REQ-ACTIVITY-INFO-PULL|The endpoint's current activity state (busy|idle) is readable via `spt api endpoint-info` — a point-|1. Activity observation is a first-class surface with two avenues — and the digest is not one of the REQ-ADAPTER-LIVE-UPDATE|An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004)|Live, daemon-coordinated adapter update: // Amendment (W3 build, 2026-06-22): A `.spt` REQ-ADAPTER-VERSION-CMD|`spt adapter version ` prints a registered adapter's declared version — the EXISTING mandatory|`[adapter]` — header: `version` is **mandatory**. It is the single declared adapter version REQ-API-3|commune/signoff are file-drops, not commands| REQ-API-4|api resolves the adapter manifest (+ profile + install dir) from `--adapter name:profile` via the re|Inbound `api` surface (detailed): **Manifest resolution from `--adapter` (since v0.8.0).** REQ-API-ENDPOINT-INFO|#7: spt api endpoint-info [] (JSON) lets an endpoint learn its ATTACHED (controlling) node — cla| REQ-ARCH-1|Many small acyclically-layered crates| REQ-ARCH-2|Public SDK surface is spt-proto, spt-runtime, spt-msg| REQ-ARCH-3|Wire-protocol version independent of crate semver, N-1 compat window| REQ-ATTACH-RESIZE-REPAINT|RESCOPED 2026-07-22 by ADR-0047 Amendment 2 (doyle-ratified): this REQ no longer asserts a defect. I|7.54 A geometry change invalidates the client's painted cells by itself — every resize entry emits t REQ-BIND-HONEST-SELF-STAMP|C2-ROOT (F028, doyle RCA 2026-07-03): the identity-attribution ROOT behind REQ-SESSIONS-LOG-ENDPOINT| REQ-BRAIN-RESUME-NO-CONN-DEADLOCK|UPDATE-WEDGE round 3 (v0.30.5, doyle-ruled Option A 2026-07-09 — the v0.30.4 field-verify re-wedge, |Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the broker for **every** host REQ-BRAIN-RESUME-NO-CONTROL-STEAL|UPDATE-WEDGE round 2 (v0.30.4, doyle-ruled 2026-07-09 — field incident on the counter-54 fetch--appl|Self-update: **resume re-attach is view-only for non-driven sessions** — on respawn the new brain qu REQ-BROKER-SCREEN-GRID|Bugs #6 + #12 + #7/#8-artifacts: the broker is a raw-byte pump with no screen model — OutputLog repl|Decision: 1. **Online is earned, not declared.** A creator may stamp `status=online` only f REQ-CONTROLLER-LEASE-IDENTITY|RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle |Decisions: 1. **Distinct viewport/lease identity.** Each rc invocation/attach stream mints REQ-DAEMON-1|One per-machine spt-daemon owning all per-machine state| REQ-DAEMON-2|Broker/brain split for seamless self-update|Restoration field-run evidence (D7-4) — the seamless-update acceptance: REQ-DAEMON-3|Any api invocation auto-starts the daemon if absent| REQ-DAEMON-REFRESH|THE-FORKENING W4 (operator add 2026-07-14): `spt daemon refresh` — restart the daemon BRAIN without |Self-update: **daemon refresh (`spt daemon refresh`)** — restart the **brain** in place, no binary s REQ-DIGEST-JSON-SELF-CONTAINED|TEARDOWN-AUTHORITY W4 (perri adapter-surface finding 2026-07-19, doyle-grounded and RE-SCOPED; title|Session digest — `endpoint digest --json`: ### v0.38.1 consequence note — `driven_by` own-node truth (ruling v3) REQ-ECHO-DROP-DIR-RESOLVE|W1 (LIFECYCLE-TRUTH): fire_echo resolves the manifest commune_dir through the SAME resolver its sibl| REQ-EFFECTIVE-INSTANCE-STATE|A-1 (REMOTE-TRUTH triage §A + ADR-0033 §Decision): the effective instance state of a perch is DERIVE|7.31 The Psyche failure budget must count REAL per-event attempts — a resident rate-guard is blind t REQ-ELEVATE-1|Cross-platform self-elevating re-launch for privilege-gated commands: a pure decision seam `decide_e|Pairing & trust: **self-elevating re-launch (cross-platform)**: When a gated command is run REQ-ENDPOINT-AUTOSTART|MSG-IDENTITY W5 / F-038 (flynn operator-directed ask 2026-07-10, SPT-CORE-NEEDS #7 + deployah field-|Startup defaults (`endpoint run --save`): Infrastructure endpoints (a gateway the phone tre REQ-ENDPOINT-LIST-MERGE-LOCAL|`spt endpoint list` always merges this node's LOCAL (unadvertised) perches into the view; the `--loc|**endpoint list always merges local perches**: `spt endpoint list` (and therefore `whoami`) REQ-ENDPOINT-LIST-RENDER-POLISH|A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT| REQ-ENDPOINT-MESSAGE-ONLY-DISPLAY|An online agent-family endpoint with NO session surface reads as message-reachable, not as a harness| REQ-ENDPOINT-PURGE|`spt endpoint purge ` fully removes an endpoint AND every record keyed on it — the formal teardo|Inbound `api` surface (detailed): **`spt endpoint purge `** (CLI, not `api`) — the standalone, f REQ-ENSURE-DAEMON-STOP-INHIBIT|An operator stop outranks every implicit daemon ensure. (ADR-0047 decision 2, AMENDING REQ-DAEMON-3'|The daemon: broker and brain: …with one exception, because you are allowed to mean it: **`s REQ-EP-1|Day-one endpoint types; open type system| REQ-EP-2|Agent endpoints vs Shells distinction in the type model| REQ-EP-4|PresenceChannel broker endpoint (seam day-one)| REQ-FRONT-1|Day-one launcher/manager frontend (list/launch/attach/init)| REQ-GOSSIP-CONTROLLED-CROSS-NODE|B7 (F028, operator, cross-node): a remote endpoint's CONTROLLED state is not rendered. Evidence: bal| REQ-GOSSIP-PROJECT-DERIVE-ONCE|REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle se| REQ-HAZARD-ADAPTER-PROFILE-STAMP-CLOBBER|A-4 (F029, operator regression): the picker/confirm views drop an endpoint's adapter `:profile` (sho| REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP|A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint — no duplicate. On an abr| REQ-HAZARD-BROKER-FLOOR-LOCK-POISON|B-1 (REMOTE-TRUTH triage §B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lo|7.32 The effective resting state MUST be derived through ONE shared liveness-aware function — a stor REQ-HAZARD-CASCADE-WIPE-GUARD|No hard-delete of a parent hosting non-empty children (6.3)| REQ-HAZARD-CONPTY-DSR|ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)| REQ-HAZARD-CONTROL-STAMP-CONVERGENCE|Control/viewer stamps must CONVERGE to broker session-table truth for every session-backed endpoint,|7.28 A relative manifest path resolves against the ENDPOINT, never the daemon `[REQ-STORE-CONTEXT-BR REQ-HAZARD-CONTROLLER-GAP-RESUME|A serving CONTROLLER whose serve-brain hits a b4 drop-don't-block FORWARD output gap must RESUME-FRO| REQ-HAZARD-CONTROLLER-LEASE|RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 — umbrella conformance seam for ADR-0044): at most one input-|7.47 The physical terminal is never mutated or terminated outside its renderer's ordered state model REQ-HAZARD-CONTROLLER-WRITER-REORDER|Two `controller_writer` threads must never race ONE brain↔broker connection's socket. ROOT (doyle, i|7.20 `spt rc` must forward the scroll wheel to the harness (our mouse capture steals WT's native scr REQ-HAZARD-DAEMON-HOSTED-LIVENESS|Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + inf| REQ-HAZARD-DEFERRED-DRAIN|Deferred spool rows excluded from the event-stream drain (1.4)| REQ-HAZARD-DEFERRED-MANIFEST|A pointer-mode (delegated / GhReleaseManaged) adapter whose binary/manifest is not yet extracted is | REQ-HAZARD-DEFERRED-SURVIVE-DRAIN|Deferred rows survive poll