=== PAIR 1 / 132 === REQ-ACTIVITY-INFO-PULL <-> REQ-LIST-JSON-LIVENESS-PARITY A: The endpoint's current activity state (busy|idle) is readable via `spt api endpoint-info` — a point-in-time read of the perch idle sentinel, for consu B: GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (human) and `endpoint list --json` MUST report an IDENT === PAIR 2 / 132 === REQ-HAZARD-LIVEHOST-NONRESIDENT <-> REQ-RC-RECONNECT-TRUTH A: A daemon-hosted Psyche that spawns then EXITS IMMEDIATELY is a host failure, surfaced like a spawn failure (closes the v0.8.1 residual masking): the R B: W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-proven (the operator's long-standing 'stop 2-4 times' === PAIR 3 / 132 === REQ-STREAM-LIFETIME-CLASS <-> REQ-STREAM-OPENER-DURABLE A: RESCOPED at W2 activation 2026-07-22 (doyle verify-first, C3-retirement precedent): the CLEAN-CASE chain this REQ was minted for is ALREADY SHIPPED un B: REDISPATCH-TRUTH W1 (ADR-0038, hertz fix B): stream classification identity is RESTART-DURABLE and independent of the evictable data ring — today reco === PAIR 4 / 132 === REQ-BROKER-SCREEN-GRID <-> REQ-HAZARD-CONTROLLER-LEASE A: Bugs #6 + #12 + #7/#8-artifacts: the broker is a raw-byte pump with no screen model — OutputLog replays the raw ring from seq 0 into a fresh terminal B: RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 — umbrella conformance seam for ADR-0044): at most one input-capable controller lease per PTY session; takeover === PAIR 5 / 132 === REQ-PICKER-NODE-GROUPING <-> REQ-WORKER-LIST-VISIBILITY A: Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253 iterates per-subnet, groups by subnet:node, no cr B: V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view — they are process-local machinery, not subnet ci === PAIR 6 / 132 === REQ-EP-8 <-> REQ-HAZARD-DAEMON-STOP-REAP A: AlwaysOnEndpoint: a resident, addressable, mindless endpoint whose adapter binary the daemon supervises continuously — register-triggered by an adapte B: Breap: `spt daemon stop` REAPS the spt-hosted children it spawned — no orphaned psyche/harness processes. Today a stop leaves ~8 orphaned claude-spt-p === PAIR 7 / 132 === REQ-RC-MOUSE-FORWARD <-> REQ-SCREENGRID-REPAINT-MODE-REPLAY A: On Windows, `spt rc` must FORWARD scroll-wheel events to the harness when the harness has mouse reporting on. ROOT (operator HITL): P1's RawGuard Enab B: RC-RENDER-TRUTH W3 (ADR-0043 decision 4, hertz stale-glyphs RCA leg 4 P1): ScreenGrid cold repaint replays EVERY tracked render-affecting mode — DECST === PAIR 8 / 132 === REQ-HAZARD-IDLE-SILENT-NONDELIVERY <-> REQ-INST-6 A: An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared), spawn-failed, FAULTED, or its inject-worker chan B: Deferred messages not delivered to dormant/suspended instances === PAIR 9 / 132 === REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP <-> REQ-PSYCHE-STAMP-CLEAR-ANY-SUCCESS A: Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via the cmdline-scoped guard (`psyche_orphan_should_reap B: W1 (LIFECYCLE-TRUTH): EVERY successful psyche operation clears psyche_host_error — not just the pulse-loop leg. ROOT (three field confirmations, perri === PAIR 10 / 132 === REQ-API-3 <-> REQ-HAZARD-ENVELOPE-PARSER-SAFE A: commune/signoff are file-drops, not commands B: Two-slice envelope parser is panic-free and tolerant (4.2) === PAIR 11 / 132 === REQ-HAZARD-DEFERRED-DRAIN <-> REQ-HAZARD-DEFERRED-SURVIVE-DRAIN A: Deferred spool rows excluded from the event-stream drain (1.4) B: Deferred rows survive poll drain (4.4) === PAIR 12 / 132 === REQ-UPD-1 <-> REQ-UPD-2 A: Peer-propagated update over P2P B: All binaries signature-verified before handoff === PAIR 13 / 132 === REQ-ADAPTER-UNRESOLVED-HINT-FORM <-> REQ-TRANSLATE-COMMAND A: F-034 leg a (perri/hertz field finding 2026-07-09): the ADAPTER_UNRESOLVED refusal hint must print a WORKING command form. It currently says 'pass --a B: `[message-idle-translation-binary]` accepts a `command` (opaque; args + ADAPTER-STATIC {adapter_dir}/{adapter_name} substitution ONLY — ratified v0.16 === PAIR 14 / 132 === REQ-HAZARD-PARENT-PID-PREFER <-> REQ-SELF-DETECT-PARENT-PID A: Prefer stable parent PID / broker handle over ephemeral PID (2.1) B: E-1 (REMOTE-TRUTH triage §E-1 #7): self-detect leg (c) — the pid-ancestry fallback — ALSO candidates on `rec.parent_pid` (the harness pid, CONTEXT's ' === PAIR 15 / 132 === REQ-HAZARD-VIEWER-CLOSE-DETACH <-> REQ-RUN-EMPTY-CREATE A: A VIEW is independent from the endpoint: closing the tab/window where `spt endpoint run` was invoked must detach ONLY the `spt rc` attach pump — the d B: `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha === PAIR 16 / 132 === REQ-PICKER-PROJECT-HISTORY-TRUTH <-> REQ-PUMP-STAGE-TRUTH A: #1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_for_dir) UNION context-store branches, EXCLUDING