1:  d71e02a5 =  1:  c7f63cb7 docs(register): IR-93/94/95 and the two amendments the golden RED paid for
 2:  c5f6f7fd =  2:  6e9509c9 docs(register): IR-95's owed census, measured — 323 poll sites, at least 304 blind
 3:  cd694e09 =  3:  08a98259 docs(register): IR-95's census is a classifier count, not a proven floor
 4:  cfb68859 =  4:  6863da97 docs(register): IR-95's census is validated in both directions, and the figure moves
 5:  7181065b =  5:  08c16df2 docs(register): IR-95's first CI margins, and the three ways I overstated them
 6:  c32287fe =  6:  24df11d3 docs(register): name what is actually new in IR-95's margins — the EXPIRY one
 7:  02b6e6b9 =  7:  a9381972 docs(register): IR-95's producer-progress instrument, and the three readings it cannot support
 8:  ebe5e80c =  8:  281698f1 docs(register): IR-95 — the poll's view is FILTERED, and my cheap instrument does not work
 9:  79ec9f8b =  9:  c1d3dc89 docs(register): IR-95 — my reason for withdrawing the cheap instrument was itself overclaimed
10:  220dceae = 10:  8872a7a3 docs(register): IR-92 — the two MSG_IN publish sites order themselves OPPOSITELY
11:  756ab627 = 11:  0491aec4 docs(register): IR-92 — the exact-once defect weakens this cell's GREENS too
12:  0dc977fa ! 12:  f3edd80b docs(hazards): 7.66 — a retry wait that reports only pass/fail is not a meter
    @@ docs/KNOWN-HAZARDS.md: The kill-path rule above generalizes: `daemon.pid` is not
      | # | Invariant | spt-core surface |
     
      ## traceable-reqs.toml ##
    -@@ traceable-reqs.toml: required_stages = ["doc", "impl", "unit", "int"]  # MINTED WEBSERVE W3 (todlando
    - id = "REQ-WEB-ADAPTER-DOCS-FACET"
    - title = "AN INSTALLED ADAPTER'S OWN DOCS ARE SERVED UNDER A RESERVED docs SEGMENT OF ITS ADAPTER FACET, AND THE SEGMENT NEVER FALLS THROUGH (releases#265, WEBSERVE W3, doyle ruled 2026-09-07 12:06Z). The adapter facet already serves the core-owned web root of an adapter; this adds the adapter's OWN documentation BESIDE it at the reserved docs segment rather than replacing what that URL already means -- the alternative, letting docs take over the facet root, would change the meaning of a URL shipped one wave earlier, which is precisely the pasteable-between-machines property the URL grammar was built to buy. THE SEGMENT IS ROUTER-FIRST AND RESERVED, the same posture the reserved facets take: with the manifest key set it serves the adapter's docs directory; with the key absent it answers NOT_FOUND NAMING THE FACET AND THE SEGMENT, and it must NEVER fall through to a docs subdirectory of the core-owned root -- a reserved segment that can resolve as an ordinary served name is how two facets collide later. MEASURED BEFORE RULING, 2026-09-06: none of the seven installed adapters ships a docs directory at all (manifest, executable, strings and state only), so the facet needs a manifest key to point at one; the key is docs_dir, adapter-relative. CONTAINMENT IS ITS OWN CODE AND IS CHECKED TWICE. It is NOT the existing served-name validation, which is a name check and not a path check (measured at the lane base). An absolute path, a parent-directory escape, or a canonical path that does not sit under the adapter directory's own canonical path is REFUSED BY NAME as MANIFEST_DOCS_DIR_OUTSIDE naming the adapter -- at manifest load AND again at request time, because a directory swapped for a link pointing elsewhere after load is a real sequence and the resolve-at-request-time rule already governs every other served path. A MISSPELLED KEY IS ALREADY VISIBLE through the unknown-manifest-key diagnostic, so the failure mode of this key is a named stderr line rather than a silently absent facet. Gate: doc -- the serving docs section naming the segment, the key, and both refusals; impl -- the manifest key, the containment check at load and at serve, the reserved docs segment in the adapter facet router, and the absent-key 404 naming facet and segment; unit -- three refusal shapes (absolute, escape, canonical-outside) and one accept, the reserved segment never reaching the core root, and the absent-key 404 text; int -- a real docs fetch through the running server and the absent-key 404 naming the facet."
