` with a pid you resolved yourself, or `taskkill //PID //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.\r\n- **Second-order, and it bit me inside this very entry.** `git checkout -- ` restores from the INDEX, not HEAD. Having staged a first draft, I \"reverted\" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.\r\n- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).\r\n- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{\"message\":\"Successfully stopped task: bn74vtqn0\"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the …\n- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.\r\n\r\n### IR-117 — a predicate that cannot fail: pre-registered outcomes whose branches are not mutually exclusive, and a requirement titled with the TASK instead of the INVARIANT\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 03:48Z (hertz, both instances his own; doyle ruled the second).\r\n- **Instance 1 — the outcome set.** For the #304 W-2 packet capture hertz pre-registered four outcomes, of which (a) was \"SYN retransmission despite the RST\" and (b) was \"above the wire in the Windows client path\". The capture showed five SYNs at a flat ~511 ms, each RST'd in 18-25 us and each ignored — which is (a)'s packet shape with (b)'s locus. The two branches were the same answer told at two altitudes, so EITHER could have been declared \"confirmed\" and neither could have been refuted by the actual result. Pre-registration defends against fitting the story to the data; it does nothing against branches that cannot both be false.\r\n- **Instance 2 — the requirement title.** hertz drafted `REQ-NET-WINDOWS-REFUSAL-BUDGET` titled \"enumerate the spt paths that treat connection-refused as a fast negative on Windows\". doyle refused it: that is the TASK, not the invariant. A requirement stated as a task is discharged by DOING the task — it would have gone green the instant the enumeration was written, whether or not one path was fixed, and would have had nothing to say about the NEXT connect bound anyone adds. The accepted title states a product invariant (\"classified by its error kind, never by elapsed time; every connect bound documented against the measured floor\"), which new code can violate.\r\n- **Mechanism.** Both are the same defect at different altitudes: an instrument whose every reachable outcome is a pass. Kin on the outcome side: memory discriminator-question, refuse-mechanism-until-something-discriminates, one-sample-is-not-a-negative. Kin on the requirement side: the activation model itself (a stage that cannot go red is not coverage), gate-against-documented-design.\r\n- **Rule.** Before registering an outcome set, name for EACH branch an observation that would refute it; if two branches share a refuter, they are one branch and the set is unfinished. Before adding a `REQ-*`, state it as something CODE can violate, never as work a person can complete — if the only way to make it red is to not write a document, it is a task and belongs in a lane, not the registry. Corollary from the same ruling: a measured constant may NOT enter product code as a threshold. The requirement forbids the interpretation (time as a proxy for error kind); it does not bless the number, which was measured on our machines and not on a user's.\r\n- **Ripe when:** now — both checks are one sentence each at authoring time. · **Size:** procedure.\r\n\r\n### IR-118 — an instrument read mid-flight, or through a filter that cannot match, returns a COMPLETE-LOOKING wrong answer with no error\r\n\r\n- **Status:** OPEN, two instances one hour apart, 2026-09-12 (hertz); doyle asked for the filter line beside IR-117.\r\n- **Instance 1 — the capture read in flight, and it would have inverted the verdict.** `tcpdump -w /tmp/hz-cap.pcap` was still running when the packets were wanted. The file was **8192 bytes** live and **11933 bytes** after `kill -TERM` flushed it; the 3741-byte tail WAS the four SYN retransmissions. Reading the live file would have yielded a well-formed pcap showing one SYN and one prompt RST — i.e. the pre-registered outcome (b), the WRONG answer, assembled entirely from the RIGHT answer's own evidence, with no truncation error and a plausible packet count. The tell was available and nearly missed: a block-aligned size (8192) is a flush boundary, not a record.\r\n- **Instance 2 — the filter that cannot match, class instance 2.** Censusing Windows TCP settings, hertz piped `netsh int tcp show supplemental template=internet` through `Select-String -Pattern 'Template|Initial RTO|Max SYN|Retransmissions'`. It returned ONE line — the header — because none of those words appear in the table's rows (which read `Minimum RTO (msec)`, `Initial Congestion Window (MSS)`, …). Had it been trusted it would have reported \"no retransmission settings exposed\", which is the identical clean zero a CORRECT filter over an empty template returns. Recovered only by re-running the command raw.\r\n- **Mechanism.** In both cases the instrument succeeded, exited 0, and returned a well-formed artefact that under-reports its population — a partial buffer and a non-matching pattern are indistinguishable from a complete capture and an empty table. Neither failure can be detected from the artefact alone; both need a second read of a different kind. Kin: memory zero-match-filter-reads-as-absent, count-predicate-needs-its-own-positive-control, verdict-from-probe-competence, absence-needs-sibling-probe.\r\n- **Rule.** Terminate a `-w` capture and confirm the writer is gone BEFORE reading it, and quote the writer's own census (`N packets captured / N received by filter / 0 dropped by kernel`) beside the packet list; a block-aligned file size is evidence you are mid-flush. For any filtered dump, either carry a positive control the filter MUST match, or dump raw once and read the filter against the real field names — a filtered census that returns only its header has measured nothing.\r\n- **Ripe when:** now — both rules cost one extra command. · **Size:** procedure.\r\n\r\n### IR-119 — a control that only had to prove a ROUTE served a real directory; and a rig is not torn down until its last process is gone, whatever the analysis says\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 05:46Z (doyle) from hertz's unprompted self-disclosure. The security remedy is an OPERATOR item, filed on releases#304 comment **5643876746** (rotate the kitsubito self-hosted runner's registration credential); this entry carries only the reusable mechanisms.\r\n- **Instance.** The accepted-connection control for the W-2 packet capture was `python3 -m http.server 29472 --bind 0.0.0.0` with **cwd `/home/reavus`** — the self-hosted runner account's home — for **1 h 59 m 54 s**. The off-box bind was REQUIRED (the peer dialled from another machine); the working directory was the whole defect. An empty temp dir returns the identical HTTP 200 and proves exactly as much. `http.server` builds its index from `os.listdir` and filters nothing, so 20 dotfiles including the runner credential files were listed and fetchable; mode 0600 did not protect one of them, because the server ran AS that user. kitsubito's posture was separately verified as RSTing with **no** host filter (ufw inactive, nft input policy accept on both tables)…\n- **Mechanism.** A route control and a file server are the SAME COMMAND, so the cheapest way to answer \"can the peer reach this port\" silently publishes whatever directory the shell was sitting in, and the excess is invisible in the result — the 200 looks identical either way. Same family as a pattern-kill that matches its own ssh line: a tool doing more than the measurement asked for.\r\n- **Second mechanism, and it is why two hours passed rather than two minutes.** The author tore down the CAPTURE, named the outcome, and stopped — treating \"the verdict is named\" as \"the leg is finished\". **Naming an outcome is a milestone in the ANALYSIS, never in the RIG.** A rig is torn down when its last process is gone, and the artefact you are proud of is not the only thing you left running. Found only because a stale wake line replayed his own teardown list back to him two hours later.\r\n- **Rule.** (1) A control that proves a route binds an EMPTY throwaway directory, never a home, a repo or a working dir, and it goes down in the SAME breath as the capture it controls. (2) Every rig's teardown is a list of PROCESSES asserted gone against a live positive control, never a list of conclusions. (3) A teardown note written BEFORE a ruling does not license deleting the ruling's cited evidence: `/tmp/hz-cap.pcap` and `/tmp/hz-cap.log` were KEPT by ruling, twice, because they are the primary record of a posted verdict.\r\n- **Evidence quality worth copying.** The window was MEASURED (1 h 59 m 54 s), not estimated; the served-request record was complete (2 requests, both ours, `GET /`, no descent, no file fetch) and its LIMIT was stated rather than implied — a server log is evidence about requests SERVED, never about the network. An independent wire instrument (the pcap, 0 dropped by kernel) covered **4.4%** of the window, and that figure is the capture PROCESS LIFETIME: reading the 2.08 s packet span as the coverage would have understated the evidence 150-fold, because a running capture with no packets is still observing.\r\n- **Kin:** [[IR-116]] (assert the post-state, never an echo), [[IR-118]] (an instrument complete about what it measures and silent about the rest), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry.\r\n- **Ripe when:** now — both rules are one line each in any rig. · **Size:** procedure.\r\n\r\n### IR-120 — a claim named for the one axis nobody varied: six readings over two routes and two libraries, all on ONE box, reported as a property of the platform\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 05:47Z (doyle); the instance is liam's, refuted by hertz's own arm and conceded by its author.\r\n- **Instance.** The ~2.05 s Windows refused-connect latency was filed as \"the WINDOWS refusal latency\" on six readings that varied ROUTE (loopback, LAN hop to Linux) and LIBRARY (curl, .NET TcpClient) and held HOST constant — every one on HFENDULEAM. Route- and library-independence were measured; \"Windows\" was the name of the box. A per-host WFP callout, endpoint agent or filter driver swallowing RSTs would have produced exactly those six readings on exactly those two routes and generalised nothing. Settled only by going to get the missing axis: a second Windows box (Win10 19045 against the first's Win11 26200) read 2077.3 ms, inside 30 ms of the band. The claim survived; it was not ENTITLED to until then.\r\n- **The control the claim also lacked.** Nothing in the record distinguished \"Windows pays 2 s\" from \"TCP to a closed port costs 2 s\" or \"curl reports refusals slowly\" — because every reading was Windows, the word could not be earned from them, only assumed for want of an alternative. The Linux arm supplied it: closed port and open port within **66 microseconds** of each other on the same libraries, so the refusal costs ~0 there and cannot be told from an open port by latency at all. With that control \"Windows\" is measured; without it, it was a label.\r\n- **Mechanism.** Breadth along the axes you happened to vary reads as generality. The check is cheap and nobody runs it: write the claim's subject noun, ask which axis that noun names, then ask whether that axis was varied. Second instance from the same author in one night (a PowerShell-edition confound priced as the product's cost), and a sibling shape in the same leg: \"the box was quiet\" inferred from the absence of ANNOUNCED work, when silence is exactly what an unannounced three-minute recursive grep produces — quiet was never measured for that window either.\r\n- **Rule.** A claim names its population and its varied axes in the same sentence, and the axis in the claim's NOUN must be one of the varied ones. One host is a host, not a platform; one edition is an edition, not a cost. A quantity claimed as a property of a class carries a NEGATIVE CONTROL from outside that class, or it is a label. Corollary already ruled: a constant measured only on our boxes does not enter product code as a threshold — see [[IR-117]].\r\n- **Kin:** memory verified-members-are-not-an-enumerated-population, one-sample-is-not-a-negative, tool-claim-must-name-its-environment, absence-needs-sibling-probe, windows-client-refused-connect-costs-2s.\r\n- **Ripe when:** now — it is a sentence-shape check at authoring time. · **Size:** procedure.\r\n\r\n### IR-121 — one declaration command expands every right-hand side before assigning any name, so a dependent id silently binds the CALLER'S GLOBAL and two arms collapse onto one artifact path; and `cat -A` behind msys `sed` is not a byte reader\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 09:05Z. Instance 1 found by hertz in todlando's driver and confirmed by doyle; repaired as a separately pinned revision (v6 `dcfb732a…` → v7 `927eafb9…`) per the standing rule that a demonstrated execution incompatibility gets a new hash and renewed verification rather than an in-place accommodation. Instance 2 is todlando's own, found while reading the repair site.\r\n- **Instance 1 — the id that looked right.** `trial()` opened with `local arm=\"$1\" n=\"$2\" id=\"$arm-$n\"`. A single declaration command expands EVERY right-hand side before assigning any of its names, so `$arm` was still unset when `id` was built — but `$n` was **not** empty, because the caller is `for n in 1 2 3; do trial a \"$n\"; done` and `n` is a GLOBAL at that point. The id therefore read `-1`, not the empty-ish `-` that would have been noticed: a plausible, consistently-formed, wrong identity. Both arms produced `-1,-2,-3`, so every per-trial artifact keyed on id — captures, stop captures, census tags, portfields snapshots, cpu brackets — collided, and **Arm B overwrote Arm A in place** with nothing downstream able to tell them apart. `arm` itself was cor…\n- **The audit the one fix does not discharge.** A predicate was written over the whole delivered set — any `local`/`declare`/`typeset`/`export`/`readonly` whose later right-hand side references a name assigned earlier in the SAME command — with a positive control broken on purpose (plain `local`, `declare`, and the `${name}` brace form: 3 arms) and a negative control of the same declarations split (0 hits). v6 = 2 hits, both that one line; v7 = 0; v5 = the same single site. Stated over-report: the predicate does not split on `;`, so two correct statements on one physical line read as a dependency — the real site was confirmed not to be that shape. The PowerShell and Python helpers got their own predicates (zero multi-target assignments across four `.ps1`, pr…\n- **Instance 2 — the byte reader that was not one.** The repair site was first read with `sed -n '869,880p' file | cat -A`, which printed `$` at every line end — i.e. LF. The file is CRLF throughout (measured: 1117 CR = 1117 LF = 1117 CRLF). msys `sed` reads in text mode and drops the CRs, so `cat -A` faithfully rendered bytes that `sed` had already removed. The project's own rule (\"after any scripted edit, verify the BYTES\") was followed and still defeated, because the verification ran downstream of a text-mode filter.\r\n- **Third consequence of instance 1, and the worse half of it (hertz, measured independently; re-measured here).** The bad id does not only collide the arms — it begins with a DASH, so every artifact is named `-1.out`, `-2.err`, `-1.stop.out`. Measured in a throwaway dir: `sha256sum *.out` over such a population exits 1 with `unknown option -- 1` and hashes NOTHING (control: the same command over `a-1.out` alone exits 0 and hashes it); `grep -c x -1.out` exits 2 having measured nothing; `sha256sum ./*.out` is the repair. That is the LOUD form. The dangerous form is the one hertz's own detector took: it returned a clean EMPTY snapshot — \"0 artifacts altered\" — in the arm that was supposed to be red, because its glob handed the dashes to a tool that consumed t…\n- **Mechanism.** Both are a wrong answer with no error: a declaration whose dependency is satisfied by an unrelated variable that happens to exist, and a byte census whose bytes were filtered before they were counted. Neither is detectable from its own output — the id is well-formed, the `cat -A` dump is honest about what reached it.\r\n- **Fourth instance, in the very commit that recorded this entry (todlando, self-reported).** The amendment above was applied with a Python text-mode read (`open(p).read()`, universal newlines) and written back with `newline='\r\n'`. This register carried **two lone CR bytes** - `\r\n\r\n- **Instances 9-11` and `\r\n\r\n- **Addendum 2026-09-12 03:20Z` - present since at least `7cdcf5da`. Universal newlines translated each bare CR into a newline, so the commit silently rewrote two lines belonging to OTHER entries (net: 2 stray CRs removed, 2 blank lines added; markdown-harmless, still undeclared). Caught by reading the commit's own diff rather than trusting the insertion count: a one-bullet append that reports **5 insertions, 2 deletions** is telling you it touched something else. A text-mode read is a WRITE hazard, not only a measurement hazard - edit a file whose byte shape you have not measured in binary, and review the diff, never the intent.\r\n- **Rule.** (1) A declaration that depends on a name is its OWN statement; never share a `local` with the name it reads. (2) Derive an identity used as an artifact key ONLY after its parts are assigned, and guard it against its expected shape — a key that can go wrong silently overwrites evidence rather than failing. (3) A negative control for an id scheme must carry the caller's real variable environment: with the caller's global `n` absent, this defect reads as the harmless `-` and is easy to dismiss. (4) Read bytes with a byte reader — `python3` on the raw file, or `od`/`xxd` — never through msys `sed`, `grep`, or any text-mode filter; if a CR/LF count is the claim, count CR and LF bytes and state both.\r\n- **Kin:** [[IR-118]] (a complete-looking wrong answer from an instrument that succeeded), memory count-predicate-needs-its-own-positive-control, make-a-new-rig-red-on-purpose, scripted-edit-zero-match-refusal, render-not-read-pipefail, windows-firewall-census-clean-zeros.\r\n- **Ripe when:** now — (1) and (4) are habits, (2) is three lines in any rig. · **Size:** procedure.\r\n\r\n### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released\r\n\r\n- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**\r","truncated":true,"truncatedBy":"lines","totalLines":572,"totalBytes":63530,"outputLines":406,"outputBytes":63530,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6937,"displayContent":{"text":"### IR-104 — checker 0.4.0 silently skips a FILE scan root under git enumeration: 81 doc stages read as missing, and a local 0.2.0 green hid it because the two versions disagree on what is evidence\n…\n- **Status:** FIXED UPSTREAM 2026-09-11 (traceable-reqs v0.4.1, PR #21 -> d9af11d, red-first cells);\n…\n- **Ripe when:** now — the #304 assembly. · **Size:** one pin fixup; one line in the gate runbook.\n\r\n### IR-105 — an assertion derived from a MODEL of the fixture instead of read off the fixture can only be refuted by a run, and the lane convention that defers the run gives the class a one-window latency: the repair for the first instance carried the second\r\n\r\n- **Status:** OPEN. Rule adopted 2026-09-11 (hertz, W1 close). Instrument = read the line, and read\r\n what the line LANDS on, before asserting either.\r\n- **Instance 1 (hertz, `test/304-remote-friction`, `4ec34d1c`, 03:07Z):** `webserve_e2e.rs`\r\n `subnet_node_labels_shadow_only_the_docs_compat_alias_while_members` still asserted the pre-#301\r\n contract at the `/llms.txt/` line — a node root with an EMPTY remainder as `200`. Under the\r\n node-root arm (`webserve.rs:778-781`) that path is a `302`, so the case died `302 != 200` at the\r\n first assertion it reached and MASKED the five http calls after it. The `4823ae5d` sweep missed\r\n the line because the case's other redirects are BARE-NODE ones, which take `redirect_node` and\r\n are untouched by #301: I classified the case by its siblings and never read the line itself.\r\n Cost: one window.\r\n- **Instance 2, inside the repair for instance 1 (`28d4eb68`, 03:19Z):** `4ec34d1c` was right about\r\n the redirect and wrong about what it lands on — it followed through to `GET /llms.txt/docs/` and\r\n asserted `200`. Measured at `71caedd4`: that is `404`, and the `404` is CORRECT. This fixture's\r\n docs dir holds `cli/reference.md` and the root-file labels and no `index.html`, and a docs root\r\n without one is a 404 by design — `webserve.rs:1028-1033` writes `index.html` precisely in order\r\n to get `200` at `/local/docs/`. So the new assertion pinned index-presence, which is not this\r\n case's subject. I asserted a property of a redirect TARGET without reading what the target\r\n contains. Cost: a second window.\r\n- **The mechanism, stated once:** both assertions were derived from a model — the case's siblings in\r\n instance 1, the contract's shape in instance 2 — rather than read off the fixture in front of me.\r\n A model-derived assertion is indistinguishable from a correct one at authoring time AND at review\r\n time; only a run refutes it. This lane commits such work `UNCOMPILED AND UNRUN at commit time:\r\n written outside the window, measured in the next one` (both commit bodies carry that line\r\n verbatim), so the class has a one-window refutation latency BY CONSTRUCTION, and a repair authored\r\n inside that same blind interval inherits the defect it repairs. That is the register-worthy part:\r\n the fix for a from-a-model assertion was itself a from-a-model assertion, 12 minutes later.\r\n- **Resolution:** `28d4eb68` drops the directory-root status and keeps the `302` + `Location` pair.\r\n The line AFTER it already fetches `/llms.txt/docs/llms.txt` and compares bytes — a real leaf\r\n fetched THROUGH the redirect target, which is stronger evidence the target is live than a status\r\n on the directory root ever was. Blast radius measured at `71caedd4`, producer 3: the case cleared\r\n the old line and the new pair and failed only on this one; the four sibling cases stayed green.\r\n Producer 3 GREEN @`28d4eb68`.\r\n- **Third instance, caught BEFORE it shipped (same session, this entry's own id):** this file in the\r\n `#304` test lane ends at IR-97; main ends at IR-104. Numbering this entry from the register in\r\n front of me would have produced `IR-98` — a collision with a real entry, written while looking at\r\n a file that had every right to look complete. The id is `105` because it was read off main. Same\r\n mechanism, third direction: a stale local artifact IS a model of the shared one.\r\n- **Rule:** assert against what the fixture CONTAINS, at a named line you have read, in the tree the\r\n claim will live in. Three corollaries earned here: a sweep must read every line it claims to have\r\n swept (classifying a case by its siblings is a model); following a redirect obliges you to read\r\n the target's contents before asserting its status (the target's shape is a model); and a register\r\n id, like any shared address, is read off the shared tree, never off your lane's copy.\r\n- **Ripe when:** any test edit is authored outside the window that will measure it — which is this\r\n lane's normal mode. · **Size:** a read, not a tool; the deferred-run interval is the thing to\r\n shorten if it recurs.\r\n- **Kin:** [[IR-101]] (its census read the rendered effect instead of the subject — same family,\r\n same morning, same file), [[IR-102]] (predicting against a blob nobody would run), memory\r\n \"rig inherits the defect it studies\", \"verify the SUBJECT not just the measurement\",\r\n \"precise claim is falsifiable\".\r\n\r\n### IR-106 — a red set HANDED OVER in a message was reported as a POPULATION: both members verified, their lines and modes corrected, and the count still wrong by half\r\n\r\n- **Status:** OPEN as a discipline line; the instance is closed (the run that refuted it is on file).\r\n Author and subject: todlando. Filed by doyle 2026-09-11 11:20Z from todlando's text; IR-105 lands\r\n from hertz's lane at the same assembly, which is why this number follows it.\r\n- **Instance (2026-09-11, #304 W1 product lane).** todlando was handed a red set naming TWO cells in\r\n the spt-daemon webserve module. He opened each one, CORRECTED its line number and its failure mode,\r\n and reported the corrected pair as his prediction. The unfiltered run at 3e7eaf67 showed FOUR reds\r\n of the same mechanism (the retired `/local/` index twin): the two named, plus\r\n `corrupt_registry_is_loud_but_does_not_disable_unrelated_facets` (:1228, 302 vs 500) and\r\n `node_routing_reserves_facets_without_registry_fallback` (:1011, 302 vs 200). A post-run sweep\r\n mapping every single-segment node-root literal to its enclosing fn closed the population at four,\r\n by enumeration; two further cells touch a root and pass for stated reasons.\r\n- **Why the verification is what hides it.** Checking a member answers \"is this one real\". It cannot\r\n answer \"is this all of them\": no amount of per-member rigour turns a received list into an\r\n enumeration, and correcting a handed-down set FEELS more rigorous than enumerating it.\r\n- **Mirror instance one window later, other direction (hertz, same lane).** His enumeration was\r\n SOUND (every node-root literal in the module mapped to its enclosing fn) but its SCOPE was\r\n inherited from the one file he happened to be resolving; the merge also brought\r\n `bootstrap_firewall.rs` (+4) and `bootstrap_firewall/windows.rs` (+2), so his whole-suite count was\r\n short by six (predicted 981, measured 987). Same family: a sound instrument pointed at the wrong\r\n population.\r\n- **Rule.** Before any COUNT enters a prediction, a START or an END, run the enumerating predicate\r\n YOURSELF, with a tool that can express the population you are claiming (an unfiltered run; a grep\r\n whose root is the crate, not the file you have open). A set received in a message is a lead.\r\n- **Kin:** [[IR-100]] (a census counts what its filter could not answer for, separately from a no),\r\n [[IR-101]] (a per-lane green is silent about the population it did not select), [[IR-105]] (a\r\n from-a-model assertion is refuted only by a run), memory \"a predicate without its tool is not evidence\".\r\n- **Ripe when:** now, a line in the window protocol, not a build. Fold into the START/END template\r\n beside the census. · **Size:** one entry, one clause; no code.\r\n\r\n### IR-107 — a rig that redirects TMP INSIDE the checkout puts every tempdir fixture under a git toplevel, and cells whose premise is \"outside any repo\" resolve THIS repo's remote\r\n\r\n- **Status:** RIG FIXED in hertz's lane (base now under `AppData/Local/Temp/hertz-304-rig/`;\r\n `HERTZ_RIG_TMP_IN_REPO=1` restores the old placement on purpose as the negative control). Recorded\r\n 2026-09-11 11:20Z (doyle, from hertz's and todlando's measurements); corrected 11:35Z on hertz's\r\n read. The A/B COMPLETED in window 7 at cba18cd5: arm A (base outside any repo) 2 run / 2 passed;\r\n arm B (base inside the checkout) 2 run / 2 FAILED at :1404 and :842 with the strings below, the two\r\n bases recorded and differing. Window 6's arm B was the non-measurement described below.\r\n- **Instance.** hertz's first unfiltered `spt-daemon --lib` at 69438c01 redded two cells that neither\r\n lane touches and that todlando's unfiltered run had passed 8 minutes earlier on the same bytes and\r\n box: `registryhost::tests::recent_projects_for_dedups_newest_first_excludes_spt_internal` (:1404,\r\n got `[\"github-com-bigscreenvr-spt-bs-core\"]`) and `projwriter::tests::batched_complexity_counters_hold`\r\n (:842, got `Some(\"spt-bs-core\")`). Both fixtures require a directory outside any repo.\r\n- **Mechanism, measured with a control.** `lane_run.py` set TMP/TEMP/TMPDIR/RUNNER_TEMP to\r\n `EVID/temp/` inside the spt-core checkout; `git -C rev-parse --show-toplevel`\r\n answers the checkout (remote `BigscreenVR/spt-bs-core`), while the same probe from the default TMP\r\n answers \"not a git repository\". `project_id_for_dir` is REMOTE-URL FIRST: `slug(remote)` and\r\n `display_from_url(remote)` are the two observed strings exactly, and the folder-name fallback could\r\n not have produced either (candidate folder names: 304-product, hertz-304, spt-core). So git got as\r\n far as step ONE of the derivation. The first mechanism offered (\"any in-repo cwd\") was killed by one\r\n datum: ci.yml:143 runs `kind(lib)` unfiltered on this runner with an in-repo cwd and passed at\r\n 6a7dd6b7. The variable was the FIXTURE's location, never the process cwd.\r\n- **Instrument defects in this lane today, all hertz's, all closed:** (window 5) `cargo ... | tail;\r\n echo $?` reports tail's status (memory \"render-not-read-pipefail\") — the compile gate was in fact\r\n green, so that reading was VOID evidence rather than a masked red; the same construct one command\r\n later printed 0 over a checker [must] finding, a true exit 1 — the hazard is that an exit read\r\n through a pipe certifies nothing, not that it hides reds. (window 4 START gate, 10:26Z) a negative\r\n control that returned at the refusal branch vouched for nothing about the send arm, which then\r\n crashed on a NameError on the first real launch (memory \"make a new rig red on purpose\",\r\n refinement). (window 8, premise lane, 12:14Z) a FOURTH void-exit instance in one day — `$?` and `${PIPESTATUS[0]}` both read a later command, a backgrounded python traceback surfaced as exit 0; every verdict rests on the producer's own recorded exit file or cargo's Finished line. Also: the window driver crashed at its END on a stale dict key AFTER json.dump had written the report — report-before-print is load-bearing and was right by accident; ordered the other way six measured arms evaporate at the summary line. (Linux cells lane, 12:46Z) fifth and sixth: a python driver died on a SyntaxError while the shell reported exit 0 (exposed only by STALE red logs from the previous sha), and a census script stalled mid-run while its ssh reported exit 0. Both caugh…\n- **Third instrument defect, same window (hertz, 11:25Z):** a mutation driver's revert check was\r\n `git hash-object` plus `git diff --quiet`, and BOTH normalize line endings; `git checkout --`\r\n re-materialized docshost.rs as CRLF, the LF-written anchors then counted 0, and the driver REFUSED\r\n at arm 5 = w6-rdrop (the guard working: nothing written; rdrop and lib-full were measured in window\r\n 7: rdrop RED at :683 with left Some(59827), lib-full 988/988) while the oid check reported an identical blob over\r\n bytes that had just changed. An oid check cannot see an eol rewrite; a revert proof records bytes,\r\n crlf and bare-lf counts beside the oids. Also: an arm whose switch reaches only the CHILD env while\r\n the base is chosen from the PARENT's ran the control arm's conditions and passed for its reason (a\r\n non-measurement, not a refutation) - the driver now refuses to call it a measurement if the two\r\n bases match.\r\n- **Rule.** A rig's TMP resolves OUTSIDE every git toplevel, and the rig proves it once per box with\r\n `rev-parse --show-toplevel` expecting \"not a git repository\". A test whose premise is \"no repo\r\n here\" names that premise in its first assertion so the failure reads as environment, not product.\r\n- **Kin:** [[IR-100]], [[IR-101]] (per-lane green silent about the unselected population; these two\r\n cells were invisible to the stock 21-name producer for the whole lane), [[IR-106]].\r\n- **Ripe when:** now for the rig (done). The assertion-premise clause for the two cells rides a\r\n SEPARATE follow-up lane after W1 closes (ruled 11:35Z: neither #304 lane touches registryhost.rs or\r\n projwriter.rs, and a comment in two untouched modules does not widen the integration diff);\r\n hertz's rig also writes its admission record under a stale sha tag (`admission-61bfd85c.json`),\r\n the same family as a reused artifact path — fix in that lane. Consequence already paid: the\r\n window-5 and window-6 admission census records were silently OVERWRITTEN by the later windows\r\n writing the same path, so those two ENDs stand on the transcript alone, not on a record. · **Size:** one env line in the rig\r\n (done); two comment lines in tests; one filename in the rig.\r\n\r\n- **Instances 9-11, all 2026-09-12, #304 W-2 (one night, three different surfaces).** NINTH (doyle's gate leg, 03:20Z): `cargo ... | tail` over non-interactive ssh to kitsubito returned 0 while cargo was off PATH in the non-login shell — already named in releases#304 comment 5643115673 and filed here for the count. TENTH (hertz, 05:30Z, while writing register entries about instruments that lie): `traceable-reqs check 2>&1 | tail -20; echo \"CHECK_EXIT=$?\"` printed `CHECK_EXIT=0` — tail's exit over a checker that exits 1, i.e. a 312-finding red read as clean. He re-ran it only because the register had made him suspicious of his own zero, which is the entry doing its job and not a skill. ELEVENTH (todlando, 05:20Z, a NEW surface — the harness itself): `cargo ne…\n\r\n- **Linux consumer recurrence (todlando, 2026-09-13, #304 at `b8482445`).**\r\n My first consumer driver put `RUNNER_TEMP` under the checkout's preserved-evidence\r\n directory, then exported its child sandbox as TEMP/TMP/TMPDIR. Phase A ran 3417 cells:\r\n 3414 passed (2 leaky), 3 failed, 1 skipped, exit 100. The two daemon premise\r\n assertions named this exact fault; `spt-store::project::tests::derivation_ladder`\r\n also derived the enclosing repository rather than its fixture folder. **That\r\n attempt is VOID, not a candidate regression.** The temp-root Git probe returned\r\n the enclosing checkout (exit 0); the replacement `/tmp/spt-consumer-304-b8482445-valid-*`\r\n root and every exported temp path returned \"not a git repository\" (exit 128).\r\n The replacement driver enforces that boundary before launching any producer.\r\n On unchanged candidate bytes, valid Phase A then ran 3417/3417 passed (1 leaky),\r\n 1 skipped, exit 0; no main delta or source edit was needed. Original raw,\r\n `temp-premise-correction.json`, and the valid `attempt2/` receipts remain under\r\n `.spt/preserved/304-handoff/consumer-linux/`. This repeats the existing rule;\r\n preserving evidence inside the repository never licenses putting fixtures there.\r\n\r\n- **Live-agent identity environment recurrence — Windows consumer (2026-09-13, #304).**\r\n Doyle reported in `5E3WTZ3N` that his live session's `OWL_SESSION_ID` reached the\r\n test driver: Windows consumer attempt 1 is **VOID, not a candidate regression**.\r\n Recorded by hertz from that report, not from an independent rerun. The current\r\n phase was to drain before a full scrubbed rerun; no corrected Windows result or\r\n BOX CLEAR is claimed here. A.2 remains held and the preparation clock unstarted.\r\n **Same mechanism, different input:** TMP placement changes a fixture's repository\r\n context; inherited session identity changes its caller context. In both cases\r\n the harness environment is part of the subject, not neutral launch plumbing.\r\n A clean checkout and pinned executable do not establish the intended test premise.\r\n **Rule:** construct the producer's child environment from its declared test/CI\r\n contract, removing inherited live-session identity inputs as a set before launch.\r\n Verify the effective environment handed to the actual test producer after all\r\n wrapper/sandbox setup; record names and presence/absence, never identity values.\r\n Fixtures that test identity must supply their own explicit fixture identity.\r\n Keep the live agent's own environment and lifecycle intact; this is test-driver\r\n isolation, not permission to evade a guard on real operational commands.\r\n Preserve the invalid attempt's logs and verdict separately from the corrected\r\n run; an environment-premise failure does not authorize a product patch.\r\n **Kin:** [[IR-22]] records the earlier identity-inheritance failure and its\r\n one-variable-at-a-time diagnostic trap; [[IR-122]] distinguishes a real rig's\r\n intentional live-session refusal from an isolated test's contaminated premise.\r\n\r\n### IR-108 — four brainproc unit cells leak a process on every run; two others leak by ordering\r\n\r\n- **Status:** OPEN, product-side backlog candidate (not #304's). Recorded 2026-09-11 11:35Z (doyle)\r\n from three unfiltered `spt-daemon --lib` runs on identical bytes on HFENDULEAM (todlando 10:52Z at\r\n 3e7eaf67; hertz 11:00Z at 69438c01 and 11:27Z at cba18cd5), all green.\r\n- **Cell-shaped (leak 3 of 3):** `brainproc::tests::clear_before_spawn_defeats_exact_generation_stale_file`,\r\n `ready_but_old_gen_never_drains_does_not_promote_rolls_back`, `stale_generation_minus_one_ready_never_promotes`,\r\n `trial_kills_alive_never_ready_candidate_before_rollback`. **Run-shaped:**\r\n `broker::tests::windows_session_is_zombie_sees_a_handle_held_corpse_as_dead` (2 of 3),\r\n `livehost::tests::legacy_psyche_sweep_guard_is_id_specific_and_fail_safe` (1 of 3).\r\n- **Why it matters:** nextest's LEAK is a child that outlives the test; on a shared box that is a\r\n process census entry with no owner and a pool handle that can pin a worktree (memory\r\n worktree-pin-holder-triage). Every post-census this cycle read zero survivors, so the leaks reap\r\n themselves within the run's teardown; the hazard is the window between.\r\n- **Count is PER RUN, not a set (corrected 12:28Z, doyle, on todlando's fold-lane read):** at 61d3459f (fold/304-w2-admission, 992/992) FOUR leaked — brainproc x3 (clear_before_spawn, ready_but_old_gen, stale_generation_minus_one) + broker windows_session_is_zombie — and `trial_kills_alive_never_ready_candidate_before_rollback` RAN (PASS 0.559s, 116/992) and did NOT leak. So \"brainproc x4 cell-shaped\" is 3-of-4 cell-shaped across four runs on three trees; the fourth is run-shaped. A leaky set carried from one END to the next without re-deriving is the inherited-claim habit (IR-106) at its mildest.\r\n- **Discriminator before any fix:** run each cell alone with `--success-output immediate` and read what\r\n child it spawns and why it is not waited; a cell-shaped leak is a missing wait or kill in the\r\n fixture, a run-shaped one is teardown ordering.\r\n- **Kin:** [[IR-100]], memory \"e2e leaked daemons shared box\", \"rig ownership reap only your own\".\r\n- **Ripe when:** next product wave that touches brainproc, or a findings-backlog sweep. · **Size:**\r\n four fixture waits; unknown for the two run-shaped.\r\n\r\n### IR-109 — a manifest `[placement] module_banner = \"accept\"` block LOOSENS the local checker to zero; CI's pinned checker is structurally blind to placement, so the loosening is invisible until the pin moves\r\n\r\n- **Status:** OPEN, RATIFIED 12:33Z (doyle, releases#304) as a TRANSITIONAL policy for the #304 head: the 0.4.1 pin stays (a tightening for every new tag), the accept key exempts only the 312 legacy banner tags, and this entry is the retirement ticket. Recorded 2026-09-11 12:10Z (doyle) from hertz's A/B/C and 0.2.0 arms; the commit's \"agreed\" is corrected by the ruling, not by rewriting a measured sha.\r\n- **Instance.** 33936943 \"chore(traceability): enable agreed placement policy\" (07:38Z, trailer todlando, on\r\n feat/304-remote-friction-product and test/304-remote-friction, NOT on main) adds `[placement] enforce = \"on\"`,\r\n `module_banner = \"accept\"`. The word \"agreed\" is UNRATIFIED: todlando cannot evidence it (his session that\r\n wrote it is gone) and doyle did not rule it.\r\n- **Measured, same binary 0.4.1, same tree 4b54a95d, manifest the only variable:** as-is exit 1 / 312\r\n misplaced_tag; block added exit 0 / 0; `enforce = \"on\"` alone exit 1 / 312. `module_banner` is the sole\r\n load-bearing key; enforce is the default already. CI-pinned 0.2.0 (golden.yml WANT=0.2.0) at the same sha:\r\n exit 0 / 0 — the `misplaced_tag` kind does not exist in that version; placement lives only in its `review`\r\n subcommand, which `check` never reaches. asm-304 (0c05e722, 0.4.1 + the block): exit 0, bought by the key.\r\n- **Why it matters.** AGENTS.md rule 1: tags sit on the evidence, never at file tops to satisfy coverage. The\r\n 312 are banner tags that violate it; the accept key retires them by policy rather than by moving one tag, and\r\n the gate that CI actually runs cannot see either state.\r\n- **Rule.** A checker config change that lowers a finding count is a loosening and is ruled on the record\r\n before it rides; \"agreed\" in a commit message is not a ruling. The honest statement of a zero under such a\r\n config names the config (\"zero under a manifest that accepts module banners\").\r\n- **Kin:** memory checker-version-must-match-ci-pin (live instance), [[IR-104]].\r\n- **CORRECTED 12:24Z (doyle):** the pin HAS moved on the W1 lane ancestry — 71caedd4 \"ci: pin traceable-reqs to v0.4.1\" (10:11Z) sits under 697eb398 (not on main), so ci.yml:253 and golden.yml:1424 both read WANT=0.4.1 at the integration head while origin/main reads WANT=0.2.0 at ci.yml:253 and golden.yml:1414. The accept key is therefore LIVE at the assembled golden gate today, not dormant: asm-304 reads 0 [must] under 0.4.1 because of the key. A lane off 697eb398 reads nine further [must] (code-stage tags in docs prose: F-035-CONFLICT, PUMP-W2-DESIGN, DEBUG-CONVERGE-PLAN, INFRA-REGISTER) that the assembly does not: measured at F-035-CONFLICT:47, 697eb398 carries the bracketed tags and origin/main carries them with brackets elided (\"so the checker\" clause),…\n- **Ripe when:** now — the key rides #304 only as a labelled hole named in the golden hand-off; retire by relocating the 312 tags and deleting the key in a lane of its own. · **Size:** 312 tag moves; the key.\r\n\r\n### IR-110 — the gater ruled a wave from origin/main's manifest while the milestone's own product lane already carried the surface; a second implementation was built to its W-1 END before the first was noticed\r\n\r\n- **Status:** OPEN, STOP LINE on #304 W2 (comment 5634187958). Recorded 2026-09-11 12:10Z (doyle, own instance).\r\n- **Instance.** feat/304-remote-friction-product @3e7eaf67 implements #297 TCP admission under\r\n REQ-WEB-LAN-BOOTSTRAP-FIREWALL (bootstrap_firewall.rs + windows.rs + linux.rs, lanhost/servehost/serveverb/cli\r\n call sites, docs-site section, ADR-0059 \"Amendment 2\" at d71df7aa): program-scoped Windows effector, all\r\n profiles, no remote restriction, zero tests in the module (six guard-level cells arrive with hertz 7b098cc2,\r\n none on scope). doyle deactivated its int stage the same morning and then ruled W2 fork (i) and let four\r\n REQ-LAN-BOOTSTRAP-* ids mint from ORIGIN/MAIN's manifest, where the id is absent (0 occurrences). todlando\r\n built build/304-w2-bootstrap-tcp @fe427497: a second, tested (E4 red at the bound-port assertion, 5/5, 981==981)\r\n netsh implementation, port+remote scoped, never program, a second \"## Amendment 2\" in the same ADR file.\r\n He found the collision at his W-1 END by reading the product lane, and touched nothing.\r\n- **Mechanism.** IR-106 from the gater's chair: the population enumerated (main's manifest) was not the\r\n population the claim was about (the milestone head's). The tell was available all morning — the gater's own\r\n deactivation note names the id — and a grep of the assembly worktree (asm-304) instead of the main checkout\r\n would have returned 1.\r\n- **Consequence.** The two texts disagree on a FACT (which rule shape admits TCP over the tailnet on this box;\r\n W-0 measured program scope admitting nothing for UDP only), both amendments share a heading, and an\r\n assembled head would run both start paths and write two rule sets.\r\n- **Rule.** Before minting or activating any id for a milestone wave, enumerate the ASSEMBLY head's manifest\r\n (asm-), not main's; a wave that \"closes\" a surface names the id it closes and greps the milestone\r\n head for it first. A fork ruling states the tree it enumerated.\r\n- **Kin:** [[IR-106]], [[IR-107]] (same day, same class in three chairs).\r\n- **Ripe when:** now — W-2a discriminating measurement in flight (arms A-D on the installed 5470 listener from\r\n kitsubito), then the fold ruling (one id, one ADR section, the tested decision seam + cells attached to the\r\n surviving effector). · **Size:** one measurement; one fold commit on the W2 lane; the ADR merge is a content\r\n decision, not a merge decision.\r\n- **Labelled hole (12:14Z):** bootstrap_firewall/linux.rs (676 lines) has ZERO #[test]; all six cells sit in bootstrap_firewall.rs and windows.rs. Under cfg the Linux arm is invisible to this box's unit lane, so the surviving id's unit stage reads green over an untested Linux backend set. Closed by a hertz cells lane run on kitsubito against ufw_scope / owned / backend (queued 12:14Z; ten cells red-first at be99017f, 12:41Z). RULE learned there: `ci.yml` lint runs clippy `--all-targets -D warnings` on kitsubito ONLY, and `--all-targets` lints cells as hard as product — a Linux-only red that no Windows gate sees caught todlando's `needless_borrow` (linux.rs:293, fixed be99017f) and hertz's own `cloned_ref_to_slice_refs` (linux.rs:891, test module) one hour ap…\n\r\n### IR-111 — the installed product's own inbound UDP rule reads Duplicate / Inactive in ActiveStore, shadowed by the fallback rule; a by-name probe reads it green\r\n\r\n- **Status:** OPEN, product-side backlog candidate (REQ-INBOUND-WINDOWS-RULE-BINDER-PATH-MATCH family). Recorded\r\n 2026-09-11 12:14Z (doyle) from an unelevated `Get-NetFirewallRule` read of both stores on HFENDULEAM.\r\n- **Instance.** ActiveStore: `spt-core inbound UDP` (Program = installed spt.exe, Profile Any, UDP, Remote Any)\r\n Enabled=True, **Enforcement=Duplicate, PrimaryStatus=Inactive**; `spt-fallback inbound UDP` (same program,\r\n Profile Any) Enforcement=ProfileInactive Enforced, Status OK. PersistentStore shows both as\r\n Enforcement=NotApplicable, Status OK — the persistent view cannot see the shadowing at all.\r\n- **Why it matters.** The product's reconcile and the `inbound_block_hint` probe key on the product rule's NAME.\r\n The rule that is doing the work is the other one; delete or repoint the fallback and the product rule may\r\n become the enforced one with no change in what the name probe reports, or the reverse. Kin to the W1\r\n effector's own comment (\"never certify a rule which ActiveStore reports as ignored or ineffective\") — the\r\n UDP side never reads ActiveStore.\r\n- **Also seen, same read:** ~26 enforced program-scoped Private rules naming target/debug and actions-runner\r\n test binaries (spt_net-*, spt_daemon-*, spt.exe), Proto TCP+UDP, LPort Any, Remote Any — the rig-rule\r\n population the hfenduleam program-scope memory describes; none admits the tailnet.\r\n- **Rule.** A rule probe that certifies anything reads ActiveStore EnforcementStatus, not PersistentStore\r\n presence and not the name.\r\n- **Kin:** [[IR-110]], memory hfenduleam-program-scoped-firewall-rules-do-not-admit-tailnet.\r\n- **Ripe when:** the next inbound-rule wave, or when the W1 CIM two-store query is generalised to the UDP side.\r\n · **Size:** one ActiveStore read in the probe; one dedupe decision.\r\n\r\n### IR-112 — bare `cargo test -p spt-daemon --lib` reds two process-global cells on Linux at a sha where nextest is green; libtest is not a sound gate for this crate\r\n\r\n- **Status:** OPEN, rig rule (CI unaffected: `ci.yml` runs `kind(lib)` under nextest). Recorded 2026-09-11 12:46Z\r\n (doyle) from hertz's Linux cells lane END on kitsubito.\r\n- **Instance.** At 697eb398 on kitsubito: `cargo nextest list -p spt-daemon --lib` = 989 ids; `cargo test -p\r\n spt-daemon --lib` = 989 run, 987 passed, **2 FAILED, exit 101**:\r\n `answerop::tests::an_approval_notifies_a_plain_knocker_with_no_pre_authorization` (answerop.rs:324, \"expected\r\n exactly one courtesy: [] left: 0 right: 1\") and\r\n `brainproc::tests::the_ready_breadcrumb_tells_a_computed_hash_from_a_cached_one` (brainproc.rs:2347, \"the FIRST\r\n ready write in a process pays for the digest\"). Both PASS under nextest with the identical filter, exit 0.\r\n- **Mechanism.** Process-per-test vs one shared libtest process: both cells read process-global state (the\r\n brainproc one says so in its own panic text); under libtest a sibling's write is visible. IR-108's leaky-cell\r\n class, measured on Linux. Kin memory bystander-test-reads-process-global, daemon-lib-tests-deadlock-on-live-host.\r\n- **Rule.** A gate or rig over spt-daemon's lib runs NEXTEST; a `cargo test --lib` red on this crate is a rig\r\n fault until discriminated under nextest with the same filter. Count agreement (list == run) says nothing about\r\n exit agreement — check both.\r\n- **Kin:** [[IR-108]], [[IR-100]].\r\n- **Ripe when:** a sweep makes those two cells hermetic (the fix belongs to the cells, not the gate). · **Size:**\r\n two fixtures.\r\n\r\n### IR-113 — a killed mutation arm does not unwind: the subject stays mutated and the NEXT arm measures a tree nobody declared; and a mutation that reds on a compile error is a void arm that \"it compiled\" cannot detect\r\n\r\n- **Status:** OPEN, rig rule for every mutation driver. Recorded 2026-09-11 13:05Z (doyle) from todlando's FOLD-1b\r\n window (fold/304-w2-admission, windows.rs).\r\n- **Instance.** A first M1 injected an early return through a struct literal naming a helper that does not exist —\r\n a mutation that would red on E0425, not at the cell's assertion, i.e. a void red-first arm. The job was stopped\r\n mid-run; the driver's restore is its LAST line, so the kill left the MUTATED file on disk: working oid d8ddfdf3\r\n against pristine 1f475a80, two residue markers present. Caught only because the next act was an oid compare, not\r\n the next arm. Restored and re-measured identical (residue 0, 786 == 786 lines). Second half: clippy on the\r\n mutated tree exited 0, so \"it compiled\" would not have exposed the void arm either.\r\n- **Mechanism.** Mutate → run → restore is not transactional; any exit before the last line (kill, timeout, crash,\r\n nextest hang) strands the mutation. A void arm is one whose red is not AT the assertion the prediction named.\r\n- **Rule.** (1) A mutation driver restores in a finally/trap path, and every arm BEGINS by asserting the subject's\r\n oid equals the declared pristine oid — the previous arm's revert is proven at the next arm's start, not trusted.\r\n (2) A red-first arm is accepted only when the artifact names the predicted assertion line; a compile-error red,\r\n a panic elsewhere, or a red at a different line is VOID, not a pass and not a fail. (3) Mutations are one-token\r\n edits with an anchor count asserted at 1; an arm that did not change the file voids itself loudly.\r\n- **Kin:** [[IR-107]] (revert proven by oid AND byte shape), memory scripted-edit-zero-match-refusal,\r\n make-a-new-rig-red-on-purpose.\r\n- **Ripe when:** now — the rule is cheap and the drivers exist; every lane's driver adopts it at its next edit. ·\r\n **Size:** a trap/finally and one oid compare per arm.\r\n\r\n### IR-114 — three hands wrote one firewall rule set inside ninety seconds under two directors; every census was true at its instant and false a minute later\r\n\r\n- **Status:** OPEN, procedure ruled 2026-09-12 00:50Z (doyle) on todlando's reconciliation; recorded 00:52Z.\r\n- **Instance.** #304 W-2a arms on HFENDULEAM: ~00:44Z todlando asked the operator to delete spt-w2a-C so B would stand alone; ~00:45Z the operator said \"C down\" and todlando's census read B present / C absent (true then); 00:45:05Z liam ADDED C at doyle's direction (doyle had been idle 11 h and did not know the operator's window); 00:46:14Z liam DELETED B at doyle's direction; 00:49:09Z todlando re-measured C present / B absent. Nobody was wrong; the population was not stable. Every fetch todlando reported had an adjacent census and stands; a long background census that straddled the writes returned no spt-w2a rows at all and is UNMEASURED. Separately, doyle's drop-log arm crossed liam's revert in flight: three fetches ran with logging already off — a void a…\n- **Mechanism.** Two directors (operator, gater) each driving a different elevated hand against the same shared host state, neither seeing the other's window; a census taken as a separate earlier step and carried forward.\r\n- **Rule.** For any arm on shared host state: ONE WRITER; the census is taken BY THE FETCHER in the SAME command as the fetch, before and after; the prediction names the exact expected population (an unexpected row is a red); every write is announced with its UTC time to every party; a director resuming after a gap re-measures the population before issuing a write. Kin: memory verify-the-subject-not-just-the-measurement, name-the-file-and-sha.\r\n- **Also measured tonight (todlando):** 'spt-core daemon' (proto Any, Private, remote Any, program = the listener's exe) covers the Private-classified Tailscale interface while TCP 5470 times out from kitsubito and the LAN address answers 200 with ICMP alive — so W-0 measured the tailnet ACL, not program scoping, and DESIRED_PROGRAM=false's cited justification is VOID (the constant may still be right; its citation is not). The shape question moves to a throwaway port and listener over the LAN (arm E).\r\n- **Ripe when:** now — the rule costs nothing. · **Size:** procedure.\r\n\r\n### IR-115 — a firewall census whose port test is DENIED reads every rule as port=Any and counts port-scoped rules as blanket; a `netsh show rule` without `verbose` omits Program and reads every rule as program=Any; a control count that merges two agents' reads is nobody's control\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 01:14Z (doyle) from todlando's and liam's own corrections during #304 arm E.\r\n- **Instances.