doyle -> todlando: W2 DISPATCH (#246 + #147, then the #17 flip) — start NOW, source-first, while my W1 legs hold the box.
BASE: branch build/ws272-w2 off build/ws272-w1 @8d980fdf (W1 is at gate; rebase onto main the moment W1 lands ff — expect a no-op rebase). Worktree .worktrees/ws272-w2.
POOL/DISK (binding): no cold pool — free is 94 GB with my legs in your ws272-w1 pool and hertz's main pool live. Do all source work now (treqs mint FIRST, no `"` in titles; registry/attachment format; short-ID; docs page drafts). Your FIRST cargo waits for my message "battery ended, pool released"; then re-claim the ws272-w1 pool from the new worktree with --foreign-pool (it is warm at 8d980fdf = your base) and build incrementally.
BATTERY SHAPE (ruled 02:40Z, operator-directed): the lane battery is TARGETED — treqs, xtask check, clippy workspace all-targets, nextest --no-fail-fast over the touched crates' units + W2's own e2e/int bins, mdbook if docs moved. NO full workspace sweep in the lane; that runs once on the golden head. Put the filter expression in the driver's nextest leg and drop the full-sweep leg from the template. Open the PR only when BOTH boxes are free of batteries (a PR open is a CI battery on both runners; W1's opened mid-battery and OOM-killed the kitsubito runner).
The §W2 brief from WEBSERVE-272-JIT.md follows verbatim:
## W2 — attachments + message identity (todlando) — #246 + #147, then #17 flips

- **REQ-WEB-ATTACHMENT-PULL** (ADR-0058; doc, impl, unit, int): `spt send --attachment <path>`
  snapshots the bytes into `$SPT_HOME/serve/snapshots/`, registers an `attachment` entry
  (ttl default 30 d, `--ttl <dur>`), and the envelope carries the node-prefixed URL
  (`attachments: [{name, url, bytes}]`, additive key); the daemon pulse reaps expired
  snapshots and logs the count. Nothing is pushed to the receiver.
- **REQ-WEB-FETCH-VERB** (doc, impl, unit, int): `spt fetch <url|<node>/f/<name>> [dest]`
  writes the bytes to `dest` (default: basename in cwd, refusing to clobber without `--force`),
  prints the path; exit codes: 0 / 3 refused (403) / 1 failed.
- **REQ-MSG-SHORT-ID** (ADR-0061; doc, impl, unit, int): 8-char base32 over the message hash,
  node-scoped, minted at commit, collision → lengthen that id; carried in the delivery
  envelope, in `MSG_IN`/`MSG_OUT` io-event rows, and rendered by `/<node>/m/<id>` (HTML +
  `?json`); `spt msg show <id>` renders one message with its attachment URLs; `spt send
  --reply-to <id>` carries the parent id.
- **#17 rider** (WIDENED by operator directive 2026-09-06 ~10:56Z, ADR-0058 Amendment 1):
  `FILE_ACCESS_HELPER` now-signal category. Two triggers: (a) a delivered message carries
  attachments → the signal emits the exact `spt fetch <url>` line(s); (b) a USER's message
  quotes a filepath that exists on the user's node → core AUTO-REGISTERS that path as a
  served resource with a **24h TTL**, **audience = the one endpoint that received the
  message** (a new per-entry field; enforced where the fetch origin is proven — the W1
  cross-node stream; loopback is the trusted machine), and the signal hands that endpoint
  the `spt fetch <url>` line. Delta discipline: once per (message, path). Guards: existence
  check on the user's node, absolute/`~` paths only, cap per message (5), entries enumerable
  in `spt serve list` with origin = the message short-ID. Same-node user+agent: no
  registration, the signal says the path is local. REMOTE user (the #17 case) needs a
  cross-node "register on my behalf" request authorized by the user's attach session —
  rides W1's stream family, so this rider lands AFTER W1 (W2 already does). Operator RULED
  reference-served (live file/dir entry + ttl + audience, never a snapshot; ADR-0058 Amendment 1).
  Flip #17 EVAL → attached-and-WIP at W2 dispatch (operator ruled it a closing rider, Q6).
- Docs: `serving/attachments.md`, api.md now-signal category list, `messaging` page for
  short-ID + reply-to.