232:required_stages = ["impl", "unit"] # activated M4-D6a: the mind now lives in the tracked/ two-tier store (spt-store::contextstore over BranchStore), physically separate from never-synced node-local perches/ — spt_live::ingest::route_slices routes commune drops' / slices into a-/p- branch files (untagged body → live, the parser fallback; precedence-guarded 6.5; checkpoint commit per written tier); signoff::write_resume_commune stamps Self provenance per slice through the same router; resume::download_psyche_context composes the two tiers back into the two-slice envelope (pure read, never mints store state; other-project download sees live only). Daemon lifecycle derives project_id from the commune dir's parent (cwd fallback). The cross-node SYNC of these branches = D6c (REQ-NET-3/REQ-INST-5); int = D9 two-host. unit = per-tier routing/no-leak + untagged→live + suppressed-consumed + resume-commune both-tiers + download compose/cross-project-isolation + e2e listen→ingest→live-tier 281:required_stages = ["doc", "impl", "unit"] # activated M4-D9-4: resources: Option on the registry Instance (additive serde-default, rides RegistryUpdate replication + the epoch lease — a blurb edit is an ordinary epoch-bumped update, NO new record kind/store/merge surface) + resource_projection (the (id,node,status,blurb) yellow-pages view over VISIBLE+routable rows — same exclusion closure as resolution, ADR-0006 §6 leak-free by construction) + both-authored sourcing (info.json resources via spt resources set wins; daemon.json resources_blurb node seed fills the gap) + spt resources set/show/list CLI off the stale-tolerant registry snapshots. The whitelist leg of the gate (viewer-node filtering) rides the deferred consent/whitelist generalization — visibility is the v1 gate exactly as CONTEXT scopes it. doc = CONTEXT §resource advertisement; unit = lease-ordered blurb + pre-D9-4 row parses + hidden-never-listed/offline-skipped/absent-renders-clean + both-authored advertisement + runtime refine epoch-bumps 674:title = "A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phantom perch-less endpoint). `api session-end --erase` removes the perch (owlery dir gone) but the subnet roster (identity/registry/.json) keeps the endpoint's instance row ACTIVE with no backing perch; `endpoint stop` says 'address unregistered' yet the line persists; no CLI verb forgets a roster entry, and a hand-edit is re-added by the single-writer daemon advertiser. FIX: daemon-side self-heal — the advertiser DROPS/forgets a LOCAL roster entry whose backing perch no longer exists (stops advertising it Active), and/or a `forget`/evict verb; verify whether the epoch lease eventually evicts it (slow-self-heal) vs a real leak and scope accordingly. doyle secondary finding (perri). (post-v0.10.0)" 752:title = "`spt endpoint purge ` fully removes an endpoint AND every record keyed on it — the formal teardown devs/CI need for clean test setup/reset. NOT consent-gated (a local dev/test op — no peer consent). OFFLINE-ONLY: refuses while the endpoint is online / daemon-hosted (deleting records out from under a live host risks the daemon re-creating or re-hosting mid-purge); `--force` STOPS it first (endpoint stop → wait for the daemon reconcile to un-host + reap the Psyche) THEN purges. Confirms interactively unless `--yes` (the CI path). Refuses purging the CALLER's OWN running id. All LOCAL — purge reaches only THIS node's records; a remote endpoint's records can't be touched, and its subnet-registry rows decay via the epoch-lease eviction (REQ-HAZARD-REGISTRY-DECAY). Removes: (1) the perch dir TREE recursively — owlery// incl every nested {id}-psyche / {id}-w* / shells child (info.json, ready marker, sessions.log ledger, spool.db, inbox, .idle/.more-done sentinels, auth token); (2) the registry address (registry::unregister_address); (3) the context store — ContextStore::remove_endpoint(id): the a- branch+worktree + the / rows from every p- branch (the same fn `fork --delete-source` already uses); (4) node-local trust rows keyed on the id — access.json + visibility.json. Reuse-heavy: it is `fork --delete-source` generalized (recursive perch remove + unregister + remove_endpoint) + the trust-record cleanup; `endpoint rename` already enumerates the same record set + uses the same offline-only gate. (v0.12.0)" 1405:title = "A VIEW is independent from the endpoint: closing the tab/window where the endpoint was brought up must detach ONLY the `spt rc` attach pump — the daemon-hosted harness keeps running and stays re-attachable via `spt rc `. ROOT (Windows, v0.12.0 real-harness defect): the daemon never breaks away from the launching terminal's Job Object. Windows Terminal / VS Code place the launched shell AND every descendant into a Job Object with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE; closing the tab drops the terminal's last job handle → the OS terminates every process still in that job. A child escapes only with CREATE_BREAKAWAY_FROM_JOB — used NOWHERE in the tree. Both daemon spawn paths (daemon.rs:707 detached_no_inherit = DETACHED_PROCESS|CREATE_NEW_PROCESS_GROUP|CREATE_NO_WINDOW; deelevate.rs:519 elevated = CREATE_NEW_CONSOLE|...) drop the CONSOLE but NOT job membership, so the daemon's freshly broker-spawned ConPTY harness subtree is reaped on tab-close. The ConPTY/pseudoconsole isolation itself is CORRECT (portable-pty builds the pseudoconsole in the daemon; no console signal / handle leak) — the leaking lifetime binding is the Job Object, not the console. FIX: add CREATE_BREAKAWAY_FROM_JOB to both daemon spawn paths AND pin each broker-spawned harness into a DAEMON-OWNED Job Object (mirror reap.rs/Breap) as backstop (survives even where a terminal sets SILENT_BREAKAWAY_OK=false). Unix: the daemon's own session detachment (new session, no controlling terminal) already keeps a closing terminal's SIGHUP off its children — verify, add a guard test, no code expected. FIX UPDATE (v0.12.1 L1.5, doyle re-scope operator-approved 2026-06-18): job-neutral daemon launch is now PRIMARY, breakaway DEMOTED to a fallback rung. ROOT reframed — the daemon INHERITS the terminal's Job because spawn_detached runs FROM the terminal-child CLI (DETACHED_PROCESS detaches the console, not the job); breakaway tried to claw back out but a job CAN deny it (the L1 finding). FIX: launch the cold-started daemon via a job-NEUTRAL creator so it is WmiPrvSE/Task-Scheduler-owned, OUTSIDE any terminal job from birth (why Task-Scheduler-autostarted daemons never had this bug). Launcher ladder (first-success-wins, daemon.rs spawn_detached → BOTH cold-start AND `spt daemon start`): (1) WMI Win32_Process.Create via ABSOLUTE powershell -EncodedCommand (KH 5.12 abs path; base64-UTF16LE dodges all quoting; success requires BOTH ReturnValue==0 AND a parsed ProcessId, else fall-through — never a silent launched), forwarding SPT_* env via a `cmd /c set … & start /b` wrapper because a WMI/scheduler child does NOT inherit transient shell env (verified — SPT_HOME would be lost, wrong universe); (2) schtasks one-shot (same env wrapper; best-effort fallback); (3) CREATE_BREAKAWAY_FROM_JOB (the L1 code, reordered below); (4) in-job last resort (logs DETACH_IN_JOB + tab-close caveat). detached_no_inherit (breakaway-then-in-job) is UNCHANGED for its other caller shellhost::launch_shell (a daemon-spawned shell is already job-neutral once the daemon is). The elevated deelevate path keeps its L1 breakaway for now (elevated-case WMI-reparent = FOLLOW-UP). (v0.12.1)" 1455:title = "SPINE INVARIANT (v0.13.0 keystone): the broker must accept INJECTED keystrokes into an spt-hosted PTY (the v0.11.0 raw direct-inject today; the ADR-0022 translation-binary choreography tomorrow) WHILE a live `spt