o B: MESH-RECOVERY W1 (ADR-0039, RCA wave 3 — the acceptance surface, same contract): peer-failure telemetry is STAGE-SPLIT and health is USER-MEANINGFUL. === PAIR 17 / 132 === REQ-HAZARD-CONTROLLER-LEASE <-> REQ-PICKER-CONTROL-LINE-STATUS-GATE A: RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 — umbrella conformance seam for ADR-0044): at most one input-capable controller lease per PTY session; takeover B: A2 (F028, operator #2): the picker confirm-panel 'controlled locally' line renders for OFFLINE endpoints. view.rs:425-436 builds control_line from ep. === PAIR 18 / 132 === REQ-INSTALL-10 <-> REQ-PAIR-NTP-MULTIHOME A: Windows at-logon autostart runs the daemon in the background with no persistent window: the scheduled task launches `spt daemon start` (which spawn_de B: W1/D1 (JOIN-TRUTH): the ceremony NTP query reaches a server on EITHER IP family — `query_unix_secs` (ntp.rs) must iterate every address `to_socket_add === PAIR 19 / 132 === REQ-DISPATCH-HYGIENE-TELEMETRY <-> REQ-PUMP-DIAL-FASTFAIL A: REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 7+8+9): dispatcher hygiene + keyed observability — (a) bounded redispatch worker pool with batched cold B: PUMP-TRUTH W1 (RE-SCOPED post round-2 empirical lock — the DIAL is EXONERATED, healthy ~100ms): a pump worker-leg PEER-REPLY read to a connect-then-si === PAIR 20 / 132 === REQ-DAEMON-1 <-> REQ-DAEMON-8 A: One per-machine spt-daemon owning all per-machine state B: Internal auto-start prefers the service: `ensure_running` (any spt command's implicit daemon start, REQ-DAEMON-3) routes through the service-aware sta === PAIR 21 / 132 === REQ-NOTIF-COALESCE <-> REQ-NOTIF-QUIET-DELIVERY A: Coalesce-key supersession: producer-stamped key REQUIRED in namespaced form : (e.g. spt-core:update-staged) — the produce front door rejec B: The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never live TCP, never a wake, for EVERY producer; loudnes === PAIR 22 / 132 === REQ-HAZARD-PAIR-TRANSCRIPT-BIND <-> REQ-PICKER-PURGE-SHORTCUT A: Pairing transcript binds roles, both node pubkeys, subnet ID, seed epoch, TOTP time-step, and confirmation MACs — or unknown-key-share/reflection/wron B: C-3 (REMOTE-TRUTH triage §C-3 #8): the pick-existing list gains an `x` purge shortcut — on an OFFLINE LOCAL highlight, `x` opens a small in-TUI confir === PAIR 23 / 132 === REQ-HAZARD-INBOX-NO-DOUBLE <-> REQ-HAZARD-RESTART-IDEMPOTENT A: No double-delivery via legacy inbox (4.5) B: Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14) === PAIR 24 / 132 === REQ-HAZARD-BIND-REST-STATE-CARRY <-> REQ-RC-RECONNECT-TRUTH A: GATEWAY-LIVENESS DEFECT A (flynn field bug 2026-07-09, confirmed independent): a re-bind MUST preserve the daemon-owned resting intent (rest_state, D9 B: W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-proven (the operator's long-standing 'stop 2-4 times' === PAIR 25 / 132 === REQ-PICKER-1 <-> REQ-SUBNET-8 A: The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t B: Status render honesty: zero-subnet text is daemon-aware ('No subnets registered — this node is standalone.' + daemon-running-dependent blurb, never im === PAIR 26 / 132 === REQ-DAEMON-BITS-AMBIGUITY <-> REQ-HAZARD-INFO-JSON-TORN-READ A: SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit t B: State-file reads tolerate concurrent writes (1.2) === PAIR 27 / 132 === REQ-HAZARD-VIEWER-ISOLATION <-> REQ-MSG-DELIVERY-AXES A: A slow / dead / hostile VIEWER must NEVER stall the controller, the PTY child, or the session drain thread. The broker drain fans output to the contro B: Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S === PAIR 28 / 132 === REQ-ACTIVITY-INFO-PULL <-> REQ-UPDATE-ONE-SHOT-FINISH A: The endpoint's current activity state (busy|idle) is readable via `spt api endpoint-info` — a point-in-time read of the perch idle sentinel, for consu B: W3 (LIFECYCLE-TRUTH): update apply works daemonless and one command finishes the cycle. ROOT (operator wart): update fetch/apply run ensure_daemon_ann === PAIR 29 / 132 === REQ-BROKER-ATTACH-JOURNAL-RESILIENT <-> REQ-HAZARD-BROKER-FLOOR-LOCK-POISON A: A poisoned EffectJournal mutex or a sick NetHost runtime must NOT permanently brick all future attaches. Bug #16 (URGENT): a live spt-hosted endpoint B: B-1 (REMOTE-TRUTH triage §B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch — a brain-only se === PAIR 30 / 132 === REQ-GOSSIP-PROJECT-DERIVE-ONCE <-> REQ-PROJECT-INDEX-READER-CUTOVER A: REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle seam-verified same day; timing-pinned ~16s burst clu B: PROJECT-INDEX W3 (ADR-0037): endpoint list, the picker, and endpoint-info consume the materialized index — NO git work in any user-facing read path (t === PAIR 31 / 132 === REQ-HAZARD-PAIR-SEED-ROTATION <-> REQ-INST-15 A: Removing a node rotates the subnet seed (epoch bump) so an old