## Rest and wake

Endpoints rest instead of dying: **dormant** (warm — zero idle compute,
instantly wakeable) or **suspended** (cold), explicitly via
`spt endpoint suspend` or on attention-shift. Resting instances stay
addressable, and rest state never gates a delivery window: a dormant
instance drains its busy-window messages on its own next poll, and a
suspended one on its first poll after waking (`spt endpoint wake`). Every active→resting edge fires a **transition echo**
    `--idle-only` holds until the target is idle, then delivers (the wake).
    Default delivers in whichever window fires first. The window is decided
    by the target's **activity** alone — busy or idle, as its adapter reports
    it — and **never by its instance state**. A **dormant** instance has two
    arms: **its driver detached** (nobody is watching; the agent may still be
    working) or **a sibling took attention** (another instance of the id is
    the active one). Either way it drains its busy-window messages on its own
    next poll. A **suspended** instance receives them on its first poll after
    it wakes. Adapter-facing names keep their spelling: the poll surface is

One endpoint can have **instances** on several nodes. Instances rest when
unused — **dormant** (warm, zero idle cost, instantly wakeable) or
**suspended** (cold) — and remain addressable while resting: messages for
them are held and delivered on wake. `spt endpoint wake sergey` re-activates
the seat in place; nothing is respawned.
1:106:Each adapter manifest declares how spt-core should *ripple-update the adapter itself* (see Self-update). One of: **file-pull** (a plugin-directory lookup regex + a gh repo for the adapter's latest files — spt-core fetches + swaps), **delegated command** (a binary command the adapter owns, e.g. `claude.exe plugin update` — spt-core invokes it), or **gh_release** (the adapter ships its updates from its own GitHub releases). After initial bootstrap, the plugin no longer self-manages updates; spt-core conducts them. The **gh_release** avenue (since v0.8.0) declares `repo = "user/repo"` (plus an optional release `asset`, default `adapter.spt`, and an optional Ed25519 `signing_key`): spt-core compares the repo's latest GitHub release version against the installed adapter version and, when newer, fetches the release `.spt` (the same archive primitive as `spt adapter add --release`), then re-extracts and re-registers. Trust mirrors first-acquisition — HTTPS + GitHub when no key is declared; when a `signing_key` is declared, the fetched `.spt` is verified **fail-closed** against a detached signature published as a sibling release asset `<asset>.sig` (lowercase-hex Ed25519 over the raw archive bytes), and the new `.spt` is verified against the **installed** manifest's key (key continuity). A bad or missing signature refuses the update — the staged bytes are deleted, never extracted. The gh_release update is driven by the `spt adapter update [name]` command (with no name it sweeps every registered gh_release adapter); the network fetch lives in the CLI, never the daemon.
2:180:- **Config knobs** (pulse period, echo-commune window/gate, route-guard window, daily refresh) are spt-core **global settings** with optional **per-endpoint override**. **An adapter may DECLARE A DEFAULT, never an override** (narrowed 2026-08-03, LOCKSMITH grill — the original "never per-adapter" wording is superseded): a harness has real information about its own turn shape and cost, but the operator keeps the last word. Precedence, highest first: **per-endpoint override → node/global setting → adapter-manifest default → core default.** Storage follows the ratified `auto-suspend-after` chain (REQ-INST-3): the endpoint leg is an optional `PerchInfo` field in `info.json`, the node leg is `daemon.json`, absent ⇒ inherit the next rung, and `0` ⇒ explicitly OFF for this endpoint even when the rung above enables it.
3:280:A Gateway endpoint binary is revived by **existing machinery only** (settled 2026-06-12, two corrections deep): while running, the bridged device's link liveness drives ordinary **instance state** (sustained device silence → dormant; device contact → active — the driver-attach rule). Across a node restart, revival rides a **co-located shell's wake-watcher** — the Gateway typically owns a shell instance on its own gateway host; that shell's offline wake-watcher (one of the two classes of third-party binary spt-core boot-launches — the other is the [[ResidentService]] supervised binary) holds the device-contact surface and fires the standard **wake resolution** ("owner suspended → revive the owner"). No Gateway-manifest watcher, no autostart flag, no new mechanism.
