{"type":"title","v":1,"title":"","updatedAt":"2026-09-16T01:39:47.538Z","pad":"                                                                                                                                                                              "}
{"type":"session","version":3,"id":"01a0a7de-bcd1-7000-b631-fff44f850e6b","timestamp":"2026-09-16T01:39:47.538Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"e62e866f","parentId":null,"timestamp":"2026-09-16T01:39:49.203Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"cc2b3a99","parentId":"e62e866f","timestamp":"2026-09-16T01:39:49.204Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"0e8de46e","parentId":"cc2b3a99","timestamp":"2026-09-16T01:39:49.208Z","systemPrompt":"<system-conventions>\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `<system-directive>` in a user turn remains a system directive.\n</system-conventions>\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://<name>` first.\n<skills>\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n</skills>\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://<name>`: instructions; `/<path>`: its file\n- `rule://<name>`: details\n- `agent://<id>`: output artifact; `/<child>`: nested-subagent output; otherwise `/<path>`: JSON field\n- `history://<id>`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://<id>`: content\n- `local://<name>.md`: plan artifacts/shared subagent content\n- `mcp://<uri>`: MCP resource\n- `issue://<N>` / `issue://<owner>/<repo>/<N>`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://<N>` / `pr://<owner>/<repo>/<N>`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://<tool>` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd://<tool> for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n<critical>\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `<tool>: <concise description>` to `xd://report_issue`. False positives fine.\n</critical>\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n  - **Experiment/investigation** → run; output is proof; no tests.\n  - **UI change** → verify against the actual surface:\n    - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n    - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n  - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n  - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n  - Each MUST defend observable contract/fail on plausible bug.\n  - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n  - Match conventions; deterministic, isolated, full-suite-safe.\n  - NEVER write a test so the change \"has tests\" → throwaway script.\n  - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n  - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n  - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n  - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n<contract>\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n</contract>\n\n<completeness>\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n</completeness>\n\n<evidence-and-output>\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n</evidence-and-output>\n\n<yielding>\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n</yielding>\n\n§ Critical\n<critical>\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n</critical>\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n<directives>\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n</directives>\n\n<thoroughness>\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n</thoroughness>\n\n<procedure>\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n</procedure>\n\n<critical>\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n</critical>\n\n§ Context\n# Goal\nPrepare evidence-only #307 W1c then W1b on hfenduleam, main289e3cdfe39a8a4e91f5ea7d4b436f11a50b191e. Main builds in new .worktrees/hertz-307-evidence with own target and owns execution. No product edits. Doyle XZKF4BRT authorizes isolated fresh homes, never resident fleet lifecycle/config. Each mutation requires explicit child SPT_HOME, isolated socket, owned PID/birth/ancestry exclusions. W1c first, then W1b; agents only resolve independent prerequisites concurrently.\n# Constraints\nREAD ONLY. Skip all builds/tests/lint/formatters, live daemon calls and mutations. Read existing patterns before proposing anything. Do not create files. Resident home/config is forbidden to mutate. Old docs/49-267-REFRESH-OBSERVATION-PLAN.md admission and executable pin are superseded by289e3cdf; measurement and300s+120s teardown bounds remain. No fabricated update pending state. Tools may need LSP where available.\n# Contract\nReturn exact source/test/retained-script references, usable command/protocol shapes, required env isolation and verifiable identity/socket checks. No top-level plan delegation: Main orchestrates and builds. Distinguish proven callable recipe from missing prerequisite. Keep answers compressed.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `RefreshTrialSeams`. Currently visible peers:\n- `HitchRigSeams` — scout (sub, running)\n- `Main` — main (main, running)\n22 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://<id>` and `agent://<id>` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n  data: {\n    summary: string;\n    files: { path: string; description: string; }[];\n    architecture: string;\n    report?: string;\n  };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n<workstation>\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n</workstation>\n<critical>\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n</critical>","task":"Complete assignment thoroughly:\n\n# Target\nW1b #49/#267 real refresh and signed brain-only AppliedPending trial: docs/DEBUG-ROLLOUT.md, docs/49-267-REFRESH-OBSERVATION-PLAN.md, relevant apply/brainproc tests and retained #304 rig signing/launch helpers.\n# Change\nFind a supported, isolated way to admit a compatible brain-only signed update/reapply from main289e3cdf without product edits, signature bypasses or direct pending-state fabrication. Name exact xtask commands/metadata compatibility inputs, trusted-key scope, candidate artifact layout and verification/state/trace receipts. Also locate existing controller/backpressure instrumentation that maps conn/session and preserves cause. Identify honest refusal/blocker conditions.\n# Acceptance\nReturn concrete source-backed command recipe and smallest retained helper reuse; no execution. Respect300s observation+120s teardown. If compatibility admission needs unavailable information, name exact prerequisite and where checked. Skip all validation/build/lint/tests.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"1c89bb29","parentId":"0e8de46e","timestamp":"2026-09-16T01:39:49.260Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nW1b #49/#267 real refresh and signed brain-only AppliedPending trial: docs/DEBUG-ROLLOUT.md, docs/49-267-REFRESH-OBSERVATION-PLAN.md, relevant apply/brainproc tests and retained #304 rig signing/launch helpers.\n# Change\nFind a supported, isolated way to admit a compatible brain-only signed update/reapply from main289e3cdf without product edits, signature bypasses or direct pending-state fabrication. Name exact xtask commands/metadata compatibility inputs, trusted-key scope, candidate artifact layout and verification/state/trace receipts. Also locate existing controller/backpressure instrumentation that maps conn/session and preserves cause. Identify honest refusal/blocker conditions.\n# Acceptance\nReturn concrete source-backed command recipe and smallest retained helper reuse; no execution. Respect300s observation+120s teardown. If compatibility admission needs unavailable information, name exact prerequisite and where checked. Skip all validation/build/lint/tests."}],"attribution":"agent","timestamp":1789522789211}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_BM3h5Yfq0kmkFRhzdqDejsPb|fc_0bac546ce171b754016aa9f368085487d1b79a80cd2f3a1b66","toolName":"grep","startedAt":"2026-09-16T01:39:54.237Z","args":{"path":"docs/DEBUG-ROLLOUT.md;docs/49-267-REFRESH-OBSERVATION-PLAN.md"},"intent":"Locating refresh signing seams"},"id":"646ec733","parentId":"1c89bb29","timestamp":"2026-09-16T01:39:54.237Z"}
{"type":"message","id":"37dfb80d","parentId":"646ec733","timestamp":"2026-09-16T01:39:54.237Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_BM3h5Yfq0kmkFRhzdqDejsPb|fc_0bac546ce171b754016aa9f368085487d1b79a80cd2f3a1b66","name":"grep","arguments":{"i":"Locating refresh signing seams","pattern":"AppliedPending|brain-only|brain_only|trusted|xtask|304","path":"docs/DEBUG-ROLLOUT.md;docs/49-267-REFRESH-OBSERVATION-PLAN.md","case":false,"gitignore":true,"skip":0},"intent":"Locating refresh signing seams"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10273,"output":80,"cacheRead":0,"cacheWrite":0,"totalTokens":10353,"cost":{"input":0.10273,"output":0.004,"cacheRead":0,"cacheWrite":0,"total":0.10673}},"stopReason":"toolUse","timestamp":1789522789258,"responseId":"resp_0bac546ce171b754016aa9f36660c487d1854272d2c6eed67b","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f368085487d1b79a80cd2f3a1b66","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating refresh signing seams\",\"pattern\":\"AppliedPending|brain-only|brain_only|trusted|xtask|304\",\"path\":\"docs/DEBUG-ROLLOUT.md;docs/49-267-REFRESH-OBSERVATION-PLAN.md\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_BM3h5Yfq0kmkFRhzdqDejsPb","internal_chat_message_metadata_passthrough":{"create_time":1789522790.695978,"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":4977.146699999983,"ttft":2798.8399999999674,"completedAt":1789522794236,"contextSnapshot":{"promptTokens":10273,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"credential_pin","id":"f7551c9b","parentId":"37dfb80d","timestamp":"2026-09-16T01:39:54.238Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"faf2e101","parentId":"f7551c9b","timestamp":"2026-09-16T01:39:54.248Z","message":{"role":"toolResult","toolCallId":"call_BM3h5Yfq0kmkFRhzdqDejsPb|fc_0bac546ce171b754016aa9f368085487d1b79a80cd2f3a1b66","toolName":"grep","content":[{"type":"text","text":"# docs/\n## DEBUG-ROLLOUT.md\n 5|Debug rollout is the maintainer-only fast path for testing a local spt-core\n*6|build across a trusted lab subnet. It uses the normal signed self-update\n 7|substrate: no raw peer file-copy, no production `spt` CLI surface, and no\n 8|embedded debug trust anchor.\n 9|\n...\n 33|```powershell\n*34|cargo run -p xtask -- debug-keygen dev-debug-2026\n 35|```\n 36|\n 37|Set the printed seed as a long-lived coordinator-local environment variable:\n...\n 45|```powershell\n*46|cargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key <public_hex>\n 47|```\n 48|\n 49|This writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\n...\n 57|```powershell\n*58|cargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=<path-to-linux-spt>\"\n 59|```\n 60|\n 61|Common flags:\n...\n 100|```powershell\n*101|cargo run -p xtask -- debug-converge --version <N> [--subnet <name>] [--timeout 120] [--poll 3]\n 102|```\n 103|\n 104|It polls every expected node (the coordinator's trust rows; `--nodes <hex,…>`\n...\n 123|1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\n*124|2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\n 125|   `spt` CLI/help surface.\n 126|3. Keep verification on the production update substrate: signed metadata,\n 127|   per-platform artifact digest, channel pinning, monotonic version, and\n## 49-267-REFRESH-OBSERVATION-PLAN.md\n 51|each invocation. No command relies on an inherited or ambient value, and no command is issued from a\n*52|shell whose environment was mutated once and trusted thereafter.\n 53|\n 54|**Before `daemon refresh` and before `daemon stop`, all four checks must pass. Any failure and the\n 55|command does not run:**"}],"details":{"scopePath":"docs/DEBUG-ROLLOUT.md, docs/49-267-REFRESH-OBSERVATION-PLAN.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":7,"fileCount":2,"files":["docs/DEBUG-ROLLOUT.md","docs/49-267-REFRESH-OBSERVATION-PLAN.md"],"fileMatches":[{"path":"docs/DEBUG-ROLLOUT.md","count":6},{"path":"docs/49-267-REFRESH-OBSERVATION-PLAN.md","count":1}],"truncated":false,"displayContent":"# docs/\n## DEBUG-ROLLOUT.md\n   5│Debug rollout is the maintainer-only fast path for testing a local spt-core\n  *6│build across a trusted lab subnet. It uses the normal signed self-update\n   7│substrate: no raw peer file-copy, no production `spt` CLI surface, and no\n   8│embedded debug trust anchor.\n   9│\n    │...\n  33│```powershell\n *34│cargo run -p xtask -- debug-keygen dev-debug-2026\n  35│```\n  36│\n  37│Set the printed seed as a long-lived coordinator-local environment variable:\n    │...\n  45│```powershell\n *46│cargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key <public_hex>\n  47│```\n  48│\n  49│This writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\n    │...\n  57│```powershell\n *58│cargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=<path-to-linux-spt>\"\n  59│```\n  60│\n  61│Common flags:\n    │...\n 100│```powershell\n*101│cargo run -p xtask -- debug-converge --version <N> [--subnet <name>] [--timeout 120] [--poll 3]\n 102│```\n 103│\n 104│It polls every expected node (the coordinator's trust rows; `--nodes <hex,…>`\n    │...\n 123│1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\n*124│2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\n 125│   `spt` CLI/help surface.\n 126│3. Keep verification on the production update substrate: signed metadata,\n 127│   per-platform artifact digest, channel pinning, monotonic version, and\n## 49-267-REFRESH-OBSERVATION-PLAN.md\n 51│each invocation. No command relies on an inherited or ambient value, and no command is issued from a\n*52│shell whose environment was mutated once and trusted thereafter.\n 53│\n 54│**Before `daemon refresh` and before `daemon stop`, all four checks must pass. Any failure and the\n 55│command does not run:**"},"isError":false,"timestamp":1789522794247}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_g3yvCkZn98a2YfFyEUbIIy3p|fc_0bac546ce171b754016aa9f36fd68887d1b4e1cf400064866c","toolName":"read","startedAt":"2026-09-16T01:39:59.908Z","args":{"path":"docs/DEBUG-ROLLOUT.md:1-150"},"intent":"Reading rollout contract"},"id":"0fe7fb3f","parentId":"faf2e101","timestamp":"2026-09-16T01:39:59.908Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_y8esOIlOfpGTByA6TiVrLUmj|fc_0bac546ce171b754016aa9f36fd69c87d19e7557122a27d0f9","toolName":"read","startedAt":"2026-09-16T01:39:59.909Z","args":{"path":"docs/49-267-REFRESH-OBSERVATION-PLAN.md:1-240"},"intent":"Reading observation constraints"},"id":"16fc7bd0","parentId":"0fe7fb3f","timestamp":"2026-09-16T01:39:59.909Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_fpYvlXUXQw1JL42JBHLFNSnb|fc_0bac546ce171b754016aa9f36fd6a487d1b1c77fb600f8fb55","toolName":"glob","startedAt":"2026-09-16T01:39:59.909Z","args":{"path":"**/*304*;xtask/**;**/*brainproc*;**/*apply*"},"intent":"Finding retained rig files"},"id":"b61f2657","parentId":"16fc7bd0","timestamp":"2026-09-16T01:39:59.909Z"}
{"type":"message","id":"1877f8dd","parentId":"b61f2657","timestamp":"2026-09-16T01:39:59.909Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_g3yvCkZn98a2YfFyEUbIIy3p|fc_0bac546ce171b754016aa9f36fd68887d1b4e1cf400064866c","name":"read","arguments":{"i":"Reading rollout contract","path":"docs/DEBUG-ROLLOUT.md:1-150"},"intent":"Reading rollout contract"},{"type":"toolCall","id":"call_y8esOIlOfpGTByA6TiVrLUmj|fc_0bac546ce171b754016aa9f36fd69c87d19e7557122a27d0f9","name":"read","arguments":{"i":"Reading observation constraints","path":"docs/49-267-REFRESH-OBSERVATION-PLAN.md:1-240"},"intent":"Reading observation constraints"},{"type":"toolCall","id":"call_fpYvlXUXQw1JL42JBHLFNSnb|fc_0bac546ce171b754016aa9f36fd6a487d1b1c77fb600f8fb55","name":"glob","arguments":{"i":"Finding retained rig files","path":"**/*304*;xtask/**;**/*brainproc*;**/*apply*","hidden":true,"gitignore":true,"limit":100},"intent":"Finding retained rig files"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10885,"output":138,"cacheRead":0,"cacheWrite":0,"totalTokens":11023,"cost":{"input":0.10885,"output":0.006900000000000001,"cacheRead":0,"cacheWrite":0,"total":0.11575}},"stopReason":"toolUse","timestamp":1789522794272,"responseId":"resp_0bac546ce171b754016aa9f36a7de887d18f76801202c46e55","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f36fd68887d1b4e1cf400064866c","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading rollout contract\",\"path\":\"docs/DEBUG-ROLLOUT.md:1-150\"}","call_id":"call_g3yvCkZn98a2YfFyEUbIIy3p","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f36fd69c87d19e7557122a27d0f9","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading observation constraints\",\"path\":\"docs/49-267-REFRESH-OBSERVATION-PLAN.md:1-240\"}","call_id":"call_y8esOIlOfpGTByA6TiVrLUmj","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f36fd6a487d1b1c77fb600f8fb55","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding retained rig files\",\"path\":\"**/*304*;xtask/**;**/*brainproc*;**/*apply*\",\"hidden\":true,\"gitignore\":true,\"limit\":100}","call_id":"call_fpYvlXUXQw1JL42JBHLFNSnb","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"glob","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":5634.516899999988,"ttft":5593.164800000028,"completedAt":1789522799907,"contextSnapshot":{"promptTokens":10885,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"d0a8717c","parentId":"1877f8dd","timestamp":"2026-09-16T01:39:59.918Z","message":{"role":"toolResult","toolCallId":"call_g3yvCkZn98a2YfFyEUbIIy3p|fc_0bac546ce171b754016aa9f36fd68887d1b4e1cf400064866c","toolName":"read","content":[{"type":"text","text":"# Debug rollout runbook\n\n<!-- [doc->REQ-UPD-6] -->\n\nDebug rollout is the maintainer-only fast path for testing a local spt-core\nbuild across a trusted lab subnet. It uses the normal signed self-update\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\nembedded debug trust anchor.\n\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\n\n## Mental model\n\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\n  artifact digest per Rust target triple.\n- Each recipient verifies the set under its node-local `release-keys.json`,\n  selects only its own platform artifact, stages it, and then follows the normal\n  consent/apply policy.\n- Debug and stable are separate channels. A debug-pinned node accepts only\n  `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\n- Debug versions are monotonic within the debug channel. To recover from a bad\n  debug build, publish a higher debug version, even if the bytes are a previous\n  known-good binary.\n- A broker-touching candidate may be staged, but apply refuses it while\n  broker-held runtime is live. Shut down or suspend hosted endpoints first; the\n  first flow does not auto-cycle them.\n\n## One-time lab setup\n\nGenerate a debug key on the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-keygen dev-debug-2026\n```\n\nSet the printed seed as a long-lived coordinator-local environment variable:\n\n```powershell\n$env:SPT_DEBUG_RELEASE_SEED = \"<seed_hex>\"\n```\n\nPin each lab node to the debug channel with the printed public key:\n\n```powershell\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key <public_hex>\n```\n\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\n`\"stable\"` removes the node from debug rollout eligibility.\n\n## Stage a rollout\n\nFrom the fast coordinator, stage an update set into the local release cache:\n\n```powershell\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=<path-to-linux-spt>\"\n```\n\nCommon flags:\n\n- `--build-current` builds and includes the coordinator's current platform.\n- `--artifact <target=path>` adds an already-built artifact for another target,\n  such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\n- `--version <u64>` overrides the local debug sequence. Use a higher value when\n  recovering from lost local state.\n- `--product-version <semver>` stamps the product semver on the signed set\n  (default empty — the apply message then falls back to the release counter).\n  The composite `spt update`'s adapters leg reads this field as its\n  staged-basis floor comparison, so a lab recipe exercising adapter floors\n  against a staged core must stamp it. Ordering stays with the monotonic\n  counter; this field never decides which release is newer.\n- `--channel <name>` overrides the set's channel (default `debug`). A lab rig\n  whose recipient home stays pinned to `stable` pairs this with a rig-key\n  overlay in that home's `release-keys.json`; fleet debug nodes keep the\n  default and the `debug-pin` flow.\n- `--stage-dir <path>` stages somewhere other than `$SPT_HOME/releases`.\n- `--state <path>` stores the local debug sequence somewhere other than\n  `target/debug-rollout-state.json`.\n\nThe staged update then propagates through the normal pull-based update pump.\nThere is intentionally no bespoke push path.\n\n## Apply and observe\n\nOn a default-gated node, apply is still explicit:\n\n```powershell\nspt update apply\n```\n\nNodes configured for full-auto update may apply after staging without a prompt.\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\nquery peers promptly.\n\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\nrun the maintainer watcher from the coordinator:\n\n```powershell\ncargo run -p xtask -- debug-converge --version <N> [--subnet <name>] [--timeout 120] [--poll 3]\n```\n\nIt polls every expected node (the coordinator's trust rows; `--nodes <hex,…>`\noverrides) over the status-only update query and prints a per-node table —\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\n`Offline` — exiting `0` only when every node applied the target (`1`\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\nThe manual walk below remains the fallback.\n\nUseful outcomes:\n\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\n  Rust target triple.\n- `WrongChannel` means the node is not pinned to `debug`.\n- `Rollback` means the offered debug version is not greater than the node's\n  current debug-channel version.\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\n  resources; quiesce hosted endpoints first.\n\n## Agent checklist\n\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\n   `spt` CLI/help surface.\n3. Keep verification on the production update substrate: signed metadata,\n   per-platform artifact digest, channel pinning, monotonic version, and\n   apply-time re-verification.\n4. Add or update traceability evidence for `REQ-UPD-6`.\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`."}],"details":{"totalLines":130,"displayContent":{"text":"# Debug rollout runbook\r\n\r\n<!-- [doc->REQ-UPD-6] -->\r\n\r\nDebug rollout is the maintainer-only fast path for testing a local spt-core\r\nbuild across a trusted lab subnet. It uses the normal signed self-update\r\nsubstrate: no raw peer file-copy, no production `spt` CLI surface, and no\r\nembedded debug trust anchor.\r\n\r\nUse this when debugging needs a local build to reach multiple lab nodes quickly.\r\nDo not use it for public releases; use `docs/RELEASE-RUNBOOK.md` for that.\r\n\r\n## Mental model\r\n\r\n- A rollout is a signed `SignedUpdateSet`: one signed metadata record, with one\r\n  artifact digest per Rust target triple.\r\n- Each recipient verifies the set under its node-local `release-keys.json`,\r\n  selects only its own platform artifact, stages it, and then follows the normal\r\n  consent/apply policy.\r\n- Debug and stable are separate channels. A debug-pinned node accepts only\r\n  `channel = \"debug\"` offers; a stable-pinned node accepts only stable offers.\r\n- Debug versions are monotonic within the debug channel. To recover from a bad\r\n  debug build, publish a higher debug version, even if the bytes are a previous\r\n  known-good binary.\r\n- A broker-touching candidate may be staged, but apply refuses it while\r\n  broker-held runtime is live. Shut down or suspend hosted endpoints first; the\r\n  first flow does not auto-cycle them.\r\n\r\n## One-time lab setup\r\n\r\nGenerate a debug key on the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-keygen dev-debug-2026\r\n```\r\n\r\nSet the printed seed as a long-lived coordinator-local environment variable:\r\n\r\n```powershell\r\n$env:SPT_DEBUG_RELEASE_SEED = \"<seed_hex>\"\r\n```\r\n\r\nPin each lab node to the debug channel with the printed public key:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-pin --key-id dev-debug-2026 --public-key <public_hex>\r\n```\r\n\r\nThis writes `$SPT_HOME/identity/release-keys.json` with the debug public key and\r\n`\"channel\": \"debug\"`. Removing the key or setting the channel back to\r\n`\"stable\"` removes the node from debug rollout eligibility.\r\n\r\n## Stage a rollout\r\n\r\nFrom the fast coordinator, stage an update set into the local release cache:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-rollout --build-current --artifact \"x86_64-unknown-linux-gnu=<path-to-linux-spt>\"\r\n```\r\n\r\nCommon flags:\r\n\r\n- `--build-current` builds and includes the coordinator's current platform.\r\n- `--artifact <target=path>` adds an already-built artifact for another target,\r\n  such as `x86_64-pc-windows-msvc` or `x86_64-unknown-linux-gnu`.\r\n- `--version <u64>` overrides the local debug sequence. Use a higher value when\r\n  recovering from lost local state.\r\n- `--product-version <semver>` stamps the product semver on the signed set\r\n  (default empty — the apply message then falls back to the release counter).\r\n  The composite `spt update`'s adapters leg reads this field as its\r\n  staged-basis floor comparison, so a lab recipe exercising adapter floors\r\n  against a staged core must stamp it. Ordering stays with the monotonic\r\n  counter; this field never decides which release is newer.\r\n- `--channel <name>` overrides the set's channel (default `debug`). A lab rig\r\n  whose recipient home stays pinned to `stable` pairs this with a rig-key\r\n  overlay in that home's `release-keys.json`; fleet debug nodes keep the\r\n  default and the `debug-pin` flow.\r\n- `--stage-dir <path>` stages somewhere other than `$SPT_HOME/releases`.\r\n- `--state <path>` stores the local debug sequence somewhere other than\r\n  `target/debug-rollout-state.json`.\r\n\r\nThe staged update then propagates through the normal pull-based update pump.\r\nThere is intentionally no bespoke push path.\r\n\r\n## Apply and observe\r\n\r\nOn a default-gated node, apply is still explicit:\r\n\r\n```powershell\r\nspt update apply\r\n```\r\n\r\nNodes configured for full-auto update may apply after staging without a prompt.\r\nFor quick debugging, run or poke the daemon/update pump on lab nodes so they\r\nquery peers promptly.\r\n\r\n**Convergence watcher (M8-D4, decision 19).** Instead of hand-walking nodes,\r\nrun the maintainer watcher from the coordinator:\r\n\r\n```powershell\r\ncargo run -p xtask -- debug-converge --version <N> [--subnet <name>] [--timeout 120] [--poll 3]\r\n```\r\n\r\nIt polls every expected node (the coordinator's trust rows; `--nodes <hex,…>`\r\noverrides) over the status-only update query and prints a per-node table —\r\n`Applied` / `StagedAwaitingConsent` / `NotPinned` / `Rejected{reason}` /\r\n`Offline` — exiting `0` only when every node applied the target (`1`\r\notherwise, `2` on usage). Spec + state model: `docs/DEBUG-CONVERGE-PLAN.md`.\r\nThe manual walk below remains the fallback.\r\n\r\nUseful outcomes:\r\n\r\n- `NoArtifactForPlatform` means the signed set did not include the recipient's\r\n  Rust target triple.\r\n- `WrongChannel` means the node is not pinned to `debug`.\r\n- `Rollback` means the offered debug version is not greater than the node's\r\n  current debug-channel version.\r\n- `RefusedClass(BrokerBreaking)` means the candidate touches broker-held\r\n  resources; quiesce hosted endpoints first.\r\n\r\n## Agent checklist\r\n\r\n1. Read `CONTEXT.md` \"debug rollout\" and ADR-0016 before changing the flow.\r\n2. Keep debug tooling in `xtask` or other maintainer tooling, not the public\r\n   `spt` CLI/help surface.\r\n3. Keep verification on the production update substrate: signed metadata,\r\n   per-platform artifact digest, channel pinning, monotonic version, and\r\n   apply-time re-verification.\r\n4. Add or update traceability evidence for `REQ-UPD-6`.\r\n5. Run `cargo fmt`, focused update tests, and `traceable-reqs check`.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130]},"fileSize":5535,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\DEBUG-ROLLOUT.md"}}},"isError":false,"timestamp":1789522799917}}
{"type":"message","id":"76e905b5","parentId":"d0a8717c","timestamp":"2026-09-16T01:39:59.925Z","message":{"role":"toolResult","toolCallId":"call_y8esOIlOfpGTByA6TiVrLUmj|fc_0bac546ce171b754016aa9f36fd69c87d19e7557122a27d0f9","toolName":"read","content":[{"type":"text","text":"# #49 / #267 — bounded refresh observation plan\n\n**Status:** prepared, **not admitted**. No execution grant. W2 run `20260912T231404Z` holds the\nexecution window. Author: todlando. Gater: doyle.\n\n**What this observes:** whether a blocked controller sink reaches eviction across one planned brain\nrestart, and whether a PTY's output and input progress resume — with session and connection\nattribution. **What it cannot decide:** the clean-close hypothesis. See §8.\n\n---\n\n## 1. Subject selection — bytes, not a path\n\n| item | value |\n| --- | --- |\n| executable path | `C:\\Users\\decid\\AppData\\Local\\spt-core\\bin\\spt` |\n| **executable sha256 (the pin)** | `689503ad9fc6cfde637cbcacf21c42faf130ba465a0df6c356cf290e2adafb85` |\n| reported version | `spt 0.69.0` |\n| mtime at planning | 2026-09-10 21:14 |\n\n**The sha256 is the pin, not the path.** Re-hash immediately before the run. **If the hash differs\nfrom the value above, the run does not start**: the subject must be re-selected and this plan\nre-admitted. A changed binary is a different subject, not a recorded detail.\n\n**Source provenance — UNVERIFIED, and recorded as such.** The installed binary predates current\n`main`, so **current `main` is not its source provenance**. The plausible release commit is v0.69.0 =\n`16df0e41be04ca4614a792f7e70e4d1bdec60b24` (2026-09-10), which is consistent with the binary's\nversion string and mtime — but **I have not verified that these bytes were built from that commit**,\nand no artifact on this box binds them. Every source citation in this plan (`brainproc.rs:1081`,\n`broker.rs:2842`/`:3787`/`:2815`, `applyhost.rs:364`) is read at **current main** and is therefore a\nclaim about the source tree, **not** a proven claim about the executable under test. Treat any\nline-number citation as indicative; if a run's behaviour disagrees with a citation, the citation is\nthe suspect.\n\n## 2. Isolation — binding\n\n**The resident fleet daemon is never refreshed.** At planning time 18 `spt.exe` processes authenticate\nto the resident daemon (pid 4732): agent perches under `spt-mobile-host.exe`, `omp-spt` chains, and\nthis session's own perch.\n\n- Isolated `SPT_HOME` under a run-specific directory, with its own broker socket.\n- The isolated home **must not exist** beforehand. If it does, the run does not start and the\n  existing directory is left untouched.\n- One disposable PTY session, created for this run only.\n- If the isolated daemon cannot be brought up cleanly within the §3 startup bound, **the run does not\n  start**.\n\n### 2.1 Exact targeting — every command, with identity checks before the two dangerous ones\n\n**Every** command in the run carries the isolated home explicitly: `SPT_HOME=<ISO_HOME>` is set on\neach invocation. No command relies on an inherited or ambient value, and no command is issued from a\nshell whose environment was mutated once and trusted thereafter.\n\n**Before `daemon refresh` and before `daemon stop`, all four checks must pass. Any failure and the\ncommand does not run:**\n\n1. `SPT_HOME` resolves to `<ISO_HOME>` — read back from the command's own environment, not assumed.\n2. The broker socket the command will address is the isolated one, not the fleet's.\n3. The target daemon pid was **created by this run**, established by ancestry.\n4. The target pid is **not 4732**, and is not an ancestor of this session.\n\nRefresh and stop are the only two verbs that act on a daemon's lifecycle; both are gated by all four.\n\n## 3. Bounds — numeric, chosen now\n\n**Two separate budgets, and a total.** The observation deadline **ends experimental activity and\nstarts cleanup — it never skips cleanup.** Cleanup holds its own maximum on top.\n\n| budget | value |\n| --- | --- |\n| **observation budget** (all experimental activity, from run start) | **300 s** |\n| **cleanup budget** (separate, begins when observation ends for any reason) | **120 s** |\n| **total bound, run start to done** | **420 s** |\n\n| phase | nominal cap | on breach |\n| --- | --- | --- |\n| isolated daemon up + session attached | 60 s | run does not start |\n| `t0` appears after refresh is issued | 60 s | record \"restart marker not observed\"; continue within the observation budget |\n| observation after `t0` | 120 s | stop observing; report recovery-after-interval or no-recovery-within-the-observed-interval |\n| reattach: detach, then fresh attach | 30 s to attach, 60 s observed | report as its own arm |\n| cleanup confirmation | 120 s (its own budget) | preserve everything and report unconfirmed (§6) |\n\n**Every observation and reattach phase is additionally capped by the REMAINING observation budget.**\nA phase's nominal cap is an upper bound, not an entitlement: if only 40 s of the 300 s remain, that\nphase gets 40 s. **A phase cut short by the remaining budget is REPORTED AS TRUNCATED**, naming the\nphase and the time it actually got — a truncated phase's result is never presented as a completed\nobservation, and its absence of an event falls under §8's \"not observed\" rule.\n\n**When the observation budget is exhausted, experimental activity stops and cleanup begins\nimmediately** under §6, with its own 120 s. Exhausting the observation budget is a normal ending, not\nan error, and it never licenses skipping or shortening cleanup.\n\n**The observation budget is independent of `t0` because `t0` may never arrive.** Every phase cap is\nrelative to `t0` or to a local step; without a run-start-relative budget, a refresh that produces no\n`BRAIN_UPDATE_RESTART` would leave the run with no defined end. If `t0` never appears, that absence\nis a recorded result — and per §8 it is \"not observed\", not proof the restart did not happen.\n\n## 4. Observation\n\n`t0` = `BRAIN_UPDATE_RESTART` (brainproc.rs:1081, per §1's provenance caveat). Daemon stderr captured\nto a file for the whole window, starting before the session is attached.\n\n| id | question | observable | attribution |\n| --- | --- | --- | --- |\n| Q2 | does a blocked sink reach eviction? | `BRAIN_SUBSCRIBER_STALL_EVICT` (broker.rs:2842, :3787) | carries `conn=` and a session id |\n| Q4 | what survives reattach? | §5, after one detach and one fresh attach | session id |\n| Q5 | does output progress resume, and when? | §5 | session id |\n| Q6 | is queued input preserved and applied in order? | §5 | session id |\n\n**Q2 is not a deadline measurement.** `evict − t0` runs from the restart signal; the sink deadline\nruns from **blocked-write onset**, which nothing emits.\n\n### 4.1 Two observables added for Q1 and Q3, and exactly what each establishes\n\n<!-- [doc->REQ-REFRESH-WAIT-ATTRIBUTION] -->\n\nQ1 and Q3 were withdrawn as UNRESOLVED (§8) because both live on **silent branches**, not because the\nplan lacked a token to look for. Both branches now emit, under the existing `SPT_PUMP_TRACE=1`\ndiagnostic gate and nothing else — the daemon reads its own environment and still exports nothing, so\nhosted harness subtrees inherit no markers. Neither line changes a predicate, a deadline, an outcome,\nthe wire, or one byte of normal output.\n\n| id | event | fires when | attribution |\n| --- | --- | --- | --- |\n| Q1 | `CONTROLLER_SLOT_CLOSED` | the epoch-guarded transition **actually empties** the slot | `conn=`, `cause=`, session id |\n| Q3 | `BRAIN_PROMOTE_GATE_NOT_DRAINED` | the FIRST not-drained read after readiness latches, once per trial | trial `generation` |\n\n**`cause=` is the caller's knowledge, never the site's inference.** `clear_controller` is shared by\nthree edges — a drain that timed out the controller's `send_timeout` (`send_deadline`), the wedge\nevict (`stall_evict`), and an ordinary detach (`detach`) — and at that site they are\nindistinguishable. `send_deadline` names the deadline the drain observed, NOT the writer's fate:\na writer blocked past its deadline has not been shown to have exited. Each caller passes what it knows.\nA reader may therefore trust the cause exactly as far as the calling path, and no further.\n\n**A guarded no-op emits nothing.** `mark_controller_gone` returns without taking when the epoch has\nmoved on; no line is written there. So the event means *a slot that was occupied is now empty*, and\nnever *something tried to close a slot*. That distinction is the whole of Q1: before this, a cleanly\nclosed old-generation conn and a slot that was already empty left identical stderr.\n\n**What `BRAIN_PROMOTE_GATE_NOT_DRAINED` does NOT establish, stated because the wrong reading is the\ntempting one:** it proves the DRAINED gate was **evaluated** and read not-drained. It is **not**\nevidence that the heartbeat's drain-driving `brain.sessions()` call completed — that call is what\nmakes a wedge drainable at all (REQ-UPDATE-TRIAL-DRAIN-DRIVE), and a trial that never drove it looks\nidentical here to one that drove it and still waited. It also names **no session**: the gate answers a\nsingle bool over every hosted session, and naming the wedged one would require a second, separately\ntaken scan that could disagree with the read the promote decision actually used. The narrower fact is\nreported instead.\n\n**Absence of either line remains \"not observed\", never established absence** — the §8 rule applies to\nthese two exactly as it applies to every other token here, and it applies twice over when the gate\nenv var was not set on the daemon under test.\n\n## 5. Output and input progress — two clocks, and what each can prove\n\nThe disposable session runs a generator emitting, on its own cadence:\n\n```\nPROG <n> <generated-at>\n```\n\nand the observer records, for every line, **its own receipt timestamp**. **Both timestamps are kept\nfor every line.** They answer different questions and neither substitutes for the other:\n\n- **generation timestamp + counter** — what the child did, and when the child did it.\n- **receipt timestamp** — when the observer was delivered it.\n\n**The trap:** after a freeze a burst arrives, and buffered output released late is indistinguishable\n**by arrival alone** from progress resuming.\n\n**What each combination establishes, stated exactly:**\n\n- Pre-`t0` counters and pre-`t0` generation stamps, received after `t0` → **buffered output being\n  released.** The transport resumed. It says nothing about the child.\n- Counter above the pre-`t0` maximum **and** generation stamp after `t0` → **the child progressed\n  after `t0`.** This does **not** establish that the child was executing *contemporaneously with\n  delivery*: such a line may itself have been generated and then buffered before reaching the\n  observer. **Arrival timing is evidence of delivery, never proof of contemporaneous child\n  execution.**\n- The **gap between generation and receipt**, per line, is the only figure that speaks to delivery\n  lag, and it is reported per line rather than averaged.\n\nRecord the highest counter and latest generation stamp seen before `t0` explicitly — the baseline the\nwhole question turns on.\n\n### 5.1 Input — three distinct observables, never conflated\n\nDuring the freeze, send inputs each carrying a **unique tag**, never a repeated keystroke. For each\ntag, three things are separately observable and are **recorded separately**:\n\n1. **terminal echo** — the tag appearing in the stream. Proves the byte reached the terminal's echo\n   path. **Proves nothing about the child.**\n2. **the child's tagged acknowledgement** — output the child itself emits naming that tag.\n3. **resulting state** — an effect the child produces that is distinct from both its echo and the\n   tag's text.\n\n\"The queue drained\" may be said only when every tag shows **2 and 3**, in the order sent.\n\n**A missing tag at the observation deadline is \"NOT OBSERVED WITHIN THE WINDOW\" — not established\nloss.** A late drain past 120 s and a genuine loss are indistinguishable to a finite observation, and\nthe plan records the former wording. A duplicated tag is **replay**; out-of-order tags are their own\nfinding. Byte counts and \"output resumed\" establish none of this.\n\n## 6. Cleanup — retention, not deletion\n\n- Stop the isolated daemon **under §2.1's four checks**; confirm its brain and broker are gone by pid\n  and by socket, and that every process the run created is gone **by ancestry**.\n- **Retain the isolated home and every captured artifact after shutdown** — stderr capture and PTY\n  transcript included. No directory deletion is required by this observation.\n- **If cleanup is uncertain, preserve — never remove.** An uncertain teardown leaves process\n  identities and artifacts intact for inspection and is reported as unconfirmed.\n- The captured log is copied out before anything else is considered.\n\n## 7. What the source says, and what that is worth\n\n`broker.rs:2806-2812` states the killed-generation mechanism in the code's own voice and contrasts it\nwith a cleanly-closed conn being \"simply absent\". **That docstring describes intended behavior. It is\nnot independent evidence that the mechanism occurs**, and this plan does not treat it as such.\n\nIts exclusion of `by: Some` controllers from the promotion predicate **does not exclude indirect\neffects on those viewports**. Connection identity is **mapped** from the run's own attribution\n(`conn=`, session id) and never inferred.\n\n## 8. Unanswered questions — explicit\n\n1. **Q1 — does the outgoing generation's connection close?** **OBSERVABLE AS OF §4.1, still\n   unanswered.** It was unresolved because the closure path is silent: `mark_controller_gone` →\n   `clear_controller` re-stamps and fires the control edge while emitting nothing, and\n   `BRAIN_CONN_RETIRED` has one emission site (`livehost.rs:1042`, a session-query error path) that\n   would not fire here. `CONTROLLER_SLOT_CLOSED` now reports the real transition with its cause. The\n   question is answered by a RUN, not by this change.\n2. **Q3 — does promotion wait on drained state?** **OBSERVABLE AS OF §4.1, still unanswered.** It was\n   unresolved because the gate is a pure read with no false-branch emission —\n   `old_gen_drained` → `any_local_controller_wedged` → `local_controller_wedged` (broker.rs:2816).\n   `BRAIN_PROMOTE_GATE_NOT_DRAINED` now fires once per trial on the first not-drained read, from the\n   same observation the promote decision uses. It establishes that the gate was evaluated, never that\n   the drain-driving heartbeat call completed (§4.1).\n3. **Blocked-write onset is unobservable**, so the 15 s sink deadline cannot be confirmed here.\n4. **Generation attribution is unverified** on every token except `BRAIN_PROMOTED`.\n5. **Executable-to-source provenance is unverified** (§1). Source citations are claims about the\n   tree, not about the bytes under test.\n6. **A missing `t0`, a missing eviction, or a missing input tag are each \"not observed\"**, never\n   established absence.\n7. **One isolated daemon with one session is not the field's condition.** A negative result does not\n   clear the field path and must not be reported as doing so.\n…\n9. **#302 is not merged into this.** Whether it relates is untested and deliberately left open.\n\n[Showing lines 1-243 of 246. Use :244 to continue]"}],"details":{"truncation":{"content":"# #49 / #267 — bounded refresh observation plan\r\n\r\n**Status:** prepared, **not admitted**. No execution grant. W2 run `20260912T231404Z` holds the\r\nexecution window. Author: todlando. Gater: doyle.\r\n\r\n**What this observes:** whether a blocked controller sink reaches eviction across one planned brain\r\nrestart, and whether a PTY's output and input progress resume — with session and connection\r\nattribution. **What it cannot decide:** the clean-close hypothesis. See §8.\r\n\r\n---\r\n\r\n## 1. Subject selection — bytes, not a path\r\n\r\n| item | value |\r\n| --- | --- |\r\n| executable path | `C:\\Users\\decid\\AppData\\Local\\spt-core\\bin\\spt` |\r\n| **executable sha256 (the pin)** | `689503ad9fc6cfde637cbcacf21c42faf130ba465a0df6c356cf290e2adafb85` |\r\n| reported version | `spt 0.69.0` |\r\n| mtime at planning | 2026-09-10 21:14 |\r\n\r\n**The sha256 is the pin, not the path.** Re-hash immediately before the run. **If the hash differs\r\nfrom the value above, the run does not start**: the subject must be re-selected and this plan\r\nre-admitted. A changed binary is a different subject, not a recorded detail.\r\n\r\n**Source provenance — UNVERIFIED, and recorded as such.** The installed binary predates current\r\n`main`, so **current `main` is not its source provenance**. The plausible release commit is v0.69.0 =\r\n`16df0e41be04ca4614a792f7e70e4d1bdec60b24` (2026-09-10), which is consistent with the binary's\r\nversion string and mtime — but **I have not verified that these bytes were built from that commit**,\r\nand no artifact on this box binds them. Every source citation in this plan (`brainproc.rs:1081`,\r\n`broker.rs:2842`/`:3787`/`:2815`, `applyhost.rs:364`) is read at **current main** and is therefore a\r\nclaim about the source tree, **not** a proven claim about the executable under test. Treat any\r\nline-number citation as indicative; if a run's behaviour disagrees with a citation, the citation is\r\nthe suspect.\r\n\r\n## 2. Isolation — binding\r\n\r\n**The resident fleet daemon is never refreshed.** At planning time 18 `spt.exe` processes authenticate\r\nto the resident daemon (pid 4732): agent perches under `spt-mobile-host.exe`, `omp-spt` chains, and\r\nthis session's own perch.\r\n\r\n- Isolated `SPT_HOME` under a run-specific directory, with its own broker socket.\r\n- The isolated home **must not exist** beforehand. If it does, the run does not start and the\r\n  existing directory is left untouched.\r\n- One disposable PTY session, created for this run only.\r\n- If the isolated daemon cannot be brought up cleanly within the §3 startup bound, **the run does not\r\n  start**.\r\n\r\n### 2.1 Exact targeting — every command, with identity checks before the two dangerous ones\r\n\r\n**Every** command in the run carries the isolated home explicitly: `SPT_HOME=<ISO_HOME>` is set on\r\neach invocation. No command relies on an inherited or ambient value, and no command is issued from a\r\nshell whose environment was mutated once and trusted thereafter.\r\n\r\n**Before `daemon refresh` and before `daemon stop`, all four checks must pass. Any failure and the\r\ncommand does not run:**\r\n\r\n1. `SPT_HOME` resolves to `<ISO_HOME>` — read back from the command's own environment, not assumed.\r\n2. The broker socket the command will address is the isolated one, not the fleet's.\r\n3. The target daemon pid was **created by this run**, established by ancestry.\r\n4. The target pid is **not 4732**, and is not an ancestor of this session.\r\n\r\nRefresh and stop are the only two verbs that act on a daemon's lifecycle; both are gated by all four.\r\n\r\n## 3. Bounds — numeric, chosen now\r\n\r\n**Two separate budgets, and a total.** The observation deadline **ends experimental activity and\r\nstarts cleanup — it never skips cleanup.** Cleanup holds its own maximum on top.\r\n\r\n| budget | value |\r\n| --- | --- |\r\n| **observation budget** (all experimental activity, from run start) | **300 s** |\r\n| **cleanup budget** (separate, begins when observation ends for any reason) | **120 s** |\r\n| **total bound, run start to done** | **420 s** |\r\n\r\n| phase | nominal cap | on breach |\r\n| --- | --- | --- |\r\n| isolated daemon up + session attached | 60 s | run does not start |\r\n| `t0` appears after refresh is issued | 60 s | record \"restart marker not observed\"; continue within the observation budget |\r\n| observation after `t0` | 120 s | stop observing; report recovery-after-interval or no-recovery-within-the-observed-interval |\r\n| reattach: detach, then fresh attach | 30 s to attach, 60 s observed | report as its own arm |\r\n| cleanup confirmation | 120 s (its own budget) | preserve everything and report unconfirmed (§6) |\r\n\r\n**Every observation and reattach phase is additionally capped by the REMAINING observation budget.**\r\nA phase's nominal cap is an upper bound, not an entitlement: if only 40 s of the 300 s remain, that\r\nphase gets 40 s. **A phase cut short by the remaining budget is REPORTED AS TRUNCATED**, naming the\r\nphase and the time it actually got — a truncated phase's result is never presented as a completed\r\nobservation, and its absence of an event falls under §8's \"not observed\" rule.\r\n\r\n**When the observation budget is exhausted, experimental activity stops and cleanup begins\r\nimmediately** under §6, with its own 120 s. Exhausting the observation budget is a normal ending, not\r\nan error, and it never licenses skipping or shortening cleanup.\r\n\r\n**The observation budget is independent of `t0` because `t0` may never arrive.** Every phase cap is\r\nrelative to `t0` or to a local step; without a run-start-relative budget, a refresh that produces no\r\n`BRAIN_UPDATE_RESTART` would leave the run with no defined end. If `t0` never appears, that absence\r\nis a recorded result — and per §8 it is \"not observed\", not proof the restart did not happen.\r\n\r\n## 4. Observation\r\n\r\n`t0` = `BRAIN_UPDATE_RESTART` (brainproc.rs:1081, per §1's provenance caveat). Daemon stderr captured\r\nto a file for the whole window, starting before the session is attached.\r\n\r\n| id | question | observable | attribution |\r\n| --- | --- | --- | --- |\r\n| Q2 | does a blocked sink reach eviction? | `BRAIN_SUBSCRIBER_STALL_EVICT` (broker.rs:2842, :3787) | carries `conn=` and a session id |\r\n| Q4 | what survives reattach? | §5, after one detach and one fresh attach | session id |\r\n| Q5 | does output progress resume, and when? | §5 | session id |\r\n| Q6 | is queued input preserved and applied in order? | §5 | session id |\r\n\r\n**Q2 is not a deadline measurement.** `evict − t0` runs from the restart signal; the sink deadline\r\nruns from **blocked-write onset**, which nothing emits.\r\n\r\n### 4.1 Two observables added for Q1 and Q3, and exactly what each establishes\r\n\r\n<!-- [doc->REQ-REFRESH-WAIT-ATTRIBUTION] -->\r\n\r\nQ1 and Q3 were withdrawn as UNRESOLVED (§8) because both live on **silent branches**, not because the\r\nplan lacked a token to look for. Both branches now emit, under the existing `SPT_PUMP_TRACE=1`\r\ndiagnostic gate and nothing else — the daemon reads its own environment and still exports nothing, so\r\nhosted harness subtrees inherit no markers. Neither line changes a predicate, a deadline, an outcome,\r\nthe wire, or one byte of normal output.\r\n\r\n| id | event | fires when | attribution |\r\n| --- | --- | --- | --- |\r\n| Q1 | `CONTROLLER_SLOT_CLOSED` | the epoch-guarded transition **actually empties** the slot | `conn=`, `cause=`, session id |\r\n| Q3 | `BRAIN_PROMOTE_GATE_NOT_DRAINED` | the FIRST not-drained read after readiness latches, once per trial | trial `generation` |\r\n\r\n**`cause=` is the caller's knowledge, never the site's inference.** `clear_controller` is shared by\r\nthree edges — a drain that timed out the controller's `send_timeout` (`send_deadline`), the wedge\r\nevict (`stall_evict`), and an ordinary detach (`detach`) — and at that site they are\r\nindistinguishable. `send_deadline` names the deadline the drain observed, NOT the writer's fate:\r\na writer blocked past its deadline has not been shown to have exited. Each caller passes what it knows.\r\nA reader may therefore trust the cause exactly as far as the calling path, and no further.\r\n\r\n**A guarded no-op emits nothing.** `mark_controller_gone` returns without taking when the epoch has\r\nmoved on; no line is written there. So the event means *a slot that was occupied is now empty*, and\r\nnever *something tried to close a slot*. That distinction is the whole of Q1: before this, a cleanly\r\nclosed old-generation conn and a slot that was already empty left identical stderr.\r\n\r\n**What `BRAIN_PROMOTE_GATE_NOT_DRAINED` does NOT establish, stated because the wrong reading is the\r\ntempting one:** it proves the DRAINED gate was **evaluated** and read not-drained. It is **not**\r\nevidence that the heartbeat's drain-driving `brain.sessions()` call completed — that call is what\r\nmakes a wedge drainable at all (REQ-UPDATE-TRIAL-DRAIN-DRIVE), and a trial that never drove it looks\r\nidentical here to one that drove it and still waited. It also names **no session**: the gate answers a\r\nsingle bool over every hosted session, and naming the wedged one would require a second, separately\r\ntaken scan that could disagree with the read the promote decision actually used. The narrower fact is\r\nreported instead.\r\n\r\n**Absence of either line remains \"not observed\", never established absence** — the §8 rule applies to\r\nthese two exactly as it applies to every other token here, and it applies twice over when the gate\r\nenv var was not set on the daemon under test.\r\n\r\n## 5. Output and input progress — two clocks, and what each can prove\r\n\r\nThe disposable session runs a generator emitting, on its own cadence:\r\n\r\n```\r\nPROG <n> <generated-at>\r\n```\r\n\r\nand the observer records, for every line, **its own receipt timestamp**. **Both timestamps are kept\r\nfor every line.** They answer different questions and neither substitutes for the other:\r\n\r\n- **generation timestamp + counter** — what the child did, and when the child did it.\r\n- **receipt timestamp** — when the observer was delivered it.\r\n\r\n**The trap:** after a freeze a burst arrives, and buffered output released late is indistinguishable\r\n**by arrival alone** from progress resuming.\r\n\r\n**What each combination establishes, stated exactly:**\r\n\r\n- Pre-`t0` counters and pre-`t0` generation stamps, received after `t0` → **buffered output being\r\n  released.** The transport resumed. It says nothing about the child.\r\n- Counter above the pre-`t0` maximum **and** generation stamp after `t0` → **the child progressed\r\n  after `t0`.** This does **not** establish that the child was executing *contemporaneously with\r\n  delivery*: such a line may itself have been generated and then buffered before reaching the\r\n  observer. **Arrival timing is evidence of delivery, never proof of contemporaneous child\r\n  execution.**\r\n- The **gap between generation and receipt**, per line, is the only figure that speaks to delivery\r\n  lag, and it is reported per line rather than averaged.\r\n\r\nRecord the highest counter and latest generation stamp seen before `t0` explicitly — the baseline the\r\nwhole question turns on.\r\n\r\n### 5.1 Input — three distinct observables, never conflated\r\n\r\nDuring the freeze, send inputs each carrying a **unique tag**, never a repeated keystroke. For each\r\ntag, three things are separately observable and are **recorded separately**:\r\n\r\n1. **terminal echo** — the tag appearing in the stream. Proves the byte reached the terminal's echo\r\n   path. **Proves nothing about the child.**\r\n2. **the child's tagged acknowledgement** — output the child itself emits naming that tag.\r\n3. **resulting state** — an effect the child produces that is distinct from both its echo and the\r\n   tag's text.\r\n\r\n\"The queue drained\" may be said only when every tag shows **2 and 3**, in the order sent.\r\n\r\n**A missing tag at the observation deadline is \"NOT OBSERVED WITHIN THE WINDOW\" — not established\r\nloss.** A late drain past 120 s and a genuine loss are indistinguishable to a finite observation, and\r\nthe plan records the former wording. A duplicated tag is **replay**; out-of-order tags are their own\r\nfinding. Byte counts and \"output resumed\" establish none of this.\r\n\r\n## 6. Cleanup — retention, not deletion\r\n\r\n- Stop the isolated daemon **under §2.1's four checks**; confirm its brain and broker are gone by pid\r\n  and by socket, and that every process the run created is gone **by ancestry**.\r\n- **Retain the isolated home and every captured artifact after shutdown** — stderr capture and PTY\r\n  transcript included. No directory deletion is required by this observation.\r\n- **If cleanup is uncertain, preserve — never remove.** An uncertain teardown leaves process\r\n  identities and artifacts intact for inspection and is reported as unconfirmed.\r\n- The captured log is copied out before anything else is considered.\r\n\r\n## 7. What the source says, and what that is worth\r\n\r\n`broker.rs:2806-2812` states the killed-generation mechanism in the code's own voice and contrasts it\r\nwith a cleanly-closed conn being \"simply absent\". **That docstring describes intended behavior. It is\r\nnot independent evidence that the mechanism occurs**, and this plan does not treat it as such.\r\n\r\nIts exclusion of `by: Some` controllers from the promotion predicate **does not exclude indirect\r\neffects on those viewports**. Connection identity is **mapped** from the run's own attribution\r\n(`conn=`, session id) and never inferred.\r\n\r\n## 8. Unanswered questions — explicit\r\n\r\n1. **Q1 — does the outgoing generation's connection close?** **OBSERVABLE AS OF §4.1, still\r\n   unanswered.** It was unresolved because the closure path is silent: `mark_controller_gone` →\r\n   `clear_controller` re-stamps and fires the control edge while emitting nothing, and\r\n   `BRAIN_CONN_RETIRED` has one emission site (`livehost.rs:1042`, a session-query error path) that\r\n   would not fire here. `CONTROLLER_SLOT_CLOSED` now reports the real transition with its cause. The\r\n   question is answered by a RUN, not by this change.\r\n2. **Q3 — does promotion wait on drained state?** **OBSERVABLE AS OF §4.1, still unanswered.** It was\r\n   unresolved because the gate is a pure read with no false-branch emission —\r\n   `old_gen_drained` → `any_local_controller_wedged` → `local_controller_wedged` (broker.rs:2816).\r\n   `BRAIN_PROMOTE_GATE_NOT_DRAINED` now fires once per trial on the first not-drained read, from the\r\n   same observation the promote decision uses. It establishes that the gate was evaluated, never that\r\n   the drain-driving heartbeat call completed (§4.1).\r\n3. **Blocked-write onset is unobservable**, so the 15 s sink deadline cannot be confirmed here.\r\n4. **Generation attribution is unverified** on every token except `BRAIN_PROMOTED`.\r\n5. **Executable-to-source provenance is unverified** (§1). Source citations are claims about the\r\n   tree, not about the bytes under test.\r\n6. **A missing `t0`, a missing eviction, or a missing input tag are each \"not observed\"**, never\r\n   established absence.\r\n7. **One isolated daemon with one session is not the field's condition.** A negative result does not\r","truncated":true,"truncatedBy":"lines","totalLines":246,"totalBytes":15069,"outputLines":243,"outputBytes":15069,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":246,"displayContent":{"text":"# #49 / #267 — bounded refresh observation plan\r\n\r\n**Status:** prepared, **not admitted**. No execution grant. W2 run `20260912T231404Z` holds the\r\nexecution window. Author: todlando. Gater: doyle.\r\n\r\n**What this observes:** whether a blocked controller sink reaches eviction across one planned brain\r\nrestart, and whether a PTY's output and input progress resume — with session and connection\r\nattribution. **What it cannot decide:** the clean-close hypothesis. See §8.\r\n\r\n---\r\n\r\n## 1. Subject selection — bytes, not a path\r\n\r\n| item | value |\r\n| --- | --- |\r\n| executable path | `C:\\Users\\decid\\AppData\\Local\\spt-core\\bin\\spt` |\r\n| **executable sha256 (the pin)** | `689503ad9fc6cfde637cbcacf21c42faf130ba465a0df6c356cf290e2adafb85` |\r\n| reported version | `spt 0.69.0` |\r\n| mtime at planning | 2026-09-10 21:14 |\r\n\r\n**The sha256 is the pin, not the path.** Re-hash immediately before the run. **If the hash differs\r\nfrom the value above, the run does not start**: the subject must be re-selected and this plan\r\nre-admitted. A changed binary is a different subject, not a recorded detail.\r\n\r\n**Source provenance — UNVERIFIED, and recorded as such.** The installed binary predates current\r\n`main`, so **current `main` is not its source provenance**. The plausible release commit is v0.69.0 =\r\n`16df0e41be04ca4614a792f7e70e4d1bdec60b24` (2026-09-10), which is consistent with the binary's\r\nversion string and mtime — but **I have not verified that these bytes were built from that commit**,\r\nand no artifact on this box binds them. Every source citation in this plan (`brainproc.rs:1081`,\r\n`broker.rs:2842`/`:3787`/`:2815`, `applyhost.rs:364`) is read at **current main** and is therefore a\r\nclaim about the source tree, **not** a proven claim about the executable under test. Treat any\r\nline-number citation as indicative; if a run's behaviour disagrees with a citation, the citation is\r\nthe suspect.\r\n\r\n## 2. Isolation — binding\r\n\r\n**The resident fleet daemon is never refreshed.** At planning time 18 `spt.exe` processes authenticate\r\nto the resident daemon (pid 4732): agent perches under `spt-mobile-host.exe`, `omp-spt` chains, and\r\nthis session's own perch.\r\n\r\n- Isolated `SPT_HOME` under a run-specific directory, with its own broker socket.\r\n- The isolated home **must not exist** beforehand. If it does, the run does not start and the\r\n  existing directory is left untouched.\r\n- One disposable PTY session, created for this run only.\r\n- If the isolated daemon cannot be brought up cleanly within the §3 startup bound, **the run does not\r\n  start**.\r\n\r\n### 2.1 Exact targeting — every command, with identity checks before the two dangerous ones\r\n\r\n**Every** command in the run carries the isolated home explicitly: `SPT_HOME=<ISO_HOME>` is set on\r\neach invocation. No command relies on an inherited or ambient value, and no command is issued from a\r\nshell whose environment was mutated once and trusted thereafter.\r\n\r\n**Before `daemon refresh` and before `daemon stop`, all four checks must pass. Any failure and the\r\ncommand does not run:**\r\n\r\n1. `SPT_HOME` resolves to `<ISO_HOME>` — read back from the command's own environment, not assumed.\r\n2. The broker socket the command will address is the isolated one, not the fleet's.\r\n3. The target daemon pid was **created by this run**, established by ancestry.\r\n4. The target pid is **not 4732**, and is not an ancestor of this session.\r\n\r\nRefresh and stop are the only two verbs that act on a daemon's lifecycle; both are gated by all four.\r\n\r\n## 3. Bounds — numeric, chosen now\r\n\r\n**Two separate budgets, and a total.** The observation deadline **ends experimental activity and\r\nstarts cleanup — it never skips cleanup.** Cleanup holds its own maximum on top.\r\n\r\n| budget | value |\r\n| --- | --- |\r\n| **observation budget** (all experimental activity, from run start) | **300 s** |\r\n| **cleanup budget** (separate, begins when observation ends for any reason) | **120 s** |\r\n| **total bound, run start to done** | **420 s** |\r\n\r\n| phase | nominal cap | on breach |\r\n| --- | --- | --- |\r\n| isolated daemon up + session attached | 60 s | run does not start |\r\n| `t0` appears after refresh is issued | 60 s | record \"restart marker not observed\"; continue within the observation budget |\r\n| observation after `t0` | 120 s | stop observing; report recovery-after-interval or no-recovery-within-the-observed-interval |\r\n| reattach: detach, then fresh attach | 30 s to attach, 60 s observed | report as its own arm |\r\n| cleanup confirmation | 120 s (its own budget) | preserve everything and report unconfirmed (§6) |\r\n\r\n**Every observation and reattach phase is additionally capped by the REMAINING observation budget.**\r\nA phase's nominal cap is an upper bound, not an entitlement: if only 40 s of the 300 s remain, that\r\nphase gets 40 s. **A phase cut short by the remaining budget is REPORTED AS TRUNCATED**, naming the\r\nphase and the time it actually got — a truncated phase's result is never presented as a completed\r\nobservation, and its absence of an event falls under §8's \"not observed\" rule.\r\n\r\n**When the observation budget is exhausted, experimental activity stops and cleanup begins\r\nimmediately** under §6, with its own 120 s. Exhausting the observation budget is a normal ending, not\r\nan error, and it never licenses skipping or shortening cleanup.\r\n\r\n**The observation budget is independent of `t0` because `t0` may never arrive.** Every phase cap is\r\nrelative to `t0` or to a local step; without a run-start-relative budget, a refresh that produces no\r\n`BRAIN_UPDATE_RESTART` would leave the run with no defined end. If `t0` never appears, that absence\r\nis a recorded result — and per §8 it is \"not observed\", not proof the restart did not happen.\r\n\r\n## 4. Observation\r\n\r\n`t0` = `BRAIN_UPDATE_RESTART` (brainproc.rs:1081, per §1's provenance caveat). Daemon stderr captured\r\nto a file for the whole window, starting before the session is attached.\r\n\r\n| id | question | observable | attribution |\r\n| --- | --- | --- | --- |\r\n| Q2 | does a blocked sink reach eviction? | `BRAIN_SUBSCRIBER_STALL_EVICT` (broker.rs:2842, :3787) | carries `conn=` and a session id |\r\n| Q4 | what survives reattach? | §5, after one detach and one fresh attach | session id |\r\n| Q5 | does output progress resume, and when? | §5 | session id |\r\n| Q6 | is queued input preserved and applied in order? | §5 | session id |\r\n\r\n**Q2 is not a deadline measurement.** `evict − t0` runs from the restart signal; the sink deadline\r\nruns from **blocked-write onset**, which nothing emits.\r\n\r\n### 4.1 Two observables added for Q1 and Q3, and exactly what each establishes\r\n\r\n<!-- [doc->REQ-REFRESH-WAIT-ATTRIBUTION] -->\r\n\r\nQ1 and Q3 were withdrawn as UNRESOLVED (§8) because both live on **silent branches**, not because the\r\nplan lacked a token to look for. Both branches now emit, under the existing `SPT_PUMP_TRACE=1`\r\ndiagnostic gate and nothing else — the daemon reads its own environment and still exports nothing, so\r\nhosted harness subtrees inherit no markers. Neither line changes a predicate, a deadline, an outcome,\r\nthe wire, or one byte of normal output.\r\n\r\n| id | event | fires when | attribution |\r\n| --- | --- | --- | --- |\r\n| Q1 | `CONTROLLER_SLOT_CLOSED` | the epoch-guarded transition **actually empties** the slot | `conn=`, `cause=`, session id |\r\n| Q3 | `BRAIN_PROMOTE_GATE_NOT_DRAINED` | the FIRST not-drained read after readiness latches, once per trial | trial `generation` |\r\n\r\n**`cause=` is the caller's knowledge, never the site's inference.** `clear_controller` is shared by\r\nthree edges — a drain that timed out the controller's `send_timeout` (`send_deadline`), the wedge\r\nevict (`stall_evict`), and an ordinary detach (`detach`) — and at that site they are\r\nindistinguishable. `send_deadline` names the deadline the drain observed, NOT the writer's fate:\r\na writer blocked past its deadline has not been shown to have exited. Each caller passes what it knows.\r\nA reader may therefore trust the cause exactly as far as the calling path, and no further.\r\n\r\n**A guarded no-op emits nothing.** `mark_controller_gone` returns without taking when the epoch has\r\nmoved on; no line is written there. So the event means *a slot that was occupied is now empty*, and\r\nnever *something tried to close a slot*. That distinction is the whole of Q1: before this, a cleanly\r\nclosed old-generation conn and a slot that was already empty left identical stderr.\r\n\r\n**What `BRAIN_PROMOTE_GATE_NOT_DRAINED` does NOT establish, stated because the wrong reading is the\r\ntempting one:** it proves the DRAINED gate was **evaluated** and read not-drained. It is **not**\r\nevidence that the heartbeat's drain-driving `brain.sessions()` call completed — that call is what\r\nmakes a wedge drainable at all (REQ-UPDATE-TRIAL-DRAIN-DRIVE), and a trial that never drove it looks\r\nidentical here to one that drove it and still waited. It also names **no session**: the gate answers a\r\nsingle bool over every hosted session, and naming the wedged one would require a second, separately\r\ntaken scan that could disagree with the read the promote decision actually used. The narrower fact is\r\nreported instead.\r\n\r\n**Absence of either line remains \"not observed\", never established absence** — the §8 rule applies to\r\nthese two exactly as it applies to every other token here, and it applies twice over when the gate\r\nenv var was not set on the daemon under test.\r\n\r\n## 5. Output and input progress — two clocks, and what each can prove\r\n\r\nThe disposable session runs a generator emitting, on its own cadence:\r\n\r\n```\r\nPROG <n> <generated-at>\r\n```\r\n\r\nand the observer records, for every line, **its own receipt timestamp**. **Both timestamps are kept\r\nfor every line.** They answer different questions and neither substitutes for the other:\r\n\r\n- **generation timestamp + counter** — what the child did, and when the child did it.\r\n- **receipt timestamp** — when the observer was delivered it.\r\n\r\n**The trap:** after a freeze a burst arrives, and buffered output released late is indistinguishable\r\n**by arrival alone** from progress resuming.\r\n\r\n**What each combination establishes, stated exactly:**\r\n\r\n- Pre-`t0` counters and pre-`t0` generation stamps, received after `t0` → **buffered output being\r\n  released.** The transport resumed. It says nothing about the child.\r\n- Counter above the pre-`t0` maximum **and** generation stamp after `t0` → **the child progressed\r\n  after `t0`.** This does **not** establish that the child was executing *contemporaneously with\r\n  delivery*: such a line may itself have been generated and then buffered before reaching the\r\n  observer. **Arrival timing is evidence of delivery, never proof of contemporaneous child\r\n  execution.**\r\n- The **gap between generation and receipt**, per line, is the only figure that speaks to delivery\r\n  lag, and it is reported per line rather than averaged.\r\n\r\nRecord the highest counter and latest generation stamp seen before `t0` explicitly — the baseline the\r\nwhole question turns on.\r\n\r\n### 5.1 Input — three distinct observables, never conflated\r\n\r\nDuring the freeze, send inputs each carrying a **unique tag**, never a repeated keystroke. For each\r\ntag, three things are separately observable and are **recorded separately**:\r\n\r\n1. **terminal echo** — the tag appearing in the stream. Proves the byte reached the terminal's echo\r\n   path. **Proves nothing about the child.**\r\n2. **the child's tagged acknowledgement** — output the child itself emits naming that tag.\r\n3. **resulting state** — an effect the child produces that is distinct from both its echo and the\r\n   tag's text.\r\n\r\n\"The queue drained\" may be said only when every tag shows **2 and 3**, in the order sent.\r\n\r\n**A missing tag at the observation deadline is \"NOT OBSERVED WITHIN THE WINDOW\" — not established\r\nloss.** A late drain past 120 s and a genuine loss are indistinguishable to a finite observation, and\r\nthe plan records the former wording. A duplicated tag is **replay**; out-of-order tags are their own\r\nfinding. Byte counts and \"output resumed\" establish none of this.\r\n\r\n## 6. Cleanup — retention, not deletion\r\n\r\n- Stop the isolated daemon **under §2.1's four checks**; confirm its brain and broker are gone by pid\r\n  and by socket, and that every process the run created is gone **by ancestry**.\r\n- **Retain the isolated home and every captured artifact after shutdown** — stderr capture and PTY\r\n  transcript included. No directory deletion is required by this observation.\r\n- **If cleanup is uncertain, preserve — never remove.** An uncertain teardown leaves process\r\n  identities and artifacts intact for inspection and is reported as unconfirmed.\r\n- The captured log is copied out before anything else is considered.\r\n\r\n## 7. What the source says, and what that is worth\r\n\r\n`broker.rs:2806-2812` states the killed-generation mechanism in the code's own voice and contrasts it\r\nwith a cleanly-closed conn being \"simply absent\". **That docstring describes intended behavior. It is\r\nnot independent evidence that the mechanism occurs**, and this plan does not treat it as such.\r\n\r\nIts exclusion of `by: Some` controllers from the promotion predicate **does not exclude indirect\r\neffects on those viewports**. Connection identity is **mapped** from the run's own attribution\r\n(`conn=`, session id) and never inferred.\r\n\r\n## 8. Unanswered questions — explicit\r\n\r\n1. **Q1 — does the outgoing generation's connection close?** **OBSERVABLE AS OF §4.1, still\r\n   unanswered.** It was unresolved because the closure path is silent: `mark_controller_gone` →\r\n   `clear_controller` re-stamps and fires the control edge while emitting nothing, and\r\n   `BRAIN_CONN_RETIRED` has one emission site (`livehost.rs:1042`, a session-query error path) that\r\n   would not fire here. `CONTROLLER_SLOT_CLOSED` now reports the real transition with its cause. The\r\n   question is answered by a RUN, not by this change.\r\n2. **Q3 — does promotion wait on drained state?** **OBSERVABLE AS OF §4.1, still unanswered.** It was\r\n   unresolved because the gate is a pure read with no false-branch emission —\r\n   `old_gen_drained` → `any_local_controller_wedged` → `local_controller_wedged` (broker.rs:2816).\r\n   `BRAIN_PROMOTE_GATE_NOT_DRAINED` now fires once per trial on the first not-drained read, from the\r\n   same observation the promote decision uses. It establishes that the gate was evaluated, never that\r\n   the drain-driving heartbeat call completed (§4.1).\r\n3. **Blocked-write onset is unobservable**, so the 15 s sink deadline cannot be confirmed here.\r\n4. **Generation attribution is unverified** on every token except `BRAIN_PROMOTED`.\r\n5. **Executable-to-source provenance is unverified** (§1). Source citations are claims about the\r\n   tree, not about the bytes under test.\r\n6. **A missing `t0`, a missing eviction, or a missing input tag are each \"not observed\"**, never\r\n   established absence.\r\n7. **One isolated daemon with one session is not the field's condition.** A negative result does not\r\n   clear the field path and must not be reported as doing so.\n…\n9. **#302 is not merged into this.** Whether it relates is untested and deliberately left open.","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,null,246]},"fileSize":15302,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\49-267-REFRESH-OBSERVATION-PLAN.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":246,"totalBytes":15069,"outputLines":243,"outputBytes":15069,"shownRange":{"start":1,"end":243},"nextOffset":244}}},"isError":false,"timestamp":1789522799924}}
