292:title = "Local message delivery: TCP-first to a registered address, spool fallback when offline; id->address via registry (stale-clean first); reply routing (__REPLY_TO__)"
304:title = "Listener stream stdout emits EVENT envelope lines (sister-format, ADR-0001): parse the __REPLY_TO__ frame, pass pre-formed typed envelopes through verbatim (no double-wrap), compose <EVENT type=\"msg\" from=…> otherwise, chunk oversized lines into EVENT-PART"
308:title = "The <EVENT type=\"msg\" from=…>body</EVENT> envelope (spt-proto::event, the ADR-0001 grammar) is the SOLE canonical arriving-message format at EVERY harness arriving-message surface on an AGENT perch — api listen AND api poll/worker-poll, byte-identical (reverses REQ-MSG-4's 'hook drains keep the raw frame by contract'). SCOPE CARVE-OUT: the shell-command relay (api poll <shell-id> --link, cmd_poll_shell) is a distinct internal transport carrying RAW MAC'd stamped frames the shell child consumes verbatim — NOT an arriving-message surface, deliberately EXEMPT from <EVENT> composition (notify_shell_e2e guards this boundary). __REPLY_TO__ — mis-elevated during the clean-room port to a fake ADR-0001 'stable wire format' (spt-msg/wire.rs, lib.rs) — is REMOVED entirely (spool format_row, the spt-msg TCP frame, emit parse_frame); (from, body) carried structurally, <EVENT> composed once at the delivery boundary. No legacy sister-interop (spt-core never required it). Reply-correlation rebinds onto the structural from / <EVENT from=…> attribute (ADR-0009 access-gate + ADR-0012 Psyche/spt-live reply-target). Self-delimiting by construction → finding F-002 (non-self-delimiting multi-message poll) dissolves. ADR-0020."
309:required_stages = ["doc", "impl", "unit", "int"]  # doc activated 2026-06-15 (ADR-0020 + amendments to ADR-0009/0012, design crystallized via grill-with-docs, operator-ruled); impl/unit/int activated 2026-06-15 — the multi-crate refactor landed (spt-store/spt-msg/spt/spt-daemon/spt-live). Supersedes the __REPLY_TO__ clauses of REQ-MSG-1 + REQ-MSG-4.
1176:title = "Psyche outbound captured + sanitized: the live-Psyche turn driver captures stdout (never Stdio::null), and the daemon strips/re-stamps Psyche-supplied from=/target and constrains routing (reply→__REPLY_TO__ sender, notify→own user/subnet) (7.3)"
1672:id = "REQ-SEND-REPLYTO-REMOVE"
1673:title = "Remove the `--reply-to` TARGET FALLBACK and its REPLIED label from `spt send` — a nicety that confuses agents and has NO WIRE EFFECT (ADR-0020 already made messages structural (from,body), no __REPLY_TO__). Hard-remove (no deprecation shim): the target fallback (a bare `spt send --reply-to <sender>` delivering with no positional), the is_reply/REPLIED label branch (always SENT/QUEUED), the `send` how-to example, and the mention in REQ-DOCS-6's send topic. Reply-correlation stays on the structural `from` attribute; `target` is a REQUIRED positional. (v0.16.0) — AMENDED WEBSERVE W2 (2026-09-07): this requirement is about the SEMANTICS, not the spelling. ADR-0061 re-uses `--reply-to` for a DIFFERENT thing — a parent message short-ID carried as an additive envelope attribute (REQ-MSG-SHORT-ID) — which leaves both killed halves dead: the flag still cannot stand in for the target, and it still stamps no label and changes no delivery. The unit cell is repinned to assert those two properties against the live flag rather than asserting the string no longer parses."
1740:required_stages = ["impl", "unit", "int"]  # ACTIVATED F-025 item 1a + final-wave int (todlando). AMENDMENT 2026-07-27, RE-PINNED by the builder (FIELD-TRUTH W1 leg D): impl = KIND_COORDINATOR_IMAGE_ANNOUNCE/_REPLY + KIND_COORDINATOR_IMAGE/_REPLY + the three DTOs (msg.rs) → run_brain announces {env!("CARGO_PKG_VERSION"), generation} post-hello via Brain::announce_coordinator_image (brainproc.rs/brain.rs) → broker records it ONLY on an exact match with brainproc::supervised_generation() (the AtomicU64 supervise_brain publishes at every spawn), gated by the pure coordinator_announce_accepted / answered by the pure recorded_coordinator_image, both re-checked at READ time so a superseded generation stops reporting (broker.rs) → Brain::coordinator_image_version client (brain.rs) → cmd_daemon_status queries it on the SAME handle and prints render_coordinator_image_line FIRST, with render_broker_image_line de-fanged to informational (no warning verb, no remedy) + JSON coordinator_image/coordinator_stale, stale None on query failure AND on an unreported coordinator (unknown ≠ stale) (cli.rs). DISCRIMINATOR NOTE: role cannot identify the coordinator — recv_hello(.., Role::Brain) admits every client incl. the CLI's own Brain::cold_start — and BRAIN_PROMOTED's version is disk-sourced + trial-path-only, so neither could carry this. unit = coordinator_image_line_is_the_only_stale_warning (matched / stale→warn + refresh-only, never stop+start / unreported→no warning / stale broker under a matched coordinator raises NOTHING) + broker_image_line_reports_without_warning_or_remedy (all three cells: no remedy, no nag) + only_the_supervised_generation_can_claim_the_coordinator_image (the pure announce + read gates: impostor generations refused, superseded record not reported). int = the_running_coordinator_reports_its_compiled_image_and_no_impostor_can (a REAL supervised `spt daemon brain` child announces to a REAL broker over the production socket; a CLI-shaped client reads back its compiled version, and the same client's own announce is refused without disturbing the record). Original evidence below stands for the broker leg. impl = KIND_BROKER_IMAGE/_REPLY + BrokerImageReply (msg.rs) → broker self-report dispatch_broker_image from env!("CARGO_PKG_VERSION") (broker.rs) + Brain::broker_image_version client reading the reply, KIND_ERROR (old broker's `unknown command kind`) → None (brain.rs) + cmd_daemon_status queries both net-status and the image on ONE handle and renders render_broker_image_line beside the installed version; JSON broker_image + broker_stale (final-wave tightening: broker_stale is None on a query FAILURE — Err, not a false-positive true — vs a definite bool only after a successful Ok query) (cli.rs). unit = broker_image_line_flags_a_stale_running_daemon (matched→"matches installed" no-nag / mismatch names both + restart recovery / None still flags older + recovery / no internal-marker leak). int = broker_reports_its_compiled_image_version_over_ipc (a Brain connected to a live served broker round-trips KIND_BROKER_IMAGE → Some(the broker's compiled CARGO_PKG_VERSION); the old-broker→None leg rides the router unknown-kind default, caught client-side).
