Index idA idB TitleA TitleB DocA_First100 DocB_First100 1 REQ-ACTIVITY-INFO-PULL REQ-LIST-JSON-LIVENESS-PARITY The endpoint's current activity state (busy|idle) is readable via `spt api endpoint-info` — a point- GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (huma 1. Activity observation is a first-class surface w 2 REQ-HAZARD-LIVEHOST-NONRESIDENT REQ-RC-RECONNECT-TRUTH A daemon-hosted Psyche that spawns then EXITS IMMEDIATELY is a host failure, surfaced like a spawn f W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-pro 3 REQ-STREAM-LIFETIME-CLASS REQ-STREAM-OPENER-DURABLE RESCOPED at W2 activation 2026-07-22 (doyle verify-first, C3-retirement precedent): the CLEAN-CASE c REDISPATCH-TRUTH W1 (ADR-0038, hertz fix B): stream classification identity is RESTART-DURABLE and i Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — te 4 REQ-BROKER-SCREEN-GRID REQ-HAZARD-CONTROLLER-LEASE Bugs #6 + #12 + #7/#8-artifacts: the broker is a raw-byte pump with no screen model — OutputLog repl RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 — umbrella conformance seam for ADR-0044): at most one input- Decision: 1. **One FIFO sequencer per at 8 REQ-HAZARD-IDLE-SILENT-NONDELIVERY REQ-INST-6 An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared) Deferred messages not delivered to dormant/suspended instances 7.21 Exactly ONE `controller_writer` per brain↔bro Deferred Features: | Feature | Cut from | Why defe 9 REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP REQ-PSYCHE-STAMP-CLEAR-ANY-SUCCESS Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via th W1 (LIFECYCLE-TRUTH): EVERY successful psyche operation clears psyche_host_error — not just the puls Conformance checklist (condensed): | # | Invariant 10 REQ-API-3 REQ-HAZARD-ENVELOPE-PARSER-SAFE commune/signoff are file-drops, not commands Two-slice envelope parser is panic-free and tolerant (4.2) 11 REQ-HAZARD-DEFERRED-DRAIN REQ-HAZARD-DEFERRED-SURVIVE-DRAIN Deferred spool rows excluded from the event-stream drain (1.4) Deferred rows survive poll drain (4.4) 12 REQ-UPD-1 REQ-UPD-2 Peer-propagated update over P2P All binaries signature-verified before handoff 13 REQ-ADAPTER-UNRESOLVED-HINT-FORM REQ-TRANSLATE-COMMAND F-034 leg a (perri/hertz field finding 2026-07-09): the ADAPTER_UNRESOLVED refusal hint must print a `[message-idle-translation-binary]` accepts a `command` (opaque; args + ADAPTER-STATIC {adapter_dir} path = "cc-spt-idle-translate" # DEPRECATED bare-p 14 REQ-HAZARD-PARENT-PID-PREFER REQ-SELF-DETECT-PARENT-PID Prefer stable parent PID / broker handle over ephemeral PID (2.1) E-1 (REMOTE-TRUTH triage §E-1 #7): self-detect leg (c) — the pid-ancestry fallback — ALSO candidates 15 REQ-HAZARD-VIEWER-CLOSE-DETACH REQ-RUN-EMPTY-CREATE A VIEW is independent from the endpoint: closing the tab/window where `spt endpoint run` was invoked `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: Terminal wrapper: **A view is independent from the 16 REQ-PICKER-PROJECT-HISTORY-TRUTH REQ-PUMP-STAGE-TRUTH #1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_ MESH-RECOVERY W1 (ADR-0039, RCA wave 3 — the acceptance surface, same contract): peer-failure teleme 17 REQ-HAZARD-CONTROLLER-LEASE REQ-PICKER-CONTROL-LINE-STATUS-GATE RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 — umbrella conformance seam for ADR-0044): at most one input- A2 (F028, operator #2): the picker confirm-panel 'controlled locally' line renders for OFFLINE endpo 7.47 The physical terminal is never mutated or ter 18 REQ-INSTALL-10 REQ-PAIR-NTP-MULTIHOME Windows at-logon autostart runs the daemon in the background with no persistent window: the schedule W1/D1 (JOIN-TRUTH): the ceremony NTP query reaches a server on EITHER IP family — `query_unix_secs` 19 REQ-DISPATCH-HYGIENE-TELEMETRY REQ-PUMP-DIAL-FASTFAIL REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 7+8+9): dispatcher