    - required_stages = ["doc", "impl", "unit", "int"]  # ACTIVATED WEBSERVE W3 (todlando lane start 2026-09-07), releases#265, doyle measured 2026-09-06 16:15Z (no installed adapter ships docs) and ruled shape (B) 2026-09-07 12:06Z (docs segment beside the core root, reserved, router-first). doc = serving/adapter-docs section. impl = manifest docs_dir + containment at load and at serve + the reserved docs segment in webserve's adapter facet. unit = three refusals + one accept + no-fall-through + absent-key 404. int = a real fetch and the absent-key 404 naming the facet. Drift-gate test riders are hertz's per WEBSERVE-272-W3-DRIFT-RIDERS.md.
    +@@ traceable-reqs.toml: required_stages = ["doc", "impl", "unit", "int"]  # ACTIVATED WEBSERVE W3 (todla
    + id = "REQ-WAN-REPLY-BOUND"
    + title = "A CROSS-NODE REQUEST VERB BOUNDS ITS REPLY READ AND REPORTS A SILENT PEER AS ITS OWN OUTCOME, NEVER AS NoReply (releases#289, doyle ruled 2026-09-09). The six one-shot request verbs in spt-daemon wan.rs -- request_wan, request_fork, request_redeem, request_answer, request_knock, request_presence -- send one record, finish their side, subscribe, then read in an UNBOUNDED loop whose only non-error exits are a decoded reply and a stream EOF. A peer that ACCEPTS the stream and never replies and never finishes it wedges the caller forever; pre-existing since ec360f16, not a WEBSERVE regression. THE FIX IS THE CARRIER, NOT A BUDGET AT THE CALL SITE, and that distinction is the requirement: a deadline handed to a blocking Whole carrier is REFUSED outright (ErrorKind Unsupported, brain.rs) because a timeout there would abandon a half-read frame and desync the conn, so the six verbs must run on the pump-mode Split carrier built by cold_start_pump, exactly as the cross-node digest pull already does. THE SEAM ENFORCES IT rather than documenting it: one shared refuse_unbounded_carrier helper, called before any wire I O in all six verbs, refuses an unbounded carrier by name and names cold_start_pump as the remedy -- the two carriers are indistinguishable at the call site (both are a mutable Brain reference), and a comment in exactly this position already failed to stop one wrong wiring. A BUDGET EXPIRY IS A DISTINCT OUTCOME: NoReply already means the receiver FINISHED the stream without a reply frame (an old or refusing receiver), so reporting silence as NoReply would report a peer that said nothing as a peer that answered nothing -- different facts, different remedies. The expiry rides the brain own reply_read_deadline so one wire has one notion of a peer gone quiet, and it is read through read_event_until rather than read_peer_reply_until because the latter reclassifies the timeout kind away for the pump per-peer drop arm. Gate: impl -- the shared refusal helper, the six carrier constructions in the CLI send paths, the bounded loops, and the distinct outcome threaded through every report surface so a timeout never prints as sent; unit -- the refusal names cold_start_pump, and the distinct outcome is asserted DISTINCT from NoReply and from the happy token in each report classifier; int -- a real dialable peer that accepts the stream and never answers returns the distinct outcome inside the budget rather than hanging, with the caller bound asserted rather than merely survived."
    + required_stages = ["doc", "impl", "unit", "int"]  # ACTIVATED releases#289 (todlando lane start 2026-09-09, doyle ruled the carrier shape and the two-commit scope the same day). impl = the shared refuse_unbounded_carrier helper + cold_start_pump at the six wansend call sites + the bounded loops + the distinct expiry variant threaded through classify_wan_reply and its siblings. unit = the refusal message names cold_start_pump; each classifier maps the expiry to its own arm, asserted distinct from NoReply. int = the silent-peer cell (a real broker that never serves the family) on the digest_cross_node.rs precedent. Kin REQ-HAZARD-PUMP-IPC-DEADLINE (the refusal this reuses) and REQ-DIGEST-CROSS-NODE-PULL (the same fix, one release earlier, on the digest family). doc = the WAN_PEER_SILENT row in the messaging overview failure-verdict table, which is a CLOSED set adapters build blind from -- a new failure tag with no published row is a silent contract change (doyle ruled 2026-09-09, commit 1b).
     +
     +[[requirements]]
     +id = "REQ-HAZARD-RETRY-MARGIN-UNMEASURED"
13:  e4d07e44 = 13:  2f4efd30 docs(register): IR-96/IR-97 — the two infra findings Arm B produced beside its own result