ID: REQ-ACTIVITY-LIST-JSON
TITLE: `spt endpoint list --json` carries a per-endpoint `activity` (busy|idle) key, for consumers surveying the idle/busy state of many endpoints at once (A
DOC: `--json` catalog: | Command | Top-level shape | |---|---| | `endpoint list` | `{ self, subnets[], local[] }` β€” `self`: `{id, status, ready, alive, u
---
ID: REQ-ADAPTER-ADD-SURFACE-ERRORS
TITLE: Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero exit prints only the exit code and DISCARDS the sub
DOC: 
---
ID: REQ-ADAPTER-PROOF-DIR-OVERRIDE
TITLE: The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an 
DOC: Validate against the live binary: <!-- --> - **Proof a DEV build off disk β€” `--dir` / `--manifest`.** Both `digest-proof` and `translate-proof` acce
---
ID: REQ-ADAPTER-TEMPLATE-KEY-VALIDATION
TITLE: P-1 core half (WORKER-TRUTH triage): `adapter add`/`adapter update` validate every declared role template β€” command, cwd, and [env] inject values β€
DOC: 
---
ID: REQ-ADAPTER-UPDATE-INPLACE
TITLE: Bug #18: spt adapter update fails at re-register with os error 2 because it derives the install dir from the update repo NAME (_github/<safe>) instead
DOC: 
---
ID: REQ-ADAPTER-UPDATE-POST
TITLE: Composite adapter update β€” an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_p
DOC: `[update.post]` β€” the composite post-step (since v0.16.0): <!-- --> // file_pull: repo + path_regex: <!-- --> **Composite update β€” `[update.post]`
---
ID: REQ-ADAPTER-VERSION-CMD
TITLE: `spt adapter version <name>` prints a registered adapter's declared version β€” the EXISTING mandatory `[adapter].version` manifest field (manifest.rs
DOC: `[adapter]` β€” header: <!-- --> `version` is **mandatory**. It is the single declared adapter version β€” read before any update (the `gh_release` co
---
ID: REQ-API-3
TITLE: commune/signoff are file-drops, not commands
DOC: 
---
ID: REQ-ARCH-1
TITLE: Many small acyclically-layered crates
DOC: 
---
ID: REQ-ARCH-2
TITLE: Public SDK surface is spt-proto, spt-runtime, spt-msg
DOC: 
---
ID: REQ-ARCH-3
TITLE: Wire-protocol version independent of crate semver, N-1 compat window
DOC: 
---
ID: REQ-ATTACH-IDEMPOTENT-REPLAY
TITLE: The equal-generation lease rung is idempotent for the same connection. (ADR-0047 decision 3, AMENDING ADR-0044's ladder inside the equal-gen rung; her
DOC: 3. The equal-generation rung is idempotent for the same connection: <!-- -->
---
ID: REQ-ATTACH-SEED-REQUEST-DOUBLE-SERVE
TITLE: A dispatcher-SEEDED attach Request is honored ONCE β€” the wire replay's copy of that same Request must not re-establish it. (Seed: DAEMON-LIFECYCLE W
DOC: 
---
ID: REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE
TITLE: SEED (DEFERRED, doyle 2026-07-09 β€” post-counter-54 root-hardening for UPDATE-WEDGE; mint now, impl a FUTURE milestone): on a PLANNED brain-restart (
DOC: 
---
ID: REQ-BROKER-ATTACH-JOURNAL-RESILIENT
TITLE: A poisoned EffectJournal mutex or a sick NetHost runtime must NOT permanently brick all future attaches. Bug #16 (URGENT): a live spt-hosted endpoint 
DOC: 
---
ID: REQ-BROKER-OUTPUT-BEFORE-EXIT
TITLE: RC-RENDER-TRUTH W3 (ADR-0043 decision 1, hertz stale-glyphs RCA leg 1 P0): the PTY drain/output writer is the SOLE FIFO sequencer for terminal Output 
DOC: Decisions: <!-- --> 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is
---
ID: REQ-CARRIER-CLAIM-EXCLUSIVE
TITLE: MSG-IDENTITY W4 / F-033 + operator self-send probe 2026-07-09 (dup-delivery cluster, RCA-FIRST): a spooled message row is delivered by EXACTLY ONE car
DOC: 
---
ID: REQ-CONN-POISON-ATTRIBUTION
TITLE: MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-conn lifecycle record is ATTRIBUTABLE β€” the W6 RCA
DOC: 
---
ID: REQ-CONN-POISON-DIAL-SCOPE
TITLE: MSG-IDENTITY W6 / F-039 (deployah field-acceptance follow-up 2026-07-10, RCA-FIRST β€” mint per the v0.30.6 PASS handoff): ambient CONN_WRITE_POISONED
DOC: 
---
ID: REQ-CONSENT-2
TITLE: Interactive consent escalation: an ungated high-risk action routes a consent prompt to the user's most-recently-active session; allow-once / allow-alw
DOC: 
---
ID: REQ-CONSENT-3
TITLE: Per-capability approval gates (class-keyed): the require_approval enum may ride INDIVIDUAL [shell.capabilities] entries β€” gating the dangerous ACT, 
DOC: Shell model (detailed): <!-- --> **per-capability approval gates** (ratified 2026-06-11, Gateway grill): the same `require_approval` enum may ride **i
---
ID: REQ-CONTROL-STAMP-CONVERGENCE
TITLE: REGISTRY-LIFECYCLE W2 (ADR-0041 decision 4, emphasys C3 P1): control-stamp writes are session/generation-VALIDATED (or per-endpoint stamp transitions 
DOC: Decision: <!-- --> 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority β€”
---
ID: REQ-CONTROLLER-LEASE-IDENTITY
TITLE: RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-131
DOC: Decisions: <!-- --> 1. **Distinct viewport/lease identity.** Each rc invocation/attach stream mints a unique controller lease id, carried through Subs
---
ID: REQ-CONTROLLER-LIVENESS-REAP
TITLE: B-2 (REMOTE-TRUTH triage Β§B-2, REDUCED @bdc1242): a stale ONLINE+CONTROLLED stamp on a live-session perch self-heals β€” the info.json driven_by/cont
DOC: 
---
ID: REQ-CONV-1
TITLE: Peer address seeding, both cold starts: durable peer-addrs.json (identity dir) maps peer pubkey β†’ last-known dialable address; the pump's resolver c
DOC: 
---
ID: REQ-DAEMON-1
TITLE: One per-machine spt-daemon owning all per-machine state
DOC: 
---
ID: REQ-DAEMON-8
TITLE: Internal auto-start prefers the service: `ensure_running` (any spt command's implicit daemon start, REQ-DAEMON-3) routes through the service-aware sta
DOC: 
---
ID: REQ-DAEMON-BITS-AMBIGUITY
TITLE: SEED (inactive, RCA-first β€” do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit
DOC: 
---
ID: REQ-DAEMON-STOP-LIVE-SESSION-WARN
TITLE: W3 (LIFECYCLE-TRUTH, promoted old follow-wave seed): `daemon stop` with live hosted sessions warns + requires --force (or names the sessions it will k
DOC: 
---
ID: REQ-DIGEST-PROFILE-ENV
TITLE: Bug #17: spt endpoint digest returns NO_DIGEST for a ccs-profile endpoint (claude-spt:ccs) though [digest] is wired and the transcript exists β€” unde
DOC: `[env]` β€” env-var table: **`direction = "read"` β€” capture a launch-env var for template substitution.** <!-- --> A `read` directive names an envir
---
ID: REQ-DIGEST-SEAL-ON-IDLE
TITLE: A digest turn's records gain their stable `seq` at the endpoint's IDLE TRANSITION β€” the adapter-reported, already-authoritative turn-finished signal
DOC: <!-- --> **A turn closes when the endpoint goes idle β€” not when the next input arrives.** The moment the endpoint reports it stopped working, the tr
---
ID: REQ-DOC-DELIVERY-VOCAB
TITLE: W6 (LIFECYCLE-TRUTH, docs β€” remaining flynn/perri gaps folded): publish the full send-outcome vocabulary (SENT / SENT(WAN) / QUEUED window semantics
DOC: Semantics: <!-- the send-outcome vocabulary itself β€” the closed set of SENT/SENT(WAN)/QUEUED/QUEUED(idle-only)/DEFERRED/NO_PERCH + WAN failure tags 
---
ID: REQ-DOCS-LOCAL-SERVER
TITLE: THE-FORKENING W3 (ADR-0036 Β§4, operator-ruled crate-over-handroll + port 5474): the daemon (broker side β€” docs are up whenever the daemon is) serve
DOC: Self-update: **docs server** β€” the daemon serves `$SPT_HOME/docs` over HTTP on **loopback only**, default `127.0.0.1:5474` (config/env-overridable).