drain (4.4)| REQ-HAZARD-DETACHED-DAEMON-STDIO|A daemon DETACHED-IN-FACT (no interactive console, or an inherited stderr PIPE nobody drains) that n| REQ-HAZARD-DIRECT-WRITE-PRECEDENCE|Direct-write precedence marker (with node id) guards stale overwrite (6.5)| REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT|An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connectio|Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS tra REQ-HAZARD-DROP-FILE-SINGLE-WRITER|Drop files are daemon-owned single-writer (6.4)| REQ-HAZARD-EBUSY-RENAME|tmp-write + atomic-rename + retry on Windows EBUSY (5.2)| REQ-HAZARD-ECHO-BEFORE-SIGNOFF|Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3)| REQ-HAZARD-ELEVATED-DAEMON-SPAWN|The daemon always runs unelevated in the invoking user's universe, regardless of which command spawn|5.6 Windows detached children inherit a captured caller's pipe `[REQ-HAZARD-DETACHED-PIPE-INHERIT]`: REQ-HAZARD-ENDPOINT-LIFECYCLE|REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 — the umbrella conformance seam for ADR-0041): endpoint li|7.44 Streams and seats on a long-lived connection must have bounded lifetime — one-way rows terminal REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT|A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY| REQ-HAZARD-ENVELOPE-PARSER-SAFE|Two-slice envelope parser is panic-free and tolerant (4.2)| REQ-HAZARD-EPHEMERAL-CLEANUP|Ephemeral perch cleanup on every ring exit path (3.1)| REQ-HAZARD-EPOCH-RESET|Advertisement-epoch reset strands a node: peers' higher last-seen epoch drops the reset node's fresh|4.10 Dead node identities leave immortal registry rows `[REQ-HAZARD-REGISTRY-GHOST-ROWS]`: ### 4.11 REQ-HAZARD-GRACE-BEFORE-SIGNOFF|Grace-period wait completes before composing INIT_SIGNOFF (1.1)| REQ-HAZARD-HANDOFF-ARGV-COMPAT|Broker/brain IPC + handoff argv version-tolerant (2.3)| REQ-HAZARD-ID-CHARSET|Addressable-id charset reserves :/@ delimiters; validated at every creation seam (4.6)|4.5 Inbox legacy compat must not double-deliver: ### 4.6 Addressable-id charset reserves the address REQ-HAZARD-INBOX-NO-DOUBLE|No double-delivery via legacy inbox (4.5)| REQ-HAZARD-INFO-RMW-LOST-UPDATE|Concurrent info.json writers must serialize under the per-perch lock (5.16): an unlocked whole-recor|5.15 Fixed atomic-write tmp name → concurrent writers collide (loser renames a consumed file) `[REQ- REQ-HAZARD-LIVEHOST-BOOT-LIVENESS-GATE|B5: `spt daemon start` does NOT revive phantom Psyches for dead-but-online-latched perches. Today re| REQ-HAZARD-LIVEHOST-NONRESIDENT|A daemon-hosted Psyche that spawns then EXITS IMMEDIATELY is a host failure, surfaced like a spawn f| REQ-HAZARD-PAIR-SEED-ROTATION|Removing a node rotates the subnet seed (epoch bump) so an old node/old seed cannot rejoin; trust-st| REQ-HAZARD-PAIR-TRANSCRIPT-BIND|Pairing transcript binds roles, both node pubkeys, subnet ID, seed epoch, TOTP time-step, and confir| REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION|W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04):|7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZ REQ-HAZARD-RC-ATTACH-FAILFAST|B1: `spt rc ` to a DEAD or non-streaming session fails fast with a clear message, never an INFIN| REQ-HAZARD-RC-EOF|A severed broker stream during a live rc session surfaces GRACEFULLY, never as a raw io error that c| REQ-HAZARD-RC-INPUT-KEY-ENCODING|An `spt rc` session forwards the Backspace key as the VT DEL byte (0x7f), so the hosted TUI (Claude | REQ-HAZARD-REDISPATCH-CONTROL-STEAL|REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 — 4/5 endpoints