** (1) todlando's first census A (\"26 blanket rules\") and B (\"occupied LocalPort set: EMPTY\"): `Get-NetFirewallPortFilter -All` returns \"Access is denied\" unelevated, the probe swallowed the denial, every rule read as port=Any, and B's positive control (the hand rule carries LocalPort 5470) is what caught it. (2) His replacement pass: `netsh advfirewall firewall show rule name=all` without `verbose` prints no Program line, so it reported 417 blankets and ZERO rules naming spt.exe — provably false, caught by the same control. The third pass (`dir=in verbose`) passed both controls (port-5470 rows = 1, spt.exe rows = 7) and was the census used. (3) doyle's fetcher: first census predicate listed port-covering and program-covering rules as two separ…\n- **Mechanism.** A denied or under-scoped read does not error; it returns the permissive default for the field it could not see, so the census reads MORE admits than exist and a shape question gets decided on a phantom population. Kin: memory a-predicate-without-its-tool-is-not-evidence, verdict-from-probe-competence, zero-match-filter-reads-as-absent.\r\n- **Rule.** A firewall census names its tool and privilege and carries two positive controls in the SAME dump: one rule known to carry a specific LocalPort, one known to name a specific Program. A census that cannot see both has not seen the population. The reaching predicate is port-covers AND program-covers AND LocalIP-covers AND profile-covers, one set. Every loopback and remote read records its curl exit code. Counts are per agent; a merged count is restated per agent or discarded.\r\n- **Ripe when:** now — the rule costs one grep. · **Size:** procedure.\r\n\r\n- **Addendum 2026-09-12 03:20Z (doyle, #304 W-2 A5/A4): the Windows Firewall event log is DIRECTION-BLIND, so a rig that keys \"written\" or \"removed\" on it cannot fail in the direction it claims.** Population controlled over one read (2011x48 / 2052x6 / 2097x6, a 400-event re-read of the same window returning the identical six): id 2052 fires on creates AND deletes in the observed population, id 2097 is create-specific, and NOTHING observed is delete-specific. The CENSUS carries the sign; the log carries only the instant. The same read established a MEASURED gap (zero events between A5's end and A4's start) and that nothing commits after the client dies — both usable, neither a direction. Kin: the firewall status fields do not discriminate either, since an ad…\n\r\n### IR-116 — a watchdog that calls a killer and then echoes success reports a kill it never made; `pkill` is absent in msys, so the guard logged \"stopped\" while the arm it guarded ran on\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 01:24Z (todlando) from his own guard during #304 FOLD-2's Windows arm at 7357ea32; doyle asked for the line.\r\n- **Instance.** todlando armed a watchdog to stop a test arm before it reached `cargo test --workspace --lib`, because spt-daemon lib tests deadlock on a live host. Shape: `if grep -q \"CLIPPY_EXIT=\" log; then pkill -f \"bash /tmp/arms.sh\" 2>/dev/null; echo \"GUARD: arms.sh stopped after clippy at $(date -u)\"`. It printed `GUARD: arms.sh stopped after clippy at 01:24:06Z`. Nothing was stopped: `pkill` does not exist in this msys/Git-Bash environment (`command not found`, exit 127), `2>/dev/null` ate the message, and the `echo` was never gated on the killer's exit. The arm ran on into its compile phase and was found by tailing the build log, not by the guard — whose only output was a green.\r\n- **Mechanism.** Two defects stack, and either alone would have been caught by the other: a missing binary, and a success line that cannot fail. Same family as IR-107 seen from the other side — there a trailing command's exit was mistaken for the producer's; here no exit was consulted at all. The aggravating factor is WHERE it lives: a guard is written while thinking about the hazard it guards, not about the guard, and a guard that never fires looks identical to a guard that works. Kin: memory watchdog-reports-a-kill-it-never-made, verdict-from-exit-not-from-silence, a-predicate-without-its-tool-is-not-evidence.\r\n- **Rule.** A watchdog asserts the POST-STATE and never echoes after the call: `kill …; sleep 1; if still_running; then echo \"GUARD FAILED\"; exit 1; fi`. On msys use `kill -9 ` with a pid you resolved yourself, or `taskkill //PID //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.\r\n- **Second-order, and it bit me inside this very entry.** `git checkout -- ` restores from the INDEX, not HEAD. Having staged a first draft, I \"reverted\" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.\r\n- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).\r\n- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{\"message\":\"Successfully stopped task: bn74vtqn0\"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the …\n- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.\r\n\r\n### IR-117 — a predicate that cannot fail: pre-registered outcomes whose branches are not mutually exclusive, and a requirement titled with the TASK instead of the INVARIANT\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 03:48Z (hertz, both instances his own; doyle ruled the second).\r\n- **Instance 1 — the outcome set.** For the #304 W-2 packet capture hertz pre-registered four outcomes, of which (a) was \"SYN retransmission despite the RST\" and (b) was \"above the wire in the Windows client path\". The capture showed five SYNs at a flat ~511 ms, each RST'd in 18-25 us and each ignored — which is (a)'s packet shape with (b)'s locus. The two branches were the same answer told at two altitudes, so EITHER could have been declared \"confirmed\" and neither could have been refuted by the actual result. Pre-registration defends against fitting the story to the data; it does nothing against branches that cannot both be false.\r\n- **Instance 2 — the requirement title.** hertz drafted `REQ-NET-WINDOWS-REFUSAL-BUDGET` titled \"enumerate the spt paths that treat connection-refused as a fast negative on Windows\". doyle refused it: that is the TASK, not the invariant. A requirement stated as a task is discharged by DOING the task — it would have gone green the instant the enumeration was written, whether or not one path was fixed, and would have had nothing to say about the NEXT connect bound anyone adds. The accepted title states a product invariant (\"classified by its error kind, never by elapsed time; every connect bound documented against the measured floor\"), which new code can violate.\r\n- **Mechanism.** Both are the same defect at different altitudes: an instrument whose every reachable outcome is a pass. Kin on the outcome side: memory discriminator-question, refuse-mechanism-until-something-discriminates, one-sample-is-not-a-negative. Kin on the requirement side: the activation model itself (a stage that cannot go red is not coverage), gate-against-documented-design.\r\n- **Rule.** Before registering an outcome set, name for EACH branch an observation that would refute it; if two branches share a refuter, they are one branch and the set is unfinished. Before adding a `REQ-*`, state it as something CODE can violate, never as work a person can complete — if the only way to make it red is to not write a document, it is a task and belongs in a lane, not the registry. Corollary from the same ruling: a measured constant may NOT enter product code as a threshold. The requirement forbids the interpretation (time as a proxy for error kind); it does not bless the number, which was measured on our machines and not on a user's.\r\n- **Ripe when:** now — both checks are one sentence each at authoring time. · **Size:** procedure.\r\n\r\n### IR-118 — an instrument read mid-flight, or through a filter that cannot match, returns a COMPLETE-LOOKING wrong answer with no error\r\n\r\n- **Status:** OPEN, two instances one hour apart, 2026-09-12 (hertz); doyle asked for the filter line beside IR-117.\r\n- **Instance 1 — the capture read in flight, and it would have inverted the verdict.** `tcpdump -w /tmp/hz-cap.pcap` was still running when the packets were wanted. The file was **8192 bytes** live and **11933 bytes** after `kill -TERM` flushed it; the 3741-byte tail WAS the four SYN retransmissions. Reading the live file would have yielded a well-formed pcap showing one SYN and one prompt RST — i.e. the pre-registered outcome (b), the WRONG answer, assembled entirely from the RIGHT answer's own evidence, with no truncation error and a plausible packet count. The tell was available and nearly missed: a block-aligned size (8192) is a flush boundary, not a record.\r\n- **Instance 2 — the filter that cannot match, class instance 2.** Censusing Windows TCP settings, hertz piped `netsh int tcp show supplemental template=internet` through `Select-String -Pattern 'Template|Initial RTO|Max SYN|Retransmissions'`. It returned ONE line — the header — because none of those words appear in the table's rows (which read `Minimum RTO (msec)`, `Initial Congestion Window (MSS)`, …). Had it been trusted it would have reported \"no retransmission settings exposed\", which is the identical clean zero a CORRECT filter over an empty template returns. Recovered only by re-running the command raw.\r\n- **Mechanism.** In both cases the instrument succeeded, exited 0, and returned a well-formed artefact that under-reports its population — a partial buffer and a non-matching pattern are indistinguishable from a complete capture and an empty table. Neither failure can be detected from the artefact alone; both need a second read of a different kind. Kin: memory zero-match-filter-reads-as-absent, count-predicate-needs-its-own-positive-control, verdict-from-probe-competence, absence-needs-sibling-probe.\r\n- **Rule.** Terminate a `-w` capture and confirm the writer is gone BEFORE reading it, and quote the writer's own census (`N packets captured / N received by filter / 0 dropped by kernel`) beside the packet list; a block-aligned file size is evidence you are mid-flush. For any filtered dump, either carry a positive control the filter MUST match, or dump raw once and read the filter against the real field names — a filtered census that returns only its header has measured nothing.\r\n- **Ripe when:** now — both rules cost one extra command. · **Size:** procedure.\r\n\r\n### IR-119 — a control that only had to prove a ROUTE served a real directory; and a rig is not torn down until its last process is gone, whatever the analysis says\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 05:46Z (doyle) from hertz's unprompted self-disclosure. The security remedy is an OPERATOR item, filed on releases#304 comment **5643876746** (rotate the kitsubito self-hosted runner's registration credential); this entry carries only the reusable mechanisms.\r\n- **Instance.** The accepted-connection control for the W-2 packet capture was `python3 -m http.server 29472 --bind 0.0.0.0` with **cwd `/home/reavus`** — the self-hosted runner account's home — for **1 h 59 m 54 s**. The off-box bind was REQUIRED (the peer dialled from another machine); the working directory was the whole defect. An empty temp dir returns the identical HTTP 200 and proves exactly as much. `http.server` builds its index from `os.listdir` and filters nothing, so 20 dotfiles including the runner credential files were listed and fetchable; mode 0600 did not protect one of them, because the server ran AS that user. kitsubito's posture was separately verified as RSTing with **no** host filter (ufw inactive, nft input policy accept on both tables)…\n- **Mechanism.** A route control and a file server are the SAME COMMAND, so the cheapest way to answer \"can the peer reach this port\" silently publishes whatever directory the shell was sitting in, and the excess is invisible in the result — the 200 looks identical either way. Same family as a pattern-kill that matches its own ssh line: a tool doing more than the measurement asked for.\r\n- **Second mechanism, and it is why two hours passed rather than two minutes.** The author tore down the CAPTURE, named the outcome, and stopped — treating \"the verdict is named\" as \"the leg is finished\". **Naming an outcome is a milestone in the ANALYSIS, never in the RIG.** A rig is torn down when its last process is gone, and the artefact you are proud of is not the only thing you left running. Found only because a stale wake line replayed his own teardown list back to him two hours later.\r\n- **Rule.** (1) A control that proves a route binds an EMPTY throwaway directory, never a home, a repo or a working dir, and it goes down in the SAME breath as the capture it controls. (2) Every rig's teardown is a list of PROCESSES asserted gone against a live positive control, never a list of conclusions. (3) A teardown note written BEFORE a ruling does not license deleting the ruling's cited evidence: `/tmp/hz-cap.pcap` and `/tmp/hz-cap.log` were KEPT by ruling, twice, because they are the primary record of a posted verdict.\r\n- **Evidence quality worth copying.** The window was MEASURED (1 h 59 m 54 s), not estimated; the served-request record was complete (2 requests, both ours, `GET /`, no descent, no file fetch) and its LIMIT was stated rather than implied — a server log is evidence about requests SERVED, never about the network. An independent wire instrument (the pcap, 0 dropped by kernel) covered **4.4%** of the window, and that figure is the capture PROCESS LIFETIME: reading the 2.08 s packet span as the coverage would have understated the evidence 150-fold, because a running capture with no packets is still observing.\r\n- **Kin:** [[IR-116]] (assert the post-state, never an echo), [[IR-118]] (an instrument complete about what it measures and silent about the rest), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry.\r\n- **Ripe when:** now — both rules are one line each in any rig. · **Size:** procedure.\r\n\r\n### IR-120 — a claim named for the one axis nobody varied: six readings over two routes and two libraries, all on ONE box, reported as a property of the platform\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 05:47Z (doyle); the instance is liam's, refuted by hertz's own arm and conceded by its author.\r\n- **Instance.** The ~2.05 s Windows refused-connect latency was filed as \"the WINDOWS refusal latency\" on six readings that varied ROUTE (loopback, LAN hop to Linux) and LIBRARY (curl, .NET TcpClient) and held HOST constant — every one on HFENDULEAM. Route- and library-independence were measured; \"Windows\" was the name of the box. A per-host WFP callout, endpoint agent or filter driver swallowing RSTs would have produced exactly those six readings on exactly those two routes and generalised nothing. Settled only by going to get the missing axis: a second Windows box (Win10 19045 against the first's Win11 26200) read 2077.3 ms, inside 30 ms of the band. The claim survived; it was not ENTITLED to until then.\r\n- **The control the claim also lacked.** Nothing in the record distinguished \"Windows pays 2 s\" from \"TCP to a closed port costs 2 s\" or \"curl reports refusals slowly\" — because every reading was Windows, the word could not be earned from them, only assumed for want of an alternative. The Linux arm supplied it: closed port and open port within **66 microseconds** of each other on the same libraries, so the refusal costs ~0 there and cannot be told from an open port by latency at all. With that control \"Windows\" is measured; without it, it was a label.\r\n- **Mechanism.** Breadth along the axes you happened to vary reads as generality. The check is cheap and nobody runs it: write the claim's subject noun, ask which axis that noun names, then ask whether that axis was varied. Second instance from the same author in one night (a PowerShell-edition confound priced as the product's cost), and a sibling shape in the same leg: \"the box was quiet\" inferred from the absence of ANNOUNCED work, when silence is exactly what an unannounced three-minute recursive grep produces — quiet was never measured for that window either.\r\n- **Rule.** A claim names its population and its varied axes in the same sentence, and the axis in the claim's NOUN must be one of the varied ones. One host is a host, not a platform; one edition is an edition, not a cost. A quantity claimed as a property of a class carries a NEGATIVE CONTROL from outside that class, or it is a label. Corollary already ruled: a constant measured only on our boxes does not enter product code as a threshold — see [[IR-117]].\r\n- **Kin:** memory verified-members-are-not-an-enumerated-population, one-sample-is-not-a-negative, tool-claim-must-name-its-environment, absence-needs-sibling-probe, windows-client-refused-connect-costs-2s.\r\n- **Ripe when:** now — it is a sentence-shape check at authoring time. · **Size:** procedure.\r\n\r\n### IR-121 — one declaration command expands every right-hand side before assigning any name, so a dependent id silently binds the CALLER'S GLOBAL and two arms collapse onto one artifact path; and `cat -A` behind msys `sed` is not a byte reader\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 09:05Z. Instance 1 found by hertz in todlando's driver and confirmed by doyle; repaired as a separately pinned revision (v6 `dcfb732a…` → v7 `927eafb9…`) per the standing rule that a demonstrated execution incompatibility gets a new hash and renewed verification rather than an in-place accommodation. Instance 2 is todlando's own, found while reading the repair site.\r\n- **Instance 1 — the id that looked right.** `trial()` opened with `local arm=\"$1\" n=\"$2\" id=\"$arm-$n\"`. A single declaration command expands EVERY right-hand side before assigning any of its names, so `$arm` was still unset when `id` was built — but `$n` was **not** empty, because the caller is `for n in 1 2 3; do trial a \"$n\"; done` and `n` is a GLOBAL at that point. The id therefore read `-1`, not the empty-ish `-` that would have been noticed: a plausible, consistently-formed, wrong identity. Both arms produced `-1,-2,-3`, so every per-trial artifact keyed on id — captures, stop captures, census tags, portfields snapshots, cpu brackets — collided, and **Arm B overwrote Arm A in place** with nothing downstream able to tell them apart. `arm` itself was cor…\n- **The audit the one fix does not discharge.** A predicate was written over the whole delivered set — any `local`/`declare`/`typeset`/`export`/`readonly` whose later right-hand side references a name assigned earlier in the SAME command — with a positive control broken on purpose (plain `local`, `declare`, and the `${name}` brace form: 3 arms) and a negative control of the same declarations split (0 hits). v6 = 2 hits, both that one line; v7 = 0; v5 = the same single site. Stated over-report: the predicate does not split on `;`, so two correct statements on one physical line read as a dependency — the real site was confirmed not to be that shape. The PowerShell and Python helpers got their own predicates (zero multi-target assignments across four `.ps1`, pr…\n- **Instance 2 — the byte reader that was not one.** The repair site was first read with `sed -n '869,880p' file | cat -A`, which printed `$` at every line end — i.e. LF. The file is CRLF throughout (measured: 1117 CR = 1117 LF = 1117 CRLF). msys `sed` reads in text mode and drops the CRs, so `cat -A` faithfully rendered bytes that `sed` had already removed. The project's own rule (\"after any scripted edit, verify the BYTES\") was followed and still defeated, because the verification ran downstream of a text-mode filter.\r\n- **Third consequence of instance 1, and the worse half of it (hertz, measured independently; re-measured here).** The bad id does not only collide the arms — it begins with a DASH, so every artifact is named `-1.out`, `-2.err`, `-1.stop.out`. Measured in a throwaway dir: `sha256sum *.out` over such a population exits 1 with `unknown option -- 1` and hashes NOTHING (control: the same command over `a-1.out` alone exits 0 and hashes it); `grep -c x -1.out` exits 2 having measured nothing; `sha256sum ./*.out` is the repair. That is the LOUD form. The dangerous form is the one hertz's own detector took: it returned a clean EMPTY snapshot — \"0 artifacts altered\" — in the arm that was supposed to be red, because its glob handed the dashes to a tool that consumed t…\n- **Mechanism.** Both are a wrong answer with no error: a declaration whose dependency is satisfied by an unrelated variable that happens to exist, and a byte census whose bytes were filtered before they were counted. Neither is detectable from its own output — the id is well-formed, the `cat -A` dump is honest about what reached it.\r\n- **Fourth instance, in the very commit that recorded this entry (todlando, self-reported).** The amendment above was applied with a Python text-mode read (`open(p).read()`, universal newlines) and written back with `newline='\r\n'`. This register carried **two lone CR bytes** - `\r\n\r\n- **Instances 9-11` and `\r\n\r\n- **Addendum 2026-09-12 03:20Z` - present since at least `7cdcf5da`. Universal newlines translated each bare CR into a newline, so the commit silently rewrote two lines belonging to OTHER entries (net: 2 stray CRs removed, 2 blank lines added; markdown-harmless, still undeclared). Caught by reading the commit's own diff rather than trusting the insertion count: a one-bullet append that reports **5 insertions, 2 deletions** is telling you it touched something else. A text-mode read is a WRITE hazard, not only a measurement hazard - edit a file whose byte shape you have not measured in binary, and review the diff, never the intent.\r\n- **Rule.** (1) A declaration that depends on a name is its OWN statement; never share a `local` with the name it reads. (2) Derive an identity used as an artifact key ONLY after its parts are assigned, and guard it against its expected shape — a key that can go wrong silently overwrites evidence rather than failing. (3) A negative control for an id scheme must carry the caller's real variable environment: with the caller's global `n` absent, this defect reads as the harmless `-` and is easy to dismiss. (4) Read bytes with a byte reader — `python3` on the raw file, or `od`/`xxd` — never through msys `sed`, `grep`, or any text-mode filter; if a CR/LF count is the claim, count CR and LF bytes and state both.\r\n- **Kin:** [[IR-118]] (a complete-looking wrong answer from an instrument that succeeded), memory count-predicate-needs-its-own-positive-control, make-a-new-rig-red-on-purpose, scripted-edit-zero-match-refusal, render-not-read-pipefail, windows-firewall-census-clean-zeros.\r\n- **Ripe when:** now — (1) and (4) are habits, (2) is three lines in any rig. · **Size:** procedure.\r\n\r\n### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released\r\n\r\n- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**\r\n…\n","startLine":6338,"lineNumbers":[6338,null,6340,null,6365,6366,6367,6368,6369,6370,6371,6372,6373,6374,6375,6376,6377,6378,6379,6380,6381,6382,6383,6384,6385,6386,6387,6388,6389,6390,6391,6392,6393,6394,6395,6396,6397,6398,6399,6400,6401,6402,6403,6404,6405,6406,6407,6408,6409,6410,6411,6412,6413,6414,6415,6416,6417,6418,6419,6420,6421,6422,6423,6424,6425,6426,6427,6428,6429,6430,6431,6432,6433,6434,6435,6436,6437,6438,6439,6440,6441,6442,6443,6444,6445,6446,6447,6448,6449,6450,6451,6452,6453,6454,6455,6456,6457,6458,6459,6460,6461,6462,6463,6464,6465,6466,6467,6468,6469,6470,6471,6472,6473,6474,6475,6476,6477,6478,6479,6480,6481,6482,6483,6484,6485,6486,6487,6488,6489,6490,6491,6492,6493,6494,6495,6496,6497,6498,6499,6500,6501,6502,6503,6504,6505,6506,6507,6508,6509,6510,6511,6512,6513,6514,6515,6516,6517,6518,6519,6520,6521,6522,6523,6524,6525,6526,6527,6528,6529,6530,6531,6532,6533,6534,6535,6536,6537,6538,6539,6540,6541,6542,6543,6544,6545,6546,6547,6548,6549,6550,6551,6552,6553,6554,6555,6556,6557,6558,6559,6560,6561,6562,6563,6564,6565,6566,6567,6568,6569,6570,6571,6572,6573,6574,6575,6576,6577,6578,6579,6580,6581,6582,6583,6584,6585,6586,6587,6588,6589,6590,6591,6592,6593,6594,6595,6596,6597,6598,6599,6600,6601,6602,6603,6604,6605,6606,6607,6608,6609,6610,6611,6612,6613,6614,6615,6616,6617,6618,6619,6620,6621,6622,6623,6624,6625,6626,6627,6628,6629,6630,6631,6632,6633,6634,6635,6636,6637,6638,6639,6640,6641,6642,6643,6644,6645,6646,6647,6648,6649,6650,6651,6652,6653,6654,6655,6656,6657,6658,6659,6660,6661,6662,6663,6664,6665,6666,6667,6668,6669,6670,6671,6672,6673,6674,6675,6676,6677,6678,6679,6680,6681,6682,6683,6684,6685,6686,6687,6688,6689,6690,6691,6692,6693,6694,6695,6696,6697,6698,6699,6700,6701,6702,6703,6704,6705,6706,6707,6708,6709,6710,6711,6712,6713,6714,6715,6716,6717,6718,6719,6720,6721,6722,6723,6724,6725,6726,6727,6728,6729,6730,6731,6732,6733,6734,6735,6736,6737,6738,6739,6740,6741,6742,6743,6744,6745,6746,6747,6748,6749,6750,6751,6752,6753,6754,6755,6756,6757,6758,6759,6760,6761,6762,6763,6764,6765,6766,6767,6768,6769,6770,6771,null,6781]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"middle","truncatedBy":"middle","totalLines":413,"totalBytes":59855,"outputLines":276,"outputBytes":40295,"maxBytes":40960,"headRange":{"start":1,"end":208},"tailRange":{"start":347,"end":413},"elidedLines":138,"elidedBytes":19582,"artifactId":"733","nextOffset":6772},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789483669340}}
{"type":"message","id":"e10fbab6","parentId":"f2a6601b","timestamp":"2026-09-15T14:47:49.347Z","message":{"role":"toolResult","toolCallId":"call_fKsgbmNm0t8sArrjynyjUTCz|fc_000c7cef03cac861016aa95a95283487d18c59a8cf5696216b","toolName":"read","content":[{"type":"text","text":"### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released\n\n- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**\n- **The refusal.** `DAEMON_STOP_REFUSED: a broker-stopping command is never run by an spt endpoint ($OWL_SESSION_ID is set). ... No flag overrides this, --force included.` The guard keys on the CALLER'S SESSION ENV, so it fires identically no matter which rig step reaches it and no matter what `SPT_HOME` the command targets.\n- **Not a new fault, and not an accident.** `readiness-r4-as-read.md:107-109` already states it: v9 DELIBERATELY leaves `OWL_SESSION_ID` set, the refusal is expected to recur, and it is \"reported, never worked around silently.\" The rig chooses a loud known refusal over an unproven workaround — that choice is right, and it is the reason this entry is about the leftover, not about the refusal.\n- **What it actually costs.** Cleanup completes with `steps_failed=1` and the isolated daemon SURVIVES. Measured in instance 2: supervisor `daemon run --detached` and its child `daemon brain --generation 0 --start-reason cold`, born 331 ms apart, both executing `/target/release/spt.exe`. They hold the SUBJECT exe open inside a pool `pool_release` has already returned, so the next build into that pool can fail on a locked `spt.exe` — a red belonging to neither lane. See memory [[live-agents-lock-target-debug-spt-exe]], [[shared-target-two-live-trees]].\n- **The counterfactual the refusal does NOT license (doyle, correcting hertz in this instance).** That the guard refused does not prove the isolated-target command *would have* stopped the resident broker. The guard reads the env, not the routing; establishing what the command would have reached needs routing evidence nobody has gathered. State the refusal, never the averted disaster.\n- **Disposal, and it is the same four-field procedure both times** (`readiness-r4-as-read.md:110-118`): identify on pid, `CreationDate`, exact `ExecutablePath` and `CommandLine` — a bare pid match is unsound because pid reuse on this box is measured, see [[pid-reuse-across-reboot]]. The supervisor must still equal `/daemon.pid`, and the brain's parent must be that supervisor. Then a fresh authorization NAMING THE NEW PIDS (the prior one is pid-specific and spent), supervisor first so the brain cannot respawn, `Stop-Process -Id` alone — never a tree kill, an image-name kill, or any action against the resident node daemon, which is a DIFFERENT binary under `AppData\\Local\\spt-core\\bin\\`. Post-state ASSERTED, not announced, or it is [[watchdog-reports-a-kill-it-never-made]].\n- **Mechanism.** A cleanup step that is structurally unrunnable in the environment the rig always runs in. It cannot be fixed by retrying, it never fails loudly enough to block the run, and its residue lands in a shared build pool rather than in the run's own directory — so the cost is paid by whoever builds next, not by the run that caused it.\n- **Rule (scoped by doyle 2026-09-12 — a bare pid-file kill is NOT approved as sufficient).** A rig that starts a daemon owns stopping it by a route that works from the rig's own environment, and `/daemon.pid` is the pid SOURCE, never the authorization. Any rig cleanup that terminates a process must, at the moment of acting: re-read creation time, exact `ExecutablePath`, `CommandLine` and isolated-home association FRESH; confirm the supervisor still equals the pid file and the brain's parent is that supervisor; stop SUPERVISOR-FIRST so no child respawns; and report failure EXPLICITLY rather than escalating scope. Any mismatch or unreadable identity STOPS the action. No PID-only automation and no product-guard bypass is approved. A cleanup step whose failure leaves state in a SHARED resource reports that residue as an identity the next consumer can act on — pid, path, command line — not merely as a failed step.\n- **Kin:** [[IR-42]] (pool enforcement speaks at the next build, not at claim time), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry, e2e-leaked-daemons-shared-box, no-machinewide-killon-shared-runner.\n- **Ripe when:** before the next field run. NOT a one-line change: the stop route is small, but the identity re-verification, supervisor-first ordering and explicit failure reporting above are part of the fix and are what make it safe. · **Size:** small.\n\n### IR-123 — a helper that LOGS cannot also RETURN through stdout: `record` tees, so `face=$(face_report ...)` captures the log block and the acceptance gate can never pass\n\n- **Status:** OPEN, mechanism recorded 2026-09-13 (hertz, found by exercising the D2 successor; confirmed by doyle from a direct source read of frozen r10). **Frozen r10 is PRESERVED as-is**; the return channel is corrected in its successor only.\n- **Instance.** `record()` is `echo \"$1\" | tee -a \"$R/findings.txt\"` — it writes to the log AND to stdout, deliberately, so a live operator sees the run. `face_report()` calls `record` twice (a FACE_COUNTS line and a FACE= line) and then `echo`es the face as its return value. The single caller reads it as `setup_face=$(face_report \"$SETUP_OUT\" \"$SETUP_ERR\" \"SETUP\" bootstrap)`, so the captured value is **the whole tee'd log block with the face appended**, and `[ \"$setup_face\" != reconciled ]` is true no matter what the product printed. The Arm-B acceptance gate — rc 0 AND face reconciled AND pair written, all three required — is therefore **unpassable on the ACCEPTED path**.\n- **Why no rig run caught it.** The stub cases that reached this line were REFUSALS, whose expected outcome is exactly the branch the defect forces (exit 3, Arm B held). A gate that always refuses looks identical to a gate that correctly refused a refusal. The accepted path had no arm at all until the D2 successor's control ran one with `LAN_FIREWALL_RECONCILED`, exit 0 and a pair measured present — see memory `setup-suppresses-failing-arm`.\n- **The same shape, twice more, in the successor's own new code** (both caught by the same control, both mine): `D2_T1_VALID=$(d2_validate_at t1)` captured the validator's tee'd log ahead of its verdict; and `local point=\"$1\" doc=\"$R/d2-$point.json\"` rebuilt [[IR-121]]'s declaration-ordering defect, so three documents present on disk all read `NO_DOCUMENT`. The precedent for the fix was already in the same file: r10's own `handoff_request` comment records that `spec=$(handoff_request ...)` was broken by exactly this tee and was repaired by setting parent globals and returning nothing on stdout.\n- **Scope of what this does and does not invalidate (doyle).** It does NOT invalidate r10's observed product refusal: the named rule reported `[5, 20]` and positive reconciliation was independently absent. It DOES invalidate any claim that the frozen rig could have admitted a successful setup — that path was never reachable.\n- **Mechanism.** A dual-purpose channel: the same stream carries human-readable logging and a machine-read value, so any helper that logs before returning hands its caller both. It fails silently and in the direction that looks conservative (a gate that refuses), which is why it survives review and why refusal-only exercises confirm it.\n- **Rule.** A function that calls `record` (or any logger that writes to stdout) **returns nothing on stdout**: it sets a named global, or writes its value to a file the caller reads. Every acceptance gate is exercised on BOTH paths — an accepting arm with real positive evidence and a refusing arm — because an acceptance test alone cannot distinguish a working gate from one that accepts everything, and a refusal test alone cannot distinguish a working gate from one that refuses everything.\n- **Kin:** [[IR-121]] (a wrong value with no error, same file), [[IR-118]], memory setup-suppresses-failing-arm, make-a-new-rig-red-on-purpose, every-return-arm-is-a-copy, zero-match-filter-reads-as-absent.\n- **Ripe when:** now — the successor already carries the fix at its call sites and in its own helper; the register entry is the part that outlives this lane. · **Size:** procedure.\n\n### IR-124 — a cleanup that runs `serve lan --stop` UNCONDITIONALLY creates the daemon it exists to remove, when the setup it is cleaning up after never ran\n\n- **Status:** OPEN, measured once in the field. D2 field run `20260913T041410Z`, driver `2e3aec1b`, recorded by hertz 2026-09-13 at doyle's direction. Archive `.spt/preserved/hertz-fp-driver-review/d2/field-run-20260913T041410Z/` (72 files, manifest `defa5d29…`). **This is a RIG defect. It is mine — I wrote the driver — and doyle's admission review missed the unconditional stop path as well; both are recorded because a review that misses a path is part of the mechanism, not an aside.**\n- **Instance.** The elevated setup was **DECLINED and NOT STARTED** by liam at 04:18:55Z — measured, unambiguous, and the right call: his leg was ready at 04:18:35Z against a hard 04:19:10Z expiry and he refused rather than race the teardown. Nothing ran, nothing mutated. The driver then entered cleanup and executed its own unconditional `env SPT_INSTALL_NO_FIREWALL=1 SPT_HOME= serve lan --stop`, which dispatched through the daemon (`ensure_running`, `serveverb.rs:191`) and **CREATED** a supervisor (`daemon run --detached`, Windows PID 45944, `04:19:18.0312050Z`) and a brain (`daemon brain --generation 0 --start-reason cold`, PID 22524, `04:19:19.7696380Z`, parent 45944). `fp-home-d2`, measured ABSENT at the 04:13:58Z at-launch recheck, existed with `daemon.pid`, `brain.ready` and a full tree by 04:19:18Z.\n- **Why the hold could not stop it.** doyle held the elevated teardown for exactly this reason and liam held all commands. But this stop is **internal to the running driver**, not a handoff, so no authorization gate reached it: the only levers were killing the driver or editing a running script, and both are forbidden. **A guard that only governs dispatched work does not govern a step the subject performs itself.**\n- **The pre-dispatch markers named the mechanism and did not prevent it.** `daemon_may_run — serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running` was set BEFORE the setup was requested. The driver correctly refused to infer absence from its own expectation — and then triggered the very mechanism the marker warned about, from the cleanup path, on the branch where the warning did not apply.\n- **Three things kept apart, because collapsing any two misstates the run.** (1) Liam's testimony: NOT_STARTED, no mutation — still true, he created none of it. (2) The driver's conservative verdict: `CLEANUP=PENDING`, `residual_state=UNREADABLE`, `residue=UNMEASURED` — an honest refusal to claim clean, not a contradiction of liam. (3) An **actually observed** residual, created by the driver itself. That third thing is a measurement; the first two are testimony and abstention.\n- **Mechanism.** A teardown verb that is also a *start* verb. `serve lan --stop` must reach the daemon to ask it to stop, so invoking it when no daemon exists starts one. Cleanup paths are written for the case where setup succeeded, and are reached on every path including the ones where setup never happened; the branch nobody exercises is the branch where cleanup has nothing to clean.\n- **Rule.** A cleanup step whose command can CREATE the resource it removes must be **conditional on evidence that the resource exists** — not on the state markers, which say \"may exist\" by design, and not on the fact that cleanup was entered. Where the existence check is itself unavailable, the step is SKIPPED and reported as skipped, because an unnecessary teardown that spawns is strictly worse than a labelled gap. Exercise every cleanup path from the **setup-never-ran** state, not only from the setup-succeeded state.\n- **Kin:** [[IR-122]] (the other half: the stop that *cannot* run leaves a daemon; this is the stop that *should not* run and makes one), memory setup-suppresses-failing-arm, gate-against-documented-design, remedy-must-run-from-refusal-state.\n- **Ripe when:** before any repeat field run — a repeat under this driver reproduces the residue. · **Size:** small.\n\n### IR-125 — the driver's own executable sweep reported ZERO processes on the pinned exe while `Win32_Process` showed TWO, at the same instant\n\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). **A FALSE-NEGATIVE SWEEP, not a false CLEAR** (doyle's classification, and the distinction is load-bearing): the ledger's actual verdict was `residual_state=UNREADABLE` / `CLEANUP=PENDING`, which was correct, and the sweep line is explicitly labelled evidence-only in the driver's own output.\n- **Instance.** `SUBJECT_EXE_PROBE=OK running_the_pinned_executable=0 enum_total=618` — the probe enumerated 618 processes and concluded none was running the pinned executable. A `Win32_Process` read moments later returned **two**, both with `ExecutablePath` exactly `…\\.worktrees\\304-w2-repr\\target\\release\\spt.exe`: PIDs 45944 and 22524. An independent sweep by path, not by pid, agreed: `count=2`.\n- **Why it matters despite being labelled evidence-only.** The line reads as a clean box to anyone skimming, and it is the only line in the run that speaks to \"is anything of ours still running\" in plain terms. It was contradicted only because a native read was performed for a different reason. Had the ledger's verdict logic depended on it, this is a false CLEAR.\n- **Candidate cause, NOT diagnosed** (deferred by doyle until cleanup was complete, and still open): the probe's raw path comparison. The Win32 `ExecutablePath` is backslashed Windows form; the driver's pinned `$EXE` is forward-slashed msys-friendly form. A literal comparison between those two spellings of the same file fails for every process. **Unconfirmed** — it is a candidate because it fits, not because it has been measured.\n- **Mechanism.** A predicate that can only ever return \"no\" reports a clean zero over a large, healthy-looking enumeration. `enum_total=618` is what makes it convincing: the instrument demonstrably ran and demonstrably saw the machine, and still could not see the thing it was looking for. Same family as the two other instrument-versus-reality mismatches in this lane, and all three were invisible to stubs.\n- **Rule.** A sweep that reports zero carries its own **positive control** — in the same run, the same predicate must find something known present, or the zero is UNMEASURED rather than absent. Where a predicate compares paths across the msys/Windows boundary, normalise both sides and prove the normalisation on a known-matching pair; never compare two spellings of a path and call a non-match an absence.\n- **Kin:** memory count-predicate-needs-its-own-positive-control, zero-match-filter-reads-as-absent, windows-firewall-census-clean-zeros, verdict-from-probe-competence, [[IR-118]].\n- **Ripe when:** with IR-124, before a repeat field run. · **Size:** small.\n\n### IR-126 — the experimental budget CONTAINED its own read-only preflight, leaving 128 s of a 300 s window for the elevated leg, and the leg was correctly declined\n\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). Boundary NOT moved for that run — doyle refused the change mid-flight and was right to; this entry is the scheduling review he asked to be preserved.\n- **Measured, from the run's own timestamps.** Run start `04:14:10Z` · pre-setup absence census `04:16:23Z` · handoff request written `04:17:02Z`. So **172 s of the 300 s experimental budget went to in-budget read-only preflight** — CI axis queried by name across five statuses, ancestry census, six-instrument hashing, subject identity, 5470 guard baseline, pre-setup absence census — and the driver printed the remainder itself: `HANDOFF_WAIT bounded to 128s`.\n- **The consequence, and it is not hypothetical.** Liam's leg script was ready at `04:18:35Z`. Setup alone had measured ~9 s, plus four PowerShell stamps, plus a t1 capture of unmeasured duration, against 35 s of remaining clock. He DECLINED without mutation, which was the correct call and the one the instruction asked for. **The window was consumed before the work it existed for could start.**\n- **Two overruns recorded beside it, as observations and not as permissions.** Experimental activity ended at **306 s of the 300 s budget** (the deadline exits through the EXIT trap, so cleanup is never skipped, but the boundary was crossed). The driver was still running after its 180 s cleanup reporting bound had elapsed; it exited by `04:23:54Z`. Neither overrun was authorised, taken as an extension, or used to do more work.\n- **Mechanism.** A budget defined from process start, over a phase order that puts every read-only admission check inside it, gives the elevated leg whatever is left rather than what it needs. The preflight cost is not waste — those checks are why the run was admissible — but charging them to the same clock makes the window's usable size an accident of how slow the host's firewall enumeration is that minute.\n- **Rule.** Bound the ELEVATED LEG on its own clock, sized from its measured duration, and start it when the leg is dispatched. Admission checks get a separate bound. A driver that cannot guarantee a usable handoff window should REFUSE TO DISPATCH rather than dispatch a leg that cannot finish — an operator declining at the deadline is the correct outcome of a wrong window, not a failure of the operator.\n- **Kin:** [[IR-122]], memory your-cadence-can-be-the-blocker, reap-step-duration-is-not-the-window, twohost-run-window-discipline.\n- **Ripe when:** with IR-124 — a repeat field run under the current budget shape reproduces the squeeze. · **Size:** small.\n\n### IR-127 — a nested value-type assignment can leave the native job limit unset while the instrument logs the requested flag and a successful setter\n\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\n- **Instance.** The containment probe assigned `$info.BasicLimitInformation.LimitFlags = 0x2000`, logged the requested KILL_ON_JOB_CLOSE flag and `SetInformationJobObject=True`, read both owned processes as job members, closed the handle, and found both still alive. The nested field is a struct: PowerShell changed a copy, not the value subsequently marshalled. The offline discriminator measured `nested_assignment_flags=0`; modifying the nested value and assigning the whole value back measured `whole_value_assignment_flags=8192`.\n- **Correction and evidence.** The corrected probe assigns the whole nested value, calls `QueryInformationJobObject`, and refuses unless the kernel's flags equal the requested flags. Readback `0x2000` then preceded both members being measured GONE after close. Initial invalid arm and corrected measurement are preserved separately under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/` (`M3/` and `instrument-repair-20260913T104354Z/M3/`); the latter's `results.txt` carries the offline discriminator.\n- **Rule.** Mutating a nested interop value requires assigning that value back to its owner. Successful native setters establish only that the submitted value was accepted: read the effective configuration back and compare it before granting the operation authority. Requested flags are not observed flags.\n- **Kin:** [[IR-116]] (a successful call is not a post-state), [[IR-118]] (a complete-looking wrong answer).\n- **Ripe when:** any PowerShell/native configuration probe is authored or changed. **Size:** whole-value assignment plus checked native readback; retain the positive and negative discriminator.\n\n[…47ln elided…]\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\n\n### IR-133 — a live capture cannot be read with read-only sharing, and daemon stderr belongs to the owned home\n\n- **Status:** Corrected in the r9 rig instrument; genuine fifth-window promotion completed with exit **0**, owned shutdown and final provenance. The subsequent field attempt failed its separate setup-handoff deadline, not this promotion read. Fourth #297 preparation measured by hertz on 2026-09-14; sharing failure localized by doyle in `R2VK8FQN`, run-identity binding ruled in `ANR522S5`, successor accepted in `GV3R6QUV`.\n- **Instance.** Fourteen admission leaves and genuine staging passed. The candidate applied daemonlessly, transitioned `applied-pending` → `applied`, brought up broker **14704** and brain **45220**, published the pinned generation-zero readiness record and emitted `BRAIN_PROMOTED` before the instrument stopped its owned job. The instrument returned only `OWNED_PROMOTION_READINESS_FAILED`. Six provisioning/promotion native jobs ended `CONFIRMED_GONE`, active counts zero; all nineteen signing-private files were absent. No field, GO or D3 occurred. Original receipt: `.spt/preserved/hertz-fp-driver-review/d2/W8TQ3MZC-FINAL-REFUSAL.json`.\n- **Mechanism.** The loop used `File.ReadAllText` on a capture held open for **Write**, with **Read** sharing, by the run-scoped launcher. Windows checks sharing in both directions: the new reader's default **Read** sharing excludes the existing writer, causing `IOException`, `0x80070020`. A completed step hid this defect because its writer had already closed. Changing only the writer's sharing does not repair the reader.\n- **Wrong source behind the exception.** The launcher's stderr capture was zero bytes; the daemon redirects stderr to `SPT_HOME/logs/daemon.stderr.log`. Reading the empty capture with compatible sharing would merely reach the later marker timeout. Read the actual owned-home log with `FileStream(Open, Read, FileShare.ReadWrite | FileShare.Delete)`, matching the existing native launcher's `ReadText` pattern; release each read handle before the next poll.\n- **Run binding.** A promotion marker counts only after the exact brain header naming the measured membership PID and readiness generation, and before another process header. Markers before that header, without it, or under another PID/generation refuse. A rolled `.1` can contribute only when absent before this owned launch and appearing during it, with the same header binding; preexisting backups cannot prove this run.\n- **Failure evidence.** Attach the instrument's constant assertion name and call-site line to its exception. Before cleanup can replace the active error, retain that name, source line, exception type and HResult. Non-assert exceptions have a null assertion name. Never serialize exception messages or environment values.\n- **Qualification.** Thirteen controls passed against `provision-promote-R2VK8FQN.ps1`: a live-held writer reproduces `0x80070020` with `ReadAllText`, the shared reader returns its exact bytes while the writer remains open, header/PID/generation/ordering and rolled-history boundaries refuse stale evidence, the actual rollback guard still refuses, and diagnostics omit a message canary. Proof: `R2VK8FQN-live-held-controls/result.json` beneath the receipt directory. No product invocations, rig mutations or fleet terminations.\n- **Live verification.** `provision-R2VK8FQN/promotion-complete.json` records `PROMOTION_COMPLETE`; the supervised promotion exited **0** after **12.9 s**. The real candidate passed the shared-log, PID/generation marker, final membership, durable-state and owned-shutdown checks. Its later field ledger remains a separate failed observation contract; successful provisioning does not turn that ledger green.\n- **Kin:** [[IR-132]] (instrument census refusal), [[IR-130]] and [[IR-131]] (phase labels lose the failing predicate). **Ripe when:** polling any live writer or accepting logs as run-specific evidence.\n\n### IR-134 — request latency consumes the elevated capture's execution budget, then a late terminal receipt leaves completed work unmeasured\n\n- **Status:** Instrument correction qualified without a sixth field window. Doyle accepted the execution-clock repair in principle under `HHDKCRH5`, then identified its still-insufficient receipt budget; the derived-window successor follows ruling `P9RLK4VU` and accepted arithmetic `KZG4IN37`. Candidate/packet/nonce/driver/runner repinning remains one future amendment, separate from field authorization. Fifth #297 field run `20260914T063552Z` remains failed and immutable. Its candidate's independent **PRODUCT RED** finding (`M5XKQ2DN`) is unchanged.\n- **Measured sequence.** Setup request `06:41:26Z`, elevated setup `06:43:18Z`–`06:43:24Z`, refused capture launcher `06:43:25Z`–`06:43:26Z`, receipt about `06:43:27Z`. The driver had written the capture deadline from request time: 112 seconds of handoff delay left the launcher's `deadline - now - 5` allocation at **−4 seconds**. No native t1 capture ran. The handoff expired before the receipt; cleanup reread its nonce and exit but retained the earlier `timestamp_order=UNMEASURED`, withholding mutation despite subsequently available terminal stamps.\n- **Clock correction.** The executor initializes `setup-start.utc`, `elevated-leg-start.epoch` and `d2-t1.deadline` immediately before `run_exactly`, from one UTC observation, with **CreateNew** writes. The independent allocation is **120 seconds**: the existing 90-second capture ceiling, 9 measured seconds around a refused capture, 5-second termination reserve and 16-second margin. Nine seconds is not a measurement of a successful capture. PREPARE initializes nothing; notification latency consumes only the separately bounded handoff. No preparation or activity window is reset or extended.\n- **Terminal evidence correction.** On handoff expiry, cleanup makes one final nonce/exit observation and, if terminal, rereads the six stamps before deciding whether completion is proven. A late observation preserves `handoff_wait=EXPIRED` and the original timeout exit separately from `setup_terminal_exit`; it never resumes activity or treats lateness as timely acceptance. Missing, duplicate or wrong nonce evidence and missing or reversed stamps remain unproven. An exceeded leg clock refuses the capture contract independently of terminal completion.\n- **No-field proof.** `.spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/` preserves the actual extracted predecessor/successor predicates, emitted PowerShell initializer, nine receipt/product controls, five clock/ledger controls and clock results. The predecessor retained UNMEASURED after receipt publication; the successor recovered ordered completion without overwriting timeout. The actual initializer refused a second initialization without changing any clock bytes. With the measured 112-second notification delay and capture at leg-start +7, the old allocation is −4 seconds and the new allocation is 90 seconds. No product, firewall, signing or field operation was invoked.\n- **The outer-clock blocker, not fixed by the inner clock.** A receipt follows execution: **112 + 120 = 232 seconds** cannot fit the retained 120-second setup handoff. Keeping a 300-second activity window and refusing every GO would be a correct refusal of the wrong shape, not an executable field design. `P9RLK4VU` therefore re-derives future activity as **630 seconds**: pre-dispatch **74** (54 observed +20 margin), setup handoff **240** (112 latency +120 leg +8 margin), post-receipt probes **200**, t2 **100**, final transition **16**. Only setup supersedes the prior 120-second handoff cap; other handoffs retain it.\n- **Measured basis and explicit allowance.** The fifth timeline records portfields calls at up to **45 seconds**, census **46 seconds**, and t3 **25 seconds**; the earlier `20260913T041410Z` capture also took 25 seconds. Two analogous portfields calls plus census give **136 seconds**; another **64 seconds** is a labelled allowance for identity capture, D1 and bookkeeping, not a claimed complete post-receipt measurement. T2 receives a **90-second native ceiling**, **5-second launcher reporting reserve** and **5-second shell/reporting margin**. The post-receipt probe deadline cannot spend t2's allocation; t2 cannot spend the final transition reserve.\n- **Derived-window controls.** `P9RLK4VU-controls/result.json` records **16 passing controls**, executing extracted real Bash predicates and the wait loop against a virtual wall clock. The complete 630-second window and the measured 54-second pre-dispatch cost pass; 555 seconds remaining fails against the 556-second dispatch requirement, while 556 fits. The actual gate refuses before GO/mutation markers. A receipt after 112-second latency plus 120-second execution fits the new setup allowance; PREPARE and cleanup retain their 120-second caps. Published request and phase deadlines still truncate waits. Preparation remains **600 seconds** and cleanup remains **180 seconds including its 30-second ledger reserve**; an observation deadline cannot override cleanup. No product or field operation was executed.\n- **Separate product finding.