---
ID: REQ-ENDPOINT-LIST-MERGE-LOCAL
TITLE: `spt endpoint list` always merges this node's LOCAL (unadvertised) perches into the view; the `--local` flag is REMOVED (operator decision 2026-06-17)
DOC: **endpoint list always merges local perches**: <!-- --> `spt endpoint list` (and therefore `whoami`) **always** appends this node's **LOCAL perch rost
---
ID: REQ-ENDPOINT-LIST-NODE-GROUPED
TITLE: spt endpoint list is node-grouped over unique INSTANCES, not subnet-grouped over duplicated rows: one row per (id,node) instance β€” subnet duplicatio
DOC: 
---
ID: REQ-ENDPOINT-LIST-PROJECT-COL
TITLE: #8: spt endpoint list gains a second column <project>/ (the endpoint's LATEST project) -> 4 columns total: id / <project>/ / type / status. Local rows
DOC: 
---
ID: REQ-ENDPOINT-LIST-REST-FILTER
TITLE: spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-first row ordering with fixed precedence ONLINE > C
DOC: 
---
ID: REQ-ENDPOINT-MESSAGE-ONLY-DISPLAY
TITLE: An online agent-family endpoint with NO session surface reads as message-reachable, not as a harness-hosted live agent and not as a plain ONLINE. (her
DOC: 
---
ID: REQ-ENDPOINT-UNBOUND-ATTACH
TITLE: An spt-hosted endpoint is ATTACHABLE between spawn and bind: gate the attach on the broker SESSION being attachable (session+PTY+OutputLog exist at sp
DOC: Pieces the Instances model requires: <!-- --> **Unbound endpoint**: The lifecycle point between *spawn* and *bind*: an spt-hosted endpoint whose broke
---
ID: REQ-EP-1
TITLE: Day-one endpoint types; open type system
DOC: 
---
ID: REQ-EP-2
TITLE: Agent endpoints vs Shells distinction in the type model
DOC: 
---
ID: REQ-EP-5
TITLE: Concrete shell instantiation model: spawn-mints-instance (vs relink/online), registered-on-node permission + broadcast-is-discovery, per-shell require
DOC: 
---
ID: REQ-EP-6
TITLE: Gateway type acceptance: a Gateway-typed perch binds (api bind --type, open type system β€” un-hardcode the live_agent default), advertises/addressabl
DOC: Endpoint types: <!-- --> **Gateway** (concept ratified 2026-06-11; registered via the open type system, first instance downstream): A **human-backed e
---
ID: REQ-EP-7
TITLE: Durable live-role.md: a per-agent broad-purpose statement in tracked/agents/<id>/ beside live-context.md (replicates with the mind on the same a-<id> 
DOC: Cross-node Psyche sync: <!-- --> **live role** (`live-role.md`, ratified 2026-06-12 β€” core milestone A): A durable statement of an agent's **broad p
---
ID: REQ-EP-8
TITLE: AlwaysOnEndpoint: a resident, addressable, mindless endpoint whose adapter binary the daemon supervises continuously β€” register-triggered by an adap
DOC: Always-on endpoints: resident supervised adapter binaries, `#`-sigil addressed: <!-- -->
---
ID: REQ-EP-9
TITLE: `#` always-on address sigil: a reserved LEADING sigil marking an AlwaysOnEndpoint, extending the REQ-INST-10 grammar to `[subnet:]#id[@node]`. Mandato
DOC: Always-on endpoints: resident supervised adapter binaries, `#`-sigil addressed: <!-- -->
---
ID: REQ-FRONT-1
TITLE: Day-one launcher/manager frontend (list/launch/attach/init)
DOC: 
---
ID: REQ-GOSSIP-ADAPTER-PROJECTS
TITLE: #4: remote endpoint details (harness + project history) are gossiped, not faked. Today from_resource_row (crates/spt/src/picker/model.rs:340) hardcode
DOC: 
---
ID: REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP
TITLE: A DELEGATED live adapter apply MUST NEVER report success without performing the swap, and the live-update seam MUST use ONE parent-aware adapter match
DOC: 7.23 A message that has REACHED a node's spool must NEVER depend on an adapter hook-poll cadence to reach an spt-hosted (relay-less) endpoint β€” the 
---
ID: REQ-HAZARD-ADAPTER-PROFILE-STAMP-CLOBBER
TITLE: A-4 (F029, operator regression): the picker/confirm views drop an endpoint's adapter `:profile` (showed `claude-spt` where `claude-spt:ccs` was create
DOC: 
---
ID: REQ-HAZARD-ATTACH-WEDGE
TITLE: A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the broker for all other clients. ROOT (v0.12.0 real-harne
DOC: 
---
ID: REQ-HAZARD-BIND-CWD-UNSET
TITLE: A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own project tab. ROOT (found, v0.13.0): `info.cwd` is NEVER 
DOC: 
---
ID: REQ-HAZARD-BIND-REST-STATE-CARRY
TITLE: GATEWAY-LIVENESS DEFECT A (flynn field bug 2026-07-09, confirmed independent): a re-bind MUST preserve the daemon-owned resting intent (rest_state, D9
DOC: 
---
ID: REQ-HAZARD-BOUNDARY-READY-STRAND
TITLE: C-2 (F029, SEAM-2 pinned β€” B6's SECOND HALF, the live-wake blocker; perri wakep9 vs wakep4 gate-state dump + doyle code trace): at a /clear, CC fire
DOC: 
---
ID: REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP
TITLE: A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint β€” no duplicate. On an abrupt brain death stop_host never runs (the LiveSe
DOC: 
---
ID: REQ-HAZARD-BROKER-PROCESS-ISOLATION
TITLE: Broker and brain are separate processes: the broker runs as its own long-lived per-machine process that survives every brain restart, so a routine (br
DOC: 6.6 Surfaced context conflicts preserve both versions until dominated: ### 6.7 Broker and brain MUST be separate processes (in-process collapse silent
---
ID: REQ-HAZARD-BROKER-QUIC-DEADLINE
TITLE: The broker bounds every brain-waiting QUIC op (dial / open_stream / send_stream) so a black-holed or dead peer fails PROMPTLY with an ORDINARY error t
DOC: 7.7 A slow/dead/hostile remote VIEWER must never stall the controller, child, or drain `[REQ-HAZARD-VIEWER-ISOLATION]`: ### 7.8 The broker must never 
---
ID: REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE
TITLE: W2 (LIFECYCLE-TRUTH, KNOWN-HAZARDS, flagship β€” the update wedge): PTY viewer fan-out and control mutations must not depend synchronously on a live d
DOC: 7.35 The cached ceremony-clock NTP offset must NOT survive an OS clock STEP β€” an offset measured against the pre-step clock strands every pairing fo
---
ID: REQ-HAZARD-CASCADE-WIPE-GUARD
TITLE: No hard-delete of a parent hosting non-empty children (6.3)
DOC: 
---
ID: REQ-HAZARD-CHILD-CONSOLE-FLASH
TITLE: Console-subsystem children of the console-less daemon spawn with CREATE_NO_WINDOW, or each spawn flashes a visible blank window on the user's desktop 
DOC: 5.7 Elevated commands spawn the daemon with the wrong token `[REQ-HAZARD-ELEVATED-DAEMON-SPAWN]`: <!-- --> ### 5.8 Console children of the console-les
---
ID: REQ-HAZARD-CONFLICT-BOTH-PRESERVED
TITLE: A surfaced concurrent context pair is durably preserved (both versions, tracked artifacts) until a strictly dominating write clears it; no reconcile f
DOC: 
---
ID: REQ-HAZARD-CONPTY-DSR
TITLE: ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)
DOC: 
---
ID: REQ-HAZARD-CONTROLLER-GAP-RESUME
TITLE: A serving CONTROLLER whose serve-brain hits a b4 drop-don't-block FORWARD output gap must RESUME-FROM-FLOOR (re-subscribe from delivered_through and r
DOC: 
---
ID: REQ-HAZARD-CONTROLLER-LEASE
TITLE: RC-RENDER-TRUTH W2 (KNOWN-HAZARDS 7.48 β€” umbrella conformance seam for ADR-0044): at most one input-capable controller lease per PTY session; takeov
DOC: 7.47 The physical terminal is never mutated or terminated outside its renderer's ordered state model β€” output before exit, owned baselines, uncondit
---
ID: REQ-HAZARD-DAEMON-HOSTED-LIVENESS
TITLE: Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2
DOC: 
---
ID: REQ-HAZARD-DAEMON-STOP-BARRIER
TITLE: B3: `spt daemon stop` then an immediate `spt daemon start` does NOT race β€” stop fully completes before it returns. Today request_stop (seedmap.rs:24
DOC: 
---
ID: REQ-HAZARD-DEFERRED-DRAIN
TITLE: Deferred spool rows excluded from the event-stream drain (1.4)
DOC: 
---
ID: REQ-HAZARD-DEFERRED-SURVIVE-DRAIN
TITLE: Deferred rows survive poll drain (4.4)
DOC: 
---
ID: REQ-HAZARD-DIRECT-WRITE-PRECEDENCE
TITLE: Direct-write precedence marker (with node id) guards stale overwrite (6.5)
DOC: 
---
ID: REQ-HAZARD-DROP-FILE-SINGLE-WRITER
TITLE: Drop files are daemon-owned single-writer (6.4)
DOC: 
---
ID: REQ-HAZARD-EBUSY-RENAME
TITLE: tmp-write + atomic-rename + retry on Windows EBUSY (5.2)
DOC: 
---
ID: REQ-HAZARD-ECHO-BEFORE-SIGNOFF
TITLE: Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3)
DOC: 
---
ID: REQ-HAZARD-EFFECT-JOURNAL-PTY-WEDGE
TITLE: The effect journal serializes EVERY PTY effect under one mutex held ACROSS two fsyncs AND the blocking PTY write β€” so interactive input stutters and
DOC: 
---
ID: REQ-HAZARD-ENDPOINT-LIFECYCLE
TITLE: REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 β€” the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY deat
DOC: 7.44 Streams and seats on a long-lived connection must have bounded lifetime β€” one-way rows terminal at FIN, seats released at serve completion, no 
---
ID: REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT
TITLE: A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY output. KEYSTONE β€” the operator's central 'atta
DOC: 
---
ID: REQ-HAZARD-ENVELOPE-PARSER-SAFE
TITLE: Two-slice envelope parser is panic-free and tolerant (4.2)
DOC: 
---
ID: REQ-HAZARD-EPHEMERAL-CLEANUP
TITLE: Ephemeral perch cleanup on every ring exit path (3.1)
DOC: 
---
ID: REQ-HAZARD-GRACE-BEFORE-SIGNOFF
TITLE: Grace-period wait completes before composing INIT_SIGNOFF (1.1)
DOC: 
---
ID: REQ-HAZARD-HANDOFF-ARGV-COMPAT
TITLE: Broker/brain IPC + handoff argv version-tolerant (2.3)
DOC: 
---
ID: REQ-HAZARD-ID-CHARSET
TITLE: Addressable-id charset reserves :/@ delimiters; validated at every creation seam (4.6)
DOC: 4.5 Inbox legacy compat must not double-deliver: ### 4.6 Addressable-id charset reserves the address delimiters <!-- --> - **Failure:** a bare endpoin
---
ID: REQ-HAZARD-INBOX-NO-DOUBLE
TITLE: No double-delivery via legacy inbox (4.5)
DOC: 
---
ID: REQ-HAZARD-INJECT-CONTROL-COEXIST
TITLE: SPINE INVARIANT (v0.13.0 keystone): the broker must accept INJECTED keystrokes into an spt-hosted PTY (the v0.11.0 raw direct-inject today; the ADR-00
DOC: 
---
ID: REQ-HAZARD-LISTEN-ORPHAN
TITLE: W4 (LIFECYCLE-TRUTH, KNOWN-HAZARDS): `api listen --parent-pid N` watches parent liveness and exits loud on parent death. ROOT (mobile-gw RCA): --paren
DOC: 
---
ID: REQ-HAZARD-LIVEHOST-NONRESIDENT
TITLE: A daemon-hosted Psyche that spawns then EXITS IMMEDIATELY is a host failure, surfaced like a spawn failure (closes the v0.8.1 residual masking): the R
DOC: 
---
ID: REQ-HAZARD-MESH-BOOTSTRAP-TRAP
TITLE: MESH-RECOVERY W1 (KNOWN-HAZARDS 7.42, hertz field RCA 2026-07-10 β€” HFENDULEAM+ENLYZEAM symmetric green-status sequester): a node holding a valid Ros
DOC: 7.41 A fresh dispatcher must NEVER re-serve a terminal stream β€” historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-
---
ID: REQ-HAZARD-PAIR-SEED-ROTATION
TITLE: Removing a node rotates the subnet seed (epoch bump) so an old node/old seed cannot rejoin; trust-store delete alone is NOT revocation because the see
DOC: 
---
ID: REQ-HAZARD-PTY-INPUT-WRITER-WEDGE
TITLE: Pasting into an `spt rc` session WEDGES the broker β€” after a paste the operator can no longer type AND can no longer attach to NEW or EXISTING sessi
DOC: 
---
ID: REQ-HAZARD-PUMP-IPC-DEADLINE
TITLE: The single-threaded peer pump's brain-IPC reads are deadline-bounded (PUMP_PEER_IO_TIMEOUT, total-wait per call); a TimedOut read POISONS the client a