4:298:A **[[ResidentService]] that additionally fronts addressable endpoints** — resident, addressable, hosting no mind — unlike an *agent endpoint* (a hosted mind with a Psyche + `tracked/` context) and unlike a **Shell** (single-owner, *driven*). The substrate carries the process (supervision, cardinality, hold/quiesce, derived liveness — see [[ResidentService]]); the endpoint layer carries the address. It is **two-way addressable**: agents message it (to drive whatever external surface it fronts) and it messages out — notably it may call `endpoint wake <id>` to draw an offline agent online (wake authorization is **target-side**, so no special caller right is needed — see the wake-watcher/sleep-wake model). Its binary **self-manages its channel endpoints via the existing `api bind`** — one connection fronts many `#`-endpoints, each another channel the one binary serves. Always online, never resting (no dormant/suspended states). Addressed with a mandatory leading [[`#` always-on sigil]].
5:301:**instance state (active / dormant / suspended / offline)**:
6:302:The four liveness states a per-endpoint registry row (`registry::Status`) advertises across the subnet. The **active/dormant pair is the multi-instance routing differentiator**: an endpoint may run on several nodes at once (cross-node context sync) — the **active** instance is the bare-`id` routing target, its live siblings are **dormant**. The canonical meaning (the resting state machine, `resting.rs`, implements active/dormant/suspended; offline is registry-only):
7:303:- **active** — the instance holding the id's **attention**: the one a bare-`id` message resolves to. At most one per id, and possibly **none** (see *active vacancy*). **Active ⇒ warm and online**: a suspended or offline instance is never active. (Working through `ling@laptop` makes `ling@desktop` **dormant**.)
8:304:- **dormant** — **warm** (still running / in-memory) but **not the active target**: a sibling became active. Genuinely *available* (a valid routing fallback) — the picker shows it online. Under the `dormant-enable` auto-suspend mode it decays to *suspended*.
9:306:**Two axes, not one (ratified 2026-09-25, INSTANCE-AXES grill).** Whether a controller is attached is the separate **controlled axis** (see *dormant / suspended instance*). Attaching or detaching a controller never moves the instance axis by itself, and the instance axis never reads the controlled one. _Avoid_: "the driver detached, so it went dormant" — that conflation is what the split retired.
10:310:The active/dormant discriminator is **running-ness + attention** (warm and which instance holds the drive); the suspended/offline discriminator is **node up vs node down**. _Avoid_: advertising a **not-running** (cold, no live session) perch as `dormant` — `dormant` requires the session to be warm/running; a cold perch on a **live** node is **suspended** (node up, endpoint cold), and a live node **never** self-gossips `offline`. (Bound-gated subtlety: an **unbound** perch reads `is_perch_alive==false` yet has a live broker session — it is still *warm*, so it is `active`/`dormant`, not suspended.) _Also avoid_: treating **corrupt** (a present-but-destroyed perch record) as a fifth instance state — it is a **record condition**, not a liveness state. A corrupt perch *advertises* suspended; a local view renders it as suspended **with a corrupt annotation**, and the fault is never hidden by resting-state display filters (it demands operator action — purge or re-mint).
11:312:**effective instance state**: The instance state a reader acts on is always **derived** — liveness discriminates warm/cold (with the unbound subtlety above), and the stored rest intent (`dormant` vs `suspended`) refines only *within* warm. No single stored field is authoritative for "resting-cold"; any reader that trusts a stored rest field against observed liveness (or vice versa) is wrong by construction. _Avoid_: treating the rest-intent record as cold-truth, or defaulting an absent intent to *active*.
12:336:**Shells differ structurally from agent endpoints** (full treatment below): a Shell has a node-local perch but **no `tracked/` context** (no mind to sync); its logs are node-local; it is **adapter/platform-bound, not adapter-agnostic**; and its lifecycle is link/teardown, not the dormant/suspended resting model of agent instances.