hygiene + keyed observability — (a PUMP-TRUTH W1 (RE-SCOPED post round-2 empirical lock — the DIAL is EXONERATED, healthy ~100ms): a pu Consequences: ## Amendment — REDISPATCH-STALL (202 20 REQ-DAEMON-1 REQ-DAEMON-8 One per-machine spt-daemon owning all per-machine state Internal auto-start prefers the service: `ensure_running` (any spt command's implicit daemon start, 21 REQ-NOTIF-COALESCE REQ-NOTIF-QUIET-DELIVERY Coalesce-key supersession: producer-stamped key REQUIRED in namespaced form : (e.g. spt- The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never l 2. Supersession: a required-namespaced coalesce ke 4. Delivery: the notify kind rides `active_only`, 22 REQ-HAZARD-PAIR-TRANSCRIPT-BIND REQ-PICKER-PURGE-SHORTCUT Pairing transcript binds roles, both node pubkeys, subnet ID, seed epoch, TOTP time-step, and confir C-3 (REMOTE-TRUTH triage §C-3 #8): the pick-existing list gains an `x` purge shortcut — on an OFFLIN 23 REQ-HAZARD-INBOX-NO-DOUBLE REQ-HAZARD-RESTART-IDEMPOTENT No double-delivery via legacy inbox (4.5) Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14) 24 REQ-HAZARD-BIND-REST-STATE-CARRY REQ-RC-RECONNECT-TRUTH GATEWAY-LIVENESS DEFECT A (flynn field bug 2026-07-09, confirmed independent): a re-bind MUST preser W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-pro 25 REQ-PICKER-1 REQ-SUBNET-8 The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list- Status render honesty: zero-subnet text is daemon-aware ('No subnets registered — this node is stand 26 REQ-DAEMON-BITS-AMBIGUITY REQ-HAZARD-INFO-JSON-TORN-READ SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SE State-file reads tolerate concurrent writes (1.2) 27 REQ-HAZARD-VIEWER-ISOLATION REQ-MSG-DELIVERY-AXES A slow / dead / hostile VIEWER must NEVER stall the controller, the PTY child, or the session drain Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque meta 7.6 Pump brain-IPC reads must be deadline-bounded Activity-gated message delivery + send-modifier ax 28 REQ-ACTIVITY-INFO-PULL REQ-UPDATE-ONE-SHOT-FINISH The endpoint's current activity state (busy|idle) is readable via `spt api endpoint-info` — a point- W3 (LIFECYCLE-TRUTH): update apply works daemonless and one command finishes the cycle. ROOT (operat 1. Activity observation is a first-class surface w 29 REQ-BROKER-ATTACH-JOURNAL-RESILIENT REQ-HAZARD-BROKER-FLOOR-LOCK-POISON A poisoned EffectJournal mutex or a sick NetHost runtime must NOT permanently brick all future attac B-1 (REMOTE-TRUTH triage §B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lo 7.32 The effective resting state MUST be derived t 30 REQ-GOSSIP-PROJECT-DERIVE-ONCE REQ-PROJECT-INDEX-READER-CUTOVER REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle se PROJECT-INDEX W3 (ADR-0037): endpoint list, the picker, and endpoint-info consume the materialized i Self-update: **project index** — a node's endpoint 31 REQ-HAZARD-PAIR-SEED-ROTATION REQ-INST-15 Removing a node rotates the subnet seed (epoch bump) so an old node/old seed cannot rejoin; trust-st Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone Immutable home subnet; fork (copy-then-diverge) is 32 REQ-ADAPTER-UPDATE-POST REQ-INSTALL-4 Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) `[update.post]` — the composite post-step (since v 33 REQ-DOCS-1 REQ-HAZARD-DEFERRED-SURVIVE-DRAIN Dual-audience docs (human + AI dev-agent), markdown once / two depths Deferred rows survive poll drain (4.4) How these docs are organized: Installation: **Installer form (gh bootstrap, ADR- 37 REQ-HAZARD-SOFT-CLEANUP REQ-HAZARD-EPHEMERAL-CLEANUP Soft-cleanup preserves state, removes only the ready marker (6.2) Ephemeral perch cleanup on every ring exit path (3.1) 38 REQ-FRONT-1 REQ-PICKER-UX-V013 Day-one launcher/manager frontend (list/launch/attach/init) `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directl 39 REQ-HAZARD-SHELL-STALE-ONLINE