[
  {
    "idx": 1,
    "a_id": "REQ-HAZARD-DROP-FILE-SINGLE-WRITER",
    "a_title": "Drop files are daemon-owned single-writer (6.4)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-DIRECT-WRITE-PRECEDENCE",
    "b_title": "Direct-write precedence marker (with node id) guards stale overwrite (6.5)",
    "b_doc": ""
  },
  {
    "idx": 2,
    "a_id": "REQ-PICKER-2",
    "a_title": "The picker's project-history loader reads the git-backed context store, not the bare working tree: data.rs project_history_for enumerates an endpoint'",
    "a_doc": "",
    "b_id": "REQ-READY-AGENT-RESUME",
    "b_title": "An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly \u00e2\u20ac\u201d closing the gap that today only LiveAgents do",
    "b_doc": "**`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): <!-- --> The bringup core is **type-agnostic** \u00e2\u20ac\u201d the endpoint TYPE is the adapter manifest's concern, not a separa"
  },
  {
    "idx": 3,
    "a_id": "REQ-ADAPTER-UPDATE-POST",
    "a_title": "Composite adapter update \u00e2\u20ac\u201d an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_p",
    "a_doc": "`[update.post]` \u00e2\u20ac\u201d the composite post-step (since v0.16.0): <!-- --> // file_pull: repo + path_regex: <!-- --> **Composite update \u00e2\u20ac\u201d `[update.post]` (since v0.16.0).** An optional **avenue-agnostic*",
    "b_id": "REQ-HAZARD-ENV-SUBST",
    "b_title": "`spt endpoint run` HONORS manifest [env.<VAR>] direction=inject values (with {key} substitution) on the spt-hosted spawn. Today only the [session.self",
    "b_doc": ""
  },
  {
    "idx": 4,
    "a_id": "REQ-HAZARD-DIRECT-WRITE-PRECEDENCE",
    "a_title": "Direct-write precedence marker (with node id) guards stale overwrite (6.5)",
    "a_doc": "",
    "b_id": "REQ-SERVE-OWNERSHIP-GENERATION",
    "b_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/generation validation on attach/detach \u00e2\u20ac\u201d a stale ",
    "b_doc": "Consequences: ## Amendment \u00e2\u20ac\u201d REDISPATCH-STALL (2026-07-16) <!-- --> <!-- --> <!-- --> <!-- -->"
  },
  {
    "idx": 5,
    "a_id": "REQ-PICKER-CHANGE-ADAPTER-FLOW",
    "a_title": "B-2 (F029, operator; LARGEST item): `ConfirmOption::ChangeAdapter` wrongly routes into the CREATE flow (Screen::CreateAdapter \u00e2\u2020\u2019 CreateId \u00e2\u2020\u2019 CreateH",
    "a_doc": "",
    "b_id": "REQ-RUN-ID-REUSES-ADAPTER",
    "b_title": "D-1 (REMOTE-TRUTH triage \u00c2\u00a7D-1): `spt endpoint run --id <id>` with NO --adapter, when <id> names an EXISTING perch, REUSES that perch's recorded info.",
    "b_doc": ""
  },
  {
    "idx": 6,
    "a_id": "REQ-ADAPTER-GH-TRANSPORT",
    "a_title": "The `gh_release` avenue (and `spt adapter add --release`) gain a fetch `transport`: `https` (current reqwest direct, public), `gh` (shell the pre-auth",
    "a_doc": "Runtime model: **adapter packaging & live update** (v0.13.2; ADR-0024, ADR-0025): <!-- --> A `.spt` may be **multi-platform**: shared `manifest.toml` + `strings/` at the root, role binaries under per-",
    "b_id": "REQ-RESUME-ADAPTER-FOLLOWS-SESSION",
    "b_title": "D-2 (REMOTE-TRUTH triage \u00c2\u00a7D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) \u00e2\u20ac\u201d",
    "b_doc": ""
  },
  {
    "idx": 7,
    "a_id": "REQ-RUN-MULTISUBNET-HOME",
    "a_title": "`spt endpoint run` resolves the home subnet at the skeleton-create step and pre-creates the skeleton perch carrying it, so the harness `bind` inherits",
    "a_doc": "Multi-subnet home resolution at `endpoint run` creation: <!-- -->",
    "b_id": "REQ-RUN-PICKER-HOME",
    "b_title": "Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferred half of REQ-RUN-MULTISUBNET-HOME's interactive ",
    "b_doc": "Shell sleep/wake (offline \u00e2\u2020\u201d online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): <!-- --> The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--a"
  },
  {
    "idx": 8,
    "a_id": "REQ-LIST-JSON-LIVENESS-PARITY",
    "a_title": "GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (human) and `endpoint list --json` MUST report an IDENT",
    "a_doc": "",
    "b_id": "REQ-SUBNET-8",
    "b_title": "Status render honesty: zero-subnet text is daemon-aware ('No subnets registered \u00e2\u20ac\u201d this node is standalone.' + daemon-running-dependent blurb, never ",
    "b_doc": ""
  },
  {
    "idx": 9,
    "a_id": "REQ-HAZARD-CONTROLLER-LEASE",
    "a_title": "RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 \u00e2\u20ac\u201d umbrella conformance seam for ADR-0044): at most one input-capable controller lease per PTY session; takeov",
    "a_doc": "7.47 The physical terminal is never mutated or terminated outside its renderer's ordered state model \u00e2\u20ac\u201d output before exit, owned baselines, unconditional teardown `[REQ-HAZARD-RENDER-LIFECYCLE]`: ##",
    "b_id": "REQ-HAZARD-INJECT-CONTROL-COEXIST",
    "b_title": "SPINE INVARIANT (v0.13.0 keystone): the broker must accept INJECTED keystrokes into an spt-hosted PTY (the v0.11.0 raw direct-inject today; the ADR-00",
    "b_doc": ""
  },
  {
    "idx": 10,
    "a_id": "REQ-HAZARD-SOFT-CLEANUP",
    "a_title": "Soft-cleanup preserves state, removes only the ready marker (6.2)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-EPHEMERAL-CLEANUP",
    "b_title": "Ephemeral perch cleanup on every ring exit path (3.1)",
    "b_doc": ""
  },
  {
    "idx": 11,
    "a_id": "REQ-ENDPOINT-STOP-OFFLINE",
    "a_title": "H3: `spt endpoint stop <id>` marks the endpoint OFFLINE (alive=false), not merely de-readied. cmd_stop (cli.rs:2994-3010) removes the ready marker + u",
    "a_doc": "",
    "b_id": "REQ-HAZARD-SOFT-CLEANUP",
    "b_title": "Soft-cleanup preserves state, removes only the ready marker (6.2)",
    "b_doc": ""
  },
  {
    "idx": 12,
    "a_id": "REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP",
    "a_title": "A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint \u00e2\u20ac\u201d no duplicate. On an abrupt brain death stop_host never runs (the LiveSe",
    "a_doc": "",
    "b_id": "REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE",
    "b_title": "MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft \u00e2\u20ac\u201d doyle ACCEPTED primary fix): the daemon MUST sanitize inherited pe",
    "b_doc": "7.38 EVERY write on a physical broker connection is bounded + cancelable + poison-on-failure \u00e2\u20ac\u201d no writer holds the send gate across an UNBOUNDED OS write `[REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UN"
  },
  {
    "idx": 13,
    "a_id": "REQ-RELAY-NO-BUSY-DELIVER",
    "a_title": "MSG-IDENTITY W4 (operator self-send probe 2026-07-09, companion leg): the relay/idle-inject carrier MUST NOT fire for an ACTIVE endpoint \u00e2\u20ac\u201d the daemo",
    "a_doc": "",
    "b_id": "REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE",
    "b_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 2+3+4): StreamLog subscriber write discipline \u00e2\u20ac\u201d (a) replay and live fan-out HALT at the first failed ",
    "b_doc": "Consequences: ## Amendment \u00e2\u20ac\u201d REDISPATCH-STALL (2026-07-16) <!-- --> <!-- --> <!-- --> <!-- -->"
  },
  {
    "idx": 14,
    "a_id": "REQ-HAZARD-DAEMON-STOP-BARRIER",
    "a_title": "B3: `spt daemon stop` then an immediate `spt daemon start` does NOT race \u00e2\u20ac\u201d stop fully completes before it returns. Today request_stop (seedmap.rs:24",
    "a_doc": "",
    "b_id": "REQ-SPAWN-COLLISION-GUARD-LIVE-DUP",
    "b_title": "W4 (LIFECYCLE-TRUTH): single-flight wake per endpoint \u00e2\u20ac\u201d the WAKE/RESUME respawn seam must not launch twice for one wake. ROOT (perri parentage + rec",
    "b_doc": ""
  },
  {
    "idx": 15,
    "a_id": "REQ-HAZARD-HANDOFF-ARGV-COMPAT",
    "a_title": "Broker/brain IPC + handoff argv version-tolerant (2.3)",
    "a_doc": "",
    "b_id": "REQ-INSTALL-2",
    "b_title": "Marketplace-repackaging-friendly install",
    "b_doc": "Installation: <!-- the two-paths model + the one-line script half (v0.1 phasing below; OS-service leg = docs/DEFERRED.md) --> <!-- the marketplace-repackaging stance: relocatable binary + minimal, non"
  },
  {
    "idx": 16,
    "a_id": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL",
    "a_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u00e2\u20ac\u201d 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve ",
    "a_doc": "7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed \u00e2\u20ac\u201d an un-committable slice preserves the drop, never delete-then-lose `[REQ-HAZARD-COMMUNE-INGEST-BLACKHOL",
    "b_id": "REQ-RCVIEW-1",
    "b_title": "Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; ",
    "b_doc": "Shell sleep/wake (offline \u00e2\u2020\u201d online): <!-- --> **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`"
  },
  {
    "idx": 17,
    "a_id": "REQ-API-3",
