A RETIRED SUBCOMMAND OF `spt endpoint access` REFUSES BY NAME RATHER THAN FALLING THROUGH ITS OWN OPTIONAL POSITIONAL AND ANSWERING PLAUSIBLY. `access` takes an optional endpoint id positionally, so once `list` and `rules` stopped being subcommands (retired when the roster views replaced them) clap handed those tokens to the POSITIONAL, and the view reported `no access entities ruled for 'list'` at exit 0 -- a well-formed, confident report about an entity nobody has ever created. Found by flynn in the v0.49.0 field verify (releases#67). THE DEFECT IS NOT A MISSING ERROR MESSAGE, IT IS AN ANSWER: the sentence is TRUE of any name nobody has ruled, so it is indistinguishable from the real result for a real endpoint, and an operator or agent still carrying the old form reads it as a report and stops looking. The same failure shape as a stale carried-forward instruction -- the surface looks diligent and is wrong. MEASURED BEFORE THE FIX, and the measurement widened the filing: `rules` falls through IDENTICALLY, so the population is the retired-token FAMILY and not the one token the issue named. The node tier is NOT affected and that was checked rather than assumed: `spt node access` declares no positional at all, so clap refuses an extra argument natively. THE REFUSAL FAILS OPEN ONTO A REAL ENDPOINT. This guard is added to a path that previously accepted EVERY positional, so it is a narrowing, and a narrowing has an unruled arm: an endpoint genuinely named `list` must stay viewable. The known-target check therefore runs FIRST and wins -- a fix that made a real target unreachable would be a new defect wearing the old one's repair. Known means the access store rules it or a local perch carries the id; the store is already loaded at that point, so the check costs no read. The token match is case-folded, because an operator who typed the old verb in any casing typed the old verb. Gate: impl -- the retired-token table with its replacement guidance, the case-folded lookup, the refusal composer naming token then retirement then the working form, and the guard placed AFTER the known-target check inside the view; unit -- a decision table whose expectations are WRITTEN OUT AS LITERALS: each retired token refuses with a nonzero exit and names its replacement, an ordinary unruled endpoint id still gets the honest roster sentence (the silence the fix must not swallow), a real endpoint that happens to BE named `list` is viewed rather than refused, the casing variants refuse alike, and every token in the table is a token the current grammar does NOT accept as a subcommand -- walked against the real parser, so a token that comes BACK as a verb cannot sit here refusing itself.
       WHERE AN INVOCATION CAME FROM IS DATA THE CHAIN REASONS ABOUT, NOT A SHORT-CIRCUIT BEFORE IT. Until releases#209 the chain's step 1 was `if local, return Allow(SameNode)`, so locally-authored traffic never reached `AccessStore::decide` at all. That was invisible while local traffic was ungated, and it is exactly what would have foreclosed the operator's intra-node governance surface (releases#211) — which under the ruled shape is NOT a new tier between the per-endpoint entries and the node tier, but SELF-REFERENTIAL Node subjects at the EXISTING tiers (v1's slot-3.5 reading withdrawn in full, operator-rephrased 2026-08-22). A tier the local path short-circuits past is not a tier. So `AccessRequest` carries an `Origin` SET AT EXACTLY ONE CONSTRUCTION SITE — the chain's own — and never re-derived per call site, because a discriminant with two derivations is one that will eventually disagree with itself. THE LOCAL VARIANT CARRIES THE ORIGIN ENDPOINT ID, not merely the fact of locality: same-node governance discriminates by SENDER at the EXISTING tier-1 `SenderEndpoint` subject, so the id has to reach `decide` as part of the origin rather than be re-derived at each call site. Dropping it at construction would cost a second plumbing pass through this very seam — and releases#215 measures precisely what re-derivation costs when it is left to call sites: three feeders hand this one parameter three different value shapes, and a tier-1 rule silently cannot match on one of them. It is carried from the first commit even though nothing consumes it yet, and it is carried in the VARIANT rather than beside it so that constructing a local origin without deciding what to put there is not expressible. Its provenance differs from the wire's and the type says so: a remote sender endpoint is DAEMON-STAMPED and session-proven, while a local one is SESSION-DETECTED in the authoring process — never the caller-supplied `from`, which an explicit `--from` owns and which would admit a forged subject (KNOWN-HAZARDS 7.5, the same reasoning that keeps `from` out of tier 1). The same-node allow is DEMOTED to the chain BOTTOM, where it always semantically belonged: nothing named this traffic, so it is the same-node operation it always was. THE FIX MUST WIDEN NOTHING, and two tiers would have widened it silently if left alone. (1) THE MODE TIERS ABSTAIN FOR A LOCAL ORIGIN. A mode is a blanket posture about who may reach this node FROM OUTSIDE it; `closed` has never in this codebase's history been asked about traffic authored on this machine, because such traffic never reached the function. Letting the modes answer now would convert every `closed` posture in the field into 'and also stop the agents on this box talking to each other' — the hole-punch failure arriving through a door nobody opened deliberately. (2) A LOCAL ORIGIN CARRIES NO SUBNETS. This node is a member of its own subnets, so handing them in would let a subnet-wildcard DENY — written to keep some peer group out — begin refusing locally-authored traffic the moment that traffic reached the chain. Only rules that NAME the local origin explicitly speak about it; everything else falls to the same-node bottom, so today's local behaviour is preserved BY CONSTRUCTION rather than by inspection. A STORE DEGRADE MUST NOT CLOSE THE NODE IN ON ITSELF: ADR-0053's fail-closed refusal protects the node from the network, and applied to local traffic it would stop the agents here talking to each other every time `access.json` was mid-write, so a local origin takes the chain bottom on a degrade. The engine room is unaffected by that arm — its lock is step 0, above all of this, and its own posture read is independently fail-closed. A NODE WITH NO IDENTITY reads as local: nothing can be proven remote either, since a wire arrival carries a handshake-proven hex by construction (REQ-HAZARD-WAN-ORIGIN-AUTH), so an empty origin can only have come from a local authoring path — and that is also the fail-open direction for the same-node hole-punch. THESE SEMANTICS ARE NOT DECIDED HERE. This requirement owes #211 a reachable slot and a carried subject, nothing more: the ORIGIN AXIS and the local sender it carries. NO NEW TIER AND NO MODE TWIN ARE OWED — the v1 shape (a slot 3.5 with a mode twin 6.5, whose twin would refuse local traffic rather than abstain) is WITHDRAWN IN FULL, operator-rephrased 2026-08-22: #211's intra-node governance is SELF-REFERENTIAL Node subjects at the EXISTING tiers, rules-only, with modes-only-abstain staying exactly as this requirement built it. The ER lock stays at step 0 regardless, because same-node governance is a rules surface and never a replacement for the ratified engine-room semantics. Gate: impl — the `Origin` axis on `AccessRequest` set at one site and carrying the local sender id, the mode-tier abstention, the empty local subnets, the demoted same-node bottom, and the local degrade arm (the v1 slot markers are NOT part of this requirement's evidence and are removed with the withdrawal above — a marker describing an unbuilt tier certifies a design, not an implementation); unit — the hole-punch negatives with a CONCRETE adversary rule in the store (a subnet-scoped DENY present, and a closed node mode present, and a local send still admitted under each), plus a remote send under the same store still refused, which is what proves the abstention did not simply disable the tiers rather than scope them. Kin REQ-ACL-SUBJECT-CHAIN (the tier order this inserts into), REQ-ER-INBOUND-LOCK-ALL-PATHS (the lane that needed the axis), REQ-SEC-1.
       ADR-0053'S FAIL-CLOSED HAS A WRITE SIDE, AND IT IS ENFORCED AT THE SAVE SEAM RATHER THAN AT THE MUTATION CALL SITES. `load_checked` split NotFound from corrupt and the gate refused a husk correctly -- but the store is READ-MODIFY-WRITE at every path that edits it, and `AccessStore::load` is `load_checked_from(..).unwrap_or_default()`, so a degrade was swallowed into an EMPTY document. The consequence inverted the guarantee (releases#57): the gate refused unsolicited traffic, and then the first `spt endpoint access` command an operator ran to investigate the refusal saved that empty document over the damaged file -- permanent rule loss, and a posture that flipped from degraded-closed to open-with-one-rule. The boundary held exactly until someone touched the CLI, and the command most likely to be run is the one an operator reaches for BECAUSE the gate is refusing. THE SWALLOWED DEGRADE IS THEREFORE CARRIED ON THE DOCUMENT (`StoreOrigin::Degraded`, `#[serde(skip)]`, never part of the record) AND `save_to` REFUSES IT. This placement is the requirement, not an implementation detail: converting the nine production mutation call sites to `load_checked` closes the population that exists today and leaves the next read-modify-write path free to re-open the class -- the same shape of defect as REQ-SEC-REPLY-EXEMPTION-SEND-LEG's per-caller write, which shipped inert because a rule satisfied by remembering to is satisfied until someone forgets. Every write of this document funnels through `save_to`, so a refusal there binds call sites that do not exist yet, and an audit is not what holds it. The call sites ARE converted as well, for the diagnostic: a refusal at the load names the store before anything is attempted, which reads better than one raised by a save the operator already believes succeeded. FRESH IS NOT DEGRADED: a document constructed in memory -- the minted baseline, a test fixture -- stands in for nothing on disk and stays writable, so mint-on-first-absence (the split that keeps an unconfigured fleet reachable) is untouched. The refusal names the store path per ADR-0053, names the cause, and names the way out, which is real rather than rhetorical: a store the operator MOVES ASIDE is re-minted empty by the next command, so starting from empty stays available as a deliberate, loud choice -- which is precisely what silently rewriting it from empty was not. Gate: impl -- `StoreOrigin` on `AccessStore` set by the loaders (`load_from` marks the swallowed degrade, `load_checked_from` marks a parsed store `Loaded`), the `save_to` refusal in the single voice of `husk_write_refusal`, and the nine production mutation sites loading checked (cli.rs `endpoint access` allow/revoke/open + subnet-mint capture + endpoint purge, api/engineroom.rs `enforce`/node-mode/node-surface-mode, daemon pairhost.rs join-time capture); unit -- a decision table over the three origins whose expectations are WRITTEN OUT rather than derived from the code under test, asserting on-disk bytes and not merely the returned Result: a husk-derived document refuses the write and the damaged file survives BYTE-FOR-BYTE, a loaded document's read-modify-write preserves the rules it did not touch, a fresh document writes, and the refusal names the store path.
