{
  "text": "903 requirements: 903 complete, 0 incomplete, 0 findings\n  [OK] REQ-ACCESS-RETIRED-VERB-REFUSAL  required: [impl, unit]  stages: -doc +impl +unit -int\n       A RETIRED SUBCOMMAND OF `spt endpoint access` REFUSES BY NAME RATHER THAN FALLING THROUGH ITS OWN OPTIONAL POSITIONAL AND ANSWERING PLAUSIBLY. `access` takes an optional endpoint id positionally, so once `list` and `rules` stopped being subcommands (retired when the roster views replaced them) clap handed those tokens to the POSITIONAL, and the view reported `no access entities ruled for 'list'` at exit 0 -- a well-formed, confident report about an entity nobody has ever created. Found by flynn in the v0.49.0 field verify (releases#67). THE DEFECT IS NOT A MISSING ERROR MESSAGE, IT IS AN ANSWER: the sentence is TRUE of any name nobody has ruled, so it is indistinguishable from the real result for a real endpoint, and an operator or agent still carr…\n  [OK] REQ-ACCESS-VERDICT-REASON  required: [impl, unit]  stages: -doc +impl +unit -int\n       The endpoint access gate reports WHY a pass passed, not merely THAT it passed: the gate's verdict carries, on its allow arm, the reason the chain admitted the interaction — the same-node short-circuit, the reply exemption, an entry whose subject NAMED the peer (a proven sender endpoint or the origin node), an entry that matched only by SUBNET WILDCARD (an entry, but one that never named this peer), or a posture pass (an endpoint / node / captured-subnet mode, or the implicit-open bottom of the chain). The reason is computed AT THE GATE, in the one place that holds the whole chain, and travels with the decision. The alternative — a downstream consumer re-deriving it — means RE-OPENING the access store after the gate has closed it, which is bot…\n  [OK] REQ-ACL-ACCESS-REFRESH-ER-ONLY  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       spt api access-refresh stops refusing and becomes real, gated to the engine room, updating ONLY the node's captured subnet-level fallbacks (ADR-0052 decision 6; the W2 refusal REQ-ACL-ACCESS-REFRESH-VERB was minted precisely so this wave changes one behavior rather than adding a surface and its gate). The refresh is the CONSENTED half of advisory gossip: a subnet-mode change reaches a member as a notification, the engine room is briefed with the exact new posture, and a human decides whether this node adopts it — which is why the verb writes the captured fallbacks and never the node's own rules, and why no remote actor can invoke it. Its authentication is the same shared engine-room function empower uses. The W2 refusal test is repinned to the ne…\n  [OK] REQ-ACL-ACCESS-REFRESH-VERB  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       `spt api access-refresh` is MINTED THIS WAVE BUT REFUSES — the verb exists, parses and is documented, and its refusal names why: the capture-refresh is engine-room-only, and engine-room enforcement (ADR-0052) does not land until W3. Minting the refusing verb now is deliberate: it fixes the contract adapters and the engine-room brief will be built against, and it makes the wave that implements enforcement a change to ONE behavior rather than a new surface plus its gate. A refusal that merely says 'unknown command' would invite an adapter to route around it. When it does light up it updates ONLY the node's captured subnet-level fallbacks — never the node's own rules, which are the operator's, not the subnet's. Gate: doc — the CONTEXT.md capture…\n  [OK] REQ-ACL-DISCOVER-DEFAULT-ON  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       DISCOVER IS ON BY DEFAULT: a `closed` posture at ANY mode tier -- endpoint mode, node mode, or the join-time-captured subnet mode -- no longer implies a DISCOVER deny, and the ONLY thing that closes DISCOVER is a deny that NAMES it: an access rule row, or a `per_surface` mode entry (engine-room-set at the node tier). Operator-ruled 2026-08-17 (releases#180/#181): being findable is what makes a knock -- the ask to be admitted -- possible at all, so a node that closed its posture to say 'do not talk to me' had also silently said 'and you may not ask', which was never the choice being made; the messaging-first majority pays for a discovery decision they never took. THE DEFAULT LIVES IN THE SURFACE VOCABULARY, NOT BESIDE THE CHAIN: the `surface::TABLE`…\n  [OK] REQ-ACL-DISCOVER-GATE  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       DISCOVER is a real gated surface: registry resolve/advertise and the resources blurb are filtered per viewer, so discovery leaks nothing a viewer could not reach. ADR-0009 NAMED this leg — 'discovery (resource advertisement) is gated by the first two gates' — and CONTEXT.md's resource-advertisement entry promises that an endpoint whose access rules exclude the viewer's node by naming DISCOVER in a deny never appears in that view; a legacy grant plus blanket-closed posture does not imply that exclusion because DISCOVER is default-on. Only the VISIBILITY half was ever built; the access half has been an unbuilt promise since M4. Un-gated discovery on a shared subnet is an inventory of every agent on every member node, including the ones an operato…\n  [OK] REQ-ACL-ER-DISCOVER-CONJUNCTION-NOTICE  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       AN ACCEPTED RULE THAT CANNOT CURRENTLY TAKE EFFECT SAYS SO: an endpoint-scoped access mutation naming the ENGINE ROOM is accepted and, when its `DISCOVER` half cannot presently disclose anything, the accept site prints a LOUD CONJUNCTION NOTICE naming the engine room's advertisement whitelist as the other lever and its current posture. Disclosure of the engine room is an AND across two records: `DiscoverGate` checks the ER advertisement filter BEFORE the access chain (REQ-ER-NOT-ADVERTISED, ratified and unchanged by this requirement), so a rule accepted against an empty whitelist discloses NOTHING while reading as policy in force. Field case: ENLYZEAM's sole `DISCOVER` allow was ER-scoped `any-of SPT_DEV` with an empty whitelist, and every SPT_DEV …\n  [OK] REQ-ACL-FAIL-CLOSED  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       A corrupt or unreadable access store degrades CLOSED, loudly (ADR-0053 — an ADR-level flip of ADR-0009's deliberate fail-open ruling). ADR-0009 justified fail-open explicitly: the whitelist was 'a same-subnet convenience boundary layered