{
  "summary": "Confirmed root cause: `todlando` is not merely a stale project-index row; it is a valid historical semantic `ready_agent` that was later relaunched into a broker-owned PTY and therefore acquired the orthogonal hosting facts `controllable:true` and `status:\"online\"`. The daemon-restart and liveness-reconcile code incorrectly assumes every broker-owned PTY must also have semantic state `live_agent`. On a full restart, the broker session table is fresh/empty, but `restart_resume_gate` silently skips `todlando` before its source-definitive `controllable:true` test because `state != live_agent`. The next successful broker-truth reconcile also skips it: the non-live-agent branch's PID hybrid healer intentionally does nothing for `controllable:true`, then unconditionally continues before broker-session absence can terminal-normalize the row. Thus the persisted projection remains online forever while broker truth contains no todlando session; `spt rc todlando` correctly resolves the broker table and reports no live session. Field timeline: (1) `owlery/todlando/sessions.log:35` records session `817eb49c-8887-473a-9562-cb47b9c347e9`; (2) the old daemon had a real broker session 5 for todlando and accepted local/remote controller attaches at `daemon.stderr.log.1:6937-6959`; (3) bind-time persistence produced the current one-line `info.json` shape `{pid:61204,parent_pid:57172,session_id:817e…,state:ready_agent,status:online,adapter:claude-spt:ccs,controllable:true}`; (4) on the current cold restart, `daemon.stderr.log:43-53` emits restart outcomes for deployah/doyle/lia/perri/webbie but none for todlando; (5) `daemon.stderr.log:62` proves a successful session snapshot found no todlando session and cleared only its control projection, with no `LIVENESS_RECONCILE_OFFLINE` afterward; (6) readers continue to display it online because `is_perch_alive` makes persisted `status` daemon-authoritative and never PID-probes (`liveness.rs:136-143`), while the project index is only a persisted project-attribution join. Ranked alternatives: stale project index is observational but not causal; broker-query failure is ruled out by the same successful sweep's `CONTROL_REAP_NO_SESSION`; an in-flight resume is ruled out by the absence of a todlando `LIVENESS_RECONCILE_DEFER`/restart refusal and by the state gate occurring before those belts; RC session-list resolution is behaving correctly against broker truth. Deterministic regression: seed the existing `endpoint_survival.rs` fresh-broker rig twice, once with `state=live_agent` and once with `state=ready_agent`, keeping `status=online`, `controllable=true`, no relay/custody PID, and a ledger row; both must produce a broker session after `resume_restart_orphaned_endpoints`. Add a focused liveness test with `ready_agent + online + controllable:true` and a successful empty live-session set; it must terminal-normalize offline. Keep/assert the existing no-Psyche contract for ready state. No files were modified and no state-changing test/build command was run, per the read-only assignment.",
  "files": [
    {
      "path": "crates/spt/src/api/startup.rs",
      "description": "Birth seam. `establish_perch` at lines 343-350 preserves a prior semantic endpoint type when a default `live_agent` bind revives it, so a prior ready endpoint remains `ready_agent`. `cmd_bind` at 746-753 independently derives `controllable=Some(true)` from the requested/default `live_agent` type, and at 779-793 derives/stamps online from that requested type plus manifest capability. This creates the observed cross-product `state=ready_agent, controllable=true, status=online`. Do not blindly convert it to live_agent: ready-resume's no-Psyche semantic contract depends on preserving ready_agent."
    },
    {
      "path": "crates/spt-daemon/src/livehost.rs",
      "description": "Primary break and minimal fix seam. `restart_resume_gate` lines 507-538 rejects `state != LIVE_AGENT_STATE` at 516-518 before checking the documented source-definitive broker-PTY fact `controllable==Some(true)` at 522-524. Remove the semantic-state parameter/gate and retain online, controllable, live-session, relay, and custody belts. `reconcile_hosted_liveness` lines 714-797 routes every non-live state through the PID-model hybrid arm at 727-751; narrow that arm to `state != live_agent && controllable != Some(true)`, allowing any broker-owned row to fall through to broker-session truth. Psyche hosting remains safely and separately state-gated at 196-198 and 907-909. Unit lines 2285-2288 currently codify the defect by expecting `ready_agent` to Skip; that case must expect Resume (or disappear when state is removed)."
    },
    {
      "path": "crates/spt-daemon/tests/endpoint_survival.rs",
      "description": "Best deterministic end-to-end regression seam. Existing lines 1-22 define exactly the fresh-broker/empty-session-table restart condition; `seed_orphaned_online_endpoint` lines 58-89 currently hardcodes `state=live_agent`; the test at 92-153 proves the re-run creates a broker session. Parameterize the semantic state and assert both live_agent and ready_agent broker-hosted rows recover."
    },
    {
      "path": "crates/spt/tests/ready_resume_ledger_e2e.rs",
      "description": "Protects the semantic constraint the lifecycle fix must not violate. Lines 1-18 state that a resumed ready endpoint stays `ready_agent` and must never receive a Psyche even with a live-capable manifest; lines 171-185 assert ledger correctness and zero Psyche hosting. This is why changing todlando's state to live_agent is the wrong repair; liveness/restart must key PTY authority on controllable instead."