       THE PRECISE `access allow` IS A RULE VERB; THE POSITIONAL ONE IS A RULE+POSTURE VERB -- and the precise arm therefore says so at write time rather than leaving the operator to discover it. releases#196 asked whether the flag spelling should also close an endpoint's posture on its first rule (the v1 semantic `restrict_if_unset` carries, which the positional arm re-applies explicitly). RULED HORN B (doyle 2026-08-21, on a census read at b88fab2a): default-open-until-explicit-close IS the shipped T6 semantic, the mutation seam stays POSTURE-BLIND, and what was missing was never the close -- it was any signal that a rule written onto an unrestricted endpoint changes no verdict. TWO STRUCTURAL FACTS DECIDE THIS RATHER THAN A PREFERENCE. (1) A CLOSE CANNOT LIVE AT THE SEAM: `tuple_mutation` is shared by the endpoint precise arms AND the engine room's node-wide seat including its per-endpoint `--for` form, and below it `apply_mutation` is also the seam for knock-answer, redeem and the knock store -- so a close in `apply_mutation` would fire on every approved knock and every redeem, and a close in `tuple_mutation` would have the engine room closing another endpoint's posture as a side effect of writing one rule for it, while being meaningless for `MutationScope::Node` (`restrict_if_unset` is per-endpoint by construction). A posture close is a CLI-ARM opinion either way; it is not, and cannot be, a property of the seam. (2) THE CODEBASE ALREADY RULES THE INERTNESS IN BINDING GATE CODE: `may_grant_node_subject` derives the unset grant-nodes policy from `effective_posture` with the premise stated in its own comment -- open implies permitted, because an allow entry on an open surface punches no hole. Closing the posture inside the very command that policy gates would falsify that premise one statement later, so horn A would have owed a re-ruling of the grant-nodes policy and was never the one-line change it reads as. WHAT THE NOTICE IS. On an operator-driven precise allow, and BEFORE the write, the chain is ASKED -- `decide()` per covered surface, per admitted origin class, at every concrete origin there is to ask about -- and if it already allowed that subject everywhere, the acceptance is followed by a sentence saying the rule stands and changes no verdict today, naming the lever that would make it bite. NEVER A REFUSAL: pre-positioning a rule before a later close is legitimate and common, and a verb that refused it would be wrong more often than the silence it replaced. ASKED, NEVER RE-DERIVED: the condition is the chain's own verdict and not a scan of rule rows, the doctrine `node_still_sees_endpoint` and `fork_without_discover` already carry -- a row scan would miss a per-surface close, count a row naming a different subject, and become a second definition of a verdict the store owns. AN ABSENCE IS NEVER A VERDICT: a subnet subject with no roster members, and a sender-endpoint subject that resolves to no machine this node knows, have NO origin to put the question to, so they get a NAMED ABSENCE saying the question was not answered -- never the word inert, which would render a missing measurement as a finding. A subnet subject with members is inert only if EVERY member reads inert. THE FIRING POPULATION IS DECLARED AND PINNED, not left to placement: operator-driven precise ALLOW upserts on an endpoint scope, and nothing else -- the engine room's `--for` seat is excluded by the seat flag the caller already passes, removals and denies are excluded by op and decision, and knock-answer and redeem never reach this body at all. NO NOTICE ON DENY THIS LANE (doyle, ruled): deny is the fail-closed direction, an inert deny pre-positions defense at zero cost, and the narrowed-deny shape is un-censused. POSTURE-NEUTRALITY IS PART OF THE CONTRACT AND IS PINNED AS SUCH: the precise arm leaves `modes` exactly as it found them, which was true at b88fab2a and untested in either direction -- a ruling no test can falsify is a ruling that survives its own reversal. Gate: impl -- the population predicate, the chain-asked probe over resolved origins and its named-absence arm, the notice line naming the lever, and the call site before the write inside the precise arm; unit -- a decision table whose expectations are WRITTEN OUT AS LITERALS rather than derived from the predicate under test: an allow onto an unrestricted endpoint reads inert, the SAME allow shadowing a node-scope deny reads NOT inert (the hole-punch negative control -- the case the notice must stay silent on), a rule whose surfaces are only partly refused reads not inert, an empty subnet reads NAMED ABSENCE and never inert, a subnet whose members split reads not inert, and the population predicate admits the operator's precise allow while refusing the daemon seat, the removal and the deny; int -- the real binary against a real store: a precise allow leaves the endpoint's posture EMPTY (the literal partition, not a value read back from the code under test) and prints the notice, the positional spelling beside it still closes the posture and prints NO notice, and the NEGATIVE POPULATION PIN -- a rule written through the knock-approval path prints no notice at all.
  [OK] REQ-ADAPTER-CHANGELOG  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int
       F-034 leg a (perri/hertz field finding 2026-07-09): the ADAPTER_UNRESOLVED refusal hint must print a WORKING command form. It currently says 'pass --adapter <name[:profile]>', but --adapter is a `spt api` GROUP flag, NOT a `listen` flag — following the hint literally (`spt api listen <id> --adapter <name>`) produces clap `error: unexpected argument '--adapter'` (exit 2). Fix: the hint prints the group-level form, e.g. `spt api --adapter <name> <cmd> …` (a hint the operator can copy-paste and have work). Gate: the ADAPTER_UNRESOLVED message text carries a clap-VALID invocation (group-level --adapter placement) — a unit asserting the hint string parses under the api clap grammar, or at minimum places --adapter before the subcommand. Pure UX/hint-correctness fix, no behavior change.
       REGISTRY-LIFECYCLE W1 (ADR-0040 rider; dropped THE-FORKENING W4 rider escalated — hertz re-measured live 2026-07-17: 61.29 MiB/s predicted vs 63.91 observed, 15.5%/core): the brain executable self-hash is captured EXACTLY ONCE per brain process (OnceLock in run_brain before the heartbeat loop); every write_ready reuses the cached value; failed capture stays None with no per-tick retry; current_exe_hash doc-comment corrected same commit. Once-at-start capture IS the resident-bytes truthfulness contract: the per-tick PATH re-read published the NEW file hash from a resident-OLD-bytes brain post-swap (breadcrumb lie in the enlyzeam class it exists to catch). 500ms ready-write cadence unchanged. Gate: impl — cached capture; unit — injected digest-counter==1 across initial+N heartbeat publishes with pid/generation/hash stable, fresh process fixture computes independently; existing D7 process-replacement e2e retained green (new brain publishes new hash first write).
       NO CI step that RELINKS a workspace binary runs while an earlier phase's leaked binary is still executing from the same target. (BAROMETER golden triage, hertz RCA 2026-08-02, releases#123.) THE DEFECT THIS CLOSES IS PLACEMENT, NOT MECHANISM: REQ-CI-POSTJOB-DAEMON-REAP's reap already kills exactly the right processes with exactly the right scoping, but it is the LAST step in the job, so it runs after every step it would have saved. Windows cannot overwrite a running image, so a leaked `spt.exe` from Phase A/B makes the next `cargo test -p spt --test <x>` die with 'failed to remove file ...\target\debug\spt.exe: Access is denied. (os error 5)'. EVIDENCE, twice out of twice on the same head: golden 30754060525 and 30758010357, both Windows `test` jobs — job-start census scoped=0 (so the leak is generated IN-job, not inherited), pre-reap census scoped=4 with the same handle-count signature both runs (two ~258-260 daemons + two ~134 brains), job-end reap killing 4 and 3 respectively AFTER the job had already died of them. The second run also shows the masking: run 1's Phase-A red hid this, and every run that survives Phase A dies at the notify relink instead. THE FIX IS CLASS-SHAPED: the guard rides EVERY relink-after-an-E2E edge (notify, installer, docs-drift, and the two-host gated-CLI step in twohost-a), not only the edge that reddened a run. ONE PREDICATE OVER ONE POPULATION: it is the same reap-census script under a `prerelink` phase, so a mid-job reap can never classify a process differently from the job-end reap; the pre-existing inline `Get-Process | Stop-Process` before the docs gate is REPLACED by it rather than left as a second, weaker rule (it scoped by GITHUB_WORKSPACE alone, missing CARGO_TARGET_DIR/RUNNER_TEMP/n1-cache roots, re-verified nothing at kill time, and printed no evidence). Census labels carry the phase (`prerelink-pre-reap`, `prerelink`) so a mid-job census is never counted as an end-of-job one by the strict-mode trigger. STRICT STAYS AN END-OF-JOB MECHANISM: a prerelink survivor warns and never reds its own step, because the relink it guards is the very next step and fails with the exact file it could not remove — a louder and more specific signal than a reap step exiting 1. WINDOWS-ONLY BY CONSTRUCTION: Linux replaces a running exe happily; role B (Linux) of the two-host pair needs no guard. Gate: impl — the `prerelink` phase in .github/ci/reap-census.ps1 plus its four wirings in golden.yml. No unit stage, for REQ-CI-POSTJOB-DAEMON-REAP's stated reason: the evidence is a recipe the runner executes and the acceptance is read off the run log (a `CI-REAP-PRERELINK summary:` line before each relink, and no os-error-5). Kin REQ-CI-POSTJOB-DAEMON-REAP (same machinery, the other placement), REQ-CI-WINDOWS-PHASE-A-BOUND (the co-tenant load leg).
       MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-conn lifecycle record is ATTRIBUTABLE — the W6 RCA's terminal undecidability (per-line 1:1 CONN_WRITE_POISONED churn = fresh-carrier churn OR stderr interleave artifact) exists because records carry no stable conn identity, no role/endpoint/session context, and no timestamps, and the once-per-conn poison latch hides multiplicity. THREE LEGS. (b) IDENTITY: mint a stable per-physical-conn id (monotonic u64 at conn construction — Arc::ptr_eq is the only identity today and it does not survive a log line) plus subscriber role and endpoint/session where known, stamped on CONN_WRITE_POISONED, CONN_WRITE_RETIRED, logical stall-evict, attach/resume/detach, and write-retirement records (RCA attach sites: presence nethost.rs:379, stream nethost.rs:258, controller broker.rs:891, viewer broker.rs:1073). (c) TIME: daemon stderr correlation records carry wall-clock AND monotonic timestamps (stderrlog has neither; broker+brain share one file — interleave is unresolvable without them). (d) LIFECYCLE (doyle-confirmed UNCONDITIONAL, not debug-gated): one BOUNDED set of per-conn lifecycle events — write start/timeout-cancel/transport close/writer exit/replacement-reattach (hertz RCA fix-shape items 1-3). Constraint (doyle LOCK): the split/attribution must not REDUCE total information, only correct its attribution; NO timeout-value changes; NO suppression-as-fix. Gate: unit — lifecycle records carry conn id + role + timestamps; the id is unique per physical conn and stable across that conn's records. Kin REQ-CONN-POISON-DIAL-SCOPE (leg a, the token split these fields ride on), REQ-CONN-BLACKHOLE-LIFECYCLE-HARNESS (leg e, consumes these records), REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK (behavior invariant preserved).
       RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-1318 + 1334-1347): each rc invocation/attach stream mints a UNIQUE controller lease id carried through SubscribeReq, the controller slot, and Input/Resize; node identity stays separate as attribution/access policy only. The ONLY silent successor/replay case is same-lease + equal-or-newer generation (ADR-0038 fix-6 dispatcher-recovery contract preserved exactly); same node + different lease = DISTINCT controller. Explicit Take on a distinct incumbent lease ALWAYS revokes loudly AND authoritatively — atomically revoke/fence the old lease and FORCE its attach stream closed, then install the taker, regardless of whether by-node strings match; the Displaced notice is best-effort (today old.tx.try_send at broker.rs:1342-1345 can DROP the notice on a Full queue while become_controller still replaces — the revoke/close must land even when notice enqueue fails; the closed stream is itself the terminal signal rc's PumpEnd::Displaced/EOF path handles). Today same_identity keys on controller_by()==by alone, intent never consulted; two same-machine windows collapse to one identity and --take silently swaps the sink leaving the incumbent input-capable but blind. Acceptable identity seam: (by, nonzero attach generation) as the logical lease. GENERATION LADDER (doyle ruling 2026-07-18, resolves fix-6/Busy conflict at T6): within the SAME by — equal gen = silent successor (dispatcher recovery, unchanged); STRICTLY NEWER gen (Control or Take) = loud+fenced supersession (full W2 revoke — without it a live replacement viewport bounces Busy off a stale-replay worker serving a zombie stream forever = post-restart lockout, fix-6 order-independence regression); OLDER gen = refused Busy (unchanged). Across DIFFERENT by: Control = Busy, Take = loud revoke. Deliberate UX: a second same-node window's plain rc loudly displaces the first (pre-W2 did the same replacement SILENTLY with the loser blind-but-interactive; loud+fenced strictly better; --view = coexistence). redispatch_stall T6 must stay green UNMODIFIED. N-1: lease field additive; absent lease (older client) degrades to legacy node-identity semantics for that subscriber. Gate: impl — lease mint + carry + loud distinct-lease Take; unit — same-lease equal/newer gen stays silent, same-node different-lease Take displaces loudly, older-gen replay still refused busy; int — hertz regression steps 1-4 + 7-8 (A gets Displaced{by} + terminal stream completion, output reaches B only, metadata identifies B, one controller slot; separate equal-lease replay test proves dispatcher recovery stays silent); doc — ADR-0044.
       REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 1+5): the opener ring-peek fallback fires ONLY on the explicit UnsupportedVerb/old-broker answer — transport timeout/EOF/poison classify Failed and requeue bounded, NEVER a second replay subscriber (today first_line's Err(_) arm at dispatch.rs:414 catches everything; the comment intends old-broker-only). Retries are CLASSIFIED: pre-setup transient may retry; a deadline-poisoned replay is CIRCUIT-BROKEN (global backoff) and a replacement subscriber is never installed until the prior subscriber is fully gone. NOT a revert to the v0.33 burn-the-claim abandonment (rejected): the stream must recover after the breaker window — show it in test. Gate: impl — narrowed fallback arm + breaker; unit — timeout/EOF/poison never reach the peek path while unsupported-verb does + breaker trips and resets + no-reinstall-until-gone; int — T2 (no peek subscriber created on transport errors) + T5 (breaker recovery, the not-abandonment discriminator) + T7 mixed-image N-1 with REAL traffic-carrying streams (handshake-only insufficient); doc — ADR-0038 Amendment. Kin REQ-DISPATCH-CLAIM-RETRY (upgraded, not reverted), REQ-STREAM-OPENER-DURABLE (the N-1 window it narrows).
       The engine room's attach surface is locked by INTENT: rc --view is denied even same-node, remote attach of any intent is denied, and local --take is allowed (ADR-0052 decision 3). Viewing is denied because a read-only spectator on the surface that renders access rulesets is an information leak with no operator benefit — and because the same-node loopback allow precedes the resolution chain, this must be an explicit engine-room carve-out rather than a rule row that the loopback shortcut would skip past. Local take is allowed on two grounds, neither of them the original 'it forces a harness restart' (it does not — a take is a broker lease displacement and restarts nothing): the displacing controller must pass the same bring-up gate the incumbent passed, so a take is a gate attempt and is bounded by the same ledger (REQ-ER-BRINGUP-ATTEMPT-BOUND); and the displacement is LOUD, so an incumbent human cannot be silently unseated. Gate: doc — ADR-0052 decision 3 and the section 3a amendment; impl — the intent-keyed engine-room carve-out ahead of the chain, the remote-attach refusal, and the take path's gate pass plus empowerment revocation; unit — same-node view denied, remote attach denied for every intent, local take admitted only after a gate pass, and a take revoking empowerments.
       Every engine-room session opens with a system-authored briefing message stating the node's exact current access posture, any pending advisory-gossip deltas, the current ruleset, the session's empowerment with its spendable verbs (empower, access-refresh), and the seat-authority statements (one-seat lifetime, no cross-node reach, no unchosen advertisement) (ADR-0052 decision 3 and decision 6; doyle ruling (e) 2026-07-29). AMENDED BY REPLACEMENT in the KEYSTONE #182 W3 lane (doyle ruling on releases#179, 2026-08-19): capabilities and responsibilities LEFT this requirement and became the engine room's durable in-core role (REQ-ER-ROLE-STATIC-IMMUTABLE), because they are static facts about the seat rather than per-session weather. The replacement is recorded here rather than annotated because a partition ruling falsifies the requirement's own ratified sentence, not just the code beneath it — a refactor UNDER a requirement is a different act from one that makes its sentence false. What stays is the per-session half: a minded governance surface is only as good as what it knows at the moment it acts, and posture is per-session state — which is why the briefing is a message spooled at bring-up under a reserved system author, NOT the endpoint's durable role text. THE BRIEFING WRITES NO ROLE TEXT: that pin is unchanged and is more load-bearing after the partition, not less, since the engine room's role now has no writer at all. The message spool is already core-side, harness-independent data that any adapter renders as ordinary inbound, so the briefing needs no harness-specific cooperation — the boundary rule holds by construction. EXTENDED for releases#177 (doyle dispatch 2026-08-19): the cadence this sentence always named is now enforced at the ENQUEUE seam — a session opens with a briefing ONCE, not once per seat-taking attach. The endpoint keeps running between attachments, so the pre-#177 product re-briefed a human who detached and came back to the SAME live session with a posture statement they had already read; "every session opens with a briefing" was true of the first attach and false as a cadence. A FRESH session — a new bring-up, or a daemon restart that re-hosts one — briefs exactly as before, which is why the bound lives on the broker's per-session log rather than in an on-disk last-briefed record: such a record would keep suppressing across a daemon restart whenever the harness outlived the broker and kept its session id, silencing the one case that must still brief. CONDITION IS NOT CADENCE: nothing here changes what a briefing says or when one is composed. The bound is on the ENQUEUE ALONE and never on delivery — REQ-ER-BRIEFING-PRESENTED clause 4 rules that a briefing whose presentation missed is retained and re-offered at the next seat-taking attach, so gating the presentation call on "did this seat enqueue" would fix #177 by re-breaking #164. Gate: doc — ADR-0052 decision 3's briefing clause and the CONTEXT.md engine-room entry; impl — the briefing composer reduced to per-session facts, spooling at bring-up under a reserved system author; unit — bring-up spools exactly one briefing carrying current posture, pending gossip deltas, the ruleset, the session's empowerment with its spendable verbs and the seat-authority statements, and no role text is written, AND a second seat-taking attach on the same session spools no second briefing while the first one still lands in that same run (the positive control that keeps the green from being a green nothing could red); int — a real second seat on a running engine-room session, pinned to be the same session by its session id, adds no briefing row.
       A DEDUPE KEY NARROWER THAN THE RECORD'S IDENTITY SILENTLY DESTROYS A SIBLING. Re-arming a mutual pre-authorization REPLACES rather than stacks, so a re-knock cannot accumulate duplicate reverse grants -- but the identity that replacement tests is `(kind, key_id, OWNER)`, never `(kind, key_id)`. A single code id is legitimately shared by TWO pre-authorizations with different owners: the MINTER's, armed at mint, whose subject is empty because no redeemer exists yet, and the REDEEMER's own, armed at redemption, whose subject is known. Keyed without the owner, arming the second would find the first and overwrite it in place, and one side of an agreed two-way would simply VANISH -- no error, no refusal, no second grant to notice missing; the surviving side would look entirely correct on its own. The dedupe is not wrong to exist, it is wrong when its key is narrower than the thing it is deduplicating, and the narrower key is the one a reader reaches for first because `(kind, key_id)` is how every OTHER seam here addresses a pre-authorization. The asymmetry with the consuming seam is deliberate and must not be 'fixed' into agreement: `consume_redeemed` filters on `(kind, key_id)` WITHOUT the owner precisely because a redemption must make BOTH siblings due at once, while `armed_mutual`/`consume_mutual` serve the knock keyspace, where only the knocker's single record exists. INVARIANT: any replace-in-place keyed lookup states the FULL identity of the record it replaces; where a key is deliberately narrower than a record's identity, the seam says why and a test pins that two records sharing the narrow key both survive. Gate: doc -- the KNOWN-HAZARDS entry stating the sibling mechanism and the deliberate arm/consume asymmetry; impl -- the owner-inclusive match in the arming seam; unit -- two pre-authorizations sharing one code id under different owners both survive arming and are BOTH made due by one redemption, with a bystander code untouched and a replay finding nothing left.
       Serving-registry writers in the broker, brain TTL reaper, and live-daemon test fixtures serialize the complete fresh-load, mutation, snapshot side effects, and durable publication across processes using one stable per-registry sentinel. Atomic replacement alone must not erase acknowledged registrations or persisted name-allocation history. Lock acquisition failure never permits an unlocked write, and process exit releases the lock. Both writer binaries must participate; a brain-only update paired with an old writer broker does not close the race (releases#308).
       RC-RENDER-TRUTH W2 (ADR-0044 decision 3, hertz same-machine --take split-brain RCA P0-C + scope clarification, doyle seam-verified broker.rs dispatch_input 3920-3935 session-addressed unfenced): broker-enforced input fencing SCOPED TO RC-ORIGIN INPUT — RC Input/Resize bind to the ACTIVE controller lease (or originating broker connection as the N-1 surrogate); commands from a displaced/stale lease are rejected/dropped after replacement. Do NOT globally gate generic KIND_INPUT: shell/system injection legitimately sends InputReq from non-controller connections (Minter::Shell, shellchan seam) — fence keys on an additive controller-ownership token validated only for token-bearing/Minter::Rc requests, or a dedicated guarded RC-input verb; token optional/default-none preserves generic injection exactly. REQUIRED DEFENSE, not optional hardening: this is what makes the at-most-one-input-capable-controller invariant TRUE even when the Displaced notification is delayed or lost (today the displaced window keeps typing into the PTY indefinitely — the field split-brain). Gate: impl — token/verb + lease-bound validation on the RC input path; unit — stale-lease RC input rejected post-replacement, active-lease applies, tokenless generic injection (shell) UNCHANGED, absent-lease N-1 falls back to connection fencing; int — hertz regression steps 5-6 (post-takeover Input+Resize from A mutate NOTHING, from B both apply) + shell injection still lands mid-controlled-session; doc — ADR-0044.