1760:id = "REQ-WAN-SEND-DELIVERY"
1765:title = "Bug #4: spt rc to a remote endpoint fails with 'no live session' though endpoint list shows it Active — rc.rs:1063 resolves only the LOCAL broker session table and always dials loopback, never consulting the registry or dialing the owning node (the cross-node attach transport exists in the broker; only the client leg is missing). Fix: on a local resolve miss, resolve the owning node from the registry (reuse resolve_across_visible), net_dial that node, and run a remote session-resolve + serve_attach round-trip (mirror the wansend resolve-dial-round-trip pattern). Shares the resolve-owning-node primitive with REQ-WAN-SEND-DELIVERY. See docs/NEXT-MILESTONE-BUG-TRIAGE.md #4."
2388:title = "UPDATE-WEDGE round 3 (v0.30.5, doyle-ruled Option A 2026-07-09 — the v0.30.4 field-verify re-wedge, root code-PROVEN + dead-peer-INDEPENDENT): the daemon brain must NOT subscribe broker PTY sessions onto its own request/reply IPC conn — it has no consumer for that output and the subscription DEADLOCKS the conn. ROOT (todlando code-read, docs/UPDATE-WEDGE-2-ROUND3-CODEREAD.md; the net-runtime AND the counter-54 reap-drive were both FALSIFIED first — docs/UPDATE-WEDGE-2-ROUND3-RIG-VERDICT.md): a conn's send half is a single `SharedSend = Arc<Mutex<SendHalf>>` (broker.rs:78). Subscriber writer threads (`viewer_writer` broker.rs:1333/1342, `controller_writer` :1451) hold `send.lock()` ACROSS a BLOCKING `write_frame`; the dispatch reply path (`send_frame` :4221 → KIND_SESSIONS_REPLY / KIND_NET_STATUS_REPLY) needs the SAME lock. `resume_sessions` (brain.rs:1031→1054) subscribes every session as a Viewer onto the brain's MAIN conn — which is ALSO the brain's request/reply channel. The daemon brain hosts no PTY sessions (brainproc.rs:184) so run_brain never drains that output; it reads the conn only during the 500ms-heartbeat net_status()/sessions() calls (drain-and-DISCARD, `_ => continue`). When an actively-streaming session backs the conn up, a subscriber writer BLOCKS in write_frame holding send.lock() → the dispatch thread can't send the heartbeat reply → net_status()/sessions() never return → the heartbeat loop stalls → the brain never drains → the writer stays blocked = SELF-DEADLOCK on the brain conn's send mutex → every subscriber writer on it wedges → BRAIN_SUBSCRIBER_STALL_EVICT (controller writer blocked >15s). BOTH severities, one mechanism: RESPAWN (resume subscribes N + the replay burst floods the conn before the loop drains) AND STEADY-STATE (an active streamer's output between heartbeats fills the socket buffer). Counter-54 (REQ-UPDATE-TRIAL-DRAIN-DRIVE) added a 2nd per-heartbeat reply round-trip (sessions()) through the contended mutex — WIDENED the window (regression-window-exact), did not create it. The round-2 Viewer fix (REQ-BRAIN-RESUME-NO-CONTROL-STEAL) removed the STEAL but kept the brain a SUBSCRIBER — viewer_writer has the same send.lock()-across-write pattern AND viewers have no stall-evict valve — so v0.30.4 field-verify wedged again. FIX (Option A, brain-side, SEAMLESS): resume_sessions does NOT subscribe (drop the subscribe_with call; §3 verification guard confirmed NO brain consumer — digest/relay/net-consumer/shellwake/presence — reads the resumed subs). The brain conn then carries only request/reply → no subscriber backpressure → no deadlock. Keep the session_cursors seed only if harmless. Rides the brain-swap ⇒ seamless (no daemon.rs:368 broker restart). Option B (a dedicated Split-reader drain of the brain conn, brain.rs:230 — the pump's carrier) is the FORWARD path for when genuinely daemon-DRIVEN sessions land (the live-agent adapter) — deferred, noted, not built. Option C (the broker-side durable CLASS fix) = REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK, deferred. Int = the confirmer rig (brain+broker+PTY, brain_decouple template): N sessions actively producing output, brain resume-subscribed onto its req/reply conn; RED-first = heartbeat stalls + an active-streaming controller stall-evicted >15s WITHOUT any dead peer present (proves dead-peer-independence); assert BOTH severities (respawn interleave + steady-state output backup); Option A turns both green. Composes with REQ-BRAIN-RESUME-NO-CONTROL-STEAL (the round-2 Viewer fix this supersedes as the wedge cure), REQ-UPDATE-TRIAL-DRAIN-DRIVE (the counter-54 reap-drive that widened the window), REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE (the stall-evict it stops triggering)."