    "a_title": "commune/signoff are file-drops, not commands",
    "a_doc": "",
    "b_id": "REQ-HAZARD-ENVELOPE-PARSER-SAFE",
    "b_title": "Two-slice envelope parser is panic-free and tolerant (4.2)",
    "b_doc": ""
  },
  {
    "idx": 18,
    "a_id": "REQ-HAZARD-GRACE-BEFORE-SIGNOFF",
    "a_title": "Grace-period wait completes before composing INIT_SIGNOFF (1.1)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-ECHO-BEFORE-SIGNOFF",
    "b_title": "Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3)",
    "b_doc": ""
  },
  {
    "idx": 19,
    "a_id": "REQ-INJECT-MULTILINE-INTEGRITY",
    "a_title": "W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le",
    "a_doc": "",
    "b_id": "REQ-SEAM-INJECT",
    "b_title": "inject-input methods configurable per activity-state",
    "b_doc": ""
  },
  {
    "idx": 20,
    "a_id": "REQ-HAZARD-ELEVATED-DAEMON-SPAWN",
    "a_title": "The daemon always runs unelevated in the invoking user's universe, regardless of which command spawns it: an elevated spawner de-elevates (Windows: UA",
    "a_doc": "5.6 Windows detached children inherit a captured caller's pipe `[REQ-HAZARD-DETACHED-PIPE-INHERIT]`: ### 5.7 Elevated commands spawn the daemon with the wrong token `[REQ-HAZARD-ELEVATED-DAEMON-SPAWN]",
    "b_id": "REQ-HAZARD-RESUME-CUSTODY-ABA",
    "b_title": "KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID \u00e2\u20ac\u201d a recycled pid must read NOT OURS. The hazard-conformance twin of REQ-RESUME-",
    "b_doc": "7.51 Process custody is an identity, never a bare PID \u00e2\u20ac\u201d a recycled pid must read NOT OURS `[REQ-HAZARD-RESUME-CUSTODY-ABA]`: <!-- --> - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle"
  },
  {
    "idx": 21,
    "a_id": "REQ-NET-3",
    "a_title": "Cross-node Psyche sync over P2P replaces gh-repo-sync",
    "a_doc": "",
    "b_id": "REQ-PICKER-RESUME-CONTEXT-PANEL",
    "b_title": "#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY the bottom panel to 'Resume from a prior session'",
    "b_doc": ""
  },
  {
    "idx": 22,
    "a_id": "REQ-HOST-RUN-1",
    "a_title": "spt-hosted harness bringup: `spt endpoint run` spawns an adapter's `[session.self]` command template into a broker-held PTY (the spawn-session seam, b",
    "a_doc": "",
    "b_id": "REQ-PICKER-START-PROJECT-CHOICE",
    "b_title": "#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' list: (1) the endpoint's most recent project dir, (2",
    "b_doc": ""
  },
  {
    "idx": 23,
    "a_id": "REQ-HAZARD-CONTROLLER-GAP-RESUME",
    "a_title": "A serving CONTROLLER whose serve-brain hits a b4 drop-don't-block FORWARD output gap must RESUME-FROM-FLOOR (re-subscribe from delivered_through and r",
    "a_doc": "",
    "b_id": "REQ-UPDATE-TRIAL-DRAIN-DRIVE",
    "b_title": "UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 \u00e2\u20ac\u201d regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller",
    "b_doc": "Self-update: **brain-trial promotion (readiness + drained)** \u00e2\u20ac\u201d the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signal"
  },
  {
    "idx": 24,
    "a_id": "REQ-INSTALL-2",
    "a_title": "Marketplace-repackaging-friendly install",
    "a_doc": "Installation: <!-- the two-paths model + the one-line script half (v0.1 phasing below; OS-service leg = docs/DEFERRED.md) --> <!-- the marketplace-repackaging stance: relocatable binary + minimal, non",
    "b_id": "REQ-UPD-3",
    "b_title": "No endpoint process terminates/suspends during self-update",
    "b_doc": ""
  },
  {
    "idx": 25,
    "a_id": "REQ-ENDPOINT-LIST-REST-FILTER",
    "a_title": "spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-first row ordering with fixed precedence ONLINE > C",
    "a_doc": "",
    "b_id": "REQ-PICKER-1",
    "b_title": "The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t",
    "b_doc": ""
  },
  {
    "idx": 26,
    "a_id": "REQ-HAZARD-CONPTY-DSR",
    "a_title": "ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-EBUSY-RENAME",
    "b_title": "tmp-write + atomic-rename + retry on Windows EBUSY (5.2)",
    "b_doc": ""
  },
  {
    "idx": 27,
    "a_id": "REQ-INSTALL-4",
    "a_title": "Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) + soft-deregister remove + optional manifest unins",
    "a_doc": "",
    "b_id": "REQ-INSTALL-BOOTSTRAP-VERB",
    "b_title": "THE-FORKENING W1 (ADR-0036 \u00c2\u00a73, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install v",
    "b_doc": "Installation: **Installer form (gh bootstrap, ADR-0036):** install gh \u00e2\u2020\u2019 `gh auth login` (org membership) \u00e2\u2020\u2019 `gh release download` the platform binary from the private channel \u00e2\u2020\u2019 one **self-install"
  },
  {
    "idx": 28,
    "a_id": "REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT",
    "a_title": "An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive",
    "a_doc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) \u00e2\u20ac\u201d teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: <!-- --> <!-- -->",
    "b_id": "REQ-MESH-2",
    "b_title": "Member roster: node-level union-merge grow-set (per member: pubkey, label, machine_id, last-known address, last-seen \u00e2\u20ac\u201d NOT the seed), the discovery ",
    "b_doc": ""
  },
  {
    "idx": 29,
    "a_id": "REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP",
    "a_title": "A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint \u00e2\u20ac\u201d no duplicate. On an abrupt brain death stop_host never runs (the LiveSe",
    "a_doc": "",
    "b_id": "REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN",
    "b_title": "C3 (F028, perri F-h): psyche wrapper crash-loop has no backoff, and `endpoint shutdown` misses a wedged wrapper. A probe psyche crash-looped ~3 boots/",
    "b_doc": ""
  },
  {
    "idx": 30,
    "a_id": "REQ-HAZARD-PSYCHE-OUTBOUND-PROXY",
    "a_title": "Psyche outbound captured + sanitized: the live-Psyche turn driver captures stdout (never Stdio::null), and the daemon strips/re-stamps Psyche-supplied",
    "a_doc": "",
    "b_id": "REQ-SEAM-PSYCHE",
    "b_title": "spawn-psyche seam (fresh + resume templates)",
    "b_doc": ""
  },
  {
    "idx": 31,
    "a_id": "REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE",
    "a_title": "MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft \u00e2\u20ac\u201d doyle ACCEPTED primary fix): the daemon MUST sanitize inherited pe",
    "a_doc": "7.38 EVERY write on a physical broker connection is bounded + cancelable + poison-on-failure \u00e2\u20ac\u201d no writer holds the send gate across an UNBOUNDED OS write `[REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UN",
    "b_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION",
    "b_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u00e2\u20ac\u201d a foreign psyche's SessionStart hook RE",
    "b_doc": ""
  },
  {
    "idx": 32,
    "a_id": "REQ-LIVE-AGENT-NO-INJECT-DELIVERY",
    "a_title": "F-033 RE-SCOPED (doyle re-ruling 2026-07-10 after the #82 gate falsified the original premise \u00e2\u20ac\u201d the hosting-mode class split is BINDING context): 's",
    "a_doc": "",
    "b_id": "REQ-MSG-CLI-ORIGIN",
    "b_title": "A bare non-perch CLI `spt send` (no owning perch to name as origin) stamps from = `cli@<node-label>` at compose time (bare `cli` when no node label is",
    "b_doc": ""
  },
  {
    "idx": 33,
    "a_id": "REQ-ARCH-2",
    "a_title": "Public SDK surface is spt-proto, spt-runtime, spt-msg",
    "a_doc": "",
    "b_id": "REQ-HAZARD-SELF-ELEVATE",
    "b_title": "Self-elevation (REQ-ELEVATE-1) re-runs the EXACT original invocation with the binary's ABSOLUTE exe path \u00e2\u20ac\u201d never widening privilege scope, never add",
    "b_doc": ""
  },
  {
    "idx": 34,
    "a_id": "REQ-ENDPOINT-CYCLE-HONEST",
    "a_title": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority \u00e2\u20ac\u201d the ALREADY_LIVE dup-guard",
    "a_doc": "Decision: <!-- --> 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u00e2\u20ac\u201d never from manifest capability alone. Legacy hybr",
    "b_id": "REQ-WHOAMI-IDENTITY-ONLY",
    "b_title": "PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-critical opener \u00e2\u20ac\u201d the 2026-07-15 message-bodies inc",
    "b_doc": "`spt whoami` \u00e2\u20ac\u201d the identity verb *(identity-only since v0.33.0)*: <!-- --> The bounded-time \"which endpoint am I?\" answer for hooks and adapter glue: resolves the calling session to its endpoint (`$"
  },
  {
    "idx": 35,
    "a_id": "REQ-HAZARD-REGISTRY-STALE-CLEAN",
    "a_title": "Stale registry entries degrade to fallback, never hard-fail (4.3)",
    "a_doc": "",
    "b_id": "REQ-PEERADDR-INVARIANT",
    "b_title": "MESH-RECOVERY W1 (ADR-0039, RCA wave 2): the peer-addrs cache INVARIANT \u00e2\u20ac\u201d outer peer key == address.id \u00e2\u20ac\u201d is ENFORCED on load and on write: invalid",