DOC: 7.5 WAN-inbound origin is transport truth, never payload `[REQ-HAZARD-WAN-ORIGIN-AUTH]`: ### 7.6 Pump brain-IPC reads must be deadline-bounded (a bloc
---
ID: REQ-HAZARD-RC-ATTACH-ONLINE-RACE
TITLE: `spt endpoint run` in an ATTACH/VIEW terminal action attaches BEFORE the freshly-spawned endpoint is online, so the attach races (or outright loses to
DOC: 
---
ID: REQ-HAZARD-RC-EOF
TITLE: A severed broker stream during a live rc session surfaces GRACEFULLY, never as a raw io error that crashes the PTY. The rc read-loop (rc.rs:352-362) c
DOC: 
---
ID: REQ-HAZARD-RC-INPUT-KEY-ENCODING
TITLE: An `spt rc` session forwards the Backspace key as the VT DEL byte (0x7f), so the hosted TUI (Claude Code) deletes ONE character β€” never a whole word
DOC: 
---
ID: REQ-HAZARD-REGISTRY-EPOCH-LEASE
TITLE: Registry merge ordered by per-node monotonic epoch, never wall-clock β€” a stale Active can't clobber a newer Offline (4.8, red-team #8)
DOC: 4.7 Concurrent SQLite openers must not fail with "database is locked": ### 4.8 Registry merge ordered by epoch, never wall-clock (red-team #8) <!-- --
---
ID: REQ-HAZARD-REGISTRY-STALE-CLEAN
TITLE: Stale registry entries degrade to fallback, never hard-fail (4.3)
DOC: 
---
ID: REQ-HAZARD-RENDER-LIFECYCLE
TITLE: RC-RENDER-TRUTH W3 (KNOWN-HAZARDS 7.47 β€” umbrella conformance seam for ADR-0043): the physical terminal is never mutated or terminated outside its r
DOC: 7.46 An rc surface answers from live session authority, never a stale persisted projection β€” and a resuming perch is UNBOUND, not offline `[REQ-HAZA
---
ID: REQ-HAZARD-RESTART-IDEMPOTENT
TITLE: Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)
DOC: 
---
ID: REQ-HAZARD-RESUME-CUSTODY-ABA
TITLE: KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID β€” a recycled pid must read NOT OURS. The hazard-conformance twin of REQ-RESUME-
DOC: 7.51 Process custody is an identity, never a bare PID β€” a recycled pid must read NOT OURS `[REQ-HAZARD-RESUME-CUSTODY-ABA]`: <!-- --> - **Failure (p
---
ID: REQ-HAZARD-ROSTER-GHOST
TITLE: A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phantom perch-less endpoint). `api session-end <id> --e
DOC: 
---
ID: REQ-HAZARD-SEEDMAP-CONNECT-UNBOUNDED
TITLE: SEED (doyle-filed, 2026-07-05, from the REQ-HAZARD-DAEMON-STOP-BARRIER B2 fix): the PRODUCTION seedmap connect callers (put / take / is_running) inher
DOC: 
---
ID: REQ-HAZARD-SINGLE-PATH-SOURCE
TITLE: Single path/registry source of truth; no layout ambiguity (6.1)
DOC: 
---
ID: REQ-HAZARD-SOFT-CLEANUP
TITLE: Soft-cleanup preserves state, removes only the ready marker (6.2)
DOC: 
---
ID: REQ-HAZARD-STALE-INDEX-LOCK
TITLE: Sweep stale lockfiles on daemon boot (1.3)
DOC: 
---
ID: REQ-HAZARD-TEARDOWN-DEADEND
TITLE: TEARDOWN-AUTHORITY W1 HAZARD (ADR-0045 decision 8; hertz RCA 2 β€” hit doyle's OWN live production endpoint, recoverable only by out-of-band scoped ki
DOC: 7.48 At most one input-capable controller lease per PTY session β€” takeover revokes atomically and loudly, input is fenced to the active lease, node 
---
ID: REQ-HAZARD-TEMPLATE-ARGV-FILL
TITLE: Command-template substitution fills argv ELEMENTS, not a re-tokenized string: spt-core currently `fill_template`s {key} values INTO the command STRING
DOC: 
---
ID: REQ-HAZARD-UNHOST-PSYCHE-REAP
TITLE: On un-host, the detached `{id}-psyche` HARNESS PROCESS is reaped β€” not just its in-brain pulse-driver thread. Today stop_host (livehost.rs:203) trip
DOC: 
---
ID: REQ-HAZARD-VIEWER-ISOLATION
TITLE: A slow / dead / hostile VIEWER must NEVER stall the controller, the PTY child, or the session drain thread. The broker drain fans output to the contro
DOC: 7.6 Pump brain-IPC reads must be deadline-bounded (a blocked read wedges the whole pump) `[REQ-HAZARD-PUMP-IPC-DEADLINE]`: ### 7.7 A slow/dead/hostile
---
ID: REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE
TITLE: A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COEXIST) moved the controller SOCKET WRITE off the dr
DOC: 
---
ID: REQ-HAZARD-WINDOWS-PID-RECYCLE
TITLE: Windows PID-recycling false positives guarded (5.1)
DOC: 
---
ID: REQ-HAZARD-WORKER-PATH
TITLE: Single source of truth for Worker/Psyche perch location (1.5)
DOC: 
---
ID: REQ-HOST-RUN-1
TITLE: spt-hosted harness bringup: `spt endpoint run` spawns an adapter's `[session.self]` command template into a broker-held PTY (the spawn-session seam, b
DOC: 
---
ID: REQ-HOSTING-AUTHORITY-CONTROLLABLE
TITLE: RC-RENDER-TRUTH v0.38.1 fast-follow leg 3 (hertz todlando immortal-hybrid trace, doyle fork ruling 2026-07-18 = controllable-authority): ONE hosting a
DOC: Requirements: <!-- --> ## Amendment (RC-RENDER-TRUTH v0.38.1 leg 3, doyle ruling 2026-07-19): one hosting authority β€” the online-earn authority spli
---
ID: REQ-IDLE-PARKED-DELIVERY
TITLE: W5 (LIFECYCLE-TRUTH): a message QUEUED to an ALREADY-idle spt-hosted endpoint is delivered without an operator poke. ROOT (live during the milestone d
DOC: 
---
ID: REQ-INST-12
TITLE: Endpoint visibility per-(endpoint,subnet): excluded semantics, OR-of-defaults + override, gates sync
DOC: 
---
ID: REQ-INST-13
TITLE: Subnet-exclusive sync + per-endpoint subnet-membership list
DOC: 
---
ID: REQ-INST-14
TITLE: Resource advertisement (subnet resource registry): free-text blurb, both-authored, registry projection, visibility/whitelist-gated
DOC: Pieces the Instances model requires: <!-- --> **resource advertisement (subnet resource registry)**: A per-endpoint **free-text blurb** describing the
---
ID: REQ-INST-4
TITLE: active to dormant/suspended fires a transition echo commune
DOC: 
---
ID: REQ-INSTALL-11
TITLE: Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.spt`-shipped binary (dropped to adapters/_github/<s