2465:id = "REQ-PUMP-DIAL-FASTFAIL"
2466:title = "PUMP-TRUTH W1 (RE-SCOPED post round-2 empirical lock — the DIAL is EXONERATED, healthy ~100ms): a pump worker-leg PEER-REPLY read to a connect-then-silent / half-alive peer must drop THAT peer as an ORDINARY per-peer failure (peer_outcome's non-TimedOut arm -> PUMP_PEER_FAIL -> drop conn + redial, round CONTINUES, heartbeat advances), NEVER burn the brain's 30s PUMP_PEER_IO_TIMEOUT carrier deadline into a whole-round TimedOut POISON -> supervise_pump doubling-backoff restart. ROOT (deployah leg-instrumented capture, enlyzeam, 3 identical rounds): DIAL_EXIT 96ms ok, LEG i=3 update ms=30025 err[TimedOut] = the wedge. request_update (propagate.rs:373-375) opens the update stream + sends UpdRecord::Query (all bounded, all land), then BLOCKS read_event_until(deadline=call_deadline()=30s) on the peer's Offer/UpToDate reply; a peer that accepts the stream but never answers burns the full 30s -> TimedOut -> peer_outcome (pump/mod.rs:601) POISON -> whole-round abort + restart (= the field PEER_PUMP_FAIL: brain IPC read deadline, always-zero PUMP_PEER_FAIL). request_sync (sync.rs:374-376) is the LATENT TWIN (SKIPS the reply-read only when the want-set is empty; bites the moment it is non-empty against a silent peer). FIX (both legs): (a) reclassify the reply-read no-progress timeout OUT of TimedOut to a non-poison kind (Brain::read_peer_reply_until) so peer_outcome drops ONLY that peer -- poison RESERVED strictly for a genuine broker-IPC-CARRIER desync (the carrier ops net_open_stream/subscribe/send keep raw TimedOut); the abandoned peer stream is safe (exactly-once seq cursor stays contiguous, a late reply matches no live stream id). (b) budget-decouple the reply-read below 30s (Brain::reply_read_deadline = now + min(io_timeout, 10s)) so a silent peer drops promptly even in the still-sequential pre-W2 pump and can never race the carrier deadline. Files: propagate.rs (request_update) + sync.rs (request_sync) + brain.rs (reply_read_deadline + read_peer_reply_until) + pump/mod.rs (peer_outcome poison reserved for carrier-desync). Gate: a connect-then-silent peer at fan#0 -> the update leg drops it ordinarily within the reply-read budget, round continues + heartbeat advances, NO PEER_PUMP_RESTART; happy path (live peer) unchanged; + the sync-non-empty-want-set latent case. Kin REQ-PUMP-PEER-ISOLATION (W2 concurrency, VALIDATED by this root) + REQ-HAZARD-PUMP-IPC-DEADLINE (the poison it must stop mis-firing on a peer)."
2467:required_stages = ["impl", "unit", "int"]  # ACTIVATED PUMP-TRUTH W1 (todlando build 2026-07-08, doyle dispatch — root round-2 empirically locked, docs/PUMP-TRUTH-TRIAGE.md @206884f). **TITLE ABOVE IS REFUTED / RE-SCOPED post-RCA** (8 refutations + round-2 field lock, docs/PUMP-TRUTH-TRIAGE.md 'ROUND-2 EMPIRICAL LOCK' @206884f): the DIAL is EXONERATED (119ms healthy, not the bug). REAL fix = the pump worker-leg REPLY-READ poison — request_update (propagate.rs:373-375) + request_sync (sync.rs:374-376 latent twin) block 30s on a connect-then-silent peer -> peer_outcome (pump/mod.rs:601) POISONs the whole pump. (a) reclassify the reply-read timeout as an ORDINARY per-peer DROP (poison RESERVED for real broker-IPC-carrier desync) + (b) budget-decouple <30s. Files: propagate.rs + sync.rs + pump/mod.rs. Kin REQ-PUMP-PEER-ISOLATION (W2 concurrency, VALIDATED by this root) + REQ-HAZARD-PUMP-IPC-DEADLINE (the poison it must stop mis-firing).
