## Scope

Fixes BigscreenVR/spt-bs-releases#277
Fixes BigscreenVR/spt-bs-releases#279

Implements IOLOG-SEQ-RESET-JIT.md plus the true-head cursor rider, now rebased onto landed docs head `bb25787aee5e809b1ab00581c4e990b158af05f3`. One commit: `7689dc33b97379a523048f1cc97dc57015ac66de`.

- Tail reads use bytes, discard the leading fragment before lossy decoding, and retain the whole-file fallback when no complete row remains.
- Appends scan prefixes under the existing exclusive stable lock, detect every adjacent non-increase (including duplicates and internal resets), and mint above the GLOBAL maximum. Repair retains file order and exact JSON payload bytes; exhaustion refuses before mutation.
- Retention counts physical lines and keeps the newest 1000 above the 1250-row threshold, not a sequence-value subset.
- Poll rows and true head come from one shared-lock snapshot. An oversized cursor returns empty events with the real head; a session cursor can recover on its next event. Capped polls still return the last delivered cursor, never skipping deferred events.
- Ordinary bind/listen never evaluate the engine-room hosting probe. Reserved-id first-mover and completion behavior remains intact.
- Registers REQ-HAZARD-IOLOG-SEQ-MONOTONIC with evidence and KNOWN-HAZARDS 6.13; documents replay and cursor recovery. No adapter, digest-sequence, wake-parser, or storage-sidecar feature.

## JIT clarification / cost

Declared JIT deviation, accepted by doyle's content gate: always scan rather than compare only the endpoints. `last < first` cannot detect `[1,2,1,3]`, and `<` misses equal adjacent sequences. Cost is one full read per append under the exclusive stable lock, bounded in steady state by the 1250-row retention cap (about 2 MB on doyle's measured log). That snapshot is reused for integrity, global maximum, count, and any repair/trim; no persistent cache or sidecar is added. Healthy appends never rewrite for integrity repair; normal retention compaction still applies. JSON escaping contributes to actual disk size, and legacy oversized logs pay a full scan until retention succeeds.

Repair is one-time renumbering, not one-time scanning. A carried old cursor sees retained history ONCE, bounded by retention. Adapter-side refusal of pre-session COMMUNE frames (claude-spt 0.38.4) is the complementary protection, not a core landing dependency.

## Full verification — both OSes at pre-handback f9452008 on base 914805d1

| Gate | Windows | kitsubito Linux |
|---|---:|---:|
| own-pool claim + disk floor | 0 | 0 |
| traceable-reqs check --json | 0 | 0 |
| cargo build --workspace --bins | 0 | 0 |
| xtask check | 0 | 0 |
| clippy -p spt-store -p spt --all-targets -- -D warnings | 0 | 0 |
| filtered store/library units | 24 passed | 24 passed |
| filtered spt binary API units | 40 passed | 40 passed |
| real IO-event / boundary / ordinary-bind e2e | 7 passed | 7 passed |
| mdbook build docs-site | 0 | 0 |

The API tests live in the spt BINARY, not a library: they were run explicitly with `--bin spt`, in addition to store `--lib` tests. Real CLI cases include seeded history, oversized after=head+1, all previously undriven IO kinds, boundary ordering, and ordinary-bind stderr without ER_HOSTED_PROBE.

Every final `aligned-*.exit` file was read on both hosts (all zero). Evidence lives in `.spt/gate` under the Windows worktree `.worktrees/iolog-277` and Linux `/home/reavus/spt-w1/.worktrees/iolog-277`. Aligned source patch SHA256: `5355b3f3f225c4e490b05964d539f48ecc7653a47c16305185e5cd80f241e37a`.

## Test-only review hand-back

`b1ce4baf` restores both reserved-first-mover refusal assertions: the diagnostic names `spt rc engine-room`, and the refusal equals the shared `engineroom::reserved_id_refusal` result. The ordinary-id panic-closure regression remains. No runtime change follows the full two-OS gate above.

Fresh Windows gates at `b1ce4baf`: `cargo clippy -p spt --all-targets -- -D warnings` exited 0; `cargo nextest run -p spt --bin spt --test-threads 1 -E 'test(/api::engineroom::tests/)'` exited 0 with **14 run / 14 passed / 742 skipped**, including the restored refusal-contract cell and the ordinary-id panic-probe cell. `traceable-reqs check --json` also exited 0. All three exit files were read: `.spt/gate/review-{clippy,engineroom,traceability}.exit`, with matching `.raw` logs. The earlier two-OS runtime results are not relabeled as execution at this test-only amended SHA.

The first hand-back (`5bfb4155`) omitted the namespace qualification and failed compilation in both requested legs (exit 101, no tests executed). It is superseded, not landable; those raw/exit files are retained as `review-at5bfb4155-*`.

## Mutation evidence

All four deliberate mutations exited100; each was restored before the final green gates above:

1. Restore `read_to_string`: the continuation-byte fixture reads false head0 instead of32. The append now has an independent global scan, so the regression directly pins the tail reader as well as append33; claiming this single mutation still necessarily mints1 would be inaccurate.
2. Restore value-filter retention: the1251-row/reset fixture loses the newest retained history; exact retained-byte assertion fails.
3. Echo an oversized input cursor: explicit3 returns3 instead of head2; persisted99999 returns99999 instead of head1 (both tests fail).
4. Eagerly invoke the hosting probe: ordinary-id guard hits the panic probe instead of bypassing it.

The repair units additionally cover duplicate1->1, an internal reset with last>=first, a global maximum outside the tail/retained suffix, byte-preserving ordered repair, bounded replay, and exhausted sequence space without partial mutation.

## Scope / provenance

`worker_seq` census: it reads a complete decimal `.wseq` counter, with no tail seek and no mid-codepoint window. It does not share this mechanism; left unchanged, no sibling issue fabricated.

Work initially gated at `a26ca59a`, then moved onto the operator-requested landed echo base and gated again. Only additive KNOWN-HAZARDS conflicts needed resolution: preserve #276's6.12 and this lane's6.13 plus both table rows. Broad formatter-only churn was removed before gates; this commit is scoped to ten files.

Ordered ff-only merge/pick-audit belongs to doyle's gate. Live-field acceptance (doyle log has unique sequences and the next event appends max+1) still requires deployment and daemon restart; no live log or running node binary was modified by this lane.

## Rebase after docs landing

Per doyle's revised landing order, rebased `b1ce4baf` from `914805d1` onto landed #190 at `bb25787a`. New head: `7689dc33b97379a523048f1cc97dc57015ac66de`. `git range-diff 914805d1..b1ce4baf bb25787a..7689dc33` reports `1: b1ce4baf = 1: 7689dc33` — one unchanged lane patch. Prior gate results above remain attributed to the SHAs actually executed; the rebased SHA requires its own thin CI run.