# Draft register entries for the v0.71.0 release-close sweep (apply after deployah ships; IDs assumed IR-138/139 — re-derive the next free id at apply time)

### IR-138 — a live perch's SPT_ENDPOINT_ID reaches a gate driver's daemon lifecycle and refuses `daemon stop` as a hosted session
- **Status:** OPEN (doyle, 2026-09-18). Origin: gate run1 on 712c987f, attach_wedge_e2e red `daemon stop` refused; `.spt/preserved/302/gate-231-712c987f/` (run1 VOID, run2 PASS after scrub).
- **Mechanism.** A perch exports SPT_ENDPOINT_ID; a gate driver inheriting it makes every spawned daemon believe a hosted live session exists, so stop refuses. The OWL_SESSION_ID scrub already existed; the newer variable was not in the list. Scrub list must be: OWL_SESSION_ID SPT_ENDPOINT_ID SPT_SESSION_NAME SPT_ADAPTER SPT_HOST_PID SPT_INJECT_VERIFY_ECHO (keep SPT_RELEASE_SEED).
- **Ripe when:** a tracked gate driver template exists (docs/GOLDEN-CI.md ad-hoc rig section) — add the scrub list + an env-after-scrub receipt as a required step; hertz lane.

### IR-139 — a pool census taken before a peer's relocation authorizes reaping the only warm pool on the box
- **Status:** OPEN (doyle, 2026-09-18). Origin: 00:39Z reap of `.worktrees/302-meet-offload/target` (todlando had relocated the STEP 2 field pool there at 23:32Z; `pool-relocation.json`). No evidence lost; capsule built cold.
- **Mechanism.** Reap decision read a stale census (23:27Z) and never read `POOL-OWNER.json` at reap time. Pool identity is the stamp, not the path.
- **Ripe when:** xtask gains a `pool-reap` verb (or the teardown discipline doc gains the rule): read the owner stamp at reap time, refuse if its lane is live, print the stamp in the receipt. hertz lane.

### IR-140 — a zero-tolerance per-tag ACK bound turns one box-ambient hitch after recovery into a golden red with the same signature as every prior pass
- **Status:** BUILT — [`046bad44`](https://github.com/BigscreenVR/spt-bs-core/commit/046bad44) + ceiling comment [`0ab1e48b`](https://github.com/BigscreenVR/spt-bs-core/commit/0ab1e48b), core PR #232 (hertz), ff-landed on main 2026-09-18 05:34Z, tested==merged (CI 35309569389 5/5). Origin: doyle's #307 golden #1 `35299506382` on f348ed0c, Windows Phase B `refresh_freeze` 241/242; RCA `.spt/preserved/307/golden-35299506382/RCA-refresh-freeze.md`; deployah CLOSED_RED record on #307 (comment 5725074841). Same-sha rerun refused.
- **Instance and mechanism.** Post-refresh 23/23 tags complete, zero replacement-write poison, detach-only closures, recovery inside the 15 s window; ONE tag at **2016 ms** against the **2000 ms** bound, sent after the recovery deadline, falsified both `sustained_timely_ack_and_state` and `all_post_tags_accounted_within_bound`. Both predicates demanded EVERY later post tag timely, while the baseline predicate on the same rig needs only 12 of 28. All four retained PASS receipts (gate-228 rig-1/2 on 39241675, 49-267 candidate-1/2 on c180eb16) carry the identical product signature (first post tag 2.5–2.9 s, one untimely tag); pre-fix negative controls on 289e3cdf show 1.4–2.6 s hitches in the BASELINE phase with no refresh at all; no CI co-tenant during Phase B (03:11–03:40Z alone under Runner.Worker). A red whose signature matches every prior pass is a ceiling, not a regression.
- **Remedy (hertz).** `ack_recovery()` anchors at the first recovered tag and then requires ≥90 % timely, no run of ≥3 consecutive untimely tags, all tags complete, backlog bounded; `ack_bound_ms`/`recovery_bound_ms` UNCHANGED (rig.py forbids weakening them; the contract is the freeze, not jitter). Proof: deterministic replay of the golden receipt = PASS, all 5 negative-control receipts = still REGRESSION (23/23 untimely, recovery None, poison present), all 4 prior PASS receipts = PASS (10/10; doyle's independent replay matched); hertz live Windows cell PASS 21/22; doyle isolated second-producer gate PASS (`.spt/preserved/307/gate-307-0ab1e48b/`, refresh_freeze 2/2, trace 0). Unit wrapper `refresh_freeze.rs` + `test_predicates.py` pin the predicate.
- **Residual ceiling (recorded in rig.py, 0ab1e48b).** Sparse periodic ≥2 s stalls with period >10 s (≤2 misses among 22 tags) still PASS this cell; that class is the #302 field gate's domain, not refresh recovery. **Ripe when:** #302's field gate is authored — it must carry a periodic-stall predicate of its own rather than inherit this cell's; and whenever a rig bound is proposed on this box, measure the box's ambient jitter (negative-control baseline receipts) before choosing a zero-tolerance shape. **Kin:** [[IR-130]]/[[IR-131]] (phase labels lose the failing predicate).