node/old seed cannot rejoin; trust-store delete alone is NOT revocation because the see B: Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone to a new identity, copy-then-diverge, not re-home === PAIR 32 / 132 === REQ-ADAPTER-UPDATE-POST <-> REQ-INSTALL-4 A: Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_pul B: Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) + soft-deregister remove + optional manifest unins === PAIR 33 / 132 === REQ-DOCS-1 <-> REQ-HAZARD-DEFERRED-SURVIVE-DRAIN A: Dual-audience docs (human + AI dev-agent), markdown once / two depths B: Deferred rows survive poll drain (4.4) === PAIR 34 / 132 === REQ-HAZARD-PERCH-RECORD-POWER-LOSS <-> REQ-REGISTRY-REPLAY-BOUNDED A: Authoritative/identity records fsync data before the rename (5.13): a hard reset must not resurrect a full-length NUL-filled record — SCOPED, not a bl B: REGISTRY-LIFECYCLE W1 (ADR-0040 decision 4, hertz defect B leg 4, defense-in-depth behind REQ-ONEWAY-STREAM-TERMINAL): a deadline-poisoned one-way (Re === PAIR 35 / 132 === REQ-HAZARD-BRAIN-RESPAWN-PATH <-> REQ-UPD-5 A: The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE B: spt-core ripple-updates registered adapters === PAIR 36 / 132 === REQ-ADAPTER-LIVE-UPDATE <-> REQ-INSTALL-BOOTSTRAP-VERB A: An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004): for an endpoint with a running RESIDENT adapter B: THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install ve === PAIR 37 / 132 === REQ-HAZARD-SOFT-CLEANUP <-> REQ-HAZARD-EPHEMERAL-CLEANUP A: Soft-cleanup preserves state, removes only the ready marker (6.2) B: Ephemeral perch cleanup on every ring exit path (3.1) === PAIR 38 / 132 === REQ-FRONT-1 <-> REQ-PICKER-UX-V013 A: Day-one launcher/manager frontend (list/launch/attach/init) B: `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directly on 'Pick existing'; `n` jumps to 'Create new'. ( === PAIR 39 / 132 === REQ-HAZARD-SHELL-STALE-ONLINE <-> REQ-LIVENESS-ORACLE-SOUND A: A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably dead), never the recorded `status` field alone — B: TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer === PAIR 40 / 132 === REQ-ADAPTER-PROOF-DIR-OVERRIDE <-> REQ-DIGEST-PROFILE-ENV A: The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir ` / `--manifest ` override so an B: Bug #17: spt endpoint digest returns NO_DIGEST for a ccs-profile endpoint (claude-spt:ccs) though [digest] is wired and the transcript exists — under === PAIR 41 / 132 === REQ-INJECT-MULTILINE-INTEGRITY <-> REQ-WAN-SPT-HOSTED-DELIVERY A: W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le B: A WAN-ARRIVED `spt send` is DELIVERED to an spt-hosted endpoint (broker holds its PTY, NO api-listen relay), not spooled-forever. Today receive_wan (s === PAIR 42 / 132 === REQ-SEND-REPLYTO-REMOVE <-> REQ-SEND-STAMP-AGENT-ID A: Remove `--reply-to` from `spt send` — a target-fallback + REPLIED-label nicety that confuses agents, with no wire effect (ADR-0020 already made messag B: MSG-IDENTITY W4 / endpoint-identity (operator-flagged 2026-07-09 + live-confirmed on flynn's F-038 ask arriving 'cli@HFENDULEAM'): a live agent's own === PAIR 43 / 132 === REQ-HAZARD-STALE-INDEX-LOCK <-> REQ-HAZARD-REGISTRY-STALE-CLEAN A: Sweep stale lockfiles on daemon boot (1.3) B: Stale registry entries degrade to fallback, never hard-fail (4.3) === PAIR 44 / 132 === REQ-ENDPOINT-LIST-NODE-IDENT <-> REQ-HAZARD-ID-CHARSET A: Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_local_section cli.rs:4359). Change to 'This node: REQ-RESUME-ADAPTER-FOLLOWS-SESSION A: RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from inside an active TUI return STRUCTURED outcomes and B: D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) — th === PAIR 46 / 132 === REQ-GOSSIP-CONTROLLED-CROSS-NODE <-> REQ-PICKER-CONTROLLED-LOCAL A: B7 (F028, operator, cross-node): a remote endpoint's CONTROLLED state is not rendered. Evidence: ball-b ONLINE + CONTROLLED on ENLYZEAM (local view), B: #3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_status() (crates/spt/src/picker/model.rs:415) derive === PAIR 47 / 132 === REQ-DAEMON-BITS-AMBIGUITY <-> REQ-PRES-1 A: SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit t B: Presence resolution: the presence datum (last_active_node, last_active_endpoint, ts) gossiped subnet-wide via the agent-interaction heartbeat (rides r === PAIR 48 / 132 === REQ-READY-AGENT-RESUME <-> REQ-RUN-EMPTY-CREATE A: An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly — closing the gap that today only LiveAgents do. B: `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha === PAIR 49 / 132 === REQ-DOC-ECHO-COMMUNE-CONTRACT <-> REQ-DOCS-NO-INTERNAL-CODES A: W6 (LIFECYCLE-TRUTH, docs — this gap cost a full outage night, priority slot): publish the [session.echo_commune] I/O contract on the docs-site: key c B: Public CLI --help (the clap `///` doc-comments) and the generated `docs-site/src/cli/reference.md` MUST NOT contain internal tracker/decision codes — === PAIR 50 / 132 === REQ-PICKER-2 <-> REQ-PICKER-PROJECT-HISTORY-TRUTH A: The picker's project-history loader reads the git-backed context store, not the bare working tree: data.rs project_history_for enumerates an endpoint' B: #1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_for_dir) UNION context-store branches, EXCLUDING o === PAIR 51 / 132 === REQ-HAZARD-DELIVERY-STARVATION <-> REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT A: A message that has REACHED a node's spool (WAN-arrived or locally spooled-while-active) is NEVER dependent on an adapter HOOK-POLL cadence for its eve B: An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive === PAIR 52 / 132 === REQ-PICKER-4 <-> REQ-PICKER-ADAPTER-DESCRIPTION A: The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node renders as 'LABEL (keyprefix…)' (e.g. 'HFENDULEAM B: The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description panel (like the Pick-existing endpoint picker's two === PAIR 53 / 132 === REQ-PICKER-3 <-> REQ-RCVIEW-1 A: A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoint_id overlaps a local (is_local) roster id is sel B: Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; === PAIR 54 / 132 === REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY <-> REQ-SEND-SPT-HOSTED A: `api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi B: An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` → `api bind`, broker holds its PTY, NO `api listen` re === PAIR 55 / 132 === REQ-GOSSIP-ADAPTER-PROJECTS <-> REQ-TRANSLATE-COMMIT-MISS-TOLERANCE A: #4: remote endpoint details (harness + project history) are gossiped, not faked. Today from_resource_row (crates/spt/src/picker/model.rs:340) hardcode B: C-1 (F029, B6 ROOT — rescope of REQ-TRANSLATE-BINARY-LIVENESS-DECAY, now PINNED): at a checkpoint clear boundary the clear-only inject drives `/clear` === PAIR 56 / 132 === REQ-ENDPOINT-LIST-NODE-IDENT <-> REQ-EP-9 A: Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_local_section cli.rs:4359). Change to 'This node: REQ-LIVENESS-ORACLE-SOUND A: An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive B: TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer === PAIR 58 / 132 === REQ-UPD-2 <-> REQ-UPDATE-DEFAULT-COMPOSITE A: All binaries signature-verified before handoff B: THE-FORKENING W4 (operator-grilled 2026-07-14): plain `spt update` = `update fetch --apply` THEN `update adapters` (core-first doctrine order); when c === PAIR 59 / 132 === REQ-BOUNDARY-ROTATION-CREDENTIAL <-> REQ-LIVENESS-ORACLE-SOUND A: api boundary's rotation credential is designed, documented, and eventually anchor-proven (ADR-0032): the proof is the DEPARTED session's (prior sid / B: TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer === PAIR 60 / 132 === REQ-ENDPOINT-LIST-REST-FILTER <-> REQ-PICKER-UX-V013 A: spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-first row ordering with fixed precedence ONLINE > C B: `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directly on 'Pick existing'; `n` jumps to 'Create new'. ( === PAIR 61 / 132 === REQ-REL-2 <-> REQ-UPD-7 A: Release asset set consumable by the self-updater: platform binaries, SHA256SUMS, SignedRelease metadata, manifest schema, mock-adapter zip; tag-trigge B: Origin-source update bootstrap (`spt update fetch`): pull the latest signed release directly from the GitHub release origin (`SaberMage/spt-releases`) === PAIR 62 / 132 === REQ-CI-FREE-SPACE-PREFLIGHT <-> REQ-HAZARD-SHELL-STALE-ONLINE A: Every CI job on a shared self-hosted runner FAILS LOUD AND FIRST on insufficient free disk, never obscurely on a downstream timing/space symptom: a pr B: A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably dead), never the recorded `status` field alone — === PAIR 63 / 132 === REQ-CONTROL-STAMP-CONVERGENCE <-> REQ-HAZARD-CONTROLLER-RETAKE-FLOOR A: REGISTRY-LIFECYCLE W2 (ADR-0041 decision 4, emphasys C3 P1): control-stamp writes are session/generation-VALIDATED (or per-endpoint stamp transitions B: `become_controller` should STRUCTURALLY refuse a controller re-take whose `from_seq` falls below the connection's already-delivered contiguous floor — === PAIR 64 / 132 === REQ-ENDPOINT-CYCLE-HONEST <-> REQ-REST-TERMINAL-NORMALIZE A: REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard l B: REGISTRY-LIFECYCLE W2 (ADR-0041 decision 3, rest-normalize P0): definitive hosted-session loss normalizes TERMINALLY and ATOMICALLY — one store-level === PAIR 65 / 132 === REQ-INST-6 <-> REQ-INSTALL-7 A: Deferred messages not delivered to dormant/suspended instances B: Windows inbound reachability: the elevated install leg registers the inbound-UDP firewall rule (New-NetFirewallRule); the daemon self-detects blocked === PAIR 66 / 132 === REQ-PICKER-UX-V013 <-> REQ-RUN-EMPTY-CREATE A: `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directly on 'Pick existing'; `n` jumps to 'Create new'. ( B: `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha === PAIR 67 / 132 === REQ-JOIN-DIAGNOSTICS <-> REQ-SUBNET-4 A: `spt subnet join` never fails SILENTLY (ADR-0030; the field incident showed no output at all). (a) LIVE progress during the meet (replace the one-shot B: Subnet membership mutations elevation-gated (create = seed reveal; join = trust-boundary enrollment) === PAIR 68 / 132 === REQ-ARCH-1 <-> REQ-ARCH-2 A: Many small acyclically-layered crates B: Public SDK surface is spt-proto, spt-runtime, spt-msg === PAIR 69 / 132 === REQ-DISPATCH-HYGIENE-TELEMETRY <-> REQ-INSTALL-8 A: REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 7+8+9): dispatcher hygiene + keyed observability — (a) bounded redispatch worker pool with batched cold B: OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install l === PAIR 70 / 132 === REQ-BIND-PSYCHE-CUSTODY-SQUAT-GUARD <-> REQ-PSYCHE-SID-CUSTODY A: MSG-IDENTITY W1 / F-036 leg c (perri field RCA, doyle ACCEPTED defense-in-depth): a bind whose --set-session-id equals a NESTED psyche perch's own cus B: W2 (F030, design §3): the psyche mints and keeps its OWN session id, stored in the nested {id}-psyche perch record — {session_id} in psyche role templ === PAIR 71 / 132 === REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT <-> REQ-MSG-IDLE-TRANSLATION-BINARY A: An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive B: spt-hosted idle message delivery via an adapter TRANSLATION BINARY (ADR-0022). New opt-in manifest section `[message-idle-translation-binary]` = a TAB === PAIR 72 / 132 === REQ-HAZARD-PTY-INPUT-WRITER-WEDGE <-> REQ-RESIZE-INPUT-MODE-INTEGRITY A: Pasting into an `spt rc` session WEDGES the broker — after a paste the operator can no longer type AND can no longer attach to NEW or EXISTING session B: RESCOPED 2026-07-22 by ADR-0047 Amendment 2 + KNOWN-HAZARDS 7.55 (doyle-ratified), on the measurement rather than on the supposition. FIELD EVIDENCE I === PAIR 73 / 132 === REQ-HAZARD-RC-INPUT-KEY-ENCODING <-> REQ-RC-HARNESS-ONLY-REFUSAL A: An `spt rc` session forwards the Backspace key as the VT DEL byte (0x7f), so the hosted TUI (Claude Code) deletes ONE character — never a whole word. B: RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc ` preflights the already-known harness_only/cont === PAIR 74 / 132 === REQ-ADAPTER-ADD-SURFACE-ERRORS <-> REQ-UPDATE-GH-TRANSPORT A: Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero exit prints only the exit code and DISCARDS the sub B: THE-FORKENING W1 (ADR-0036, operator-ruled 2026-07-14): the release channel is PRIVATE (`BigscreenVR/spt-bs-releases`) and the gh CLI is the mandated === PAIR 75 / 132 === REQ-RUN-EMPTY-CREATE <-> REQ-WORKER-PICKER-EXCLUDED A: `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha B: V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows — a worker perch cannot be dri === PAIR 76 / 132 === REQ-CONTROLLER-LEASE-IDENTITY <-> REQ-PRESENCE-CONTROL-REAP-ON-EXIT A: RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-131 B: B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE decay window + sticky CONTROLLED stamp. Repro: /exit - === PAIR 77 / 132 === REQ-READY-AGENT-RESUME <-> REQ-SEAM-PSYCHE A: An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly — closing the gap that today only LiveAgents do. B: spawn-psyche seam (fresh + resume templates) === PAIR 78 / 132 === REQ-INST-6 <-> REQ-NOTIF-QUIET-DELIVERY A: Deferred messages not delivered to dormant/suspended instances B: The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never live TCP, never a wake, for EVERY producer; loudnes === PAIR 79 / 132 === REQ-ADAPTER-LIVE-UPDATE <-> REQ-NOTIF-UPDATE-ROW-VERSION-RETIRE A: An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004): for an endpoint with a running RESIDENT adapter B: An update-available notif row minted by a node running PRE-0.40.0 spt is retired on the version the running node has ALREADY reached — because the key === PAIR 80 / 132 === REQ-API-2 <-> REQ-START-1 A: The api subcommand surface (bind/listen/poll/state/worker/boundary/...) B: Adapters never resolve SPT_HOME; binary on PATH; api bridging only === PAIR 81 / 132 === REQ-CONSENT-2 <-> REQ-NOTIF-1 A: Interactive consent escalation: an ungated high-risk action routes a consent prompt to the user's most-recently-active session; allow-once / allow-alw B: Notification primitive: per-subnet replicated spool, seen/dismissed, resurface-at-boundary, subsumes update+consent prompts === PAIR 82 / 132 === REQ-RUN-MULTISUBNET-HOME <-> REQ-START-5 A: `spt endpoint run` resolves the home subnet at the skeleton-create step