DOC: Manifest seams (outbound contract, detailed): - **Command templates are opaque.** spt-core never parses out a model/tool/flag β€” the adapter writes t
---
ID: REQ-INSTALL-12
TITLE: Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.toml at the registry ROOT (sibling to the per-adap
DOC: Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve
---
ID: REQ-INSTALL-3
TITLE: Idempotent + interactive-optional first run
DOC: 
---
ID: REQ-INSTALL-8
TITLE: OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install l
DOC: 
---
ID: REQ-JOIN-VERBOSE-CLOCK
TITLE: W2/D4 (JOIN-TRUTH): the JOINER side is no longer blind to its own ceremony clock β€” `spt subnet join --verbose` prints the joiner's derived TOTP step
DOC: 
---
ID: REQ-LIST-JSON-LIVENESS-PARITY
TITLE: GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (human) and `endpoint list --json` MUST report an IDENT
DOC: 
---
ID: REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY
TITLE: `api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi
DOC: 
---
ID: REQ-LIVENESS-ORACLE-SOUND
TITLE: TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer 
DOC: 7.50 The liveness oracle answers from the process table, never from a handle a caller still holds `[REQ-LIVENESS-ORACLE-SOUND]`: <!-- --> - **Failure 
---
ID: REQ-MANIFEST-1
TITLE: Per-adapter manifest with adapter_name and min_spt_core_version
DOC: What is NOT in the manifest (spt-core-owned): <!-- The sections below are the authoritative schema; the typed form in `crates/spt-runtime/src/manifest
---
ID: REQ-MANIFEST-5
TITLE: File-backed adapter [strings] (M12-W3-T3.1): a [strings] dot-path value MAY be an inline-table FILE POINTER `key = { file = "rel/path" }` resolved to 
DOC: Runtime model: **adapter strings** (ratified 2026-06-11, Gateway grill): <!-- --> A `[strings]` manifest section β€” an adapter-authored JSON/TOML KV 
---
ID: REQ-MANIFEST-6
TITLE: Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed as `<adapter>:<profile>` (not just a bare adapter
DOC: Manifest seams (outbound contract, detailed): - **Command templates are opaque.** spt-core never parses out a model/tool/flag β€” the adapter writes t
---
ID: REQ-MANIFEST-7
TITLE: Adapter-declared shortcut basename (M12-W2 follow-on): an optional `[adapter] shortcut_basename` manifest field names the basename the `spt endpoint r
DOC: `[adapter]` β€” header: <!-- --> `shortcut_basename` *(optional, default `spt`)* β€” the basename the `spt endpoint run` picker's `s` keybind bakes in
---
ID: REQ-MANIFEST-NODE-KEY
TITLE: A new session-scoped manifest fill key `{node}` resolves to THIS node's advertised label β€” available wherever the session-scoped keys ({id}/{session
DOC: Claude Code: native resume into an existing transcript by id, in its project cwd.: <!-- --> ```toml [session.self] # {node} fills as one argv token β€
---
ID: REQ-MANIFEST-SUBST
TITLE: Manifest substitution primitives for resolve-not-execute (ADR-0029, supersedes a rejected `spt api run-hook`): (1) two adapter-static substitution key
DOC: Claude Code: native resume into an existing transcript by id, in its project cwd.: <!-- --> **Adapter-static keys β€” `{adapter_dir}` and `{adapter_na
---
ID: REQ-MESH-2
TITLE: Member roster: node-level union-merge grow-set (per member: pubkey, label, machine_id, last-known address, last-seen β€” NOT the seed), the discovery 
DOC: 
---
ID: REQ-MSG-1
TITLE: Local message delivery: TCP-first to a registered address, spool fallback when offline; id->address via registry (stale-clean first); reply routing (_
DOC: 
---
ID: REQ-MSG-6
TITLE: cross-node Gateway user-msg honored via advertised endpoint_type: a user-msg from a Gateway-typed origin survives the receive_wan funnel as user-msg (
DOC: Endpoint types: <!-- --> _Implemented posture_: the **local** user-backed origins are honored end-to-end β€” a locally-hosted Gateway endpoint (info.j
---
ID: REQ-MSG-CLI-ORIGIN
TITLE: A bare non-perch CLI `spt send` (no owning perch to name as origin) stamps from = `cli@<node-label>` at compose time (bare `cli` when no node label is
DOC: 
---
ID: REQ-MSG-ENVELOPE
TITLE: The <EVENT type="msg" from=…>body</EVENT> envelope (spt-proto::event, the ADR-0001 grammar) is the SOLE canonical arriving-message format at EVERY h
DOC: Decision: <!-- -->
---
ID: REQ-NET-1
TITLE: WAN messaging first-class, behind default-on net feature flag
DOC: 
---
ID: REQ-NOTIF-1
TITLE: Notification primitive: per-subnet replicated spool, seen/dismissed, resurface-at-boundary, subsumes update+consent prompts
DOC: 
---
ID: REQ-NOTIF-COALESCE
TITLE: Coalesce-key supersession: producer-stamped key REQUIRED in namespaced form <owner>:<key> (e.g. spt-core:update-staged) β€” the produce front door rej
DOC: 2. Supersession: a required-namespaced coalesce key, latest-wins: <!-- -->
---
ID: REQ-NOTIF-DRAIN-ROW-VALIDITY
TITLE: A spooled notify envelope is validated against its notif row at DELIVERY time β€” a copy outliving its row must not deliver. (ADR-0046 Amendment 1 + K
DOC: 7.53 A durable copy of revocable content is validated against its source of truth at DELIVERY time β€” a spooled notice outliving its row must not del
---
ID: REQ-NOTIF-QUIET-DELIVERY
TITLE: The notify kind rides the active_only window UNCONDITIONALLY, rollback included: spool-only, never live TCP, never a wake, for EVERY producer; loudnes
DOC: 4. Delivery: the notify kind rides `active_only`, unconditionally: <!-- -->
---
ID: REQ-NOTIF-TTL
TITLE: Producer-optional TTL for informational kinds with no dismissal seam (node-paired, agent-issued): expired row auto-dismissed instead of surfaced β€” a
DOC: 5. TTL: producer-optional, expiry ignores seen-state: <!-- -->
---
ID: REQ-NOTIF-UPDATE-ROW-VERSION-RETIRE