rc` controller is attached to the SAME PTY, without (a) the operator losing control, (b) the endpoint latching ONLINE+CONTROLLED, or (c) the broker wedging. The injection inlet is PERMANENT — spt-claude-code requires keystroke injection — so this is root-caused + fixed at the PTY-injection layer, IN STEP with the ADR-0022 delivery redesign that formalizes the inlet. REOPENS the wedge facet of REQ-HAZARD-ATTACH-WEDGE: the v0.12.1 prove-don't-change covered only DEAD-CHILD backpressure, NOT the injection trigger (operator's signal — one injected keystroke succeeds, the next wedges → the single-threaded broker parks on a blocking PTY/loopback write after injection-induced harness output). REPRO-FIRST on the real dummy-harness fixture (NO theory): instrument to nail the exact blocking call before any fix. Fix candidates: non-blocking/fail-fast PTY write, split input/output, bounded-evicting. Mechanism shared with W2 — spt-core owns EVERY PTY write and applies an injected sequence ATOMICALLY (controller input buffered during the sequence, flushed after) so a stash/restore can't be clobbered. CONFIRMED ROOT (doyle /diagnose 2026-06-19, code-grounded): Broker::append (broker.rs:205-227) fans each live output chunk to the CONTROLLER on a SYNCHRONOUS BLOCKING write_frame held inline in the session's drain thread (the 'authoritative, advances delivered_through' path, D4-1), while VIEWERS use a dedicated writer thread + bounded evicting sync_channel (add_viewer:273 / viewer_writer) that can never stall the drain. So a slow/backed-up controller socket — or the full 64KB loopback duplex (the ATTACH-WEDGE buffer) — BLOCKS the drain thread → output stalls → keystroke echoes stall (PERCEIVED input lag) → unrecoverable wedge when the consumer never drains. TRIGGERS ON NORMAL INTERACTIVE rc USE under heavy harness output (TUI redraw), NOT only message injection — same root, wider repro. FIX DIRECTION: move controller delivery off the drain thread onto a dedicated writer (the viewer_writer pattern) BUT preserve the authoritative cursor — block the WRITER thread (not the drain), bound the wedge (deadline → detach/mark-gone, never park forever), never silently evict the operator's authoritative view. (v0.13.0)" 1545:title = "An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delivers the detach) AND whose session is IDLE (no output) stays latched ONLINE+CONTROLLED forever: the W1 drain-evict only fires on OUTPUT (CONTROLLER_WRITE_DEADLINE on a backed-up write), a clean disconnect self-heals via detach_if→clear_controller, but an idle session with a half-open/wedged controller connection produces neither signal. PROVED repro-first on a real broker (v0.13.0 W5, inject_control_wedge.rs w5_a2): controller_by STAYS Some(origin) and driven_by STAYS Some after the remote is abandoned without a clean EOF on an idle session — so the brain reconcile CANNOT detect it from KIND_SESSIONS controller_by (the broker still reports it controlled). FIX DIRECTION (doyle ruling 2026-06-19, broker-side single-writer — the broker owns driven_by/clear_controller): wire the EXISTING D4c NetPresence connection-disconnect event → clear_controller for any session whose controller identity == the dead origin (become_controller already stores Some(origin); presence events already exist — modest wiring, NOT a new probe). The liveness ORACLE is QUIC's own keepalive/idle-timeout: a presence-disconnect IS a real QUIC conn close, already tolerant of transient blips within the keepalive window, so NO heavy partition ADR is needed UNLESS the QUIC timeout proves too slow for the UX (then mint an ADR for a faster controller-heartbeat + its false-evict bound). Composes with W1 (output path) + W5 Gap B (no-session) — this is the third, idle-remote, leg. (v0.13.0 follow-up)" 1546:required_stages = ["int"] # W2 ACTIVATED on build/daemon-lifecycle-w2 (todlando 