       Adapter command templates resolve their program against the adapter's install dir BEFORE PATH: a `.spt`-shipped binary (dropped to adapters/_github/<safe>/ by --release/--github acquisition, or kept in the source_dir under copy-mode where only manifest+strings/ are copied to adapters/<name>) runs without any PATH placement — a bare-name template token (e.g. `claude-spt-digest ...`) is rewritten to <install_dir>/<program>(.exe on Windows) when that file exists, else left bare for the PATH fallback. Makes a `.spt` self-contained (closes the --release bundled-binary gap perri confirmed) (v0.7.4)
       Windows inbound reachability: the install path RECONCILES the product inbound-UDP firewall rule onto the binder it places — create when missing, REPOINT when the rule names a different image, and report which it did — and the daemon self-detects blocked inbound and renders it as the no-connection state in subnet status + the coming-online banner (covers user-scope installs that skip the elevated leg — never a silent NO_SEED_HOLDER dead-end) (M8 root cause 3). AMENDED BY REPLACEMENT (releases#173, doyle ruling 2026-08-21): the previous title said the elevated leg REGISTERS the rule, which is create-only and describes half the behaviour. A program-scoped rule admits exactly one path, so the moment the binder can move is the moment the rule can go stale — and a stale rule reads GREEN BY NAME while inbound is dead on the Public profile (KNOWN-HAZARDS 7.61; field specimen 2026-08-06, a rule naming an actions-runner debug exe on a node whose installed binder serves, still reproducing at c62904e7). REPOINT-IF-DIFFERENT IS THE LOAD-BEARING ARM and create belongs to first install: an update swaps the binary in place at the same canonical path, so the program scope does not change and the reconcile is a no-op in the common case. SCOPED TO THE PRODUCT-NAMED RULE ALWAYS — the probe queries by name and the repair deletes by name, so dev and CI rules naming spt images on the same box are never read and never touched; they can be load-bearing for runner jobs, and a delete-by-image sweep would read as tidying while eating one. Elevation unavailable degrades LOUD and NEVER FATAL: the rule is left exactly as it was and the operator is handed the exact command, because a placed binder with a stated reachability problem beats a refused installation. The durable verdict is NOT written by the installer — the inbound record is pinned to the binder pid AND image (REQ-INBOUND-VERDICT-RECORD-BINDER-PINNED), so a record authored by a short-lived installer re-derives as Unknown for every reader, which is the self-erase class releases#172 closed; the verdict stays the daemon's to write at bind. Gate: doc — the CONTEXT.md install entry stating that placement reconciles the rule and what happens unelevated; impl — the pure reconcile decision seam, its thin netsh effector, and the call at binder placement; unit — the four decision cases (missing, correct, stale path, cannot-elevate) decided with no netsh and no privilege, plus a named cell proving a reconcile never reaches a rule it was not asked about.
       Explicit, loud controller displacement: `spt rc kick <target>` / `--take` (Take intent) kicks the incumbent controller and becomes controller; the displaced controller receives a LOUD `Displaced{by}` notice and is FULLY DETACHED (not demoted to a viewer). A default attach to a controlled endpoint is NEVER a silent displace (it is the Control busy-refusal). An old (N-1) rc omits intent → Control, so it can drive a free endpoint but CANNOT `--take` — it can never silently steal, and gets a clean busy-refusal instead. Taking control rides the same access_check(endpoint, origin, Unsolicited) as a normal control attach (if you may drive, you may take — no elevated kick policy). The picker surfaces 'Kick <node> and attach' (Take) only on a controlled (blue ■) endpoint, via the existing attach dispatch (single-bringup-path: intent is a parameter).
       DIRECTIONALITY IS SENDER-DECLARED, AND ONLY SENDER-DECLARED (ratified 2026-08-04 bag grill, releases#144 / ADR-0055). The reach-REQUESTING surfaces — `spt knock <target>`, `spt knock send` and `spt knock redeem` — take a MANDATORY, MUTUALLY EXCLUSIVE pair, --send-only | --send-receive, with NO default: a bare invocation refuses loudly naming both, and naming both together refuses as opposite answers to one question. The declaration names what the DECLARER'S OWN SIDE does — --send-receive arms the declarer's own inbound to the counterparty, at answer-receipt for a knock and at redemption for a code, and nothing more. The RECEIVER verbs `knock approve` and `knock new-code` carry NO directionality flag at all: accepting IS the receiver's own-side act, so there is nothing further for them to declare, and the `approve --mutual` COUNTER-KNOCK IS REMOVED RATHER THAN RENAMED — a receiver who wants reverse reach knocks back, because the counter-ask is the knock verb's own job and a rider on approval duplicated it with a second grammar. VOCABULARY: send-only and send-receive are canonical; mutual and one-way are RETIRED from every user-visible surface — help text, refusals, stdout claims and the published guide alike — because 'mutual' misdescribes an act that only ever opens the declarer's side. MIGRATION IS A CLEAN BREAK WITH A SPEAKING REFUSAL: --mutual and --one-way are parse errors that NAME the flag which replaced them and the seat they were typed at, never clap's bare unexpected-argument, and there are no deprecation aliases (an alias keeps the retired mental model alive in scripts and agent habits). THE RENAME IS THE USER-VISIBLE SURFACE ONLY: store and wire field names are untouched, and PRE-AUTHORIZATIONS ARMED UNDER THE OLD FLAGS STAY HONORED — a record armed before this change still consumes through the answer-receipt path and still opens the reverse it was armed for. Gate: doc — the CONTEXT.md knock/knock-code directionality sentence and the mutual-whitelisting entry corrected by replacement so no entry states the retired seats, plus the published knocking guide; impl — the mandatory mutex at the bare form, `send` and `redeem`, the absence of any directionality argument at `approve` and `new-code`, the removal of the counter-knock path, and the retired-flag refusals; unit — a bare requesting invocation refuses naming both new flags, each flag ALONE is accepted, both together refuse, `approve` and `new-code` refuse the directionality flags outright, a retired flag's refusal NAMES its replacement at every seat that carried it, no user-visible string on the knock family carries the retired vocabulary, and — the load-bearing row — A PRE-AUTHORIZATION RECORD ARMED UNDER THE OLD FLAGS, DECODED FROM ITS SHIPPED BYTES RATHER THAN BUILT BY THE NEW CLI, STILL CONSUMES THROUGH THE RECEIPT PATH AND STILL OPENS ITS REVERSE, with the store and wire field names it names unchanged.
       A KNOCK REACHES AN EVIDENCE-KNOWN PEER THAT RESOLUTION CANNOT FIND, exactly as an ordinary send already does. `knock_send_remote` returned `NotFound` the moment `resolve_across_visible` did, while the message leg at the SAME resolution point fell through to the node-tier evidence route (REQ-UNLISTED-EVIDENCE-ROUTE, DOORBELL W3): an undiscoverable target was therefore UNKNOCKABLE WHILE STILL SENDABLE -- the one door whose whole purpose is to be knocked on was the one that was closed, and a knock is precisely how a stranger asks to be admitted. IT IS ALSO THE N-1 INTEROP LEG OF releases#180 AND LOAD-BEARING, NOT COSMETIC: a peer on a pre-#180 build still applies its blanket-closed posture to DISCOVER and will not advertise, so flipping OUR default cannot make THEM knockable, and without this arm #180 buys nothing against the installed fleet. THE ARM IS THE MESSAGE LEG'S, NOT A SECOND MECHANISM: the same `unlisted::route_node_for` over the same `raw_evidence`, consuming the same field (the node key) the message leg consumes, and the ASKER'S OWN EXCLUSION IS RE-IMPOSED AT THE ARM with `excl.anywhere()` -- the same source the resolve path's predicate came from -- because resolution's own check lives INSIDE the call this arm has already fallen out of. NOTHING ABOUT ADMISSION MOVES: the TARGET's access gate rules this hop at the owner's own seam exactly as it rules every inbound today; routing on evidence is not circumventing hiddenness, because the invitation IS the consent. `KnockSendOutcome::Excluded` is minted as the message leg's `WanSendOutcome::Excluded` sibling so an exclusion refusal NAMES THE BOUNDARY AND WHOSE IT IS instead of collapsing into `NotFound` and sending the operator hunting at the far end for a decision they made at this one -- and it is deliberately NOT a landing: it must not take `NotFound`'s local-inbox fallback, since recording the ask locally would write a row against a boundary the operator themselves drew (releases#145's defect in a new costume). Gate: doc -- the CONTEXT.md evidence-route entry extended to name the knock leg and what it does not widen; impl -- the NotFound arm on the knock leg, the `Excluded` outcome, its CLI line, and its placement in the landing/refusal partition; unit -- the discriminator triple at the real function over an EMPTY registry (no evidence still refuses NotFound, an excluded id refuses through the route, and a non-excluded evidence-known id is REACHED), with the excluded arm run FIRST so the admitted arm cannot be a leftover, plus `Excluded` proven to be neither a landing at EITHER value of target-locality nor a wire refusal.
       A PRESENT-BUT-UNREADABLE monic record — a HUSK — COUNTS AS PRESENT when `add` and `update` classify what they found (ratified 2026-08-04, bag grill; this REVERSES the reading that shipped in W5 and was deliberately preserved through the releases#70 re-key). The question the two verbs ask is whether the monic id is already SPOKEN FOR, and a file filed under that id speaks for it whether or not anything can parse the bytes. So `add` REFUSES a husk, naming it as unreadable and pointing at `update` and `remove`, and `update` PROCEEDS over one, announcing the replacement out loud. The superseded polarity was not dishonest — both arms said what they saw — but it made `add`, the verb whose entire job is refusing to clobber what is already filed, the one that destroyed content, and `update`, the verb whose job IS replacement, the one that refused to perform it; it then instructed the caller to reach for the destructive verb in order to replace a record, teaching precisely the reflex the add/update split exists to prevent, in the ONE case where the operator cannot read the old content to judge what the replacement costs. THE ESCAPE HATCH IS VERIFIED, NOT BUILT: making `add` refuse a husk would strand a caller only if nothing else could clear a corrupt record, and `remove` decides on FILE EXISTENCE rather than readability, so it already withdraws a husk by construction — no `--force` flag is minted, and that shipped property is asserted by a test rather than trusted. THE POLARITY IS ONE FACT AND MUST BE SPELLED THE SAME EVERYWHERE IT IS ENCODED: the CLI's classify call, the store's own add/update primitive, and every printed line that names a verb for an unreadable record — a listing hint still pointing at `add` would be a surface instructing the caller to run the arm that now refuses. UNCHANGED, deliberately: the DELIVERY EDGE still reads a husk as never-classified (it fails safe — it warns more, never less), and the LISTING still shows a husk under its own id marked unreadable. Gate: doc — the CONTEXT.md mnemonics entry states the ratified polarity, the reason the previous reading was reversed, the verified escape hatch, and what stayed unchanged; impl — the classification input counts a husk as present at BOTH encoding sites (the CLI verb path and the store's write primitive, which classifies on the FILE question rather than on a successful parse), the `add` arm refuses with the unreadable diagnosis naming `update` and `remove`, the `update` arm proceeds and keeps the announced-replacement line, and the listing's advice names the verb that now replaces; unit — a husk REFUSES `add` as Exists AND SURVIVES THE REFUSAL UNREAD (the refusal is not a partial write, which is the whole point of refusing over content nobody can read), a husk is REPAIRED IN PLACE by `update` (the caller has no other route to repair), and `remove` withdraws a husk and stays idempotent over the cleared id, proving the escape hatch that made the `add` refusal safe to ship.