{"type":"message","id":"78e5e7f9","parentId":"76e905b5","timestamp":"2026-09-16T01:39:59.942Z","message":{"role":"toolResult","toolCallId":"call_fpYvlXUXQw1JL42JBHLFNSnb|fc_0bac546ce171b754016aa9f36fd6a487d1b1c77fb600f8fb55","toolName":"glob","content":[{"type":"text","text":"# crates/spt-daemon/src/\nbrainproc.rs\napplyhost.rs\n# docs/\n304-W2-ADMISSION-RECEIPT.md\n304-W2-FIELD-PLAN.md\n\nSkipped missing paths: xtask/**"}],"details":{"scopePath":"**/*304*, **/*brainproc*, **/*apply*","fileCount":4,"files":["crates/spt-daemon/src/brainproc.rs","docs/304-W2-ADMISSION-RECEIPT.md","docs/304-W2-FIELD-PLAN.md","crates/spt-daemon/src/applyhost.rs"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","missingPaths":["xtask/**"]},"isError":false,"timestamp":1789522799941}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ar1Ad9JPlSPxOI4kQsvv1GEl|fc_0bac546ce171b754016aa9f378af1c87d1a36c33e19689269f","toolName":"grep","startedAt":"2026-09-16T01:40:08.756Z","args":{"path":"crates/xtask;crates/spt-update;crates/spt-daemon/src/applyhost.rs"},"intent":"Locating signer compatibility inputs"},"id":"caf19fa3","parentId":"78e5e7f9","timestamp":"2026-09-16T01:40:08.756Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_FQWXgUp2nRFsAOmdkVH0G2st|fc_0bac546ce171b754016aa9f378af2c87d1a44fc4c10ebd5ee4","toolName":"glob","startedAt":"2026-09-16T01:40:08.757Z","args":{"path":"**/*rig*;**/*debug_rollout*;**/xtask*;scripts/**;tools/**"},"intent":"Locating rig and xtask directories"},"id":"3b4567cb","parentId":"caf19fa3","timestamp":"2026-09-16T01:40:08.757Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_0PDfKJcnHWIJIKAEbQvC25zZ|fc_0bac546ce171b754016aa9f378af3887d1a02428bd9c19a625","toolName":"grep","startedAt":"2026-09-16T01:40:08.757Z","args":{"path":"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs;crates/spt-daemon/src/broker.rs"},"intent":"Locating trial and controller receipts"},"id":"df7a1800","parentId":"3b4567cb","timestamp":"2026-09-16T01:40:08.757Z"}
{"type":"message","id":"7959659b","parentId":"df7a1800","timestamp":"2026-09-16T01:40:08.757Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_ar1Ad9JPlSPxOI4kQsvv1GEl|fc_0bac546ce171b754016aa9f378af1c87d1a36c33e19689269f","name":"grep","arguments":{"i":"Locating signer compatibility inputs","pattern":"debug-rollout|brain_only|brain-only|broker_abi|compatibility","path":"crates/xtask;crates/spt-update;crates/spt-daemon/src/applyhost.rs","case":false,"gitignore":true,"skip":0},"intent":"Locating signer compatibility inputs"},{"type":"toolCall","id":"call_FQWXgUp2nRFsAOmdkVH0G2st|fc_0bac546ce171b754016aa9f378af2c87d1a44fc4c10ebd5ee4","name":"glob","arguments":{"i":"Locating rig and xtask directories","path":"**/*rig*;**/*debug_rollout*;**/xtask*;scripts/**;tools/**","hidden":true,"gitignore":false,"limit":100},"intent":"Locating rig and xtask directories"},{"type":"toolCall","id":"call_0PDfKJcnHWIJIKAEbQvC25zZ|fc_0bac546ce171b754016aa9f378af3887d1a02428bd9c19a625","name":"grep","arguments":{"i":"Locating trial and controller receipts","pattern":"AppliedPending|BRAIN_UPDATE_RESTART|BRAIN_PROMOTE_GATE_NOT_DRAINED|CONTROLLER_SLOT_CLOSED|compat","path":"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs;crates/spt-daemon/src/broker.rs","case":true,"gitignore":true,"skip":0},"intent":"Locating trial and controller receipts"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":5282,"output":252,"cacheRead":10752,"cacheWrite":0,"totalTokens":16286,"cost":{"input":0.052820000000000006,"output":0.0126,"cacheRead":0.010752,"cacheWrite":0,"total":0.076172}},"stopReason":"toolUse","timestamp":1789522799973,"responseId":"resp_0bac546ce171b754016aa9f37052c087d19732d6fa7170d2f2","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f378af1c87d1a36c33e19689269f","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating signer compatibility inputs\",\"pattern\":\"debug-rollout|brain_only|brain-only|broker_abi|compatibility\",\"path\":\"crates/xtask;crates/spt-update;crates/spt-daemon/src/applyhost.rs\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_ar1Ad9JPlSPxOI4kQsvv1GEl","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f378af2c87d1a44fc4c10ebd5ee4","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating rig and xtask directories\",\"path\":\"**/*rig*;**/*debug_rollout*;**/xtask*;scripts/**;tools/**\",\"hidden\":true,\"gitignore\":false,\"limit\":100}","call_id":"call_FQWXgUp2nRFsAOmdkVH0G2st","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"glob","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f378af3887d1a02428bd9c19a625","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating trial and controller receipts\",\"pattern\":\"AppliedPending|BRAIN_UPDATE_RESTART|BRAIN_PROMOTE_GATE_NOT_DRAINED|CONTROLLER_SLOT_CLOSED|compat\",\"path\":\"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs;crates/spt-daemon/src/broker.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_0PDfKJcnHWIJIKAEbQvC25zZ","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":8780.965199999977,"ttft":8741.054899999988,"completedAt":1789522808755,"contextSnapshot":{"promptTokens":16034,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"00f59559","parentId":"7959659b","timestamp":"2026-09-16T01:40:08.764Z","message":{"role":"toolResult","toolCallId":"call_0PDfKJcnHWIJIKAEbQvC25zZ|fc_0bac546ce171b754016aa9f378af3887d1a02428bd9c19a625","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## brainproc.rs\n 104|///\n*105|/// Parsing is **lenient** (KH-2.3 forward-compat): an unrecognized value — a\n 106|/// reason a *future* broker adds that this brain predates — defaults to `Cold`,\n 107|/// never a parse failure that would brick the brain before it rehydrates.\n 108|// [impl->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n...\n 473|/// **additive / N-1-readable** field (an N-1 brain ignores it; absence parses to\n*474|/// `None`) registered in the D6-3 [`crate::rollback_compat::PRE_READY_DURABLE_FILES`]\n 475|/// tripwire. Liveness of the *daemon* stays the seed-control ping, never this file.\n 476|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 477|fn write_ready(generation: u64) -> ReadyCost {\n...\n 821|/// The verdict of one trial-candidate's readiness watch (D6-2). The latch is\n*822|/// the unpromoted `AppliedPending` record (**A8**), not the start reason — so a\n 823|/// pre-ready crash respawn (`reason=Crash`) and a reboot-mid-trial cold spawn\n 824|/// (`reason=Cold`) are *both* trials.\n 825|enum TrialStep {\n...\n 913|                    spt_proto::emit_line_err!(\n*914|                        \"BRAIN_PROMOTE_GATE_NOT_DRAINED: generation {generation} — ready latched \\\n 915|                         and the DRAINED gate read NOT drained; this is the first such \\\n 916|                         observation in THIS trial, not the first evaluation of the gate; the trial \\\n 917|                         keeps polling to its window \\\n...\n 952|/// **Readiness-gated promotion + auto-rollback (ADR-0018 Q7, D6-2).** When the\n*953|/// injected `env` reports an unpromoted `AppliedPending` record, the spawn is a\n 954|/// **trial** (the latch is the *record*, **A8** — regardless of start reason):\n 955|/// the supervisor clears `brain.ready` (**A9**), spawns the candidate, and waits\n 956|/// for it to stamp ready for ITS generation within `window`. It **promotes** on\n...\n 994|        // Record-driven binary selection + trial latch (A8). The latch is the\n*995|        // unpromoted `AppliedPending` record, NOT the start reason; a `RolledBack`\n 996|        // record selects the last-known-good binary (and is never a trial — it is\n 997|        // the recovery steady state). A missing/corrupt record degrades to \"no\n 998|        // trial, default binary\" — the supervisor never panics on the record.\n...\n 1005|        };\n*1006|        let is_trial = matches!(record, Some(AppliedRecord::AppliedPending { .. }));\n 1007|        // A9: clear `brain.ready` immediately before a trial spawn — the prior\n 1008|        // child is already waited-on dead (below), so the only stamp that can\n 1009|        // exist post-clear is THIS trial child's. Closes the cross-lifetime hole\n...\n 1044|                            let version = match &record {\n*1045|                                Some(AppliedRecord::AppliedPending { version, .. }) => Some(*version),\n 1046|                                _ => None,\n 1047|                            };\n 1048|                            if let Some(version) = version {\n...\n 1115|                        if restart.take() {\n*1116|                            spt_proto::emit_line_err!(\"BRAIN_UPDATE_RESTART: planned restart — cycling brain onto the swapped binary\");\n 1117|                            let _ = child.kill();\n 1118|                            let _ = child.wait();\n 1119|                            planned = true;\n...\n 1159|/// Effect the rollback for an exhausted trial (D6-2): from the candidate's\n*1160|/// `AppliedPending` record, write `RolledBack{quarantine=N, running, rollback_binary}`\n 1161|/// and fire the loud notif (via `env`). `running` is the candidate's\n 1162|/// `prior_version` (the version actually running before the swap, captured by\n 1163|/// `apply`) — NOT `N-1`, which is wrong on a skip-version update (applied v5 →\n...\n 1165|/// It degrades to `N-1` only for a pre-D6-2b record that lacks `prior_version`.\n*1166|/// A record that is not `AppliedPending` (already rolled back, or raced away) is\n 1167|/// a no-op — never a double rollback.\n 1168|///\n 1169|/// **Rollback is SELECTION, not an update (open-call-4).** The recovery never\n...\n 1176|fn rollback(env: &dyn TrialEnv, record: &Option<AppliedRecord>) {\n*1177|    if let Some(AppliedRecord::AppliedPending {\n 1178|        version,\n 1179|        rollback_binary,\n 1180|        prior_version,\n...\n 1308|/// CLI surface and `daemon` is its alias, so this argv keeps parsing — but the\n*1309|/// compatibility this function exists for runs the OTHER way: an N-1 *binary*\n 1310|/// spawned or spawning across an update knows only the old spelling, and an\n 1311|/// argv of `node brain` would not parse there at all. An alias cannot rescue a\n 1312|/// parser that predates it. Do not change this to `node` without a fleet\n...\n 1542|    /// reason an older brain predates) defaults to `Cold` rather than failing —\n*1543|    /// the KH-2.3 forward-compat posture for the reason field's value space.\n 1544|    // [unit->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n 1545|    #[test]\n 1546|    fn start_reason_arg_round_trips_and_is_lenient() {\n...\n 1706|            TestTrialEnv {\n*1707|                state: Mutex::new(Some(AppliedRecord::AppliedPending {\n 1708|                    version,\n 1709|                    rollback_binary: rollback_binary.to_string(),\n 1710|                    candidate_started_ms: 0,\n...\n 2284|            &env,\n*2285|            &Some(AppliedRecord::AppliedPending {\n 2286|                version: 8,\n 2287|                rollback_binary: \"/good/spt.old-8\".to_string(),\n 2288|                candidate_started_ms: 0,\n...\n 2301|            &env2,\n*2302|            &Some(AppliedRecord::AppliedPending {\n 2303|                version: 8,\n 2304|                rollback_binary: \"/good/spt.old-8\".to_string(),\n 2305|                candidate_started_ms: 0,\n## applyhost.rs\n 86|    // [impl->REQ-UPD-8]\n*87|    AppliedPending {\n 88|        version: u64,\n 89|        product_version: String,\n 90|    },\n...\n 93|    /// hand off to (the old-broker-boot-pre-swap wart) and no brain was cycled;\n*94|    /// the `AppliedPending` trial is recorded so the NEXT daemon start boots the\n 95|    /// new bytes and promotes it on the fresh brain's `ready`. `version` is the\n 96|    /// monotonic counter; `product_version` the human semver (empty pre-v0.3.2).\n 97|    // [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n...\n 248|/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\n*249|/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\n 250|/// and the daemonless apply — both land the SAME bytes and record the SAME trial\n 251|/// (the supervisor promotes it on the next brain's `ready`); they differ only in\n 252|/// whether a running brain is cycled afterwards.\n...\n 271|    // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n*272|    // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n 273|    // carrying the last-known-good `rollback_binary` (the aside we just created)\n 274|    // so the broker's supervisor, a different process from this CLI, can promote\n 275|    // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\n...\n 279|    // [impl->REQ-UPD-6]\n*280|    let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\n 281|        version,\n 282|        rollback_binary: aside.to_string_lossy().into_owned(),\n 283|        candidate_started_ms: now_ms(),\n...\n 339|    match brain.request_brain_restart() {\n*340|        Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\n 341|            version,\n 342|            product_version,\n 343|        }),\n...\n 378|/// REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so hosted endpoints come back). The\n*379|/// recorded `AppliedPending` promotes on that fresh brain's `ready`, exactly as\n 380|/// the handoff path's does. Runs the identical verify/classify gate as\n 381|/// [`apply_staged`], so every fail-closed refusal is preserved.\n 382|// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n...\n 408|/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n*409|/// is >= the staged candidate, OR a still-open trial (`AppliedPending`) already\n 410|/// landed this version (its bytes are on disk though not yet ready-promoted). Pure.\n 411|// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n 412|fn staged_already_applied(\n...\n 417|    // A trial for this version (or newer) already swapped the binary on disk.\n*418|    if let Some(AppliedRecord::AppliedPending { version, .. }) = applied_state {\n 419|        if *version >= staged_version {\n 420|            return true;\n 421|        }\n...\n 538|        // (re-applying would re-rename an already-swapped exe = the os-error-5).\n*539|        let pending = AppliedRecord::AppliedPending {\n 540|            version: 8,\n 541|            rollback_binary: \"spt.old-7\".to_string(),\n 542|            candidate_started_ms: 0,\n...\n 546|        // A trial for an OLDER version does not mask a genuinely newer stage.\n*547|        let old_pending = AppliedRecord::AppliedPending {\n 548|            version: 5,\n 549|            rollback_binary: \"spt.old-4\".to_string(),\n 550|            candidate_started_ms: 0,\n...\n 806|        assert!(\n*807|            matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 808|            \"matching-platform single applies, got {out:?}\"\n 809|        );\n 810|        assert_eq!(std::fs::read(&exe).unwrap(), b\"CROSS-OS BYTES\");\n...\n 916|        assert!(\n*917|            matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n 918|            \"got {out:?}\"\n 919|        );\n 920|        assert_eq!(\n...\n 973|                cache.applied_state(),\n*974|                Some(AppliedRecord::AppliedPending { version: 7, .. })\n 975|            ),\n*976|            \"daemonless apply records the open AppliedPending trial\"\n 977|        );\n 978|    }\n 979|\n...\n 1012|        cache\n*1013|            .record_applied_state(&AppliedRecord::AppliedPending {\n 1014|                version: 9,\n 1015|                rollback_binary: \"spt-binary.old-8\".to_string(),\n 1016|                candidate_started_ms: 0,\n...\n 1047|        assert!(\n*1048|            matches!(out, ApplyStagedOutcome::AppliedPending { version: 11, .. }),\n 1049|            \"got {out:?}\"\n 1050|        );\n 1051|        assert_eq!(std::fs::read(&exe).unwrap(), b\"SET BINARY BYTES\");\n...\n 1069|        assert!(\n*1070|            matches!(out, ApplyStagedOutcome::AppliedPending { version: 13, .. }),\n 1071|            \"got {out:?}\"\n 1072|        );\n 1073|        assert_eq!(std::fs::read(&exe).unwrap(), b\"NEW WITHOUT SESSIONS\");\n...\n 1199|        assert!(\n*1200|            matches!(out, ApplyStagedOutcome::AppliedPending { version: 8, .. }),\n 1201|            \"a newer version is not quarantined, got {out:?}\"\n 1202|        );\n 1203|    }\n## broker.rs\n 2764|                spt_proto::emit_line_err!(\n*2765|                    \"CONTROLLER_SLOT_CLOSED:{} conn={} cause={cause} {} — the controller slot \\\n 2766|                     was occupied and is now empty [REQ-REFRESH-WAIT-ATTRIBUTION]\",\n 2767|                    self.session_id,\n 2768|                    conn.unwrap_or(0),\n...\n 6100|                // EXACTLY like an N-1 broker that predates the verb — the\n*6101|                // forward-compat unknown-kind reply, byte-identical. Never set\n 6102|                // in production.\n 6103|                // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\n 6104|                KIND_SPAWN_FRESH => {\n...\n 6252|                    // answers the verb EXACTLY like an N-1 broker that\n*6253|                    // predates it — the forward-compat unknown-kind reply\n 6254|                    // below, byte-identical (the stable KH-2.3 wire fact the\n 6255|                    // dispatcher's fallback gate keys on). Never set in\n 6256|                    // production.\n...\n 6420|                KIND_BRAIN_RESTART => self.dispatch_brain_restart(&send),\n*6421|                // An unknown kind is tolerated (forward-compat): report, don't die.\n 6422|                other => send_error(&send, &format!(\"unknown command kind {other:?}\")),\n 6423|            }\n 6424|        }\n...\n 9507|                    .map_err(|e| format!(\"net-dial failed: {e}\"))?;\n*9508|                // Frozen wire-compat text, single-sourced from the shared marker so\n 9509|                // the A-4b retry matches one source of truth (ADR-0034 Addendum 2).\n 9510|                let conn_id = host\n 9511|                    .dial_op_conn(minter, op)\n...\n 9807|                    .map_err(|e| format!(\"net-stream-open failed: {e}\"))?;\n*9808|                // Frozen wire-compat text, single-sourced from the shared marker so\n 9809|                // the A-4b retry matches one source of truth (ADR-0034 Addendum 2).\n 9810|                let stream_id = host\n 9811|                    .stream_op_id(minter, op)"}],"details":{"scopePath":"crates/spt-daemon/src/brainproc.rs, crates/spt-daemon/src/applyhost.rs, crates/spt-daemon/src/broker.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":42,"fileCount":3,"files":["crates/spt-daemon/src/brainproc.rs","crates/spt-daemon/src/applyhost.rs","crates/spt-daemon/src/broker.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/brainproc.rs","count":17},{"path":"crates/spt-daemon/src/applyhost.rs","count":19},{"path":"crates/spt-daemon/src/broker.rs","count":6}],"truncated":false,"displayContent":"# crates/spt-daemon/src/\n## brainproc.rs\n  104│///\n *105│/// Parsing is **lenient** (KH-2.3 forward-compat): an unrecognized value — a\n  106│/// reason a *future* broker adds that this brain predates — defaults to `Cold`,\n  107│/// never a parse failure that would brick the brain before it rehydrates.\n  108│// [impl->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n     │...\n  473│/// **additive / N-1-readable** field (an N-1 brain ignores it; absence parses to\n *474│/// `None`) registered in the D6-3 [`crate::rollback_compat::PRE_READY_DURABLE_FILES`]\n  475│/// tripwire. Liveness of the *daemon* stays the seed-control ping, never this file.\n  476│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n  477│fn write_ready(generation: u64) -> ReadyCost {\n     │...\n  821│/// The verdict of one trial-candidate's readiness watch (D6-2). The latch is\n *822│/// the unpromoted `AppliedPending` record (**A8**), not the start reason — so a\n  823│/// pre-ready crash respawn (`reason=Crash`) and a reboot-mid-trial cold spawn\n  824│/// (`reason=Cold`) are *both* trials.\n  825│enum TrialStep {\n     │...\n  913│                    spt_proto::emit_line_err!(\n *914│                        \"BRAIN_PROMOTE_GATE_NOT_DRAINED: generation {generation} — ready latched \\\n  915│                         and the DRAINED gate read NOT drained; this is the first such \\\n  916│                         observation in THIS trial, not the first evaluation of the gate; the trial \\\n  917│                         keeps polling to its window \\\n     │...\n  952│/// **Readiness-gated promotion + auto-rollback (ADR-0018 Q7, D6-2).** When the\n *953│/// injected `env` reports an unpromoted `AppliedPending` record, the spawn is a\n  954│/// **trial** (the latch is the *record*, **A8** — regardless of start reason):\n  955│/// the supervisor clears `brain.ready` (**A9**), spawns the candidate, and waits\n  956│/// for it to stamp ready for ITS generation within `window`. It **promotes** on\n     │...\n  994│        // Record-driven binary selection + trial latch (A8). The latch is the\n *995│        // unpromoted `AppliedPending` record, NOT the start reason; a `RolledBack`\n  996│        // record selects the last-known-good binary (and is never a trial — it is\n  997│        // the recovery steady state). A missing/corrupt record degrades to \"no\n  998│        // trial, default binary\" — the supervisor never panics on the record.\n     │...\n 1005│        };\n*1006│        let is_trial = matches!(record, Some(AppliedRecord::AppliedPending { .. }));\n 1007│        // A9: clear `brain.ready` immediately before a trial spawn — the prior\n 1008│        // child is already waited-on dead (below), so the only stamp that can\n 1009│        // exist post-clear is THIS trial child's. Closes the cross-lifetime hole\n     │...\n 1044│                            let version = match &record {\n*1045│                                Some(AppliedRecord::AppliedPending { version, .. }) => Some(*version),\n 1046│                                _ => None,\n 1047│                            };\n 1048│                            if let Some(version) = version {\n     │...\n 1115│                        if restart.take() {\n*1116│                            spt_proto::emit_line_err!(\"BRAIN_UPDATE_RESTART: planned restart — cycling brain onto the swapped binary\");\n 1117│                            let _ = child.kill();\n 1118│                            let _ = child.wait();\n 1119│                            planned = true;\n     │...\n 1159│/// Effect the rollback for an exhausted trial (D6-2): from the candidate's\n*1160│/// `AppliedPending` record, write `RolledBack{quarantine=N, running, rollback_binary}`\n 1161│/// and fire the loud notif (via `env`). `running` is the candidate's\n 1162│/// `prior_version` (the version actually running before the swap, captured by\n 1163│/// `apply`) — NOT `N-1`, which is wrong on a skip-version update (applied v5 →\n     │...\n 1165│/// It degrades to `N-1` only for a pre-D6-2b record that lacks `prior_version`.\n*1166│/// A record that is not `AppliedPending` (already rolled back, or raced away) is\n 1167│/// a no-op — never a double rollback.\n 1168│///\n 1169│/// **Rollback is SELECTION, not an update (open-call-4).** The recovery never\n     │...\n 1176│fn rollback(env: &dyn TrialEnv, record: &Option<AppliedRecord>) {\n*1177│    if let Some(AppliedRecord::AppliedPending {\n 1178│        version,\n 1179│        rollback_binary,\n 1180│        prior_version,\n     │...\n 1308│/// CLI surface and `daemon` is its alias, so this argv keeps parsing — but the\n*1309│/// compatibility this function exists for runs the OTHER way: an N-1 *binary*\n 1310│/// spawned or spawning across an update knows only the old spelling, and an\n 1311│/// argv of `node brain` would not parse there at all. An alias cannot rescue a\n 1312│/// parser that predates it. Do not change this to `node` without a fleet\n     │...\n 1542│    /// reason an older brain predates) defaults to `Cold` rather than failing —\n*1543│    /// the KH-2.3 forward-compat posture for the reason field's value space.\n 1544│    // [unit->REQ-HAZARD-HANDOFF-ARGV-COMPAT]\n 1545│    #[test]\n 1546│    fn start_reason_arg_round_trips_and_is_lenient() {\n     │...\n 1706│            TestTrialEnv {\n*1707│                state: Mutex::new(Some(AppliedRecord::AppliedPending {\n 1708│                    version,\n 1709│                    rollback_binary: rollback_binary.to_string(),\n 1710│                    candidate_started_ms: 0,\n     │...\n 2284│            &env,\n*2285│            &Some(AppliedRecord::AppliedPending {\n 2286│                version: 8,\n 2287│                rollback_binary: \"/good/spt.old-8\".to_string(),\n 2288│                candidate_started_ms: 0,\n     │...\n 2301│            &env2,\n*2302│            &Some(AppliedRecord::AppliedPending {\n 2303│                version: 8,\n 2304│                rollback_binary: \"/good/spt.old-8\".to_string(),\n 2305│                candidate_started_ms: 0,\n## applyhost.rs\n   86│    // [impl->REQ-UPD-8]\n  *87│    AppliedPending {\n   88│        version: u64,\n   89│        product_version: String,\n   90│    },\n     │...\n   93│    /// hand off to (the old-broker-boot-pre-swap wart) and no brain was cycled;\n  *94│    /// the `AppliedPending` trial is recorded so the NEXT daemon start boots the\n   95│    /// new bytes and promotes it on the fresh brain's `ready`. `version` is the\n   96│    /// monotonic counter; `product_version` the human semver (empty pre-v0.3.2).\n   97│    // [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n     │...\n  248│/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\n *249│/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\n  250│/// and the daemonless apply — both land the SAME bytes and record the SAME trial\n  251│/// (the supervisor promotes it on the next brain's `ready`); they differ only in\n  252│/// whether a running brain is cycled afterwards.\n     │...\n  271│    // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n *272│    // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n  273│    // carrying the last-known-good `rollback_binary` (the aside we just created)\n  274│    // so the broker's supervisor, a different process from this CLI, can promote\n  275│    // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\n     │...\n  279│    // [impl->REQ-UPD-6]\n *280│    let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\n  281│        version,\n  282│        rollback_binary: aside.to_string_lossy().into_owned(),\n  283│        candidate_started_ms: now_ms(),\n     │...\n  339│    match brain.request_brain_restart() {\n *340│        Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\n  341│            version,\n  342│            product_version,\n  343│        }),\n     │...\n  378│/// REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL so hosted endpoints come back). The\n *379│/// recorded `AppliedPending` promotes on that fresh brain's `ready`, exactly as\n  380│/// the handoff path's does. Runs the identical verify/classify gate as\n  381│/// [`apply_staged`], so every fail-closed refusal is preserved.\n  382│// [impl->REQ-UPDATE-ONE-SHOT-FINISH]\n     │...\n  408│/// (REQ-UPDATE-FETCH-CURRENT-UX): already-applied when the promoted applied version\n *409│/// is >= the staged candidate, OR a still-open trial (`AppliedPending`) already\n  410│/// landed this version (its bytes are on disk though not yet ready-promoted). Pure.\n  411│// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n  412│fn staged_already_applied(\n     │...\n  417│    // A trial for this version (or newer) already swapped the binary on disk.\n *418│    if let Some(AppliedRecord::AppliedPending { version, .. }) = applied_state {\n  419│        if *version >= staged_version {\n  420│            return true;\n  421│        }\n     │...\n  538│        // (re-applying would re-rename an already-swapped exe = the os-error-5).\n *539│        let pending = AppliedRecord::AppliedPending {\n  540│            version: 8,\n  541│            rollback_binary: \"spt.old-7\".to_string(),\n  542│            candidate_started_ms: 0,\n     │...\n  546│        // A trial for an OLDER version does not mask a genuinely newer stage.\n *547│        let old_pending = AppliedRecord::AppliedPending {\n  548│            version: 5,\n  549│            rollback_binary: \"spt.old-4\".to_string(),\n  550│            candidate_started_ms: 0,\n     │...\n  806│        assert!(\n *807│            matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n  808│            \"matching-platform single applies, got {out:?}\"\n  809│        );\n  810│        assert_eq!(std::fs::read(&exe).unwrap(), b\"CROSS-OS BYTES\");\n     │...\n  916│        assert!(\n *917│            matches!(out, ApplyStagedOutcome::AppliedPending { version: 7, .. }),\n  918│            \"got {out:?}\"\n  919│        );\n  920│        assert_eq!(\n     │...\n  973│                cache.applied_state(),\n *974│                Some(AppliedRecord::AppliedPending { version: 7, .. })\n  975│            ),\n *976│            \"daemonless apply records the open AppliedPending trial\"\n  977│        );\n  978│    }\n  979│\n     │...\n 1012│        cache\n*1013│            .record_applied_state(&AppliedRecord::AppliedPending {\n 1014│                version: 9,\n 1015│                rollback_binary: \"spt-binary.old-8\".to_string(),\n 1016│                candidate_started_ms: 0,\n     │...\n 1047│        assert!(\n*1048│            matches!(out, ApplyStagedOutcome::AppliedPending { version: 11, .. }),\n 1049│            \"got {out:?}\"\n 1050│        );\n 1051│        assert_eq!(std::fs::read(&exe).unwrap(), b\"SET BINARY BYTES\");\n     │...\n 1069│        assert!(\n*1070│            matches!(out, ApplyStagedOutcome::AppliedPending { version: 13, .. }),\n 1071│            \"got {out:?}\"\n 1072│        );\n 1073│        assert_eq!(std::fs::read(&exe).unwrap(), b\"NEW WITHOUT SESSIONS\");\n     │...\n 1199│        assert!(\n*1200│            matches!(out, ApplyStagedOutcome::AppliedPending { version: 8, .. }),\n 1201│            \"a newer version is not quarantined, got {out:?}\"\n 1202│        );\n 1203│    }\n## broker.rs\n 2764│                spt_proto::emit_line_err!(\n*2765│                    \"CONTROLLER_SLOT_CLOSED:{} conn={} cause={cause} {} — the controller slot \\\n 2766│                     was occupied and is now empty [REQ-REFRESH-WAIT-ATTRIBUTION]\",\n 2767│                    self.session_id,\n 2768│                    conn.unwrap_or(0),\n     │...\n 6100│                // EXACTLY like an N-1 broker that predates the verb — the\n*6101│                // forward-compat unknown-kind reply, byte-identical. Never set\n 6102│                // in production.\n 6103│                // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\n 6104│                KIND_SPAWN_FRESH => {\n     │...\n 6252│                    // answers the verb EXACTLY like an N-1 broker that\n*6253│                    // predates it — the forward-compat unknown-kind reply\n 6254│                    // below, byte-identical (the stable KH-2.3 wire fact the\n 6255│                    // dispatcher's fallback gate keys on). Never set in\n 6256│                    // production.\n     │...\n 6420│                KIND_BRAIN_RESTART => self.dispatch_brain_restart(&send),\n*6421│                // An unknown kind is tolerated (forward-compat): report, don't die.\n 6422│                other => send_error(&send, &format!(\"unknown command kind {other:?}\")),\n 6423│            }\n 6424│        }\n     │...\n 9507│                    .map_err(|e| format!(\"net-dial failed: {e}\"))?;\n*9508│                // Frozen wire-compat text, single-sourced from the shared marker so\n 9509│                // the A-4b retry matches one source of truth (ADR-0034 Addendum 2).\n 9510│                let conn_id = host\n 9511│                    .dial_op_conn(minter, op)\n     │...\n 9807│                    .map_err(|e| format!(\"net-stream-open failed: {e}\"))?;\n*9808│                // Frozen wire-compat text, single-sourced from the shared marker so\n 9809│                // the A-4b retry matches one source of truth (ADR-0034 Addendum 2).\n 9810│                let stream_id = host\n 9811│                    .stream_op_id(minter, op)"},"isError":false,"timestamp":1789522808764}}
{"type":"message","id":"fcc9b10a","parentId":"00f59559","timestamp":"2026-09-16T01:40:08.880Z","message":{"role":"toolResult","toolCallId":"call_ar1Ad9JPlSPxOI4kQsvv1GEl|fc_0bac546ce171b754016aa9f378af1c87d1a36c33e19689269f","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## xtask/src/\n### main.rs\n 81|        \"debug-pin\" => debug_pin(&args[1..]),\n*82|        \"debug-rollout\" => debug_rollout(&args[1..]),\n 83|        \"debug-mark-applied\" => debug_mark_applied(&args[1..]),\n 84|        \"debug-converge\" => debug_converge(&args[1..]),\n 85|        _ => {\n 86|            eprintln!(\n*87|                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--fo...\n 88|            );\n 89|            std::process::exit(2);\n 90|        }\n...\n 2266|/// refuses a staged-but-unapplied set (`lanhost::set_gate`). Pairs with\n*2267|/// `debug-pin` + `debug-rollout`, which already cover the trust overlay and the\n 2268|/// signed staged set; `--home` defaults to `SPT_HOME` like they do.\n 2269|///\n 2270|/// Maintainer tooling only — never the public `spt` surface (ADR-0016).\n...\n 2422|    let state_path =\n*2423|        state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\n 2424|    let version = version.unwrap_or_else(|| next_debug_version(&state_path));\n 2425|    let identity = debug_signing_identity();\n 2426|\n\n## spt-daemon/src/\n### applyhost.rs\n 1|//! Staged-update apply orchestration (M5-D7b) — the **production caller** for\n*2|//! [`crate::update::apply_brain_only`], closing the M4-D9 honest residual\n 3|//! (\"nothing in the daemon invokes this apply after the user acks the consent\n 4|//! notif\").\n 5|//!\n...\n 33|//!    broker holds them all across the cycle). This replaces the old in-process\n*34|//!    `apply_brain_only` handoff, the regression that re-attached a CLI-side\n 35|//!    subscriber while the live brain kept running the OLD code.\n 36|//!\n 37|//! New code runs **immediately** — the supervised respawn lands on the new\n...\n 68|    Rejected(String),\n*69|    /// Verified but not brain-only — the M5 apply surface refuses the\n 70|    /// broker-touching classes typed; the artifact stays staged.\n 71|    RefusedClass(UpdateClass),\n 72|    /// Refused: this version was auto-rolled-back on this node (a prior trial\n...\n 111|    Done(ApplyStagedOutcome),\n*112|    /// Verified brain-only bytes ready to land at the exe path.\n 113|    Proceed {\n 114|        version: u64,\n 115|        product_version: String,\n...\n 121|/// already-applied short-circuit, at-rest re-verification, platform guard, and\n*122|/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\n 123|/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\n 124|/// run this identical gate so their fail-closed posture never diverges.\n 125|// [impl->REQ-UPD-4]\n...\n 330|    // no manual bounce, every broker-held endpoint untouched at the process\n*331|    // level. This replaces the old in-process `apply_brain_only` handoff (the\n 332|    // regression: it re-attached a CLI-side subscriber while the live brain kept\n*333|    // running the OLD code). `classify` already gated this as brain-only, so the\n 334|    // broker never moves; only the brain restarts.\n 335|    //\n 336|    // A broker without a supervisor wired (`honored: false`) still swapped the\n...\n 894|    // [unit->REQ-UPD-4] the ack-driven apply end to end: a staged + verified\n*895|    // brain-only release swaps the binary (artifact lands at the exe path,\n 896|    // the original steps aside) and triggers the brain handoff with the\n 897|    // hosted endpoint untouched — the production caller the M4-D9 residual\n 898|    // promised. [unit->REQ-UPD-3]\n...\n 1055|    // [unit->REQ-UPD-3] A node with no broker-hosted sessions still applies a\n*1056|    // brain-only update: there is nothing to hand off, and no endpoint can be\n 1057|    // terminated by the apply.\n 1058|    #[test]\n 1059|    fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n...\n 1108|    // [unit->REQ-UPD-4] idempotent no-op and fail-closed gates: nothing\n*1109|    // staged ⇒ NoUpdate; a non-brain-only class refuses typed with the seat\n 1110|    // untouched; a tampered at-rest artifact rejects with the seat untouched.\n 1111|    #[test]\n 1112|    fn apply_staged_gates_fail_closed_with_the_seat_untouched() {\n\nSkipped missing paths: crates/spt-update\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":"crates/xtask, crates/spt-daemon/src/applyhost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":14,"fileCount":2,"files":["crates/xtask/src/main.rs","crates/spt-daemon/src/applyhost.rs"],"fileMatches":[{"path":"crates/xtask/src/main.rs","count":4},{"path":"crates/spt-daemon/src/applyhost.rs","count":10}],"truncated":true,"displayContent":"# crates/\n\n## xtask/src/\n### main.rs\n   81│        \"debug-pin\" => debug_pin(&args[1..]),\n  *82│        \"debug-rollout\" => debug_rollout(&args[1..]),\n   83│        \"debug-mark-applied\" => debug_mark_applied(&args[1..]),\n   84│        \"debug-converge\" => debug_converge(&args[1..]),\n   85│        _ => {\n   86│            eprintln!(\n  *87│                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--fo...\n   88│            );\n   89│            std::process::exit(2);\n   90│        }\n     │...\n 2266│/// refuses a staged-but-unapplied set (`lanhost::set_gate`). Pairs with\n*2267│/// `debug-pin` + `debug-rollout`, which already cover the trust overlay and the\n 2268│/// signed staged set; `--home` defaults to `SPT_HOME` like they do.\n 2269│///\n 2270│/// Maintainer tooling only — never the public `spt` surface (ADR-0016).\n     │...\n 2422│    let state_path =\n*2423│        state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\n 2424│    let version = version.unwrap_or_else(|| next_debug_version(&state_path));\n 2425│    let identity = debug_signing_identity();\n 2426│\n\n## spt-daemon/src/\n### applyhost.rs\n    1│//! Staged-update apply orchestration (M5-D7b) — the **production caller** for\n   *2│//! [`crate::update::apply_brain_only`], closing the M4-D9 honest residual\n    3│//! (\"nothing in the daemon invokes this apply after the user acks the consent\n    4│//! notif\").\n    5│//!\n     │...\n   33│//!    broker holds them all across the cycle). This replaces the old in-process\n  *34│//!    `apply_brain_only` handoff, the regression that re-attached a CLI-side\n   35│//!    subscriber while the live brain kept running the OLD code.\n   36│//!\n   37│//! New code runs **immediately** — the supervised respawn lands on the new\n     │...\n   68│    Rejected(String),\n  *69│    /// Verified but not brain-only — the M5 apply surface refuses the\n   70│    /// broker-touching classes typed; the artifact stays staged.\n   71│    RefusedClass(UpdateClass),\n   72│    /// Refused: this version was auto-rolled-back on this node (a prior trial\n     │...\n  111│    Done(ApplyStagedOutcome),\n *112│    /// Verified brain-only bytes ready to land at the exe path.\n  113│    Proceed {\n  114│        version: u64,\n  115│        product_version: String,\n     │...\n  121│/// already-applied short-circuit, at-rest re-verification, platform guard, and\n *122│/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\n  123│/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\n  124│/// run this identical gate so their fail-closed posture never diverges.\n  125│// [impl->REQ-UPD-4]\n     │...\n  330│    // no manual bounce, every broker-held endpoint untouched at the process\n *331│    // level. This replaces the old in-process `apply_brain_only` handoff (the\n  332│    // regression: it re-attached a CLI-side subscriber while the live brain kept\n *333│    // running the OLD code). `classify` already gated this as brain-only, so the\n  334│    // broker never moves; only the brain restarts.\n  335│    //\n  336│    // A broker without a supervisor wired (`honored: false`) still swapped the\n     │...\n  894│    // [unit->REQ-UPD-4] the ack-driven apply end to end: a staged + verified\n *895│    // brain-only release swaps the binary (artifact lands at the exe path,\n  896│    // the original steps aside) and triggers the brain handoff with the\n  897│    // hosted endpoint untouched — the production caller the M4-D9 residual\n  898│    // promised. [unit->REQ-UPD-3]\n     │...\n 1055│    // [unit->REQ-UPD-3] A node with no broker-hosted sessions still applies a\n*1056│    // brain-only update: there is nothing to hand off, and no endpoint can be\n 1057│    // terminated by the apply.\n 1058│    #[test]\n 1059│    fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n     │...\n 1108│    // [unit->REQ-UPD-4] idempotent no-op and fail-closed gates: nothing\n*1109│    // staged ⇒ NoUpdate; a non-brain-only class refuses typed with the seat\n 1110│    // untouched; a tampered at-rest artifact rejects with the seat untouched.\n 1111│    #[test]\n 1112│    fn apply_staged_gates_fail_closed_with_the_seat_untouched() {","missingPaths":["crates/spt-update"],"linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789522808880}}
{"type":"message","id":"fe27c96d","parentId":"fcc9b10a","timestamp":"2026-09-16T01:40:11.721Z","message":{"role":"toolResult","toolCallId":"call_FQWXgUp2nRFsAOmdkVH0G2st|fc_0bac546ce171b754016aa9f378af2c87d1a44fc4c10ebd5ee4","toolName":"glob","content":[{"type":"text","text":"# .worktrees/\n## hertz-307-evidence/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## hertz-ir11-built/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-ir11-headless-column/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-ir86-retire/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-ir86-disk-delta/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## hertz-ir137-launch-discipline/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## hertz-ir86-windows-floor/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-ir86-linux-floor/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-ir136-fixture/\n### crates/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n#### xtask/\n### docs/spikes/\npump-on-one-box-rig.patch\n## hertz-ir135-checker/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## 304-web-helper-rca/\n### docs/spikes/\npump-on-one-box-rig.patch\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n## hertz-S4-foreign-apply/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## 304-release-note-s4/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## 308-registry-process-lock/\n### crates/\n#### xtask/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n### docs/spikes/\npump-on-one-box-rig.patch\n## 297-enforcement-shape/\n### target/\n#### release/\nxtask.d\nxtask.pdb\nxtask.exe\n##### .fingerprint/xtask-62c7e52423994289/\n##### deps/\nxtask.pdb\nxtask.exe\nxtask.lib\nxtask.exp\nxtask.d\n#### debug/\nxtask.d\nxtask.pdb\nxtask.exe\n##### deps/\nxtask.pdb\nxtask.exe\nxtask.d\nxtask-f64fb31c8e975f68.d\ntwo_origin_spanning-6029f7bcb85b7bb6.d\nlibtwo_origin_spanning-6029f7bcb85b7bb6.rmeta\nxtask-148094371e1466c6.d\nxtask-9354010cd3385346.d\nxtask-1ffacec11598b22a.d\ntwo_origin_spanning-23b9094790b3eaaa.d\nlibtwo_origin_spanning-23b9094790b3eaaa.rmeta\n##### .fingerprint/\n###### spt-daemon-6029f7bcb85b7bb6/\ntest-integration-test-two_origin_spanning\ntest-integration-test-two_origin_spanning.json\ndep-test-integration-test-two_origin_spanning\n###### spt-daemon-23b9094790b3eaaa/\ntest-integration-test-two_origin_spanning\ntest-integration-test-two_origin_spanning.json\ndep-test-integration-test-two_origin_spanning\n###### xtask-62c7e52423994289/\n###### xtask-e82e92e8d41e507b/\n###### xtask-148094371e1466c6/\n###### xtask-8d808743af0f8817/\n###### xtask-f64fb31c8e975f68/\n###### xtask-beba7cb4dae8c4a1/\n###### xtask-9354010cd3385346/\n###### xtask-ecf4528ecaf01a68/\n###### xtask-1ffacec11598b22a/\n### crates/\n#### spt-daemon/tests/\ntwo_origin_spanning.rs\n#### xtask/\n### docs/spikes/\npump-on-one-box-rig.patch\n## release-S2-527cd8e8/target/release/\nxtask.d\nxtask.pdb\nxtask.exe\n### .fingerprint/xtask-62c7e52423994289/\n### deps/\nxtask.pdb\nxtask.exe\nxtask.lib\nxtask.exp\n# .spt/preserved/\n## 304-handoff/s4-release-note/\nxtask-gen-receipt.json\nxtask-gen.log\nxtask-check-admission.json\nxtask-check-receipt.json\nxtask-check.log\nxtask-gen-admission.json\n## hertz-fp-driver-review/d2/\n### field-rig-r10-w7-a2-QWHXWYUH/\n### field-rig-r10-w6-ENA6WIMS/\n## hertz-attachment-NO4JJOEL/\nrig-pins-before-proof.json\n\nSkipped missing paths: scripts/**, tools/**\n\n[100 results limit reached. Use limit=200 for more]"}],"details":{"scopePath":"**/*rig*, **/*debug_rollout*, **/xtask*","fileCount":100,"files":[".worktrees/hertz-307-evidence/crates/xtask/",".worktrees/hertz-307-evidence/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-307-evidence/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir11-built/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir11-built/crates/xtask/",".worktrees/hertz-ir11-built/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir11-headless-column/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir11-headless-column/crates/xtask/",".worktrees/hertz-ir11-headless-column/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir86-retire/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir86-retire/crates/xtask/",".worktrees/hertz-ir86-retire/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir86-disk-delta/crates/xtask/",".worktrees/hertz-ir86-disk-delta/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir137-launch-discipline/crates/xtask/",".worktrees/hertz-ir137-launch-discipline/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir137-launch-discipline/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir86-windows-floor/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir86-windows-floor/crates/xtask/",".worktrees/hertz-ir86-windows-floor/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir86-linux-floor/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir86-linux-floor/crates/xtask/",".worktrees/hertz-ir86-linux-floor/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir136-fixture/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-ir136-fixture/crates/xtask/",".worktrees/hertz-ir136-fixture/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir135-checker/crates/xtask/",".worktrees/hertz-ir135-checker/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-ir135-checker/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/304-web-helper-rca/docs/spikes/pump-on-one-box-rig.patch",".worktrees/304-web-helper-rca/crates/xtask/",".worktrees/304-web-helper-rca/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/hertz-S4-foreign-apply/crates/xtask/",".worktrees/hertz-S4-foreign-apply/docs/spikes/pump-on-one-box-rig.patch",".worktrees/hertz-S4-foreign-apply/crates/spt-daemon/tests/two_origin_spanning.rs",".spt/preserved/304-handoff/s4-release-note/xtask-gen-receipt.json",".spt/preserved/304-handoff/s4-release-note/xtask-gen.log",".spt/preserved/304-handoff/s4-release-note/xtask-check-admission.json",".spt/preserved/304-handoff/s4-release-note/xtask-check-receipt.json",".spt/preserved/304-handoff/s4-release-note/xtask-check.log",".spt/preserved/304-handoff/s4-release-note/xtask-gen-admission.json",".worktrees/304-release-note-s4/crates/xtask/",".worktrees/304-release-note-s4/docs/spikes/pump-on-one-box-rig.patch",".worktrees/304-release-note-s4/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/308-registry-process-lock/crates/xtask/",".worktrees/308-registry-process-lock/docs/spikes/pump-on-one-box-rig.patch",".worktrees/308-registry-process-lock/crates/spt-daemon/tests/two_origin_spanning.rs",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/",".spt/preserved/hertz-attachment-NO4JJOEL/rig-pins-before-proof.json",".worktrees/297-enforcement-shape/target/release/xtask.d",".worktrees/297-enforcement-shape/target/release/.fingerprint/xtask-62c7e52423994289/",".worktrees/297-enforcement-shape/target/release/deps/xtask.pdb",".worktrees/297-enforcement-shape/target/release/xtask.pdb",".worktrees/297-enforcement-shape/target/release/deps/xtask.exe",".worktrees/297-enforcement-shape/target/release/xtask.exe",".worktrees/297-enforcement-shape/target/release/deps/xtask.lib",".worktrees/297-enforcement-shape/target/release/deps/xtask.exp",".worktrees/297-enforcement-shape/target/release/deps/xtask.d",".worktrees/297-enforcement-shape/target/debug/xtask.d",".worktrees/297-enforcement-shape/target/debug/deps/xtask.pdb",".worktrees/297-enforcement-shape/target/debug/xtask.pdb",".worktrees/297-enforcement-shape/target/debug/deps/xtask.exe",".worktrees/297-enforcement-shape/target/debug/xtask.exe",".worktrees/297-enforcement-shape/target/debug/deps/xtask.d",".worktrees/297-enforcement-shape/target/debug/deps/xtask-f64fb31c8e975f68.d",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-6029f7bcb85b7bb6/test-integration-test-two_origin_spanning",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-6029f7bcb85b7bb6/test-integration-test-two_origin_spanning.json",".worktrees/297-enforcement-shape/target/debug/deps/two_origin_spanning-6029f7bcb85b7bb6.d",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-6029f7bcb85b7bb6/dep-test-integration-test-two_origin_spanning",".worktrees/297-enforcement-shape/target/debug/deps/libtwo_origin_spanning-6029f7bcb85b7bb6.rmeta",".worktrees/297-enforcement-shape/target/debug/deps/xtask-148094371e1466c6.d",".worktrees/297-enforcement-shape/target/debug/deps/xtask-9354010cd3385346.d",".worktrees/297-enforcement-shape/target/debug/deps/xtask-1ffacec11598b22a.d",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-23b9094790b3eaaa/test-integration-test-two_origin_spanning",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-23b9094790b3eaaa/test-integration-test-two_origin_spanning.json",".worktrees/297-enforcement-shape/target/debug/deps/two_origin_spanning-23b9094790b3eaaa.d",".worktrees/297-enforcement-shape/target/debug/.fingerprint/spt-daemon-23b9094790b3eaaa/dep-test-integration-test-two_origin_spanning",".worktrees/297-enforcement-shape/target/debug/deps/libtwo_origin_spanning-23b9094790b3eaaa.rmeta",".worktrees/297-enforcement-shape/crates/spt-daemon/tests/two_origin_spanning.rs",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-62c7e52423994289/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-e82e92e8d41e507b/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-148094371e1466c6/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-8d808743af0f8817/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-f64fb31c8e975f68/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-beba7cb4dae8c4a1/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-9354010cd3385346/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-ecf4528ecaf01a68/",".worktrees/297-enforcement-shape/target/debug/.fingerprint/xtask-1ffacec11598b22a/",".worktrees/297-enforcement-shape/docs/spikes/pump-on-one-box-rig.patch",".worktrees/297-enforcement-shape/crates/xtask/",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w6-ENA6WIMS/",".worktrees/release-S2-527cd8e8/target/release/xtask.d",".worktrees/release-S2-527cd8e8/target/release/.fingerprint/xtask-62c7e52423994289/",".worktrees/release-S2-527cd8e8/target/release/deps/xtask.pdb",".worktrees/release-S2-527cd8e8/target/release/xtask.pdb",".worktrees/release-S2-527cd8e8/target/release/deps/xtask.exe",".worktrees/release-S2-527cd8e8/target/release/xtask.exe",".worktrees/release-S2-527cd8e8/target/release/deps/xtask.lib",".worktrees/release-S2-527cd8e8/target/release/deps/xtask.exp"],"truncated":true,"resultLimitReached":100,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","missingPaths":["scripts/**","tools/**"],"meta":{"limits":{"resultLimit":{"reached":100,"suggestion":200}}}},"isError":false,"timestamp":1789522811721}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_M3B63h1TRMAMMoEvhWBGr4GF|fc_0bac546ce171b754016aa9f3832e0087d1a43a213ba6d4ce09","toolName":"read","startedAt":"2026-09-16T01:40:19.261Z","args":{"path":"crates/xtask/src/main.rs:2160-2265,2330-2550"},"intent":"Reading signer implementation"},"id":"8436fe94","parentId":"fe27c96d","timestamp":"2026-09-16T01:40:19.261Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_M5cqhowqin9tT1nT1xV3ctZ0|fc_0bac546ce171b754016aa9f3832e1087d195f4fbcd3525a850","toolName":"read","startedAt":"2026-09-16T01:40:19.261Z","args":{"path":"crates/spt-daemon/src/applyhost.rs:120-345"},"intent":"Reading apply admission gate"},"id":"9b69c54f","parentId":"8436fe94","timestamp":"2026-09-16T01:40:19.261Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_31cO3o2q75S6bJRQK1aPueVs|fc_0bac546ce171b754016aa9f3832e1887d1a61af3097f1a2609","toolName":"grep","startedAt":"2026-09-16T01:40:19.261Z","args":{"path":"docs/304-W2-FIELD-PLAN.md;docs/304-W2-ADMISSION-RECEIPT.md;crates/spt-daemon/src/update.rs;crates/xtask/src/main.rs"},"intent":"Finding compatibility and retained helper references"},"id":"276a2b0f","parentId":"9b69c54f","timestamp":"2026-09-16T01:40:19.261Z"}
{"type":"message","id":"2b093ef7","parentId":"276a2b0f","timestamp":"2026-09-16T01:40:19.261Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_M3B63h1TRMAMMoEvhWBGr4GF|fc_0bac546ce171b754016aa9f3832e0087d1a43a213ba6d4ce09","name":"read","arguments":{"i":"Reading signer implementation","path":"crates/xtask/src/main.rs:2160-2265,2330-2550"},"intent":"Reading signer implementation"},{"type":"toolCall","id":"call_M5cqhowqin9tT1nT1xV3ctZ0|fc_0bac546ce171b754016aa9f3832e1087d195f4fbcd3525a850","name":"read","arguments":{"i":"Reading apply admission gate","path":"crates/spt-daemon/src/applyhost.rs:120-345"},"intent":"Reading apply admission gate"},{"type":"toolCall","id":"call_31cO3o2q75S6bJRQK1aPueVs|fc_0bac546ce171b754016aa9f3832e1887d1a61af3097f1a2609","name":"grep","arguments":{"i":"Finding compatibility and retained helper references","pattern":"fingerprint|broker_hash|broker_fingerprint|debug-rollout|sign|\\.py|\\.ps1","path":"docs/304-W2-FIELD-PLAN.md;docs/304-W2-ADMISSION-RECEIPT.md;crates/spt-daemon/src/update.rs;crates/xtask/src/main.rs","case":false,"gitignore":true,"skip":0},"intent":"Finding compatibility and retained helper references"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":6532,"output":196,"cacheRead":15872,"cacheWrite":0,"totalTokens":22600,"cost":{"input":0.06532,"output":0.0098,"cacheRead":0.015872,"cacheWrite":0,"total":0.090992}},"stopReason":"toolUse","timestamp":1789522811748,"responseId":"resp_0bac546ce171b754016aa9f37c2a9087d19929a83459af0f55","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f3832e0087d1a43a213ba6d4ce09","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading signer implementation\",\"path\":\"crates/xtask/src/main.rs:2160-2265,2330-2550\"}","call_id":"call_M3B63h1TRMAMMoEvhWBGr4GF","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3832e1087d195f4fbcd3525a850","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading apply admission gate\",\"path\":\"crates/spt-daemon/src/applyhost.rs:120-345\"}","call_id":"call_M5cqhowqin9tT1nT1xV3ctZ0","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3832e1887d1a61af3097f1a2609","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding compatibility and retained helper references\",\"pattern\":\"fingerprint|broker_hash|broker_fingerprint|debug-rollout|sign|\\\\.py|\\\\.ps1\",\"path\":\"docs/304-W2-FIELD-PLAN.md;docs/304-W2-ADMISSION-RECEIPT.md;crates/spt-daemon/src/update.rs;crates/xtask/src/main.rs\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_31cO3o2q75S6bJRQK1aPueVs","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":7511.288700000034,"ttft":7473.092500000028,"completedAt":1789522819260,"contextSnapshot":{"promptTokens":22404,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"ec4ddce9","parentId":"2b093ef7","timestamp":"2026-09-16T01:40:19.268Z","message":{"role":"toolResult","toolCallId":"call_M5cqhowqin9tT1nT1xV3ctZ0|fc_0bac546ce171b754016aa9f3832e1087d195f4fbcd3525a850","toolName":"read","content":[{"type":"text","text":"\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\n/// run this identical gate so their fail-closed posture never diverges.\n// [impl->REQ-UPD-4]\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result<Prepared, String> {\n    let Some(staged) = cache.staged_update() else {\n        return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\n    };\n    let version = cache.staged_version().unwrap_or(0);\n    let product_version = staged.product_version().unwrap_or_default();\n\n    // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\n    // failed readiness on this node and auto-rolled-back is quarantined — never\n    // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\n    // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\n    // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\n    // operator override (`--force`) to re-apply a genuinely-good version whose\n    // failure was environmental is the deferred escape hatch (note-i).\n    // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n    let applied_state = cache.applied_state();\n    if let Some(AppliedRecord::RolledBack {\n        quarantine_version, ..\n    }) = &applied_state\n    {\n        if *quarantine_version == version {\n            return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\n        }\n    }\n\n    // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\n    // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\n    // applied image must NOT reach the binary-aside rename below — re-renaming an\n    // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\n    // to a friendly exit-0 no-op instead. Checked before verify/connect: an\n    // already-applied node is up to date regardless of the staged bytes' state.\n    // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n    if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\n        return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\n            version,\n            product_version,\n        }));\n    }\n\n    // At-rest re-verification. Version floor 0: monotonicity already gated\n    // the stage; this check is authenticity/integrity/expiry of the bytes on\n    // disk. Fail-closed on an unprovisioned key file (same posture as the\n    // pump's pull leg).\n    let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\n    if policy.trusted_keys.is_empty() {\n        return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n            \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\n        )));\n    }\n    let (plan, artifact) = match staged {\n        StagedUpdate::Single(signed) => {\n            // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\n            // cross-OS brick. A legacy single carries NO platform identity in\n            // its signed metadata, so apply trusts only the cache's platform\n            // stamp: apply proceeds solely when the stage asserted THIS node's\n            // platform. An unstamped single (every P2P-pulled single, and any\n            // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\n            // — exactly the path that swapped a Linux ELF in as `spt.exe`.\n            let here = current_platform();\n            match cache.staged_platform() {\n                Some(p) if p == here => {}\n                Some(p) => {\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n                        \"staged single targets platform {p}, not this node's {here} — \\\n                         re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\n                    ))))\n                }\n                None => {\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\n                        \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\n                         refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\n                         (stages a platform-safe update set)\"\n                            .to_string(),\n                    )))\n                }\n            }\n            let artifact = cache\n                .load_artifact()\n                .map_err(|e| format!(\"staged artifact: {e}\"))?;\n            let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\n                Ok(p) => p,\n                Err(reason) => {\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n                        \"{reason:?}\"\n                    ))))\n                }\n            };\n            (plan, artifact)\n        }\n        StagedUpdate::Set(signed) => {\n            let platform = current_platform();\n            let artifact = cache\n                .load_artifact_for_platform(platform)\n                .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\n            let plan = match plan_verified_update_set(\n                &BrokerAbi::current(),\n                &signed,\n                platform,\n                &artifact,\n                &policy,\n            ) {\n                Ok(p) => p,\n                Err(reason) => {\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n                        \"{reason:?}\"\n                    ))))\n                }\n            };\n            (plan, artifact)\n        }\n    };\n    if plan.class != UpdateClass::BrainOnly {\n        return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\n    }\n\n    Ok(Prepared::Proceed {\n        version,\n        product_version,\n        artifact,\n    })\n}\n\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\n/// whether a running brain is cycled afterwards.\n// [impl->REQ-UPD-6]\nfn swap_and_record(\n    cache: &ReleaseCache,\n    exe_path: &Path,\n    version: u64,\n    artifact: &[u8],\n) -> Result<(), String> {\n    // Swap the binary: step aside, land the artifact, roll back on failure.\n    let aside = swap_aside_path(exe_path, version);\n    let _ = std::fs::remove_file(&aside); // stale prior apply of this version\n    std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\n    if let Err(e) = land_artifact(exe_path, artifact) {\n        let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\n        return Err(format!(\"land new binary (rolled back): {e}\"));\n    }\n    // The binary IS swapped from here on — but DO NOT claim `applied` yet\n    // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\n    // reached `ready`. Writing `applied` here is the optimism the design indicts\n    // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\n    // ran the old code). Instead record the FIRST phase — `AppliedPending` —\n    // carrying the last-known-good `rollback_binary` (the aside we just created)\n    // so the broker's supervisor, a different process from this CLI, can promote\n    // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\n    // Best-effort: an unrecorded phase degrades the readiness gate, never the\n    // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\n    // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\n    // [impl->REQ-UPD-6]\n    let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\n        version,\n        rollback_binary: aside.to_string_lossy().into_owned(),\n        candidate_started_ms: now_ms(),\n        // The version actually running before this swap — what a rollback returns\n        // to. The supervisor must NOT derive it as N-1 (a skip-version update,\n        // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\n        // the quarantined version, not the running one. `None` when nothing was\n        // ever recorded applied (a first-ever apply) → the supervisor falls back\n        // to N-1, the only honest guess then.