inside subnet membership, not the system's outer wall', because every member node was the one user's own machine. The SHARED SUBNET ruling breaks that premise — member nodes now belong to different human operators and the access layer gates agents — and a boundary that evaporates when its store file corrupts is not a boundary an operator can reason about. So a store that CANNOT BE READ refuses unlisted-subject traffic on every surface rather than admitting it, and says so on the refusing node naming the store…\n  [OK] REQ-ACL-FORK-WITHOUT-DISCOVER-CONSEQUENCE  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A `FORK` GRANT WHOSE SUBJECT CANNOT RESOLVE THE ENDPOINT SAYS SO AT WRITE TIME -- a stated consequence, never a refusal: the rule lands exactly as typed and the operator is told that as written the subject cannot resolve the endpoint it may now fork, so the attempt fails later as an unresolvable subject. Forking a remote endpoint takes TWO surfaces and only one is obvious: `FORK` authorizes the operation, `DISCOVER` is what lets the grantee resolve the row at all. Field origin (releases#76, from the releases#29 cross-node rung): node B granted node A `FORK` alone, A could never fork, and granting the pair fixed it -- diagnosed empirically, not by reading. The operator-facing defect was never that the pair is required; it is that the requirement was…\n  [OK] REQ-ACL-GRANT-NODES-POLICY  required: [doc, impl, unit]  stages: +doc +impl +unit +int\n       ENDPOINTS_CAN_GRANT_NODES is a node-tier policy toggle, settable only via the engine-room, gating whether an ordinary endpoint may write a NODE-SUBJECT entry into its own whitelist — the widened grant a non-attributable-surface approval produces. Explicitly set it is true or false; UNSET DERIVES PER-DECISION from the effective posture of the REQUESTED SURFACE at the target node: open => endpoints may self-approve (an allow entry on an open surface punches no hole), closed => engine-room only (a node-subject allow would punch a hole in a closed posture). The gate applies in BOTH POLARITIES — adding a node allow and removing a node deny are the same widening act — and it is enforced at the STORE MUTATION SEAM rather than in any one caller, so n…\n  [OK] REQ-ACL-INTRA-NODE-SELF  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       INTRA-NODE GOVERNANCE IS A SELF-REFERENTIAL NODE SUBJECT AT THE EXISTING TIERS, NOT A NEW TIER. Operator-rephrased 2026-08-22, superseding in full the v1 reading (a slot-3.5 rules tier with a mode twin at 6.5): #211 adds NO tier, NO Subject kind and NO schema change. A rule whose subject is THIS NODE'S OWN id governs traffic authored on this node, and it does so through machinery that already shipped. Two effects, both operator-confirmed: a NODE-SCOPE own-node rule governs intra-node actions for every endpoint hosted here, and a PER-ENDPOINT own-node rule governs incoming actions from other same-node endpoints. The third -- endpoint-targeted rules evaluate before node-targeted -- is the chain's existing order and nothing moves. THE MECHANISM AND TH…\n  [OK] REQ-ACL-LOCAL-ORIGIN-TIERS  required: [impl, unit]  stages: -doc +impl +unit -int\n       WHERE AN INVOCATION CAME FROM IS DATA THE CHAIN REASONS ABOUT, NOT A SHORT-CIRCUIT BEFORE IT. Until releases#209 the chain's step 1 was `if local, return Allow(SameNode)`, so locally-authored traffic never reached `AccessStore::decide` at all. That was invisible while local traffic was ungated, and it is exactly what would have foreclosed the operator's intra-node governance surface (releases#211) — which under the ruled shape is NOT a new tier between the per-endpoint entries and the node tier, but SELF-REFERENTIAL Node subjects at the EXISTING tiers (v1's slot-3.5 reading withdrawn in full, operator-rephrased 2026-08-22). A tier the local path short-circuits past is not a tier. So `AccessRequest` carries an `Origin` SET AT EXACTLY ONE CONSTRUCT…\n  [OK] REQ-ACL-LOCAL-SUBJECT-ONE-SHAPE  required: [impl, unit]  stages: -doc +impl +unit -int\n       EVERY LOCAL FEEDER OF THE ADMISSION GATE HANDS IT A PROVEN ENDPOINT ID OR NOTHING — ONE MEANING, ONE SPELLING (releases#215): `gate::admit_local_delivery`'s `sender` is a SUBJECT (`Subject::SenderEndpoint` matches it by equality), and its three local feeders disagreed on what they put there — `spt send` passed the session-proven bare id, `spt ring` passed `resolve_from(--from)` (where an EXPLICIT `--from` BEATS session detection), and `notify` passed `NotifRow.from_id`, the COMPOSITE `{issuer}@{node_hex}`. A tier-1 rule an operator wrote for endpoint `ling`, that the CLI accepted and the view renders, therefore covered two of three local delivery verbs and COULD NEVER MATCH ON NOTIFY: it failed in the SILENT direction. `access_check_with_sender…\n  [OK] REQ-ACL-LOCKED-POSTURE  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       The **locked** claim is one predicate, and it asks the CHAIN. `ACCESS_LOCKED` (the `revoke` arm) and the access view's `locked` field are two renderings of a single fact — this endpoint refuses ALL unsolicited remote inbound — and both take that fact from ONE predicate, `AccessStore::is_locked(endpoint)`. It is CHAIN-SCOPED by necessity, not by preference: the superseded `EndpointAcl::is_locked` was record-scoped and therefore structurally unable to answer, because an endpoint that names no posture of its own inherits one from the node mode and from captured subnet modes, neither of which a record can see; it counted node-subject allows (`allowed_nodes().is_empty()`) and never read a mode at all, so a `revoke` on a default-open endpoint told th…\n  [OK] REQ-ACL-MODE-ADVISORY-GOSSIP  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       A subnet-mode change gossips ADVISORILY — it produces a notification and nothing else. An existing member's EFFECTIVE posture never changes remotely: the captured mode (REQ-ACL-SUBNET-MODE-CAPTURE) is immutable except through the node's own refresh (REQ-ACL-ACCESS-REFRESH-VERB), so no remote party can reach into a member node and re-posture its gate. This is the difference between a subnet owner ADVISING members of a policy change and COMMANDING their enforcement — on a shared subnet whose members are different humans, only the former is defensible, and a producer that quietly applied would be a remote write to security material. Gate: doc — the CONTEXT.md control-surface-modes advisory-gossip sentence; impl — the notif producer on subnet-m…\n  [OK] REQ-ACL-MUTATION-HUSK-REFUSAL  required: [impl, unit]  stages: -doc +impl +unit -int\n       ADR-0053'S FAIL-CLOSED HAS A WRITE SIDE, AND IT IS ENFORCED AT THE SAVE SEAM RATHER THAN AT THE MUTATION CALL SITES. `load_checked` split NotFound from corrupt and the gate refused a husk correctly -- but the store is READ-MODIFY-WRITE at every path that edits it, and `AccessStore::load` is `load_checked_from(..).unwrap_or_default()`, so a degrade was swallowed into an EMPTY document. The consequence inverted the guarantee (releases#57): the gate refused unsolicited traffic, and then the first `spt endpoint access` command an operator ran to investigate the refusal saved that empty document over the damaged file -- permanent rule loss, and a posture that flipped from degraded-closed to open-with-one-rule. The boundary held exactly until someone tou…\n  [OK] REQ-ACL-NODE-MODE-SET  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       The node's control-surface modes are settable through the engine room and nowhere else (ADR-0052 decisions 1 and 3, CONTEXT.md 'control-surface modes' — the node level of the three). Modes are exactly what a confused or adversarial agent would loosen, so the mutation surface must be the one place an agent cannot reach without passing a human-held TOTP; every other candidate — a plain CLI verb, an elevation-gated verb, a config file the daemon reads — is reachable by something running as the user. Subnet-scope mode authority is separate and rides empower (REQ-SUBNET-EMPOWER-VERB); this requirement is the node's own posture, which needs no empowerment because the bring-up gate already proved subnet membership. Gate: doc — the CONTEXT.md contr…\n  [OK] REQ-ACL-NODE-VIEW  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       `spt daemon access` is the node-tier roster: the entities the node-scope rules name (node and subnet-wildcard subjects — a node-scope sender-endpoint rule cannot exist by schema), this machine's own mode with its per-surface exceptions, and the captured subnet modes — the tier every hosted endpoint falls through to, in the same item grammar as the per-endpoint view so the two scopes read as one system. There is NO `spt subnet access`: a subnet is a subject tier and a mode source, never a rule-holding target — its mode facts surface on `spt subnet status` (REQ-SUBNET-STATUS-MODES). Gate: doc — the CONTEXT.md access-entity entry; impl — the node roster builder and the daemon verb; unit — the node roster's entities, mode-exception summary,…\n  [OK] REQ-ACL-ORIGIN-QUALIFIER  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       An access rule may carry an ORIGIN QUALIFIER (any|user|agent) restricting it to invocations of that origin class, so a rule can say 'the humans on node A, not its agents' and let that node's agents fall through to the mode. TWO TYPES, NOT ONE (doyle-ruled design): the RULE side is a three-valued qualifier defaulting to `any` for N-1 records; the REQUEST side is a TOTAL two-valued class (user|agent) with no unknown arm, because `any` is a rule-side value that no classifier ever emits — a single three-valued type would let a classifier return `any`, which is meaningless. Classification is ambient and ceremony-free, performed by the SENDING daemon over the existing local-origin predicate (interactive terminal with no perch/broker ancestry => user; a…\n  [OK] REQ-ACL-POSITIONAL-ALLOW-HONORS-FLAGS  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       `access allow`'s POSITIONAL SPELLING REACHES THE SAME MUTATION SEAM ITS FLAG SPELLING DOES -- it is a shorthand for the rule, never a second, ungated way to write one. The v1 arm matched `node: Some(..)` and swallowed every other flag in a `..`, then called `AccessStore::allow` directly, and that cost three things at once, all three RUNTIME-MEASURED before the fix (releases#185; the filing was read-derived and named only the first). (1) `--surfaces MSG` WAS DROPPED, and an empty surface list means EVERY surface -- so the store took a rule strictly WIDER than the operator typed, exit 0, no diagnostic on either stream. The direction matters and was checked rather than assumed: the `is_empty => set_all(Mode::Closed)` at the tail of `allow_surfaces` re…\n  [OK] REQ-ACL-PRECISE-ALLOW-WRITE-CONTRACT  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       THE PRECISE `access allow` IS A RULE VERB; THE POSITIONAL ONE IS A RULE+POSTURE VERB -- and the precise arm therefore says so at write time rather than leaving the operator to discover it. releases#196 asked whether the flag spelling should also close an endpoint's posture on its first rule (the v1 semantic `restrict_if_unset` carries, which the positional arm re-applies explicitly). RULED HORN B (doyle 2026-08-21, on a census read at b88fab2a): default-open-until-explicit-close IS the shipped T6 semantic, the mutation seam stays POSTURE-BLIND, and what was missing was never the close -- it was any signal that a rule written onto an unrestricted endpoint changes no verdict. TWO STRUCTURAL FACTS DECIDE THIS RATHER THAN A PREFERENCE. (1) A CLOSE CANN…\n  [OK] REQ-ACL-RC-VIEW-SPLIT  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       Watching an endpoint's terminal and DRIVING it are separately grantable: attach gates on the request's AttachIntent — Viewer -> RC_VIEW, Control/Take -> RC_ATTACH. Before this, one access_check(endpoint, origin, Unsolicited) covered every attach intent, so admitting a node to view an endpoint necessarily admitted it to take the keyboard (and, with Take, to displace an incumbent controller). On a shared subnet that is the difference between showing a colleague's agent what happened and letting their agent drive yours. The split is keyed on the intent the REQUEST carries, evaluated at the serve side under the handshake-proven origin — never on anything the attaching side can restate after the gate. Kin: ADR-0042 (rc-attach truth) and REQ-ACL-SURF…\n  [OK] REQ-ACL-RULE-MUTATION  required: []  stages: -doc +impl +unit -int\n       Access rule mutation and revocation are TUPLE-SHAPED, never id-shaped: a removal restates the subject, surfaces and origin qualifier rather than naming a generated rule id, which makes it idempotent and script-safe and removes