** Candidate `b8482445` logged one `verify-query` completed at **2650 ms**, followed by a second pre-write snapshot killed at **3027 ms** under its **3000 ms** budget; no reconcile-write ran. The budget **starts before spawn and includes output collection** (`run_ps_inner`, source timing supplied by doyle in `IRXYIJHS`); spawn is not outside this clock. The successor ledger records this query kill separately from handoff/capture failure. Fifth-window cleanup was subsequently closed on existing measurements as **NOTHING_TO_REMOVE**; its original PENDING ledger was not rewritten.\n- **Kin:** [[IR-126]] (execution receives leftover scheduling time), [[IR-124]] (cleanup must not race unproven setup). **Rule:** measure execution from execution, preserve timeout and late completion as separate facts, and do not let an instrumentation repair erase a product failure.\n\n### IR-135 — checker pin and runner installation can disagree, and the repair path disguises that version mismatch as an authentication failure\n\n- **Status:** CI precheck remedy implemented in the IR-135 lane; workflow execution awaits integration. Measured by doyle in S4 golden `34946493637`, 2026-09-15; filed by hertz from `3HHHPWCR`. The immediate box mismatch was repaired by hand-install.\n- **Instance and mechanism.** The #304 candidate carried `71caedd4`, setting `WANT=0.4.1` in `golden.yml`/`ci.yml`, while kitsubito's `~/.local/bin/traceable-reqs` was **0.2.0**. The install step's mismatch path attempted a private clone without a provisioned `TRACEABLE_REQS_TOKEN` and exited **128 before any check**. The visible failure named authentication, not the wanted and installed versions. A checked-in pin is not evidence that the runner can supply it; the fallback requires a second, independently missing prerequisite.\n- **Implemented remedy (QD54OM7S).** Both workflows run an explicit pin/runner precheck and use `.github/ci/traceable-reqs.sh` as the single pin/install owner. It reports the actual version and native version exit; matching requires literal equality and exit zero. A mismatch without `TRACEABLE_REQS_TOKEN` refuses before clone/build, naming the version disagreement and missing credential separately. With a token present, source repair remains available and native clone failure is preserved; token presence never claims access. The installed version is checked before coverage. On kitsubito, eight isolated shell controls passed: matching precheck/install without a token, stale/missing/failing/lookalike versions refused, authenticated repair admission, and clone exit128 retained. The predecessor failed the stale/no-token discriminator with128; the successor refused with1 and both diagnostics. A separate smoke used kitsubito's real0.4.1 binary through both entry points without a token, exit0. No live credential was provisioned or private-source build exercised. Contract and reproduction command: `docs/TRACEABILITY.md` §CI checker admission and installation. PAT provisioning remains the operator's decision, banked since2026-07-30.\n- **Kin:** [[IR-104]] (the checker version changes what counts as evidence), [[IR-109]] (the #304 pin is already live). **Ripe when:** the next checker pin or golden-intake/install-step change. **Size:** a version diagnostic and intake assertion; credential provisioning is separate operator work.\n\n### IR-136 — a broker bound under the seed socket's name is not seed control, so a URL-minting rig can omit the very listener contract the product queries\n\n- **Status:** Instance fixed in S5 **`ddd7fc7f070667524578c282894dd44a2e36062f`**, test-only atop S4; S5 golden34957614641 passed, including both twohost roles. Shared fixture-composition remedy implemented and Linux-verified in the IR-136 lane. Origin: doyle's S4 golden `34946493637` twohost helper red, 2026-09-15.\n- **Mechanism.** Role B hosted broker IPC under an invented name, with neither `seedmap::serve_seed_control` nor a docs listener. `REQ-WEB-URL-BOUND-PORT` requires `serve_for` to ask the canonical seed-control plane for `DocsStatus` before publishing a URL; the missing plane returned `DOCS_PORT_DISCOVERY_FAILED: Connection refused (os error 111)`. Merely renaming a Broker to `seed_socket_name()` does not provide that protocol: `serve_request` is dispatched by seed control, not Broker. The docs-server fixture had already encountered the same trap. The last green twohost run predated this bound-port contract.\n- **Discriminator and scope.** Todlando's unchanged-S4 Linux fixture failed at the exact discovery seam without seed control/listener (**native 101**) and returned `Registered` at the actual bound port **33319** when those fixtures were added (**native 0**); both arms retained the invented B broker name. Evidence: `.spt/preserved/304-web-helper-rca/linux/`. S5 gives B distinct canonical broker/seed sockets, real seed control, a broker-backed ephemeral docs listener, and a discovered-port equality precondition. Helper expectations stay unchanged. A's helper cell relays B's returned URL and does not query its own DocsStatus; its existing broker-on-seed-name path is not this failure. The seven unopted-in Windows passes do not exercise the role-gated twohost bodies.\n\n- **Shared remedy (P2Y2GWUP).** `crates/spt-daemon/tests/support/serving.rs` provides `ServingFixture`, included by both `docs_server_e2e` and `twohost_web` rather than exported as product surface. `start` composes the distinct canonical broker and real seed control, waits for seed readiness, binds broker-backed docs on port0, and asserts that seed-control `DocsStatus` returns that actual port. The caller supplies its private home, journal and optional NetHost; socket spelling is no longer a caller choice. `stop` stops and joins both IPC accept loops. The docs listener remains process-lifetime under the existing production interface, so tests require process-per-test isolation and one broker-backed listener per process.\n- **Negative-state coverage retained.** The docs fixture uses the separate `control` stage only to distinguish absent control (offline fallback permitted) from running control without a listener (fallback refused); its normal serving case uses the same complete constructor as role B. Role A's seed-named proxy Broker and the standalone docs-less listener remain intentionally separate: neither is the owner's URL-minting control plane. No default/configured port substitutes for discovery, and no production protocol changes.\n- **Shared-fixture proof (2026-09-15).** Kitsubito, private tree/target, jobs2: targeted clippy with `-D warnings` **0**; nextest, both migrated binaries, one test thread and zero retries **0**. All **3 docs cases** exercised their real bodies: absent-vs-unbound discovery, HTTP published-surface/security checks through the complete fixture, and the standalone docs-less pointer. The other **7 twohost cases** returned through their unopted role gate; these are compile coverage, not a new cross-host execution claim. Traceable0.4.1: **920complete/0findings**. Raw exits/output/hashes: `.spt/preserved/hertz-ir136-fixture/linux-v2/`; the initial wrapper PATH failure started no cargo and is preserved separately.\n- **Ripe when:** another URL-producing fixture is added. Use the shared complete constructor rather than rebuilding its three planes independently; use the partial stage only when missing-listener behavior is the test subject.\n\n### IR-137 — a redirected Start-Process child can share the tool call's console lifetime and die when that call returns\n\n- **Status:** RETIRED, 2026-09-15, doyle ruling `YPLFG3CG`: **no tracked callsite; discipline recorded + receipt**. This closes a Windows ad-hoc rig-craft item, not a CI or candidate defect; no helper or product change.\n- **Mechanism and rule.** `Start-Process` with redirected output from a PowerShell tool call was observed to end with **`STATUS_CONTROL_C_EXIT`** when the tool call ended: a returned child PID did not establish detachment. The reported detached form uses a **hidden window without redirects**. Where a child must outlive the call, qualify its survival after the caller returns and give it a durable output path of its own; do not treat process creation or a hidden window alone as lifetime evidence.\n- **Origin clarified (YPLFG3CG).** Claude Code PowerShell tool host, 2026-09-15T07:17Z, #304 S3 Windows attempt-2 launch A: redirected `Start-Process pwsh` PID47560; `rustc` exited `0xc000013a` seconds after the tool returned, driver receipt contained only its start line and no refusal file. The same driver relaunched with `-WindowStyle Hidden -PassThru` and no redirects (PID37536) ran25minutes to exit0. There is no tracked failing launcher to repair; the existing tracked g6 launcher already uses the reported good shape.\n- **Discipline and receipt.** [Windows ad-hoc rig launch discipline](GOLDEN-CI.md#windows-ad-hoc-rigs-that-outlive-the-tool-call) states the shape, child-owned durable output and post-return PID/birth/output qualification. Preserved harmless-child receipt: `.spt/preserved/hertz-ir137-caller-return/receipt.json`, SHA256 **`e1c9b207544e6313eac5421ebb692786ec18b3a165756b451bff3a704899b178`**. Both valid arms survived under **OMP**, wrote post-return events and exited0; an initial observer-handshake timeout is excluded. All3probe children ended and native handles closed. This does not reproduce the **Claude Code** failure; the host boundary stays explicit. Reopen only for a newly owned callsite or contrary evidence, not to build an unused helper.\n\n[Showing lines 1-68 and 116-169 of 169; 47 middle lines (13.5KB) elided. Use :6938 to continue. Read artifact://732 for full output]"}],"details":{"truncation":{"content":"### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released\r\n\r\n- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**\r\n- **The refusal.** `DAEMON_STOP_REFUSED: a broker-stopping command is never run by an spt endpoint ($OWL_SESSION_ID is set). ... No flag overrides this, --force included.` The guard keys on the CALLER'S SESSION ENV, so it fires identically no matter which rig step reaches it and no matter what `SPT_HOME` the command targets.\r\n- **Not a new fault, and not an accident.** `readiness-r4-as-read.md:107-109` already states it: v9 DELIBERATELY leaves `OWL_SESSION_ID` set, the refusal is expected to recur, and it is \"reported, never worked around silently.\" The rig chooses a loud known refusal over an unproven workaround — that choice is right, and it is the reason this entry is about the leftover, not about the refusal.\r\n- **What it actually costs.** Cleanup completes with `steps_failed=1` and the isolated daemon SURVIVES. Measured in instance 2: supervisor `daemon run --detached` and its child `daemon brain --generation 0 --start-reason cold`, born 331 ms apart, both executing `/target/release/spt.exe`. They hold the SUBJECT exe open inside a pool `pool_release` has already returned, so the next build into that pool can fail on a locked `spt.exe` — a red belonging to neither lane. See memory [[live-agents-lock-target-debug-spt-exe]], [[shared-target-two-live-trees]].\r\n- **The counterfactual the refusal does NOT license (doyle, correcting hertz in this instance).** That the guard refused does not prove the isolated-target command *would have* stopped the resident broker. The guard reads the env, not the routing; establishing what the command would have reached needs routing evidence nobody has gathered. State the refusal, never the averted disaster.\r\n- **Disposal, and it is the same four-field procedure both times** (`readiness-r4-as-read.md:110-118`): identify on pid, `CreationDate`, exact `ExecutablePath` and `CommandLine` — a bare pid match is unsound because pid reuse on this box is measured, see [[pid-reuse-across-reboot]]. The supervisor must still equal `/daemon.pid`, and the brain's parent must be that supervisor. Then a fresh authorization NAMING THE NEW PIDS (the prior one is pid-specific and spent), supervisor first so the brain cannot respawn, `Stop-Process -Id` alone — never a tree kill, an image-name kill, or any action against the resident node daemon, which is a DIFFERENT binary under `AppData\\Local\\spt-core\\bin\\`. Post-state ASSERTED, not announced, or it is [[watchdog-reports-a-kill-it-never-made]].\r\n- **Mechanism.** A cleanup step that is structurally unrunnable in the environment the rig always runs in. It cannot be fixed by retrying, it never fails loudly enough to block the run, and its residue lands in a shared build pool rather than in the run's own directory — so the cost is paid by whoever builds next, not by the run that caused it.\r\n- **Rule (scoped by doyle 2026-09-12 — a bare pid-file kill is NOT approved as sufficient).** A rig that starts a daemon owns stopping it by a route that works from the rig's own environment, and `/daemon.pid` is the pid SOURCE, never the authorization. Any rig cleanup that terminates a process must, at the moment of acting: re-read creation time, exact `ExecutablePath`, `CommandLine` and isolated-home association FRESH; confirm the supervisor still equals the pid file and the brain's parent is that supervisor; stop SUPERVISOR-FIRST so no child respawns; and report failure EXPLICITLY rather than escalating scope. Any mismatch or unreadable identity STOPS the action. No PID-only automation and no product-guard bypass is approved. A cleanup step whose failure leaves state in a SHARED resource reports that residue as an identity the next consumer can act on — pid, path, command line — not merely as a failed step.\r\n- **Kin:** [[IR-42]] (pool enforcement speaks at the next build, not at claim time), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry, e2e-leaked-daemons-shared-box, no-machinewide-killon-shared-runner.\r\n- **Ripe when:** before the next field run. NOT a one-line change: the stop route is small, but the identity re-verification, supervisor-first ordering and explicit failure reporting above are part of the fix and are what make it safe. · **Size:** small.\r\n\r\n### IR-123 — a helper that LOGS cannot also RETURN through stdout: `record` tees, so `face=$(face_report ...)` captures the log block and the acceptance gate can never pass\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-13 (hertz, found by exercising the D2 successor; confirmed by doyle from a direct source read of frozen r10). **Frozen r10 is PRESERVED as-is**; the return channel is corrected in its successor only.\r\n- **Instance.** `record()` is `echo \"$1\" | tee -a \"$R/findings.txt\"` — it writes to the log AND to stdout, deliberately, so a live operator sees the run. `face_report()` calls `record` twice (a FACE_COUNTS line and a FACE= line) and then `echo`es the face as its return value. The single caller reads it as `setup_face=$(face_report \"$SETUP_OUT\" \"$SETUP_ERR\" \"SETUP\" bootstrap)`, so the captured value is **the whole tee'd log block with the face appended**, and `[ \"$setup_face\" != reconciled ]` is true no matter what the product printed. The Arm-B acceptance gate — rc 0 AND face reconciled AND pair written, all three required — is therefore **unpassable on the ACCEPTED path**.\r\n- **Why no rig run caught it.** The stub cases that reached this line were REFUSALS, whose expected outcome is exactly the branch the defect forces (exit 3, Arm B held). A gate that always refuses looks identical to a gate that correctly refused a refusal. The accepted path had no arm at all until the D2 successor's control ran one with `LAN_FIREWALL_RECONCILED`, exit 0 and a pair measured present — see memory `setup-suppresses-failing-arm`.\r\n- **The same shape, twice more, in the successor's own new code** (both caught by the same control, both mine): `D2_T1_VALID=$(d2_validate_at t1)` captured the validator's tee'd log ahead of its verdict; and `local point=\"$1\" doc=\"$R/d2-$point.json\"` rebuilt [[IR-121]]'s declaration-ordering defect, so three documents present on disk all read `NO_DOCUMENT`. The precedent for the fix was already in the same file: r10's own `handoff_request` comment records that `spec=$(handoff_request ...)` was broken by exactly this tee and was repaired by setting parent globals and returning nothing on stdout.\r\n- **Scope of what this does and does not invalidate (doyle).** It does NOT invalidate r10's observed product refusal: the named rule reported `[5, 20]` and positive reconciliation was independently absent. It DOES invalidate any claim that the frozen rig could have admitted a successful setup — that path was never reachable.\r\n- **Mechanism.** A dual-purpose channel: the same stream carries human-readable logging and a machine-read value, so any helper that logs before returning hands its caller both. It fails silently and in the direction that looks conservative (a gate that refuses), which is why it survives review and why refusal-only exercises confirm it.\r\n- **Rule.** A function that calls `record` (or any logger that writes to stdout) **returns nothing on stdout**: it sets a named global, or writes its value to a file the caller reads. Every acceptance gate is exercised on BOTH paths — an accepting arm with real positive evidence and a refusing arm — because an acceptance test alone cannot distinguish a working gate from one that accepts everything, and a refusal test alone cannot distinguish a working gate from one that refuses everything.\r\n- **Kin:** [[IR-121]] (a wrong value with no error, same file), [[IR-118]], memory setup-suppresses-failing-arm, make-a-new-rig-red-on-purpose, every-return-arm-is-a-copy, zero-match-filter-reads-as-absent.\r\n- **Ripe when:** now — the successor already carries the fix at its call sites and in its own helper; the register entry is the part that outlives this lane. · **Size:** procedure.\r\n\r\n### IR-124 — a cleanup that runs `serve lan --stop` UNCONDITIONALLY creates the daemon it exists to remove, when the setup it is cleaning up after never ran\r\n\r\n- **Status:** OPEN, measured once in the field. D2 field run `20260913T041410Z`, driver `2e3aec1b`, recorded by hertz 2026-09-13 at doyle's direction. Archive `.spt/preserved/hertz-fp-driver-review/d2/field-run-20260913T041410Z/` (72 files, manifest `defa5d29…`). **This is a RIG defect. It is mine — I wrote the driver — and doyle's admission review missed the unconditional stop path as well; both are recorded because a review that misses a path is part of the mechanism, not an aside.**\r\n- **Instance.** The elevated setup was **DECLINED and NOT STARTED** by liam at 04:18:55Z — measured, unambiguous, and the right call: his leg was ready at 04:18:35Z against a hard 04:19:10Z expiry and he refused rather than race the teardown. Nothing ran, nothing mutated. The driver then entered cleanup and executed its own unconditional `env SPT_INSTALL_NO_FIREWALL=1 SPT_HOME= serve lan --stop`, which dispatched through the daemon (`ensure_running`, `serveverb.rs:191`) and **CREATED** a supervisor (`daemon run --detached`, Windows PID 45944, `04:19:18.0312050Z`) and a brain (`daemon brain --generation 0 --start-reason cold`, PID 22524, `04:19:19.7696380Z`, parent 45944). `fp-home-d2`, measured ABSENT at the 04:13:58Z at-launch recheck, existed with `daemon.pid`, `brain.ready` and a full tree by 04:19:18Z.\r\n- **Why the hold could not stop it.** doyle held the elevated teardown for exactly this reason and liam held all commands. But this stop is **internal to the running driver**, not a handoff, so no authorization gate reached it: the only levers were killing the driver or editing a running script, and both are forbidden. **A guard that only governs dispatched work does not govern a step the subject performs itself.**\r\n- **The pre-dispatch markers named the mechanism and did not prevent it.** `daemon_may_run — serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running` was set BEFORE the setup was requested. The driver correctly refused to infer absence from its own expectation — and then triggered the very mechanism the marker warned about, from the cleanup path, on the branch where the warning did not apply.\r\n- **Three things kept apart, because collapsing any two misstates the run.** (1) Liam's testimony: NOT_STARTED, no mutation — still true, he created none of it. (2) The driver's conservative verdict: `CLEANUP=PENDING`, `residual_state=UNREADABLE`, `residue=UNMEASURED` — an honest refusal to claim clean, not a contradiction of liam. (3) An **actually observed** residual, created by the driver itself. That third thing is a measurement; the first two are testimony and abstention.\r\n- **Mechanism.** A teardown verb that is also a *start* verb. `serve lan --stop` must reach the daemon to ask it to stop, so invoking it when no daemon exists starts one. Cleanup paths are written for the case where setup succeeded, and are reached on every path including the ones where setup never happened; the branch nobody exercises is the branch where cleanup has nothing to clean.\r\n- **Rule.** A cleanup step whose command can CREATE the resource it removes must be **conditional on evidence that the resource exists** — not on the state markers, which say \"may exist\" by design, and not on the fact that cleanup was entered. Where the existence check is itself unavailable, the step is SKIPPED and reported as skipped, because an unnecessary teardown that spawns is strictly worse than a labelled gap. Exercise every cleanup path from the **setup-never-ran** state, not only from the setup-succeeded state.\r\n- **Kin:** [[IR-122]] (the other half: the stop that *cannot* run leaves a daemon; this is the stop that *should not* run and makes one), memory setup-suppresses-failing-arm, gate-against-documented-design, remedy-must-run-from-refusal-state.\r\n- **Ripe when:** before any repeat field run — a repeat under this driver reproduces the residue. · **Size:** small.\r\n\r\n### IR-125 — the driver's own executable sweep reported ZERO processes on the pinned exe while `Win32_Process` showed TWO, at the same instant\r\n\r\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). **A FALSE-NEGATIVE SWEEP, not a false CLEAR** (doyle's classification, and the distinction is load-bearing): the ledger's actual verdict was `residual_state=UNREADABLE` / `CLEANUP=PENDING`, which was correct, and the sweep line is explicitly labelled evidence-only in the driver's own output.\r\n- **Instance.** `SUBJECT_EXE_PROBE=OK running_the_pinned_executable=0 enum_total=618` — the probe enumerated 618 processes and concluded none was running the pinned executable. A `Win32_Process` read moments later returned **two**, both with `ExecutablePath` exactly `…\\.worktrees\\304-w2-repr\\target\\release\\spt.exe`: PIDs 45944 and 22524. An independent sweep by path, not by pid, agreed: `count=2`.\r\n- **Why it matters despite being labelled evidence-only.** The line reads as a clean box to anyone skimming, and it is the only line in the run that speaks to \"is anything of ours still running\" in plain terms. It was contradicted only because a native read was performed for a different reason. Had the ledger's verdict logic depended on it, this is a false CLEAR.\r\n- **Candidate cause, NOT diagnosed** (deferred by doyle until cleanup was complete, and still open): the probe's raw path comparison. The Win32 `ExecutablePath` is backslashed Windows form; the driver's pinned `$EXE` is forward-slashed msys-friendly form. A literal comparison between those two spellings of the same file fails for every process. **Unconfirmed** — it is a candidate because it fits, not because it has been measured.\r\n- **Mechanism.** A predicate that can only ever return \"no\" reports a clean zero over a large, healthy-looking enumeration. `enum_total=618` is what makes it convincing: the instrument demonstrably ran and demonstrably saw the machine, and still could not see the thing it was looking for. Same family as the two other instrument-versus-reality mismatches in this lane, and all three were invisible to stubs.\r\n- **Rule.** A sweep that reports zero carries its own **positive control** — in the same run, the same predicate must find something known present, or the zero is UNMEASURED rather than absent. Where a predicate compares paths across the msys/Windows boundary, normalise both sides and prove the normalisation on a known-matching pair; never compare two spellings of a path and call a non-match an absence.\r\n- **Kin:** memory count-predicate-needs-its-own-positive-control, zero-match-filter-reads-as-absent, windows-firewall-census-clean-zeros, verdict-from-probe-competence, [[IR-118]].\r\n- **Ripe when:** with IR-124, before a repeat field run. · **Size:** small.\r\n\r\n### IR-126 — the experimental budget CONTAINED its own read-only preflight, leaving 128 s of a 300 s window for the elevated leg, and the leg was correctly declined\r\n\r\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). Boundary NOT moved for that run — doyle refused the change mid-flight and was right to; this entry is the scheduling review he asked to be preserved.\r\n- **Measured, from the run's own timestamps.** Run start `04:14:10Z` · pre-setup absence census `04:16:23Z` · handoff request written `04:17:02Z`. So **172 s of the 300 s experimental budget went to in-budget read-only preflight** — CI axis queried by name across five statuses, ancestry census, six-instrument hashing, subject identity, 5470 guard baseline, pre-setup absence census — and the driver printed the remainder itself: `HANDOFF_WAIT bounded to 128s`.\r\n- **The consequence, and it is not hypothetical.** Liam's leg script was ready at `04:18:35Z`. Setup alone had measured ~9 s, plus four PowerShell stamps, plus a t1 capture of unmeasured duration, against 35 s of remaining clock. He DECLINED without mutation, which was the correct call and the one the instruction asked for. **The window was consumed before the work it existed for could start.**\r\n- **Two overruns recorded beside it, as observations and not as permissions.** Experimental activity ended at **306 s of the 300 s budget** (the deadline exits through the EXIT trap, so cleanup is never skipped, but the boundary was crossed). The driver was still running after its 180 s cleanup reporting bound had elapsed; it exited by `04:23:54Z`. Neither overrun was authorised, taken as an extension, or used to do more work.\r\n- **Mechanism.** A budget defined from process start, over a phase order that puts every read-only admission check inside it, gives the elevated leg whatever is left rather than what it needs. The preflight cost is not waste — those checks are why the run was admissible — but charging them to the same clock makes the window's usable size an accident of how slow the host's firewall enumeration is that minute.\r\n- **Rule.** Bound the ELEVATED LEG on its own clock, sized from its measured duration, and start it when the leg is dispatched. Admission checks get a separate bound. A driver that cannot guarantee a usable handoff window should REFUSE TO DISPATCH rather than dispatch a leg that cannot finish — an operator declining at the deadline is the correct outcome of a wrong window, not a failure of the operator.\r\n- **Kin:** [[IR-122]], memory your-cadence-can-be-the-blocker, reap-step-duration-is-not-the-window, twohost-run-window-discipline.\r\n- **Ripe when:** with IR-124 — a repeat field run under the current budget shape reproduces the squeeze. · **Size:** small.\r\n\r\n### IR-127 — a nested value-type assignment can leave the native job limit unset while the instrument logs the requested flag and a successful setter\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** The containment probe assigned `$info.BasicLimitInformation.LimitFlags = 0x2000`, logged the requested KILL_ON_JOB_CLOSE flag and `SetInformationJobObject=True`, read both owned processes as job members, closed the handle, and found both still alive. The nested field is a struct: PowerShell changed a copy, not the value subsequently marshalled. The offline discriminator measured `nested_assignment_flags=0`; modifying the nested value and assigning the whole value back measured `whole_value_assignment_flags=8192`.\r\n- **Correction and evidence.** The corrected probe assigns the whole nested value, calls `QueryInformationJobObject`, and refuses unless the kernel's flags equal the requested flags. Readback `0x2000` then preceded both members being measured GONE after close. Initial invalid arm and corrected measurement are preserved separately under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/` (`M3/` and `instrument-repair-20260913T104354Z/M3/`); the latter's `results.txt` carries the offline discriminator.\r\n- **Rule.** Mutating a nested interop value requires assigning that value back to its owner. Successful native setters establish only that the submitted value was accepted: read the effective configuration back and compare it before granting the operation authority. Requested flags are not observed flags.\r\n- **Kin:** [[IR-116]] (a successful call is not a post-state), [[IR-118]] (a complete-looking wrong answer).\r\n- **Ripe when:** any PowerShell/native configuration probe is authored or changed. **Size:** whole-value assignment plus checked native readback; retain the positive and negative discriminator.\r\n\r\n### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.\r\n- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.\r\n- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.\r\n- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.\r\n- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).\r\n- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.\r\n\r\n### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.\r\n- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.\r\n- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.\r\n- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.\r\n- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.\r\n- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.\r\n\r\n### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.\r\n- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.\r\n- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.\r\n- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.\r\n- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.\r\n- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).\r\n- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.\r\n\r\n### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists\r\n\r\n- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.\r\n- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.\r\n- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.\r\n- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.\r\n- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.\r\n- **Scrub qualification.** The fresh-child receipt recorded `before_names=[\"SPT_ENDPOINT_ID\",\"SPT_RELEASE_SEED\"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.\r\n- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).\r\n- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.\r\n\r\n### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission\r\n\r\n- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.\r\n- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.\r\n- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.\r\n- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.\r\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\r\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\r\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\r\n\r\n### IR-133 — a live capture cannot be read with read-only sharing, and daemon stderr belongs to the owned home\r\n\r\n- **Status:** Corrected in the r9 rig instrument; genuine fifth-window promotion completed with exit **0**, owned shutdown and final provenance. The subsequent field attempt failed its separate setup-handoff deadline, not this promotion read. Fourth #297 preparation measured by hertz on 2026-09-14; sharing failure localized by doyle in `R2VK8FQN`, run-identity binding ruled in `ANR522S5`, successor accepted in `GV3R6QUV`.\r\n- **Instance.** Fourteen admission leaves and genuine staging passed. The candidate applied daemonlessly, transitioned `applied-pending` → `applied`, brought up broker **14704** and brain **45220**, published the pinned generation-zero readiness record and emitted `BRAIN_PROMOTED` before the instrument stopped its owned job. The instrument returned only `OWNED_PROMOTION_READINESS_FAILED`. Six provisioning/promotion native jobs ended `CONFIRMED_GONE`, active counts zero; all nineteen signing-private files were absent. No field, GO or D3 occurred. Original receipt: `.spt/preserved/hertz-fp-driver-review/d2/W8TQ3MZC-FINAL-REFUSAL.json`.\r\n- **Mechanism.** The loop used `File.ReadAllText` on a capture held open for **Write**, with **Read** sharing, by the run-scoped launcher. Windows checks sharing in both directions: the new reader's default **Read** sharing excludes the existing writer, causing `IOException`, `0x80070020`. A completed step hid this defect because its writer had already closed. Changing only the writer's sharing does not repair the reader.\r\n- **Wrong source behind the exception.** The launcher's stderr capture was zero bytes; the daemon redirects stderr to `SPT_HOME/logs/daemon.stderr.log`. Reading the empty capture with compatible sharing would merely reach the later marker timeout. Read the actual owned-home log with `FileStream(Open, Read, FileShare.ReadWrite | FileShare.Delete)`, matching the existing native launcher's `ReadText` pattern; release each read handle before the next poll.\r\n- **Run binding.** A promotion marker counts only after the exact brain header naming the measured membership PID and readiness generation, and before another process header. Markers before that header, without it, or under another PID/generation refuse. A rolled `.1` can contribute only when absent before this owned launch and appearing during it, with the same header binding; preexisting backups cannot prove this run.\r\n- **Failure evidence.** Attach the instrument's constant assertion name and call-site line to its exception. Before cleanup can replace the active error, retain that name, source line, exception type and HResult. Non-assert exceptions have a null assertion name. Never serialize exception messages or environment values.\r\n- **Qualification.** Thirteen controls passed against `provision-promote-R2VK8FQN.ps1`: a live-held writer reproduces `0x80070020` with `ReadAllText`, the shared reader returns its exact bytes while the writer remains open, header/PID/generation/ordering and rolled-history boundaries refuse stale evidence, the actual rollback guard still refuses, and diagnostics omit a message canary. Proof: `R2VK8FQN-live-held-controls/result.json` beneath the receipt directory. No product invocations, rig mutations or fleet terminations.\r\n- **Live verification.** `provision-R2VK8FQN/promotion-complete.json` records `PROMOTION_COMPLETE`; the supervised promotion exited **0** after **12.9 s**. The real candidate passed the shared-log, PID/generation marker, final membership, durable-state and owned-shutdown checks. Its later field ledger remains a separate failed observation contract; successful provisioning does not turn that ledger green.\r\n- **Kin:** [[IR-132]] (instrument census refusal), [[IR-130]] and [[IR-131]] (phase labels lose the failing predicate). **Ripe when:** polling any live writer or accepting logs as run-specific evidence.\r\n\r\n### IR-134 — request latency consumes the elevated capture's execution budget, then a late terminal receipt leaves completed work unmeasured\r\n\r\n- **Status:** Instrument correction qualified without a sixth field window. Doyle accepted the execution-clock repair in principle under `HHDKCRH5`, then identified its still-insufficient receipt budget; the derived-window successor follows ruling `P9RLK4VU` and accepted arithmetic `KZG4IN37`. Candidate/packet/nonce/driver/runner repinning remains one future amendment, separate from field authorization. Fifth #297 field run `20260914T063552Z` remains failed and immutable. Its candidate's independent **PRODUCT RED** finding (`M5XKQ2DN`) is unchanged.\r\n- **Measured sequence.** Setup request `06:41:26Z`, elevated setup `06:43:18Z`–`06:43:24Z`, refused capture launcher `06:43:25Z`–`06:43:26Z`, receipt about `06:43:27Z`. The driver had written the capture deadline from request time: 112 seconds of handoff delay left the launcher's `deadline - now - 5` allocation at **−4 seconds**. No native t1 capture ran. The handoff expired before the receipt; cleanup reread its nonce and exit but retained the earlier `timestamp_order=UNMEASURED`, withholding mutation despite subsequently available terminal stamps.\r\n- **Clock correction.** The executor initializes `setup-start.utc`, `elevated-leg-start.epoch` and `d2-t1.deadline` immediately before `run_exactly`, from one UTC observation, with **CreateNew** writes. The independent allocation is **120 seconds**: the existing 90-second capture ceiling, 9 measured seconds around a refused capture, 5-second termination reserve and 16-second margin. Nine seconds is not a measurement of a successful capture. PREPARE initializes nothing; notification latency consumes only the separately bounded handoff. No preparation or activity window is reset or extended.\r\n- **Terminal evidence correction.** On handoff expiry, cleanup makes one final nonce/exit observation and, if terminal, rereads the six stamps before deciding whether completion is proven. A late observation preserves `handoff_wait=EXPIRED` and the original timeout exit separately from `setup_terminal_exit`; it never resumes activity or treats lateness as timely acceptance. Missing, duplicate or wrong nonce evidence and missing or reversed stamps remain unproven. An exceeded leg clock refuses the capture contract independently of terminal completion.\r\n- **No-field proof.** `.spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/` preserves the actual extracted predecessor/successor predicates, emitted PowerShell initializer, nine receipt/product controls, five clock/ledger controls and clock results. The predecessor retained UNMEASURED after receipt publication; the successor recovered ordered completion without overwriting timeout. The actual initializer refused a second initialization without changing any clock bytes. With the measured 112-second notification delay and capture at leg-start +7, the old allocation is −4 seconds and the new allocation is 90 seconds. No product, firewall, signing or field operation was invoked.\r\n- **The outer-clock blocker, not fixed by the inner clock.** A receipt follows execution: **112 + 120 = 232 seconds** cannot fit the retained 120-second setup handoff. Keeping a 300-second activity window and refusing every GO would be a correct refusal of the wrong shape, not an executable field design. `P9RLK4VU` therefore re-derives future activity as **630 seconds**: pre-dispatch **74** (54 observed +20 margin), setup handoff **240** (112 latency +120 leg +8 margin), post-receipt probes **200**, t2 **100**, final transition **16**. Only setup supersedes the prior 120-second handoff cap; other handoffs retain it.\r\n- **Measured basis and explicit allowance.** The fifth timeline records portfields calls at up to **45 seconds**, census **46 seconds**, and t3 **25 seconds**; the earlier `20260913T041410Z` capture also took 25 seconds. Two analogous portfields calls plus census give **136 seconds**; another **64 seconds** is a labelled allowance for identity capture, D1 and bookkeeping, not a claimed complete post-receipt measurement. T2 receives a **90-second native ceiling**, **5-second launcher reporting reserve** and **5-second shell/reporting margin**. The post-receipt probe deadline cannot spend t2's allocation; t2 cannot spend the final transition reserve.\r\n- **Derived-window controls.** `P9RLK4VU-controls/result.json` records **16 passing controls**, executing extracted real Bash predicates and the wait loop against a virtual wall clock. The complete 630-second window and the measured 54-second pre-dispatch cost pass; 555 seconds remaining fails against the 556-second dispatch requirement, while 556 fits. The actual gate refuses before GO/mutation markers. A receipt after 112-second latency plus 120-second execution fits the new setup allowance; PREPARE and cleanup retain their 120-second caps. Published request and phase deadlines still truncate waits. Preparation remains **600 seconds** and cleanup remains **180 seconds including its 30-second ledger reserve**; an observation deadline cannot override cleanup. No product or field operation was executed.\r\n- **Separate product finding.** Candidate `b8482445` logged one `verify-query` completed at **2650 ms**, followed by a second pre-write snapshot killed at **3027 ms** under its **3000 ms** budget; no reconcile-write ran. The budget **starts before spawn and includes output collection** (`run_ps_inner`, source timing supplied by doyle in `IRXYIJHS`); spawn is not outside this clock. The successor ledger records this query kill separately from handoff/capture failure. Fifth-window cleanup was subsequently closed on existing measurements as **NOTHING_TO_REMOVE**; its original PENDING ledger was not rewritten.\r\n- **Kin:** [[IR-126]] (execution receives leftover scheduling time), [[IR-124]] (cleanup must not race unproven setup). **Rule:** measure execution from execution, preserve timeout and late completion as separate facts, and do not let an instrumentation repair erase a product failure.\r\n\r\n### IR-135 — checker pin and runner installation can disagree, and the repair path disguises that version mismatch as an authentication failure\r\n\r\n- **Status:** CI precheck remedy implemented in the IR-135 lane; workflow execution awaits integration. Measured by doyle in S4 golden `34946493637`, 2026-09-15; filed by hertz from `3HHHPWCR`. The immediate box mismatch was repaired by hand-install.\r\n- **Instance and mechanism.** The #304 candidate carried `71caedd4`, setting `WANT=0.4.1` in `golden.yml`/`ci.yml`, while kitsubito's `~/.local/bin/traceable-reqs` was **0.2.0**. The install step's mismatch path attempted a private clone without a provisioned `TRACEABLE_REQS_TOKEN` and exited **128 before any check**. The visible failure named authentication, not the wanted and installed versions. A checked-in pin is not evidence that the runner can supply it; the fallback requires a second, independently missing prerequisite.\r\n- **Implemented remedy (QD54OM7S).** Both workflows run an explicit pin/runner precheck and use `.github/ci/traceable-reqs.sh` as the single pin/install owner. It reports the actual version and native version exit; matching requires literal equality and exit zero. A mismatch without `TRACEABLE_REQS_TOKEN` refuses before clone/build, naming the version disagreement and missing credential separately. With a token present, source repair remains available and native clone failure is preserved; token presence never claims access. The installed version is checked before coverage. On kitsubito, eight isolated shell controls passed: matching precheck/install without a token, stale/missing/failing/lookalike versions refused, authenticated repair admission, and clone exit128 retained. The predecessor failed the stale/no-token discriminator with128; the successor refused with1 and both diagnostics. A separate smoke used kitsubito's real0.4.1 binary through both entry points without a token, exit0. No live credential was provisioned or private-source build exercised. Contract and reproduction command: `docs/TRACEABILITY.md` §CI checker admission and installation. PAT provisioning remains the operator's decision, banked since2026-07-30.\r\n- **Kin:** [[IR-104]] (the checker version changes what counts as evidence), [[IR-109]] (the #304 pin is already live). **Ripe when:** the next checker pin or golden-intake/install-step change. **Size:** a version diagnostic and intake assertion; credential provisioning is separate operator work.\r\n\r\n### IR-136 — a broker bound under the seed socket's name is not seed control, so a URL-minting rig can omit the very listener contract the product queries\r\n\r\n- **Status:** Instance fixed in S5 **`ddd7fc7f070667524578c282894dd44a2e36062f`**, test-only atop S4; S5 golden34957614641 passed, including both twohost roles. Shared fixture-composition remedy implemented and Linux-verified in the IR-136 lane. Origin: doyle's S4 golden `34946493637` twohost helper red, 2026-09-15.\r\n- **Mechanism.** Role B hosted broker IPC under an invented name, with neither `seedmap::serve_seed_control` nor a docs listener. `REQ-WEB-URL-BOUND-PORT` requires `serve_for` to ask the canonical seed-control plane for `DocsStatus` before publishing a URL; the missing plane returned `DOCS_PORT_DISCOVERY_FAILED: Connection refused (os error 111)`. Merely renaming a Broker to `seed_socket_name()` does not provide that protocol: `serve_request` is dispatched by seed control, not Broker. The docs-server fixture had already encountered the same trap. The last green twohost run predated this bound-port contract.\r\n- **Discriminator and scope.** Todlando's unchanged-S4 Linux fixture failed at the exact discovery seam without seed control/listener (**native 101**) and returned `Registered` at the actual bound port **33319** when those fixtures were added (**native 0**); both arms retained the invented B broker name. Evidence: `.spt/preserved/304-web-helper-rca/linux/`. S5 gives B distinct canonical broker/seed sockets, real seed control, a broker-backed ephemeral docs listener, and a discovered-port equality precondition. Helper expectations stay unchanged. A's helper cell relays B's returned URL and does not query its own DocsStatus; its existing broker-on-seed-name path is not this failure. The seven unopted-in Windows passes do not exercise the role-gated twohost bodies.\r\n\r\n- **Shared remedy (P2Y2GWUP).** `crates/spt-daemon/tests/support/serving.rs` provides `ServingFixture`, included by both `docs_server_e2e` and `twohost_web` rather than exported as product surface. `start` composes the distinct canonical broker and real seed control, waits for seed readiness, binds broker-backed docs on port0, and asserts that seed-control `DocsStatus` returns that actual port. The caller supplies its private home, journal and optional NetHost; socket spelling is no longer a caller choice. `stop` stops and joins both IPC accept loops. The docs listener remains process-lifetime under the existing production interface, so tests require process-per-test isolation and one broker-backed listener per process.\r\n- **Negative-state coverage retained.** The docs fixture uses the separate `control` stage only to distinguish absent control (offline fallback permitted) from running control without a listener (fallback refused); its normal serving case uses the same complete constructor as role B. Role A's seed-named proxy Broker and the standalone docs-less listener remain intentionally separate: neither is the owner's URL-minting control plane. No default/configured port substitutes for discovery, and no production protocol changes.\r\n- **Shared-fixture proof (2026-09-15).** Kitsubito, private tree/target, jobs2: targeted clippy with `-D warnings` **0**; nextest, both migrated binaries, one test thread and zero retries **0**. All **3 docs cases** exercised their real bodies: absent-vs-unbound discovery, HTTP published-surface/security checks through the complete fixture, and the standalone docs-less pointer. The other **7 twohost cases** returned through their unopted role gate; these are compile coverage, not a new cross-host execution claim. Traceable0.4.1: **920complete/0findings**. Raw exits/output/hashes: `.spt/preserved/hertz-ir136-fixture/linux-v2/`; the initial wrapper PATH failure started no cargo and is preserved separately.\r\n- **Ripe when:** another URL-producing fixture is added. Use the shared complete constructor rather than rebuilding its three planes independently; use the partial stage only when missing-listener behavior is the test subject.\r\n\r\n### IR-137 — a redirected Start-Process child can share the tool call's console lifetime and die when that call returns\r\n\r\n- **Status:** RETIRED, 2026-09-15, doyle ruling `YPLFG3CG`: **no tracked callsite; discipline recorded + receipt**. This closes a Windows ad-hoc rig-craft item, not a CI or candidate defect; no helper or product change.\r\n- **Mechanism and rule.** `Start-Process` with redirected output from a PowerShell tool call was observed to end with **`STATUS_CONTROL_C_EXIT`** when the tool call ended: a returned child PID did not establish detachment. The reported detached form uses a **hidden window without redirects**. Where a child must outlive the call, qualify its survival after the caller returns and give it a durable output path of its own; do not treat process creation or a hidden window alone as lifetime evidence.\r\n- **Origin clarified (YPLFG3CG).** Claude Code PowerShell tool host, 2026-09-15T07:17Z, #304 S3 Windows attempt-2 launch A: redirected `Start-Process pwsh` PID47560; `rustc` exited `0xc000013a` seconds after the tool returned, driver receipt contained only its start line and no refusal file. The same driver relaunched with `-WindowStyle Hidden -PassThru` and no redirects (PID37536) ran25minutes to exit0. There is no tracked failing launcher to repair; the existing tracked g6 launcher already uses the reported good shape.\r\n- **Discipline and receipt.** [Windows ad-hoc rig launch discipline](GOLDEN-CI.md#windows-ad-hoc-rigs-that-outlive-the-tool-call) states the shape, child-owned durable output and post-return PID/birth/output qualification. Preserved harmless-child receipt: `.spt/preserved/hertz-ir137-caller-return/receipt.json`, SHA256 **`e1c9b207544e6313eac5421ebb692786ec18b3a165756b451bff3a704899b178`**. Both valid arms survived under **OMP**, wrote post-return events and exited0; an initial observer-handshake timeout is excluded. All3probe children ended and native handles closed. This does not reproduce the **Claude Code** failure; the host boundary stays explicit. Reopen only for a newly owned callsite or contrary evidence, not to build an unused helper.\r","truncated":true,"truncatedBy":"lines","totalLines":170,"totalBytes":54464,"outputLines":169,"outputBytes":54464,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6938,"displayContent":{"text":"### IR-122 — the field rig's isolated-daemon stop cannot run from an spt-hosted session, so every run leaves a live daemon holding the subject exe inside the pool it just released\r\n\r\n- **Status:** OPEN, recurring. Instance 1 attempt 2 (`rig/arm2-driver-stdout.txt`: `RIG_DAEMON_STOP_REFUSED_OR_ERRORED — reported, not forced`). Instance 2 run `20260912T231404Z` under frozen r10 (`rig_daemon_stop_EXIT=3`, `cleanup-failures.txt`, `rig-daemon-stop.err`). Recorded by hertz 2026-09-12 23:50Z at doyle's direction; **this is a RIG defect, and any product-surface change requires a separate contract review.**\r\n- **The refusal.** `DAEMON_STOP_REFUSED: a broker-stopping command is never run by an spt endpoint ($OWL_SESSION_ID is set). ... No flag overrides this, --force included.` The guard keys on the CALLER'S SESSION ENV, so it fires identically no matter which rig step reaches it and no matter what `SPT_HOME` the command targets.\r\n- **Not a new fault, and not an accident.** `readiness-r4-as-read.md:107-109` already states it: v9 DELIBERATELY leaves `OWL_SESSION_ID` set, the refusal is expected to recur, and it is \"reported, never worked around silently.\" The rig chooses a loud known refusal over an unproven workaround — that choice is right, and it is the reason this entry is about the leftover, not about the refusal.\r\n- **What it actually costs.** Cleanup completes with `steps_failed=1` and the isolated daemon SURVIVES. Measured in instance 2: supervisor `daemon run --detached` and its child `daemon brain --generation 0 --start-reason cold`, born 331 ms apart, both executing `/target/release/spt.exe`. They hold the SUBJECT exe open inside a pool `pool_release` has already returned, so the next build into that pool can fail on a locked `spt.exe` — a red belonging to neither lane. See memory [[live-agents-lock-target-debug-spt-exe]], [[shared-target-two-live-trees]].\r\n- **The counterfactual the refusal does NOT license (doyle, correcting hertz in this instance).** That the guard refused does not prove the isolated-target command *would have* stopped the resident broker. The guard reads the env, not the routing; establishing what the command would have reached needs routing evidence nobody has gathered. State the refusal, never the averted disaster.\r\n- **Disposal, and it is the same four-field procedure both times** (`readiness-r4-as-read.md:110-118`): identify on pid, `CreationDate`, exact `ExecutablePath` and `CommandLine` — a bare pid match is unsound because pid reuse on this box is measured, see [[pid-reuse-across-reboot]]. The supervisor must still equal `/daemon.pid`, and the brain's parent must be that supervisor. Then a fresh authorization NAMING THE NEW PIDS (the prior one is pid-specific and spent), supervisor first so the brain cannot respawn, `Stop-Process -Id` alone — never a tree kill, an image-name kill, or any action against the resident node daemon, which is a DIFFERENT binary under `AppData\\Local\\spt-core\\bin\\`. Post-state ASSERTED, not announced, or it is [[watchdog-reports-a-kill-it-never-made]].\r\n- **Mechanism.** A cleanup step that is structurally unrunnable in the environment the rig always runs in. It cannot be fixed by retrying, it never fails loudly enough to block the run, and its residue lands in a shared build pool rather than in the run's own directory — so the cost is paid by whoever builds next, not by the run that caused it.\r\n- **Rule (scoped by doyle 2026-09-12 — a bare pid-file kill is NOT approved as sufficient).** A rig that starts a daemon owns stopping it by a route that works from the rig's own environment, and `/daemon.pid` is the pid SOURCE, never the authorization. Any rig cleanup that terminates a process must, at the moment of acting: re-read creation time, exact `ExecutablePath`, `CommandLine` and isolated-home association FRESH; confirm the supervisor still equals the pid file and the brain's parent is that supervisor; stop SUPERVISOR-FIRST so no child respawns; and report failure EXPLICITLY rather than escalating scope. Any mismatch or unreadable identity STOPS the action. No PID-only automation and no product-guard bypass is approved. A cleanup step whose failure leaves state in a SHARED resource reports that residue as an identity the next consumer can act on — pid, path, command line — not merely as a failed step.