fixes #228

CONDUIT W2. Branch off `f1395b6a`; head `e4c122cc`. doyle ruled shape **(c) with conditions** on releases#228 — (a) not built, (b) rejected (ADR-0048 untouched).

## The defect

Daemons boot before endpoints do. The once-per-generation boot sweep of releases#78 skips an owner endpoint that is not up yet — correctly, by its own conjunct, since an offline owner is owed nothing — and then **nothing revisits it**: the sweep does not run again this generation, and bringup from offline emits no rest edge, so the ADR-0048 cascade never fires either. The shell stays down until a `shell cmd` wakes it or an operator relinks by hand. Whether a node restart strands its shells is an ordering accident, which is exactly the intermittency the ticket reported.

Dating, because it changes what this is: `REQ-SHELL-PERSISTENT-BOOT-RESTORE` landed 2026-08-02 and this was filed 2026-08-26. Not that class recurring — the slice that lane left in the seam.

## The fix

The reconcile loop runs the **same per-owner body** the sweep runs, triggered on owner offline→online transitions since the last pass.

| Condition | Where it is honored |
| --- | --- |
| adapter `persistent`, owner online, down in fact, launch predates boot, no boot oracle ⇒ nothing | one shared `restore_persistent_shells_of_owner` — carried by construction, not restated |
| edge, not level | `OwnerOnlineEdge::transitions` — a failing launch gets one attempt per owner-online event, not one per tick |
| force-kill ruling preserved | `launch_predates_boot`, monotone within a machine boot — a later evaluation can only refuse MORE |
| watcher mutual exclusivity | the edge path stops an armed watcher before launching; the boot sweep passes none (no watcher exists before the first tick) |

The edge state is seeded **before** the sweep: seeded after, an owner coming online in the window between the two would read as already-online and never fire. Seeded before, the worst case is a second attempt at an instance the sweep already restored — refused by the **restamped birth stamp**, not by the down-in-fact arm (a launch is not the online switch, so a just-restored instance still reads as down until its `bind-shell` handshake).

Each trigger names itself in its event line (`SHELL_OWNER_ONLINE_RESTORED` vs `SHELL_BOOT_RESTORED`): the field diagnosis of this ticket was a count of those events in a rotated daemon log.

## The comment that contradicted the ruling

`spawn_wake_host` claimed running the restore per tick "would relaunch a shell an operator force-killed seconds after they killed it". That contradicts the ruling `reconcile_once` records at its own start side, and it is mechanically false — a shell an operator can kill this boot was launched this boot, so its stamp postdates `boot_ms` and the discriminant refuses. Replaced, and the doc-stage text stating the sweep as the only trigger swept with it: `CONTEXT.md`, `docs/KNOWN-HAZARDS.md` 2.7 (entry, table row, and both mapping lines), `docs/MANIFEST.md` Sleep/wake and the field line, plus the two published `docs-site` surfaces (`shells/overview.md`, `harness-contract/manifest.md`) — the second stated it as "not by the owner's own online edge", which is the sentence this change falsifies.

## Registry

Mints and activates `REQ-SHELL-OWNER-ONLINE-RESTORE` (doc/impl/unit).

## Evidence

Every verdict read from its own `.exit` file, never a wrapper's status.

| Leg | Verdict |
| --- | --- |
| `traceable-reqs check` | 0 — new REQ `+doc +impl +unit` |
| `cargo nextest -p spt-daemon` (shell/wake/restore/reconcile filter) | 0 — 111 run, 111 passed |
| `cargo clippy --workspace --all-targets -- -D warnings` (Windows) | 0 |
| `xtask check` | 0 |
| Linux clippy (`reavus@kitsubito`, at this sha) | 0 — `SHA=e4c122cc…` echoed by the same command |

### Hazard test, three arms in one fixture

`an_owner_coming_online_after_a_spent_sweep_restores_only_its_restart_casualty` brings an owner online **after** a spent sweep with **no rest edge anywhere** in its setup, tagged `[unit->REQ-HAZARD-RESTART-STRANDS-PERSISTENT-SHELLS]`, `[unit->REQ-SHELL-PERSISTENT-BOOT-RESTORE]`, `[unit->REQ-SHELL-OWNER-ONLINE-RESTORE]`.

Both discriminating arms were mutation-proved rather than asserted — a green that cannot redden is not evidence:

| Mutation | Leg exit | What reddened |
| --- | --- | --- |
| level trigger instead of edge | 100 | `["ling/mock-owner-online-2"]` — the freshly stranded instance restored with no new owner-online edge |
| predates-boot arm dropped from the shared body | 100 | `["…-0", "…-1"]` — the this-boot force-kill came back too |

Source restored byte-identical after the table (sha256 `5d9e75ec…` before and after, asserted in the harness rather than eyeballed).