2026-07-22) — INSTRUMENT-FIRST: int is the measurement leg (with its clean-FIN sibling probe); impl/unit activate only if the measurement shows the heal is absent (doyle dispatch, outcome (b)). MEASURED 2026-07-22, crates/spt-daemon/tests/transport_death_eof.rs, OUTCOME (a): on REAL QUIC (two brokers, BindScope::Loopback + a real net_dial — NOT the in-process duplex, which has no idle timeout) a no-FIN transport death DOES surface NetStreamEof to the already-serving serve_attach worker and the seat releases. Numbers: clean FIN 120ms / torn no-FIN 65057ms (MESH_MAX_IDLE 60s + quinn PTO slack; a number materially UNDER 60s would have meant the staging leaked a signal). Staged by freezing the peer's net runtime (NetHost::freeze_transport_for_test) — endpoint alive, UDP port still BOUND (asserted), keepalives unanswered; a bare host drop / process kill would have CLOSED the socket and drawn ICMP unreachable, which is not silence. So impl/unit stay UNACTIVATED: no presence-FIN synthesis is owed on this evidence. The ~65s is REPORTED, not ruled acceptable — tune-keepalive vs synthesize-presence-FIN is a design decision taken ON the number. SCOPE: this covers the QUIC-STACK-DEAD peer only; the ALIVE-but-WEDGED controller (KH 7.15 A2 — stack answers keepalives, only the app writer parked, so no idle timeout ever fires) is NOT reached and stays deferred. 1765:required_stages = ["impl", "unit", "int"] # ACTIVATED F-025 item 1a + final-wave int (todlando). AMENDMENT 2026-07-27, RE-PINNED by the builder (FIELD-TRUTH W1 leg D): impl = KIND_COORDINATOR_IMAGE_ANNOUNCE/_REPLY + KIND_COORDINATOR_IMAGE/_REPLY + the three DTOs (msg.rs) → run_brain announces {env!("CARGO_PKG_VERSION"), generation} post-hello via Brain::announce_coordinator_image (brainproc.rs/brain.rs) → broker records it ONLY on an exact match with brainproc::supervised_generation() (the AtomicU64 supervise_brain publishes at every spawn), gated by the pure coordinator_announce_accepted / answered by the pure recorded_coordinator_image, both re-checked at READ time so a superseded generation stops reporting (broker.rs) → Brain::coordinator_image_version client (brain.rs) → cmd_daemon_status queries it on the SAME handle and prints render_coordinator_image_line FIRST, with render_broker_image_line de-fanged to informational (no warning verb, no remedy) + JSON coordinator_image/coordinator_stale, stale None on query failure AND on an unreported coordinator (unknown ≠ stale) (cli.rs). DISCRIMINATOR NOTE: role cannot identify the coordinator — recv_hello(.., Role::Brain) admits every client incl. the CLI's own Brain::cold_start — and BRAIN_PROMOTED's version is disk-sourced + trial-path-only, so neither could carry this. unit = coordinator_image_line_is_the_only_stale_warning (matched / stale→warn + refresh-only, never stop+start / unreported→no warning / stale broker under a matched coordinator raises NOTHING) + broker_image_line_reports_without_warning_or_remedy (all three cells: no remedy, no nag) + only_the_supervised_generation_can_claim_the_coordinator_image (the pure announce + read gates: impostor generations refused, superseded record not reported). int = the_running_coordinator_reports_its_compiled_image_and_no_impostor_can (a REAL supervised `spt daemon brain` child announces to a REAL broker over the production socket; a CLI-shaped client reads back its compiled version, and the same client's own announce is refused without disturbing the record). Original evidence below stands for the broker leg. impl = KIND_BROKER_IMAGE/_REPLY + BrokerImageReply (msg.rs) → broker self-report dispatch_broker_image from env!