3874:title = "When a message reaches an endpoint because an access ENTRY admitted its sender, and the receiving agent holds NO MONIC about that sender, the delivery edge composes a system-authored TRUST WARNING and delivers it alongside the message. The entry is a routing decision — often made by a human at a knock, sometimes weeks earlier — and it says the peer may speak; it says nothing about whether the receiving agent has decided anything ABOUT them, and the warning is what closes that gap before the agent acts. THE CLASSIFICATION QUESTION IS MONIC-ONLY: an access entry naming the peer is NOT a classification, since the entry is the very thing that let them in, and reading it as evidence of judgement would silence the warning exactly when it is warranted. THREE RATIFIED NON-WARNING CASES, stated because a warning that fires on invited traffic teaches agents to ignore warnings, which costs it its only job: SAME-NODE arrivals are inside the node's own trust unit; a REPLY is correlated to the agent's own outbound, so it is traffic the agent itself invited; and a POSTURE-OPEN pass admits nobody in particular — no entry named this peer, the endpoint simply is not refusing anyone. A WILDCARD entry warns exactly as a named one does: it admitted a peer the agent never named at all. THE WARNING NEVER CHANGES DELIVERY. The gate already allowed the message; the warning is advisory text that rides alongside, is skipped for a duplicate (the replay check precedes it, so a retried message does not re-warn), and — when it cannot be delivered at all — costs a loud diagnostic naming the unwarned delivery rather than withholding a message the gate permitted. IT IS NEVER PART OF THE PEER'S BODY, because a warning inside the body is indistinguishable from one the sender wrote — precisely what a stranger would forge. THE CARRIER IS THE DELIVERED MESSAGE'S OWN ENVELOPE (REQ-TRUST-WARNING-ENVELOPE, which changed the carrier and left this rule untouched): the block rides as a `trust-warning` attribute composed by the RECEIVING node, so the caution and the message it is about reach the agent in ONE arrival, and the sender authors the text in neither design — an attribute is not the body, and it is composed exactly where a matched monic's is. Where the body is ALREADY A TYPED ENVELOPE it can carry no attribute, and there the warning keeps its own system-authored delivery under a RESERVED author id (not a legal endpoint id, so no peer can author under it), delivered FIRST over the same cascade the message takes, so the caution is read before the message it is about. THE DECISION CONSUMES THE GATE'S OWN VERDICT AND NOTHING ELSE: the pass reason IS the posture question (an entry matched means the chain never reached a mode tier), so there is no second read of the access store, whose snapshot would be taken after the decision it purports to explain. The receiver's own mind is read as a PLAIN FILE off the tracked root, never through the store's ensure-worktree path, because that path spawns git and this question is asked on the inbound message path. An unreadable monic is not a classification, so a husk makes the warning fire rather than suppressing it. TWO LIMITS, RULED (doyle 2026-07-31, at T6's acceptance): (1) a sender the daemon could not prove IS still warned about, and that warning is UNSUPPRESSIBLE by design rather than merely fail-safe — a peer nobody can name is more of a stranger, not less — since monic-only classification means no provable id yields no monic, so every unproven sender on an entry-admitted pass warns, which is honest — they ARE unproven — and self-heals as the fleet's daemons come to stamp their senders. THE TEXT DISCIPLINE IS THE LIMIT THAT KEEPS WARN-MORE FROM BECOMING WARN-NOISE, and is required, not stylistic: the block names the admitting RULE as the way out and NEVER prints a classify command that cannot be run, because an instruction the reader cannot carry out is what turns an unsuppressible warning into noise the agent learns to skip; (2) the override text (the elevation-gated verb, own requirement) replaces ONLY the advisory paragraph — RATIFIED at the same acceptance, on the grounding that override text is agent-behavior instruction and therefore a prompt-injection surface, so keeping the factual spine unforgeable BOUNDS that surface: a whole-block override would let one elevated write hide who is knocking, which no legitimate override needs — the line naming the sender and stating that no note is held, and the line saying how to classify them, are always core-composed, so an override can change what the agent is cautioned about but never hide who is knocking. Gate: impl — the pure warn-or-not decision over the verdict's pass reason and the monic predicate, the store-free tracked-root read, the composer with its reserved author, and the delivery-alongside at the WAN edge ahead of the message legs; unit — the full table (every pass reason x monic-held/not, with the three non-warning reasons asserted by name and the wildcard case asserted to warn), the composer naming the peer, the three cautions and the exact classify command, the override replacing the advisory while identity survives, the unnamed-sender text carrying no unrunnable command, and the tracked-root read answering identically to the store form while creating no worktree for an agent that has no mind."
3948:title = "REDEMPTION TRAVELS AS ITS OWN KIND-TAGGED WIRE FAMILY, never a field on `KnockRecord`. Extending the knock record was refused on the record and the reason is the decisive one: UNKNOWN FIELDS DECODE FINE, so an older minter would ACCEPT a redemption as an ordinary knock -- pending in its inbox, no auto-approve, the code unconsumed, a knock-shaped ack returning -- and MISREAD IS WORSE THAN DROPPED. A new kind means an N-1 daemon resolves it to the unknown family and DROPS IT CLEAN, which is the honest failure. THE REDEEMER'S IDENTITY IS DAEMON-STAMPED at the proven-sender tier and never caller-supplied, the same seam the knocker stamp already rests on. THE OUTCOME IS A TRIPLE AND THE THIRD MEMBER IS LOAD-BEARING: REDEEMED (the granted surfaces, the one-directional sentence and the reverse command), REDEEM_REFUSED (ONE anti-oracle message covering unknown, expired, consumed-by-ANOTHER-EXCHANGE AND rate-limited alike -- WHICH budget or which reason a caller exhausted is itself the oracle), and REDEEM_UNCONFIRMED (no answer at all -- an older node or an unreachable one), which must NEVER collapse into refused: silence is not a decision, and a redeemer told 'refused' would stop trying a code that was never seen. THE REDEEMER RENDERS FROM THE REPLY, not from its own store, because redemption executes on the MINTING node and the redeemer holds no code record -- so the granted surfaces, the target and the acknowledgment citation ride the REDEEMED reply, while REFUSED CARRIES NOTHING AT ALL and UNCONFIRMED CLAIMS NOTHING (a refusal carrying a target would be the oracle the single message exists to prevent). THE RATE LIMIT IS THE RECEIVING NODE'S OWN, enforced against its own store and clock, and it SHARES ONE BUCKET with knock arrivals from that origin: both are attempts at the same door. A REPEAT OF THE EXCHANGE THAT ALREADY SPENT THE CODE IS ECHOED, NOT REFUSED (releases#193): the receiving node records WHICH wire exchange consumed each code -- the handshake-proven origin, the stamped redeemer and that presentation's own correlation id, plus the `reverse_requested` its first reply carried, which is the one field a later reply cannot recompute once the due is consumed -- and a presentation matching all three is answered with the SAME REDEEMED payload, reply-only: no second rule, no second minter courtesy, no second monic. This is the promise the seam's replay comment already made -- a replayed REDEEMED finds nothing unconsumed and writes nothing -- and the claim arm contradicted: measured on the two-host ladder, two dispatcher PROCESSES on one node each served one redemption, the winner consumed it and notified the minter, and the LOSER's refusal reached the presenter 88 ms ahead of the winner's REDEEMED -- so a redeemer was told 'nothing was decided and nothing was spent' about a grant written in their own name, which is the misread the outcome triple exists to prevent. The single anti-oracle message is UNCHANGED for every other cause, byte for byte, and the oracle does not widen: an echo requires proof of the exchange, which a guesser holding only the code string does not have. The dispatcher-exclusion half -- why two serve loops can exist at all -- is NOT this requirement's (releases#194). Gate: doc -- the networking entry naming the family, its tag and the outcome triple; impl -- the record, the reply, the classifier arm and the serve side; unit -- the record classifies into its own family and is never read as a message feed, an N-1 receiver drops it clean, the three outcomes are distinct with silence never rendering as refusal, refused and rate-limited emit the IDENTICAL message, and a refused reply carries no target."
3973:title = "`spt ring` BLOCKS until the reply arrives or the wait elapses, in the arms where blocking is the honest behaviour. Ringing is a question, and a verb that returns instantly having only DISPATCHED the question makes the caller invent their own wait — which is the shape the request was filed against (releases#39). THE SCOPE IS BLOCKING ONLY. The wait UNIT and its DEFAULT VALUE are releases#59 and stay OUT of this requirement entirely: they are a separate ratification and folding them in would let one change smuggle a timing default past the gate that ruled on behaviour. THE ARMS ARE MAPPED AND THE MAP IS PART OF THE CONTRACT, recorded here so a later reader does not re-derive it wrongly from the symptom. THE MAP IS STATED BY REPLACEMENT: an earlier three-arm reading of this code (the builder's own, posted to the issue and carried into the dispatch) said flatly that 'a perchless caller already blocks', and that is TRUE ONLY WHEN THE TARGET IS LISTENING AT THAT INSTANT. It is corrected here rather than annotated, because that sentence is what made the report look like it might be about expectations rather than a defect. THE ARM THAT WAS MISSING IS THE ONE THE REQUEST IS ABOUT: a perchless caller takes `Occupancy::Vacant` and builds its ephemeral reply perch, then `deliver` attempts a live send and FALLS BACK TO THE SPOOL whenever that fails — which is not merely the offline case but the ordinary state of a WORKING agent that is mid-turn, the same condition that makes `spt send` report QUEUED. On that path ring used to tear the ephemeral perch down (`remove_dir_all`) and return immediately, DELETING THE ONLY ADDRESS THE REPLY COULD ROUTE BACK TO before any reply could exist. So the reply was unreachable by construction — literally the report's 'a reply can never be processed' — and the same command had opposite semantics for the same caller depending on whether the callee happened to be mid-turn. THE FIX IS THAT A SPOOLED DELIVERY WAITS EXACTLY LIKE A LIVE ONE, entering the same loop, with cleanup still running on every exit. The loop needed no change to cover it: it already drains the perch's SPOOL as well as polling the listener, which is the leg a late reply arrives on. This touches NEITHER ruled constraint — `Vacant` means there was no perch to adopt so the adoption guard is not on this path, and the caller has no live listener to race. THE TIMEOUT OUTCOME MUST SAY WHICH SILENCE IT GOT: a spooled message that was never collected is a different event from a live message that was read and not answered, and a caller told 'did not reply' about mail nobody has picked up draws the wrong conclusion about the peer. The two are therefore SEPARATE OUTCOMES rather than one flag. The superseded `Queued` outcome is KEPT UNCONSTRUCTED rather than deleted: removing it is a public API change with nothing to do with this defect, and the wait-unit request may want exactly that shape back as an explicit no-wait mode. TWO ARMS ARE NON-BLOCKING FOR REASONS THAT SURVIVE THIS CHANGE, and neither is a defect to close: (1) `Delivered` — the caller HAS a live listener, and blocking in the ringing process would race the listener that is already going to receive the reply, so the reply is delivered where the caller is actually listening rather than to a second waiter competing for it; (2) `PerchExists` / `StaleDir` — these are held by REQ-HAZARD-RING-PERCH-ADOPTION, where adoption once deleted a LIVE endpoint AND its spool. THAT GUARD IS NOT THE BUG AND MUST NOT BE REMOVED TO SATISFY THIS REQUIREMENT — it is named here in as many words because deleting it is the shortest path to a green demo of blocking and it would re-break an invariant already paid for once. ALL THREE NON-BLOCKING ARMS ALREADY PRINT EXPLANATORY STDERR (verified in `cmd_ring` at recon), so this requirement adds no diagnostics and must not be read as asking for any. Gate: impl — the spooled path entering the existing wait with cleanup on every exit, the distinct not-yet-collected timeout outcome, and the adoption guard untouched; unit — a reply arriving inside the wait returns it, a LATE reply on the spooled path (the arm where the reply used to be unreachable) still reaches the caller, a spooled wait that elapses returns the not-yet-collected outcome and is asserted NOT EQUAL to the live timeout outcome so the two cannot be collapsed later, and each non-blocking arm is asserted to STILL not block and to still carry its explanatory stderr (the regression rows that keep a later 'make it always block' from eating the hazard guard); int — the real binary rings a real perch whose peer answers LATE, and the reply reaches stdout, with the elapsed time asserted to show it both waited and stopped waiting on the reply rather than on the deadline."
