comment #308
Fix sizing (todlando, read-only source review at 7890ead3, 2026-09-14 14:06Z; no edits, no lane opened).

RCA CONFIRMED from source. One `REGISTRY_WRITE` declaration (crates/spt-daemon/src/servehost.rs:18-20) but two PROCESSES hold independent instances: broker `apply_at` (servehost.rs:171, arms Add/Attach/AddScoped/AddInputReference/Remove/Reconcile + List) and brain `with_registry_write` (servehost.rs:148, called from livehost.rs:1287 by the 5 s reconciliation reaper). crates/spt-store/src/serving.rs `load_at` has no lock; `save_at` serializes the WHOLE registry and atomic-renames it with no compare-and-swap — atomic publication prevents torn JSON, not lost updates. The stale-write path (brain loads R0; broker adds alpha, saves R1; brain saves its stale R0 minus the expired entry, erasing alpha; broker adds beta) reproduces the reported membership exactly. Inferred interleaving, not a captured trace. The overwrite also clobbers next_suffix and name_owners (serving.rs:126-133), so orphaned snapshot bytes and lost name-ownership history (ADR-0057 stale-link identity) are source-derived risks of the same defect.

A green 10x cohort would NOT refute this gap. ARM11's identity assertion must not be weakened or retried.

Minimal fix: ONE per-registry CROSS-PROCESS file-lock guard, owned by spt-store (serving.rs; reuse the fs2 sentinel pattern at info.rs:871-886, fs2 0.4 already a dep — no new dependency; sentinel e.g. serve/.registry.lock, derived in one owner). Acquire BEFORE the fresh load, hold through mutation, snapshot side effects/rollback and durable publication. servehost.rs drops the static mutex for the store guard (six arms keep their explicit save/error behaviour); livehost.rs acquires the same guard around reap → unlink → save. Do NOT lock only save_at (snapshot already stale), do NOT lock the registry file itself (atomic rename swaps it), do NOT unlink the sentinel on unlock, do NOT auto-save from a generic wrapper (no-op paths publish nothing). HTTP readers stay lock-free atomic snapshot reads; Docs/LAN bypasses preserved.

Blast radius: 3 runtime files (serving.rs, servehost.rs, livehost.rs) + 2 e2e files that mutate the registry under a live daemon (webserve_attachment_e2e.rs:676-708, webserve_cross_node_e2e.rs:662-762 — after ARM11, not this incident's cause) + a two-process regression replacing the two-thread test at servehost.rs:703-756 (worker-bin fixture pattern, tests/wtlock_two_process_int.rs) ≈ 8 code/manifest files + traceability/docs/changelog. No JSON schema, CLI, URL, TTL or production dependency change.

ROLLOUT CONSTRAINT: the lock coordinates only participating binaries — both broker AND brain must run the fixed implementation; an old broker with a new brain remains unsafe. Serialization can delay the brain pulse behind a large attachment save and vice versa; lock failure must stay an error, never proceed unlocked.

Milestone home: operator ruling pending (stop-and-referred via lia). No edit GO issued.