\n        prior_version: cache.applied_version(),\n    });\n    let _ = cache.record_last_outcome(\"apply-pending\");\n    Ok(())\n}\n\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\n// [impl->REQ-UPD-3]\n// [impl->REQ-UPD-4]\npub fn apply_staged(\n    cache: &ReleaseCache,\n    release_keys: &Path,\n    exe_path: &Path,\n    broker_name: &str,\n) -> Result<ApplyStagedOutcome, String> {\n    let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\n        Prepared::Done(outcome) => return Ok(outcome),\n        Prepared::Proceed {\n            version,\n            product_version,\n            artifact,\n        } => (version, product_version, artifact),\n    };\n\n    // Connect to the broker BEFORE the binary moves — a dead broker fails the\n    // apply with the seat untouched. The connection is the channel the planned\n    // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\n    // attach to any session (the broker holds every hosted endpoint across the\n    // brain cycle — that is the whole point).\n    let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\n\n    swap_and_record(cache, exe_path, version, &artifact)?;\n\n    // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\n    // The broker signals its supervisor to cycle the brain child onto the\n    // just-swapped binary with `start-reason=update`; new code runs immediately,\n    // no manual bounce, every broker-held endpoint untouched at the process\n    // level. This replaces the old in-process `apply_brain_only` handoff (the\n    // regression: it re-attached a CLI-side subscriber while the live brain kept\n    // running the OLD code). `classify` already gated this as brain-only, so the\n    // broker never moves; only the brain restarts.\n    //\n    // A broker without a supervisor wired (`honored: false`) still swapped the\n    // binary — the next daemon start uses the new executable. Readiness-gated\n    // promotion + auto-rollback on a brain that fails to come up is D6.\n    match brain.request_brain_restart() {\n        Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\n            version,\n            product_version,\n        }),\n        Err(e) => Err(format!(\n            \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\n             and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\n             predates the restart verb needs a one-time manual daemon restart to run the new code)\"\n        )),\n    }\n}\n\n[Showing lines 119-348 of 1204. Use :349 to continue]"}],"details":{"truncation":{"content":"\r\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\r\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\r\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\r\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\r\n/// run this identical gate so their fail-closed posture never diverges.\r\n// [impl->REQ-UPD-4]\r\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result<Prepared, String> {\r\n    let Some(staged) = cache.staged_update() else {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\r\n    };\r\n    let version = cache.staged_version().unwrap_or(0);\r\n    let product_version = staged.product_version().unwrap_or_default();\r\n\r\n    // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\r\n    // failed readiness on this node and auto-rolled-back is quarantined — never\r\n    // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\r\n    // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\r\n    // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\r\n    // operator override (`--force`) to re-apply a genuinely-good version whose\r\n    // failure was environmental is the deferred escape hatch (note-i).\r\n    // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n    let applied_state = cache.applied_state();\r\n    if let Some(AppliedRecord::RolledBack {\r\n        quarantine_version, ..\r\n    }) = &applied_state\r\n    {\r\n        if *quarantine_version == version {\r\n            return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\r\n        }\r\n    }\r\n\r\n    // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\r\n    // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\r\n    // applied image must NOT reach the binary-aside rename below — re-renaming an\r\n    // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\r\n    // to a friendly exit-0 no-op instead. Checked before verify/connect: an\r\n    // already-applied node is up to date regardless of the staged bytes' state.\r\n    // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\n    if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\r\n            version,\r\n            product_version,\r\n        }));\r\n    }\r\n\r\n    // At-rest re-verification. Version floor 0: monotonicity already gated\r\n    // the stage; this check is authenticity/integrity/expiry of the bytes on\r\n    // disk. Fail-closed on an unprovisioned key file (same posture as the\r\n    // pump's pull leg).\r\n    let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\r\n    if policy.trusted_keys.is_empty() {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n            \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\r\n        )));\r\n    }\r\n    let (plan, artifact) = match staged {\r\n        StagedUpdate::Single(signed) => {\r\n            // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\r\n            // cross-OS brick. A legacy single carries NO platform identity in\r\n            // its signed metadata, so apply trusts only the cache's platform\r\n            // stamp: apply proceeds solely when the stage asserted THIS node's\r\n            // platform. An unstamped single (every P2P-pulled single, and any\r\n            // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\r\n            // — exactly the path that swapped a Linux ELF in as `spt.exe`.\r\n            let here = current_platform();\r\n            match cache.staged_platform() {\r\n                Some(p) if p == here => {}\r\n                Some(p) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"staged single targets platform {p}, not this node's {here} — \\\r\n                         re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\r\n                    ))))\r\n                }\r\n                None => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n                        \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\r\n                         refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\r\n                         (stages a platform-safe update set)\"\r\n                            .to_string(),\r\n                    )))\r\n                }\r\n            }\r\n            let artifact = cache\r\n                .load_artifact()\r\n                .map_err(|e| format!(\"staged artifact: {e}\"))?;\r\n            let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\r\n                Ok(p) => p,\r\n                Err(reason) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"{reason:?}\"\r\n                    ))))\r\n                }\r\n            };\r\n            (plan, artifact)\r\n        }\r\n        StagedUpdate::Set(signed) => {\r\n            let platform = current_platform();\r\n            let artifact = cache\r\n                .load_artifact_for_platform(platform)\r\n                .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\r\n            let plan = match plan_verified_update_set(\r\n                &BrokerAbi::current(),\r\n                &signed,\r\n                platform,\r\n                &artifact,\r\n                &policy,\r\n            ) {\r\n                Ok(p) => p,\r\n                Err(reason) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"{reason:?}\"\r\n                    ))))\r\n                }\r\n            };\r\n            (plan, artifact)\r\n        }\r\n    };\r\n    if plan.class != UpdateClass::BrainOnly {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\r\n    }\r\n\r\n    Ok(Prepared::Proceed {\r\n        version,\r\n        product_version,\r\n        artifact,\r\n    })\r\n}\r\n\r\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\r\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\r\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\r\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\r\n/// whether a running brain is cycled afterwards.\r\n// [impl->REQ-UPD-6]\r\nfn swap_and_record(\r\n    cache: &ReleaseCache,\r\n    exe_path: &Path,\r\n    version: u64,\r\n    artifact: &[u8],\r\n) -> Result<(), String> {\r\n    // Swap the binary: step aside, land the artifact, roll back on failure.\r\n    let aside = swap_aside_path(exe_path, version);\r\n    let _ = std::fs::remove_file(&aside); // stale prior apply of this version\r\n    std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\r\n    if let Err(e) = land_artifact(exe_path, artifact) {\r\n        let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\r\n        return Err(format!(\"land new binary (rolled back): {e}\"));\r\n    }\r\n    // The binary IS swapped from here on — but DO NOT claim `applied` yet\r\n    // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\r\n    // reached `ready`. Writing `applied` here is the optimism the design indicts\r\n    // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\r\n    // ran the old code). Instead record the FIRST phase — `AppliedPending` —\r\n    // carrying the last-known-good `rollback_binary` (the aside we just created)\r\n    // so the broker's supervisor, a different process from this CLI, can promote\r\n    // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\r\n    // Best-effort: an unrecorded phase degrades the readiness gate, never the\r\n    // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\r\n    // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\r\n    // [impl->REQ-UPD-6]\r\n    let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\r\n        version,\r\n        rollback_binary: aside.to_string_lossy().into_owned(),\r\n        candidate_started_ms: now_ms(),\r\n        // The version actually running before this swap — what a rollback returns\r\n        // to. The supervisor must NOT derive it as N-1 (a skip-version update,\r\n        // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\r\n        // the quarantined version, not the running one. `None` when nothing was\r\n        // ever recorded applied (a first-ever apply) → the supervisor falls back\r\n        // to N-1, the only honest guess then.\r\n        prior_version: cache.applied_version(),\r\n    });\r\n    let _ = cache.record_last_outcome(\"apply-pending\");\r\n    Ok(())\r\n}\r\n\r\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\r\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\r\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\r\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\r\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\r\n// [impl->REQ-UPD-3]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged(\r\n    cache: &ReleaseCache,\r\n    release_keys: &Path,\r\n    exe_path: &Path,\r\n    broker_name: &str,\r\n) -> Result<ApplyStagedOutcome, String> {\r\n    let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n        Prepared::Done(outcome) => return Ok(outcome),\r\n        Prepared::Proceed {\r\n            version,\r\n            product_version,\r\n            artifact,\r\n        } => (version, product_version, artifact),\r\n    };\r\n\r\n    // Connect to the broker BEFORE the binary moves — a dead broker fails the\r\n    // apply with the seat untouched. The connection is the channel the planned\r\n    // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\r\n    // attach to any session (the broker holds every hosted endpoint across the\r\n    // brain cycle — that is the whole point).\r\n    let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n\r\n    swap_and_record(cache, exe_path, version, &artifact)?;\r\n\r\n    // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\r\n    // The broker signals its supervisor to cycle the brain child onto the\r\n    // just-swapped binary with `start-reason=update`; new code runs immediately,\r\n    // no manual bounce, every broker-held endpoint untouched at the process\r\n    // level. This replaces the old in-process `apply_brain_only` handoff (the\r\n    // regression: it re-attached a CLI-side subscriber while the live brain kept\r\n    // running the OLD code). `classify` already gated this as brain-only, so the\r\n    // broker never moves; only the brain restarts.\r\n    //\r\n    // A broker without a supervisor wired (`honored: false`) still swapped the\r\n    // binary — the next daemon start uses the new executable. Readiness-gated\r\n    // promotion + auto-rollback on a brain that fails to come up is D6.\r\n    match brain.request_brain_restart() {\r\n        Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\r\n            version,\r\n            product_version,\r\n        }),\r\n        Err(e) => Err(format!(\r\n            \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\r\n             and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\r\n             predates the restart verb needs a one-time manual daemon restart to run the new code)\"\r\n        )),\r","truncated":true,"truncatedBy":"lines","totalLines":1086,"totalBytes":11821,"outputLines":230,"outputBytes":11821,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1204,"displayContent":{"text":"\r\n/// The verify + classify preamble (module docs steps 1-2): quarantine guard,\r\n/// already-applied short-circuit, at-rest re-verification, platform guard, and\r\n/// the brain-only class gate. Pure w.r.t. the daemon — reads only the cache +\r\n/// keys, swaps nothing. Both the broker-handoff apply and the daemonless apply\r\n/// run this identical gate so their fail-closed posture never diverges.\r\n// [impl->REQ-UPD-4]\r\nfn prepare_apply(cache: &ReleaseCache, release_keys: &Path) -> Result<Prepared, String> {\r\n    let Some(staged) = cache.staged_update() else {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::NoUpdate));\r\n    };\r\n    let version = cache.staged_version().unwrap_or(0);\r\n    let product_version = staged.product_version().unwrap_or_default();\r\n\r\n    // Quarantine guard (ADR-0018 Q7, restoration D6-2): a version that already\r\n    // failed readiness on this node and auto-rolled-back is quarantined — never\r\n    // re-applied, or the self-heal becomes a self-harm loop (apply → fail → roll\r\n    // back → re-apply → …). The `RolledBack` record is the quarantine marker; it\r\n    // clears naturally when a newer version stages (N+1 ≠ the quarantined N). An\r\n    // operator override (`--force`) to re-apply a genuinely-good version whose\r\n    // failure was environmental is the deferred escape hatch (note-i).\r\n    // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\n    let applied_state = cache.applied_state();\r\n    if let Some(AppliedRecord::RolledBack {\r\n        quarantine_version, ..\r\n    }) = &applied_state\r\n    {\r\n        if *quarantine_version == version {\r\n            return Ok(Prepared::Done(ApplyStagedOutcome::Quarantined { version }));\r\n        }\r\n    }\r\n\r\n    // Already-applied classifier (F-025, mirrors fetch's v0.18.0 classifier,\r\n    // REQ-UPDATE-FETCH-CURRENT-UX): a staged version that is already the running/\r\n    // applied image must NOT reach the binary-aside rename below — re-renaming an\r\n    // already-swapped exe is today's 'Access is denied (os error 5)'. Short-circuit\r\n    // to a friendly exit-0 no-op instead. Checked before verify/connect: an\r\n    // already-applied node is up to date regardless of the staged bytes' state.\r\n    // [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\r\n    if staged_already_applied(applied_state.as_ref(), cache.applied_version(), version) {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::AlreadyApplied {\r\n            version,\r\n            product_version,\r\n        }));\r\n    }\r\n\r\n    // At-rest re-verification. Version floor 0: monotonicity already gated\r\n    // the stage; this check is authenticity/integrity/expiry of the bytes on\r\n    // disk. Fail-closed on an unprovisioned key file (same posture as the\r\n    // pump's pull leg).\r\n    let policy = VerifyPolicy::load_from(release_keys, 0, now_ms());\r\n    if policy.trusted_keys.is_empty() {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n            \"release-keys.json unprovisioned (no trusted keys)\".to_string(),\r\n        )));\r\n    }\r\n    let (plan, artifact) = match staged {\r\n        StagedUpdate::Single(signed) => {\r\n            // Platform guard (REQ-UPD-8) — defense-in-depth against the v0.3.1\r\n            // cross-OS brick. A legacy single carries NO platform identity in\r\n            // its signed metadata, so apply trusts only the cache's platform\r\n            // stamp: apply proceeds solely when the stage asserted THIS node's\r\n            // platform. An unstamped single (every P2P-pulled single, and any\r\n            // pre-v0.3.2 stage) or one stamped for another OS fail-safe refuses\r\n            // — exactly the path that swapped a Linux ELF in as `spt.exe`.\r\n            let here = current_platform();\r\n            match cache.staged_platform() {\r\n                Some(p) if p == here => {}\r\n                Some(p) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"staged single targets platform {p}, not this node's {here} — \\\r\n                         re-fetch with `spt update fetch` on v0.3.2+ (platform-safe update set)\"\r\n                    ))))\r\n                }\r\n                None => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(\r\n                        \"staged single release has no platform stamp (pre-v0.3.2 / peer-propagated) — \\\r\n                         refusing a platform-blind single; re-fetch with `spt update fetch` on v0.3.2+ \\\r\n                         (stages a platform-safe update set)\"\r\n                            .to_string(),\r\n                    )))\r\n                }\r\n            }\r\n            let artifact = cache\r\n                .load_artifact()\r\n                .map_err(|e| format!(\"staged artifact: {e}\"))?;\r\n            let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\r\n                Ok(p) => p,\r\n                Err(reason) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"{reason:?}\"\r\n                    ))))\r\n                }\r\n            };\r\n            (plan, artifact)\r\n        }\r\n        StagedUpdate::Set(signed) => {\r\n            let platform = current_platform();\r\n            let artifact = cache\r\n                .load_artifact_for_platform(platform)\r\n                .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\r\n            let plan = match plan_verified_update_set(\r\n                &BrokerAbi::current(),\r\n                &signed,\r\n                platform,\r\n                &artifact,\r\n                &policy,\r\n            ) {\r\n                Ok(p) => p,\r\n                Err(reason) => {\r\n                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\r\n                        \"{reason:?}\"\r\n                    ))))\r\n                }\r\n            };\r\n            (plan, artifact)\r\n        }\r\n    };\r\n    if plan.class != UpdateClass::BrainOnly {\r\n        return Ok(Prepared::Done(ApplyStagedOutcome::RefusedClass(plan.class)));\r\n    }\r\n\r\n    Ok(Prepared::Proceed {\r\n        version,\r\n        product_version,\r\n        artifact,\r\n    })\r\n}\r\n\r\n/// Swap the binary at `exe_path` (step aside → land → roll back on failure) and\r\n/// record the open `AppliedPending` trial. Shared by the broker-handoff apply\r\n/// and the daemonless apply — both land the SAME bytes and record the SAME trial\r\n/// (the supervisor promotes it on the next brain's `ready`); they differ only in\r\n/// whether a running brain is cycled afterwards.\r\n// [impl->REQ-UPD-6]\r\nfn swap_and_record(\r\n    cache: &ReleaseCache,\r\n    exe_path: &Path,\r\n    version: u64,\r\n    artifact: &[u8],\r\n) -> Result<(), String> {\r\n    // Swap the binary: step aside, land the artifact, roll back on failure.\r\n    let aside = swap_aside_path(exe_path, version);\r\n    let _ = std::fs::remove_file(&aside); // stale prior apply of this version\r\n    std::fs::rename(exe_path, &aside).map_err(|e| format!(\"step current binary aside: {e}\"))?;\r\n    if let Err(e) = land_artifact(exe_path, artifact) {\r\n        let _ = std::fs::rename(&aside, exe_path); // roll back — never half-swapped\r\n        return Err(format!(\"land new binary (rolled back): {e}\"));\r\n    }\r\n    // The binary IS swapped from here on — but DO NOT claim `applied` yet\r\n    // (ADR-0018 Q7, restoration D6-1): the new brain has not booted, let alone\r\n    // reached `ready`. Writing `applied` here is the optimism the design indicts\r\n    // (the `applied.json={version:6}` observed on `enlyzeam` while the box still\r\n    // ran the old code). Instead record the FIRST phase — `AppliedPending` —\r\n    // carrying the last-known-good `rollback_binary` (the aside we just created)\r\n    // so the broker's supervisor, a different process from this CLI, can promote\r\n    // to `applied` on the brain's `ready` signal or roll back on failure (D6-2).\r\n    // Best-effort: an unrecorded phase degrades the readiness gate, never the\r\n    // swap. The legacy `applied.json`/`last-outcome=applied` writes move to the\r\n    // supervisor's ready-promotion (D6-2) — here we only mark the trial open.\r\n    // [impl->REQ-UPD-6]\r\n    let _ = cache.record_applied_state(&AppliedRecord::AppliedPending {\r\n        version,\r\n        rollback_binary: aside.to_string_lossy().into_owned(),\r\n        candidate_started_ms: now_ms(),\r\n        // The version actually running before this swap — what a rollback returns\r\n        // to. The supervisor must NOT derive it as N-1 (a skip-version update,\r\n        // applied v5 → candidate v8, would mis-claim v7); the aside name encodes\r\n        // the quarantined version, not the running one. `None` when nothing was\r\n        // ever recorded applied (a first-ever apply) → the supervisor falls back\r\n        // to N-1, the only honest guess then.\r\n        prior_version: cache.applied_version(),\r\n    });\r\n    let _ = cache.record_last_outcome(\"apply-pending\");\r\n    Ok(())\r\n}\r\n\r\n/// Apply the staged release against a RUNNING daemon (module docs). `exe_path` is\r\n/// the executable to swap (production: `std::env::current_exe()`); `broker_name`\r\n/// the canonical broker socket the brain handoff runs against. For a stopped box,\r\n/// the caller uses [`apply_staged_daemonless`] instead — this path REQUIRES a live\r\n/// broker to hand off to (a dead broker fails the apply with the seat untouched).\r\n// [impl->REQ-UPD-3]\r\n// [impl->REQ-UPD-4]\r\npub fn apply_staged(\r\n    cache: &ReleaseCache,\r\n    release_keys: &Path,\r\n    exe_path: &Path,\r\n    broker_name: &str,\r\n) -> Result<ApplyStagedOutcome, String> {\r\n    let (version, product_version, artifact) = match prepare_apply(cache, release_keys)? {\r\n        Prepared::Done(outcome) => return Ok(outcome),\r\n        Prepared::Proceed {\r\n            version,\r\n            product_version,\r\n            artifact,\r\n        } => (version, product_version, artifact),\r\n    };\r\n\r\n    // Connect to the broker BEFORE the binary moves — a dead broker fails the\r\n    // apply with the seat untouched. The connection is the channel the planned\r\n    // brain-restart trigger rides after the swap (ADR-0018 D3-3); it does not\r\n    // attach to any session (the broker holds every hosted endpoint across the\r\n    // brain cycle — that is the whole point).\r\n    let mut brain = connect_retry(broker_name).map_err(|e| format!(\"broker connect: {e}\"))?;\r\n\r\n    swap_and_record(cache, exe_path, version, &artifact)?;\r\n\r\n    // REQ-UPD-3's moment (ADR-0018 D3-3): trigger a real brain-PROCESS restart.\r\n    // The broker signals its supervisor to cycle the brain child onto the\r\n    // just-swapped binary with `start-reason=update`; new code runs immediately,\r\n    // no manual bounce, every broker-held endpoint untouched at the process\r\n    // level. This replaces the old in-process `apply_brain_only` handoff (the\r\n    // regression: it re-attached a CLI-side subscriber while the live brain kept\r\n    // running the OLD code). `classify` already gated this as brain-only, so the\r\n    // broker never moves; only the brain restarts.\r\n    //\r\n    // A broker without a supervisor wired (`honored: false`) still swapped the\r\n    // binary — the next daemon start uses the new executable. Readiness-gated\r\n    // promotion + auto-rollback on a brain that fails to come up is D6.\r\n    match brain.request_brain_restart() {\r\n        Ok(_honored) => Ok(ApplyStagedOutcome::AppliedPending {\r\n            version,\r\n            product_version,\r\n        }),\r\n        Err(e) => Err(format!(\r\n            \"binary swapped to v{version}, but the brain-restart trigger failed: {e} — the broker \\\r\n             and every hosted endpoint are intact; retry `spt update apply` (an older broker that \\\r\n             predates the restart verb needs a one-time manual daemon restart to run the new code)\"\r\n        )),\r\n    }\n}","startLine":119,"lineNumbers":[119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350]},"fileSize":55910,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\applyhost.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1204,"totalBytes":11821,"outputLines":230,"outputBytes":11821,"shownRange":{"start":119,"end":348},"nextOffset":349}}},"isError":false,"timestamp":1789522819268}}
{"type":"message","id":"621fd5c1","parentId":"ec4ddce9","timestamp":"2026-09-16T01:40:19.289Z","message":{"role":"toolResult","toolCallId":"call_M3B63h1TRMAMMoEvhWBGr4GF|fc_0bac546ce171b754016aa9f3832e0087d1a43a213ba6d4ce09","toolName":"read","content":[{"type":"text","text":"fn release_verify(args: &[String]) {\n…\n    while let Some(a) = it.next() {\n        match a.as_str() {\n…\n        }\n    }\n    let signed_path = signed_path.expect(\"usage: release-verify <signed.json> [artifact]\");\n    let raw = std::fs::read_to_string(&signed_path).expect(\"read signed metadata\");\n    let signed: spt_daemon::release::SignedRelease =\n        serde_json::from_str(&raw).expect(\"parse SignedRelease JSON\");\n\n    // The embedded anchor, exactly as a fresh node assembles it (no keys\n    // file): builtin set + default channel.\n    let now_ms = std::time::SystemTime::now()\n        .duration_since(std::time::UNIX_EPOCH)\n        .unwrap()\n        .as_millis() as u64;\n    let missing = std::env::temp_dir().join(\"spt-release-verify-no-such-keys.json\");\n    let policy = spt_daemon::release::VerifyPolicy::load_from(&missing, current_version, now_ms);\n\n    match spt_daemon::release::verify_metadata(&signed, &policy) {\n        Ok(meta) => {\n            println!(\n                \"metadata VERIFIED: version={} channel={} key_id={} sha256={}\",\n                meta.version, meta.channel, meta.key_id, meta.artifact_sha256\n            );\n            if let Some(artifact) = artifact {\n                let bytes = std::fs::read(&artifact).expect(\"read artifact\");\n                match spt_daemon::release::verify_artifact(&meta, &bytes) {\n                    Ok(()) => println!(\"artifact VERIFIED: {}\", artifact.display()),\n                    Err(e) => {\n                        eprintln!(\"artifact REJECTED: {e}\");\n                        std::process::exit(1);\n                    }\n                }\n            }\n        }\n        Err(e) => {\n            eprintln!(\"metadata REJECTED: {e}\");\n            std::process::exit(1);\n        }\n    }\n}\n\n// ---------------------------------------------------------- debug rollout\n\n// [impl->REQ-UPD-6]\nfn debug_keygen(args: &[String]) {\n    let key_id = args.first().expect(\"usage: xtask debug-keygen <key-id>\");\n    let id = spt_proto::identity::Identity::generate();\n    let seed_hex: String = id.seed().iter().map(|b| format!(\"{b:02x}\")).collect();\n    println!(\"key_id:     {key_id}\");\n    println!(\"public_hex: {}\", id.public_key().to_hex());\n    println!(\"seed_hex:   {seed_hex}\");\n    println!();\n    println!(\"1. Set SPT_DEBUG_RELEASE_SEED to seed_hex on the fast coordinator.\");\n    println!(\"2. Pin lab nodes with:\");\n    println!(\n        \"   cargo run -p xtask -- debug-pin --key-id {key_id} --public-key {}\",\n        id.public_key().to_hex()\n    );\n}\n\n// [impl->REQ-UPD-6]\nfn debug_pin(args: &[String]) {\n    let mut key_id = None;\n    let mut public_key = None;\n    let mut home = None;\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--key-id\" => key_id = it.next().cloned(),\n            \"--public-key\" => public_key = it.next().cloned(),\n            \"--home\" => home = it.next().map(PathBuf::from),\n            other => panic!(\"unknown arg {other}\"),\n        }\n    }\n    let key_id = key_id.expect(\"--key-id <id>\");\n    let public_key = public_key.expect(\"--public-key <ed25519-public-key-hex>\");\n    spt_daemon::parse_verifying_key(&public_key).expect(\"debug public key must be valid\");\n\n    let identity = home\n        .unwrap_or_else(spt_store::perch::spt_home)\n        .join(\"identity\");\n    std::fs::create_dir_all(&identity).expect(\"create identity dir\");\n    let path = identity.join(\"release-keys.json\");\n    let mut json: serde_json::Value = std::fs::read_to_string(&path)\n        .ok()\n        .and_then(|raw| serde_json::from_str(&raw).ok())\n        .unwrap_or_else(|| serde_json::json!({}));\n    if !json.is_object() {\n        json = serde_json::json!({});\n    }\n    if json.get(\"keys\").and_then(|v| v.as_object()).is_none() {\n        json[\"keys\"] = serde_json::json!({});\n    }\n    json[\"keys\"][key_id.as_str()] = serde_json::Value::String(public_key);\n    json[\"channel\"] = serde_json::Value::String(\"debug\".to_string());\n    if json.get(\"revoked\").is_none() {\n        json[\"revoked\"] = serde_json::json!([]);\n    }\n    std::fs::write(&path, serde_json::to_string_pretty(&json).unwrap())\n        .expect(\"write release keys\");\n    println!(\"debug-pinned node release policy: {}\", path.display());\n}\n\n/// `xtask debug-mark-applied` (field rig tooling): record `Applied{version}`\n/// for an already-staged set, the one thing no other maintainer verb writes.\n/// The real apply path owns this record (applyhost/brainproc); a field rig that\n/// stages a set by hand has no apply to run, and the LAN bootstrap set gate\n…\nfn debug_rollout_meta(\n…\n) -> spt_daemon::UpdateSetMetadata {\n…\n}\n\n#[cfg(test)]\nmod debug_rollout_meta_tests {\n    use super::debug_rollout_meta;\n\n    // [unit->REQ-UPD-6] the stamp flags ride the SIGNED metadata: --channel and\n    // --product-version land verbatim in the set a recipient verifies against\n    // its release-keys policy, alongside the counter and expiry window.\n    #[test]\n    fn stamps_channel_and_product_version_verbatim() {\n        let meta = debug_rollout_meta(\n            96,\n            \"stable\",\n            \"0.60.1\",\n            14,\n            1_000,\n            \"rig-roll3-2026\",\n            std::collections::BTreeMap::new(),\n            None,\n        );\n        assert_eq!(meta.version, 96);\n        assert_eq!(meta.channel, \"stable\");\n        assert_eq!(meta.product_version, \"0.60.1\");\n        assert_eq!(meta.key_id, \"rig-roll3-2026\");\n        assert_eq!(meta.expires_at_ms, 1_000 + 14 * 24 * 60 * 60 * 1000);\n    }\n\n    // [unit->REQ-UPD-6] the defaults reproduce the pre-flag debug shape\n    // exactly: debug channel, counter-only (empty semver), no docs.\n    #[test]\n    fn defaults_reproduce_the_counter_only_debug_shape() {\n        let meta = debug_rollout_meta(\n            1,\n            \"debug\",\n            \"\",\n            14,\n            0,\n            \"dev-debug-2026\",\n            std::collections::BTreeMap::new(),\n            None,\n        );\n        assert_eq!(meta.channel, \"debug\");\n        assert!(meta.product_version.is_empty());\n        assert!(meta.docs.is_none());\n        assert!(meta.provenance.is_none());\n    }\n}\n\n// [impl->REQ-UPD-6]\nfn debug_rollout(args: &[String]) {\n    let mut key_id = \"dev-debug-2026\".to_string();\n    let mut version = None;\n    let mut expires_days: u64 = 14;\n    let mut stage_dir = None;\n    let mut state_path = None;\n    let mut build_current = false;\n    let mut product_version = String::new();\n    let mut channel = \"debug\".to_string();\n    let mut artifact_args: Vec<String> = Vec::new();\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--key-id\" => key_id = it.next().cloned().expect(\"--key-id <id>\"),\n            \"--product-version\" => {\n                product_version = it.next().cloned().expect(\"--product-version <semver>\")\n            }\n            \"--channel\" => channel = it.next().cloned().expect(\"--channel <name>\"),\n            \"--version\" => {\n                version = Some(\n                    it.next()\n                        .and_then(|v| v.parse().ok())\n                        .expect(\"--version <u64>\"),\n                )\n            }\n            \"--expires-days\" => {\n                expires_days = it\n                    .next()\n                    .and_then(|v| v.parse().ok())\n                    .expect(\"--expires-days <n>\")\n            }\n            \"--stage-dir\" => stage_dir = it.next().map(PathBuf::from),\n            \"--state\" => state_path = it.next().map(PathBuf::from),\n            \"--build-current\" => build_current = true,\n            \"--artifact\" => {\n                artifact_args.push(it.next().cloned().expect(\"--artifact <target=path>\"))\n            }\n            other => panic!(\"unknown arg {other}\"),\n        }\n    }\n\n    let root = repo_root();\n    let state_path =\n        state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\n    let version = version.unwrap_or_else(|| next_debug_version(&state_path));\n    let identity = debug_signing_identity();\n\n    let mut artifact_paths: Vec<(String, PathBuf)> =\n        artifact_args.iter().map(|a| parse_target_path(a)).collect();\n    if build_current {\n        let path = build_release_spt(&root);\n        artifact_paths.push((spt_daemon::current_platform().to_string(), path));\n    }\n    assert!(\n        !artifact_paths.is_empty(),\n        \"provide --artifact <target=path> or --build-current\"\n    );\n\n    let now = system_time_ms();\n    let mut artifact_meta = std::collections::BTreeMap::new();\n    let mut artifact_bytes = std::collections::BTreeMap::new();\n    for (target, path) in artifact_paths {\n        let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!(\"read {}: {e}\", path.display()));\n        artifact_meta.insert(\n            target.clone(),\n            spt_daemon::UpdateArtifactMetadata {\n                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n                broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n                asset_name: path\n                    .file_name()\n                    .and_then(|n| n.to_str())\n                    .map(str::to_string),\n            },\n        );\n        artifact_bytes.insert(target, bytes);\n    }\n\n    let meta = debug_rollout_meta(\n        version,\n        &channel,\n        &product_version,\n        expires_days,\n        now,\n        &key_id,\n        artifact_meta,\n        Some(spt_daemon::UpdateSetProvenance {\n            git_commit: git_stdout(&root, &[\"rev-parse\", \"HEAD\"]),\n            git_dirty: Some(\n                git_stdout(&root, &[\"status\", \"--porcelain\"]).is_some_and(|s| !s.is_empty()),\n            ),\n            build_host: build_host(),\n            build_timestamp_ms: Some(now),\n        }),\n    );\n    let metadata_json = serde_json::to_string(&meta).expect(\"serialize update set\");\n    let sig = identity.sign(metadata_json.as_bytes());\n    let signed = spt_daemon::SignedUpdateSet {\n        metadata_json,\n        signature_hex: sig.iter().map(|b| format!(\"{b:02x}\")).collect(),\n    };\n\n    let pub_hex = identity.public_key().to_hex();\n    let vk = spt_daemon::parse_verifying_key(&pub_hex).expect(\"debug public key parses\");\n    let policy = spt_daemon::VerifyPolicy {\n        trusted_keys: std::collections::BTreeMap::from([(key_id.clone(), vk)]),\n        revoked_keys: std::collections::BTreeSet::new(),\n        pinned_channel: channel.clone(),\n        current_version: 0,\n        now_ms: now,\n    };\n    let verified = spt_daemon::verify_update_set_metadata(&signed, &policy)\n        .expect(\"freshly signed update set verifies\");\n    for (target, bytes) in &artifact_bytes {\n        spt_daemon::verify_update_set_artifact(&verified, target, bytes)\n            .unwrap_or_else(|e| panic!(\"{target}: artifact verification failed: {e}\"));\n    }\n\n    let stage_dir = stage_dir.unwrap_or_else(|| spt_store::perch::spt_home().join(\"releases\"));\n    spt_daemon::ReleaseCache::open(&stage_dir)\n        .stage_update_set(&signed, &artifact_bytes)\n        .expect(\"stage debug update set\");\n    write_debug_version(&state_path, version);\n    println!(\n        \"DEBUG_ROLLOUT_STAGED version={version} channel={channel} platforms={} stage_dir={}\",\n        verified\n            .artifacts\n            .keys()\n            .cloned()\n            .collect::<Vec<_>>()\n            .join(\",\"),\n        stage_dir.display()\n    );\n    println!(\"Peers pinned to debug will fetch via the normal update pump; run/poke the daemon pump for immediate propagation.\");\n}\n\n/// `xtask debug-converge` (M8 decision 19, REQ-UPD-6,\n/// docs/DEBUG-CONVERGE-PLAN.md): after a coordinator stages a debug rollout,\n/// answer \"did every expected lab node converge on the target debug version,\n/// and if not, why not?\" without hand-walking nodes. Watches via the\n/// status-only update query (`spt_daemon::propagate::request_update_status`)\n/// over the local daemon's broker until every expected node is `Applied`, or\n/// prints the per-node timeout table. Maintainer tooling only — never the\n/// public `spt` surface (ADR-0016).\n///\n/// Exit codes: `0` converged, `1` not converged (timeout/failure rows),\n/// `2` usage — machine-distinguishable per the plan.\n// [impl->REQ-UPD-6]\nfn debug_converge(args: &[String]) {\n    use spt_daemon::propagate::{classify_status, ConvergeState, UpdateStatusReport};\n\n    let mut version: Option<u64> = None;\n    let mut nodes: Vec<String> = Vec::new();\n    let mut subnet: Option<String> = None;\n    let mut timeout_secs: u64 = 120;\n    let mut poll_secs: u64 = 3;\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--version\" => version = it.next().and_then(|v| v.parse().ok()),\n            \"--nodes\" => {\n                nodes = it\n                    .next()\n                    .map(|s| s.split(',').map(str::to_string).collect())\n                    .unwrap_or_default()\n            }\n            \"--subnet\" => subnet = it.next().cloned(),\n            \"--timeout\" => timeout_secs = it.next().and_then(|v| v.parse().ok()).unwrap_or(120),\n            \"--poll\" => poll_secs = it.next().and_then(|v| v.parse().ok()).unwrap_or(3),\n            \"--home\" => {\n                if let Some(h) = it.next() {\n…\n                }\n            }\n…\n        }\n    }\n…\n}"}],"details":{"displayContent":{"text":"fn release_verify(args: &[String]) {\n…\n    while let Some(a) = it.next() {\n        match a.as_str() {\n…\n        }\n    }\n    let signed_path = signed_path.expect(\"usage: release-verify <signed.json> [artifact]\");\n    let raw = std::fs::read_to_string(&signed_path).expect(\"read signed metadata\");\n    let signed: spt_daemon::release::SignedRelease =\n        serde_json::from_str(&raw).expect(\"parse SignedRelease JSON\");\n\n    // The embedded anchor, exactly as a fresh node assembles it (no keys\n    // file): builtin set + default channel.\n    let now_ms = std::time::SystemTime::now()\n        .duration_since(std::time::UNIX_EPOCH)\n        .unwrap()\n        .as_millis() as u64;\n    let missing = std::env::temp_dir().join(\"spt-release-verify-no-such-keys.json\");\n    let policy = spt_daemon::release::VerifyPolicy::load_from(&missing, current_version, now_ms);\n\n    match spt_daemon::release::verify_metadata(&signed, &policy) {\n        Ok(meta) => {\n            println!(\n                \"metadata VERIFIED: version={} channel={} key_id={} sha256={}\",\n                meta.version, meta.channel, meta.key_id, meta.artifact_sha256\n            );\n            if let Some(artifact) = artifact {\n                let bytes = std::fs::read(&artifact).expect(\"read artifact\");\n                match spt_daemon::release::verify_artifact(&meta, &bytes) {\n                    Ok(()) => println!(\"artifact VERIFIED: {}\", artifact.display()),\n                    Err(e) => {\n                        eprintln!(\"artifact REJECTED: {e}\");\n                        std::process::exit(1);\n                    }\n                }\n            }\n        }\n        Err(e) => {\n            eprintln!(\"metadata REJECTED: {e}\");\n            std::process::exit(1);\n        }\n    }\n}\n\n// ---------------------------------------------------------- debug rollout\n\n// [impl->REQ-UPD-6]\nfn debug_keygen(args: &[String]) {\n    let key_id = args.first().expect(\"usage: xtask debug-keygen <key-id>\");\n    let id = spt_proto::identity::Identity::generate();\n    let seed_hex: String = id.seed().iter().map(|b| format!(\"{b:02x}\")).collect();\n    println!(\"key_id:     {key_id}\");\n    println!(\"public_hex: {}\", id.public_key().to_hex());\n    println!(\"seed_hex:   {seed_hex}\");\n    println!();\n    println!(\"1. Set SPT_DEBUG_RELEASE_SEED to seed_hex on the fast coordinator.\");\n    println!(\"2. Pin lab nodes with:\");\n    println!(\n        \"   cargo run -p xtask -- debug-pin --key-id {key_id} --public-key {}\",\n        id.public_key().to_hex()\n    );\n}\n\n// [impl->REQ-UPD-6]\nfn debug_pin(args: &[String]) {\n    let mut key_id = None;\n    let mut public_key = None;\n    let mut home = None;\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--key-id\" => key_id = it.next().cloned(),\n            \"--public-key\" => public_key = it.next().cloned(),\n            \"--home\" => home = it.next().map(PathBuf::from),\n            other => panic!(\"unknown arg {other}\"),\n        }\n    }\n    let key_id = key_id.expect(\"--key-id <id>\");\n    let public_key = public_key.expect(\"--public-key <ed25519-public-key-hex>\");\n    spt_daemon::parse_verifying_key(&public_key).expect(\"debug public key must be valid\");\n\n    let identity = home\n        .unwrap_or_else(spt_store::perch::spt_home)\n        .join(\"identity\");\n    std::fs::create_dir_all(&identity).expect(\"create identity dir\");\n    let path = identity.join(\"release-keys.json\");\n    let mut json: serde_json::Value = std::fs::read_to_string(&path)\n        .ok()\n        .and_then(|raw| serde_json::from_str(&raw).ok())\n        .unwrap_or_else(|| serde_json::json!({}));\n    if !json.is_object() {\n        json = serde_json::json!({});\n    }\n    if json.get(\"keys\").and_then(|v| v.as_object()).is_none() {\n        json[\"keys\"] = serde_json::json!({});\n    }\n    json[\"keys\"][key_id.as_str()] = serde_json::Value::String(public_key);\n    json[\"channel\"] = serde_json::Value::String(\"debug\".to_string());\n    if json.get(\"revoked\").is_none() {\n        json[\"revoked\"] = serde_json::json!([]);\n    }\n    std::fs::write(&path, serde_json::to_string_pretty(&json).unwrap())\n        .expect(\"write release keys\");\n    println!(\"debug-pinned node release policy: {}\", path.display());\n}\n\n/// `xtask debug-mark-applied` (field rig tooling): record `Applied{version}`\n/// for an already-staged set, the one thing no other maintainer verb writes.\n/// The real apply path owns this record (applyhost/brainproc); a field rig that\n/// stages a set by hand has no apply to run, and the LAN bootstrap set gate\n…\nfn debug_rollout_meta(\n…\n) -> spt_daemon::UpdateSetMetadata {\n…\n}\n\n#[cfg(test)]\nmod debug_rollout_meta_tests {\n    use super::debug_rollout_meta;\n\n    // [unit->REQ-UPD-6] the stamp flags ride the SIGNED metadata: --channel and\n    // --product-version land verbatim in the set a recipient verifies against\n    // its release-keys policy, alongside the counter and expiry window.\n    #[test]\n    fn stamps_channel_and_product_version_verbatim() {\n        let meta = debug_rollout_meta(\n            96,\n            \"stable\",\n            \"0.60.1\",\n            14,\n            1_000,\n            \"rig-roll3-2026\",\n            std::collections::BTreeMap::new(),\n            None,\n        );\n        assert_eq!(meta.version, 96);\n        assert_eq!(meta.channel, \"stable\");\n        assert_eq!(meta.product_version, \"0.60.1\");\n        assert_eq!(meta.key_id, \"rig-roll3-2026\");\n        assert_eq!(meta.expires_at_ms, 1_000 + 14 * 24 * 60 * 60 * 1000);\n    }\n\n    // [unit->REQ-UPD-6] the defaults reproduce the pre-flag debug shape\n    // exactly: debug channel, counter-only (empty semver), no docs.\n    #[test]\n    fn defaults_reproduce_the_counter_only_debug_shape() {\n        let meta = debug_rollout_meta(\n            1,\n            \"debug\",\n            \"\",\n            14,\n            0,\n            \"dev-debug-2026\",\n            std::collections::BTreeMap::new(),\n            None,\n        );\n        assert_eq!(meta.channel, \"debug\");\n        assert!(meta.product_version.is_empty());\n        assert!(meta.docs.is_none());\n        assert!(meta.provenance.is_none());\n    }\n}\n\n// [impl->REQ-UPD-6]\nfn debug_rollout(args: &[String]) {\n    let mut key_id = \"dev-debug-2026\".to_string();\n    let mut version = None;\n    let mut expires_days: u64 = 14;\n    let mut stage_dir = None;\n    let mut state_path = None;\n    let mut build_current = false;\n    let mut product_version = String::new();\n    let mut channel = \"debug\".to_string();\n    let mut artifact_args: Vec<String> = Vec::new();\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--key-id\" => key_id = it.next().cloned().expect(\"--key-id <id>\"),\n            \"--product-version\" => {\n                product_version = it.next().cloned().expect(\"--product-version <semver>\")\n            }\n            \"--channel\" => channel = it.next().cloned().expect(\"--channel <name>\"),\n            \"--version\" => {\n                version = Some(\n                    it.next()\n                        .and_then(|v| v.parse().ok())\n                        .expect(\"--version <u64>\"),\n                )\n            }\n            \"--expires-days\" => {\n                expires_days = it\n                    .next()\n                    .and_then(|v| v.parse().ok())\n                    .expect(\"--expires-days <n>\")\n            }\n            \"--stage-dir\" => stage_dir = it.next().map(PathBuf::from),\n            \"--state\" => state_path = it.next().map(PathBuf::from),\n            \"--build-current\" => build_current = true,\n            \"--artifact\" => {\n                artifact_args.push(it.next().cloned().expect(\"--artifact <target=path>\"))\n            }\n            other => panic!(\"unknown arg {other}\"),\n        }\n    }\n\n    let root = repo_root();\n    let state_path =\n        state_path.unwrap_or_else(|| root.join(\"target\").join(\"debug-rollout-state.json\"));\n    let version = version.unwrap_or_else(|| next_debug_version(&state_path));\n    let identity = debug_signing_identity();\n\n    let mut artifact_paths: Vec<(String, PathBuf)> =\n        artifact_args.iter().map(|a| parse_target_path(a)).collect();\n    if build_current {\n        let path = build_release_spt(&root);\n        artifact_paths.push((spt_daemon::current_platform().to_string(), path));\n    }\n    assert!(\n        !artifact_paths.is_empty(),\n        \"provide --artifact <target=path> or --build-current\"\n    );\n\n    let now = system_time_ms();\n    let mut artifact_meta = std::collections::BTreeMap::new();\n    let mut artifact_bytes = std::collections::BTreeMap::new();\n    for (target, path) in artifact_paths {\n        let bytes = std::fs::read(&path).unwrap_or_else(|e| panic!(\"read {}: {e}\", path.display()));\n        artifact_meta.insert(\n            target.clone(),\n            spt_daemon::UpdateArtifactMetadata {\n                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n                broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n                asset_name: path\n                    .file_name()\n                    .and_then(|n| n.to_str())\n                    .map(str::to_string),\n            },\n        );\n        artifact_bytes.insert(target, bytes);\n    }\n\n    let meta = debug_rollout_meta(\n        version,\n        &channel,\n        &product_version,\n        expires_days,\n        now,\n        &key_id,\n        artifact_meta,\n        Some(spt_daemon::UpdateSetProvenance {\n            git_commit: git_stdout(&root, &[\"rev-parse\", \"HEAD\"]),\n            git_dirty: Some(\n                git_stdout(&root, &[\"status\", \"--porcelain\"]).is_some_and(|s| !s.is_empty()),\n            ),\n            build_host: build_host(),\n            build_timestamp_ms: Some(now),\n        }),\n    );\n    let metadata_json = serde_json::to_string(&meta).expect(\"serialize update set\");\n    let sig = identity.sign(metadata_json.as_bytes());\n    let signed = spt_daemon::SignedUpdateSet {\n        metadata_json,\n        signature_hex: sig.iter().map(|b| format!(\"{b:02x}\")).collect(),\n    };\n\n    let pub_hex = identity.public_key().to_hex();\n    let vk = spt_daemon::parse_verifying_key(&pub_hex).expect(\"debug public key parses\");\n    let policy = spt_daemon::VerifyPolicy {\n        trusted_keys: std::collections::BTreeMap::from([(key_id.clone(), vk)]),\n        revoked_keys: std::collections::BTreeSet::new(),\n        pinned_channel: channel.clone(),\n        current_version: 0,\n        now_ms: now,\n    };\n    let verified = spt_daemon::verify_update_set_metadata(&signed, &policy)\n        .expect(\"freshly signed update set verifies\");\n    for (target, bytes) in &artifact_bytes {\n        spt_daemon::verify_update_set_artifact(&verified, target, bytes)\n            .unwrap_or_else(|e| panic!(\"{target}: artifact verification failed: {e}\"));\n    }\n\n    let stage_dir = stage_dir.unwrap_or_else(|| spt_store::perch::spt_home().join(\"releases\"));\n    spt_daemon::ReleaseCache::open(&stage_dir)\n        .stage_update_set(&signed, &artifact_bytes)\n        .expect(\"stage debug update set\");\n    write_debug_version(&state_path, version);\n    println!(\n        \"DEBUG_ROLLOUT_STAGED version={version} channel={channel} platforms={} stage_dir={}\",\n        verified\n            .artifacts\n            .keys()\n            .cloned()\n            .collect::<Vec<_>>()\n            .join(\",\"),\n        stage_dir.display()\n    );\n    println!(\"Peers pinned to debug will fetch via the normal update pump; run/poke the daemon pump for immediate propagation.\");\n}\n\n/// `xtask debug-converge` (M8 decision 19, REQ-UPD-6,\n/// docs/DEBUG-CONVERGE-PLAN.md): after a coordinator stages a debug rollout,\n/// answer \"did every expected lab node converge on the target debug version,\n/// and if not, why not?\" without hand-walking nodes. Watches via the\n/// status-only update query (`spt_daemon::propagate::request_update_status`)\n/// over the local daemon's broker until every expected node is `Applied`, or\n/// prints the per-node timeout table. Maintainer tooling only — never the\n/// public `spt` surface (ADR-0016).\n///\n/// Exit codes: `0` converged, `1` not converged (timeout/failure rows),\n/// `2` usage — machine-distinguishable per the plan.\n// [impl->REQ-UPD-6]\nfn debug_converge(args: &[String]) {\n    use spt_daemon::propagate::{classify_status, ConvergeState, UpdateStatusReport};\n\n    let mut version: Option<u64> = None;\n    let mut nodes: Vec<String> = Vec::new();\n    let mut subnet: Option<String> = None;\n    let mut timeout_secs: u64 = 120;\n    let mut poll_secs: u64 = 3;\n    let mut it = args.iter();\n    while let Some(a) = it.next() {\n        match a.as_str() {\n            \"--version\" => version = it.next().and_then(|v| v.parse().ok()),\n            \"--nodes\" => {\n                nodes = it\n                    .next()\n                    .map(|s| s.split(',').map(str::to_string).collect())\n                    .unwrap_or_default()\n            }\n            \"--subnet\" => subnet = it.next().cloned(),\n            \"--timeout\" => timeout_secs = it.next().and_then(|v| v.parse().ok()).unwrap_or(120),\n            \"--poll\" => poll_secs = it.next().and_then(|v| v.parse().ok()).unwrap_or(3),\n            \"--home\" => {\n                if let Some(h) = it.next() {\n…\n                }\n            }\n…\n        }\n    }\n…\n}","startLine":2145,"lineNumbers":[2145,null,2150,2151,null,2160,2161,2162,2163,2164,2165,2166,2167,2168,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2181,2182,2183,2184,2185,2186,2187,2188,2189,2190,2191,2192,2193,2194,2195,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,2210,2211,2212,2213,2214,2215,2216,2217,2218,2219,2220,2221,2222,2223,2224,2225,2226,2227,2228,2229,2230,2231,2232,2233,2234,2235,2236,2237,2238,2239,2240,2241,2242,2243,2244,2245,2246,2247,2248,2249,2250,2251,2252,2253,2254,2255,2256,2257,2258,2259,2260,2261,2262,2263,2264,2265,null,2310,null,2319,null,2330,2331,2332,2333,2334,2335,2336,2337,2338,2339,2340,2341,2342,2343,2344,2345,2346,2347,2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,2370,2371,2372,2373,2374,2375,2376,2377,2378,2379,2380,2381,2382,2383,2384,2385,2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,2413,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,2425,2426,2427,2428,2429,2430,2431,2432,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,2448,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2465,2466,2467,2468,2469,2470,2471,2472,2473,2474,2475,2476,2477,2478,2479,2480,2481,2482,2483,2484,2485,2486,2487,2488,2489,2490,2491,2492,2493,2494,2495,2496,2497,2498,2499,2500,2501,2502,2503,2504,2505,2506,2507,2508,2509,2510,2511,2512,2513,2514,2515,2516,2517,2518,2519,2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533,2534,2535,2536,2537,2538,2539,2540,2541,2542,2543,2544,2545,2546,2547,2548,2549,2550,null,2552,2553,null,2558,2559,null,2673]},"fileSize":163022,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\xtask\\src\\main.rs"}}},"isError":false,"timestamp":1789522819289}}
{"type":"message","id":"b00fd4b7","parentId":"621fd5c1","timestamp":"2026-09-16T01:40:19.307Z","message":{"role":"toolResult","toolCallId":"call_31cO3o2q75S6bJRQK1aPueVs|fc_0bac546ce171b754016aa9f3832e1887d1a61af3097f1a2609","toolName":"grep","content":[{"type":"text","text":"# docs/\n## 304-W2-FIELD-PLAN.md\n 69|\n*70|**One release build, via `debug-rollout --build-current`.** Not build-then-build. The cargo producer\n 71|runs inside that verb (`crates/xtask/src/main.rs:2738-2746`), so the capacity floor is read\n 72|immediately before it.\n 73|\n...\n 113|Describe the resulting chain accurately and in these terms: *checked source tree, successful\n*114|producer, rejected known-old artifact, internally consistent signed set.* No extra build, no target\n 115|deletion, no universal \"hash must change\" rule.\n 116|\n 117|---\n## 304-W2-ADMISSION-RECEIPT.md\n 122|| --- | --- |\n*123|| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |\n*124|| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |\n*125|| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |\n*126|| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |\n*127|| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |\n 128|\n 129|Driver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged\n 130|manifest, and on disk.\n...\n 139|own tree returned nothing, and that absence was **not** reported — a wider search found it\n*140|immediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census\n 141|r3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.\n 142|\n 143|## 5. Isolated home\n...\n 151|| --- | --- | --- |\n*152|| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |\n 153|| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |\n 154|| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |\n 155|\n\n# crates/\n\n## spt-daemon/src/\n### update.rs\n 23|//! substrate ([`crate::brain::Brain::handoff`]) — it does **not** re-implement\n*24|//! one (clean-room posture, `M3c-PLAN.md` §C0). The signing/rollback hardening\n 25|//! that gates *which* binary is even eligible to swap arrives in C1.\n 26|// [impl->REQ-UPD-3]\n 27|\n...\n 33|    verify_artifact, verify_metadata, verify_update_set_artifact, verify_update_set_metadata,\n*34|    RejectReason, SignedRelease, SignedUpdateSet, VerifyPolicy,\n 35|};\n 36|\n 37|/// The held-resource-type ABI of this build's broker — the broker-breaking axis\n...\n 75|/// What a candidate release declares about its broker/brain — the subset the\n*76|/// classifier needs (C1 adds version + signature + expiry). Forward-compatible\n 77|/// by intent: only the two ADR-0004 §A axes live here.\n 78|#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n 79|pub struct ReleaseSpec {\n...\n 144|\n*145|/// The verify-before-handoff gate (C1): authenticate a signed release + confirm\n 146|/// the binary bytes, then — and only then — classify it into an [`UpdatePlan`].\n 147|///\n*148|/// This is the **front door** of an update: ADR-0004 §D makes signing mandatory,\n 149|/// so a release is never even classified (let alone applied) until it has passed\n*150|/// [`verify_metadata`] (signature + key trust/revocation + channel + expiry +\n 151|/// monotonic version) **and** [`verify_artifact`] (the real bytes match the\n*152|/// signed digest). A rejected release returns its [`RejectReason`] and **no plan\n 153|/// is produced** — there is nothing for [`apply_brain_only`] to act on, so an\n 154|/// unverified binary can never reach a handoff ([`REQ-UPD-2`]).\n 155|// [impl->REQ-UPD-2]\n...\n 158|    running: &BrokerAbi,\n*159|    signed: &SignedRelease,\n 160|    artifact: &[u8],\n 161|    policy: &VerifyPolicy,\n 162|) -> Result<UpdatePlan, RejectReason> {\n*163|    let meta = verify_metadata(signed, policy)?;\n 164|    verify_artifact(&meta, artifact)?;\n 165|    Ok(plan_update(running, meta.spec()))\n 166|}\n 167|\n*168|/// The update-set front door: authenticate a signed multi-platform set, select\n*169|/// the recipient's Rust target triple, confirm those bytes match the signed\n 170|/// digest, then classify that platform artifact.\n 171|// [impl->REQ-UPD-6]\n 172|pub fn plan_verified_update_set(\n 173|    running: &BrokerAbi,\n*174|    signed: &SignedUpdateSet,\n 175|    platform: &str,\n 176|    artifact: &[u8],\n 177|    policy: &VerifyPolicy,\n 178|) -> Result<UpdatePlan, RejectReason> {\n*179|    let meta = verify_update_set_metadata(signed, policy)?;\n 180|    let selected = meta.artifact_for(platform)?;\n 181|    verify_update_set_artifact(&meta, platform, artifact)?;\n 182|    Ok(plan_update(running, selected.spec()))\n...\n 337|    use crate::release::{\n*338|        sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateArtifactMetadata,\n 339|        UpdateSetMetadata, VerifyPolicy,\n 340|    };\n*341|    use ed25519_dalek::{Signer, SigningKey};\n 342|    use std::collections::{BTreeMap, BTreeSet};\n 343|\n*344|    fn signed_for(sk: &SigningKey, meta: &ReleaseMetadata) -> SignedRelease {\n 345|        let metadata_json = serde_json::to_string(meta).unwrap();\n*346|        let sig = sk.sign(metadata_json.as_bytes());\n*347|        let signature_hex = sig.to_bytes().iter().map(|b| format!(\"{b:02x}\")).collect();\n*348|        SignedRelease {\n 349|            metadata_json,\n*350|            signature_hex,\n 351|        }\n 352|    }\n 353|\n\n## xtask/src/\n### main.rs\n 76|        \"release-keygen\" => release_keygen(&args[1..]),\n*77|        \"release-sign\" => release_sign(&args[1..]),\n 78|        \"release-publish\" => release_publish(&args[1..]),\n 79|        \"release-verify\" => release_verify(&args[1..]),\n 80|        \"debug-keygen\" => debug_keygen(&args[1..]),\n 81|        \"debug-pin\" => debug_pin(&args[1..]),\n*82|        \"debug-rollout\" => debug_rollout(&args[1..]),\n 83|        \"debug-mark-applied\" => debug_mark_applied(&args[1..]),\n 84|        \"debug-converge\" => debug_converge(&args[1..]),\n 85|        _ => {\n 86|            eprintln!(\n*87|                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--fo...\n 88|            );\n 89|            std::process::exit(2);\n 90|        }\n...\n 200|/// subcommand the help lists — the FULL command tree (IR-52's durable\n*201|/// remedy, SIGNET W1): any help below a fixed rendering depth was invisible\n 202|/// to the docs-drift gate, so a deep help edit or regression shipped\n 203|/// unpublished and ungated unless some REQ's unit happened to pin it. With\n 204|/// the recursion, published depth == tree depth by construction, and the\n...\n 1532|\n*1533|/// Every relative `.md`/`.json`/`.sh`/`.ps1` link in the curated llms.txt\n 1534|/// must resolve — agents cache links; a dead one is a contract break\n 1535|/// (DOCS-STRATEGY principle 9).\n 1536|fn check_llms_links() {\n...\n 1568|            .is_file(),\n*1569|        \"install.sh\" | \"install.ps1\" => root.join(target).is_file(),\n 1570|        t => root.join(\"docs-site/src\").join(t).is_file(),\n 1571|    }\n 1572|}\n...\n 1699|\n*1700|/// The manual local signing step (ADR-0015 — no CI secrets): produce the\n*1701|/// exact `SignedRelease` JSON the self-updater consumes, one per platform\n*1702|/// artifact. The signing seed comes from the SPT_RELEASE_SEED env var\n 1703|/// (paste from the password manager into the shell session, never argv).\n 1704|///\n*1705|/// `xtask release-sign --key-id <id> --version <u64> [--expires-days <n>]\n 1706|///  <artifact>…` writes `<artifact>.release.json` beside each artifact.\n 1707|// [impl->REQ-REL-2]\n 1708|// [impl->REQ-REL-3]\n*1709|fn release_sign(args: &[String]) {\n 1710|    let mut key_id = None;\n 1711|    let mut version = None;\n 1712|    let mut expires_days: u64 = 365;\n...\n 1729|    let version = version.expect(\"--version <u64> (the monotonic release counter)\");\n*1730|    assert!(!artifacts.is_empty(), \"at least one artifact to sign\");\n 1731|\n*1732|    let identity = signing_identity();\n 1733|    println!(\n*1734|        \"signing as: {} (key_id {key_id})\",\n 1735|        identity.public_key().to_hex()\n 1736|    );\n*1737|    // The low-level manual signer carries no release tag, so no semver to\n 1738|    // stamp — the post-apply message falls back to the release counter.\n*1739|    sign_artifacts(&identity, &key_id, version, expires_days, \"\", &artifacts);\n 1740|}\n 1741|\n*1742|/// Resolve the signing identity. Preference order:\n 1743|/// 1. `SPT_RELEASE_SEED_CMD` — a command that prints the seed hex (the\n 1744|///    password-manager CLI integration, e.g.\n 1745|///    `op read \"op://Private/spt release primary/seed\"` or\n...\n 1749|// [impl->REQ-REL-3]\n*1750|fn signing_identity() -> spt_proto::identity::Identity {\n 1751|    let seed_hex = if let Ok(cmd) = std::env::var(\"SPT_RELEASE_SEED_CMD\") {\n 1752|        let out = if cfg!(windows) {\n 1753|            Command::new(\"powershell\")\n...\n 1779|\n*1780|/// Sign each artifact, writing `<artifact>.release.json` beside it.\n 1781|// [impl->REQ-REL-2]\n*1782|fn sign_artifacts(\n 1783|    identity: &spt_proto::identity::Identity,\n 1784|    key_id: &str,\n 1785|    version: u64,\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":"docs/304-W2-FIELD-PLAN.md, docs/304-W2-ADMISSION-RECEIPT.md, crates/spt-daemon/src/update.rs, crates/xtask/src/main.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":49,"fileCount":4,"files":["docs/304-W2-FIELD-PLAN.md","docs/304-W2-ADMISSION-RECEIPT.md","crates/spt-daemon/src/update.rs","crates/xtask/src/main.rs"],"fileMatches":[{"path":"docs/304-W2-FIELD-PLAN.md","count":2},{"path":"docs/304-W2-ADMISSION-RECEIPT.md","count":7},{"path":"crates/spt-daemon/src/update.rs","count":20},{"path":"crates/xtask/src/main.rs","count":20}],"truncated":true,"perFileLimitReached":20,"displayContent":"# docs/\n## 304-W2-FIELD-PLAN.md\n  69│\n *70│**One release build, via `debug-rollout --build-current`.** Not build-then-build. The cargo producer\n  71│runs inside that verb (`crates/xtask/src/main.rs:2738-2746`), so the capacity floor is read\n  72│immediately before it.\n  73│\n    │...\n 113│Describe the resulting chain accurately and in these terms: *checked source tree, successful\n*114│producer, rejected known-old artifact, internally consistent signed set.* No extra build, no target\n 115│deletion, no universal \"hash must change\" rule.\n 116│\n 117│---\n## 304-W2-ADMISSION-RECEIPT.md\n 122│| --- | --- |\n*123│| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |\n*124│| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |\n*125│| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |\n*126│| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |\n*127│| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |\n 128│\n 129│Driver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged\n 130│manifest, and on disk.\n    │...\n 139│own tree returned nothing, and that absence was **not** reported — a wider search found it\n*140│immediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census\n 141│r3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.\n 142│\n 143│## 5. Isolated home\n    │...\n 151│| --- | --- | --- |\n*152│| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |\n 153│| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |\n 154│| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |\n 155│\n\n# crates/\n\n## spt-daemon/src/\n### update.rs\n  23│//! substrate ([`crate::brain::Brain::handoff`]) — it does **not** re-implement\n *24│//! one (clean-room posture, `M3c-PLAN.md` §C0). The signing/rollback hardening\n  25│//! that gates *which* binary is even eligible to swap arrives in C1.\n  26│// [impl->REQ-UPD-3]\n  27│\n    │...\n  33│    verify_artifact, verify_metadata, verify_update_set_artifact, verify_update_set_metadata,\n *34│    RejectReason, SignedRelease, SignedUpdateSet, VerifyPolicy,\n  35│};\n  36│\n  37│/// The held-resource-type ABI of this build's broker — the broker-breaking axis\n    │...\n  75│/// What a candidate release declares about its broker/brain — the subset the\n *76│/// classifier needs (C1 adds version + signature + expiry). Forward-compatible\n  77│/// by intent: only the two ADR-0004 §A axes live here.\n  78│#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n  79│pub struct ReleaseSpec {\n    │...\n 144│\n*145│/// The verify-before-handoff gate (C1): authenticate a signed release + confirm\n 146│/// the binary bytes, then — and only then — classify it into an [`UpdatePlan`].\n 147│///\n*148│/// This is the **front door** of an update: ADR-0004 §D makes signing mandatory,\n 149│/// so a release is never even classified (let alone applied) until it has passed\n*150│/// [`verify_metadata`] (signature + key trust/revocation + channel + expiry +\n 151│/// monotonic version) **and** [`verify_artifact`] (the real bytes match the\n*152│/// signed digest). A rejected release returns its [`RejectReason`] and **no plan\n 153│/// is produced** — there is nothing for [`apply_brain_only`] to act on, so an\n 154│/// unverified binary can never reach a handoff ([`REQ-UPD-2`]).\n 155│// [impl->REQ-UPD-2]\n    │...\n 158│    running: &BrokerAbi,\n*159│    signed: &SignedRelease,\n 160│    artifact: &[u8],\n 161│    policy: &VerifyPolicy,\n 162│) -> Result<UpdatePlan, RejectReason> {\n*163│    let meta = verify_metadata(signed, policy)?;\n 164│    verify_artifact(&meta, artifact)?;\n 165│    Ok(plan_update(running, meta.spec()))\n 166│}\n 167│\n*168│/// The update-set front door: authenticate a signed multi-platform set, select\n*169│/// the recipient's Rust target triple, confirm those bytes match the signed\n 170│/// digest, then classify that platform artifact.\n 171│// [impl->REQ-UPD-6]\n 172│pub fn plan_verified_update_set(\n 173│    running: &BrokerAbi,\n*174│    signed: &SignedUpdateSet,\n 175│    platform: &str,\n 176│    artifact: &[u8],\n 177│    policy: &VerifyPolicy,\n 178│) -> Result<UpdatePlan, RejectReason> {\n*179│    let meta = verify_update_set_metadata(signed, policy)?;\n 180│    let selected = meta.artifact_for(platform)?;\n 181│    verify_update_set_artifact(&meta, platform, artifact)?;\n 182│    Ok(plan_update(running, selected.spec()))\n    │...\n 337│    use crate::release::{\n*338│        sha256_hex, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateArtifactMetadata,\n 339│        UpdateSetMetadata, VerifyPolicy,\n 340│    };\n*341│    use ed25519_dalek::{Signer, SigningKey};\n 342│    use std::collections::{BTreeMap, BTreeSet};\n 343│\n*344│    fn signed_for(sk: &SigningKey, meta: &ReleaseMetadata) -> SignedRelease {\n 345│        let metadata_json = serde_json::to_string(meta).unwrap();\n*346│        let sig = sk.sign(metadata_json.as_bytes());\n*347│        let signature_hex = sig.to_bytes().iter().map(|b| format!(\"{b:02x}\")).collect();\n*348│        SignedRelease {\n 349│            metadata_json,\n*350│            signature_hex,\n 351│        }\n 352│    }\n 353│\n\n## xtask/src/\n### main.rs\n   76│        \"release-keygen\" => release_keygen(&args[1..]),\n  *77│        \"release-sign\" => release_sign(&args[1..]),\n   78│        \"release-publish\" => release_publish(&args[1..]),\n   79│        \"release-verify\" => release_verify(&args[1..]),\n   80│        \"debug-keygen\" => debug_keygen(&args[1..]),\n   81│        \"debug-pin\" => debug_pin(&args[1..]),\n  *82│        \"debug-rollout\" => debug_rollout(&args[1..]),\n   83│        \"debug-mark-applied\" => debug_mark_applied(&args[1..]),\n   84│        \"debug-converge\" => debug_converge(&args[1..]),\n   85│        _ => {\n   86│            eprintln!(\n  *87│                \"usage: xtask <gen|check|brain-read-check|binedge-check [--no-prebuilds] [--baseline|--write-baseline] [--sites]|perjob-map|pick-audit --range <base>..<head> --lane <base>..<tip> [--lane <base>..<tip>] [--pair <lane-rev>:<pick-rev>] [--repo <dir>]|disk-floor [--path <dir>] [--floor-gb <n>] [--label <lane>]|docs-bundle <out.tar.gz>|bench-wrap --step <name> [--key <k>] -- <cmd...>|bench-report [--top <n>] [--window-hours <h>]|pool-claim --pool <dir> --label <lane> [--holder-pid <pid>] [--fo...\n   88│            );\n   89│            std::process::exit(2);\n   90│        }\n     │...\n  200│/// subcommand the help lists — the FULL command tree (IR-52's durable\n *201│/// remedy, SIGNET W1): any help below a fixed rendering depth was invisible\n  202│/// to the docs-drift gate, so a deep help edit or regression shipped\n  203│/// unpublished and ungated unless some REQ's unit happened to pin it. With\n  204│/// the recursion, published depth == tree depth by construction, and the\n     │...\n 1532│\n*1533│/// Every relative `.md`/`.json`/`.sh`/`.ps1` link in the curated llms.txt\n 1534│/// must resolve — agents cache links; a dead one is a contract break\n 1535│/// (DOCS-STRATEGY principle 9).\n 1536│fn check_llms_links() {\n     │...\n 1568│            .is_file(),\n*1569│        \"install.sh\" | \"install.ps1\" => root.join(target).is_file(),\n 1570│        t => root.join(\"docs-site/src\").join(t).is_file(),\n 1571│    }\n 1572│}\n     │...\n 1699│\n*1700│/// The manual local signing step (ADR-0015 — no CI secrets): produce the\n*1701│/// exact `SignedRelease` JSON the self-updater consumes, one per platform\n*1702│/// artifact. The signing seed comes from the SPT_RELEASE_SEED env var\n 1703│/// (paste from the password manager into the shell session, never argv).\n 1704│///\n*1705│/// `xtask release-sign --key-id <id> --version <u64> [--expires-days <n>]\n 1706│///  <artifact>…` writes `<artifact>.release.json` beside each artifact.\n 1707│// [impl->REQ-REL-2]\n 1708│// [impl->REQ-REL-3]\n*1709│fn release_sign(args: &[String]) {\n 1710│    let mut key_id = None;\n 1711│    let mut version = None;\n 1712│    let mut expires_days: u64 = 365;\n     │...\n 1729│    let version = version.expect(\"--version <u64> (the monotonic release counter)\");\n*1730│    assert!(!artifacts.is_empty(), \"at least one artifact to sign\");\n 1731│\n*1732│    let identity = signing_identity();\n 1733│    println!(\n*1734│        \"signing as: {} (key_id {key_id})\",\n 1735│        identity.public_key().to_hex()\n 1736│    );\n*1737│    // The low-level manual signer carries no release tag, so no semver to\n 1738│    // stamp — the post-apply message falls back to the release counter.\n*1739│    sign_artifacts(&identity, &key_id, version, expires_days, \"\", &artifacts);\n 1740│}\n 1741│\n*1742│/// Resolve the signing identity. Preference order:\n 1743│/// 1. `SPT_RELEASE_SEED_CMD` — a command that prints the seed hex (the\n 1744│///    password-manager CLI integration, e.g.\n 1745│///    `op read \"op://Private/spt release primary/seed\"` or\n     │...\n 1749│// [impl->REQ-REL-3]\n*1750│fn signing_identity() -> spt_proto::identity::Identity {\n 1751│    let seed_hex = if let Ok(cmd) = std::env::var(\"SPT_RELEASE_SEED_CMD\") {\n 1752│        let out = if cfg!(windows) {\n 1753│            Command::new(\"powershell\")\n     │...\n 1779│\n*1780│/// Sign each artifact, writing `<artifact>.release.json` beside it.\n 1781│// [impl->REQ-REL-2]\n*1782│fn sign_artifacts(\n 1783│    identity: &spt_proto::identity::Identity,\n 1784│    key_id: &str,\n 1785│    version: u64,","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789522819306}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_lhdcRdK6IrLSaUSICdpkzsKV|fc_0bac546ce171b754016aa9f38cf1cc87d18ef2ed90ea0440a4","toolName":"read","startedAt":"2026-09-16T01:40:29.017Z","args":{"path":"crates/spt-daemon/src/update.rs:37-145"},"intent":"Reading compatibility constants"},"id":"7cb49a7f","parentId":"b00fd4b7","timestamp":"2026-09-16T01:40:29.017Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_bWmJhYmH0CCTNfDbbWbHERXq|fc_0bac546ce171b754016aa9f38cf1dc87d1883281b4748af45b","toolName":"grep","startedAt":"2026-09-16T01:40:29.017Z","args":{"path":"crates/spt-daemon/src/release.rs;crates/spt-daemon/src/releasecache.rs;crates/spt-proto/src;crates/spt-daemon/src/brainproc.rs"},"intent":"Locating cache and trust implementations"},"id":"e9f40d5f","parentId":"7cb49a7f","timestamp":"2026-09-16T01:40:29.017Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_XcHY9iq4xjdlFfNZ8AzlrBM2|fc_0bac546ce171b754016aa9f38cf1e887d1a91ecee7a35fb1c3","toolName":"glob","startedAt":"2026-09-16T01:40:29.017Z","args":{"path":".spt/preserved/**/*sign*;.spt/preserved/**/*launch*;.spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/*rig*.py;.spt/preserved/**/*rig*.ps1"},"intent":"Finding preserved rig scripts"},"id":"867ad19f","parentId":"e9f40d5f","timestamp":"2026-09-16T01:40:29.017Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_CSFKPTlNJsA6DPzumTrSe8lC|fc_0bac546ce171b754016aa9f38cf1f487d1938c09e9f617e07f","toolName":"read","startedAt":"2026-09-16T01:40:29.017Z","args":{"path":"docs/304-W2-ADMISSION-RECEIPT.md:90-151"},"intent":"Reading admission artifact locations"},"id":"7340c068","parentId":"867ad19f","timestamp":"2026-09-16T01:40:29.017Z"}