4006:title = "Passing the engine room's bring-up gate BRINGS THE ENGINE ROOM UP: the node spawns its session through the adapter bound at the ceremony, and the operator's attach then lands on it. Today it does not, and the endpoint is entirely inaccessible (releases#71, operator-reported): the ceremony provisions a record, the gate is complete and correct, and NOTHING ANYWHERE SPAWNS THE SESSION — `BringUp::Admitted` briefs and returns proceed, and the attach falls through to the ordinary no-live-session refusal. THE SPAWN LIVES DAEMON-SIDE (ruled): the broker owns hosting, so a client-side spawn would replicate hosting logic in the CLI and race the attach that follows it; the daemon already launches harnesses on its own behalf at autostart, which is the shipped precedent for the mechanism and for its threading. The attach that follows the spawn WAITS FOR READY UNDER A BOUND — a wait with no bound turns a broken adapter into a hung terminal, and no wait at all reintroduces the same no-live-session refusal one race later. THE ENTRY POINT IS PART OF THIS REQUIREMENT AND IS STATED HERE BECAUSE IT IS WHERE THE DEFECT ACTUALLY BITES: with no session hosted, `spt rc engine-room` never subscribes at all — it resolves no local session, resolves no owning node for an endpoint that is deliberately never advertised, and returns the reported 'No live session' before any code reaches the daemon, so the typed code is verified NOWHERE and the Admitted arm is unreachable in exactly the flow the operator ran. A fix that adds a spawn leg to that arm without giving a session-less bring-up a way to reach the gate closes nothing. VERIFICATION STAYS DAEMON-SIDE WHEREVER THE ENTRY LANDS: the adversary in this threat model is an agent on the box, which can speak the broker's IPC and never run a line of the CLI, so a client-side check is a courtesy and the rule must be evaluated where the session is hosted. THE ENTRY IS AN ADDITIVE BROKER REQUEST carrying the code (ruled): the daemon runs the same classifier it already owns, spawns on admit, and replies the session the operator then attaches to. Additive is the ADR-0001-safe shape, and an N-1 broker that does not know the verb answers unknown — WHICH THE CLIENT REPORTS HONESTLY IN THE OPERATOR'S OWN WORDS, naming the version skew, and NEVER falls through silently to the resolve path that produces the very no-live-session refusal this requirement exists to kill. The spawn RUNS OFF THE REQUEST HANDLER on its own thread, following the autostart replay's shipped shape, because the launch dials the broker as a client and must not run inline inside the handler serving that request. THE GATE IS SPENT ONCE PER BRING-UP, and the deciding argument is NOT budget arithmetic but the TOTP WINDOW RACE: the bounded spawn wait can outlive the ±1 ceremony window, so a code re-presented at the following subscribe can be REFUSED by the same gate that just admitted it — charging the human a ledger failure and rebuilding gate-admits-then-attach-refuses one seam later, which is the exact shape #71 exists to kill. The admitted bring-up therefore mints a SINGLE-USE ADMIT TICKET for the subscribe that seats the controller: a random secret of at least 128 bits, returned in the reply, SCOPED TO THE SESSION ID the bring-up spawned, and EXPIRING 30 SECONDS AFTER THE REPLY. A CONNECTION-KEYED exemption was ruled first and is STRUCTURALLY UNREDEEMABLE at this topology, which is why the key is a ticket and why that is stated here rather than left as an implementation choice: an rc attach opens a net stream, and the subscribe that seats the controller is sent by the DISPATCHER'S OWN broker connection, never by the connection that asked for the bring-up, so the two connection ids can never match and a conn-keyed exemption could never fire at all. The key must be the thing that actually crosses the seam, and the attach's code field is already the end-to-end pipe for exactly this class of secret, so the ticket rides that field behind a reserved `admit:` prefix and no new wire field appears. THE PREFIX IS RESERVED OUT OF THE TOTP PATH STRUCTURALLY: a prefixed string is never evaluated as a code guess, because an expired ticket is not a wrong guess and must not spend a unit of the human's attempt budget — which also stops anyone on the box from ratcheting the human toward a backoff by replaying a dead ticket. The ticket is consumed BY PRESENTATION rather than by success, so a second presentation is refused even inside its window and a ticket presented for another session is spent as it is refused; expired, already-spent, wrong-session and never-minted all answer ONE uniform sentence, so a caller learns only that this string does not seat it and never whether an admit is outstanding. The TTL starts at the REPLY — after the spawn, after the bounded wait — so it covers only the client's attach turnaround and never a harness start. Entropy, TTL and single use are the ticket's whole defense, because the field it rides spends no ledger. EXEMPTION PRECEDENCE, ADDED FOR releases#203 (doyle ruling 2026-08-20): the seated-connection re-serve exemption is evaluated BEFORE the presented ticket, and that ORDER is part of the requirement rather than an implementation detail — because the ticket this requirement mints is SINGLE-USE and the connection it seats re-presents it on every re-subscribe. With the ticket matched first, a gap resume or dispatcher reconstruction of a ticket-seated controller answered `Unredeemed` and the refusal UNSEATED the human mid-session; the seat this requirement exists to establish was then lost to the very credential that established it, and the exemption was structurally unreachable for any re-serve carrying its spent ticket. Measured on golden 32341702157 (Linux leg): seat on a redeemed ticket, the SAME conn re-serving ~700ms later with `req_gen` unchanged, `engine-room-admit-unredeemed`, `session-detach was_controller=true`. Latent since the ticket shipped and first witnessed by a new e2e, not by a report — the availability half of this requirement had no same-connection witness at all. THE ORDER IS NOT A WIDENING, and the reason belongs in the requirement because it is what makes the precedence safe to state: the exemption's discriminant