13:404:- **no active instance**, a **dormant** or **suspended** one reachable → the wake-watcher is an explicit wake: that instance wakes **active** (reviving it first if suspended), then the shell comes online;
14:416:**BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, wire-default `Control`): `Control` to a FREE endpoint becomes controller; `Control` to a CONTROLLED endpoint is **refused with guidance** (`--view` to watch, `--take` to control) — never auto-viewer, never silent-displace; `Take` (`spt rc --take` / picker "Kick") kicks the incumbent with a **loud `Displaced{by}` notice** and full detach (not demote). The broker's per-session `OutputLog` is the fan-out hub: ONE authoritative **controller** (advances the brain-resume cursor `delivered_through`) plus ANY NUMBER of read-only **viewers**, each an isolated bounded queue + writer thread evicted on overflow (a wedged viewer never stalls the drain, controller, or child — `REQ-HAZARD-VIEWER-ISOLATION`). The controller is **no longer a *blocking* writer**: since b4 it is a NON-BLOCKING `try_send` that DROPS on a full channel (`CONTROLLER_CHANNEL_DEPTH`), so a slow controller can never throttle the drain and starve a concurrent viewer (`REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE`). Exactly-once for the controller is preserved by RE-FETCH, not by blocking: a controller that falls behind its own echo and drops frames hits a forward `output gap`, and the serve loop RESUMES-FROM-FLOOR — re-subscribes from the frozen `delivered_through` so the broker replays the dropped frames from the ring (`REQ-HAZARD-CONTROLLER-GAP-RESUME`, a re-fetch — NOT the viewer's snap, which would skip frames and violate the controller's exactly-once resume). This holds while the ring still retains `delivered_through`; a controller that falls behind a **ring-exceeding** flood (the dropped frames have rolled out of the ring) surfaces a clearly-marked data-loss rather than a silent skip or a hang (`REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND`, deferred for full graceful handling). An evicted viewer **skips to live** instead of dying silently: the broker signals the eviction (a marker distinct from session-exit EOF) and the viewer re-subscribes from the current ring floor — rate-limited so a hopelessly-behind `--view` under a sustained output flood sees intermittent live bursts (tail -f reconnect), never a frozen viewport or an evict→resubscribe CPU spin. Viewer-only, so it never touches the authoritative resume cursor (`REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT`). A viewer also tolerates a forward ring-roll gap **before** any eviction: if it falls behind the live ring under a hard flood and reads a seq past its cursor (the ring rolled the intervening frames out between reads, with no eviction marker), it **snaps to that live seq** (accept-and-advance via snap-above, armed at the initial viewer attach) instead of fataling on the gap — composing with skip-to-live, which recovers *after* eviction, and staying viewer-only so the controller keeps its strict exactly-once reject-gap (`REQ-HAZARD-VIEWER-RING-ROLL-SNAP`). Resize is **controller-exclusive** (the broker rejects a viewer's resize). The **broker is the single writer** of the perch's `driven_by` (controller node) + `viewer_count`, resolving the displaced-controller clear-race. **Controller identity is keyed on the operator node (`by`)**: a same-`by` re-subscribe (a successor re-taking the slot after a brain restart) silently re-takes — `Displaced` fires ONLY on a genuine cross-operator `Take` (the gate-#7 self-kick guard; a brain update never kicks attached operators). **Dormancy keys on the controller only** (viewer attach/detach is wake-neutral; a viewer may watch a dormant endpoint as-is). **v1: viewing is gated identically to driving** (a viewer runs the same `access_check(Unsolicited)`; the lighter distinct watch-gate is the future seam). The picker is status-conditional: a CONTROLLED endpoint offers **View + Kick** only (no plain Attach), pinned `controlled by <node> (+N viewing)`; all of View/Attach/Kick ride the SAME rc dispatch (intent is a parameter — single-bringup-path). (rc viewer letterboxing is a one-line size indicator in v1; true clip/pad needs a client grid model — deferred.)
15:422:**rc keyboard input (Windows VT translation, v0.13.0 bug 2).** On **Windows** an interactive `spt rc` console reads crossterm **key events** and translates each to **standard xterm VT** (`translate_key_event`) — arrows / Home / End / PgUp/Dn / Insert / Delete / F-keys + modifiers all reach the harness as the universal terminal contract (**agnostic**, NOT win32-input-mode; the legacy console delivers those keys as events, not bytes, so the old byte-pump left them DEAD). **Unix passes through** (its raw-mode stream is already VT; cfg-split, zero Unix change). Detach stays the **`ctrl-b d`** prefix, event-sourced on Windows. A **non-tty** stdin (piped / tests) falls back to the raw byte path (the e2e byte-injection contract). This **supersedes** the W7 `normalize_key_byte` byte-swap (KNOWN-HAZARDS 7.13 → 7.16): Backspace and Ctrl+Backspace are emitted natively by the translator.