\r\n- **Kin:** [[IR-42]] (pool enforcement speaks at the next build, not at claim time), memory rig-ownership-reap-only-your-own, reap-root-needs-authenticated-ancestry, e2e-leaked-daemons-shared-box, no-machinewide-killon-shared-runner.\r\n- **Ripe when:** before the next field run. NOT a one-line change: the stop route is small, but the identity re-verification, supervisor-first ordering and explicit failure reporting above are part of the fix and are what make it safe. · **Size:** small.\r\n\r\n### IR-123 — a helper that LOGS cannot also RETURN through stdout: `record` tees, so `face=$(face_report ...)` captures the log block and the acceptance gate can never pass\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-13 (hertz, found by exercising the D2 successor; confirmed by doyle from a direct source read of frozen r10). **Frozen r10 is PRESERVED as-is**; the return channel is corrected in its successor only.\r\n- **Instance.** `record()` is `echo \"$1\" | tee -a \"$R/findings.txt\"` — it writes to the log AND to stdout, deliberately, so a live operator sees the run. `face_report()` calls `record` twice (a FACE_COUNTS line and a FACE= line) and then `echo`es the face as its return value. The single caller reads it as `setup_face=$(face_report \"$SETUP_OUT\" \"$SETUP_ERR\" \"SETUP\" bootstrap)`, so the captured value is **the whole tee'd log block with the face appended**, and `[ \"$setup_face\" != reconciled ]` is true no matter what the product printed. The Arm-B acceptance gate — rc 0 AND face reconciled AND pair written, all three required — is therefore **unpassable on the ACCEPTED path**.\r\n- **Why no rig run caught it.** The stub cases that reached this line were REFUSALS, whose expected outcome is exactly the branch the defect forces (exit 3, Arm B held). A gate that always refuses looks identical to a gate that correctly refused a refusal. The accepted path had no arm at all until the D2 successor's control ran one with `LAN_FIREWALL_RECONCILED`, exit 0 and a pair measured present — see memory `setup-suppresses-failing-arm`.\r\n- **The same shape, twice more, in the successor's own new code** (both caught by the same control, both mine): `D2_T1_VALID=$(d2_validate_at t1)` captured the validator's tee'd log ahead of its verdict; and `local point=\"$1\" doc=\"$R/d2-$point.json\"` rebuilt [[IR-121]]'s declaration-ordering defect, so three documents present on disk all read `NO_DOCUMENT`. The precedent for the fix was already in the same file: r10's own `handoff_request` comment records that `spec=$(handoff_request ...)` was broken by exactly this tee and was repaired by setting parent globals and returning nothing on stdout.\r\n- **Scope of what this does and does not invalidate (doyle).** It does NOT invalidate r10's observed product refusal: the named rule reported `[5, 20]` and positive reconciliation was independently absent. It DOES invalidate any claim that the frozen rig could have admitted a successful setup — that path was never reachable.\r\n- **Mechanism.** A dual-purpose channel: the same stream carries human-readable logging and a machine-read value, so any helper that logs before returning hands its caller both. It fails silently and in the direction that looks conservative (a gate that refuses), which is why it survives review and why refusal-only exercises confirm it.\r\n- **Rule.** A function that calls `record` (or any logger that writes to stdout) **returns nothing on stdout**: it sets a named global, or writes its value to a file the caller reads. Every acceptance gate is exercised on BOTH paths — an accepting arm with real positive evidence and a refusing arm — because an acceptance test alone cannot distinguish a working gate from one that accepts everything, and a refusal test alone cannot distinguish a working gate from one that refuses everything.\r\n- **Kin:** [[IR-121]] (a wrong value with no error, same file), [[IR-118]], memory setup-suppresses-failing-arm, make-a-new-rig-red-on-purpose, every-return-arm-is-a-copy, zero-match-filter-reads-as-absent.\r\n- **Ripe when:** now — the successor already carries the fix at its call sites and in its own helper; the register entry is the part that outlives this lane. · **Size:** procedure.\r\n\r\n### IR-124 — a cleanup that runs `serve lan --stop` UNCONDITIONALLY creates the daemon it exists to remove, when the setup it is cleaning up after never ran\r\n\r\n- **Status:** OPEN, measured once in the field. D2 field run `20260913T041410Z`, driver `2e3aec1b`, recorded by hertz 2026-09-13 at doyle's direction. Archive `.spt/preserved/hertz-fp-driver-review/d2/field-run-20260913T041410Z/` (72 files, manifest `defa5d29…`). **This is a RIG defect. It is mine — I wrote the driver — and doyle's admission review missed the unconditional stop path as well; both are recorded because a review that misses a path is part of the mechanism, not an aside.**\r\n- **Instance.** The elevated setup was **DECLINED and NOT STARTED** by liam at 04:18:55Z — measured, unambiguous, and the right call: his leg was ready at 04:18:35Z against a hard 04:19:10Z expiry and he refused rather than race the teardown. Nothing ran, nothing mutated. The driver then entered cleanup and executed its own unconditional `env SPT_INSTALL_NO_FIREWALL=1 SPT_HOME= serve lan --stop`, which dispatched through the daemon (`ensure_running`, `serveverb.rs:191`) and **CREATED** a supervisor (`daemon run --detached`, Windows PID 45944, `04:19:18.0312050Z`) and a brain (`daemon brain --generation 0 --start-reason cold`, PID 22524, `04:19:19.7696380Z`, parent 45944). `fp-home-d2`, measured ABSENT at the 04:13:58Z at-launch recheck, existed with `daemon.pid`, `brain.ready` and a full tree by 04:19:18Z.\r\n- **Why the hold could not stop it.** doyle held the elevated teardown for exactly this reason and liam held all commands. But this stop is **internal to the running driver**, not a handoff, so no authorization gate reached it: the only levers were killing the driver or editing a running script, and both are forbidden. **A guard that only governs dispatched work does not govern a step the subject performs itself.**\r\n- **The pre-dispatch markers named the mechanism and did not prevent it.** `daemon_may_run — serve dispatches through the daemon (ensure_running, serveverb.rs:191); the elevated leg may leave one running` was set BEFORE the setup was requested. The driver correctly refused to infer absence from its own expectation — and then triggered the very mechanism the marker warned about, from the cleanup path, on the branch where the warning did not apply.\r\n- **Three things kept apart, because collapsing any two misstates the run.** (1) Liam's testimony: NOT_STARTED, no mutation — still true, he created none of it. (2) The driver's conservative verdict: `CLEANUP=PENDING`, `residual_state=UNREADABLE`, `residue=UNMEASURED` — an honest refusal to claim clean, not a contradiction of liam. (3) An **actually observed** residual, created by the driver itself. That third thing is a measurement; the first two are testimony and abstention.\r\n- **Mechanism.** A teardown verb that is also a *start* verb. `serve lan --stop` must reach the daemon to ask it to stop, so invoking it when no daemon exists starts one. Cleanup paths are written for the case where setup succeeded, and are reached on every path including the ones where setup never happened; the branch nobody exercises is the branch where cleanup has nothing to clean.\r\n- **Rule.** A cleanup step whose command can CREATE the resource it removes must be **conditional on evidence that the resource exists** — not on the state markers, which say \"may exist\" by design, and not on the fact that cleanup was entered. Where the existence check is itself unavailable, the step is SKIPPED and reported as skipped, because an unnecessary teardown that spawns is strictly worse than a labelled gap. Exercise every cleanup path from the **setup-never-ran** state, not only from the setup-succeeded state.\r\n- **Kin:** [[IR-122]] (the other half: the stop that *cannot* run leaves a daemon; this is the stop that *should not* run and makes one), memory setup-suppresses-failing-arm, gate-against-documented-design, remedy-must-run-from-refusal-state.\r\n- **Ripe when:** before any repeat field run — a repeat under this driver reproduces the residue. · **Size:** small.\r\n\r\n### IR-125 — the driver's own executable sweep reported ZERO processes on the pinned exe while `Win32_Process` showed TWO, at the same instant\r\n\r\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). **A FALSE-NEGATIVE SWEEP, not a false CLEAR** (doyle's classification, and the distinction is load-bearing): the ledger's actual verdict was `residual_state=UNREADABLE` / `CLEANUP=PENDING`, which was correct, and the sweep line is explicitly labelled evidence-only in the driver's own output.\r\n- **Instance.** `SUBJECT_EXE_PROBE=OK running_the_pinned_executable=0 enum_total=618` — the probe enumerated 618 processes and concluded none was running the pinned executable. A `Win32_Process` read moments later returned **two**, both with `ExecutablePath` exactly `…\\.worktrees\\304-w2-repr\\target\\release\\spt.exe`: PIDs 45944 and 22524. An independent sweep by path, not by pid, agreed: `count=2`.\r\n- **Why it matters despite being labelled evidence-only.** The line reads as a clean box to anyone skimming, and it is the only line in the run that speaks to \"is anything of ours still running\" in plain terms. It was contradicted only because a native read was performed for a different reason. Had the ledger's verdict logic depended on it, this is a false CLEAR.\r\n- **Candidate cause, NOT diagnosed** (deferred by doyle until cleanup was complete, and still open): the probe's raw path comparison. The Win32 `ExecutablePath` is backslashed Windows form; the driver's pinned `$EXE` is forward-slashed msys-friendly form. A literal comparison between those two spellings of the same file fails for every process. **Unconfirmed** — it is a candidate because it fits, not because it has been measured.\r\n- **Mechanism.** A predicate that can only ever return \"no\" reports a clean zero over a large, healthy-looking enumeration. `enum_total=618` is what makes it convincing: the instrument demonstrably ran and demonstrably saw the machine, and still could not see the thing it was looking for. Same family as the two other instrument-versus-reality mismatches in this lane, and all three were invisible to stubs.\r\n- **Rule.** A sweep that reports zero carries its own **positive control** — in the same run, the same predicate must find something known present, or the zero is UNMEASURED rather than absent. Where a predicate compares paths across the msys/Windows boundary, normalise both sides and prove the normalisation on a known-matching pair; never compare two spellings of a path and call a non-match an absence.\r\n- **Kin:** memory count-predicate-needs-its-own-positive-control, zero-match-filter-reads-as-absent, windows-firewall-census-clean-zeros, verdict-from-probe-competence, [[IR-118]].\r\n- **Ripe when:** with IR-124, before a repeat field run. · **Size:** small.\r\n\r\n### IR-126 — the experimental budget CONTAINED its own read-only preflight, leaving 128 s of a 300 s window for the elevated leg, and the leg was correctly declined\r\n\r\n- **Status:** OPEN, measured in D2 field run `20260913T041410Z` (hertz, 2026-09-13). Boundary NOT moved for that run — doyle refused the change mid-flight and was right to; this entry is the scheduling review he asked to be preserved.\r\n- **Measured, from the run's own timestamps.** Run start `04:14:10Z` · pre-setup absence census `04:16:23Z` · handoff request written `04:17:02Z`. So **172 s of the 300 s experimental budget went to in-budget read-only preflight** — CI axis queried by name across five statuses, ancestry census, six-instrument hashing, subject identity, 5470 guard baseline, pre-setup absence census — and the driver printed the remainder itself: `HANDOFF_WAIT bounded to 128s`.\r\n- **The consequence, and it is not hypothetical.** Liam's leg script was ready at `04:18:35Z`. Setup alone had measured ~9 s, plus four PowerShell stamps, plus a t1 capture of unmeasured duration, against 35 s of remaining clock. He DECLINED without mutation, which was the correct call and the one the instruction asked for. **The window was consumed before the work it existed for could start.**\r\n- **Two overruns recorded beside it, as observations and not as permissions.** Experimental activity ended at **306 s of the 300 s budget** (the deadline exits through the EXIT trap, so cleanup is never skipped, but the boundary was crossed). The driver was still running after its 180 s cleanup reporting bound had elapsed; it exited by `04:23:54Z`. Neither overrun was authorised, taken as an extension, or used to do more work.\r\n- **Mechanism.** A budget defined from process start, over a phase order that puts every read-only admission check inside it, gives the elevated leg whatever is left rather than what it needs. The preflight cost is not waste — those checks are why the run was admissible — but charging them to the same clock makes the window's usable size an accident of how slow the host's firewall enumeration is that minute.\r\n- **Rule.** Bound the ELEVATED LEG on its own clock, sized from its measured duration, and start it when the leg is dispatched. Admission checks get a separate bound. A driver that cannot guarantee a usable handoff window should REFUSE TO DISPATCH rather than dispatch a leg that cannot finish — an operator declining at the deadline is the correct outcome of a wrong window, not a failure of the operator.\r\n- **Kin:** [[IR-122]], memory your-cadence-can-be-the-blocker, reap-step-duration-is-not-the-window, twohost-run-window-discipline.\r\n- **Ripe when:** with IR-124 — a repeat field run under the current budget shape reproduces the squeeze. · **Size:** small.\r\n\r\n### IR-127 — a nested value-type assignment can leave the native job limit unset while the instrument logs the requested flag and a successful setter\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** The containment probe assigned `$info.BasicLimitInformation.LimitFlags = 0x2000`, logged the requested KILL_ON_JOB_CLOSE flag and `SetInformationJobObject=True`, read both owned processes as job members, closed the handle, and found both still alive. The nested field is a struct: PowerShell changed a copy, not the value subsequently marshalled. The offline discriminator measured `nested_assignment_flags=0`; modifying the nested value and assigning the whole value back measured `whole_value_assignment_flags=8192`.\r\n- **Correction and evidence.** The corrected probe assigns the whole nested value, calls `QueryInformationJobObject`, and refuses unless the kernel's flags equal the requested flags. Readback `0x2000` then preceded both members being measured GONE after close. Initial invalid arm and corrected measurement are preserved separately under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/` (`M3/` and `instrument-repair-20260913T104354Z/M3/`); the latter's `results.txt` carries the offline discriminator.\r\n- **Rule.** Mutating a nested interop value requires assigning that value back to its owner. Successful native setters establish only that the submitted value was accepted: read the effective configuration back and compare it before granting the operation authority. Requested flags are not observed flags.\r\n- **Kin:** [[IR-116]] (a successful call is not a post-state), [[IR-118]] (a complete-looking wrong answer).\r\n- **Ripe when:** any PowerShell/native configuration probe is authored or changed. **Size:** whole-value assignment plus checked native readback; retain the positive and negative discriminator.\r\n\r\n### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.\r\n- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.\r\n- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.\r\n- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.\r\n- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).\r\n- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.\r\n\r\n### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.\r\n- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.\r\n- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.\r\n- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.\r\n- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.\r\n- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.\r\n\r\n### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.\r\n- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.\r\n- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.\r\n- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.\r\n- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.\r\n- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).\r\n- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.\r\n\r\n### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists\r\n\r\n- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.\r\n- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.\r\n- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.\r\n- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.\r\n- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.\r\n- **Scrub qualification.** The fresh-child receipt recorded `before_names=[\"SPT_ENDPOINT_ID\",\"SPT_RELEASE_SEED\"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.\r\n- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).\r\n- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.\r\n\r\n### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission\r\n\r\n- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.\r\n- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.\r\n- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.\r\n- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.\r\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\r\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\r\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\r\n\r\n### IR-133 — a live capture cannot be read with read-only sharing, and daemon stderr belongs to the owned home\r\n\r\n- **Status:** Corrected in the r9 rig instrument; genuine fifth-window promotion completed with exit **0**, owned shutdown and final provenance. The subsequent field attempt failed its separate setup-handoff deadline, not this promotion read. Fourth #297 preparation measured by hertz on 2026-09-14; sharing failure localized by doyle in `R2VK8FQN`, run-identity binding ruled in `ANR522S5`, successor accepted in `GV3R6QUV`.\r\n- **Instance.** Fourteen admission leaves and genuine staging passed. The candidate applied daemonlessly, transitioned `applied-pending` → `applied`, brought up broker **14704** and brain **45220**, published the pinned generation-zero readiness record and emitted `BRAIN_PROMOTED` before the instrument stopped its owned job. The instrument returned only `OWNED_PROMOTION_READINESS_FAILED`. Six provisioning/promotion native jobs ended `CONFIRMED_GONE`, active counts zero; all nineteen signing-private files were absent. No field, GO or D3 occurred. Original receipt: `.spt/preserved/hertz-fp-driver-review/d2/W8TQ3MZC-FINAL-REFUSAL.json`.\r\n- **Mechanism.** The loop used `File.ReadAllText` on a capture held open for **Write**, with **Read** sharing, by the run-scoped launcher. Windows checks sharing in both directions: the new reader's default **Read** sharing excludes the existing writer, causing `IOException`, `0x80070020`. A completed step hid this defect because its writer had already closed. Changing only the writer's sharing does not repair the reader.\r\n- **Wrong source behind the exception.** The launcher's stderr capture was zero bytes; the daemon redirects stderr to `SPT_HOME/logs/daemon.stderr.log`. Reading the empty capture with compatible sharing would merely reach the later marker timeout. Read the actual owned-home log with `FileStream(Open, Read, FileShare.ReadWrite | FileShare.Delete)`, matching the existing native launcher's `ReadText` pattern; release each read handle before the next poll.\r\n- **Run binding.** A promotion marker counts only after the exact brain header naming the measured membership PID and readiness generation, and before another process header. Markers before that header, without it, or under another PID/generation refuse. A rolled `.1` can contribute only when absent before this owned launch and appearing during it, with the same header binding; preexisting backups cannot prove this run.\r\n- **Failure evidence.** Attach the instrument's constant assertion name and call-site line to its exception. Before cleanup can replace the active error, retain that name, source line, exception type and HResult. Non-assert exceptions have a null assertion name. Never serialize exception messages or environment values.\r\n- **Qualification.** Thirteen controls passed against `provision-promote-R2VK8FQN.ps1`: a live-held writer reproduces `0x80070020` with `ReadAllText`, the shared reader returns its exact bytes while the writer remains open, header/PID/generation/ordering and rolled-history boundaries refuse stale evidence, the actual rollback guard still refuses, and diagnostics omit a message canary. Proof: `R2VK8FQN-live-held-controls/result.json` beneath the receipt directory. No product invocations, rig mutations or fleet terminations.\r\n- **Live verification.** `provision-R2VK8FQN/promotion-complete.json` records `PROMOTION_COMPLETE`; the supervised promotion exited **0** after **12.9 s**. The real candidate passed the shared-log, PID/generation marker, final membership, durable-state and owned-shutdown checks. Its later field ledger remains a separate failed observation contract; successful provisioning does not turn that ledger green.\r\n- **Kin:** [[IR-132]] (instrument census refusal), [[IR-130]] and [[IR-131]] (phase labels lose the failing predicate). **Ripe when:** polling any live writer or accepting logs as run-specific evidence.\r\n\r\n### IR-134 — request latency consumes the elevated capture's execution budget, then a late terminal receipt leaves completed work unmeasured\r\n\r\n- **Status:** Instrument correction qualified without a sixth field window. Doyle accepted the execution-clock repair in principle under `HHDKCRH5`, then identified its still-insufficient receipt budget; the derived-window successor follows ruling `P9RLK4VU` and accepted arithmetic `KZG4IN37`. Candidate/packet/nonce/driver/runner repinning remains one future amendment, separate from field authorization. Fifth #297 field run `20260914T063552Z` remains failed and immutable. Its candidate's independent **PRODUCT RED** finding (`M5XKQ2DN`) is unchanged.\r\n- **Measured sequence.** Setup request `06:41:26Z`, elevated setup `06:43:18Z`–`06:43:24Z`, refused capture launcher `06:43:25Z`–`06:43:26Z`, receipt about `06:43:27Z`. The driver had written the capture deadline from request time: 112 seconds of handoff delay left the launcher's `deadline - now - 5` allocation at **−4 seconds**. No native t1 capture ran. The handoff expired before the receipt; cleanup reread its nonce and exit but retained the earlier `timestamp_order=UNMEASURED`, withholding mutation despite subsequently available terminal stamps.\r\n- **Clock correction.** The executor initializes `setup-start.utc`, `elevated-leg-start.epoch` and `d2-t1.deadline` immediately before `run_exactly`, from one UTC observation, with **CreateNew** writes. The independent allocation is **120 seconds**: the existing 90-second capture ceiling, 9 measured seconds around a refused capture, 5-second termination reserve and 16-second margin. Nine seconds is not a measurement of a successful capture. PREPARE initializes nothing; notification latency consumes only the separately bounded handoff. No preparation or activity window is reset or extended.\r\n- **Terminal evidence correction.** On handoff expiry, cleanup makes one final nonce/exit observation and, if terminal, rereads the six stamps before deciding whether completion is proven. A late observation preserves `handoff_wait=EXPIRED` and the original timeout exit separately from `setup_terminal_exit`; it never resumes activity or treats lateness as timely acceptance. Missing, duplicate or wrong nonce evidence and missing or reversed stamps remain unproven. An exceeded leg clock refuses the capture contract independently of terminal completion.\r\n- **No-field proof.** `.spt/preserved/hertz-fp-driver-review/d2/AQ23KKNI-controls/` preserves the actual extracted predecessor/successor predicates, emitted PowerShell initializer, nine receipt/product controls, five clock/ledger controls and clock results. The predecessor retained UNMEASURED after receipt publication; the successor recovered ordered completion without overwriting timeout. The actual initializer refused a second initialization without changing any clock bytes. With the measured 112-second notification delay and capture at leg-start +7, the old allocation is −4 seconds and the new allocation is 90 seconds. No product, firewall, signing or field operation was invoked.\r\n- **The outer-clock blocker, not fixed by the inner clock.** A receipt follows execution: **112 + 120 = 232 seconds** cannot fit the retained 120-second setup handoff. Keeping a 300-second activity window and refusing every GO would be a correct refusal of the wrong shape, not an executable field design. `P9RLK4VU` therefore re-derives future activity as **630 seconds**: pre-dispatch **74** (54 observed +20 margin), setup handoff **240** (112 latency +120 leg +8 margin), post-receipt probes **200**, t2 **100**, final transition **16**. Only setup supersedes the prior 120-second handoff cap; other handoffs retain it.\r\n- **Measured basis and explicit allowance.** The fifth timeline records portfields calls at up to **45 seconds**, census **46 seconds**, and t3 **25 seconds**; the earlier `20260913T041410Z` capture also took 25 seconds. Two analogous portfields calls plus census give **136 seconds**; another **64 seconds** is a labelled allowance for identity capture, D1 and bookkeeping, not a claimed complete post-receipt measurement. T2 receives a **90-second native ceiling**, **5-second launcher reporting reserve** and **5-second shell/reporting margin**. The post-receipt probe deadline cannot spend t2's allocation; t2 cannot spend the final transition reserve.\r\n- **Derived-window controls.** `P9RLK4VU-controls/result.json` records **16 passing controls**, executing extracted real Bash predicates and the wait loop against a virtual wall clock. The complete 630-second window and the measured 54-second pre-dispatch cost pass; 555 seconds remaining fails against the 556-second dispatch requirement, while 556 fits. The actual gate refuses before GO/mutation markers. A receipt after 112-second latency plus 120-second execution fits the new setup allowance; PREPARE and cleanup retain their 120-second caps. Published request and phase deadlines still truncate waits. Preparation remains **600 seconds** and cleanup remains **180 seconds including its 30-second ledger reserve**; an observation deadline cannot override cleanup. No product or field operation was executed.\r\n- **Separate product finding.** Candidate `b8482445` logged one `verify-query` completed at **2650 ms**, followed by a second pre-write snapshot killed at **3027 ms** under its **3000 ms** budget; no reconcile-write ran. The budget **starts before spawn and includes output collection** (`run_ps_inner`, source timing supplied by doyle in `IRXYIJHS`); spawn is not outside this clock. The successor ledger records this query kill separately from handoff/capture failure. Fifth-window cleanup was subsequently closed on existing measurements as **NOTHING_TO_REMOVE**; its original PENDING ledger was not rewritten.\r\n- **Kin:** [[IR-126]] (execution receives leftover scheduling time), [[IR-124]] (cleanup must not race unproven setup). **Rule:** measure execution from execution, preserve timeout and late completion as separate facts, and do not let an instrumentation repair erase a product failure.\r\n\r\n### IR-135 — checker pin and runner installation can disagree, and the repair path disguises that version mismatch as an authentication failure\r\n\r\n- **Status:** CI precheck remedy implemented in the IR-135 lane; workflow execution awaits integration. Measured by doyle in S4 golden `34946493637`, 2026-09-15; filed by hertz from `3HHHPWCR`. The immediate box mismatch was repaired by hand-install.\r\n- **Instance and mechanism.** The #304 candidate carried `71caedd4`, setting `WANT=0.4.1` in `golden.yml`/`ci.yml`, while kitsubito's `~/.local/bin/traceable-reqs` was **0.2.0**. The install step's mismatch path attempted a private clone without a provisioned `TRACEABLE_REQS_TOKEN` and exited **128 before any check**. The visible failure named authentication, not the wanted and installed versions. A checked-in pin is not evidence that the runner can supply it; the fallback requires a second, independently missing prerequisite.\r\n- **Implemented remedy (QD54OM7S).** Both workflows run an explicit pin/runner precheck and use `.github/ci/traceable-reqs.sh` as the single pin/install owner. It reports the actual version and native version exit; matching requires literal equality and exit zero. A mismatch without `TRACEABLE_REQS_TOKEN` refuses before clone/build, naming the version disagreement and missing credential separately. With a token present, source repair remains available and native clone failure is preserved; token presence never claims access. The installed version is checked before coverage. On kitsubito, eight isolated shell controls passed: matching precheck/install without a token, stale/missing/failing/lookalike versions refused, authenticated repair admission, and clone exit128 retained. The predecessor failed the stale/no-token discriminator with128; the successor refused with1 and both diagnostics. A separate smoke used kitsubito's real0.4.1 binary through both entry points without a token, exit0. No live credential was provisioned or private-source build exercised. Contract and reproduction command: `docs/TRACEABILITY.md` §CI checker admission and installation. PAT provisioning remains the operator's decision, banked since2026-07-30.\r\n- **Kin:** [[IR-104]] (the checker version changes what counts as evidence), [[IR-109]] (the #304 pin is already live). **Ripe when:** the next checker pin or golden-intake/install-step change. **Size:** a version diagnostic and intake assertion; credential provisioning is separate operator work.\r\n\r\n### IR-136 — a broker bound under the seed socket's name is not seed control, so a URL-minting rig can omit the very listener contract the product queries\r\n\r\n- **Status:** Instance fixed in S5 **`ddd7fc7f070667524578c282894dd44a2e36062f`**, test-only atop S4; S5 golden34957614641 passed, including both twohost roles. Shared fixture-composition remedy implemented and Linux-verified in the IR-136 lane. Origin: doyle's S4 golden `34946493637` twohost helper red, 2026-09-15.\r\n- **Mechanism.** Role B hosted broker IPC under an invented name, with neither `seedmap::serve_seed_control` nor a docs listener. `REQ-WEB-URL-BOUND-PORT` requires `serve_for` to ask the canonical seed-control plane for `DocsStatus` before publishing a URL; the missing plane returned `DOCS_PORT_DISCOVERY_FAILED: Connection refused (os error 111)`. Merely renaming a Broker to `seed_socket_name()` does not provide that protocol: `serve_request` is dispatched by seed control, not Broker. The docs-server fixture had already encountered the same trap. The last green twohost run predated this bound-port contract.\r\n- **Discriminator and scope.** Todlando's unchanged-S4 Linux fixture failed at the exact discovery seam without seed control/listener (**native 101**) and returned `Registered` at the actual bound port **33319** when those fixtures were added (**native 0**); both arms retained the invented B broker name. Evidence: `.spt/preserved/304-web-helper-rca/linux/`. S5 gives B distinct canonical broker/seed sockets, real seed control, a broker-backed ephemeral docs listener, and a discovered-port equality precondition. Helper expectations stay unchanged. A's helper cell relays B's returned URL and does not query its own DocsStatus; its existing broker-on-seed-name path is not this failure. The seven unopted-in Windows passes do not exercise the role-gated twohost bodies.\r\n\r\n- **Shared remedy (P2Y2GWUP).** `crates/spt-daemon/tests/support/serving.rs` provides `ServingFixture`, included by both `docs_server_e2e` and `twohost_web` rather than exported as product surface. `start` composes the distinct canonical broker and real seed control, waits for seed readiness, binds broker-backed docs on port0, and asserts that seed-control `DocsStatus` returns that actual port. The caller supplies its private home, journal and optional NetHost; socket spelling is no longer a caller choice. `stop` stops and joins both IPC accept loops. The docs listener remains process-lifetime under the existing production interface, so tests require process-per-test isolation and one broker-backed listener per process.\r\n- **Negative-state coverage retained.** The docs fixture uses the separate `control` stage only to distinguish absent control (offline fallback permitted) from running control without a listener (fallback refused); its normal serving case uses the same complete constructor as role B. Role A's seed-named proxy Broker and the standalone docs-less listener remain intentionally separate: neither is the owner's URL-minting control plane. No default/configured port substitutes for discovery, and no production protocol changes.\r\n- **Shared-fixture proof (2026-09-15).** Kitsubito, private tree/target, jobs2: targeted clippy with `-D warnings` **0**; nextest, both migrated binaries, one test thread and zero retries **0**. All **3 docs cases** exercised their real bodies: absent-vs-unbound discovery, HTTP published-surface/security checks through the complete fixture, and the standalone docs-less pointer. The other **7 twohost cases** returned through their unopted role gate; these are compile coverage, not a new cross-host execution claim. Traceable0.4.1: **920complete/0findings**. Raw exits/output/hashes: `.spt/preserved/hertz-ir136-fixture/linux-v2/`; the initial wrapper PATH failure started no cargo and is preserved separately.\r\n- **Ripe when:** another URL-producing fixture is added. Use the shared complete constructor rather than rebuilding its three planes independently; use the partial stage only when missing-listener behavior is the test subject.\r\n\r\n### IR-137 — a redirected Start-Process child can share the tool call's console lifetime and die when that call returns\r\n\r\n- **Status:** RETIRED, 2026-09-15, doyle ruling `YPLFG3CG`: **no tracked callsite; discipline recorded + receipt**. This closes a Windows ad-hoc rig-craft item, not a CI or candidate defect; no helper or product change.\r\n- **Mechanism and rule.** `Start-Process` with redirected output from a PowerShell tool call was observed to end with **`STATUS_CONTROL_C_EXIT`** when the tool call ended: a returned child PID did not establish detachment. The reported detached form uses a **hidden window without redirects**. Where a child must outlive the call, qualify its survival after the caller returns and give it a durable output path of its own; do not treat process creation or a hidden window alone as lifetime evidence.\r\n- **Origin clarified (YPLFG3CG).** Claude Code PowerShell tool host, 2026-09-15T07:17Z, #304 S3 Windows attempt-2 launch A: redirected `Start-Process pwsh` PID47560; `rustc` exited `0xc000013a` seconds after the tool returned, driver receipt contained only its start line and no refusal file. The same driver relaunched with `-WindowStyle Hidden -PassThru` and no redirects (PID37536) ran25minutes to exit0. There is no tracked failing launcher to repair; the existing tracked g6 launcher already uses the reported good shape.\r\n- **Discipline and receipt.** [Windows ad-hoc rig launch discipline](GOLDEN-CI.md#windows-ad-hoc-rigs-that-outlive-the-tool-call) states the shape, child-owned durable output and post-return PID/birth/output qualification. Preserved harmless-child receipt: `.spt/preserved/hertz-ir137-caller-return/receipt.json`, SHA256 **`e1c9b207544e6313eac5421ebb692786ec18b3a165756b451bff3a704899b178`**. Both valid arms survived under **OMP**, wrote post-return events and exited0; an initial observer-handshake timeout is excluded. All3probe children ended and native handles closed. This does not reproduce the **Claude Code** failure; the host boundary stays explicit. Reopen only for a newly owned callsite or contrary evidence, not to build an unused helper.\r","startLine":6769,"lineNumbers":[6769,6770,6771,6772,6773,6774,6775,6776,6777,6778,6779,6780,6781,6782,6783,6784,6785,6786,6787,6788,6789,6790,6791,6792,6793,6794,6795,6796,6797,6798,6799,6800,6801,6802,6803,6804,6805,6806,6807,6808,6809,6810,6811,6812,6813,6814,6815,6816,6817,6818,6819,6820,6821,6822,6823,6824,6825,6826,6827,6828,6829,6830,6831,6832,6833,6834,6835,6836,6837,6838,6839,6840,6841,6842,6843,6844,6845,6846,6847,6848,6849,6850,6851,6852,6853,6854,6855,6856,6857,6858,6859,6860,6861,6862,6863,6864,6865,6866,6867,6868,6869,6870,6871,6872,6873,6874,6875,6876,6877,6878,6879,6880,6881,6882,6883,6884,6885,6886,6887,6888,6889,6890,6891,6892,6893,6894,6895,6896,6897,6898,6899,6900,6901,6902,6903,6904,6905,6906,6907,6908,6909,6910,6911,6912,6913,6914,6915,6916,6917,6918,6919,6920,6921,6922,6923,6924,6925,6926,6927,6928,6929,6930,6931,6932,6933,6934,6935,6936,6937]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"middle","truncatedBy":"middle","totalLines":169,"totalBytes":54464,"outputLines":123,"outputBytes":40632,"maxBytes":40960,"headRange":{"start":1,"end":68},"tailRange":{"start":116,"end":169},"elidedLines":47,"elidedBytes":13853,"artifactId":"732","nextOffset":6938}}},"isError":false,"timestamp":1789483669346}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_52Jm9jS2HvdzvgO7GV2Jtefh|fc_000c7cef03cac861016aa95aa394a087d1944f537678374a58","toolName":"read","startedAt":"2026-09-15T14:48:03.648Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6567-6711:raw"},"intent":"Recovering omitted policy entries"},"id":"892af14f","parentId":"e10fbab6","timestamp":"2026-09-15T14:48:03.648Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_2IGSye7spdRTE53b7IVjRIX6|fc_000c7cef03cac861016aa95aa394b087d18fd08c07672129b7","toolName":"read","startedAt":"2026-09-15T14:48:03.648Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6837-6888:raw"},"intent":"Recovering instrument corrections"},"id":"c1979897","parentId":"892af14f","timestamp":"2026-09-15T14:48:03.648Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_5SC73LBYbynWTk3TB4TBE7Wq|fc_000c7cef03cac861016aa95aa394b487d19afa73ed25f51f2f","toolName":"grep","startedAt":"2026-09-15T14:48:03.648Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs;.wo…"},"intent":"Checking shipped small remedies"},"id":"fe008097","parentId":"c1979897","timestamp":"2026-09-15T14:48:03.648Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_BWgHB0WgbZ4MGEdGwkEa3y09|fc_000c7cef03cac861016aa95aa394bc87d1bb5dc561ac768e35","toolName":"grep","startedAt":"2026-09-15T14:48:03.649Z","args":{"path":".worktrees/hertz-ir86-disk-delta/AGENTS.md;.worktrees/hertz-ir86-disk-delta/.github;.worktrees/hertz-ir86-disk-delta/xtask/src;.worktrees/hertz-ir86-disk-delta/traceable-reqs.toml;.worktrees/hertz-ir8…"},"intent":"Checking current shared mechanisms"},"id":"4728c1f8","parentId":"fe008097","timestamp":"2026-09-15T14:48:03.649Z"}
{"type":"message","id":"322e9538","parentId":"4728c1f8","timestamp":"2026-09-15T14:48:03.649Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_52Jm9jS2HvdzvgO7GV2Jtefh|fc_000c7cef03cac861016aa95aa394a087d1944f537678374a58","name":"read","arguments":{"i":"Recovering omitted policy entries","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6567-6711:raw"},"intent":"Recovering omitted policy entries"},{"type":"toolCall","id":"call_2IGSye7spdRTE53b7IVjRIX6|fc_000c7cef03cac861016aa95aa394b087d18fd08c07672129b7","name":"read","arguments":{"i":"Recovering instrument corrections","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6837-6888:raw"},"intent":"Recovering instrument corrections"},{"type":"toolCall","id":"call_5SC73LBYbynWTk3TB4TBE7Wq|fc_000c7cef03cac861016aa95aa394b487d19afa73ed25f51f2f","name":"grep","arguments":{"i":"Checking shipped small remedies","pattern":"IR.?78|IR.?82|IR.?90|IR.?94|DAEMON_SUCCEEDS_PID|daemon.pid.prev|free.space|disk.*floor","path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs;.worktrees/hertz-ir86-disk-delta/xtask/src/brainread.rs","case":false,"gitignore":false,"skip":null},"intent":"Checking shipped small remedies"},{"type":"toolCall","id":"call_BWgHB0WgbZ4MGEdGwkEa3y09|fc_000c7cef03cac861016aa95aa394bc87d1bb5dc561ac768e35","name":"grep","arguments":{"i":"Checking current shared mechanisms","pattern":"IR.?79|IR.?88|IR.?76|IR.?106|IR.?107|IR.?109|module_banner|DaemonReaper|kill.scop|0\\.4\\.1","path":".worktrees/hertz-ir86-disk-delta/AGENTS.md;.worktrees/hertz-ir86-disk-delta/.github;.worktrees/hertz-ir86-disk-delta/xtask/src;.worktrees/hertz-ir86-disk-delta/traceable-reqs.toml;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common","case":false,"gitignore":false,"skip":null},"intent":"Checking current shared mechanisms"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":41361,"output":418,"cacheRead":60416,"cacheWrite":0,"totalTokens":102195,"cost":{"input":0.41361000000000003,"output":0.020900000000000002,"cacheRead":0.060416,"cacheWrite":0,"total":0.4949260000000001}},"stopReason":"toolUse","timestamp":1789483669376,"responseId":"resp_000c7cef03cac861016aa95a95a00c87d1a63347ddc47ba755","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_000c7cef03cac861016aa95aa394a087d1944f537678374a58","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering omitted policy entries\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6567-6711:raw\"}","call_id":"call_52Jm9jS2HvdzvgO7GV2Jtefh","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aa394b087d18fd08c07672129b7","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering instrument corrections\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6837-6888:raw\"}","call_id":"call_2IGSye7spdRTE53b7IVjRIX6","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aa394b487d19afa73ed25f51f2f","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking shipped small remedies\",\"pattern\":\"IR.?78|IR.?82|IR.?90|IR.?94|DAEMON_SUCCEEDS_PID|daemon.pid.prev|free.space|disk.*floor\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs;.worktrees/hertz-ir86-disk-delta/xtask/src/brainread.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_5SC73LBYbynWTk3TB4TBE7Wq","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aa394bc87d1bb5dc561ac768e35","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking current shared mechanisms\",\"pattern\":\"IR.?79|IR.?88|IR.?76|IR.?106|IR.?107|IR.?109|module_banner|DaemonReaper|kill.scop|0\\\\.4\\\\.1\",\"path\":\".worktrees/hertz-ir86-disk-delta/AGENTS.md;.worktrees/hertz-ir86-disk-delta/.github;.worktrees/hertz-ir86-disk-delta/xtask/src;.worktrees/hertz-ir86-disk-delta/traceable-reqs.toml;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_BWgHB0WgbZ4MGEdGwkEa3y09","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":14270.163399994373,"ttft":14237.342599987984,"completedAt":1789483683647,"contextSnapshot":{"promptTokens":101777,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"a78066f9","parentId":"322e9538","timestamp":"2026-09-15T14:48:03.712Z","message":{"role":"toolResult","toolCallId":"call_52Jm9jS2HvdzvgO7GV2Jtefh|fc_000c7cef03cac861016aa95aa394a087d1944f537678374a58","toolName":"read","content":[{"type":"text","text":"### IR-109 — a manifest `[placement] module_banner = \"accept\"` block LOOSENS the local checker to zero; CI's pinned checker is structurally blind to placement, so the loosening is invisible until the pin moves\n\n- **Status:** OPEN, RATIFIED 12:33Z (doyle, releases#304) as a TRANSITIONAL policy for the #304 head: the 0.4.1 pin stays (a tightening for every new tag), the accept key exempts only the 312 legacy banner tags, and this entry is the retirement ticket. Recorded 2026-09-11 12:10Z (doyle) from hertz's A/B/C and 0.2.0 arms; the commit's \"agreed\" is corrected by the ruling, not by rewriting a measured sha.\n- **Instance.** 33936943 \"chore(traceability): enable agreed placement policy\" (07:38Z, trailer todlando, on\n feat/304-remote-friction-product and test/304-remote-friction, NOT on main) adds `[placement] enforce = \"on\"`,\n `module_banner = \"accept\"`. The word \"agreed\" is UNRATIFIED: todlando cannot evidence it (his session that\n wrote it is gone) and doyle did not rule it.\n- **Measured, same binary 0.4.1, same tree 4b54a95d, manifest the only variable:** as-is exit 1 / 312\n misplaced_tag; block added exit 0 / 0; `enforce = \"on\"` alone exit 1 / 312. `module_banner` is the sole\n load-bearing key; enforce is the default already. CI-pinned 0.2.0 (golden.yml WANT=0.2.0) at the same sha:\n exit 0 / 0 — the `misplaced_tag` kind does not exist in that version; placement lives only in its `review`\n subcommand, which `check` never reaches. asm-304 (0c05e722, 0.4.1 + the block): exit 0, bought by the key.\n- **Why it matters.** AGENTS.md rule 1: tags sit on the evidence, never at file tops to satisfy coverage. The\n 312 are banner tags that violate it; the accept key retires them by policy rather than by moving one tag, and\n the gate that CI actually runs cannot see either state.\n- **Rule.** A checker config change that lowers a finding count is a loosening and is ruled on the record\n before it rides; \"agreed\" in a commit message is not a ruling. The honest statement of a zero under such a\n config names the config (\"zero under a manifest that accepts module banners\").\n- **Kin:** memory checker-version-must-match-ci-pin (live instance), [[IR-104]].\n- **CORRECTED 12:24Z (doyle):** the pin HAS moved on the W1 lane ancestry — 71caedd4 \"ci: pin traceable-reqs to v0.4.1\" (10:11Z) sits under 697eb398 (not on main), so ci.yml:253 and golden.yml:1424 both read WANT=0.4.1 at the integration head while origin/main reads WANT=0.2.0 at ci.yml:253 and golden.yml:1414. The accept key is therefore LIVE at the assembled golden gate today, not dormant: asm-304 reads 0 [must] under 0.4.1 because of the key. A lane off 697eb398 reads nine further [must] (code-stage tags in docs prose: F-035-CONFLICT, PUMP-W2-DESIGN, DEBUG-CONVERGE-PLAN, INFRA-REGISTER) that the assembly does not: measured at F-035-CONFLICT:47, 697eb398 carries the bracketed tags and origin/main carries them with brackets elided (\"so the checker\" clause), fixed on main between the merge-base f020c4c7 and 4b54a95d. Resolves at assembly by construction; not a fold-lane finding.\n- **Ripe when:** now — the key rides #304 only as a labelled hole named in the golden hand-off; retire by relocating the 312 tags and deleting the key in a lane of its own. · **Size:** 312 tag moves; the key.\n\n### IR-110 — the gater ruled a wave from origin/main's manifest while the milestone's own product lane already carried the surface; a second implementation was built to its W-1 END before the first was noticed\n\n- **Status:** OPEN, STOP LINE on #304 W2 (comment 5634187958). Recorded 2026-09-11 12:10Z (doyle, own instance).\n- **Instance.** feat/304-remote-friction-product @3e7eaf67 implements #297 TCP admission under\n REQ-WEB-LAN-BOOTSTRAP-FIREWALL (bootstrap_firewall.rs + windows.rs + linux.rs, lanhost/servehost/serveverb/cli\n call sites, docs-site section, ADR-0059 \"Amendment 2\" at d71df7aa): program-scoped Windows effector, all\n profiles, no remote restriction, zero tests in the module (six guard-level cells arrive with hertz 7b098cc2,\n none on scope). doyle deactivated its int stage the same morning and then ruled W2 fork (i) and let four\n REQ-LAN-BOOTSTRAP-* ids mint from ORIGIN/MAIN's manifest, where the id is absent (0 occurrences). todlando\n built build/304-w2-bootstrap-tcp @fe427497: a second, tested (E4 red at the bound-port assertion, 5/5, 981==981)\n netsh implementation, port+remote scoped, never program, a second \"## Amendment 2\" in the same ADR file.\n He found the collision at his W-1 END by reading the product lane, and touched nothing.\n- **Mechanism.** IR-106 from the gater's chair: the population enumerated (main's manifest) was not the\n population the claim was about (the milestone head's). The tell was available all morning — the gater's own\n deactivation note names the id — and a grep of the assembly worktree (asm-304) instead of the main checkout\n would have returned 1.\n- **Consequence.** The two texts disagree on a FACT (which rule shape admits TCP over the tailnet on this box;\n W-0 measured program scope admitting nothing for UDP only), both amendments share a heading, and an\n assembled head would run both start paths and write two rule sets.\n- **Rule.** Before minting or activating any id for a milestone wave, enumerate the ASSEMBLY head's manifest\n (asm-), not main's; a wave that \"closes\" a surface names the id it closes and greps the milestone\n head for it first. A fork ruling states the tree it enumerated.\n- **Kin:** [[IR-106]], [[IR-107]] (same day, same class in three chairs).\n- **Ripe when:** now — W-2a discriminating measurement in flight (arms A-D on the installed 5470 listener from\n kitsubito), then the fold ruling (one id, one ADR section, the tested decision seam + cells attached to the\n surviving effector). · **Size:** one measurement; one fold commit on the W2 lane; the ADR merge is a content\n decision, not a merge decision.\n- **Labelled hole (12:14Z):** bootstrap_firewall/linux.rs (676 lines) has ZERO #[test]; all six cells sit in bootstrap_firewall.rs and windows.rs. Under cfg the Linux arm is invisible to this box's unit lane, so the surviving id's unit stage reads green over an untested Linux backend set. Closed by a hertz cells lane run on kitsubito against ufw_scope / owned / backend (queued 12:14Z; ten cells red-first at be99017f, 12:41Z). RULE learned there: `ci.yml` lint runs clippy `--all-targets -D warnings` on kitsubito ONLY, and `--all-targets` lints cells as hard as product — a Linux-only red that no Windows gate sees caught todlando's `needless_borrow` (linux.rs:293, fixed be99017f) and hertz's own `cloned_ref_to_slice_refs` (linux.rs:891, test module) one hour apart; nextest 10/10 said nothing about either. Cells in a cfg-gated module pass clippy on that platform before the lane is clean. Structural fold ruling issued 12:13Z: surviving id REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM effector + pure RuleSpec/desired_spec/spec_satisfied_by seam, W2 netsh section removed, four minted ids deleted; scope constants and prose wait for W-2a arm C.\n\n### IR-111 — the installed product's own inbound UDP rule reads Duplicate / Inactive in ActiveStore, shadowed by the fallback rule; a by-name probe reads it green\n\n- **Status:** OPEN, product-side backlog candidate (REQ-INBOUND-WINDOWS-RULE-BINDER-PATH-MATCH family). Recorded\n 2026-09-11 12:14Z (doyle) from an unelevated `Get-NetFirewallRule` read of both stores on HFENDULEAM.\n- **Instance.** ActiveStore: `spt-core inbound UDP` (Program = installed spt.exe, Profile Any, UDP, Remote Any)\n Enabled=True, **Enforcement=Duplicate, PrimaryStatus=Inactive**; `spt-fallback inbound UDP` (same program,\n Profile Any) Enforcement=ProfileInactive Enforced, Status OK. PersistentStore shows both as\n Enforcement=NotApplicable, Status OK — the persistent view cannot see the shadowing at all.\n- **Why it matters.** The product's reconcile and the `inbound_block_hint` probe key on the product rule's NAME.\n The rule that is doing the work is the other one; delete or repoint the fallback and the product rule may\n become the enforced one with no change in what the name probe reports, or the reverse. Kin to the W1\n effector's own comment (\"never certify a rule which ActiveStore reports as ignored or ineffective\") — the\n UDP side never reads ActiveStore.\n- **Also seen, same read:** ~26 enforced program-scoped Private rules naming target/debug and actions-runner\n test binaries (spt_net-*, spt_daemon-*, spt.exe), Proto TCP+UDP, LPort Any, Remote Any — the rig-rule\n population the hfenduleam program-scope memory describes; none admits the tailnet.\n- **Rule.** A rule probe that certifies anything reads ActiveStore EnforcementStatus, not PersistentStore\n presence and not the name.\n- **Kin:** [[IR-110]], memory hfenduleam-program-scoped-firewall-rules-do-not-admit-tailnet.\n- **Ripe when:** the next inbound-rule wave, or when the W1 CIM two-store query is generalised to the UDP side.\n · **Size:** one ActiveStore read in the probe; one dedupe decision.\n\n### IR-112 — bare `cargo test -p spt-daemon --lib` reds two process-global cells on Linux at a sha where nextest is green; libtest is not a sound gate for this crate\n\n- **Status:** OPEN, rig rule (CI unaffected: `ci.yml` runs `kind(lib)` under nextest). Recorded 2026-09-11 12:46Z\n (doyle) from hertz's Linux cells lane END on kitsubito.\n- **Instance.** At 697eb398 on kitsubito: `cargo nextest list -p spt-daemon --lib` = 989 ids; `cargo test -p\n spt-daemon --lib` = 989 run, 987 passed, **2 FAILED, exit 101**:\n `answerop::tests::an_approval_notifies_a_plain_knocker_with_no_pre_authorization` (answerop.rs:324, \"expected\n exactly one courtesy: [] left: 0 right: 1\") and\n `brainproc::tests::the_ready_breadcrumb_tells_a_computed_hash_from_a_cached_one` (brainproc.rs:2347, \"the FIRST\n ready write in a process pays for the digest\"). Both PASS under nextest with the identical filter, exit 0.\n- **Mechanism.