and pre-creates the skeleton perch carrying it, so the harness `bind` inherits B: Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` carries only parent_pid + session_id (+ optional cw === PAIR 83 / 132 === REQ-HAZARD-PAIR-RATE-LIMIT <-> REQ-PAIR-5 A: Subnet-global pairing rate limit: one active ceremony per subnet, shared attempt counter, exponential backoff — a public pre-trust relay + multiple se B: Multi-subnet pairing: subnet-name discovery input, create-new-names-up-front, rendezvous-token hashing === PAIR 84 / 132 === REQ-HAZARD-DROP-FILE-SINGLE-WRITER <-> REQ-HAZARD-DIRECT-WRITE-PRECEDENCE A: Drop files are daemon-owned single-writer (6.4) B: Direct-write precedence marker (with node id) guards stale overwrite (6.5) === PAIR 85 / 132 === REQ-HAZARD-GRACE-BEFORE-SIGNOFF <-> REQ-HAZARD-ECHO-BEFORE-SIGNOFF A: Grace-period wait completes before composing INIT_SIGNOFF (1.1) B: Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3) === PAIR 86 / 132 === REQ-EFFECTIVE-INSTANCE-STATE <-> REQ-PRESENCE-CONTROL-REAP-ON-EXIT A: A-1 (REMOTE-TRUTH triage §A + ADR-0033 §Decision): the effective instance state of a perch is DERIVED through ONE shared function — liveness discrimin B: B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE decay window + sticky CONTROLLED stamp. Repro: /exit - === PAIR 87 / 132 === REQ-HAZARD-BIND-CWD-UNSET <-> REQ-MSG-DELIVERY-AXES A: A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own project tab. ROOT (found, v0.13.0): `info.cwd` is NEVER B: Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S === PAIR 88 / 132 === REQ-CLI-HELP-MARKDOWN <-> REQ-DOCS-RELEASE-ASSET A: `spt --help` (and every subcommand --help) renders the inline Markdown authored in the clap doc-comments as terminal styling, never as literal markers B: THE-FORKENING W2 (ADR-0036 §4): every release ships a platform-independent docs bundle `spt-docs.tar.gz` (BUILT mdbook output: HTML + llms.txt + llms- === PAIR 89 / 132 === REQ-ADAPTER-UPDATE-POST <-> REQ-SEAM-POSTSPAWN A: Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_pul B: post-spawn / api bind seam with boot nonce === PAIR 90 / 132 === REQ-INST-1 <-> REQ-PSYCHE-NESTED-RESOLUTION A: endpoint ID vs instance split (adapter-agnostic ID) B: W4 (F030, design §3; F-017 sibling, general not psyche-only): nested {parent}/{nested} ids resolve under the PARENT's home — subnet-less resolution fo === PAIR 91 / 132 === REQ-SUBNET-1 <-> REQ-SUBNET-3 A: spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-code; spt pair deleted B: Node labels: hostname-default, gossiped, addressable in @node qualifiers (refuse-on-ambiguity) === PAIR 92 / 132 === REQ-INST-15 <-> REQ-INSTALL-BOOTSTRAP-VERB A: Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone to a new identity, copy-then-diverge, not re-home B: THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install ve === PAIR 93 / 132 === REQ-HAZARD-RESTART-IDEMPOTENT <-> REQ-NOTIF-QUIET-DELIVERY A: Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14) B: The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never live TCP, never a wake, for EVERY producer; loudnes === PAIR 94 / 132 === REQ-MIGRATE-1 <-> REQ-NOTIF-MIGRATE A: Auto-detect and migrate a legacy claude_skill_owl install B: One-shot field migration: on first run the new binary auto-dismisses existing rows with from_id = spt-update (kinds consent/rollback) — the known-stal === PAIR 95 / 132 === REQ-MIGRATE-1 <-> REQ-MSG-1 A: Auto-detect and migrate a legacy claude_skill_owl install B: Local message delivery: TCP-first to a registered address, spool fallback when offline; id->address via registry (stale-clean first); reply routing (_ === PAIR 96 / 132 === REQ-RUN-ID-REUSES-ADAPTER <-> REQ-RUN-NO-DUP-SESSION A: D-1 (REMOTE-TRUTH triage §D-1): `spt endpoint run --id ` with NO --adapter, when names an EXISTING perch, REUSES that perch's recorded info.a B: B1 (F028, hall-b diagnosis, verified 0.22.0): `endpoint run --id X --create` on an endpoint with a LIVE session mints a silent DUPLICATE session — and === PAIR 97 / 132 === REQ-HAZARD-DEFERRED-DRAIN <-> REQ-HAZARD-IDLE-SILENT-NONDELIVERY A: Deferred spool rows excluded from the event-stream drain (1.4) B: An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared), spawn-failed, FAULTED, or its inject-worker chan === PAIR 98 / 132 === REQ-HAZARD-SUDO-SECURE-PATH <-> REQ-INSTALL-6 A: Elevation guidance on Unix names the binary's ABSOLUTE path under sudo (a user-local install ~/.local/bin · ~/.cargo/bin is not on sudo's secure_path, B: Linux elevation install leg: install.sh symlinks the binary into a sudo-reachable path (/usr/local/bin; graceful print-the-one-liner when unelevated) === PAIR 99 / 132 === REQ-HAZARD-CONPTY-DSR <-> REQ-HAZARD-EBUSY-RENAME A: ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5) B: tmp-write + atomic-rename + retry on