# REMOTE-FRICTION — execution plan

Authority: operator explicitly confirmed and GREENLIT releases#304 on 2026-09-11. All eight decisions in REMOTE-FRICTION-GRILL.md bind this plan. No scope drops without recorded operator ruling and relocation/EVAL disposition.

## Ownership and mutation contracts

- Doyle: scope, requirement/ADR integration, capacity allocation, wave acceptance, golden assembly, release orchestration.
- Todlando: product implementation for all eleven requests, product docs and requirement evidence. No test-only cleanup or CI rewrites.
- Hertz: regressions, test/rig repairs and infra workflow/tooling riders. No production fixes without handing the finding to todlando.
- Deployah: independent golden-head intake and execution; returns reds to doyle. Doyle never runs golden CI.
- Each author uses an owned source tree under .worktrees/ and its own claimed pool. No shared-file edits across authors without an explicit ownership handoff. Todlando owns initial product requirement additions; hertz sends test mappings before editing shared traceable-reqs.toml. Doyle owns this plan, grill journal and infra intake record on main.
- Concurrent editing lanes skip validation while mutations overlap. Run scoped checks after a wave is stable and capacity/load preflight passes; full milestone suites belong to golden.

## Waves and acceptance

### W0 — prerequisites, concurrently with product implementation

Hertz: compose IR-31/46/59/60/76/86/87/90/97 into one driver/workflow lane: measured aggregate capacity, actual producer exit status, existing quiet-window contract, independent rendezvous clocks, failure-time disk observations and between-run process census. Reuse existing disk-floor/floor tokens; do not rebuild them. Adopt IR-88's prebuilt release-before-delete recipe. Include small same-tooling riders IR-32 (failed/empty generator refusal), IR-37 (released checker downstream adoption), IR-40B/47 (truthful notification scope and absent attribution). Before tests, enumerate exact executing targets and capture real status. No budget widening or causal inference from load alone.

Doyle: allocate capacity against measured incremental growth plus protected reserve. Windows currently lacks the 32 GiB reserve before any new growth; identify owner-confirmed reconstructible artifacts, outbound/inbound reparse links and active consumers before reclamation. Preserve all retained evidence. No speculative deletion of operator data. Linux capacity is a separate measured allocation, not an assumed escape.

### W1 — bounded serving and command usability

Todlando owns #301 node-root redirect, #282 bound-listener-port URL derivation, #288 accurate cmd-capability wording and #251 viewer detach. Preserve docs/facet routing and remote node semantics. Viewer detach must work without input forwarding or controller displacement. Hertz supplies focused regressions. IR-78 notice rides actual docshost changes; IR-32 precedes reference regeneration. Amend ADR-0056 for the operator's root ruling.

Acceptance: actual local/remote root lands on docs; minted URL reaches the fixture's actual listener rather than fleet; unknown shell cmd names only cmd capabilities; read-only viewer detaches while hosted process and controller survive.

### W2 — bootstrap admission and file intent

Todlando owns #297 and #300. Bootstrap uses actual executable/TCP port, installation-equivalent network scope and existing elevation mechanisms. Firewall refusal/cancellation never falsely means unreachable: proceed with otherwise-valid bootstrap, warning and rerun guidance. Stop listener regardless of rule cleanup; remove only owned TCP rule and report residuals. No docs LAN exposure or tailnet-policy changes. Amend ADR-0059.

USER_INPUT is the helper trigger. Preserve authenticated controller/user-node origin and committed input identity; no MSG_OUT requirement or terminal-keystroke parsing. Reference serving, 24h TTL, receiving-endpoint audience and once-per-input/path behavior stay binding. Amend ADR-0058's message-specific origin language to the ruled input contract. Product-side IR-92 successful-inject MSG_IN observation is a distinct IO rider, not a substitute for USER_INPUT correctness. IR-70 only if construction/sink seams are actually touched.

Acceptance: two-machine bootstrap fetch plus elevation denial/cancel, port override, repeated start/stop and rule ownership cases. Real remote RC USER_INPUT creates scoped helper; modifications are visible, deletion yields 404, duplicate processing does not duplicate guidance/grants.

### W3 — responsiveness and truthful client guidance

Todlando owns #299 roster stalls, #302 recurring local/remote hitches, #49/#267 refresh/update freezes, and #230 ATTACH_CLIENT_STALE. Diagnosis precedes fixes; symptom similarity does not merge causes. Hertz owns reproduction instruments/regressions. Preserve complete rosters and queued terminal input; no timeout widening, partial-output fallback or silent rerun-as-fix. #49 must explain prior failed-fix coverage. Its old #42 joint-release coupling is explicitly superseded.

For #230, release-maintained policy carries minimum recommended client version, platform/attach-role applicability and concrete degraded-function reason. Unknown client versions do not trigger the warning; ordinary skew does not trigger it. Delta-only notice, no forced detach; advise client reopen or client update/reopen as appropriate, never daemon restart for client-only skew.

Acceptance: measured original standalone roster scenario without unnecessary wait and without lost rows; sustained actual local and remote terminal interaction across the reported hitch interval; existing views remain usable across refresh/update with no manual reattach; positive/negative/unknown/applicability cases for the new signal. IR-94 is mandatory before any bounded serve_sync carrier migration; IR-95 instrumentation stays scoped to investigated waits. IR-72 only if roster read-model changes; no unsolicited diagnostic product.

## Infra dispositions outside immediate riders

All 97 entries were audited. Built/retired work stays built/retired. IR-7/17/20/22/25/34/35/55/63/79/80 remain the lifecycle hardening package: adopt only the cells/shared seams needed by this milestone's actual rigs, with hard-death cleanup distinct from Drop. IR-81/82 remain separately owed product obligations; not declared satisfied by adjacent work. IR-14/26/27/49 govern pool/custody work; do not rebuild enumeration or build-side enforcement. IR-74/75 ride a Linux box audit if that lane is used. IR-83/89 require receipt reconciliation, not fresh box configuration. IR-2/64 capacity-policy changes, IR-41 concurrency-policy changes and IR-93 symbol packaging are not silently authorized. IR-85/96 remain separate cause-unclassified investigations. All other entries retain their recorded conditional triggers; any touched trigger is reevaluated in the relevant wave.

## Integration and release

Each wave returns immutable commits, exact requirement mapping, scoped evidence and explicitly unexecuted acceptance. No phase is complete on compilation alone. Doyle merges the full member chain off current main, runs compile/traceability pre-handoff checks under allocated capacity, and records exact scope on #304. Version, lockfile, changelog and generated docs are part of the tested candidate. Deployah validates the greenlit form and executes golden. Reds return for diagnosis; no broad retries without a ruling. Advance main to the approved tested SHA under ADR-0050, publish signed release through the existing release runbook, verify published artifacts/docs/update metadata, reconcile request states, and perform the required infra release-close sweep.

The doyle/emphasys hosted-relay classification experiment is separate and remains capacity/isolation gated. Its findings do not silently add #303 or reopen the CUT request.