16:538:A long-lived, one-per-machine daemon that owns the PTYs for all hosted sessions, multiplexes them (sessions addressable by name, tmux-style), and accepts attach/detach from frontends. A hosted agent session (a LiveAgent's Self, a ReadyAgent, etc.) runs *inside* a supervised PTY. **Headed** = a frontend is attached and rendering/driving the PTY; **headless** = the session runs with no frontend attached. The daemon's persistence is what lets a session keep running while unwatched and be re-attached "on a whim." *(M3b ✅ — `spt-daemon` hosts many M3a `spt-term` surfaces behind a versioned local IPC, split into a stable **broker** (holds the PTYs/children/sockets) + a restartable **brain** (all logic) so a brain swap leaves hosted sessions gapless; `spt-term` itself is deliberately single-surface-per-handle.)*
17:541:<!-- [doc->REQ-HAZARD-VIEWER-CLOSE-DETACH] -->
18:543:tab/window where the endpoint was brought up detaches only the `spt rc` attach pump — the endpoint keeps running under
19:551:daemon's own session detachment (new session, no controlling terminal) already keeps the SIGHUP of a closing terminal off
20:670:- **Resurface** re-delivers *undismissed* notifs at boundaries, gated to avoid nagging: skip if already **seen on this endpoint**, and skip if surfaced anywhere within a **global suppression timeout** (default ~1h, configurable) — the timeout is cross-endpoint so a notif can't bounce between endpoints. **Resurface boundaries** (reuse existing reported events, no new plumbing): state→active (`wake` from offline/suspended/dormant), `api boundary clear`, `api boundary compact`, and **new-session-start**. The daemon injects undismissed notifs into the activating/cleared/compacted/fresh session's context.
21:808:**dormant / suspended instance:**
22:810:- **dormant** (default, *warm*): a live, state-preserved seat whose harness session stays running → instant re-activation. The default resting state. It has **two arms**, and a dormant instance may be either: **the driver detached** (nobody is watching — the agent may still be working) **or a sibling took attention** (another instance of the id is the active one). Neither arm means the instance cannot work, and **no instance state gates a delivery window** (see *delivery window vs instance state*).
23:811:- **suspended** (opt-in, *cold*): the harness session is closed and resumed-on-wake → frees RAM/compute (and, for billable harnesses, footprint), at the cost of a resume on wake. Reached via per-endpoint opt-in *auto-suspend*, or on demand: a subcommand can **suspend an endpoint from anywhere** (any node).
24:814:- **controlled axis** — whether a **controller** is attached. Only attach and detach move it; viewers never count. It is carried per instance and replicated. It feeds auto-suspend and nothing else on the instance axis.
25:815:- **instance axis** — active / dormant / suspended / offline, moved only by the transitions below.
26:826:**Wake landing, by cause:** an explicit wake and a shell wake-watcher land **active**. A controller attaching to a suspended instance wakes it and lands it **dormant** — unless active is vacant, in which case it lands active. A stealing message lands active; the active sibling's normal message to a suspended sibling wakes it **dormant**.
27:828:**The one transition to dormant:** a sibling becoming active. Nothing else makes an instance dormant — not a detach, not idleness.
28:830:**active vacancy**: an id with no active instance. It happens when the active instance is suspended (by hand or by `enable`-mode auto-suspend) or goes offline. **Active is never passed on automatically** to a dormant sibling: a deliberate vacate most likely means *stay inactive*, and anyone who needs the id can wake an instance. The vacancy ends at the next activation trigger. _Avoid_: promoting "the next best" dormant sibling — it would hand attention to a seat nobody is working through.
29:832:**Handoff and the dormant send restriction:**
30:833:- A **dormant** instance may message **only its active sibling**. Everything else it would send — peer messages and traffic to its own shells — is refused with `SEND_REFUSED_DORMANT`, which names the active sibling and the `--handoff` way out. It can still become active through its own user input.
31:834:- **`--handoff`** is a flag on an ordinary send (it carries a body), and only the **active** instance may send it. To a dormant sibling it swaps the two. To a suspended sibling, the sibling wakes active and the sender goes dormant. To an offline sibling it is refused and the sender stays active, so active never lands on a seat that cannot take it.