("CARGO_PKG_VERSION") (broker.rs) + Brain::broker_image_version client reading the reply, KIND_ERROR (old broker's `unknown command kind`) → None (brain.rs) + cmd_daemon_status queries both net-status and the image on ONE handle and renders render_broker_image_line beside the installed version; JSON broker_image + broker_stale (final-wave tightening: broker_stale is None on a query FAILURE — Err, not a false-positive true — vs a definite bool only after a successful Ok query) (cli.rs). unit = broker_image_line_flags_a_stale_running_daemon (matched→"matches installed" no-nag / mismatch names both + restart recovery / None still flags older + recovery / no internal-marker leak). int = broker_reports_its_compiled_image_version_over_ipc (a Brain connected to a live served broker round-trips KIND_BROKER_IMAGE → Some(the broker's compiled CARGO_PKG_VERSION); the old-broker→None leg rides the router unknown-kind default, caught client-side). AMENDED releases#292 (111568f2): title re-keyed so the resident-web exception (REQ-RESIDENT-WEB-SKEW-DIAGNOSIS) is the only restart advice; the evidence map above is UNCHANGED by #292 (render_broker_image_line now also carries resident_web_skew_notice, informational otherwise). 1909:title = "#10 (F026 micro): `spt | ` must not PANIC when stdout closes early. A closed downstream reader mid-print panics with 'failed printing to stdout: The pipe is being closed. (os error 232)' (live repro: `spt daemon status | Select -First N`). Fix: tolerate BrokenPipe process-wide — a write to a closed stdout exits 0 (SIGPIPE-equivalent: a consumer that stops reading is a normal end, not a crash), without leaking a Rust panic + backtrace to the user." 1960:title = "B2 (F028, hall-b diagnosis, verified 0.22.0): respawn/`--resume` feeds the SPT session id to `claude -r`. After the 02:05 daemon bounce respawn built `claude.exe -r 70b5bfa40901b7d4` — an spt session id in claude's OWN session-id namespace -> claude hangs forever at a 'No sessions match' resume-picker while the endpoint reads online. Hits after EVERY daemon bounce + every picker Resume. The HARNESS session id (claude UUID, stamped in sessions.log/info.json by the hooks) is what {session_id} must mean in the adapter's [session.resume] command; the spt sid must not leak. FIX: substitute the HARNESS session id in the resume template (spt-core substitution-key semantics + LIKELY claude-spt manifest coordination — FLAG perri BEFORE touching the manifest, adapter-boundary rule). Int: resume template receives the ledger UUID, not the spt sid. See triage B2." 2554:title = "MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft — doyle ACCEPTED primary fix): the daemon MUST sanitize inherited per-session identity env (SPT_ENDPOINT_ID / OWL_SESSION_ID / SPT_AGENT_ID) at startup AND before EVERY role spawn — these are per-session identity and are NEVER correct inherited state for a daemon or its role children. ROOT: a daemon restarted from inside an agent session (routine during core dev / `spt update apply`) carries the session's SPT_ENDPOINT_ID and passes it verbatim to every [session.psyche_resume] spawn; core only strips each role's DECLARED env_remove list (runtime.rs:728), so ONE adapter env_remove miss infects the whole node — every psyche claude turn fires SessionStart, the adapter hook sees the endpoint id, takes the bind path, and ROTATES the victim's perch to the psyche's own sid with a valid prior-sid proof, every pulse (field: lia/deployah/doyle psyches ALL briefed as ; 37 peer msgs drained into lia's psyche transcript; victim deliveries eaten, communes dark, sends downgraded from:cli@node). Adapter half FIXED v0.18.8 (env_remove += SPT_ENDPOINT_ID + shim scrub + SPT_PSYCHE_TURN hook-bail) — this REQ is the CORE-LAYER defense so no adapter miss can ever leak identity again. FOLD (F-036 leg b docs-fix, doyle-owned): broaden the recursion_guard_env schema description (manifest.rs:314 + crates/spt-runtime/manifest.schema.json:306) — core honors it on ANY role declaring the field (runtime.rs:740, keyed on the FIELD not the role name); drop the 'summarizer children' wording (perri adopted on both psyche roles v0.18.8, proven live). Gate: a daemon started with SPT_ENDPOINT_ID/OWL_SESSION_ID/SPT_AGENT_ID in its env spawns role children WITHOUT those vars (unit: role-spawn env assembly scrubs the identity set regardless of the role's declared env_remove); KNOWN-HAZARDS entry on landing. Kin psyche-custody/session-pin cluster, [[spt-core-findings-backlog]] F-036." 