Windows EBUSY (5.2) === PAIR 100 / 132 === REQ-HAZARD-RC-ATTACH-TRUTH <-> REQ-HAZARD-RC-EOF A: RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 — umbrella conformance seam for ADR-0042): an rc surface answers from live session authority, never a stale per B: A severed broker stream during a live rc session surfaces GRACEFULLY, never as a raw io error that crashes the PTY. The rc read-loop (rc.rs:352-362) c === PAIR 101 / 132 === REQ-ADAPTER-GH-TRANSPORT <-> REQ-ADAPTER-UPDATE-POST A: The `gh_release` avenue (and `spt adapter add --release`) gain a fetch `transport`: `https` (current reqwest direct, public), `gh` (shell the pre-auth B: Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_pul === PAIR 102 / 132 === REQ-BROKER-SCREEN-GRID <-> REQ-ENDPOINT-LIST-RENDER-POLISH A: Bugs #6 + #12 + #7/#8-artifacts: the broker is a raw-byte pump with no screen model — OutputLog replays the raw ring from seq 0 into a fresh terminal B: A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT dim — LIGHT_GRAY = "37" (cli.rs:3019) is standard === PAIR 103 / 132 === REQ-HAZARD-ENV-SUBST <-> REQ-MANIFEST-5 A: `spt endpoint run` HONORS manifest [env.] direction=inject values (with {key} substitution) on the spt-hosted spawn. Today only the [session.self B: File-backed adapter [strings] (M12-W3-T3.1): a [strings] dot-path value MAY be an inline-table FILE POINTER `key = { file = "rel/path" }` resolved to === PAIR 104 / 132 === REQ-INJECT-MULTILINE-INTEGRITY <-> REQ-MSG-INJECT-LEG-DROP-VISIBLE A: W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le B: SEED (inactive — observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an honestly-offline endpoint on a status surface. The sp === PAIR 105 / 132 === REQ-HAZARD-CONTROL-STAMP-LIFETIME <-> REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY A: #2: a control/viewer stamp never outlives its session — every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) send B: `api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi === PAIR 106 / 132 === REQ-INST-9 <-> REQ-PAIR-4 A: Multi-subnet membership (same-user N subnets; cross-user seam) B: Subnet naming on first pairing === PAIR 107 / 132 === REQ-HAZARD-HOSTED-LIVENESS-RECONCILE <-> REQ-HOSTING-AUTHORITY-CONTROLLABLE A: B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness, not left latched online. The broker exit-waiter B: RC-RENDER-TRUTH v0.38.1 fast-follow leg 3 (hertz todlando immortal-hybrid trace, doyle fork ruling 2026-07-18 = controllable-authority): ONE hosting a === PAIR 108 / 132 === REQ-ENDPOINT-CYCLE-HONEST <-> REQ-START-5 A: REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard l B: Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` carries only parent_pid + session_id (+ optional cw === PAIR 109 / 132 === REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE <-> REQ-SEAM-INJECT A: MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft — doyle ACCEPTED primary fix): the daemon MUST sanitize inherited per- B: inject-input methods configurable per activity-state === PAIR 110 / 132 === REQ-ARCH-3 <-> REQ-HAZARD-HANDOFF-ARGV-COMPAT A: Wire-protocol version independent of crate semver, N-1 compat window B: Broker/brain IPC + handoff argv version-tolerant (2.3) === PAIR 111 / 132 === REQ-HAZARD-CASCADE-WIPE-GUARD <-> REQ-HAZARD-SINGLE-PATH-SOURCE A: No hard-delete of a parent hosting non-empty children (6.3) B: Single path/registry source of truth; no layout ambiguity (6.1) === PAIR 112 / 132 === REQ-HAZARD-SUDO-SECURE-PATH <-> REQ-PAIR-6 A: Elevation guidance on Unix names the binary's ABSOLUTE path under sudo (a user-local install ~/.local/bin · ~/.cargo/bin is not on sudo's secure_path, B: Elevation-gated per-subnet code fetch (UAC/root or elevated agent; else authenticator app) === PAIR 113 / 132 === REQ-HAZARD-RC-ATTACH-TRUTH <-> REQ-SOFT-END-PRESERVES-LIVE-LISTENER A: RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 — umbrella conformance seam for ADR-0042): an rc surface answers from live session authority, never a stale per B: F-2 (REMOTE-TRUTH triage §F-2, field-repro'd hall-bf 2026-07-04): a /clear must not sever a SURVIVING poll listener's relay address — post-clear owl-p === PAIR 114 / 132 === REQ-EFFECTIVE-INSTANCE-STATE <-> REQ-PICKER-1 A: A-1 (REMOTE-TRUTH triage §A + ADR-0033 §Decision): the effective instance state of a perch is DERIVED through ONE shared function — liveness discrimin B: The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t === PAIR 115 / 132 === REQ-CONN-BLACKHOLE-LIFECYCLE-HARNESS <-> REQ-PICKER-1 A: MSG-IDENTITY W6 / F-039 leg e (doyle W6 LOCK 2026-07-10, minted per amendment 3 — hertz's five invariants VERBATIM from his RCA fix-shape item 5): 'Bu B: The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t === PAIR 116 / 132 === REQ-ENDPOINT-LIST-PROJECT-COL <-> REQ-PICKER-1 A: #8: spt endpoint list gains a second column / (the endpoint's LATEST project) -> 4 columns total: id / / / type / status. Local rows B: The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t === PAIR 117 / 132 === REQ-INST-12 <-> REQ-PICKER-4 A: Endpoint visibility per-(endpoint,subnet): excluded semantics, OR-of-defaults + override, gates sync B: The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node renders as 'LABEL (keyprefix…)' (e.g. 