frozen per brain|7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed — an un REQ-HAZARD-REGISTRY-CONCURRENT|Concurrent SQLite openers (registry/spool) must not fail with 'database is locked' (4.7)|4.6 Addressable-id charset reserves the address delimiters: ### 4.7 Concurrent SQLite openers must n REQ-HAZARD-REGISTRY-DIR-CREATE|SQLite store opens create their parent dir themselves — a fresh-home registry op must not SQLITE_CAN|4.8 Registry merge ordered by epoch, never wall-clock (red-team #8): ### 4.9 SQLite stores must crea REQ-HAZARD-REGISTRY-GHOST-ROWS|Registry rows must decay (no immortal rows) via TWO triggers: (a) NODE-SILENCE — evict rows whose au|4.9 SQLite stores must create their parent dir — SQLite won't: ### 4.10 Dead node identities leave i REQ-HAZARD-REGISTRY-STALE-CLEAN|Stale registry entries degrade to fallback, never hard-fail (4.3)| REQ-HAZARD-RESTART-IDEMPOTENT|Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)| REQ-HAZARD-ROSTER-GHOST|A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phant| REQ-HAZARD-SESSION-PIN-WEDGE|A perch PINNED to a DEAD session-id self-heals instead of wedging forever. authenticate() (spt/src/a|F-019 diagnosis lesson — confirm an adapter binary actually SPAWNED before behavioral diagnosis `[RE REQ-HAZARD-SINGLE-PATH-SOURCE|Single path/registry source of truth; no layout ambiguity (6.1)| REQ-HAZARD-SOFT-CLEANUP|Soft-cleanup preserves state, removes only the ready marker (6.2)| REQ-HAZARD-STALE-INDEX-LOCK|Sweep stale lockfiles on daemon boot (1.3)| REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP|Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via th|Conformance checklist (condensed): | # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace REQ-HAZARD-STOP-RESPAWN-CONVOY|KNOWN-HAZARDS 7.52: an operator stop outranks every implicit ensure — no convenience path resurrects|7.52 An operator stop outranks every implicit ensure — no convenience path resurrects what the opera REQ-HAZARD-TEARDOWN-DEADEND|TEARDOWN-AUTHORITY W1 HAZARD (ADR-0045 decision 8; hertz RCA 2 — hit doyle's OWN live production end|7.48 At most one input-capable controller lease per PTY session — takeover revokes atomically and lo REQ-HAZARD-TEMPLATE-ARGV-FILL|Command-template substitution fills argv ELEMENTS, not a re-tokenized string: spt-core currently `fi| REQ-HAZARD-UNC-PATH-STRIP|Strip Windows UNC prefix on serialized paths (5.4)| REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE|A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COE| REQ-IDLE-PARKED-DELIVERY|W5 (LIFECYCLE-TRUTH): a message QUEUED to an ALREADY-idle spt-hosted endpoint is delivered without a| REQ-INPUT-CONTROLLER-FENCE|RC-RENDER-TRUTH W2 (ADR-0044 decision 3, hertz same-machine --take split-brain RCA P0-C + scope clar|Decisions: Across DIFFERENT `by` identities the intent split stands: `Control` = Busy, `Take` = loud REQ-INST-10|Qualified addressing [subnet:]id[@node] + ambiguity forces qualification| REQ-INST-3|Dormant (warm) / suspended (cold) resting states|Dormancy resource budget (D9-3 — ADR-0003 red-team #9): REQ-INST-5|Two-tier context sync (live to all, project to same-project)| REQ-INST-6|Deferred messages not delivered to dormant/suspended instances|Deferred Features: | Feature | Cut from | Why deferred | Trigger to revisit | |---|---|---|---| | Sc REQ-INSTALL-11|Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.s|Manifest seams (outbound contract, detailed): - **Command templates are opaque.** spt-core never par REQ-INSTALL-12|Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.|Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the REQ-INSTALL-13|Adapter add is non-destructive & idempotent-safe (F-018): `spt adapter add --github|--release` REFUS|Installation: **adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter — REQ-INSTALL-3|Idempotent + interactive-optional first run| REQ-INSTALL-7|Windows inbound reachability: the elevated install leg registers the inbound-UDP firewall rule (New-| REQ-INSTALL-BOOTSTRAP-VERB|THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release d|Installation: **Installer form (gh bootstrap, ADR-0036):** install gh → `gh auth login` (org members REQ-JOIN-DEFERRED-ELEVATION|W2 (JOIN-TRUTH, operator UX ruling verbatim): 'if --code was not supplied, don't spawn the elevated |Deferred-elevation amendment (2026-07-06 — JOIN-TRUTH W2): REQ-LIST-JSON-LIVENESS-PARITY|GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (huma| REQ-LIVENESS-ORACLE-SOUND|TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-0|7.50 The liveness oracle answers from the process table, never from a handle a caller still holds `[ REQ-MANIFEST-6|Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed|Manifest seams (outbound contract, detailed): - **Command templates are opaque.** spt-core never par REQ-MANIFEST-NODE-KEY|A new session-scoped manifest fill key `{node}` resolves to THIS node's advertised label — available|Claude Code: native resume into an existing transcript by id, in its project cwd.: ```toml REQ-MANIFEST-SUBST|Manifest substitution primitives for resolve-not-execute (ADR-0029, supersedes a rejected `spt api r|Claude Code: native resume into an existing transcript by id, in its project cwd.: **Adapte REQ-MESH-2|Member roster: node-level union-merge grow-set (per member: pubkey, label, machine_id, last-known ad| REQ-MESH-3|Mesh row fan-out: registry rows stay OWN-AUTHORED; the only change is the push target widens from di| REQ-MSG-INJECT-LEG-DROP-VISIBLE|SEED (inactive — observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an hon| REQ-NOTIF-COALESCE|Coalesce-key supersession: producer-stamped key REQUIRED in namespaced form : (e.g. spt-|2. Supersession: a required-namespaced coalesce key, latest-wins: REQ-NOTIF-DRAIN-ROW-VALIDITY|A spooled notify envelope is validated against its notif row at DELIVERY time — a copy outliving its|7.53 A durable copy of revocable content is validated against its source of truth at DELIVERY time — REQ-NOTIF-MIGRATE|One-shot field migration: on first run the new binary auto-dismisses existing rows with from_id = sp|6. Field migration: one-shot targeted auto-dismiss: REQ-OPID-TRACING-RETRY|A-4b (REMOTE-TRUTH triage §A + ADR-0034 Decision 2): the tracing-only op families auto-retry ONCE wi|no-longer-held error by a SHARED CONST MARKER, not a typed wire variant): Decision 3's "typ REQ-PAIR-1|TOTP-seeded SPAKE2 pairing| REQ-PAIR-4|Subnet naming on first pairing| REQ-PAIR-5|Multi-subnet pairing: subnet-name discovery input, create-new-names-up-front, rendezvous-token hashi| REQ-PAIR-6|Elevation-gated per-subnet code fetch (UAC/root or elevated agent; else authenticator app)| REQ-PAIR-8|NTP TOTP offset: the pairing ceremony queries NTP at ceremony time (both sides) and applies the deri| REQ-PICKER-1|The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-| REQ-PICKER-3|A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoi| REQ-PICKER-4|The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node| REQ-PICKER-5|`spt endpoint list` (bare/subnet view) renders an ALIGNED table with canonical node labels: cmd_endp| REQ-PICKER-ADAPTER-DESCRIPTION|The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description p| REQ-PICKER-CHOOSE-DEDUP-ALL|A4 (F028, operator #5): choose-project duplicate rows. model.rs:314-337 build_project_choices dedups| REQ-PICKER-CONTROL-LINE-STATUS-GATE|A2 (F028, operator #2): the picker confirm-panel 'controlled locally' line renders for OFFLINE endpo| REQ-PICKER-CONTROLLED-LOCAL|#3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_st| REQ-PICKER-CURRENT-DIR-LABEL|A-2/A-3 (F029, operator, semantic pair): the Choose-project rows must self-identify the CURRENT DIR.| REQ-PICKER-KEY-GATE-LAUNCH-CAPABLE|B-1 (F029, operator): the `h` (headless start) / `s` (shortcut) keybinds fire from broad picker cont| REQ-PICKER-NODE-GROUPING|Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253| REQ-PICKER-PROJECT-DISPLAY-NAME|A1 (F028, operator #1/#4/#6-display): `github-com-*` 'ghost' project entries are NOT phantoms — proj| REQ-PICKER-PURGE-STRUCTURED|RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from i|Decisions: 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the so REQ-PICKER-REMOTE-WAKE|C-2 (REMOTE-TRUTH triage §C-2 #4 + addendum @3442ce5): a REMOTE suspended picker row offers `Wake no| REQ-PICKER-RESUME-CONTEXT-PANEL|#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY| REQ-PICKER-SHORTCUT-LABEL-FILENAME|B-4 (F029, operator): the confirm-panel shortcut option label is a static `New/Update spt- short| REQ-PICKER-START-PROJECT-CHOICE|#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' li| REQ-PLATFORM-MUSL|MUSL-TIER W2 (register the musl platform, self-IDENTIFY): add x86_64-unknown-linux-musl to the W1 re| REQ-PLATFORM-REGISTRY|MUSL-TIER W1 (target-triple centralization, behaviour-NEUTRAL refactor): ONE authoritative platform | REQ-PROJECT-INDEX-READER-CUTOVER|PROJECT-INDEX W3 (ADR-0037): endpoint list, the picker, and endpoint-info consume the materialized i|Self-update: **project index** — a node's endpoint→project attribution is DERIVED state, held as a * REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN|C3 (F028, perri F-h): psyche wrapper crash-loop has no backoff, and `endpoint shutdown` misses a wed| REQ-PSYCHE-SPAWN-ENV-PARITY|P-2 (WORKER-TRUTH triage addendum, perri-filed field finding 2026-07-06): the per-event psyche_resum| REQ-PUBLIC-ERROR-SURFACES|F-1 (REMOTE-TRUTH triage §F-1, Q4 UX rule, operator-ruled): CLI stderr a non-developer can hit names| REQ-RC-1|`spt rc ` — user CLI attaching a local terminal to a broker-held PTY, reusing the cross-node att| REQ-RC-DISPLAY-SOLE-WRITER|TEARDOWN-AUTHORITY W5 (hertz RCA 3 bug 1, 2026-07-19 — REPRODUCED on 0.38.1 CLI + 0.38.1 broker; doy| REQ-RC-HARNESS-ONLY-REFUSAL|RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc 1. **`spt rc` consults the honest-session authority before the offline fast-fail REQ-RC-IDENTITY|`spt rc` overlays a persistent endpoint-identity marker so the operator always groks which endpoint | REQ-RC-IDMARKER-DISABLE|Bugs #14 + #7/#8 (marker half): feature-flag the top-right StatusRow endpoint-id marker OFF (rc.rs:1| REQ-RC-KEY-VT-TRANSLATE|On Windows, `spt rc` translates CONSOLE KEY EVENTS to standard xterm VT so ALL keys reach the hosted|Shell sleep/wake (offline ↔ online): **rc keyboard input (Windows VT translation, v0.13.0 b REQ-RC-MOUSE-FORWARD|On Windows, `spt rc` must FORWARD scroll-wheel events to the harness when the harness has mouse repo|7.19 An operator input FLOOD must not deadlock the broker via the applied-ack on the same conn `[REQ REQ-RC-RESIZE-PRESENTATION-BARRIER|During a resize transition, LIVE DELIVERY is barriered along with the grid parse: no attached sink (| **BUILT (M12 W2.5).