REQ-LIVENESS-ORACLE-SOUND A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-0 Conformance checklist (condensed): | # | Invariant 7.50 The liveness oracle answers from the process 40 REQ-ADAPTER-PROOF-DIR-OVERRIDE REQ-DIGEST-PROFILE-ENV The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `- Bug #17: spt endpoint digest returns NO_DIGEST for a ccs-profile endpoint (claude-spt:ccs) though [d Validate against the live binary: - **Pro `[env]` — env-var table: **`direction = "read"` — 41 REQ-INJECT-MULTILINE-INTEGRITY REQ-WAN-SPT-HOSTED-DELIVERY W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. R A WAN-ARRIVED `spt send` is DELIVERED to an spt-hosted endpoint (broker holds its PTY, NO api-listen 42 REQ-SEND-REPLYTO-REMOVE REQ-SEND-STAMP-AGENT-ID Remove `--reply-to` from `spt send` — a target-fallback + REPLIED-label nicety that confuses agents, MSG-IDENTITY W4 / endpoint-identity (operator-flagged 2026-07-09 + live-confirmed on flynn's F-038 a 43 REQ-HAZARD-STALE-INDEX-LOCK REQ-HAZARD-REGISTRY-STALE-CLEAN Sweep stale lockfiles on daemon boot (1.3) Stale registry entries degrade to fallback, never hard-fail (4.3) 44 REQ-ENDPOINT-LIST-NODE-IDENT REQ-HAZARD-ID-CHARSET Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_lo Addressable-id charset reserves :/@ delimiters; validated at every creation seam (4.6) 4.5 Inbox legacy compat must not double-deliver: # 45 REQ-PICKER-PURGE-STRUCTURED REQ-RESUME-ADAPTER-FOLLOWS-SESSION RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from i D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED s Decisions: 1. **One FIFO sequencer per at 46 REQ-GOSSIP-CONTROLLED-CROSS-NODE REQ-PICKER-CONTROLLED-LOCAL B7 (F028, operator, cross-node): a remote endpoint's CONTROLLED state is not rendered. Evidence: bal #3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_st 47 REQ-DAEMON-BITS-AMBIGUITY REQ-PRES-1 SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SE Presence resolution: the presence datum (last_active_node, last_active_endpoint, ts) gossiped subnet Deferred Features: | Feature | Cut from | Why defe 48 REQ-READY-AGENT-RESUME REQ-RUN-EMPTY-CREATE An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: **`spt endpoint run` is the spt-hosted bringup for 49 REQ-DOC-ECHO-COMMUNE-CONTRACT REQ-DOCS-NO-INTERNAL-CODES W6 (LIFECYCLE-TRUTH, docs — this gap cost a full outage night, priority slot): publish the [session. Public CLI --help (the clap `///` doc-comments) and the generated `docs-site/src/cli/reference.md` M Echo-commune — the I/O contract: **Public help carries no 50 REQ-PICKER-2 REQ-PICKER-PROJECT-HISTORY-TRUTH The picker's project-history loader reads the git-backed context store, not the bare working tree: d #1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_ 51 REQ-HAZARD-DELIVERY-STARVATION REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT A message that has REACHED a node's spool (WAN-arrived or locally spooled-while-active) is NEVER dep An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connectio 7.22 An idle delivery with no working translation Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — te 52 REQ-PICKER-4 REQ-PICKER-ADAPTER-DESCRIPTION The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description p 53 REQ-PICKER-3 REQ-RCVIEW-1 A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoi Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE inte Shell sleep/wake (offline ↔ online): **BU 54 REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY REQ-SEND-SPT-HOSTED `api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` → `a 55 REQ-GOSSIP-ADAPTER-PROJECTS REQ-TRANSLATE-COMMIT-MISS-TOLERANCE #4: remote endpoint details (harness + project history) are gossiped, not faked. Today from_resource C-1 (F029, B6 ROOT — rescope of REQ-TRANSLATE-BINARY-LIVENESS-DECAY, now PINNED): at a checkpoint cl Amendment (2026-07-03, F029 C-1) — a