2641:title = "THE-FORKENING W3 (ADR-0036 §4, operator-ruled crate-over-handroll + port 5474): the daemon (broker side — docs are up whenever the daemon is) serves $SPT_HOME/docs over HTTP on LOOPBACK ONLY, default 127.0.0.1:5474 (+ ::1 where available; 547 rejected — privileged <1024 breaks the Linux user-daemon + IANA dhcpv6-server), config + env override. Implementation = hyper (ALREADY in-tree via iroh/reqwest — zero new supply chain; operator ruled battle-tested crate over hand-rolled HTTP). GET-only; strict path-sanitize under $SPT_HOME/docs (reject .., absolute, encoded traversal); bounded write discipline (conn-hazard class). Published URL surface preserved VERBATIM (llms.txt contract: /llms-full.txt, append-.md raw, /manifest.schema.json — flynn/perri doc habits must not break). Verbs: `spt docs url` prints the resolved URL honoring overrides; bare `spt docs` opens the system browser (cfg(windows) creation_flags no-console). NEVER 0.0.0.0 — a LAN-visible server re-leaks what privating hid. Gate: unit — path-sanitize rejections + content-type map + loopback-only bind config; int — daemon up serves book index + llms-full.txt + a raw .md byte-true from a landed bundle; doc — CONTEXT.md Docs Server entry + docs-site self-reference updated (site-url). Kin REQ-DOCS-RELEASE-ASSET (the producer), ADR-0036, translation-binary console-window gotcha." 2706:id = "REQ-HEAVY-UNIT-CLASSIFICATION" 2707:title = "A unit test that stands up a REAL broker inside a lib/bin `#[cfg(test)]` block must sit in the `heavy-broker-pty` nextest group, and the classification must be ENFORCED rather than remembered. FLAKE-LEDGER: `attach_viewport_reconnects_across_a_broker_bounce` diagnosed this class in the `spt` binary, wrote the CLASS in prose, then shipped an ENUMERATION of four `rc::tests::` names — so the identical shape in `spt-daemon`'s lib (`applyhost`: a real `Broker::bind` + `serve()` in 10 of its 13 units) stayed in the full-parallel Phase-A pool and TIMED OUT at 240s twice, at v0.32.0 and again under the v0.39.0 W5 gate, the v0.32.0 remedy never having landed. The defect is provable from `.config/nextest.toml` ALONE (two overrides, neither matching `kind(lib)`); timing evidence only ever estimated the rate. Gate: impl — heavy-group overrides for `applyhost`/`livehost`/`pump` (spt-daemon lib) and `wansend` (spt bin, found BY the check rather than by a person), plus `xtask check`'s `check_heavy_unit_classification` keyed on the SHAPE (a `Broker::bind` after the `mod tests` marker) instead of a name list; unit — the two pure seams, including the regression for this check's OWN first draft, which substring-matched `::tests` and so missed every module written inside an alternation group. Kin FLAKE-LEDGER: `attach_viewport_reconnects_across_a_broker_bounce` + the HEAVY-AT-BIRTH ruling (.config/nextest.toml), REQ-CI-DOCS-ONLY-THIN." 2726:title = "CI (operator-ruled 2026-07-16, from PR #8 review; registry-only extension operator-approved 2026-07-27; superseded for main pushes by ADR-0050 on 2026-07-29): a PR whose ENTIRE diff is Markdown OUTSIDE docs-site/ and/or the declarative `traceable-reqs.toml` registry runs THIN CI — the heavy build/test jobs are skipped via a changed-files classifier job. `traceable-reqs.toml` has no Rust/product consumer; its load-bearing correctness gate is traceability. Invariants: the traceability gate ALWAYS runs (doc/registry tags and activated-stage coverage are load-bearing evidence, and a run with zero