** The controller/viewer model is i REQ-READY-AGENT-RESUME|An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly|**`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): The bri REQ-REGISTRY-REPLAY-BOUNDED|REGISTRY-LIFECYCLE W1 (ADR-0040 decision 4, hertz defect B leg 4, defense-in-depth behind REQ-ONEWAY| REQ-REL-2|Release asset set consumable by the self-updater: platform binaries, SHA256SUMS, SignedRelease metad|Release runbook: REQ-RELEASE-CHANNEL-PRIVATE|THE-FORKENING W2 (ADR-0036 §2): the publish pipeline targets `BigscreenVR/spt-bs-releases` — release| REQ-RESUME-ADAPTER-FOLLOWS-SESSION|D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED s| REQ-RESUME-CONTEXT-PULL|Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-|Manifest seams (outbound contract, detailed): **resume-session seam** — two distinct forms: - **fres REQ-RESUME-HARNESS-SESSION-ID|B2 (F028, hall-b diagnosis, verified 0.22.0): respawn/`--resume` feeds the SPT session id to `claude| REQ-RESUME-ROW-PER-PROJECT|A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project.| REQ-RESUME-UNBOUND-STAMP|RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitio|Decisions: 1. **`spt rc` consults the honest-session authority before the offline fast-fail REQ-RUN-ID-REUSES-ADAPTER|D-1 (REMOTE-TRUTH triage §D-1): `spt endpoint run --id ` with NO --adapter, when names an E| REQ-RUN-NO-DUP-SESSION|B1 (F028, hall-b diagnosis, verified 0.22.0): `endpoint run --id X --create` on an endpoint with a L| REQ-RUN-SHORTCUT|`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start|**`spt-` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` w REQ-SCREENGRID-WIDTH|TEARDOWN-AUTHORITY W3 (hertz field RCA 2026-07-19, doyle-confirmed at source): ScreenGrid models eve|Server-side **screen grid** — the clean-room render model behind the clean repaint on attach (field REQ-SEAM-PSYCHE|spawn-psyche seam (fresh + resume templates)| REQ-SEAT-LIFETIME-BOUNDED|REGISTRY-LIFECYCLE W1 (ADR-0040 decision 5, hertz defect B leg 5 CROSS-FAMILY per the final attribut|Decision: 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.* REQ-SEND-SPT-HOSTED|An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` → `a| REQ-SEND-WINDOW-DRAIN-HONOR|F-035 (field finding 2026-07-09): active_only = POLL-ONLY for a relay-bearing live agent -- it must | # F-035 RCA — idle-edge parked-drain ignores the delivery-wi REQ-SERVE-OWNERSHIP-GENERATION|REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/g|Consequences: ## Amendment — REDISPATCH-STALL (2026-07-16) REQ-SESSION-ADAPTER-RECORDED|D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profi| REQ-SESSION-RESUME-TEMPLATE|Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, c|`[session.]` — outbound templates: **Resuming an existing harness session (since v0.1 REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION|C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contami| REQ-SHELL-1|Shell hosting machinery: shell perch under the owner (type/owner/adapter_name/status/alias), broker-| REQ-SHELL-FRAME-VOCAB|The shell relay frame vocabulary is a PUBLISHED contract, not a reverse-engineered one. (flynn spt-a|The frame contract: what a shell binary parses: REQ-SHELL-LIST-DERIVED-PROVENANCE|SEED (inactive — observability, perri-backed 2026-07-26): a status a reader can act on should be dis| REQ-SPOOL-TAKE-AUDIT|W5 (LIFECYCLE-TRUTH, RCA cost: proving WHO took delivered=1 rows burned an hour): the spool records | REQ-START-2|Harness-hosted startup: api seed then