** Process-per-test vs one shared libtest process: both cells read process-global state (the\n brainproc one says so in its own panic text); under libtest a sibling's write is visible. IR-108's leaky-cell\n class, measured on Linux. Kin memory bystander-test-reads-process-global, daemon-lib-tests-deadlock-on-live-host.\n- **Rule.** A gate or rig over spt-daemon's lib runs NEXTEST; a `cargo test --lib` red on this crate is a rig\n fault until discriminated under nextest with the same filter. Count agreement (list == run) says nothing about\n exit agreement — check both.\n- **Kin:** [[IR-108]], [[IR-100]].\n- **Ripe when:** a sweep makes those two cells hermetic (the fix belongs to the cells, not the gate). · **Size:**\n two fixtures.\n\n### IR-113 — a killed mutation arm does not unwind: the subject stays mutated and the NEXT arm measures a tree nobody declared; and a mutation that reds on a compile error is a void arm that \"it compiled\" cannot detect\n\n- **Status:** OPEN, rig rule for every mutation driver. Recorded 2026-09-11 13:05Z (doyle) from todlando's FOLD-1b\n window (fold/304-w2-admission, windows.rs).\n- **Instance.** A first M1 injected an early return through a struct literal naming a helper that does not exist —\n a mutation that would red on E0425, not at the cell's assertion, i.e. a void red-first arm. The job was stopped\n mid-run; the driver's restore is its LAST line, so the kill left the MUTATED file on disk: working oid d8ddfdf3\n against pristine 1f475a80, two residue markers present. Caught only because the next act was an oid compare, not\n the next arm. Restored and re-measured identical (residue 0, 786 == 786 lines). Second half: clippy on the\n mutated tree exited 0, so \"it compiled\" would not have exposed the void arm either.\n- **Mechanism.** Mutate → run → restore is not transactional; any exit before the last line (kill, timeout, crash,\n nextest hang) strands the mutation. A void arm is one whose red is not AT the assertion the prediction named.\n- **Rule.** (1) A mutation driver restores in a finally/trap path, and every arm BEGINS by asserting the subject's\n oid equals the declared pristine oid — the previous arm's revert is proven at the next arm's start, not trusted.\n (2) A red-first arm is accepted only when the artifact names the predicted assertion line; a compile-error red,\n a panic elsewhere, or a red at a different line is VOID, not a pass and not a fail. (3) Mutations are one-token\n edits with an anchor count asserted at 1; an arm that did not change the file voids itself loudly.\n- **Kin:** [[IR-107]] (revert proven by oid AND byte shape), memory scripted-edit-zero-match-refusal,\n make-a-new-rig-red-on-purpose.\n- **Ripe when:** now — the rule is cheap and the drivers exist; every lane's driver adopts it at its next edit. ·\n **Size:** a trap/finally and one oid compare per arm.\n\n### IR-114 — three hands wrote one firewall rule set inside ninety seconds under two directors; every census was true at its instant and false a minute later\n\n- **Status:** OPEN, procedure ruled 2026-09-12 00:50Z (doyle) on todlando's reconciliation; recorded 00:52Z.\n- **Instance.** #304 W-2a arms on HFENDULEAM: ~00:44Z todlando asked the operator to delete spt-w2a-C so B would stand alone; ~00:45Z the operator said \"C down\" and todlando's census read B present / C absent (true then); 00:45:05Z liam ADDED C at doyle's direction (doyle had been idle 11 h and did not know the operator's window); 00:46:14Z liam DELETED B at doyle's direction; 00:49:09Z todlando re-measured C present / B absent. Nobody was wrong; the population was not stable. Every fetch todlando reported had an adjacent census and stands; a long background census that straddled the writes returned no spt-w2a rows at all and is UNMEASURED. Separately, doyle's drop-log arm crossed liam's revert in flight: three fetches ran with logging already off — a void arm, redone.\n- **Mechanism.** Two directors (operator, gater) each driving a different elevated hand against the same shared host state, neither seeing the other's window; a census taken as a separate earlier step and carried forward.\n- **Rule.** For any arm on shared host state: ONE WRITER; the census is taken BY THE FETCHER in the SAME command as the fetch, before and after; the prediction names the exact expected population (an unexpected row is a red); every write is announced with its UTC time to every party; a director resuming after a gap re-measures the population before issuing a write. Kin: memory verify-the-subject-not-just-the-measurement, name-the-file-and-sha.\n- **Also measured tonight (todlando):** 'spt-core daemon' (proto Any, Private, remote Any, program = the listener's exe) covers the Private-classified Tailscale interface while TCP 5470 times out from kitsubito and the LAN address answers 200 with ICMP alive — so W-0 measured the tailnet ACL, not program scoping, and DESIRED_PROGRAM=false's cited justification is VOID (the constant may still be right; its citation is not). The shape question moves to a throwaway port and listener over the LAN (arm E).\n- **Ripe when:** now — the rule costs nothing. · **Size:** procedure.\n\n### IR-115 — a firewall census whose port test is DENIED reads every rule as port=Any and counts port-scoped rules as blanket; a `netsh show rule` without `verbose` omits Program and reads every rule as program=Any; a control count that merges two agents' reads is nobody's control\n\n- **Status:** OPEN, mechanisms recorded 2026-09-12 01:14Z (doyle) from todlando's and liam's own corrections during #304 arm E.\n- **Instances.** (1) todlando's first census A (\"26 blanket rules\") and B (\"occupied LocalPort set: EMPTY\"): `Get-NetFirewallPortFilter -All` returns \"Access is denied\" unelevated, the probe swallowed the denial, every rule read as port=Any, and B's positive control (the hand rule carries LocalPort 5470) is what caught it. (2) His replacement pass: `netsh advfirewall firewall show rule name=all` without `verbose` prints no Program line, so it reported 417 blankets and ZERO rules naming spt.exe — provably false, caught by the same control. The third pass (`dir=in verbose`) passed both controls (port-5470 rows = 1, spt.exe rows = 7) and was the census used. (3) doyle's fetcher: first census predicate listed port-covering and program-covering rules as two separate sets; the reaching set is their CONJUNCTION (plus LocalIP, which the first predicate lacked and which is what scopes `Tailscale-In` to the tailnet address only). (4) liam's \"3/3 200\" loopback count merged two of his reads with three of doyle's re-reads as reported; liam corrected it himself. (5) doyle's one in-arm loopback read of 000 at 01:04:22Z had no exit code captured; it is carried as a labelled hole, not classified by a later burst (a later instant cannot classify an earlier read).\n- **Mechanism.** A denied or under-scoped read does not error; it returns the permissive default for the field it could not see, so the census reads MORE admits than exist and a shape question gets decided on a phantom population. Kin: memory a-predicate-without-its-tool-is-not-evidence, verdict-from-probe-competence, zero-match-filter-reads-as-absent.\n- **Rule.** A firewall census names its tool and privilege and carries two positive controls in the SAME dump: one rule known to carry a specific LocalPort, one known to name a specific Program. A census that cannot see both has not seen the population. The reaching predicate is port-covers AND program-covers AND LocalIP-covers AND profile-covers, one set. Every loopback and remote read records its curl exit code. Counts are per agent; a merged count is restated per agent or discarded.\n- **Ripe when:** now — the rule costs one grep. · **Size:** procedure.\n\n- **Addendum 2026-09-12 03:20Z (doyle, #304 W-2 A5/A4): the Windows Firewall event log is DIRECTION-BLIND, so a rig that keys \"written\" or \"removed\" on it cannot fail in the direction it claims.** Population controlled over one read (2011x48 / 2052x6 / 2097x6, a 400-event re-read of the same window returning the identical six): id 2052 fires on creates AND deletes in the observed population, id 2097 is create-specific, and NOTHING observed is delete-specific. The CENSUS carries the sign; the log carries only the instant. The same read established a MEASURED gap (zero events between A5's end and A4's start) and that nothing commits after the client dies — both usable, neither a direction. Kin: the firewall status fields do not discriminate either, since an admitting hand rule reads the same `PrimaryStatus`/`EnforcementStatus` strings as a non-admitting product pair on the same query.\n\n### IR-116 — a watchdog that calls a killer and then echoes success reports a kill it never made; `pkill` is absent in msys, so the guard logged \"stopped\" while the arm it guarded ran on\n\n- **Status:** OPEN, mechanism recorded 2026-09-12 01:24Z (todlando) from his own guard during #304 FOLD-2's Windows arm at 7357ea32; doyle asked for the line.\n- **Instance.** todlando armed a watchdog to stop a test arm before it reached `cargo test --workspace --lib`, because spt-daemon lib tests deadlock on a live host. Shape: `if grep -q \"CLIPPY_EXIT=\" log; then pkill -f \"bash /tmp/arms.sh\" 2>/dev/null; echo \"GUARD: arms.sh stopped after clippy at $(date -u)\"`. It printed `GUARD: arms.sh stopped after clippy at 01:24:06Z`. Nothing was stopped: `pkill` does not exist in this msys/Git-Bash environment (`command not found`, exit 127), `2>/dev/null` ate the message, and the `echo` was never gated on the killer's exit. The arm ran on into its compile phase and was found by tailing the build log, not by the guard — whose only output was a green.\n- **Mechanism.** Two defects stack, and either alone would have been caught by the other: a missing binary, and a success line that cannot fail. Same family as IR-107 seen from the other side — there a trailing command's exit was mistaken for the producer's; here no exit was consulted at all. The aggravating factor is WHERE it lives: a guard is written while thinking about the hazard it guards, not about the guard, and a guard that never fires looks identical to a guard that works. Kin: memory watchdog-reports-a-kill-it-never-made, verdict-from-exit-not-from-silence, a-predicate-without-its-tool-is-not-evidence.\n- **Rule.** A watchdog asserts the POST-STATE and never echoes after the call: `kill …; sleep 1; if still_running; then echo \"GUARD FAILED\"; exit 1; fi`. On msys use `kill -9 ` with a pid you resolved yourself, or `taskkill //PID //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.\n- **Second-order, and it bit me inside this very entry.** `git checkout -- ` restores from the INDEX, not HEAD. Having staged a first draft, I \"reverted\" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.\n- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).\n- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{\"message\":\"Successfully stopped task: bn74vtqn0\"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the post-state after every stop, whatever the stopping tool said.** Aggravating detail worth its own note — hertz had todlando's disclosure of this exact shape in context and ran it anyway four minutes later; a hazard report describes a SHAPE, and remembering the INSTANCE is not being inoculated against the shape.\n- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.\n\n\n[Showing lines 6567-6711 of 6938. Use :6712 to continue]"}],"details":{"truncation":{"content":"### IR-109 — a manifest `[placement] module_banner = \"accept\"` block LOOSENS the local checker to zero; CI's pinned checker is structurally blind to placement, so the loosening is invisible until the pin moves\r\n\r\n- **Status:** OPEN, RATIFIED 12:33Z (doyle, releases#304) as a TRANSITIONAL policy for the #304 head: the 0.4.1 pin stays (a tightening for every new tag), the accept key exempts only the 312 legacy banner tags, and this entry is the retirement ticket. Recorded 2026-09-11 12:10Z (doyle) from hertz's A/B/C and 0.2.0 arms; the commit's \"agreed\" is corrected by the ruling, not by rewriting a measured sha.\r\n- **Instance.** 33936943 \"chore(traceability): enable agreed placement policy\" (07:38Z, trailer todlando, on\r\n feat/304-remote-friction-product and test/304-remote-friction, NOT on main) adds `[placement] enforce = \"on\"`,\r\n `module_banner = \"accept\"`. The word \"agreed\" is UNRATIFIED: todlando cannot evidence it (his session that\r\n wrote it is gone) and doyle did not rule it.\r\n- **Measured, same binary 0.4.1, same tree 4b54a95d, manifest the only variable:** as-is exit 1 / 312\r\n misplaced_tag; block added exit 0 / 0; `enforce = \"on\"` alone exit 1 / 312. `module_banner` is the sole\r\n load-bearing key; enforce is the default already. CI-pinned 0.2.0 (golden.yml WANT=0.2.0) at the same sha:\r\n exit 0 / 0 — the `misplaced_tag` kind does not exist in that version; placement lives only in its `review`\r\n subcommand, which `check` never reaches. asm-304 (0c05e722, 0.4.1 + the block): exit 0, bought by the key.\r\n- **Why it matters.** AGENTS.md rule 1: tags sit on the evidence, never at file tops to satisfy coverage. The\r\n 312 are banner tags that violate it; the accept key retires them by policy rather than by moving one tag, and\r\n the gate that CI actually runs cannot see either state.\r\n- **Rule.** A checker config change that lowers a finding count is a loosening and is ruled on the record\r\n before it rides; \"agreed\" in a commit message is not a ruling. The honest statement of a zero under such a\r\n config names the config (\"zero under a manifest that accepts module banners\").\r\n- **Kin:** memory checker-version-must-match-ci-pin (live instance), [[IR-104]].\r\n- **CORRECTED 12:24Z (doyle):** the pin HAS moved on the W1 lane ancestry — 71caedd4 \"ci: pin traceable-reqs to v0.4.1\" (10:11Z) sits under 697eb398 (not on main), so ci.yml:253 and golden.yml:1424 both read WANT=0.4.1 at the integration head while origin/main reads WANT=0.2.0 at ci.yml:253 and golden.yml:1414. The accept key is therefore LIVE at the assembled golden gate today, not dormant: asm-304 reads 0 [must] under 0.4.1 because of the key. A lane off 697eb398 reads nine further [must] (code-stage tags in docs prose: F-035-CONFLICT, PUMP-W2-DESIGN, DEBUG-CONVERGE-PLAN, INFRA-REGISTER) that the assembly does not: measured at F-035-CONFLICT:47, 697eb398 carries the bracketed tags and origin/main carries them with brackets elided (\"so the checker\" clause), fixed on main between the merge-base f020c4c7 and 4b54a95d. Resolves at assembly by construction; not a fold-lane finding.\r\n- **Ripe when:** now — the key rides #304 only as a labelled hole named in the golden hand-off; retire by relocating the 312 tags and deleting the key in a lane of its own. · **Size:** 312 tag moves; the key.\r\n\r\n### IR-110 — the gater ruled a wave from origin/main's manifest while the milestone's own product lane already carried the surface; a second implementation was built to its W-1 END before the first was noticed\r\n\r\n- **Status:** OPEN, STOP LINE on #304 W2 (comment 5634187958). Recorded 2026-09-11 12:10Z (doyle, own instance).\r\n- **Instance.** feat/304-remote-friction-product @3e7eaf67 implements #297 TCP admission under\r\n REQ-WEB-LAN-BOOTSTRAP-FIREWALL (bootstrap_firewall.rs + windows.rs + linux.rs, lanhost/servehost/serveverb/cli\r\n call sites, docs-site section, ADR-0059 \"Amendment 2\" at d71df7aa): program-scoped Windows effector, all\r\n profiles, no remote restriction, zero tests in the module (six guard-level cells arrive with hertz 7b098cc2,\r\n none on scope). doyle deactivated its int stage the same morning and then ruled W2 fork (i) and let four\r\n REQ-LAN-BOOTSTRAP-* ids mint from ORIGIN/MAIN's manifest, where the id is absent (0 occurrences). todlando\r\n built build/304-w2-bootstrap-tcp @fe427497: a second, tested (E4 red at the bound-port assertion, 5/5, 981==981)\r\n netsh implementation, port+remote scoped, never program, a second \"## Amendment 2\" in the same ADR file.\r\n He found the collision at his W-1 END by reading the product lane, and touched nothing.\r\n- **Mechanism.** IR-106 from the gater's chair: the population enumerated (main's manifest) was not the\r\n population the claim was about (the milestone head's). The tell was available all morning — the gater's own\r\n deactivation note names the id — and a grep of the assembly worktree (asm-304) instead of the main checkout\r\n would have returned 1.\r\n- **Consequence.** The two texts disagree on a FACT (which rule shape admits TCP over the tailnet on this box;\r\n W-0 measured program scope admitting nothing for UDP only), both amendments share a heading, and an\r\n assembled head would run both start paths and write two rule sets.\r\n- **Rule.** Before minting or activating any id for a milestone wave, enumerate the ASSEMBLY head's manifest\r\n (asm-), not main's; a wave that \"closes\" a surface names the id it closes and greps the milestone\r\n head for it first. A fork ruling states the tree it enumerated.\r\n- **Kin:** [[IR-106]], [[IR-107]] (same day, same class in three chairs).\r\n- **Ripe when:** now — W-2a discriminating measurement in flight (arms A-D on the installed 5470 listener from\r\n kitsubito), then the fold ruling (one id, one ADR section, the tested decision seam + cells attached to the\r\n surviving effector). · **Size:** one measurement; one fold commit on the W2 lane; the ADR merge is a content\r\n decision, not a merge decision.\r\n- **Labelled hole (12:14Z):** bootstrap_firewall/linux.rs (676 lines) has ZERO #[test]; all six cells sit in bootstrap_firewall.rs and windows.rs. Under cfg the Linux arm is invisible to this box's unit lane, so the surviving id's unit stage reads green over an untested Linux backend set. Closed by a hertz cells lane run on kitsubito against ufw_scope / owned / backend (queued 12:14Z; ten cells red-first at be99017f, 12:41Z). RULE learned there: `ci.yml` lint runs clippy `--all-targets -D warnings` on kitsubito ONLY, and `--all-targets` lints cells as hard as product — a Linux-only red that no Windows gate sees caught todlando's `needless_borrow` (linux.rs:293, fixed be99017f) and hertz's own `cloned_ref_to_slice_refs` (linux.rs:891, test module) one hour apart; nextest 10/10 said nothing about either. Cells in a cfg-gated module pass clippy on that platform before the lane is clean. Structural fold ruling issued 12:13Z: surviving id REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM effector + pure RuleSpec/desired_spec/spec_satisfied_by seam, W2 netsh section removed, four minted ids deleted; scope constants and prose wait for W-2a arm C.\r\n\r\n### IR-111 — the installed product's own inbound UDP rule reads Duplicate / Inactive in ActiveStore, shadowed by the fallback rule; a by-name probe reads it green\r\n\r\n- **Status:** OPEN, product-side backlog candidate (REQ-INBOUND-WINDOWS-RULE-BINDER-PATH-MATCH family). Recorded\r\n 2026-09-11 12:14Z (doyle) from an unelevated `Get-NetFirewallRule` read of both stores on HFENDULEAM.\r\n- **Instance.** ActiveStore: `spt-core inbound UDP` (Program = installed spt.exe, Profile Any, UDP, Remote Any)\r\n Enabled=True, **Enforcement=Duplicate, PrimaryStatus=Inactive**; `spt-fallback inbound UDP` (same program,\r\n Profile Any) Enforcement=ProfileInactive Enforced, Status OK. PersistentStore shows both as\r\n Enforcement=NotApplicable, Status OK — the persistent view cannot see the shadowing at all.\r\n- **Why it matters.** The product's reconcile and the `inbound_block_hint` probe key on the product rule's NAME.\r\n The rule that is doing the work is the other one; delete or repoint the fallback and the product rule may\r\n become the enforced one with no change in what the name probe reports, or the reverse. Kin to the W1\r\n effector's own comment (\"never certify a rule which ActiveStore reports as ignored or ineffective\") — the\r\n UDP side never reads ActiveStore.\r\n- **Also seen, same read:** ~26 enforced program-scoped Private rules naming target/debug and actions-runner\r\n test binaries (spt_net-*, spt_daemon-*, spt.exe), Proto TCP+UDP, LPort Any, Remote Any — the rig-rule\r\n population the hfenduleam program-scope memory describes; none admits the tailnet.\r\n- **Rule.** A rule probe that certifies anything reads ActiveStore EnforcementStatus, not PersistentStore\r\n presence and not the name.\r\n- **Kin:** [[IR-110]], memory hfenduleam-program-scoped-firewall-rules-do-not-admit-tailnet.\r\n- **Ripe when:** the next inbound-rule wave, or when the W1 CIM two-store query is generalised to the UDP side.\r\n · **Size:** one ActiveStore read in the probe; one dedupe decision.\r\n\r\n### IR-112 — bare `cargo test -p spt-daemon --lib` reds two process-global cells on Linux at a sha where nextest is green; libtest is not a sound gate for this crate\r\n\r\n- **Status:** OPEN, rig rule (CI unaffected: `ci.yml` runs `kind(lib)` under nextest). Recorded 2026-09-11 12:46Z\r\n (doyle) from hertz's Linux cells lane END on kitsubito.\r\n- **Instance.** At 697eb398 on kitsubito: `cargo nextest list -p spt-daemon --lib` = 989 ids; `cargo test -p\r\n spt-daemon --lib` = 989 run, 987 passed, **2 FAILED, exit 101**:\r\n `answerop::tests::an_approval_notifies_a_plain_knocker_with_no_pre_authorization` (answerop.rs:324, \"expected\r\n exactly one courtesy: [] left: 0 right: 1\") and\r\n `brainproc::tests::the_ready_breadcrumb_tells_a_computed_hash_from_a_cached_one` (brainproc.rs:2347, \"the FIRST\r\n ready write in a process pays for the digest\"). Both PASS under nextest with the identical filter, exit 0.\r\n- **Mechanism.** Process-per-test vs one shared libtest process: both cells read process-global state (the\r\n brainproc one says so in its own panic text); under libtest a sibling's write is visible. IR-108's leaky-cell\r\n class, measured on Linux. Kin memory bystander-test-reads-process-global, daemon-lib-tests-deadlock-on-live-host.\r\n- **Rule.** A gate or rig over spt-daemon's lib runs NEXTEST; a `cargo test --lib` red on this crate is a rig\r\n fault until discriminated under nextest with the same filter. Count agreement (list == run) says nothing about\r\n exit agreement — check both.\r\n- **Kin:** [[IR-108]], [[IR-100]].\r\n- **Ripe when:** a sweep makes those two cells hermetic (the fix belongs to the cells, not the gate). · **Size:**\r\n two fixtures.\r\n\r\n### IR-113 — a killed mutation arm does not unwind: the subject stays mutated and the NEXT arm measures a tree nobody declared; and a mutation that reds on a compile error is a void arm that \"it compiled\" cannot detect\r\n\r\n- **Status:** OPEN, rig rule for every mutation driver. Recorded 2026-09-11 13:05Z (doyle) from todlando's FOLD-1b\r\n window (fold/304-w2-admission, windows.rs).\r\n- **Instance.** A first M1 injected an early return through a struct literal naming a helper that does not exist —\r\n a mutation that would red on E0425, not at the cell's assertion, i.e. a void red-first arm. The job was stopped\r\n mid-run; the driver's restore is its LAST line, so the kill left the MUTATED file on disk: working oid d8ddfdf3\r\n against pristine 1f475a80, two residue markers present. Caught only because the next act was an oid compare, not\r\n the next arm. Restored and re-measured identical (residue 0, 786 == 786 lines). Second half: clippy on the\r\n mutated tree exited 0, so \"it compiled\" would not have exposed the void arm either.\r\n- **Mechanism.** Mutate → run → restore is not transactional; any exit before the last line (kill, timeout, crash,\r\n nextest hang) strands the mutation. A void arm is one whose red is not AT the assertion the prediction named.\r\n- **Rule.** (1) A mutation driver restores in a finally/trap path, and every arm BEGINS by asserting the subject's\r\n oid equals the declared pristine oid — the previous arm's revert is proven at the next arm's start, not trusted.\r\n (2) A red-first arm is accepted only when the artifact names the predicted assertion line; a compile-error red,\r\n a panic elsewhere, or a red at a different line is VOID, not a pass and not a fail. (3) Mutations are one-token\r\n edits with an anchor count asserted at 1; an arm that did not change the file voids itself loudly.\r\n- **Kin:** [[IR-107]] (revert proven by oid AND byte shape), memory scripted-edit-zero-match-refusal,\r\n make-a-new-rig-red-on-purpose.\r\n- **Ripe when:** now — the rule is cheap and the drivers exist; every lane's driver adopts it at its next edit. ·\r\n **Size:** a trap/finally and one oid compare per arm.\r\n\r\n### IR-114 — three hands wrote one firewall rule set inside ninety seconds under two directors; every census was true at its instant and false a minute later\r\n\r\n- **Status:** OPEN, procedure ruled 2026-09-12 00:50Z (doyle) on todlando's reconciliation; recorded 00:52Z.\r\n- **Instance.** #304 W-2a arms on HFENDULEAM: ~00:44Z todlando asked the operator to delete spt-w2a-C so B would stand alone; ~00:45Z the operator said \"C down\" and todlando's census read B present / C absent (true then); 00:45:05Z liam ADDED C at doyle's direction (doyle had been idle 11 h and did not know the operator's window); 00:46:14Z liam DELETED B at doyle's direction; 00:49:09Z todlando re-measured C present / B absent. Nobody was wrong; the population was not stable. Every fetch todlando reported had an adjacent census and stands; a long background census that straddled the writes returned no spt-w2a rows at all and is UNMEASURED. Separately, doyle's drop-log arm crossed liam's revert in flight: three fetches ran with logging already off — a void arm, redone.\r\n- **Mechanism.** Two directors (operator, gater) each driving a different elevated hand against the same shared host state, neither seeing the other's window; a census taken as a separate earlier step and carried forward.\r\n- **Rule.** For any arm on shared host state: ONE WRITER; the census is taken BY THE FETCHER in the SAME command as the fetch, before and after; the prediction names the exact expected population (an unexpected row is a red); every write is announced with its UTC time to every party; a director resuming after a gap re-measures the population before issuing a write. Kin: memory verify-the-subject-not-just-the-measurement, name-the-file-and-sha.\r\n- **Also measured tonight (todlando):** 'spt-core daemon' (proto Any, Private, remote Any, program = the listener's exe) covers the Private-classified Tailscale interface while TCP 5470 times out from kitsubito and the LAN address answers 200 with ICMP alive — so W-0 measured the tailnet ACL, not program scoping, and DESIRED_PROGRAM=false's cited justification is VOID (the constant may still be right; its citation is not). The shape question moves to a throwaway port and listener over the LAN (arm E).\r\n- **Ripe when:** now — the rule costs nothing. · **Size:** procedure.\r\n\r\n### IR-115 — a firewall census whose port test is DENIED reads every rule as port=Any and counts port-scoped rules as blanket; a `netsh show rule` without `verbose` omits Program and reads every rule as program=Any; a control count that merges two agents' reads is nobody's control\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 01:14Z (doyle) from todlando's and liam's own corrections during #304 arm E.\r\n- **Instances.** (1) todlando's first census A (\"26 blanket rules\") and B (\"occupied LocalPort set: EMPTY\"): `Get-NetFirewallPortFilter -All` returns \"Access is denied\" unelevated, the probe swallowed the denial, every rule read as port=Any, and B's positive control (the hand rule carries LocalPort 5470) is what caught it. (2) His replacement pass: `netsh advfirewall firewall show rule name=all` without `verbose` prints no Program line, so it reported 417 blankets and ZERO rules naming spt.exe — provably false, caught by the same control. The third pass (`dir=in verbose`) passed both controls (port-5470 rows = 1, spt.exe rows = 7) and was the census used. (3) doyle's fetcher: first census predicate listed port-covering and program-covering rules as two separate sets; the reaching set is their CONJUNCTION (plus LocalIP, which the first predicate lacked and which is what scopes `Tailscale-In` to the tailnet address only). (4) liam's \"3/3 200\" loopback count merged two of his reads with three of doyle's re-reads as reported; liam corrected it himself. (5) doyle's one in-arm loopback read of 000 at 01:04:22Z had no exit code captured; it is carried as a labelled hole, not classified by a later burst (a later instant cannot classify an earlier read).\r\n- **Mechanism.** A denied or under-scoped read does not error; it returns the permissive default for the field it could not see, so the census reads MORE admits than exist and a shape question gets decided on a phantom population. Kin: memory a-predicate-without-its-tool-is-not-evidence, verdict-from-probe-competence, zero-match-filter-reads-as-absent.\r\n- **Rule.** A firewall census names its tool and privilege and carries two positive controls in the SAME dump: one rule known to carry a specific LocalPort, one known to name a specific Program. A census that cannot see both has not seen the population. The reaching predicate is port-covers AND program-covers AND LocalIP-covers AND profile-covers, one set. Every loopback and remote read records its curl exit code. Counts are per agent; a merged count is restated per agent or discarded.\r\n- **Ripe when:** now — the rule costs one grep. · **Size:** procedure.\r\n\r\n- **Addendum 2026-09-12 03:20Z (doyle, #304 W-2 A5/A4): the Windows Firewall event log is DIRECTION-BLIND, so a rig that keys \"written\" or \"removed\" on it cannot fail in the direction it claims.** Population controlled over one read (2011x48 / 2052x6 / 2097x6, a 400-event re-read of the same window returning the identical six): id 2052 fires on creates AND deletes in the observed population, id 2097 is create-specific, and NOTHING observed is delete-specific. The CENSUS carries the sign; the log carries only the instant. The same read established a MEASURED gap (zero events between A5's end and A4's start) and that nothing commits after the client dies — both usable, neither a direction. Kin: the firewall status fields do not discriminate either, since an admitting hand rule reads the same `PrimaryStatus`/`EnforcementStatus` strings as a non-admitting product pair on the same query.\r\n\r\n### IR-116 — a watchdog that calls a killer and then echoes success reports a kill it never made; `pkill` is absent in msys, so the guard logged \"stopped\" while the arm it guarded ran on\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 01:24Z (todlando) from his own guard during #304 FOLD-2's Windows arm at 7357ea32; doyle asked for the line.\r\n- **Instance.** todlando armed a watchdog to stop a test arm before it reached `cargo test --workspace --lib`, because spt-daemon lib tests deadlock on a live host. Shape: `if grep -q \"CLIPPY_EXIT=\" log; then pkill -f \"bash /tmp/arms.sh\" 2>/dev/null; echo \"GUARD: arms.sh stopped after clippy at $(date -u)\"`. It printed `GUARD: arms.sh stopped after clippy at 01:24:06Z`. Nothing was stopped: `pkill` does not exist in this msys/Git-Bash environment (`command not found`, exit 127), `2>/dev/null` ate the message, and the `echo` was never gated on the killer's exit. The arm ran on into its compile phase and was found by tailing the build log, not by the guard — whose only output was a green.\r\n- **Mechanism.** Two defects stack, and either alone would have been caught by the other: a missing binary, and a success line that cannot fail. Same family as IR-107 seen from the other side — there a trailing command's exit was mistaken for the producer's; here no exit was consulted at all. The aggravating factor is WHERE it lives: a guard is written while thinking about the hazard it guards, not about the guard, and a guard that never fires looks identical to a guard that works. Kin: memory watchdog-reports-a-kill-it-never-made, verdict-from-exit-not-from-silence, a-predicate-without-its-tool-is-not-evidence.\r\n- **Rule.** A watchdog asserts the POST-STATE and never echoes after the call: `kill …; sleep 1; if still_running; then echo \"GUARD FAILED\"; exit 1; fi`. On msys use `kill -9 ` with a pid you resolved yourself, or `taskkill //PID //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.\r\n- **Second-order, and it bit me inside this very entry.** `git checkout -- ` restores from the INDEX, not HEAD. Having staged a first draft, I \"reverted\" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.\r\n- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).\r\n- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{\"message\":\"Successfully stopped task: bn74vtqn0\"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the post-state after every stop, whatever the stopping tool said.** Aggravating detail worth its own note — hertz had todlando's disclosure of this exact shape in context and ran it anyway four minutes later; a hazard report describes a SHAPE, and remembering the INSTANCE is not being inoculated against the shape.\r\n- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.\r\n\r","truncated":true,"truncatedBy":"lines","totalLines":372,"totalBytes":22853,"outputLines":145,"outputBytes":22853,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6938,"displayContent":{"text":"### IR-109 — a manifest `[placement] module_banner = \"accept\"` block LOOSENS the local checker to zero; CI's pinned checker is structurally blind to placement, so the loosening is invisible until the pin moves\r\n\r\n- **Status:** OPEN, RATIFIED 12:33Z (doyle, releases#304) as a TRANSITIONAL policy for the #304 head: the 0.4.1 pin stays (a tightening for every new tag), the accept key exempts only the 312 legacy banner tags, and this entry is the retirement ticket. Recorded 2026-09-11 12:10Z (doyle) from hertz's A/B/C and 0.2.0 arms; the commit's \"agreed\" is corrected by the ruling, not by rewriting a measured sha.\r\n- **Instance.** 33936943 \"chore(traceability): enable agreed placement policy\" (07:38Z, trailer todlando, on\r\n feat/304-remote-friction-product and test/304-remote-friction, NOT on main) adds `[placement] enforce = \"on\"`,\r\n `module_banner = \"accept\"`. The word \"agreed\" is UNRATIFIED: todlando cannot evidence it (his session that\r\n wrote it is gone) and doyle did not rule it.\r\n- **Measured, same binary 0.4.1, same tree 4b54a95d, manifest the only variable:** as-is exit 1 / 312\r\n misplaced_tag; block added exit 0 / 0; `enforce = \"on\"` alone exit 1 / 312. `module_banner` is the sole\r\n load-bearing key; enforce is the default already. CI-pinned 0.2.0 (golden.yml WANT=0.2.0) at the same sha:\r\n exit 0 / 0 — the `misplaced_tag` kind does not exist in that version; placement lives only in its `review`\r\n subcommand, which `check` never reaches. asm-304 (0c05e722, 0.4.1 + the block): exit 0, bought by the key.\r\n- **Why it matters.** AGENTS.md rule 1: tags sit on the evidence, never at file tops to satisfy coverage. The\r\n 312 are banner tags that violate it; the accept key retires them by policy rather than by moving one tag, and\r\n the gate that CI actually runs cannot see either state.\r\n- **Rule.** A checker config change that lowers a finding count is a loosening and is ruled on the record\r\n before it rides; \"agreed\" in a commit message is not a ruling. The honest statement of a zero under such a\r\n config names the config (\"zero under a manifest that accepts module banners\").\r\n- **Kin:** memory checker-version-must-match-ci-pin (live instance), [[IR-104]].\r\n- **CORRECTED 12:24Z (doyle):** the pin HAS moved on the W1 lane ancestry — 71caedd4 \"ci: pin traceable-reqs to v0.4.1\" (10:11Z) sits under 697eb398 (not on main), so ci.yml:253 and golden.yml:1424 both read WANT=0.4.1 at the integration head while origin/main reads WANT=0.2.0 at ci.yml:253 and golden.yml:1414. The accept key is therefore LIVE at the assembled golden gate today, not dormant: asm-304 reads 0 [must] under 0.4.1 because of the key. A lane off 697eb398 reads nine further [must] (code-stage tags in docs prose: F-035-CONFLICT, PUMP-W2-DESIGN, DEBUG-CONVERGE-PLAN, INFRA-REGISTER) that the assembly does not: measured at F-035-CONFLICT:47, 697eb398 carries the bracketed tags and origin/main carries them with brackets elided (\"so the checker\" clause), fixed on main between the merge-base f020c4c7 and 4b54a95d. Resolves at assembly by construction; not a fold-lane finding.\r\n- **Ripe when:** now — the key rides #304 only as a labelled hole named in the golden hand-off; retire by relocating the 312 tags and deleting the key in a lane of its own. · **Size:** 312 tag moves; the key.\r\n\r\n### IR-110 — the gater ruled a wave from origin/main's manifest while the milestone's own product lane already carried the surface; a second implementation was built to its W-1 END before the first was noticed\r\n\r\n- **Status:** OPEN, STOP LINE on #304 W2 (comment 5634187958). Recorded 2026-09-11 12:10Z (doyle, own instance).\r\n- **Instance.** feat/304-remote-friction-product @3e7eaf67 implements #297 TCP admission under\r\n REQ-WEB-LAN-BOOTSTRAP-FIREWALL (bootstrap_firewall.rs + windows.rs + linux.rs, lanhost/servehost/serveverb/cli\r\n call sites, docs-site section, ADR-0059 \"Amendment 2\" at d71df7aa): program-scoped Windows effector, all\r\n profiles, no remote restriction, zero tests in the module (six guard-level cells arrive with hertz 7b098cc2,\r\n none on scope). doyle deactivated its int stage the same morning and then ruled W2 fork (i) and let four\r\n REQ-LAN-BOOTSTRAP-* ids mint from ORIGIN/MAIN's manifest, where the id is absent (0 occurrences). todlando\r\n built build/304-w2-bootstrap-tcp @fe427497: a second, tested (E4 red at the bound-port assertion, 5/5, 981==981)\r\n netsh implementation, port+remote scoped, never program, a second \"## Amendment 2\" in the same ADR file.\r\n He found the collision at his W-1 END by reading the product lane, and touched nothing.\r\n- **Mechanism.** IR-106 from the gater's chair: the population enumerated (main's manifest) was not the\r\n population the claim was about (the milestone head's). The tell was available all morning — the gater's own\r\n deactivation note names the id — and a grep of the assembly worktree (asm-304) instead of the main checkout\r\n would have returned 1.\r\n- **Consequence.** The two texts disagree on a FACT (which rule shape admits TCP over the tailnet on this box;\r\n W-0 measured program scope admitting nothing for UDP only), both amendments share a heading, and an\r\n assembled head would run both start paths and write two rule sets.\r\n- **Rule.** Before minting or activating any id for a milestone wave, enumerate the ASSEMBLY head's manifest\r\n (asm-), not main's; a wave that \"closes\" a surface names the id it closes and greps the milestone\r\n head for it first. A fork ruling states the tree it enumerated.\r\n- **Kin:** [[IR-106]], [[IR-107]] (same day, same class in three chairs).\r\n- **Ripe when:** now — W-2a discriminating measurement in flight (arms A-D on the installed 5470 listener from\r\n kitsubito), then the fold ruling (one id, one ADR section, the tested decision seam + cells attached to the\r\n surviving effector). · **Size:** one measurement; one fold commit on the W2 lane; the ADR merge is a content\r\n decision, not a merge decision.\r\n- **Labelled hole (12:14Z):** bootstrap_firewall/linux.rs (676 lines) has ZERO #[test]; all six cells sit in bootstrap_firewall.rs and windows.rs. Under cfg the Linux arm is invisible to this box's unit lane, so the surviving id's unit stage reads green over an untested Linux backend set. Closed by a hertz cells lane run on kitsubito against ufw_scope / owned / backend (queued 12:14Z; ten cells red-first at be99017f, 12:41Z). RULE learned there: `ci.yml` lint runs clippy `--all-targets -D warnings` on kitsubito ONLY, and `--all-targets` lints cells as hard as product — a Linux-only red that no Windows gate sees caught todlando's `needless_borrow` (linux.rs:293, fixed be99017f) and hertz's own `cloned_ref_to_slice_refs` (linux.rs:891, test module) one hour apart; nextest 10/10 said nothing about either. Cells in a cfg-gated module pass clippy on that platform before the lane is clean. Structural fold ruling issued 12:13Z: surviving id REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM effector + pure RuleSpec/desired_spec/spec_satisfied_by seam, W2 netsh section removed, four minted ids deleted; scope constants and prose wait for W-2a arm C.\r\n\r\n### IR-111 — the installed product's own inbound UDP rule reads Duplicate / Inactive in ActiveStore, shadowed by the fallback rule; a by-name probe reads it green\r\n\r\n- **Status:** OPEN, product-side backlog candidate (REQ-INBOUND-WINDOWS-RULE-BINDER-PATH-MATCH family). Recorded\r\n 2026-09-11 12:14Z (doyle) from an unelevated `Get-NetFirewallRule` read of both stores on HFENDULEAM.\r\n- **Instance.** ActiveStore: `spt-core inbound UDP` (Program = installed spt.exe, Profile Any, UDP, Remote Any)\r\n Enabled=True, **Enforcement=Duplicate, PrimaryStatus=Inactive**; `spt-fallback inbound UDP` (same program,\r\n Profile Any) Enforcement=ProfileInactive Enforced, Status OK. PersistentStore shows both as\r\n Enforcement=NotApplicable, Status OK — the persistent view cannot see the shadowing at all.\r\n- **Why it matters.** The product's reconcile and the `inbound_block_hint` probe key on the product rule's NAME.\r\n The rule that is doing the work is the other one; delete or repoint the fallback and the product rule may\r\n become the enforced one with no change in what the name probe reports, or the reverse. Kin to the W1\r\n effector's own comment (\"never certify a rule which ActiveStore reports as ignored or ineffective\") — the\r\n UDP side never reads ActiveStore.\r\n- **Also seen, same read:** ~26 enforced program-scoped Private rules naming target/debug and actions-runner\r\n test binaries (spt_net-*, spt_daemon-*, spt.exe), Proto TCP+UDP, LPort Any, Remote Any — the rig-rule\r\n population the hfenduleam program-scope memory describes; none admits the tailnet.\r\n- **Rule.** A rule probe that certifies anything reads ActiveStore EnforcementStatus, not PersistentStore\r\n presence and not the name.\r\n- **Kin:** [[IR-110]], memory hfenduleam-program-scoped-firewall-rules-do-not-admit-tailnet.\r\n- **Ripe when:** the next inbound-rule wave, or when the W1 CIM two-store query is generalised to the UDP side.\r\n · **Size:** one ActiveStore read in the probe; one dedupe decision.\r\n\r\n### IR-112 — bare `cargo test -p spt-daemon --lib` reds two process-global cells on Linux at a sha where nextest is green; libtest is not a sound gate for this crate\r\n\r\n- **Status:** OPEN, rig rule (CI unaffected: `ci.yml` runs `kind(lib)` under nextest). Recorded 2026-09-11 12:46Z\r\n (doyle) from hertz's Linux cells lane END on kitsubito.\r\n- **Instance.** At 697eb398 on kitsubito: `cargo nextest list -p spt-daemon --lib` = 989 ids; `cargo test -p\r\n spt-daemon --lib` = 989 run, 987 passed, **2 FAILED, exit 101**:\r\n `answerop::tests::an_approval_notifies_a_plain_knocker_with_no_pre_authorization` (answerop.rs:324, \"expected\r\n exactly one courtesy: [] left: 0 right: 1\") and\r\n `brainproc::tests::the_ready_breadcrumb_tells_a_computed_hash_from_a_cached_one` (brainproc.rs:2347, \"the FIRST\r\n ready write in a process pays for the digest\"). Both PASS under nextest with the identical filter, exit 0.\r\n- **Mechanism.** Process-per-test vs one shared libtest process: both cells read process-global state (the\r\n brainproc one says so in its own panic text); under libtest a sibling's write is visible. IR-108's leaky-cell\r\n class, measured on Linux. Kin memory bystander-test-reads-process-global, daemon-lib-tests-deadlock-on-live-host.\r\n- **Rule.** A gate or rig over spt-daemon's lib runs NEXTEST; a `cargo test --lib` red on this crate is a rig\r\n fault until discriminated under nextest with the same filter. Count agreement (list == run) says nothing about\r\n exit agreement — check both.\r\n- **Kin:** [[IR-108]], [[IR-100]].\r\n- **Ripe when:** a sweep makes those two cells hermetic (the fix belongs to the cells, not the gate). · **Size:**\r\n two fixtures.\r\n\r\n### IR-113 — a killed mutation arm does not unwind: the subject stays mutated and the NEXT arm measures a tree nobody declared; and a mutation that reds on a compile error is a void arm that \"it compiled\" cannot detect\r\n\r\n- **Status:** OPEN, rig rule for every mutation driver. Recorded 2026-09-11 13:05Z (doyle) from todlando's FOLD-1b\r\n window (fold/304-w2-admission, windows.rs).\r\n- **Instance.** A first M1 injected an early return through a struct literal naming a helper that does not exist —\r\n a mutation that would red on E0425, not at the cell's assertion, i.e. a void red-first arm. The job was stopped\r\n mid-run; the driver's restore is its LAST line, so the kill left the MUTATED file on disk: working oid d8ddfdf3\r\n against pristine 1f475a80, two residue markers present. Caught only because the next act was an oid compare, not\r\n the next arm. Restored and re-measured identical (residue 0, 786 == 786 lines). Second half: clippy on the\r\n mutated tree exited 0, so \"it compiled\" would not have exposed the void arm either.\r\n- **Mechanism.** Mutate → run → restore is not transactional; any exit before the last line (kill, timeout, crash,\r\n nextest hang) strands the mutation. A void arm is one whose red is not AT the assertion the prediction named.\r\n- **Rule.** (1) A mutation driver restores in a finally/trap path, and every arm BEGINS by asserting the subject's\r\n oid equals the declared pristine oid — the previous arm's revert is proven at the next arm's start, not trusted.\r\n (2) A red-first arm is accepted only when the artifact names the predicted assertion line; a compile-error red,\r\n a panic elsewhere, or a red at a different line is VOID, not a pass and not a fail. (3) Mutations are one-token\r\n edits with an anchor count asserted at 1; an arm that did not change the file voids itself loudly.\r\n- **Kin:** [[IR-107]] (revert proven by oid AND byte shape), memory scripted-edit-zero-match-refusal,\r\n make-a-new-rig-red-on-purpose.\r\n- **Ripe when:** now — the rule is cheap and the drivers exist; every lane's driver adopts it at its next edit. ·\r\n **Size:** a trap/finally and one oid compare per arm.\r\n\r\n### IR-114 — three hands wrote one firewall rule set inside ninety seconds under two directors; every census was true at its instant and false a minute later\r\n\r\n- **Status:** OPEN, procedure ruled 2026-09-12 00:50Z (doyle) on todlando's reconciliation; recorded 00:52Z.\r\n- **Instance.** #304 W-2a arms on HFENDULEAM: ~00:44Z todlando asked the operator to delete spt-w2a-C so B would stand alone; ~00:45Z the operator said \"C down\" and todlando's census read B present / C absent (true then); 00:45:05Z liam ADDED C at doyle's direction (doyle had been idle 11 h and did not know the operator's window); 00:46:14Z liam DELETED B at doyle's direction; 00:49:09Z todlando re-measured C present / B absent. Nobody was wrong; the population was not stable. Every fetch todlando reported had an adjacent census and stands; a long background census that straddled the writes returned no spt-w2a rows at all and is UNMEASURED. Separately, doyle's drop-log arm crossed liam's revert in flight: three fetches ran with logging already off — a void arm, redone.\r\n- **Mechanism.** Two directors (operator, gater) each driving a different elevated hand against the same shared host state, neither seeing the other's window; a census taken as a separate earlier step and carried forward.\r\n- **Rule.** For any arm on shared host state: ONE WRITER; the census is taken BY THE FETCHER in the SAME command as the fetch, before and after; the prediction names the exact expected population (an unexpected row is a red); every write is announced with its UTC time to every party; a director resuming after a gap re-measures the population before issuing a write. Kin: memory verify-the-subject-not-just-the-measurement, name-the-file-and-sha.\r\n- **Also measured tonight (todlando):** 'spt-core daemon' (proto Any, Private, remote Any, program = the listener's exe) covers the Private-classified Tailscale interface while TCP 5470 times out from kitsubito and the LAN address answers 200 with ICMP alive — so W-0 measured the tailnet ACL, not program scoping, and DESIRED_PROGRAM=false's cited justification is VOID (the constant may still be right; its citation is not). The shape question moves to a throwaway port and listener over the LAN (arm E).\r\n- **Ripe when:** now — the rule costs nothing. · **Size:** procedure.\r\n\r\n### IR-115 — a firewall census whose port test is DENIED reads every rule as port=Any and counts port-scoped rules as blanket; a `netsh show rule` without `verbose` omits Program and reads every rule as program=Any; a control count that merges two agents' reads is nobody's control\r\n\r\n- **Status:** OPEN, mechanisms recorded 2026-09-12 01:14Z (doyle) from todlando's and liam's own corrections during #304 arm E.\r\n- **Instances.** (1) todlando's first census A (\"26 blanket rules\") and B (\"occupied LocalPort set: EMPTY\"): `Get-NetFirewallPortFilter -All` returns \"Access is denied\" unelevated, the probe swallowed the denial, every rule read as port=Any, and B's positive control (the hand rule carries LocalPort 5470) is what caught it. (2) His replacement pass: `netsh advfirewall firewall show rule name=all` without `verbose` prints no Program line, so it reported 417 blankets and ZERO rules naming spt.exe — provably false, caught by the same control. The third pass (`dir=in verbose`) passed both controls (port-5470 rows = 1, spt.exe rows = 7) and was the census used. (3) doyle's fetcher: first census predicate listed port-covering and program-covering rules as two separate sets; the reaching set is their CONJUNCTION (plus LocalIP, which the first predicate lacked and which is what scopes `Tailscale-In` to the tailnet address only). (4) liam's \"3/3 200\" loopback count merged two of his reads with three of doyle's re-reads as reported; liam corrected it himself. (5) doyle's one in-arm loopback read of 000 at 01:04:22Z had no exit code captured; it is carried as a labelled hole, not classified by a later burst (a later instant cannot classify an earlier read).\r\n- **Mechanism.** A denied or under-scoped read does not error; it returns the permissive default for the field it could not see, so the census reads MORE admits than exist and a shape question gets decided on a phantom population. Kin: memory a-predicate-without-its-tool-is-not-evidence, verdict-from-probe-competence, zero-match-filter-reads-as-absent.\r\n- **Rule.** A firewall census names its tool and privilege and carries two positive controls in the SAME dump: one rule known to carry a specific LocalPort, one known to name a specific Program. A census that cannot see both has not seen the population. The reaching predicate is port-covers AND program-covers AND LocalIP-covers AND profile-covers, one set. Every loopback and remote read records its curl exit code. Counts are per agent; a merged count is restated per agent or discarded.\r\n- **Ripe when:** now — the rule costs one grep. · **Size:** procedure.\r\n\r\n- **Addendum 2026-09-12 03:20Z (doyle, #304 W-2 A5/A4): the Windows Firewall event log is DIRECTION-BLIND, so a rig that keys \"written\" or \"removed\" on it cannot fail in the direction it claims.** Population controlled over one read (2011x48 / 2052x6 / 2097x6, a 400-event re-read of the same window returning the identical six): id 2052 fires on creates AND deletes in the observed population, id 2097 is create-specific, and NOTHING observed is delete-specific. The CENSUS carries the sign; the log carries only the instant. The same read established a MEASURED gap (zero events between A5's end and A4's start) and that nothing commits after the client dies — both usable, neither a direction. Kin: the firewall status fields do not discriminate either, since an admitting hand rule reads the same `PrimaryStatus`/`EnforcementStatus` strings as a non-admitting product pair on the same query.\r\n\r\n### IR-116 — a watchdog that calls a killer and then echoes success reports a kill it never made; `pkill` is absent in msys, so the guard logged \"stopped\" while the arm it guarded ran on\r\n\r\n- **Status:** OPEN, mechanism recorded 2026-09-12 01:24Z (todlando) from his own guard during #304 FOLD-2's Windows arm at 7357ea32; doyle asked for the line.\r\n- **Instance.** todlando armed a watchdog to stop a test arm before it reached `cargo test --workspace --lib`, because spt-daemon lib tests deadlock on a live host. Shape: `if grep -q \"CLIPPY_EXIT=\" log; then pkill -f \"bash /tmp/arms.sh\" 2>/dev/null; echo \"GUARD: arms.sh stopped after clippy at $(date -u)\"`. It printed `GUARD: arms.sh stopped after clippy at 01:24:06Z`. Nothing was stopped: `pkill` does not exist in this msys/Git-Bash environment (`command not found`, exit 127), `2>/dev/null` ate the message, and the `echo` was never gated on the killer's exit. The arm ran on into its compile phase and was found by tailing the build log, not by the guard — whose only output was a green.\r\n- **Mechanism.** Two defects stack, and either alone would have been caught by the other: a missing binary, and a success line that cannot fail. Same family as IR-107 seen from the other side — there a trailing command's exit was mistaken for the producer's; here no exit was consulted at all. The aggravating factor is WHERE it lives: a guard is written while thinking about the hazard it guards, not about the guard, and a guard that never fires looks identical to a guard that works. Kin: memory watchdog-reports-a-kill-it-never-made, verdict-from-exit-not-from-silence, a-predicate-without-its-tool-is-not-evidence.\r\n- **Rule.** A watchdog asserts the POST-STATE and never echoes after the call: `kill …; sleep 1; if still_running; then echo \"GUARD FAILED\"; exit 1; fi`. On msys use `kill -9 ` with a pid you resolved yourself, or `taskkill //PID //T //F`; do not assume `pkill`/`pgrep` exist — check the tool before building a guard on it. Reap your own tree only: resolve the pid and its children, never a machine-wide sweep on a shared box.\r\n- **Second-order, and it bit me inside this very entry.** `git checkout -- ` restores from the INDEX, not HEAD. Having staged a first draft, I \"reverted\" it and appended a rewrite — producing a file carrying BOTH. Caught by the diffstat (49 insertions for a ten-line entry). Restore from `HEAD --` when HEAD is what you mean; the diffstat is the control.\r\n- **Corollary, accepted by doyle.** The killed arm reported `TEST_EXIT=137`. That is the SIGKILL, delivered during compilation with ZERO tests executed (last lines `Compiling acto / iroh-dns / wmi`) — a VOID arm, not a red. A 137 sitting in a log over a test arm is precisely the number quoted later as a product failure. Same family as IR-113 (a killed mutation arm does not unwind).\r\n- **Instance 2 — a DIFFERENT tool surface, 2026-09-12 03:39Z (hertz).** The mechanism is not a property of todlando's guard. hertz ran a recursive `grep -rl` over the project tree; it exceeded the foreground timeout and the harness backgrounded it. `TaskStop` returned `{\"message\":\"Successfully stopped task: bn74vtqn0\"}` — a structured success from the harness itself, not a hand-rolled echo. The process was still in the table two minutes later: pid 35104, StartTime 03:37:20Z, **CPU 13.25 s**, killed only by an explicit `Stop-Process -Id 35104 -Force` and confirmed gone by a post-state count of 0 against a live positive control (`pwsh` count 12). So a first-party tool's success object is no better warranted than an `echo`, and the rule generalises: **read the post-state after every stop, whatever the stopping tool said.** Aggravating detail worth its own note — hertz had todlando's disclosure of this exact shape in context and ran it anyway four minutes later; a hazard report describes a SHAPE, and remembering the INSTANCE is not being inoculated against the shape.\r\n- **Ripe when:** now — the rule costs three lines in any guard. · **Size:** procedure.\r\n\r","startLine":6567,"lineNumbers":[6567,6568,6569,6570,6571,6572,6573,6574,6575,6576,6577,6578,6579,6580,6581,6582,6583,6584,6585,6586,6587,6588,6589,6590,6591,6592,6593,6594,6595,6596,6597,6598,6599,6600,6601,6602,6603,6604,6605,6606,6607,6608,6609,6610,6611,6612,6613,6614,6615,6616,6617,6618,6619,6620,6621,6622,6623,6624,6625,6626,6627,6628,6629,6630,6631,6632,6633,6634,6635,6636,6637,6638,6639,6640,6641,6642,6643,6644,6645,6646,6647,6648,6649,6650,6651,6652,6653,6654,6655,6656,6657,6658,6659,6660,6661,6662,6663,6664,6665,6666,6667,6668,6669,6670,6671,6672,6673,6674,6675,6676,6677,6678,6679,6680,6681,6682,6683,6684,6685,6686,6687,6688,6689,6690,6691,6692,6693,6694,6695,6696,6697,6698,6699,6700,6701,6702,6703,6704,6705,6706,6707,6708,6709,6710,6711]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":6938,"totalBytes":22853,"outputLines":145,"outputBytes":22853,"shownRange":{"start":6567,"end":6711},"nextOffset":6712}}},"isError":false,"timestamp":1789483683711}}