rule-id bookkeeping from the model entirely (tuples ARE the identity). Every entry records its PROVENANCE — knock-approve, code-redeem, or manual — and the access drill-down view prints the exact removal command beside each rule together with that provenance, so revocation is copy-paste from the view that showed it. Entries born of knocks or codes have no special lifecycle after birth. Authority is threefold: the owner endpoint's agent (narrowing mutations always free, widening node-subject mutations in either polarity ga…\n  [OK] REQ-ACL-SUBJECT-CHAIN  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       One FIRST-MATCH-WINS subject chain decides every access question, with an implicit-open bottom that preserves current fleet behavior. Order: per-endpoint sender-endpoint rule -> per-endpoint node rule -> per-endpoint subnet-wildcard rule -> node-scope node rule -> node-scope subnet-wildcard rule -> endpoint mode for the surface -> node mode for the surface -> join-time-captured subnet mode for the surface -> (nothing matched) OPEN. The stateful-firewall reply exemption a\n[…1687ln elided…]\nenVR/spt-bs-releases`) and the gh CLI is the mandated carrier — release discovery (`releases/latest`, cli.rs:9717) and asset download (cli.rs:4861 public browser URLs) move to deadline-wrapped `gh` subprocess calls (`gh api`, `gh release download`; run_git pattern). WHY gh not token+HTTP: private-repo `browser_download_url` 404s even with a valid token — the API asset-id dance is gh's job. Default repo flips via the existing SPT_INSTALL_REPO seam (cli.rs:5363) + xtask REPO const (main.rs:729) + notif.rs consent-changelog URL rider. Loud failure classes: gh missing -> UPDATE_FETCH_REJECTED:GhCliRequired with OS-SPECIFIC install hints (winget/apt/brew)…\n  [OK] REQ-UPDATE-ONE-SHOT-FINISH  required: [impl, unit]  stages: -doc +impl +unit -int\n       W3 (LIFECYCLE-TRUTH): update apply works daemonless and one command finishes the cycle. ROOT (operator wart): update fetch/apply run ensure_daemon_announced (cli.rs:4386) -> on a stopped box they BOOT THE OLD broker pre-swap, guaranteeing the mixed old-broker/new-brain pair + a manual bounce. FIX: apply works daemonless (swap + record, next start runs new bytes); `update apply --finish` (name subject to docs-token gate) completes the cycle: swap -> brain cycle -> broker restart onto new bytes (rides REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so the restart is not a massacre). CLI change -> xtask docs gen, no internal codes in clap ///.\n  [OK] REQ-UPDATE-PROMOTE-DRAINED  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       W3 (LIFECYCLE-TRUTH, mechanic-d MOVED FROM W2 per doyle gate verdict @e5ae7a9 — binding): the update-apply brain-generation promotion completes only when the OLD generation's broker subscriber connection is CLOSED or stall-EVICTED — never while blocked writes still pend on it. ROOT: `brain.ready` != subscribers drained; W2's stall-evict (REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE) only BOUNDS the false-promote window to BRAIN_WRITE_DEADLINE (15s), it does NOT close it — a new brain can signal ready inside that window while the old gen's conn is still wedged, so the apply 'promotes' onto a still-frozen control plane (the 22:47 incident-night false-promote). FIX: the promotion gate (ADR-0018 brain-trial, brainproc.rs) adds an explicit DRAINED prec…\n  [OK] REQ-UPDATE-REFUSAL-EXIT-DISTINCT  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       A REFUSAL AND A FAILURE ARE DIFFERENT ANSWERS AND MUST NOT SHARE AN EXIT CODE OR A SUMMARY WORD (releases#153, doyle ruling 2026-08-21). A guard that DECLINED and did no work leaves the box exactly as it was; a failure means something broke and may have left work half-done. A caller gating on exit status therefore needs THREE answers: applied (0), refused-with-nothing-done (3), failed (1). CODIFICATION, NOT A NEW CONTRACT — the tree already answered refusals with 3 at three sites (EXIT_NOT_ELEVATED, DAEMON_STOP_REFUSED, UPDATE_FINISH_REFUSED) while cli.rs's own module doc called 1 a 'runtime refusal'; there is no migration to look for, and a fourth code would fork a convention that already reads consistently. WHAT THIS REQUIREMENT COVERS is the p…\n  [OK] REQ-UPDATE-RESTART-SAFE-SWAP  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       THE-FORKENING W4 (operator-grilled 2026-07-14; RETIRES findings-backlog seed #12 REQ-UPDATE-ONE-STEP-SAFE-SWAP): `spt update --restart` = the one-step ergonomic path to the SAFE full-cycle swap — fetch -> `update adapters` -> `apply --finish` LAST (lethal-leg-last, ruled: apply --finish restarts the whole daemon incl. broker/PTYs, so it must be the final act — everything completes from ANY invoking context including an spt-hosted session whose PTY dies at that step; accepted cost: a finish FAILURE leaves updated adapters on old-activated core briefly — loud + operator-attended by nature of the flag). Composes with `-c/--core-only` (skip adapters leg). The 0.28.0 wedge lesson closes: the ergonomic one-step no longer picks the riskier path by d…\n  [OK] REQ-UPDATE-RUNNING-IMAGE-SURFACE  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       Node status reports the running broker and coordinator image versions beside the installed version. Both running versions come from live process self-report, never disk bytes, manifests, or timestamps. Coordinator mismatch recommends only node refresh, preserving hosted sessions and networking; an unreported coordinator does not warn. Ordinary post-apply broker skew is informational because the broker intentionally survives an in-place apply. AMENDED releases#292: REQ-RESIDENT-WEB-SKEW-DIAGNOSIS is the narrow exception for positively identified missing resident web routes; that exception states the restart cost rather than advising a restart for every version mismatch.