32:837:- **dormant → suspended** — manual (`spt endpoint suspend` / `spt endpoint shutdown` / shell `api owner-shutdown`), *or* auto-suspend (below). A manual suspend may also hit the **active** instance, which vacates active.
33:839:**auto-suspend modes:** `disable` · `dormant-enable` · `enable`. An instance auto-suspends when it is **uncontrolled AND agent-idle** (the activity sentinel, busy|idle — the same signal the delivery window reads), **AND dormant** under `dormant-enable`, all held without a break for the timeout. Any break resets the timer. A **sole** instance is never dormant, so `dormant-enable` never suspends it.
34:841:A resting instance retains its files + last context and is re-activatable in place — a lightweight **wake** (state's already there), distinct from instantiate-anywhere's fresh spawn. Resting instances remain addressable by node (`ling@desktop`). Registry status: **active / dormant / suspended / offline** (offline = node unreachable).
35:843:**Default policy (amended 2026-09-25, INSTANCE-AXES grill):** the auto-suspend setting is a **{mode, after}** pair, and the default is **{`dormant-enable`, 15 min}**: an uncontrolled, idle, dormant instance suspends after 15 minutes. The earlier default was OFF. No shipped value had ever turned it on, so every existing value migrates to the new default, which turns auto-suspend on across the fleet at upgrade. The knob chain is unchanged: node default → endpoint override, with **operator verbs** for both (`spt daemon config auto-suspend`, `spt endpoint auto-suspend … | --inherit`), a bare form that prints the effective value and where it came from, and a public docs section. A node may still choose `enable` (a handheld / Pi / resource-constrained node) or `disable`, and an endpoint may override either way (e.g. a billable harness whose warm session holds a cost footprint). *Confirmed by measurement (M4-D9-3, `docs/DORMANCY-BUDGET.md`): an idle warm seat burns zero CPU — the cost is RSS only (~8 MiB shell-class, ~300 MiB LLM-harness-class); suspended residual is just the on-disk record.*
36:845:**Commands** (user/agent-initiated lifecycle, under the `endpoint` noun since M8-D1): `spt endpoint suspend <id[@node]>` (suspend any of your instances from any node), `spt endpoint wake <id[@node]>` (explicitly wake a dormant/suspended instance), `spt endpoint shutdown` (an agent suspends its *own* endpoint — graceful, fires the suspend boundary signoff, cascades shells offline), `spt endpoint stop <id>` (the **definitive**, ungraceful counterpart — no signoff ceremony, terminal-normalized state), `spt refresh` (spt-hosted only — an agent clears + resumes itself without stalling: `/clear` → commune capture → guaranteed post-clear resume signal so its turn restarts from immediate next-steps; see `docs/CONTEXT-MEMORY.md`).
37:855:**transition echo commune:** any active → (dormant | suspended) transition fires an **echo commune** capturing the outgoing instance's final context delta; that commune syncs to whichever instance becomes active next. This is the finer mechanism behind catch-up-on-activation (and mirrors the sister project's "echo commune before signoff" pattern — KNOWN-HAZARDS 3.3). **Exception — `endpoint stop` fires NO echo** (ADR-0045 decision 5): the echo needs a *responsive* harness, and `stop` exists precisely to work when the harness is **wedged**, so an echo-with-timeout would re-import the hang the verb exists to break. The cost is real and deliberate: **`stop` loses the final context delta**, which is why `shutdown` is the preferred verb and `stop` is the escalation. _Avoid_: "fixing" this back by adding a best-effort echo to `stop`.
38:858:**delivery window vs instance state (operator-ruled 2026-09-24, releases#341):** a busy-window (deferred, spool-only, hook-consumer) message is delivered on the receiving endpoint's own next hook-poll, **whatever its instance state**. Two unrelated axes both use the word *active*, so keep them apart: **activity** is busy|idle — the two states an adapter reports through its sentinel — and it is the **only** input to a delivery window; **instance state** is active|dormant|suspended|offline, and it selects **which instance** a bare id resolves to and may require a **wake** first. So a warm, undriven (**dormant**) endpoint drains its busy-window messages on its own next poll — being unwatched is not being unable to work, and an unwatched autonomous agent is the one that most needs its peer traffic — and a **suspended** endpoint receives them on the first poll after it wakes, because that is simply when its harness next polls. The away/return notice pair is the canonical case: it reaches the agent **while** it is away, in order. An instance-axis hold is not forbidden, only unbuilt: if one is ever wanted it arrives as its own flag on its own axis. _Avoid_: a gate that reads the rest record to answer a delivery question — the rest state machine's events (Detach / AttentionShift / Suspend / Wake / AutoSuspendTick) carry no activity input, so no reading of it can decide a window.