checks is unmergeable); any docs-site/ change runs the PR lint/unit/traceability lane; any other non-Markdown path runs that same lane. Main pushes also run thin CI only; the full evidence for main's exact SHA is the uncancelled golden run that produced it, and main advances only by fast-forward to that tested SHA. The classifier is plain git diff over the PR merge commit (HEAD^1..HEAD, fetch-depth 2) — no third-party changed-files action on the self-hosted runners. Skipped-required-check note: GitHub treats an if-skipped job as satisfying required status checks, and the classifier + traceability always report, so thin PRs stay mergeable." 2770:title = "releases#95: `docs/FLAKE-LEDGER.md` rows are keyed by the TEST (or CI-step) NAME, never by a hand-numbered position column. The number column made an append-at-end table into a merge hazard — two lanes each appending \"row N+1\" conflict textually AND mint the same N — but the harder half is that a POSITIONAL key can be squatted: commit 5199464 (2026-07-15) minted the citation `FLAKE-LEDGER #15` for the HEAVY-AT-BIRTH classification ruling WITHOUT adding a ledger row (the table was 14 rows before and after), the label then propagated to 20 further sites across `.config/nextest.toml`, six test-file headers, two triage docs and this registry, and commit e1a3338 (2026-08-01) appended a genuinely unrelated row 15 (the servicehost pid-identity defect) — so every in-tree `#15` citation silently resolved to the wrong entry until this change. The fix is therefore BOTH halves in one commit: drop the column AND re-key every citation, in-table and out. In-table backrefs (rows citing #7/#8/#10/#12/#13 in their own prose) become test names; external citations become `FLAKE-LEDGER: `; the phantom `#15` class is re-pointed at what it actually names — the HEAVY-AT-BIRTH ruling, whose canonical text is the `.config/nextest.toml` stanza, cited by ruling name and not by any number. Gate: doc — the ledger states the keying discipline, carries no number column, and BACKFILLS the row the phantom number concealed. That backfill was deferred to doyle at first report and handed back (2026-08-02): the primary RCA log predates doyle's last context reset and is not retained, so the 20 citation sites plus `5199464`'s own commit message — which ends \"Ledger entry appended.\" over a diff that touches only `ci.yml` and `.config/nextest.toml` — ARE the surviving record. The row is therefore written in date order rather than appended, and states in its own status column that it is reconstructed and which evidence (run ids, per-sighting timestamps, raw gate logs) did not survive; a backfill indistinguishable from a contemporaneous row would be cited as if it carried primary evidence. The ledger intro carries that backfill discipline as a standing rule. Kin REQ-HEAVY-UNIT-CLASSIFICATION, REQ-CI-WINDOWS-PHASE-A-BOUND (both cite the ledger)." 2796:title = "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 — 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a terminal stream — a replayed historical Attach must not steal (same-identity silent become_controller, no Displaced) or clear (replayed-EOF detach_session) a LIVE controller. The legitimate same-by successor re-take after a brain restart still silently re-takes: the discriminator is stream LIFECYCLE, never origin identity. Gate: int — production-path regression D1: finished historical Attach + current active Attach, same endpoint/origin; restart target brain only (real run_dispatch_loop rediscovery, NO manual re-serve — the pre-fix e2e bypass is the lesson); prove the historical stream neither takes nor clears the current controller and current input/output stays exactly-once without detach; doc — KNOWN-HAZARDS 7.41. HEAVY nextest group at birth (the HEAVY-AT-BIRTH ruling, .config/nextest.toml). Kin REQ-REDISPATCH-FINISHED-RETIRE (the mechanism), REQ-BRAIN-RESUME-NO-CONTROL-STEAL (the CLOSED session-cursor sibling — different leg), ADR-0038." 