commit-miss i 56 REQ-ENDPOINT-LIST-NODE-IDENT REQ-EP-9 Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_lo `#` always-on address sigil: a reserved LEADING sigil marking an AlwaysOnEndpoint, extending the REQ Always-on endpoints: resident supervised adapter b 57 REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT REQ-LIVENESS-ORACLE-SOUND An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connectio TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-0 Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — te 7.50 The liveness oracle answers from the process 58 REQ-UPD-2 REQ-UPDATE-DEFAULT-COMPOSITE All binaries signature-verified before handoff THE-FORKENING W4 (operator-grilled 2026-07-14): plain `spt update` = `update fetch --apply` THEN `up Self-update: **update composite (`spt update`)** — 59 REQ-BOUNDARY-ROTATION-CREDENTIAL REQ-LIVENESS-ORACLE-SOUND api boundary's rotation credential is designed, documented, and eventually anchor-proven (ADR-0032): TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-0 `api boundary --to-session-id 7.50 The liveness oracle answers from the process 60 REQ-ENDPOINT-LIST-REST-FILTER REQ-PICKER-UX-V013 spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-f `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directl 61 REQ-REL-2 REQ-UPD-7 Release asset set consumable by the self-updater: platform binaries, SHA256SUMS, SignedRelease metad Origin-source update bootstrap (`spt update fetch`): pull the latest signed release directly from th 62 REQ-CI-FREE-SPACE-PREFLIGHT REQ-HAZARD-SHELL-STALE-ONLINE Every CI job on a shared self-hosted runner FAILS LOUD AND FIRST on insufficient free disk, never ob A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably Conformance checklist (condensed): | # | Invariant 63 REQ-CONTROL-STAMP-CONVERGENCE REQ-HAZARD-CONTROLLER-RETAKE-FLOOR REGISTRY-LIFECYCLE W2 (ADR-0041 decision 4, emphasys C3 P1): control-stamp writes are session/genera `become_controller` should STRUCTURALLY refuse a controller re-take whose `from_seq` falls below the Decision: 1. **Online is earned, not decl 64 REQ-ENDPOINT-CYCLE-HONEST REQ-REST-TERMINAL-NORMALIZE REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE REGISTRY-LIFECYCLE W2 (ADR-0041 decision 3, rest-normalize P0): definitive hosted-session loss norma Decision: 1. **Online is earned, not decl Decision: 1. **Online is earned, not decl 65 REQ-INST-6 REQ-INSTALL-7 Deferred messages not delivered to dormant/suspended instances Windows inbound reachability: the elevated install leg registers the inbound-UDP firewall rule (New- Deferred Features: | Feature | Cut from | Why defe 66 REQ-PICKER-UX-V013 REQ-RUN-EMPTY-CREATE `spt endpoint run` picker UX (v0.13.0 operator dogfooding): (1) SKIP the first screen — open directl `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: 67 REQ-JOIN-DIAGNOSTICS REQ-SUBNET-4 `spt subnet join` never fails SILENTLY (ADR-0030; the field incident showed no output at all). (a) L Subnet membership mutations elevation-gated (create = seed reveal; join = trust-boundary enrollment) Robust WAN subnet join: meet-before-code + per-fam Product-surface amendment (2026-06-05 — M7 D3): 1. **`spt rc` consults the hon 74 REQ-ADAPTER-ADD-SURFACE-ERRORS REQ-UPDATE-GH-TRANSPORT Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero e THE-FORKENING W1 (ADR-0036, operator-ruled 2026-07-14): the release channel is PRIVATE (`BigscreenVR Self-update: **release channel (private, gh-carrie 75 REQ-RUN-EMPTY-CREATE REQ-WORKER-PICKER-EXCLUDED `spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoi 76 REQ-CONTROLLER-LEASE-IDENTITY REQ-PRESENCE-CONTROL-REAP-ON-EXIT RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE deca Decisions: 1. **Distinct viewport/lease i 77 REQ-READY-AGENT-RESUME REQ-SEAM-PSYCHE An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly spawn-psyche seam (fresh + resume templates) **`spt endpoint run` is the spt-hosted bringup for 78 REQ-INST-6 REQ-NOTIF-QUIET-DELIVERY Deferred messages not delivered to dormant/suspended instances The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never l Deferred Features: | Feature | Cut from | Why defe 4. Delivery: the notify kind rides `active_only`, 79 REQ-ADAPTER-LIVE-UPDATE REQ-NOTIF-UPDATE-ROW-VERSION-RETIRE An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004) An update-available notif row minted by a node running PRE-0.40.0 spt is retired on the version the Live, daemon-coordinated adapter update: 80 REQ-API-2 REQ-START-1 The api subcommand surface (bind/listen/poll/state/worker/boundary/...) Adapters never resolve SPT_HOME; binary on PATH; api bridging only 81 REQ-CONSENT-2 REQ-NOTIF-1 Interactive consent escalation: an ungated high-risk action routes a consent prompt to the user's mo Notification primitive: per-subnet replicated spool, seen/dismissed, resurface-at-boundary, subsumes 82 REQ-RUN-MULTISUBNET-HOME REQ-START-5 `spt endpoint run` resolves the home subnet at the skeleton-create step and pre-creates the skeleton Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` c Multi-subnet home resolution at `endpoint run` cre Startup flows (the two topologies): **Harness-host 83 REQ-HAZARD-PAIR-RATE-LIMIT REQ-PAIR-5 Subnet-global pairing rate limit: one active ceremony per subnet, shared attempt counter, exponentia Multi-subnet pairing: subnet-name discovery input, create-new-names-up-front, rendezvous-token hashi 84 REQ-HAZARD-DROP-FILE-SINGLE-WRITER REQ-HAZARD-DIRECT-WRITE-PRECEDENCE Drop files are daemon-owned single-writer (6.4) Direct-write precedence marker (with node id) guards stale overwrite (6.5) 85 REQ-HAZARD-GRACE-BEFORE-SIGNOFF REQ-HAZARD-ECHO-BEFORE-SIGNOFF Grace-period wait completes before composing INIT_SIGNOFF (1.1) Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3) 86 REQ-EFFECTIVE-INSTANCE-STATE REQ-PRESENCE-CONTROL-REAP-ON-EXIT A-1 (REMOTE-TRUTH triage §A + ADR-0033 §Decision): the effective instance state of a perch is DERIVE B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE deca 7.31 The Psyche failure budget must count REAL per 87 REQ-HAZARD-BIND-CWD-UNSET REQ-MSG-DELIVERY-AXES A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own projec Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque meta Activity-gated message delivery + send-modifier ax 88 REQ-CLI-HELP-MARKDOWN REQ-DOCS-RELEASE-ASSET `spt --help` (and every subcommand --help) renders the inline Markdown authored in the clap doc-comm THE-FORKENING W2 (ADR-0036 §4): every release ships a platform-independent docs bundle `spt-docs.tar Self-update: **docs bundle** — every release ships 89 REQ-ADAPTER-UPDATE-POST REQ-SEAM-POSTSPAWN Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` post-spawn / api bind seam with boot nonce `[update.post]` — the composite post-step (since v 90 REQ-INST-1 REQ-PSYCHE-NESTED-RESOLUTION endpoint ID vs instance split (adapter-agnostic ID) W4 (F030, design §3; F-017 sibling, general not psyche-only): nested {parent}/{nested} ids resolve u then it exits — no resident process, no detach.: < 91 REQ-SUBNET-1 REQ-SUBNET-3 spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-c Node labels: hostname-default, gossiped, addressable in @node qualifiers (refuse-on-ambiguity) 92 REQ-INST-15 REQ-INSTALL-BOOTSTRAP-VERB Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release d Immutable home subnet; fork (copy-then-diverge) is Installation: **Installer form (gh bootstrap, ADR- 93 REQ-HAZARD-RESTART-IDEMPOTENT REQ-NOTIF-QUIET-DELIVERY Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14) The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never l 4. Delivery: the notify kind rides `active_only`, 94 REQ-MIGRATE-1 REQ-NOTIF-MIGRATE Auto-detect and migrate a legacy claude_skill_owl install