# Preservation + same-worktree handoff plan — 304-w2-repr to 85f84d73

NOT COMMISSIONED. No checkout change, no claim, no cargo. Every command below is written to be run
from the worktree it acts on. WT = C:\Users\decid\Documents\projects\spt-core\.worktrees\304-w2-repr
PRES = C:\Users\decid\Documents\projects\spt-core\.spt\preserved\attested-304-w2-repr-20260912

## Phase 0 — preservation, BEFORE anything else touches the tree

Measured source set (hashes taken 2026-09-12, read-only):

| artifact | bytes | sha256 (12) |
|---|---|---|
| target\release\spt.exe | 38,411,776 | edd3d8e05666 |
| target\release\deps\spt.exe | 38,411,776 | edd3d8e05666 |
| target\release\spt.pdb | 12,455,936 | 16b6f15f69c2 |

Set is provisional pending hertz's answer on whether debug\deps\spt_daemon-8ceb80bef5261bf4.exe is
attested evidence or rebuildable cache. Rebuildable cache is NOT preserved.

```powershell
$WT   = 'C:\Users\decid\Documents\projects\spt-core\.worktrees\304-w2-repr'
$PRES = 'C:\Users\decid\Documents\projects\spt-core\.spt\preserved\attested-304-w2-repr-20260912'
New-Item -ItemType Directory -Force -Path $PRES | Out-Null

$set = @(
  'target\release\spt.exe',
  'target\release\deps\spt.exe',
  'target\release\spt.pdb'
)

# 1. hash at source, 2. copy, 3. re-hash at destination, 4. COMPARE and refuse on mismatch
$manifest = foreach ($rel in $set) {
    $src = Join-Path $WT $rel
    $dst = Join-Path $PRES ($rel -replace '[\]', '__')
    $h1  = (Get-FileHash $src -Algorithm SHA256).Hash
    Copy-Item $src $dst
    $h2  = (Get-FileHash $dst -Algorithm SHA256).Hash
    [pscustomobject]@{ rel=$rel; bytes=(Get-Item $src).Length; src_sha=$h1; dst_sha=$h2; ok=($h1 -eq $h2) }
}
$manifest | Format-Table -AutoSize | Out-String | Tee-Object "$PRES\MANIFEST.txt"
if ($manifest | Where-Object { -not $_.ok }) { throw 'PRESERVATION FAILED - hash mismatch, stop here' }
```

Verification gate: the plan does not proceed past Phase 0 unless every row reads ok=True AND the
attested row's sha begins edd3d8e05666. A preserved copy is verified by CONTENT at the destination,
never by the copy command's exit code -- a full disk exits nonzero and can still leave a truncated
file, and a zero-length artifact reads as "nothing to preserve".

## Phase 1 — checkout handoff, coordinated

Current: WT is at 53d625cd on test/304-w2-observed-spelling-cells (a sibling lane's checkout --
this is why hertz's agreement gates it, not just doyle's admission).

```powershell
cd $WT
git status --porcelain          # MUST be empty; uncommitted work here belongs to the sibling lane
git rev-parse HEAD              # expect 53d625cd...
git checkout 85f84d73           # detached, or the branch if hertz prefers to track it
git rev-parse HEAD              # expect 85f84d738fa702f35c83910f314aae17849d125c
```

Refuse if `git status --porcelain` is non-empty: `git checkout` would silently carry or clobber
another lane's uncommitted work. That is a stop-and-report, not something to stash.

## Phase 2 — pool claim, from the lane's own worktree

```powershell
cd $WT
cargo run -p xtask -- pool-claim --pool "$WT\target" --label 304-w2-enforcement-codes
```

Claimed from inside WT so the identity written is this lane's. No --foreign-pool: the pool belongs
to the tree claiming it. The claim WRITES and does not read the incumbent -- last-writer-wins by
construction -- so the lane-identity verdict comes from the NEXT BUILD, not from this command. Do
not predict a refusal from the claim's output.

## Phase 3 — the build, hertz's invocation

Awaiting hertz's exact command. It decides what is touched: a targeted debug library build writes
into target\debug only and does not overwrite target\release\spt.exe. The preserved copies exist
regardless, per Phase 0.

## Rollback

Restore the attested artifacts from $PRES by content-verified copy back, and return WT to 53d625cd.
The preserved copies are the recovery path, so Phase 0's verification is what makes every later
phase reversible.