       An agent edits its own monics through `spt endpoint monic <list|add|update|remove> [--owner <id>]` and copies another endpoint's through `spt endpoint monic clone <monic-id>|--all --from <src> [--to <dst>] [--overwrite]`. ADD, UPDATE AND REMOVE REQUIRE `--target <monic-id>`; ADD AND UPDATE REQUIRE `--triggers <triggers-json>`; AND THE BODY ARRIVES ON STDIN, because a monic body is prose carrying newlines, quotes and shell metacharacters, which an argv-borne body hands to whatever shell is in the middle to mangle. ONE STDIN PAYLOAD MAY CARRY SEVERAL MONICS: the multi-record form takes whole records from stdin as a JSON array, each with its own id, triggers and body, and it is a DISTINCT INPUT SHAPE from the single-record form rather than a reinterpretation of it — the flags name the record and stdin is its body, so a payload that also had to carry ids would be two sources for one fact, and the surface refuses the two spellings together so neither is ever ambiguous. A multi-record write applies RECORD BY RECORD and does not roll back what already landed, because each record is an independent fact and a partial application that names exactly which ids landed is more recoverable than an all-or-nothing failure the operator must then diagnose; the exit code is non-zero if ANY record was refused, so a script cannot read a partial application as success. NO MONIC VERB IS EVER ELEVATION-GATED (ratified): a monic is the agent's own judgement, written by the agent, and an agent holds no OS privilege to prove — gating one would make an agent's own mind editable only by the human standing at the machine, which is the opposite of what the register is for. That invariant is a CHECKED PROPERTY, not a comment: the verbs' one decision point TAKES the process's real elevation and ignores it, so a gate added later in either direction fails a test rather than passing unnoticed as a filled-in absence. ADD AND UPDATE ARE SEPARATE VERBS because they refuse opposite states — add refuses to replace a monic that already exists, update refuses to invent one that does not — so a typo'd id or a re-run script cannot quietly change a record; the refusal names the other verb. THE LISTING SHOWS UNREADABLE RECORDS AS UNREADABLE. A record that is present and unparseable reads as never having matched at the delivery edge, which is correct there because it fails safe (it warns more, never less) — but a husk that also vanishes from the listing is a file the agent can neither act on nor discover, the erased-distinction class. So the list names it UNDER ITS OWN MONIC ID, marks it unreadable, and points at the verb that rewrites it. The listing also states a trigger kind that is RATIFIED BUT INERT as such, since a trigger that cannot fire today must not be presented as working. CLONE COPIES THROUGH THE FORK'S COPY SEAM (REQ-FORK-MIND-COMPLETE), not a second copy path, and copies the source's mind AT ITS TIP; a record the destination already holds under that id is KEPT and reported rather than silently replaced (--overwrite is the deliberate replacement), and every copied record is re-stamped as inherited so the destination can tell its own monics from the ones it was handed. A husk in the source travels as a husk — visible in the destination's listing, never dropped and never invented. A clone that copies nothing mints nothing: no branch, no worktree, no empty commit. Gate: impl — the five verbs over the monic store with owner defaulting to the session's own endpoint, the stdin body read, the trigger-set parse with an unparseable set REFUSED rather than defaulted to empty, the multi-record payload form, the elevation-taking decision function, the add/update preconditions, the unreadable-record row in the listing, and the clone routed through the shared copy seam; unit — the elevation table (every verb x record-present/absent yields the SAME outcome under elevated, not-elevated and undeterminable), the add/update split including the husk reading ratified 2026-08-04 (a husk is PRESENT for these verbs, so add refuses it with the unreadable diagnosis and update replaces it while announcing that it did — see REQ-MONIC-HUSK-PRESENT, which owns that polarity and its escape hatch), the clap surface (bare `monic` lists, --target and --triggers required without the multi-record flag and refused with it, clone takes exactly one selector), the two-part husk row (delivery edge says never-matched, list path names it unreadable under its id), and the clone rows (existing destination record kept and reported, --overwrite replaces, copies stamped inherited, source untouched, self-clone refused, nothing-to-copy mints no mind).
       An update-available notif row minted by a node running PRE-0.40.0 spt is retired on the version the running node has ALREADY reached — because the keyed catch-up dismissal is structurally blind to it. (DAEMON-LIFECYCLE W2 RIDER, operator-ordered; doyle root-caused end to end 2026-07-22 on the live box.) FIELD CHAIN, verified: GRAVITY-NVDA-PC (f15d837b, BIGNET) runs pre-0.40.0 spt, whose legacy producer mints the update notice SUBNET-scoped with NO coalesce key (the scoped+keyed producer shipped in 0.40.0). The row replicated fleet-wide. The modern catch-up dismissal (REQ-NOTIF-SEAM-DISMISS, pump/update.rs dismiss_staged_notif_if_caught_up) dismisses ONLY by coalesce key, so a keyless row can never be retired by it: a FULLY-UPDATED node holds a live 'v0.41.0 available' row forever, surfacing once per endpoint at every boundary (observed: todlando ~19:54 + Librarian/Athenaeum-Library; store showed seen=2, undismissed, the only undismissed update row in the whole history). FIX: a version-grounded retirement sweep at the EXISTING catch-up site, same per-tick per-subnet cadence, running ALONGSIDE the key path (which stays PRIMARY — belt-and-braces, not a replacement): dismiss any UNDISMISSED row whose from_id == 'spt-update' AND whose body advertises a version that PARSES AND is <= the running image's own env!(CARGO_PKG_VERSION) (the same running-image self-truth the existing out-of-band leg reads). CONSERVATISM INHERITED VERBATIM from version_ge: an unparseable advertised version NEVER dismisses (the ancient 'update-available 5' counter-shape stays untouched), and advertised > running STAYS LIVE (a genuinely pending notice must survive the sweep). MUST NOT KEY ON kind ALONE: kind=consent is SHARED with the grants act-gate asks (grants.rs mints consent-kind through the plain front door with from_id = the asking agent), so from_id == 'spt-update' PLUS the body version-parse is the discriminator. The relevance predicate stays DAEMON-side (ADR-0046: the notif primitive evaluates no relevance predicate) — the store keeps only its existing undismissed()/dismiss() primitives. KNOWN LIMIT, stated not hidden: the ORIGIN node's one-time cross-node wake at mint is a plain live send from old code and is not preventable from our side; retiring/updating the legacy node is the operator's lever. This fix kills the row's AFTERLIFE (undismissable + boundary-resurfaces at every endpoint forever), which is the repeating harm. Gate: impl — the sweep + the pure advertised-version extractor at the catch-up site; unit — the extractor cells (dotted token found / v-prefixed / counter-shape and garbage refused) and the retire predicate; int — RED-first four legs: (1) legacy-shaped row (subnet scope, NULL key, from_id spt-update, advertised <= running) SURVIVES pre-fix ticks and is DISMISSED post-fix; (2) sibling advertising > running stays live; (3) sibling with a garbage/counter-shape body stays live; (4) regression: a modern Node-scoped KEYED row still dismisses via the key path; plus an asserted (not assumed) replication leg — a sweep-minted dismissal merges as dismissed through notifsync, since the fleet-wide kill is the point.
  [OK] REQ-NOW-SIGNAL-UPDATE-DIVULGE  required: [doc, impl, unit]  stages: +doc +impl +unit -int
       A SUBJECT WHOSE VERSION MOVED IS TOLD AS A MOVE, INSIDE THE EXISTING UPDATES BLOCK AND NOWHERE ELSE (releases#337, SEAMLESS-UPDATES W6). The row becomes UPDATED <subject> <old> -> <new> at <HH:MMAM|PM YYYY-MM-DD> -- changelog: <url>, and every subject whose version did NOT move keeps its current one-line shape to the byte. THIS ADDS NO NOTIFICATION SURFACE — operator re-ruled 2026-09-24 08:20Z: no ADR-0046 notif row, no second render site; the divulge is a reshaping of gather_updates inside the <UPDATES> block that REQ-NOW-SIGNAL-UPDATES already ratified, and that requirement's contract is otherwise untouched. THE SEEN-SET REMAINS THE ONLY EVENT DETECTOR: its key already carries the version, so a moved subject still re-tells exactly once and this row MUST NOT introduce a second source for the fact that something moved. The two facts the current row cannot supply — the OLD version and the applied-at time — are read from the apply record, which is therefore written by BOTH writers that can apply an update, the CLI path and the daemon pump path, so a subject moved by either is told identically. An apply record that is absent, unreadable or carries no prior version degrades to the unmoved one-line shape rather than to an error line or a half-filled row, because absence is silence on a turn-boundary hook. The changelog suffix appears ONLY when the subject declares one (REQ-ADAPTER-CHANGELOG); with no declaration the row ends after the applied-at time.
       MESH-RECOVERY W1 (ADR-0039, RCA wave 1): dial-address resolution is the ROUTE CHAIN — exact peer-cache entry, then VALIDATED RosterEntry.address (address.id must match the peer key; a poison row never becomes a route), then id-only discovery — always fully consulted in order (no failure-count heuristics gating legs; rotation machinery REJECTED). Retention is NONDESTRUCTIVE: PRESENCE_DIAL_FAILED demotes the cached route to suspect (skipped in favor of the roster leg while suspect, superseded by any validated fresher address from connect write-back or reconcile), never deletes a sole route; removal only via validated-fresher replacement or roster tombstone. Validated roster addresses RECONCILE into the cache at daemon startup and on roster merge (beyond gapfill's fill-only: validated-fresher replaces failed/suspect rows) — recovery is connection-independent. Amends REQ-CONV-1's drop-on-fail mechanism; peeraddrs.rs/pump doc-comment truth rides the same change. Gate: impl — chain + demote + reconcile; unit — chain order incl. id-mismatch roster row resolves nothing + suspect row survives N failures with no replacement + reconcile replaces suspect with validated-fresher; int — rides REQ-HAZARD-MESH-BOOTSTRAP-TRAP D-legs; doc — ADR-0039 + CONTEXT peer-route chain entry. Kin REQ-PEERADDR-INVARIANT, REQ-CONV-1.
       A COMMUNE THAT CAN NEVER INGEST IS LOUD WHERE IT IS NOTICED, AND NEVER LETS A RESUME SERVE THE STALE TIER AS IF IT WERE FRESH. MECHANISM (field-settled, and NOT the one this requirement was minted describing -- see the amendment note): a commune written from a cwd other than the endpoint's REGISTERED one silently never enters the tier. The ingest resolves the manifest's drop dir against the endpoint's recorded cwd; a drop written from a worktree, or any non-registered dir, lands somewhere nothing watches. NOTHING FAILS -- so no error is stamped, no strike accrues, and the surfacing that does exist is structurally incapable of firing. The durable tier keeps the PREVIOUS commune and the next resume is rebuilt from it, confidently and wrong. THE SEAM IS AN ANCHOR DISAGREEMENT INSIDE ONE BRIEF: the ingest anchors the drop dir to the endpoint's registered cwd, while the CLI brief composer joined the raw manifest dir against nothing, binding it to whatever cwd the CALLER ran in -- so the durable tiers came from the endpoint and the pending-drop lookup came from the caller, and the two could name different directories without either being wrong on its own terms. TWO INVARIANTS, AND THE SECOND IS THE ONE THAT BITES: (1) a drop that can never ingest is surfaced at the instant a resume is composed over it -- the one moment the degraded party is listening -- and NAMES ITS ABSOLUTE PATH, because the recovery is reading the file and that is only actionable if the party is told where it is; (2) a resume composed over such a drop does not present its durable tiers as current -- the staleness is carried WITH the context rather than inferred by an agent lucky enough to have a nonce discipline. A LOST INGEST IS NOT A LOST FILE: the drop survives on disk and the wake leg fires correctly, so the recovery exists and is cheap. That is the field mitigation already proven to work, and naming the unspooled file is the actionable half of being loud. PAIR, NOT SEQUENCE (acceptance condition): before the anchor was corrected a worktree session found its own misplaced drop BY ACCIDENT, because the composer's lookup was wrong in the same direction the drop was; correcting the anchor without a deliberate misplacement arm in the SAME change would delete that accidental recovery and silently re-open the hole. SCOPE IS SPT-CORE-SIDE -- the daemon AND the CLI brief composer; the harness ADAPTER is untouched. That distinction is the whole of the scope line and is not to be re-litigated: `resolve_filedrops` is spt-core's own code at the seam the adapter calls, and leaving the CLI brief wrong fails invariant 2 at the exact surface an operator reads. Gate: impl -- one shared drop-dir resolver both composers route through, the misplacement arm paired with it, the compose-instant surfacing carrying the unspooled drop's absolute path, the resume refusing to present a never-ingested drop's tiers as fresh, and the registered drop dir surfaced on the endpoint's own info (the only fact that makes a surviving drop classifiable as misplaced-versus-failed by anyone but its owner); unit -- a misplaced drop emits its surfacing ONCE and names the file while a CONSUMED drop emits none (the pair asserted together, since the misplaced row alone passes an implementation that shouts on every compose), a resume over a misplaced drop is marked stale while the SAME resume over a registered drop is not (the discriminator, since both otherwise return the same shaped context and an implementation that marks nothing, or everything, satisfies either row alone), and -- the acceptance row -- a misplaced drop is still FOUND after the anchor is correct, since the anchor fix alone would make it invisible and read as a clean pass.