{"type":"message","id":"da6c549e","parentId":"a78066f9","timestamp":"2026-09-15T14:48:03.717Z","message":{"role":"toolResult","toolCallId":"call_2IGSye7spdRTE53b7IVjRIX6|fc_000c7cef03cac861016aa95aa394b087d18fd08c07672129b7","toolName":"read","content":[{"type":"text","text":"### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached\n\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\n- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.\n- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.\n- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.\n- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.\n- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).\n- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.\n\n### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict\n\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.\n- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.\n- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.\n- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.\n- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.\n- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).\n- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.\n\n### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached\n\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.\n- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.\n- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.\n- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.\n- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.\n- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).\n- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.\n\n### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists\n\n- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.\n- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.\n- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.\n- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.\n- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.\n- **Scrub qualification.** The fresh-child receipt recorded `before_names=[\"SPT_ENDPOINT_ID\",\"SPT_RELEASE_SEED\"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.\n- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).\n- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.\n\n### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission\n\n- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.\n- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.\n- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.\n- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\n\n\n[Showing lines 6837-6888 of 6938. Use :6889 to continue]"}],"details":{"truncation":{"content":"### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.\r\n- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.\r\n- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.\r\n- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.\r\n- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).\r\n- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.\r\n\r\n### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.\r\n- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.\r\n- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.\r\n- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.\r\n- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.\r\n- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.\r\n\r\n### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.\r\n- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.\r\n- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.\r\n- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.\r\n- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.\r\n- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).\r\n- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.\r\n\r\n### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists\r\n\r\n- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.\r\n- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.\r\n- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.\r\n- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.\r\n- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.\r\n- **Scrub qualification.** The fresh-child receipt recorded `before_names=[\"SPT_ENDPOINT_ID\",\"SPT_RELEASE_SEED\"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.\r\n- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).\r\n- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.\r\n\r\n### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission\r\n\r\n- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.\r\n- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.\r\n- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.\r\n- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.\r\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\r\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\r\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\r\n\r","truncated":true,"truncatedBy":"lines","totalLines":102,"totalBytes":15276,"outputLines":52,"outputBytes":15276,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6938,"displayContent":{"text":"### IR-128 — PowerShell `$null` can become an empty native string, so a failed launch is misread as a policy refusal before the policy is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`.\r\n- **Instance.** Both breakaway probe arms called a P/Invoke string parameter with PowerShell `$null`; both returned `CreateProcess` error **123** and created no child. This is an invalid-name result, not the **5** required to establish breakaway-policy denial. An offline C# string-parameter discriminator returned `IsNull($null)=False`: the PowerShell binder had supplied an empty string rather than native NULL.\r\n- **Correction and evidence.** A C# helper passes the executable explicitly, uses a mutable `StringBuilder` for `CreateProcessW`'s command line, and supplies C# null for the optional current directory. The repaired no-breakaway arm returned **5**, while the BREAKAWAY_OK contrast created a child measured outside the job and still alive after job closure. Original error-123 arms remain invalid and preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M5/`; corrected records live in its `instrument-repair-20260913T104354Z/M5-denied/` and `M5-allowed/`.\r\n- **Managed-string recurrence (group N).** The same binder coercion reached `[IO.File]::Replace($tmp, $record, $null)`: the optional backup path became empty, and publication failed with `The path is empty` before any subject was created. The initial N0 gate correctly refused; its partial record and exception are preserved under `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T1109444702137Z-N/N0/`. The PowerShell publisher now uses the overwrite-rename overload `[IO.File]::Move($tmp, $record, $true)` instead of passing a nullable string. The corrected N0 reached the intended false coverage assertion; native C# publication retains a real C# null.\r\n- **Rule.** At native string seams, distinguish NULL from the empty string and verify what the language binder supplies. Use a typed native-call helper where this distinction is load-bearing. Classify the actual error code at the failing stage: a launch error before policy evaluation cannot establish a policy refusal. Command buffers documented writable must be mutable.\r\n- **Kin:** [[IR-113]] (a failure at the wrong stage is a void discriminator), [[IR-117]] (name the observation that refutes each branch).\r\n- **Ripe when:** any optional native string argument or process-creation probe crosses PowerShell's binder. **Size:** typed call seam and a null/empty discriminator.\r\n\r\n### IR-129 — JSON date materialization followed by implicit string parsing loses UTC kind and precision, turning a live creation anchor into a false pid-reuse verdict\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz in group M, 2026-09-13; accepted by doyle in `3XE67XYP`. The first M8 exit 0 is explicitly INVALID.\r\n- **Instance.** `ConvertFrom-Json` materialized an ISO birth string as `DateTime`; `[DateTime]::Parse($id.created)` implicitly formatted that object back to text before parsing it. Kind and fractional precision were lost and local time was reinterpreted. The result printed birth timestamps agreeing within a microsecond but computed roughly seven-hour deltas, mislabelling four live registered identities `GONE_PID_REUSED`. The original output remains at `.spt/preserved/hertz-fp-driver-review/d2/controls-out/20260913T103751Z-M/M8/`.\r\n- **Correction and evidence.** The reader handles `DateTime` values directly with `ToUniversalTime`; strings are parsed as `DateTimeOffset` and converted to UTC. Its live-self JSON-roundtrip control measured **9 ticks** difference; a deliberately 500-ms-skewed anchor measured **5,000,009 ticks** and could not match. The corrected final pass covered all **13** registered identities, found every one GONE, and retained the escaped child's earlier SURVIVING readings. Evidence: the same group's `instrument-repair-20260913T104354Z/all-identities-disposition.jsonl` and `final-disposition.stdout`.\r\n- **2026-09-14 recurrence caught before the field window.** The bound promotion instrument repeated the same reader/parse pair at its brain-birth guard. A language-only discriminator using that pair measured **251,998,765,433 ticks** error. Reading JSON with `-DateKind String` instead preserved the timestamp: same-anchor delta **0 ticks**, deliberately wrong 500-ms anchor **5,000,000 ticks** and refused by the unchanged **10-tick** guard. The successor changes only `Read-Json`; the original instrument remains intact. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/promotion-date-discriminator-result.json` and `provision-promote-VGCTKD7A.ps1`. No field process was needed to expose this known hazard.\r\n- **Rule.** Treat deserialization's runtime type as part of the interface. Never reparse a typed date through implicit culture-sensitive formatting. Exercise both a same-process roundtrip and a wrong-anchor negative control; preserve raw timestamps and the computed delta so their agreement can be audited. Match at the actual reader resolution, not by discarding the fractional second.\r\n- **Kin:** [[IR-118]] (successful instrument, wrong answer), [[IR-125]] (an absence predicate needs a known-present control), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** any JSON record is used to authenticate process identity or order events. **Size:** type-aware UTC conversion and two local controls.\r\n\r\n### IR-130 — a lowercase `$home` local collides with PowerShell's protected `$HOME`, refusing custody qualification before the signer is reached\r\n\r\n- **Status:** OPEN, rig-instrument hazard, not a product finding. Measured by hertz on 2026-09-13 in the D2 custody lane; narrow correction and one fresh-root attempt authorized by doyle `5FWLC3F2`. Original refusal remains preserved.\r\n- **Instance.** The prepared custody controller passed syntax parsing and compiled its native observer successfully, then exited **1 after 3.33 s** before any custody arm. Its next statement assigned `$home = Join-Path $armRoot 'home'`. PowerShell variable names are case-insensitive: this is an assignment to automatic `$HOME`, whose measured options were **ReadOnly, AllScope**. A separate language-only reproduction returned **VariableNotWritable**. The original catch deliberately omitted exception details, so that error ID belongs to the minimized reproduction; the original record carries the generic refusal and `arms=[]`.\r\n- **Boundary and evidence.** Compiler native exit **0**, `COMPLETE`, `CONFIRMED_GONE`, active processes **0**; a public fixture and empty `custody-normal` directory existed, but no home, subject arguments, dummy EnvironmentFile, observer execution, signer, git child, real key, or field rig existed. Evidence: `.spt/preserved/hertz-fp-driver-review/d2/AZLCQNZL-CUSTODY-REFUSAL.txt`, `AZLCQNZL-home-variable-repro.json`, `AZLCQNZL-custody-failure-inventory.json`, and `controls-out/custody-6U2UZVXK/`.\r\n- **Correction.** Rename the local to `$qualificationHome` at its assignment/directory call and environment-overlay reference (two source lines), re-pin the controller, and use a fresh qualification root. Do not relax automatic-variable protection, reuse the failed root, or classify this as a rejection of the assembled xtask's seed isolation. The authorized retry's result is separate evidence, not a rewrite of the first attempt.\r\n- **Rule.** PowerShell locals share a case-insensitive namespace with automatic variables: use role-specific names rather than `$home`, `$host`, or `$pid`. Syntax acceptance and a successful subordinate compiler do not prove that controller initialization reached its behavioral discriminator. State the last stage actually executed; an empty retirement list is not evidence that secret-bearing processes ran and were cleaned.\r\n- **Kin:** [[IR-113]] (wrong-stage refusal is a void discriminator), [[IR-128]] (language-boundary failure before the intended policy), [[IR-118]] (plausible result without the claimed observation).\r\n- **Ripe when:** any PowerShell orchestration or custody controller is authored or changed. **Size:** two-line naming correction plus retained refusal and fresh-root qualification evidence.\r\n\r\n### IR-131 — a live-agent signing environment leaks into the provisioning process and correctly refuses before the private signer exists\r\n\r\n- **Status:** OPEN, rig invocation-environment defect, not a candidate or disk defect. Measured by hertz on 2026-09-14; classified by doyle in `VGCTKD7A`.\r\n- **Instance.** Second fresh #297 preparation admitted fourteen native leaves at `04:51:39.245Z`. The separate provisioning call launched at `04:51:52.802Z` and returned `STAGING_FAILED_PREFLIGHT`, native exit **1**, after **0.45 s**. No rig, private directory, key or field nonce existed. This was a preflight refusal before the `04:59:31Z` deadline, not a stalled launch.\r\n- **Exact check.** A read-only preflight discriminator surfaced `AMBIENT_SIGNING_SECRET_REFUSED` from `Assert-SeedAbsent`. A names-only environment probe found `SPT_RELEASE_SEED` **present**; `SPT_DEBUG_RELEASE_SEED` and `SPT_RELEASE_SEED_CMD` were absent. No values were emitted or changed. The refusal reproduced with **102,099,394,560 bytes free**, and the failing check reads process environment before filesystem preflight: reclaiming disk cannot cure this guard.\r\n- **Evidence gap.** The original catch persisted a failure JSON only after `$publicReady`, set after preflight. Earlier throws produced only a generic stderr phase and an empty evidence directory. Preserve safe, fixed preflight reasons and caller exit evidence before mutation; silence in the directory is not evidence that the command never ran. Original artifacts remain unchanged under `.spt/preserved/hertz-fp-driver-review/d2/`; see `IH4QFFXS-execution-boundary.json`, `X2LPSQ7A-preflight-only-result.json`, and `X2LPSQ7A-signing-env-presence-result.json`.\r\n- **Rule.** Scrub the environment handed to the **provisioning PowerShell process itself**, not merely its later signer child: remove every ambient `OWL_*`/`SPT_*` key except the leg's declared allowlist, recording names before/after, never values. Preserve the live agent's parent environment and lifecycle. The guard remains strict. The new debug signing seed enters only the controlled signer's private `EnvironmentFile`; it never becomes ambient in the provisioning process or helpers.\r\n- **Scrub qualification.** The fresh-child receipt recorded `before_names=[\"SPT_ENDPOINT_ID\",\"SPT_RELEASE_SEED\"]`, `after_names=[]`, and parent names unchanged. This exposed the next startup error: `Stop-Transcript -ErrorAction SilentlyContinue` throws a terminating exception when the required fresh `-NoProfile` host is not transcribing. The successor removes that invalid stop, not the forced-logging policy checks or seed guard. The complete no-mutation preflight then exited **0** with `PREFLIGHT_ONLY_PASS_NO_MUTATION`; no third preparation clock had begun. Evidence: `VGCTKD7A-preflight-result.json`, `VGCTKD7A-preflight-clean-result.json`, and `VGCTKD7A-preflight-clean-environment.json` plus its exit receipt.\r\n- **Kin:** [[IR-107]] (live-agent identity leaking into consumer/test legs), [[IR-130]] (preflight failure hidden by phase-only reporting), [[IR-122]] (live operational context is not an isolated rig).\r\n- **Ripe when:** any leg is launched from a live-agent session. **Size:** explicit child environment boundary and durable preflight evidence; no candidate change.\r\n\r\n### IR-132 — requiring every live-fleet `spt.exe` image path to be readable permanently refuses an isolated rig's admission\r\n\r\n- **Status:** OPEN, rig-instrument admission defect, not a candidate, environment-scrub or disk defect. Measured by hertz and independently localized by doyle on 2026-09-14; correction ruled in `W8TQ3MZC`, `6IQ4HYIL`, `QKQC2NET` and `MRQX7XEK`.\r\n- **Instance.** Third preparation passed fourteen native admission leaves and genuinely staged the signed set. Promotion then returned `PROMOTION_ADMISSION_FAILED`, native **1**, with `native_records=[]` and shutdown `NOT_STARTED`. Its census required a nonblank CIM `ExecutablePath` for **every** `spt.exe`, not merely one that could belong to the new rig. The read-only predicate replay passed twenty-five preceding statements and failed `SPT_PROCESS_PATH_UNREADABLE` at line 273. No apply, daemon, field nonce or firewall mutation occurred. Receipt: `.spt/preserved/hertz-fp-driver-review/d2/GEL6JAWN-FINAL-REFUSAL.json`.\r\n- **Shared-box mechanism.** The subsequent census exposed persistent PID **52860**, birth `2026-09-12T20:17:00.5331330Z`, with readable birth but unreadable image path; the rig did not exist until `2026-09-14T05:45:32.8201734Z`. Doyle additionally measured blank paths in **12/12** samples, with transient CLI children alongside the persistent process. An image-readability requirement cannot admit this live shared box. Missing per-rig state files remain an independent gate, not a substitute for process-identity reasoning.\r\n- **Correction.** Capture `(pid, CIM CreationDate)` together. A birth provably earlier than rig creation excludes that identity without needing its image; the **10-tick** precision allowance only narrows this exemption. Later or overlapping blank-path identities use the existing limited-query native image/birth/retained-handle seam. A native failure is unresolved, not gone. A successful immediate CIM re-read with a live positive control can establish absence; access-denied or failed queries cannot. PID reuse records the original identity gone and classifies the replacement independently. Unknown birth or a persistent unresolved identity refuses. No fleet-process termination is permitted.\r\n- **Evidence.** Fourteen discriminator cases cover pre-rig exemption, native image resolution, known rig refusal, disappearance versus denied/failed queries, dead-provider control, unknown/equal/precision-overlap births and PID reuse. The final successor passed all fourteen. A read-only live run admitted **17** census hits, including 52860 as `PREDATES_RIG`; actual native self controls measured a **5-tick** CIM/native birth delta, admitted the other-image case and refused the same-image case. Proof: `W8TQ3MZC-census-controls-final.json` and `W8TQ3MZC-census-live-result.json` beside the receipt. Neither proof invoked the product or mutated the rig.\r\n- **Rule.** Admission asks whether an observed identity can belong to the owned rig, not whether the caller can read every process on the host. Preserve query failure, confirmed absence and replacement identity as different outcomes, with pid and birth in the receipt. Re-pin changed instruments; preserve failed windows and obtain a fresh grant rather than extending their clocks.\r\n- **Kin:** [[IR-107]] (live operational context enters the rig), [[IR-129]] (creation-time type/precision), [[IR-125]] (known-present control for absence), [[IR-15]] (identity-aware liveness).\r\n- **Ripe when:** a rig shares a host with elevated perches or short-lived CLI traffic. **Size:** birth-aware census and retained native identity probe, with fail-closed boundary controls.\r\n\r","startLine":6837,"lineNumbers":[6837,6838,6839,6840,6841,6842,6843,6844,6845,6846,6847,6848,6849,6850,6851,6852,6853,6854,6855,6856,6857,6858,6859,6860,6861,6862,6863,6864,6865,6866,6867,6868,6869,6870,6871,6872,6873,6874,6875,6876,6877,6878,6879,6880,6881,6882,6883,6884,6885,6886,6887,6888]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":6938,"totalBytes":15276,"outputLines":52,"outputBytes":15276,"shownRange":{"start":6837,"end":6888},"nextOffset":6889}}},"isError":false,"timestamp":1789483683717}}
{"type":"message","id":"397f1935","parentId":"da6c549e","timestamp":"2026-09-15T14:48:03.759Z","message":{"role":"toolResult","toolCallId":"call_5SC73LBYbynWTk3TB4TBE7Wq|fc_000c7cef03cac861016aa95aa394b487d19afa73ed25f51f2f","toolName":"grep","content":[{"type":"text","text":"No matches found\nSkipped missing paths: .worktrees/hertz-ir86-disk-delta/xtask/src/brainread.rs"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\spt-daemon","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":0,"fileCount":0,"files":[],"truncated":false,"missingPaths":[".worktrees/hertz-ir86-disk-delta/xtask/src/brainread.rs"]},"isError":false,"useless":true,"timestamp":1789483683759}}
{"type":"message","id":"14cca78f","parentId":"397f1935","timestamp":"2026-09-15T14:48:03.944Z","message":{"role":"toolResult","toolCallId":"call_BWgHB0WgbZ4MGEdGwkEa3y09|fc_000c7cef03cac861016aa95aa394bc87d1bb5dc561ac768e35","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/\n## traceable-reqs.toml\n 24|enforce = \"on\"\n*25|module_banner = \"accept\"\n 26|\n 27|[[requirements]]\n 28|id = \"REQ-STATUS-LIVE-SUPERVISOR-PID\"\n...\n 1176|required_stages = [\"doc\", \"impl\", \"unit\"] # doc activated restoration D1 (KNOWN-HAZARDS 6.8 + ADR-0018 + design doc V1). impl/unit activated restoration D6-3 (the one D6 toml activation): impl = rollback_compat.rs (the pre-ready durable-file registry PRE_READY_DURABLE_FILES — the enumerated guard surface) + the two-phase AppliedRecord (relcache.rs, additive durable state); unit = the rollback_compat tripwire (every current pre-ready file shape is additive / N-1-readable; a non-additive pre-ready chang...\n*1177|# --- Added 2026-06-11 (v0.4.2): the v0.4.1 fleet-roll Linux brain-respawn blocker (ADR-0018 Q3 amendment); rule 3 register-before-satisfy, rule 5 activate per task ---\n 1178|[[requirements]]\n 1179|id = \"REQ-HAZARD-BRAIN-RESPAWN-PATH\"\n 1180|title = \"The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE at broker start, never a per-spawn std::env::current_exe() — on Linux current_exe (readlink /proc/self/exe) is inode-tracking and follows the `apply` rename (spt -> spt.old-N), so a resident broker would respawn the brain onto OLD bytes while recording `applied` (Windows GetModuleFileName is path-at-start, so Windows was green; ADR-0018 Q3 silen...\n*1181|required_stages = [\"doc\", \"impl\", \"unit\", \"int\"] # activated v0.4.2 (2026-06-11): minted from the v0.4.1 fleet-roll blocker. doc = KNOWN-HAZARDS 6.11 + ADR-0018 Q3 amendment; int = brain_respawn_rename.rs (real broker process, in-place rename P->P.old-N + new bytes at P, respawn must run B not A — fails Linux pre-fix). Stages: impl = brainproc.rs canonical-exe capture at spawn_brain_supervisor + promotion bytes-gate in supervise_brain Promoted arm (TrialEnv ready_exe_hash/staged_artifact_hash); unit =...\n 1182|# --- Added 2026-06-03 from grill-with-docs (ADR-0012, hazard 7.3); inactive until M4-D7.5 ---\n 1183|[[requirements]]\n 1184|id = \"REQ-HAZARD-PSYCHE-OUTBOUND-PROXY\"\n...\n 3061|id = \"REQ-CI-POSTJOB-DAEMON-REAP\"\n*3062|title = \"A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job start AND job end so contamination and reap effectiveness are visible in every run's log. (Load-flake family leg 1, doyle-ratified 2026-07-22 from deployah's third-run analysis.) THE SIGNATURE THIS CLOSES: a DIFFERENT single daemon-spawning test dying per run with a bare exit 1 and NO assertion output — process-level death, not a failed assert — while sibling tests in the same families pass a...\n 3063|required_stages = [\"impl\"] # LOAD-FLAKE leg 1 ACTIVATED on build branch (todlando 2026-07-22). impl = .github/ci/reap-census.ps1 + .github/ci/reap-census.sh (scope roots, per-pid re-verification at kill time, hard exclusions, bounded settle, start/end census) wired into ci.yml's `test` and `n1-gate` jobs on both runners, the end step under always(). No unit stage: the evidence is a recipe the runner executes, and the acceptance is a census diff read off live run logs (zero test-spawned daemons surviving...\n 3064|\n 3065|[[requirements]]\n...\n 3266|id = \"REQ-DAEMON-BITS-AMBIGUITY\"\n*3267|title = \"SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit twice in one day (2026-07-25). Case 1 (adapter-side echo): a post-reboot ensure race left a dev-build alchemy Hub Daemon serving release shells — version skew visible only by manually comparing process image paths. Case 2 (core, field-measured by flynn): TWO spt daemons resident with live brains on one node — the installed main daemon (owning ...\n 3268|required_stages = [] # rule 5: INACTIVE — RCA-first; activate when a milestone owns the daemon-identity observability question.\n 3269|\n 3270|# --- Seeded 2026-07-25 (doyle) from the operator's account of the 17:47 restart failure\n\n## .github/ci/\n### reap-census.ps1\n 25|\n*26| KILL SCOPE IS PATH-VERIFIED AND NARROW, per-pid, AT KILL TIME — never machine-wide.\n 27| A process is eligible only if its on-disk image sits under one of this run's own build\n 28| roots (workspace, CARGO_TARGET_DIR, the notify-adapter checkout's target, RUNNER_TEMP,\n 29| the pinned n1 old-broker build cache). Two hard exclusions are checked even for a\n### reap-census.sh\n 24|# 3. The obvious patch — `pgrep -f` — is WORSE, not better: full-cmdline substring matching\n*25|# is precisely the machine-wide-match class this script's own kill-scope rules forbid.\n 26|#\n 27|# Walking /proc and classifying on the exe path makes that path the SINGLE SOURCE OF TRUTH\n 28|# for both membership and scope, and the 15-char limit stops existing. comm is consulted\n...\n 35|#\n*36|# KILL SCOPE IS PATH-VERIFIED AND NARROW, re-resolved per-pid at kill time via\n 37|# /proc//exe — never a bare `pkill spt`. Live infra under a `spt-core/bin/` install\n 38|# prefix and any `owl` binary are hard-excluded even if a root is ever computed too wide,\n 39|# and a process whose exe link cannot be read is reported but never killed: unreadable\n### traceable-reqs-selftest.sh\n 40| # authentication/build, not just report an unrelated downstream exit 128.\n*41| case \"$out\" in *\"pin=0.4.1\"*) ;; *) printf 'FAIL missing pin: %s\\n' \"$out\"; exit 1;; esac\n 42| case \"$out\" in *\"box=\"*) ;; *) printf 'FAIL missing box: %s\\n' \"$out\"; exit 1;; esac\n 43| if [ \"$label\" = stale-no-token ]; then\n 44| case \"$out\" in *\"0.2.0\"*\"TRACEABLE_REQS_TOKEN\"*) ;; *) printf 'FAIL mismatch/auth diagnostic: %s\\n' \"$out\"; exit 1;; esac\n...\n 51| if [ \"$mode\" = install ] && [ \"$rc\" = 0 ]; then\n*52| [ \"$(\"$root/checkout/traceable-reqs\" --version)\" = 'traceable-reqs 0.4.1' ]\n 53| else\n 54| [ ! -e \"$root/checkout/traceable-reqs\" ]\n 55| fi\n...\n 60|run_case stale-no-token 'traceable-reqs 0.2.0' 0 '' precheck 1\n*61|run_case matching-no-token 'traceable-reqs 0.4.1' 0 '' precheck 0\n*62|run_case matching-install 'traceable-reqs 0.4.1' 0 '' install 0\n 63|run_case missing-no-token missing 0 '' install 1\n*64|run_case failed-version 'traceable-reqs 0.4.1' 7 '' precheck 1\n 65|run_case regex-lookalike 'traceable-reqs 0x4x1' 0 '' precheck 1\n 66|run_case repair-admitted 'traceable-reqs 0.2.0' 0 TOKEN_CANARY precheck 0\n 67|run_case clone-refusal 'traceable-reqs 0.2.0' 0 TOKEN_CANARY install 128\n### traceable-reqs.sh\n 4|set -euo pipefail\n*5|# 0.4.1 fixes file-root enumeration dropping present doc evidence (IR-109).\n*6|WANT=0.4.1\n 7|BIN=\"$HOME/.local/bin/traceable-reqs\"\n 8|mode=\"${1:-precheck}\"\n 9|case \"$mode\" in precheck|install) ;; *) echo 'usage: traceable-reqs.sh [precheck|install]' >&2; exit 2;; esac\n### ws272-w0.py\n 4|--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*5|all three IR-76 decisions without network access. --run requires the explicit\n 6|hold-release acknowledgement and repeats the live meter before each cargo leg.\n 7|Every leg retains its raw output and actual subprocess exit code beside it.\n 8|\n### ws272-w1.py\n 3|\n*4|Same shape as ws272-w0.py: the IR-76 three-arm pre-flight, the lane lock, the env\n 5|scrub, the cold-pool bootstrap. W1 adds spt-net to the nextest population (the\n 6|`web` record family lives there) and runs the new `twohost_web` bin ALONE as its\n 7|own leg, never beside the unit leg (it is env-gated and a silent no-op without\n...\n 10|--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*11|all three IR-76 decisions without network access. --run requires the explicit\n 12|hold-release acknowledgement and repeats the live meter before each cargo leg.\n 13|Every leg retains its raw output and actual subprocess exit code beside it.\n 14|\n### ws272-w2.py\n 3|\n*4|Same shape as ws272-w2.py — the IR-76 three-arm pre-flight, the lane lock, the env\n 5|scrub, the cold-pool bootstrap — with ONE deliberate difference: the nextest leg is\n 6|TARGETED, not a workspace sweep (gater ruling 2026-09-07 02:40Z). W2 shares the W1\n 7|pool (176 GB) on a box measuring ~28 GB free against CI's 32 GiB floor, and a full\n...\n 17|--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*18|all three IR-76 decisions without network access. --run requires the explicit\n 19|hold-release acknowledgement and repeats the live meter before each cargo leg.\n 20|Every leg retains its raw output and actual subprocess exit code beside it.\n 21|\n\nSkipped missing paths: .worktrees/hertz-ir86-disk-delta/xtask/src\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/AGENTS.md, .worktrees/hertz-ir86-disk-delta/.github, .worktrees/hertz-ir86-disk-delta/traceable-reqs.toml, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/common","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":20,"fileCount":8,"files":[".worktrees/hertz-ir86-disk-delta/.github/ci/reap-census.ps1",".worktrees/hertz-ir86-disk-delta/.github/ci/reap-census.sh",".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs-selftest.sh",".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs.sh",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w0.py",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w1.py",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w2.py",".worktrees/hertz-ir86-disk-delta/traceable-reqs.toml"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/reap-census.ps1","count":1},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/reap-census.sh","count":2},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs-selftest.sh","count":5},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs.sh","count":2},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w0.py","count":1},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w1.py","count":2},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w2.py","count":2},{"path":".worktrees/hertz-ir86-disk-delta/traceable-reqs.toml","count":5}],"truncated":true,"displayContent":"# .worktrees/hertz-ir86-disk-delta/\n## traceable-reqs.toml\n 24│enforce = \"on\"\n *25│module_banner = \"accept\"\n 26│\n 27│[[requirements]]\n 28│id = \"REQ-STATUS-LIVE-SUPERVISOR-PID\"\n │...\n 1176│required_stages = [\"doc\", \"impl\", \"unit\"] # doc activated restoration D1 (KNOWN-HAZARDS 6.8 + ADR-0018 + design doc V1). impl/unit activated restoration D6-3 (the one D6 toml activation): impl = rollback_compat.rs (the pre-ready durable-file registry PRE_READY_DURABLE_FILES — the enumerated guard surface) + the two-phase AppliedRecord (relcache.rs, additive durable state); unit = the rollback_compat tripwire (every current pre-ready file shape is additive / N-1-readable; a non-additive pre-ready chang...\n*1177│# --- Added 2026-06-11 (v0.4.2): the v0.4.1 fleet-roll Linux brain-respawn blocker (ADR-0018 Q3 amendment); rule 3 register-before-satisfy, rule 5 activate per task ---\n 1178│[[requirements]]\n 1179│id = \"REQ-HAZARD-BRAIN-RESPAWN-PATH\"\n 1180│title = \"The broker respawns the brain onto the APPLIED bytes, not the renamed old binary: the candidate-binary default is the canonical exe path captured ONCE at broker start, never a per-spawn std::env::current_exe() — on Linux current_exe (readlink /proc/self/exe) is inode-tracking and follows the `apply` rename (spt -> spt.old-N), so a resident broker would respawn the brain onto OLD bytes while recording `applied` (Windows GetModuleFileName is path-at-start, so Windows was green; ADR-0018 Q3 silen...\n*1181│required_stages = [\"doc\", \"impl\", \"unit\", \"int\"] # activated v0.4.2 (2026-06-11): minted from the v0.4.1 fleet-roll blocker. doc = KNOWN-HAZARDS 6.11 + ADR-0018 Q3 amendment; int = brain_respawn_rename.rs (real broker process, in-place rename P->P.old-N + new bytes at P, respawn must run B not A — fails Linux pre-fix). Stages: impl = brainproc.rs canonical-exe capture at spawn_brain_supervisor + promotion bytes-gate in supervise_brain Promoted arm (TrialEnv ready_exe_hash/staged_artifact_hash); unit =...\n 1182│# --- Added 2026-06-03 from grill-with-docs (ADR-0012, hazard 7.3); inactive until M4-D7.5 ---\n 1183│[[requirements]]\n 1184│id = \"REQ-HAZARD-PSYCHE-OUTBOUND-PROXY\"\n │...\n 3061│id = \"REQ-CI-POSTJOB-DAEMON-REAP\"\n*3062│title = \"A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job start AND job end so contamination and reap effectiveness are visible in every run's log. (Load-flake family leg 1, doyle-ratified 2026-07-22 from deployah's third-run analysis.) THE SIGNATURE THIS CLOSES: a DIFFERENT single daemon-spawning test dying per run with a bare exit 1 and NO assertion output — process-level death, not a failed assert — while sibling tests in the same families pass a...\n 3063│required_stages = [\"impl\"] # LOAD-FLAKE leg 1 ACTIVATED on build branch (todlando 2026-07-22). impl = .github/ci/reap-census.ps1 + .github/ci/reap-census.sh (scope roots, per-pid re-verification at kill time, hard exclusions, bounded settle, start/end census) wired into ci.yml's `test` and `n1-gate` jobs on both runners, the end step under always(). No unit stage: the evidence is a recipe the runner executes, and the acceptance is a census diff read off live run logs (zero test-spawned daemons surviving...\n 3064│\n 3065│[[requirements]]\n │...\n 3266│id = \"REQ-DAEMON-BITS-AMBIGUITY\"\n*3267│title = \"SEED (inactive, RCA-first — do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit twice in one day (2026-07-25). Case 1 (adapter-side echo): a post-reboot ensure race left a dev-build alchemy Hub Daemon serving release shells — version skew visible only by manually comparing process image paths. Case 2 (core, field-measured by flynn): TWO spt daemons resident with live brains on one node — the installed main daemon (owning ...\n 3268│required_stages = [] # rule 5: INACTIVE — RCA-first; activate when a milestone owns the daemon-identity observability question.\n 3269│\n 3270│# --- Seeded 2026-07-25 (doyle) from the operator's account of the 17:47 restart failure\n\n## .github/ci/\n### reap-census.ps1\n 25│\n*26│ KILL SCOPE IS PATH-VERIFIED AND NARROW, per-pid, AT KILL TIME — never machine-wide.\n 27│ A process is eligible only if its on-disk image sits under one of this run's own build\n 28│ roots (workspace, CARGO_TARGET_DIR, the notify-adapter checkout's target, RUNNER_TEMP,\n 29│ the pinned n1 old-broker build cache). Two hard exclusions are checked even for a\n### reap-census.sh\n 24│# 3. The obvious patch — `pgrep -f` — is WORSE, not better: full-cmdline substring matching\n*25│# is precisely the machine-wide-match class this script's own kill-scope rules forbid.\n 26│#\n 27│# Walking /proc and classifying on the exe path makes that path the SINGLE SOURCE OF TRUTH\n 28│# for both membership and scope, and the 15-char limit stops existing. comm is consulted\n │...\n 35│#\n*36│# KILL SCOPE IS PATH-VERIFIED AND NARROW, re-resolved per-pid at kill time via\n 37│# /proc//exe — never a bare `pkill spt`. Live infra under a `spt-core/bin/` install\n 38│# prefix and any `owl` binary are hard-excluded even if a root is ever computed too wide,\n 39│# and a process whose exe link cannot be read is reported but never killed: unreadable\n### traceable-reqs-selftest.sh\n 40│ # authentication/build, not just report an unrelated downstream exit 128.\n*41│ case \"$out\" in *\"pin=0.4.1\"*) ;; *) printf 'FAIL missing pin: %s\\n' \"$out\"; exit 1;; esac\n 42│ case \"$out\" in *\"box=\"*) ;; *) printf 'FAIL missing box: %s\\n' \"$out\"; exit 1;; esac\n 43│ if [ \"$label\" = stale-no-token ]; then\n 44│ case \"$out\" in *\"0.2.0\"*\"TRACEABLE_REQS_TOKEN\"*) ;; *) printf 'FAIL mismatch/auth diagnostic: %s\\n' \"$out\"; exit 1;; esac\n │...\n 51│ if [ \"$mode\" = install ] && [ \"$rc\" = 0 ]; then\n*52│ [ \"$(\"$root/checkout/traceable-reqs\" --version)\" = 'traceable-reqs 0.4.1' ]\n 53│ else\n 54│ [ ! -e \"$root/checkout/traceable-reqs\" ]\n 55│ fi\n │...\n 60│run_case stale-no-token 'traceable-reqs 0.2.0' 0 '' precheck 1\n*61│run_case matching-no-token 'traceable-reqs 0.4.1' 0 '' precheck 0\n*62│run_case matching-install 'traceable-reqs 0.4.1' 0 '' install 0\n 63│run_case missing-no-token missing 0 '' install 1\n*64│run_case failed-version 'traceable-reqs 0.4.1' 7 '' precheck 1\n 65│run_case regex-lookalike 'traceable-reqs 0x4x1' 0 '' precheck 1\n 66│run_case repair-admitted 'traceable-reqs 0.2.0' 0 TOKEN_CANARY precheck 0\n 67│run_case clone-refusal 'traceable-reqs 0.2.0' 0 TOKEN_CANARY install 128\n### traceable-reqs.sh\n 4│set -euo pipefail\n*5│# 0.4.1 fixes file-root enumeration dropping present doc evidence (IR-109).\n*6│WANT=0.4.1\n 7│BIN=\"$HOME/.local/bin/traceable-reqs\"\n 8│mode=\"${1:-precheck}\"\n 9│case \"$mode\" in precheck|install) ;; *) echo 'usage: traceable-reqs.sh [precheck|install]' >&2; exit 2;; esac\n### ws272-w0.py\n 4│--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*5│all three IR-76 decisions without network access. --run requires the explicit\n 6│hold-release acknowledgement and repeats the live meter before each cargo leg.\n 7│Every leg retains its raw output and actual subprocess exit code beside it.\n 8│\n### ws272-w1.py\n 3│\n *4│Same shape as ws272-w0.py: the IR-76 three-arm pre-flight, the lane lock, the env\n 5│scrub, the cold-pool bootstrap. W1 adds spt-net to the nextest population (the\n 6│`web` record family lives there) and runs the new `twohost_web` bin ALONE as its\n 7│own leg, never beside the unit leg (it is env-gated and a silent no-op without\n │...\n 10│--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*11│all three IR-76 decisions without network access. --run requires the explicit\n 12│hold-release acknowledgement and repeats the live meter before each cargo leg.\n 13│Every leg retains its raw output and actual subprocess exit code beside it.\n 14│\n### ws272-w2.py\n 3│\n *4│Same shape as ws272-w2.py — the IR-76 three-arm pre-flight, the lane lock, the env\n 5│scrub, the cold-pool bootstrap — with ONE deliberate difference: the nextest leg is\n 6│TARGETED, not a workspace sweep (gater ruling 2026-09-07 02:40Z). W2 shares the W1\n 7│pool (176 GB) on a box measuring ~28 GB free against CI's 32 GiB floor, and a full\n │...\n 17│--preflight-only makes no build claim and runs no cargo. --self-test exercises\n*18│all three IR-76 decisions without network access. --run requires the explicit\n 19│hold-release acknowledgement and repeats the live meter before each cargo leg.\n 20│Every leg retains its raw output and actual subprocess exit code beside it.\n 21│","missingPaths":[".worktrees/hertz-ir86-disk-delta/xtask/src"],"linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789483683943}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_LSsdWOUS92qzkbZeHEmIMANj|fc_000c7cef03cac861016aa95ab3f0f487d186dfb8587f6291d4","toolName":"glob","startedAt":"2026-09-15T14:48:20.444Z","args":{"path":".worktrees/hertz-ir86-disk-delta/**/brainread*;.worktrees/hertz-ir86-disk-delta/**/common*;.worktrees/hertz-ir86-disk-delta/**/pool*.rs"},"intent":"Locating source seams"},"id":"de8ed0e5","parentId":"14cca78f","timestamp":"2026-09-15T14:48:20.444Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_qjddaxyctVVq1q5bXueyVdUm|fc_000c7cef03cac861016aa95ab3f10487d18fdb80e2835f7b83","toolName":"grep","startedAt":"2026-09-15T14:48:20.444Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs;.wo…"},"intent":"Finding current remedy implementations"},"id":"731f20c0","parentId":"de8ed0e5","timestamp":"2026-09-15T14:48:20.445Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Ql1a5zFwhmaAWjY87WJIPBjJ|fc_000c7cef03cac861016aa95ab3f10c87d1821a480a12e9d8e9","toolName":"grep","startedAt":"2026-09-15T14:48:20.447Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_reader_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/br…"},"intent":"Checking adopted guards and recipe"},"id":"93070db2","parentId":"731f20c0","timestamp":"2026-09-15T14:48:20.447Z"}
{"type":"message","id":"f38b6591","parentId":"93070db2","timestamp":"2026-09-15T14:48:20.468Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Locating actual xtask crates**"},{"type":"toolCall","id":"call_LSsdWOUS92qzkbZeHEmIMANj|fc_000c7cef03cac861016aa95ab3f0f487d186dfb8587f6291d4","name":"glob","arguments":{"i":"Locating source seams","path":".worktrees/hertz-ir86-disk-delta/**/brainread*;.worktrees/hertz-ir86-disk-delta/**/common*;.worktrees/hertz-ir86-disk-delta/**/pool*.rs","hidden":true,"gitignore":false,"limit":60},"intent":"Locating source seams"},{"type":"toolCall","id":"call_qjddaxyctVVq1q5bXueyVdUm|fc_000c7cef03cac861016aa95ab3f10487d18fdb80e2835f7b83","name":"grep","arguments":{"i":"Finding current remedy implementations","pattern":"resolve_daemon_docs_port|daemon_pid_path|try_spt_hosted_inject|IO_KIND_MSG_IN|disk|free_space|available_space","path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/twohost.rs","case":false,"gitignore":false,"skip":null},"intent":"Finding current remedy implementations"},{"type":"toolCall","id":"call_Ql1a5zFwhmaAWjY87WJIPBjJ|fc_000c7cef03cac861016aa95ab3f10c87d1821a480a12e9d8e9","name":"grep","arguments":{"i":"Checking adopted guards and recipe","pattern":"DaemonReaper|impl Drop|pool-release|release.before|prebuilt|outside.*repo|git toplevel|quiet.window|IR-76|IR-106","path":".worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_reader_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_split.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_respawn_rename.rs;.worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md;.worktrees/hertz-ir86-disk-delta/AGENTS.md","case":false,"gitignore":false,"skip":null},"intent":"Checking adopted guards and recipe"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":12700,"output":481,"cacheRead":101632,"cacheWrite":0,"totalTokens":114813,"reasoningTokens":11,"cost":{"input":0.127,"output":0.024050000000000002,"cacheRead":0.101632,"cacheWrite":0,"total":0.252682}},"stopReason":"toolUse","timestamp":1789483683982,"responseId":"resp_000c7cef03cac861016aa95aa44ef087d1890e7bea2457026b","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95aa5872c87d19040dc7171f9fe67","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVqz-Yp38ne-2koX4-0t5h1mQnx4zzy7doymsmt4FQVgo8FkpLL69FdRT1ctqCJZ1_Mn9OdetTw2lLHuhWSnBqYa8z1RNBqJlgFJ-M556I227EEDtZ0OpTemex-vNRlNXgQv52HcXgMtSljxU64xOK4YcRRSdaSeZfbYdV-3w4lIWuyVkJAxBsNuBd-EqAtXzp2chjCEDhoqMmVSTF630OVM1u_xuhXBc-vWoM4aftm0EEYhbIIW746a4Wf2cW9Dwz1pj9TNHhyiW6u8xjcBE3w7or2Y7ndHSLnxGK9EyaPe1JUxm7TNwtYdfs_ScPqRO5Qobt4MmuVJ5h1Y8I45GkVpFOkiDdJwwHrxvFES9V5E7tjxcATEKdgQeijHMI-Tljl9ruFGCKXvogcJBaZBaRIdg1MwT7FtveV2pijj-loebOoTJyPrUI9U4be0NfuPV3-PXSXRmfEvkfQ5vlJPaqd3Wd1PGslbByIORaNXqwao1tvT9Z57tkYan_YB3M9Y2kWZvPdaz8iLVKW3mDb7E6oLSHN31T7-WxP0QY9837oVucND3FFil7IXeZtXDbaH3H8-vAZh04VJhRZlBtKkTpEBVjT_WNXWyGxVyY9oQqkFibneaYGuQgjMUQD9SyyoHPmmVZoXUQN435ThnLaivHtrcrFn3PBk6wctJmPneskbY9LrcdtFl-7hAzYou8wBPwp60qfiU2J5dj0KaaGuLD-OJ7O6pEzkRDCi6zztyQw9igJliWeiUFVG2ALjeLOFMsjEvhuciiTEIVBvonbzy-qFOuZMtqWJg-JxJSsoFKaPvyXqDFK9QeDqoMLR1_w1T8lUueK-Lm9oFnyKdl-C7XJV0fco61toD-sEz3xVso4ofw_CwQp1q57gUd0xvOua0a6mwZJzI_JDvl8gOt8HfGvkkeTDkXoW-Vu4eehEX-p0eUK8Gk8CXPWUddGj_sASeGDTcrUV8QGjWXLFWzONKimy-ybnC8GppMdf6U2qiHF5puqDiUSoOU8D89Go70A4pIxDi7KTWTZrKdd6NGpXqwtPSH9evFfSTeZg6TG-V3uTEnx6yWamnDLGYJAiZJ0f35drVqRNS-HJfvDP77e9_Dbc4dY2fdErKiP_YbdM1AhvKZmX-DlUljlwgyBfObFAPJRz0GHHG3H2bZWKbwS5MwTwkJbPq8MAfsnP14-D1r0f-UoXZ2Sl7vzV1N2DAuzrmPk9ahZ3uWJuaBtJ1nMMA__UfmHevVXVOWx6o2Ngi95K6Zmum59XUv2JpZtIMw8rsNRKQd3QD9GTuuGiyFJkCLJYH0Dfo3qZZG8MSG61-oBzSbHAUwiXKQu9732HE-O2N2zz","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Locating actual xtask crates**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ab3f0f487d186dfb8587f6291d4","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating source seams\",\"path\":\".worktrees/hertz-ir86-disk-delta/**/brainread*;.worktrees/hertz-ir86-disk-delta/**/common*;.worktrees/hertz-ir86-disk-delta/**/pool*.rs\",\"hidden\":true,\"gitignore\":false,\"limit\":60}","call_id":"call_LSsdWOUS92qzkbZeHEmIMANj","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"glob","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ab3f10487d18fdb80e2835f7b83","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding current remedy implementations\",\"pattern\":\"resolve_daemon_docs_port|daemon_pid_path|try_spt_hosted_inject|IO_KIND_MSG_IN|disk|free_space|available_space\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/twohost.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_qjddaxyctVVq1q5bXueyVdUm","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ab3f10c87d1821a480a12e9d8e9","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking adopted guards and recipe\",\"pattern\":\"DaemonReaper|impl Drop|pool-release|release.before|prebuilt|outside.*repo|git toplevel|quiet.window|IR-76|IR-106\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_reader_e2e.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_split.rs;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_respawn_rename.rs;.worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md;.worktrees/hertz-ir86-disk-delta/AGENTS.md\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_Ql1a5zFwhmaAWjY87WJIPBjJ","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":16436.875100016594,"ttft":1571.6533000171185,"completedAt":1789483700440,"contextSnapshot":{"promptTokens":114332,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"b23bed1a","parentId":"f38b6591","timestamp":"2026-09-15T14:48:20.498Z","message":{"role":"toolResult","toolCallId":"call_LSsdWOUS92qzkbZeHEmIMANj|fc_000c7cef03cac861016aa95ab3f0f487d186dfb8587f6291d4","toolName":"glob","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/crates/\n## xtask/\n### src/\nbrainread.rs\n### tests/\npool_claim.rs\n## spt/tests/common/\n## spt-store/tests/\npool_guard_canary.rs"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/**/brainread*, .worktrees/hertz-ir86-disk-delta/**/common*, .worktrees/hertz-ir86-disk-delta/**/pool*.rs","fileCount":4,"files":[".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs",".worktrees/hertz-ir86-disk-delta/crates/spt/tests/common/",".worktrees/hertz-ir86-disk-delta/crates/spt-store/tests/pool_guard_canary.rs",".worktrees/hertz-ir86-disk-delta/crates/xtask/tests/pool_claim.rs"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1789483700497}}