is the seated CONNECTION id, which belongs to another process's socket and cannot be claimed by asking, so the only attach it admits on a spent ticket is one arriving on the connection ALREADY SEATED — granted nothing it does not already hold, and dying with that connection. A ticket presented by any other connection still meets the match and is refused on its own merits, ledger untouched. Gate: doc — the engine-room setup guide's bring-up section, stating that the first bring-up spawns the session and what a bounded wait failing looks like; impl — the daemon-side spawn on admit through the ceremony-bound adapter, the bounded wait-for-ready, and the session-less entry path that carries the code to the gate; unit — an admitted bring-up spawns exactly once through the BOUND adapter, a refused one spawns nothing, a bring-up over an already-live session spawns no second session, the wait's bound is proven to be a bound (an adapter that never reports ready ends in a typed failure rather than a hang), one bring-up spends exactly one ledger attempt, the admit ticket is proven to seat the controller ACROSS THE REAL TWO-CONNECTION TOPOLOGY (the row that would have caught a conn-keyed exemption before it shipped), a SECOND presentation of the same ticket is refused, an EXPIRED ticket is refused WITH THE ATTEMPT LEDGER UNTOUCHED, a ticket presented for a DIFFERENT session is refused, and every non-redeeming presentation answers the SAME sentence so the refusal discloses nothing, a SPENT ticket re-presented by the connection that is ALREADY SEATED keeps that seat (the same-connection gap-resume row, pinned by an explicit conn-id assertion and a FIXED attach generation so a fresh-connection re-serve cannot masquerade as it), and that same spent ticket presented by a DIFFERENT connection is still refused with the ledger untouched (the non-widening control, without which deleting the refusal arm outright would satisfy the row above); int — a provisioned engine room with a registered adapter comes up end to end from the invocation the operator runs and the controller is seated on the session that was spawned."
4050:title = "Recent-traffic evidence rides NEW node-scoped state, and the REQ-SEC-1 recent-outbound correlation log is UNTOUCHED. A firewall's memory and a UI's memory must not be the same row: `RecentOutbound` is keyed (local endpoint, remote node) with no peer endpoint id, its window is REPLY_WINDOW_MS = 15 minutes, and it is the stateful-firewall 'established/related' input -- widening its key or its retention for a listing feature would silently widen an admit verdict, a security regression wearing a feature's clothes. THE CONSTRAINTS RIDE THIS MINT, NOT A LATER REVIEW: rows are (direction inbound/outbound, endpoint id, origin node key, last-seen); the retention window is 14 DAYS; the hard size cap is 512 ROWS, pruned oldest-first, so the ledger is bounded regardless of traffic shape; and it is NODE-LOCAL AND NEVER SYNCED -- it enters no replication feed, in the shape ADR-0046's node-scoped notif rows already established. Write sites: inbound is recorded POST-GATE in the WAN receive funnel (the sender endpoint is daemon-stamped and the origin node is handshake-proven; a message the gate refused is not contact), outbound at the send legs. Gate: doc -- the storage entry naming the window, the cap and the never-synced rule; impl -- the store with record/prune/cap and both write sites; unit -- a row older than the window is dropped, the cap prunes oldest-first at its stated VALUE, a refused inbound writes nothing, and the ledger is absent from every emitted feed."
4099:title = "VOCABULARY CORRECTED 2026-08-04 (ADR-0055, releases#144): the flag is --send-receive, its retired spelling was --mutual; the requirement itself is UNCHANGED and survives the ratification intact, since redeem is a REQUESTING verb and keeps its directionality declaration. `redeem --send-receive` ARMS THE REDEEMER'S OWN SIDE AND THE NODE-PROVEN `REDEEMED` REPLY CONSUMES IT. Unlike the knock case the receipt ALREADY EXISTS on this route -- the proven reply arrives back at the redeemer -- and is simply not wired to the flag, which is why this is materially cheaper than the answer-receipt build and not covered by it. ADR-0054's governing clause is the spec, verbatim: `--send-receive` stays redeemer-local, consumed once by the node-proven `REDEEMED` reply. As shipped the cross-node route arms NOTHING and refuses with a general rule -- that `--send-receive` arms the minter's side and is set at mint -- WHICH THE LOCAL ROUTE FALSIFIES by arming the redeemer's own side and consuming it in the same invocation: the refusal is keyed on the ROUTE but explains itself on the axis of flag ownership, so it is wrong wherever it is read. THE SUBJECT COMES FROM THE REPLY, NEVER FROM A LOCAL GUESS -- the redeemer holds no code record, so the counterpart identity and the surfaces are exactly what the proven reply carried, which is what the store's already-shipped empty-subject-means-whoever-answered resolution exists for. THE INTENTION IS RECORDED BEFORE THE OUTCOME IS KNOWN, so the three outcomes can be told apart on the record and not merely in a rendering: REDEEMED consumes, REFUSED disarms, and UNCONFIRMED NEITHER -- no proof, no open, and no false close either; the armed record survives the silence and expires with itself rather than being read as an answer. Gate: impl -- the arm on the redeemer's own store ahead of the send, keyed in the CODE keyspace, and the three-way consume/disarm/leave on the outcome; unit -- REDEEMED consumes exactly once and writes the reverse rule naming the subject THE REPLY carried (asserted against a reply whose target differs from anything the redeemer could have guessed locally, so a local-guess implementation fails the row), REFUSED leaves NO armed record, UNCONFIRMED leaves the record ARMED and unconsumed -- the three asserted on one fixture, since any two alone pass an implementation that collapses the third into a neighbour -- and a replayed REDEEMED reply writes the reverse rule no second time. Retirement row: the shipped cross-node refusal message is GONE from every surface that carried it, asserted by rendering the surfaces rather than by reading the source."