       EVERY WRITE INTO A SHARED CONTEXT-STORE WORKTREE IS SERIALIZED BY AN EXCLUSIVE ADVISORY LOCK ON THAT WORKTREE, AND A LOSER WAITS RATHER THAN FAILING (releases#221): concurrent per-agent project-tier ingests commit into ONE shared `p-<project_id>` worktree and race git's `index.lock` and the branch's HEAD ref -- 6 PSYCHE_INGEST_FAIL across 3 agents measured on HFENDULEAM 2026-08-25, `fatal: Unable to create '.../worktrees/<name>/index.lock': File exists` and `cannot lock ref 'HEAD': is at X but expected Y`. THE LOCK LIVES AT THE LEAF GIT OPS OF `BranchStore` -- `commit_in_worktree`, `fast_forward_worktree`, `merge_commit_in_worktree` -- NOT at the ingest call site (doyle ruling 2): the ingest path is one of SIX writers of the same worktree (spt-live reconcile, syncmerge fast-forward + merge, contextstore conflict/rename/monic arms), several of them in OTHER PROCESSES, so a narrow guard leaves the identical collision reachable through a rarer door. It is an EXCLUSIVE FILE LOCK ON A STABLE NEVER-RENAMED SENTINEL keyed by the WORKTREE PATH (the `worker_seq` precedent: fs2, RAII-released on handle drop or process death, so a crashed holder strands no file and there is no stale-lock class to sweep) -- NEVER git's own `index.lock`, which stays exactly what `sweep_stale_index_locks` treats it as. THE LOCK IS NON-REENTRANT AND ACQUIRED ONLY AT THE LEAF, so a caller walking many worktrees (the rename loop) acquires them ONE AT A TIME and never nests -- the no-lock-ordering claim is an ASSERTION IN A UNIT, not a comment (doyle ruling 2 rider). ACQUISITION BLOCKS WITH A BOUND (doyle ruling 3): default 10s (two pulse periods; the guarded op is sub-second, so contention is milliseconds), overridable ONLY by a test-scoped `SPT_TEST_*` env var that never enters the operator vocabulary. A pulse tick MAY block -- it blocks only that endpoint's own driver thread, and failing fast is the very defect. ON TIMEOUT the acquire returns an ERROR carrying THE SENTINEL PATH AND THE ELAPSED WAIT BESIDE THE BOUND (at-budget vs under-budget is the only discriminator between a deadlock and a slow box), and that error rides the EXISTING capture-and-continue seam: PSYCHE_INGEST_FAIL is printed, a hard-ingest strike accrues, and THE DROP FILE IS PRESERVED -- nothing is consumed, so nothing is lost, and the F-032 preserve-pending arm (REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE) is untouched beneath it. THE LOCK IS THE ONLY MECHANISM: no retry belt over git's own lock errors (doyle ruling 4) -- a second handler would make a broken lock invisible, and an index.lock failure observed WHILE the sentinel is held is a FINDING to file, never a transient to swallow. Sibling surface: REQ-PSYCHE-INGEST-FAILURE-LOUD (the misplaced-drop half of the same observability seam). Gate: impl -- the sentinel path fn + bounded exclusive acquire + its wiring at the three leaf ops; unit -- an acquire held by one handle makes a second measure elapsed >= the hold and THEN succeed (the lock is load-bearing, proven by elapsed not by a rate), the timeout error names the sentinel path AND the elapsed AND the bound, the bound is env-overridable in test scope only, a multi-worktree caller's acquisitions are sequential and never nested (the lock-ordering assertion), and a timed-out ingest DELETES NO DROP. int -- TWO PROCESSES committing concurrently into one shared worktree: zero failures, every slice PRESENT by existence read, per-arm durations reported, plus a DETERMINISTIC arm where process A holds the sentinel for a known T and process B's acquire measures elapsed >= T then succeeds.
       The rc client's busy-refuse reads a LIVE driver, never a stale stamp (kin to REQ-HAZARD-DRIVEN-BY-SELFHEAL / KH 7.15, observed from the CLIENT side; instrumented x20 2026-08-19, doyle-ruled same day). MECHANISM, measured not inferred: `driven_by` is broker-owned and EVERY clear of it lives in the daemon (broker stamp_reaped, converge_perch_stamps, the livehost reconcile belt), while the write that makes a stopped perch read `offline` is `terminal_normalize` — run SYNCHRONOUSLY in the `spt endpoint stop` CLI process, whose write set is exactly the REST triple (status / rest_state / dormant_since_ms) and structurally cannot touch the CONTROL triple. `current_driver` (rc.rs) was a raw disk read of `driven_by` with NO liveness check, feeding `pre_broker_busy_guidance`, which prints and `return Ok(())` BEFORE any broker traffic — so between the CLI's stop-write and the next daemon tick, a plain `spt rc` is refused by a controller that is provably gone, and the broker's own truth (no live session) is never consulted. This is operator-visible with no test involved: stop an endpoint, immediately rc it, get 'controlled by another window on this machine' and exit 0. Instrument vector (run-3 of 20): driven_by=Some(own hex) + controlled=true beside status=offline at the refusal instant, cleared only ~56s later — the clear is LATE, not missing. FIX = reader-side and NARROW: the driver a record names is `None` exactly when `status == STATUS_OFFLINE`, the product's own declared staleness marker (the same predicate the daemon's DRIVEN_BY_SELFHEAL_OFFLINE belt asserts at livehost.rs); the reader stops having to wait for the tick to agree. Any other status — INCLUDING a record with no `status` field at all — is left alone and reports its driver verbatim: a broader `!= online` rule would suppress the refusal on legitimately mid-bind records, which is worse than the residual it closes (3/20 status-absent reads measured at capture instants, doyle-ruled ACCEPTED WITH ITS NUMBER 2026-08-19; re-opens only if a gate-instant absent-status refusal is ever measured). NO new writer: `driven_by` stays single-writer (the broker) — the belt that would have cleared the control triple from the CLI stop path was ruled OUT for exactly that reason, and `terminal_normalize`'s doc instead states the ownership split by replacement. `--view`/`--take`/qualified targets are unaffected (they already bypass the gate). Gate: impl — the liveness-filtered driver read in rc.rs + the terminal_normalize ownership-split doc; unit — an offline record reports no driver, an online one reports it verbatim, and NEITHER a non-offline status NOR an absent status is treated as a staleness marker (the narrowing is asserted in both directions, so a later widening cannot land silently). NO int: the existing engine-room bring-up e2e already expresses the invariant and must go green as it stands — a new int cell would only re-run it.
       A resize transition is ATOMIC from ScreenGrid's perspective: every byte is parsed at the geometry it was EMITTED under. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source the same hour; P0 — this falsifies a SHIPPED v0.39.0 release claim, so it is a regression, not new scope.) SYMPTOM: right-margin fragments and left-shifted rows on a node where CLI and broker are BOTH 0.39.0 — i.e. exactly the defect the v0.39.0 notes claim fixed. SOURCE (statically provable, no repro box required): broker.rs dispatch_resize calls session.resize(SurfaceSize::new(rows, cols)) (~4557-4559) and only THEN recover_log(&log).set_size_and_notify(rows, cols) (~4560), which reaches self.grid.resize(rows, cols) (~1492) — TWO SEPARATE recover_log acquisitions, so the reader thread's append/parse interleaves between them BY CONSTRUCTION. On ConPTY the resize ITSELF emits a full repaint asynchronously; the reader parses that repaint into the grid at the OLD geometry; the subsequent top-left-preserving grid.resize then faithfully preserves an ALREADY-MISWRAPPED model; the cold attach repaint emits the shift. WHY THE EXISTING TESTS PASS: the spt-term width oracle (REQ-SCREENGRID-WIDTH's int stage) is green 5/5 while the field is red — it never crosses the ConPTY-emission -> grid-geometry -> attach-repaint seam, and the surface mock structurally cannot. The W3 width model is therefore NOT falsified; it is correct work running under a broken geometry transition. FIX — and the record must carry WHY the obvious fix is wrong: merely REORDERING (set grid geometry before invoking the ConPTY resize) is INSUFFICIENT. It is safe on a GROW and unsafe on a SHRINK, because bytes already in flight at the old WIDER geometry are then parsed at the new narrow width and wrap early. Neither pure ordering is correct because the defect is not the ORDER — it is that the grid has no notion of 'these bytes were emitted under the old geometry'. Required shape: quiesce/gate the drain across the ordered surface+grid transition AND carry an explicit geometry EPOCH so parse always reckons at the emitting geometry, with rollback/refetch of the grid geometry if the surface resize fails. Gate: doc — the epoch/barrier contract stated where the resize path is documented, including the shrink counter-example so the insufficient reorder is not re-proposed; impl — barrier + geometry epoch + failure rollback in the dispatch_resize/set_size_and_notify path; unit — a resize whose repaint bytes arrive mid-transition is parsed at the emitting geometry (both grow AND shrink), and a failed surface resize leaves the grid geometry unchanged; int — Windows REAL ConPTY (not the surface mock): resize emits a dense frame, then the synthesized attach repaint is compared against an INDEPENDENT terminal authority, never ScreenGrid against itself. FIXTURE AMENDMENT (hertz field supplement 2026-07-21 second capture, doyle-accepted, carried by todlando at build): the dense frame is ordinary readable PROSE with REPEATED WORDS and punctuation, not sparse synthetic markers — the field captures are semantic corruption of rendered content (`ReQ2`, `ROADMAPnsayh'credertigls`, `Recommend:gdirect REST`, `thii reqw st`, `resdluuion`: clobber, merge, substitution and displacement of width-1 cells MID-ROW), and repeated words are what make a displaced fragment land somewhere that still looks plausible — the shape that let this read as cosmetic. The leg must fail on DELETION, INSERTION, SUBSTITUTION, MERGE or DISPLACEMENT of any width-1 cell, with NO normalization and NO presence-only assertions (full-row untrimmed string equality plus equal row counts satisfies this by construction). CONSTRAINT, binding: the fixture stays inside the region where the authority emulator and ConPTY AGREE — the screen at the resize instant carries no line reaching either margin and loses no row, so reflow-vs-truncate is a no-op on it, and the wrap-crossing prose is emitted AFTER the transition opens, at the new geometry. A fixture crossing the margin at the resize instant would red on emulator POLICY DIVERGENCE rather than on this defect; pinning the wrap policy between authority and ConPTY is separate work and must not be smuggled in here. The comparison is EVERY CELL, including cells expected to be BLANK — not row starts, right margins, or text presence. The dense frame must include erased interior spans and repeated spaces, and those cells must still be blank after the synthesized repaint. (hertz field supplement 2026-07-21, doyle-accepted: the operator confirmed a THIRD corruption shape on the same fully-0.39.0 node — stale characters surviving INSIDE nominal whitespace between words, e.g. `isnsettled`, `fulllyacaptured`. A mis-widthed repaint places glyphs into wrong interior cells; later differential output and EL operations address the CORRECT geometry and so do not necessarily clear them; the synthesized cold repaint then faithfully re-emits the contaminated interior. Accepted as further evidence for THIS requirement, not a new root, on a DISCRIMINATION rather than the prediction: the captured debris is pure ASCII, every glyph width-1, so no width-table or wide-half defect can produce it — and the erase paths are already width-normalized on both halves at screen.rs clear_cell_keep_pen ~416/~420, the span helper ~440-443, and delete/insert_chars ~617-620, with erase_across_a_wide_half_leaves_no_orphan ~1391 passing. Word-scale `isn`+`settled` collapsing across a space is the same shifted-by-N placement as the whole-row left shift, observed at word scale. OPEN DISCRIMINATOR: interior debris in a session where NO resize occurred at any point would mean a SECOND root that this fix will not clear.) BINDING CONSTRAINT on satisfying the blank-cell assertions: NO whitespace special-casing and NO extra clears — the barrier must restore ONE geometry authority for glyph placement AND erasure. A fix that passes by clearing harder satisfies the test and leaves the defect. KNOWN ACCEPTED RESIDUAL (doyle ruling 2026-07-21): a cold attach landing DURING a transition renders the PRE-TRANSITION screen — the held bytes are not parsed yet. Accepted because it is a strict improvement over the shipped behavior on the same input (pre-fix: miswrapped/corrupt; post-fix: stale but coherent). The window is bounded in TIME (settle + one surface call) AND — since REQ-RC-RESIZE-PRESENTATION-BARRIER (built 2026-07-21) — in VISIBILITY: the commit/abort-time sync frame delivers every attached sink, transition-era attachers included, the fresh repaint the moment the barrier tears down, quiet child or not (the successor REQ's commit-time sync frame IS the follow-up seed this residual carried, absorbed by construction). The attach itself still renders the pre-transition screen for the width of the window. REFUSED, so nobody builds it later without a fresh argument: making the attach repaint WAIT on an in-flight transition — that puts a user-facing attach behind the settle cap / serialize wait.