TITLE: An update-available notif row minted by a node running PRE-0.40.0 spt is retired on the version the running node has ALREADY reached β€” because the k
DOC: 
---
ID: REQ-OPID-MINTER-NAMESPACE
TITLE: A-4a (REMOTE-TRUTH triage Β§A + ADR-0034 Decision 1 + Amendments 1 & 2): the broker effect journal's dedup key gains a minter dimension so ops minted 
DOC: Decision's minter list did not match the code): <!-- --> Executor recon verified the actual journaled-op surface against HEAD; the Decision-1 tag list
---
ID: REQ-PAIR-NTP-MULTIHOME
TITLE: W1/D1 (JOIN-TRUTH): the ceremony NTP query reaches a server on EITHER IP family β€” `query_unix_secs` (ntp.rs) must iterate every address `to_socket_a
DOC: 
---
ID: REQ-PICKER-1
TITLE: The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t
DOC: 
---
ID: REQ-PICKER-2
TITLE: The picker's project-history loader reads the git-backed context store, not the bare working tree: data.rs project_history_for enumerates an endpoint'
DOC: 
---
ID: REQ-PICKER-4
TITLE: The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node renders as 'LABEL (keyprefix…)' (e.g. 'HFENDULE
DOC: 
---
ID: REQ-PICKER-5
TITLE: `spt endpoint list` (bare/subnet view) renders an ALIGNED table with canonical node labels: cmd_endpoint_list prints subnet rows with `\t` TAB separat
DOC: 
---
ID: REQ-PICKER-ADAPTER-DESCRIPTION
TITLE: The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description panel (like the Pick-existing endpoint picker's two
DOC: 
---
ID: REQ-PICKER-CHOOSE-DEDUP-ALL
TITLE: A4 (F028, operator #5): choose-project duplicate rows. model.rs:314-337 build_project_choices dedups the `Here: <run_cwd>` row only against the HEAD r
DOC: 
---
ID: REQ-PICKER-CURRENT-DIR-LABEL
TITLE: A-2/A-3 (F029, operator, semantic pair): the Choose-project rows must self-identify the CURRENT DIR. build_project_choices (picker/model.rs:322-352). 
DOC: 
---
ID: REQ-PICKER-PROJECT-DISPLAY-NAME
TITLE: A1 (F028, operator #1/#4/#6-display): `github-com-*` 'ghost' project entries are NOT phantoms β€” project_id_for_dir (spt-store/src/project.rs:64) der
DOC: 
---
ID: REQ-PICKER-PURGE-STRUCTURED
TITLE: RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from inside an active TUI return STRUCTURED outcomes and
DOC: Decisions: <!-- --> 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is
---
ID: REQ-PICKER-WINDOW-TITLE
TITLE: B-5 (F029, operator): `spt endpoint run`'s interactive picker window/tab is untitled β€” hard to find among many terminals. Set the window/tab title t
DOC: 
---
ID: REQ-PRES-1
TITLE: Presence resolution: the presence datum (last_active_node, last_active_endpoint, ts) gossiped subnet-wide via the agent-interaction heartbeat (rides r
DOC: Deferred Features: | Feature | Cut from | Why deferred | Trigger to revisit | |---|---|---|---| | Scrollback on-disk spillover | terminal wrapper v1 |
---
ID: REQ-PRESENCE-CONTROL-REAP-ON-EXIT
TITLE: B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE decay window + sticky CONTROLLED stamp. Repro: /exit -
DOC: 
---
ID: REQ-PRESENCE-LIVENESS-TRUTH
TITLE: A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga
DOC: 
---
ID: REQ-PSYCHE-EPHEMERAL-DRIVER
TITLE: W1 (F030, design Β§3): each psyche-relevant event runs exactly ONE bounded per-event turn through the existing driver stack (psyche_turn_and_relay for
DOC: Endpoint types: **Psyche**: The Psyche companion's own perch, distinct from its paired LiveAgent's perch. First-class endpoint type so messages addres
---
ID: REQ-PSYCHE-SID-CUSTODY
TITLE: W2 (F030, design Β§3): the psyche mints and keeps its OWN session id, stored in the nested {id}-psyche perch record β€” {session_id} in psyche role te
DOC: The role spt-core actually drives β€” one bounded turn per Psyche event.: <!-- --> <!-- --> // then it exits β€” no resident process, no detach.: <!--
---
ID: REQ-PUBLIC-ERROR-SURFACES
TITLE: F-1 (REMOTE-TRUTH triage Β§F-1, Q4 UX rule, operator-ruled): CLI stderr a non-developer can hit names the OBSERVABLE SITUATION + the NEXT ACTION β€” n
DOC: 
---
ID: REQ-RC-1
TITLE: `spt rc <id>` β€” user CLI attaching a local terminal to a broker-held PTY, reusing the cross-node attach machinery (attach.rs request_attach β†’ send
DOC: 
---
ID: REQ-RC-DISPLAY-SOLE-WRITER
TITLE: TEARDOWN-AUTHORITY W5 (hertz RCA 3 bug 1, 2026-07-19 β€” REPRODUCED on 0.38.1 CLI + 0.38.1 broker; doyle ruled, and it CORRECTS an incomplete v0.38.1 
DOC: 
---
ID: REQ-RC-HARNESS-ONLY-REFUSAL
TITLE: RC-RENDER-TRUTH W1 (ADR-0042 decision 3, hertz elevated-endpoints RCA core leg 1): direct `spt rc <id>` preflights the already-known harness_only/cont
DOC: Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `Se
---
ID: REQ-RC-HONEST-SESSION-AUTHORITY
TITLE: RC-RENDER-TRUTH W1 (ADR-0042 decision 1, hertz perri-contradiction RCA): normal `spt rc` consults the ADR-0041 single honest-session authority BEFORE 
DOC: Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `Se
---
ID: REQ-RC-IDENTITY
TITLE: `spt rc` overlays a persistent endpoint-identity marker so the operator always groks which endpoint they control: a reserved TOP status row via a DECS
DOC: 
---
ID: REQ-RC-IDMARKER-DISABLE
TITLE: Bugs #14 + #7/#8 (marker half): feature-flag the top-right StatusRow endpoint-id marker OFF (rc.rs:198-307). It is a one-shot absolutely-positioned pa
DOC: 
---
ID: REQ-RC-NEWLINE-PRESENTATION-TRUTH
TITLE: W3 (v0.39.4 field bug 3 ROOT, pinned 2026-07-22): the rc client presents relayed bytes exactly as the emitter addressed them β€” KNOWN-HAZARDS 7.56. r
DOC: 7.56 The rc client presents relayed bytes exactly as the emitter addressed them β€” console output modes are part of presentation truth `[REQ-RC-NEWLI
---
ID: REQ-RC-QUALIFIED-TARGET-CANONICAL