{"type":"message","id":"60b6137c","parentId":"7340c068","timestamp":"2026-09-16T01:40:29.017Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_lhdcRdK6IrLSaUSICdpkzsKV|fc_0bac546ce171b754016aa9f38cf1cc87d18ef2ed90ea0440a4","name":"read","arguments":{"i":"Reading compatibility constants","path":"crates/spt-daemon/src/update.rs:37-145"},"intent":"Reading compatibility constants"},{"type":"toolCall","id":"call_bWmJhYmH0CCTNfDbbWbHERXq|fc_0bac546ce171b754016aa9f38cf1dc87d1883281b4748af45b","name":"grep","arguments":{"i":"Locating cache and trust implementations","pattern":"fn stage_update_set|applied-state|staged-set|artifact-|fn load_from|BUILTIN|IPC_PROTOCOL_VERSION","path":"crates/spt-daemon/src/release.rs;crates/spt-daemon/src/releasecache.rs;crates/spt-proto/src;crates/spt-daemon/src/brainproc.rs","case":true,"gitignore":true,"skip":0},"intent":"Locating cache and trust implementations"},{"type":"toolCall","id":"call_XcHY9iq4xjdlFfNZ8AzlrBM2|fc_0bac546ce171b754016aa9f38cf1e887d1a91ecee7a35fb1c3","name":"glob","arguments":{"i":"Finding preserved rig scripts","path":".spt/preserved/**/*sign*;.spt/preserved/**/*launch*;.spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/*rig*.py;.spt/preserved/**/*rig*.ps1","hidden":true,"gitignore":false,"limit":65},"intent":"Finding preserved rig scripts"},{"type":"toolCall","id":"call_CSFKPTlNJsA6DPzumTrSe8lC|fc_0bac546ce171b754016aa9f38cf1f487d1938c09e9f617e07f","name":"read","arguments":{"i":"Reading admission artifact locations","path":"docs/304-W2-ADMISSION-RECEIPT.md:90-151"},"intent":"Reading admission artifact locations"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":9336,"output":277,"cacheRead":22272,"cacheWrite":0,"totalTokens":31885,"cost":{"input":0.09336000000000001,"output":0.013850000000000001,"cacheRead":0.022272,"cacheWrite":0,"total":0.129482}},"stopReason":"toolUse","timestamp":1789522819313,"responseId":"resp_0bac546ce171b754016aa9f383a5e087d1a30e8d3ed772a096","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f38cf1cc87d18ef2ed90ea0440a4","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading compatibility constants\",\"path\":\"crates/spt-daemon/src/update.rs:37-145\"}","call_id":"call_lhdcRdK6IrLSaUSICdpkzsKV","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f38cf1dc87d1883281b4748af45b","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating cache and trust implementations\",\"pattern\":\"fn stage_update_set|applied-state|staged-set|artifact-|fn load_from|BUILTIN|IPC_PROTOCOL_VERSION\",\"path\":\"crates/spt-daemon/src/release.rs;crates/spt-daemon/src/releasecache.rs;crates/spt-proto/src;crates/spt-daemon/src/brainproc.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_bWmJhYmH0CCTNfDbbWbHERXq","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f38cf1e887d1a91ecee7a35fb1c3","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding preserved rig scripts\",\"path\":\".spt/preserved/**/*sign*;.spt/preserved/**/*launch*;.spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/*rig*.py;.spt/preserved/**/*rig*.ps1\",\"hidden\":true,\"gitignore\":false,\"limit\":65}","call_id":"call_XcHY9iq4xjdlFfNZ8AzlrBM2","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"glob","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f38cf1f487d1938c09e9f617e07f","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading admission artifact locations\",\"path\":\"docs/304-W2-ADMISSION-RECEIPT.md:90-151\"}","call_id":"call_CSFKPTlNJsA6DPzumTrSe8lC","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":9701.587300000014,"ttft":9657.294400000013,"completedAt":1789522829015,"contextSnapshot":{"promptTokens":31608,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"f2179f67","parentId":"60b6137c","timestamp":"2026-09-16T01:40:29.022Z","message":{"role":"toolResult","toolCallId":"call_CSFKPTlNJsA6DPzumTrSe8lC|fc_0bac546ce171b754016aa9f38cf1f487d1938c09e9f617e07f","toolName":"read","content":[{"type":"text","text":"## 3. CI axis — `BigscreenVR/spt-bs-core`\n…\n### Controls — so a zero is a real zero and not a dead instrument\n…\n| control | exit | count | what it establishes |\n…\n| negative: `--status stale` | 0 | **0** | a zero is reachable through that same live path |\n\nThe positive control proves **liveness, not exhaustiveness**: 200 is the `--limit` cap, so that\nquery was itself truncated. It does one job — showing that a 0 from this code path means \"none\nmatched\" rather than \"nothing was counted\". It also returned far more than 15 rows, which is the\nempirical answer to the original defect: this query is not bounded to a recent slice the way the\n`--limit 15` listing was.\n\n### Superseded first reading, retained\n\n`gh run list --limit 15 --json databaseId,headSha,status,conclusion,workflowName,createdAt`: 15 runs\nreturned, 0 non-terminal, newest `34676423540` `completed`/`success`, workflow `ci`, head `7cdcf5da`,\n2026-09-12T05:46:11Z, gh exit 0. That reading is **not wrong about what it measured** — it is\ninsufficient as an admission predicate, because absence within the newest 15 is not absence.\n\n**The CI axis alone is blind to local builds**, which is why §2 is taken independently and not\ninferred from this section.\n\n## 4. Staged driver and helper hashes — three-way agreement\n\nVerified by me with `sha256sum -c` against both manifests, and separately by hashing the resolved\nfiles directly.\n\n**Freeze manifest** `R8-FROZEN.sha256` = `6384a8c9ec77dea62ed2bdff2d3a43acb9f038df5a328b1186375a56fb06e108`\n— matches doyle's reported pin. `sha256sum -c` over it: **10 of 10 OK.**\n\n**Staged manifest** `INSTRUMENTS-STAGED-r5.sha256` = `c658dd3ffb7c04436e4391f5ed0726a7188f230549b3ab5278b092cab7c95cbd`\n— matches doyle's reported pin. `sha256sum -c` over it: **6 of 6 OK.**\n\nThe five helpers agree across all three independent sources — the accepted `bundle-r4` baseline, the\nreissued staged manifest, and the bytes actually resolving at `$BIN` right now:\n\n| helper | accepted (r4) == staged (r5) == resolved on disk |\n| --- | --- |\n| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |\n| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |\n| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |\n| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |\n| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |\n\nDriver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged\nmanifest, and on disk.\n\nThis closes the earlier prerequisite that the **actual resolved files** — not merely an unchanged\nreview tree — match the accepted helper pins. It is closed by my own measurement of all three\nsources, not by a report of any of them.\n\n**Provenance note on the r4 baseline.** `BUNDLE-R4-FROZEN.sha256`\n(`b8547bd67ac4e589ffd9adaeeccd462ec3a7ac3d9aebfd8940af380e39007332`) does **not** live beside the\nr5 bundle; it is under a different session scratchpad root. A first search bounded to the r5 bundle's\nown tree returned nothing, and that absence was **not** reported — a wider search found it\nimmediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census\nr3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.\n\n## 5. Isolated home\n\n`…/bundle-r5/fp-home` — **ABSENT.** This is the required admission state: a pre-existing isolated\nhome is rejected and never truncated, because a prior run's home would make provenance unreadable.\n\n## 6. Build shape — retained unchanged\n\n| parameter | value | source |\n| --- | --- | --- |\n| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |\n| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |\n| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |\n…\n\n\n[Showing lines 89-154 of 188. Use :155 to continue]"}],"details":{"truncation":{"content":"| negative: `--status stale` | 0 | **0** | a zero is reachable through that same live path |\r\n\r\nThe positive control proves **liveness, not exhaustiveness**: 200 is the `--limit` cap, so that\r\nquery was itself truncated. It does one job — showing that a 0 from this code path means \"none\r\nmatched\" rather than \"nothing was counted\". It also returned far more than 15 rows, which is the\r\nempirical answer to the original defect: this query is not bounded to a recent slice the way the\r\n`--limit 15` listing was.\r\n\r\n### Superseded first reading, retained\r\n\r\n`gh run list --limit 15 --json databaseId,headSha,status,conclusion,workflowName,createdAt`: 15 runs\r\nreturned, 0 non-terminal, newest `34676423540` `completed`/`success`, workflow `ci`, head `7cdcf5da`,\r\n2026-09-12T05:46:11Z, gh exit 0. That reading is **not wrong about what it measured** — it is\r\ninsufficient as an admission predicate, because absence within the newest 15 is not absence.\r\n\r\n**The CI axis alone is blind to local builds**, which is why §2 is taken independently and not\r\ninferred from this section.\r\n\r\n## 4. Staged driver and helper hashes — three-way agreement\r\n\r\nVerified by me with `sha256sum -c` against both manifests, and separately by hashing the resolved\r\nfiles directly.\r\n\r\n**Freeze manifest** `R8-FROZEN.sha256` = `6384a8c9ec77dea62ed2bdff2d3a43acb9f038df5a328b1186375a56fb06e108`\r\n— matches doyle's reported pin. `sha256sum -c` over it: **10 of 10 OK.**\r\n\r\n**Staged manifest** `INSTRUMENTS-STAGED-r5.sha256` = `c658dd3ffb7c04436e4391f5ed0726a7188f230549b3ab5278b092cab7c95cbd`\r\n— matches doyle's reported pin. `sha256sum -c` over it: **6 of 6 OK.**\r\n\r\nThe five helpers agree across all three independent sources — the accepted `bundle-r4` baseline, the\r\nreissued staged manifest, and the bytes actually resolving at `$BIN` right now:\r\n\r\n| helper | accepted (r4) == staged (r5) == resolved on disk |\r\n| --- | --- |\r\n| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |\r\n| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |\r\n| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |\r\n| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |\r\n| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |\r\n\r\nDriver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged\r\nmanifest, and on disk.\r\n\r\nThis closes the earlier prerequisite that the **actual resolved files** — not merely an unchanged\r\nreview tree — match the accepted helper pins. It is closed by my own measurement of all three\r\nsources, not by a report of any of them.\r\n\r\n**Provenance note on the r4 baseline.** `BUNDLE-R4-FROZEN.sha256`\r\n(`b8547bd67ac4e589ffd9adaeeccd462ec3a7ac3d9aebfd8940af380e39007332`) does **not** live beside the\r\nr5 bundle; it is under a different session scratchpad root. A first search bounded to the r5 bundle's\r\nown tree returned nothing, and that absence was **not** reported — a wider search found it\r\nimmediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census\r\nr3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.\r\n\r\n## 5. Isolated home\r\n\r\n`…/bundle-r5/fp-home` — **ABSENT.** This is the required admission state: a pre-existing isolated\r\nhome is rejected and never truncated, because a prior run's home would make provenance unreadable.\r\n\r\n## 6. Build shape — retained unchanged\r\n\r\n| parameter | value | source |\r\n| --- | --- | --- |\r\n| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |\r\n| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |\r\n| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |\r","truncated":true,"truncatedBy":"lines","totalLines":100,"totalBytes":3894,"outputLines":66,"outputBytes":3894,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":188,"displayContent":{"text":"## 3. CI axis — `BigscreenVR/spt-bs-core`\n…\n### Controls — so a zero is a real zero and not a dead instrument\n…\n| control | exit | count | what it establishes |\n…\n| negative: `--status stale` | 0 | **0** | a zero is reachable through that same live path |\r\n\r\nThe positive control proves **liveness, not exhaustiveness**: 200 is the `--limit` cap, so that\r\nquery was itself truncated. It does one job — showing that a 0 from this code path means \"none\r\nmatched\" rather than \"nothing was counted\". It also returned far more than 15 rows, which is the\r\nempirical answer to the original defect: this query is not bounded to a recent slice the way the\r\n`--limit 15` listing was.\r\n\r\n### Superseded first reading, retained\r\n\r\n`gh run list --limit 15 --json databaseId,headSha,status,conclusion,workflowName,createdAt`: 15 runs\r\nreturned, 0 non-terminal, newest `34676423540` `completed`/`success`, workflow `ci`, head `7cdcf5da`,\r\n2026-09-12T05:46:11Z, gh exit 0. That reading is **not wrong about what it measured** — it is\r\ninsufficient as an admission predicate, because absence within the newest 15 is not absence.\r\n\r\n**The CI axis alone is blind to local builds**, which is why §2 is taken independently and not\r\ninferred from this section.\r\n\r\n## 4. Staged driver and helper hashes — three-way agreement\r\n\r\nVerified by me with `sha256sum -c` against both manifests, and separately by hashing the resolved\r\nfiles directly.\r\n\r\n**Freeze manifest** `R8-FROZEN.sha256` = `6384a8c9ec77dea62ed2bdff2d3a43acb9f038df5a328b1186375a56fb06e108`\r\n— matches doyle's reported pin. `sha256sum -c` over it: **10 of 10 OK.**\r\n\r\n**Staged manifest** `INSTRUMENTS-STAGED-r5.sha256` = `c658dd3ffb7c04436e4391f5ed0726a7188f230549b3ab5278b092cab7c95cbd`\r\n— matches doyle's reported pin. `sha256sum -c` over it: **6 of 6 OK.**\r\n\r\nThe five helpers agree across all three independent sources — the accepted `bundle-r4` baseline, the\r\nreissued staged manifest, and the bytes actually resolving at `$BIN` right now:\r\n\r\n| helper | accepted (r4) == staged (r5) == resolved on disk |\r\n| --- | --- |\r\n| `census.ps1` | `7a50b14e2ea0bf93a310ca14c0ba4f06faf82f6905a9bc764c692b0f913d413b` |\r\n| `cpubracket.ps1` | `fc10031d25eb551daa88ba84b1cb13da4b90baa45ddc5dde3986fbd1abe90e73` |\r\n| `d1_render.py` | `3b9844932696286b83342b831a90407e4505cf1a16665bc936c71f2d99cca596` |\r\n| `portfields.ps1` | `283386e7e1cac9df5e8e3c7e8283faea224ad3d12f4da30185a9b342b9a1da85` |\r\n| `runner-census.ps1` | `63d0508b93a8d15fa2bc9940708c7a13ac4abda1f8ca9c9a5d32a63b1dcf3e8a` |\r\n\r\nDriver: `staged-r8-cleanup-exit.sh` = `2dc91f95…`, identical in the freeze manifest, in the staged\r\nmanifest, and on disk.\r\n\r\nThis closes the earlier prerequisite that the **actual resolved files** — not merely an unchanged\r\nreview tree — match the accepted helper pins. It is closed by my own measurement of all three\r\nsources, not by a report of any of them.\r\n\r\n**Provenance note on the r4 baseline.** `BUNDLE-R4-FROZEN.sha256`\r\n(`b8547bd67ac4e589ffd9adaeeccd462ec3a7ac3d9aebfd8940af380e39007332`) does **not** live beside the\r\nr5 bundle; it is under a different session scratchpad root. A first search bounded to the r5 bundle's\r\nown tree returned nothing, and that absence was **not** reported — a wider search found it\r\nimmediately. The staged manifest's own note is confirmed: the accepted `runner-census.ps1` is census\r\nr3 `63d0508b`, superseding v9-as-delivered's `0d8b67ed`, and `63d0508b` is what resolves on disk.\r\n\r\n## 5. Isolated home\r\n\r\n`…/bundle-r5/fp-home` — **ABSENT.** This is the required admission state: a pre-existing isolated\r\nhome is rejected and never truncated, because a prior run's home would make provenance unreadable.\r\n\r\n## 6. Build shape — retained unchanged\r\n\r\n| parameter | value | source |\r\n| --- | --- | --- |\r\n| build path | **one** release build via `debug-rollout --build-current` | plan §2; not build-then-build |\r\n| build parallelism | `CARGO_BUILD_JOBS=2` | driver r8:935, read not recalled |\r\n| capacity thresholds | floor 96 GiB, hard stop 32 GiB | §1, retained |\r\n…\n","startLine":52,"lineNumbers":[52,null,84,null,86,null,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,null,159]},"fileSize":10229,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\304-W2-ADMISSION-RECEIPT.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":188,"totalBytes":3894,"outputLines":66,"outputBytes":3894,"shownRange":{"start":89,"end":154},"nextOffset":155}}},"isError":false,"timestamp":1789522829022}}
{"type":"message","id":"a7660e15","parentId":"f2179f67","timestamp":"2026-09-16T01:40:29.026Z","message":{"role":"toolResult","toolCallId":"call_lhdcRdK6IrLSaUSICdpkzsKV|fc_0bac546ce171b754016aa9f38cf1cc87d18ef2ed90ea0440a4","toolName":"read","content":[{"type":"text","text":"\n/// The held-resource-type ABI of this build's broker — the broker-breaking axis\n/// (ADR-0004 §A/§B). Bumped **only** when the *kind* of resource the broker holds\n/// changes: a new held-resource type, or a new OS PTY/socket API that changes how\n/// an existing handle is carried. A pure logic change (the routine update) never\n/// touches this — that is precisely what keeps the routine case *brain-only*.\npub const BROKER_RESOURCE_ABI: u32 = 1;\n\n/// What the currently-running broker provides — the fixed point an incoming\n/// release is classified against (ADR-0004 §A). Captured from the live broker,\n/// not from this build, because the whole point of a self-update is that the\n/// *running* broker may be older than the binary proposing the update.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub struct BrokerAbi {\n    /// The IPC protocol version the running broker speaks.\n    pub ipc_version: u32,\n    /// The oldest brain IPC version the running broker will handshake\n    /// (`accept_hello`'s floor). A release brain at or above this can attach to\n    /// the running broker as-is.\n    pub min_compatible: u32,\n    /// The held-resource-type ABI tag ([`BROKER_RESOURCE_ABI`]) — the\n    /// broker-breaking axis.\n    pub resource_abi: u32,\n}\n\nimpl BrokerAbi {\n    /// The ABI of *this* build's broker. In the live daemon the running broker's\n    /// ABI is read off the broker over the IPC; this is the value a broker built\n    /// from this source reports (and the classifier's stand-in when the running\n    /// broker is this same build).\n    pub fn current() -> Self {\n        BrokerAbi {\n            ipc_version: IPC_PROTOCOL_VERSION,\n            min_compatible: MIN_COMPATIBLE_VERSION,\n            resource_abi: BROKER_RESOURCE_ABI,\n        }\n    }\n}\n\n/// What a candidate release declares about its broker/brain — the subset the\n/// classifier needs (C1 adds version + signature + expiry). Forward-compatible\n/// by intent: only the two ADR-0004 §A axes live here.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub struct ReleaseSpec {\n    /// The IPC protocol version the release's **brain** speaks.\n    pub brain_ipc_version: u32,\n    /// The held-resource-type ABI the release's **broker** implements — compared\n    /// against the running broker's [`BrokerAbi::resource_abi`] to detect a\n    /// broker-breaking change.\n    pub broker_resource_abi: u32,\n}\n\n/// The three update classes (ADR-0004 §A), each routed to its own invariant.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum UpdateClass {\n    /// Swap logic only; the running broker hosts the new brain unchanged. No\n    /// endpoint terminates ([`REQ-UPD-3`], absolute). The routine case.\n    BrainOnly,\n    /// The broker binary hot-swaps behind the versioned IPC (held-resource type\n    /// unchanged); endpoints survive. Apply path deferred (no spike — ADR-0004 §A).\n    BrokerCompatible,\n    /// Held-resource-type / OS-API change; a planned endpoint-cycle is required\n    /// and endpoints MAY suspend with consent + scheduling. [`REQ-UPD-3`] weakened.\n    BrokerBreaking,\n}\n\n/// Classify a candidate release against the running broker (ADR-0004 §A).\n///\n/// The decision is purely the two ADR axes:\n/// 1. **held-resource ABI** — if the release's broker implements a *different*\n///    `resource_abi`, the held-resource type changed: **broker-breaking**,\n///    regardless of IPC (a planned endpoint-cycle is unavoidable).\n/// 2. **IPC hostability** — with the resource type unchanged, ask whether the\n///    *running* broker can host the release's brain. If the brain's IPC version\n///    is at or above the running broker's floor, the handshake accepts it and\n///    only logic swaps: **brain-only**. Otherwise the broker must move to a build\n///    that speaks the new IPC — but since the resource type is unchanged the new\n///    broker adopts the existing handles: **broker-compatible**.\n// [impl->REQ-UPD-3]\npub fn classify(running: &BrokerAbi, release: &ReleaseSpec) -> UpdateClass {\n    if release.broker_resource_abi != running.resource_abi {\n        return UpdateClass::BrokerBreaking;\n    }\n    if release.brain_ipc_version >= running.min_compatible {\n        UpdateClass::BrainOnly\n    } else {\n        UpdateClass::BrokerCompatible\n    }\n}\n\n/// A classified update: the class plus the release that produced it. Built by\n/// [`plan_update`] so the class is always derived from the same `(running,\n/// release)` pair the apply step will act on.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub struct UpdatePlan {\n    /// The update class (ADR-0004 §A).\n    pub class: UpdateClass,\n    /// The release the plan was built for.\n    pub release: ReleaseSpec,\n}\n\n/// Classify `release` against `running` and bundle the verdict with it.\npub fn plan_update(running: &BrokerAbi, release: ReleaseSpec) -> UpdatePlan {\n    UpdatePlan {\n        class: classify(running, &release),\n        release,\n    }\n}\n\n/// The verify-before-handoff gate (C1): authenticate a signed release + confirm\n/// the binary bytes, then — and only then — classify it into an [`UpdatePlan`].\n///\n/// This is the **front door** of an update: ADR-0004 §D makes signing mandatory,\n\n[Showing lines 36-148 of 528. Use :149 to continue]"}],"details":{"truncation":{"content":"\r\n/// The held-resource-type ABI of this build's broker — the broker-breaking axis\r\n/// (ADR-0004 §A/§B). Bumped **only** when the *kind* of resource the broker holds\r\n/// changes: a new held-resource type, or a new OS PTY/socket API that changes how\r\n/// an existing handle is carried. A pure logic change (the routine update) never\r\n/// touches this — that is precisely what keeps the routine case *brain-only*.\r\npub const BROKER_RESOURCE_ABI: u32 = 1;\r\n\r\n/// What the currently-running broker provides — the fixed point an incoming\r\n/// release is classified against (ADR-0004 §A). Captured from the live broker,\r\n/// not from this build, because the whole point of a self-update is that the\r\n/// *running* broker may be older than the binary proposing the update.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct BrokerAbi {\r\n    /// The IPC protocol version the running broker speaks.\r\n    pub ipc_version: u32,\r\n    /// The oldest brain IPC version the running broker will handshake\r\n    /// (`accept_hello`'s floor). A release brain at or above this can attach to\r\n    /// the running broker as-is.\r\n    pub min_compatible: u32,\r\n    /// The held-resource-type ABI tag ([`BROKER_RESOURCE_ABI`]) — the\r\n    /// broker-breaking axis.\r\n    pub resource_abi: u32,\r\n}\r\n\r\nimpl BrokerAbi {\r\n    /// The ABI of *this* build's broker. In the live daemon the running broker's\r\n    /// ABI is read off the broker over the IPC; this is the value a broker built\r\n    /// from this source reports (and the classifier's stand-in when the running\r\n    /// broker is this same build).\r\n    pub fn current() -> Self {\r\n        BrokerAbi {\r\n            ipc_version: IPC_PROTOCOL_VERSION,\r\n            min_compatible: MIN_COMPATIBLE_VERSION,\r\n            resource_abi: BROKER_RESOURCE_ABI,\r\n        }\r\n    }\r\n}\r\n\r\n/// What a candidate release declares about its broker/brain — the subset the\r\n/// classifier needs (C1 adds version + signature + expiry). Forward-compatible\r\n/// by intent: only the two ADR-0004 §A axes live here.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct ReleaseSpec {\r\n    /// The IPC protocol version the release's **brain** speaks.\r\n    pub brain_ipc_version: u32,\r\n    /// The held-resource-type ABI the release's **broker** implements — compared\r\n    /// against the running broker's [`BrokerAbi::resource_abi`] to detect a\r\n    /// broker-breaking change.\r\n    pub broker_resource_abi: u32,\r\n}\r\n\r\n/// The three update classes (ADR-0004 §A), each routed to its own invariant.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub enum UpdateClass {\r\n    /// Swap logic only; the running broker hosts the new brain unchanged. No\r\n    /// endpoint terminates ([`REQ-UPD-3`], absolute). The routine case.\r\n    BrainOnly,\r\n    /// The broker binary hot-swaps behind the versioned IPC (held-resource type\r\n    /// unchanged); endpoints survive. Apply path deferred (no spike — ADR-0004 §A).\r\n    BrokerCompatible,\r\n    /// Held-resource-type / OS-API change; a planned endpoint-cycle is required\r\n    /// and endpoints MAY suspend with consent + scheduling. [`REQ-UPD-3`] weakened.\r\n    BrokerBreaking,\r\n}\r\n\r\n/// Classify a candidate release against the running broker (ADR-0004 §A).\r\n///\r\n/// The decision is purely the two ADR axes:\r\n/// 1. **held-resource ABI** — if the release's broker implements a *different*\r\n///    `resource_abi`, the held-resource type changed: **broker-breaking**,\r\n///    regardless of IPC (a planned endpoint-cycle is unavoidable).\r\n/// 2. **IPC hostability** — with the resource type unchanged, ask whether the\r\n///    *running* broker can host the release's brain. If the brain's IPC version\r\n///    is at or above the running broker's floor, the handshake accepts it and\r\n///    only logic swaps: **brain-only**. Otherwise the broker must move to a build\r\n///    that speaks the new IPC — but since the resource type is unchanged the new\r\n///    broker adopts the existing handles: **broker-compatible**.\r\n// [impl->REQ-UPD-3]\r\npub fn classify(running: &BrokerAbi, release: &ReleaseSpec) -> UpdateClass {\r\n    if release.broker_resource_abi != running.resource_abi {\r\n        return UpdateClass::BrokerBreaking;\r\n    }\r\n    if release.brain_ipc_version >= running.min_compatible {\r\n        UpdateClass::BrainOnly\r\n    } else {\r\n        UpdateClass::BrokerCompatible\r\n    }\r\n}\r\n\r\n/// A classified update: the class plus the release that produced it. Built by\r\n/// [`plan_update`] so the class is always derived from the same `(running,\r\n/// release)` pair the apply step will act on.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct UpdatePlan {\r\n    /// The update class (ADR-0004 §A).\r\n    pub class: UpdateClass,\r\n    /// The release the plan was built for.\r\n    pub release: ReleaseSpec,\r\n}\r\n\r\n/// Classify `release` against `running` and bundle the verdict with it.\r\npub fn plan_update(running: &BrokerAbi, release: ReleaseSpec) -> UpdatePlan {\r\n    UpdatePlan {\r\n        class: classify(running, &release),\r\n        release,\r\n    }\r\n}\r\n\r\n/// The verify-before-handoff gate (C1): authenticate a signed release + confirm\r\n/// the binary bytes, then — and only then — classify it into an [`UpdatePlan`].\r\n///\r\n/// This is the **front door** of an update: ADR-0004 §D makes signing mandatory,\r","truncated":true,"truncatedBy":"lines","totalLines":493,"totalBytes":5295,"outputLines":113,"outputBytes":5295,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":528,"displayContent":{"text":"\r\n/// The held-resource-type ABI of this build's broker — the broker-breaking axis\r\n/// (ADR-0004 §A/§B). Bumped **only** when the *kind* of resource the broker holds\r\n/// changes: a new held-resource type, or a new OS PTY/socket API that changes how\r\n/// an existing handle is carried. A pure logic change (the routine update) never\r\n/// touches this — that is precisely what keeps the routine case *brain-only*.\r\npub const BROKER_RESOURCE_ABI: u32 = 1;\r\n\r\n/// What the currently-running broker provides — the fixed point an incoming\r\n/// release is classified against (ADR-0004 §A). Captured from the live broker,\r\n/// not from this build, because the whole point of a self-update is that the\r\n/// *running* broker may be older than the binary proposing the update.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct BrokerAbi {\r\n    /// The IPC protocol version the running broker speaks.\r\n    pub ipc_version: u32,\r\n    /// The oldest brain IPC version the running broker will handshake\r\n    /// (`accept_hello`'s floor). A release brain at or above this can attach to\r\n    /// the running broker as-is.\r\n    pub min_compatible: u32,\r\n    /// The held-resource-type ABI tag ([`BROKER_RESOURCE_ABI`]) — the\r\n    /// broker-breaking axis.\r\n    pub resource_abi: u32,\r\n}\r\n\r\nimpl BrokerAbi {\r\n    /// The ABI of *this* build's broker. In the live daemon the running broker's\r\n    /// ABI is read off the broker over the IPC; this is the value a broker built\r\n    /// from this source reports (and the classifier's stand-in when the running\r\n    /// broker is this same build).\r\n    pub fn current() -> Self {\r\n        BrokerAbi {\r\n            ipc_version: IPC_PROTOCOL_VERSION,\r\n            min_compatible: MIN_COMPATIBLE_VERSION,\r\n            resource_abi: BROKER_RESOURCE_ABI,\r\n        }\r\n    }\r\n}\r\n\r\n/// What a candidate release declares about its broker/brain — the subset the\r\n/// classifier needs (C1 adds version + signature + expiry). Forward-compatible\r\n/// by intent: only the two ADR-0004 §A axes live here.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct ReleaseSpec {\r\n    /// The IPC protocol version the release's **brain** speaks.\r\n    pub brain_ipc_version: u32,\r\n    /// The held-resource-type ABI the release's **broker** implements — compared\r\n    /// against the running broker's [`BrokerAbi::resource_abi`] to detect a\r\n    /// broker-breaking change.\r\n    pub broker_resource_abi: u32,\r\n}\r\n\r\n/// The three update classes (ADR-0004 §A), each routed to its own invariant.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub enum UpdateClass {\r\n    /// Swap logic only; the running broker hosts the new brain unchanged. No\r\n    /// endpoint terminates ([`REQ-UPD-3`], absolute). The routine case.\r\n    BrainOnly,\r\n    /// The broker binary hot-swaps behind the versioned IPC (held-resource type\r\n    /// unchanged); endpoints survive. Apply path deferred (no spike — ADR-0004 §A).\r\n    BrokerCompatible,\r\n    /// Held-resource-type / OS-API change; a planned endpoint-cycle is required\r\n    /// and endpoints MAY suspend with consent + scheduling. [`REQ-UPD-3`] weakened.\r\n    BrokerBreaking,\r\n}\r\n\r\n/// Classify a candidate release against the running broker (ADR-0004 §A).\r\n///\r\n/// The decision is purely the two ADR axes:\r\n/// 1. **held-resource ABI** — if the release's broker implements a *different*\r\n///    `resource_abi`, the held-resource type changed: **broker-breaking**,\r\n///    regardless of IPC (a planned endpoint-cycle is unavoidable).\r\n/// 2. **IPC hostability** — with the resource type unchanged, ask whether the\r\n///    *running* broker can host the release's brain. If the brain's IPC version\r\n///    is at or above the running broker's floor, the handshake accepts it and\r\n///    only logic swaps: **brain-only**. Otherwise the broker must move to a build\r\n///    that speaks the new IPC — but since the resource type is unchanged the new\r\n///    broker adopts the existing handles: **broker-compatible**.\r\n// [impl->REQ-UPD-3]\r\npub fn classify(running: &BrokerAbi, release: &ReleaseSpec) -> UpdateClass {\r\n    if release.broker_resource_abi != running.resource_abi {\r\n        return UpdateClass::BrokerBreaking;\r\n    }\r\n    if release.brain_ipc_version >= running.min_compatible {\r\n        UpdateClass::BrainOnly\r\n    } else {\r\n        UpdateClass::BrokerCompatible\r\n    }\r\n}\r\n\r\n/// A classified update: the class plus the release that produced it. Built by\r\n/// [`plan_update`] so the class is always derived from the same `(running,\r\n/// release)` pair the apply step will act on.\r\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\r\npub struct UpdatePlan {\r\n    /// The update class (ADR-0004 §A).\r\n    pub class: UpdateClass,\r\n    /// The release the plan was built for.\r\n    pub release: ReleaseSpec,\r\n}\r\n\r\n/// Classify `release` against `running` and bundle the verdict with it.\r\npub fn plan_update(running: &BrokerAbi, release: ReleaseSpec) -> UpdatePlan {\r\n    UpdatePlan {\r\n        class: classify(running, &release),\r\n        release,\r\n    }\r\n}\r\n\r\n/// The verify-before-handoff gate (C1): authenticate a signed release + confirm\r\n/// the binary bytes, then — and only then — classify it into an [`UpdatePlan`].\r\n///\r\n/// This is the **front door** of an update: ADR-0004 §D makes signing mandatory,\r","startLine":36,"lineNumbers":[36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148]},"fileSize":22801,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\update.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":528,"totalBytes":5295,"outputLines":113,"outputBytes":5295,"shownRange":{"start":36,"end":148},"nextOffset":149}}},"isError":false,"timestamp":1789522829025}}
{"type":"message","id":"8c9e7ee7","parentId":"a7660e15","timestamp":"2026-09-16T01:40:29.174Z","message":{"role":"toolResult","toolCallId":"call_bWmJhYmH0CCTNfDbbWbHERXq|fc_0bac546ce171b754016aa9f38cf1dc87d1883281b4748af45b","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## release.rs\n 324|// [impl->REQ-REL-3]\n*325|pub const BUILTIN_RELEASE_KEYS: &[(&str, &str)] = &[\n 326|    (\n 327|        \"rel-primary-2026\",\n 328|        \"54188f127f9c361090c90f85ac072e623d7001b311d25eca0dd5f57ad05e3ec9\",\n...\n 370|    ///\n*371|    /// The policy starts from [`BUILTIN_RELEASE_KEYS`] (the ADR-0015 trust\n 372|    /// anchor every binary carries), then the file overlays it: file keys\n 373|    /// add (and may shadow a builtin id), file revocations void builtin ids\n 374|    /// too. A missing/malformed file leaves exactly the builtin set.\n...\n 376|    // [impl->REQ-REL-3]\n*377|    pub fn load_from(path: &std::path::Path, current_version: u64, now_ms: u64) -> VerifyPolicy {\n 378|        let file: ReleaseKeysFile = std::fs::read_to_string(path)\n 379|            .ok()\n 380|            .and_then(|raw| serde_json::from_str(&raw).ok())\n 381|            .unwrap_or_default();\n*382|        Self::assemble(BUILTIN_RELEASE_KEYS, &file, current_version, now_ms)\n 383|    }\n 384|\n 385|    /// Merge mechanics, separated for testability with injected builtin\n...\n 699|\n*700|/// Lowercase-hex SHA-256 of `bytes` — the artifact-digest format used in\n 701|/// [`ReleaseMetadata::artifact_sha256`].\n 702|pub fn sha256_hex(bytes: &[u8]) -> String {\n 703|    let mut hasher = Sha256::new();\n...\n 946|    // bad hex skipped, channel pinned. Since M6-D6 a missing file no longer\n*947|    // means an empty set — every binary carries BUILTIN_RELEASE_KEYS (the\n 948|    // ADR-0015 anchor), and the file is a pure overlay on top of it.\n 949|    #[test]\n 950|    fn production_policy_loads_fail_closed() {\n...\n 955|        let p = VerifyPolicy::load_from(&path, 3, 1_000);\n*956|        assert_eq!(p.trusted_keys.len(), BUILTIN_RELEASE_KEYS.len());\n*957|        for (key_id, _) in BUILTIN_RELEASE_KEYS {\n 958|            assert!(\n 959|                p.trusted_keys.contains_key(*key_id),\n 960|                \"builtin {key_id} trusted\"\n...\n 977|            p.trusted_keys.len(),\n*978|            BUILTIN_RELEASE_KEYS.len() + 1,\n 979|            \"bad hex skipped, good key added to the builtin set\"\n 980|        );\n 981|        assert!(p.trusted_keys.contains_key(\"good\"));\n...\n 989|            VerifyPolicy::load_from(&path, 0, 0).trusted_keys.len(),\n*990|            BUILTIN_RELEASE_KEYS.len()\n 991|        );\n 992|    }\n 993|\n...\n 1274|\n*1275|        // The revoked BUILTIN primary is rejected even with a valid signature…\n 1276|        let mut meta = meta_for(6, b\"bin\");\n 1277|        meta.key_id = \"rel-primary\".to_string();\n 1278|        let signed = sign_release(&primary, &meta);\n...\n 1301|    fn shipped_builtin_table_is_well_formed() {\n*1302|        for (key_id, hex) in BUILTIN_RELEASE_KEYS {\n 1303|            parse_verifying_key(hex)\n 1304|                .unwrap_or_else(|e| panic!(\"builtin release key {key_id:?} invalid: {e}\"));\n 1305|            assert!(!key_id.trim().is_empty());\n## brainproc.rs\n 1213|            let which = if expected.is_none() {\n*1214|                \"artifact-hash-absent\"\n 1215|            } else {\n 1216|                \"ready-hash-absent\"\n 1217|            };\n\nSkipped missing paths: crates/spt-daemon/src/releasecache.rs"}],"details":{"scopePath":"crates/spt-daemon/src/release.rs, crates/spt-proto/src, crates/spt-daemon/src/brainproc.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":13,"fileCount":2,"files":["crates/spt-daemon/src/release.rs","crates/spt-daemon/src/brainproc.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/release.rs","count":12},{"path":"crates/spt-daemon/src/brainproc.rs","count":1}],"truncated":false,"displayContent":"# crates/spt-daemon/src/\n## release.rs\n  324│// [impl->REQ-REL-3]\n *325│pub const BUILTIN_RELEASE_KEYS: &[(&str, &str)] = &[\n  326│    (\n  327│        \"rel-primary-2026\",\n  328│        \"54188f127f9c361090c90f85ac072e623d7001b311d25eca0dd5f57ad05e3ec9\",\n     │...\n  370│    ///\n *371│    /// The policy starts from [`BUILTIN_RELEASE_KEYS`] (the ADR-0015 trust\n  372│    /// anchor every binary carries), then the file overlays it: file keys\n  373│    /// add (and may shadow a builtin id), file revocations void builtin ids\n  374│    /// too. A missing/malformed file leaves exactly the builtin set.\n     │...\n  376│    // [impl->REQ-REL-3]\n *377│    pub fn load_from(path: &std::path::Path, current_version: u64, now_ms: u64) -> VerifyPolicy {\n  378│        let file: ReleaseKeysFile = std::fs::read_to_string(path)\n  379│            .ok()\n  380│            .and_then(|raw| serde_json::from_str(&raw).ok())\n  381│            .unwrap_or_default();\n *382│        Self::assemble(BUILTIN_RELEASE_KEYS, &file, current_version, now_ms)\n  383│    }\n  384│\n  385│    /// Merge mechanics, separated for testability with injected builtin\n     │...\n  699│\n *700│/// Lowercase-hex SHA-256 of `bytes` — the artifact-digest format used in\n  701│/// [`ReleaseMetadata::artifact_sha256`].\n  702│pub fn sha256_hex(bytes: &[u8]) -> String {\n  703│    let mut hasher = Sha256::new();\n     │...\n  946│    // bad hex skipped, channel pinned. Since M6-D6 a missing file no longer\n *947│    // means an empty set — every binary carries BUILTIN_RELEASE_KEYS (the\n  948│    // ADR-0015 anchor), and the file is a pure overlay on top of it.\n  949│    #[test]\n  950│    fn production_policy_loads_fail_closed() {\n     │...\n  955│        let p = VerifyPolicy::load_from(&path, 3, 1_000);\n *956│        assert_eq!(p.trusted_keys.len(), BUILTIN_RELEASE_KEYS.len());\n *957│        for (key_id, _) in BUILTIN_RELEASE_KEYS {\n  958│            assert!(\n  959│                p.trusted_keys.contains_key(*key_id),\n  960│                \"builtin {key_id} trusted\"\n     │...\n  977│            p.trusted_keys.len(),\n *978│            BUILTIN_RELEASE_KEYS.len() + 1,\n  979│            \"bad hex skipped, good key added to the builtin set\"\n  980│        );\n  981│        assert!(p.trusted_keys.contains_key(\"good\"));\n     │...\n  989│            VerifyPolicy::load_from(&path, 0, 0).trusted_keys.len(),\n *990│            BUILTIN_RELEASE_KEYS.len()\n  991│        );\n  992│    }\n  993│\n     │...\n 1274│\n*1275│        // The revoked BUILTIN primary is rejected even with a valid signature…\n 1276│        let mut meta = meta_for(6, b\"bin\");\n 1277│        meta.key_id = \"rel-primary\".to_string();\n 1278│        let signed = sign_release(&primary, &meta);\n     │...\n 1301│    fn shipped_builtin_table_is_well_formed() {\n*1302│        for (key_id, hex) in BUILTIN_RELEASE_KEYS {\n 1303│            parse_verifying_key(hex)\n 1304│                .unwrap_or_else(|e| panic!(\"builtin release key {key_id:?} invalid: {e}\"));\n 1305│            assert!(!key_id.trim().is_empty());\n## brainproc.rs\n 1213│            let which = if expected.is_none() {\n*1214│                \"artifact-hash-absent\"\n 1215│            } else {\n 1216│                \"ready-hash-absent\"\n 1217│            };","missingPaths":["crates/spt-daemon/src/releasecache.rs"]},"isError":false,"timestamp":1789522829174}}
{"type":"message","id":"d315a175","parentId":"8c9e7ee7","timestamp":"2026-09-16T01:40:29.325Z","message":{"role":"toolResult","toolCallId":"call_XcHY9iq4xjdlFfNZ8AzlrBM2|fc_0bac546ce171b754016aa9f38cf1e887d1a91ecee7a35fb1c3","toolName":"glob","content":[{"type":"text","text":"# .spt/preserved/\n## hertz-ir137-caller-return/\nlaunch.ps1\n### hidden/\nlaunch.json\n### redirected-v2/\nlaunch.json\n### redirected/\nlaunch.json\n## deployah-304-s5-intake/\nsign-linux-admission.json\nsign-windows-admission.json\n## deployah-304-final-intake/\nlaunch-admission.json\n## 304-handoff/\n### consumer-windows-S3/\ns3-daemon-v2r-launch.txt\ns3-daemon-v2-launcher.out.txt\ns3-daemon-v2-launch.txt\ns3-daemon-v2-launcher.err.txt\ns3-daemon-launcher.out.txt\ns3-daemon-launch.txt\ns3-daemon-launcher.err.txt\n### successor-linux-daemon/\ns3-prelaunch-census.json\n#### corrected-workspace/\nprelaunch-census.json\n### consumer-linux-7890ead3/golden-env-values/\nlaunch-linux.py\n## hertz-fp-driver-review/d2/\n### window7-2PEMLAIQ/control-A2-QWHXWYUH/driver-launch/\n### field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/\nlaunch-coverage.json\nlaunch-records.jsonl\nlaunched-identities.txt\nlaunch-index.jsonl\n.launch-rec.19.json\n.launch-rec.19.json.events.jsonl\n.launch-log.19\n.launch-args.19.json\n.launch-rec.18.json\n.launch-rec.18.json.events.jsonl\n.launch-log.18\n.launch-args.18.json\n.launch-rec.17.json\n.launch-rec.17.json.events.jsonl\n.launch-log.17\n.launch-args.17.json\n.launch-rec.16.json\n.launch-rec.16.json.events.jsonl\n.launch-log.16\n.launch-args.16.json\n.launch-rec.15.json\n.launch-rec.15.json.events.jsonl\n.launch-log.15\n.launch-args.15.json\n.launch-rec.14.json\n.launch-rec.14.json.events.jsonl\n.launch-log.14\n.launch-args.14.json\n.launch-rec.13.json\n.launch-rec.13.json.events.jsonl\n.launch-log.13\n.launch-args.13.json\n.launch-rec.12.json\n.launch-rec.12.json.events.jsonl\n.launch-log.12\n.launch-args.12.json\n.launch-rec.11.json\n.launch-rec.11.json.events.jsonl\n.launch-log.11\n.launch-args.11.json\n.launch-rec.10.json\n.launch-rec.10.json.events.jsonl\n.launch-log.10\n.launch-args.10.json\n.launch-rec.9.json\n.launch-rec.9.json.events.jsonl\n.launch-log.9\n\n[65 results limit reached. Use limit=130 for more]"}],"details":{"scopePath":".spt/preserved/**/*sign*, .spt/preserved/**/*launch*, .spt/preserved/**/staged-r8-cleanup-exit.sh, .spt/preserved/**/*rig*.py, .spt/preserved/**/*rig*.ps1","fileCount":65,"files":[".spt/preserved/hertz-ir137-caller-return/hidden/launch.json",".spt/preserved/hertz-ir137-caller-return/redirected-v2/launch.json",".spt/preserved/hertz-ir137-caller-return/launch.ps1",".spt/preserved/hertz-ir137-caller-return/redirected/launch.json",".spt/preserved/deployah-304-s5-intake/sign-linux-admission.json",".spt/preserved/deployah-304-s5-intake/sign-windows-admission.json",".spt/preserved/deployah-304-final-intake/launch-admission.json",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-v2r-launch.txt",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-v2-launcher.out.txt",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-v2-launch.txt",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-v2-launcher.err.txt",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-launcher.out.txt",".spt/preserved/304-handoff/successor-linux-daemon/corrected-workspace/prelaunch-census.json",".spt/preserved/304-handoff/successor-linux-daemon/s3-prelaunch-census.json",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-launch.txt",".spt/preserved/304-handoff/consumer-windows-S3/s3-daemon-launcher.err.txt",".spt/preserved/304-handoff/consumer-linux-7890ead3/golden-env-values/launch-linux.py",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/control-A2-QWHXWYUH/driver-launch/",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/launch-coverage.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/launch-records.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/launched-identities.txt",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/launch-index.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.19.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.19.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.19",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.19.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.18.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.18.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.18",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.18.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.17.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.17.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.17",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.17.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.16.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.16.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.16",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.16.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.15.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.15.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.15",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.15.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.14.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.14.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.14",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.14.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.13.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.13.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.13",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.13.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.12.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.12.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.12",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.12.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.11.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.11.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.11",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.11.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.10.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.10.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.10",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-args.10.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.9.json",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-rec.9.json.events.jsonl",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-run/20260914T160645Z/.launch-log.9"],"truncated":true,"resultLimitReached":65,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","meta":{"limits":{"resultLimit":{"reached":65,"suggestion":130}}}},"isError":false,"timestamp":1789522829325}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_p4QOZKX632szHyfLrG2IwpI5|fc_0bac546ce171b754016aa9f396149087d1bbe9ef70573a3e6e","toolName":"glob","startedAt":"2026-09-16T01:40:38.587Z","args":{"path":".spt/preserved/hertz-fp-driver-review/**/*.py;.spt/preserved/hertz-fp-driver-review/**/*.sh;.spt/preserved/304-handoff/**/*.py;crates/spt-daemon/src/*cache*"},"intent":"Finding retained launcher helpers"},"id":"9cb20abf","parentId":"d315a175","timestamp":"2026-09-16T01:40:38.587Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_sZh1MeYNAXepMjszfnZ3J2m6|fc_0bac546ce171b754016aa9f39614a487d1a0994b40b254d74b","toolName":"grep","startedAt":"2026-09-16T01:40:38.587Z","args":{"path":"crates/spt-daemon/src/brainproc.rs;crates/spt-ipc;crates/spt-daemon/src"},"intent":"Locating protocol and trial tests"},"id":"c116cc84","parentId":"9cb20abf","timestamp":"2026-09-16T01:40:38.587Z"}
{"type":"message","id":"80f2bfa9","parentId":"c116cc84","timestamp":"2026-09-16T01:40:38.587Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_p4QOZKX632szHyfLrG2IwpI5|fc_0bac546ce171b754016aa9f396149087d1bbe9ef70573a3e6e","name":"glob","arguments":{"i":"Finding retained launcher helpers","path":".spt/preserved/hertz-fp-driver-review/**/*.py;.spt/preserved/hertz-fp-driver-review/**/*.sh;.spt/preserved/304-handoff/**/*.py;crates/spt-daemon/src/*cache*","hidden":true,"gitignore":false,"limit":80},"intent":"Finding retained launcher helpers"},{"type":"toolCall","id":"call_sZh1MeYNAXepMjszfnZ3J2m6|fc_0bac546ce171b754016aa9f39614a487d1a0994b40b254d74b","name":"grep","arguments":{"i":"Locating protocol and trial tests","pattern":"pub const (IPC_PROTOCOL_VERSION|MIN_COMPATIBLE_VERSION)|fn .*trial|fn .*drain|fn .*promot|BRAIN_PROMOTED|BRAIN_ROLL|brain.ready|applied-state","path":"crates/spt-daemon/src/brainproc.rs;crates/spt-ipc;crates/spt-daemon/src","case":true,"gitignore":true,"skip":0},"intent":"Locating protocol and trial tests"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":4463,"output":208,"cacheRead":31488,"cacheWrite":0,"totalTokens":36159,"cost":{"input":0.04463,"output":0.010400000000000001,"cacheRead":0.031487999999999995,"cacheWrite":0,"total":0.086518}},"stopReason":"toolUse","timestamp":1789522829351,"responseId":"resp_0bac546ce171b754016aa9f38da20487d1ab3343ab016993fa","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f396149087d1bbe9ef70573a3e6e","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding retained launcher helpers\",\"path\":\".spt/preserved/hertz-fp-driver-review/**/*.py;.spt/preserved/hertz-fp-driver-review/**/*.sh;.spt/preserved/304-handoff/**/*.py;crates/spt-daemon/src/*cache*\",\"hidden\":true,\"gitignore\":false,\"limit\":80}","call_id":"call_p4QOZKX632szHyfLrG2IwpI5","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"glob","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f39614a487d1a0994b40b254d74b","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating protocol and trial tests\",\"pattern\":\"pub const (IPC_PROTOCOL_VERSION|MIN_COMPATIBLE_VERSION)|fn .*trial|fn .*drain|fn .*promot|BRAIN_PROMOTED|BRAIN_ROLL|brain.ready|applied-state\",\"path\":\"crates/spt-daemon/src/brainproc.rs;crates/spt-ipc;crates/spt-daemon/src\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_sZh1MeYNAXepMjszfnZ3J2m6","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":9234.068100000033,"ttft":9185.04879999999,"completedAt":1789522838586,"contextSnapshot":{"promptTokens":35951,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"20253c3a","parentId":"80f2bfa9","timestamp":"2026-09-16T01:40:38.618Z","message":{"role":"toolResult","toolCallId":"call_sZh1MeYNAXepMjszfnZ3J2m6|fc_0bac546ce171b754016aa9f39614a487d1a0994b40b254d74b","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## brainproc.rs\n 33|use crate::brain::{now_ms, Brain};\n*34|use crate::endpoint::{brain_ready_path, broker_socket_name};\n 35|use crate::relcache::{AppliedRecord, ReleaseCache};\n 36|\n 37|/// Supervisor backoff floor after a brain death (mirrors the peer-pump\n...\n 225|    // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*226|    // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n 227|    // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n 228|    // paid for that twice: four cells burned a full 30s readiness budget while\n 229|    // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n...\n 318|        ready_cost.hash_computed,\n*319|        brain_ready_path().display()\n 320|    );\n 321|\n 322|    // Shell wake-watchers (restoration D2-2): the offline half of the shell\n...\n 496|    }\n*497|    let _ = spt_store::atomic::atomic_write_string(&brain_ready_path(), &obj.to_string());\n 498|    cost\n 499|}\n 500|\n...\n 542|\n*543|/// Parse the `generation` stamp out of a `brain.ready` body — pure, so the\n 544|/// staleness gate (D6-2) is unit-tested with explicit values, no wall-clock or\n 545|/// real process. `None` for an absent/garbled/legacy-bare-pid body (the gate\n 546|/// reads that as not-ready — fail-safe). Restoration D6-1b.\n...\n 554|\n*555|/// Parse the `exe_hash` breadcrumb out of a `brain.ready` body — pure (D7-1).\n 556|/// `None` for an absent field / garbled body (a legacy N-1 stamp carries none, so\n 557|/// `None` is the N-1-readable answer, not an error). The D7-1 survival E2E reads\n 558|/// this to prove a respawn ran the swapped binary's bytes.\n...\n 567|\n*568|/// Read the current `brain.ready` generation stamp from `path`, `None` if the\n 569|/// file is absent or its body has no parseable generation (fail-safe to\n 570|/// not-ready). The supervisor's \"is generation N ready?\" gate (D6-2) reads\n*571|/// [`brain_ready_path`]; the path is a parameter here so the unit harness points\n 572|/// it at a temp file. Restoration D6-1b.\n 573|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 574|pub fn ready_generation_at(path: &std::path::Path) -> Option<u64> {\n...\n 604|    fn applied_state(&self) -> Option<AppliedRecord>;\n*605|    /// The generation stamped in `brain.ready`, or `None` if absent/garbled\n 606|    /// (the readiness gate reads `None` as not-ready — fail-safe).\n 607|    fn ready_generation(&self) -> Option<u64>;\n*608|    /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609|    /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610|    /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611|    /// trial and falsely promote a brain that never booted).\n...\n 616|    /// write — promotion is the *real* moment the new code is accepted).\n*617|    fn record_promoted(&self, version: u64);\n 618|    /// Correct the record: the candidate failed readiness. Persist\n 619|    /// `RolledBack{…}` and fire the loud, resurfacing rollback notif.\n 620|    fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n*621|    /// The `exe_hash` the candidate stamped in `brain.ready` (the bytes it is\n 622|    /// actually running), or `None` if absent/garbled — degrades the promotion\n 623|    /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n 624|    fn ready_exe_hash(&self) -> Option<String>;\n...\n 632|    /// brain round-trip): the supervisor promotes a ready candidate only once this is\n*633|    /// `true`, so `brain.ready` arriving inside the W2 `BRAIN_WRITE_DEADLINE` window\n 634|    /// can no longer promote onto a still-frozen control plane (the 22:47 false-\n 635|    /// promote). Fail-safe toward DRAINED (`true`) where there is nothing to read — a\n 636|    /// net-less broker, no hosted sessions, or [`NoTrialEnv`] — so the gate never\n 637|    /// strands an apply where no old-gen control plane exists.\n*638|    fn old_gen_drained(&self) -> bool;\n 639|}\n 640|\n 641|/// The no-trial environment: every probe degrades to \"nothing pending / not\n...\n 653|    fn clear_ready(&self) {}\n*654|    fn record_promoted(&self, _version: u64) {}\n 655|    fn record_rolled_back(&self, _q: u64, _r: u64, _bin: &str) {}\n 656|    fn ready_exe_hash(&self) -> Option<String> {\n 657|        None\n...\n 661|    }\n*662|    fn old_gen_drained(&self) -> bool {\n 663|        // No readiness gate to drive here → no old-gen control plane to drain; the\n 664|        // no-op env promotes exactly as the pre-D6 respawn loop (mirrors its other\n 665|        // no-op effects).\n...\n 670|/// Production [`TrialEnv`]: reads/writes the canonical `spt_home` durable files\n*671|/// (the `releases` relcache + the `brain.ready` breadcrumb) and fires the\n 672|/// rollback notif through the real producer front door. Constructed in the\n 673|/// broker process where `spt_home()` is stable.\n 674|///\n...\n 694|    fn ready_generation(&self) -> Option<u64> {\n*695|        ready_generation_at(&brain_ready_path())\n 696|    }\n 697|    fn clear_ready(&self) {\n*698|        let _ = std::fs::remove_file(brain_ready_path());\n 699|    }\n*700|    fn record_promoted(&self, version: u64) {\n 701|        let cache = self.cache();\n 702|        let _ = cache.record_applied_state(&AppliedRecord::Applied { version });\n 703|        // The legacy convergence records (M8 `xtask debug-converge`) are written\n## broker.rs\n 5996|    /// generation whose local controller conn is black-holed reads wedged until the W2\n*5997|    /// stall-evict releases it, so `brain.ready` inside the 15 s window can no longer\n 5998|    /// promote onto a still-frozen control plane (the 22:47 false-promote). A cleanly-\n 5999|    /// closed old conn is simply absent → `false` at once (the normal fast promote).\n 6000|    /// Follows the established sessions→log lock order (KIND_SESSIONS reap); reads\n...\n 11191|    #[test]\n*11192|    fn a_full_controller_does_not_starve_a_viewer_or_block_the_drain() {\n 11193|        let mut log = OutputLog::new(1, 1024, String::new(), (24, 80));\n 11194|        log.controller_epoch.store(9, Ordering::Release);\n 11195|        // A CONTROLLER whose 2-slot channel we NEVER drain (rx held, unread) — a\n...\n 11472|    #[test]\n*11473|    fn input_enqueue_drops_and_stamps_on_full_then_heals_on_drain() {\n 11474|        const DEPTH: usize = 3;\n 11475|        // Consumer is the test; it does NOT drain until we say so → the queue fills.\n 11476|        let (w, rx) = test_input_writer(DEPTH);\n...\n 12587|    /// (no per-read deadline: Windows named pipes reject I/O timeouts).\n*12588|    fn drain_output_seqs(client: &mut Stream, n: usize) -> Vec<u64> {\n 12589|        let mut seqs = Vec::with_capacity(n);\n 12590|        while seqs.len() < n {\n 12591|            let env = read_frame(client).expect(\"output frame on the wire\");\n## daemon.rs\n 1968|/// the real per-rung launchers and log which rung won. The caller still confirms\n*1969|/// readiness via the existing `brain.ready` poll — the returned pid is for\n 1970|/// logging/return, not readiness (WMI/schtasks pids are the launcher's view).\n 1971|// [impl->REQ-HAZARD-VIEWER-CLOSE-DETACH]\n 1972|#[cfg(windows)]\n...\n 2224|/// is recoverable from schtasks → returns a sentinel; readiness is the caller's\n*2225|/// `brain.ready` poll. This is the FALLBACK rung (WMI is primary); its `/tr`\n 2226|/// quoting is best-effort.\n 2227|// [impl->REQ-HAZARD-VIEWER-CLOSE-DETACH]\n 2228|#[cfg(windows)]\n...\n 2264|    }\n*2265|    // No pid from schtasks; sentinel — readiness is the brain.ready poll.\n 2266|    Ok(0)\n 2267|}\n 2268|\n## endpoint.rs\n 84|\n*85|/// The brain child's readiness breadcrumb: `<spt_home>/brain.ready` (the brain\n 86|/// child's pid, rewritten each heartbeat). The broker spawns the brain as a\n 87|/// supervised child process (ADR-0018 Q2/Q3 — the two-process restoration); the\n 88|/// child writes this once it has connected to the broker socket, and refreshes\n...\n 93|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*94|pub fn brain_ready_path() -> PathBuf {\n*95|    spt_home().join(\"brain.ready\")\n 96|}\n 97|\n 98|/// Where the peer pump records its last-tick heartbeat (epoch ms, M8\n## frame.rs\n 26|/// Additive changes — new `kind`s, new optional fields — do **not** bump this.\n*27|pub const IPC_PROTOCOL_VERSION: u32 = 1;\n 28|\n 29|/// The oldest peer `protocol_version` this build will still handshake with.\n 30|/// Held at `1` for v1; raised only when an old version is genuinely retired.\n*31|pub const MIN_COMPATIBLE_VERSION: u32 = 1;\n 32|\n 33|/// Which side of the IPC a connecting peer is. The broker is the stable kernel;\n 34|/// the brain is the restartable logic layer (ADR-0004).\n## inject.rs\n 127|// [impl->REQ-HAZARD-DELIVERY-STARVATION]\n*128|pub fn drain_idle_spool(id: &str, owlery: &Path) -> usize {\n 129|    drain_spool_offering(id, owlery, false)\n 130|}\n 131|\n...\n 147|// [impl->REQ-IDLE-PARKED-DELIVERY]\n*148|pub fn drain_spool_native(id: &str, owlery: &Path) -> usize {\n 149|    drain_spool_offering(id, owlery, true)\n 150|}\n 151|\n...\n 154|/// renderer are identical, which is what keeps the two arms from drifting.\n*155|fn drain_spool_offering(id: &str, owlery: &Path, native: bool) -> usize {\n 156|    if !is_spt_hosted_no_relay(id, owlery) {\n 157|        return 0;\n 158|    }\n## nethost.rs\n 508|    /// pending yet.\n*509|    fn drain(&mut self) -> (Vec<u8>, bool) {\n 510|        let mut out = Vec::new();\n 511|        while let Some((_, chunk)) = self.ring.pop_front() {\n 512|            out.extend_from_slice(&chunk);\n...\n 2104|    // [impl->REQ-SHELL-4]\n*2105|    pub fn drain_stream(&self, stream_id: u64) -> Option<(Vec<u8>, bool)> {\n 2106|        let entry = Arc::clone(self.shared.streams.lock().unwrap().get(&stream_id)?);\n 2107|        let drained = entry.log.lock().unwrap().drain();\n 2108|        // The drain freed ring room — wake a pump that was backpressure-parked.\n...\n 2993|    #[test]\n*2994|    fn begin_attach_refuses_only_while_a_poisoned_prior_still_drains() {\n 2995|        let (a, _ca, _ra) = seat_socket_pair(Duration::from_secs(5));\n 2996|        let (b, _cb, _rb) = seat_socket_pair(Duration::from_secs(5));\n 2997|        let mut log = StreamLog::new(3, 64);\n## relay.rs\n 62|    /// killed one left behind. Returns the number of messages forwarded.\n*63|    pub fn drain_backlog<F: FnMut(&str, &str)>(&self, mut sink: F) -> usize {\n 64|        // [impl->REQ-SPOOL-TAKE-AUDIT] relay-backlog leg — stamp who drained the row.\n 65|        let audit =\n 66|            spool::TakerAudit::new(spool::TakerLeg::RelayBacklog, None, Some(std::process::id()));\n...\n 152|    #[test]\n*153|    fn relay_backlog_never_drains_active_only() {\n 154|        with_home(|_| {\n 155|            let perch = perch_for(\"lia\");\n 156|            // default → relay-eligible (idle/wake window); active_only → poll-only.\n## relcache.rs\n 56|\n*57|/// The two-phase applied-state record (ADR-0018 Q7, restoration D6). The legacy\n 58|/// `applied.json` + `last-outcome.json` are written *optimistically* at the\n 59|/// moment of binary swap — before the new brain has even booted (the\n 60|/// `applied.json={version:6}` observed on `enlyzeam` while the box still ran the\n...\n 76|///\n*77|/// Stored as `applied-state.json`, atomic-write + corrupt/absent-degrades-to-None\n 78|/// (the supervisor reads `None` as \"no pending trial\", never a hard fail — the\n 79|/// same posture as every other durable file here). **Additive durable state**\n 80|/// (restoration D6-3 / KH 6.8): a rolled-back pre-D6 binary does not know this\n...\n 390|    /// (KH 6.11, REQ-HAZARD-BRAIN-RESPAWN-PATH) compares a just-promoted\n*391|    /// candidate's `brain.ready` `exe_hash` against. `None` when nothing is\n 392|    /// staged, the staged version != `version`, the metadata doesn't parse, or\n 393|    /// this platform is absent from a set — every `None` degrades the gate to\n 394|    /// readiness-only (N-1-safe), never a false rejection.\n...\n 469|    fn applied_state_path(&self) -> PathBuf {\n*470|        self.dir.join(\"applied-state.json\")\n 471|    }\n 472|\n 473|    /// Write the two-phase [`AppliedRecord`] (atomic). Best-effort at the call\n...\n 481|\n*482|    /// Read the two-phase applied-state record; `None` when absent or corrupt\n 483|    /// (degrade-to-no-trial — the supervisor treats that as \"no pending trial\",\n 484|    /// never a hard fail). Additive to the legacy `applied.json`/`last-outcome`,\n 485|    /// which keep their own readers.\n...\n 580|\n*581|    // [unit->REQ-UPD-6] The two-phase applied-state record (ADR-0018 Q7,\n 582|    // restoration D6-1) round-trips all three phases through disk; an absent\n 583|    // file degrades to None (no-trial), and a corrupt body degrades to None too\n 584|    // (the supervisor reads that as \"no pending trial\", never a hard fail).\n## rollback_compat.rs\n 43|    // D6-1: the two-phase applied record (`crate::relcache::AppliedRecord`).\n*44|    \"applied-state.json\",\n 45|    // D6-1b + D7-1: the readiness breadcrumb (`{pid, generation, exe_hash}`); the\n 46|    // D7-1 `exe_hash` field is additive (N-1 ignores it) — the tripwire owns it.\n*47|    \"brain.ready\",\n 48|];\n 49|\n 50|#[cfg(test)]\n...\n 105|            PRE_READY_DURABLE_FILES,\n*106|            &[\"deadline-<key>.json\", \"applied-state.json\", \"brain.ready\"],\n 107|            \"the tripwire asserts every file the registry names — keep them in lockstep\"\n 108|        );\n 109|\n...\n 118|\n*119|        // D6-1: applied-state.json (AppliedRecord) — all three phases. The serde\n 120|        // tag (`phase`) and each phase's load-bearing fields are N-1-readable.\n 121|        assert_additive_n1_readable(\n 122|            &AppliedRecord::AppliedPending {\n...