       During a resize transition, LIVE DELIVERY is barriered along with the grid parse: no attached sink (controller or viewer) ever receives mixed-geometry raw bytes; commit substitutes ONE synthesized sync frame at the target geometry. (hertz post-fix field RCA 2026-07-21 on a fully-0.39.3 node, doyle-accepted with every cite verified at source; SUCCEEDS REQ-RC-RESIZE-GEOMETRY-EPOCH, which shipped correct but scoped to the wrong surface — broker.rs's own ResizeTransition doc states append 'still rings + fans out every chunk exactly as before' during a transition, and OutputLog::append gates ONLY grid.advance. A live attached terminal therefore receives old+new-geometry differentials across an already-resized viewport; the cold-attach repaint model is definitionally blind to that path, which is why the shipped gate was green while the field was red. REQUIREMENT-SCOPE defect: the gate held against documented design.) CONTRACT (ADR-0031 Amendment II): (1) append still assigns seq and rings every chunk, but controller handoff and viewer fan-out are SUPPRESSED during the transition — a skip, never a block or sleep (KH 7.12 intact), and the suppressed window does not count toward the controller Full-eviction deadline; (2) commit replays held segments at their emitting geometry (the geometry-epoch machinery, unchanged), lands the grid at target geometry, then UNDER THE SAME OutputLog LOCK ACQUISITION pushes viewers the size frame FIRST and then one synthesized sync frame (render_repaint at target geometry ++ deferred non-grid bytes) to EVERY attached sink, controller included, before raw fan-out resumes — no raw frame may interleave; (3) the controller sync frame carries watermark seq = highest suppressed seq, so the cursor-of-record advances past the whole suppressed range as-if-written (repaint supersedes; the repaint_initial watermark shape); WIRE-FLAG AMENDMENT (doyle ruling 2026-07-21, from the build's real-wire int finding — the watermark jump would otherwise fatal every STRICT consumer as an output gap and ladder into ControllerIrrecoverablyBehind = marked truncation on every resize under a live controller): OutputEvent gains additive `sync: bool` (serde default false, never serialized when false — the resume_seq D4-1 additive shape), set by the broker on the commit AND abort sync frames AND on every repaint_initial batch; a consumer accepts a FLAGGED FORWARD jump and baselines on it on BOTH dedup paths (the supersession is explicit and broker-authored — B2-sound, nothing silently skipped); FORWARD-ONLY, binding: a flagged frame at/below the cursor dedup-drops exactly as today, never a backward baseline; an UNFLAGGED jump keeps strict reject-gap byte-for-byte; baseline_next_output STAYS as the old-broker x new-client cold-attach compat path (retirement is an N-2 seed at most); N-1 matrix published: new broker x old client = a resize in the mixed-version window ends the attach with a marked truncation (honest termination, strictly better than the pre-fix silent corruption; release notes carry 'update CLI and broker together'), old broker x new client = no flag arrives, strict paths byte-identical (unit-pinned as the N-1 leg); REJECTED shapes recorded in ADR-0031 Amendment II so none is re-proposed: unconditional baseline-on-jump, empty-frame delivery through the window, seq rebase, cold-reattach-on-second-gap; (4) abort takes the same uniform path minus the size frame, at the old geometry; (5) the log records the presentation floor (seq after last commit/abort) and a resume-from-floor asking BELOW it is served the cold-attach shape (sync repaint + skip to live), never a raw replay across the boundary — at-least-once preserved in effect because the repaint supersedes the skipped range. NON-GRID BYTE DISPOSITION (enumerated at triage, every class ruled): tracked-by-grid state (title OSC 0/2, alt screen 47/1047/1049, DECTCEM 25, DECSTBM, pen, cursor) = SUPERSEDED by the repaint by construction, unit-pinned per class; untracked STATEFUL sequences (bracketed paste 2004, mouse 9/1000/1002/1003 + encodings 1005/1006/1015, focus 1004, DECCKM 1, DECAWM 7, keypad ESC=/ESC>, DECSCUSR, OSC color 4/10/11/12/104/110/111/112, charset designation), ONE-SHOT events (BEL, OSC 52 clipboard, OSC 9/777 notifications) and child->client QUERIES (DA1/DA2, DECRQM, XTWINOPS, OSC 10/11 '?') = DEFERRED verbatim in emission order, flushed inside the sync frame (a dropped toggle is indefinite divergence, a dropped query can hang a waiting child; a deferred one is bounded-window latency); cell-scoped decorations the grid does not carry (OSC 8 hyperlinks, DCS graphics) = DROPPED as a balanced class (content superseded by the repaint; an unbalanced deferred open would decorate unrelated post-repaint text; matches the repaint's existing fidelity boundary). DSR is in NO class: the drain strips + answers it pre-append (REQ-DSR-SINGLE-CPR); its mid-transition CPR reports the pre-transition cursor — accepted bounded residual, recorded not built-around. MECHANISM CONSTRAINT, binding: classification runs in the ONE parser authority — ScreenGrid's vte::Perform in a capture mode during held-byte replay, re-encoding unconsumed sequences from callback parameters; NEVER a second scanner over raw bytes (two parsers = two truths about sequence boundaries). SIDE EFFECT, must be recorded when built: the commit-time sync frame IS the seeded 'push a fresh repaint to transition-era attachers' follow-up — the cold-attach-during-transition residual's 'not bounded in VISIBILITY' caveat dies (the stale window now ends at commit); update the KNOWN ACCEPTED RESIDUAL text at repaint_initial and in REQ-RC-RESIZE-GEOMETRY-EPOCH accordingly. RESIZE_HOLD_CAP overflow now also means suppressed-never-delivered bytes: the sync repaint after a partial parse leaves client and grid sharing the same self-healing partial view — strictly more consistent than shipped; keep the overflow loud. BINDING CONSTRAINTS CARRIED FORWARD from the predecessor: NO whitespace special-casing, NO extra clears (one geometry authority for placement AND erasure — a fix that passes by clearing harder fails gate); fixture rules verbatim (readable prose, repeated words, every cell incl. expected-blank interiors, full-row untrimmed equality, no reflow-crossing at the resize instant). FENCED SEPARATE, do not build in this wave: the heuristic epoch-split strengthening (mark_resize_issued precedes session.resize; the 20ms-quiet/250ms-cap split is a heuristic, RESIZE_SETTLE_CAP admits old-geometry bytes may land in the new epoch) — only if the field stays red after the fanout repair. Gate: doc — ADR-0031 Amendment II states the presentation contract incl. the byte-class disposition table; impl — suppression + commit-time sync frame + watermark cursor advance + presentation floor in OutputLog/append/commit_resize/abort_resize; unit — per-class disposition pins (a title change, cursor-visibility toggle, DECSTBM change, alt-screen switch, AND a bracketed-paste/mouse toggle inside the suppressed window each surface in or after the sync frame; a hyperlink pair does not), the watermark advance (a resumed controller never re-receives a suppressed seq), the eviction-deadline exemption, the abort path, AND the wire-flag matrix (flagged-forward accepted + baselined on both dedup paths; flagged-backward dedup-dropped unchanged; unflagged-forward strict reject-gap byte-for-byte; old-broker wire without the key defaults false and a cold attach still baselines via baseline_next_output); int — the REAL live controller writer driven across a transition: an attached controller whose socket feed is parsed by an independent terminal authority at the CLIENT TARGET geometry, full untrimmed row equality every row after the sync frame, every cell incl. blanks; a viewer leg asserting size-frame-before-sync-frame and zero raw frames between commit and sync; a resume-across-resize leg (controller detaches pre-resize, resumes post-commit, receives zero mixed-geometry raw bytes and lands exact at target geometry). The cold-attach oracle is insufficient by construction and does not satisfy the int stage.
       RC-RENDER-TRUTH W3 (ADR-0043 decision 2, hertz stale-glyphs RCA leg 2 P0): rc display teardown is a display RAII guard SEPARATE from the OS input/raw-mode guard, unconditional and idempotent on EVERY exit path including errors and unwind — best-effort SGR reset + full scroll-region reset + cursor show + leave alternate screen + clear/home, emitted while VT output processing is still enabled, THEN restore the prior console output mode, THEN parting prose (today RawGuard::drop restores raw/mouse/console-mode only; detach, child exit, displacement, first-event stall, fatal error, and the 30s reconnect give-up all can leave the operator terminal dirty; the reconnect banner clears+homes then give-up prints at the centered cursor). Gate: impl — split display guard + every-path coverage; unit — guard emits the cleanup postlude exactly once, idempotent on double-drop; int — dirty sink (?1049h ?25l SGR31) x every PumpEnd/error class => cleanup postlude precedes the final prose; doc — ADR-0043.
