRESH_RIG_OUTPUT=Out. Keep these pins through the cell. Python path is grounded in hertz-w2-regression/golden-python-fixup.json (prior empty-PATH interactive proof) and gate-228 driver.ps1:9,20. Rust independently discovers sys.executable and demands absolute existing file.\n5. Inventory exact selection before run: cargo nextest list -p spt-daemon --test refresh_freeze --profile ci-windows -E 'test(=refresh_resumes_bounded_input_ack_without_replacement_poison)'. Require precisely one selected Windows cell, not just command success.\n6. Actual historical command: cargo nextest run -p spt-daemon --test refresh_freeze --profile ci-windows --retries 0 -E 'test(=refresh_resumes_bounded_input_ack_without_replacement_poison)' --no-capture. Gate-228 driver.ps1:34-35,64-75. Explicit --test-threads 1 is harmless for this one-cell selection. Do not use ignored/test-stub mode; Windows cfg is required. Rust cfg(windows) means non-Windows zero-cell success proves nothing.\n7. Preserve candidate hash, cargo argv/stdout/stderr/exit, source identity, admission/census/resource artifacts and Out tree. Release only own pool via Controller pool-release --pool Target after owned producer teardown proven. No pool deletion required.\n\nBOUNDARIES / OUTPUT\nrefresh_freeze.rs:71-88 sets observation_seconds=150, teardown_seconds=60, ack_bound_ms=2000, recovery_bound_ms=15000, baseline_seconds=30, post_refresh_seconds=25. Leave bounds unchanged. Native launch uses -Label refresh-freeze -Seconds 220 -Admission process-tree -Scope step and Rust waits up to230s (lines106-139). nextest default backstop is60s ×4=240s, inherited by ci-windows (.config/nextest.toml:23,430-431). A supervisor deadline must leave room for this 230–240s path and separate Cargo compilation; do not give the whole compile+cell only220s. Native launcher exit124=deadline,126=confirmation/status failure,127=setup refused, otherwise actual subject exit (launch-v2.cs:608-614). Native launcher is already contained at birth; no new guard implementation required.\nOut/config.json and Out/observation must not preexist (Rust:61-73); launch destinations must be absolute, unaliased and new (launch-v2.ps1:65-89). Relative caller output is canonicalized by Rust, but absolute is safer. Expected evidence: Out/observation/receipt.json status PASS; Out/native.json termination CONFIRMED_GONE, job.active_processes=0; stdout/stderr, native.json.events.jsonl; observation/events.jsonl, teardown.json, rc progress/chunks, command records, before/after daemon logs. Native wrapper receipt is NOT the observable rig receipt. Gate-228/rig-2/native.json records prior native exit0, coverage COMPLETE, termination CONFIRMED_GONE, active_processes0; prior config confirms same unchanged bounds. Receipt scout owns detailed recovery metrics.\nPython rig scrubs every SPT_/OWL_/CLAUDE_ variable then sets SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1, SPT_INSTALL_NO_FIREWALL=1, SPT_PUMP_TRACE=1, PYTHONUNBUFFERED=1 (rig.py:270-274); checks candidate SHA, producer.py presence and home vs resident installation; socket helper computes real socket names. Do not set resident SPT_HOME or run a resident lifecycle command. Support files needed beside rig.py: producer.py, launch-v2.ps1, launch-v2.cs; stdlib-only rig, PowerShell Add-Type compilation is part of native setup.\n\nEXISTING ADMISSION/SUPERVISION OPTIONS AND LIMITATIONS\n.github/ci/local-lane.py is the general existing allocated-lane wrapper: python <Tree>\\.github\\ci\\local-lane.py --plan <absolute-plan.json> --output <new-wrapper-output> --xtask <prebuilt-xtask> --hold-released. Plan requires positive reserve_bytes/max_growth_bytes, reserve>=32GiB, exact warm-cache rustc -Vv stdout and nonempty bounded steps (270-305). Admission requires free>=reserve+growth; running refuses free<=reserve or aggregate drop>=growth (42-46,157-170). It samples every0.5s, owns retained Popen and birth-identified descendants, writes *.command.json/*.raw/*.exit/*.observation.json, capacity.jsonl, environment/toolchain/selection/census receipts (199-270). It claims/releases own target and takes .spt/driver.lock.\nCritical: target/debug/deps, target/.rustc_info.json and real .rlib/.rmeta must already exist; matching toolchain, same build/temp volume, no reparse target; cold target explicitly refuses (325-356). Glob found no hertz-307-ack-jitter/target at inspection. Thus generic local-lane cannot bootstrap this fresh tree unchanged; use existing approved cold-build route/allocation rather than pretend warm admission. Do not repurpose fixed W0/W1/W2 drivers: their batteries are broad and would exceed this assignment. Existing preserved cold-build precedent is .spt/preserved/302/todlando-step3-field/run.py:44-47,74-78 and handoff.txt:27 (96GiB admission/32GiB emergency/64GiB cap); these are that lane's authorization, NOT automatic authorization for this lane.\nlocal-lane also forbids raw cargo test/nextest argv steps; nextest schema accepts packages/filter/profile only (49-62,300-304), so it cannot express historical --test refresh_freeze or --retries0 directly and may compile broader package targets. Narrow filter can select one cell but not necessarily minimize compilation. Do not silently route raw cargo through a shell to evade this guard. It needs psutil (rig itself does not).\nIts golden preflight is only golden.yml (ws272-w0.py:36-105), not all CI, and builder_snapshot merely records sampled builders, does NOT refuse for their presence (local-lane.py:141-155,370). Therefore wrapper success is not the full documented quiet-box proof. Main must separately satisfy docs/GOLDEN-CI.md:30-53: zero nonterminal CI runs AND no local cargo/rustc/cargo-nextest; inspect authoritative Runner.Worker process occupancy and parent-chain attribution. queued is not idle. CI-owned cargo isn't a second occupant, but CI is still an occupied axis. Do not infer current activity from these historical rules.\nTwohost-b overlap: any nonterminal coordinated golden leg keeps golden preflight HOLD, even if Windows test leg finished and twohost-b runs on kitsubito. docs/INFRA-REGISTER.md:5139-5179 records IR-87 foreign-run runner starvation and disjoint role lifetimes; golden jobs releasing after test is not exclusive runner reservation. Do not take a locally quiet-looking Windows interval as permission to overlap an unfinished golden/twohost-b run. No current runner activity was inspected.\nCensus: .github/ci/reap-census.ps1 -Phase start -Strict is observation only; end/prerelink actually reaps. local-lane's census_clear additionally demands last scoped=0 and unreadable_path=0; script start itself returns0 even when contaminated (local-lane.py:118-138; reap-census.ps1:172-180). Unreadable session0 paths never mean clear and are never killed. Existing census also includes USERPROFILE\\spt-n1-oldbroker scope; know that boundary before any authorized end-phase use. Rig's own copied preserved executable may be outside own-tree census roots: its native Job and observation teardown are the authoritative cleanup evidence, not an empty cargo-root census.\n\nCONTROLLER PROVENANCE\n.spt/preserved/302/todlando-step3-field/pool-controller.exe exists. pool-controller-provenance.json records source .worktrees/gate-302-712c987f/target/debug/xtask.exe and SHA256 2ec9a1f93ce4d52454c49a5c01593e6a292ca75286dc5798d26a0ed6858e01bf, purpose claim/release only with cwd lane identity. run.py:68-78 checks that hash before invoking. I did not execute or rehash it. Main should verify bytes against this recorded hash before use; do not use this historical helper for candidate generation/docs validation. No other agent sessions inspected."
}