    "b_doc": "Context: ## Decision <!-- --> <!-- --> <!-- -->"
  },
  {
    "idx": 36,
    "a_id": "REQ-PICKER-3",
    "a_title": "A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoint_id overlaps a local (is_local) roster id is sel",
    "a_doc": "",
    "b_id": "REQ-WORKER-PICKER-EXCLUDED",
    "b_title": "V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows \u00e2\u20ac\u201d a worker perch cannot be d",
    "b_doc": ""
  },
  {
    "idx": 37,
    "a_id": "REQ-API-ENDPOINT-INFO",
    "a_title": "#7: spt api endpoint-info [<id>] (JSON) lets an endpoint learn its ATTACHED (controlling) node \u00e2\u20ac\u201d claude-spt surfaces local + attached node names on ",
    "a_doc": "",
    "b_id": "REQ-RESUME-CONTEXT-PULL",
    "b_title": "Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-SPT parity, operator-directed 2026-06-24). GAP: sp",
    "b_doc": "Manifest seams (outbound contract, detailed): **resume-session seam** \u00e2\u20ac\u201d two distinct forms: - **fresh-with-preload:** resume with *cleared* context (a fresh session) + psyche-download. Accepts a `$p"
  },
  {
    "idx": 38,
    "a_id": "REQ-HAZARD-WMI-DAEMON-WINDOW",
    "a_title": "`spt daemon start` launches the daemon with NO visible console window. REGRESSION (v0.12.1 L1.5): the WMI job-neutral launch (spawn_daemon_via_wmi) se",
    "a_doc": "",
    "b_id": "REQ-PICKER-1",
    "b_title": "The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t",
    "b_doc": ""
  },
  {
    "idx": 39,
    "a_id": "REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE",
    "a_title": "SEED (DEFERRED, doyle 2026-07-09 \u00e2\u20ac\u201d post-counter-54 root-hardening for UPDATE-WEDGE; mint now, impl a FUTURE milestone): on a PLANNED brain-restart (",
    "a_doc": "",
    "b_id": "REQ-HAZARD-RENDER-LIFECYCLE",
    "b_title": "RC-RENDER-TRUTH W3 (KNOWN-HAZARDS 7.47 \u00e2\u20ac\u201d umbrella conformance seam for ADR-0043): the physical terminal is never mutated or terminated outside its r",
    "b_doc": "7.46 An rc surface answers from live session authority, never a stale persisted projection \u00e2\u20ac\u201d and a resuming perch is UNBOUND, not offline `[REQ-HAZARD-RC-ATTACH-TRUTH]`: ### 7.47 The physical termin"
  },
  {
    "idx": 40,
    "a_id": "REQ-SEAM-PSYCHE",
    "a_title": "spawn-psyche seam (fresh + resume templates)",
    "a_doc": "",
    "b_id": "REQ-SESSION-ADAPTER-RECORDED",
    "b_title": "D-2 (REMOTE-TRUTH triage \u00c2\u00a7D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profile] a session ran under, so a later resume can re",
    "b_doc": ""
  },
  {
    "idx": 41,
    "a_id": "REQ-HAZARD-SINGLE-PATH-SOURCE",
    "a_title": "Single path/registry source of truth; no layout ambiguity (6.1)",
    "a_doc": "",
    "b_id": "REQ-WORKER-LIST-VISIBILITY",
    "b_title": "V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view \u00e2\u20ac\u201d they are process-local machinery, not subnet ",
    "b_doc": ""
  },
  {
    "idx": 42,
    "a_id": "REQ-MSG-IDLE-EDGE-DRAIN",
    "a_title": "On an endpoint's ACTIVE\u00e2\u2020\u2019IDLE transition the daemon DRAINS its pending spool (deferred AND non-deferred) through the same shared spt-hosted inject le",
    "a_doc": "",
    "b_id": "REQ-MSG-IDLE-TRANSLATION-BINARY",
    "b_title": "spt-hosted idle message delivery via an adapter TRANSLATION BINARY (ADR-0022). New opt-in manifest section `[message-idle-translation-binary]` = a TAB",
    "b_doc": "`[message-idle-translation-binary]` \u00e2\u20ac\u201d spt-hosted idle delivery: <!-- --> // `[inject]` \u00e2\u20ac\u201d inject-input methods: <!-- --> ### `[message-idle-translation-binary]` \u00e2\u20ac\u201d spt-hosted idle delivery (ADR-00"
  },
  {
    "idx": 43,
    "a_id": "REQ-BRAIN-RESUME-NO-CONTROL-STEAL",
    "a_title": "UPDATE-WEDGE round 2 (v0.30.4, doyle-ruled 2026-07-09 \u00e2\u20ac\u201d field incident on the counter-54 fetch--apply): a brain-respawn must NEVER steal, then stall",
    "a_doc": "Self-update: **resume re-attach is view-only for non-driven sessions** \u00e2\u20ac\u201d on respawn the new brain queries the broker for every hosted session and re-attaches to rebuild output-continuity cursors, bu",
    "b_id": "REQ-CI-WINDOWS-PHASE-A-BOUND",
    "b_title": "Phase-A nextest parallelism is BOUNDED on the Windows self-hosted leg, so the full-parallel 1881-test battery stops saturating a box that also hosts t",
    "b_doc": ""
  },
  {
    "idx": 44,
    "a_id": "REQ-ARCH-1",
    "a_title": "Many small acyclically-layered crates",
    "a_doc": "",
    "b_id": "REQ-ARCH-2",
    "b_title": "Public SDK surface is spt-proto, spt-runtime, spt-msg",
    "b_doc": ""
  },
  {
    "idx": 45,
    "a_id": "REQ-DIGEST-JSON-SELF-CONTAINED",
    "a_title": "TEARDOWN-AUTHORITY W4 (perri adapter-surface finding 2026-07-19, doyle-grounded and RE-SCOPED; title AMENDED at gate 2026-07-19 \u00e2\u20ac\u201d the original welde",
    "a_doc": "Session digest \u00e2\u20ac\u201d `endpoint digest --json`: <!-- the self-contained --json contract: top-level integer version cursor, stderr-clean under --json, the complete entry-kind enum with per-kind agent-prod",
    "b_id": "REQ-MSG-IDLE-EDGE-DRAIN",
    "b_title": "On an endpoint's ACTIVE\u00e2\u2020\u2019IDLE transition the daemon DRAINS its pending spool (deferred AND non-deferred) through the same shared spt-hosted inject le",
    "b_doc": ""
  },
  {
    "idx": 46,
    "a_id": "REQ-MESH-3",
    "a_title": "Mesh row fan-out: registry rows stay OWN-AUTHORED; the only change is the push target widens from directly-paired peers to ALL roster members (a wider",
    "a_doc": "",
    "b_id": "REQ-WAN-SEND-DELIVERY",
    "b_title": "Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Real root: spt send resolves the dial with id-only ad",
    "b_doc": ""
  },
  {
    "idx": 47,
    "a_id": "REQ-DAEMON-SERVICE-INSTALL",
    "a_title": "F-038 RIDER (flynn nice-to-have, QUEUED not activated): a documented OS-service registration recipe or `spt daemon install-service` verb so the daemon",
    "a_doc": "",
    "b_id": "REQ-HAZARD-DAEMON-HOSTED-LIVENESS",
    "b_title": "Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2",
    "b_doc": ""
  },
  {
    "idx": 48,
    "a_id": "REQ-INSTALL-10",
    "a_title": "Windows at-logon autostart runs the daemon in the background with no persistent window: the scheduled task launches `spt daemon start` (which spawn_de",
    "a_doc": "",
    "b_id": "REQ-INSTALL-4",
    "b_title": "Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) + soft-deregister remove + optional manifest unins",
    "b_doc": ""
  },
  {
    "idx": 49,
    "a_id": "REQ-NOTIF-UPDATE-ROW-VERSION-RETIRE",
    "a_title": "An update-available notif row minted by a node running PRE-0.40.0 spt is retired on the version the running node has ALREADY reached \u00e2\u20ac\u201d because the k",
    "a_doc": "",
    "b_id": "REQ-UPD-9",
    "b_title": "`gh_release` adapter [update] avenue (optional signing): an adapter declares `[update] avenue = \"gh_release\", repo = \"user/repo\"` (+ optional `asset`,",
    "b_doc": "Runtime model: **adapter update declaration** (manifest field): <!-- --> Each adapter manifest declares how spt-core should *ripple-update the adapter itself* (see Self-update). One of: **file-pull** "
  },
  {
    "idx": 50,
    "a_id": "REQ-RC-CROSS-NODE-ATTACH",
    "a_title": "Bug #4: spt rc to a remote endpoint fails with 'no live session' though endpoint list shows it Active \u00e2\u20ac\u201d rc.rs:1063 resolves only the LOCAL broker se",
    "a_doc": "Instances: <!-- --> **Remote-control vs local operation (two distinct modes \u00e2\u20ac\u201d not the same as instances):** - **Operate locally:** drive the native instance on *your* machine (its local files, its s",
    "b_id": "REQ-RESUME-CUSTODY-IDENTITY",
    "b_title": "Resume custody is an identity pair (pid + process creation time), never a bare PID. (ADR-0047 decision 1; hertz v0.39.4 field bug 1, RCA accepted 2026",
    "b_doc": "1. Process custody is an identity, never a bare PID: <!-- -->"
  },
  {
    "idx": 51,
    "a_id": "REQ-MSG-ENVELOPE",
    "a_title": "The <EVENT type=\"msg\" from=\u00e2\u20ac\u00a6>body</EVENT> envelope (spt-proto::event, the ADR-0001 grammar) is the SOLE canonical arriving-message format at EVERY h",
    "a_doc": "Decision: <!-- -->",
    "b_id": "REQ-WAN-SEND-DELIVERY",
    "b_title": "Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Real root: spt send resolves the dial with id-only ad",
    "b_doc": ""
  },
  {
    "idx": 52,
    "a_id": "REQ-ENDPOINT-STOP-RESOLVES",
    "a_title": "`spt endpoint stop <id>` REFUSES an id that nothing on the node knows, instead of stamping success on a no-op \u00e2\u20ac\u201d an unconditional-success verb is a l",
    "a_doc": "",
    "b_id": "REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH",