'HFENDULEAM === PAIR 118 / 132 === REQ-READY-AGENT-RESUME <-> REQ-RUN-PICKER-HOME A: An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly — closing the gap that today only LiveAgents do. B: Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferred half of REQ-RUN-MULTISUBNET-HOME's interactive === PAIR 119 / 132 === REQ-PICKER-OFFLINE-NO-VIEW <-> REQ-WORKER-PICKER-EXCLUDED A: A3 (F028, operator #3): 'View now (read-only)' is offered for OFFLINE endpoints. model.rs:1030 offline branch of confirm_options is vec![Start, View] B: V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows — a worker perch cannot be dri === PAIR 120 / 132 === REQ-REGISTRY-APPLY-TRANSACTIONAL <-> REQ-REGISTRY-REPLAY-BOUNDED A: REGISTRY-LIFECYCLE W1 (ADR-0040 decision 3, hertz defect B leg 3): registry feed application is TRANSACTIONAL per feed — serve_registry_feed merges de B: REGISTRY-LIFECYCLE W1 (ADR-0040 decision 4, hertz defect B leg 4, defense-in-depth behind REQ-ONEWAY-STREAM-TERMINAL): a deadline-poisoned one-way (Re === PAIR 121 / 132 === REQ-SHELL-2 <-> REQ-WAKE-WAIT A: Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout), ephemeral teardown vs persistent offline/relink, B: A-2 rider (REMOTE-TRUTH triage §A-2): `spt endpoint wake --wait` blocks on the REAL bind (status reaches online) after the daemon wake-resume lift (RE === PAIR 122 / 132 === REQ-HAZARD-ENDPOINT-LIFECYCLE <-> REQ-PICKER-CONTROLLED-LOCAL A: REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 — the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY death B: #3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_status() (crates/spt/src/picker/model.rs:415) derive === PAIR 123 / 132 === REQ-INST-13 <-> REQ-SCREENGRID-WIDTH A: Subnet-exclusive sync + per-endpoint subnet-membership list B: TEARDOWN-AUTHORITY W3 (hertz field RCA 2026-07-19, doyle-confirmed at source): ScreenGrid models every character as ONE display column, so wide charac === PAIR 124 / 132 === REQ-HAZARD-CONTROL-STAMP-LIFETIME <-> REQ-START-3 A: #2: a control/viewer stamp never outlives its session — every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) send B: spt-hosted startup: spawn-session then api bind (no file) === PAIR 125 / 132 === REQ-RESUME-ADAPTER-FOLLOWS-SESSION <-> REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION A: D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) — th B: C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination — a foreign psyche's SessionStart hook REBI === PAIR 126 / 132 === REQ-MSG-5 <-> REQ-MSG-DELIVERY-AXES A: user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user-msg (the user's authority); agent-family senders B: Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S === PAIR 127 / 132 === REQ-ENDPOINT-LIST-PALETTE <-> REQ-RCVIEW-1 A: Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the same ResourceRow into the W5 colored EpDisplay pal B: Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; === PAIR 128 / 132 === REQ-ATTACH-SEED-REQUEST-DOUBLE-SERVE <-> REQ-EP-5 A: A dispatcher-SEEDED attach Request is honored ONCE — the wire replay's copy of that same Request must not re-establish it. (Seed: DAEMON-LIFECYCLE W1 B: Concrete shell instantiation model: spawn-mints-instance (vs relink/online), registered-on-node permission + broadcast-is-discovery, per-shell require === PAIR 129 / 132 === REQ-HAZARD-DAEMON-HOSTED-LIVENESS <-> REQ-UPDATE-TRIAL-DRAIN-DRIVE A: Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2 B: UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 — regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller-l === PAIR 130 / 132 === REQ-HAZARD-INPUT-ACK-BACKPRESSURE <-> REQ-HAZARD-MESH-BOOTSTRAP-TRAP A: A FLOOD of operator input on one brain↔broker connection deadlocks the broker PERMANENTLY (entire broker — no new/existing attach; the controller stay B: MESH-RECOVERY W1 (KNOWN-HAZARDS 7.42, hertz field RCA 2026-07-10 — HFENDULEAM+ENLYZEAM symmetric green-status sequester): a node holding a valid Roste === PAIR 131 / 132 === REQ-EP-1 <-> REQ-EP-2 A: Day-one endpoint types; open type system B: Agent endpoints vs Shells distinction in the type model === PAIR 132 / 132 === REQ-INST-15 <-> REQ-SUBNET-1 A: Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone to a new identity, copy-then-diverge, not re-home B: spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-code; spt pair deleted