39:865:- **Smooth handoff (remote-control → local):** no teardown required. `git pull` brings the files; the **fresh-with-preload resume seam** preloads the other instance's latest synced context (psyche-download); the remote instance simply goes dormant. The mind follows; the files are local.
40:904:How bare `ling` resolves when multiple instances exist (amended 2026-09-25, INSTANCE-AXES grill, releases#345). Rule, in order: **node-qualified** (exact) → the **unique active instance** → the **local** instance → the **sole** instance → **refuse** and force qualification. Offline instances are excluded, and suspended ranks below dormant. The explicit override is always available. **Two qualifier syntaxes**, combinable: **subnet-qualified** `home:ling` and **node-qualified** `ling@hfenduleam` (→ `home:ling@hfenduleam`). **Multi-subnet ambiguity rule:** under node-global identity (endpoint ID below), a node on several subnets may see two *distinct* endpoints that share a bare name (a `home:ling` and an unrelated `work:ling`). When a bare `id` is ambiguous across the visible subnets, resolution **refuses and forces qualification** (by subnet or node) rather than guessing. Within a single subnet, bare ids stay unique (join-time collision check, below).
41:910:When a dormant instance is activated again, it is unobtrusively fed the latest Psyche context — newest-among-peers *and* newer than its own. Scoped by the existing Psyche-context split:
42:916:The precedence/freshness guard (KNOWN-HAZARDS 6.5) — with node identity in the marker — keeps a dormant instance's stale context from clobbering the active authoritative one.
43:966:**One per node.** A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind — so it can reason about the node's access posture) that is the designated surface for setting the **node's** control-surface modes, and — via *empower* — a **subnet's** modes. Bring-online + controller-attach requires a **same-node CLI call + a member-or-admin TOTP** for the engine-room's anchor subnet (no OS elevation). Structural locks: refuses all inbound except replies to its own outbound (**knocks and knock-codes ARE accepted**) — and that refusal reaches **every spt-authored delivery path on this node, not only the wire** (amended 2026-08-22, releases#209): a local `spt send`, an `spt ring`, or a subnet notify aimed at the seat meets the same lock, because admission is asked **once, where the message is AUTHORED**, and the seat's own session briefing is exempt by being written on a path that never crosses that site rather than by carrying anything a sender could wear. **What the lock holds, stated rather than implied:** the check runs in the **authoring process**, so it governs spt's own delivery verbs — an old or modified binary, a direct write into the spool database, or a raw TCP connect to a relay listener is same-user local code, which is outside what any spt gate claims to hold, and rows spooled before the flip drain ungated exactly once; empowered **only while a controller is attached** — detach drops its **access posture**, not its process (it refuses all inbound, drops every empowerment and stops being advertised, while the hosted session lives on and can be re-attached through the same TOTP gate; amended 2026-07-29, the literal "detach kills it" reading would re-break the attach-lifecycle invariant); `rc --view` denied even locally; remote attach denied; **local `rc --take` allowed** — on two grounds, neither of them a restart (a take displaces a broker lease and restarts nothing): the displacing controller must pass the **same bring-up gate** the incumbent did, so a take is itself a gate attempt bounded by the same failure ledger, and the displacement is **loud**, so an incumbent human cannot be silently unseated. **Revoking empowerments on take and on detach is an explicit step**, never a consequence of a restart; **not registry-advertised by default** (advertised only to endpoints it has whitelisted); **its role is SERVED FROM CORE and has no writer at all** (ratified releases#179, skeleton releases#165, KEYSTONE #182 W3): what the seat *is* — its seat line, its rule tiers, its control-surface vocabulary, its discipline — is a static, immutable value composed in-core and identical on every node, so **both** readers of role text (the resume path's `<live-role>` slice and `spt endpoint role`) serve that value for the reserved id, an on-disk `live-role.md` planted under it is ignored dead weight, and the sole writer (`spt endpoint role --overwrite`) **refuses** that id loudly and names the in-core role as the reason. This is not an exception to *role is durable identity, never written per session* but the