TITLE: RC-RENDER-TRUTH W1 (ADR-0042 decision 4, hertz elevated-endpoints RCA core leg 2, doyle seam-confirmed rc.rs establish_attach): the resolver's canonic
DOC: Decisions: <!-- --> 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc <id>` runs the same bounded `Se
---
ID: REQ-RC-RECONNECT
TITLE: B-3 (REMOTE-TRUTH triage Β§B-3, the operator-asked UX): the rc attach viewport RECONNECTS on a severed transport instead of print-and-exit. Pre-fix rc
DOC: Proven rows (injection evidence in-tree): | # | Fault injected | Blast radius (by design) | Survives untouched | Recovery | Evidence | |---|---|---|--
---
ID: REQ-RC-RECONNECT-TRUTH
TITLE: W3 (LIFECYCLE-TRUTH): rc reconnect never auto-starts a daemon and never hangs forever. ROOTS rig-proven (the operator's long-standing 'stop 2-4 times'
DOC: 
---
ID: REQ-RC-RESIZE-GEOMETRY-EPOCH
TITLE: A resize transition is ATOMIC from ScreenGrid's perspective: every byte is parsed at the geometry it was EMITTED under. (hertz v0.39.0 field RCA 2026-
DOC: Decision: <!-- the resize barrier + geometry epoch on the dispatch_resize / set_size_and_notify path: hold the grid parse across the ordered surface+g
---
ID: REQ-RC-VT-TEARDOWN
TITLE: RC-RENDER-TRUTH W3 (ADR-0043 decision 2, hertz stale-glyphs RCA leg 2 P0): rc display teardown is a display RAII guard SEPARATE from the OS input/raw-
DOC: Decisions: <!-- --> 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is
---
ID: REQ-RCVIEW-1
TITLE: Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; 
DOC: Shell sleep/wake (offline ↔ online): <!-- --> **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-
---
ID: REQ-REACH-1
TITLE: Off-node remote-drive detection + file transfer
DOC: 
---
ID: REQ-READY-AGENT-RESUME
TITLE: An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly β€” closing the gap that today only LiveAgents do
DOC: **`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): <!-- --> The bringup core is **type-agnostic** β€” the endpoint TY
---
ID: REQ-RESIDENT-SERVICE
TITLE: ResidentService substrate (ADR-0049, design ratified 2026-07-26): a daemon-supervised binary an adapter declares via a `[service]` manifest section β€
DOC: `[service]` β€” a daemon-supervised resident service (ADR-0049): <!-- --> - **`command`** β€” an **opaque** command string (program token plus args), 
---
ID: REQ-RESUME-CONTEXT-PULL
TITLE: Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-SPT parity, operator-directed 2026-06-24). GAP: sp
DOC: Manifest seams (outbound contract, detailed): **resume-session seam** β€” two distinct forms: - **fresh-with-preload:** resume with *cleared* context 
---
ID: REQ-RESUME-REAP-PRIOR-HARNESS
TITLE: B4 (F028, hall-b diagnosis, verified 0.22.0): `--resume` respawns a SECOND harness onto the SAME session without reaping the first. Observed live: res
DOC: 
---
ID: REQ-RUN-NO-DUP-SESSION
TITLE: B1 (F028, hall-b diagnosis, verified 0.22.0): `endpoint run --id X --create` on an endpoint with a LIVE session mints a silent DUPLICATE session β€” a
DOC: 
---
ID: REQ-RUN-PICKER-HOME
TITLE: Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferred half of REQ-RUN-MULTISUBNET-HOME's interactive 
DOC: Shell sleep/wake (offline ↔ online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): <!-- --> The user-facing bringup flow for spt-host
---
ID: REQ-SCREENGRID-WIDTH
TITLE: TEARDOWN-AUTHORITY W3 (hertz field RCA 2026-07-19, doyle-confirmed at source): ScreenGrid models every character as ONE display column, so wide charac
DOC: Server-side **screen grid** β€” the clean-room render model behind the clean repaint on attach (field bug #6 / `REQ-BROKER-SCREEN-GRID`, ADR-0031). A 
---
ID: REQ-SEAM-POSTSPAWN
TITLE: post-spawn / api bind seam with boot nonce
DOC: 
---
ID: REQ-SEAM-RESUME
TITLE: resume-session seam (fresh-with-preload / continue-existing)
DOC: 
---
ID: REQ-SEND-STAMP-AGENT-ID
TITLE: MSG-IDENTITY W4 / endpoint-identity (operator-flagged 2026-07-09 + live-confirmed on flynn's F-038 ask arriving 'cli@HFENDULEAM'): a live agent's own 
DOC: 
---
ID: REQ-SEND-WINDOW-DRAIN-HONOR
TITLE: F-035 (field finding 2026-07-09): active_only = POLL-ONLY for a relay-bearing live agent -- it must NEVER be RELAY-delivered (its contract is 'active 
DOC: <!-- F-035 RCA β€” report-before-fix. --> # F-035 RCA β€” idle-edge parked-drain ignores the delivery-window tag
---
ID: REQ-SESSION-ADAPTER-RECORDED
TITLE: D-2 (REMOTE-TRUTH triage Β§D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profile] a session ran under, so a later resume can re
DOC: 
---
ID: REQ-SESSION-RESUME-TEMPLATE
TITLE: Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT β€” case-3 spt-core MISSING
DOC: `[session.<role>]` β€” outbound templates: <!-- --> **Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh* bringup;
---
ID: REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION
TITLE: C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination β€” a foreign psyche's SessionStart hook RE
DOC: 
---
ID: REQ-SHELL-3
TITLE: Drive channel (owner->shell, REST-only, never-spooled, latest-wins): the owner->shell mirror of sensory for continuous real-time control (scroll/crank
DOC: 
---
ID: REQ-SHELL-4
TITLE: Shell tunnel (reliable-ordered opaque byte stream): an owner<->shell link may hold a long-lived, reliable-ordered, link-bound QUIC stream pair carryin
DOC: Shell model (detailed): <!-- shell tunnel: a long-lived reliable-ordered link-bound QUIC stream pair carrying opaque bytes the taxonomy never reinterp
---
ID: REQ-SHELL-ADAPTER-OWNED-DETACHED-SERVICE
TITLE: RULING OWED (unratified β€” do NOT satisfy without one): may a shell adapter own a DETACHED process that deliberately OUTLIVES its shell's link-break?