    "b_title": "C-1 hazard (F029; paid-for: B6 + three-version checkpoint-wake breakage): a REAL translation fault (binary death \u00e2\u20ac\u201d stdin write fail / stdout disconn",
    "b_doc": ""
  },
  {
    "idx": 53,
    "a_id": "REQ-HAZARD-ROLLBACK-STATE-COMPAT",
    "a_title": "A brain must not irreversibly migrate durable state before update ready-promotion: the readiness-gated auto-rollback (ADR-0018 Q7) spawns the N-1 bina",
    "a_doc": "6.7 Broker and brain MUST be separate processes (in-process collapse silently breaks no-endpoint-drop update) `[REQ-HAZARD-BROKER-PROCESS-ISOLATION]`: ### 6.8 No irreversible durable-state migration b",
    "b_id": "REQ-UPD-4",
    "b_title": "Update gated on user confirmation by default; opt-in full-auto",
    "b_doc": ""
  },
  {
    "idx": 54,
    "a_id": "REQ-HAZARD-PSYCHE-OUTBOUND-PROXY",
    "a_title": "Psyche outbound captured + sanitized: the live-Psyche turn driver captures stdout (never Stdio::null), and the daemon strips/re-stamps Psyche-supplied",
    "a_doc": "",
    "b_id": "REQ-PICKER-3",
    "b_title": "A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoint_id overlaps a local (is_local) roster id is sel",
    "b_doc": ""
  },
  {
    "idx": 55,
    "a_id": "REQ-RESUME-ROW-PER-PROJECT",
    "a_title": "A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project. data.rs:480-496 resume_rows_for clones project_hi",
    "a_doc": "",
    "b_id": "REQ-SESSION-ADAPTER-RECORDED",
    "b_title": "D-2 (REMOTE-TRUTH triage \u00c2\u00a7D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profile] a session ran under, so a later resume can re",
    "b_doc": ""
  },
  {
    "idx": 56,
    "a_id": "REQ-EFFECTIVE-INSTANCE-STATE",
    "a_title": "A-1 (REMOTE-TRUTH triage \u00c2\u00a7A + ADR-0033 \u00c2\u00a7Decision): the effective instance state of a perch is DERIVED through ONE shared function \u00e2\u20ac\u201d liveness discr",
    "a_doc": "7.31 The Psyche failure budget must count REAL per-event attempts \u00e2\u20ac\u201d a resident rate-guard is blind to per-event churn `[REQ-HAZARD-THRASH-GUARD-BLIND]`: ### 7.32 The effective resting state MUST be ",
    "b_id": "REQ-HAZARD-DEAD-REC-PID",
    "b_title": "E-1 rider (F-026 #11 dead-pid class, doyle-ruled SCOPED 2026-07-05 \u00e2\u20ac\u201d KNOWN-HAZARDS 7.34): a dead `rec.pid` on an spt-hosted perch is EXPECTED, not s",
    "b_doc": "7.33 NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch \u00e2\u20ac\u201d a poison permanently wedges every attach `[REQ-HAZARD-BROKER-FLOOR-LOCK-POISON]`: ### 7.34 A dead `rec.pid` "
  },
  {
    "idx": 57,
    "a_id": "REQ-CARRIER-CLAIM-EXCLUSIVE",
    "a_title": "MSG-IDENTITY W4 / F-033 + operator self-send probe 2026-07-09 (dup-delivery cluster, RCA-FIRST): a spooled message row is delivered by EXACTLY ONE car",
    "a_doc": "",
    "b_id": "REQ-DISPATCH-CLAIM-RETRY",
    "b_title": "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix C): dispatcher claims are RETRYABLE and outcomes are CLASSIFIED \u00e2\u20ac\u201d today claimed.insert(stream_id) happens P",
    "b_doc": ""
  },
  {
    "idx": 58,
    "a_id": "REQ-ENDPOINT-STOP-RESOLVES",
    "a_title": "`spt endpoint stop <id>` REFUSES an id that nothing on the node knows, instead of stamping success on a no-op \u00e2\u20ac\u201d an unconditional-success verb is a l",
    "a_doc": "",
    "b_id": "REQ-RELAY-NO-BUSY-DELIVER",
    "b_title": "MSG-IDENTITY W4 (operator self-send probe 2026-07-09, companion leg): the relay/idle-inject carrier MUST NOT fire for an ACTIVE endpoint \u00e2\u20ac\u201d the daemo",
    "b_doc": ""
  },
  {
    "idx": 59,
    "a_id": "REQ-CLI-BROKEN-PIPE-TOLERANT",
    "a_title": "#10 (F026 micro): `spt <anything> | <pager/Select-First-N>` must not PANIC when stdout closes early. A closed downstream reader mid-print panics with ",
    "a_doc": "",
    "b_id": "REQ-PRESENCE-LIVENESS-TRUTH",
    "b_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga",
    "b_doc": ""
  },
  {
    "idx": 60,
    "a_id": "REQ-CLI-2",
    "a_title": "spt daemon noun: run|stop|status (hidden daemon verb becomes daemon run; agent-endpoint shutdown keeps its name under endpoint); daemon status renders",
    "a_doc": "",
    "b_id": "REQ-DAEMON-STATUS-JSON-TRUTH",
    "b_title": "D2 (F028, perri F-d): `daemon status --json` truth drift. managed_by/managed_active read null in JSON while the HUMAN view says 'managed-by: manual \u00e2\u20ac",
    "b_doc": ""
  },
  {
    "idx": 61,
    "a_id": "REQ-INSTALL-12",
    "a_title": "Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.toml at the registry ROOT (sibling to the per-adap",
    "a_doc": "Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a p",
    "b_id": "REQ-RUN-ID-REUSES-ADAPTER",
    "b_title": "D-1 (REMOTE-TRUTH triage \u00c2\u00a7D-1): `spt endpoint run --id <id>` with NO --adapter, when <id> names an EXISTING perch, REUSES that perch's recorded info.",
    "b_doc": ""
  },
  {
    "idx": 62,
    "a_id": "REQ-DAEMON-9",
    "a_title": "Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed \u00e2\u20ac\u201d e.g. the systemd unit autostarted before the network/DNS sta",
    "a_doc": "",
    "b_id": "REQ-ENDPOINT-ONLINE-TRUTH",
    "b_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared \u00e2\u20ac\u201d cmd_listen stamps status=online only from actual pe",
    "b_doc": "Decision: <!-- --> 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u00e2\u20ac\u201d never from manifest capability alone. Legacy hybr"
  },
  {
    "idx": 63,
    "a_id": "REQ-CI-POSTJOB-DAEMON-REAP",
    "a_title": "A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job start AND job end so contamination and reap effec",
    "a_doc": "",
    "b_id": "REQ-DAEMON-REFRESH",
    "b_title": "THE-FORKENING W4 (operator add 2026-07-14): `spt daemon refresh` \u00e2\u20ac\u201d restart the daemon BRAIN without a binary swap and WITHOUT touching the broker: e",
    "b_doc": "Self-update: **daemon refresh (`spt daemon refresh`)** \u00e2\u20ac\u201d restart the **brain** in place, no binary swap, broker and every held PTY untouched: the routine-update handoff path minus the swap. The reco"
  },
  {
    "idx": 64,
    "a_id": "REQ-INSTALL-11",
    "a_title": "Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.spt`-shipped binary (dropped to adapters/_github/<s",
    "a_doc": "Manifest seams (outbound contract, detailed): - **Command templates are opaque.** spt-core never parses out a model/tool/flag \u00e2\u20ac\u201d the adapter writes the whole command line; spt-core fills substitution",
    "b_id": "REQ-MANIFEST-8",
    "b_title": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts agents inside (e.g. host_binaries = [\"claude\"]); bind",
    "b_doc": "Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a p"
  },
  {
    "idx": 65,
    "a_id": "REQ-EFFECTIVE-INSTANCE-STATE",
    "a_title": "A-1 (REMOTE-TRUTH triage \u00c2\u00a7A + ADR-0033 \u00c2\u00a7Decision): the effective instance state of a perch is DERIVED through ONE shared function \u00e2\u20ac\u201d liveness discr",
    "a_doc": "7.31 The Psyche failure budget must count REAL per-event attempts \u00e2\u20ac\u201d a resident rate-guard is blind to per-event churn `[REQ-HAZARD-THRASH-GUARD-BLIND]`: ### 7.32 The effective resting state MUST be ",
    "b_id": "REQ-RC-RESIZE-GEOMETRY-EPOCH",
    "b_title": "A resize transition is ATOMIC from ScreenGrid's perspective: every byte is parsed at the geometry it was EMITTED under. (hertz v0.39.0 field RCA 2026-",
    "b_doc": "Decision: <!-- the resize barrier + geometry epoch on the dispatch_resize / set_size_and_notify path: hold the grid parse across the ordered surface+grid transition, tag held output with the geometry "
  },
  {
    "idx": 66,
    "a_id": "REQ-PICKER-CURRENT-DIR-LABEL",
    "a_title": "A-2/A-3 (F029, operator, semantic pair): the Choose-project rows must self-identify the CURRENT DIR. build_project_choices (picker/model.rs:322-352). ",
    "a_doc": "",
    "b_id": "REQ-PICKER-START-PROJECT-CHOICE",
    "b_title": "#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' list: (1) the endpoint's most recent project dir, (2",
    "b_doc": ""
  },
  {
    "idx": 67,
    "a_id": "REQ-BRAIN-RESUME-NO-CONN-DEADLOCK",
    "a_title": "UPDATE-WEDGE round 3 (v0.30.5, doyle-ruled Option A 2026-07-09 \u00e2\u20ac\u201d the v0.30.4 field-verify re-wedge, root code-PROVEN + dead-peer-INDEPENDENT): the d",
    "a_doc": "Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the broker for **every** hosted session and re-attach **each** in resume mode from the broker's per-session delivered cursor (`re",
    "b_id": "REQ-PRES-1",
    "b_title": "Presence resolution: the presence datum (last_active_node, last_active_endpoint, ts) gossiped subnet-wide via the agent-interaction heartbeat (rides r",
    "b_doc": "Deferred Features: | Feature | Cut from | Why deferred | Trigger to revisit | |---|---|---|---| | Scrollback on-disk spillover | terminal wrapper v1 | In-memory ring covers the common case; spillover "