{"type":"message","id":"0f8bad5b","parentId":"b23bed1a","timestamp":"2026-09-15T14:48:20.520Z","message":{"role":"toolResult","toolCallId":"call_qjddaxyctVVq1q5bXueyVdUm|fc_000c7cef03cac861016aa95ab3f10487d18fdb80e2835f7b83","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/\n\n## src/\n### docshost.rs\n 113|// [impl->REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS]\n*114|pub fn resolve_daemon_docs_port(\n 115| config_port: Option,\n 116| env_value: Option<&str>,\n 117| ephemeral_advisory_ports: bool,\n...\n 620| let selected =\n*621| resolve_daemon_docs_port(Some(occupied_port), Some(\"not-a-port\"), true);\n 622| assert_eq!(selected, 0, \"rig posture wins over every fixed-port layer\");\n 623|\n 624| let docs = tempfile::tempdir().expect(\"temp docs root\");\n### daemon.rs\n 29|use crate::endpoint::{\n*30| broker_socket_name, daemon_pid_path, digest_socket_name, drive_socket_name, seed_socket_name,\n 31|};\n 32|use crate::nethost::{NetConfig, NetHost};\n 33|use crate::seedmap::{self, SeedRegistry};\n...\n 247| // the controller slot, the viewer map, and the viewer origin\n*248| // nodes retained on `ViewerSink`. A disk reconciler could not\n 249| // compose its frame, and snapshotting attachment identity to\n*250| // disk for one to read was refused. Background + best-effort:\n 251| // a spawn failure logs loud and the daemon runs on, exactly\n 252| // like the docs server below — shells simply do not learn who\n 253| // is watching, which degrades a signal rather than a surface.\n...\n 282| crate::lanhost::capture_canonical_exe();\n*283| let port = crate::docshost::resolve_daemon_docs_port(\n 284| crate::config::DaemonConfig::load().docs_port,\n 285| std::env::var(crate::docshost::DOCS_PORT_ENV).ok().as_deref(),\n 286| std::env::var_os(\n...\n 396| // resource, which is the ADR-0018 Q2/Q5 broker-side test. The shellwake\n*397| // Q5 exception reads \"a pure disk-reconciler\" and this is not one. Hosting\n 398| // it in the restartable brain would also make every routine brain restart\n 399| // — `StartReason::Update` is exactly that — bounce every resident service\n 400| // through the orphan path with no quiesce, no grace and no hold, which is\n...\n 432| // D2-2): shellwake is brain-owned logic (ADR-0018 Q5 exception), a pure\n*433| // disk-reconciler whose boot sweep re-reconciles the watcher children on\n 434| // every brain start. The broker no longer hosts it; see\n 435| // [`crate::brainproc::run_brain`].\n 436| // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n...\n 475| // is the socket ping, never this file, so a stale value is harmless.\n*476| let _ = std::fs::write(daemon_pid_path(), std::process::id().to_string());\n 477|\n 478| // The seed-control channel is the foreground loop. Binding it is what\n 479| // arbitrates the single-daemon-per-home invariant: a second daemon racing\n...\n 2049|/// The Win32 `GetFileType` result for a PIPE handle — the ONLY std-handle sink that\n*2050|/// BLOCKS when it fills. (DISK=1, CHAR=2, PIPE=3, UNKNOWN=0.)\n 2051|pub const FILE_TYPE_PIPE: u32 = 0x0003;\n 2052|\n 2053|/// Decide whether `daemon run` must NULL its std handles as a detached-in-fact\n...\n 2056|/// daemon once full. Every OTHER sink is safe and MUST survive: a FILE (`2>run.log`,\n*2057|/// AND every int test's `Stdio::from(file)` brain-log capture) is a disk handle that\n 2058|/// never blocks; a CONSOLE scrolls; a NULL/absent handle (the DETACHED_PROCESS rungs)\n 2059|/// already discards. So we DELIBERATELY do NOT gate on \"no console\" (`GetConsoleWindow`):\n 2060|/// a CREATE_NO_WINDOW daemon has no console window yet a perfectly-drained FILE stderr\n...\n 2078|/// pipe-tee ergonomics. The SANCTIONED foreground-capture form is a FILE redirect\n*2079|/// (`spt daemon run 2>run.log`): a disk handle is not a pipe, so it survives (this is\n 2080|/// exactly why the int-test brain-log capture is safe). Called unconditionally at\n 2081|/// `daemon run` startup. // [impl->REQ-HAZARD-DETACHED-DAEMON-STDIO]\n 2082|#[cfg(windows)]\n...\n 3084| const FILE_TYPE_UNKNOWN: u32 = 0x0000;\n*3085| const FILE_TYPE_DISK: u32 = 0x0001;\n 3086| const FILE_TYPE_CHAR: u32 = 0x0002;\n 3087| assert!(should_null_std_handles(FILE_TYPE_PIPE), \"an undrained pipe blocks ⇒ null\");\n 3088| assert!(\n*3089| !should_null_std_handles(FILE_TYPE_DISK),\n*3090| \"a FILE redirect (2>run.log / the int-test brain-log) is disk ⇒ survives\"\n 3091| );\n 3092| assert!(\n 3093| !should_null_std_handles(FILE_TYPE_CHAR),\n### inject.rs\n 74|// [impl->REQ-SEND-SPT-HOSTED]\n*75|pub fn try_spt_hosted_inject(\n 76| target: &str,\n 77| from: &str,\n 78| body: &str,\n...\n 100| .and_then(|parsed| parsed.attr(spt_proto::event::EVENT_ATTR_MSG_ID).map(str::to_owned));\n*101| let event = crate::iobus::IoEvent::new(target, spt_proto::ioevent::IO_KIND_MSG_IN, body)\n 102| .with_peer(from)\n 103| .with_msg_id(msg_id);\n 104| for published in crate::iobus::default_bus(owlery, now_ms()).publish(&event) {\n...\n 117|/// an operator poke. Identical mechanic to the F-023 idle-EDGE drain: CLAIM the pending\n*118|/// rows (audited, idle-inject leg), offer each through [`try_spt_hosted_inject`]\n 119|/// (`native=false` — the genuine idle window), and on the first miss (no live\n 120|/// translation binary, or the broker still views the endpoint ACTIVE) RELEASE the row\n 121|/// plus all not-yet-attempted back to the spool intact (v0.14.3 LAW: spooled loud, never\n...\n 185| for (msg_id, from, body) in rest.by_ref() {\n*186| match try_spt_hosted_inject(id, &from, &body, owlery, native) {\n 187| Some((true, _)) => delivered += 1,\n 188| _ => {\n 189| release_ids.push(msg_id);\n...\n 250|\n*251| /// Establish an on-disk perch that reads ONLINE + broker-PTY-controllable: the\n 252| /// class the inject leg targets.\n 253| fn establish_hosted(id: &str) -> std::path::PathBuf {\n 254| let perch_path = perch::resolve_perch_path(id, ParentHint::Infer);\n\n## tests/\n### twohost.rs\n 180|// process-global SPT_HOME, so B projects from a store A can already see. Here the\n*181|// logs, the idle sentinel and the projection are on the OTHER HOST's disk.\n 182|//\n 183|// Its OWN endpoint on purpose: writing a `.idle` sentinel onto ID_B would change\n 184|// delivery routing under the message/presence rungs, and a digest.log would ride\n...\n 284|/// A→B store-state signal (the rung-7 replicated-notif pattern): A has sent AND\n*285|/// has read its own correlation row back off disk. B may now answer. Without the\n 286|/// barrier B would race the write whose effect the rung exists to measure, and a\n 287|/// refused answer would read as the defect rather than as the race.\n 288|const SIG_REPLY_RECORDED: &str = \"twohost-reply-outbound-recorded-at-a\";\n...\n 2997|\n*2998| // The barrier is the fact this rung rests on, read back off disk rather\n 2999| // than inferred from the send having returned: `request_wan` writing the\n 3000| // row IS the change under test, so assuming it here would make the\n 3001| // cross-node arm the only thing that could fail and give a missing write\n...\n 3059| // digest; B's logs, B's idle sentinel and B's projection are all on the other\n*3060| // machine's disk — the part the hermetic single-box rig cannot prove, since\n 3061| // there both \"nodes\" share one process-global SPT_HOME.\n 3062| //\n 3063| // The composition this pins (ADR-0048's own note): seal-on-idle's stable seqs\n...\n 3138| Some(DIGEST_INPUT),\n*3139| \"the turn text is the one B wrote on ITS disk\"\n 3140| );\n 3141|\n 3142| // The SEAL crossed intact: B reported idle, so the trailing turn arrives"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/twohost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\spt-daemon","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":25,"fileCount":4,"files":[".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/twohost.rs"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs","count":2},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs","count":13},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs","count":5},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/twohost.rs","count":5}],"truncated":false,"displayContent":"# .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/\n\n## src/\n### docshost.rs\n 113│// [impl->REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS]\n*114│pub fn resolve_daemon_docs_port(\n 115│ config_port: Option,\n 116│ env_value: Option<&str>,\n 117│ ephemeral_advisory_ports: bool,\n │...\n 620│ let selected =\n*621│ resolve_daemon_docs_port(Some(occupied_port), Some(\"not-a-port\"), true);\n 622│ assert_eq!(selected, 0, \"rig posture wins over every fixed-port layer\");\n 623│\n 624│ let docs = tempfile::tempdir().expect(\"temp docs root\");\n### daemon.rs\n 29│use crate::endpoint::{\n *30│ broker_socket_name, daemon_pid_path, digest_socket_name, drive_socket_name, seed_socket_name,\n 31│};\n 32│use crate::nethost::{NetConfig, NetHost};\n 33│use crate::seedmap::{self, SeedRegistry};\n │...\n 247│ // the controller slot, the viewer map, and the viewer origin\n *248│ // nodes retained on `ViewerSink`. A disk reconciler could not\n 249│ // compose its frame, and snapshotting attachment identity to\n *250│ // disk for one to read was refused. Background + best-effort:\n 251│ // a spawn failure logs loud and the daemon runs on, exactly\n 252│ // like the docs server below — shells simply do not learn who\n 253│ // is watching, which degrades a signal rather than a surface.\n │...\n 282│ crate::lanhost::capture_canonical_exe();\n *283│ let port = crate::docshost::resolve_daemon_docs_port(\n 284│ crate::config::DaemonConfig::load().docs_port,\n 285│ std::env::var(crate::docshost::DOCS_PORT_ENV).ok().as_deref(),\n 286│ std::env::var_os(\n │...\n 396│ // resource, which is the ADR-0018 Q2/Q5 broker-side test. The shellwake\n *397│ // Q5 exception reads \"a pure disk-reconciler\" and this is not one. Hosting\n 398│ // it in the restartable brain would also make every routine brain restart\n 399│ // — `StartReason::Update` is exactly that — bounce every resident service\n 400│ // through the orphan path with no quiesce, no grace and no hold, which is\n │...\n 432│ // D2-2): shellwake is brain-owned logic (ADR-0018 Q5 exception), a pure\n *433│ // disk-reconciler whose boot sweep re-reconciles the watcher children on\n 434│ // every brain start. The broker no longer hosts it; see\n 435│ // [`crate::brainproc::run_brain`].\n 436│ // [impl->REQ-HAZARD-BROKER-PROCESS-ISOLATION]\n │...\n 475│ // is the socket ping, never this file, so a stale value is harmless.\n *476│ let _ = std::fs::write(daemon_pid_path(), std::process::id().to_string());\n 477│\n 478│ // The seed-control channel is the foreground loop. Binding it is what\n 479│ // arbitrates the single-daemon-per-home invariant: a second daemon racing\n │...\n 2049│/// The Win32 `GetFileType` result for a PIPE handle — the ONLY std-handle sink that\n*2050│/// BLOCKS when it fills. (DISK=1, CHAR=2, PIPE=3, UNKNOWN=0.)\n 2051│pub const FILE_TYPE_PIPE: u32 = 0x0003;\n 2052│\n 2053│/// Decide whether `daemon run` must NULL its std handles as a detached-in-fact\n │...\n 2056│/// daemon once full. Every OTHER sink is safe and MUST survive: a FILE (`2>run.log`,\n*2057│/// AND every int test's `Stdio::from(file)` brain-log capture) is a disk handle that\n 2058│/// never blocks; a CONSOLE scrolls; a NULL/absent handle (the DETACHED_PROCESS rungs)\n 2059│/// already discards. So we DELIBERATELY do NOT gate on \"no console\" (`GetConsoleWindow`):\n 2060│/// a CREATE_NO_WINDOW daemon has no console window yet a perfectly-drained FILE stderr\n │...\n 2078│/// pipe-tee ergonomics. The SANCTIONED foreground-capture form is a FILE redirect\n*2079│/// (`spt daemon run 2>run.log`): a disk handle is not a pipe, so it survives (this is\n 2080│/// exactly why the int-test brain-log capture is safe). Called unconditionally at\n 2081│/// `daemon run` startup. // [impl->REQ-HAZARD-DETACHED-DAEMON-STDIO]\n 2082│#[cfg(windows)]\n │...\n 3084│ const FILE_TYPE_UNKNOWN: u32 = 0x0000;\n*3085│ const FILE_TYPE_DISK: u32 = 0x0001;\n 3086│ const FILE_TYPE_CHAR: u32 = 0x0002;\n 3087│ assert!(should_null_std_handles(FILE_TYPE_PIPE), \"an undrained pipe blocks ⇒ null\");\n 3088│ assert!(\n*3089│ !should_null_std_handles(FILE_TYPE_DISK),\n*3090│ \"a FILE redirect (2>run.log / the int-test brain-log) is disk ⇒ survives\"\n 3091│ );\n 3092│ assert!(\n 3093│ !should_null_std_handles(FILE_TYPE_CHAR),\n### inject.rs\n 74│// [impl->REQ-SEND-SPT-HOSTED]\n *75│pub fn try_spt_hosted_inject(\n 76│ target: &str,\n 77│ from: &str,\n 78│ body: &str,\n │...\n 100│ .and_then(|parsed| parsed.attr(spt_proto::event::EVENT_ATTR_MSG_ID).map(str::to_owned));\n*101│ let event = crate::iobus::IoEvent::new(target, spt_proto::ioevent::IO_KIND_MSG_IN, body)\n 102│ .with_peer(from)\n 103│ .with_msg_id(msg_id);\n 104│ for published in crate::iobus::default_bus(owlery, now_ms()).publish(&event) {\n │...\n 117│/// an operator poke. Identical mechanic to the F-023 idle-EDGE drain: CLAIM the pending\n*118│/// rows (audited, idle-inject leg), offer each through [`try_spt_hosted_inject`]\n 119│/// (`native=false` — the genuine idle window), and on the first miss (no live\n 120│/// translation binary, or the broker still views the endpoint ACTIVE) RELEASE the row\n 121│/// plus all not-yet-attempted back to the spool intact (v0.14.3 LAW: spooled loud, never\n │...\n 185│ for (msg_id, from, body) in rest.by_ref() {\n*186│ match try_spt_hosted_inject(id, &from, &body, owlery, native) {\n 187│ Some((true, _)) => delivered += 1,\n 188│ _ => {\n 189│ release_ids.push(msg_id);\n │...\n 250│\n*251│ /// Establish an on-disk perch that reads ONLINE + broker-PTY-controllable: the\n 252│ /// class the inject leg targets.\n 253│ fn establish_hosted(id: &str) -> std::path::PathBuf {\n 254│ let perch_path = perch::resolve_perch_path(id, ParentHint::Infer);\n\n## tests/\n### twohost.rs\n 180│// process-global SPT_HOME, so B projects from a store A can already see. Here the\n *181│// logs, the idle sentinel and the projection are on the OTHER HOST's disk.\n 182│//\n 183│// Its OWN endpoint on purpose: writing a `.idle` sentinel onto ID_B would change\n 184│// delivery routing under the message/presence rungs, and a digest.log would ride\n │...\n 284│/// A→B store-state signal (the rung-7 replicated-notif pattern): A has sent AND\n *285│/// has read its own correlation row back off disk. B may now answer. Without the\n 286│/// barrier B would race the write whose effect the rung exists to measure, and a\n 287│/// refused answer would read as the defect rather than as the race.\n 288│const SIG_REPLY_RECORDED: &str = \"twohost-reply-outbound-recorded-at-a\";\n │...\n 2997│\n*2998│ // The barrier is the fact this rung rests on, read back off disk rather\n 2999│ // than inferred from the send having returned: `request_wan` writing the\n 3000│ // row IS the change under test, so assuming it here would make the\n 3001│ // cross-node arm the only thing that could fail and give a missing write\n │...\n 3059│ // digest; B's logs, B's idle sentinel and B's projection are all on the other\n*3060│ // machine's disk — the part the hermetic single-box rig cannot prove, since\n 3061│ // there both \"nodes\" share one process-global SPT_HOME.\n 3062│ //\n 3063│ // The composition this pins (ADR-0048's own note): seal-on-idle's stable seqs\n │...\n 3138│ Some(DIGEST_INPUT),\n*3139│ \"the turn text is the one B wrote on ITS disk\"\n 3140│ );\n 3141│\n 3142│ // The SEAL crossed intact: B reported idle, so the trailing turn arrives"},"isError":false,"timestamp":1789483700519}}
{"type":"message","id":"a7d11eaf","parentId":"0f8bad5b","timestamp":"2026-09-15T14:48:20.546Z","message":{"role":"toolResult","toolCallId":"call_Ql1a5zFwhmaAWjY87WJIPBjJ|fc_000c7cef03cac861016aa95ab3f10c87d1821a480a12e9d8e9","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/\n## AGENTS.md\n 39|\n*40|- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the quest...\n 41|- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 ...\n 42|- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n 43|\n\n## docs/\n### GOLDEN-CI.md\n 25|\n*26|## Shared-runner quiet-window predicate\n 27|\n 28|\n 29|\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_reader_e2e.rs, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_split.rs, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/brain_respawn_rename.rs, .worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md, .worktrees/hertz-ir86-disk-delta/AGENTS.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":2,"fileCount":2,"files":[".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md",".worktrees/hertz-ir86-disk-delta/AGENTS.md"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md","count":1},{"path":".worktrees/hertz-ir86-disk-delta/AGENTS.md","count":1}],"truncated":true,"displayContent":"# .worktrees/hertz-ir86-disk-delta/\n## AGENTS.md\n 39│\n*40│- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the quest...\n 41│- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 ...\n 42│- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n 43│\n\n## docs/\n### GOLDEN-CI.md\n 25│\n*26│## Shared-runner quiet-window predicate\n 27│\n 28│\n 29│","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789483700545}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_wxE2LgQMqRc85Bpwo9CjKNxK|fc_000c7cef03cac861016aa95ab8be8c87d1bba64c77f539d59d","toolName":"hub","startedAt":"2026-09-15T14:48:26.070Z","intent":"Flagging already shipped inject remedy"},"id":"2fbecc9b","parentId":"a7d11eaf","timestamp":"2026-09-15T14:48:26.070Z"}
{"type":"message","id":"e3747261","parentId":"2fbecc9b","timestamp":"2026-09-15T14:48:26.071Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Recovering truncated entries**"},{"type":"toolCall","id":"call_wxE2LgQMqRc85Bpwo9CjKNxK|fc_000c7cef03cac861016aa95ab8be8c87d1bba64c77f539d59d","name":"hub","arguments":{"i":"Flagging already shipped inject remedy","op":"send","to":"Main","message":"IR92 register stale: fixed-tree crates/spt-daemon/src/inject.rs:95-109 already publishes MSG_IN at successful try_spt_hosted_inject chokepoint. Do not redispatch. IR109 accept key still live (traceable-reqs.toml:25); IR90 remains absent in inspected sync/twohost source. Full 67-ID disposition follows."},"intent":"Flagging already shipped inject remedy"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":3340,"output":144,"cacheRead":114176,"cacheWrite":0,"totalTokens":117660,"reasoningTokens":30,"cost":{"input":0.033400000000000006,"output":0.007200000000000001,"cacheRead":0.114176,"cacheWrite":0,"total":0.154776}},"stopReason":"toolUse","timestamp":1789483700581,"responseId":"resp_000c7cef03cac861016aa95ab4c5a887d1bc23c07752d2d35e","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95ab5b04087d1a10a5c72a323d406","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVq4j0UbEzqfTR_s0_tH5S_5KLv_obIR0xLnDWA6ais3VcnJrfgGt8vKjY0fMDxrc78sB8QhX1VYJuhzLZqDSXlTFkgj0m-zseUm2weulMjTfpQ9hLciRqqmvzG_Wnyn4ER9CaRKHe9GGN0mADtlkdxkAlMpU73QG13SG_WkTWtKXgJpMFG0mD7wGxxnE7ZIfi84bo4Mhxg5H6d_e11Bw65D9nFa4imdVHUVn45ErI_cQUUz1gGt4mOErNJaadURyizV3jzN1dvRAHMYn9QAewuBwFbiqotFQWR-VTMKeQcnrpOsgrubCT9z-9UIVzAufGjtUXNaTVZ1mWxfh4MCU7oPu_aDvPxof28zVXoEy2ZBq20P36ih68v_xvpFq-u6C-pwVgm4I3ZWvmvO6Mj9F0jJ5_-r8FB5d5idvkycSTBEllswdxT6__-DynTTexO-WNB3_OGj4uautEIL5Pra8CVEganc8fwahw9jVg18bEZBNOz0XI4dqdDqOgCgw41KOUY2LKN7F3N-vfblADADMu0SRSGc3YHjEaIViA8GJrbNOdHpvzVnvaavh0cUym9ayrZgKi5m28WiJKKUMgzf5WplxkEZiBH1A4GlNXsKPkAGFkRIA9gXfGTPFwd4BBxUksPdUOWqLIPVuKBujCPZatkgUu2xXtaMvrQIDgi_FzS9W70Snn5q_PvCuAhpBN_cAL4FVX9KG8T0OE2N-tjfMINuhTLKslTk4RIx4vM3mVGnoMfldif0306Gttzm0bQBWWkYjD56cn0kdeuGT79F3OzSp21NJ41bWxSbhq1Umz7ClVx0UaT3X03HZpt9qApb5cjZ-MgwBsXMRuB63XoiHXuC_WY3Bd_vrVfCtIvvvOUS7GZsj8lhwuH1UEbx7xGXFLBnnC4f7Y2tzs648hiAZUIInszjH6yl4g6Q9R_Ef8DIrIoEo_ZXs3e364SjBxlGBOQ7GcRc-olE-9SjMUcQPV6D1KqeomQHr3bGjbuYuFC48Xb-ELjifQgOSSe3cca5-7_D7gRovX83oO6MGhICWWVu3yGg5qccWzJfEuatpVYgKMQ-9M-iCrpjZUqN8Tpw0Um8yEW3ZarRIuWiId6KE5cEMqzAqwOsS0Z4Ro09zB5hidQ3u6-PZjwWZuLF6324ESnQkEMqShRHcvbIPucZYxSEUufobdcxLFL-1QeJUFOMDOkDZRA3yBmeXA_IxRqx4Z8X-oztdqhBrcJ8K5BqnO6BdN5804FS2z7_8OkRXBe_hGFJuC1lwMVXZ0r4IppPwkzhUBqrrlEOFSUb795yaRQ3M5HXPG09kCjSpEcli05SdbsOlzySzMPp8iA19Iq5GCEfeFr101zNGSAqjDhWpZ9FqZKx4vtGRnVoA5t0E4eyj__faErPWtFQvdasqCTmCrD5FL3MA-YTLSH8S6G9nWXERX6Dhf3lcjurf1amWbZ9aZ8=","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Recovering truncated entries**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ab8be8c87d1bba64c77f539d59d","type":"function_call","status":"completed","arguments":"{\"i\":\"Flagging already shipped inject remedy\",\"op\":\"send\",\"to\":\"Main\",\"message\":\"IR92 register stale: fixed-tree crates/spt-daemon/src/inject.rs:95-109 already publishes MSG_IN at successful try_spt_hosted_inject chokepoint. Do not redispatch. IR109 accept key still live (traceable-reqs.toml:25); IR90 remains absent in inspected sync/twohost source. Full 67-ID disposition follows.\"}","call_id":"call_wxE2LgQMqRc85Bpwo9CjKNxK","internal_chat_message_metadata_passthrough":{"create_time":1789483700.935775,"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"hub","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":5488.231799989939,"ttft":2234.0937999784946,"completedAt":1789483706070,"contextSnapshot":{"promptTokens":117516,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"05a4e0aa","parentId":"e3747261","timestamp":"2026-09-15T14:48:26.073Z","message":{"role":"toolResult","toolCallId":"call_wxE2LgQMqRc85Bpwo9CjKNxK|fc_000c7cef03cac861016aa95ab8be8c87d1bba64c77f539d59d","toolName":"hub","content":[{"type":"text","text":"Delivered to 1 peer(s):\n- Main: injected"}],"details":{"op":"send","from":"RegisterLater","to":"Main","receipts":[{"to":"Main","outcome":"injected"}]},"isError":false,"timestamp":1789483706072}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_1Ox1qSbJQ9WWw9iZRexzhaOz|fc_000c7cef03cac861016aa95ac70d1887d185c3abb948d98674","toolName":"read","startedAt":"2026-09-15T14:48:39.137Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs:104-135"},"intent":"Reading candidate implementation boundaries"},"id":"51acab71","parentId":"05a4e0aa","timestamp":"2026-09-15T14:48:39.137Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_i0CaS7AiD7lyaEwc1XYUxGT1|fc_000c7cef03cac861016aa95ac70d3087d18b184d3f5ffd1e1c","toolName":"read","startedAt":"2026-09-15T14:48:39.137Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs:75-112"},"intent":"Reading inject publication boundary"},"id":"036b2863","parentId":"51acab71","timestamp":"2026-09-15T14:48:39.137Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_aIK7qRHtqSCJn7EBShPXraxe|fc_000c7cef03cac861016aa95ac70d3887d1a82878cf1c1893e1","toolName":"read","startedAt":"2026-09-15T14:48:39.137Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:1-185"},"intent":"Reading brainread gate population"},"id":"1e3a0429","parentId":"036b2863","timestamp":"2026-09-15T14:48:39.137Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_UCvDs7ofV3cynhAzSxs7ofql|fc_000c7cef03cac861016aa95ac70d4087d1b7d0404c61cea686","toolName":"grep","startedAt":"2026-09-15T14:48:39.138Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests;.worktrees/hertz-ir86-disk-delta/cra…"},"intent":"Checking residual gates and fixtures"},"id":"c26da3b4","parentId":"1e3a0429","timestamp":"2026-09-15T14:48:39.138Z"}
{"type":"message","id":"d8729f9f","parentId":"c26da3b4","timestamp":"2026-09-15T14:48:39.138Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_1Ox1qSbJQ9WWw9iZRexzhaOz|fc_000c7cef03cac861016aa95ac70d1887d185c3abb948d98674","name":"read","arguments":{"i":"Reading candidate implementation boundaries","path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs:104-135"},"intent":"Reading candidate implementation boundaries"},{"type":"toolCall","id":"call_i0CaS7AiD7lyaEwc1XYUxGT1|fc_000c7cef03cac861016aa95ac70d3087d18b184d3f5ffd1e1c","name":"read","arguments":{"i":"Reading inject publication boundary","path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs:75-112"},"intent":"Reading inject publication boundary"},{"type":"toolCall","id":"call_aIK7qRHtqSCJn7EBShPXraxe|fc_000c7cef03cac861016aa95ac70d3887d1a82878cf1c1893e1","name":"read","arguments":{"i":"Reading brainread gate population","path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:1-185"},"intent":"Reading brainread gate population"},{"type":"toolCall","id":"call_UCvDs7ofV3cynhAzSxs7ofql|fc_000c7cef03cac861016aa95ac70d4087d1b7d0404c61cea686","name":"grep","arguments":{"i":"Checking residual gates and fixtures","pattern":"kill.scop|IR.?81|free_space|available_space|RESOURCE=disk|10\\s*\\*\\s*1024|DaemonReaper|struct .*Reaper|outside.*repo|git toplevel","path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","case":false,"gitignore":false,"skip":null},"intent":"Checking residual gates and fixtures"},{"type":"toolCall","id":"call_8EPJvsNB7nS8ILWFgqU2hHqL|fc_000c7cef03cac861016aa95ac70d4887d19b9c3fbc7e2981b9","name":"read","arguments":{"i":"Recovering long amendment details","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6467-6480,6505-6506,6753-6767:raw"},"intent":"Recovering long amendment details"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":306,"output":392,"cacheRead":117376,"cacheWrite":0,"totalTokens":118074,"cost":{"input":0.0030600000000000002,"output":0.0196,"cacheRead":0.117376,"cacheWrite":0,"total":0.140036}},"stopReason":"toolUse","timestamp":1789483706082,"responseId":"resp_000c7cef03cac861016aa95aba575c87d181acb616db6e85f2","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_000c7cef03cac861016aa95ac70d1887d185c3abb948d98674","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading candidate implementation boundaries\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs:104-135\"}","call_id":"call_1Ox1qSbJQ9WWw9iZRexzhaOz","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ac70d3087d18b184d3f5ffd1e1c","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading inject publication boundary\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs:75-112\"}","call_id":"call_i0CaS7AiD7lyaEwc1XYUxGT1","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ac70d3887d1a82878cf1c1893e1","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading brainread gate population\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:1-185\"}","call_id":"call_aIK7qRHtqSCJn7EBShPXraxe","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ac70d4087d1b7d0404c61cea686","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking residual gates and fixtures\",\"pattern\":\"kill.scop|IR.?81|free_space|available_space|RESOURCE=disk|10\\\\s*\\\\*\\\\s*1024|DaemonReaper|struct .*Reaper|outside.*repo|git toplevel\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_UCvDs7ofV3cynhAzSxs7ofql","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ac70d4887d19b9c3fbc7e2981b9","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering long amendment details\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6467-6480,6505-6506,6753-6767:raw\"}","call_id":"call_8EPJvsNB7nS8ILWFgqU2hHqL","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":13052.795399993658,"ttft":13007.482499986887,"completedAt":1789483719136,"contextSnapshot":{"promptTokens":117682,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_8EPJvsNB7nS8ILWFgqU2hHqL|fc_000c7cef03cac861016aa95ac70d4887d19b9c3fbc7e2981b9","toolName":"read","startedAt":"2026-09-15T14:48:39.138Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6467-6480,6505-6506,6753-6767:raw"},"intent":"Recovering long amendment details"},"id":"e3c4091d","parentId":"d8729f9f","timestamp":"2026-09-15T14:48:39.138Z"}
{"type":"message","id":"9dd8ca6d","parentId":"e3c4091d","timestamp":"2026-09-15T14:48:39.157Z","message":{"role":"toolResult","toolCallId":"call_i0CaS7AiD7lyaEwc1XYUxGT1|fc_000c7cef03cac861016aa95ac70d3087d18b184d3f5ffd1e1c","toolName":"read","content":[{"type":"text","text":"// [impl->REQ-SEND-SPT-HOSTED]\npub fn try_spt_hosted_inject(\n target: &str,\n from: &str,\n body: &str,\n owlery: &Path,\n native: bool,\n) -> Option<(bool, bool)> {\n if !is_spt_hosted_no_relay(target, owlery) {\n return None;\n }\n // The envelope renders FOR `target` — the recipient whose mind is read for a\n // monic about this sender (REQ-MONIC-DELIVERY-TRIGGER).\n let mut bytes = spt_msg::emit::render_event_whole_for(target, from, body);\n bytes.push('\\n');\n let outcome = match Brain::cold_start(&broker_socket_name(), now_ms()) {\n Ok(mut brain) => brain.inject_endpoint(target, bytes.as_bytes(), native).ok(),\n Err(_) => None,\n };\n // The inject verdict is authoritative. A failed or deferred offer owes no\n // arrival; every successful caller, including spool drains, crosses here.\n // Publication follows injection and never changes its verdict.\n // [impl->REQ-IO-MSG-EDGES]\n // [impl->REQ-IO-EVENT-BUS]\n if matches!(outcome, Some((true, _))) {\n let msg_id = spt_proto::event::parse_event(body)\n .and_then(|parsed| parsed.attr(spt_proto::event::EVENT_ATTR_MSG_ID).map(str::to_owned));\n let event = crate::iobus::IoEvent::new(target, spt_proto::ioevent::IO_KIND_MSG_IN, body)\n .with_peer(from)\n .with_msg_id(msg_id);\n for published in crate::iobus::default_bus(owlery, now_ms()).publish(&event) {\n if let Err(error) = published.result {\n spt_proto::emit_line_err!(\"IO_SINK_WARN:{}: {error}\", published.sink);\n }\n }\n }\n outcome\n}\n\n/// Drain an already-idle spt-hosted endpoint's pending spool through the inject leg\n/// (W5, REQ-IDLE-PARKED-DELIVERY) — the shared core behind BOTH the send-time\n/// already-idle path AND the pulse-tick re-offer belt, so a message QUEUED to a session\n\n[Showing lines 74-115 of 361. Use :116 to continue]"}],"details":{"truncation":{"content":"// [impl->REQ-SEND-SPT-HOSTED]\r\npub fn try_spt_hosted_inject(\r\n target: &str,\r\n from: &str,\r\n body: &str,\r\n owlery: &Path,\r\n native: bool,\r\n) -> Option<(bool, bool)> {\r\n if !is_spt_hosted_no_relay(target, owlery) {\r\n return None;\r\n }\r\n // The envelope renders FOR `target` — the recipient whose mind is read for a\r\n // monic about this sender (REQ-MONIC-DELIVERY-TRIGGER).\r\n let mut bytes = spt_msg::emit::render_event_whole_for(target, from, body);\r\n bytes.push('\\n');\r\n let outcome = match Brain::cold_start(&broker_socket_name(), now_ms()) {\r\n Ok(mut brain) => brain.inject_endpoint(target, bytes.as_bytes(), native).ok(),\r\n Err(_) => None,\r\n };\r\n // The inject verdict is authoritative. A failed or deferred offer owes no\r\n // arrival; every successful caller, including spool drains, crosses here.\r\n // Publication follows injection and never changes its verdict.\r\n // [impl->REQ-IO-MSG-EDGES]\r\n // [impl->REQ-IO-EVENT-BUS]\r\n if matches!(outcome, Some((true, _))) {\r\n let msg_id = spt_proto::event::parse_event(body)\r\n .and_then(|parsed| parsed.attr(spt_proto::event::EVENT_ATTR_MSG_ID).map(str::to_owned));\r\n let event = crate::iobus::IoEvent::new(target, spt_proto::ioevent::IO_KIND_MSG_IN, body)\r\n .with_peer(from)\r\n .with_msg_id(msg_id);\r\n for published in crate::iobus::default_bus(owlery, now_ms()).publish(&event) {\r\n if let Err(error) = published.result {\r\n spt_proto::emit_line_err!(\"IO_SINK_WARN:{}: {error}\", published.sink);\r\n }\r\n }\r\n }\r\n outcome\r\n}\r\n\r\n/// Drain an already-idle spt-hosted endpoint's pending spool through the inject leg\r\n/// (W5, REQ-IDLE-PARKED-DELIVERY) — the shared core behind BOTH the send-time\r\n/// already-idle path AND the pulse-tick re-offer belt, so a message QUEUED to a session\r","truncated":true,"truncatedBy":"lines","totalLines":288,"totalBytes":1911,"outputLines":42,"outputBytes":1911,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":361,"displayContent":{"text":"// [impl->REQ-SEND-SPT-HOSTED]\r\npub fn try_spt_hosted_inject(\r\n target: &str,\r\n from: &str,\r\n body: &str,\r\n owlery: &Path,\r\n native: bool,\r\n) -> Option<(bool, bool)> {\r\n if !is_spt_hosted_no_relay(target, owlery) {\r\n return None;\r\n }\r\n // The envelope renders FOR `target` — the recipient whose mind is read for a\r\n // monic about this sender (REQ-MONIC-DELIVERY-TRIGGER).\r\n let mut bytes = spt_msg::emit::render_event_whole_for(target, from, body);\r\n bytes.push('\\n');\r\n let outcome = match Brain::cold_start(&broker_socket_name(), now_ms()) {\r\n Ok(mut brain) => brain.inject_endpoint(target, bytes.as_bytes(), native).ok(),\r\n Err(_) => None,\r\n };\r\n // The inject verdict is authoritative. A failed or deferred offer owes no\r\n // arrival; every successful caller, including spool drains, crosses here.\r\n // Publication follows injection and never changes its verdict.\r\n // [impl->REQ-IO-MSG-EDGES]\r\n // [impl->REQ-IO-EVENT-BUS]\r\n if matches!(outcome, Some((true, _))) {\r\n let msg_id = spt_proto::event::parse_event(body)\r\n .and_then(|parsed| parsed.attr(spt_proto::event::EVENT_ATTR_MSG_ID).map(str::to_owned));\r\n let event = crate::iobus::IoEvent::new(target, spt_proto::ioevent::IO_KIND_MSG_IN, body)\r\n .with_peer(from)\r\n .with_msg_id(msg_id);\r\n for published in crate::iobus::default_bus(owlery, now_ms()).publish(&event) {\r\n if let Err(error) = published.result {\r\n spt_proto::emit_line_err!(\"IO_SINK_WARN:{}: {error}\", published.sink);\r\n }\r\n }\r\n }\r\n outcome\r\n}\r\n\r\n/// Drain an already-idle spt-hosted endpoint's pending spool through the inject leg\r\n/// (W5, REQ-IDLE-PARKED-DELIVERY) — the shared core behind BOTH the send-time\r\n/// already-idle path AND the pulse-tick re-offer belt, so a message QUEUED to a session\r","startLine":74,"lineNumbers":[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115]},"fileSize":18494,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\spt-daemon\\src\\inject.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":361,"totalBytes":1911,"outputLines":42,"outputBytes":1911,"shownRange":{"start":74,"end":115},"nextOffset":116}}},"isError":false,"timestamp":1789483719157}}
{"type":"message","id":"ce18f8a0","parentId":"9dd8ca6d","timestamp":"2026-09-15T14:48:39.163Z","message":{"role":"toolResult","toolCallId":"call_aIK7qRHtqSCJn7EBShPXraxe|fc_000c7cef03cac861016aa95ac70d3887d1a82878cf1c1893e1","toolName":"read","content":[{"type":"text","text":"//! #293 static policy audit. Runtime tests cannot distinguish an explicit None\n//! from call_deadline() on a Whole carrier. This gate checks that distinction;\n//! its unit cells exercise synthetic source, never repository contents.\n\nuse std::path::Path;\n\n#[derive(Debug, PartialEq, Eq)]\npub struct Finding {\n pub line: usize,\n pub message: String,\n}\n\n#[derive(Clone, Debug)]\nstruct Token<'a> {\n text: &'a str,\n line: usize,\n}\n\n// Lex only what the census needs. Comments (including nested block comments),\n// strings, raw strings, and characters are opaque; lifetimes are not characters.\nfn tokens(src: &str) -> Result>, String> {\n let b = src.as_bytes();\n let mut out = Vec::new();\n let (mut i, mut line) = (0, 1);\n while i < b.len() {\n let start = i;\n if b[i..].starts_with(b\"//\") {\n while i < b.len() && b[i] != b'\\n' {\n i += 1;\n }\n } else if b[i..].starts_with(b\"/*\") {\n i += 2;\n let mut depth = 1;\n while i < b.len() && depth > 0 {\n if b[i..].starts_with(b\"/*\") {\n depth += 1;\n i += 2;\n } else if b[i..].starts_with(b\"*/\") {\n depth -= 1;\n i += 2;\n } else {\n i += 1;\n }\n }\n if depth != 0 {\n return Err(format!(\"line {line}: unclosed comment\"));\n }\n } else {\n let raw_start = if b[i..].starts_with(b\"br\") || b[i..].starts_with(b\"cr\") {\n Some(i + 2)\n } else if b[i] == b'r' {\n Some(i + 1)\n } else {\n None\n };\n let raw = raw_start.and_then(|hash_start| {\n let mut end = hash_start;\n while end < b.len() && b[end] == b'#' {\n end += 1;\n }\n (b.get(end) == Some(&b'\"')).then_some((end, end - hash_start))\n });\n if let Some((quote, hashes)) = raw {\n let marker = format!(\"\\\"{}\", \"#\".repeat(hashes));\n let rest = &src[quote + 1..];\n let end = rest\n .find(&marker)\n .ok_or_else(|| format!(\"line {line}: unclosed raw string\"))?;\n i = quote + 1 + end + marker.len();\n } else if b[i] == b'\"' {\n i += 1;\n while i < b.len() && b[i] != b'\"' {\n i += if b[i] == b'\\\\' { 2 } else { 1 };\n }\n if i >= b.len() {\n return Err(format!(\"line {line}: unclosed string\"));\n }\n i += 1;\n } else if b[i] == b'\\'' && char_end(src, i).is_some() {\n i = char_end(src, i).unwrap();\n } else if b[i].is_ascii_whitespace() {\n i += 1;\n } else {\n let token_start = if b[i..].starts_with(b\"r#\")\n && b.get(i + 2)\n .is_some_and(|c| c.is_ascii_alphabetic() || *c == b'_')\n {\n i += 2;\n i\n } else {\n start\n };\n if b[i].is_ascii_alphabetic() || b[i] == b'_' {\n i += 1;\n while i < b.len() && (b[i].is_ascii_alphanumeric() || b[i] == b'_') {\n i += 1;\n }\n } else {\n i += src[i..].chars().next().unwrap().len_utf8();\n }\n out.push(Token {\n text: &src[token_start..i],\n line,\n });\n }\n }\n line += b[start..i].iter().filter(|&&c| c == b'\\n').count();\n }\n Ok(out)\n}\n\nfn char_end(src: &str, start: usize) -> Option {\n let b = src.as_bytes();\n let mut i = start + 1;\n if *b.get(i)? == b'\\\\' {\n i += 1;\n match *b.get(i)? {\n b'u' if b.get(i + 1) == Some(&b'{') => {\n i += 2;\n while *b.get(i)? != b'}' {\n i += 1;\n }\n i += 1;\n }\n b'x' => i += 3,\n _ => i += 1,\n }\n } else {\n i += src.get(i..)?.chars().next()?.len_utf8();\n }\n (b.get(i) == Some(&b'\\'')).then_some(i + 1)\n}\n\nstruct Function<'a> {\n name: &'a str,\n line: usize,\n body: &'a [Token<'a>],\n}\n\nfn functions<'a>(words: &'a [Token<'a>]) -> Result>, String> {\n let mut out = Vec::new();\n for i in 0..words.len().saturating_sub(2) {\n if words[i].text != \"fn\" || ![\"(\", \"<\"].contains(&words[i + 2].text) {\n continue;\n }\n let Some(start) = (i + 2..words.len()).find(|&j| [\"{\", \";\"].contains(&words[j].text))\n else {\n continue;\n };\n if words[start].text == \";\" {\n continue;\n }\n let mut depth = 1;\n let mut end = start + 1;\n while end < words.len() && depth != 0 {\n match words[end].text {\n \"{\" => depth += 1,\n \"}\" => depth -= 1,\n _ => {}\n }\n end += 1;\n }\n if depth != 0 {\n return Err(format!(\"line {}: unclosed function body\", words[i].line));\n }\n out.push(Function {\n name: words[i + 1].text,\n line: words[i].line,\n body: &words[start + 1..end - 1],\n });\n }\n Ok(out)\n}\n\nfn has(words: &[Token<'_>], sequence: &[&str]) -> bool {\n words\n .windows(sequence.len())\n .any(|window| window.iter().map(|t| t.text).eq(sequence.iter().copied()))\n}\n\n/// Retired member calls, associated calls and declarations, including test code.\npub fn read_event_sites(src: &str) -> Result, String> {\n let words = tokens(src)?;\n Ok(words\n .windows(2)\n .filter(|w| w[1].text == \"read_event\" && [\".\", \":\", \"fn\"].contains(&w[0].text))\n .map(|w| Finding {\n line: w[1].line,\n…\n })\n .collect())\n}\n\n[Showing lines 1-188 of 396. Use :189 to continue]"}],"details":{"truncation":{"content":"//! #293 static policy audit. Runtime tests cannot distinguish an explicit None\r\n//! from call_deadline() on a Whole carrier. This gate checks that distinction;\r\n//! its unit cells exercise synthetic source, never repository contents.\r\n\r\nuse std::path::Path;\r\n\r\n#[derive(Debug, PartialEq, Eq)]\r\npub struct Finding {\r\n pub line: usize,\r\n pub message: String,\r\n}\r\n\r\n#[derive(Clone, Debug)]\r\nstruct Token<'a> {\r\n text: &'a str,\r\n line: usize,\r\n}\r\n\r\n// Lex only what the census needs. Comments (including nested block comments),\r\n// strings, raw strings, and characters are opaque; lifetimes are not characters.\r\nfn tokens(src: &str) -> Result>, String> {\r\n let b = src.as_bytes();\r\n let mut out = Vec::new();\r\n let (mut i, mut line) = (0, 1);\r\n while i < b.len() {\r\n let start = i;\r\n if b[i..].starts_with(b\"//\") {\r\n while i < b.len() && b[i] != b'\\n' {\r\n i += 1;\r\n }\r\n } else if b[i..].starts_with(b\"/*\") {\r\n i += 2;\r\n let mut depth = 1;\r\n while i < b.len() && depth > 0 {\r\n if b[i..].starts_with(b\"/*\") {\r\n depth += 1;\r\n i += 2;\r\n } else if b[i..].starts_with(b\"*/\") {\r\n depth -= 1;\r\n i += 2;\r\n } else {\r\n i += 1;\r\n }\r\n }\r\n if depth != 0 {\r\n return Err(format!(\"line {line}: unclosed comment\"));\r\n }\r\n } else {\r\n let raw_start = if b[i..].starts_with(b\"br\") || b[i..].starts_with(b\"cr\") {\r\n Some(i + 2)\r\n } else if b[i] == b'r' {\r\n Some(i + 1)\r\n } else {\r\n None\r\n };\r\n let raw = raw_start.and_then(|hash_start| {\r\n let mut end = hash_start;\r\n while end < b.len() && b[end] == b'#' {\r\n end += 1;\r\n }\r\n (b.get(end) == Some(&b'\"')).then_some((end, end - hash_start))\r\n });\r\n if let Some((quote, hashes)) = raw {\r\n let marker = format!(\"\\\"{}\", \"#\".repeat(hashes));\r\n let rest = &src[quote + 1..];\r\n let end = rest\r\n .find(&marker)\r\n .ok_or_else(|| format!(\"line {line}: unclosed raw string\"))?;\r\n i = quote + 1 + end + marker.len();\r\n } else if b[i] == b'\"' {\r\n i += 1;\r\n while i < b.len() && b[i] != b'\"' {\r\n i += if b[i] == b'\\\\' { 2 } else { 1 };\r\n }\r\n if i >= b.len() {\r\n return Err(format!(\"line {line}: unclosed string\"));\r\n }\r\n i += 1;\r\n } else if b[i] == b'\\'' && char_end(src, i).is_some() {\r\n i = char_end(src, i).unwrap();\r\n } else if b[i].is_ascii_whitespace() {\r\n i += 1;\r\n } else {\r\n let token_start = if b[i..].starts_with(b\"r#\")\r\n && b.get(i + 2)\r\n .is_some_and(|c| c.is_ascii_alphabetic() || *c == b'_')\r\n {\r\n i += 2;\r\n i\r\n } else {\r\n start\r\n };\r\n if b[i].is_ascii_alphabetic() || b[i] == b'_' {\r\n i += 1;\r\n while i < b.len() && (b[i].is_ascii_alphanumeric() || b[i] == b'_') {\r\n i += 1;\r\n }\r\n } else {\r\n i += src[i..].chars().next().unwrap().len_utf8();\r\n }\r\n out.push(Token {\r\n text: &src[token_start..i],\r\n line,\r\n });\r\n }\r\n }\r\n line += b[start..i].iter().filter(|&&c| c == b'\\n').count();\r\n }\r\n Ok(out)\r\n}\r\n\r\nfn char_end(src: &str, start: usize) -> Option {\r\n let b = src.as_bytes();\r\n let mut i = start + 1;\r\n if *b.get(i)? == b'\\\\' {\r\n i += 1;\r\n match *b.get(i)? {\r\n b'u' if b.get(i + 1) == Some(&b'{') => {\r\n i += 2;\r\n while *b.get(i)? != b'}' {\r\n i += 1;\r\n }\r\n i += 1;\r\n }\r\n b'x' => i += 3,\r\n _ => i += 1,\r\n }\r\n } else {\r\n i += src.get(i..)?.chars().next()?.len_utf8();\r\n }\r\n (b.get(i) == Some(&b'\\'')).then_some(i + 1)\r\n}\r\n\r\nstruct Function<'a> {\r\n name: &'a str,\r\n line: usize,\r\n body: &'a [Token<'a>],\r\n}\r\n\r\nfn functions<'a>(words: &'a [Token<'a>]) -> Result>, String> {\r\n let mut out = Vec::new();\r\n for i in 0..words.len().saturating_sub(2) {\r\n if words[i].text != \"fn\" || ![\"(\", \"<\"].contains(&words[i + 2].text) {\r\n continue;\r\n }\r\n let Some(start) = (i + 2..words.len()).find(|&j| [\"{\", \";\"].contains(&words[j].text))\r\n else {\r\n continue;\r\n };\r\n if words[start].text == \";\" {\r\n continue;\r\n }\r\n let mut depth = 1;\r\n let mut end = start + 1;\r\n while end < words.len() && depth != 0 {\r\n match words[end].text {\r\n \"{\" => depth += 1,\r\n \"}\" => depth -= 1,\r\n _ => {}\r\n }\r\n end += 1;\r\n }\r\n if depth != 0 {\r\n return Err(format!(\"line {}: unclosed function body\", words[i].line));\r\n }\r\n out.push(Function {\r\n name: words[i + 1].text,\r\n line: words[i].line,\r\n body: &words[start + 1..end - 1],\r\n });\r\n }\r\n Ok(out)\r\n}\r\n\r\nfn has(words: &[Token<'_>], sequence: &[&str]) -> bool {\r\n words\r\n .windows(sequence.len())\r\n .any(|window| window.iter().map(|t| t.text).eq(sequence.iter().copied()))\r\n}\r\n\r\n/// Retired member calls, associated calls and declarations, including test code.\r\npub fn read_event_sites(src: &str) -> Result, String> {\r\n let words = tokens(src)?;\r\n Ok(words\r\n .windows(2)\r\n .filter(|w| w[1].text == \"read_event\" && [\".\", \":\", \"fn\"].contains(&w[0].text))\r\n .map(|w| Finding {\r\n line: w[1].line,\r","truncated":true,"truncatedBy":"lines","totalLines":396,"totalBytes":6308,"outputLines":188,"outputBytes":6308,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":396,"displayContent":{"text":"//! #293 static policy audit. Runtime tests cannot distinguish an explicit None\r\n//! from call_deadline() on a Whole carrier. This gate checks that distinction;\r\n//! its unit cells exercise synthetic source, never repository contents.\r\n\r\nuse std::path::Path;\r\n\r\n#[derive(Debug, PartialEq, Eq)]\r\npub struct Finding {\r\n pub line: usize,\r\n pub message: String,\r\n}\r\n\r\n#[derive(Clone, Debug)]\r\nstruct Token<'a> {\r\n text: &'a str,\r\n line: usize,\r\n}\r\n\r\n// Lex only what the census needs. Comments (including nested block comments),\r\n// strings, raw strings, and characters are opaque; lifetimes are not characters.\r\nfn tokens(src: &str) -> Result>, String> {\r\n let b = src.as_bytes();\r\n let mut out = Vec::new();\r\n let (mut i, mut line) = (0, 1);\r\n while i < b.len() {\r\n let start = i;\r\n if b[i..].starts_with(b\"//\") {\r\n while i < b.len() && b[i] != b'\\n' {\r\n i += 1;\r\n }\r\n } else if b[i..].starts_with(b\"/*\") {\r\n i += 2;\r\n let mut depth = 1;\r\n while i < b.len() && depth > 0 {\r\n if b[i..].starts_with(b\"/*\") {\r\n depth += 1;\r\n i += 2;\r\n } else if b[i..].starts_with(b\"*/\") {\r\n depth -= 1;\r\n i += 2;\r\n } else {\r\n i += 1;\r\n }\r\n }\r\n if depth != 0 {\r\n return Err(format!(\"line {line}: unclosed comment\"));\r\n }\r\n } else {\r\n let raw_start = if b[i..].starts_with(b\"br\") || b[i..].starts_with(b\"cr\") {\r\n Some(i + 2)\r\n } else if b[i] == b'r' {\r\n Some(i + 1)\r\n } else {\r\n None\r\n };\r\n let raw = raw_start.and_then(|hash_start| {\r\n let mut end = hash_start;\r\n while end < b.len() && b[end] == b'#' {\r\n end += 1;\r\n }\r\n (b.get(end) == Some(&b'\"')).then_some((end, end - hash_start))\r\n });\r\n if let Some((quote, hashes)) = raw {\r\n let marker = format!(\"\\\"{}\", \"#\".repeat(hashes));\r\n let rest = &src[quote + 1..];\r\n let end = rest\r\n .find(&marker)\r\n .ok_or_else(|| format!(\"line {line}: unclosed raw string\"))?;\r\n i = quote + 1 + end + marker.len();\r\n } else if b[i] == b'\"' {\r\n i += 1;\r\n while i < b.len() && b[i] != b'\"' {\r\n i += if b[i] == b'\\\\' { 2 } else { 1 };\r\n }\r\n if i >= b.len() {\r\n return Err(format!(\"line {line}: unclosed string\"));\r\n }\r\n i += 1;\r\n } else if b[i] == b'\\'' && char_end(src, i).is_some() {\r\n i = char_end(src, i).unwrap();\r\n } else if b[i].is_ascii_whitespace() {\r\n i += 1;\r\n } else {\r\n let token_start = if b[i..].starts_with(b\"r#\")\r\n && b.get(i + 2)\r\n .is_some_and(|c| c.is_ascii_alphabetic() || *c == b'_')\r\n {\r\n i += 2;\r\n i\r\n } else {\r\n start\r\n };\r\n if b[i].is_ascii_alphabetic() || b[i] == b'_' {\r\n i += 1;\r\n while i < b.len() && (b[i].is_ascii_alphanumeric() || b[i] == b'_') {\r\n i += 1;\r\n }\r\n } else {\r\n i += src[i..].chars().next().unwrap().len_utf8();\r\n }\r\n out.push(Token {\r\n text: &src[token_start..i],\r\n line,\r\n });\r\n }\r\n }\r\n line += b[start..i].iter().filter(|&&c| c == b'\\n').count();\r\n }\r\n Ok(out)\r\n}\r\n\r\nfn char_end(src: &str, start: usize) -> Option {\r\n let b = src.as_bytes();\r\n let mut i = start + 1;\r\n if *b.get(i)? == b'\\\\' {\r\n i += 1;\r\n match *b.get(i)? {\r\n b'u' if b.get(i + 1) == Some(&b'{') => {\r\n i += 2;\r\n while *b.get(i)? != b'}' {\r\n i += 1;\r\n }\r\n i += 1;\r\n }\r\n b'x' => i += 3,\r\n _ => i += 1,\r\n }\r\n } else {\r\n i += src.get(i..)?.chars().next()?.len_utf8();\r\n }\r\n (b.get(i) == Some(&b'\\'')).then_some(i + 1)\r\n}\r\n\r\nstruct Function<'a> {\r\n name: &'a str,\r\n line: usize,\r\n body: &'a [Token<'a>],\r\n}\r\n\r\nfn functions<'a>(words: &'a [Token<'a>]) -> Result>, String> {\r\n let mut out = Vec::new();\r\n for i in 0..words.len().saturating_sub(2) {\r\n if words[i].text != \"fn\" || ![\"(\", \"<\"].contains(&words[i + 2].text) {\r\n continue;\r\n }\r\n let Some(start) = (i + 2..words.len()).find(|&j| [\"{\", \";\"].contains(&words[j].text))\r\n else {\r\n continue;\r\n };\r\n if words[start].text == \";\" {\r\n continue;\r\n }\r\n let mut depth = 1;\r\n let mut end = start + 1;\r\n while end < words.len() && depth != 0 {\r\n match words[end].text {\r\n \"{\" => depth += 1,\r\n \"}\" => depth -= 1,\r\n _ => {}\r\n }\r\n end += 1;\r\n }\r\n if depth != 0 {\r\n return Err(format!(\"line {}: unclosed function body\", words[i].line));\r\n }\r\n out.push(Function {\r\n name: words[i + 1].text,\r\n line: words[i].line,\r\n body: &words[start + 1..end - 1],\r\n });\r\n }\r\n Ok(out)\r\n}\r\n\r\nfn has(words: &[Token<'_>], sequence: &[&str]) -> bool {\r\n words\r\n .windows(sequence.len())\r\n .any(|window| window.iter().map(|t| t.text).eq(sequence.iter().copied()))\r\n}\r\n\r\n/// Retired member calls, associated calls and declarations, including test code.\r\npub fn read_event_sites(src: &str) -> Result, String> {\r\n let words = tokens(src)?;\r\n Ok(words\r\n .windows(2)\r\n .filter(|w| w[1].text == \"read_event\" && [\".\", \":\", \"fn\"].contains(&w[0].text))\r\n .map(|w| Finding {\r\n line: w[1].line,\r\n…\n })\n .collect())\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,null,190,191,192]},"fileSize":14300,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\xtask\\src\\brainread.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":396,"totalBytes":6308,"outputLines":188,"outputBytes":6308,"shownRange":{"start":1,"end":188},"nextOffset":189}}},"isError":false,"timestamp":1789483719162}}
{"type":"message","id":"108f3ff4","parentId":"ce18f8a0","timestamp":"2026-09-15T14:48:39.168Z","message":{"role":"toolResult","toolCallId":"call_1Ox1qSbJQ9WWw9iZRexzhaOz|fc_000c7cef03cac861016aa95ac70d1887d185c3abb948d98674","toolName":"read","content":[{"type":"text","text":"pub fn resolve_docs_port(config_port: Option, env_value: Option<&str>) -> u16 {\n if let Some(v) = env_value {\n if let Ok(p) = v.trim().parse::() {\n if p != 0 {\n return p;\n }\n }\n }\n config_port.unwrap_or(DEFAULT_DOCS_PORT)\n}\n\n/// Daemon-side resolution adds the rig's ephemeral-port posture without\n/// changing the public `SPT_DOCS_PORT=0` contract used by `spt docs url`.\n// [impl->REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS]\npub fn resolve_daemon_docs_port(\n config_port: Option,\n env_value: Option<&str>,\n ephemeral_advisory_ports: bool,\n) -> u16 {\n if ephemeral_advisory_ports {\n return 0;\n }\n resolve_docs_port(config_port, env_value)\n}\n\n/// The canonical node-prefixed URL printed by `spt docs url`.\n// [impl->REQ-DOCS-LOCAL-SERVER]\n// [impl->REQ-WEB-URL-NODE-PREFIX]\npub fn docs_url(node: &str, port: u16) -> String {\n let node = spt_store::serving::encode_url_segment(&node.to_ascii_lowercase());\n format!(\"http://localhost:{port}/{node}/docs/\")\n}\n\n/// Percent-decode a URI path (the sanitizer runs AFTER decoding, so\n/// `%2e%2e` cannot smuggle a traversal). Invalid escapes ⇒ `None` (reject).\nfn percent_decode(path: &str) -> Option {\n let bytes = path.as_bytes();\n let mut out = Vec::with_capacity(bytes.len());\n let mut i = 0;\n…\n}\n\n[Showing lines 103-138 of 765. Use :139 to continue]"}],"details":{"truncation":{"content":" if p != 0 {\r\n return p;\r\n }\r\n }\r\n }\r\n config_port.unwrap_or(DEFAULT_DOCS_PORT)\r\n}\r\n\r\n/// Daemon-side resolution adds the rig's ephemeral-port posture without\r\n/// changing the public `SPT_DOCS_PORT=0` contract used by `spt docs url`.\r\n// [impl->REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS]\r\npub fn resolve_daemon_docs_port(\r\n config_port: Option,\r\n env_value: Option<&str>,\r\n ephemeral_advisory_ports: bool,\r\n) -> u16 {\r\n if ephemeral_advisory_ports {\r\n return 0;\r\n }\r\n resolve_docs_port(config_port, env_value)\r\n}\r\n\r\n/// The canonical node-prefixed URL printed by `spt docs url`.\r\n// [impl->REQ-DOCS-LOCAL-SERVER]\r\n// [impl->REQ-WEB-URL-NODE-PREFIX]\r\npub fn docs_url(node: &str, port: u16) -> String {\r\n let node = spt_store::serving::encode_url_segment(&node.to_ascii_lowercase());\r\n format!(\"http://localhost:{port}/{node}/docs/\")\r\n}\r\n\r\n/// Percent-decode a URI path (the sanitizer runs AFTER decoding, so\r\n/// `%2e%2e` cannot smuggle a traversal). Invalid escapes ⇒ `None` (reject).\r\nfn percent_decode(path: &str) -> Option {\r\n let bytes = path.as_bytes();\r\n let mut out = Vec::with_capacity(bytes.len());\r\n let mut i = 0;\r","truncated":true,"truncatedBy":"lines","totalLines":663,"totalBytes":1230,"outputLines":36,"outputBytes":1230,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":765,"displayContent":{"text":"pub fn resolve_docs_port(config_port: Option, env_value: Option<&str>) -> u16 {\n if let Some(v) = env_value {\n if let Ok(p) = v.trim().parse::() {\n if p != 0 {\r\n return p;\r\n }\r\n }\r\n }\r\n config_port.unwrap_or(DEFAULT_DOCS_PORT)\r\n}\r\n\r\n/// Daemon-side resolution adds the rig's ephemeral-port posture without\r\n/// changing the public `SPT_DOCS_PORT=0` contract used by `spt docs url`.\r\n// [impl->REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS]\r\npub fn resolve_daemon_docs_port(\r\n config_port: Option,\r\n env_value: Option<&str>,\r\n ephemeral_advisory_ports: bool,\r\n) -> u16 {\r\n if ephemeral_advisory_ports {\r\n return 0;\r\n }\r\n resolve_docs_port(config_port, env_value)\r\n}\r\n\r\n/// The canonical node-prefixed URL printed by `spt docs url`.\r\n// [impl->REQ-DOCS-LOCAL-SERVER]\r\n// [impl->REQ-WEB-URL-NODE-PREFIX]\r\npub fn docs_url(node: &str, port: u16) -> String {\r\n let node = spt_store::serving::encode_url_segment(&node.to_ascii_lowercase());\r\n format!(\"http://localhost:{port}/{node}/docs/\")\r\n}\r\n\r\n/// Percent-decode a URI path (the sanitizer runs AFTER decoding, so\r\n/// `%2e%2e` cannot smuggle a traversal). Invalid escapes ⇒ `None` (reject).\r\nfn percent_decode(path: &str) -> Option {\r\n let bytes = path.as_bytes();\r\n let mut out = Vec::with_capacity(bytes.len());\r\n let mut i = 0;\r\n…\n}","startLine":100,"lineNumbers":[100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,null,151]},"fileSize":32476,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\spt-daemon\\src\\docshost.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":765,"totalBytes":1230,"outputLines":36,"outputBytes":1230,"shownRange":{"start":103,"end":138},"nextOffset":139}}},"isError":false,"timestamp":1789483719167}}
