#300 design packet — source findings, not an implementation or acceptance claim
Source: .worktrees/304-product at d89a655f. Production token changes held by Doyle.

1. Ordinary remote-RC path today
spt/src/rc.rs::pump forwards opaque StdinMsg::Bytes as AttachRecord::Input. spt-net/src/net/attach.rs documents Input.op_id as PTY-write dedup, not semantic submission identity. spt-daemon/src/attach.rs::serve_attach receives the handshake-proven origin and forwards journaled input through the controller lease. The target harness interprets the terminal stream. Only later its adapter calls api state busy with the semantic payload (spt/src/api/mod.rs State; delivery.rs::cmd_state/publish_state_io). That call has endpoint/session authentication but no origin receipt or stable input ID. IoEvent carries neither. docs/MANIFEST.md [io] declares parsing compliance, not input correlation.

This is the only existing ordinary-RC route found to USER_INPUT. Origin is known at byte delivery; semantics are known later at the harness. There is no carried association between them. Input.op_id cannot be relabeled a prompt ID: one prompt can consume multiple chunks, a chunk can contain multiple submissions, and editing/queueing breaks equality. Digest turn sequence is also unsuitable: MANIFEST.md says the trailing partial turn has no stable seq until it closes.

2. Handoff counterexample
A types/submits a prompt; the harness queues it. B takes control before A's USER_INPUT hook runs. Sampling driven_by attributes A's path to B. Sending the semantic event back on B's authenticated attach proves B received it, not B authored it. Sampling the last input writer also fails with later queued input. A lease token minted only at the eventual hook has the same defect. Payload hashing binds content after identity exists; it cannot recover missing origin.

3. Public capability necessary for fully automatic ordinary-RC behavior
A versioned semantic-input-provenance capability would need BOTH (a) a receipt-bearing input transport consumed by the harness/adapter, preserving authenticated origin-node, endpoint incarnation and controller lease alongside input through its editor/queue; and (b) semantic commit reporting that returns a stable submission ID, the relevant receipt(s), and exact final payload. Core verifies receipts, fixes the origin/lease before deferred processing, and binds the commit ID to the payload digest. Mixed-origin or missing receipts refuse grants. Replayed commit returns the same result; changed payload under the same ID refuses; a new lease cannot redeem the old lease's submission. Owner-side authorization must validate the originating node's receipt/consent and extract only quoted paths from the bound committed payload; audience and 24h TTL are fixed. Replays cannot extend grant expiry.

This cannot be supplied by adding a field to api state alone. A generic PTY transports bytes, not out-of-band semantic provenance. Existing external terminal harnesses would need a real correlated-input integration (native hook/extension or structured submission channel) and adapter support. No existing manifest facility or transport implementing that integration was found. Core must not parse terminal keys to synthesize it. An optional capability leaves legacy terminal operation intact but legacy adapters cannot meet automatic #300 acceptance. No claim is made that a capability declaration alone delivers the behavior, or that existing shipped adapters can implement it without harness changes.

4. Smallest explicit-consent alternative (different flow; requires operator ruling)
Keep ordinary remote RC and its target-side USER_INPUT event. Treat quoted remote paths as REQUESTS ONLY. On the user's RC client, display the exact local path(s), receiving endpoint/node, live-reference semantics and 24h lifetime; require a fresh explicit user approval before the originating node registers anything. Approval itself is the local authorization, rather than a claim that the earlier input was authored by that controller. Fix the proposal to one input identity/payload and endpoint incarnation; a controller handoff cancels an outstanding proposal rather than transferring it; viewers cannot approve; replay never re-prompts or extends an existing grant. Registration uses the existing scoped-reference path and helper guidance after success. No approval means no grant. Limit proposals to quoted paths from USER_INPUT, never parse raw keys.

This preserves normal typing but adds a local file-sharing consent step. It deliberately does NOT satisfy the currently ruled automatic ordinary-RC acceptance. It is smaller than replacing RC with an origin-side compose/submit editor, which would also change the input flow and require structured harness submission.

Decision requested from Doyle/operator: authorize a concrete harness-correlated transport and adapter delivery scope, or explicitly amend acceptance to fresh local path-sharing consent. Until then, no token implementation, current-controller inference, or refusal-only claim of completion. Independent W3 and IR92 source work can continue. Hertz has been told not to author tests around controller sampling.