  },
  {
    "idx": 68,
    "a_id": "REQ-HAZARD-SUBPROCESS-TIMEOUT",
    "a_title": "Every harness/git subprocess has a timeout (5.3)",
    "a_doc": "",
    "b_id": "REQ-INSTALL-BOOTSTRAP-VERB",
    "b_title": "THE-FORKENING W1 (ADR-0036 \u00c2\u00a73, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install v",
    "b_doc": "Installation: **Installer form (gh bootstrap, ADR-0036):** install gh \u00e2\u2020\u2019 `gh auth login` (org membership) \u00e2\u2020\u2019 `gh release download` the platform binary from the private channel \u00e2\u2020\u2019 one **self-install"
  },
  {
    "idx": 69,
    "a_id": "REQ-ACTIVITY-LIST-JSON",
    "a_title": "`spt endpoint list --json` carries a per-endpoint `activity` (busy|idle) key, for consumers surveying the idle/busy state of many endpoints at once (A",
    "a_doc": "`--json` catalog: | Command | Top-level shape | |---|---| | `endpoint list` | `{ self, subnets[], local[] }` \u00e2\u20ac\u201d `self`: `{id, status, ready, alive, unbound, description, psyche_host_error, translatio",
    "b_id": "REQ-ENDPOINT-LIST-PALETTE",
    "b_title": "Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the same ResourceRow into the W5 colored EpDisplay pal",
    "b_doc": ""
  },
  {
    "idx": 70,
    "a_id": "REQ-PICKER-ONLINE-ACTION",
    "a_title": "The `spt endpoint run` picker shows the correct action for an ALREADY-ONLINE endpoint \u00e2\u20ac\u201d Attach, NOT 'Start now' (operator-raised v0.12.0 real-harnes",
    "a_doc": "",
    "b_id": "REQ-READY-AGENT-RESUME",
    "b_title": "An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly \u00e2\u20ac\u201d closing the gap that today only LiveAgents do",
    "b_doc": "**`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): <!-- --> The bringup core is **type-agnostic** \u00e2\u20ac\u201d the endpoint TYPE is the adapter manifest's concern, not a separa"
  },
  {
    "idx": 71,
    "a_id": "REQ-HAZARD-INBOX-NO-DOUBLE",
    "a_title": "No double-delivery via legacy inbox (4.5)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-RESTART-IDEMPOTENT",
    "b_title": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)",
    "b_doc": ""
  },
  {
    "idx": 72,
    "a_id": "REQ-RESUME-CONTEXT-PULL",
    "a_title": "Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-SPT parity, operator-directed 2026-06-24). GAP: sp",
    "a_doc": "Manifest seams (outbound contract, detailed): **resume-session seam** \u00e2\u20ac\u201d two distinct forms: - **fresh-with-preload:** resume with *cleared* context (a fresh session) + psyche-download. Accepts a `$p",
    "b_id": "REQ-SHELL-CLI-SPAWN-JOB-EXPOSURE",
    "b_title": "HARDENING SEED (inactive \u00e2\u20ac\u201d no defect claimed): a CLI-side `spt shell spawn` rises inside the launching terminal's Job Object when that job denies br",
    "b_doc": ""
  },
  {
    "idx": 73,
    "a_id": "REQ-HAZARD-DETACHED-PIPE-INHERIT",
    "a_title": "Windows detached long-lived children must not inherit a captured caller's pipe: every detach-spawn of an immortal child (daemon, shell binary) runs bI",
    "a_doc": "5.5 ConPTY withholds output until DSR is answered `[REQ-HAZARD-CONPTY-DSR]`: <!-- --> ### 5.6 Windows detached children inherit a captured caller's pipe `[REQ-HAZARD-DETACHED-PIPE-INHERIT]` - **Failur",
    "b_id": "REQ-RC-RECONNECT-TRUTH",
    "b_title": "W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-proven (the operator's long-standing 'stop 2-4 times'",
    "b_doc": ""
  },
  {
    "idx": 74,
    "a_id": "REQ-HAZARD-CONTROL-STAMP-LIFETIME",
    "a_title": "#2: a control/viewer stamp never outlives its session \u00e2\u20ac\u201d every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) se",
    "a_doc": "7.26 Concurrent first-touch of ONE fresh BranchStore must ALL succeed \u00e2\u20ac\u201d a non-atomic `git init` race must never strand a first-toucher `[REQ-HAZARD-STORE-INIT-RACE]`: <!-- --> ### 7.27 A control/vie",
    "b_id": "REQ-RC-HARNESS-ONLY-REFUSAL",
    "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc <id>` preflights the already-known harness_only/cont",
    "b_doc": "Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin"
  },
  {
    "idx": 75,
    "a_id": "REQ-CONV-2",
    "a_title": "Event-driven advertisement: endpoint online/offline transitions (ready-listener start/stop, rest-state transition, perch death) trigger an immediate a",
    "a_doc": "",
    "b_id": "REQ-INST-14",
    "b_title": "Resource advertisement (subnet resource registry): free-text blurb, both-authored, registry projection, visibility/whitelist-gated",
    "b_doc": "Pieces the Instances model requires: <!-- --> **resource advertisement (subnet resource registry)**: A per-endpoint **free-text blurb** describing the services/functions the endpoint can serve \u00e2\u20ac\u201d an "
  },
  {
    "idx": 76,
    "a_id": "REQ-RESUME-ROW-PER-PROJECT",
    "a_title": "A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project. data.rs:480-496 resume_rows_for clones project_hi",
    "a_doc": "",
    "b_id": "REQ-SESSION-RESUME-TEMPLATE",
    "b_title": "Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT \u00e2\u20ac\u201d case-3 spt-core MISSING",
    "b_doc": "`[session.<role>]` \u00e2\u20ac\u201d outbound templates: <!-- --> **Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh* bringup; `[session.resume]` is the **native-resume** sibli"
  },
  {
    "idx": 77,
    "a_id": "REQ-HAZARD-ATTACH-WEDGE",
    "a_title": "A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the broker for all other clients. ROOT (v0.12.0 real-harne",
    "a_doc": "",
    "b_id": "REQ-RCVIEW-1",
    "b_title": "Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; ",
    "b_doc": "Shell sleep/wake (offline \u00e2\u2020\u201d online): <!-- --> **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`"
  },
  {
    "idx": 78,
    "a_id": "REQ-SEND-SPT-HOSTED",
    "a_title": "An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` \u00e2\u2020\u2019 `api bind`, broker holds its PTY, NO `api listen` ",
    "a_doc": "",
    "b_id": "REQ-STREAM-LEASE-CLASSES",
    "b_title": "REGISTRY-LIFECYCLE W2 (ADR-0040 decision 6 + ADR-0041, emphasys C2 P0): streams declare a lifetime class at open \u00e2\u20ac\u201d RC attach/view streams are Connec",
    "b_doc": "Decision: <!-- --> 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream"
  },
  {
    "idx": 79,
    "a_id": "REQ-MSG-SELF-DETECT-ANCESTRY",
    "a_title": "#9 (F026, operator field bug): a perch-owned `spt send` from an endpoint's OWN session must self-identify, not mis-stamp `cli@<node>` (whose replies b",
    "a_doc": "",
    "b_id": "REQ-SELF-ID-TRUST-INJECTED-ENV",
    "b_title": "DEFERRED to a followup vX.X.n sprint (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07): self-identity resolution must trust the harness-injected autho",
    "b_doc": ""
  },
  {
    "idx": 80,
    "a_id": "REQ-REDISPATCH-FINISHED-RETIRE",
    "a_title": "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix A): finished/terminal stream rows are RETIRED from redispatch eligibility \u00e2\u20ac\u201d NetShared.streams today has NO ",
    "a_doc": "Context: ## Decision <!-- -->",
    "b_id": "REQ-STREAM-INFOS-SERVER-FILTER",
    "b_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 2, hertz defect B leg 2): broker stream_infos excludes initiated_locally rows SERVER-SIDE (retired already ex",
    "b_doc": ""
  },
  {
    "idx": 81,
    "a_id": "REQ-CONN-POISON-DIAL-SCOPE",
    "a_title": "MSG-IDENTITY W6 / F-039 (deployah field-acceptance follow-up 2026-07-10, RCA-FIRST \u00e2\u20ac\u201d mint per the v0.30.6 PASS handoff): ambient CONN_WRITE_POISONED",
    "a_doc": "",
    "b_id": "REQ-PICKER-KEY-GATE-LAUNCH-CAPABLE",
    "b_title": "B-1 (F029, operator): the `h` (headless start) / `s` (shortcut) keybinds fire from broad picker contexts (mod.rs handle_confirm_key / ChooseProject / ",
    "b_doc": ""
  },
  {
    "idx": 82,
    "a_id": "REQ-HAZARD-PAIR-SEED-ROTATION",
    "a_title": "Removing a node rotates the subnet seed (epoch bump) so an old node/old seed cannot rejoin; trust-store delete alone is NOT revocation because the see",
    "a_doc": "",
    "b_id": "REQ-LISTEN-SEED-CONSUME-AFTER-BIND",
    "b_title": "F-034 leg b (perri/hertz field finding 2026-07-09, hertz's HEADLINE): `api listen` must NOT consume the consume-once ephemeral seed on a PRE-BIND refu",
    "b_doc": "`api listen <id> [--once] [--parent-pid <pid>] [--subnet <name>] [--session-id <sid>]`: <!-- --> **Recoverable refusals do not consume the seed.** The seed is consumed by a **successful bind** \u00e2\u20ac\u201d or "
  },
  {
    "idx": 83,
    "a_id": "REQ-DIGEST-GENERATION-SUPERSEDE",
    "a_title": "W3 (LIFECYCLE-TRUTH, digest projection truth \u00e2\u20ac\u201d flynn filing spt-mobile d0aa3f4): a one-shot `endpoint digest --json` snapshot must return each logic",