\n  [OK] REQ-UPDATE-TRIAL-DRAIN-DRIVE  required: [doc, impl, int]  stages: +doc +impl -unit +int\n       UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 — regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller-liveness reap (a KIND_SESSIONS poll) each heartbeat throughout its boot/trial loop, so a hard-KILLED prior generation's black-holed LOCAL controller conn (by:None) is stall-evicted within the trial window and can never permanently strand the promotion DRAINED gate. ROOT (2026-07-09 field freeze, `spt update fetch --apply` v0.30.0->v0.30.2 froze all 7 live PTYs ~30s then rolled back): the promote gate (run_trial, brainproc.rs:657-661) needs BOTH `ready_generation==gen` AND `old_gen_drained()`; `old_gen_drained()` = `!any_local_controller_wedged()` (brainproc.rs:534) is a PURE READ of `write_blocked_si…\n  [OK] REQ-USHER-LIFECYCLE-VERBS  required: [doc, impl, unit]  stages: +doc +impl +unit +int\n       THE ENDPOINT LIFECYCLE READS AS VERBS, AND `endpoint run` RETIRES WITHOUT A SHIM. One overloaded verb carried the whole lifecycle: `spt endpoint run` minted an endpoint, started a new session on an existing one, resumed a prior session, opened the interactive picker, and (with `--save`) set a startup default — the invocation's MEANING sat in which of nine flags were present, so the CLI could not be read and the picker's doors could not be named. The ratified surface (releases#5 bag grill, 2026-08-04) is: `endpoint create <new-id> [--subnet S] [--adapter A] [--cwd DIR]` = the ONLY mint, subnet immutable after it; `endpoint start <id> [--adapter A] [--cwd DIR]` = a NEW session on the endpoint's most-recent adapter in its most-recent project folder,…\n  [OK] REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A `rc --view` VIEWER that overflows its broker subscription queue and is EVICTED (OutputLog::append try_send Full → viewers.remove, REQ-HAZARD-VIEWER-ISOLATION session-protection) must SKIP TO LIVE, not die silently. ROOT (v0.13.0, b4 JIT item 2 = p0_paste + post-b4 a_journaled-Linux, ONE root): serve_attach forwards each frame (read_event→b64decode→re-encode AttachRecord→net_stream_send) SLOWER than the drain fans out under flood → its VIEWER_CHANNEL_DEPTH(256) channel overflows → the drain evicts (viewers.remove drops the ViewerSink → drops tx → viewer_writer's rx.recv() Err → the writer returns WRITING NOTHING) → serve_attach's brain.read_event() just STOPS getting Output (no EOF, no error) → serve_attach blocks forever →…\n  [OK] REQ-VIS-REMOTE-NOT-HIDE-NEW  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A REMOTE ENDPOINT'S VISIBILITY IS ITS OWN NODE'S BUSINESS, AND THE ASKING NODE'S `hide_new_endpoints` POSTURE GOVERNS ITS OWN ENDPOINTS ONLY. `VisibilityStore::hidden` resolves an explicit per-(endpoint, subnet) override first and otherwise falls through to `subnet_hide_new || default_hide`; a REMOTE id never has an override or a default-hide row in the ASKING node's local store, so on any node whose subnet has `hide_new_endpoints` ON that fall-through evaluates true for EVERY remote id and the resolve-side exclusion vetoes them all -- `resolve_across_visible` returns NotFound and every remote wan target is refused on that node. IT IS NOT CONSERVATIVE, IT IS BACKWARDS: `hide_new_endpoints` is the OWNING node's advertisement policy, captured at join…\n  [OK] REQ-VOCAB-ANCHOR-SUBNET  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       THE UBIQUITOUS LANGUAGE FOR AN ENDPOINT'S DEFAULT-SCOPE SUBNET IS `anchor subnet`, NOT `home subnet`. Operator-requested (discord:reavo) and GREENLIT as releases#176: `home` reads as a place the endpoint lives, which is precisely the reading the concept must not carry — identity is node-global and advertised into EVERY subnet the node belongs to, and the subnet in question anchors DEFAULTS (sync scope, bare-name qualification) rather than bounding where the endpoint exists. The glossary body already used the word `anchor` to explain what `home` meant, which is the tell: the definition needed a second word to undo the first. THIS INVERTS A RATIFIED GLOSSARY AVOID AND MUST SAY SO INLINE. CONTEXT.md carried an `_Avoid_` line forbidding the term `anc…\n  [OK] REQ-WAKE-RESUME-LEG  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       A-2 (REMOTE-TRUTH triage §A-2 + ADR-0033): the daemon reconcile gains a WAKE-RESUME LEG — an endpoint whose rest INTENT is Active but whose harness session is COLD (status != online) is resumed by the daemon via the adapter's [session.resume] template using the LAST LEDGER session id, so a bare `spt wake <id>` on a suspended live agent actually brings it back (today: reconcile_once start-arm hosts ONLY status==online (livehost.rs:199), so a woken-but-unbound endpoint is skipped forever — neither status reaches online nor does reconcile re-host). This is the ADR-0033 LIFT: the thin `spt wake` edge writes rest intent, the DAEMON does the work. Mirrors shellwake::resolve_wake (read rest state, live-pid double-launch guard, launch, NEVER flip stat…\n  [OK] REQ-WAKE-WAIT  required: []  stages: -doc -impl -unit -int\n       A-2 rider (REMOTE-TRUTH triage §A-2): `spt endpoint wake --wait` blocks on the REAL bind (status reaches online) after the daemon wake-resume lift (REQ-WAKE-RESUME-LEG), instead of the DEFAULT accepted-not-bound print (thin edge writes intent, daemon lifts async — ADR-0033). Reuses the F-027 bind-await machinery if/when it lands, else a bounded poll on status==online with a plain-language timeout (no core lingo, F-1). Default wake is UNCHANGED (accepted-not-bound truth). Separate chunk from the core leg (doyle A-2 ruling: C-2 needs the core leg, not --wait); F-027 bind-await stays design-only until this activates.\n  [OK] REQ-WAN-DENY-PRECEDES-EXISTENCE  required: [impl, unit]  stages: -doc +impl +unit -int\n       At the WAN ingress, an ACCESS DENIAL and an ABSENT PERCH are DISTINCT OUTCOMES, and the denial arm runs FIRST. `receive_wan` consults the gate before it asks whether the target's perch exists, so a refused arrival returns `WanOutcome::Refused` whether or not the target is there, and `WanOutcome::NoPerch` is reserved for an ADMITTED arrival with nothing to deliver to. The ordering is the load-bearing half and it is not an accident of layout: reversed, a denied message to an absent perch would report absence, which both mislabels the refusal AND is the precise shape that would make a later `DENIED`-style reword of the NO_PERCH line leak the existence of an endpoint deliberately hidden from the asker (the DISCOVER-denial seam, where `Existence is not …\n  [OK] REQ-WAN-REPLY-BOUND  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A CROSS-NODE REQUEST VERB BOUNDS ITS REPLY READ AND REPORTS A SILENT PEER AS ITS OWN OUTCOME, NEVER AS NoReply (releases#289, doyle ruled 2026-09-09). The six one-shot request verbs in spt-daemon wan.rs -- request_wan, request_fork, request_redeem, request_answer, request_knock, request_presence -- send one record, finish their side, subscribe, then read in an UNBOUNDED loop whose only non-error exits are a decoded reply and a stream EOF. A peer that ACCEPTS the stream and never replies and never finishes it wedges the caller forever; pre-existing since ec360f16, not a WEBSERVE regression. THE FIX IS THE CARRIER, NOT A BUDGET AT THE CALL SITE, and that distinction is the requirement: a deadline handed to a blocking Whole carrier is REFUSED outright…\n  [OK] REQ-WAN-SEND-DELIVERY  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Real root: spt send resolves the dial with id-only addr_for_node_hex (endpoint.rs:538) which forces a fresh iroh discovery round-trip every send, while the gossip pump uses cached direct addresses (dial_seeded/PeerAddrStore) so gossip stays green but send rides a marginal discovery path that cannot carry the fire-and-forget payload; the handshake completes so SENT(WAN) prints falsely. Fix: (1) route the WAN dial through the pump seeded-direct-address resolution (PeerAddrStore first, id-only fallback); (2) receiver writes its WanOutcome back so the sender confirms delivery under the QUIC deadline and only reports SENT on confirmed delivery, honest failur…\n  [OK] REQ-WAN-SPT-HOSTED-DELIVERY  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       A WAN-ARRIVED `spt send` is DELIVERED to an spt-hosted endpoint (broker holds its PTY, NO api-listen relay), not spooled-forever. Today receive_wan (spt-daemon/wan.rs:271-276) tries deliver_tcp (the harness-hosted relay leg) then falls to spool — it has NO spt-hosted broker-inject leg, which exists ONLY in local cmd_send (REQ-SEND-SPT-HOSTED, Brain::inject_endpoint → KIND_ENDPOINT_INPUT → broker dispatch_endpoint_input → translation-binary idle-inject). So a WAN arrival to an idle spt-hosted perch with a live translation binary ALWAYS sleeps in spool until an adapter hook polls (F-023: perch verifiably idle 7min, binary healthy, zero injection). FIX: factor cmd_send's spt-hosted delivery leg into a SHARED fn; receive_wan calls it after the …\n  [OK] REQ-WEB-ACCESS-SURFACE  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       WEB SERVING GETS ITS OWN ACCESS SURFACE AND IT IS MINTED BEFORE ANYTHING DIALS IT (ADR-0060, releases#272/#249/#246). Mint the `WEB` row in the OPEN surface vocabulary -- one row, no schema change, the FORK precedent -- gating every served resource reached ACROSS THE SUBNET, checked by the OWNING node under the handshake-proven origin. DEFAULT-ON WITHIN THE SUBNET, the DISCOVER shape: content in the serving registry is there by a deliberate act (ADR-0057), so the deny lever is for lockdown and not the default; deny-by-default was rejected because a second gate at every read would make the registry a list of things nobody can fetch. NON-ATTRIBUTABLE for now, and that is stated rather than implied: there is no daemon-stamped sender identity yet (the …\n  [OK] REQ-WEB-ADAPTER-DOCS-FACET  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       AN INSTALLED ADAPTER'S OWN DOCS ARE SERVED UNDER A RESERVED docs SEGMENT OF ITS ADAPTER FACET, AND THE SEGMENT NEVER FALLS THROUGH (releases#265, WEBSERVE W3, doyle ruled 2026-09-07 12:06Z). The adapter facet already serves the core-owned web root of an adapter; this adds the adapter's OWN documentation BESIDE it at the reserved docs segment rather than replacing what that URL already means -- the alternative, letting docs take over the facet root, would change the meaning of a URL shipped one wave earlier, which is precisely the pasteable-between-machines property the URL grammar was built to buy. THE SEGMENT IS ROUTER-FIRST AND RESERVED, the same posture the reserved facets take: with the manifest key set it serves the adapter's docs directory; w…\n  [OK] REQ-WEB-ATTACHMENT-PULL  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       AN ATTACHMENT IS A SNAPSHOT REGISTERED FOR SERVING AND THE MESSAGE CARRIES ONLY ITS URL (ADR-0058, releases#272/#246). `spt send --attachment <path>` COPIES THE BYTES AT SEND TIME into `$SPT_HOME/serve/snapshots/` and registers an entry of kind attachment, because a message's attachment is as immutable as the message -- this is the ONE place the serving registry does NOT resolve at request time, and it is exactly what distinguishes an attachment from a `serve add` file entry: an edit after the send must NOT change what the receiver pulls, and deleting the source must NOT turn the link into a 404. NOTHING IS PUSHED TO THE RECEIVER. The envelope grows an ADDITIVE `attachments` key -- a list of {name, url, bytes} whose url is the node-prefixed `/<node…\n  [OK] REQ-WEB-CROSS-NODE-PROXY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A NODE-PREFIXED URL FOR A SUBNET PEER IS SERVED BY THE OWNER THROUGH THE LOCAL DAEMON, WITHOUT A CACHE (ADR-0056, ADR-0060, WEBSERVE W1, releases#272/#249). A request on the loopback server for `/<peer>/...` where `<peer>` is a KNOWN subnet member opens ONE Iroh stream of a NEW TAGGED stream family (kind web -- the Knock shape: an N-1 owner has no arm, classifies it Unknown and drops it, so the requester answers 502 naming the node under a DEADLINE, never a hang) and relays the owner's answer back verbatim. THE OWNER DECIDES: it runs access_check on the WEB surface with the origin taken from the HANDSHAKE-PROVEN stream identity (the serve_xfer shape, REQ-HAZARD-WAN-ORIGIN-AUTH), the subject being the served entry's registering endpoint, and a refus…\n  [OK] REQ-WEB-ENTRY-AUDIENCE  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A SERVING ENTRY MAY NAME THE ONE ENDPOINT ALLOWED TO FETCH IT, AND THAT AUDIENCE IS ENFORCED WHEREVER THE ORIGIN IS PROVEN (ADR-0058 Amendment 1, operator-directed 2026-09-06, releases#272/#17). `audience` is a PER-ENTRY, KIND-INDEPENDENT field sitting beside ttl: ABSENT means the entry is reachable by anyone the WEB surface admits, which leaves REQ-WEB-ACCESS-SURFACE's default-on subnet posture UNCHANGED; PRESENT means the owner serves the entry ONLY to that endpoint id and answers everyone else 403 NAMING THE SURFACE -- deliberately the SAME refusal shape a WEB deny rule produces, so a narrower audience is not distinguishable from a denial by probing, and the registry does not become an oracle for what exists. IT IS ENFORCED WHERE THE FETCH ORIGI…\n  [OK] REQ-WEB-FETCH-VERB  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       `spt fetch <url> [dest]` IS THE ONE-COMMAND PULL AND ITS EXIT CODES SEPARATE REFUSED FROM FAILED (ADR-0058, releases#272/#246). It accepts a full node-prefixed URL or the bare `<node>/f/<name>` shorthand, writes the bytes to `dest` (default: the URL's basename in the current directory), REFUSES TO CLOBBER an existing dest without `--force`, and PRINTS THE WRITTEN PATH on success so a caller can pipe it. THE THREE OUTCOMES ARE DISTINCT AND THAT IS THE WHOLE POINT: exit 0 wrote the file; exit 3 the owner REFUSED (403 -- an access decision, not an error, and a caller that retries it is wrong); exit 1 is everything else (unreachable owner, not-found, a deadline, a local write error), each naming its cause on stderr. This verb's spelling is a PUBLISHED …\n  [OK] REQ-WEB-LAN-BOOTSTRAP-INTEGRITY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       THE BOOTSTRAP LISTENER SERVES THE ARTIFACTS OF THE APPLIED SIGNED SET, PER-TRIPLE SHA-ANCHORED, OR IT SERVES NOTHING (ADR-0059 Amendment 1, ADR-0015 trust roots, releases#266). The puller EXECUTES what it downloads over plain HTTP, so access rules are not the story -- the bytes need provenance, and three conjuncts are ALL required. SET GATE, WHOLE LISTENER: the served set is the release-cache set whose HOST-TRIPLE artifact hash equals the running daemon's own executable (canonical path captured at start, never a per-request current-exe lookup) AND whose applied state reads applied at that set version; failure refuses the start BY NAME -- LAN_BOOTSTRAP_REFUSED with unsigned-exe, sha-mismatch, or set-not-applied -- and serves nothing. There is delibe…\n  [OK] REQ-WEB-LAN-BOOTSTRAP-LISTENER  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       A SECOND, OPT-IN, OPERATOR-STARTED LISTENER SERVES THE INSTALLED BINARY TO STRANGERS ON THE LAN, AND IT IS NOT THE DOCS SERVER (ADR-0059, releases#266, WEBSERVE W3). The serve lan --bootstrap verb starts a SEPARATE listener on all interfaces at port 5470 (config and env override) whose router knows ONLY the per-triple binary path, the provenance sidecar beside it, and a one-liner install page -- nothing else exists in that process. ITS AUDIENCE IS BY DEFINITION A STRANGER WHO IS NOT YET A NODE: a fresh box has no network identity, so no access chain can run and the listener must never grow a membership concept; the ONLY gate is the operator's explicit start. OFF BY DEFAULT, serve lan --stop takes it down, the LAN URL is printed at start, and the no…\n  [OK] REQ-WEB-SERVING-REGISTRY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       THE SERVING REGISTRY IS THE PRIMITIVE AND SERVED NAMES ARE STABLE AND DISAMBIGUATED (ADR-0057, releases#272/#248). The registry is the node's single enumerable list of what it exposes, and exposure is a DELIBERATE ACT of adding an entry -- so what-is-this-node-serving has exactly one answer. A served root (a dir entry an adapter declares in its manifest) is NOT a second mechanism: it is a registry entry of kind dir, which is what keeps the audit to one command. A drop-folder primitive was rejected because exposure would become a property of where a file happens to sit. STORE: `$SPT_HOME/serve/registry`, spt-store owns the format and the read path, the DAEMON IS THE SINGLE WRITER. ENTRY: id, kind (file | dir | attachment), absolute source path (file…\n  [OK] REQ-WEB-URL-NODE-PREFIX  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       EVERY SERVED URL IS NODE-PREFIXED, LOCAL RESOURCES INCLUDED (ADR-0056, WEBSERVE grill round 1+2, releases#272/#249). ONE GRAMMAR: the 5474 server answers `/<node-name>/...` for every facet, and a resource on this node is reached by the SAME path here and on every other subnet machine -- the local daemon resolves the prefix and proxies to the owner when it is elsewhere. WHY ONE GRAMMAR AND NOT TWO: un-prefixed-local plus prefixed-remote was rejected because a URL would then mean different things depending on which machine it was pasted into, and a URL that cannot be pasted between subnet machines is a path, not a link -- which is exactly what #147 message links and #17 FILE_ACCESS_HELPER need it to be. Bare `/` REDIRECTS (302) to `/<local-node>/`. T…\n  [OK] REQ-WHOAMI-1  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       The `endpoint list` SELF pin carries the Self endpoint's authored `endpoint description` (info::read_info(...).resources) when present, inline after the liveness state; whoami stays a top-level hot-path verb (parse unchanged, REQ-MSG-9) and renders the same description-carrying SELF pin. HISTORY: originally minted whoami as a thin ALIAS of `spt endpoint list` — that alias premise is SUPERSEDED by REQ-WHOAMI-IDENTITY-ONLY (PROJECT-INDEX W1, 2026-07-15): the alias inherited the list's O(perches x branches) git fanout onto hook paths (the 2026-07-15 message-delivery incident), so whoami is now identity-only over the shared render_self_pin. The pin render + parse evidence here stands; the full-roster surface lives solely on `endpoint list`.\n  [OK] REQ-WHOAMI-EXPLICIT-SID-REFUSAL  required: []  stages: -doc -impl -unit -int\n       RULED DESIGN, delivery unowned (doyle 2026-07-26): when a caller hands identity resolution an EXPLICIT non-empty $OWL_SESSION_ID that resolves to NO perch, core must REFUSE identity (unresolved, exit 1, loud distinct diagnostic) rather than fall through to an ambient/inherited one — today `detect_self_id` (roster.rs, legs a→b→b2→c) treats sid-UNMATCHED identically to sid-ABSENT, so the fallback chain re-adopts precisely the identity a sharper claim just failed to prove. MEASURED (perri, this node, 2026-07-26, three read-only whoami calls from a genuine descendant of the perri host process): (1) all SPT_*/OWL_* scrubbed → id null, exit 1 — ancestry resolved nothing (caveat honored from the probe: the perch's recorded pid was not in the c…\n  [OK] REQ-WHOAMI-IDENTITY-ONLY  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-critical opener — the 2026-07-15 message-bodies incident root): a core IDENTITY-ONLY resolution — session -> endpoint|null — that touches NO list/registry/project/git/network path, and `spt whoami` DE-ALIASED from cmd_endpoint_list (cli.rs ~6609 aliases the full list = 100+ git children under hook deadlines). endpoint-info is DISQUALIFIED as the carrier (runs latest_project_ref). Adapters/hooks get a bounded-time identity verb; the harness-hosted adapter fallback stays deadline-vulnerable until this ships. Gate: impl — the resolver + whoami de-alias; unit — resolver returns endpoint|null with zero project derivation (assert no git spawn seam);…\n  [OK] REQ-WORKER-LIST-VISIBILITY  required: [impl, int]  stages: -doc +impl -unit +int\n       V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view — they are process-local machinery, not subnet citizens; leaked-or-live worker rows rendering as permanent OFFLINE endpoints is the operator-visible symptom root. A dedicated flag (--workers) reveals them (one command + flag per the --all/--detail precedent, NOT a separate list-working command — sister divergence deliberate). Applies to the human render, --json (additive default-absent filter), and the registry/projection legs; verify-and-stop any worker gossip into the subnet registry as peer endpoints.