\n 139|\n*140|        // D6-1b + D7-1: brain.ready (`{pid, generation, exe_hash}`) — no struct;\n 141|        // assert the shape carries all three fields AND that the production\n 142|        // readers still extract generation + exe_hash when an unknown extra field\n 143|        // is present (additive-tolerant), and that the D7-1 `exe_hash` is itself\n## shellchan.rs\n 320|// [impl->REQ-HAZARD-SHELL-STALE-ONLINE]\n*321|pub fn restamp_for_drain(shell_perch: &Path, current_key: &[u8; 32], body: &str) -> String {\n 322|    if verify_stamped_frame(current_key, body).is_some() {\n 323|        return body.to_string();\n 324|    }\n## translation.rs\n 459|    #[test]\n*460|    fn inject_floor_buffers_while_held_then_drains_in_order() {\n 461|        let mut f = InjectFloor::default();\n 462|        // free floor → input passes through (caller writes), nothing buffered.\n 463|        assert!(!f.buffer_if_held(b\"a\"), \"free floor does not buffer\");\n\n## pump/\n### mod.rs\n 206|// [impl->REQ-PUMP-PEER-ISOLATION]\n*207|fn classify_drain_read(read: io::Result<BrokerEvent>) -> DrainStep {\n 208|    match read {\n 209|        Ok(BrokerEvent::NetPresence(ev)) => DrainStep::Apply(ev),\n 210|        Ok(_) => DrainStep::Skip,\n...\n 2211|    #[test]\n*2212|    fn drain_read_classifies_dead_carrier_as_restart_timeout_as_quiet() {\n 2213|        // A quiet TimedOut closes the round — it is NEVER a restart.\n 2214|        assert!(matches!(\n 2215|            classify_drain_read(Err(io::Error::new(io::ErrorKind::TimedOut, \"read deadline\"))),\n\nSkipped missing paths: crates/spt-ipc"}],"details":{"scopePath":"crates/spt-daemon/src/brainproc.rs, crates/spt-daemon/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":55,"fileCount":13,"files":["crates/spt-daemon/src/brainproc.rs","crates/spt-daemon/src/broker.rs","crates/spt-daemon/src/daemon.rs","crates/spt-daemon/src/endpoint.rs","crates/spt-daemon/src/frame.rs","crates/spt-daemon/src/inject.rs","crates/spt-daemon/src/nethost.rs","crates/spt-daemon/src/pump/mod.rs","crates/spt-daemon/src/relay.rs","crates/spt-daemon/src/relcache.rs","crates/spt-daemon/src/rollback_compat.rs","crates/spt-daemon/src/shellchan.rs","crates/spt-daemon/src/translation.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/brainproc.rs","count":20},{"path":"crates/spt-daemon/src/broker.rs","count":4},{"path":"crates/spt-daemon/src/daemon.rs","count":3},{"path":"crates/spt-daemon/src/endpoint.rs","count":3},{"path":"crates/spt-daemon/src/frame.rs","count":2},{"path":"crates/spt-daemon/src/inject.rs","count":3},{"path":"crates/spt-daemon/src/nethost.rs","count":3},{"path":"crates/spt-daemon/src/pump/mod.rs","count":2},{"path":"crates/spt-daemon/src/relay.rs","count":2},{"path":"crates/spt-daemon/src/relcache.rs","count":6},{"path":"crates/spt-daemon/src/rollback_compat.rs","count":5},{"path":"crates/spt-daemon/src/shellchan.rs","count":1},{"path":"crates/spt-daemon/src/translation.rs","count":1}],"truncated":true,"perFileLimitReached":20,"displayContent":"# crates/spt-daemon/src/\n## brainproc.rs\n  33│use crate::brain::{now_ms, Brain};\n *34│use crate::endpoint::{brain_ready_path, broker_socket_name};\n  35│use crate::relcache::{AppliedRecord, ReleaseCache};\n  36│\n  37│/// Supervisor backoff floor after a brain death (mirrors the peer-pump\n    │...\n 225│    // [impl->REQ-UPDATE-RUNNING-IMAGE-SURFACE]\n*226│    // [impl->REQ-BRAIN-READY-WINDOW-OBSERVABLE] The BRAIN_UP -> brain.ready\n 227│    // window used to be SILENT on every happy-path stretch, and RCA-242-R2-LINUX\n 228│    // paid for that twice: four cells burned a full 30s readiness budget while\n 229│    // their daemon stderr showed `BRAIN_UP` at 26-65ms, and the stall point\n    │...\n 318│        ready_cost.hash_computed,\n*319│        brain_ready_path().display()\n 320│    );\n 321│\n 322│    // Shell wake-watchers (restoration D2-2): the offline half of the shell\n    │...\n 496│    }\n*497│    let _ = spt_store::atomic::atomic_write_string(&brain_ready_path(), &obj.to_string());\n 498│    cost\n 499│}\n 500│\n    │...\n 542│\n*543│/// Parse the `generation` stamp out of a `brain.ready` body — pure, so the\n 544│/// staleness gate (D6-2) is unit-tested with explicit values, no wall-clock or\n 545│/// real process. `None` for an absent/garbled/legacy-bare-pid body (the gate\n 546│/// reads that as not-ready — fail-safe). Restoration D6-1b.\n    │...\n 554│\n*555│/// Parse the `exe_hash` breadcrumb out of a `brain.ready` body — pure (D7-1).\n 556│/// `None` for an absent field / garbled body (a legacy N-1 stamp carries none, so\n 557│/// `None` is the N-1-readable answer, not an error). The D7-1 survival E2E reads\n 558│/// this to prove a respawn ran the swapped binary's bytes.\n    │...\n 567│\n*568│/// Read the current `brain.ready` generation stamp from `path`, `None` if the\n 569│/// file is absent or its body has no parseable generation (fail-safe to\n 570│/// not-ready). The supervisor's \"is generation N ready?\" gate (D6-2) reads\n*571│/// [`brain_ready_path`]; the path is a parameter here so the unit harness points\n 572│/// it at a temp file. Restoration D6-1b.\n 573│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n 574│pub fn ready_generation_at(path: &std::path::Path) -> Option<u64> {\n    │...\n 604│    fn applied_state(&self) -> Option<AppliedRecord>;\n*605│    /// The generation stamped in `brain.ready`, or `None` if absent/garbled\n 606│    /// (the readiness gate reads `None` as not-ready — fail-safe).\n 607│    fn ready_generation(&self) -> Option<u64>;\n*608│    /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609│    /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610│    /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611│    /// trial and falsely promote a brain that never booted).\n    │...\n 616│    /// write — promotion is the *real* moment the new code is accepted).\n*617│    fn record_promoted(&self, version: u64);\n 618│    /// Correct the record: the candidate failed readiness. Persist\n 619│    /// `RolledBack{…}` and fire the loud, resurfacing rollback notif.\n 620│    fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n*621│    /// The `exe_hash` the candidate stamped in `brain.ready` (the bytes it is\n 622│    /// actually running), or `None` if absent/garbled — degrades the promotion\n 623│    /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n 624│    fn ready_exe_hash(&self) -> Option<String>;\n    │...\n 632│    /// brain round-trip): the supervisor promotes a ready candidate only once this is\n*633│    /// `true`, so `brain.ready` arriving inside the W2 `BRAIN_WRITE_DEADLINE` window\n 634│    /// can no longer promote onto a still-frozen control plane (the 22:47 false-\n 635│    /// promote). Fail-safe toward DRAINED (`true`) where there is nothing to read — a\n 636│    /// net-less broker, no hosted sessions, or [`NoTrialEnv`] — so the gate never\n 637│    /// strands an apply where no old-gen control plane exists.\n*638│    fn old_gen_drained(&self) -> bool;\n 639│}\n 640│\n 641│/// The no-trial environment: every probe degrades to \"nothing pending / not\n    │...\n 653│    fn clear_ready(&self) {}\n*654│    fn record_promoted(&self, _version: u64) {}\n 655│    fn record_rolled_back(&self, _q: u64, _r: u64, _bin: &str) {}\n 656│    fn ready_exe_hash(&self) -> Option<String> {\n 657│        None\n    │...\n 661│    }\n*662│    fn old_gen_drained(&self) -> bool {\n 663│        // No readiness gate to drive here → no old-gen control plane to drain; the\n 664│        // no-op env promotes exactly as the pre-D6 respawn loop (mirrors its other\n 665│        // no-op effects).\n    │...\n 670│/// Production [`TrialEnv`]: reads/writes the canonical `spt_home` durable files\n*671│/// (the `releases` relcache + the `brain.ready` breadcrumb) and fires the\n 672│/// rollback notif through the real producer front door. Constructed in the\n 673│/// broker process where `spt_home()` is stable.\n 674│///\n    │...\n 694│    fn ready_generation(&self) -> Option<u64> {\n*695│        ready_generation_at(&brain_ready_path())\n 696│    }\n 697│    fn clear_ready(&self) {\n*698│        let _ = std::fs::remove_file(brain_ready_path());\n 699│    }\n*700│    fn record_promoted(&self, version: u64) {\n 701│        let cache = self.cache();\n 702│        let _ = cache.record_applied_state(&AppliedRecord::Applied { version });\n 703│        // The legacy convergence records (M8 `xtask debug-converge`) are written\n## broker.rs\n  5996│    /// generation whose local controller conn is black-holed reads wedged until the W2\n *5997│    /// stall-evict releases it, so `brain.ready` inside the 15 s window can no longer\n  5998│    /// promote onto a still-frozen control plane (the 22:47 false-promote). A cleanly-\n  5999│    /// closed old conn is simply absent → `false` at once (the normal fast promote).\n  6000│    /// Follows the established sessions→log lock order (KIND_SESSIONS reap); reads\n      │...\n 11191│    #[test]\n*11192│    fn a_full_controller_does_not_starve_a_viewer_or_block_the_drain() {\n 11193│        let mut log = OutputLog::new(1, 1024, String::new(), (24, 80));\n 11194│        log.controller_epoch.store(9, Ordering::Release);\n 11195│        // A CONTROLLER whose 2-slot channel we NEVER drain (rx held, unread) — a\n      │...\n 11472│    #[test]\n*11473│    fn input_enqueue_drops_and_stamps_on_full_then_heals_on_drain() {\n 11474│        const DEPTH: usize = 3;\n 11475│        // Consumer is the test; it does NOT drain until we say so → the queue fills.\n 11476│        let (w, rx) = test_input_writer(DEPTH);\n      │...\n 12587│    /// (no per-read deadline: Windows named pipes reject I/O timeouts).\n*12588│    fn drain_output_seqs(client: &mut Stream, n: usize) -> Vec<u64> {\n 12589│        let mut seqs = Vec::with_capacity(n);\n 12590│        while seqs.len() < n {\n 12591│            let env = read_frame(client).expect(\"output frame on the wire\");\n## daemon.rs\n 1968│/// the real per-rung launchers and log which rung won. The caller still confirms\n*1969│/// readiness via the existing `brain.ready` poll — the returned pid is for\n 1970│/// logging/return, not readiness (WMI/schtasks pids are the launcher's view).\n 1971│// [impl->REQ-HAZARD-VIEWER-CLOSE-DETACH]\n 1972│#[cfg(windows)]\n     │...\n 2224│/// is recoverable from schtasks → returns a sentinel; readiness is the caller's\n*2225│/// `brain.ready` poll. This is the FALLBACK rung (WMI is primary); its `/tr`\n 2226│/// quoting is best-effort.\n 2227│// [impl->REQ-HAZARD-VIEWER-CLOSE-DETACH]\n 2228│#[cfg(windows)]\n     │...\n 2264│    }\n*2265│    // No pid from schtasks; sentinel — readiness is the brain.ready poll.\n 2266│    Ok(0)\n 2267│}\n 2268│\n## endpoint.rs\n 84│\n*85│/// The brain child's readiness breadcrumb: `<spt_home>/brain.ready` (the brain\n 86│/// child's pid, rewritten each heartbeat). The broker spawns the brain as a\n 87│/// supervised child process (ADR-0018 Q2/Q3 — the two-process restoration); the\n 88│/// child writes this once it has connected to the broker socket, and refreshes\n   │...\n 93│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*94│pub fn brain_ready_path() -> PathBuf {\n*95│    spt_home().join(\"brain.ready\")\n 96│}\n 97│\n 98│/// Where the peer pump records its last-tick heartbeat (epoch ms, M8\n## frame.rs\n 26│/// Additive changes — new `kind`s, new optional fields — do **not** bump this.\n*27│pub const IPC_PROTOCOL_VERSION: u32 = 1;\n 28│\n 29│/// The oldest peer `protocol_version` this build will still handshake with.\n 30│/// Held at `1` for v1; raised only when an old version is genuinely retired.\n*31│pub const MIN_COMPATIBLE_VERSION: u32 = 1;\n 32│\n 33│/// Which side of the IPC a connecting peer is. The broker is the stable kernel;\n 34│/// the brain is the restartable logic layer (ADR-0004).\n## inject.rs\n 127│// [impl->REQ-HAZARD-DELIVERY-STARVATION]\n*128│pub fn drain_idle_spool(id: &str, owlery: &Path) -> usize {\n 129│    drain_spool_offering(id, owlery, false)\n 130│}\n 131│\n    │...\n 147│// [impl->REQ-IDLE-PARKED-DELIVERY]\n*148│pub fn drain_spool_native(id: &str, owlery: &Path) -> usize {\n 149│    drain_spool_offering(id, owlery, true)\n 150│}\n 151│\n    │...\n 154│/// renderer are identical, which is what keeps the two arms from drifting.\n*155│fn drain_spool_offering(id: &str, owlery: &Path, native: bool) -> usize {\n 156│    if !is_spt_hosted_no_relay(id, owlery) {\n 157│        return 0;\n 158│    }\n## nethost.rs\n  508│    /// pending yet.\n *509│    fn drain(&mut self) -> (Vec<u8>, bool) {\n  510│        let mut out = Vec::new();\n  511│        while let Some((_, chunk)) = self.ring.pop_front() {\n  512│            out.extend_from_slice(&chunk);\n     │...\n 2104│    // [impl->REQ-SHELL-4]\n*2105│    pub fn drain_stream(&self, stream_id: u64) -> Option<(Vec<u8>, bool)> {\n 2106│        let entry = Arc::clone(self.shared.streams.lock().unwrap().get(&stream_id)?);\n 2107│        let drained = entry.log.lock().unwrap().drain();\n 2108│        // The drain freed ring room — wake a pump that was backpressure-parked.\n     │...\n 2993│    #[test]\n*2994│    fn begin_attach_refuses_only_while_a_poisoned_prior_still_drains() {\n 2995│        let (a, _ca, _ra) = seat_socket_pair(Duration::from_secs(5));\n 2996│        let (b, _cb, _rb) = seat_socket_pair(Duration::from_secs(5));\n 2997│        let mut log = StreamLog::new(3, 64);\n## relay.rs\n  62│    /// killed one left behind. Returns the number of messages forwarded.\n *63│    pub fn drain_backlog<F: FnMut(&str, &str)>(&self, mut sink: F) -> usize {\n  64│        // [impl->REQ-SPOOL-TAKE-AUDIT] relay-backlog leg — stamp who drained the row.\n  65│        let audit =\n  66│            spool::TakerAudit::new(spool::TakerLeg::RelayBacklog, None, Some(std::process::id()));\n    │...\n 152│    #[test]\n*153│    fn relay_backlog_never_drains_active_only() {\n 154│        with_home(|_| {\n 155│            let perch = perch_for(\"lia\");\n 156│            // default → relay-eligible (idle/wake window); active_only → poll-only.\n## relcache.rs\n  56│\n *57│/// The two-phase applied-state record (ADR-0018 Q7, restoration D6). The legacy\n  58│/// `applied.json` + `last-outcome.json` are written *optimistically* at the\n  59│/// moment of binary swap — before the new brain has even booted (the\n  60│/// `applied.json={version:6}` observed on `enlyzeam` while the box still ran the\n    │...\n  76│///\n *77│/// Stored as `applied-state.json`, atomic-write + corrupt/absent-degrades-to-None\n  78│/// (the supervisor reads `None` as \"no pending trial\", never a hard fail — the\n  79│/// same posture as every other durable file here). **Additive durable state**\n  80│/// (restoration D6-3 / KH 6.8): a rolled-back pre-D6 binary does not know this\n    │...\n 390│    /// (KH 6.11, REQ-HAZARD-BRAIN-RESPAWN-PATH) compares a just-promoted\n*391│    /// candidate's `brain.ready` `exe_hash` against. `None` when nothing is\n 392│    /// staged, the staged version != `version`, the metadata doesn't parse, or\n 393│    /// this platform is absent from a set — every `None` degrades the gate to\n 394│    /// readiness-only (N-1-safe), never a false rejection.\n    │...\n 469│    fn applied_state_path(&self) -> PathBuf {\n*470│        self.dir.join(\"applied-state.json\")\n 471│    }\n 472│\n 473│    /// Write the two-phase [`AppliedRecord`] (atomic). Best-effort at the call\n    │...\n 481│\n*482│    /// Read the two-phase applied-state record; `None` when absent or corrupt\n 483│    /// (degrade-to-no-trial — the supervisor treats that as \"no pending trial\",\n 484│    /// never a hard fail). Additive to the legacy `applied.json`/`last-outcome`,\n 485│    /// which keep their own readers.\n    │...\n 580│\n*581│    // [unit->REQ-UPD-6] The two-phase applied-state record (ADR-0018 Q7,\n 582│    // restoration D6-1) round-trips all three phases through disk; an absent\n 583│    // file degrades to None (no-trial), and a corrupt body degrades to None too\n 584│    // (the supervisor reads that as \"no pending trial\", never a hard fail).\n## rollback_compat.rs\n  43│    // D6-1: the two-phase applied record (`crate::relcache::AppliedRecord`).\n *44│    \"applied-state.json\",\n  45│    // D6-1b + D7-1: the readiness breadcrumb (`{pid, generation, exe_hash}`); the\n  46│    // D7-1 `exe_hash` field is additive (N-1 ignores it) — the tripwire owns it.\n *47│    \"brain.ready\",\n  48│];\n  49│\n  50│#[cfg(test)]\n    │...\n 105│            PRE_READY_DURABLE_FILES,\n*106│            &[\"deadline-<key>.json\", \"applied-state.json\", \"brain.ready\"],\n 107│            \"the tripwire asserts every file the registry names — keep them in lockstep\"\n 108│        );\n 109│\n    │...\n 118│\n*119│        // D6-1: applied-state.json (AppliedRecord) — all three phases. The serde\n 120│        // tag (`phase`) and each phase's load-bearing fields are N-1-readable.\n 121│        assert_additive_n1_readable(\n 122│            &AppliedRecord::AppliedPending {\n    │...\n 139│\n*140│        // D6-1b + D7-1: brain.ready (`{pid, generation, exe_hash}`) — no struct;\n 141│        // assert the shape carries all three fields AND that the production\n 142│        // readers still extract generation + exe_hash when an unknown extra field\n 143│        // is present (additive-tolerant), and that the D7-1 `exe_hash` is itself\n## shellchan.rs\n 320│// [impl->REQ-HAZARD-SHELL-STALE-ONLINE]\n*321│pub fn restamp_for_drain(shell_perch: &Path, current_key: &[u8; 32], body: &str) -> String {\n 322│    if verify_stamped_frame(current_key, body).is_some() {\n 323│        return body.to_string();\n 324│    }\n## translation.rs\n 459│    #[test]\n*460│    fn inject_floor_buffers_while_held_then_drains_in_order() {\n 461│        let mut f = InjectFloor::default();\n 462│        // free floor → input passes through (caller writes), nothing buffered.\n 463│        assert!(!f.buffer_if_held(b\"a\"), \"free floor does not buffer\");\n\n## pump/\n### mod.rs\n  206│// [impl->REQ-PUMP-PEER-ISOLATION]\n *207│fn classify_drain_read(read: io::Result<BrokerEvent>) -> DrainStep {\n  208│    match read {\n  209│        Ok(BrokerEvent::NetPresence(ev)) => DrainStep::Apply(ev),\n  210│        Ok(_) => DrainStep::Skip,\n     │...\n 2211│    #[test]\n*2212│    fn drain_read_classifies_dead_carrier_as_restart_timeout_as_quiet() {\n 2213│        // A quiet TimedOut closes the round — it is NEVER a restart.\n 2214│        assert!(matches!(\n 2215│            classify_drain_read(Err(io::Error::new(io::ErrorKind::TimedOut, \"read deadline\"))),","missingPaths":["crates/spt-ipc"]},"isError":false,"timestamp":1789522838618}}
{"type":"message","id":"6a812009","parentId":"20253c3a","timestamp":"2026-09-16T01:40:38.796Z","message":{"role":"toolResult","toolCallId":"call_p4QOZKX632szHyfLrG2IwpI5|fc_0bac546ce171b754016aa9f396149087d1bbe9ef70573a3e6e","toolName":"glob","content":[{"type":"text","text":"# .spt/preserved/\n## 304-handoff/\n### s3-target-reclaim/\nreclaim-s3.py\n### finished-lane-reclaim/\nreclaim-finished.py\n### s4-release-note/\nrun-s4-docs.py\n### successor-linux-daemon/\nprepare-linux.py\nrun-linux-successor-daemon.py\n#### corrected-workspace/\nrun-linux-successor-daemon.py\n### consumer-linux-7890ead3/\nfinalize-refusal.py\nprepare-linux.py\nclassify-closed-targets.py\nlaunch-linux.py\nreclaim-and-prepare-warm.py\nrun-linux-7890ead3.py\n#### golden-env-values/\nlaunch-linux.py\nrun-linux-7890ead3.py\n#### golden-env/\nlaunch-linux.py\nrun-linux-7890ead3.py\n#### full49-warm/\nprepare-full49.py\nlaunch-linux.py\nrun-linux-7890ead3.py\n### consumer-linux-S2-527cd8e8/\nrun-S2.py\nrun-S2-corrected.py\n#### windows-release/\ngate.py\n### hertz-phase-b-B2FGTAFA/\ntriage-run.py\n### consumer-linux-49a08a07/\nrun-linux-49a08a07.py\n### target-reclaim-20260914/\nreap.py\nscan.py\n## hertz-fp-driver-review/d2/\nfp-driver-d2-r10-P9RLK4VU.sh\nfp-driver-d2-r10-HHDKCRH5.sh\nfp-driver-d2-r10-AQ23KKNI.sh\n### field-rig-r10-w7-a2-QWHXWYUH/support/\nfp-driver-d2-r10-w7-a2.frozen.sh\n#### fp-bin/\nrun-daemon-control.py\nlaunch-record.py\nd2_validate.py\nd1_render.py\n### window7-2PEMLAIQ/\nfp-driver-d2-r10-w7-a2.frozen.sh\nfp-driver-d2-r10-w7.frozen.sh\nfp-driver-d2-r10-w7.draft.sh\n#### control-A2-QWHXWYUH/prep/instruments/\nfp-driver-d2-r10-w7-a2.frozen.sh\n#### control-DYGO34U2/prep/instruments/\nfp-driver-d2-r10-w7.frozen.sh\n#### qualification with spaces/\nnative-bound-smoke.sh\nreceipt-before-native.sh\nclock-with-native-proof.sh\nrequest-render-native-required.sh\nverdict-replay.sh\nrequest-render-file-transport.sh\nrequest-render-attempt1.sh\n##### r13-real-L2-02de4f40d60f40b1967e7da2c6f35adb/\n###### negative-absent/\nrender.sh\n###### positive-reserved/\nrender.sh\n#### fp-bin/\nlaunch-record.py\nrun-daemon-control.py\nd2_validate.py\nd1_render.py\n### liam-runner-r11/\nprepare-ack-w7c.sh\nprepare-ack-w7b.sh\nprepare-ack-w7.sh\nteardown-runner-r13.sh\nteardown-runner-r12.sh\nteardown-runner-r11.c97dc496.frozen.sh\nteardown-runner-r11.sh\nleg-runner-r11.sh\n### field-rig-r10-w6-ENA6WIMS/support/fp-bin/\nrun-daemon-control.py\nlaunch-record.py\nd2_validate.py\nd1_render.py\n### binding-VMNIVWIY/\nfp-driver-d2-r10-S2-configured.sh\n#### fp-bin/\nrun-daemon-control.py\nlaunch-record.py\nd2_validate.py\nd1_render.py\n### P9RLK4VU-controls/\nrun.sh\nbefore-dispatch.sh\nbefore-go.sh\nsubject.sh\n### prep-VMNIVWIY/instruments/\nfp-driver-d2-r10-P9RLK4VU.sh\n### AQ23KKNI-controls/\nextra.sh\nledger-function.sh\ncontrols-v2.sh\ncontrols.sh\nemit-clock.sh\nfunctions.sh\n\n[80 results limit reached. Use limit=160 for more]"}],"details":{"scopePath":".spt/preserved/hertz-fp-driver-review/**/*.py, .spt/preserved/hertz-fp-driver-review/**/*.sh, .spt/preserved/304-handoff/**/*.py, crates/spt-daemon/src/*cache*","fileCount":80,"files":[".spt/preserved/304-handoff/s3-target-reclaim/reclaim-s3.py",".spt/preserved/304-handoff/finished-lane-reclaim/reclaim-finished.py",".spt/preserved/304-handoff/s4-release-note/run-s4-docs.py",".spt/preserved/304-handoff/successor-linux-daemon/corrected-workspace/run-linux-successor-daemon.py",".spt/preserved/304-handoff/successor-linux-daemon/prepare-linux.py",".spt/preserved/304-handoff/successor-linux-daemon/run-linux-successor-daemon.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/golden-env-values/launch-linux.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/golden-env-values/run-linux-7890ead3.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/run-daemon-control.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-record.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/d2_validate.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/d1_render.py",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/control-A2-QWHXWYUH/prep/instruments/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/prepare-ack-w7c.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/prepare-ack-w7b.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/prepare-ack-w7.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/control-DYGO34U2/prep/instruments/fp-driver-d2-r10-w7.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/r13-real-L2-02de4f40d60f40b1967e7da2c6f35adb/negative-absent/render.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/r13-real-L2-02de4f40d60f40b1967e7da2c6f35adb/positive-reserved/render.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7.draft.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/teardown-runner-r13.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-bin/launch-record.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/golden-env/launch-linux.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/golden-env/run-linux-7890ead3.py",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/native-bound-smoke.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/teardown-runner-r12.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/receipt-before-native.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/clock-with-native-proof.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/teardown-runner-r11.c97dc496.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/request-render-native-required.sh",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/teardown-runner-r11.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/verdict-replay.sh",".spt/preserved/304-handoff/consumer-linux-7890ead3/finalize-refusal.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/prepare-linux.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/classify-closed-targets.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/launch-linux.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/reclaim-and-prepare-warm.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/full49-warm/prepare-full49.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/full49-warm/launch-linux.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/full49-warm/run-linux-7890ead3.py",".spt/preserved/304-handoff/consumer-linux-7890ead3/run-linux-7890ead3.py",".spt/preserved/hertz-fp-driver-review/d2/liam-runner-r11/leg-runner-r11.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/request-render-file-transport.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/qualification with spaces/request-render-attempt1.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-bin/run-daemon-control.py",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-bin/d2_validate.py",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-bin/d1_render.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w6-ENA6WIMS/support/fp-bin/run-daemon-control.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w6-ENA6WIMS/support/fp-bin/launch-record.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w6-ENA6WIMS/support/fp-bin/d2_validate.py",".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w6-ENA6WIMS/support/fp-bin/d1_render.py",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-driver-d2-r10-S2-configured.sh",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-bin/run-daemon-control.py",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-bin/launch-record.py",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-bin/d2_validate.py",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-bin/d1_render.py",".spt/preserved/304-handoff/consumer-linux-S2-527cd8e8/run-S2.py",".spt/preserved/304-handoff/consumer-linux-S2-527cd8e8/run-S2-corrected.py",".spt/preserved/304-handoff/consumer-linux-S2-527cd8e8/windows-release/gate.py",".spt/preserved/304-handoff/hertz-phase-b-B2FGTAFA/triage-run.py",".spt/preserved/304-handoff/consumer-linux-49a08a07/run-linux-49a08a07.py",".spt/preserved/hertz-fp-driver-review/d2/P9RLK4VU-controls/run.sh",".spt/preserved/hertz-fp-driver-review/d2/P9RLK4VU-controls/before-dispatch.sh",".spt/preserved/hertz-fp-driver-review/d2/P9RLK4VU-controls/before-go.sh",".spt/preserved/hertz-fp-driver-review/d2/P9RLK4VU-controls/subject.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-P9RLK4VU.sh",".spt/preserved/hertz-fp-driver-review/d2/prep-VMNIVWIY/instruments/fp-driver-d2-r10-P9RLK4VU.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-HHDKCRH5.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/extra.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/ledger-function.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/controls-v2.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/controls.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/emit-clock.sh",".spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/functions.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-AQ23KKNI.sh",".spt/preserved/304-handoff/target-reclaim-20260914/reap.py",".spt/preserved/304-handoff/target-reclaim-20260914/scan.py"],"truncated":true,"resultLimitReached":80,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","meta":{"limits":{"resultLimit":{"reached":80,"suggestion":160}}}},"isError":false,"timestamp":1789522838796}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_pngpbiw0LnFWtt0D4jbFQPh0|fc_0bac546ce171b754016aa9f3a2aecc87d18538fddda47b64f1","toolName":"grep","startedAt":"2026-09-16T01:40:50.793Z","args":{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh"},"intent":"Locating retained signing callsites"},"id":"be43b79b","parentId":"6a812009","timestamp":"2026-09-16T01:40:50.793Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_4hmMqnSfeosICDD7EnHTtLHy|fc_0bac546ce171b754016aa9f3a2aedc87d18215bc521cb446dd","toolName":"read","startedAt":"2026-09-16T01:40:50.793Z","args":{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/run-daemon-control.py:1-160"},"intent":"Reading isolated launch helper interface"},"id":"a0a690aa","parentId":"be43b79b","timestamp":"2026-09-16T01:40:50.793Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_WECNvTDcFMo1bo6UppR6iL2H|fc_0bac546ce171b754016aa9f3a2aee487d19cb10011e0fb7540","toolName":"read","startedAt":"2026-09-16T01:40:50.793Z","args":{"path":"crates/spt-daemon/src/relcache.rs:140-260"},"intent":"Reading cache artifact layout"},"id":"7e2d0f29","parentId":"a0a690aa","timestamp":"2026-09-16T01:40:50.793Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_vutNL1cHYoq5NRYzq9r0wTnC|fc_0bac546ce171b754016aa9f3a2aeec87d199ea19b4fec971cf","toolName":"read","startedAt":"2026-09-16T01:40:50.794Z","args":{"path":"crates/spt-daemon/src/endpoint.rs:1-96"},"intent":"Reading socket addressing"},"id":"817add81","parentId":"7e2d0f29","timestamp":"2026-09-16T01:40:50.794Z"}
{"type":"message","id":"c444b094","parentId":"817add81","timestamp":"2026-09-16T01:40:50.794Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_pngpbiw0LnFWtt0D4jbFQPh0|fc_0bac546ce171b754016aa9f3a2aecc87d18538fddda47b64f1","name":"grep","arguments":{"i":"Locating retained signing callsites","pattern":"debug-rollout|debug-pin|SPT_DEBUG_RELEASE|release-keys|launch-record.py|run-daemon-control","path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh","case":true,"gitignore":false,"skip":0},"intent":"Locating retained signing callsites"},{"type":"toolCall","id":"call_4hmMqnSfeosICDD7EnHTtLHy|fc_0bac546ce171b754016aa9f3a2aedc87d18215bc521cb446dd","name":"read","arguments":{"i":"Reading isolated launch helper interface","path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/run-daemon-control.py:1-160"},"intent":"Reading isolated launch helper interface"},{"type":"toolCall","id":"call_WECNvTDcFMo1bo6UppR6iL2H|fc_0bac546ce171b754016aa9f3a2aee487d19cb10011e0fb7540","name":"read","arguments":{"i":"Reading cache artifact layout","path":"crates/spt-daemon/src/relcache.rs:140-260"},"intent":"Reading cache artifact layout"},{"type":"toolCall","id":"call_vutNL1cHYoq5NRYzq9r0wTnC|fc_0bac546ce171b754016aa9f3a2aeec87d199ea19b4fec971cf","name":"read","arguments":{"i":"Reading socket addressing","path":"crates/spt-daemon/src/endpoint.rs:1-96"},"intent":"Reading socket addressing"},{"type":"toolCall","id":"call_ntbYatCliFeSwrkmDq6N3QXn|fc_0bac546ce171b754016aa9f3a2aef087d1b4ab1fa37c492330","name":"grep","arguments":{"i":"Locating concrete trial tests","pattern":"fn (.*ready|.*trial|.*promot|.*drain|.*hash|apply_staged_.*)","path":"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs","case":true,"gitignore":true,"skip":0},"intent":"Locating concrete trial tests"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":5726,"output":337,"cacheRead":35840,"cacheWrite":0,"totalTokens":41903,"cost":{"input":0.057260000000000005,"output":0.01685,"cacheRead":0.03584,"cacheWrite":0,"total":0.10995}},"stopReason":"toolUse","timestamp":1789522838824,"responseId":"resp_0bac546ce171b754016aa9f397143887d182e7de37726784b9","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f3a2aecc87d18538fddda47b64f1","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating retained signing callsites\",\"pattern\":\"debug-rollout|debug-pin|SPT_DEBUG_RELEASE|release-keys|launch-record.py|run-daemon-control\",\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_pngpbiw0LnFWtt0D4jbFQPh0","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3a2aedc87d18215bc521cb446dd","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading isolated launch helper interface\",\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/run-daemon-control.py:1-160\"}","call_id":"call_4hmMqnSfeosICDD7EnHTtLHy","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3a2aee487d19cb10011e0fb7540","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading cache artifact layout\",\"path\":\"crates/spt-daemon/src/relcache.rs:140-260\"}","call_id":"call_WECNvTDcFMo1bo6UppR6iL2H","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3a2aeec87d199ea19b4fec971cf","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading socket addressing\",\"path\":\"crates/spt-daemon/src/endpoint.rs:1-96\"}","call_id":"call_vutNL1cHYoq5NRYzq9r0wTnC","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3a2aef087d1b4ab1fa37c492330","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating concrete trial tests\",\"pattern\":\"fn (.*ready|.*trial|.*promot|.*drain|.*hash|apply_staged_.*)\",\"path\":\"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_ntbYatCliFeSwrkmDq6N3QXn","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":11967.125299999956,"ttft":11891.381300000008,"completedAt":1789522850791,"contextSnapshot":{"promptTokens":41566,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ntbYatCliFeSwrkmDq6N3QXn|fc_0bac546ce171b754016aa9f3a2aef087d1b4ab1fa37c492330","toolName":"grep","startedAt":"2026-09-16T01:40:50.794Z","args":{"path":"crates/spt-daemon/src/brainproc.rs;crates/spt-daemon/src/applyhost.rs"},"intent":"Locating concrete trial tests"},"id":"f9c0194d","parentId":"c444b094","timestamp":"2026-09-16T01:40:50.794Z"}
{"type":"message","id":"2fe012b0","parentId":"f9c0194d","timestamp":"2026-09-16T01:40:50.807Z","message":{"role":"toolResult","toolCallId":"call_WECNvTDcFMo1bo6UppR6iL2H|fc_0bac546ce171b754016aa9f3a2aee487d19cb10011e0fb7540","toolName":"read","content":[{"type":"text","text":"impl StagedUpdate {\n…\n    pub fn signature_hex(&self) -> &str {\n…\n    }\n\n    pub fn version(&self) -> Option<u64> {\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\n        meta.get(\"version\").and_then(|v| v.as_u64())\n    }\n\n    pub fn channel(&self) -> Option<String> {\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\n        meta.get(\"channel\")\n            .and_then(|v| v.as_str())\n            .map(str::to_string)\n    }\n\n    /// The human-facing semantic version stamped in the signed metadata\n    /// ([`crate::release::ReleaseMetadata::product_version`]), or `None` when\n    /// absent/empty (pre-v0.3.2 metadata) — the apply message falls back to the\n    /// monotonic counter then.\n    // [impl->REQ-UPD-8]\n    pub fn product_version(&self) -> Option<String> {\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\n        meta.get(\"product_version\")\n            .and_then(|v| v.as_str())\n            .filter(|s| !s.is_empty())\n            .map(str::to_string)\n    }\n}\n\n/// The on-disk staged-release cache: one directory holding at most one\n/// `(SignedRelease, artifact)` pair. Constructed with an explicit directory —\n/// production resolution (under the daemon's data root) rides the D9\n/// lifecycle wiring; tests pass temp dirs.\n#[derive(Debug, Clone)]\npub struct ReleaseCache {\n    dir: PathBuf,\n}\n\nimpl ReleaseCache {\n    /// A cache rooted at `dir` (created lazily on first stage).\n    pub fn open(dir: &Path) -> ReleaseCache {\n        ReleaseCache {\n            dir: dir.to_path_buf(),\n        }\n    }\n\n    /// Path of the staged artifact bytes.\n    pub fn artifact_path(&self) -> PathBuf {\n        self.dir.join(ARTIFACT_FILE)\n    }\n\n    /// Path for one platform artifact in an update set.\n    // [impl->REQ-UPD-6]\n    pub fn artifact_path_for_platform(&self, platform: &str) -> PathBuf {\n        self.dir\n            .join(ARTIFACTS_DIR)\n            .join(format!(\"{}.bin\", sanitize_platform(platform)))\n    }\n\n    fn release_path(&self) -> PathBuf {\n        self.dir.join(RELEASE_FILE)\n    }\n\n    fn platform_path(&self) -> PathBuf {\n        self.dir.join(PLATFORM_FILE)\n    }\n\n    /// Stage a verified release: artifact first, signed metadata last (the\n    /// commit point), both atomic. Restaging replaces the previous release —\n    /// the cache holds only the newest verified one.\n    ///\n    /// The caller MUST have run the gate (`update::plan_verified`) on exactly\n    /// this `(signed, artifact)` pair — staging unverified bytes would make\n    /// this node a poison server (ADR-0004 §D).\n    // [impl->REQ-UPD-1]\n    pub fn stage(&self, signed: &SignedRelease, artifact: &[u8]) -> io::Result<()> {\n        std::fs::create_dir_all(&self.dir)?;\n        let _ = std::fs::remove_dir_all(self.dir.join(ARTIFACTS_DIR));\n        // No truthful platform identity for a bare single — clear any stale\n        // stamp so the apply guard fail-safe refuses (REQ-UPD-8). A caller that\n        // genuinely knows the artifact's platform uses\n        // [`stage_single_with_platform`] instead.\n        // [impl->REQ-UPD-8]\n        let _ = std::fs::remove_file(self.platform_path());\n        atomic_write_bytes(&self.artifact_path(), artifact)?;\n        let json = serde_json::to_string_pretty(signed)\n            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n        atomic_write_string(&self.release_path(), &json)\n    }\n\n    /// Stage a single release whose artifact is KNOWN to target `platform`\n    /// (the origin-fetch path that downloaded THIS node's platform asset, or a\n    /// test). Identical to [`stage`](Self::stage) but additionally writes the\n    /// platform stamp the apply guard requires — apply proceeds only when the\n    /// stamp equals the running node's [`current_platform`] (REQ-UPD-8). Update\n    /// sets do not need this; they carry per-platform identity in their signed\n    /// metadata.\n    // [impl->REQ-UPD-8]\n    pub fn stage_single_with_platform(\n        &self,\n        signed: &SignedRelease,\n        artifact: &[u8],\n        platform: &str,\n    ) -> io::Result<()> {\n        self.stage(signed, artifact)?;\n        atomic_write_string(\n            &self.platform_path(),\n            &serde_json::json!({ \"platform\": platform }).to_string(),\n        )\n    }\n\n    /// The platform stamp of the staged single release, if one was recorded by\n    /// [`stage_single_with_platform`]. `None` for an unstamped single (a bare\n    /// [`stage`](Self::stage), incl. every P2P-pulled single) or an update set.\n    // [impl->REQ-UPD-8]\n    pub fn staged_platform(&self) -> Option<String> {\n        let s = std::fs::read_to_string(self.platform_path()).ok()?;\n        serde_json::from_str::<serde_json::Value>(&s)\n            .ok()?\n            .get(\"platform\")?\n            .as_str()\n            .map(str::to_string)\n    }\n\n    /// Stage a platform-targeted update set: every artifact first, signed\n    /// metadata last (commit point). The caller MUST have verified that the\n…\n}\n\n[Showing lines 139-263 of 768. Use :264 to continue]"}],"details":{"truncation":{"content":"    }\r\n\r\n    pub fn version(&self) -> Option<u64> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"version\").and_then(|v| v.as_u64())\r\n    }\r\n\r\n    pub fn channel(&self) -> Option<String> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"channel\")\r\n            .and_then(|v| v.as_str())\r\n            .map(str::to_string)\r\n    }\r\n\r\n    /// The human-facing semantic version stamped in the signed metadata\r\n    /// ([`crate::release::ReleaseMetadata::product_version`]), or `None` when\r\n    /// absent/empty (pre-v0.3.2 metadata) — the apply message falls back to the\r\n    /// monotonic counter then.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn product_version(&self) -> Option<String> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"product_version\")\r\n            .and_then(|v| v.as_str())\r\n            .filter(|s| !s.is_empty())\r\n            .map(str::to_string)\r\n    }\r\n}\r\n\r\n/// The on-disk staged-release cache: one directory holding at most one\r\n/// `(SignedRelease, artifact)` pair. Constructed with an explicit directory —\r\n/// production resolution (under the daemon's data root) rides the D9\r\n/// lifecycle wiring; tests pass temp dirs.\r\n#[derive(Debug, Clone)]\r\npub struct ReleaseCache {\r\n    dir: PathBuf,\r\n}\r\n\r\nimpl ReleaseCache {\r\n    /// A cache rooted at `dir` (created lazily on first stage).\r\n    pub fn open(dir: &Path) -> ReleaseCache {\r\n        ReleaseCache {\r\n            dir: dir.to_path_buf(),\r\n        }\r\n    }\r\n\r\n    /// Path of the staged artifact bytes.\r\n    pub fn artifact_path(&self) -> PathBuf {\r\n        self.dir.join(ARTIFACT_FILE)\r\n    }\r\n\r\n    /// Path for one platform artifact in an update set.\r\n    // [impl->REQ-UPD-6]\r\n    pub fn artifact_path_for_platform(&self, platform: &str) -> PathBuf {\r\n        self.dir\r\n            .join(ARTIFACTS_DIR)\r\n            .join(format!(\"{}.bin\", sanitize_platform(platform)))\r\n    }\r\n\r\n    fn release_path(&self) -> PathBuf {\r\n        self.dir.join(RELEASE_FILE)\r\n    }\r\n\r\n    fn platform_path(&self) -> PathBuf {\r\n        self.dir.join(PLATFORM_FILE)\r\n    }\r\n\r\n    /// Stage a verified release: artifact first, signed metadata last (the\r\n    /// commit point), both atomic. Restaging replaces the previous release —\r\n    /// the cache holds only the newest verified one.\r\n    ///\r\n    /// The caller MUST have run the gate (`update::plan_verified`) on exactly\r\n    /// this `(signed, artifact)` pair — staging unverified bytes would make\r\n    /// this node a poison server (ADR-0004 §D).\r\n    // [impl->REQ-UPD-1]\r\n    pub fn stage(&self, signed: &SignedRelease, artifact: &[u8]) -> io::Result<()> {\r\n        std::fs::create_dir_all(&self.dir)?;\r\n        let _ = std::fs::remove_dir_all(self.dir.join(ARTIFACTS_DIR));\r\n        // No truthful platform identity for a bare single — clear any stale\r\n        // stamp so the apply guard fail-safe refuses (REQ-UPD-8). A caller that\r\n        // genuinely knows the artifact's platform uses\r\n        // [`stage_single_with_platform`] instead.\r\n        // [impl->REQ-UPD-8]\r\n        let _ = std::fs::remove_file(self.platform_path());\r\n        atomic_write_bytes(&self.artifact_path(), artifact)?;\r\n        let json = serde_json::to_string_pretty(signed)\r\n            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n        atomic_write_string(&self.release_path(), &json)\r\n    }\r\n\r\n    /// Stage a single release whose artifact is KNOWN to target `platform`\r\n    /// (the origin-fetch path that downloaded THIS node's platform asset, or a\r\n    /// test). Identical to [`stage`](Self::stage) but additionally writes the\r\n    /// platform stamp the apply guard requires — apply proceeds only when the\r\n    /// stamp equals the running node's [`current_platform`] (REQ-UPD-8). Update\r\n    /// sets do not need this; they carry per-platform identity in their signed\r\n    /// metadata.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn stage_single_with_platform(\r\n        &self,\r\n        signed: &SignedRelease,\r\n        artifact: &[u8],\r\n        platform: &str,\r\n    ) -> io::Result<()> {\r\n        self.stage(signed, artifact)?;\r\n        atomic_write_string(\r\n            &self.platform_path(),\r\n            &serde_json::json!({ \"platform\": platform }).to_string(),\r\n        )\r\n    }\r\n\r\n    /// The platform stamp of the staged single release, if one was recorded by\r\n    /// [`stage_single_with_platform`]. `None` for an unstamped single (a bare\r\n    /// [`stage`](Self::stage), incl. every P2P-pulled single) or an update set.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn staged_platform(&self) -> Option<String> {\r\n        let s = std::fs::read_to_string(self.platform_path()).ok()?;\r\n        serde_json::from_str::<serde_json::Value>(&s)\r\n            .ok()?\r\n            .get(\"platform\")?\r\n            .as_str()\r\n            .map(str::to_string)\r\n    }\r\n\r\n    /// Stage a platform-targeted update set: every artifact first, signed\r\n    /// metadata last (commit point). The caller MUST have verified that the\r","truncated":true,"truncatedBy":"lines","totalLines":630,"totalBytes":5115,"outputLines":125,"outputBytes":5115,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":768,"displayContent":{"text":"impl StagedUpdate {\n…\n    pub fn signature_hex(&self) -> &str {\n…\n    }\r\n\r\n    pub fn version(&self) -> Option<u64> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"version\").and_then(|v| v.as_u64())\r\n    }\r\n\r\n    pub fn channel(&self) -> Option<String> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"channel\")\r\n            .and_then(|v| v.as_str())\r\n            .map(str::to_string)\r\n    }\r\n\r\n    /// The human-facing semantic version stamped in the signed metadata\r\n    /// ([`crate::release::ReleaseMetadata::product_version`]), or `None` when\r\n    /// absent/empty (pre-v0.3.2 metadata) — the apply message falls back to the\r\n    /// monotonic counter then.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn product_version(&self) -> Option<String> {\r\n        let meta: serde_json::Value = serde_json::from_str(self.metadata_json()).ok()?;\r\n        meta.get(\"product_version\")\r\n            .and_then(|v| v.as_str())\r\n            .filter(|s| !s.is_empty())\r\n            .map(str::to_string)\r\n    }\r\n}\r\n\r\n/// The on-disk staged-release cache: one directory holding at most one\r\n/// `(SignedRelease, artifact)` pair. Constructed with an explicit directory —\r\n/// production resolution (under the daemon's data root) rides the D9\r\n/// lifecycle wiring; tests pass temp dirs.\r\n#[derive(Debug, Clone)]\r\npub struct ReleaseCache {\r\n    dir: PathBuf,\r\n}\r\n\r\nimpl ReleaseCache {\r\n    /// A cache rooted at `dir` (created lazily on first stage).\r\n    pub fn open(dir: &Path) -> ReleaseCache {\r\n        ReleaseCache {\r\n            dir: dir.to_path_buf(),\r\n        }\r\n    }\r\n\r\n    /// Path of the staged artifact bytes.\r\n    pub fn artifact_path(&self) -> PathBuf {\r\n        self.dir.join(ARTIFACT_FILE)\r\n    }\r\n\r\n    /// Path for one platform artifact in an update set.\r\n    // [impl->REQ-UPD-6]\r\n    pub fn artifact_path_for_platform(&self, platform: &str) -> PathBuf {\r\n        self.dir\r\n            .join(ARTIFACTS_DIR)\r\n            .join(format!(\"{}.bin\", sanitize_platform(platform)))\r\n    }\r\n\r\n    fn release_path(&self) -> PathBuf {\r\n        self.dir.join(RELEASE_FILE)\r\n    }\r\n\r\n    fn platform_path(&self) -> PathBuf {\r\n        self.dir.join(PLATFORM_FILE)\r\n    }\r\n\r\n    /// Stage a verified release: artifact first, signed metadata last (the\r\n    /// commit point), both atomic. Restaging replaces the previous release —\r\n    /// the cache holds only the newest verified one.\r\n    ///\r\n    /// The caller MUST have run the gate (`update::plan_verified`) on exactly\r\n    /// this `(signed, artifact)` pair — staging unverified bytes would make\r\n    /// this node a poison server (ADR-0004 §D).\r\n    // [impl->REQ-UPD-1]\r\n    pub fn stage(&self, signed: &SignedRelease, artifact: &[u8]) -> io::Result<()> {\r\n        std::fs::create_dir_all(&self.dir)?;\r\n        let _ = std::fs::remove_dir_all(self.dir.join(ARTIFACTS_DIR));\r\n        // No truthful platform identity for a bare single — clear any stale\r\n        // stamp so the apply guard fail-safe refuses (REQ-UPD-8). A caller that\r\n        // genuinely knows the artifact's platform uses\r\n        // [`stage_single_with_platform`] instead.\r\n        // [impl->REQ-UPD-8]\r\n        let _ = std::fs::remove_file(self.platform_path());\r\n        atomic_write_bytes(&self.artifact_path(), artifact)?;\r\n        let json = serde_json::to_string_pretty(signed)\r\n            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\r\n        atomic_write_string(&self.release_path(), &json)\r\n    }\r\n\r\n    /// Stage a single release whose artifact is KNOWN to target `platform`\r\n    /// (the origin-fetch path that downloaded THIS node's platform asset, or a\r\n    /// test). Identical to [`stage`](Self::stage) but additionally writes the\r\n    /// platform stamp the apply guard requires — apply proceeds only when the\r\n    /// stamp equals the running node's [`current_platform`] (REQ-UPD-8). Update\r\n    /// sets do not need this; they carry per-platform identity in their signed\r\n    /// metadata.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn stage_single_with_platform(\r\n        &self,\r\n        signed: &SignedRelease,\r\n        artifact: &[u8],\r\n        platform: &str,\r\n    ) -> io::Result<()> {\r\n        self.stage(signed, artifact)?;\r\n        atomic_write_string(\r\n            &self.platform_path(),\r\n            &serde_json::json!({ \"platform\": platform }).to_string(),\r\n        )\r\n    }\r\n\r\n    /// The platform stamp of the staged single release, if one was recorded by\r\n    /// [`stage_single_with_platform`]. `None` for an unstamped single (a bare\r\n    /// [`stage`](Self::stage), incl. every P2P-pulled single) or an update set.\r\n    // [impl->REQ-UPD-8]\r\n    pub fn staged_platform(&self) -> Option<String> {\r\n        let s = std::fs::read_to_string(self.platform_path()).ok()?;\r\n        serde_json::from_str::<serde_json::Value>(&s)\r\n            .ok()?\r\n            .get(\"platform\")?\r\n            .as_str()\r\n            .map(str::to_string)\r\n    }\r\n\r\n    /// Stage a platform-targeted update set: every artifact first, signed\r\n    /// metadata last (commit point). The caller MUST have verified that the\r\n…\n}","startLine":126,"lineNumbers":[126,null,134,null,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,null,491]},"fileSize":33505,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\relcache.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":768,"totalBytes":5115,"outputLines":125,"outputBytes":5115,"shownRange":{"start":139,"end":263},"nextOffset":264}}},"isError":false,"timestamp":1789522850806}}
{"type":"message","id":"536c0990","parentId":"2fe012b0","timestamp":"2026-09-16T01:40:50.807Z","message":{"role":"toolResult","toolCallId":"call_vutNL1cHYoq5NRYzq9r0wTnC|fc_0bac546ce171b754016aa9f3a2aeec87d199ea19b4fec971cf","toolName":"read","content":[{"type":"text","text":"//! Canonical per-machine daemon endpoint names + pid path (B6).\n//!\n//! The daemon binds two local-IPC listeners — the broker (PTY hosting, B1/B2)\n//! and the seed-control channel (B6) — under names derived from the active\n//! `spt_home`. Deriving from `spt_home` keeps each isolated home (a test's\n//! `SPT_HOME` override, a per-user install) on its own daemon, so parallel test\n//! processes never collide on one machine while a real install gets one stable\n//! per-home daemon. The auto-start spawn inherits `SPT_HOME`, so the spawned\n//! daemon computes the **same** names as the client that started it — that\n//! shared derivation is the whole of the rendezvous (no registry lookup).\n// [impl->REQ-DAEMON-3]\n\nuse std::hash::{Hash, Hasher};\nuse std::path::PathBuf;\n\nuse spt_store::perch::spt_home;\n\n/// A deterministic short tag for the active spt home. `DefaultHasher::new()` is\n/// seeded with fixed keys (it is **not** randomized like `RandomState`), so the\n/// tag is stable across processes that share the same `spt_home` — exactly what\n/// the auto-start handshake needs (the spawned daemon must independently derive\n/// the launching client's socket name).\nfn home_tag() -> String {\n    let mut h = std::collections::hash_map::DefaultHasher::new();\n    spt_home().hash(&mut h);\n    format!(\"{:016x}\", h.finish())\n}\n\n/// The seed-control listener name (B6): the channel `api seed`/`api listen`\n/// connect to for the in-memory seed map. It is also the daemon's liveness\n/// anchor — present for the daemon's whole lifetime.\npub fn seed_socket_name() -> String {\n    format!(\"spt-daemon-seed-{}.sock\", home_tag())\n}\n\n/// The broker listener name (B1/B2): PTY hosting + gapless handoff.\npub fn broker_socket_name() -> String {\n    format!(\"spt-daemon-broker-{}.sock\", home_tag())\n}\n\n/// The digest-control listener name (B8): the channel `spt digest <id>` connects\n/// to for a snapshot pull or a delta-stream subscribe (ADR-0008 / REQ-TERM-4).\npub fn digest_socket_name() -> String {\n    format!(\"spt-daemon-digest-{}.sock\", home_tag())\n}\n\n/// The drive-control listener name (M11-W2): the channel `spt shell drive` (owner\n/// write) and `api drive-poll --link` (shell take-and-clear) connect to for the\n/// per-shell ephemeral drive slot (REQ-SHELL-3). Broker-served like the digest\n/// channel; the slot is in-memory and dies with the daemon.\n// [impl->REQ-SHELL-3]\npub fn drive_socket_name() -> String {\n    format!(\"spt-daemon-drive-{}.sock\", home_tag())\n}\n\n/// The tunnel-control listener name (M11-W3): the channel `spt shell tunnel` (owner\n/// duplex) and the shell binary's `api tunnel` connect to for the per-shell opaque\n/// byte tunnel registry (REQ-SHELL-4). Broker-served like the drive channel; the\n/// registry holds only held stream ids + the link-token stamp and dies with the\n/// daemon.\n// [impl->REQ-SHELL-4]\npub fn tunnel_socket_name() -> String {\n    format!(\"spt-daemon-tunnel-{}.sock\", home_tag())\n}\n\n/// The service-control listener name (RESIDENT-SERVICE W1): the channel the\n/// `spt` CLI connects to after a successful adapter registration to nudge the\n/// daemon into reconciling that adapter's declared `[service]`\n/// (REQ-RESIDENT-SERVICE's ruled wire op). Broker-served like the drive and\n/// tunnel channels — the supervised set is a daemon-lifetime resource holding\n/// live child handles, and a CLI reaches broker memory, never brain memory.\n// [impl->REQ-RESIDENT-SERVICE]\npub fn service_socket_name() -> String {\n    format!(\"spt-daemon-service-{}.sock\", home_tag())\n}\n\n/// The daemon's pid file: `<spt_home>/daemon.pid`. Best-effort breadcrumb the\n/// running daemon writes on start — discoverable for management/cleanup. Not a\n/// liveness signal (liveness is the seed-control ping); a stale pid here is\n/// harmless because callers probe the socket, never this file.\npub fn daemon_pid_path() -> PathBuf {\n    spt_home().join(\"daemon.pid\")\n}\n\n/// The brain child's readiness breadcrumb: `<spt_home>/brain.ready` (the brain\n/// child's pid, rewritten each heartbeat). The broker spawns the brain as a\n/// supervised child process (ADR-0018 Q2/Q3 — the two-process restoration); the\n/// child writes this once it has connected to the broker socket, and refreshes\n/// it while attached. A test (or a future readiness-gated rollback, ADR-0018\n/// Q7) reads it to confirm the brain came up and — on a pid change — that it\n/// respawned. Best-effort like the daemon pid breadcrumb; liveness of the\n/// *daemon* is still the seed-control ping, never this file.\n// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\npub fn brain_ready_path() -> PathBuf {\n    spt_home().join(\"brain.ready\")\n}\n\n/// Where the peer pump records its last-tick heartbeat (epoch ms, M8\n/// decision 23 / REQ-DAEMON-5): written each pump tick (D4), read by\n\n[Showing lines 1-99 of 122. Use :100 to continue]"}],"details":{"truncation":{"content":"//! Canonical per-machine daemon endpoint names + pid path (B6).\r\n//!\r\n//! The daemon binds two local-IPC listeners — the broker (PTY hosting, B1/B2)\r\n//! and the seed-control channel (B6) — under names derived from the active\r\n//! `spt_home`. Deriving from `spt_home` keeps each isolated home (a test's\r\n//! `SPT_HOME` override, a per-user install) on its own daemon, so parallel test\r\n//! processes never collide on one machine while a real install gets one stable\r\n//! per-home daemon. The auto-start spawn inherits `SPT_HOME`, so the spawned\r\n//! daemon computes the **same** names as the client that started it — that\r\n//! shared derivation is the whole of the rendezvous (no registry lookup).\r\n// [impl->REQ-DAEMON-3]\r\n\r\nuse std::hash::{Hash, Hasher};\r\nuse std::path::PathBuf;\r\n\r\nuse spt_store::perch::spt_home;\r\n\r\n/// A deterministic short tag for the active spt home. `DefaultHasher::new()` is\r\n/// seeded with fixed keys (it is **not** randomized like `RandomState`), so the\r\n/// tag is stable across processes that share the same `spt_home` — exactly what\r\n/// the auto-start handshake needs (the spawned daemon must independently derive\r\n/// the launching client's socket name).\r\nfn home_tag() -> String {\r\n    let mut h = std::collections::hash_map::DefaultHasher::new();\r\n    spt_home().hash(&mut h);\r\n    format!(\"{:016x}\", h.finish())\r\n}\r\n\r\n/// The seed-control listener name (B6): the channel `api seed`/`api listen`\r\n/// connect to for the in-memory seed map. It is also the daemon's liveness\r\n/// anchor — present for the daemon's whole lifetime.\r\npub fn seed_socket_name() -> String {\r\n    format!(\"spt-daemon-seed-{}.sock\", home_tag())\r\n}\r\n\r\n/// The broker listener name (B1/B2): PTY hosting + gapless handoff.\r\npub fn broker_socket_name() -> String {\r\n    format!(\"spt-daemon-broker-{}.sock\", home_tag())\r\n}\r\n\r\n/// The digest-control listener name (B8): the channel `spt digest <id>` connects\r\n/// to for a snapshot pull or a delta-stream subscribe (ADR-0008 / REQ-TERM-4).\r\npub fn digest_socket_name() -> String {\r\n    format!(\"spt-daemon-digest-{}.sock\", home_tag())\r\n}\r\n\r\n/// The drive-control listener name (M11-W2): the channel `spt shell drive` (owner\r\n/// write) and `api drive-poll --link` (shell take-and-clear) connect to for the\r\n/// per-shell ephemeral drive slot (REQ-SHELL-3). Broker-served like the digest\r\n/// channel; the slot is in-memory and dies with the daemon.\r\n// [impl->REQ-SHELL-3]\r\npub fn drive_socket_name() -> String {\r\n    format!(\"spt-daemon-drive-{}.sock\", home_tag())\r\n}\r\n\r\n/// The tunnel-control listener name (M11-W3): the channel `spt shell tunnel` (owner\r\n/// duplex) and the shell binary's `api tunnel` connect to for the per-shell opaque\r\n/// byte tunnel registry (REQ-SHELL-4). Broker-served like the drive channel; the\r\n/// registry holds only held stream ids + the link-token stamp and dies with the\r\n/// daemon.\r\n// [impl->REQ-SHELL-4]\r\npub fn tunnel_socket_name() -> String {\r\n    format!(\"spt-daemon-tunnel-{}.sock\", home_tag())\r\n}\r\n\r\n/// The service-control listener name (RESIDENT-SERVICE W1): the channel the\r\n/// `spt` CLI connects to after a successful adapter registration to nudge the\r\n/// daemon into reconciling that adapter's declared `[service]`\r\n/// (REQ-RESIDENT-SERVICE's ruled wire op). Broker-served like the drive and\r\n/// tunnel channels — the supervised set is a daemon-lifetime resource holding\r\n/// live child handles, and a CLI reaches broker memory, never brain memory.\r\n// [impl->REQ-RESIDENT-SERVICE]\r\npub fn service_socket_name() -> String {\r\n    format!(\"spt-daemon-service-{}.sock\", home_tag())\r\n}\r\n\r\n/// The daemon's pid file: `<spt_home>/daemon.pid`. Best-effort breadcrumb the\r\n/// running daemon writes on start — discoverable for management/cleanup. Not a\r\n/// liveness signal (liveness is the seed-control ping); a stale pid here is\r\n/// harmless because callers probe the socket, never this file.\r\npub fn daemon_pid_path() -> PathBuf {\r\n    spt_home().join(\"daemon.pid\")\r\n}\r\n\r\n/// The brain child's readiness breadcrumb: `<spt_home>/brain.ready` (the brain\r\n/// child's pid, rewritten each heartbeat). The broker spawns the brain as a\r\n/// supervised child process (ADR-0018 Q2/Q3 — the two-process restoration); the\r\n/// child writes this once it has connected to the broker socket, and refreshes\r\n/// it while attached. A test (or a future readiness-gated rollback, ADR-0018\r\n/// Q7) reads it to confirm the brain came up and — on a pid change — that it\r\n/// respawned. Best-effort like the daemon pid breadcrumb; liveness of the\r\n/// *daemon* is still the seed-control ping, never this file.\r\n// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\npub fn brain_ready_path() -> PathBuf {\r\n    spt_home().join(\"brain.ready\")\r\n}\r\n\r\n/// Where the peer pump records its last-tick heartbeat (epoch ms, M8\r\n/// decision 23 / REQ-DAEMON-5): written each pump tick (D4), read by\r","truncated":true,"truncatedBy":"lines","totalLines":122,"totalBytes":4886,"outputLines":99,"outputBytes":4886,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":122,"displayContent":{"text":"//! Canonical per-machine daemon endpoint names + pid path (B6).\r\n//!\r\n//! The daemon binds two local-IPC listeners — the broker (PTY hosting, B1/B2)\r\n//! and the seed-control channel (B6) — under names derived from the active\r\n//! `spt_home`. Deriving from `spt_home` keeps each isolated home (a test's\r\n//! `SPT_HOME` override, a per-user install) on its own daemon, so parallel test\r\n//! processes never collide on one machine while a real install gets one stable\r\n//! per-home daemon. The auto-start spawn inherits `SPT_HOME`, so the spawned\r\n//! daemon computes the **same** names as the client that started it — that\r\n//! shared derivation is the whole of the rendezvous (no registry lookup).\r\n// [impl->REQ-DAEMON-3]\r\n\r\nuse std::hash::{Hash, Hasher};\r\nuse std::path::PathBuf;\r\n\r\nuse spt_store::perch::spt_home;\r\n\r\n/// A deterministic short tag for the active spt home. `DefaultHasher::new()` is\r\n/// seeded with fixed keys (it is **not** randomized like `RandomState`), so the\r\n/// tag is stable across processes that share the same `spt_home` — exactly what\r\n/// the auto-start handshake needs (the spawned daemon must independently derive\r\n/// the launching client's socket name).\r\nfn home_tag() -> String {\r\n    let mut h = std::collections::hash_map::DefaultHasher::new();\r\n    spt_home().hash(&mut h);\r\n    format!(\"{:016x}\", h.finish())\r\n}\r\n\r\n/// The seed-control listener name (B6): the channel `api seed`/`api listen`\r\n/// connect to for the in-memory seed map. It is also the daemon's liveness\r\n/// anchor — present for the daemon's whole lifetime.\r\npub fn seed_socket_name() -> String {\r\n    format!(\"spt-daemon-seed-{}.sock\", home_tag())\r\n}\r\n\r\n/// The broker listener name (B1/B2): PTY hosting + gapless handoff.\r\npub fn broker_socket_name() -> String {\r\n    format!(\"spt-daemon-broker-{}.sock\", home_tag())\r\n}\r\n\r\n/// The digest-control listener name (B8): the channel `spt digest <id>` connects\r\n/// to for a snapshot pull or a delta-stream subscribe (ADR-0008 / REQ-TERM-4).\r\npub fn digest_socket_name() -> String {\r\n    format!(\"spt-daemon-digest-{}.sock\", home_tag())\r\n}\r\n\r\n/// The drive-control listener name (M11-W2): the channel `spt shell drive` (owner\r\n/// write) and `api drive-poll --link` (shell take-and-clear) connect to for the\r\n/// per-shell ephemeral drive slot (REQ-SHELL-3). Broker-served like the digest\r\n/// channel; the slot is in-memory and dies with the daemon.\r\n// [impl->REQ-SHELL-3]\r\npub fn drive_socket_name() -> String {\r\n    format!(\"spt-daemon-drive-{}.sock\", home_tag())\r\n}\r\n\r\n/// The tunnel-control listener name (M11-W3): the channel `spt shell tunnel` (owner\r\n/// duplex) and the shell binary's `api tunnel` connect to for the per-shell opaque\r\n/// byte tunnel registry (REQ-SHELL-4). Broker-served like the drive channel; the\r\n/// registry holds only held stream ids + the link-token stamp and dies with the\r\n/// daemon.\r\n// [impl->REQ-SHELL-4]\r\npub fn tunnel_socket_name() -> String {\r\n    format!(\"spt-daemon-tunnel-{}.sock\", home_tag())\r\n}\r\n\r\n/// The service-control listener name (RESIDENT-SERVICE W1): the channel the\r\n/// `spt` CLI connects to after a successful adapter registration to nudge the\r\n/// daemon into reconciling that adapter's declared `[service]`\r\n/// (REQ-RESIDENT-SERVICE's ruled wire op). Broker-served like the drive and\r\n/// tunnel channels — the supervised set is a daemon-lifetime resource holding\r\n/// live child handles, and a CLI reaches broker memory, never brain memory.\r\n// [impl->REQ-RESIDENT-SERVICE]\r\npub fn service_socket_name() -> String {\r\n    format!(\"spt-daemon-service-{}.sock\", home_tag())\r\n}\r\n\r\n/// The daemon's pid file: `<spt_home>/daemon.pid`. Best-effort breadcrumb the\r\n/// running daemon writes on start — discoverable for management/cleanup. Not a\r\n/// liveness signal (liveness is the seed-control ping); a stale pid here is\r\n/// harmless because callers probe the socket, never this file.\r\npub fn daemon_pid_path() -> PathBuf {\r\n    spt_home().join(\"daemon.pid\")\r\n}\r\n\r\n/// The brain child's readiness breadcrumb: `<spt_home>/brain.ready` (the brain\r\n/// child's pid, rewritten each heartbeat). The broker spawns the brain as a\r\n/// supervised child process (ADR-0018 Q2/Q3 — the two-process restoration); the\r\n/// child writes this once it has connected to the broker socket, and refreshes\r\n/// it while attached. A test (or a future readiness-gated rollback, ADR-0018\r\n/// Q7) reads it to confirm the brain came up and — on a pid change — that it\r\n/// respawned. Best-effort like the daemon pid breadcrumb; liveness of the\r\n/// *daemon* is still the seed-control ping, never this file.\r\n// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\r\npub fn brain_ready_path() -> PathBuf {\r\n    spt_home().join(\"brain.ready\")\r\n}\r\n\r\n/// Where the peer pump records its last-tick heartbeat (epoch ms, M8\r\n/// decision 23 / REQ-DAEMON-5): written each pump tick (D4), read by\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99]},"fileSize":5981,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\endpoint.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":122,"totalBytes":4886,"outputLines":99,"outputBytes":4886,"shownRange":{"start":1,"end":99},"nextOffset":100}}},"isError":false,"timestamp":1789522850807}}
{"type":"message","id":"8e9599bb","parentId":"536c0990","timestamp":"2026-09-16T01:40:50.809Z","message":{"role":"toolResult","toolCallId":"call_4hmMqnSfeosICDD7EnHTtLHy|fc_0bac546ce171b754016aa9f3a2aedc87d18215bc521cb446dd","toolName":"read","content":[{"type":"text","text":"\"\"\"Encode run-owned daemon environment without changing inherited session guards.\"\"\"\nimport json\nfrom pathlib import Path\nimport sys\n\nop, destination, home = sys.argv[1:]\nif op != 'environment':\n    raise ValueError(op)\nwith Path(destination).open('x', encoding='utf-8') as out:\n    json.dump({'SPT_HOME':home, 'SPT_INSTALL_NO_FIREWALL':'1'}, out)"}],"details":{"totalLines":10,"displayContent":{"text":"\"\"\"Encode run-owned daemon environment without changing inherited session guards.\"\"\"\nimport json\nfrom pathlib import Path\nimport sys\n\nop, destination, home = sys.argv[1:]\nif op != 'environment':\n    raise ValueError(op)\nwith Path(destination).open('x', encoding='utf-8') as out:\n    json.dump({'SPT_HOME':home, 'SPT_INSTALL_NO_FIREWALL':'1'}, out)","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10]},"fileSize":348,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\hertz-fp-driver-review\\d2\\field-rig-r10-w7-a2-QWHXWYUH\\support\\fp-bin\\run-daemon-control.py"}}},"isError":false,"timestamp":1789522850809}}