    "a_doc": "",
    "b_id": "REQ-SESSION-RESUME-TEMPLATE",
    "b_title": "Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT \u00e2\u20ac\u201d case-3 spt-core MISSING",
    "b_doc": "`[session.<role>]` \u00e2\u20ac\u201d outbound templates: <!-- --> **Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh* bringup; `[session.resume]` is the **native-resume** sibli"
  },
  {
    "idx": 84,
    "a_id": "REQ-HAZARD-PTY-INPUT-WRITER-WEDGE",
    "a_title": "Pasting into an `spt rc` session WEDGES the broker \u00e2\u20ac\u201d after a paste the operator can no longer type AND can no longer attach to NEW or EXISTING sessi",
    "a_doc": "",
    "b_id": "REQ-RC-1",
    "b_title": "`spt rc <id>` \u00e2\u20ac\u201d user CLI attaching a local terminal to a broker-held PTY, reusing the cross-node attach machinery (attach.rs request_attach \u00e2\u2020\u2019 send",
    "b_doc": ""
  },
  {
    "idx": 85,
    "a_id": "REQ-MSG-IDLE-TRANSLATION-BINARY",
    "a_title": "spt-hosted idle message delivery via an adapter TRANSLATION BINARY (ADR-0022). New opt-in manifest section `[message-idle-translation-binary]` = a TAB",
    "a_doc": "`[message-idle-translation-binary]` \u00e2\u20ac\u201d spt-hosted idle delivery: <!-- --> // `[inject]` \u00e2\u20ac\u201d inject-input methods: <!-- --> ### `[message-idle-translation-binary]` \u00e2\u20ac\u201d spt-hosted idle delivery (ADR-00",
    "b_id": "REQ-SHELL-2",
    "b_title": "Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout), ephemeral teardown vs persistent offline/relink, ",
    "b_doc": ""
  },
  {
    "idx": 86,
    "a_id": "REQ-HAZARD-ENDPOINT-LIFECYCLE",
    "a_title": "REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 \u00e2\u20ac\u201d the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY deat",
    "a_doc": "7.44 Streams and seats on a long-lived connection must have bounded lifetime \u00e2\u20ac\u201d one-way rows terminal at FIN, seats released at serve completion, no per-chunk full-state rewrites in a drain loop `[RE",
    "b_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION",
    "b_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u00e2\u20ac\u201d a foreign psyche's SessionStart hook RE",
    "b_doc": ""
  },
  {
    "idx": 87,
    "a_id": "REQ-HAZARD-CONTROLLER-GAP-RESUME",
    "a_title": "A serving CONTROLLER whose serve-brain hits a b4 drop-don't-block FORWARD output gap must RESUME-FROM-FLOOR (re-subscribe from delivered_through and r",
    "a_doc": "",
    "b_id": "REQ-HAZARD-CONTROLLER-LEASE",
    "b_title": "RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 \u00e2\u20ac\u201d umbrella conformance seam for ADR-0044): at most one input-capable controller lease per PTY session; takeov",
    "b_doc": "7.47 The physical terminal is never mutated or terminated outside its renderer's ordered state model \u00e2\u20ac\u201d output before exit, owned baselines, unconditional teardown `[REQ-HAZARD-RENDER-LIFECYCLE]`: ##"
  },
  {
    "idx": 88,
    "a_id": "REQ-HAZARD-STALE-INDEX-LOCK",
    "a_title": "Sweep stale lockfiles on daemon boot (1.3)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-REGISTRY-STALE-CLEAN",
    "b_title": "Stale registry entries degrade to fallback, never hard-fail (4.3)",
    "b_doc": ""
  },
  {
    "idx": 89,
    "a_id": "REQ-ENDPOINT-LIST-PALETTE",
    "a_title": "Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the same ResourceRow into the W5 colored EpDisplay pal",
    "a_doc": "",
    "b_id": "REQ-WORKER-LIST-VISIBILITY",
    "b_title": "V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view \u00e2\u20ac\u201d they are process-local machinery, not subnet ",
    "b_doc": ""
  },
  {
    "idx": 90,
    "a_id": "REQ-LIVENESS-ORACLE-SOUND",
    "a_title": "TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer ",
    "a_doc": "7.50 The liveness oracle answers from the process table, never from a handle a caller still holds `[REQ-LIVENESS-ORACLE-SOUND]`: <!-- --> - **Failure (paid-for, found by todlando during TEARDOWN-AUTHO",
    "b_id": "REQ-PAIR-3",
    "b_title": "Fetch current pairing code from any paired node",
    "b_doc": ""
  },
  {
    "idx": 91,
    "a_id": "REQ-EP-1",
    "a_title": "Day-one endpoint types; open type system",
    "a_doc": "",
    "b_id": "REQ-EP-2",
    "b_title": "Agent endpoints vs Shells distinction in the type model",
    "b_doc": ""
  },
  {
    "idx": 92,
    "a_id": "REQ-PICKER-1",
    "a_title": "The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t",
    "a_doc": "",
    "b_id": "REQ-PICKER-2",
    "b_title": "The picker's project-history loader reads the git-backed context store, not the bare working tree: data.rs project_history_for enumerates an endpoint'",
    "b_doc": ""
  },
  {
    "idx": 93,
    "a_id": "REQ-CLI-4",
    "a_title": "User-facing CLI output is human-readable: DIRECT-USER commands (e.g. adapter update/list/use) render friendly prose instead of raw CODE:RESULT markers",
    "a_doc": "",
    "b_id": "REQ-HAZARD-PAIR-RATE-LIMIT",
    "b_title": "Subnet-global pairing rate limit: one active ceremony per subnet, shared attempt counter, exponential backoff \u00e2\u20ac\u201d a public pre-trust relay + multiple ",
    "b_doc": ""
  },
  {
    "idx": 94,
    "a_id": "REQ-ECHO-DROP-DIR-RESOLVE",
    "a_title": "W1 (LIFECYCLE-TRUTH): fire_echo resolves the manifest commune_dir through the SAME resolver its siblings use before any write. ROOT (pinned): fire_ech",
    "a_doc": "",
    "b_id": "REQ-PICKER-PROJECT-HISTORY-TRUTH",
    "b_title": "#1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_for_dir) UNION context-store branches, EXCLUDING o",
    "b_doc": ""
  },
  {
    "idx": 95,
    "a_id": "REQ-BRAIN-RESUME-NO-CONTROL-STEAL",
    "a_title": "UPDATE-WEDGE round 2 (v0.30.4, doyle-ruled 2026-07-09 \u00e2\u20ac\u201d field incident on the counter-54 fetch--apply): a brain-respawn must NEVER steal, then stall",
    "a_doc": "Self-update: **resume re-attach is view-only for non-driven sessions** \u00e2\u20ac\u201d on respawn the new brain queries the broker for every hosted session and re-attaches to rebuild output-continuity cursors, bu",
    "b_id": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION",
    "b_title": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04): a psyche failure of ANY shape must NOT remove or ",
    "b_doc": "7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]`: ### 7.30 A Psyche failure of ANY shape must NEVER remove or alter t"
  },
  {
    "idx": 96,
    "a_id": "REQ-ADAPTER-FLOOR-ENFORCE",
    "a_title": "F-5 (REMOTE-TRUTH triage \u00c2\u00a7F-5 + doyle rulings 2026-07-05): BOTH adapter acquisition verbs (spt adapter add + spt adapter update) REFUSE when the inst",
    "a_doc": "`[adapter]` \u00e2\u20ac\u201d header: <!-- --> `min_spt_core_version` is the **enforced** compatibility floor. Both acquisition verbs \u00e2\u20ac\u201d `spt adapter add` and `spt adapter update` \u00e2\u20ac\u201d REFUSE when the installed spt",
    "b_id": "REQ-INSTALL-13",
    "b_title": "Adapter add is non-destructive & idempotent-safe (F-018): `spt adapter add --github|--release` REFUSES when the target `_github/<safe>` home already b",
    "b_doc": "Installation: **adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter \u00e2\u20ac\u201d harness or shell. An explicit **`spt adapter add <path>`** (or **`--github <user/repo>`**) validat"
  },
  {
    "idx": 97,
    "a_id": "REQ-UPD-8",
    "a_title": "Platform-safe `spt update fetch` + apply platform-guard (v0.3.1 cross-OS brick fix): `spt update fetch` stages the signed multi-platform `SignedUpdate",
    "a_doc": "",
    "b_id": "REQ-UPDATE-FETCH-APPLY-FLAG",
    "b_title": "`spt update fetch --apply` is the one-shot get-to-latest: fetch, then INSTALL the staged update REGARDLESS of whether the fetch itself staged anything",
    "b_doc": ""
  },
  {
    "idx": 98,
    "a_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION",
    "a_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u00e2\u20ac\u201d a foreign psyche's SessionStart hook RE",
    "a_doc": "",
    "b_id": "REQ-TERM-6",
    "b_title": "Thread-spanning digest across session boundaries: a per-endpoint session ledger (`<perch>/sessions.log`) appended at first bind and by `api boundary` ",
    "b_doc": ""
  },
  {
    "idx": 99,
    "a_id": "REQ-HAZARD-CONTROL-STAMP-LIFETIME",
    "a_title": "#2: a control/viewer stamp never outlives its session \u00e2\u20ac\u201d every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) se",
    "a_doc": "7.26 Concurrent first-touch of ONE fresh BranchStore must ALL succeed \u00e2\u20ac\u201d a non-atomic `git init` race must never strand a first-toucher `[REQ-HAZARD-STORE-INIT-RACE]`: <!-- --> ### 7.27 A control/vie",
    "b_id": "REQ-SERVE-OWNERSHIP-GENERATION",
    "b_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/generation validation on attach/detach \u00e2\u20ac\u201d a stale ",