One-shot field migration: on first run the new binary auto-dismisses existing rows with from_id = sp 6. Field migration: one-shot targeted auto-dismiss 95 REQ-MIGRATE-1 REQ-MSG-1 Auto-detect and migrate a legacy claude_skill_owl install Local message delivery: TCP-first to a registered address, spool fallback when offline; id->address 96 REQ-RUN-ID-REUSES-ADAPTER REQ-RUN-NO-DUP-SESSION D-1 (REMOTE-TRUTH triage §D-1): `spt endpoint run --id ` with NO --adapter, when names an E B1 (F028, hall-b diagnosis, verified 0.22.0): `endpoint run --id X --create` on an endpoint with a L 97 REQ-HAZARD-DEFERRED-DRAIN REQ-HAZARD-IDLE-SILENT-NONDELIVERY Deferred spool rows excluded from the event-stream drain (1.4) An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared) 7.21 Exactly ONE `controller_writer` per brain↔bro 98 REQ-HAZARD-SUDO-SECURE-PATH REQ-INSTALL-6 Elevation guidance on Unix names the binary's ABSOLUTE path under sudo (a user-local install ~/.loca Linux elevation install leg: install.sh symlinks the binary into a sudo-reachable path (/usr/local/b 99 REQ-HAZARD-CONPTY-DSR REQ-HAZARD-EBUSY-RENAME ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5) tmp-write + atomic-rename + retry on Windows EBUSY (5.2) 100 REQ-HAZARD-RC-ATTACH-TRUTH REQ-HAZARD-RC-EOF RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 — umbrella conformance seam for ADR-0042): an rc surface answ A severed broker stream during a live rc session surfaces GRACEFULLY, never as a raw io error that c 7.45 Endpoint lifecycle state converges to truth f 101 REQ-ADAPTER-GH-TRANSPORT REQ-ADAPTER-UPDATE-POST The `gh_release` avenue (and `spt adapter add --release`) gain a fetch `transport`: `https` (current Composite adapter update — an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` Runtime model: **adapter packaging & live update** `[update.post]` — the composite post-step (since v 102 REQ-BROKER-SCREEN-GRID REQ-ENDPOINT-LIST-RENDER-POLISH Bugs #6 + #12 + #7/#8-artifacts: the broker is a raw-byte pump with no screen model — OutputLog repl A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT Decision: ## Amendment (RC-RENDER-TRU 108 REQ-ENDPOINT-CYCLE-HONEST REQ-START-5 REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` c Decision: 1. **Online is earned, not decl Startup flows (the two topologies): **Harness-host 109 REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE REQ-SEAM-INJECT MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft — doyle ACCEPTED pri inject-input methods configurable per activity-state 7.38 EVERY write on a physical broker connection i 110 REQ-ARCH-3 REQ-HAZARD-HANDOFF-ARGV-COMPAT Wire-protocol version independent of crate semver, N-1 compat window Broker/brain IPC + handoff argv version-tolerant (2.3) 111 REQ-HAZARD-CASCADE-WIPE-GUARD REQ-HAZARD-SINGLE-PATH-SOURCE No hard-delete of a parent hosting non-empty children (6.3) Single path/registry source of truth; no layout ambiguity (6.1) 112 REQ-HAZARD-SUDO-SECURE-PATH REQ-PAIR-6 Elevation guidance on Unix names the binary's ABSOLUTE path under sudo (a user-local install ~/.loca Elevation-gated per-subnet code fetch (UAC/root or elevated agent; else authenticator app) 113 REQ-HAZARD-RC-ATTACH-TRUTH REQ-SOFT-END-PRESERVES-LIVE-LISTENER RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 — umbrella conformance seam for ADR-0042): an rc surface answ F-2 (REMOTE-TRUTH triage §F-2, field-repro'd hall-bf 2026-07-04): a /clear must not sever a SURVIVIN 7.45 Endpoint lifecycle state converges to truth f 114 REQ-EFFECTIVE-INSTANCE-STATE REQ-PICKER-1 A-1 (REMOTE-TRUTH triage §A + ADR-0033 §Decision): the effective instance state of a perch is DERIVE The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list- 7.31 The Psyche failure budget must count REAL per 115 REQ-CONN-BLACKHOLE-LIFECYCLE-HARNESS REQ-PICKER-1 MSG-IDENTITY W6 / F-039 leg e (doyle W6 LOCK 