{"type":"message","id":"d0226150","parentId":"8e9599bb","timestamp":"2026-09-16T01:40:50.818Z","message":{"role":"toolResult","toolCallId":"call_ntbYatCliFeSwrkmDq6N3QXn|fc_0bac546ce171b754016aa9f3a2aef087d1b4ab1fa37c492330","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## brainproc.rs\n 417|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*418|fn consumer_gate(net_enabled: bool, already_started: bool) -> bool {\n 419|    net_enabled && !already_started\n 420|}\n 421|\n...\n 476|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*477|fn write_ready(generation: u64) -> ReadyCost {\n 478|    let mut obj = serde_json::json!({ \"pid\": std::process::id(), \"generation\": generation });\n 479|    // Best-effort: omit `exe_hash` if the self-read fails (additive — a reader\n 480|    // tolerates its absence). Never fail the ready write over a diagnostic field.\n...\n 525|// [impl->REQ-BRAIN-HASH-ONCE]\n*526|fn current_exe_hash() -> Option<String> {\n 527|    static EXE_HASH: OnceLock<Option<String>> = OnceLock::new();\n 528|    EXE_HASH\n 529|        .get_or_init(|| {\n...\n 547|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*548|pub fn parse_ready_generation(body: &str) -> Option<u64> {\n 549|    serde_json::from_str::<serde_json::Value>(body)\n 550|        .ok()?\n 551|        .get(\"generation\")?\n...\n 559|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*560|pub fn parse_ready_exe_hash(body: &str) -> Option<String> {\n 561|    serde_json::from_str::<serde_json::Value>(body)\n 562|        .ok()?\n 563|        .get(\"exe_hash\")?\n...\n 573|// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*574|pub fn ready_generation_at(path: &std::path::Path) -> Option<u64> {\n 575|    parse_ready_generation(&std::fs::read_to_string(path).ok()?)\n 576|}\n 577|\n...\n 606|    /// (the readiness gate reads `None` as not-ready — fail-safe).\n*607|    fn ready_generation(&self) -> Option<u64>;\n 608|    /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609|    /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610|    /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611|    /// trial and falsely promote a brain that never booted).\n*612|    fn clear_ready(&self);\n 613|    /// Promote the candidate: it reached ready. Persist `Applied{version}` plus\n 614|    /// the legacy `applied.json`/`last-outcome=applied` convergence records\n 615|    /// (relocated here from `apply`, where they were the optimistic enlyzeam\n 616|    /// write — promotion is the *real* moment the new code is accepted).\n*617|    fn record_promoted(&self, version: u64);\n 618|    /// Correct the record: the candidate failed readiness. Persist\n 619|    /// `RolledBack{…}` and fire the loud, resurfacing rollback notif.\n 620|    fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n...\n 623|    /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n*624|    fn ready_exe_hash(&self) -> Option<String>;\n 625|    /// The staged artifact's SHA-256 for THIS platform at `version` (the bytes\n 626|    /// the candidate SHOULD be running), or `None` if no staged metadata /\n 627|    /// version mismatch / platform absent — degrades the gate to readiness-only.\n*628|    fn staged_artifact_hash(&self, version: u64) -> Option<String>;\n 629|    /// Whether the OLD brain generation's broker subscriber connection is DRAINED —\n 630|    /// its local controller conn CLOSED or stall-evicted, no blocked writes still\n 631|    /// pending on it (REQ-UPDATE-PROMOTE-DRAINED). Reads BROKER TRUTH in-process (no\n...\n 637|    /// strands an apply where no old-gen control plane exists.\n*638|    fn old_gen_drained(&self) -> bool;\n 639|}\n 640|\n 641|/// The no-trial environment: every probe degrades to \"nothing pending / not\n...\n 649|    }\n*650|    fn ready_generation(&self) -> Option<u64> {\n 651|        None\n 652|    }\n*653|    fn clear_ready(&self) {}\n*654|    fn record_promoted(&self, _version: u64) {}\n 655|    fn record_rolled_back(&self, _q: u64, _r: u64, _bin: &str) {}\n*656|    fn ready_exe_hash(&self) -> Option<String> {\n 657|        None\n 658|    }\n*659|    fn staged_artifact_hash(&self, _version: u64) -> Option<String> {\n 660|        None\n 661|    }\n*662|    fn old_gen_drained(&self) -> bool {\n 663|        // No readiness gate to drive here → no old-gen control plane to drain; the\n 664|        // no-op env promotes exactly as the pre-D6 respawn loop (mirrors its other\n 665|        // no-op effects).\n...\n 693|    }\n*694|    fn ready_generation(&self) -> Option<u64> {\n 695|        ready_generation_at(&brain_ready_path())\n 696|    }\n*697|    fn clear_ready(&self) {\n 698|        let _ = std::fs::remove_file(brain_ready_path());\n 699|    }\n## applyhost.rs\n 383|// [impl->REQ-UPD-4]\n*384|pub fn apply_staged_daemonless(\n 385|    cache: &ReleaseCache,\n 386|    release_keys: &Path,\n 387|    exe_path: &Path,\n...\n 411|// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n*412|fn staged_already_applied(\n 413|    applied_state: Option<&AppliedRecord>,\n 414|    applied_version: Option<u64>,\n 415|    staged_version: u64,\n...\n 527|    #[test]\n*528|    fn staged_already_applied_classifies_up_to_date_vs_newer() {\n 529|        // First-ever apply: nothing applied, no state → proceed.\n 530|        assert!(!staged_already_applied(None, None, 8));\n 531|        // A newer version is staged than what's applied → proceed (apply it).\n...\n 760|    #[test]\n*761|    fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n 762|        let dir = tempfile::tempdir().unwrap();\n 763|        let name = unique_name();\n 764|        let _broker = served_broker(&name);\n...\n 899|    #[test]\n*900|    fn apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint() {\n 901|        let dir = tempfile::tempdir().unwrap();\n 902|        let name = unique_name();\n 903|        let broker = served_broker(&name);\n...\n 946|    #[test]\n*947|    fn apply_staged_daemonless_swaps_binary_with_no_broker() {\n 948|        let dir = tempfile::tempdir().unwrap();\n 949|        let exe = dir.path().join(\"spt-binary\");\n 950|        std::fs::write(&exe, b\"OLD BINARY\").unwrap();\n...\n 985|    #[test]\n*986|    fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n 987|        let dir = tempfile::tempdir().unwrap();\n 988|        let exe = dir.path().join(\"spt-binary\");\n 989|        std::fs::write(&exe, b\"OLD\").unwrap();\n...\n 1031|    #[test]\n*1032|    fn apply_staged_update_set_selects_local_platform_artifact() {\n 1033|        let dir = tempfile::tempdir().unwrap();\n 1034|        let name = unique_name();\n 1035|        let broker = served_broker(&name);\n...\n 1058|    #[test]\n*1059|    fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n 1060|        let dir = tempfile::tempdir().unwrap();\n 1061|        let name = unique_name();\n 1062|        let broker = served_broker(&name);\n...\n 1081|    #[test]\n*1082|    fn apply_staged_update_set_refuses_broker_touching_payloads() {\n 1083|        let dir = tempfile::tempdir().unwrap();\n 1084|        let name = unique_name();\n 1085|        let _broker = served_broker(&name);\n...\n 1111|    #[test]\n*1112|    fn apply_staged_gates_fail_closed_with_the_seat_untouched() {\n 1113|        let dir = tempfile::tempdir().unwrap();\n 1114|        let name = unique_name();\n 1115|        let _broker = served_broker(&name);\n...\n 1164|    #[test]\n*1165|    fn apply_staged_refuses_a_quarantined_version() {\n 1166|        let dir = tempfile::tempdir().unwrap();\n 1167|        let name = unique_name();\n 1168|        let _broker = served_broker(&name);"}],"details":{"scopePath":"crates/spt-daemon/src/brainproc.rs, crates/spt-daemon/src/applyhost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":32,"fileCount":2,"files":["crates/spt-daemon/src/brainproc.rs","crates/spt-daemon/src/applyhost.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/brainproc.rs","count":20},{"path":"crates/spt-daemon/src/applyhost.rs","count":12}],"truncated":true,"perFileLimitReached":20,"displayContent":"# crates/spt-daemon/src/\n## brainproc.rs\n 417│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*418│fn consumer_gate(net_enabled: bool, already_started: bool) -> bool {\n 419│    net_enabled && !already_started\n 420│}\n 421│\n    │...\n 476│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*477│fn write_ready(generation: u64) -> ReadyCost {\n 478│    let mut obj = serde_json::json!({ \"pid\": std::process::id(), \"generation\": generation });\n 479│    // Best-effort: omit `exe_hash` if the self-read fails (additive — a reader\n 480│    // tolerates its absence). Never fail the ready write over a diagnostic field.\n    │...\n 525│// [impl->REQ-BRAIN-HASH-ONCE]\n*526│fn current_exe_hash() -> Option<String> {\n 527│    static EXE_HASH: OnceLock<Option<String>> = OnceLock::new();\n 528│    EXE_HASH\n 529│        .get_or_init(|| {\n    │...\n 547│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*548│pub fn parse_ready_generation(body: &str) -> Option<u64> {\n 549│    serde_json::from_str::<serde_json::Value>(body)\n 550│        .ok()?\n 551│        .get(\"generation\")?\n    │...\n 559│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*560│pub fn parse_ready_exe_hash(body: &str) -> Option<String> {\n 561│    serde_json::from_str::<serde_json::Value>(body)\n 562│        .ok()?\n 563│        .get(\"exe_hash\")?\n    │...\n 573│// [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n*574│pub fn ready_generation_at(path: &std::path::Path) -> Option<u64> {\n 575│    parse_ready_generation(&std::fs::read_to_string(path).ok()?)\n 576│}\n 577│\n    │...\n 606│    /// (the readiness gate reads `None` as not-ready — fail-safe).\n*607│    fn ready_generation(&self) -> Option<u64>;\n 608│    /// Delete `brain.ready` immediately before a trial spawn (**A9** — close the\n 609│    /// cross-lifetime staleness hole: the in-memory generation resets to 0 on a\n 610│    /// broker restart, so a stale gen-0 file would otherwise match a fresh gen-0\n 611│    /// trial and falsely promote a brain that never booted).\n*612│    fn clear_ready(&self);\n 613│    /// Promote the candidate: it reached ready. Persist `Applied{version}` plus\n 614│    /// the legacy `applied.json`/`last-outcome=applied` convergence records\n 615│    /// (relocated here from `apply`, where they were the optimistic enlyzeam\n 616│    /// write — promotion is the *real* moment the new code is accepted).\n*617│    fn record_promoted(&self, version: u64);\n 618│    /// Correct the record: the candidate failed readiness. Persist\n 619│    /// `RolledBack{…}` and fire the loud, resurfacing rollback notif.\n 620│    fn record_rolled_back(&self, quarantine_version: u64, running_version: u64, rollback_binary: &str);\n    │...\n 623│    /// bytes-gate to readiness-only (KH 6.11, N-1-safe).\n*624│    fn ready_exe_hash(&self) -> Option<String>;\n 625│    /// The staged artifact's SHA-256 for THIS platform at `version` (the bytes\n 626│    /// the candidate SHOULD be running), or `None` if no staged metadata /\n 627│    /// version mismatch / platform absent — degrades the gate to readiness-only.\n*628│    fn staged_artifact_hash(&self, version: u64) -> Option<String>;\n 629│    /// Whether the OLD brain generation's broker subscriber connection is DRAINED —\n 630│    /// its local controller conn CLOSED or stall-evicted, no blocked writes still\n 631│    /// pending on it (REQ-UPDATE-PROMOTE-DRAINED). Reads BROKER TRUTH in-process (no\n    │...\n 637│    /// strands an apply where no old-gen control plane exists.\n*638│    fn old_gen_drained(&self) -> bool;\n 639│}\n 640│\n 641│/// The no-trial environment: every probe degrades to \"nothing pending / not\n    │...\n 649│    }\n*650│    fn ready_generation(&self) -> Option<u64> {\n 651│        None\n 652│    }\n*653│    fn clear_ready(&self) {}\n*654│    fn record_promoted(&self, _version: u64) {}\n 655│    fn record_rolled_back(&self, _q: u64, _r: u64, _bin: &str) {}\n*656│    fn ready_exe_hash(&self) -> Option<String> {\n 657│        None\n 658│    }\n*659│    fn staged_artifact_hash(&self, _version: u64) -> Option<String> {\n 660│        None\n 661│    }\n*662│    fn old_gen_drained(&self) -> bool {\n 663│        // No readiness gate to drive here → no old-gen control plane to drain; the\n 664│        // no-op env promotes exactly as the pre-D6 respawn loop (mirrors its other\n 665│        // no-op effects).\n    │...\n 693│    }\n*694│    fn ready_generation(&self) -> Option<u64> {\n 695│        ready_generation_at(&brain_ready_path())\n 696│    }\n*697│    fn clear_ready(&self) {\n 698│        let _ = std::fs::remove_file(brain_ready_path());\n 699│    }\n## applyhost.rs\n  383│// [impl->REQ-UPD-4]\n *384│pub fn apply_staged_daemonless(\n  385│    cache: &ReleaseCache,\n  386│    release_keys: &Path,\n  387│    exe_path: &Path,\n     │...\n  411│// [impl->REQ-UPDATE-APPLY-ALREADY-APPLIED]\n *412│fn staged_already_applied(\n  413│    applied_state: Option<&AppliedRecord>,\n  414│    applied_version: Option<u64>,\n  415│    staged_version: u64,\n     │...\n  527│    #[test]\n *528│    fn staged_already_applied_classifies_up_to_date_vs_newer() {\n  529│        // First-ever apply: nothing applied, no state → proceed.\n  530│        assert!(!staged_already_applied(None, None, 8));\n  531│        // A newer version is staged than what's applied → proceed (apply it).\n     │...\n  760│    #[test]\n *761│    fn apply_staged_refuses_platform_blind_or_mismatched_single() {\n  762│        let dir = tempfile::tempdir().unwrap();\n  763│        let name = unique_name();\n  764│        let _broker = served_broker(&name);\n     │...\n  899│    #[test]\n *900│    fn apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint() {\n  901│        let dir = tempfile::tempdir().unwrap();\n  902│        let name = unique_name();\n  903│        let broker = served_broker(&name);\n     │...\n  946│    #[test]\n *947│    fn apply_staged_daemonless_swaps_binary_with_no_broker() {\n  948│        let dir = tempfile::tempdir().unwrap();\n  949│        let exe = dir.path().join(\"spt-binary\");\n  950│        std::fs::write(&exe, b\"OLD BINARY\").unwrap();\n     │...\n  985│    #[test]\n *986│    fn apply_staged_daemonless_holds_the_fail_closed_gates() {\n  987│        let dir = tempfile::tempdir().unwrap();\n  988│        let exe = dir.path().join(\"spt-binary\");\n  989│        std::fs::write(&exe, b\"OLD\").unwrap();\n     │...\n 1031│    #[test]\n*1032│    fn apply_staged_update_set_selects_local_platform_artifact() {\n 1033│        let dir = tempfile::tempdir().unwrap();\n 1034│        let name = unique_name();\n 1035│        let broker = served_broker(&name);\n     │...\n 1058│    #[test]\n*1059│    fn apply_staged_without_broker_hosted_sessions_swaps_binary() {\n 1060│        let dir = tempfile::tempdir().unwrap();\n 1061│        let name = unique_name();\n 1062│        let broker = served_broker(&name);\n     │...\n 1081│    #[test]\n*1082│    fn apply_staged_update_set_refuses_broker_touching_payloads() {\n 1083│        let dir = tempfile::tempdir().unwrap();\n 1084│        let name = unique_name();\n 1085│        let _broker = served_broker(&name);\n     │...\n 1111│    #[test]\n*1112│    fn apply_staged_gates_fail_closed_with_the_seat_untouched() {\n 1113│        let dir = tempfile::tempdir().unwrap();\n 1114│        let name = unique_name();\n 1115│        let _broker = served_broker(&name);\n     │...\n 1164│    #[test]\n*1165│    fn apply_staged_refuses_a_quarantined_version() {\n 1166│        let dir = tempfile::tempdir().unwrap();\n 1167│        let name = unique_name();\n 1168│        let _broker = served_broker(&name);"},"isError":false,"timestamp":1789522850818}}
{"type":"message","id":"f310a2a9","parentId":"d0226150","timestamp":"2026-09-16T01:40:50.819Z","message":{"role":"toolResult","toolCallId":"call_pngpbiw0LnFWtt0D4jbFQPh0|fc_0bac546ce171b754016aa9f3a2aecc87d18538fddda47b64f1","toolName":"grep","content":[{"type":"text","text":" 25|# silently dropped gate is a defect:\n*26|#   - debug-keygen / debug-pin / debug-rollout --build-current / debug-mark-applied, the\n 27|#     subject_boundary pair that bracketed the producer, and the THREE-WAY PROVENANCE check.\n 28|#     D2 reuses the executable r10 already built and receipted; there is no new artifact to\n 29|#     sign, stage or agree with. The executable is instead PINNED BY EXACT HASH (S1), and\n...\n 402|# The run-local names-only receipt must exist before any spt/cargo invocation.\n*403|python \"$BIN/launch-record.py\" env-before \"$(cygpath -w \"$R\")\" || exit 64\n 404|while IFS= read -r -d '' env_name; do\n 405|  unset \"$env_name\" || { echo \"REFUSED: cannot scrub environment name $env_name\" >&2; exit 64; }\n 406|done < \"$R/env-remove.names\"\n*407|python \"$BIN/launch-record.py\" env-after \"$(cygpath -w \"$R\")\" || exit 64\n 408|\n 409|stamp()  { echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) $1\" >> \"$R/timeline.txt\"; }\n 410|record() { echo \"$1\" | tee -a \"$R/findings.txt\"; }\n...\n 633|  [ \"$runner_sha\" = \"$TEARDOWN_RUNNER_SHA256\" ] && [ \"$literal_sha\" = \"$TEARDOWN_LITERAL_SHA256\" ] || return 1\n*634|  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$R/teardown.argv.json\")\" \\\n 635|    --noprofile --norc \"$TEARDOWN_RUNNER\" \"$PREPARE_REQUEST_FILE\" \"$request\" run || return 1\n*636|  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/teardown.environment.json\")\" \\\n 637|    GRANT_LITERAL_PINNED \"$TEARDOWN_COMMAND_FILE\" GRANT_LITERAL_SHA \"$TEARDOWN_LITERAL_SHA256\" \\\n 638|    GRANT_PAYLOAD_SHA \"$TEARDOWN_B64_SHA256\" || return 1\n 639|  # L2 owns the one native record from reservation through terminal publication.\n...\n 695|          local native_rc=0\n*696|          python \"$BIN/launch-record.py\" complete-native \"$(cygpath -w \"$R/teardown.native.json\")\" \"$nonce\" || native_rc=$?\n 697|          case \"$native_rc\" in\n 698|            2) sleep 1; continue ;; # Receipt precedes terminal job record; same clock.\n 699|            0) : ;;\n...\n 1011|launch_file() { echo \"$R/launched-identities.txt\"; }\n*1012|launcher_record() { python \"$BIN/launch-record.py\" field \"$2\" \"$1\"; }\n 1013|launch_admission() { # LABEL -> audited creation-chain scope, never inferred from a scan\n 1014|  case \"$1\" in\n 1015|    identity_capture_*|portfields_*|census_*|rule_probe_*|d1_*_render|d1_*_exec|d2_*_capture) echo process-tree ;;\n...\n 1020|  LAUNCH_SEQ=$((LAUNCH_SEQ + 1))\n*1021|  python \"$BIN/launch-record.py\" register \"$(cygpath -w \"$R\")\" \"$1\" \"$(cygpath -w \"$2\")\" \"$LAUNCH_SEQ\" >> \"$R/findings.txt\"\n 1022|}\n 1023|measure_termination() { # LABEL SEQ DEADLINE: status is owned-job evidence, not a pid scan\n 1024|  local label=\"$1\" seq=\"$2\" rec\n...\n 1055|  if [ -z \"$lwin\" ]; then BOUNDED_STATE=SETUP_FAILED; return 91; fi\n*1056|  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$argf\")\" \"$@\" || { BOUNDED_STATE=SETUP_FAILED; return 91; }\n 1057|  admission=$(launch_admission \"$label\")\n 1058|  stamp \"${label}_START deadline_epoch=$dl admission=$admission\"\n 1059|  pwsh -NoProfile -File \"$(cygpath -w \"$BIN/launch-v2.ps1\")\" \\\n...\n 1079|  local summary=\"$R/.coverage-values.txt\"\n*1080|  python \"$BIN/launch-record.py\" aggregate \"$(cygpath -w \"$R\")\" \"${LAUNCH_SEQ:-0}\" \"${RUN_JOB_EXPECTED:-0}\" > \"$summary\" || return 1\n 1081|  local k v\n 1082|  while read -r k v; do\n 1083|    case \"$k\" in coverage) OPERATION_COVERAGE=\"$v\" ;; termination) OPERATION_TERMINATION=\"$v\" ;; direct) DIRECT_SUBJECT_STATES=\"$v\" ;; esac\n...\n 1091|  local rec=\"$R/run-daemon.json\" args=\"$R/run-daemon-args.json\" envf=\"$R/run-daemon-env.json\"\n*1092|  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$args\")\" daemon run || return 1\n*1093|  python \"$BIN/run-daemon-control.py\" environment \"$(cygpath -w \"$envf\")\" \"$(cygpath -w \"$H\")\" || return 1\n 1094|  local seconds; seconds=$(( EXP_DEADLINE + PRE_TEARDOWN_BUDGET_S + CLEANUP_HANDOFF_WAIT_S + CLEANUP_BUDGET_S - $(date +%s) ))\n 1095|  [ \"$seconds\" -gt 10 ] || return 1\n 1096|  pwsh -NoProfile -File \"$(cygpath -w \"$BIN/launch-v2.ps1\")\" \\\n...\n 1250|  CLEANUP_CLOCK_STATE=STARTED\n*1251|  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/cleanup-clock.json\")\" \\\n 1252|    mode \"$mode\" start_utc \"$CLEANUP_START_UTC\" start_epoch \"$epoch\" \\\n 1253|    deadline_epoch \"$CLEANUP_DEADLINE\" budget_seconds \"$CLEANUP_BUDGET_S\" \\\n 1254|    report_deadline_epoch \"$REPORT_DEADLINE\" || { cfail \"cleanup clock evidence could not be written\"; return 1; }\n...\n 2067|  CLEANUP_VERDICT_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)\n*2068|  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/cleanup-verdict.json\")\" \\\n 2069|    verdict \"$CLEANUP_VERDICT\" verdict_utc \"$CLEANUP_VERDICT_UTC\" clock_state \"$CLEANUP_CLOCK_STATE\" \\\n 2070|    start_utc \"$CLEANUP_START_UTC\" failures \"$CLEANUP_FAILURES\" || cfail \"cleanup verdict evidence could not be written\"\n 2071|  d2_ledger\n...\n 2117|  EXPERIMENTAL_VERDICT_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)\n*2118|  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/experimental-verdict.json\")\" \\\n 2119|    capture_contract \"$CAPTURE_CONTRACT\" verdict_utc \"$EXPERIMENTAL_VERDICT_UTC\" \\\n 2120|    activity_end_utc \"$EXPERIMENTAL_END_UTC\" activity_end_reason \"$EXPERIMENTAL_ENDED\" \\\n 2121|    original_exit \"$ORIGINAL_RC\" || cfail \"experimental verdict evidence could not be written\"\n...\n 2396|# measurement instead of a name filter.\n*2397|for inst in census.ps1 runner-census.ps1 portfields.ps1 d1_render.py d2_capture.ps1 d2_validate.py launch-v2.ps1 launch-v2.cs launch-record.py run-daemon-ready.ps1 run-daemon-control.py; do\n 2398|  [ -f \"$BIN/$inst\" ] || die \"instrument $BIN/$inst is missing — every dependency must exist before any runnable claim\"\n 2399|done\n 2400|sha256sum \"$BIN\"/census.ps1 \"$BIN\"/runner-census.ps1 \"$BIN\"/portfields.ps1 \"$BIN\"/d1_render.py \\\n 2401|          \"$BIN\"/d2_capture.ps1 \"$BIN\"/d2_validate.py \"$BIN\"/launch-v2.ps1 \"$BIN\"/launch-v2.cs \\\n*2402|          \"$BIN\"/launch-record.py \"$BIN\"/run-daemon-ready.ps1 \"$BIN\"/run-daemon-control.py \\\n 2403|  > \"$R/INSTRUMENTS.sha256\" 2>\"$R/instruments.err\"\n 2404|irc=$?\n 2405|exits \"instruments_sha_EXIT=$irc\"\n...\n 2726|T1_CODE=\"& '$BIN/d2_capture.ps1' -CapturePoint 't1' -RuleName @('$RULE_TAILNET','$RULE_LAN') -Port $PORT -IsolatedHome '$H' -RunId '$RUN_ID' -OutPath '$R/d2-t1.json' -ControlRuleName '$CONTROL_RULE' -AbsentControlName '$ABSENT_CONTROL' -PreSetupAbsence '$PRE_SETUP_ABSENCE' -SetupIntervalStart (Get-Content -Raw '$R/setup-start.utc').Trim() -SetupIntervalEnd (Get-Content -Raw '$R/setup-return.utc').Trim(); exit \\$LASTEXITCODE\"\n*2727|python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$R/d2-t1.argv.json\")\" -NoProfile -Command \"$T1_CODE\" || die \"capture argv preparation failed\"\n 2728|( set -o noclobber; printf '{}\\n' > \"$R/d2-t1.environment.json\" ) || die \"capture environment reservation failed\"\n 2729|T1_LAUNCH=\"pwsh -NoProfile -File '$BIN/launch-v2.ps1' -Label 't1-$RUN_ID' -Seconds ([Math]::Min(90, ([long][IO.File]::ReadAllText('$R/d2-t1.deadline') - [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - 5))) -RecordFile '$R/d2-t1.native.json' -ArgsFile '$R/d2-t1.argv.json' -Exe '$CAPTURE_PWSH' -OutFile '$R/d2-t1.out' -ErrFile '$R/d2-t1.err' -Admission process-tree -Scope step -EnvironmentFile '$R/d2-t1.environment.json'\"\n 2730|LEG_CLOCK_BEGIN=\"\\$ErrorActionPreference='Stop'; \\$legStart=[DateTimeOffset]::UtcNow; \\$entries=@(@('$R/setup-start.utc',\\$legStart.UtcDateTime.ToString('yyyy-MM-ddTHH:mm:ssZ')),@('$R/elevated-leg-start.epoch',[string]\\$legStart.ToUnixTimeSeconds()),@('$R/d2-t1.deadline',[string](\\$legStart.ToUnixTimeSeconds()+$ELEVATED_LEG_BUDGET_S))); foreach(\\$entry in \\$entries){\\$file=[IO.File]::Open(\\$entry[0],[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read); try{\\$bytes=[Text.Encoding]::ASCII...."}],"details":{"scopePath":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\hertz-fp-driver-review\\d2\\field-rig-r10-w7-a2-QWHXWYUH\\support\\fp-driver-d2-r10-w7-a2.frozen.sh","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":18,"fileCount":1,"files":[".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh"],"fileMatches":[{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh","count":18}],"truncated":false,"displayContent":"   25│# silently dropped gate is a defect:\n  *26│#   - debug-keygen / debug-pin / debug-rollout --build-current / debug-mark-applied, the\n   27│#     subject_boundary pair that bracketed the producer, and the THREE-WAY PROVENANCE check.\n   28│#     D2 reuses the executable r10 already built and receipted; there is no new artifact to\n   29│#     sign, stage or agree with. The executable is instead PINNED BY EXACT HASH (S1), and\n     │...\n  402│# The run-local names-only receipt must exist before any spt/cargo invocation.\n *403│python \"$BIN/launch-record.py\" env-before \"$(cygpath -w \"$R\")\" || exit 64\n  404│while IFS= read -r -d '' env_name; do\n  405│  unset \"$env_name\" || { echo \"REFUSED: cannot scrub environment name $env_name\" >&2; exit 64; }\n  406│done < \"$R/env-remove.names\"\n *407│python \"$BIN/launch-record.py\" env-after \"$(cygpath -w \"$R\")\" || exit 64\n  408│\n  409│stamp()  { echo \"$(date -u +%Y-%m-%dT%H:%M:%SZ) $1\" >> \"$R/timeline.txt\"; }\n  410│record() { echo \"$1\" | tee -a \"$R/findings.txt\"; }\n     │...\n  633│  [ \"$runner_sha\" = \"$TEARDOWN_RUNNER_SHA256\" ] && [ \"$literal_sha\" = \"$TEARDOWN_LITERAL_SHA256\" ] || return 1\n *634│  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$R/teardown.argv.json\")\" \\\n  635│    --noprofile --norc \"$TEARDOWN_RUNNER\" \"$PREPARE_REQUEST_FILE\" \"$request\" run || return 1\n *636│  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/teardown.environment.json\")\" \\\n  637│    GRANT_LITERAL_PINNED \"$TEARDOWN_COMMAND_FILE\" GRANT_LITERAL_SHA \"$TEARDOWN_LITERAL_SHA256\" \\\n  638│    GRANT_PAYLOAD_SHA \"$TEARDOWN_B64_SHA256\" || return 1\n  639│  # L2 owns the one native record from reservation through terminal publication.\n     │...\n  695│          local native_rc=0\n *696│          python \"$BIN/launch-record.py\" complete-native \"$(cygpath -w \"$R/teardown.native.json\")\" \"$nonce\" || native_rc=$?\n  697│          case \"$native_rc\" in\n  698│            2) sleep 1; continue ;; # Receipt precedes terminal job record; same clock.\n  699│            0) : ;;\n     │...\n 1011│launch_file() { echo \"$R/launched-identities.txt\"; }\n*1012│launcher_record() { python \"$BIN/launch-record.py\" field \"$2\" \"$1\"; }\n 1013│launch_admission() { # LABEL -> audited creation-chain scope, never inferred from a scan\n 1014│  case \"$1\" in\n 1015│    identity_capture_*|portfields_*|census_*|rule_probe_*|d1_*_render|d1_*_exec|d2_*_capture) echo process-tree ;;\n     │...\n 1020│  LAUNCH_SEQ=$((LAUNCH_SEQ + 1))\n*1021│  python \"$BIN/launch-record.py\" register \"$(cygpath -w \"$R\")\" \"$1\" \"$(cygpath -w \"$2\")\" \"$LAUNCH_SEQ\" >> \"$R/findings.txt\"\n 1022│}\n 1023│measure_termination() { # LABEL SEQ DEADLINE: status is owned-job evidence, not a pid scan\n 1024│  local label=\"$1\" seq=\"$2\" rec\n     │...\n 1055│  if [ -z \"$lwin\" ]; then BOUNDED_STATE=SETUP_FAILED; return 91; fi\n*1056│  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$argf\")\" \"$@\" || { BOUNDED_STATE=SETUP_FAILED; return 91; }\n 1057│  admission=$(launch_admission \"$label\")\n 1058│  stamp \"${label}_START deadline_epoch=$dl admission=$admission\"\n 1059│  pwsh -NoProfile -File \"$(cygpath -w \"$BIN/launch-v2.ps1\")\" \\\n     │...\n 1079│  local summary=\"$R/.coverage-values.txt\"\n*1080│  python \"$BIN/launch-record.py\" aggregate \"$(cygpath -w \"$R\")\" \"${LAUNCH_SEQ:-0}\" \"${RUN_JOB_EXPECTED:-0}\" > \"$summary\" || return 1\n 1081│  local k v\n 1082│  while read -r k v; do\n 1083│    case \"$k\" in coverage) OPERATION_COVERAGE=\"$v\" ;; termination) OPERATION_TERMINATION=\"$v\" ;; direct) DIRECT_SUBJECT_STATES=\"$v\" ;; esac\n     │...\n 1091│  local rec=\"$R/run-daemon.json\" args=\"$R/run-daemon-args.json\" envf=\"$R/run-daemon-env.json\"\n*1092│  python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$args\")\" daemon run || return 1\n*1093│  python \"$BIN/run-daemon-control.py\" environment \"$(cygpath -w \"$envf\")\" \"$(cygpath -w \"$H\")\" || return 1\n 1094│  local seconds; seconds=$(( EXP_DEADLINE + PRE_TEARDOWN_BUDGET_S + CLEANUP_HANDOFF_WAIT_S + CLEANUP_BUDGET_S - $(date +%s) ))\n 1095│  [ \"$seconds\" -gt 10 ] || return 1\n 1096│  pwsh -NoProfile -File \"$(cygpath -w \"$BIN/launch-v2.ps1\")\" \\\n     │...\n 1250│  CLEANUP_CLOCK_STATE=STARTED\n*1251│  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/cleanup-clock.json\")\" \\\n 1252│    mode \"$mode\" start_utc \"$CLEANUP_START_UTC\" start_epoch \"$epoch\" \\\n 1253│    deadline_epoch \"$CLEANUP_DEADLINE\" budget_seconds \"$CLEANUP_BUDGET_S\" \\\n 1254│    report_deadline_epoch \"$REPORT_DEADLINE\" || { cfail \"cleanup clock evidence could not be written\"; return 1; }\n     │...\n 2067│  CLEANUP_VERDICT_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)\n*2068│  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/cleanup-verdict.json\")\" \\\n 2069│    verdict \"$CLEANUP_VERDICT\" verdict_utc \"$CLEANUP_VERDICT_UTC\" clock_state \"$CLEANUP_CLOCK_STATE\" \\\n 2070│    start_utc \"$CLEANUP_START_UTC\" failures \"$CLEANUP_FAILURES\" || cfail \"cleanup verdict evidence could not be written\"\n 2071│  d2_ledger\n     │...\n 2117│  EXPERIMENTAL_VERDICT_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)\n*2118│  python \"$BIN/launch-record.py\" snapshot \"$(cygpath -w \"$R/experimental-verdict.json\")\" \\\n 2119│    capture_contract \"$CAPTURE_CONTRACT\" verdict_utc \"$EXPERIMENTAL_VERDICT_UTC\" \\\n 2120│    activity_end_utc \"$EXPERIMENTAL_END_UTC\" activity_end_reason \"$EXPERIMENTAL_ENDED\" \\\n 2121│    original_exit \"$ORIGINAL_RC\" || cfail \"experimental verdict evidence could not be written\"\n     │...\n 2396│# measurement instead of a name filter.\n*2397│for inst in census.ps1 runner-census.ps1 portfields.ps1 d1_render.py d2_capture.ps1 d2_validate.py launch-v2.ps1 launch-v2.cs launch-record.py run-daemon-ready.ps1 run-daemon-control.py; do\n 2398│  [ -f \"$BIN/$inst\" ] || die \"instrument $BIN/$inst is missing — every dependency must exist before any runnable claim\"\n 2399│done\n 2400│sha256sum \"$BIN\"/census.ps1 \"$BIN\"/runner-census.ps1 \"$BIN\"/portfields.ps1 \"$BIN\"/d1_render.py \\\n 2401│          \"$BIN\"/d2_capture.ps1 \"$BIN\"/d2_validate.py \"$BIN\"/launch-v2.ps1 \"$BIN\"/launch-v2.cs \\\n*2402│          \"$BIN\"/launch-record.py \"$BIN\"/run-daemon-ready.ps1 \"$BIN\"/run-daemon-control.py \\\n 2403│  > \"$R/INSTRUMENTS.sha256\" 2>\"$R/instruments.err\"\n 2404│irc=$?\n 2405│exits \"instruments_sha_EXIT=$irc\"\n     │...\n 2726│T1_CODE=\"& '$BIN/d2_capture.ps1' -CapturePoint 't1' -RuleName @('$RULE_TAILNET','$RULE_LAN') -Port $PORT -IsolatedHome '$H' -RunId '$RUN_ID' -OutPath '$R/d2-t1.json' -ControlRuleName '$CONTROL_RULE' -AbsentControlName '$ABSENT_CONTROL' -PreSetupAbsence '$PRE_SETUP_ABSENCE' -SetupIntervalStart (Get-Content -Raw '$R/setup-start.utc').Trim() -SetupIntervalEnd (Get-Content -Raw '$R/setup-return.utc').Trim(); exit \\$LASTEXITCODE\"\n*2727│python \"$BIN/launch-record.py\" argv \"$(cygpath -w \"$R/d2-t1.argv.json\")\" -NoProfile -Command \"$T1_CODE\" || die \"capture argv preparation failed\"\n 2728│( set -o noclobber; printf '{}\\n' > \"$R/d2-t1.environment.json\" ) || die \"capture environment reservation failed\"\n 2729│T1_LAUNCH=\"pwsh -NoProfile -File '$BIN/launch-v2.ps1' -Label 't1-$RUN_ID' -Seconds ([Math]::Min(90, ([long][IO.File]::ReadAllText('$R/d2-t1.deadline') - [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - 5))) -RecordFile '$R/d2-t1.native.json' -ArgsFile '$R/d2-t1.argv.json' -Exe '$CAPTURE_PWSH' -OutFile '$R/d2-t1.out' -ErrFile '$R/d2-t1.err' -Admission process-tree -Scope step -EnvironmentFile '$R/d2-t1.environment.json'\"\n 2730│LEG_CLOCK_BEGIN=\"\\$ErrorActionPreference='Stop'; \\$legStart=[DateTimeOffset]::UtcNow; \\$entries=@(@('$R/setup-start.utc',\\$legStart.UtcDateTime.ToString('yyyy-MM-ddTHH:mm:ssZ')),@('$R/elevated-leg-start.epoch',[string]\\$legStart.ToUnixTimeSeconds()),@('$R/d2-t1.deadline',[string](\\$legStart.ToUnixTimeSeconds()+$ELEVATED_LEG_BUDGET_S))); foreach(\\$entry in \\$entries){\\$file=[IO.File]::Open(\\$entry[0],[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::Read); try{\\$bytes=[Text.Encoding]::ASCII...."},"isError":false,"timestamp":1789522850819}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_KppV6oG8hfts7usb4gdih4J5|fc_0bac546ce171b754016aa9f3b05c5487d1a9fe4b498048d5b5","toolName":"glob","startedAt":"2026-09-16T01:41:04.442Z","args":{"path":".spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/fp-driver*r10*.sh"},"intent":"Finding original signing driver"},"id":"3342467e","parentId":"f310a2a9","timestamp":"2026-09-16T01:41:04.442Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_7dQvpoNVs3d8ZYHGuiBaQmjU|fc_0bac546ce171b754016aa9f3b05c6887d1ab8e18958d3d86b7","toolName":"read","startedAt":"2026-09-16T01:41:04.442Z","args":{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1:1-110"},"intent":"Reading launcher arguments"},"id":"8fa402a5","parentId":"3342467e","timestamp":"2026-09-16T01:41:04.442Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_0QF5YF5kskULCIXE3KhceEM7|fc_0bac546ce171b754016aa9f3b05c6c87d1a456fdf868a6dbba","toolName":"read","startedAt":"2026-09-16T01:41:04.442Z","args":{"path":"crates/spt-daemon/src/brainproc.rs:840-931,1030-1080"},"intent":"Reading trial decisions"},"id":"914e4984","parentId":"8fa402a5","timestamp":"2026-09-16T01:41:04.442Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_gLmM2joo7q3tXA2y2JUPBkit|fc_0bac546ce171b754016aa9f3b05c7487d18026e21c2bb927dc","toolName":"grep","startedAt":"2026-09-16T01:41:04.442Z","args":{"path":"crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/brainproc.rs:1750-2400"},"intent":"Locating backpressure attribution sites"},"id":"6ce1e8bf","parentId":"914e4984","timestamp":"2026-09-16T01:41:04.442Z"}
{"type":"message","id":"13a562ff","parentId":"6ce1e8bf","timestamp":"2026-09-16T01:41:04.442Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Checking worktree constants**"},{"type":"toolCall","id":"call_KppV6oG8hfts7usb4gdih4J5|fc_0bac546ce171b754016aa9f3b05c5487d1a9fe4b498048d5b5","name":"glob","arguments":{"i":"Finding original signing driver","path":".spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/fp-driver*r10*.sh","hidden":true,"gitignore":false,"limit":25},"intent":"Finding original signing driver"},{"type":"toolCall","id":"call_7dQvpoNVs3d8ZYHGuiBaQmjU|fc_0bac546ce171b754016aa9f3b05c6887d1ab8e18958d3d86b7","name":"read","arguments":{"i":"Reading launcher arguments","path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1:1-110"},"intent":"Reading launcher arguments"},{"type":"toolCall","id":"call_0QF5YF5kskULCIXE3KhceEM7|fc_0bac546ce171b754016aa9f3b05c6c87d1a456fdf868a6dbba","name":"read","arguments":{"i":"Reading trial decisions","path":"crates/spt-daemon/src/brainproc.rs:840-931,1030-1080"},"intent":"Reading trial decisions"},{"type":"toolCall","id":"call_gLmM2joo7q3tXA2y2JUPBkit|fc_0bac546ce171b754016aa9f3b05c7487d18026e21c2bb927dc","name":"grep","arguments":{"i":"Locating backpressure attribution sites","pattern":"send_deadline|stall_evict|BRAIN_SUBSCRIBER_STALL_EVICT|CONTROLLER_|BRAIN_WRITE|fn .*drained|fn .*trial|fn .*promot","path":"crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/brainproc.rs:1750-2400","case":true,"gitignore":true,"skip":0},"intent":"Locating backpressure attribution sites"},{"type":"toolCall","id":"call_JX9kEiEECP7WYiWKGaNX7dUS|fc_0bac546ce171b754016aa9f3b05c7c87d1b7e794b2673041a3","name":"read","arguments":{"i":"Reading cache set commit","path":"crates/spt-daemon/src/relcache.rs:25-40,263-302"},"intent":"Reading cache set commit"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":7761,"output":351,"cacheRead":41472,"cacheWrite":0,"totalTokens":49584,"reasoningTokens":25,"cost":{"input":0.07761000000000001,"output":0.01755,"cacheRead":0.041471999999999995,"cacheWrite":0,"total":0.136632}},"stopReason":"toolUse","timestamp":1789522850850,"responseId":"resp_0bac546ce171b754016aa9f3a33e2087d1af4bf0b47a2d8150","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_0bac546ce171b754016aa9f3a5d8c087d198652fdfaf38d180","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqfOwaF0bXkx6eo6fiFv-EmoZjsww5PI4K2mR8l2BjCppJju_tAnv3w2jYUizRgGMfTJ9FWNq9RowWuNU-v_bAWc3EGucj_yTEqZR96ESbY9wo1IycnE_MHlTkfIWAo6RJcxBsDezMJSZWdGql3qirS5Dhvf7JecnDH2uM3XDIBqfSJ13onbpTL5qtYwK7UOP8LWwZcjsKzobw2JqpOOc_VADYKMnALluLmQjOx4yr5tfOKMAisfAEYvXVQVXmtnBALIBNYGa4yeK8Xg6NtU9S4CzGOsstlCNF-OUE1p_BVJUq8hscwh3PkxdpYsG_uA9FZFcz4mKNCYyOY49LNtYahgqV0RWV0snd_o1U3mWU9W83SZL3UoDJkjSGA3qsM4SbFC6ceUCBsCs1bhBbYGDhoknwb_sOxvyRAS--zRiul4uUbXEJR0_4SozCxKGOrZDbbCvMCiIpxuVe-KQrGD26GbjdihRdUuUNaWcDWcZW1leMopfkIrRP99FDzSBYFV6VOCtTxdKpjkEGCqArFyyeQHwO2zxkNpA1taM7-slo9mCueofGIv_ChgnJZJRIpDWbKk1HaVDSi1IwFG4ATRoXx5IwMBXn3G2Fcj3UMxW-b_1jPnvxEzlpLkKvApVgFlzC3-pKg_iaggIn_fB2lQmHAXXWAqq7OlyYGDhx3yu7sqPHkM1PEPitL8efqFrRwwDH742Pm3iTtFhrOUCrly0u4gIIH0pBuJemRn6mRrz8YA2T7NmoKEflwl3ZpJEk01_egauOvcdU4T17Ow6_q7Tzi9JJjikerg383p0iOnsYA7NxR6Nnm_Y5N7lIjkSwI0kdMjcFpwbKVkcChIwg234WyYY-7d4oWGHqhTuaiLPsfHFinSqxf_90BfOkNI5rgeh5UGsIYdvTMr7EQU6kSLcdeS_3JByGLCsobSlDjPvIgbuZcNUAKSDEPbWZmaxNlecINHK9x16cZ7REH1SZzva722YOIjMI5YUTQlYxPrv4a8KA4wQwzibCOTYVkylV8uiuteQrCBehlm6bR9SIkAySyLky3ny5wL1_tQJ0Z6JLGr23EEzVMJB2d56o3lJTcQdC0XfLyO9FkMra_zAcLMba4LiqVfhALMI_QaknniXaJE174UFy8NO3lIz2Z2wAt_fqcCfXUYDbNPmyBvHX5TYNQTjo9AkIzvFdPggsjvx3DHRxM9i1j_HkaDgI4lwQJ5uWGq6p1Akg7jbmdP4sMqYRjwv1zz-YUJeVZ-_hmRkiq0Y0r9ncX2013mzRz2xt8xevT0u5GeyIwBRYPIKiAHKC-_yia9r6l5Qe7FL--0i_wqCEEz40plHCengLkeTPyC3VcwLR3q9O1JW1H7M7GED0EuX4_0QFs1Vy_q1o_VLTQbWNJmaf0U1Mgoeo30GxkMnRNh6yMMOjpqWmA4snqOJLe9FSIUi7tgeQOFhIch8MKhKWNE=","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"summary":[{"type":"summary_text","text":"**Checking worktree constants**"}],"metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3b05c5487d1a9fe4b498048d5b5","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding original signing driver\",\"path\":\".spt/preserved/**/staged-r8-cleanup-exit.sh;.spt/preserved/**/fp-driver*r10*.sh\",\"hidden\":true,\"gitignore\":false,\"limit\":25}","call_id":"call_KppV6oG8hfts7usb4gdih4J5","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"glob","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3b05c6887d1ab8e18958d3d86b7","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading launcher arguments\",\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1:1-110\"}","call_id":"call_7dQvpoNVs3d8ZYHGuiBaQmjU","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3b05c6c87d1a456fdf868a6dbba","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading trial decisions\",\"path\":\"crates/spt-daemon/src/brainproc.rs:840-931,1030-1080\"}","call_id":"call_0QF5YF5kskULCIXE3KhceEM7","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3b05c7487d18026e21c2bb927dc","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating backpressure attribution sites\",\"pattern\":\"send_deadline|stall_evict|BRAIN_SUBSCRIBER_STALL_EVICT|CONTROLLER_|BRAIN_WRITE|fn .*drained|fn .*trial|fn .*promot\",\"path\":\"crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/brainproc.rs:1750-2400\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_gLmM2joo7q3tXA2y2JUPBkit","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3b05c7c87d1b7e794b2673041a3","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading cache set commit\",\"path\":\"crates/spt-daemon/src/relcache.rs:25-40,263-302\"}","call_id":"call_JX9kEiEECP7WYiWKGaNX7dUS","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":13590.04230000003,"ttft":3020.540099999984,"completedAt":1789522864441,"contextSnapshot":{"promptTokens":49233,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_JX9kEiEECP7WYiWKGaNX7dUS|fc_0bac546ce171b754016aa9f3b05c7c87d1b7e794b2673041a3","toolName":"read","startedAt":"2026-09-16T01:41:04.443Z","args":{"path":"crates/spt-daemon/src/relcache.rs:25-40,263-302"},"intent":"Reading cache set commit"},"id":"64704683","parentId":"13a562ff","timestamp":"2026-09-16T01:41:04.443Z"}
{"type":"message","id":"e7f511cd","parentId":"64704683","timestamp":"2026-09-16T01:41:04.450Z","message":{"role":"toolResult","toolCallId":"call_JX9kEiEECP7WYiWKGaNX7dUS|fc_0bac546ce171b754016aa9f3b05c7c87d1b7e794b2673041a3","toolName":"read","content":[{"type":"text","text":"use std::path::{Path, PathBuf};\n\nuse serde::{Deserialize, Serialize};\nuse spt_store::atomic::{atomic_write_bytes, atomic_write_string};\n\nuse crate::release::{\n    current_platform, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateSetMetadata,\n};\n\n/// File name of the staged release's signed metadata (the commit point).\nconst RELEASE_FILE: &str = \"release.json\";\n/// File name of the staged artifact bytes.\nconst ARTIFACT_FILE: &str = \"artifact.bin\";\n/// Directory for platform-targeted update-set artifact bytes.\nconst ARTIFACTS_DIR: &str = \"artifacts\";\n/// File name of the platform stamp for a staged **single** release — the\n…\n    /// metadata last (commit point). The caller MUST have verified that the\n    /// provided bytes match the signed digests.\n    // [impl->REQ-UPD-6]\n    pub fn stage_update_set(\n        &self,\n        signed: &SignedUpdateSet,\n        artifacts: &std::collections::BTreeMap<String, Vec<u8>>,\n    ) -> io::Result<()> {\n        std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n        let _ = std::fs::remove_file(self.artifact_path());\n        // A set self-describes its platforms in signed metadata; the single\n        // stamp must not linger from a prior single stage. [impl->REQ-UPD-8]\n        let _ = std::fs::remove_file(self.platform_path());\n        for (platform, bytes) in artifacts {\n            atomic_write_bytes(&self.artifact_path_for_platform(platform), bytes)?;\n        }\n        let json = serde_json::to_string_pretty(signed)\n            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n        atomic_write_string(&self.release_path(), &json)\n    }\n\n    /// Path of the staged docs bundle (`spt-docs.tar.gz` bytes), staged beside\n    /// the artifacts by [`stage_docs`](Self::stage_docs).\n    // [impl->REQ-DOCS-RELEASE-ASSET]\n    pub fn docs_bundle_path(&self) -> PathBuf {\n        self.dir.join(DOCS_BUNDLE_FILE)\n    }\n\n    /// Stage a verified docs bundle beside the staged set. The caller MUST\n    /// have verified the bytes against the signed set's docs entry\n    /// (`verify_update_set_docs`) — the cache never re-derives trust. Failure\n    /// isolation lives with the CALLER: a docs staging error must never fail\n    /// the binary staging that preceded it (ADR-0036 §4).\n    // [impl->REQ-DOCS-RELEASE-ASSET]\n    pub fn stage_docs(&self, bundle: &[u8]) -> io::Result<()> {\n        std::fs::create_dir_all(&self.dir)?;\n        atomic_write_bytes(&self.docs_bundle_path(), bundle)\n    }\n\n    /// The staged docs bundle bytes, or `None` when no bundle is staged (a"}],"details":{"displayContent":{"text":"use std::path::{Path, PathBuf};\n\nuse serde::{Deserialize, Serialize};\nuse spt_store::atomic::{atomic_write_bytes, atomic_write_string};\n\nuse crate::release::{\n    current_platform, ReleaseMetadata, SignedRelease, SignedUpdateSet, UpdateSetMetadata,\n};\n\n/// File name of the staged release's signed metadata (the commit point).\nconst RELEASE_FILE: &str = \"release.json\";\n/// File name of the staged artifact bytes.\nconst ARTIFACT_FILE: &str = \"artifact.bin\";\n/// Directory for platform-targeted update-set artifact bytes.\nconst ARTIFACTS_DIR: &str = \"artifacts\";\n/// File name of the platform stamp for a staged **single** release — the\n…\n    /// metadata last (commit point). The caller MUST have verified that the\n    /// provided bytes match the signed digests.\n    // [impl->REQ-UPD-6]\n    pub fn stage_update_set(\n        &self,\n        signed: &SignedUpdateSet,\n        artifacts: &std::collections::BTreeMap<String, Vec<u8>>,\n    ) -> io::Result<()> {\n        std::fs::create_dir_all(self.dir.join(ARTIFACTS_DIR))?;\n        let _ = std::fs::remove_file(self.artifact_path());\n        // A set self-describes its platforms in signed metadata; the single\n        // stamp must not linger from a prior single stage. [impl->REQ-UPD-8]\n        let _ = std::fs::remove_file(self.platform_path());\n        for (platform, bytes) in artifacts {\n            atomic_write_bytes(&self.artifact_path_for_platform(platform), bytes)?;\n        }\n        let json = serde_json::to_string_pretty(signed)\n            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;\n        atomic_write_string(&self.release_path(), &json)\n    }\n\n    /// Path of the staged docs bundle (`spt-docs.tar.gz` bytes), staged beside\n    /// the artifacts by [`stage_docs`](Self::stage_docs).\n    // [impl->REQ-DOCS-RELEASE-ASSET]\n    pub fn docs_bundle_path(&self) -> PathBuf {\n        self.dir.join(DOCS_BUNDLE_FILE)\n    }\n\n    /// Stage a verified docs bundle beside the staged set. The caller MUST\n    /// have verified the bytes against the signed set's docs entry\n    /// (`verify_update_set_docs`) — the cache never re-derives trust. Failure\n    /// isolation lives with the CALLER: a docs staging error must never fail\n    /// the binary staging that preceded it (ADR-0036 §4).\n    // [impl->REQ-DOCS-RELEASE-ASSET]\n    pub fn stage_docs(&self, bundle: &[u8]) -> io::Result<()> {\n        std::fs::create_dir_all(&self.dir)?;\n        atomic_write_bytes(&self.docs_bundle_path(), bundle)\n    }\n\n    /// The staged docs bundle bytes, or `None` when no bundle is staged (a","startLine":25,"lineNumbers":[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,null,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302]},"fileSize":33505,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\relcache.rs"}}},"isError":false,"timestamp":1789522864450}}
{"type":"message","id":"172b0d23","parentId":"e7f511cd","timestamp":"2026-09-16T01:41:04.465Z","message":{"role":"toolResult","toolCallId":"call_0QF5YF5kskULCIXE3KhceEM7|fc_0bac546ce171b754016aa9f3b05c6c87d1a456fdf868a6dbba","toolName":"read","content":[{"type":"text","text":"enum TrialStep {\n…\n    Stopped,\n}\n\n/// Watch a freshly-spawned trial candidate for readiness within `window`\n/// (ADR-0018 Q7, D6-2). Polls in `TICK` slices (so a daemon stop stays prompt,\n/// A11/note-ii) for a `brain.ready` stamp **== this spawn's `generation`** — a\n/// stale stamp from another generation never satisfies the gate (the single\n/// load-bearing correctness invariant; the A9 clear-before-spawn closes the\n/// cross-lifetime exact-generation hole). Returns the moment readiness is seen\n/// **AND the old generation has drained**, the child exits pre-ready, the window\n/// elapses, or `stop` is raised.\n///\n/// **The DRAINED precondition (REQ-UPDATE-PROMOTE-DRAINED).** `brain.ready` alone is\n/// NOT a promote: the W2 stall-evict only BOUNDS the false-promote window to\n/// `BRAIN_WRITE_DEADLINE`, so a new brain can signal ready while the OLD generation's\n/// local controller conn is still wedged (the 22:47 apply \"promoted\" onto a frozen\n/// control plane). So readiness is LATCHED (`ready_seen` — a candidate that stamped\n/// ready then exited is not demoted, preserving the ready-then-exit-still-promotes\n/// semantic) and promotion waits for `env.old_gen_drained()` too. While ready-seen\n/// but not-yet-drained the watch keeps polling to `deadline`; if the drain never\n/// comes the window elapses to [`TrialStep::WindowElapsedAlive`] — the caller KILLS\n/// the candidate and rolls back (conservative: never a false-promote onto a wedge).\n/// The normal case drains well inside the window — W2 bounds a real drain to\n/// `BRAIN_WRITE_DEADLINE` (15 s) < [`SUPERVISE_HEALTHY_RUN`] (30 s) — and a cleanly-\n/// closed old conn drains at once. `child.try_wait()` is consulted only while\n/// NOT-yet-ready, so a ready-then-exited candidate still promotes once drained.\nfn run_trial(\n    child: &mut Child,\n    generation: u64,\n    window: Duration,\n    env: &dyn TrialEnv,\n    stop: &AtomicBool,\n) -> TrialStep {\n    let deadline = Instant::now() + window;\n    let mut ready_seen = false;\n    // ONCE PER TRIAL (releases#49/#267 Q3). The gate is a pure read that says\n    // nothing when it says no, so a trial that waited on the drain and a trial\n    // that never had to are the same silence. One line on the FIRST not-drained\n    // read ends that; repeating it every tick would turn an answer into a log.\n    let mut not_drained_reported = false;\n    loop {\n        if stop.load(Ordering::Relaxed) {\n            return TrialStep::Stopped;\n        }\n        // Latch readiness FIRST (don't demote a ready-then-exit child) — but do NOT\n        // promote on it alone: the old generation's control plane must have drained.\n        if !ready_seen && env.ready_generation() == Some(generation) {\n            ready_seen = true;\n        }\n        if ready_seen {\n            // ONE observation, read once and used twice — the promote decision and\n            // the diagnostic line are the SAME read. A second `old_gen_drained()`\n            // call to describe what the first one decided could disagree with it,\n            // and a diagnostic that can contradict the branch it reports on is\n            // worse than no diagnostic.\n            let drained = env.old_gen_drained();\n            if drained {\n                return TrialStep::Promoted;\n            }\n            // THE NARROWER FACT, DELIBERATELY. The gate answers one bool over every\n            // hosted session; naming WHICH session is wedged would need a second,\n            // separately-taken scan, so this reports what this observation actually\n            // established — that the gate was EVALUATED and read not-drained — and\n            // nothing about which conn held it. It is scoped to THIS trial: earlier\n            // trials evaluated the same gate and this line says nothing about them, so\n            // it must not be read as the first evaluation the daemon ever made. It is\n            // also not evidence that the\n            // heartbeat's drain-driving `brain.sessions()` call completed: this says\n            // the gate was consulted, never that the reap ran.\n            // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n            if !not_drained_reported {\n                not_drained_reported = true;\n                if crate::brain::diag_trace_enabled() {\n                    spt_proto::emit_line_err!(\n                        \"BRAIN_PROMOTE_GATE_NOT_DRAINED: generation {generation} — ready latched \\\n                         and the DRAINED gate read NOT drained; this is the first such \\\n                         observation in THIS trial, not the first evaluation of the gate; the trial \\\n                         keeps polling to its window \\\n                         [REQ-REFRESH-WAIT-ATTRIBUTION]\"\n                    );\n                }\n            }\n        }\n        // Only watch for a pre-ready exit while the candidate has NOT reached ready;\n        // once ready-seen we are waiting on the OLD gen to drain, and a ready-then-\n        // exited child still promotes (the exit is a normal later respawn).\n        if !ready_seen {\n            match child.try_wait() {\n                Ok(Some(_)) => return TrialStep::PreReadyExit,\n                Ok(None) => {}\n                // A wait error: treat as a pre-ready exit (fail toward retry, never\n                // a panic in the supervisor thread).\n…\n            }\n        }\n…\n    }\n}\n…\n                let mut supervise = !is_trial;\n                if is_trial {\n                    match run_trial(&mut child, generation, window, env, stop) {\n                        TrialStep::Stopped => {\n                            let _ = child.kill();\n                            let _ = child.wait();\n                            return;\n                        }\n                        TrialStep::Promoted => {\n                            // Bytes-gate (KH 6.11): readiness != new-bytes. Promote\n                            // only if the candidate is running the staged bytes; a\n                            // ready-but-wrong-bytes candidate (e.g. a Linux respawn\n                            // onto the renamed old binary) fails the trial → kill +\n                            // rollback, never a falsely-`applied` record.\n                            let version = match &record {\n                                Some(AppliedRecord::AppliedPending { version, .. }) => Some(*version),\n                                _ => None,\n                            };\n                            if let Some(version) = version {\n                                if let BytesGate::Mismatch = bytes_gate(env, version) {\n                                    spt_proto::emit_line_err!(\"BRAIN_PROMOTE_REJECTED: candidate v{version} ready but running the WRONG bytes (generation {generation}) — rolling back (KH 6.11)\");\n                                    let _ = child.kill();\n                                    let _ = child.wait();\n                                    rollback(env, &record);\n                                    pre_ready_exits = 0;\n                                    generation += 1;\n                                    reason = StartReason::Crash;\n                                    backoff = base;\n                                    continue;\n                                }\n                                spt_proto::emit_line_err!(\"BRAIN_PROMOTED: candidate v{version} signalled ready (generation {generation}) — swap accepted\");\n                                env.record_promoted(version);\n                            }\n                            pre_ready_exits = 0;\n                            backoff = base;\n                            supervise = true; // keep supervising the now-accepted child\n                        }\n                        TrialStep::PreReadyExit => {\n                            pre_ready_exits += 1;\n                            spt_proto::emit_line_err!(\"BRAIN_TRIAL_EXIT: candidate exited pre-ready ({pre_ready_exits}/{TRIAL_PREREADY_BUDGET})\");\n                            if pre_ready_exits >= TRIAL_PREREADY_BUDGET {\n                                rollback(env, &record);\n                                pre_ready_exits = 0;\n                                // The rollback binary is known-good — respawn it\n                                // promptly, no crash-penalty backoff (mirror the\n                                // WindowElapsedAlive path); only the under-budget\n                                // candidate retries keep the doubling backoff.\n                                backoff = base;\n                            } else {\n                                backoff = next_backoff(backoff, started.elapsed(), base);\n                            }\n…\n                        }\n…\n                    }\n                }"}],"details":{"displayContent":{"text":"enum TrialStep {\n…\n    Stopped,\n}\n\n/// Watch a freshly-spawned trial candidate for readiness within `window`\n/// (ADR-0018 Q7, D6-2). Polls in `TICK` slices (so a daemon stop stays prompt,\n/// A11/note-ii) for a `brain.ready` stamp **== this spawn's `generation`** — a\n/// stale stamp from another generation never satisfies the gate (the single\n/// load-bearing correctness invariant; the A9 clear-before-spawn closes the\n/// cross-lifetime exact-generation hole). Returns the moment readiness is seen\n/// **AND the old generation has drained**, the child exits pre-ready, the window\n/// elapses, or `stop` is raised.\n///\n/// **The DRAINED precondition (REQ-UPDATE-PROMOTE-DRAINED).** `brain.ready` alone is\n/// NOT a promote: the W2 stall-evict only BOUNDS the false-promote window to\n/// `BRAIN_WRITE_DEADLINE`, so a new brain can signal ready while the OLD generation's\n/// local controller conn is still wedged (the 22:47 apply \"promoted\" onto a frozen\n/// control plane). So readiness is LATCHED (`ready_seen` — a candidate that stamped\n/// ready then exited is not demoted, preserving the ready-then-exit-still-promotes\n/// semantic) and promotion waits for `env.old_gen_drained()` too. While ready-seen\n/// but not-yet-drained the watch keeps polling to `deadline`; if the drain never\n/// comes the window elapses to [`TrialStep::WindowElapsedAlive`] — the caller KILLS\n/// the candidate and rolls back (conservative: never a false-promote onto a wedge).\n/// The normal case drains well inside the window — W2 bounds a real drain to\n/// `BRAIN_WRITE_DEADLINE` (15 s) < [`SUPERVISE_HEALTHY_RUN`] (30 s) — and a cleanly-\n/// closed old conn drains at once. `child.try_wait()` is consulted only while\n/// NOT-yet-ready, so a ready-then-exited candidate still promotes once drained.\nfn run_trial(\n    child: &mut Child,\n    generation: u64,\n    window: Duration,\n    env: &dyn TrialEnv,\n    stop: &AtomicBool,\n) -> TrialStep {\n    let deadline = Instant::now() + window;\n    let mut ready_seen = false;\n    // ONCE PER TRIAL (releases#49/#267 Q3). The gate is a pure read that says\n    // nothing when it says no, so a trial that waited on the drain and a trial\n    // that never had to are the same silence. One line on the FIRST not-drained\n    // read ends that; repeating it every tick would turn an answer into a log.\n    let mut not_drained_reported = false;\n    loop {\n        if stop.load(Ordering::Relaxed) {\n            return TrialStep::Stopped;\n        }\n        // Latch readiness FIRST (don't demote a ready-then-exit child) — but do NOT\n        // promote on it alone: the old generation's control plane must have drained.\n        if !ready_seen && env.ready_generation() == Some(generation) {\n            ready_seen = true;\n        }\n        if ready_seen {\n            // ONE observation, read once and used twice — the promote decision and\n            // the diagnostic line are the SAME read. A second `old_gen_drained()`\n            // call to describe what the first one decided could disagree with it,\n            // and a diagnostic that can contradict the branch it reports on is\n            // worse than no diagnostic.\n            let drained = env.old_gen_drained();\n            if drained {\n                return TrialStep::Promoted;\n            }\n            // THE NARROWER FACT, DELIBERATELY. The gate answers one bool over every\n            // hosted session; naming WHICH session is wedged would need a second,\n            // separately-taken scan, so this reports what this observation actually\n            // established — that the gate was EVALUATED and read not-drained — and\n            // nothing about which conn held it. It is scoped to THIS trial: earlier\n            // trials evaluated the same gate and this line says nothing about them, so\n            // it must not be read as the first evaluation the daemon ever made. It is\n            // also not evidence that the\n            // heartbeat's drain-driving `brain.sessions()` call completed: this says\n            // the gate was consulted, never that the reap ran.\n            // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n            if !not_drained_reported {\n                not_drained_reported = true;\n                if crate::brain::diag_trace_enabled() {\n                    spt_proto::emit_line_err!(\n                        \"BRAIN_PROMOTE_GATE_NOT_DRAINED: generation {generation} — ready latched \\\n                         and the DRAINED gate read NOT drained; this is the first such \\\n                         observation in THIS trial, not the first evaluation of the gate; the trial \\\n                         keeps polling to its window \\\n                         [REQ-REFRESH-WAIT-ATTRIBUTION]\"\n                    );\n                }\n            }\n        }\n        // Only watch for a pre-ready exit while the candidate has NOT reached ready;\n        // once ready-seen we are waiting on the OLD gen to drain, and a ready-then-\n        // exited child still promotes (the exit is a normal later respawn).\n        if !ready_seen {\n            match child.try_wait() {\n                Ok(Some(_)) => return TrialStep::PreReadyExit,\n                Ok(None) => {}\n                // A wait error: treat as a pre-ready exit (fail toward retry, never\n                // a panic in the supervisor thread).\n…\n            }\n        }\n…\n    }\n}\n…\n                let mut supervise = !is_trial;\n                if is_trial {\n                    match run_trial(&mut child, generation, window, env, stop) {\n                        TrialStep::Stopped => {\n                            let _ = child.kill();\n                            let _ = child.wait();\n                            return;\n                        }\n                        TrialStep::Promoted => {\n                            // Bytes-gate (KH 6.11): readiness != new-bytes. Promote\n                            // only if the candidate is running the staged bytes; a\n                            // ready-but-wrong-bytes candidate (e.g. a Linux respawn\n                            // onto the renamed old binary) fails the trial → kill +\n                            // rollback, never a falsely-`applied` record.\n                            let version = match &record {\n                                Some(AppliedRecord::AppliedPending { version, .. }) => Some(*version),\n                                _ => None,\n                            };\n                            if let Some(version) = version {\n                                if let BytesGate::Mismatch = bytes_gate(env, version) {\n                                    spt_proto::emit_line_err!(\"BRAIN_PROMOTE_REJECTED: candidate v{version} ready but running the WRONG bytes (generation {generation}) — rolling back (KH 6.11)\");\n                                    let _ = child.kill();\n                                    let _ = child.wait();\n                                    rollback(env, &record);\n                                    pre_ready_exits = 0;\n                                    generation += 1;\n                                    reason = StartReason::Crash;\n                                    backoff = base;\n                                    continue;\n                                }\n                                spt_proto::emit_line_err!(\"BRAIN_PROMOTED: candidate v{version} signalled ready (generation {generation}) — swap accepted\");\n                                env.record_promoted(version);\n                            }\n                            pre_ready_exits = 0;\n                            backoff = base;\n                            supervise = true; // keep supervising the now-accepted child\n                        }\n                        TrialStep::PreReadyExit => {\n                            pre_ready_exits += 1;\n                            spt_proto::emit_line_err!(\"BRAIN_TRIAL_EXIT: candidate exited pre-ready ({pre_ready_exits}/{TRIAL_PREREADY_BUDGET})\");\n                            if pre_ready_exits >= TRIAL_PREREADY_BUDGET {\n                                rollback(env, &record);\n                                pre_ready_exits = 0;\n                                // The rollback binary is known-good — respawn it\n                                // promptly, no crash-penalty backoff (mirror the\n                                // WindowElapsedAlive path); only the under-budget\n                                // candidate retries keep the doubling backoff.\n                                backoff = base;\n                            } else {\n                                backoff = next_backoff(backoff, started.elapsed(), base);\n                            }\n…\n                        }\n…\n                    }\n                }","startLine":825,"lineNumbers":[825,null,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,null,936,937,null,942,943,null,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,null,1085,null,1102,1103]},"fileSize":122482,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\brainproc.rs"}}},"isError":false,"timestamp":1789522864465}}