    "b_doc": "Consequences: ## Amendment \u00e2\u20ac\u201d REDISPATCH-STALL (2026-07-16) <!-- --> <!-- --> <!-- --> <!-- -->"
  },
  {
    "idx": 100,
    "a_id": "REQ-ENDPOINT-ONLINE-TRUTH",
    "a_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared \u00e2\u20ac\u201d cmd_listen stamps status=online only from actual pe",
    "a_doc": "Decision: <!-- --> 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u00e2\u20ac\u201d never from manifest capability alone. Legacy hybr",
    "b_id": "REQ-SCREENGRID-REPAINT-MODE-REPLAY",
    "b_title": "RC-RENDER-TRUTH W3 (ADR-0043 decision 4, hertz stale-glyphs RCA leg 4 P1): ScreenGrid cold repaint replays EVERY tracked render-affecting mode \u00e2\u20ac\u201d DEC",
    "b_doc": "Decisions: <!-- --> 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (d"
  },
  {
    "idx": 101,
    "a_id": "REQ-RC-IDENTITY",
    "a_title": "`spt rc` overlays a persistent endpoint-identity marker so the operator always groks which endpoint they control: a reserved TOP status row via a DECS",
    "a_doc": "",
    "b_id": "REQ-RC-MOUSE-FORWARD",
    "b_title": "On Windows, `spt rc` must FORWARD scroll-wheel events to the harness when the harness has mouse reporting on. ROOT (operator HITL): P1's RawGuard Enab",
    "b_doc": "7.19 An operator input FLOOD must not deadlock the broker via the applied-ack on the same conn `[REQ-HAZARD-INPUT-ACK-BACKPRESSURE]`: <!-- --> ### 7.20 `spt rc` must forward the scroll wheel to the ha"
  },
  {
    "idx": 102,
    "a_id": "REQ-CONTROLLER-LEASE-IDENTITY",
    "a_title": "RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-131",
    "a_doc": "Decisions: <!-- --> 1. **Distinct viewport/lease identity.** Each rc invocation/attach stream mints a unique controller lease id, carried through SubscribeReq, the controller slot, and Input/Resize. N",
    "b_id": "REQ-HAZARD-CONTROLLER-WRITER-REORDER",
    "b_title": "Two `controller_writer` threads must never race ONE brain\u00e2\u2020\u201dbroker connection's socket. ROOT (doyle, instrumented RACEDIAG repro on kitsubito): on a b",
    "b_doc": "7.20 `spt rc` must forward the scroll wheel to the harness (our mouse capture steals WT's native scroll) `[REQ-RC-MOUSE-FORWARD]`: <!-- --> ### 7.21 Exactly ONE `controller_writer` per brain\u00e2\u2020\u201dbroker "
  },
  {
    "idx": 103,
    "a_id": "REQ-FRONT-1",
    "a_title": "Day-one launcher/manager frontend (list/launch/attach/init)",
    "a_doc": "",
    "b_id": "REQ-PICKER-CONTROL-LINE-STATUS-GATE",
    "b_title": "A2 (F028, operator #2): the picker confirm-panel 'controlled locally' line renders for OFFLINE endpoints. view.rs:425-436 builds control_line from ep.",
    "b_doc": ""
  },
  {
    "idx": 104,
    "a_id": "REQ-CONN-POISON-ATTRIBUTION",
    "a_title": "MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-conn lifecycle record is ATTRIBUTABLE \u00e2\u20ac\u201d the W6 RCA",
    "a_doc": "",
    "b_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION",
    "b_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u00e2\u20ac\u201d a foreign psyche's SessionStart hook RE",
    "b_doc": ""
  },
  {
    "idx": 105,
    "a_id": "REQ-HAZARD-CONTROLLER-WRITER-REORDER",
    "a_title": "Two `controller_writer` threads must never race ONE brain\u00e2\u2020\u201dbroker connection's socket. ROOT (doyle, instrumented RACEDIAG repro on kitsubito): on a b",
    "a_doc": "7.20 `spt rc` must forward the scroll wheel to the harness (our mouse capture steals WT's native scroll) `[REQ-RC-MOUSE-FORWARD]`: <!-- --> ### 7.21 Exactly ONE `controller_writer` per brain\u00e2\u2020\u201dbroker ",
    "b_id": "REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK",
    "b_title": "UPDATE-WEDGE round-4 (hertz RCA, root reproduced + source-pinned on Windows 2026-07-09): EVERY write on a physical broker connection rides ONE bounded",
    "b_doc": "7.37 The Layer-1 settle-gate must RE-ARM per delivery on an observable PTY \u00e2\u20ac\u201d a mid-session reader reattach (`/clear`) re-creates the head-swallow race `[REQ-HAZARD-INJECT-SETTLE-REARM]`: ### 7.38 EV"
  },
  {
    "idx": 106,
    "a_id": "REQ-CONV-1",
    "a_title": "Peer address seeding, both cold starts: durable peer-addrs.json (identity dir) maps peer pubkey \u00e2\u2020\u2019 last-known dialable address; the pump's resolver c",
    "a_doc": "",
    "b_id": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE",
    "b_title": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed record is neither alive nor Active (counter-39 #2",
    "b_doc": "5.13 Atomic write leaves data un-synced before the rename \u00e2\u2020\u2019 NUL zero-fill on power loss `[REQ-HAZARD-PERCH-RECORD-POWER-LOSS]`: <!-- --> ### 5.14 Corrupt info.json read as ABSENT \u00e2\u2020\u2019 fail-open reade"
  },
  {
    "idx": 107,
    "a_id": "REQ-RESUME-REAP-PRIOR-HARNESS",
    "a_title": "B4 (F028, hall-b diagnosis, verified 0.22.0): `--resume` respawns a SECOND harness onto the SAME session without reaping the first. Observed live: res",
    "a_doc": "",
    "b_id": "REQ-SESSION-RESUME-TEMPLATE",
    "b_title": "Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT \u00e2\u20ac\u201d case-3 spt-core MISSING",
    "b_doc": "`[session.<role>]` \u00e2\u20ac\u201d outbound templates: <!-- --> **Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh* bringup; `[session.resume]` is the **native-resume** sibli"
  },
  {
    "idx": 108,
    "a_id": "REQ-HAZARD-ENDPOINT-LIFECYCLE",
    "a_title": "REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 \u00e2\u20ac\u201d the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY deat",
    "a_doc": "7.44 Streams and seats on a long-lived connection must have bounded lifetime \u00e2\u20ac\u201d one-way rows terminal at FIN, seats released at serve completion, no per-chunk full-state rewrites in a drain loop `[RE",
    "b_id": "REQ-RESUME-ADAPTER-FOLLOWS-SESSION",
    "b_title": "D-2 (REMOTE-TRUTH triage \u00c2\u00a7D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) \u00e2\u20ac\u201d",
    "b_doc": ""
  },
  {
    "idx": 109,
    "a_id": "REQ-ENDPOINT-LIST-RENDER-POLISH",
    "a_title": "A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT dim \u00e2\u20ac\u201d LIGHT_GRAY = \"37\" (cli.rs:3019) is standa",
    "a_doc": "",
    "b_id": "REQ-ENDPOINT-MESSAGE-ONLY-DISPLAY",
    "b_title": "An online agent-family endpoint with NO session surface reads as message-reachable, not as a harness-hosted live agent and not as a plain ONLINE. (her",
    "b_doc": ""
  },
  {
    "idx": 110,
    "a_id": "REQ-HAZARD-INJECT-CONTROL-COEXIST",
    "a_title": "SPINE INVARIANT (v0.13.0 keystone): the broker must accept INJECTED keystrokes into an spt-hosted PTY (the v0.11.0 raw direct-inject today; the ADR-00",
    "a_doc": "",
    "b_id": "REQ-RC-HARNESS-ONLY-REFUSAL",
    "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc <id>` preflights the already-known harness_only/cont",
    "b_doc": "Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin"
  },
  {
    "idx": 111,
    "a_id": "REQ-RESUME-ROW-PER-PROJECT",
    "a_title": "A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project. data.rs:480-496 resume_rows_for clones project_hi",
    "a_doc": "",
    "b_id": "REQ-RUN-PICKER",
    "b_title": "Interactive `spt endpoint run` picker (ratatui TUI): bare `spt endpoint run` (no --adapter/--id) enters an in-process picker (flags-present = the REQ-",
    "b_doc": "Shell sleep/wake (offline \u00e2\u2020\u201d online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): <!-- --> The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--a"
  },
  {
    "idx": 112,
    "a_id": "REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE",
    "a_title": "A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COEXIST) moved the controller SOCKET WRITE off the dr",
    "a_doc": "",
    "b_id": "REQ-RC-HARNESS-ONLY-REFUSAL",
    "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc <id>` preflights the already-known harness_only/cont",
    "b_doc": "Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin"
  },
  {
    "idx": 113,
    "a_id": "REQ-HAZARD-RESUME-CUSTODY-ABA",
    "a_title": "KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID \u00e2\u20ac\u201d a recycled pid must read NOT OURS. The hazard-conformance twin of REQ-RESUME-",
    "a_doc": "7.51 Process custody is an identity, never a bare PID \u00e2\u20ac\u201d a recycled pid must read NOT OURS `[REQ-HAZARD-RESUME-CUSTODY-ABA]`: <!-- --> - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle",
    "b_id": "REQ-SEND-STAMP-AGENT-ID",
    "b_title": "MSG-IDENTITY W4 / endpoint-identity (operator-flagged 2026-07-09 + live-confirmed on flynn's F-038 ask arriving 'cli@HFENDULEAM'): a live agent's own ",
    "b_doc": ""
  },
  {
    "idx": 114,
    "a_id": "REQ-LIVEHOST-RECONCILE-TRIAL-SILENT",