2026-07-10, minted per amendment 3 — hertz's five invar The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list- 116 REQ-ENDPOINT-LIST-PROJECT-COL REQ-PICKER-1 #8: spt endpoint list gains a second column / (the endpoint's LATEST project) -> 4 columns The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list- 117 REQ-INST-12 REQ-PICKER-4 Endpoint visibility per-(endpoint,subnet): excluded semantics, OR-of-defaults + override, gates sync The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node 118 REQ-READY-AGENT-RESUME REQ-RUN-PICKER-HOME An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferr **`spt endpoint run` is the spt-hosted bringup for Shell sleep/wake (offline ↔ online): **spt-hosted 119 REQ-PICKER-OFFLINE-NO-VIEW REQ-WORKER-PICKER-EXCLUDED A3 (F028, operator #3): 'View now (read-only)' is offered for OFFLINE endpoints. model.rs:1030 offli V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoi 120 REQ-REGISTRY-APPLY-TRANSACTIONAL REQ-REGISTRY-REPLAY-BOUNDED REGISTRY-LIFECYCLE W1 (ADR-0040 decision 3, hertz defect B leg 3): registry feed application is TRAN REGISTRY-LIFECYCLE W1 (ADR-0040 decision 4, hertz defect B leg 4, defense-in-depth behind REQ-ONEWAY Decision: 1. **One-way (fire-and-forget) 121 REQ-SHELL-2 REQ-WAKE-WAIT Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout), A-2 rider (REMOTE-TRUTH triage §A-2): `spt endpoint wake --wait` blocks on the REAL bind (status rea 122 REQ-HAZARD-ENDPOINT-LIFECYCLE REQ-PICKER-CONTROLLED-LOCAL REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 — the umbrella conformance seam for ADR-0041): endpoint li #3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_st 7.44 Streams and seats on a long-lived connection 123 REQ-INST-13 REQ-SCREENGRID-WIDTH Subnet-exclusive sync + per-endpoint subnet-membership list TEARDOWN-AUTHORITY W3 (hertz field RCA 2026-07-19, doyle-confirmed at source): ScreenGrid models eve Server-side **screen grid** — the clean-room rende 124 REQ-HAZARD-CONTROL-STAMP-LIFETIME REQ-START-3 #2: a control/viewer stamp never outlives its session — every teardown path clears what attach stamp spt-hosted startup: spawn-session then api bind (no file) 7.26 Concurrent first-touch of ONE fresh BranchSto 125 REQ-RESUME-ADAPTER-FOLLOWS-SESSION REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED s C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contami 126 REQ-MSG-5 REQ-MSG-DELIVERY-AXES user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque meta Endpoint types: A message sent from a Gat Activity-gated message delivery + send-modifier ax 127 REQ-ENDPOINT-LIST-PALETTE REQ-RCVIEW-1 Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE inte Shell sleep/wake (offline ↔ online): **BU 128 REQ-ATTACH-SEED-REQUEST-DOUBLE-SERVE REQ-EP-5 A dispatcher-SEEDED attach Request is honored ONCE — the wire replay's copy of that same Request mus Concrete shell instantiation model: spawn-mints-instance (vs relink/online), registered-on-node perm 129 REQ-HAZARD-DAEMON-HOSTED-LIVENESS REQ-UPDATE-TRIAL-DRAIN-DRIVE Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + inf UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 — regression of the v0.29.0 seamless brain-swap): a Self-update: **brain-trial promotion (readiness + 130 REQ-HAZARD-INPUT-ACK-BACKPRESSURE REQ-HAZARD-MESH-BOOTSTRAP-TRAP A FLOOD of operator input on one brain↔broker connection deadlocks the broker PERMANENTLY (entire br MESH-RECOVERY W1 (KNOWN-HAZARDS 7.42, hertz field RCA 2026-07-10 — HFENDULEAM+ENLYZEAM symmetric gre 7.18 `spt rc` paste is client-originated on Window 7.41 A fresh dispatcher must NEVER re-serve a term 131 REQ-EP-1 REQ-EP-2 Day-one endpoint types; open type system Agent endpoints vs Shells distinction in the type model 132 REQ-INST-15 REQ-SUBNET-1 Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-c Immutable home subnet; fork (copy-then-diverge) is