{"type":"message","id":"d487ed98","parentId":"172b0d23","timestamp":"2026-09-16T01:41:04.475Z","message":{"role":"toolResult","toolCallId":"call_gLmM2joo7q3tXA2y2JUPBkit|fc_0bac546ce171b754016aa9f3b05c7487d18026e21c2bb927dc","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## broker.rs\n 165|/// merely-slow controller DROPS chunks + falls behind the ring, and only a channel\n*166|/// that stays full for [`CONTROLLER_WRITE_DEADLINE`] (tracked via\n 167|/// [`ControllerSink::last_ok`]) is detached. Generous so a momentary slow consumer\n 168|/// never trips the deadline.\n*169|const CONTROLLER_CHANNEL_DEPTH: usize = 4096;\n 170|\n 171|/// How long a CONTROLLER's channel may stay FULL (no successful handoff since\n 172|/// [`ControllerSink::last_ok`]) before the drain declares it stalled and detaches it\n...\n 178|/// untouched.\n*179|const CONTROLLER_WRITE_DEADLINE: Duration = Duration::from_secs(5);\n 180|\n 181|/// The RESIZE BARRIER's drain-quiescence window (REQ-RC-RESIZE-GEOMETRY-EPOCH):\n 182|/// how long the appended high-water must hold STILL before the surface resize is\n...\n 213|/// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE). Distinct from and 3× longer than\n*214|/// [`CONTROLLER_WRITE_DEADLINE`] on PURPOSE (doyle ruling Q1): that 5 s bound\n 215|/// protects the fan-out against ONE per-client conn falling behind and is\n 216|/// output-driven (the drain observes a Full channel); THIS bound is measured\n 217|/// full-with-**zero writer progress** and covers the case the output-driven path\n...\n 225|// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n*226|const BRAIN_WRITE_DEADLINE: Duration = Duration::from_secs(15);\n 227|\n*228|/// The EFFECTIVE brain-write deadline. Production is [`BRAIN_WRITE_DEADLINE`]; the\n*229|/// suspend-brain int rig shrinks it via `SPT_BRAIN_WRITE_DEADLINE_MS` so the\n 230|/// structural outcome (a wedged controller is stall-evicted → take/reattach frees\n 231|/// the slot) is provable in ~1 s instead of 15 (mirrors the\n 232|/// `SPT_INJECT_COMMIT_DEADLINE_MS` env-knob precedent). Grants test wall-clock\n...\n 235|fn brain_write_deadline() -> Duration {\n*236|    match std::env::var(\"SPT_BRAIN_WRITE_DEADLINE_MS\") {\n 237|        Ok(ms) => ms\n 238|            .parse::<u64>()\n 239|            .map(Duration::from_millis)\n*240|            .unwrap_or(BRAIN_WRITE_DEADLINE),\n*241|        Err(_) => BRAIN_WRITE_DEADLINE,\n 242|    }\n 243|}\n 244|\n...\n 545|/// A brain that never returns is then a DIAGNOSABLE fact — surfaced on `daemon\n*546|/// status` (via [`Broker::stall_evict_stats`]) alongside the per-evict broker log\n 547|/// line, not a silent absence.\n 548|// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n 549|static STALL_EVICT_COUNT: AtomicU64 = AtomicU64::new(0);\n...\n 560|// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n*561|fn record_stall_evict() {\n 562|    STALL_EVICT_COUNT.fetch_add(1, Ordering::Relaxed);\n 563|    STALL_EVICT_LAST_MS.store(crate::brain::now_ms(), Ordering::Relaxed);\n 564|}\n...\n 575|\n*576|pub(crate) fn stall_evict_stats() -> (u64, u64) {\n 577|    (\n 578|        STALL_EVICT_COUNT.load(Ordering::Relaxed),\n 579|        STALL_EVICT_LAST_MS.load(Ordering::Relaxed),\n...\n 620|/// buggy translation binary can therefore stall operator input for at most this\n*621|/// long. Mirrors [`CONTROLLER_WRITE_DEADLINE`]'s order (5 s).\n 622|const INJECT_COMMIT_DEADLINE: Duration = Duration::from_secs(5);\n 623|\n 624|/// The effective commit deadline. Production is the const above; the int gate\n...\n 827|/// advances `delivered_through` on each successful write, and it is never evicted\n*828|/// on a single full `try_send` — only after [`CONTROLLER_WRITE_DEADLINE`].\n 829|struct ControllerSink {\n 830|    /// The bounded live-frame queue to the controller's writer thread.\n 831|    tx: SyncSender<CtrlMsg>,\n...\n 865|    /// The drain does a SINGLE non-blocking `try_send` per chunk and NEVER sleeps;\n*866|    /// a channel that stays Full for [`CONTROLLER_WRITE_DEADLINE`] PAST this stamp\n 867|    /// evicts the stalled controller (bounded wedge preserved), while a slow-but-\n 868|    /// alive controller just drops the chunk + falls behind the ring (resume-from-\n 869|    /// floor). Seeded `now` at [`OutputLog::become_controller`].\n...\n 875|    /// ([`OutputLog::controller_stalled`]) sees a `Some` older than\n*876|    /// [`BRAIN_WRITE_DEADLINE`] as a writer WEDGED on a suspended/black-holed brain\n 877|    /// conn and stall-evicts it — the signal `last_ok` (channel-handoff time) cannot\n 878|    /// give: an IDLE controller (writer parked on `rx.recv()`, `None` here) and a\n 879|    /// BLOCKED one (writer stuck in the socket write, `Some` here) both leave\n...\n 1456|    /// left the HANDOFF as an inline sleep-poll (`ControllerJob::deliver`, up to\n*1457|    /// `CONTROLLER_WRITE_DEADLINE`) ON the drain — so a controller draining slower\n 1458|    /// than the PTY floods filled its channel, the inline poll throttled the drain,\n 1459|    /// and the viewer fan-out below stopped running → a concurrent `rc --view`\n 1460|    /// VIEWER starved. Now the controller handoff is ONE non-blocking `try_send`\n...\n 1462|    /// controller speed. A slow-but-alive controller DROPS the chunk + falls behind\n*1463|    /// the ring (resume-from-floor); a controller Full for `CONTROLLER_WRITE_DEADLINE`\n 1464|    /// since its last successful handoff (`ControllerSink::last_ok`) is evicted\n 1465|    /// (bounded wedge preserved). The writer still does the blocking socket write +\n 1466|    /// advances the authoritative CONTIGUOUS cursor. Called only from the session's\n...\n 1576|                Err(TrySendError::Full(_)) => {\n*1577|                    if now.duration_since(c.last_ok) >= CONTROLLER_WRITE_DEADLINE {\n 1578|                        Some(epoch) // stalled past the deadline → bounded detach\n 1579|                    } else {\n 1580|                        None // drop this chunk; controller falls behind the ring\n## brainproc.rs\n 1760|        }\n*1761|        fn record_promoted(&self, version: u64) {\n 1762|            self.promotions.lock().unwrap().push(version);\n 1763|            *self.state.lock().unwrap() = Some(AppliedRecord::Applied { version });\n 1764|        }\n...\n 1780|        }\n*1781|        fn old_gen_drained(&self) -> bool {\n 1782|            // Countdown: false (still draining) while > 0, decrementing; then true.\n 1783|            // Single-threaded per env in these harnesses (the supervisor polls\n 1784|            // sequentially), so a plain load/store is race-free here.\n...\n 1821|    #[test]\n*1822|    fn trial_promotes_on_ready_then_supervises_the_accepted_binary() {\n 1823|        let env = Arc::new(TestTrialEnv::pending(7, \"/good/spt.old-7\"));\n 1824|        let stop = Arc::new(AtomicBool::new(false));\n 1825|        let restart = BrainRestart::new();\n...\n 1869|    #[test]\n*1870|    fn ready_but_old_gen_never_drains_does_not_promote_rolls_back() {\n 1871|        // Ready is stamped, bytes match (so a bare readiness gate WOULD promote), but\n 1872|        // the old-gen control plane never drains within the window.\n 1873|        let env = Arc::new(\n...\n 1917|    #[test]\n*1918|    fn ready_candidate_promotes_once_old_gen_drains() {\n 1919|        let env = Arc::new(TestTrialEnv::pending(7, \"/good/spt.old-7\").drains_after(1));\n 1920|        let stop = Arc::new(AtomicBool::new(false));\n 1921|        let restart = BrainRestart::new();\n...\n 2001|    #[test]\n*2002|    fn ready_but_wrong_bytes_rolls_back_never_promotes() {\n 2003|        let env = Arc::new(\n 2004|            TestTrialEnv::pending(8, \"/good/spt.old-8\")\n 2005|                .with_hashes(Some(\"oldbytes\"), Some(\"newbytes\")),\n...\n 2044|    #[test]\n*2045|    fn ready_with_matching_bytes_promotes() {\n 2046|        let env = Arc::new(\n 2047|            TestTrialEnv::pending(8, \"/good/spt.old-8\")\n 2048|                .with_hashes(Some(\"samebytes\"), Some(\"samebytes\")),\n...\n 2089|    #[test]\n*2090|    fn trial_rolls_back_after_budget_of_pre_ready_exits() {\n 2091|        let env = Arc::new(TestTrialEnv::pending(9, \"/good/spt.old-9\"));\n 2092|        let stop = Arc::new(AtomicBool::new(false));\n 2093|        let restart = BrainRestart::new();\n...\n 2144|    #[test]\n*2145|    fn trial_kills_alive_never_ready_candidate_before_rollback() {\n 2146|        let env = Arc::new(TestTrialEnv::pending(5, \"/good/spt.old-5\"));\n 2147|        let stop = Arc::new(AtomicBool::new(false));\n 2148|        let restart = BrainRestart::new();\n...\n 2190|    #[test]\n*2191|    fn stale_generation_minus_one_ready_never_promotes() {\n 2192|        let env = Arc::new(TestTrialEnv::pending(3, \"/good/spt.old-3\"));\n 2193|        let stop = Arc::new(AtomicBool::new(false));\n 2194|        let restart = BrainRestart::new();"}],"details":{"scopePath":"crates/spt-daemon/src/broker.rs, crates/spt-daemon/src/brainproc.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":30,"fileCount":2,"files":["crates/spt-daemon/src/broker.rs","crates/spt-daemon/src/brainproc.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/broker.rs","count":20},{"path":"crates/spt-daemon/src/brainproc.rs","count":10}],"truncated":true,"perFileLimitReached":20,"displayContent":"# crates/spt-daemon/src/\n## broker.rs\n  165│/// merely-slow controller DROPS chunks + falls behind the ring, and only a channel\n *166│/// that stays full for [`CONTROLLER_WRITE_DEADLINE`] (tracked via\n  167│/// [`ControllerSink::last_ok`]) is detached. Generous so a momentary slow consumer\n  168│/// never trips the deadline.\n *169│const CONTROLLER_CHANNEL_DEPTH: usize = 4096;\n  170│\n  171│/// How long a CONTROLLER's channel may stay FULL (no successful handoff since\n  172│/// [`ControllerSink::last_ok`]) before the drain declares it stalled and detaches it\n     │...\n  178│/// untouched.\n *179│const CONTROLLER_WRITE_DEADLINE: Duration = Duration::from_secs(5);\n  180│\n  181│/// The RESIZE BARRIER's drain-quiescence window (REQ-RC-RESIZE-GEOMETRY-EPOCH):\n  182│/// how long the appended high-water must hold STILL before the surface resize is\n     │...\n  213│/// REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE). Distinct from and 3× longer than\n *214│/// [`CONTROLLER_WRITE_DEADLINE`] on PURPOSE (doyle ruling Q1): that 5 s bound\n  215│/// protects the fan-out against ONE per-client conn falling behind and is\n  216│/// output-driven (the drain observes a Full channel); THIS bound is measured\n  217│/// full-with-**zero writer progress** and covers the case the output-driven path\n     │...\n  225│// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n *226│const BRAIN_WRITE_DEADLINE: Duration = Duration::from_secs(15);\n  227│\n *228│/// The EFFECTIVE brain-write deadline. Production is [`BRAIN_WRITE_DEADLINE`]; the\n *229│/// suspend-brain int rig shrinks it via `SPT_BRAIN_WRITE_DEADLINE_MS` so the\n  230│/// structural outcome (a wedged controller is stall-evicted → take/reattach frees\n  231│/// the slot) is provable in ~1 s instead of 15 (mirrors the\n  232│/// `SPT_INJECT_COMMIT_DEADLINE_MS` env-knob precedent). Grants test wall-clock\n     │...\n  235│fn brain_write_deadline() -> Duration {\n *236│    match std::env::var(\"SPT_BRAIN_WRITE_DEADLINE_MS\") {\n  237│        Ok(ms) => ms\n  238│            .parse::<u64>()\n  239│            .map(Duration::from_millis)\n *240│            .unwrap_or(BRAIN_WRITE_DEADLINE),\n *241│        Err(_) => BRAIN_WRITE_DEADLINE,\n  242│    }\n  243│}\n  244│\n     │...\n  545│/// A brain that never returns is then a DIAGNOSABLE fact — surfaced on `daemon\n *546│/// status` (via [`Broker::stall_evict_stats`]) alongside the per-evict broker log\n  547│/// line, not a silent absence.\n  548│// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n  549│static STALL_EVICT_COUNT: AtomicU64 = AtomicU64::new(0);\n     │...\n  560│// [impl->REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]\n *561│fn record_stall_evict() {\n  562│    STALL_EVICT_COUNT.fetch_add(1, Ordering::Relaxed);\n  563│    STALL_EVICT_LAST_MS.store(crate::brain::now_ms(), Ordering::Relaxed);\n  564│}\n     │...\n  575│\n *576│pub(crate) fn stall_evict_stats() -> (u64, u64) {\n  577│    (\n  578│        STALL_EVICT_COUNT.load(Ordering::Relaxed),\n  579│        STALL_EVICT_LAST_MS.load(Ordering::Relaxed),\n     │...\n  620│/// buggy translation binary can therefore stall operator input for at most this\n *621│/// long. Mirrors [`CONTROLLER_WRITE_DEADLINE`]'s order (5 s).\n  622│const INJECT_COMMIT_DEADLINE: Duration = Duration::from_secs(5);\n  623│\n  624│/// The effective commit deadline. Production is the const above; the int gate\n     │...\n  827│/// advances `delivered_through` on each successful write, and it is never evicted\n *828│/// on a single full `try_send` — only after [`CONTROLLER_WRITE_DEADLINE`].\n  829│struct ControllerSink {\n  830│    /// The bounded live-frame queue to the controller's writer thread.\n  831│    tx: SyncSender<CtrlMsg>,\n     │...\n  865│    /// The drain does a SINGLE non-blocking `try_send` per chunk and NEVER sleeps;\n *866│    /// a channel that stays Full for [`CONTROLLER_WRITE_DEADLINE`] PAST this stamp\n  867│    /// evicts the stalled controller (bounded wedge preserved), while a slow-but-\n  868│    /// alive controller just drops the chunk + falls behind the ring (resume-from-\n  869│    /// floor). Seeded `now` at [`OutputLog::become_controller`].\n     │...\n  875│    /// ([`OutputLog::controller_stalled`]) sees a `Some` older than\n *876│    /// [`BRAIN_WRITE_DEADLINE`] as a writer WEDGED on a suspended/black-holed brain\n  877│    /// conn and stall-evicts it — the signal `last_ok` (channel-handoff time) cannot\n  878│    /// give: an IDLE controller (writer parked on `rx.recv()`, `None` here) and a\n  879│    /// BLOCKED one (writer stuck in the socket write, `Some` here) both leave\n     │...\n 1456│    /// left the HANDOFF as an inline sleep-poll (`ControllerJob::deliver`, up to\n*1457│    /// `CONTROLLER_WRITE_DEADLINE`) ON the drain — so a controller draining slower\n 1458│    /// than the PTY floods filled its channel, the inline poll throttled the drain,\n 1459│    /// and the viewer fan-out below stopped running → a concurrent `rc --view`\n 1460│    /// VIEWER starved. Now the controller handoff is ONE non-blocking `try_send`\n     │...\n 1462│    /// controller speed. A slow-but-alive controller DROPS the chunk + falls behind\n*1463│    /// the ring (resume-from-floor); a controller Full for `CONTROLLER_WRITE_DEADLINE`\n 1464│    /// since its last successful handoff (`ControllerSink::last_ok`) is evicted\n 1465│    /// (bounded wedge preserved). The writer still does the blocking socket write +\n 1466│    /// advances the authoritative CONTIGUOUS cursor. Called only from the session's\n     │...\n 1576│                Err(TrySendError::Full(_)) => {\n*1577│                    if now.duration_since(c.last_ok) >= CONTROLLER_WRITE_DEADLINE {\n 1578│                        Some(epoch) // stalled past the deadline → bounded detach\n 1579│                    } else {\n 1580│                        None // drop this chunk; controller falls behind the ring\n## brainproc.rs\n 1760│        }\n*1761│        fn record_promoted(&self, version: u64) {\n 1762│            self.promotions.lock().unwrap().push(version);\n 1763│            *self.state.lock().unwrap() = Some(AppliedRecord::Applied { version });\n 1764│        }\n     │...\n 1780│        }\n*1781│        fn old_gen_drained(&self) -> bool {\n 1782│            // Countdown: false (still draining) while > 0, decrementing; then true.\n 1783│            // Single-threaded per env in these harnesses (the supervisor polls\n 1784│            // sequentially), so a plain load/store is race-free here.\n     │...\n 1821│    #[test]\n*1822│    fn trial_promotes_on_ready_then_supervises_the_accepted_binary() {\n 1823│        let env = Arc::new(TestTrialEnv::pending(7, \"/good/spt.old-7\"));\n 1824│        let stop = Arc::new(AtomicBool::new(false));\n 1825│        let restart = BrainRestart::new();\n     │...\n 1869│    #[test]\n*1870│    fn ready_but_old_gen_never_drains_does_not_promote_rolls_back() {\n 1871│        // Ready is stamped, bytes match (so a bare readiness gate WOULD promote), but\n 1872│        // the old-gen control plane never drains within the window.\n 1873│        let env = Arc::new(\n     │...\n 1917│    #[test]\n*1918│    fn ready_candidate_promotes_once_old_gen_drains() {\n 1919│        let env = Arc::new(TestTrialEnv::pending(7, \"/good/spt.old-7\").drains_after(1));\n 1920│        let stop = Arc::new(AtomicBool::new(false));\n 1921│        let restart = BrainRestart::new();\n     │...\n 2001│    #[test]\n*2002│    fn ready_but_wrong_bytes_rolls_back_never_promotes() {\n 2003│        let env = Arc::new(\n 2004│            TestTrialEnv::pending(8, \"/good/spt.old-8\")\n 2005│                .with_hashes(Some(\"oldbytes\"), Some(\"newbytes\")),\n     │...\n 2044│    #[test]\n*2045│    fn ready_with_matching_bytes_promotes() {\n 2046│        let env = Arc::new(\n 2047│            TestTrialEnv::pending(8, \"/good/spt.old-8\")\n 2048│                .with_hashes(Some(\"samebytes\"), Some(\"samebytes\")),\n     │...\n 2089│    #[test]\n*2090│    fn trial_rolls_back_after_budget_of_pre_ready_exits() {\n 2091│        let env = Arc::new(TestTrialEnv::pending(9, \"/good/spt.old-9\"));\n 2092│        let stop = Arc::new(AtomicBool::new(false));\n 2093│        let restart = BrainRestart::new();\n     │...\n 2144│    #[test]\n*2145│    fn trial_kills_alive_never_ready_candidate_before_rollback() {\n 2146│        let env = Arc::new(TestTrialEnv::pending(5, \"/good/spt.old-5\"));\n 2147│        let stop = Arc::new(AtomicBool::new(false));\n 2148│        let restart = BrainRestart::new();\n     │...\n 2190│    #[test]\n*2191│    fn stale_generation_minus_one_ready_never_promotes() {\n 2192│        let env = Arc::new(TestTrialEnv::pending(3, \"/good/spt.old-3\"));\n 2193│        let stop = Arc::new(AtomicBool::new(false));\n 2194│        let restart = BrainRestart::new();"},"isError":false,"timestamp":1789522864475}}
{"type":"message","id":"fa77923d","parentId":"d487ed98","timestamp":"2026-09-16T01:41:04.483Z","message":{"role":"toolResult","toolCallId":"call_7dQvpoNVs3d8ZYHGuiBaQmjU|fc_0bac546ce171b754016aa9f3b05c6887d1ab8e18958d3d86b7","toolName":"read","content":[{"type":"text","text":"[CmdletBinding()]\nparam(\n    [Parameter(Mandatory)] [string]$Label,\n    [Parameter(Mandatory)] [ValidateRange(1,2147483)] [int]$Seconds,\n    [Parameter(Mandatory)] [string]$RecordFile,\n    [Parameter(Mandatory)] [string]$ArgsFile,\n    [Parameter(Mandatory)] [string]$Exe,\n    [Parameter(Mandatory)] [string]$OutFile,\n    [Parameter(Mandatory)] [string]$ErrFile,\n    [ValidateSet('process-tree','none')] [string]$Admission = 'none',\n    [ValidateSet('step','run')] [string]$Scope = 'step',\n    [string]$StopFile,\n    [string]$EnvironmentFile,\n    [ValidateSet('none','assignment','accounting','crash-after-resume')] [string]$ControlFault = 'none'\n)\n\n# Start before file setup and compilation; native setup and confirmation share this clock.\n$clock = [Diagnostics.Stopwatch]::StartNew()\n$started = [DateTime]::UtcNow.ToString('o')\n$ErrorActionPreference = 'Stop'\nSet-StrictMode -Version Latest\n$events = $null\n$ownsRecord = $false\n$nativeEntered = $false\n$utf8 = [Text.UTF8Encoding]::new($false)\n$record = [ordered]@{\n    version = 2; label = $Label; scope = $Scope\n    launcher = [ordered]@{ pid = $PID; created = $null; exe = $null }\n    subject = [ordered]@{ pid = 0; created = $null; exe = $null; native_exit = $null; state = 'NOT_STARTED' }\n    completion_reason = 'running'; coverage = 'NONE'; termination = 'NOT_CONFIRMED'\n    job = [ordered]@{ assigned = $false; membership_read = $false; kill_on_close_read = $false; limit_flags = $null; active_processes = $null }\n    started_utc = $started; ended_utc = $null; error = $null\n}\n\nfunction Save-InitialState([string]$Event, [bool]$First) {\n    $json = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $tmp = \"$RecordFile.tmp.$([Guid]::NewGuid().ToString('N'))\"\n    $stream = $null\n    try {\n        $stream = [IO.FileStream]::new($tmp, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n        $bytes = $utf8.GetBytes($json)\n        $stream.Write($bytes, 0, $bytes.Length)\n        $stream.Flush($true)\n        $stream.Dispose(); $stream = $null\n        if ($First) {\n            [IO.File]::Move($tmp, $RecordFile)\n            $script:ownsRecord = $true\n        }\n        else { [IO.File]::Move($tmp, $RecordFile, $true) }\n        $row = ConvertTo-Json -InputObject ([ordered]@{ event = $Event; elapsed_ms = $clock.ElapsedMilliseconds; record = $record }) -Depth 10 -Compress\n        $bytes = $utf8.GetBytes($row + \"`n\")\n        $events.Write($bytes, 0, $bytes.Length)\n        $events.Flush($true)\n    }\n    finally {\n        if ($null -ne $stream) { $stream.Dispose() }\n        # Keep an unpublished temp as failure evidence. Never remove a destination.\n    }\n}\n\ntry {\n    if (-not $IsWindows) { throw 'WINDOWS_REQUIRED' }\n    $destinations = @($RecordFile, $OutFile, $ErrFile, \"$RecordFile.events.jsonl\", \"$RecordFile.membership.json\", \"$RecordFile.membership-request.json\")\n    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)\n    foreach ($path in $destinations) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        $full = [IO.Path]::GetFullPath($path)\n        if (-not $seen.Add($full)) { throw \"ALIASED_DESTINATION: $path\" }\n        if ([IO.File]::Exists($full) -or [IO.Directory]::Exists($full)) { throw \"DESTINATION_EXISTS: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n    }\n    if ($Scope -eq 'run' -and [string]::IsNullOrWhiteSpace($StopFile)) { throw 'RUN_REQUIRES_STOPFILE' }\n    foreach ($path in @($StopFile, $EnvironmentFile)) {\n        if ($path -and -not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        if ($path -and $seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if ($seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    if ($StopFile -and ([IO.File]::Exists($StopFile) -or [IO.Directory]::Exists($StopFile))) { throw 'STOPFILE_ALREADY_EXISTS' }\n    # Exclusive CreateNew is the invocation reservation; do not adopt old evidence.\n    $events = [IO.FileStream]::new(\"$RecordFile.events.jsonl\", [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n    Save-InitialState 'initialized' $true\n    $ownsRecord = $true\n    $self = [Diagnostics.Process]::GetCurrentProcess()\n    try {\n        $record.launcher.created = $self.StartTime.ToUniversalTime().ToString('o')\n        $record.launcher.exe = $self.MainModule.FileName\n    }\n    finally { $self.Dispose() }\n    Save-InitialState 'launcher_identified' $false\n    Add-Type -Path (Join-Path $PSScriptRoot 'launch-v2.cs')\n    $initialJson = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $nativeEntered = $true\n    $result = [D2NativeLauncher]::Run($Label, $Seconds, $RecordFile, $ArgsFile, $Exe, $OutFile, $ErrFile, $Admission, $Scope, $StopFile, $EnvironmentFile, $ControlFault, $clock, $events, $initialJson)\n    $events.Dispose(); $events = $null\n    exit $result\n}\ncatch {\n    [Console]::Error.WriteLine($_.Exception.ToString())\n    # Once native ownership begins, only its retained-handle path may describe the subject.\n    # Do not overwrite that record with this wrapper's prelaunch snapshot.\n    if ($ownsRecord -and -not $nativeEntered) {\n        $record.completion_reason = 'setup_refused'\n        $record.error = $_.Exception.ToString()\n        $record.ended_utc = [DateTime]::UtcNow.ToString('o')\n        try { Save-InitialState 'final' $false }\n        catch { [Console]::Error.WriteLine(\"STATUS_WRITE_FAILED: $($_.Exception)\") }\n    }\n    if ($null -ne $events) {\n        try { $events.Dispose() } catch { [Console]::Error.WriteLine(\"EVENT_DISPOSE_FAILED: $($_.Exception)\") }\n        $events = $null\n    }\n…\n    exit 127\n}\n\n[Showing lines 1-113 of 118. Use :114 to continue]"}],"details":{"truncation":{"content":"[CmdletBinding()]\nparam(\n    [Parameter(Mandatory)] [string]$Label,\n    [Parameter(Mandatory)] [ValidateRange(1,2147483)] [int]$Seconds,\n    [Parameter(Mandatory)] [string]$RecordFile,\n    [Parameter(Mandatory)] [string]$ArgsFile,\n    [Parameter(Mandatory)] [string]$Exe,\n    [Parameter(Mandatory)] [string]$OutFile,\n    [Parameter(Mandatory)] [string]$ErrFile,\n    [ValidateSet('process-tree','none')] [string]$Admission = 'none',\n    [ValidateSet('step','run')] [string]$Scope = 'step',\n    [string]$StopFile,\n    [string]$EnvironmentFile,\n    [ValidateSet('none','assignment','accounting','crash-after-resume')] [string]$ControlFault = 'none'\n)\n\n# Start before file setup and compilation; native setup and confirmation share this clock.\n$clock = [Diagnostics.Stopwatch]::StartNew()\n$started = [DateTime]::UtcNow.ToString('o')\n$ErrorActionPreference = 'Stop'\nSet-StrictMode -Version Latest\n$events = $null\n$ownsRecord = $false\n$nativeEntered = $false\n$utf8 = [Text.UTF8Encoding]::new($false)\n$record = [ordered]@{\n    version = 2; label = $Label; scope = $Scope\n    launcher = [ordered]@{ pid = $PID; created = $null; exe = $null }\n    subject = [ordered]@{ pid = 0; created = $null; exe = $null; native_exit = $null; state = 'NOT_STARTED' }\n    completion_reason = 'running'; coverage = 'NONE'; termination = 'NOT_CONFIRMED'\n    job = [ordered]@{ assigned = $false; membership_read = $false; kill_on_close_read = $false; limit_flags = $null; active_processes = $null }\n    started_utc = $started; ended_utc = $null; error = $null\n}\n\nfunction Save-InitialState([string]$Event, [bool]$First) {\n    $json = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $tmp = \"$RecordFile.tmp.$([Guid]::NewGuid().ToString('N'))\"\n    $stream = $null\n    try {\n        $stream = [IO.FileStream]::new($tmp, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n        $bytes = $utf8.GetBytes($json)\n        $stream.Write($bytes, 0, $bytes.Length)\n        $stream.Flush($true)\n        $stream.Dispose(); $stream = $null\n        if ($First) {\n            [IO.File]::Move($tmp, $RecordFile)\n            $script:ownsRecord = $true\n        }\n        else { [IO.File]::Move($tmp, $RecordFile, $true) }\n        $row = ConvertTo-Json -InputObject ([ordered]@{ event = $Event; elapsed_ms = $clock.ElapsedMilliseconds; record = $record }) -Depth 10 -Compress\n        $bytes = $utf8.GetBytes($row + \"`n\")\n        $events.Write($bytes, 0, $bytes.Length)\n        $events.Flush($true)\n    }\n    finally {\n        if ($null -ne $stream) { $stream.Dispose() }\n        # Keep an unpublished temp as failure evidence. Never remove a destination.\n    }\n}\n\ntry {\n    if (-not $IsWindows) { throw 'WINDOWS_REQUIRED' }\n    $destinations = @($RecordFile, $OutFile, $ErrFile, \"$RecordFile.events.jsonl\", \"$RecordFile.membership.json\", \"$RecordFile.membership-request.json\")\n    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)\n    foreach ($path in $destinations) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        $full = [IO.Path]::GetFullPath($path)\n        if (-not $seen.Add($full)) { throw \"ALIASED_DESTINATION: $path\" }\n        if ([IO.File]::Exists($full) -or [IO.Directory]::Exists($full)) { throw \"DESTINATION_EXISTS: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n    }\n    if ($Scope -eq 'run' -and [string]::IsNullOrWhiteSpace($StopFile)) { throw 'RUN_REQUIRES_STOPFILE' }\n    foreach ($path in @($StopFile, $EnvironmentFile)) {\n        if ($path -and -not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        if ($path -and $seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if ($seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    if ($StopFile -and ([IO.File]::Exists($StopFile) -or [IO.Directory]::Exists($StopFile))) { throw 'STOPFILE_ALREADY_EXISTS' }\n    # Exclusive CreateNew is the invocation reservation; do not adopt old evidence.\n    $events = [IO.FileStream]::new(\"$RecordFile.events.jsonl\", [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n    Save-InitialState 'initialized' $true\n    $ownsRecord = $true\n    $self = [Diagnostics.Process]::GetCurrentProcess()\n    try {\n        $record.launcher.created = $self.StartTime.ToUniversalTime().ToString('o')\n        $record.launcher.exe = $self.MainModule.FileName\n    }\n    finally { $self.Dispose() }\n    Save-InitialState 'launcher_identified' $false\n    Add-Type -Path (Join-Path $PSScriptRoot 'launch-v2.cs')\n    $initialJson = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $nativeEntered = $true\n    $result = [D2NativeLauncher]::Run($Label, $Seconds, $RecordFile, $ArgsFile, $Exe, $OutFile, $ErrFile, $Admission, $Scope, $StopFile, $EnvironmentFile, $ControlFault, $clock, $events, $initialJson)\n    $events.Dispose(); $events = $null\n    exit $result\n}\ncatch {\n    [Console]::Error.WriteLine($_.Exception.ToString())\n    # Once native ownership begins, only its retained-handle path may describe the subject.\n    # Do not overwrite that record with this wrapper's prelaunch snapshot.\n    if ($ownsRecord -and -not $nativeEntered) {\n        $record.completion_reason = 'setup_refused'\n        $record.error = $_.Exception.ToString()\n        $record.ended_utc = [DateTime]::UtcNow.ToString('o')\n        try { Save-InitialState 'final' $false }\n        catch { [Console]::Error.WriteLine(\"STATUS_WRITE_FAILED: $($_.Exception)\") }\n    }\n    if ($null -ne $events) {\n        try { $events.Dispose() } catch { [Console]::Error.WriteLine(\"EVENT_DISPOSE_FAILED: $($_.Exception)\") }","truncated":true,"truncatedBy":"lines","totalLines":118,"totalBytes":5872,"outputLines":113,"outputBytes":5872,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":118,"displayContent":{"text":"[CmdletBinding()]\nparam(\n    [Parameter(Mandatory)] [string]$Label,\n    [Parameter(Mandatory)] [ValidateRange(1,2147483)] [int]$Seconds,\n    [Parameter(Mandatory)] [string]$RecordFile,\n    [Parameter(Mandatory)] [string]$ArgsFile,\n    [Parameter(Mandatory)] [string]$Exe,\n    [Parameter(Mandatory)] [string]$OutFile,\n    [Parameter(Mandatory)] [string]$ErrFile,\n    [ValidateSet('process-tree','none')] [string]$Admission = 'none',\n    [ValidateSet('step','run')] [string]$Scope = 'step',\n    [string]$StopFile,\n    [string]$EnvironmentFile,\n    [ValidateSet('none','assignment','accounting','crash-after-resume')] [string]$ControlFault = 'none'\n)\n\n# Start before file setup and compilation; native setup and confirmation share this clock.\n$clock = [Diagnostics.Stopwatch]::StartNew()\n$started = [DateTime]::UtcNow.ToString('o')\n$ErrorActionPreference = 'Stop'\nSet-StrictMode -Version Latest\n$events = $null\n$ownsRecord = $false\n$nativeEntered = $false\n$utf8 = [Text.UTF8Encoding]::new($false)\n$record = [ordered]@{\n    version = 2; label = $Label; scope = $Scope\n    launcher = [ordered]@{ pid = $PID; created = $null; exe = $null }\n    subject = [ordered]@{ pid = 0; created = $null; exe = $null; native_exit = $null; state = 'NOT_STARTED' }\n    completion_reason = 'running'; coverage = 'NONE'; termination = 'NOT_CONFIRMED'\n    job = [ordered]@{ assigned = $false; membership_read = $false; kill_on_close_read = $false; limit_flags = $null; active_processes = $null }\n    started_utc = $started; ended_utc = $null; error = $null\n}\n\nfunction Save-InitialState([string]$Event, [bool]$First) {\n    $json = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $tmp = \"$RecordFile.tmp.$([Guid]::NewGuid().ToString('N'))\"\n    $stream = $null\n    try {\n        $stream = [IO.FileStream]::new($tmp, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n        $bytes = $utf8.GetBytes($json)\n        $stream.Write($bytes, 0, $bytes.Length)\n        $stream.Flush($true)\n        $stream.Dispose(); $stream = $null\n        if ($First) {\n            [IO.File]::Move($tmp, $RecordFile)\n            $script:ownsRecord = $true\n        }\n        else { [IO.File]::Move($tmp, $RecordFile, $true) }\n        $row = ConvertTo-Json -InputObject ([ordered]@{ event = $Event; elapsed_ms = $clock.ElapsedMilliseconds; record = $record }) -Depth 10 -Compress\n        $bytes = $utf8.GetBytes($row + \"`n\")\n        $events.Write($bytes, 0, $bytes.Length)\n        $events.Flush($true)\n    }\n    finally {\n        if ($null -ne $stream) { $stream.Dispose() }\n        # Keep an unpublished temp as failure evidence. Never remove a destination.\n    }\n}\n\ntry {\n    if (-not $IsWindows) { throw 'WINDOWS_REQUIRED' }\n    $destinations = @($RecordFile, $OutFile, $ErrFile, \"$RecordFile.events.jsonl\", \"$RecordFile.membership.json\", \"$RecordFile.membership-request.json\")\n    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)\n    foreach ($path in $destinations) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        $full = [IO.Path]::GetFullPath($path)\n        if (-not $seen.Add($full)) { throw \"ALIASED_DESTINATION: $path\" }\n        if ([IO.File]::Exists($full) -or [IO.Directory]::Exists($full)) { throw \"DESTINATION_EXISTS: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if (-not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n    }\n    if ($Scope -eq 'run' -and [string]::IsNullOrWhiteSpace($StopFile)) { throw 'RUN_REQUIRES_STOPFILE' }\n    foreach ($path in @($StopFile, $EnvironmentFile)) {\n        if ($path -and -not [IO.Path]::IsPathFullyQualified($path)) { throw \"ABSOLUTE_PATH_REQUIRED: $path\" }\n        if ($path -and $seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    foreach ($path in @($Exe, $ArgsFile)) {\n        if ($seen.Contains([IO.Path]::GetFullPath($path))) { throw \"INPUT_ALIASES_DESTINATION: $path\" }\n    }\n    if ($StopFile -and ([IO.File]::Exists($StopFile) -or [IO.Directory]::Exists($StopFile))) { throw 'STOPFILE_ALREADY_EXISTS' }\n    # Exclusive CreateNew is the invocation reservation; do not adopt old evidence.\n    $events = [IO.FileStream]::new(\"$RecordFile.events.jsonl\", [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::Read)\n    Save-InitialState 'initialized' $true\n    $ownsRecord = $true\n    $self = [Diagnostics.Process]::GetCurrentProcess()\n    try {\n        $record.launcher.created = $self.StartTime.ToUniversalTime().ToString('o')\n        $record.launcher.exe = $self.MainModule.FileName\n    }\n    finally { $self.Dispose() }\n    Save-InitialState 'launcher_identified' $false\n    Add-Type -Path (Join-Path $PSScriptRoot 'launch-v2.cs')\n    $initialJson = ConvertTo-Json -InputObject $record -Depth 8 -Compress\n    $nativeEntered = $true\n    $result = [D2NativeLauncher]::Run($Label, $Seconds, $RecordFile, $ArgsFile, $Exe, $OutFile, $ErrFile, $Admission, $Scope, $StopFile, $EnvironmentFile, $ControlFault, $clock, $events, $initialJson)\n    $events.Dispose(); $events = $null\n    exit $result\n}\ncatch {\n    [Console]::Error.WriteLine($_.Exception.ToString())\n    # Once native ownership begins, only its retained-handle path may describe the subject.\n    # Do not overwrite that record with this wrapper's prelaunch snapshot.\n    if ($ownsRecord -and -not $nativeEntered) {\n        $record.completion_reason = 'setup_refused'\n        $record.error = $_.Exception.ToString()\n        $record.ended_utc = [DateTime]::UtcNow.ToString('o')\n        try { Save-InitialState 'final' $false }\n        catch { [Console]::Error.WriteLine(\"STATUS_WRITE_FAILED: $($_.Exception)\") }\n    }\n    if ($null -ne $events) {\n        try { $events.Dispose() } catch { [Console]::Error.WriteLine(\"EVENT_DISPOSE_FAILED: $($_.Exception)\") }\n        $events = $null\n    }\n…\n    exit 127\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,null,117,118]},"fileSize":5955,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\hertz-fp-driver-review\\d2\\field-rig-r10-w7-a2-QWHXWYUH\\support\\fp-bin\\launch-v2.ps1"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":118,"totalBytes":5872,"outputLines":113,"outputBytes":5872,"shownRange":{"start":1,"end":113},"nextOffset":114}}},"isError":false,"timestamp":1789522864483}}
{"type":"message","id":"2f702db2","parentId":"fa77923d","timestamp":"2026-09-16T01:41:04.803Z","message":{"role":"toolResult","toolCallId":"call_KppV6oG8hfts7usb4gdih4J5|fc_0bac546ce171b754016aa9f3b05c5487d1a9fe4b498048d5b5","toolName":"glob","content":[{"type":"text","text":"# .spt/preserved/hertz-fp-driver-review/\n## d2/\nfp-driver-d2-r10-P9RLK4VU.sh\nfp-driver-d2-r10-HHDKCRH5.sh\nfp-driver-d2-r10-AQ23KKNI.sh\n### field-rig-r10-w7-a2-QWHXWYUH/support/\nfp-driver-d2-r10-w7-a2.frozen.sh\n### window7-2PEMLAIQ/\nfp-driver-d2-r10-w7-a2.frozen.sh\nfp-driver-d2-r10-w7.frozen.sh\nfp-driver-d2-r10-w7.draft.sh\n#### control-A2-QWHXWYUH/prep/instruments/\nfp-driver-d2-r10-w7-a2.frozen.sh\n#### control-DYGO34U2/prep/instruments/\nfp-driver-d2-r10-w7.frozen.sh\n### binding-VMNIVWIY/\nfp-driver-d2-r10-S2-configured.sh\n### prep-VMNIVWIY/instruments/\nfp-driver-d2-r10-P9RLK4VU.sh\n## v9-exercises/r8/\nstaged-r8-cleanup-exit.sh"}],"details":{"scopePath":".spt/preserved/**/staged-r8-cleanup-exit.sh, .spt/preserved/**/fp-driver*r10*.sh","fileCount":12,"files":[".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/control-A2-QWHXWYUH/prep/instruments/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7-a2.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/control-DYGO34U2/prep/instruments/fp-driver-d2-r10-w7.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7.frozen.sh",".spt/preserved/hertz-fp-driver-review/d2/window7-2PEMLAIQ/fp-driver-d2-r10-w7.draft.sh",".spt/preserved/hertz-fp-driver-review/d2/binding-VMNIVWIY/fp-driver-d2-r10-S2-configured.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-P9RLK4VU.sh",".spt/preserved/hertz-fp-driver-review/d2/prep-VMNIVWIY/instruments/fp-driver-d2-r10-P9RLK4VU.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-HHDKCRH5.sh",".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-AQ23KKNI.sh",".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1789522864803}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_6OxeCdy7lbuEi6VczIUZfLcB|fc_0bac546ce171b754016aa9f3bdbcac87d18c1c486f1f25f960","toolName":"grep","startedAt":"2026-09-16T01:41:17.867Z","args":{"path":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh"},"intent":"Reading retained signing protocol"},"id":"f268d580","parentId":"2f702db2","timestamp":"2026-09-16T01:41:17.867Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_PbsCMy9JMR4tRTlP03sPx0RC|fc_0bac546ce171b754016aa9f3bdbcc087d196f56d9b384dc171","toolName":"grep","startedAt":"2026-09-16T01:41:17.867Z","args":{"path":".worktrees/hertz-307-evidence/crates/xtask/src/main.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs;.worktrees/hertz-30…"},"intent":"Checking pinned source admission seams"},"id":"15d9eea2","parentId":"f268d580","timestamp":"2026-09-16T01:41:17.867Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_KSUWSnjJd2tvojQtJ6C2sqha|fc_0bac546ce171b754016aa9f3bdbcd087d1b77d151fc0f1869b","toolName":"read","startedAt":"2026-09-16T01:41:17.867Z","args":{"path":"crates/spt-daemon/src/broker.rs:2725-2785"},"intent":"Reading exact controller cause semantics"},"id":"05842ae6","parentId":"15d9eea2","timestamp":"2026-09-16T01:41:17.867Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_vOPSb0c2NkkD4XhoRDTbjPQn|fc_0bac546ce171b754016aa9f3bdbcd887d1b0a657c2fdf82076","toolName":"grep","startedAt":"2026-09-16T01:41:17.867Z","args":{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs"},"intent":"Locating launcher environment isolation"},"id":"0098408d","parentId":"05842ae6","timestamp":"2026-09-16T01:41:17.867Z"}
{"type":"message","id":"526ded3c","parentId":"0098408d","timestamp":"2026-09-16T01:41:17.868Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_6OxeCdy7lbuEi6VczIUZfLcB|fc_0bac546ce171b754016aa9f3bdbcac87d18c1c486f1f25f960","name":"grep","arguments":{"i":"Reading retained signing protocol","pattern":"debug-keygen|debug-pin|debug-rollout|debug-mark|SPT_DEBUG_RELEASE|release-keys|broker_resource|brain_ipc","path":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh","case":true,"gitignore":false,"skip":0},"intent":"Reading retained signing protocol"},{"type":"toolCall","id":"call_PbsCMy9JMR4tRTlP03sPx0RC|fc_0bac546ce171b754016aa9f3bdbcc087d196f56d9b384dc171","name":"grep","arguments":{"i":"Checking pinned source admission seams","pattern":"brain_ipc_version: spt_daemon|broker_resource_abi: spt_daemon|plan_verified_update_set|BrokerAbi::current|pub const (IPC_PROTOCOL_VERSION|MIN_COMPATIBLE_VERSION|BROKER_RESOURCE_ABI)","path":".worktrees/hertz-307-evidence/crates/xtask/src/main.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/update.rs","case":true,"gitignore":false,"skip":0},"intent":"Checking pinned source admission seams"},{"type":"toolCall","id":"call_KSUWSnjJd2tvojQtJ6C2sqha|fc_0bac546ce171b754016aa9f3bdbcd087d1b77d151fc0f1869b","name":"read","arguments":{"i":"Reading exact controller cause semantics","path":"crates/spt-daemon/src/broker.rs:2725-2785"},"intent":"Reading exact controller cause semantics"},{"type":"toolCall","id":"call_vOPSb0c2NkkD4XhoRDTbjPQn|fc_0bac546ce171b754016aa9f3bdbcd887d1b0a657c2fdf82076","name":"grep","arguments":{"i":"Locating launcher environment isolation","pattern":"Environment|SPT_|birth|Creation|JobObject|membership","path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs","case":true,"gitignore":false,"skip":0},"intent":"Locating launcher environment isolation"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":7278,"output":393,"cacheRead":49152,"cacheWrite":0,"totalTokens":56823,"cost":{"input":0.07278000000000001,"output":0.01965,"cacheRead":0.049152,"cacheWrite":0,"total":0.141582}},"stopReason":"toolUse","timestamp":1789522864836,"responseId":"resp_0bac546ce171b754016aa9f3b1254c87d1a3bdda049bdca45f","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0bac546ce171b754016aa9f3bdbcac87d18c1c486f1f25f960","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading retained signing protocol\",\"pattern\":\"debug-keygen|debug-pin|debug-rollout|debug-mark|SPT_DEBUG_RELEASE|release-keys|broker_resource|brain_ipc\",\"path\":\".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_6OxeCdy7lbuEi6VczIUZfLcB","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3bdbcc087d196f56d9b384dc171","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking pinned source admission seams\",\"pattern\":\"brain_ipc_version: spt_daemon|broker_resource_abi: spt_daemon|plan_verified_update_set|BrokerAbi::current|pub const (IPC_PROTOCOL_VERSION|MIN_COMPATIBLE_VERSION|BROKER_RESOURCE_ABI)\",\"path\":\".worktrees/hertz-307-evidence/crates/xtask/src/main.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs;.worktrees/hertz-307-evidence/crates/spt-daemon/src/update.rs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_PbsCMy9JMR4tRTlP03sPx0RC","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3bdbcd087d1b77d151fc0f1869b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading exact controller cause semantics\",\"path\":\"crates/spt-daemon/src/broker.rs:2725-2785\"}","call_id":"call_KSUWSnjJd2tvojQtJ6C2sqha","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"read","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3bdbcd887d1b0a657c2fdf82076","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating launcher environment isolation\",\"pattern\":\"Environment|SPT_|birth|Creation|JobObject|membership\",\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs\",\"case\":true,\"gitignore\":false,\"skip\":0}","call_id":"call_vOPSb0c2NkkD4XhoRDTbjPQn","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"grep","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":13029.280899999954,"ttft":12928.856299999985,"completedAt":1789522877866,"contextSnapshot":{"promptTokens":56430,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"87795809","parentId":"526ded3c","timestamp":"2026-09-16T01:41:17.875Z","message":{"role":"toolResult","toolCallId":"call_KSUWSnjJd2tvojQtJ6C2sqha|fc_0bac546ce171b754016aa9f3bdbcd087d1b77d151fc0f1869b","toolName":"read","content":[{"type":"text","text":"    /// so this names the deadline the drain observed and not the writer's fate.\n    /// This is the edge releases#49/#267 Q1 asks about: a cleanly-closed\n    /// OLD-generation conn arrives here too, and from this site the two are\n    /// indistinguishable.\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n    const CLOSE_SEND_DEADLINE: &'static str = \"send_deadline\";\n    /// The wedge evict released the slot ([`stall_evict_controller`], inline stamp\n    /// mode). `BRAIN_SUBSCRIBER_STALL_EVICT` already names the wedge; this names\n    /// the slot transition that followed it.\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n    const CLOSE_STALL_EVICT: &'static str = \"stall_evict\";\n    /// A subscriber detached and it happened to be the controller\n    /// ([`detach_if`]) — an ordinary departure, not a wedge and not a kill.\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n    const CLOSE_DETACH: &'static str = \"detach\";\n\n    /// Detach the controller and UNLATCH the perch — the ONE unlatch path shared\n    /// by W1's deadline-evict ([`mark_controller_gone`]), [`detach_if`], and (per\n    /// the W1↔W5 synergy) W5's reconcile self-heal. Dropping the sink ends its\n    /// writer thread; clearing the slot re-stamps `driven_by` to `None` (so an\n    /// `ONLINE+CONTROLLED` latch cannot outlive a gone controller).\n    ///\n    /// `cause` is the CALLER'S OWN knowledge of which edge closed the slot, and it\n    /// is a parameter for the reason releases#49/#267 needed this line at all: at\n    /// this site a writer that exited, an evicted wedge and a deliberate detach are\n    /// indistinguishable, so a cause DERIVED here would be a guess wearing a label.\n    /// Each caller names what it knows; nothing infers.\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n    fn clear_controller(&mut self, cause: &'static str) {\n        let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\n        // Captured BEFORE the take: after it there is no sink left to ask.\n        let conn = self.controller.as_ref().map(|c| c.send.id());\n        if self.controller.take().is_some() {\n            // ONLY ON THE REAL TRANSITION (releases#49/#267 Q1). The epoch-guarded\n            // no-op above returns without taking anything, and a line there would\n            // report a closure that did not happen — which is exactly the confusion\n            // the question exists to remove: today a clean close and a slot that was\n            // already empty leave identical stderr.\n            // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\n            if crate::brain::diag_trace_enabled() {\n                spt_proto::emit_line_err!(\n                    \"CONTROLLER_SLOT_CLOSED:{} conn={} cause={cause} {} — the controller slot \\\n                     was occupied and is now empty [REQ-REFRESH-WAIT-ATTRIBUTION]\",\n                    self.session_id,\n                    conn.unwrap_or(0),\n                    crate::conn::log_stamp()\n                );\n            }\n            self.stamp_driven_by();\n            // Detach is a drop edge: the posture goes offline (derived from the\n            // stamp just written) and the empowerments go with it.\n            self.on_control_edge(prev_gen, None);\n        }\n    }\n\n    /// B-2 (REQ-CONTROLLER-LIVENESS-REAP): lazily drop a controller whose WRITER\n    /// THREAD has EXITED — the record-vs-truth honesty step, run on the authoritative\n    /// `KIND_SESSIONS` poll BEFORE `controller_by`/`has_controller` are read. The\n    /// writer exits when a socket write fails (a severed / keepalive-killed controller\n    /// conn) or its `tx` drops; while it is parked on `rx.recv()` (a LIVE but idle\n    /// controller) it is NOT finished, so a live controller is never touched (the\n    /// no-false-reap guard). Reaping here makes the broker report honest truth so the\n    /// EXISTING [`converge_perch_stamps`] clears the now-stale info.json\n    /// `driven_by`/`controlled` stamp — no new detach path, no new query.\n    ///\n\n[Showing lines 2724-2788 of 16852. Use :2789 to continue]"}],"details":{"truncation":{"content":"    /// so this names the deadline the drain observed and not the writer's fate.\r\n    /// This is the edge releases#49/#267 Q1 asks about: a cleanly-closed\r\n    /// OLD-generation conn arrives here too, and from this site the two are\r\n    /// indistinguishable.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_SEND_DEADLINE: &'static str = \"send_deadline\";\r\n    /// The wedge evict released the slot ([`stall_evict_controller`], inline stamp\r\n    /// mode). `BRAIN_SUBSCRIBER_STALL_EVICT` already names the wedge; this names\r\n    /// the slot transition that followed it.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_STALL_EVICT: &'static str = \"stall_evict\";\r\n    /// A subscriber detached and it happened to be the controller\r\n    /// ([`detach_if`]) — an ordinary departure, not a wedge and not a kill.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_DETACH: &'static str = \"detach\";\r\n\r\n    /// Detach the controller and UNLATCH the perch — the ONE unlatch path shared\r\n    /// by W1's deadline-evict ([`mark_controller_gone`]), [`detach_if`], and (per\r\n    /// the W1↔W5 synergy) W5's reconcile self-heal. Dropping the sink ends its\r\n    /// writer thread; clearing the slot re-stamps `driven_by` to `None` (so an\r\n    /// `ONLINE+CONTROLLED` latch cannot outlive a gone controller).\r\n    ///\r\n    /// `cause` is the CALLER'S OWN knowledge of which edge closed the slot, and it\r\n    /// is a parameter for the reason releases#49/#267 needed this line at all: at\r\n    /// this site a writer that exited, an evicted wedge and a deliberate detach are\r\n    /// indistinguishable, so a cause DERIVED here would be a guess wearing a label.\r\n    /// Each caller names what it knows; nothing infers.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    fn clear_controller(&mut self, cause: &'static str) {\r\n        let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\r\n        // Captured BEFORE the take: after it there is no sink left to ask.\r\n        let conn = self.controller.as_ref().map(|c| c.send.id());\r\n        if self.controller.take().is_some() {\r\n            // ONLY ON THE REAL TRANSITION (releases#49/#267 Q1). The epoch-guarded\r\n            // no-op above returns without taking anything, and a line there would\r\n            // report a closure that did not happen — which is exactly the confusion\r\n            // the question exists to remove: today a clean close and a slot that was\r\n            // already empty leave identical stderr.\r\n            // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n            if crate::brain::diag_trace_enabled() {\r\n                spt_proto::emit_line_err!(\r\n                    \"CONTROLLER_SLOT_CLOSED:{} conn={} cause={cause} {} — the controller slot \\\r\n                     was occupied and is now empty [REQ-REFRESH-WAIT-ATTRIBUTION]\",\r\n                    self.session_id,\r\n                    conn.unwrap_or(0),\r\n                    crate::conn::log_stamp()\r\n                );\r\n            }\r\n            self.stamp_driven_by();\r\n            // Detach is a drop edge: the posture goes offline (derived from the\r\n            // stamp just written) and the empowerments go with it.\r\n            self.on_control_edge(prev_gen, None);\r\n        }\r\n    }\r\n\r\n    /// B-2 (REQ-CONTROLLER-LIVENESS-REAP): lazily drop a controller whose WRITER\r\n    /// THREAD has EXITED — the record-vs-truth honesty step, run on the authoritative\r\n    /// `KIND_SESSIONS` poll BEFORE `controller_by`/`has_controller` are read. The\r\n    /// writer exits when a socket write fails (a severed / keepalive-killed controller\r\n    /// conn) or its `tx` drops; while it is parked on `rx.recv()` (a LIVE but idle\r\n    /// controller) it is NOT finished, so a live controller is never touched (the\r\n    /// no-false-reap guard). Reaping here makes the broker report honest truth so the\r\n    /// EXISTING [`converge_perch_stamps`] clears the now-stale info.json\r\n    /// `driven_by`/`controlled` stamp — no new detach path, no new query.\r\n    ///\r","truncated":true,"truncatedBy":"lines","totalLines":14129,"totalBytes":4029,"outputLines":65,"outputBytes":4029,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":16852,"displayContent":{"text":"    /// so this names the deadline the drain observed and not the writer's fate.\r\n    /// This is the edge releases#49/#267 Q1 asks about: a cleanly-closed\r\n    /// OLD-generation conn arrives here too, and from this site the two are\r\n    /// indistinguishable.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_SEND_DEADLINE: &'static str = \"send_deadline\";\r\n    /// The wedge evict released the slot ([`stall_evict_controller`], inline stamp\r\n    /// mode). `BRAIN_SUBSCRIBER_STALL_EVICT` already names the wedge; this names\r\n    /// the slot transition that followed it.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_STALL_EVICT: &'static str = \"stall_evict\";\r\n    /// A subscriber detached and it happened to be the controller\r\n    /// ([`detach_if`]) — an ordinary departure, not a wedge and not a kill.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    const CLOSE_DETACH: &'static str = \"detach\";\r\n\r\n    /// Detach the controller and UNLATCH the perch — the ONE unlatch path shared\r\n    /// by W1's deadline-evict ([`mark_controller_gone`]), [`detach_if`], and (per\r\n    /// the W1↔W5 synergy) W5's reconcile self-heal. Dropping the sink ends its\r\n    /// writer thread; clearing the slot re-stamps `driven_by` to `None` (so an\r\n    /// `ONLINE+CONTROLLED` latch cannot outlive a gone controller).\r\n    ///\r\n    /// `cause` is the CALLER'S OWN knowledge of which edge closed the slot, and it\r\n    /// is a parameter for the reason releases#49/#267 needed this line at all: at\r\n    /// this site a writer that exited, an evicted wedge and a deliberate detach are\r\n    /// indistinguishable, so a cause DERIVED here would be a guess wearing a label.\r\n    /// Each caller names what it knows; nothing infers.\r\n    // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n    fn clear_controller(&mut self, cause: &'static str) {\r\n        let prev_gen = self.controller.as_ref().map(|c| c.attach_gen);\r\n        // Captured BEFORE the take: after it there is no sink left to ask.\r\n        let conn = self.controller.as_ref().map(|c| c.send.id());\r\n        if self.controller.take().is_some() {\r\n            // ONLY ON THE REAL TRANSITION (releases#49/#267 Q1). The epoch-guarded\r\n            // no-op above returns without taking anything, and a line there would\r\n            // report a closure that did not happen — which is exactly the confusion\r\n            // the question exists to remove: today a clean close and a slot that was\r\n            // already empty leave identical stderr.\r\n            // [impl->REQ-REFRESH-WAIT-ATTRIBUTION]\r\n            if crate::brain::diag_trace_enabled() {\r\n                spt_proto::emit_line_err!(\r\n                    \"CONTROLLER_SLOT_CLOSED:{} conn={} cause={cause} {} — the controller slot \\\r\n                     was occupied and is now empty [REQ-REFRESH-WAIT-ATTRIBUTION]\",\r\n                    self.session_id,\r\n                    conn.unwrap_or(0),\r\n                    crate::conn::log_stamp()\r\n                );\r\n            }\r\n            self.stamp_driven_by();\r\n            // Detach is a drop edge: the posture goes offline (derived from the\r\n            // stamp just written) and the empowerments go with it.\r\n            self.on_control_edge(prev_gen, None);\r\n        }\r\n    }\r\n\r\n    /// B-2 (REQ-CONTROLLER-LIVENESS-REAP): lazily drop a controller whose WRITER\r\n    /// THREAD has EXITED — the record-vs-truth honesty step, run on the authoritative\r\n    /// `KIND_SESSIONS` poll BEFORE `controller_by`/`has_controller` are read. The\r\n    /// writer exits when a socket write fails (a severed / keepalive-killed controller\r\n    /// conn) or its `tx` drops; while it is parked on `rx.recv()` (a LIVE but idle\r\n    /// controller) it is NOT finished, so a live controller is never touched (the\r\n    /// no-false-reap guard). Reaping here makes the broker report honest truth so the\r\n    /// EXISTING [`converge_perch_stamps`] clears the now-stale info.json\r\n    /// `driven_by`/`controlled` stamp — no new detach path, no new query.\r\n    ///\r","startLine":2724,"lineNumbers":[2724,2725,2726,2727,2728,2729,2730,2731,2732,2733,2734,2735,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,2751,2752,2753,2754,2755,2756,2757,2758,2759,2760,2761,2762,2763,2764,2765,2766,2767,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779,2780,2781,2782,2783,2784,2785,2786,2787,2788]},"fileSize":877537,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src\\broker.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":16852,"totalBytes":4029,"outputLines":65,"outputBytes":4029,"shownRange":{"start":2724,"end":2788},"nextOffset":2789}}},"isError":false,"timestamp":1789522877875}}
{"type":"message","id":"b11d1c85","parentId":"87795809","timestamp":"2026-09-16T01:41:17.878Z","message":{"role":"toolResult","toolCallId":"call_6OxeCdy7lbuEi6VczIUZfLcB|fc_0bac546ce171b754016aa9f3bdbcac87d18c1c486f1f25f960","toolName":"grep","content":[{"type":"text","text":" 210|#                          D1 is out-of-band and bounds host spellings only.\n*211|#   xtask/src/main.rs:2204-2218  debug-keygen prints, one each:\n 212|#                          \"key_id:     <id>\" / \"public_hex: <hex>\" / \"seed_hex:   <hex>\"\n*213|#   xtask/src/main.rs:2708-2712  debug-rollout derives its signing identity FROM\n*214|#                          SPT_DEBUG_RELEASE_SEED. :2717 panics \"seed is hex\" on a bad\n 215|#                          one — where A7's S3 died.\n 216|#   xtask/src/main.rs:2504 DEBUG_ROLLOUT_STAGED version=.. channel=.. platforms=.. stage_dir=..\n 217|#   xtask/src/main.rs:2295 DEBUG_MARKED_APPLIED version=.. releases=..\n...\n 235|H=\"$SP/fp-home\"                   # isolated SPT_HOME, this experiment only\n*236|EXE=\"$W/target/release/spt.exe\"   # RELEASE, built by debug-rollout --build-current\n 237|PORT=29470                        # never 5470\n 238|GUARD_PORT=5470                   # the production port this run must not disturb\n 239|TRIPLE='x86_64-pc-windows-msvc'\n...\n 951|# a different generated key is exactly the defect doyle named.\n*952|if [ -n \"${SPT_DEBUG_RELEASE_SEED:-}\" ]; then\n*953|  record \"INHERITED SPT_DEBUG_RELEASE_SEED present and DISCARDED — this run signs only with the key it generates\"\n 954|fi\n*955|unset SPT_DEBUG_RELEASE_SEED\n 956|capacity_gate keygen\n 957|mkdir -p \"$H\"\n 958|run_cmd s2_keygen \"$SECRET/keygen.out\" \"$R/s2-keygen.err\" -- \\\n*959|  env -C \"$W\" cargo run -p xtask -- debug-keygen \"$KEY_ID\"\n 960|krc=$?\n*961|[ \"$krc\" -eq 0 ] || die \"debug-keygen exited $krc — see s2-keygen.err\"\n 962|# EXACTLY ONE of each, counted as OCCURRENCES.\n 963|n_pub=$(grep -o '^public_hex:' \"$SECRET/keygen.out\" | wc -l | tr -d ' ')\n 964|n_seed=$(grep -o '^seed_hex:' \"$SECRET/keygen.out\" | wc -l | tr -d ' ')\n...\n 973|# RELATIONSHIP, within the one invocation: xtask prints the same public key twice —\n*974|# once as public_hex and once inside the debug-pin instruction it tells you to run\n 975|# (xtask/src/main.rs:2208 and :2214-2216). They must agree, or the parse is reading\n 976|# two different keys.\n*977|pub_echo=$(grep -o 'debug-pin --key-id [^ ]* --public-key [0-9a-f]*' \"$SECRET/keygen.out\" | sed -n 's/.*--public-key //p' | tr -d ' \\r')\n 978|[ \"$pub_echo\" = \"$pub\" ] || die \"the keygen output's two public-key occurrences disagree ($pub vs $pub_echo) — refusing to pin a key the invocation does not agree on\"\n 979|# BY CONSTRUCTION the signer now uses THIS invocation's seed. The value is exported\n 980|# and never recorded, printed or expanded into any capture.\n*981|export SPT_DEBUG_RELEASE_SEED=\"$seed\"\n 982|record \"SEED bound to this keygen invocation: shape=64hex (value never recorded), pinned public=$pub\"\n 983|record \"  CEILING, stated: the seed/public relationship is established BY CONSTRUCTION (one invocation, both values parsed from it, two occurrences agreeing) and CONFIRMED LATER BY REFUSAL — a set signed by a key other than the pinned one fails verification at apply/serve time by name. There is no verb at this sha that re-derives a public key from a seed for an independent check.\"\n 984|seed=''\n...\n 988|run_cmd s2_pin \"$R/s2-pin.out\" \"$R/s2-pin.err\" -- \\\n*989|  env -C \"$W\" cargo run -p xtask -- debug-pin --key-id \"$KEY_ID\" --public-key \"$pub\" --home \"$H\"\n*990|[ $? -eq 0 ] || die \"debug-pin exited nonzero — see s2-pin.err\"\n 991|\n 992|# ===========================================================================\n 993|# S3  BUILD AND STAGE. A cargo producer runs INSIDE this verb (main.rs:2738).\n...\n 1032|run_cmd s3_rollout \"$R/s3-rollout.out\" \"$R/s3-rollout.err\" -- \\\n*1033|  env -C \"$W\" cargo run -p xtask -- debug-rollout --key-id \"$KEY_ID\" \\\n 1034|    --product-version 0.69.0-fp --channel debug --version 1 --build-current \\\n 1035|    --stage-dir \"$H/releases\" --state \"$W/target/fp-rollout-state.json\"\n 1036|rrc=$?\n...\n 1047|run_cmd s4_applied \"$R/s4-applied.out\" \"$R/s4-applied.err\" -- \\\n*1048|  env -C \"$W\" cargo run -p xtask -- debug-mark-applied --version 1 --home \"$H\"\n*1049|[ $? -eq 0 ] || die \"debug-mark-applied exited nonzero — see s4-applied.err\"\n 1050|grep -q 'DEBUG_MARKED_APPLIED version=1' \"$R/s4-applied.out\" || die \"S4 printed no DEBUG_MARKED_APPLIED row\"\n 1051|\n 1052|# ==========================================================================="}],"details":{"scopePath":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\hertz-fp-driver-review\\v9-exercises\\r8\\staged-r8-cleanup-exit.sh","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":17,"fileCount":1,"files":[".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh"],"fileMatches":[{"path":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh","count":17}],"truncated":false,"displayContent":"  210│#                          D1 is out-of-band and bounds host spellings only.\n *211│#   xtask/src/main.rs:2204-2218  debug-keygen prints, one each:\n  212│#                          \"key_id:     <id>\" / \"public_hex: <hex>\" / \"seed_hex:   <hex>\"\n *213│#   xtask/src/main.rs:2708-2712  debug-rollout derives its signing identity FROM\n *214│#                          SPT_DEBUG_RELEASE_SEED. :2717 panics \"seed is hex\" on a bad\n  215│#                          one — where A7's S3 died.\n  216│#   xtask/src/main.rs:2504 DEBUG_ROLLOUT_STAGED version=.. channel=.. platforms=.. stage_dir=..\n  217│#   xtask/src/main.rs:2295 DEBUG_MARKED_APPLIED version=.. releases=..\n     │...\n  235│H=\"$SP/fp-home\"                   # isolated SPT_HOME, this experiment only\n *236│EXE=\"$W/target/release/spt.exe\"   # RELEASE, built by debug-rollout --build-current\n  237│PORT=29470                        # never 5470\n  238│GUARD_PORT=5470                   # the production port this run must not disturb\n  239│TRIPLE='x86_64-pc-windows-msvc'\n     │...\n  951│# a different generated key is exactly the defect doyle named.\n *952│if [ -n \"${SPT_DEBUG_RELEASE_SEED:-}\" ]; then\n *953│  record \"INHERITED SPT_DEBUG_RELEASE_SEED present and DISCARDED — this run signs only with the key it generates\"\n  954│fi\n *955│unset SPT_DEBUG_RELEASE_SEED\n  956│capacity_gate keygen\n  957│mkdir -p \"$H\"\n  958│run_cmd s2_keygen \"$SECRET/keygen.out\" \"$R/s2-keygen.err\" -- \\\n *959│  env -C \"$W\" cargo run -p xtask -- debug-keygen \"$KEY_ID\"\n  960│krc=$?\n *961│[ \"$krc\" -eq 0 ] || die \"debug-keygen exited $krc — see s2-keygen.err\"\n  962│# EXACTLY ONE of each, counted as OCCURRENCES.\n  963│n_pub=$(grep -o '^public_hex:' \"$SECRET/keygen.out\" | wc -l | tr -d ' ')\n  964│n_seed=$(grep -o '^seed_hex:' \"$SECRET/keygen.out\" | wc -l | tr -d ' ')\n     │...\n  973│# RELATIONSHIP, within the one invocation: xtask prints the same public key twice —\n *974│# once as public_hex and once inside the debug-pin instruction it tells you to run\n  975│# (xtask/src/main.rs:2208 and :2214-2216). They must agree, or the parse is reading\n  976│# two different keys.\n *977│pub_echo=$(grep -o 'debug-pin --key-id [^ ]* --public-key [0-9a-f]*' \"$SECRET/keygen.out\" | sed -n 's/.*--public-key //p' | tr -d ' \\r')\n  978│[ \"$pub_echo\" = \"$pub\" ] || die \"the keygen output's two public-key occurrences disagree ($pub vs $pub_echo) — refusing to pin a key the invocation does not agree on\"\n  979│# BY CONSTRUCTION the signer now uses THIS invocation's seed. The value is exported\n  980│# and never recorded, printed or expanded into any capture.\n *981│export SPT_DEBUG_RELEASE_SEED=\"$seed\"\n  982│record \"SEED bound to this keygen invocation: shape=64hex (value never recorded), pinned public=$pub\"\n  983│record \"  CEILING, stated: the seed/public relationship is established BY CONSTRUCTION (one invocation, both values parsed from it, two occurrences agreeing) and CONFIRMED LATER BY REFUSAL — a set signed by a key other than the pinned one fails verification at apply/serve time by name. There is no verb at this sha that re-derives a public key from a seed for an independent check.\"\n  984│seed=''\n     │...\n  988│run_cmd s2_pin \"$R/s2-pin.out\" \"$R/s2-pin.err\" -- \\\n *989│  env -C \"$W\" cargo run -p xtask -- debug-pin --key-id \"$KEY_ID\" --public-key \"$pub\" --home \"$H\"\n *990│[ $? -eq 0 ] || die \"debug-pin exited nonzero — see s2-pin.err\"\n  991│\n  992│# ===========================================================================\n  993│# S3  BUILD AND STAGE. A cargo producer runs INSIDE this verb (main.rs:2738).\n     │...\n 1032│run_cmd s3_rollout \"$R/s3-rollout.out\" \"$R/s3-rollout.err\" -- \\\n*1033│  env -C \"$W\" cargo run -p xtask -- debug-rollout --key-id \"$KEY_ID\" \\\n 1034│    --product-version 0.69.0-fp --channel debug --version 1 --build-current \\\n 1035│    --stage-dir \"$H/releases\" --state \"$W/target/fp-rollout-state.json\"\n 1036│rrc=$?\n     │...\n 1047│run_cmd s4_applied \"$R/s4-applied.out\" \"$R/s4-applied.err\" -- \\\n*1048│  env -C \"$W\" cargo run -p xtask -- debug-mark-applied --version 1 --home \"$H\"\n*1049│[ $? -eq 0 ] || die \"debug-mark-applied exited nonzero — see s4-applied.err\"\n 1050│grep -q 'DEBUG_MARKED_APPLIED version=1' \"$R/s4-applied.out\" || die \"S4 printed no DEBUG_MARKED_APPLIED row\"\n 1051│\n 1052│# ==========================================================================="},"isError":false,"timestamp":1789522877877}}
{"type":"message","id":"abffd27c","parentId":"b11d1c85","timestamp":"2026-09-16T01:41:17.888Z","message":{"role":"toolResult","toolCallId":"call_vOPSb0c2NkkD4XhoRDTbjPQn|fc_0bac546ce171b754016aa9f3bdbcd887d1b0a657c2fdf82076","toolName":"grep","content":[{"type":"text","text":" 32|        public bool assigned { get; set; }\n*33|        public bool membership_read { get; set; }\n 34|        public bool kill_on_close_read { get; set; }\n 35|        public uint? limit_flags { get; set; }\n 36|        public uint? active_processes { get; set; }\n...\n 125|    [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n*126|    static extern IntPtr CreateJobObjectW(IntPtr attributes, string name);\n 127|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*128|    static extern bool SetInformationJobObject(IntPtr job, int infoClass, ref EXTENDED_LIMITS info, uint length);\n*129|    [DllImport(\"kernel32.dll\", EntryPoint = \"QueryInformationJobObject\", SetLastError = true)]\n 130|    static extern bool QueryLimits(IntPtr job, int infoClass, out EXTENDED_LIMITS info, uint length, IntPtr returnedLength);\n*131|    [DllImport(\"kernel32.dll\", EntryPoint = \"QueryInformationJobObject\", SetLastError = true)]\n 132|    static extern bool QueryAccounting(IntPtr job, int infoClass, out ACCOUNTING info, uint length, IntPtr returnedLength);\n 133|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*134|    static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);\n 135|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n 136|    static extern bool IsProcessInJob(IntPtr process, IntPtr job, out bool member);\n 137|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*138|    static extern bool TerminateJobObject(IntPtr job, uint exitCode);\n 139|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n 140|    static extern bool TerminateProcess(IntPtr process, uint exitCode);\n 141|    [DllImport(\"kernel32.dll\", SetLastError = true)]\n...\n 182|    IntPtr job, process, thread, input, output, errorOutput, queriedSupervisor, queriedBrain;\n*183|    bool resumed, directExited, cleanupFailed, dispositionConfirmed, membershipPublished;\n 184|    string ownedHome, lastMembershipRequestId, lastMembershipRequestText;\n 185|\n 186|    D2NativeLauncher(int seconds, string path, string stop, string control, Stopwatch elapsed, FileStream journal, string initial)\n...\n 279|                    if (String.Equals(name, \"OWL_SESSION_ID\", StringComparison.OrdinalIgnoreCase) ||\n*280|                        String.Equals(name, \"SPT_AGENT_ID\", StringComparison.OrdinalIgnoreCase) ||\n*281|                        String.Equals(name, \"SPT_ENDPOINT_ID\", StringComparison.OrdinalIgnoreCase) ||\n*282|                        String.Equals(name, \"SPT_SESSION_ID\", StringComparison.OrdinalIgnoreCase))\n 283|                        throw new InvalidDataException(\"SESSION_GUARD_OVERRIDE_REFUSED: \" + name);\n*284|                    psi.Environment[name] = value;\n*285|                    if (String.Equals(name, \"SPT_HOME\", StringComparison.OrdinalIgnoreCase))\n 286|                    {\n*287|                        if (!Path.IsPathFullyQualified(value)) throw new InvalidDataException(\"SPT_HOME_MUST_BE_ABSOLUTE\");\n 288|                        ownedHome = Path.GetFullPath(value).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);\n 289|                    }\n 290|                }\n...\n 294|    }\n*295|    static IntPtr EnvironmentBlock(ProcessStartInfo psi)\n 296|    {\n*297|        var names = new List<string>(psi.Environment.Keys);\n 298|        names.Sort(StringComparer.OrdinalIgnoreCase);\n 299|        var block = new StringBuilder();\n 300|        foreach (string name in names)\n 301|        {\n*302|            string value = psi.Environment[name];\n 303|            if (value == null || name.IndexOf('\\0') >= 0 || value.IndexOf('\\0') >= 0)\n 304|                throw new InvalidDataException(\"INVALID_INHERITED_ENVIRONMENT\");\n 305|            block.Append(name).Append('=').Append(value).Append('\\0');\n...\n 314|        // Real C# null: PowerShell string marshaling of $null is not native NULL.\n*315|        job = CreateJobObjectW(IntPtr.Zero, null);\n*316|        if (job == IntPtr.Zero) throw NativeError(\"CreateJobObjectW\");\n 317|        uint handleFlags;\n 318|        if (!GetHandleInformation(job, out handleFlags)) throw NativeError(\"GetHandleInformation(job)\");\n 319|        if ((handleFlags & 1) != 0) throw new InvalidOperationException(\"JOB_HANDLE_IS_INHERITABLE\");\n...\n 321|        var requested = new EXTENDED_LIMITS { BasicLimitInformation = basic };\n*322|        if (!SetInformationJobObject(job, 9, ref requested, (uint)Marshal.SizeOf<EXTENDED_LIMITS>())) throw NativeError(\"SetInformationJobObject\");\n 323|        EXTENDED_LIMITS actual;\n*324|        if (!QueryLimits(job, 9, out actual, (uint)Marshal.SizeOf<EXTENDED_LIMITS>(), IntPtr.Zero)) throw NativeError(\"QueryInformationJobObject(limits)\");\n 325|        record.job.limit_flags = actual.BasicLimitInformation.LimitFlags;\n 326|        record.job.kill_on_close_read = record.job.limit_flags == 0x2000;\n 327|        Publish(\"limits_read\");\n...\n 371|            if (command.Length >= 32767) throw new InvalidDataException(\"NATIVE_COMMAND_LINE_TOO_LONG\");\n*372|            environment = EnvironmentBlock(psi);\n 373|            RequireWorkTime();\n 374|            PROCESS_INFORMATION created;\n 375|            if (!CreateProcessW(psi.FileName, command, IntPtr.Zero, IntPtr.Zero, true,\n...\n 453|            {\n*454|                if (!TerminateJobObject(job, exitCode)) throw NativeError(\"TerminateJobObject\");\n 455|                terminationRequested = true;\n 456|            }\n 457|            else if (!directExited)\n...\n 500|                    if (!QueryAccounting(queriedJob, 1, out accounting, (uint)Marshal.SizeOf<ACCOUNTING>(), IntPtr.Zero))\n*501|                        throw NativeError(\"QueryInformationJobObject(accounting)\");\n 502|                    if (fault == \"accounting\") throw new InvalidOperationException(\"FAULT_HANDLE_UNEXPECTEDLY_ACCEPTED\");\n 503|                    record.job.active_processes = accounting.ActiveProcesses;\n 504|                    Evidence(\"accounting_read\");\n...\n 530|            RequireWorkTime();\n*531|            if (!AssignProcessToJobObject(fault == \"assignment\" ? new IntPtr(-2) : job, process))\n*532|                throw NativeError(\"AssignProcessToJobObject\");\n 533|            if (fault == \"assignment\") throw new InvalidOperationException(\"FAULT_HANDLE_UNEXPECTEDLY_ACCEPTED\");\n 534|            record.job.assigned = true;\n 535|            record.coverage = \"PARTIAL\";\n...\n 538|            if (!IsProcessInJob(process, job, out member)) throw NativeError(\"IsProcessInJob(subject)\");\n*539|            record.job.membership_read = member;\n 540|            if (!member) throw new InvalidOperationException(\"ASSIGNED_SUBJECT_NOT_IN_JOB\");\n 541|            record.coverage = admission == \"process-tree\" ? \"COMPLETE\" : \"PARTIAL\";\n*542|            Publish(\"membership_read\");\n 543|            RequireWorkTime();\n 544|            uint previous = ResumeThread(thread);\n 545|            if (previous == 0xffffffff) throw NativeError(\"ResumeThread\");\n...\n 684|            uint wait = WaitForSingleObject(handle, 0);\n*685|            if (wait == 0xffffffff) throw NativeError(\"WaitForSingleObject(membership)\");\n 686|            if (wait != 258) throw new InvalidOperationException(\"MEMBERSHIP_SUBJECT_NOT_LIVE\");\n 687|            bool member;\n 688|            bool ok = IsProcessInJob(handle, job, out member);\n...\n 716|        if (handle != IntPtr.Zero) return Membership(handle, expected, parent);\n*717|        var failure = NativeError(\"OpenProcess(membership readback)\");\n 718|        return new MembershipRow { pid = expected.pid, created = expected.created,\n 719|            win32_error = failure.NativeErrorCode, error = failure.ToString() };\n 720|    }\n...\n 722|    {\n*723|        string requestPath = recordFile + \".membership-request.json\";\n 724|        if (!File.Exists(requestPath)) return;\n 725|        string text = ReadText(requestPath);\n 726|        if (text == lastMembershipRequestText) return;\n...\n 739|                lastMembershipRequestId = requestId;\n*740|                if (ownedHome == null) throw new InvalidOperationException(\"MEMBERSHIP_REQUIRES_EXPLICIT_ENVIRONMENTFILE_SPT_HOME\");\n 741|                string requestedHome = request.GetProperty(\"home\").GetString();\n 742|                if (!Path.IsPathFullyQualified(requestedHome) || !String.Equals(ownedHome,\n 743|                    Path.GetFullPath(requestedHome).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar), StringComparison.OrdinalIgnoreCase))\n...\n 782|        if (cleanupFailed) { valid = false; queryError = queryError ?? \"MEMBERSHIP_HANDLE_RELEASE_FAILED\"; }\n*783|        AtomicJson(recordFile + \".membership.json\", new { version = 1, request_id = requestId, home = ownedHome,\n*784|            measured_utc = DateTime.UtcNow.ToString(\"o\"), valid = valid, supervisor = supervisor, brain = brain, error = queryError }, membershipPublished);\n*785|        membershipPublished = true;\n*786|        Publish(\"membership_query\");\n 787|        if (cleanupFailed) throw new InvalidOperationException(\"MEMBERSHIP_HANDLE_RELEASE_FAILED\");\n 788|    }\n 789|}"}],"details":{"scopePath":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\hertz-fp-driver-review\\d2\\field-rig-r10-w7-a2-QWHXWYUH\\support\\fp-bin\\launch-v2.cs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":36,"fileCount":1,"files":[".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs"],"fileMatches":[{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs","count":36}],"truncated":false,"displayContent":"  32│        public bool assigned { get; set; }\n *33│        public bool membership_read { get; set; }\n  34│        public bool kill_on_close_read { get; set; }\n  35│        public uint? limit_flags { get; set; }\n  36│        public uint? active_processes { get; set; }\n    │...\n 125│    [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode, SetLastError = true)]\n*126│    static extern IntPtr CreateJobObjectW(IntPtr attributes, string name);\n 127│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*128│    static extern bool SetInformationJobObject(IntPtr job, int infoClass, ref EXTENDED_LIMITS info, uint length);\n*129│    [DllImport(\"kernel32.dll\", EntryPoint = \"QueryInformationJobObject\", SetLastError = true)]\n 130│    static extern bool QueryLimits(IntPtr job, int infoClass, out EXTENDED_LIMITS info, uint length, IntPtr returnedLength);\n*131│    [DllImport(\"kernel32.dll\", EntryPoint = \"QueryInformationJobObject\", SetLastError = true)]\n 132│    static extern bool QueryAccounting(IntPtr job, int infoClass, out ACCOUNTING info, uint length, IntPtr returnedLength);\n 133│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*134│    static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);\n 135│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n 136│    static extern bool IsProcessInJob(IntPtr process, IntPtr job, out bool member);\n 137│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n*138│    static extern bool TerminateJobObject(IntPtr job, uint exitCode);\n 139│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n 140│    static extern bool TerminateProcess(IntPtr process, uint exitCode);\n 141│    [DllImport(\"kernel32.dll\", SetLastError = true)]\n    │...\n 182│    IntPtr job, process, thread, input, output, errorOutput, queriedSupervisor, queriedBrain;\n*183│    bool resumed, directExited, cleanupFailed, dispositionConfirmed, membershipPublished;\n 184│    string ownedHome, lastMembershipRequestId, lastMembershipRequestText;\n 185│\n 186│    D2NativeLauncher(int seconds, string path, string stop, string control, Stopwatch elapsed, FileStream journal, string initial)\n    │...\n 279│                    if (String.Equals(name, \"OWL_SESSION_ID\", StringComparison.OrdinalIgnoreCase) ||\n*280│                        String.Equals(name, \"SPT_AGENT_ID\", StringComparison.OrdinalIgnoreCase) ||\n*281│                        String.Equals(name, \"SPT_ENDPOINT_ID\", StringComparison.OrdinalIgnoreCase) ||\n*282│                        String.Equals(name, \"SPT_SESSION_ID\", StringComparison.OrdinalIgnoreCase))\n 283│                        throw new InvalidDataException(\"SESSION_GUARD_OVERRIDE_REFUSED: \" + name);\n*284│                    psi.Environment[name] = value;\n*285│                    if (String.Equals(name, \"SPT_HOME\", StringComparison.OrdinalIgnoreCase))\n 286│                    {\n*287│                        if (!Path.IsPathFullyQualified(value)) throw new InvalidDataException(\"SPT_HOME_MUST_BE_ABSOLUTE\");\n 288│                        ownedHome = Path.GetFullPath(value).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);\n 289│                    }\n 290│                }\n    │...\n 294│    }\n*295│    static IntPtr EnvironmentBlock(ProcessStartInfo psi)\n 296│    {\n*297│        var names = new List<string>(psi.Environment.Keys);\n 298│        names.Sort(StringComparer.OrdinalIgnoreCase);\n 299│        var block = new StringBuilder();\n 300│        foreach (string name in names)\n 301│        {\n*302│            string value = psi.Environment[name];\n 303│            if (value == null || name.IndexOf('\\0') >= 0 || value.IndexOf('\\0') >= 0)\n 304│                throw new InvalidDataException(\"INVALID_INHERITED_ENVIRONMENT\");\n 305│            block.Append(name).Append('=').Append(value).Append('\\0');\n    │...\n 314│        // Real C# null: PowerShell string marshaling of $null is not native NULL.\n*315│        job = CreateJobObjectW(IntPtr.Zero, null);\n*316│        if (job == IntPtr.Zero) throw NativeError(\"CreateJobObjectW\");\n 317│        uint handleFlags;\n 318│        if (!GetHandleInformation(job, out handleFlags)) throw NativeError(\"GetHandleInformation(job)\");\n 319│        if ((handleFlags & 1) != 0) throw new InvalidOperationException(\"JOB_HANDLE_IS_INHERITABLE\");\n    │...\n 321│        var requested = new EXTENDED_LIMITS { BasicLimitInformation = basic };\n*322│        if (!SetInformationJobObject(job, 9, ref requested, (uint)Marshal.SizeOf<EXTENDED_LIMITS>())) throw NativeError(\"SetInformationJobObject\");\n 323│        EXTENDED_LIMITS actual;\n*324│        if (!QueryLimits(job, 9, out actual, (uint)Marshal.SizeOf<EXTENDED_LIMITS>(), IntPtr.Zero)) throw NativeError(\"QueryInformationJobObject(limits)\");\n 325│        record.job.limit_flags = actual.BasicLimitInformation.LimitFlags;\n 326│        record.job.kill_on_close_read = record.job.limit_flags == 0x2000;\n 327│        Publish(\"limits_read\");\n    │...\n 371│            if (command.Length >= 32767) throw new InvalidDataException(\"NATIVE_COMMAND_LINE_TOO_LONG\");\n*372│            environment = EnvironmentBlock(psi);\n 373│            RequireWorkTime();\n 374│            PROCESS_INFORMATION created;\n 375│            if (!CreateProcessW(psi.FileName, command, IntPtr.Zero, IntPtr.Zero, true,\n    │...\n 453│            {\n*454│                if (!TerminateJobObject(job, exitCode)) throw NativeError(\"TerminateJobObject\");\n 455│                terminationRequested = true;\n 456│            }\n 457│            else if (!directExited)\n    │...\n 500│                    if (!QueryAccounting(queriedJob, 1, out accounting, (uint)Marshal.SizeOf<ACCOUNTING>(), IntPtr.Zero))\n*501│                        throw NativeError(\"QueryInformationJobObject(accounting)\");\n 502│                    if (fault == \"accounting\") throw new InvalidOperationException(\"FAULT_HANDLE_UNEXPECTEDLY_ACCEPTED\");\n 503│                    record.job.active_processes = accounting.ActiveProcesses;\n 504│                    Evidence(\"accounting_read\");\n    │...\n 530│            RequireWorkTime();\n*531│            if (!AssignProcessToJobObject(fault == \"assignment\" ? new IntPtr(-2) : job, process))\n*532│                throw NativeError(\"AssignProcessToJobObject\");\n 533│            if (fault == \"assignment\") throw new InvalidOperationException(\"FAULT_HANDLE_UNEXPECTEDLY_ACCEPTED\");\n 534│            record.job.assigned = true;\n 535│            record.coverage = \"PARTIAL\";\n    │...\n 538│            if (!IsProcessInJob(process, job, out member)) throw NativeError(\"IsProcessInJob(subject)\");\n*539│            record.job.membership_read = member;\n 540│            if (!member) throw new InvalidOperationException(\"ASSIGNED_SUBJECT_NOT_IN_JOB\");\n 541│            record.coverage = admission == \"process-tree\" ? \"COMPLETE\" : \"PARTIAL\";\n*542│            Publish(\"membership_read\");\n 543│            RequireWorkTime();\n 544│            uint previous = ResumeThread(thread);\n 545│            if (previous == 0xffffffff) throw NativeError(\"ResumeThread\");\n    │...\n 684│            uint wait = WaitForSingleObject(handle, 0);\n*685│            if (wait == 0xffffffff) throw NativeError(\"WaitForSingleObject(membership)\");\n 686│            if (wait != 258) throw new InvalidOperationException(\"MEMBERSHIP_SUBJECT_NOT_LIVE\");\n 687│            bool member;\n 688│            bool ok = IsProcessInJob(handle, job, out member);\n    │...\n 716│        if (handle != IntPtr.Zero) return Membership(handle, expected, parent);\n*717│        var failure = NativeError(\"OpenProcess(membership readback)\");\n 718│        return new MembershipRow { pid = expected.pid, created = expected.created,\n 719│            win32_error = failure.NativeErrorCode, error = failure.ToString() };\n 720│    }\n    │...\n 722│    {\n*723│        string requestPath = recordFile + \".membership-request.json\";\n 724│        if (!File.Exists(requestPath)) return;\n 725│        string text = ReadText(requestPath);\n 726│        if (text == lastMembershipRequestText) return;\n    │...\n 739│                lastMembershipRequestId = requestId;\n*740│                if (ownedHome == null) throw new InvalidOperationException(\"MEMBERSHIP_REQUIRES_EXPLICIT_ENVIRONMENTFILE_SPT_HOME\");\n 741│                string requestedHome = request.GetProperty(\"home\").GetString();\n 742│                if (!Path.IsPathFullyQualified(requestedHome) || !String.Equals(ownedHome,\n 743│                    Path.GetFullPath(requestedHome).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar), StringComparison.OrdinalIgnoreCase))\n    │...\n 782│        if (cleanupFailed) { valid = false; queryError = queryError ?? \"MEMBERSHIP_HANDLE_RELEASE_FAILED\"; }\n*783│        AtomicJson(recordFile + \".membership.json\", new { version = 1, request_id = requestId, home = ownedHome,\n*784│            measured_utc = DateTime.UtcNow.ToString(\"o\"), valid = valid, supervisor = supervisor, brain = brain, error = queryError }, membershipPublished);\n*785│        membershipPublished = true;\n*786│        Publish(\"membership_query\");\n 787│        if (cleanupFailed) throw new InvalidOperationException(\"MEMBERSHIP_HANDLE_RELEASE_FAILED\");\n 788│    }\n 789│}"},"isError":false,"timestamp":1789522877888}}