listen| REQ-START-5|Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` c|Startup flows (the two topologies): **Harness-hosted (e.g. spt-plugin; the harness binary is user-la REQ-STORE-1|spt-store::BranchStore (git branch as versioned KV; commit=checkpoint/tip=resume, atomic multi-key, | REQ-STORE-CONTEXT-BRANCH-FILL|#1 SI-1 (RCA, operator-promoted 2026-07-03): the context store (tracked/.seed.git) holds ZERO p-* br|7.27 A control/viewer stamp must NEVER outlive its session — every teardown path clears what attach REQ-STREAM-LEASE-CLASSES|REGISTRY-LIFECYCLE W2 (ADR-0040 decision 6 + ADR-0041, emphasys C2 P0): streams declare a lifetime c|Decision: 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.* REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE|REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 2+3+4): StreamLog subscriber write discipline — (a) r|Consequences: ## Amendment — REDISPATCH-STALL (2026-07-16) REQ-SUBNET-1|spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-c| REQ-SUBNET-3|Node labels: hostname-default, gossiped, addressable in @node qualifiers (refuse-on-ambiguity)| REQ-TERM-2|session-surface abstraction; send-keys + send-line injection| REQ-TERM-4|Live activity buffer (session digest): projection of normalized session logs, snapshot-pull (spt end| REQ-TERM-6|Thread-spanning digest across session boundaries: a per-endpoint session ledger (`/sessions.l| REQ-TERM-7|Two-origin digest merge: spt-owned context-injection entries (psyche_download | echo_mirror | owl_me| REQ-TRANSLATE-BINARY-LIVENESS-DECAY|SUPERSEDED by REQ-TRANSLATE-COMMIT-MISS-TOLERANCE (F029 C-1). B6 (F028, perri F-e) was ROOT-PINNED a| REQ-TRANSLATE-COMMIT-MISS-TOLERANCE|C-1 (F029, B6 ROOT — rescope of REQ-TRANSLATE-BINARY-LIVENESS-DECAY, now PINNED): at a checkpoint cl|Amendment (2026-07-03, F029 C-1) — a commit-miss is NOT a fault; real faults respawn: REQ-UPD-3|No endpoint process terminates/suspends during self-update| REQ-UPD-5|spt-core ripple-updates registered adapters| REQ-UPD-6|Platform-targeted update sets and debug rollout: signed multi-platform update metadata, recipient pl|Build plan — `xtask debug-converge` (deferred follow-up): // Debug rollout runbook: Each adapter manifest decla REQ-UPDATE-ADAPTERS-VERB|THE-FORKENING W4 (operator-grilled 2026-07-14): `spt update adapters [[,...]]` = thin ALIAS ov|Self-update: **update composite (`spt update`)** — the plain verb is the primary form: `update fetch REQ-UPDATE-APPLY-ALREADY-APPLIED|`spt update apply` classifies an already-staged / already-applied state as a friendly exit-0 no-op i| REQ-UPDATE-FETCH-APPLY-FLAG|`spt update fetch --apply` is the one-shot get-to-latest: fetch, then INSTALL the staged update REGA| REQ-UPDATE-FINISH-COMMUNE-FLUSH|DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 — mint now, impl a FUTURE milestone): make| REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL|W3 (LIFECYCLE-TRUTH): daemon restart no longer massacres hosted endpoints — daemon start RE-RUNS pre| REQ-WAN-SEND-DELIVERY|Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Rea| REQ-WHOAMI-EXPLICIT-SID-REFUSAL|RULED DESIGN, delivery unowned (doyle 2026-07-26): when a caller hands identity resolution an EXPLIC| REQ-WHOAMI-IDENTITY-ONLY|PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-cri|`spt whoami` — the identity verb *(identity-only since v0.33.0)*: The bounded-time "which e REQ-WORKER-LIST-VISIBILITY|V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view| REQ-WORKER-REAP|W-3 (WORKER-TRUTH triage): worker records must not persist indefinitely past their useful life — 6 d|