degenerate case of it: the seat is minted by the node rather than chosen by a person, so there is nobody to author it and nothing to race. The role **composes the control-surface vocabulary from the same table, through the same composer, as the CLI's `--help` sections** (DOORBELL, releases#73; carrier moved 2026-08-19), so the seat answering node-tier requests reads the surfaces it grants in the same words the asker read them, and a surface added to the table reaches every rendering with no second edit — and it prescribes only verbs the grammar actually has, walked over its whole span. Every session start still delivers a briefing message, now carrying **per-session weather only**: the node's exact posture, pending advisory deltas, the ruleset, what *this* session was empowered for with the verbs that makes spendable (`empower`, `access-refresh`), and the seat-authority statements (one-seat lifetime, no cross-node reach, no unchosen advertisement) — and that briefing is enqueued **once per session, not once per attach** (releases#177): the endpoint keeps running between attachments, so a human who detaches and takes the seat again on the SAME live session is handed no second copy of a posture statement they already read, while a fresh session (a new bring-up, or a daemon restart that re-hosts one) briefs exactly as before. The bound is on the ENQUEUE only — a briefing whose delivery missed is still retained and re-offered at the next seat-taking attach — and its RETENTION is **session-scoped** (releases#208): a briefing states one session's weather, so when a NEW session opens, the undelivered briefings earlier sessions left behind are DROPPED at that same new-session moment, before this session's own is written. Undelivered rows only — a delivered one is history and cannot reach anybody — and the count is stated rather than deleted in silence. Without it they accumulate forever (the spool's default TTL is none) and the next session's drain hands a human every one of them at once, oldest first: measured in the field as six briefings spanning sixteen days, three asserting an empty ruleset in retired vocabulary. The ephemeral-message axis is deliberately NOT the mechanism — its deletion set is exactly the retained-row rescue's retention set, so it would destroy the briefing that failed to present, which is the one case that rescue exists for; and a time TTL is the wrong axis in both directions, since the honest scope is a session and not a duration. The intra-session rescue is untouched: the drop fires when the session is new, never between seats of one session; **the node's admin command center for access** (amended 2026-07-31, knock grill): beyond modes and node-tier rules it may read and edit **endpoint-scope** access entries across the node — the one seat for access questions and bulk rule management — though it never answers another endpoint's knocks. `endpoint purge` against it **requires elevation and resets rather than deletes**. **Ordinary lifecycle boundaries never wedge the seat** (ratified 2026-08-04 bag grill, releases#142): a harness exit (the user typing the harness's own quit) leaves the endpoint cleanly offline and re-bringable through the same TOTP gate; a session-clear/sid-rotation boundary survives re-attach; and bring-up announces empowerment only **after** the controller's attach is established — a grant line describing a controller that never attached must be impossible. Its anchor subnet and harness adapter are settable only by the **create/reset ceremony** (`spt endpoint engine-room <subnet> --adapter <id>` — one code path for both): **creation is unelevated** (the window closes at the first run; run the ceremony early), **reset requires elevation**, and **both refuse invocation by an SPT agent** (env + process-identity deny, ruled 2026-07-30 fast-follow grill).
44:970:The verb an engine-room endpoint invokes to gain authority over the named subnet's control-surface modes. The grant lasts until **session end or controller detach** (a local `rc --take` also revokes it). Verified locally — every member node holds the admin seed. **Admin bring-up auto-empowers** (ratified 2026-08-01 bag grill, releases#102): when the engine-room bring-up gate (attach *or* take — same gate) is passed with the **admin** TOTP rather than the member TOTP, the seat is empowered for its **anchor subnet** at attach, with exactly the lifetime an explicit empower would have — no new capability, just the collapse of a double-entry of the same credential. The grant is **loud**: the attach output and the session-start briefing both state the seat is empowered and how. Any *other* subnet still requires an explicit empower.