{"type":"message","id":"f216f8f7","parentId":"abffd27c","timestamp":"2026-09-16T01:41:17.892Z","message":{"role":"toolResult","toolCallId":"call_PbsCMy9JMR4tRTlP03sPx0RC|fc_0bac546ce171b754016aa9f3bdbcc087d196f56d9b384dc171","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-307-evidence/crates/\n\n## xtask/src/\n### main.rs\n 1802|            artifact_sha256: spt_daemon::release::sha256_hex(&bytes),\n*1803|            brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*1804|            broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1805|            product_version: product_version.to_string(),\n 1806|        };\n 1807|        let metadata_json = serde_json::to_string(&meta).expect(\"serialize metadata\");\n...\n 1880|                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*1881|                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*1882|                broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1883|                asset_name: Some(name.to_string()),\n 1884|            },\n 1885|        );\n...\n 2446|                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*2447|                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*2448|                broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n 2449|                asset_name: path\n 2450|                    .file_name()\n 2451|                    .and_then(|n| n.to_str())\n\n## spt-daemon/src/\n### applyhost.rs\n 49|use crate::release::{current_platform, VerifyPolicy};\n*50|use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdateClass};\n 51|\n 52|/// What [`apply_staged`] did — loud + typed, never silent.\n 53|#[derive(Debug, Clone, PartialEq, Eq)]\n...\n 204|                .map_err(|e| format!(\"staged artifact: {e}\"))?;\n*205|            let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\n 206|                Ok(p) => p,\n 207|                Err(reason) => {\n 208|                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n...\n 219|                .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\n*220|            let plan = match plan_verified_update_set(\n*221|                &BrokerAbi::current(),\n 222|                &signed,\n 223|                platform,\n 224|                &artifact,\n### frame.rs\n 26|/// Additive changes — new `kind`s, new optional fields — do **not** bump this.\n*27|pub const IPC_PROTOCOL_VERSION: u32 = 1;\n 28|\n 29|/// The oldest peer `protocol_version` this build will still handshake with.\n 30|/// Held at `1` for v1; raised only when an old version is genuinely retired.\n*31|pub const MIN_COMPATIBLE_VERSION: u32 = 1;\n 32|\n 33|/// Which side of the IPC a connecting peer is. The broker is the stable kernel;\n 34|/// the brain is the restartable logic layer (ADR-0004).\n### update.rs\n 41|/// touches this — that is precisely what keeps the routine case *brain-only*.\n*42|pub const BROKER_RESOURCE_ABI: u32 = 1;\n 43|\n 44|/// What the currently-running broker provides — the fixed point an incoming\n 45|/// release is classified against (ADR-0004 §A). Captured from the live broker,\n...\n 171|// [impl->REQ-UPD-6]\n*172|pub fn plan_verified_update_set(\n 173|    running: &BrokerAbi,\n 174|    signed: &SignedUpdateSet,\n 175|    platform: &str,\n...\n 276|    fn classify_brain_only_when_broker_hosts_new_brain() {\n*277|        let running = BrokerAbi::current();\n 278|        let same_ipc = ReleaseSpec {\n 279|            brain_ipc_version: running.ipc_version,\n 280|            broker_resource_abi: running.resource_abi,\n...\n 320|    fn classify_broker_breaking_on_resource_abi_change() {\n*321|        let running = BrokerAbi::current();\n 322|        let new_resource = ReleaseSpec {\n 323|            brain_ipc_version: running.ipc_version, // IPC fine — irrelevant here\n 324|            broker_resource_abi: running.resource_abi + 1,\n...\n 422|        let signed = signed_for(&sk, &gate_meta(6, artifact));\n*423|        let plan = plan_verified(&BrokerAbi::current(), &signed, artifact, &gate_policy(&sk))\n 424|            .expect(\"a valid release produces a plan\");\n 425|        assert_eq!(plan.class, UpdateClass::BrainOnly);\n 426|    }\n...\n 437|        let signed = signed_for(&sk, &gate_meta(4, artifact));\n*438|        let got = plan_verified(&BrokerAbi::current(), &signed, artifact, &gate_policy(&sk));\n 439|        assert!(matches!(\n 440|            got,\n 441|            Err(crate::release::RejectReason::Rollback { .. })\n...\n 446|        let wrong = plan_verified(\n*447|            &BrokerAbi::current(),\n 448|            &signed_ok,\n 449|            b\"different bytes\",\n 450|            &gate_policy(&sk),\n...\n 461|    #[test]\n*462|    fn plan_verified_update_set_uses_selected_platform_spec() {\n 463|        let sk = SigningKey::from_bytes(&[3u8; 32]);\n 464|        let artifact = b\"linux binary\";\n 465|        let signed = signed_set_for(\n...\n 468|        );\n*469|        let plan = plan_verified_update_set(\n*470|            &BrokerAbi::current(),\n 471|            &signed,\n 472|            \"x86_64-unknown-linux-gnu\",\n 473|            artifact,\n...\n 478|\n*479|        let missing = plan_verified_update_set(\n*480|            &BrokerAbi::current(),\n 481|            &signed,\n 482|            \"x86_64-pc-windows-msvc\",\n 483|            artifact,\n...\n 499|        );\n*500|        let plan = plan_verified_update_set(\n*501|            &BrokerAbi::current(),\n 502|            &breaking,\n 503|            \"x86_64-unknown-linux-gnu\",\n 504|            b\"next\",\n...\n 512|    fn apply_refuses_non_brain_only_plan() {\n*513|        let running = BrokerAbi::current();\n 514|        let breaking = plan_update(\n 515|            &running,\n 516|            ReleaseSpec {"}],"details":{"scopePath":".worktrees/hertz-307-evidence/crates/xtask/src/main.rs, .worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs, .worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs, .worktrees/hertz-307-evidence/crates/spt-daemon/src/update.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-307-evidence\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":27,"fileCount":4,"files":[".worktrees/hertz-307-evidence/crates/xtask/src/main.rs",".worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs",".worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs",".worktrees/hertz-307-evidence/crates/spt-daemon/src/update.rs"],"fileMatches":[{"path":".worktrees/hertz-307-evidence/crates/xtask/src/main.rs","count":6},{"path":".worktrees/hertz-307-evidence/crates/spt-daemon/src/applyhost.rs","count":4},{"path":".worktrees/hertz-307-evidence/crates/spt-daemon/src/frame.rs","count":2},{"path":".worktrees/hertz-307-evidence/crates/spt-daemon/src/update.rs","count":15}],"truncated":false,"displayContent":"# .worktrees/hertz-307-evidence/crates/\n\n## xtask/src/\n### main.rs\n 1802│            artifact_sha256: spt_daemon::release::sha256_hex(&bytes),\n*1803│            brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*1804│            broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1805│            product_version: product_version.to_string(),\n 1806│        };\n 1807│        let metadata_json = serde_json::to_string(&meta).expect(\"serialize metadata\");\n     │...\n 1880│                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*1881│                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*1882│                broker_resource_abi: spt_daemon::update::BROKER_RESOURCE_ABI,\n 1883│                asset_name: Some(name.to_string()),\n 1884│            },\n 1885│        );\n     │...\n 2446│                artifact_sha256: spt_daemon::sha256_hex(&bytes),\n*2447│                brain_ipc_version: spt_daemon::IPC_PROTOCOL_VERSION,\n*2448│                broker_resource_abi: spt_daemon::BROKER_RESOURCE_ABI,\n 2449│                asset_name: path\n 2450│                    .file_name()\n 2451│                    .and_then(|n| n.to_str())\n\n## spt-daemon/src/\n### applyhost.rs\n  49│use crate::release::{current_platform, VerifyPolicy};\n *50│use crate::update::{plan_verified, plan_verified_update_set, BrokerAbi, UpdateClass};\n  51│\n  52│/// What [`apply_staged`] did — loud + typed, never silent.\n  53│#[derive(Debug, Clone, PartialEq, Eq)]\n    │...\n 204│                .map_err(|e| format!(\"staged artifact: {e}\"))?;\n*205│            let plan = match plan_verified(&BrokerAbi::current(), &signed, &artifact, &policy) {\n 206│                Ok(p) => p,\n 207│                Err(reason) => {\n 208│                    return Ok(Prepared::Done(ApplyStagedOutcome::Rejected(format!(\n    │...\n 219│                .map_err(|e| format!(\"staged artifact for {platform}: {e}\"))?;\n*220│            let plan = match plan_verified_update_set(\n*221│                &BrokerAbi::current(),\n 222│                &signed,\n 223│                platform,\n 224│                &artifact,\n### frame.rs\n 26│/// Additive changes — new `kind`s, new optional fields — do **not** bump this.\n*27│pub const IPC_PROTOCOL_VERSION: u32 = 1;\n 28│\n 29│/// The oldest peer `protocol_version` this build will still handshake with.\n 30│/// Held at `1` for v1; raised only when an old version is genuinely retired.\n*31│pub const MIN_COMPATIBLE_VERSION: u32 = 1;\n 32│\n 33│/// Which side of the IPC a connecting peer is. The broker is the stable kernel;\n 34│/// the brain is the restartable logic layer (ADR-0004).\n### update.rs\n  41│/// touches this — that is precisely what keeps the routine case *brain-only*.\n *42│pub const BROKER_RESOURCE_ABI: u32 = 1;\n  43│\n  44│/// What the currently-running broker provides — the fixed point an incoming\n  45│/// release is classified against (ADR-0004 §A). Captured from the live broker,\n    │...\n 171│// [impl->REQ-UPD-6]\n*172│pub fn plan_verified_update_set(\n 173│    running: &BrokerAbi,\n 174│    signed: &SignedUpdateSet,\n 175│    platform: &str,\n    │...\n 276│    fn classify_brain_only_when_broker_hosts_new_brain() {\n*277│        let running = BrokerAbi::current();\n 278│        let same_ipc = ReleaseSpec {\n 279│            brain_ipc_version: running.ipc_version,\n 280│            broker_resource_abi: running.resource_abi,\n    │...\n 320│    fn classify_broker_breaking_on_resource_abi_change() {\n*321│        let running = BrokerAbi::current();\n 322│        let new_resource = ReleaseSpec {\n 323│            brain_ipc_version: running.ipc_version, // IPC fine — irrelevant here\n 324│            broker_resource_abi: running.resource_abi + 1,\n    │...\n 422│        let signed = signed_for(&sk, &gate_meta(6, artifact));\n*423│        let plan = plan_verified(&BrokerAbi::current(), &signed, artifact, &gate_policy(&sk))\n 424│            .expect(\"a valid release produces a plan\");\n 425│        assert_eq!(plan.class, UpdateClass::BrainOnly);\n 426│    }\n    │...\n 437│        let signed = signed_for(&sk, &gate_meta(4, artifact));\n*438│        let got = plan_verified(&BrokerAbi::current(), &signed, artifact, &gate_policy(&sk));\n 439│        assert!(matches!(\n 440│            got,\n 441│            Err(crate::release::RejectReason::Rollback { .. })\n    │...\n 446│        let wrong = plan_verified(\n*447│            &BrokerAbi::current(),\n 448│            &signed_ok,\n 449│            b\"different bytes\",\n 450│            &gate_policy(&sk),\n    │...\n 461│    #[test]\n*462│    fn plan_verified_update_set_uses_selected_platform_spec() {\n 463│        let sk = SigningKey::from_bytes(&[3u8; 32]);\n 464│        let artifact = b\"linux binary\";\n 465│        let signed = signed_set_for(\n    │...\n 468│        );\n*469│        let plan = plan_verified_update_set(\n*470│            &BrokerAbi::current(),\n 471│            &signed,\n 472│            \"x86_64-unknown-linux-gnu\",\n 473│            artifact,\n    │...\n 478│\n*479│        let missing = plan_verified_update_set(\n*480│            &BrokerAbi::current(),\n 481│            &signed,\n 482│            \"x86_64-pc-windows-msvc\",\n 483│            artifact,\n    │...\n 499│        );\n*500│        let plan = plan_verified_update_set(\n*501│            &BrokerAbi::current(),\n 502│            &breaking,\n 503│            \"x86_64-unknown-linux-gnu\",\n 504│            b\"next\",\n    │...\n 512│    fn apply_refuses_non_brain_only_plan() {\n*513│        let running = BrokerAbi::current();\n 514│        let breaking = plan_update(\n 515│            &running,\n 516│            ReleaseSpec {"},"isError":false,"timestamp":1789522877891}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_IO7vs83ioF9qCjAFdpkRobEO|fc_0bac546ce171b754016aa9f3c0c4f887d195795db04ee4e4b3","toolName":"yield","startedAt":"2026-09-16T01:43:06.016Z"},"id":"b4ee9754","parentId":"f216f8f7","timestamp":"2026-09-16T01:43:06.016Z"}
{"type":"message","id":"84377a29","parentId":"b4ee9754","timestamp":"2026-09-16T01:43:06.017Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":""},{"type":"toolCall","id":"call_IO7vs83ioF9qCjAFdpkRobEO|fc_0bac546ce171b754016aa9f3c0c4f887d195795db04ee4e4b3","name":"yield","arguments":{"type":null,"data":{"summary":"Supported W1b recipe exists: launch an owned copy of main289e3cdf in a fresh home, sign the same compatible bytes as a newer debug update set with main-built xtask, stage only that home, then invoke its copied spt update apply. Real apply owns AppliedPending and brain restart; no synthetic state or product edits needed. Read-only investigation only; nothing executed.","files":[{"path":"crates/xtask/src/main.rs:2204-2259,2377-2524","description":"debug-keygen/debug-pin/debug-rollout arguments, same-invocation seed binding, automatic ABI metadata, signed-set verification and staging."},{"path":"crates/spt-daemon/src/update.rs:37-182","description":"Resource ABI=1, classifier and signature/digest-before-classification gate."},{"path":"crates/spt-daemon/src/frame.rs:27-31","description":"IPC version=1 and minimum compatible version=1; also checked in .worktrees/hertz-307-evidence."},{"path":"crates/spt-daemon/src/applyhost.rs:120-345,528-554,900-944,1032-1202","description":"Real apply gates, executable swap, pending record and broker restart; relevant isolation/class/platform/quarantine tests."},{"path":"crates/spt-daemon/src/brainproc.rs:477-497,670-746,840-931,994-1118,1822-2191","description":"Readiness/hash receipts, record-driven trial, drain-gated promotion, restart trace, rollback and focused trial tests."},{"path":"crates/spt-daemon/src/broker.rs:169-240,2724-2788","description":"5-second controller handoff and 15-second brain writer thresholds; epoch-safe controller slot transition preserving caller cause."},{"path":"crates/spt-daemon/src/relcache.rs:34-39,263-284,469-485","description":"release.json, artifacts/<target>.bin and applied-state.json durable layout."},{"path":"crates/spt-daemon/src/endpoint.rs:18-95","description":"Home-derived broker/seed names, daemon.pid and brain.ready; PID file is not liveness evidence."},{"path":"docs/DEBUG-ROLLOUT.md","description":"Supported isolated debug-key trust overlay, signed-set rollout and explicit apply."},{"path":"docs/49-267-REFRESH-OBSERVATION-PLAN.md:44-240","description":"Identity gates, 300-second observation plus separate 120-second teardown, progress/input attribution and interpretation limits; old admission and binary pin superseded."},{"path":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh:951-1049","description":"Retained #304 keygen/pin/sign recipe; omit its build-current and synthetic debug-mark-applied steps for this trial."},{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1","description":"Small retained native launcher interface: child environment file, bounded run/step scopes, fresh receipts and native job ownership; requires adjacent launch-v2.cs."},{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs:265-305,314-327,530-545,722-785","description":"Explicit child environment, retained native process/job identity and membership receipts; rejects session-guard overrides."}],"architecture":"debug-rollout signs ABI-tagged per-platform bytes and stages a SignedUpdateSet. update apply re-verifies trust/channel/expiry/hash and classifies, swaps its own executable, writes AppliedPending and requests broker-supervised brain restart. Supervisor promotes only after matching-generation readiness plus old-generation drain, with candidate hash check; broker/PTY remain held.","report":"CALLABLE RECIPE (not executed)\nLet W=.worktrees/hertz-307-evidence, X=Main's xtask built from that checkout, A=Main's Windows spt.exe artifact, H=fresh absolute run-owned home, R=fresh retained evidence directory, E=run-owned writable copy of A (not Main's build output or resident executable), K=unique run key id. Every child invocation, including X, receives explicit SPT_HOME=H. Keep signer seed only in the signing child's environment/private keygen output, never shared daemon environment or ordinary logs.\n1. X debug-keygen K. Parse precisely one key_id/public_hex/seed_hex from that invocation; public hex must equal the public key repeated in the printed debug-pin instruction. The retained r8 driver:951-984 already does these identity/shape checks. Discard inherited SPT_DEBUG_RELEASE_SEED; use this invocation's seed only.\n2. X debug-pin --key-id K --public-key PUBLIC --home H. This writes H/identity/release-keys.json, adding K and channel=debug. Only H is trusted for this experiment; never pin the resident home. release.rs:371-382 shows the file OVERLAYS builtin trust, not replaces it, and revoked keys still apply. The private seed is not needed by the recipient.\n3. Launch E daemon run in the retained run-scope launcher with child environment {SPT_HOME:H, SPT_INSTALL_NO_FIREWALL:'1', SPT_PUMP_TRACE:'1'}, captured stderr, owned PID/birth/job receipts and isolated network configuration as separately admitted by Main. Use a run-owned copy because apply swaps current_exe, not a path selected by SPT_HOME. Start observation at run start, not restart-marker arrival.\n4. X debug-rollout --key-id K --channel debug --version 1 --product-version <actual-main-product-version> --artifact x86_64-pc-windows-msvc=A --stage-dir H/releases --state R/debug-rollout-state.json, with SPT_DEBUG_RELEASE_SEED from step 1 on this child only. Use version 1 only for genuinely fresh state; otherwise N must exceed applied/pending/staged/channel counters. No --build-current: Main owns the one build. An empty product_version is supported for this core-only trial; if supplied, do not copy #304's obsolete 0.69.0-fp stamp. Supply A as an immutable source separate from E. xtask verifies its new metadata and each digest before stage, printing DEBUG_ROLLOUT_STAGED. Its explicit --version path is caller-selected, so independently retain monotonic evidence rather than claim the local stage operation consulted recipient history.\n5. With the same explicit child H and verified isolation/ownership, invoke E update apply. This is the production signed path. applyhost:prepare_apply re-verifies stored metadata and artifact, then swap_and_record creates pending and request_brain_restart signals the broker. Do NOT run debug-mark-applied; r8:1047-1049 was a bootstrap-serving fixture shortcut, not acceptable W1b evidence. Do NOT write applied-state.json, edit signed JSON or forge readiness. Same artifact bytes with a higher release counter are supported: there is no different-bytes predicate. Reusing the same version yields AlreadyApplied (including an open pending trial) and does not create another trial. Reapply therefore signs a strictly higher N, not --force (quarantine override is deferred).\n\nCOMPATIBILITY: NO MISSING EXTERNAL ABI VALUE FOR SAME-BUILD REAPPLY\nConfirmed in target worktree: frame.rs:27/31 gives IPC=1 and floor=1; update.rs:42 gives broker resource ABI=1. xtask main.rs:2447-2448 automatically signs these compiled constants; it has no flags to override them. classify (update.rs:112-123) is BrainOnly iff resource ABI matches and candidate brain IPC >= broker floor. Main-built xtask + Main-built A + owned daemon booted from A therefore gives (1,1,1), a supported compatible same-byte reapply. Important source limitation: despite BrokerAbi documentation describing live-broker input, prepare_apply actually passes BrokerAbi::current() (target worktree applyhost.rs:205,221), not a fresh live ABI query. Bind running broker, applying CLI, signer and candidate to Main's producer/hash receipts; do not claim arbitrary resident/different-build compatibility from comments. For a different candidate, exact prerequisites are its true brain IPC/resource ABI and provenance matching the signer's constants, plus actual running-broker compatibility. Unknown values mean refuse; metadata signature alone cannot establish that an arbitrary file really implements xtask's ABI tags.\n\nARTIFACTS / RECEIPTS\nH/releases/release.json contains metadata_json plus signature_hex. Signed metadata artifacts['x86_64-pc-windows-msvc'] contains SHA256, brain_ipc_version=1, broker_resource_abi=1 and asset_name. Bytes reside H/releases/artifacts/x86_64-pc-windows-msvc.bin. Retain source SHA, build invocation/exit and hashes of A/E before apply, signer executable identity, public policy, exact signed JSON and staged artifact SHA; keep secret seed out of receipts. xtask self-verification proves its own signature/hash consistency; actual apply proves acceptance under recipient policy. xtask release-verify is NOT the right standalone verifier here: main.rs:2160+ parses SignedRelease and builtin-only policy, not this debug SignedUpdateSet/home overlay.\nReal swap writes H/releases/applied-state.json phase AppliedPending with version, rollback_binary, candidate_started_ms and prior_version, plus last-outcome=apply-pending (applyhost:280-293). Its write is best-effort, so receipt absence cannot be papered over; if the trial record is not observed, report that limitation rather than manufacturing it. Preserve the aside file path from the record. Supervisor consumes pending regardless of start-reason, clears stale ready before spawn, and promotes only when ready_generation matches and old_gen_drained is true. Retain brain.ready pid/generation/exe_hash, BRAIN_UPDATE_RESTART, BRAIN_PROMOTED or BRAIN_PROMOTE_REJECTED/BRAIN_TRIAL_EXIT/rollback evidence and final applied-state/applied/last-outcome records. Promotion updates Applied and legacy convergence records only after readiness. Hash-unavailable degrades to readiness-only, so require the hash receipt for this experiment's stronger byte claim. Same-byte reapply needs PID/generation change as restart evidence; unchanged SHA alone cannot prove a new process.\n\nSMALLEST RETAINED HELPER REUSE\nReuse r8 keygen parsing/pin/sign sequence as a reference, not the entire field driver (it includes unrelated mutations and debug-mark-applied). Reuse launch-v2.ps1 + adjacent launch-v2.cs, optionally launch-record.py for JSON argv/receipt preparation. Shape: pwsh -NoProfile -File <helper>/launch-v2.ps1 -Label <run-id> -Seconds <remaining-bound> -RecordFile <absolute-fresh.json> -ArgsFile <absolute-argv.json> -Exe <absolute-E> -OutFile <absolute-stdout> -ErrFile <absolute-stderr> -Admission process-tree -Scope run -StopFile <absolute-fresh-stopfile> -EnvironmentFile <absolute-child-env.json>. argv JSON is ['daemon','run']; per-command steps use -Scope step. Launcher refuses preexisting destinations; run scope requires StopFile; environment overlay forbids OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID/SPT_SESSION_ID overrides. Existing run-daemon-control.py only writes SPT_HOME and SPT_INSTALL_NO_FIREWALL, so unchanged invocation alone will NOT add required SPT_PUMP_TRACE. Main must supply a child environment JSON with trace too (not mutate product or ambient parent). Native helper verifies job assignment/member/kill-on-close, records process creation, and offers H-bound supervisor/brain membership requests. It does not itself prove resident exclusions or broker socket address; those remain explicit admission checks.\n\nIDENTITY / SOCKET GATES\nBefore every mutation, especially apply/refresh/stop: retain child's actual H, H's absence-at-admission, E path/hash, launch-created PID plus birth, ancestry/owned-job membership; exclude resident daemon identity and caller ancestor chain (old plan's PID 4732 is a historical exclusion, not sufficient present-day census). endpoint.rs derives spt-daemon-broker-<home-hash>.sock and seed socket from Rust PathBuf hash; it is NOT a file under H or a SHA256 prefix. Establish actual isolated broker/seed endpoints and prove they differ from resident targets. daemon.pid is only a breadcrumb, not liveness/ownership proof. Retained launcher native membership binds home and birth; socket checks must be separately captured. Abort if identity, ancestry, current birth, environment or endpoint cannot be bound. Cleanup only owned run tree, confirm broker/brain/process-tree gone plus isolated sockets gone, retain all artifacts. Observe <=300s from run start, then separate <=120s cleanup; no later marker resets budget. Phase truncation must be named.\n\nCONTROLLER / BACKPRESSURE MEASUREMENTS\nSPT_PUMP_TRACE=1 on the launched daemon enables broker.rs:2765 CONTROLLER_SLOT_CLOSED:<session> conn=<id> cause=<caller-cause> with log stamp, emitted only on occupied-to-empty transition. Epoch-guarded no-op emits nothing. Causes defined at 2730+ are send_deadline, stall_evict, detach; preserve these literals, never infer clean close from a generic absent connection. send_deadline is the caller's observed handoff deadline, NOT proof writer exited. BRAIN_SUBSCRIBER_STALL_EVICT provides session+conn attribution; map run's controller/session connections directly, not from BRAIN_CONN_RETIRED (that token's unrelated error path is not general close evidence). brainproc.rs:914 BRAIN_PROMOTE_GATE_NOT_DRAINED reports first false drain read after readiness per trial generation; no session, no proof heartbeat brain.sessions() completed. Thresholds remain production 5s controller /15s brain writer (broker.rs:179,226); do not inherit SPT_BRAIN_WRITE_DEADLINE_MS override. Blocked-write onset has no emitted receipt, so eviction minus BRAIN_UPDATE_RESTART is NOT sink deadline latency. Keep generation/receipt clocks and counters per PROG line; queued tagged input requires child ACK plus distinct resulting state, ordered, not terminal echo. Missing event/tag means not observed within bounded window, never established absence/loss. One isolated success does not clear field behavior.\n\nTEST REFERENCES (READ ONLY; NOT RUN)\napplyhost.rs:900 apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint; :1032 apply_staged_update_set_selects_local_platform_artifact; :1082 apply_staged_update_set_refuses_broker_touching_payloads; :1112 apply_staged_gates_fail_closed_with_the_seat_untouched; :1165 apply_staged_refuses_a_quarantined_version; :528 staged_already_applied_classifies_up_to_date_vs_newer. brainproc.rs:1822 trial_promotes_on_ready_then_supervises_the_accepted_binary; :1870 ready_but_old_gen_never_drains_does_not_promote_rolls_back; :1918 ready_candidate_promotes_once_old_gen_drains; :2002 ready_but_wrong_bytes_rolls_back_never_promotes; :2045 ready_with_matching_bytes_promotes; :2090 trial_rolls_back_after_budget_of_pre_ready_exits; :2145 trial_kills_alive_never_ready_candidate_before_rollback; :2191 stale_generation_minus_one_ready_never_promotes. These fixtures establish source contracts, not a license to fabricate live pending state.\n\nHONEST REFUSALS\nUnproven producer/ABI relation; wrong platform; bad signature/digest; unknown/revoked key; wrong channel; expired metadata; counter rollback/no-op; quarantined version; RefusedClass for broker-touching metadata; dead broker before swap; restart failure after swap; missing pending/hash receipt; unknown ownership/socket; preexisting home; budget expiry. AppliedPending API result alone does not prove restart (applyhost accepts Ok(_honored), including false); require new brain identity/generation and supervisor traces. If signed pending trial cannot be observed, report refresh-only evidence separately rather than claiming W1b. All live evidence is still Main's future execution prerequisite; no builds, tests, daemon calls or mutations occurred in this investigation."},"error":null}}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":6487,"output":3490,"cacheRead":56320,"cacheWrite":0,"totalTokens":66297,"reasoningTokens":11,"cost":{"input":0.06487000000000001,"output":0.17450000000000002,"cacheRead":0.056319999999999995,"cacheWrite":0,"total":0.29569}},"stopReason":"toolUse","timestamp":1789522877897,"responseId":"resp_0bac546ce171b754016aa9f3be1f4087d199c2e23b3c90cb2b","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_0bac546ce171b754016aa9f3befadc87d1b259ef283642159c","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqfPAVXE6Aa5H3JSa9QHhfvBBUmcMzViKzYZDRwfa-smi2YRhZg_OA8bZ_fIYgk2AoHrfkiJQrRq5GPLeTuwLqVwO0P73dilD0VG2lmVLYRnMzQDelptwAjPiH257HIZC_YuseXz2rMcXC3x543U8_zaXBuodH2DGtbpN3DiwPquVO89ue6Mz8Ix1BMOlg7UgaqodVSVat7XysA9osQatmLzCdlPu-iKICp0A8LmNyqli0jVvUadbqx2RgTytX21N7O-LUUxD49i6O0gfM4teQwgCzKsiEDax9-Em2Mqf-qEjIvIiefeJU7UL9E-xdd7niUFa2Dv1NcMFJGkjsoYLB0fkBF5gEXQNtlMMfMQfxl_jwbofLLKbXL_X9GEAc4TRVqDeDVEc1o0gtEEyHE6znnnwrg6SNIZw_SQLPcCgKrQ5hpNy9PfrsgLtcD2ySpb23q8zTWeea9WtjlGOsEPU4rbSTw2F3sb7ld7Xlx7kNiUocDuVMOEFNIZgdh9Ylx9ySzEoeDdzOO472mpkLmGBqmRSZ39--0H5uf60faV4IqApUUp0lF0uCDDQKAk7iPUMArlxE-9whHc2OUi3BIolq9nxWtFlxfH6aL43GCGOWUNtKwgB0qQuDfV9EwkNDZM3HMl3JSHzkP6eJ9xUYvTl2eMar5vDzQ-UE8_F54lumyjNsRRGpOdoVpUKylRK9YG3viovOYaO8Eo4oKRY2sc-GF6T0dpdC5Nt60g-MeHz6ac3DHq9LtexsDKpfskXzdcegtO1G8279Ip7Mt6Afr4jKeR-uCIsXUajTCddSpUpE1ZJs6k3oUPvP-TTp-a_nWhi8DQtlz5qDbbZK07qDchiWU1HWBV7uqSg9-A4lLlQeY7tusIig4axEg7gm29f7L0Z0ZpJVkWLPuVB3ME5GJlVAZ7WGOg-W7bMnHe-6EoMtkSApgbicCjFC8lPdlAHvr9Crp3SctV5iGRYHCQHrGrX-a5n-PJ7YAIrmvbhFJuyR_NVxnpYP9nH3mB0a3RiFVkJEG3tJBGha95rB7LoSrv31N0AXxmbao9STtSU5bPgCfdOiF-H6d0P8SZWw7mbALdlPY7p7pokTevjQQ5MzeWEG8Q4FRwaAjnieGbggUD2auHWeUmKP0URWZ2so5y8XWoLWeiU96SYvX_Mrc84P5yX56ABfLzSzAwBnJlfjCoWAux5Ph4Fv96k7RI6EnWidjQRjMts8Fy61LdeSsExkP9vECuswV4e3EspfMohL_pbnd4-L88HQ47IzPPEX8jWZi33llv_0OIb0KEwCMnJBq4CzouM_lQxrWeq-7xngRdJN4q8c45E_BDO1FB_fqzxNtz_0u_S","internal_chat_message_metadata_passthrough":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"summary":[],"metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}},{"id":"fc_0bac546ce171b754016aa9f3c0c4f887d195795db04ee4e4b3","type":"function_call","status":"completed","arguments":"{\"type\":null,\"data\":{\"summary\":\"Supported W1b recipe exists: launch an owned copy of main289e3cdf in a fresh home, sign the same compatible bytes as a newer debug update set with main-built xtask, stage only that home, then invoke its copied spt update apply. Real apply owns AppliedPending and brain restart; no synthetic state or product edits needed. Read-only investigation only; nothing executed.\",\"files\":[{\"path\":\"crates/xtask/src/main.rs:2204-2259,2377-2524\",\"description\":\"debug-keygen/debug-pin/debug-rollout arguments, same-invocation seed binding, automatic ABI metadata, signed-set verification and staging.\"},{\"path\":\"crates/spt-daemon/src/update.rs:37-182\",\"description\":\"Resource ABI=1, classifier and signature/digest-before-classification gate.\"},{\"path\":\"crates/spt-daemon/src/frame.rs:27-31\",\"description\":\"IPC version=1 and minimum compatible version=1; also checked in .worktrees/hertz-307-evidence.\"},{\"path\":\"crates/spt-daemon/src/applyhost.rs:120-345,528-554,900-944,1032-1202\",\"description\":\"Real apply gates, executable swap, pending record and broker restart; relevant isolation/class/platform/quarantine tests.\"},{\"path\":\"crates/spt-daemon/src/brainproc.rs:477-497,670-746,840-931,994-1118,1822-2191\",\"description\":\"Readiness/hash receipts, record-driven trial, drain-gated promotion, restart trace, rollback and focused trial tests.\"},{\"path\":\"crates/spt-daemon/src/broker.rs:169-240,2724-2788\",\"description\":\"5-second controller handoff and 15-second brain writer thresholds; epoch-safe controller slot transition preserving caller cause.\"},{\"path\":\"crates/spt-daemon/src/relcache.rs:34-39,263-284,469-485\",\"description\":\"release.json, artifacts/<target>.bin and applied-state.json durable layout.\"},{\"path\":\"crates/spt-daemon/src/endpoint.rs:18-95\",\"description\":\"Home-derived broker/seed names, daemon.pid and brain.ready; PID file is not liveness evidence.\"},{\"path\":\"docs/DEBUG-ROLLOUT.md\",\"description\":\"Supported isolated debug-key trust overlay, signed-set rollout and explicit apply.\"},{\"path\":\"docs/49-267-REFRESH-OBSERVATION-PLAN.md:44-240\",\"description\":\"Identity gates, 300-second observation plus separate 120-second teardown, progress/input attribution and interpretation limits; old admission and binary pin superseded.\"},{\"path\":\".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh:951-1049\",\"description\":\"Retained #304 keygen/pin/sign recipe; omit its build-current and synthetic debug-mark-applied steps for this trial.\"},{\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1\",\"description\":\"Small retained native launcher interface: child environment file, bounded run/step scopes, fresh receipts and native job ownership; requires adjacent launch-v2.cs.\"},{\"path\":\".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs:265-305,314-327,530-545,722-785\",\"description\":\"Explicit child environment, retained native process/job identity and membership receipts; rejects session-guard overrides.\"}],\"architecture\":\"debug-rollout signs ABI-tagged per-platform bytes and stages a SignedUpdateSet. update apply re-verifies trust/channel/expiry/hash and classifies, swaps its own executable, writes AppliedPending and requests broker-supervised brain restart. Supervisor promotes only after matching-generation readiness plus old-generation drain, with candidate hash check; broker/PTY remain held.\",\"report\":\"CALLABLE RECIPE (not executed)\\nLet W=.worktrees/hertz-307-evidence, X=Main's xtask built from that checkout, A=Main's Windows spt.exe artifact, H=fresh absolute run-owned home, R=fresh retained evidence directory, E=run-owned writable copy of A (not Main's build output or resident executable), K=unique run key id. Every child invocation, including X, receives explicit SPT_HOME=H. Keep signer seed only in the signing child's environment/private keygen output, never shared daemon environment or ordinary logs.\\n1. X debug-keygen K. Parse precisely one key_id/public_hex/seed_hex from that invocation; public hex must equal the public key repeated in the printed debug-pin instruction. The retained r8 driver:951-984 already does these identity/shape checks. Discard inherited SPT_DEBUG_RELEASE_SEED; use this invocation's seed only.\\n2. X debug-pin --key-id K --public-key PUBLIC --home H. This writes H/identity/release-keys.json, adding K and channel=debug. Only H is trusted for this experiment; never pin the resident home. release.rs:371-382 shows the file OVERLAYS builtin trust, not replaces it, and revoked keys still apply. The private seed is not needed by the recipient.\\n3. Launch E daemon run in the retained run-scope launcher with child environment {SPT_HOME:H, SPT_INSTALL_NO_FIREWALL:'1', SPT_PUMP_TRACE:'1'}, captured stderr, owned PID/birth/job receipts and isolated network configuration as separately admitted by Main. Use a run-owned copy because apply swaps current_exe, not a path selected by SPT_HOME. Start observation at run start, not restart-marker arrival.\\n4. X debug-rollout --key-id K --channel debug --version 1 --product-version <actual-main-product-version> --artifact x86_64-pc-windows-msvc=A --stage-dir H/releases --state R/debug-rollout-state.json, with SPT_DEBUG_RELEASE_SEED from step 1 on this child only. Use version 1 only for genuinely fresh state; otherwise N must exceed applied/pending/staged/channel counters. No --build-current: Main owns the one build. An empty product_version is supported for this core-only trial; if supplied, do not copy #304's obsolete 0.69.0-fp stamp. Supply A as an immutable source separate from E. xtask verifies its new metadata and each digest before stage, printing DEBUG_ROLLOUT_STAGED. Its explicit --version path is caller-selected, so independently retain monotonic evidence rather than claim the local stage operation consulted recipient history.\\n5. With the same explicit child H and verified isolation/ownership, invoke E update apply. This is the production signed path. applyhost:prepare_apply re-verifies stored metadata and artifact, then swap_and_record creates pending and request_brain_restart signals the broker. Do NOT run debug-mark-applied; r8:1047-1049 was a bootstrap-serving fixture shortcut, not acceptable W1b evidence. Do NOT write applied-state.json, edit signed JSON or forge readiness. Same artifact bytes with a higher release counter are supported: there is no different-bytes predicate. Reusing the same version yields AlreadyApplied (including an open pending trial) and does not create another trial. Reapply therefore signs a strictly higher N, not --force (quarantine override is deferred).\\n\\nCOMPATIBILITY: NO MISSING EXTERNAL ABI VALUE FOR SAME-BUILD REAPPLY\\nConfirmed in target worktree: frame.rs:27/31 gives IPC=1 and floor=1; update.rs:42 gives broker resource ABI=1. xtask main.rs:2447-2448 automatically signs these compiled constants; it has no flags to override them. classify (update.rs:112-123) is BrainOnly iff resource ABI matches and candidate brain IPC >= broker floor. Main-built xtask + Main-built A + owned daemon booted from A therefore gives (1,1,1), a supported compatible same-byte reapply. Important source limitation: despite BrokerAbi documentation describing live-broker input, prepare_apply actually passes BrokerAbi::current() (target worktree applyhost.rs:205,221), not a fresh live ABI query. Bind running broker, applying CLI, signer and candidate to Main's producer/hash receipts; do not claim arbitrary resident/different-build compatibility from comments. For a different candidate, exact prerequisites are its true brain IPC/resource ABI and provenance matching the signer's constants, plus actual running-broker compatibility. Unknown values mean refuse; metadata signature alone cannot establish that an arbitrary file really implements xtask's ABI tags.\\n\\nARTIFACTS / RECEIPTS\\nH/releases/release.json contains metadata_json plus signature_hex. Signed metadata artifacts['x86_64-pc-windows-msvc'] contains SHA256, brain_ipc_version=1, broker_resource_abi=1 and asset_name. Bytes reside H/releases/artifacts/x86_64-pc-windows-msvc.bin. Retain source SHA, build invocation/exit and hashes of A/E before apply, signer executable identity, public policy, exact signed JSON and staged artifact SHA; keep secret seed out of receipts. xtask self-verification proves its own signature/hash consistency; actual apply proves acceptance under recipient policy. xtask release-verify is NOT the right standalone verifier here: main.rs:2160+ parses SignedRelease and builtin-only policy, not this debug SignedUpdateSet/home overlay.\\nReal swap writes H/releases/applied-state.json phase AppliedPending with version, rollback_binary, candidate_started_ms and prior_version, plus last-outcome=apply-pending (applyhost:280-293). Its write is best-effort, so receipt absence cannot be papered over; if the trial record is not observed, report that limitation rather than manufacturing it. Preserve the aside file path from the record. Supervisor consumes pending regardless of start-reason, clears stale ready before spawn, and promotes only when ready_generation matches and old_gen_drained is true. Retain brain.ready pid/generation/exe_hash, BRAIN_UPDATE_RESTART, BRAIN_PROMOTED or BRAIN_PROMOTE_REJECTED/BRAIN_TRIAL_EXIT/rollback evidence and final applied-state/applied/last-outcome records. Promotion updates Applied and legacy convergence records only after readiness. Hash-unavailable degrades to readiness-only, so require the hash receipt for this experiment's stronger byte claim. Same-byte reapply needs PID/generation change as restart evidence; unchanged SHA alone cannot prove a new process.\\n\\nSMALLEST RETAINED HELPER REUSE\\nReuse r8 keygen parsing/pin/sign sequence as a reference, not the entire field driver (it includes unrelated mutations and debug-mark-applied). Reuse launch-v2.ps1 + adjacent launch-v2.cs, optionally launch-record.py for JSON argv/receipt preparation. Shape: pwsh -NoProfile -File <helper>/launch-v2.ps1 -Label <run-id> -Seconds <remaining-bound> -RecordFile <absolute-fresh.json> -ArgsFile <absolute-argv.json> -Exe <absolute-E> -OutFile <absolute-stdout> -ErrFile <absolute-stderr> -Admission process-tree -Scope run -StopFile <absolute-fresh-stopfile> -EnvironmentFile <absolute-child-env.json>. argv JSON is ['daemon','run']; per-command steps use -Scope step. Launcher refuses preexisting destinations; run scope requires StopFile; environment overlay forbids OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID/SPT_SESSION_ID overrides. Existing run-daemon-control.py only writes SPT_HOME and SPT_INSTALL_NO_FIREWALL, so unchanged invocation alone will NOT add required SPT_PUMP_TRACE. Main must supply a child environment JSON with trace too (not mutate product or ambient parent). Native helper verifies job assignment/member/kill-on-close, records process creation, and offers H-bound supervisor/brain membership requests. It does not itself prove resident exclusions or broker socket address; those remain explicit admission checks.\\n\\nIDENTITY / SOCKET GATES\\nBefore every mutation, especially apply/refresh/stop: retain child's actual H, H's absence-at-admission, E path/hash, launch-created PID plus birth, ancestry/owned-job membership; exclude resident daemon identity and caller ancestor chain (old plan's PID 4732 is a historical exclusion, not sufficient present-day census). endpoint.rs derives spt-daemon-broker-<home-hash>.sock and seed socket from Rust PathBuf hash; it is NOT a file under H or a SHA256 prefix. Establish actual isolated broker/seed endpoints and prove they differ from resident targets. daemon.pid is only a breadcrumb, not liveness/ownership proof. Retained launcher native membership binds home and birth; socket checks must be separately captured. Abort if identity, ancestry, current birth, environment or endpoint cannot be bound. Cleanup only owned run tree, confirm broker/brain/process-tree gone plus isolated sockets gone, retain all artifacts. Observe <=300s from run start, then separate <=120s cleanup; no later marker resets budget. Phase truncation must be named.\\n\\nCONTROLLER / BACKPRESSURE MEASUREMENTS\\nSPT_PUMP_TRACE=1 on the launched daemon enables broker.rs:2765 CONTROLLER_SLOT_CLOSED:<session> conn=<id> cause=<caller-cause> with log stamp, emitted only on occupied-to-empty transition. Epoch-guarded no-op emits nothing. Causes defined at 2730+ are send_deadline, stall_evict, detach; preserve these literals, never infer clean close from a generic absent connection. send_deadline is the caller's observed handoff deadline, NOT proof writer exited. BRAIN_SUBSCRIBER_STALL_EVICT provides session+conn attribution; map run's controller/session connections directly, not from BRAIN_CONN_RETIRED (that token's unrelated error path is not general close evidence). brainproc.rs:914 BRAIN_PROMOTE_GATE_NOT_DRAINED reports first false drain read after readiness per trial generation; no session, no proof heartbeat brain.sessions() completed. Thresholds remain production 5s controller /15s brain writer (broker.rs:179,226); do not inherit SPT_BRAIN_WRITE_DEADLINE_MS override. Blocked-write onset has no emitted receipt, so eviction minus BRAIN_UPDATE_RESTART is NOT sink deadline latency. Keep generation/receipt clocks and counters per PROG line; queued tagged input requires child ACK plus distinct resulting state, ordered, not terminal echo. Missing event/tag means not observed within bounded window, never established absence/loss. One isolated success does not clear field behavior.\\n\\nTEST REFERENCES (READ ONLY; NOT RUN)\\napplyhost.rs:900 apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint; :1032 apply_staged_update_set_selects_local_platform_artifact; :1082 apply_staged_update_set_refuses_broker_touching_payloads; :1112 apply_staged_gates_fail_closed_with_the_seat_untouched; :1165 apply_staged_refuses_a_quarantined_version; :528 staged_already_applied_classifies_up_to_date_vs_newer. brainproc.rs:1822 trial_promotes_on_ready_then_supervises_the_accepted_binary; :1870 ready_but_old_gen_never_drains_does_not_promote_rolls_back; :1918 ready_candidate_promotes_once_old_gen_drains; :2002 ready_but_wrong_bytes_rolls_back_never_promotes; :2045 ready_with_matching_bytes_promotes; :2090 trial_rolls_back_after_budget_of_pre_ready_exits; :2145 trial_kills_alive_never_ready_candidate_before_rollback; :2191 stale_generation_minus_one_ready_never_promotes. These fixtures establish source contracts, not a license to fabricate live pending state.\\n\\nHONEST REFUSALS\\nUnproven producer/ABI relation; wrong platform; bad signature/digest; unknown/revoked key; wrong channel; expired metadata; counter rollback/no-op; quarantined version; RefusedClass for broker-touching metadata; dead broker before swap; restart failure after swap; missing pending/hash receipt; unknown ownership/socket; preexisting home; budget expiry. AppliedPending API result alone does not prove restart (applyhost accepts Ok(_honored), including false); require new brain identity/generation and supervisor traces. If signed pending trial cannot be observed, report refresh-only evidence separately rather than claiming W1b. All live evidence is still Main's future execution prerequisite; no builds, tests, daemon calls or mutations occurred in this investigation.\"},\"error\":null}","call_id":"call_IO7vs83ioF9qCjAFdpkRobEO","internal_chat_message_metadata_passthrough":{"create_time":1789522878.269019,"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"},"name":"yield","metadata":{"turn_id":"4968bd68-156c-4c23-869c-ca8887a0440b"}}]},"duration":108118.08170000004,"ttft":1107.611499999999,"completedAt":1789522986016,"contextSnapshot":{"promptTokens":62807,"nonMessageTokens":10373,"compactionEpoch":0}}}
{"type":"message","id":"a509a209","parentId":"84377a29","timestamp":"2026-09-16T01:43:06.019Z","message":{"role":"toolResult","toolCallId":"call_IO7vs83ioF9qCjAFdpkRobEO|fc_0bac546ce171b754016aa9f3c0c4f887d195795db04ee4e4b3","toolName":"yield","content":[{"type":"text","text":"Result submitted."}],"details":{"data":{"summary":"Supported W1b recipe exists: launch an owned copy of main289e3cdf in a fresh home, sign the same compatible bytes as a newer debug update set with main-built xtask, stage only that home, then invoke its copied spt update apply. Real apply owns AppliedPending and brain restart; no synthetic state or product edits needed. Read-only investigation only; nothing executed.","files":[{"path":"crates/xtask/src/main.rs:2204-2259,2377-2524","description":"debug-keygen/debug-pin/debug-rollout arguments, same-invocation seed binding, automatic ABI metadata, signed-set verification and staging."},{"path":"crates/spt-daemon/src/update.rs:37-182","description":"Resource ABI=1, classifier and signature/digest-before-classification gate."},{"path":"crates/spt-daemon/src/frame.rs:27-31","description":"IPC version=1 and minimum compatible version=1; also checked in .worktrees/hertz-307-evidence."},{"path":"crates/spt-daemon/src/applyhost.rs:120-345,528-554,900-944,1032-1202","description":"Real apply gates, executable swap, pending record and broker restart; relevant isolation/class/platform/quarantine tests."},{"path":"crates/spt-daemon/src/brainproc.rs:477-497,670-746,840-931,994-1118,1822-2191","description":"Readiness/hash receipts, record-driven trial, drain-gated promotion, restart trace, rollback and focused trial tests."},{"path":"crates/spt-daemon/src/broker.rs:169-240,2724-2788","description":"5-second controller handoff and 15-second brain writer thresholds; epoch-safe controller slot transition preserving caller cause."},{"path":"crates/spt-daemon/src/relcache.rs:34-39,263-284,469-485","description":"release.json, artifacts/<target>.bin and applied-state.json durable layout."},{"path":"crates/spt-daemon/src/endpoint.rs:18-95","description":"Home-derived broker/seed names, daemon.pid and brain.ready; PID file is not liveness evidence."},{"path":"docs/DEBUG-ROLLOUT.md","description":"Supported isolated debug-key trust overlay, signed-set rollout and explicit apply."},{"path":"docs/49-267-REFRESH-OBSERVATION-PLAN.md:44-240","description":"Identity gates, 300-second observation plus separate 120-second teardown, progress/input attribution and interpretation limits; old admission and binary pin superseded."},{"path":".spt/preserved/hertz-fp-driver-review/v9-exercises/r8/staged-r8-cleanup-exit.sh:951-1049","description":"Retained #304 keygen/pin/sign recipe; omit its build-current and synthetic debug-mark-applied steps for this trial."},{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.ps1","description":"Small retained native launcher interface: child environment file, bounded run/step scopes, fresh receipts and native job ownership; requires adjacent launch-v2.cs."},{"path":".spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-a2-QWHXWYUH/support/fp-bin/launch-v2.cs:265-305,314-327,530-545,722-785","description":"Explicit child environment, retained native process/job identity and membership receipts; rejects session-guard overrides."}],"architecture":"debug-rollout signs ABI-tagged per-platform bytes and stages a SignedUpdateSet. update apply re-verifies trust/channel/expiry/hash and classifies, swaps its own executable, writes AppliedPending and requests broker-supervised brain restart. Supervisor promotes only after matching-generation readiness plus old-generation drain, with candidate hash check; broker/PTY remain held.","report":"CALLABLE RECIPE (not executed)\nLet W=.worktrees/hertz-307-evidence, X=Main's xtask built from that checkout, A=Main's Windows spt.exe artifact, H=fresh absolute run-owned home, R=fresh retained evidence directory, E=run-owned writable copy of A (not Main's build output or resident executable), K=unique run key id. Every child invocation, including X, receives explicit SPT_HOME=H. Keep signer seed only in the signing child's environment/private keygen output, never shared daemon environment or ordinary logs.\n1. X debug-keygen K. Parse precisely one key_id/public_hex/seed_hex from that invocation; public hex must equal the public key repeated in the printed debug-pin instruction. The retained r8 driver:951-984 already does these identity/shape checks. Discard inherited SPT_DEBUG_RELEASE_SEED; use this invocation's seed only.\n2. X debug-pin --key-id K --public-key PUBLIC --home H. This writes H/identity/release-keys.json, adding K and channel=debug. Only H is trusted for this experiment; never pin the resident home. release.rs:371-382 shows the file OVERLAYS builtin trust, not replaces it, and revoked keys still apply. The private seed is not needed by the recipient.\n3. Launch E daemon run in the retained run-scope launcher with child environment {SPT_HOME:H, SPT_INSTALL_NO_FIREWALL:'1', SPT_PUMP_TRACE:'1'}, captured stderr, owned PID/birth/job receipts and isolated network configuration as separately admitted by Main. Use a run-owned copy because apply swaps current_exe, not a path selected by SPT_HOME. Start observation at run start, not restart-marker arrival.\n4. X debug-rollout --key-id K --channel debug --version 1 --product-version <actual-main-product-version> --artifact x86_64-pc-windows-msvc=A --stage-dir H/releases --state R/debug-rollout-state.json, with SPT_DEBUG_RELEASE_SEED from step 1 on this child only. Use version 1 only for genuinely fresh state; otherwise N must exceed applied/pending/staged/channel counters. No --build-current: Main owns the one build. An empty product_version is supported for this core-only trial; if supplied, do not copy #304's obsolete 0.69.0-fp stamp. Supply A as an immutable source separate from E. xtask verifies its new metadata and each digest before stage, printing DEBUG_ROLLOUT_STAGED. Its explicit --version path is caller-selected, so independently retain monotonic evidence rather than claim the local stage operation consulted recipient history.\n5. With the same explicit child H and verified isolation/ownership, invoke E update apply. This is the production signed path. applyhost:prepare_apply re-verifies stored metadata and artifact, then swap_and_record creates pending and request_brain_restart signals the broker. Do NOT run debug-mark-applied; r8:1047-1049 was a bootstrap-serving fixture shortcut, not acceptable W1b evidence. Do NOT write applied-state.json, edit signed JSON or forge readiness. Same artifact bytes with a higher release counter are supported: there is no different-bytes predicate. Reusing the same version yields AlreadyApplied (including an open pending trial) and does not create another trial. Reapply therefore signs a strictly higher N, not --force (quarantine override is deferred).\n\nCOMPATIBILITY: NO MISSING EXTERNAL ABI VALUE FOR SAME-BUILD REAPPLY\nConfirmed in target worktree: frame.rs:27/31 gives IPC=1 and floor=1; update.rs:42 gives broker resource ABI=1. xtask main.rs:2447-2448 automatically signs these compiled constants; it has no flags to override them. classify (update.rs:112-123) is BrainOnly iff resource ABI matches and candidate brain IPC >= broker floor. Main-built xtask + Main-built A + owned daemon booted from A therefore gives (1,1,1), a supported compatible same-byte reapply. Important source limitation: despite BrokerAbi documentation describing live-broker input, prepare_apply actually passes BrokerAbi::current() (target worktree applyhost.rs:205,221), not a fresh live ABI query. Bind running broker, applying CLI, signer and candidate to Main's producer/hash receipts; do not claim arbitrary resident/different-build compatibility from comments. For a different candidate, exact prerequisites are its true brain IPC/resource ABI and provenance matching the signer's constants, plus actual running-broker compatibility. Unknown values mean refuse; metadata signature alone cannot establish that an arbitrary file really implements xtask's ABI tags.\n\nARTIFACTS / RECEIPTS\nH/releases/release.json contains metadata_json plus signature_hex. Signed metadata artifacts['x86_64-pc-windows-msvc'] contains SHA256, brain_ipc_version=1, broker_resource_abi=1 and asset_name. Bytes reside H/releases/artifacts/x86_64-pc-windows-msvc.bin. Retain source SHA, build invocation/exit and hashes of A/E before apply, signer executable identity, public policy, exact signed JSON and staged artifact SHA; keep secret seed out of receipts. xtask self-verification proves its own signature/hash consistency; actual apply proves acceptance under recipient policy. xtask release-verify is NOT the right standalone verifier here: main.rs:2160+ parses SignedRelease and builtin-only policy, not this debug SignedUpdateSet/home overlay.\nReal swap writes H/releases/applied-state.json phase AppliedPending with version, rollback_binary, candidate_started_ms and prior_version, plus last-outcome=apply-pending (applyhost:280-293). Its write is best-effort, so receipt absence cannot be papered over; if the trial record is not observed, report that limitation rather than manufacturing it. Preserve the aside file path from the record. Supervisor consumes pending regardless of start-reason, clears stale ready before spawn, and promotes only when ready_generation matches and old_gen_drained is true. Retain brain.ready pid/generation/exe_hash, BRAIN_UPDATE_RESTART, BRAIN_PROMOTED or BRAIN_PROMOTE_REJECTED/BRAIN_TRIAL_EXIT/rollback evidence and final applied-state/applied/last-outcome records. Promotion updates Applied and legacy convergence records only after readiness. Hash-unavailable degrades to readiness-only, so require the hash receipt for this experiment's stronger byte claim. Same-byte reapply needs PID/generation change as restart evidence; unchanged SHA alone cannot prove a new process.\n\nSMALLEST RETAINED HELPER REUSE\nReuse r8 keygen parsing/pin/sign sequence as a reference, not the entire field driver (it includes unrelated mutations and debug-mark-applied). Reuse launch-v2.ps1 + adjacent launch-v2.cs, optionally launch-record.py for JSON argv/receipt preparation. Shape: pwsh -NoProfile -File <helper>/launch-v2.ps1 -Label <run-id> -Seconds <remaining-bound> -RecordFile <absolute-fresh.json> -ArgsFile <absolute-argv.json> -Exe <absolute-E> -OutFile <absolute-stdout> -ErrFile <absolute-stderr> -Admission process-tree -Scope run -StopFile <absolute-fresh-stopfile> -EnvironmentFile <absolute-child-env.json>. argv JSON is ['daemon','run']; per-command steps use -Scope step. Launcher refuses preexisting destinations; run scope requires StopFile; environment overlay forbids OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID/SPT_SESSION_ID overrides. Existing run-daemon-control.py only writes SPT_HOME and SPT_INSTALL_NO_FIREWALL, so unchanged invocation alone will NOT add required SPT_PUMP_TRACE. Main must supply a child environment JSON with trace too (not mutate product or ambient parent). Native helper verifies job assignment/member/kill-on-close, records process creation, and offers H-bound supervisor/brain membership requests. It does not itself prove resident exclusions or broker socket address; those remain explicit admission checks.\n\nIDENTITY / SOCKET GATES\nBefore every mutation, especially apply/refresh/stop: retain child's actual H, H's absence-at-admission, E path/hash, launch-created PID plus birth, ancestry/owned-job membership; exclude resident daemon identity and caller ancestor chain (old plan's PID 4732 is a historical exclusion, not sufficient present-day census). endpoint.rs derives spt-daemon-broker-<home-hash>.sock and seed socket from Rust PathBuf hash; it is NOT a file under H or a SHA256 prefix. Establish actual isolated broker/seed endpoints and prove they differ from resident targets. daemon.pid is only a breadcrumb, not liveness/ownership proof. Retained launcher native membership binds home and birth; socket checks must be separately captured. Abort if identity, ancestry, current birth, environment or endpoint cannot be bound. Cleanup only owned run tree, confirm broker/brain/process-tree gone plus isolated sockets gone, retain all artifacts. Observe <=300s from run start, then separate <=120s cleanup; no later marker resets budget. Phase truncation must be named.\n\nCONTROLLER / BACKPRESSURE MEASUREMENTS\nSPT_PUMP_TRACE=1 on the launched daemon enables broker.rs:2765 CONTROLLER_SLOT_CLOSED:<session> conn=<id> cause=<caller-cause> with log stamp, emitted only on occupied-to-empty transition. Epoch-guarded no-op emits nothing. Causes defined at 2730+ are send_deadline, stall_evict, detach; preserve these literals, never infer clean close from a generic absent connection. send_deadline is the caller's observed handoff deadline, NOT proof writer exited. BRAIN_SUBSCRIBER_STALL_EVICT provides session+conn attribution; map run's controller/session connections directly, not from BRAIN_CONN_RETIRED (that token's unrelated error path is not general close evidence). brainproc.rs:914 BRAIN_PROMOTE_GATE_NOT_DRAINED reports first false drain read after readiness per trial generation; no session, no proof heartbeat brain.sessions() completed. Thresholds remain production 5s controller /15s brain writer (broker.rs:179,226); do not inherit SPT_BRAIN_WRITE_DEADLINE_MS override. Blocked-write onset has no emitted receipt, so eviction minus BRAIN_UPDATE_RESTART is NOT sink deadline latency. Keep generation/receipt clocks and counters per PROG line; queued tagged input requires child ACK plus distinct resulting state, ordered, not terminal echo. Missing event/tag means not observed within bounded window, never established absence/loss. One isolated success does not clear field behavior.\n\nTEST REFERENCES (READ ONLY; NOT RUN)\napplyhost.rs:900 apply_staged_swaps_binary_and_hands_off_without_touching_the_endpoint; :1032 apply_staged_update_set_selects_local_platform_artifact; :1082 apply_staged_update_set_refuses_broker_touching_payloads; :1112 apply_staged_gates_fail_closed_with_the_seat_untouched; :1165 apply_staged_refuses_a_quarantined_version; :528 staged_already_applied_classifies_up_to_date_vs_newer. brainproc.rs:1822 trial_promotes_on_ready_then_supervises_the_accepted_binary; :1870 ready_but_old_gen_never_drains_does_not_promote_rolls_back; :1918 ready_candidate_promotes_once_old_gen_drains; :2002 ready_but_wrong_bytes_rolls_back_never_promotes; :2045 ready_with_matching_bytes_promotes; :2090 trial_rolls_back_after_budget_of_pre_ready_exits; :2145 trial_kills_alive_never_ready_candidate_before_rollback; :2191 stale_generation_minus_one_ready_never_promotes. These fixtures establish source contracts, not a license to fabricate live pending state.\n\nHONEST REFUSALS\nUnproven producer/ABI relation; wrong platform; bad signature/digest; unknown/revoked key; wrong channel; expired metadata; counter rollback/no-op; quarantined version; RefusedClass for broker-touching metadata; dead broker before swap; restart failure after swap; missing pending/hash receipt; unknown ownership/socket; preexisting home; budget expiry. AppliedPending API result alone does not prove restart (applyhost accepts Ok(_honored), including false); require new brain identity/generation and supervisor traces. If signed pending trial cannot be observed, report refresh-only evidence separately rather than claiming W1b. All live evidence is still Main's future execution prerequisite; no builds, tests, daemon calls or mutations occurred in this investigation."},"status":"success"},"isError":false,"timestamp":1789522986018}}
{"type":"custom","customType":"session_exit","data":{"reason":"dispose","kind":"normal","recordedAt":"2026-09-16T01:50:06.050Z"},"id":"f30021c3","parentId":"a509a209","timestamp":"2026-09-16T01:50:06.050Z"}