       RESCOPED 2026-07-22 by ADR-0047 Amendment 2 + KNOWN-HAZARDS 7.55 (doyle-ratified), on the measurement rather than on the supposition. FIELD EVIDENCE IS REAL: hertz's second ENLYZEAM capture shows the operator's keystrokes as isolated one-byte OUTPUT records in the child->broker RAW DRAIN — server-side, upstream of any client console, so independent of the 7.56 presentation root that explains the other half of the /c/config line. LOCAL SEAM MEASURES CLEAN: a probe child under a real ConPTY, clamped raw at startup and resized 24x80->60x131 live, reports an IDENTICAL input mode word at four sample points (boot / before-resize / after-resize / before-write, all in=0x000001f0 echo=0 line=0), and typed bytes do not come back as output; a seeded capability probe moves BOTH observables, so the absence is earned, not vacuous. Amendment 1's addendum supposed the resize path re-enables console echo — on this box and portable_pty/ConPTY version it does NOT. TRIGGER UNPINNED. OPEN CANDIDATE (hertz field question, deliberately NOT built against): the pseudoconsole BOOTS with ENABLE_ECHO_INPUT/ENABLE_LINE_INPUT ON (in=0x000001f7 measured) and the CHILD clamps them off, so any UNCLAMPED WINDOW (startup, or a re-clamp after a TUI state transition) echoes by default with no seam re-enabling anything — reframing the question from who turns echo back on to whether there is a window where nobody has turned it off yet. NO impl STAGE, for a structural reason and not a scheduling one: the hosted child's console handles belong to the pseudoconsole it is attached to and the daemon holds only the master end, so the daemon can neither OBSERVE nor SET those modes — instrumenting spt-term's resize seam would probe a console that is not the one in question, and a server-side clamp is equally impossible. Shipping instrumentation that measures the wrong console is manufactured confidence (doyle, declined explicitly); the RIG is the instrument, and the probe-child pattern ships as a debug tool if the field ever needs live diagnosis. The restore-placement question (spt-term seam vs broker write_input) is MOOT, not answered: there is nothing to restore when the mode is preserved. WHAT THIS REQ OWNS: unit — the probe protocol contract (the verdict travels in the stdout protocol line because under a ConPTY the child's stderr is interleaved into the same re-rendered stream and arrives shredded, so a refused SetConsoleMode could otherwise read as a measurement); int — the four-sample measurement, the typed-bytes-do-not-echo symptom leg (which survives being wrong about the mechanism), and the seeded capability probe. Rig-craft pinned in the rig and transferable: a probe that never clamps raw sits at the very default the seam is suspected of restoring and cannot tell reset from never-changed; and ConPTY's post-resize REPAINT re-emits earlier output, impersonating a fresh reply to any rig that matches loosely. Kin REQ-RC-NEWLINE-PRESENTATION-TRUTH (7.56, the presentation half, FIXED) and REQ-ATTACH-RESIZE-REPAINT (7.54, rescoped the same honest way).
       RC-RENDER-TRUTH W3 (ADR-0043 decision 4, hertz stale-glyphs RCA leg 4 P1): ScreenGrid cold repaint replays EVERY tracked render-affecting mode — DECSTBM scroll margins at minimum — before final cursor placement (today render_repaint omits tracked margins, so client and server grids interpret subsequent raw scrolling against different regions => stale/moved rows after reattach/resize; the trailing-blank omission after ED2 is semantically correct and NOT the bug). Stateful emulator contract: dirty screen + synthesized repaint + next raw frame == server grid. Gate: impl — tracked-mode replay in render_repaint; unit — repaint emits tracked DECSTBM, emulator contract holds for scroll-after-repaint; doc — ADR-0043.
       A REMOTE ATTACHED CONTROLLER RUNS THE CEREMONY CLIENT-SIDE AND SHIPS THE PROOF UP THE RC CHANNEL (CONTEXT.md ratified; the rc-paste client-originated precedent — the daemon has no reach into the operator's terminal or clipboard, so the overlay renders and the code is collected in the rc client process) — AND THE PROOF IS THE PRESENTED CODE, NEVER A CLIENT-SIDE VERDICT: verification, the attempt ledger, and the mint stay daemon-side (REQ-SEAL-CEREMONY-TOTP), because an agent on the box can speak the broker's IPC directly and a client-side decision would be decorative (the bring-up precedent, broker seat-resolver placement rationale). The ceremony records ride the EXISTING attach stream as additive serde variants, so the LOCAL and REMOTE arms are ONE code path — nothing about a remote controller is special except transport latency; N-1 clients are protected by the default-false capability declaration (REQ-SEAL-NO-CEREMONY-SURFACE refuses rather than pushing records an old client cannot decode). Gate: doc — the CONTEXT.md rc-arm sentence; impl — the ceremony AttachRecord variants and the client ceremony mode; unit — the upstream ceremony record carries the presented code and has no verdict field for a client to assert, keys fold through the shared kernel, and a ceremony round-trips over the attach machinery (push, code up, result down).
       REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/generation validation on attach/detach — a stale worker can never detach or displace a REPLACEMENT controller (today detach_if compares Arc ptr identity only; the serve path re-checks nothing at completion). Covers the UNFINISHED-stale-row control-steal shape (raw-close no-FIN viewports, emphasys C2 leak class feeding it) that finished-row retirement (D1/D1b) definitionally cannot see — the discriminating field observable on the next live steal catch = the stolen row's finished+retired flags. Gate: impl — pre-serve terminal exclusion + generation/ownership tokens on attach/detach; unit — stale-generation detach refused while the same-generation detach lands; int — T6 (UNFINISHED-stale attach row + live current controller + dispatcher restart: neither takes nor clears the replacement, D1/D1b green alongside); doc — ADR-0038 Amendment. Kin REQ-HAZARD-REDISPATCH-CONTROL-STEAL (the finished sibling), REQ-REDISPATCH-FINISHED-RETIRE.
       `spt subnet revoke` (both forms, --force-rotate-seed included) requires the subnet's CURRENT admin TOTP — a member code is insufficient, and OS elevation stays on top answering its different question (ADR-0051 §2a, FF grill 2026-07-30). Eviction is a subnet-governance act, and the proof doubles as the identity gate for the re-surface: only the proven incumbent admin is shown the replacement key. The gate runs BEFORE any write, so a cancelled, thrice-wrong, or non-interactive attempt (refused up front — the gate needs a human and the ceremony after it needs one more) leaves roster, schedule, and seeds untouched. Acceptance is the same ±1-step window every other typed-code ceremony uses. A subnet predating the two-key model has no admin authority to prove; it proceeds loudly on elevation alone. Gate: doc — ADR-0051 §2a; impl — the per-subnet gate in the revoke path, ordered before all writes; unit — the windowed code acceptance (shared with the capture proof) and the nothing-written refusal orderings exercised at the gate seam.
  [OK] REQ-UPDATE-STATUS-TRUST-ANCHOR  required: [doc, impl, unit]  stages: +doc +impl +unit -int
       THE ENDPOINT LIFECYCLE READS AS VERBS, AND `endpoint run` RETIRES WITHOUT A SHIM. One overloaded verb carried the whole lifecycle: `spt endpoint run` minted an endpoint, started a new session on an existing one, resumed a prior session, opened the interactive picker, and (with `--save`) set a startup default — the invocation's MEANING sat in which of nine flags were present, so the CLI could not be read and the picker's doors could not be named. The ratified surface (releases#5 bag grill, 2026-08-04) is: `endpoint create <new-id> [--subnet S] [--adapter A] [--cwd DIR]` = the ONLY mint, subnet immutable after it; `endpoint start <id> [--adapter A] [--cwd DIR]` = a NEW session on the endpoint's most-recent adapter in its most-recent project folder, NEVER the env cwd, and an UNKNOWN id REFUSES pointing at `create` so a typo cannot mint a phantom endpoint; `endpoint resume <id>` = its LATEST session; `endpoint auto-start <id> [--off]` = the standalone lever that was `run --save`; and top-level `go <id>` = the operator's take-me-to-this-endpoint ladder (online+uncontrolled -> rc; online+controlled -> interactive kick confirm over `rc --take`; suspended -> wake then rc; offline WITH sessions -> resume then rc; offline WITHOUT sessions -> mint the first session then rc; engine-room -> defers to the gated `rc engine-room` path). `go`'s offline discriminant reads the SESSION LEDGER (a non-provisional row) and NOT the record's `session_id`, which persists by design after a clean stop as the CAS identity anchor and is never a liveness claim. RETIREMENT IS A CLEAN BREAK: `endpoint run` is removed through a RAW-ARGV PRE-SCAN ahead of `Cli::command()` so its nine args never enter the derive tree, and it answers with a parse error naming the replacement verb — no hidden variant, no silent alias. TWO CAPABILITY NARROWINGS ARE DELIBERATE AND MUST NOT BE RE-ADDED QUIETLY: specific-session resume (`run --resume <session>`) retires with the verb and has no replacement, `resume` being latest-only; and the picker's two argv prefill quadrants (`--adapter`-only pre-select, `--id`-only create-new prefill) retire with their verb, the id-only case's replacement being `start <unknown-id>`'s refusal. `create` MINTS ONLY — skeleton perch, permanent home, recorded adapter/cwd defaults — and does NOT start a session; the first session is `start` (or `go`, which also attaches), so a fresh bringup is TWO commands where `run --start` was one. That is a shape change to every bringup script rather than a lost capability, and it rides the release notes beside the resume narrowing. It was decided rather than read off the table (todlando, ratified by doyle 2026-08-04) on the ladder's own evidence: a first-class offline-WITHOUT-sessions rung is near-unreachable unless zero-session endpoints are routine, so create cannot be starting one. The picker's own door is BARE `spt` on an interactive terminal and this requirement does not touch it, nor does it add a `pick` verb. Generated launcher shortcuts bake the retired argv, so the generated body becomes `spt go <id>` (the launcher's intent IS `go`'s ladder, and it opens a console so the kick confirm has its TTY), the shortcut SENTINEL is bumped so a stale launcher is detectable rather than merely broken, and the refusal text names BOTH the new verb and shortcut regeneration. REGISTRY SUPERSESSION: this requirement is the authority on the bringup SPELLING, and it supersedes every earlier title in this file that names `endpoint run`. Those were swept where they state a CURRENT contract or a CURRENT gate's invocation; where they narrate a PAST failure or a past field observation they are left verbatim, because a failure record rewritten into a spelling that did not exist when it happened stops being a record. Arg budget: the ratified surface is the MIN spelling at 11 leaf args against the retired 9, a net +2 that is only affordable because the pre-scan keeps the retired args out of the tree — and it rides on REQ-CLI-STACK-HEADROOM having deleted the ceiling rather than budgeted under it.
note: 5 tag-carrying file(s) not placement-judged (no grammar for the language, or the parse recovered from errors)