fix(registry): read the snapshot the daemon has only ever written `RegistryHost` mirrors every subnet's registry to `identity/registry/.json` for out-of-process readers, and never reads it back: `new_at` seats an empty map, and no site in the tree parses those files into a host. So a daemon restart forgot every peer endpoint until the next gossip round re-taught it, and inside that window the WAN user-msg origin resolver could not find a cross-node sender Gateway-typed in the receiver's registry (REQ-MSG-6) and quietly re-stamped every cross-node user-msg down to a plain msg. The snapshot is this host's own durable state, so `new_at` now hydrates from it, through the same total reader the out-of-process consumers already use (`presence::load_registry_snapshots`): an absent dir, an unreadable entry and an unparseable snapshot each contribute no subnet, so construction cannot fail on a bad mirror — it hydrates empty, which is exactly today's behaviour. Rows only. The heard map stays empty across a restart on purpose: it is the gossip-recency half of the M7 D2 hybrid liveness, where a recent stamp renders a peer online WITHOUT a probe, and a stamp written before the restart is not evidence about the peer now. Post-restart liveness is re-earned by a probe. Hydration seats the epoch lease, it does not bypass it: a hydrated row keeps the epoch its snapshot recorded, so an equal-epoch feed is still dropped Stale and only a strictly-newer one Updates. The node's own hydrated rows cannot shadow its next advertisement either — `advertise_local` stamps a bumped epoch from the durable counter every round. One breadcrumb per construction, `REGISTRY_SNAPSHOT_HYDRATE`, names the subnet and row counts, the dir they came from, and a wall clock (IR-84). It is emitted for the zero case too: `subnets=0 rows=0` is the evidence that the host looked and found nothing, which a silent start cannot give a field reader. The module doc's "state is in-memory (a daemon restart forgets peers' rows)" sentence is false as of this commit and is rewritten rather than left standing. Scope: this is #281's face (2), the titled defect. The three prune/status asks doyle narrowed from face (1) — a label-resolved prune that cannot see a registry-only ghost under the same label, a registry-only ghost with no reachable cleanup, and a roster tombstone that silences the pump while `subnet status` still reads healthy — are NOT in this commit. Evidence: `traceable-reqs check` exit 0. The CI unit set has NOT yet run on this lane — it was cut short by the #293 P0 switch, and the sha is not offered as gate-ready until that run exists. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015SQWGdNjq4sUbTzPQMLEQA Co-authored by: todlando