45:1058:An optional per-entry qualifier on any whitelist subject: the entry matches only invocations of that **origin class**, letting a rule say "the humans on node A, not its agents" (`ALLOW rc-surfaces, subject node-A, origin user` — agents fall through to the mode). Classification is **ambient and ceremony-free**: the sending daemon classifies the invoking process context exactly as `classify_local_origin` / the ceremony agent-deny already do — interactive terminal with no perch/broker ancestry ⇒ `user`; agent-session ancestry ⇒ `agent`; **absent or unclassifiable ⇒ `agent`** (the restrictive class — a `user` rule never admits an unknown, and N-1 senders land in `agent`). Honest limit, never to be inflated: this is the honest member daemon's report, sound against agents on honest nodes (ancestry cannot be env-scrubbed away), not against a malicious node — and a detached process spawned outside an agent's session tree can launder to `user`; defense-in-depth, not proof. **Forward design — `user-proven` (not v1):** a TOTP-gated verb mints a **pid-linked proof token** into the terminal session's environment, so every invocation from that one window classifies `user-proven` without further ceremony; rules opt into requiring it per-entry. Wax seal remains the durable, content-bound tier above both.
46:1137:**subnet attachment (attached / detached)**:
47:1138:Whether this node's daemon is **actively serving** a held subnet membership right now — pairing responder reachable, rendezvous meet listener rotating, registry gossip pumping. **Attached** = serving; **detached** = the membership record (seed) is held on disk but deliberately not served (the daemon neither advertises into nor connects to that subnet). Detachment is a *chosen* per-subnet state — `spt subnet detach/attach <NAME> [--save]` (shipped M8-D2; `--save` persists the startup default in daemon config, renamed from the once-planned `--auto`; an unsaved flip deliberately does not survive a daemon restart). A *degraded* daemon that cannot serve at all (net-less broker — endpoint bind failed) is rendered as **no connection**, never conflated with deliberate detachment. Corollary, ratified 2026-06-06: **membership implies reachability** — the membership-creating verbs (`subnet create`, `subnet join`) ensure the daemon is running, because a sole seed-holder with no responder is a contradiction of the subnet's purpose.
48:1193:**The TOTP ceremony (shipped WAX-SEAL W2, releases#21).** The whole decision runs **daemon-side** (write-through-daemon, doyle-approved 2026-08-23): the attached controller's overlay collects the code and ships the **presented code — never a verdict** — up the attach stream; the daemon verifies member-or-admin of the **binding subnet** (both seeds tried unconditionally, combined bitwise), bounds attempts on its **own** persisted ledger `trust/seal-ceremony-gate.json` (throttle before verify; separate from the bring-up and empower ledgers per the denial-of-governance rationale), and mints + saves under the same `SEAL_APPLY` serialization as the replication apply arm. The record's minter **node half is the daemon's own node-key short hex** (the roster short form, the durable ADR-0054 node spelling) — never the mutable, non-unique hostname (doyle W2 gate ruling 2026-08-23: durable evidence must cite the identity, and the pubkey is the identity). The overlay shows the human the **content verbatim and names the binding subnet** — the same byte buffer the mint hashes. Content size is the operator's three-part shape (ruling 8, 2026-08-23): capped at **500 Unicode scalar values at the ceremony seam only** (longer refuses `SEAL_CEREMONY_CONTENT_TOO_LONG`, never truncated — not a record property), the overlay **scrolls** content a small grid cannot show whole (the surface adapts, the content never shrinks), and **submit is never gated on scrolled-to-end**; content must be **valid UTF-8** (bytes nobody can read are bytes nobody can consent to — `SEAL_CEREMONY_CONTENT_NOT_UTF8`). **Esc (or ctrl-c) aborts cleanly**: no record anywhere, nothing spent on the ledger (a cancel is not a guess), the requester answered with the named cancellation — and controller detach or requester drop abort identically. A mint with **no ceremony surface** (no live session, no attached controller, or an N-1 controller that did not declare the seal-ceremony capability) refuses **fast and by name** (`SEAL_NO_CEREMONY_SURFACE`, read off the broker's live seat table — never the perch stamp) with attach-and-retry guidance; nothing is parked. The ceremony records ride the **existing attach stream** as additive variants, so local and remote controllers are **one code path**; the default-false capability bit on the attach Request is what keeps N-1 clients on the refusal instead of on undecodable records.