2797:required_stages = ["doc", "int"] # ACTIVATED REDISPATCH-TRUTH W1 (todlando 2026-07-16). doc = KNOWN-HAZARDS 7.41; int = redispatch.rs D1 (Served-retired historical attach) + D1b gate-round-1 (finished-UNRETIRED orderings: kill gen1 mid-serve THEN detach — pre-existing-backlog/brain-down-detach shape; gen2 skips + retires-on-sight, current controller unharmed across multi-second polls) — both production run_dispatch_loop via killable dispatch_fixture generations. HEAVY at birth, all three strings. 2806:title = "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix B): stream classification identity is RESTART-DURABLE and independent of the evictable data ring — today reconstruction classifies via peek_first_line from ring seq 0, but StreamLog is a bounded 4096-transport-chunk ring (DEFAULT_STREAM_RING_CHUNKS, nethost.rs:111), so a high-traffic ACTIVE stream's opener/Request record evicts and replay classifies Unknown/Failed = active stream permanently abandoned. Pin an immutable bounded opener/classification fact (the complete first NDJSON record, or its derived family+cursor facts) OUTSIDE the data ring per broker-held inbound stream, held until stream close; recovery classifies from that metadata, never ring seq 0. Ring semantics and size untouched (enlarging the ring for a correctness fact is REJECTED). Gate: impl — the pinned opener fact + classification cutover; unit — classification survives full ring roll-over; int — production-path regression D2: push >4096 transport chunks on an active Attach (opener evicted), restart dispatcher, prove durable classification resumes the SAME operator stream. HEAVY nextest group at birth. Kin REQ-DISPATCH-CLAIM-RETRY, REQ-HAZARD-REDISPATCH-CONTROL-STEAL." 13:// [impl->REQ-DOCS-1] 14:// [impl->REQ-DOCS-4] 101:// [impl->REQ-DOCS-5] 166:// [impl->REQ-DOCS-5] 209:// [impl->REQ-DOCS-5] 236: // [unit->REQ-DOCS-5] the api stand-in adapter injects at EVERY depth the 325: // [unit->REQ-DOCS-5] 348: // [unit->REQ-DOCS-5] 369: // [unit->REQ-DOCS-5] 383: // [unit->REQ-DOCS-5] 412:// [impl->REQ-XTASK-SPT-BIN-TARGET-DIR] 438: // or an isolated-target rig looks in the wrong place. [impl->REQ-XTASK-SPT-BIN-TARGET-DIR] 450: // [impl->REQ-DOCS-CHANGELOG-PAGE] the changelog half is a returning seam 466:// [impl->REQ-DOCS-CHANGELOG-PAGE] 500:// [impl->REQ-DOCS-5] 545:// [impl->REQ-DOCS-NO-INTERNAL-CODES] 570:// [impl->REQ-DOCS-NO-INTERNAL-CODES] 571:// [impl->REQ-DOCS-CHANGELOG-PAGE] 629:// [impl->REQ-DOCS-CHANGELOG-PAGE] 655:// [impl->REQ-DOCS-CHANGELOG-PAGE] 692:// [impl->REQ-DOCS-CHANGELOG-PAGE] 730:// [impl->REQ-DOCS-NO-INTERIOR-SPACE-RUNS] 770:// [impl->REQ-BUILD-UNIQUE-BIN-NAMES] 802:// [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL] 817:// [impl->REQ-DOCS-NO-INTERNAL-CODES] 820: // [impl->REQ-DOCS-CHANGELOG-PAGE] the generated changelog page is 831:// [impl->REQ-DOCS-NO-INTERNAL-CODES] 1122:// [impl->REQ-CI-WINDOWS-PHASE-A-BOUND] 1148:// [impl->REQ-CI-WINDOWS-PHASE-A-BOUND] 1161:// [impl->REQ-CI-WINDOWS-PHASE-A-BOUND] 1216:// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN] 1262:// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN] 1291:// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN] 1311:// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN] 1343:// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN] 1371: // [unit->REQ-CI-LOAD-BEARING-PATCH-PIN] the in-force shape: the manifest pins 1383: // [unit->REQ-CI-LOAD-BEARING-PATCH-PIN] FAILURE MODE 1, stanza deleted. This is 1392: // [unit->REQ-CI-LOAD-BEARING-PATCH-PIN] FAILURE MODE 2, a re-resolve returns the 1401: // [unit->REQ-CI-LOAD-BEARING-PATCH-PIN] FAILURE MODE 3, the lock carries a 1416: // [unit->REQ-CI-LOAD-BEARING-PATCH-PIN] a longer crate name that merely STARTS