    },
    {
      "path": "crates/spt/src/rc.rs",
      "description": "Broker-truth consumer and duplicate-pump explanation. `SessionProbe::connect` lines 977-990 opens one `Brain::cold_start_pump`; the initial RC gate calls it at 1388-1391 and gives honest broker session truth precedence over persisted offline status. `establish_attach` lines 1632-1660 opens a second pump-mode Brain, then `resolve_session`/local-first resolution at 1669-1691 queries the broker's session table and returns the clean no-live-session result when absent. Therefore each normal RC attempt can spawn two real IPC reader threads: one probe carrier and one attach carrier; the diagnostic is not printed twice by one spawn."
    },
    {
      "path": "crates/spt-daemon/src/brain.rs",
      "description": "Actual `PUMP_IPC_READER` emitter. `BrainConn::split_with_reader` lines 239-278 creates exactly one named reader thread and logs `spawned` once inside that thread. Two lines therefore mean two actual split carriers, not duplicate diagnostics from one thread."
    },
    {
      "path": "crates/spt-daemon/src/pump/mod.rs",
      "description": "Separately explains the daemon-log pair. `run_peer_pump` lines 528-555 intentionally calls `connect` twice: one main peer-operation brain and a second dedicated presence-event drain brain, so `daemon.stderr.log:5-6` immediately after `BRAIN_NET_CONSUMERS_UP` are also two real reader spawns by design."
    },
    {
      "path": "crates/spt-store/src/liveness.rs",
      "description": "Why the stale projection displays alive. Module lines 1-3 define daemon-authoritative status; `is_perch_alive` lines 136-143 returns `status == online` immediately and explicitly never checks PID once status is present."
    },
    {
      "path": "crates/spt/src/roster.rs",
      "description": "Status projection consumer. Lines 69-73 read the ready marker separately but derive `alive` from `liveness::is_perch_alive`, so todlando can have no current ready marker yet still project alive from stale online status."
    },
    {
      "path": "crates/spt/src/picker/data.rs",
      "description": "Project picker join. `local_rows` lines 204 onward reads the persisted project index once, then joins it to roster liveness. The index supplies project attribution/history, not broker-session truth, so it can keep todlando grouped under the spt-core project while the stale roster status paints it online."
    },
    {
      "path": "C:/Users/decid/AppData/Local/spt-core/owlery/todlando/info.json",
      "description": "One-line field projection proving the contradictory current shape exactly: pid 61204, parent_pid 57172, session 817eb49c…, state ready_agent, status online, adapter claude-spt:ccs, controllable true, cwd spt-core."
    },
    {
      "path": "C:/Users/decid/AppData/Local/spt-core/owlery/todlando/sessions.log",
      "description": "Historical session truth used for restart/resume material. Line 35 records session 817eb49c… at 2026-07-17T11:39:02Z under claude-spt:ccs in the spt-core cwd."
    },
    {
      "path": "C:/Users/decid/AppData/Local/spt-core/logs/daemon.stderr.log.1",
      "description": "Pre-restart broker truth. Lines 6937-6941 show broker session 5 endpoint todlando accepted a local controller and detached; lines 6953-6959 show a remote controller attach/replacement on the same session. This proves todlando previously had a real PTY, not merely an index/status row."
    },
    {
      "path": "C:/Users/decid/AppData/Local/spt-core/logs/daemon.stderr.log",
      "description": "Restart failure seam. Lines 43-53 show other endpoints' restart gate outcomes while todlando is silently absent. Line 62 then logs `CONTROL_REAP_NO_SESSION:todlando`, proving the successful broker snapshot contained no todlando session; the missing subsequent offline normalization is the non-live-state early-continue defect. Lines 3-6 show the independent pump diagnostic pair after net-consumer startup."
    },
    {
      "path": "C:/Users/decid/AppData/Local/spt-core/index/project-index.json",
      "description": "Persisted materialized project attribution containing todlando's spt-core history. It explains the project grouping but is not session or liveness authority."
    }
  ],
  "architecture": "There are three distinct authorities that the bug accidentally conflates. (1) Semantic endpoint type (`info.state`: ready_agent vs live_agent) controls behavior such as whether the daemon may host a Psyche. (2) Hosting authority (`info.controllable`: true means broker-owned PTY, false/None means harness/PID model) determines whether liveness and restart must be reconciled against the broker session table. (3) Display/project projection (`info.status`, ready marker, materialized project index) is persisted derived state and must converge from the appropriate authority. Ready-resume intentionally permits the cross-product `ready_agent + broker-owned PTY`: semantic type remains ready so no Psyche is hosted, while controllable is true because `endpoint run --resume` owns a real PTY. The v0.29 restart-survival implementation and current liveness pull incorrectly used `state==live_agent` as a prerequisite for broker-session reconciliation, even though their own comments call `controllable==Some(true)` source-definitive. A full daemon restart legitimately destroys broker PTY sessions and starts with an empty session map. The one-shot restart pass should rebuild every previously-online broker-owned endpoint from its ledger, independent of semantic type; the recurring successful session pull should terminal-normalize every online broker-owned row absent from that map, also independent of semantic type. Psyche start/host decisions remain state-gated. RC is downstream and correct: it first opens a short-lived pump-mode probe Brain to query honest session truth, then normally opens a second pump-mode attach Brain; each split Brain owns one real `pump-ipc-reader`, explaining two actual spawn diagnostics. The daemon's peer pump independently has the same intentional two-carrier architecture (operations plus presence drain), explaining the adjacent pair in daemon stderr without any duplicated logging sink."
}