    "a_title": "SEED (DEFERRED investigation, doyle 2026-07-09 \u00e2\u20ac\u201d UPDATE-WEDGE follow-up): determine WHY the trial/rollback brain's livehost reconcile loop did NOT d",
    "a_doc": "",
    "b_id": "REQ-PROJECT-INDEX-WRITER",
    "b_title": "PROJECT-INDEX W2 (ADR-0037): the daemon is the SOLE single-flight project-index writer: load persisted index at startup; ready WITHOUT warm (cold star",
    "b_doc": "Self-update: **index writer duty (daemon)** \u00e2\u20ac\u201d the brain hosts ONE writer thread (`projwriter`, spawned beside the live host; single-flight by construction). Batched complexity is contract, `O(P+B+F+"
  },
  {
    "idx": 115,
    "a_id": "REQ-CONTROLLER-LIVENESS-REAP",
    "a_title": "B-2 (REMOTE-TRUTH triage \u00c2\u00a7B-2, REDUCED @bdc1242): a stale ONLINE+CONTROLLED stamp on a live-session perch self-heals \u00e2\u20ac\u201d the info.json driven_by/cont",
    "a_doc": "",
    "b_id": "REQ-SOFT-END-PRESERVES-LIVE-LISTENER",
    "b_title": "F-2 (REMOTE-TRUTH triage \u00c2\u00a7F-2, field-repro'd hall-bf 2026-07-04): a /clear must not sever a SURVIVING poll listener's relay address \u00e2\u20ac\u201d post-clear ow",
    "b_doc": ""
  },
  {
    "idx": 116,
    "a_id": "REQ-ONEWAY-STREAM-TERMINAL",
    "a_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 1, hertz defect B leg 1): a one-way fire-and-forget stream family is TERMINAL at successful FIN, sender-side ",
    "a_doc": "Decision: <!-- --> 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream",
    "b_id": "REQ-STREAM-LEASE-CLASSES",
    "b_title": "REGISTRY-LIFECYCLE W2 (ADR-0040 decision 6 + ADR-0041, emphasys C2 P0): streams declare a lifetime class at open \u00e2\u20ac\u201d RC attach/view streams are Connec",
    "b_doc": "Decision: <!-- --> 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream"
  },
  {
    "idx": 117,
    "a_id": "REQ-INST-13",
    "a_title": "Subnet-exclusive sync + per-endpoint subnet-membership list",
    "a_doc": "",
    "b_id": "REQ-INST-4",
    "b_title": "active to dormant/suspended fires a transition echo commune",
    "b_doc": ""
  },
  {
    "idx": 118,
    "a_id": "REQ-PICKER-PURGE-STRUCTURED",
    "a_title": "RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from inside an active TUI return STRUCTURED outcomes and",
    "a_doc": "Decisions: <!-- --> 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (d",
    "b_id": "REQ-PICKER-RESUME-CONTEXT-PANEL",
    "b_title": "#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY the bottom panel to 'Resume from a prior session'",
    "b_doc": ""
  },
  {
    "idx": 119,
    "a_id": "REQ-HAZARD-BRAIN-RESPAWN-PATH",
    "a_title": "The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE",
    "a_doc": "6.10 Phase-significant loop timing must be a durable absolute-deadline grid, not phase-relative sleep `[REQ-HAZARD-BROKER-PROCESS-ISOLATION]`: ### 6.11 Brain respawn must exec the APPLIED bytes, not t",
    "b_id": "REQ-HAZARD-HANDOFF-ARGV-COMPAT",
    "b_title": "Broker/brain IPC + handoff argv version-tolerant (2.3)",
    "b_doc": ""
  },
  {
    "idx": 120,
    "a_id": "REQ-HAZARD-DRIVEN-BY-SELFHEAL",
    "a_title": "An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC is lost \u00e2\u20ac\u201d do NOT rely on the detach signal (same ",
    "a_doc": "",
    "b_id": "REQ-WAKE-RESUME-LEG",
    "b_title": "A-2 (REMOTE-TRUTH triage \u00c2\u00a7A-2 + ADR-0033): the daemon reconcile gains a WAKE-RESUME LEG \u00e2\u20ac\u201d an endpoint whose rest INTENT is Active but whose harness",
    "b_doc": ""
  },
  {
    "idx": 121,
    "a_id": "REQ-HAZARD-CASCADE-WIPE-GUARD",
    "a_title": "No hard-delete of a parent hosting non-empty children (6.3)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-SINGLE-PATH-SOURCE",
    "b_title": "Single path/registry source of truth; no layout ambiguity (6.1)",
    "b_doc": ""
  },
  {
    "idx": 122,
    "a_id": "REQ-HAZARD-DELIVERY-STARVATION",
    "a_title": "A message that has REACHED a node's spool (WAN-arrived or locally spooled-while-active) is NEVER dependent on an adapter HOOK-POLL cadence for its eve",
    "a_doc": "7.22 An idle delivery with no working translation binary must SPOOL, never raw-inject a pseudo-delivery reported as delivered `[REQ-HAZARD-IDLE-SILENT-NONDELIVERY]`: ### 7.23 A message that has REACHE",
    "b_id": "REQ-MSG-IDLE-EDGE-DRAIN",
    "b_title": "On an endpoint's ACTIVE\u00e2\u2020\u2019IDLE transition the daemon DRAINS its pending spool (deferred AND non-deferred) through the same shared spt-hosted inject le",
    "b_doc": ""
  },
  {
    "idx": 123,
    "a_id": "REQ-MSG-DELIVERY-AXES",
    "a_title": "Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S",
    "a_doc": "Activity-gated message delivery + send-modifier axes: <!-- -->",
    "b_id": "REQ-PUMP-DIAL-FASTFAIL",
    "b_title": "PUMP-TRUTH W1 (RE-SCOPED post round-2 empirical lock \u00e2\u20ac\u201d the DIAL is EXONERATED, healthy ~100ms): a pump worker-leg PEER-REPLY read to a connect-then-",
    "b_doc": ""
  },
  {
    "idx": 124,
    "a_id": "REQ-PAIR-5",
    "a_title": "Multi-subnet pairing: subnet-name discovery input, create-new-names-up-front, rendezvous-token hashing",
    "a_doc": "",
    "b_id": "REQ-SUBNET-5",
    "b_title": "Per-subnet serve-state: spt subnet detach <NAME> [--save] / attach <NAME> [--save] \u00e2\u20ac\u201d daemon keeps running, stops/starts advertising + connecting for",
    "b_doc": ""
  },
  {
    "idx": 125,
    "a_id": "REQ-DIGEST-SEAL-ON-IDLE",
    "a_title": "A digest turn's records gain their stable `seq` at the endpoint's IDLE TRANSITION \u00e2\u20ac\u201d the adapter-reported, already-authoritative turn-finished signal",
    "a_doc": "<!-- --> **A turn closes when the endpoint goes idle \u00e2\u20ac\u201d not when the next input arrives.** The moment the endpoint reports it stopped working, the trailing turn is finished: `partial` drops away and ",
    "b_id": "REQ-HAZARD-LIVEHOST-BOOT-RACE",
    "b_title": "The brain's daemon-hosted Psyche lifecycle surfaces a host-FAILURE on the live perch (harness-diagnosable) and runs net-INDEPENDENTLY. When reconcile_",
    "b_doc": ""
  },
  {
    "idx": 126,
    "a_id": "REQ-MSG-INJECT-LEG-DROP-VISIBLE",
    "a_title": "SEED (inactive \u00e2\u20ac\u201d observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an honestly-offline endpoint on a status surface. The ",
    "a_doc": "",
    "b_id": "REQ-PAIR-NTP-LOUD-FAIL",
    "b_title": "W1/D2 (JOIN-TRUTH): total NTP failure (no server on any family answered) is LOUD, not silent \u00e2\u20ac\u201d a node running the ceremony on its raw skewed system ",
    "b_doc": ""
  },
  {
    "idx": 127,
    "a_id": "REQ-HAZARD-ENVELOPE-DECODE-ORDER",
    "a_title": "Envelope decode order, ampersand decoded last (4.1)",
    "a_doc": "Body and attribute encoding: <!-- --> **Decode order is binding.** Decode a *body* as: `<br>` \u00e2\u2020\u2019 `\\n` **first**, then `&lt;`/`&gt;`/`&quot;`, then `&amp;` \u00e2\u2020\u2019 `&` **last**. Decode an *attribute value",
    "b_id": "REQ-SEAM-ACTIVITY",
    "b_title": "Activity/idle reported via api sentinels, not PTY quiescence",
    "b_doc": ""
  },
  {
    "idx": 128,
    "a_id": "REQ-HAZARD-DEFERRED-DRAIN",
    "a_title": "Deferred spool rows excluded from the event-stream drain (1.4)",
    "a_doc": "",
    "b_id": "REQ-HAZARD-DEFERRED-SURVIVE-DRAIN",
    "b_title": "Deferred rows survive poll drain (4.4)",
    "b_doc": ""
  },
  {
    "idx": 129,
    "a_id": "REQ-DAEMON-1",
    "a_title": "One per-machine spt-daemon owning all per-machine state",
    "a_doc": "",
    "b_id": "REQ-MESH-2",
    "b_title": "Member roster: node-level union-merge grow-set (per member: pubkey, label, machine_id, last-known address, last-seen \u00e2\u20ac\u201d NOT the seed), the discovery ",
    "b_doc": ""
  },
  {
    "idx": 130,
    "a_id": "REQ-ARCH-3",
    "a_title": "Wire-protocol version independent of crate semver, N-1 compat window",
    "a_doc": "",
    "b_id": "REQ-HAZARD-HANDOFF-ARGV-COMPAT",
    "b_title": "Broker/brain IPC + handoff argv version-tolerant (2.3)",
    "b_doc": ""
  },
  {
    "idx": 131,
    "a_id": "REQ-ADAPTER-MULTIPLATFORM-SPT",
    "a_title": "A `.spt` adapter archive may pack multiple platforms in one signed asset: shared `manifest.toml` + `strings/` at the root, role binaries under per-Rus",
    "a_doc": "Multi-platform adapter `.spt` packaging: <!-- -->",
    "b_id": "REQ-PAIR-4",
    "b_title": "Subnet naming on first pairing",
    "b_doc": ""
  },
  {
    "idx": 132,
    "a_id": "REQ-HAZARD-RESTART-IDEMPOTENT",
    "a_title": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)",
    "a_doc": "",
    "b_id": "REQ-WAKE-RESUME-LEG",
    "b_title": "A-2 (REMOTE-TRUTH triage \u00c2\u00a7A-2 + ADR-0033): the daemon reconcile gains a WAKE-RESUME LEG \u00e2\u20ac\u201d an endpoint whose rest INTENT is Active but whose harness",
    "b_doc": ""
  }
]