### IR-141 — `Start-Process -ArgumentList` joins tokens unquoted, so a `-c '<script> …'` payload reaches bash as the single word `bash` and the driver never runs
- **Status:** RETIRED-AS-DISCIPLINE candidate (doyle, 2026-09-18) — no tracked callsite: the tracked g6 launcher does not use this shape; three ad-hoc doyle launches on the #307 second-producer gate misfired 04:43–04:56Z (`.spt/preserved/307/gate-307-0ab1e48b/`, attempt receipts absent by construction). Sibling of [[IR-137]] (same Claude Code PowerShell host, same Windows ad-hoc rig class).
- **Mechanism.** `-ArgumentList @('-c','bash /path/driver.sh …')` is emitted as `-c bash /path/driver.sh …` with no quotes; bash re-tokenizes, its COMMAND becomes `bash` (an interactive shell blocked on the hidden console's stdin, alive for 10 min, writing nothing) and the script path becomes `$0`. With `exec` and no command the child exits 0 instantly. First misread as the fresh-console stdin hazard (IR-137 kin, real but not this): the launched child's actual `Win32_Process.CommandLine` named the defect in one read.
- **Rule.** Pass the payload as ONE self-quoted token — `-ArgumentList @('-c', ('"' + $cmd + '"'))` — then read the child's CommandLine to confirm the quotes survived, and require the driver's FIRST receipt file within 15 s: a detached launch with no first receipt is a launch defect until proven otherwise. Belongs in [Windows ad-hoc rigs that outlive the tool call](GOLDEN-CI.md#windows-ad-hoc-rigs-that-outlive-the-tool-call) as a second bullet beside IR-137's no-redirect shape. **Ripe when:** that doc section is next touched (fold both into one launch recipe with the two verifications: CommandLine read + first-receipt deadline); hertz lane, docs-only.

### IR-143 — a local compile overlapping a runner unit leg can push that leg past `timeout-minutes: 40`, cancelling it at the last few tests and voiding 40 minutes of CI

- **Status:** OPEN discipline (doyle, 2026-09-18) — measured on releases#307: PR #233 thin CI `35322019343` Windows unit CANCELLED at 40:01 at test 3236/3254 while todlando's `--jobs 2` build + clippy ran on the same box under my overlap authorization; the same-sha rerun 09:17–09:51Z uncontended passed in 34.5 min. Cost = one VOID leg, one full rerun, ~50 min of milestone wall-clock.
- **Mechanism.** CI-vs-CI on the single-slot hfenduleam runner queues serially, so two workflows never contend; only LOCAL cargo (a gate rig, a builder lane, a capsule build) shares the CPU with a running runner leg. The Windows unit leg's uncontended wall is ~32–35 min against a 40-min job timeout, so it has ≤8 min of slack; any concurrent compile of a comparable tree eats that slack before it eats anything else. A cancelled job whose wall equals `timeout-minutes` is a VOID, not a red (rule already on record); the overlap ruling is what manufactures the VOID.
- **Rule.** Before authorizing local cargo while a runner leg is in flight, read the leg's uncontended wall from its last green run and compare to its `timeout-minutes`; overlap only when slack exceeds 15 min, otherwise sequence (local cargo waits, or the CI leg waits — the merge-required leg outranks an informational post-merge run). Post-merge `ci` on a just-landed main is informational (tested==merged already); a PR's own CI is merge-required and is never overlapped. **Ripe when:** `docs/GOLDEN-CI.md` next touches the runner-occupancy section (fold beside the merge-push-reoccupies-the-box note); hertz lane, docs-only. **Size:** one paragraph + one line in the operating checklist.
- **Third instance, non-agent contender (doyle, 2026-09-18 12:07Z).** Post-merge `ci` `35339675565` (main @71165e35) Windows unit CANCELLED at 40m19s with EVERY step green (3254/3254, floor PASS, cleanup done — the cap fired during "Complete job"). No agent cargo in the window; per-test timings vs the green PR job `105562570404` of the same sha: median 1.88x slower, 1384/3248 tests >2x, pure-compute crates 6–8x ⇒ box-wide CPU starvation, contender = operator desktop load (game 2–4.5 cores, box 51–64% CPU at rest, 16 cores). So the mechanism is not only local cargo: ANY sustained load on hfenduleam voids the leg, and the golden `test` leg (67–69 min uncontended vs cap 80) and `twohost-a` (30–31 vs 40) carry the same ≤11-min slack. Golden #3 held on a sampler predicate (CPU ≤20% sustained 5 min); RCA `.spt/preserved/307/deployah-intake-r3/RCA-postmerge-35339675565-void.md`.
- **Fix candidates (operator decides, referred 12:22Z):** (a) raise caps to ≥1.5x uncontended wall (ci unit 40→60, golden test 80→120, twohost-a 40→60) so a hang still surfaces but desktop load no longer voids; (b) a pre-leg box-load gate step that refuses to start the long leg above a CPU baseline and prints the top consumers, turning a silent VOID into a named resource red at minute 0 — the DISK floor step is the template.

## CANDIDATE (doyle 2026-09-18T15:33Z, id at apply time): same-sha post-merge ci redundancy
Every ff-only merge starts a push-main `ci` run on the sha whose pull_request run just went green (2f7df27a: PR run 35353733267 success 5/5, then push run 35362584091 re-runs unit on both boxes). Cost ~35 min of hfenduleam + ~8 min kitsubito per merge; with two riders per milestone tail that is ~70 min of the golden launch window. Candidate fix (hertz lane): `changes` job checks `gh api /repos/.../commits/<sha>/check-runs` for a green pull_request `unit` on the same sha and skips the heavy legs; the push run still records traceability/changes/lint. Blocked-by: none. Evidence: this file's sibling STATUS lines in JIT-PLAN.md 15:33Z.