DOC: 
---
ID: REQ-SHELL-PERCH-DIR
TITLE: A shell binary can mechanically resolve where its files land. (flynn spt-alchemy clean-room audit 2026-07-21, doyle code-verified, seed pair item 2, P
DOC: `shell_text` β€” free text: <!-- --> ## `shell_file` β€” a landed file
---
ID: REQ-START-2
TITLE: Harness-hosted startup: api seed then listen
DOC: 
---
ID: REQ-START-3
TITLE: spt-hosted startup: spawn-session then api bind (no file)
DOC: 
---
ID: REQ-STORE-1
TITLE: spt-store::BranchStore (git branch as versioned KV; commit=checkpoint/tip=resume, atomic multi-key, merge-native sync) is the substrate for coarse/dur
DOC: 
---
ID: REQ-STREAM-LEASE-CLASSES
TITLE: REGISTRY-LIFECYCLE W2 (ADR-0040 decision 6 + ADR-0041, emphasys C2 P0): streams declare a lifetime class at open β€” RC attach/view streams are Connec
DOC: Decision: <!-- --> 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after
---
ID: REQ-STREAM-OPENER-DURABLE
TITLE: REDISPATCH-TRUTH W1 (ADR-0038, hertz fix B): stream classification identity is RESTART-DURABLE and independent of the evictable data ring β€” today re
DOC: 
---
ID: REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE
TITLE: REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 2+3+4): StreamLog subscriber write discipline β€” (a) replay and live fan-out HALT at the first failed 
DOC: Consequences: ## Amendment β€” REDISPATCH-STALL (2026-07-16) <!-- --> <!-- --> <!-- --> <!-- -->
---
ID: REQ-SUBNET-1
TITLE: spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-code; spt pair deleted
DOC: 
---
ID: REQ-SUBNET-2
TITLE: Guided join e2e: spt subnet join CLI initiator + always-on daemon pairing responder
DOC: Product-surface amendment (2026-06-05 β€” M7 D3): <!-- -->
---
ID: REQ-SUBNET-3
TITLE: Node labels: hostname-default, gossiped, addressable in @node qualifiers (refuse-on-ambiguity)
DOC: 
---
ID: REQ-SUBNET-7
TITLE: Per-machine re-pair trust overwrite: registry rows carry a hashed stable machine identifier (OS machine id /etc/machine-id|MachineGuid, domain-separat
DOC: 
---
ID: REQ-SUBNET-8
TITLE: Status render honesty: zero-subnet text is daemon-aware ('No subnets registered β€” this node is standalone.' + daemon-running-dependent blurb, never 
DOC: 
---
ID: REQ-SUBNET-COUNT-ROUTABLE
TITLE: Bug #2: a remote node endpoint count drifts (0/2, 1/3) because node_status_rows (cli.rs:5314) increments the per-node total unconditionally, counting 
DOC: 
---
ID: REQ-SUBNET-DISPLAY-PARITY
TITLE: The `spt endpoint run` picker renders endpoint state IDENTICALLY for local and remote (subnet) rows β€” bound/unbound, controlled (+driver node), and 
DOC: 
---
ID: REQ-TERM-2
TITLE: session-surface abstraction; send-keys + send-line injection
DOC: 
---
ID: REQ-TERM-4
TITLE: Live activity buffer (session digest): projection of normalized session logs, snapshot-pull (spt endpoint digest) + structured-delta-stream contract +
DOC: 
---
ID: REQ-TERM-7
TITLE: Two-origin digest merge: spt-owned context-injection entries (psyche_download | echo_mirror | owl_message) appended by spt to the endpoint `digest.log
DOC: 
---
ID: REQ-UPD-7
TITLE: Origin-source update bootstrap (`spt update fetch`): pull the latest signed release directly from the GitHub release origin (`SaberMage/spt-releases`)
DOC: 
---
ID: REQ-UPD-9
TITLE: `gh_release` adapter [update] avenue (optional signing): an adapter declares `[update] avenue = "gh_release", repo = "user/repo"` (+ optional `asset`,
DOC: Runtime model: **adapter update declaration** (manifest field): <!-- --> Each adapter manifest declares how spt-core should *ripple-update the adapter
---
ID: REQ-UPDATE-DEFAULT-COMPOSITE
TITLE: THE-FORKENING W4 (operator-grilled 2026-07-14): plain `spt update` = `update fetch --apply` THEN `update adapters` (core-first doctrine order); when c
DOC: Self-update: **update composite (`spt update`)** β€” the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first ord
---
ID: REQ-UPDATE-FETCH-CURRENT-UX
TITLE: `spt update fetch` reports an already-staged / already-applied latest as an ACTIONABLE human outcome (exit 0), not a Debug-formatted error. ROOT: cmd_
DOC: 
---
ID: REQ-UPDATE-RUNNING-IMAGE-SURFACE
TITLE: `spt` surfaces the RUNNING broker image version beside the on-disk version so an updated-looking node reveals broker-side dormancy. ROOT (F-025): `spt
DOC: 
---
ID: REQ-UPDATE-TRIAL-DRAIN-DRIVE
TITLE: UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 β€” regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller
DOC: Self-update: **brain-trial promotion (readiness + drained)** β€” the broker supervises the swapped-in brain through a bounded readiness **trial** and 
---
ID: REQ-WAKE-WAIT
TITLE: A-2 rider (REMOTE-TRUTH triage Β§A-2): `spt endpoint wake --wait` blocks on the REAL bind (status reaches online) after the daemon wake-resume lift (R
DOC: 
---
ID: REQ-WAN-SPT-HOSTED-DELIVERY
TITLE: A WAN-ARRIVED `spt send` is DELIVERED to an spt-hosted endpoint (broker holds its PTY, NO api-listen relay), not spooled-forever. Today receive_wan (s
DOC: 
---
ID: REQ-WHOAMI-IDENTITY-ONLY
TITLE: PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-critical opener β€” the 2026-07-15 message-bodies inc
DOC: `spt whoami` β€” the identity verb *(identity-only since v0.33.0)*: <!-- --> The bounded-time "which endpoint am I?" answer for hooks and adapter glue
---
ID: REQ-WORKER-LIST-VISIBILITY
TITLE: V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view β€” they are process-local machinery, not subnet 
DOC: 
---
ID: REQ-WORKER-PICKER-EXCLUDED
TITLE: V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows β€” a worker perch cannot be d
DOC: 
---