\n  [OK] REQ-WORKER-MINTED-NAME  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       N-1 (WORKER-TRUTH triage, operator rider): worker perch identity is CORE-MINTED and parent-derived — `{parent}-w{N}` with a per-parent counter at registration (sister shape: claude_skill_owl hook_subagent_start.rs) — never the adapter-presented agent id (CC Task ids render as random-named rows). worker-start mints + echoes the id (WORKER_STARTED:{parent}-w{N}); the adapter's agent_id/agent_type ride the record as correlation METADATA, not identity. Verb-shape contract change — freeze with W-2 in ONE coordination with perri.\n  [OK] REQ-WORKER-PICKER-EXCLUDED  required: [impl, unit]  stages: -doc +impl +unit -int\n       V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as picker rows — a worker perch cannot be driven, instantiated, or controlled; offering it is a lie the picker then fails on. Filter endpoint_type worker (and the psyche class if it ever surfaces — same non-drivable family) at every picker source leg, extend-not-multiply for future non-drivable classes.\n  [OK] REQ-WORKER-REAP  required: [impl, unit, int]  stages: -doc +impl +unit +int\n       W-3 (WORKER-TRUTH triage): worker records must not persist indefinitely past their useful life — 6 dead-pid workers leaked OFFLINE on flynn (kill-paths where SubagentStop never fires: parent killed, abort, timeout). The stored rec.pid is the ephemeral worker-start hook process (dead by design — the REQ-HAZARD-DEAD-REC-PID class; NEVER an alive-gate signal). Honest reap signals: (a) parent-session lifecycle — reap the parent's soft-stopped + orphaned workers at parent session-end/boundary and on parent-death detection (a worker cannot outlive its parent's live session); (b) a generous TTL floor since `created` as belt-and-braces. Soft-stop preservation semantics (REQ-HAZARD-SOFT-CLEANUP: results drain before reap) stay honored — reap after d…\n  [OK] REQ-WORKER-SID-SYMMETRIC-AUTH  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int\n       W-2 (WORKER-TRUTH triage, operator-ruled 2026-07-06): worker verbs go sid-symmetric with every sibling id-scoped verb — worker-start mints NO token and worker-stop takes NONE (token custody is undue adapter burden, ruling via perri). Registration STORES the sid it authenticated (the parent's sid at start; today cmd_worker_start hardcodes session_id=\"\" — worker.rs:44 — so a sid-authed stop compares against empty and refuses 100%). Stop accepts the parent's CURRENT sid OR the stored registration sid (a /clear between start and stop rotates the parent's sid; either rotation endpoint is honest custody — the REQ-PSYCHE-SID-CUSTODY rotation reasoning). Under the ruling the field adapter's existing emission (worker-stop <id> --session-id <parent s…\n  [OK] REQ-XFER-RETIRED  required: [doc, impl, unit]  stages: +doc +impl +unit -int\n       XFER IS RETIRED FROM THE CONTROL-SURFACE VOCABULARY AND ITS TRANSFER MACHINERY LEAVES THE TREE WITH IT (ADR-0060, releases#272/#246, close rider on the WEBSERVE milestone). MEASURED BEFORE THE RULING (main 8a21a3b0): the transfer INITIATORS `fetch_file` and `push_file` have ZERO production callers -- no verb opens the Xfer stream -- while the SERVE side was live: the daemon gated the inbound Xfer stream on `XFER`, knock codes were mintable for it, rules could name it; zero grant rows named it on the measuring node. The pull-model attachment (ADR-0058) supersedes the machinery, so the Xfer stream family, its serve gate, its tests and the surface row leave TOGETHER -- a row left behind would gate traffic that no longer exists, which is a promise the …\n  [OK] REQ-XTASK-SPT-BIN-TARGET-DIR  required: [impl, unit]  stages: -doc +impl +unit -int\n       #13 (F026 micro, tooling): xtask `spt_bin()` (crates/xtask/src/main.rs) BUILDS `spt` via cargo (which honors CARGO_TARGET_DIR) but returns a HARDCODED `<root>/target/debug/spt` path — so under a redirected target dir (CI / isolated-gate rigs that set CARGO_TARGET_DIR to a throwaway) the binary lands in `$CARGO_TARGET_DIR/debug` while xtask looks in `<root>/target/debug` -> NotFound -> `xtask check` (docs-drift gate) spuriously fails. Workaround was running `xtask check` with CARGO_TARGET_DIR unset. FIX: a pure `target_debug_dir(root, CARGO_TARGET_DIR)` seam mirroring cargo's resolution — absolute override as-is, relative resolved against `root` (the dir cargo is invoked in), default `<root>/target` — join `debug`; `spt_bin` returns from it. S…\n\nnote: 2 tag-carrying file(s) not placement-judged (no grammar for the language, or the parse recovered from errors)\n\n\nWall time: 3.63 seconds\n\n[Showing lines 1-63 and 1751-1812 of 1812; 1,687 middle lines (572.4KB) elided. Read artifact://221 for full output. Some lines truncated to 768 chars]",
  "details": {
    "timeoutSeconds": 90,
    "wallTimeMs": 3633.3058000057936,
    "meta": {
      "limits": {
        "columnTruncated": {
          "maxColumn": 768
        }
      },
      "truncation": {
        "direction": "middle",
        "truncatedBy": "middle",
        "totalLines": 1812,
        "totalBytes": 1395272,
        "outputLines": 126,
        "outputBytes": 51223,
        "headRange": {
          "start": 1,
          "end": 63
        },
        "tailRange": {
          "start": 1751,
          "end": 1812
        },
        "elidedBytes": 586101,
        "elidedLines": 1687,
        "artifactId": "221"
      }
    }
  }
}