# Milestone #318 HANDED-FILE — JIT plan (doyle, 2026-09-21)

Base: main b33aedca (v0.71.0 + sync rider). Target: v0.72.0, counter 108. Golden head assembled by doyle, run by deployah.
Members: #317 (operator-named), #254, #311, #312. Infra riders: IR-144 (hertz), IR-95 status line (doyle).
Intake RCA: releases#317 comment 5768362088. Composition: releases#318 comment 5768367416.

## Waves — todlando (product), serial, one thin PR each, branch off CURRENT main
W1 `fix/317-quoted-span-paths` — #317 defects 1+2.
  - `spt_store::helperline::quoted_path_candidates`: extract quoted spans ("…", '…', `…`) BEFORE whitespace tokenising; keep fixed-point trim, anchoring, dedupe, cap 5. Unquoted space-bearing path stays out of contract; docs say so.
  - `report_user_input_with` gate uses the same extractor (it already does; keep ONE extractor).
  - `gather_file_access_helper`: additionally dedupe on the EMITTED line within one gather.
  - RCA (report, do not guess): why ONE prompt wrote TWO helper records 107 ms apart with different msg_id (owlery/webbie/helper-fetch.jsonl, at_ms 1790027897746/…853). Fix at the source if it is core.
  - Units: quoted path with spaces (Windows + POSIX), `~/a b/c.md`, two quoted paths in one line, trailing punctuation after the closing quote, a fragment must NEVER be reported (negative control: the old tokeniser's `C:\Users\x\My` case).
W2 `fix/317-second-audience-and-prompt-delivery` — #317 defects 4+3.
  - 4 (now its OWN request, see releases board; OPERATOR-RULED CONTRACT 2026-09-21): the helper fires for every endpoint + session + filepath combination it has not already fired on, and RESURFACES THE EXISTING served URL when the path is already served (no second entry, no silence). Read owner-side registration first; state the mechanism before the fix. The existing entry's audience must admit the new endpoint and that widening must show in `spt serve list`. Resurfacing does NOT extend the original 24 h deadline. Doc sentence on repeated payloads becomes per endpoint+session+path.
  - 3: deliver the line WITH the prompt. Bounded wait on the prompt-submit poll ONLY when the payload quoted a path. MEASURE owner round-trip HFENDULEAM<->ENLYZEAM first (n>=10), propose the bound from the measurement, report hook cost added on the common no-path prompt (must be zero: no IPC, no wait). ADR-0058 Amendment 2 + docs-site serving/attachments.md in the same PR.
W3 `fix/254-boundary-manifest` — resolve the manifest on cmd_bind and cmd_boundary so the compliance gate fires (#254).
W4 `fix/312-gh-positive-probe` — gate `spt update` fetch on a positive credential probe; name a stale account in the refusal (#312).
W5 `fix/311-seal-token-to-author` — the in-output ceremony answer carries the minted token (dispatch result line); confirm whether #223's path regressed or never covered this arm (#311).

Every wave: new REQ ids in traceable-reqs.toml FIRST, tags in the same commit, `traceable-reqs check` exit 0, clippy --workspace, never cargo fmt, pool-claim from the lane's own worktree under .worktrees/, release the pool, co-author trailer `Co-authored by: todlando`.

## hertz (test/CI), parallel
H1 IR-144: push-main ci re-tests the sha its PR run just greened; ci.yml `changes` job. Thin PR.
H2 Two-node field acceptance driver for the helper (docs already say this acceptance is PENDING): HFENDULEAM endpoint, controller seated from ENLYZEAM. Cells: spaced path arrives; one line not two; arrives with the prompt; second endpoint gets its own line; a core-delivered path-bearing PEER message causes NO serve. Red on purpose first against b33aedca.

## doyle
Gate every wave in an isolated worktree (targeted suites + compile gate), rule forks, IR-95 status line, assemble golden head, hand to deployah, triage reds, publish close.
Box rule: hfenduleam is builder box AND golden Windows runner. No local cargo while a runner leg is inside its last 15 min; post-merge ci occupies the box ~35 min after every ff (until H1 lands).