=== stages of the closest one ===
1760:id = "REQ-WAN-SEND-DELIVERY"
1761-title = "Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Real root: spt send resolves the dial with id-only addr_for_node_hex (endpoint.rs:538) which forces a fresh iroh discovery round-trip every send, while the gossip pump uses cached direct addresses (dial_seeded/PeerAddrStore) so gossip stays green but send rides a marginal discovery path that cannot carry the fire-and-forget payload; the handshake completes so SENT(WAN) prints falsely. Fix: (1) route the WAN dial through the pump seeded-direct-address resolution (PeerAddrStore first, id-only fallback); (2) receiver writes its WanOutcome back so the sender confirms delivery under the QUIC deadline and only reports SENT on confirmed delivery, honest failure otherwise. Access-gate/perch/spool all verified correct (ruled out). See docs/NEXT-MILESTONE-BUG-TRIAGE.md #9-10."
1762-required_stages = ["impl", "unit", "int"]  # ACTIVATED counter-38 W5 (#9/#10, todlando). impl = (a) seed_first_addr (PeerAddrStore direct-addr FIRST, id-only fallback) at all 3 wansend resolver sites; (b) reply-leg: WanReply wire record (spt-net wanmsg) + WanOutcome::token/WanRequestOutcome::from_token + request_wan round-trip (spt-daemon wan.rs) + serve_wan_feed writes the reply (dispatch.rs) + wan_send_with blocks for it → classify_wan_reply → honest WanSendOutcome (Sent only on Delivered/Spooled/Duplicate; Refused/NoPerchRemote/Unconfirmed else) + CLI honest lines. unit = WanReply wire round-trip, token↔from_token (+ unknown→NoReply), classify_wan_reply honest-SENT invariant, seed_first_addr seed-first. int = wan_send_ships_to_the_resolved_node (real two-broker distinct-node loopback: B's production dispatcher spools AND replies, A reports Sent(spooled)). The real cross-MACHINE confirm rides the [twohost] CI gate (tag in PR TITLE — head_commit NULL on pull_request); a single-node "SENT confirmed" would be lying (no second host), so local asserts the wire/selection/mapping seams only."
1763-[[requirements]]
1764-id = "REQ-RC-CROSS-NODE-ATTACH"
1765-title = "Bug #4: spt rc to a remote endpoint fails with 'no live session' though endpoint list shows it Active — rc.rs:1063 resolves only the LOCAL broker session table and always dials loopback, never consulting the registry or dialing the owning node (the cross-node attach transport exists in the broker; only the client leg is missing). Fix: on a local resolve miss, resolve the owning node from the registry (reuse resolve_across_visible), net_dial that node, and run a remote session-resolve + serve_attach round-trip (mirror the wansend resolve-dial-round-trip pattern). Shares the resolve-owning-node primitive with REQ-WAN-SEND-DELIVERY. See docs/NEXT-MILESTONE-BUG-TRIAGE.md #4."
1766-required_stages = ["doc", "impl", "unit", "int"]  # ACTIVATED counter-38 W7 (#4, todlando; doyle-ratified design D1-D6). doc = CONTEXT.md Remote-control "Owning-node resolution (client leg)" bullet (registry-resolve + server-side endpoint→session + honest stale-row failure). impl = additive AttachRecord::Request.endpoint_id (spt-net; serde skip_serializing_if=none → local wire byte-identical + N-1) + request_attach_endpoint + serve-side resolve_local_session (dispatch gate on endpoint_id w/ session-presence D5/D6 + serve_attach maps endpoint→OUR session id) + rc.rs run_attach_inner remote branch (local-miss → wansend::resolve_and_dial_owner reuse resolve_across_visible/seed_first_addr/net_dial → request_attach_endpoint) + pump rendered_any → PumpEnd::NoLiveSession honest message (D2). unit = wire endpoint_id additive/local-byte-identity round-trip (spt-net) + resolve_and_dial_owner honest misses NotFound/own-node-degrade/Ambiguous (spt wansend). int = dispatcher_resolves_attach_by_endpoint_and_refuses_a_stale_endpoint (server: endpoint→session resolve + stale refuse, spt-daemon) + resolve_and_dial_owner_dials_the_resolved_node (client resolve+seed-dial, spt). VIEWPORT-ONLY/two-conn-split/QUIC-origin hazards inherited unchanged (serve_attach untouched — cross-node session resolve happens in the DISPATCHER before subscribe, never a mid-serve sessions() that would swallow interleaved attach records). #6/grid NOT touched (separate design pass).