{"type":"message","id":"c876ddbc","parentId":"108f3ff4","timestamp":"2026-09-15T14:48:39.184Z","message":{"role":"toolResult","toolCallId":"call_8EPJvsNB7nS8ILWFgqU2hHqL|fc_000c7cef03cac861016aa95ac70d4887d19b9c3fbc7e2981b9","toolName":"read","content":[{"type":"text","text":" `display_from_url(remote)` are the two observed strings exactly, and the folder-name fallback could\n not have produced either (candidate folder names: 304-product, hertz-304, spt-core). So git got as\n far as step ONE of the derivation. The first mechanism offered (\"any in-repo cwd\") was killed by one\n datum: ci.yml:143 runs `kind(lib)` unfiltered on this runner with an in-repo cwd and passed at\n 6a7dd6b7. The variable was the FIXTURE's location, never the process cwd.\n- **Instrument defects in this lane today, all hertz's, all closed:** (window 5) `cargo ... | tail;\n echo $?` reports tail's status (memory \"render-not-read-pipefail\") — the compile gate was in fact\n green, so that reading was VOID evidence rather than a masked red; the same construct one command\n later printed 0 over a checker [must] finding, a true exit 1 — the hazard is that an exit read\n through a pipe certifies nothing, not that it hides reds. (window 4 START gate, 10:26Z) a negative\n control that returned at the refusal branch vouched for nothing about the send arm, which then\n crashed on a NameError on the first real launch (memory \"make a new rig red on purpose\",\n refinement). (window 8, premise lane, 12:14Z) a FOURTH void-exit instance in one day — `$?` and `${PIPESTATUS[0]}` both read a later command, a backgrounded python traceback surfaced as exit 0; every verdict rests on the producer's own recorded exit file or cargo's Finished line. Also: the window driver crashed at its END on a stale dict key AFTER json.dump had written the report — report-before-print is load-bearing and was right by accident; ordered the other way six measured arms evaporate at the summary line. (Linux cells lane, 12:46Z) fifth and sixth: a python driver died on a SyntaxError while the shell reported exit 0 (exposed only by STALE red logs from the previous sha), and a census script stalled mid-run while its ssh reported exit 0. Both caught by reading the artifact; neither would have been caught by the exit. (13:16Z, FOLD-1b last arm) seventh: non-interactive ssh to kitsubito returned 0 while both producers wrote 127 (`cargo: command not found`, PATH not sourced) — a green whose population was empty, on the one arm whose purpose is to see what the Windows box cannot; caught by the producer-written exit files. Same window, same class in the other direction: a census line cited a positive control that another agent had run on another box, attached to one's own zero; deleted before sending, the real control then showed the zero was timing luck. Rule: the exit is the PRODUCER's file beside its log; the control is YOUR run on THIS box. (13:18Z) eighth, and the more dangerous SHAPE: `git rebase ... | tail` under set -e — the rebase failed (no git identity on kitsubito), the pipeline exit was tail's 0, and the downstream assertions ran against a tree that was never created, printing \"DIFFERS - rebase touched linux.rs\" and \"tests: 0\": a FORGED RED. A false red is not obviously an instrument failure; it reads as a finding. Rule: no pipe on the producer whose exit decides the arm; a red is accepted only after the subject it describes is proven to exist (oid).\n- **Third instrument defect, same window (hertz, 11:25Z):** a mutation driver's revert check was\n\n…\n\n\n- **Linux consumer recurrence (todlando, 2026-09-13, #304 at `b8482445`).**\n\n…\n\n- **Status:** OPEN, mechanisms recorded 2026-09-12 09:05Z. Instance 1 found by hertz in todlando's driver and confirmed by doyle; repaired as a separately pinned revision (v6 `dcfb732a…` → v7 `927eafb9…`) per the standing rule that a demonstrated execution incompatibility gets a new hash and renewed verification rather than an in-place accommodation. Instance 2 is todlando's own, found while reading the repair site.\n- **Instance 1 — the id that looked right.** `trial()` opened with `local arm=\"$1\" n=\"$2\" id=\"$arm-$n\"`. A single declaration command expands EVERY right-hand side before assigning any of its names, so `$arm` was still unset when `id` was built — but `$n` was **not** empty, because the caller is `for n in 1 2 3; do trial a \"$n\"; done` and `n` is a GLOBAL at that point. The id therefore read `-1`, not the empty-ish `-` that would have been noticed: a plausible, consistently-formed, wrong identity. Both arms produced `-1,-2,-3`, so every per-trial artifact keyed on id — captures, stop captures, census tags, portfields snapshots, cpu brackets — collided, and **Arm B overwrote Arm A in place** with nothing downstream able to tell them apart. `arm` itself was correct at every site that used it directly, so the defect surfaced ONLY through the derived ids. Reproduced independently on msys bash 5.2.21 at both LF and CRLF (igncr is not a valid shopt there): old shape → 3 distinct ids for 6 trials, split shape → 6.\n- **The audit the one fix does not discharge.** A predicate was written over the whole delivered set — any `local`/`declare`/`typeset`/`export`/`readonly` whose later right-hand side references a name assigned earlier in the SAME command — with a positive control broken on purpose (plain `local`, `declare`, and the `${name}` brace form: 3 arms) and a negative control of the same declarations split (0 hits). v6 = 2 hits, both that one line; v7 = 0; v5 = the same single site. Stated over-report: the predicate does not split on `;`, so two correct statements on one physical line read as a dependency — the real site was confirmed not to be that shape. The PowerShell and Python helpers got their own predicates (zero multi-target assignments across four `.ps1`, proven live against a control that has one; the single Python tuple unpack takes its values from one call and references none of its own targets), because a bash declaration rule measures nothing in another language.\n- **Instance 2 — the byte reader that was not one.** The repair site was first read with `sed -n '869,880p' file | cat -A`, which printed `$` at every line end — i.e. LF. The file is CRLF throughout (measured: 1117 CR = 1117 LF = 1117 CRLF). msys `sed` reads in text mode and drops the CRs, so `cat -A` faithfully rendered bytes that `sed` had already removed. The project's own rule (\"after any scripted edit, verify the BYTES\") was followed and still defeated, because the verification ran downstream of a text-mode filter.\n- **Third consequence of instance 1, and the worse half of it (hertz, measured independently; re-measured here).** The bad id does not only collide the arms — it begins with a DASH, so every artifact is named `-1.out`, `-2.err`, `-1.stop.out`. Measured in a throwaway dir: `sha256sum *.out` over such a population exits 1 with `unknown option -- 1` and hashes NOTHING (control: the same command over `a-1.out` alone exits 0 and hashes it); `grep -c x -1.out` exits 2 having measured nothing; `sha256sum ./*.out` is the repair. That is the LOUD form. The dangerous form is the one hertz's own detector took: it returned a clean EMPTY snapshot — \"0 artifacts altered\" — in the arm that was supposed to be red, because its glob handed the dashes to a tool that consumed them as flags. So a defective identity scheme does not merely lose evidence, it makes every downstream census over that run read either as a refusal or as a confident zero, depending on the consumer. Any id that can reach a filesystem is checked for a leading dash, and any glob feeding a census is written `./*` so its members cannot be parsed as options.\n- **Mechanism.** Both are a wrong answer with no error: a declaration whose dependency is satisfied by an unrelated variable that happens to exist, and a byte census whose bytes were filtered before they were counted. Neither is detectable from its own output — the id is well-formed, the `cat -A` dump is honest about what reached it.\n- **Fourth instance, in the very commit that recorded this entry (todlando, self-reported).** The amendment above was applied with a Python text-mode read (`open(p).read()`, universal newlines) and written back with `newline='\n'`. This register carried **two lone CR bytes** - `\n\n- **Instances 9-11` and `\n\n- **Addendum 2026-09-12 03:20Z` - present since at least `7cdcf5da`. Universal newlines translated each bare CR into a newline, so the commit silently rewrote two lines belonging to OTHER entries (net: 2 stray CRs removed, 2 blank lines added; markdown-harmless, still undeclared). Caught by reading the commit's own diff rather than trusting the insertion count: a one-bullet append that reports **5 insertions, 2 deletions** is telling you it touched something else. A text-mode read is a WRITE hazard, not only a measurement hazard - edit a file whose byte shape you have not measured in binary, and review the diff, never the intent.\n- **Rule.** (1) A declaration that depends on a name is its OWN statement; never share a `local` with the name it reads. (2) Derive an identity used as an artifact key ONLY after its parts are assigned, and guard it against its expected shape — a key that can go wrong silently overwrites evidence rather than failing. (3) A negative control for an id scheme must carry the caller's real variable environment: with the caller's global `n` absent, this defect reads as the harmless `-` and is easy to dismiss. (4) Read bytes with a byte reader — `python3` on the raw file, or `od`/`xxd` — never through msys `sed`, `grep`, or any text-mode filter; if a CR/LF count is the claim, count CR and LF bytes and state both.\n- **Kin:** [[IR-118]] (a complete-looking wrong answer from an instrument that succeeded), memory count-predicate-needs-its-own-positive-control, make-a-new-rig-red-on-purpose, scripted-edit-zero-match-refusal, render-not-read-pipefail, windows-firewall-census-clean-zeros.\n- **Ripe when:** now — (1) and (4) are habits, (2) is three lines in any rig. · **Size:** procedure."}],"details":{"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"}}},"isError":false,"timestamp":1789483719183}}
{"type":"message","id":"97f8472b","parentId":"c876ddbc","timestamp":"2026-09-15T14:48:40.015Z","message":{"role":"toolResult","toolCallId":"call_UCvDs7ofV3cynhAzSxs7ofql|fc_000c7cef03cac861016aa95ac70d4087d1b7d0404c61cea686","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/crates/\n\n## xtask/src/\n### diskfloor.rs\n 19|//! step prints `disk preflight: drive= free_bytes= floor_bytes=` and\n*20|//! fails with `RESOURCE=disk drive= free_bytes= floor_bytes=`; this\n 21|//! verb prints the same keys so one grep reads local rig logs and CI logs\n 22|//! alike. (Cited by text, not by line number — that step moves.)\n 23|// [impl->REQ-DISK-FLOOR-PREFLIGHT]\n...\n 62|/// EXIT: 0 when the run may start (always, under `--floor-gb 0`); 1 under the\n*63|/// floor, with the golden runner's `RESOURCE=disk` diagnostic; 2 on usage.\n 64|pub fn disk_floor(args: &[String]) {\n 65| let path = flag(args, \"--path\")\n 66| .map(PathBuf::from)\n...\n 79|\n*80| let free_bytes = match fs2::available_space(&path) {\n 81| Ok(n) => n,\n 82| Err(e) => {\n 83| eprintln!(\"disk-floor: cannot read free space at {}: {e}\", path.display());\n...\n 99| eprintln!(\n*100| \"RESOURCE=disk drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes} — this run starts under the floor; reds it produces are uninterpretable and must be re-run, not re-read\"\n 101| );\n 102| std::process::exit(1);\n 103| }\n...\n 207| let tmp = tempfile::tempdir().expect(\"temp dir\");\n*208| let free = fs2::available_space(tmp.path()).expect(\"read free space\");\n 209| assert!(free > 0, \"a writable temp dir reports free space\");\n 210| }\n 211|}\n\n## spt-daemon/src/\n### registryhost.rs\n 1362| std::fs::create_dir_all(&perch).unwrap();\n*1363| // Real project dirs OUTSIDE any repo → project_id_for_dir falls back to the\n*1364| // folder name (no remote, no git toplevel).\n 1365| let work = root.join(\"work\");\n 1366| for p in [\"alpha\", \"beta\", \"gamma\"] {\n 1367| std::fs::create_dir_all(work.join(p)).unwrap();"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/xtask/src, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/common, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":7,"fileCount":2,"files":[".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs","count":5},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs","count":2}],"truncated":false,"displayContent":"# .worktrees/hertz-ir86-disk-delta/crates/\n\n## xtask/src/\n### diskfloor.rs\n 19│//! step prints `disk preflight: drive= free_bytes= floor_bytes=` and\n *20│//! fails with `RESOURCE=disk drive= free_bytes= floor_bytes=`; this\n 21│//! verb prints the same keys so one grep reads local rig logs and CI logs\n 22│//! alike. (Cited by text, not by line number — that step moves.)\n 23│// [impl->REQ-DISK-FLOOR-PREFLIGHT]\n │...\n 62│/// EXIT: 0 when the run may start (always, under `--floor-gb 0`); 1 under the\n *63│/// floor, with the golden runner's `RESOURCE=disk` diagnostic; 2 on usage.\n 64│pub fn disk_floor(args: &[String]) {\n 65│ let path = flag(args, \"--path\")\n 66│ .map(PathBuf::from)\n │...\n 79│\n *80│ let free_bytes = match fs2::available_space(&path) {\n 81│ Ok(n) => n,\n 82│ Err(e) => {\n 83│ eprintln!(\"disk-floor: cannot read free space at {}: {e}\", path.display());\n │...\n 99│ eprintln!(\n*100│ \"RESOURCE=disk drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes} — this run starts under the floor; reds it produces are uninterpretable and must be re-run, not re-read\"\n 101│ );\n 102│ std::process::exit(1);\n 103│ }\n │...\n 207│ let tmp = tempfile::tempdir().expect(\"temp dir\");\n*208│ let free = fs2::available_space(tmp.path()).expect(\"read free space\");\n 209│ assert!(free > 0, \"a writable temp dir reports free space\");\n 210│ }\n 211│}\n\n## spt-daemon/src/\n### registryhost.rs\n 1362│ std::fs::create_dir_all(&perch).unwrap();\n*1363│ // Real project dirs OUTSIDE any repo → project_id_for_dir falls back to the\n*1364│ // folder name (no remote, no git toplevel).\n 1365│ let work = root.join(\"work\");\n 1366│ for p in [\"alpha\", \"beta\", \"gamma\"] {\n 1367│ std::fs::create_dir_all(work.join(p)).unwrap();"},"isError":false,"timestamp":1789483720014}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_De3ToMeth5sgNRma5gIqyrug|fc_000c7cef03cac861016aa95ad81b1c87d1b729d1f25099241d","toolName":"read","startedAt":"2026-09-15T14:48:56.184Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:190-310"},"intent":"Reading gate classification and registry"},"id":"9ccc233b","parentId":"97f8472b","timestamp":"2026-09-15T14:48:56.184Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_pnCLQlvySNRAWVGozmIUYMEo|fc_000c7cef03cac861016aa95ad81b3487d19052aec29d0cf75b","toolName":"read","startedAt":"2026-09-15T14:48:56.184Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs:1-105"},"intent":"Reading shipped disk floor seam"},"id":"ef64ca05","parentId":"9ccc233b","timestamp":"2026-09-15T14:48:56.184Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_eSJjaOjRS6EBKgWPWeZqMDVN|fc_000c7cef03cac861016aa95ad81b4487d1a48ceb1f04af34b7","toolName":"grep","startedAt":"2026-09-15T14:48:56.184Z","args":{"path":".worktrees/hertz-ir86-disk-delta/.github/ci;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md;.worktrees/hertz-ir86-disk-delta/AGENTS.md;.work…"},"intent":"Locating disk guard adoption"},"id":"360a4fcd","parentId":"ef64ca05","timestamp":"2026-09-15T14:48:56.184Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Y4ghvkwQjrnLATzXftSxoZRu|fc_000c7cef03cac861016aa95ad81b4c87d18615fea1728a0594","toolName":"read","startedAt":"2026-09-15T14:48:56.184Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md:26-85"},"intent":"Reading current runner covenant"},"id":"4805f89b","parentId":"360a4fcd","timestamp":"2026-09-15T14:48:56.184Z"}
{"type":"message","id":"0acb2376","parentId":"4805f89b","timestamp":"2026-09-15T14:48:56.184Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Inspecting common patterns**"},{"type":"toolCall","id":"call_De3ToMeth5sgNRma5gIqyrug|fc_000c7cef03cac861016aa95ad81b1c87d1b729d1f25099241d","name":"read","arguments":{"i":"Reading gate classification and registry","path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:190-310"},"intent":"Reading gate classification and registry"},{"type":"toolCall","id":"call_pnCLQlvySNRAWVGozmIUYMEo|fc_000c7cef03cac861016aa95ad81b3487d19052aec29d0cf75b","name":"read","arguments":{"i":"Reading shipped disk floor seam","path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs:1-105"},"intent":"Reading shipped disk floor seam"},{"type":"toolCall","id":"call_eSJjaOjRS6EBKgWPWeZqMDVN|fc_000c7cef03cac861016aa95ad81b4487d1a48ceb1f04af34b7","name":"grep","arguments":{"i":"Locating disk guard adoption","pattern":"disk-floor|IR.?90|IR.?88|pool-release|DaemonReaper|Reaper|Drop for","path":".worktrees/hertz-ir86-disk-delta/.github/ci;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md;.worktrees/hertz-ir86-disk-delta/AGENTS.md;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs","case":false,"gitignore":false,"skip":null},"intent":"Locating disk guard adoption"},{"type":"toolCall","id":"call_Y4ghvkwQjrnLATzXftSxoZRu|fc_000c7cef03cac861016aa95ad81b4c87d18615fea1728a0594","name":"read","arguments":{"i":"Reading current runner covenant","path":".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md:26-85"},"intent":"Reading current runner covenant"},{"type":"toolCall","id":"call_nFoNv8zrzhtHjqBnNgdnSZNP|fc_000c7cef03cac861016aa95ad81b5887d1b64780f9a0b8e70e","name":"grep","arguments":{"i":"Checking latest register amendments","pattern":"IR.?78|IR.?79|IR.?81|IR.?82|IR.?87|IR.?90|IR.?94|IR.?107|IR.?130|IR.?134","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-3887","case":false,"gitignore":false,"skip":null},"intent":"Checking latest register amendments"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":123610,"output":431,"cacheRead":0,"cacheWrite":0,"totalTokens":124041,"reasoningTokens":31,"cost":{"input":1.2361000000000002,"output":0.02155,"cacheRead":0,"cacheWrite":0,"total":1.2576500000000002}},"stopReason":"toolUse","timestamp":1789483720048,"responseId":"resp_000c7cef03cac861016aa95ac8458087d1a9a7219af26a7f02","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95acb33f487d188453423e1a0d3e7","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVrYAT6VfwlTysRQrQ6wvQQcUBhh582kTLP-eJCLC5agYxIGtx-icMh5nC9EHrpLz-hNekex_vj_INa_uLgDdqgI8ykyPwnRlA61l-OxFH_7b1xd9t0I8k1n78akmGNehPmKDnJRdnJPA1Ctrj8qEnWNhm7XML5ovDoMGD-3zrVrK_-olYVbyDIKzZ_08ioV1XJCNi2cRAsBsWRqzrnn1LO8caVTKZY1BnMgZpckyU8VKt3KBuGqUHpmRGtIjUjQfK7iVDBHLrV3nDVIjMq7VwPllXmrsdYO2tLaUBxRVSAvUJ_py9dptLn9xhAphJL0MMAAWlBAAL3xVW3XirR-tsX8Yg6JX7lZnxclqi35pP5a_Xc4aAGXzsw9Immh09u_jQwmbnZVdDSw0wT2xC4mfOvSkm09AEdUf6UNAD6g5D5vxQK_WYerYRMYGzmB8iVh2tlaey4WCuKP1PtQMJGNJla0AxZISreEhTYXabcohSVfFAngyt6kQY00Z4uR4bHgyzbIu_TBZjmRXurXSfeiO03e4z_sh6Kt81iMy2PtvDw_BeHyXJ7DmbknHmLdb5KxvSiXyVvchjcUxMCfaYjFBSe6d4PlKnaqBPU51O7TnZWrJMUnoWz2U0MUtM6YSS0g4-_3aCAF291Wmb-Bxqw6zsnXJALOljZYsZOqvySM1Lf73_0DmAoRR7PHkNvhvrttiih6AdP3Do9in1UqkRV6Xx8NUf-HS4XJ_oOW2zfcsHf5tf_cZbVbwOMiz35khtNXdalFgveixoQ9tkaCqOQRjHsEJyNt3rtGHtQHdFAq557WEoR9N99hdKUiwDcWnEh8e6zYywe5MfSx9Inpsw6iJtf6D4GPEOjhJb8LCDfVUr7q3GQsaT5kzzvDstjWd2tSXvBUDexuryEonvcjNgsuSWn4GIpn3_Da8sPdoVEliJRq-AdBOyz0I4wLMtXFdravoKwy4_LV8ffuORpO8LWZiSv6CncT8zVVm1WY2JxyIXvex6LJW1moPaFwUIuNbRfYD1SYg3pjxFrcpD9xJSae1T_seC4Ln6ubjPkUgtnpe5HNssGok2l35ALZOvbchjl1AW4c6x0TSfT8RzBvjEvmTkOEHjk7rbXOU9hQFR1xW2gbm-IQne_Oekq9zBQAfavNRoQnkKlrO0k6Ai7cECEh6ozU8-9eJ5WSgX15_2bILIRSOCIwY_f13LBnaxtqfbElVRTebbIJmO73JT_AoHU_wlQM0ofS659SZBAlyoLSUEuQPZHxwHn0YxOEouder-Axj6ccH-d5Vps5IovjRrMO7vuVKwc3BqTfFXMFFx2CV2bBwWloW8I9MwqZy5t4g3UBAFpRPjRng1Xc8Bf6iZmDe5IwsGEM_39xz0LpLwhXuD-3TfxaKMJXCSHx0mtvGIi66uqWoNrLh6MvZjbfpWqX8wI8bJqS5b4UBchwEiCrYN7Irhr1o7jQxe9-oGfkE7Le0zwbxb7acVL4JBMKRwAK_I9GyA==","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Inspecting common patterns**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ad81b1c87d1b729d1f25099241d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading gate classification and registry\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs:190-310\"}","call_id":"call_De3ToMeth5sgNRma5gIqyrug","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ad81b3487d19052aec29d0cf75b","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading shipped disk floor seam\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs:1-105\"}","call_id":"call_pnCLQlvySNRAWVGozmIUYMEo","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ad81b4487d1a48ceb1f04af34b7","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating disk guard adoption\",\"pattern\":\"disk-floor|IR.?90|IR.?88|pool-release|DaemonReaper|Reaper|Drop for\",\"path\":\".worktrees/hertz-ir86-disk-delta/.github/ci;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/common;.worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md;.worktrees/hertz-ir86-disk-delta/AGENTS.md;.worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_eSJjaOjRS6EBKgWPWeZqMDVN","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ad81b4c87d18615fea1728a0594","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading current runner covenant\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md:26-85\"}","call_id":"call_Y4ghvkwQjrnLATzXftSxoZRu","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ad81b5887d1b64780f9a0b8e70e","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking latest register amendments\",\"pattern\":\"IR.?78|IR.?79|IR.?81|IR.?82|IR.?87|IR.?90|IR.?94|IR.?107|IR.?130|IR.?134\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-3887\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_nFoNv8zrzhtHjqBnNgdnSZNP","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":16133.497000008821,"ttft":3182.1265000104904,"completedAt":1789483736182,"contextSnapshot":{"promptTokens":123610,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_nFoNv8zrzhtHjqBnNgdnSZNP|fc_000c7cef03cac861016aa95ad81b5887d1b64780f9a0b8e70e","toolName":"grep","startedAt":"2026-09-15T14:48:56.184Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-3887"},"intent":"Checking latest register amendments"},"id":"eae955b3","parentId":"0acb2376","timestamp":"2026-09-15T14:48:56.184Z"}
{"type":"message","id":"0dfb2c5a","parentId":"eae955b3","timestamp":"2026-09-15T14:48:56.188Z","message":{"role":"toolResult","toolCallId":"call_De3ToMeth5sgNRma5gIqyrug|fc_000c7cef03cac861016aa95ad81b1c87d1b729d1f25099241d","toolName":"read","content":[{"type":"text","text":"pub fn read_event_sites(src: &str) -> Result, String> {\n…\n Ok(words\n…\n .map(|w| Finding {\n…\n message: \"retired read_event symbol\".into(),\n })\n .collect())\n}\n\n/// Includes all future serve_*_feed bodies, not merely the current nine.\npub fn feed_bodies_calling_call_deadline(src: &str) -> Result, String> {\n let words = tokens(src)?;\n let mut findings = Vec::new();\n for f in functions(&words)? {\n if (f.name.starts_with(\"serve_\") && f.name.ends_with(\"_feed\")) || f.name == \"serve_attach\" {\n for token in f.body.iter().filter(|t| t.text == \"call_deadline\") {\n findings.push(Finding {\n line: token.line,\n message: format!(\"{}: stream lifetime must not use call_deadline\", f.name),\n });\n }\n }\n }\n Ok(findings)\n}\n\nfn policy_controls(\n src: &str,\n streams: &[&str],\n replies: &[(&str, &str)],\n) -> Result, String> {\n let words = tokens(src)?;\n let funcs = functions(&words)?;\n let mut findings = Vec::new();\n for &name in streams.iter().chain(replies.iter().map(|(name, _)| name)) {\n let matching: Vec<_> = funcs.iter().filter(|f| f.name == name).collect();\n if matching.len() != 1 {\n findings.push(Finding {\n line: 1,\n message: format!(\"expected exactly one {name}, found {}\", matching.len()),\n });\n continue;\n }\n let f = matching[0];\n let binding = if let Some((_, receiver)) = replies.iter().find(|(n, _)| *n == name) {\n vec![\n \"let\",\n \"deadline\",\n \"=\",\n receiver,\n \".\",\n \"call_deadline\",\n \"(\",\n \")\",\n \";\",\n \"loop\",\n \"{\",\n ]\n } else {\n vec![\n \"let\", \"deadline\", \":\", \"Option\", \"<\", \"Instant\", \">\", \"=\", \"None\", \";\", \"loop\",\n \"{\",\n ]\n };\n if !has(f.body, &binding) || !has(f.body, &[\"read_event_until\", \"(\", \"deadline\", \")\"]) {\n findings.push(Finding {\n line: f.line,\n message: format!(\"{name}: explicit stream/reply deadline control missing\"),\n });\n }\n }\n Ok(findings)\n}\n\n/// Apply the pure predicates to every crate Rust source, including tests.\n/// Caller prints the returned diagnostics and exits nonzero on Err.\n// [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\npub fn check(root: &Path) -> Result {\n fn collect(dir: &Path, files: &mut Vec) -> Result<(), String> {\n for entry in std::fs::read_dir(dir).map_err(|e| format!(\"{}: {e}\", dir.display()))? {\n let entry = entry.map_err(|e| e.to_string())?;\n let kind = entry.file_type().map_err(|e| e.to_string())?;\n if kind.is_dir() {\n collect(&entry.path(), files)?;\n } else if entry.path().extension().is_some_and(|ext| ext == \"rs\") {\n files.push(entry.path());\n }\n }\n Ok(())\n }\n let mut files = Vec::new();\n collect(&root.join(\"crates\"), &mut files)?;\n files.sort();\n if files.is_empty() {\n return Err(\"BRAIN_READ_AUDIT: no Rust sources\".into());\n }\n let mut errors = Vec::new();\n for path in &files {\n let src = std::fs::read_to_string(path).map_err(|e| format!(\"{}: {e}\", path.display()))?;\n let mut findings = read_event_sites(&src)?;\n findings.extend(feed_bodies_calling_call_deadline(&src)?);\n for finding in findings {\n errors.push(format!(\n \"{}:{}: {}\",\n path.strip_prefix(root).unwrap_or(path).display(),\n finding.line,\n finding.message\n ));\n }\n }\n let feeds = [\n \"serve_registry_feed\",\n \"serve_notif_feed\",\n \"serve_seal_feed\",\n \"serve_knock_feed\",\n \"serve_fork_feed\",\n \"serve_redeem_feed\",\n \"serve_answer_feed\",\n \"serve_presence_feed\",\n \"serve_wan_feed\",\n ];\n for (relative, streams, replies) in [\n (\n \"crates/spt-daemon/src/dispatch.rs\",\n feeds.as_slice(),\n vec![(\"peek_first_line\", \"brain\")],\n ),\n (\n \"crates/spt-daemon/src/attach.rs\",\n…\n ),\n…\n ] {\n…\n }\n…\n}\n\n[Showing lines 189-313 of 396. Use :314 to continue]"}],"details":{"truncation":{"content":" message: \"retired read_event symbol\".into(),\r\n })\r\n .collect())\r\n}\r\n\r\n/// Includes all future serve_*_feed bodies, not merely the current nine.\r\npub fn feed_bodies_calling_call_deadline(src: &str) -> Result, String> {\r\n let words = tokens(src)?;\r\n let mut findings = Vec::new();\r\n for f in functions(&words)? {\r\n if (f.name.starts_with(\"serve_\") && f.name.ends_with(\"_feed\")) || f.name == \"serve_attach\" {\r\n for token in f.body.iter().filter(|t| t.text == \"call_deadline\") {\r\n findings.push(Finding {\r\n line: token.line,\r\n message: format!(\"{}: stream lifetime must not use call_deadline\", f.name),\r\n });\r\n }\r\n }\r\n }\r\n Ok(findings)\r\n}\r\n\r\nfn policy_controls(\r\n src: &str,\r\n streams: &[&str],\r\n replies: &[(&str, &str)],\r\n) -> Result, String> {\r\n let words = tokens(src)?;\r\n let funcs = functions(&words)?;\r\n let mut findings = Vec::new();\r\n for &name in streams.iter().chain(replies.iter().map(|(name, _)| name)) {\r\n let matching: Vec<_> = funcs.iter().filter(|f| f.name == name).collect();\r\n if matching.len() != 1 {\r\n findings.push(Finding {\r\n line: 1,\r\n message: format!(\"expected exactly one {name}, found {}\", matching.len()),\r\n });\r\n continue;\r\n }\r\n let f = matching[0];\r\n let binding = if let Some((_, receiver)) = replies.iter().find(|(n, _)| *n == name) {\r\n vec![\r\n \"let\",\r\n \"deadline\",\r\n \"=\",\r\n receiver,\r\n \".\",\r\n \"call_deadline\",\r\n \"(\",\r\n \")\",\r\n \";\",\r\n \"loop\",\r\n \"{\",\r\n ]\r\n } else {\r\n vec![\r\n \"let\", \"deadline\", \":\", \"Option\", \"<\", \"Instant\", \">\", \"=\", \"None\", \";\", \"loop\",\r\n \"{\",\r\n ]\r\n };\r\n if !has(f.body, &binding) || !has(f.body, &[\"read_event_until\", \"(\", \"deadline\", \")\"]) {\r\n findings.push(Finding {\r\n line: f.line,\r\n message: format!(\"{name}: explicit stream/reply deadline control missing\"),\r\n });\r\n }\r\n }\r\n Ok(findings)\r\n}\r\n\r\n/// Apply the pure predicates to every crate Rust source, including tests.\r\n/// Caller prints the returned diagnostics and exits nonzero on Err.\r\n// [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\r\npub fn check(root: &Path) -> Result {\r\n fn collect(dir: &Path, files: &mut Vec) -> Result<(), String> {\r\n for entry in std::fs::read_dir(dir).map_err(|e| format!(\"{}: {e}\", dir.display()))? {\r\n let entry = entry.map_err(|e| e.to_string())?;\r\n let kind = entry.file_type().map_err(|e| e.to_string())?;\r\n if kind.is_dir() {\r\n collect(&entry.path(), files)?;\r\n } else if entry.path().extension().is_some_and(|ext| ext == \"rs\") {\r\n files.push(entry.path());\r\n }\r\n }\r\n Ok(())\r\n }\r\n let mut files = Vec::new();\r\n collect(&root.join(\"crates\"), &mut files)?;\r\n files.sort();\r\n if files.is_empty() {\r\n return Err(\"BRAIN_READ_AUDIT: no Rust sources\".into());\r\n }\r\n let mut errors = Vec::new();\r\n for path in &files {\r\n let src = std::fs::read_to_string(path).map_err(|e| format!(\"{}: {e}\", path.display()))?;\r\n let mut findings = read_event_sites(&src)?;\r\n findings.extend(feed_bodies_calling_call_deadline(&src)?);\r\n for finding in findings {\r\n errors.push(format!(\r\n \"{}:{}: {}\",\r\n path.strip_prefix(root).unwrap_or(path).display(),\r\n finding.line,\r\n finding.message\r\n ));\r\n }\r\n }\r\n let feeds = [\r\n \"serve_registry_feed\",\r\n \"serve_notif_feed\",\r\n \"serve_seal_feed\",\r\n \"serve_knock_feed\",\r\n \"serve_fork_feed\",\r\n \"serve_redeem_feed\",\r\n \"serve_answer_feed\",\r\n \"serve_presence_feed\",\r\n \"serve_wan_feed\",\r\n ];\r\n for (relative, streams, replies) in [\r\n (\r\n \"crates/spt-daemon/src/dispatch.rs\",\r\n feeds.as_slice(),\r\n vec![(\"peek_first_line\", \"brain\")],\r\n ),\r\n (\r\n \"crates/spt-daemon/src/attach.rs\",\r","truncated":true,"truncatedBy":"lines","totalLines":208,"totalBytes":4467,"outputLines":125,"outputBytes":4467,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":396,"displayContent":{"text":"pub fn read_event_sites(src: &str) -> Result, String> {\n…\n Ok(words\n…\n .map(|w| Finding {\n…\n message: \"retired read_event symbol\".into(),\r\n })\r\n .collect())\r\n}\r\n\r\n/// Includes all future serve_*_feed bodies, not merely the current nine.\r\npub fn feed_bodies_calling_call_deadline(src: &str) -> Result, String> {\r\n let words = tokens(src)?;\r\n let mut findings = Vec::new();\r\n for f in functions(&words)? {\r\n if (f.name.starts_with(\"serve_\") && f.name.ends_with(\"_feed\")) || f.name == \"serve_attach\" {\r\n for token in f.body.iter().filter(|t| t.text == \"call_deadline\") {\r\n findings.push(Finding {\r\n line: token.line,\r\n message: format!(\"{}: stream lifetime must not use call_deadline\", f.name),\r\n });\r\n }\r\n }\r\n }\r\n Ok(findings)\r\n}\r\n\r\nfn policy_controls(\r\n src: &str,\r\n streams: &[&str],\r\n replies: &[(&str, &str)],\r\n) -> Result, String> {\r\n let words = tokens(src)?;\r\n let funcs = functions(&words)?;\r\n let mut findings = Vec::new();\r\n for &name in streams.iter().chain(replies.iter().map(|(name, _)| name)) {\r\n let matching: Vec<_> = funcs.iter().filter(|f| f.name == name).collect();\r\n if matching.len() != 1 {\r\n findings.push(Finding {\r\n line: 1,\r\n message: format!(\"expected exactly one {name}, found {}\", matching.len()),\r\n });\r\n continue;\r\n }\r\n let f = matching[0];\r\n let binding = if let Some((_, receiver)) = replies.iter().find(|(n, _)| *n == name) {\r\n vec![\r\n \"let\",\r\n \"deadline\",\r\n \"=\",\r\n receiver,\r\n \".\",\r\n \"call_deadline\",\r\n \"(\",\r\n \")\",\r\n \";\",\r\n \"loop\",\r\n \"{\",\r\n ]\r\n } else {\r\n vec![\r\n \"let\", \"deadline\", \":\", \"Option\", \"<\", \"Instant\", \">\", \"=\", \"None\", \";\", \"loop\",\r\n \"{\",\r\n ]\r\n };\r\n if !has(f.body, &binding) || !has(f.body, &[\"read_event_until\", \"(\", \"deadline\", \")\"]) {\r\n findings.push(Finding {\r\n line: f.line,\r\n message: format!(\"{name}: explicit stream/reply deadline control missing\"),\r\n });\r\n }\r\n }\r\n Ok(findings)\r\n}\r\n\r\n/// Apply the pure predicates to every crate Rust source, including tests.\r\n/// Caller prints the returned diagnostics and exits nonzero on Err.\r\n// [impl->REQ-BRAIN-READ-BOUNDED-PER-CALL]\r\npub fn check(root: &Path) -> Result {\r\n fn collect(dir: &Path, files: &mut Vec) -> Result<(), String> {\r\n for entry in std::fs::read_dir(dir).map_err(|e| format!(\"{}: {e}\", dir.display()))? {\r\n let entry = entry.map_err(|e| e.to_string())?;\r\n let kind = entry.file_type().map_err(|e| e.to_string())?;\r\n if kind.is_dir() {\r\n collect(&entry.path(), files)?;\r\n } else if entry.path().extension().is_some_and(|ext| ext == \"rs\") {\r\n files.push(entry.path());\r\n }\r\n }\r\n Ok(())\r\n }\r\n let mut files = Vec::new();\r\n collect(&root.join(\"crates\"), &mut files)?;\r\n files.sort();\r\n if files.is_empty() {\r\n return Err(\"BRAIN_READ_AUDIT: no Rust sources\".into());\r\n }\r\n let mut errors = Vec::new();\r\n for path in &files {\r\n let src = std::fs::read_to_string(path).map_err(|e| format!(\"{}: {e}\", path.display()))?;\r\n let mut findings = read_event_sites(&src)?;\r\n findings.extend(feed_bodies_calling_call_deadline(&src)?);\r\n for finding in findings {\r\n errors.push(format!(\r\n \"{}:{}: {}\",\r\n path.strip_prefix(root).unwrap_or(path).display(),\r\n finding.line,\r\n finding.message\r\n ));\r\n }\r\n }\r\n let feeds = [\r\n \"serve_registry_feed\",\r\n \"serve_notif_feed\",\r\n \"serve_seal_feed\",\r\n \"serve_knock_feed\",\r\n \"serve_fork_feed\",\r\n \"serve_redeem_feed\",\r\n \"serve_answer_feed\",\r\n \"serve_presence_feed\",\r\n \"serve_wan_feed\",\r\n ];\r\n for (relative, streams, replies) in [\r\n (\r\n \"crates/spt-daemon/src/dispatch.rs\",\r\n feeds.as_slice(),\r\n vec![(\"peek_first_line\", \"brain\")],\r\n ),\r\n (\r\n \"crates/spt-daemon/src/attach.rs\",\r\n…\n ),\n…\n ] {\n…\n }\n…\n}","startLine":182,"lineNumbers":[182,null,184,null,187,null,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,null,316,null,326,null,332,null,338]},"fileSize":14300,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\xtask\\src\\brainread.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":396,"totalBytes":4467,"outputLines":125,"outputBytes":4467,"shownRange":{"start":189,"end":313},"nextOffset":314}}},"isError":false,"timestamp":1789483736187}}
{"type":"message","id":"29b226fe","parentId":"0dfb2c5a","timestamp":"2026-09-15T14:48:56.212Z","message":{"role":"toolResult","toolCallId":"call_Y4ghvkwQjrnLATzXftSxoZRu|fc_000c7cef03cac861016aa95ad81b4c87d18615fea1728a0594","toolName":"read","content":[{"type":"text","text":"## Step timings leave as an artifact\n…\n\n## Shared-runner quiet-window predicate\n\n\n\nA shared box is quiet only when **both** conditions hold:\n\n1. zero non-terminal CI runs; and\n2. no local `cargo`, `rustc`, or `cargo-nextest` process alive on the box.\n\nA GitHub-only drain check reads clean while another agent is mid-local-build. That is the contention class that muddied the g6 evidence twice. These axes are proxies for contention, not a definition of quiet; a proxy returning “quiet” is not itself a measurement of quiet.\n\n### Queue status is not occupancy\n\n`gh run list` status is not an occupancy probe. A run can report `queued` while its job is already executing on the box; this was observed on #121/#122 with `Runner.Worker` and `cargo-nextest` live and a suite mid-flight. Therefore `queued` never means “not started,” and an idle-looking queue is not evidence of a deaf runner.\n\nThe authoritative occupancy signal is the process table. `Runner.Worker` means a job is running on this box. `cargo-nextest` means a suite is running, which is the seedmap-starvation collision.\n\n### Attribute process load before counting it\n\nThe two predicate axes are not independent: a CI job manifests in the local process table as `cargo` and `rustc`. Their presence does not imply a second occupant. Walk each PID's parent chain before counting it as new load:\n\n- a chain rooted at `Runner.Worker.exe`, `Runner.Listener.exe`, or `RunnerService.exe` is the CI axis already counted;\n- a chain rooted at a user shell is a genuine second occupant, so hold.\n\nOwner queries alone are insufficient. The runner service account can return empty owner and command-line fields; use the parent chain. Report attributed load, not bare process presence: “live local cargo” and “box free of a second occupant” can both be true.\n\n### The link is a third axis, and it is measured rather than assumed\n\n\n\nBoth axes above are process-shaped. A box can be quiet by both and still be a bad place to run a two-host rendezvous, because neither axis can see the link. Run 30771155390 is the specimen: zero non-terminal runs, no local build, and a link so degraded that a 1-second checkout took 321 seconds with bidirectional 10-second QUIC dial timeouts. Its `PUMP_PEER_FAIL` counts moved 0→3→0 on one host and 8→22→8 on the other across green/red/rerun, and the red was triaged as if it were a product failure because nothing in the run recorded what the network was doing.\n\nkitsubito's only link is wifi, indefinitely (operator-confirmed 2026-08-02). The link cannot be hardened, so the predicate has to see it.\n\nBoth two-host jobs therefore probe the peer immediately before rendezvous, via `.github/bench/link-probe.sh` (Linux) and `.github/bench/link-probe.ps1` (Windows), and each writes its result into the run's bench ledger. Read the probe's line like this:\n\n```\nLINK peer=kitsubito ip=100.98.197.12 path=direct samples=5/5 min=10ms med=15ms max=83ms rtts=10,12,15,81,83\n```\n\n- **`path=relay`** means tailscale fell back to DERP. That is a different network than the one the rig's timings were tuned on, and it is the first thing to check when a rendezvous is slow rather than broken.\n- **`samples=n/5` below full** is loss. A rendezvous over a lossy link produces timeouts that look exactly like a product wedge.\n- **`max` far above `med`** is jitter, and jitter is the failure shape here — the motivating run's link mostly worked. A median alone would have read healthy through it, which is why both numbers are carried: the ledger gets `link-rtt-med-` and `link-rtt-max-` rows, so the spread is a trend across runs and not one number in one log.\n- **`probe=NO-REPLY` or `probe=UNAVAILABLE`** is a labelled hole, not a silence. The `ok:false` row says a measurement was attempted and did not land, which is a different claim from a run that never probed.\n- **`ip=` must match that job's `SPT_TWO_HOST_PEER_IP`.** The probe names its peer and the rig addresses one; a disagreement means they are not talking about the same box.\n\nThe probe is an instrument, not a gate: it always exits 0, and no threshold refuses a rendezvous today. Whether a number should is a ruling nobody has made, and an instrument that reds a run converts \"the link was slow\" into \"the suite failed\" — the exact confusion it exists to remove.\n\n### Post-restart daemon churn is a known blind spot\n\nThe fleet daemon's own resume storm—reconnects, pulses, and disk I/O for minutes after restart—is real load that neither predicate axis sees. This is an existing 2026-07-27 g6 finding with an existing mitigation, not a new discovery: a timed-window run adjacent to a daemon restart records the fleet-`spt` CPU-seconds delta sampled before and after, so contention is measured rather than inferred. Recording a rediscovery as a discovery loses the mitigation someone already paid for.\n\nThe preserved instruments are `.github/ci/g6-postbounce.ps1`, for the immediate post-restart sample, and `.github/ci/g6-curve.ps1`, for the private-daemon age/CPU dose-response curve. Both require caller-supplied scratch and fixture-worktree paths; neither embeds an expired agent-session scratchpad. The curve's throwaway `SPT_HOME`, home-hashed IPC socket, `daemon run`, and PID-scoped bounce are deliberate safety boundaries: `daemon start` or `daemon stop` may reach the fleet service and are prohibited in this rig.\n\nThis is a second reason never to restart a wedged daemon merely to tidy the box before a run: that trades a known abnormality for an unmeasured one.\n\n## Windows ad-hoc rigs that outlive the tool call\n\n\n\nUse `Start-Process` with **`-WindowStyle Hidden -PassThru` and no\n`-RedirectStandardOutput` / `-RedirectStandardError`** when a Windows rig must\noutlive its invoking PowerShell tool call. Give the driver durable output paths\n…\nservice hosting, or product daemons.\n…\n\n\n[Showing lines 25-88 of 163. Use :89 to continue]"}],"details":{"truncation":{"content":"\r\n## Shared-runner quiet-window predicate\r\n\r\n\r\n\r\nA shared box is quiet only when **both** conditions hold:\r\n\r\n1. zero non-terminal CI runs; and\r\n2. no local `cargo`, `rustc`, or `cargo-nextest` process alive on the box.\r\n\r\nA GitHub-only drain check reads clean while another agent is mid-local-build. That is the contention class that muddied the g6 evidence twice. These axes are proxies for contention, not a definition of quiet; a proxy returning “quiet” is not itself a measurement of quiet.\r\n\r\n### Queue status is not occupancy\r\n\r\n`gh run list` status is not an occupancy probe. A run can report `queued` while its job is already executing on the box; this was observed on #121/#122 with `Runner.Worker` and `cargo-nextest` live and a suite mid-flight. Therefore `queued` never means “not started,” and an idle-looking queue is not evidence of a deaf runner.\r\n\r\nThe authoritative occupancy signal is the process table. `Runner.Worker` means a job is running on this box. `cargo-nextest` means a suite is running, which is the seedmap-starvation collision.\r\n\r\n### Attribute process load before counting it\r\n\r\nThe two predicate axes are not independent: a CI job manifests in the local process table as `cargo` and `rustc`. Their presence does not imply a second occupant. Walk each PID's parent chain before counting it as new load:\r\n\r\n- a chain rooted at `Runner.Worker.exe`, `Runner.Listener.exe`, or `RunnerService.exe` is the CI axis already counted;\r\n- a chain rooted at a user shell is a genuine second occupant, so hold.\r\n\r\nOwner queries alone are insufficient. The runner service account can return empty owner and command-line fields; use the parent chain. Report attributed load, not bare process presence: “live local cargo” and “box free of a second occupant” can both be true.\r\n\r\n### The link is a third axis, and it is measured rather than assumed\r\n\r\n\r\n\r\nBoth axes above are process-shaped. A box can be quiet by both and still be a bad place to run a two-host rendezvous, because neither axis can see the link. Run 30771155390 is the specimen: zero non-terminal runs, no local build, and a link so degraded that a 1-second checkout took 321 seconds with bidirectional 10-second QUIC dial timeouts. Its `PUMP_PEER_FAIL` counts moved 0→3→0 on one host and 8→22→8 on the other across green/red/rerun, and the red was triaged as if it were a product failure because nothing in the run recorded what the network was doing.\r\n\r\nkitsubito's only link is wifi, indefinitely (operator-confirmed 2026-08-02). The link cannot be hardened, so the predicate has to see it.\r\n\r\nBoth two-host jobs therefore probe the peer immediately before rendezvous, via `.github/bench/link-probe.sh` (Linux) and `.github/bench/link-probe.ps1` (Windows), and each writes its result into the run's bench ledger. Read the probe's line like this:\r\n\r\n```\r\nLINK peer=kitsubito ip=100.98.197.12 path=direct samples=5/5 min=10ms med=15ms max=83ms rtts=10,12,15,81,83\r\n```\r\n\r\n- **`path=relay`** means tailscale fell back to DERP. That is a different network than the one the rig's timings were tuned on, and it is the first thing to check when a rendezvous is slow rather than broken.\r\n- **`samples=n/5` below full** is loss. A rendezvous over a lossy link produces timeouts that look exactly like a product wedge.\r\n- **`max` far above `med`** is jitter, and jitter is the failure shape here — the motivating run's link mostly worked. A median alone would have read healthy through it, which is why both numbers are carried: the ledger gets `link-rtt-med-` and `link-rtt-max-` rows, so the spread is a trend across runs and not one number in one log.\r\n- **`probe=NO-REPLY` or `probe=UNAVAILABLE`** is a labelled hole, not a silence. The `ok:false` row says a measurement was attempted and did not land, which is a different claim from a run that never probed.\r\n- **`ip=` must match that job's `SPT_TWO_HOST_PEER_IP`.** The probe names its peer and the rig addresses one; a disagreement means they are not talking about the same box.\r\n\r\nThe probe is an instrument, not a gate: it always exits 0, and no threshold refuses a rendezvous today. Whether a number should is a ruling nobody has made, and an instrument that reds a run converts \"the link was slow\" into \"the suite failed\" — the exact confusion it exists to remove.\r\n\r\n### Post-restart daemon churn is a known blind spot\r\n\r\nThe fleet daemon's own resume storm—reconnects, pulses, and disk I/O for minutes after restart—is real load that neither predicate axis sees. This is an existing 2026-07-27 g6 finding with an existing mitigation, not a new discovery: a timed-window run adjacent to a daemon restart records the fleet-`spt` CPU-seconds delta sampled before and after, so contention is measured rather than inferred. Recording a rediscovery as a discovery loses the mitigation someone already paid for.\r\n\r\nThe preserved instruments are `.github/ci/g6-postbounce.ps1`, for the immediate post-restart sample, and `.github/ci/g6-curve.ps1`, for the private-daemon age/CPU dose-response curve. Both require caller-supplied scratch and fixture-worktree paths; neither embeds an expired agent-session scratchpad. The curve's throwaway `SPT_HOME`, home-hashed IPC socket, `daemon run`, and PID-scoped bounce are deliberate safety boundaries: `daemon start` or `daemon stop` may reach the fleet service and are prohibited in this rig.\r\n\r\nThis is a second reason never to restart a wedged daemon merely to tidy the box before a run: that trades a known abnormality for an unmeasured one.\r\n\r\n## Windows ad-hoc rigs that outlive the tool call\r\n\r\n\r\n\r\nUse `Start-Process` with **`-WindowStyle Hidden -PassThru` and no\r\n`-RedirectStandardOutput` / `-RedirectStandardError`** when a Windows rig must\r\noutlive its invoking PowerShell tool call. Give the driver durable output paths\r","truncated":true,"truncatedBy":"lines","totalLines":139,"totalBytes":5982,"outputLines":64,"outputBytes":5982,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":163,"displayContent":{"text":"## Step timings leave as an artifact\n…\n\r\n## Shared-runner quiet-window predicate\r\n\r\n\r\n\r\nA shared box is quiet only when **both** conditions hold:\r\n\r\n1. zero non-terminal CI runs; and\r\n2. no local `cargo`, `rustc`, or `cargo-nextest` process alive on the box.\r\n\r\nA GitHub-only drain check reads clean while another agent is mid-local-build. That is the contention class that muddied the g6 evidence twice. These axes are proxies for contention, not a definition of quiet; a proxy returning “quiet” is not itself a measurement of quiet.\r\n\r\n### Queue status is not occupancy\r\n\r\n`gh run list` status is not an occupancy probe. A run can report `queued` while its job is already executing on the box; this was observed on #121/#122 with `Runner.Worker` and `cargo-nextest` live and a suite mid-flight. Therefore `queued` never means “not started,” and an idle-looking queue is not evidence of a deaf runner.\r\n\r\nThe authoritative occupancy signal is the process table. `Runner.Worker` means a job is running on this box. `cargo-nextest` means a suite is running, which is the seedmap-starvation collision.\r\n\r\n### Attribute process load before counting it\r\n\r\nThe two predicate axes are not independent: a CI job manifests in the local process table as `cargo` and `rustc`. Their presence does not imply a second occupant. Walk each PID's parent chain before counting it as new load:\r\n\r\n- a chain rooted at `Runner.Worker.exe`, `Runner.Listener.exe`, or `RunnerService.exe` is the CI axis already counted;\r\n- a chain rooted at a user shell is a genuine second occupant, so hold.\r\n\r\nOwner queries alone are insufficient. The runner service account can return empty owner and command-line fields; use the parent chain. Report attributed load, not bare process presence: “live local cargo” and “box free of a second occupant” can both be true.\r\n\r\n### The link is a third axis, and it is measured rather than assumed\r\n\r\n\r\n\r\nBoth axes above are process-shaped. A box can be quiet by both and still be a bad place to run a two-host rendezvous, because neither axis can see the link. Run 30771155390 is the specimen: zero non-terminal runs, no local build, and a link so degraded that a 1-second checkout took 321 seconds with bidirectional 10-second QUIC dial timeouts. Its `PUMP_PEER_FAIL` counts moved 0→3→0 on one host and 8→22→8 on the other across green/red/rerun, and the red was triaged as if it were a product failure because nothing in the run recorded what the network was doing.\r\n\r\nkitsubito's only link is wifi, indefinitely (operator-confirmed 2026-08-02). The link cannot be hardened, so the predicate has to see it.\r\n\r\nBoth two-host jobs therefore probe the peer immediately before rendezvous, via `.github/bench/link-probe.sh` (Linux) and `.github/bench/link-probe.ps1` (Windows), and each writes its result into the run's bench ledger. Read the probe's line like this:\r\n\r\n```\r\nLINK peer=kitsubito ip=100.98.197.12 path=direct samples=5/5 min=10ms med=15ms max=83ms rtts=10,12,15,81,83\r\n```\r\n\r\n- **`path=relay`** means tailscale fell back to DERP. That is a different network than the one the rig's timings were tuned on, and it is the first thing to check when a rendezvous is slow rather than broken.\r\n- **`samples=n/5` below full** is loss. A rendezvous over a lossy link produces timeouts that look exactly like a product wedge.\r\n- **`max` far above `med`** is jitter, and jitter is the failure shape here — the motivating run's link mostly worked. A median alone would have read healthy through it, which is why both numbers are carried: the ledger gets `link-rtt-med-` and `link-rtt-max-` rows, so the spread is a trend across runs and not one number in one log.\r\n- **`probe=NO-REPLY` or `probe=UNAVAILABLE`** is a labelled hole, not a silence. The `ok:false` row says a measurement was attempted and did not land, which is a different claim from a run that never probed.\r\n- **`ip=` must match that job's `SPT_TWO_HOST_PEER_IP`.** The probe names its peer and the rig addresses one; a disagreement means they are not talking about the same box.\r\n\r\nThe probe is an instrument, not a gate: it always exits 0, and no threshold refuses a rendezvous today. Whether a number should is a ruling nobody has made, and an instrument that reds a run converts \"the link was slow\" into \"the suite failed\" — the exact confusion it exists to remove.\r\n\r\n### Post-restart daemon churn is a known blind spot\r\n\r\nThe fleet daemon's own resume storm—reconnects, pulses, and disk I/O for minutes after restart—is real load that neither predicate axis sees. This is an existing 2026-07-27 g6 finding with an existing mitigation, not a new discovery: a timed-window run adjacent to a daemon restart records the fleet-`spt` CPU-seconds delta sampled before and after, so contention is measured rather than inferred. Recording a rediscovery as a discovery loses the mitigation someone already paid for.\r\n\r\nThe preserved instruments are `.github/ci/g6-postbounce.ps1`, for the immediate post-restart sample, and `.github/ci/g6-curve.ps1`, for the private-daemon age/CPU dose-response curve. Both require caller-supplied scratch and fixture-worktree paths; neither embeds an expired agent-session scratchpad. The curve's throwaway `SPT_HOME`, home-hashed IPC socket, `daemon run`, and PID-scoped bounce are deliberate safety boundaries: `daemon start` or `daemon stop` may reach the fleet service and are prohibited in this rig.\r\n\r\nThis is a second reason never to restart a wedged daemon merely to tidy the box before a run: that trades a known abnormality for an unmeasured one.\r\n\r\n## Windows ad-hoc rigs that outlive the tool call\r\n\r\n\r\n\r\nUse `Start-Process` with **`-WindowStyle Hidden -PassThru` and no\r\n`-RedirectStandardOutput` / `-RedirectStandardError`** when a Windows rig must\r\noutlive its invoking PowerShell tool call. Give the driver durable output paths\r\n…\nservice hosting, or product daemons.\n…\n","startLine":22,"lineNumbers":[22,null,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,null,91,null,125]},"fileSize":16315,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\GOLDEN-CI.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":163,"totalBytes":5982,"outputLines":64,"outputBytes":5982,"shownRange":{"start":25,"end":88},"nextOffset":89}}},"isError":false,"timestamp":1789483736211}}
{"type":"message","id":"21de4f5e","parentId":"29b226fe","timestamp":"2026-09-15T14:48:56.214Z","message":{"role":"toolResult","toolCallId":"call_pnCLQlvySNRAWVGozmIUYMEo|fc_000c7cef03cac861016aa95ad81b3487d19052aec29d0cf75b","toolName":"read","content":[{"type":"text","text":"//! `xtask disk-floor` — record free space at run start, and refuse a run that\n//! starts under the floor (IR-59, the log-the-floor half).\n//!\n//! WHY THIS EXISTS: a full volume reds as a LINKER defect that names no disk —\n//! `LINK: fatal error LNK1318: Unexpected PDB error` (the parenthesised code\n//! varies), beside `LNK4209: debugging information corrupt`, and once as a\n//! `traceable-reqs check` PANIC with `os error 112`. Nothing in any of those\n//! says \"disk\". Two agents spent hours on a mechanism for one of them and\n//! neither read free space; the falsifier was one command away throughout.\n//!\n//! WHY IT IS A VERB AND NOT A LINE IN A SCRIPT: the entry's remedy asks for the\n//! reading in \"the rig/gate preflight path\", and there is no such path in the\n//! tree to amend — the gate legs that hit this ran as PLAIN SCRIPTS, authored\n//! per run, which is the entry's own second face. There is nothing to add a\n//! line to, so the verb IS the template: one command a rig script calls at run\n//! start, carrying the floor with it.\n//!\n//! ITS OUTPUT SHAPE IS GOLDEN'S, DELIBERATELY. The golden runner's preflight\n//! step prints `disk preflight: drive= free_bytes= floor_bytes=` and\n//! fails with `RESOURCE=disk drive= free_bytes= floor_bytes=`; this\n//! verb prints the same keys so one grep reads local rig logs and CI logs\n//! alike. (Cited by text, not by line number — that step moves.)\n// [impl->REQ-DISK-FLOOR-PREFLIGHT]\n\nuse std::path::{Path, PathBuf};\n\n/// The golden runner's floor, in bytes: the observed tens-of-GB full-suite\n/// footprint rounded up. Kept as the default so a local rig and a golden leg\n/// refuse at the same number rather than at two numbers.\npub const DEFAULT_FLOOR_GIB: u64 = 32;\n\nconst GIB: u64 = 1024 * 1024 * 1024;\n\n/// The preflight line, in the golden runner's key shape.\n///\n/// It is printed on EVERY run, passing or not: the point of this half is that\n/// \"was the disk full\" stays answerable after the fact, and a reading that only\n/// appears on refusal leaves every red already in hand uninterpretable.\npub fn preflight_line(drive: &str, free_bytes: u64, floor_bytes: u64, label: Option<&str>) -> String {\n let mut line =\n format!(\"disk preflight: drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes}\");\n if let Some(label) = label {\n // Multi-lane boxes put several rigs' readings in one log; without this\n // the readings are unattributable and read as one lane's history.\n line.push_str(&format!(\" label={label}\"));\n }\n line\n}\n\n/// Whether a run may start.\n///\n/// A floor of ZERO is print-only mode and never refuses — for informational\n/// call sites that want the reading recorded without owning a refusal. The\n/// default floor still refuses, which is golden parity and the\n/// `GATE_ABORTED_DISK_FLOOR` precedent.\npub fn admits(free_bytes: u64, floor_bytes: u64) -> bool {\n floor_bytes == 0 || free_bytes >= floor_bytes\n}\n\n/// `xtask disk-floor [--path ] [--floor-gb ] [--label ]`\n///\n/// EXIT: 0 when the run may start (always, under `--floor-gb 0`); 1 under the\n/// floor, with the golden runner's `RESOURCE=disk` diagnostic; 2 on usage.\npub fn disk_floor(args: &[String]) {\n let path = flag(args, \"--path\")\n .map(PathBuf::from)\n .unwrap_or_else(|| std::env::current_dir().expect(\"cwd\"));\n let floor_gib = match flag(args, \"--floor-gb\") {\n Some(v) => match v.parse::() {\n Ok(n) => n,\n Err(_) => {\n eprintln!(\"disk-floor: --floor-gb takes whole GiB, got {v}\");\n std::process::exit(2);\n }\n },\n None => DEFAULT_FLOOR_GIB,\n };\n let label = flag(args, \"--label\");\n\n let free_bytes = match fs2::available_space(&path) {\n Ok(n) => n,\n Err(e) => {\n eprintln!(\"disk-floor: cannot read free space at {}: {e}\", path.display());\n std::process::exit(2);\n }\n };\n let floor_bytes = floor_gib * GIB;\n let drive = drive_of(&path);\n\n println!(\n \"{}\",\n preflight_line(&drive, free_bytes, floor_bytes, label.as_deref())\n );\n // IR-46: one reading is an INSTANT, not headroom. A cold build's danger\n // window is its TAIL — the 2026-08-22 instance died linking the last and\n // largest artifact of a 74 GB pool while that same build drained the volume\n // out from under itself, and a reading taken before it looked fine.\n if !admits(free_bytes, floor_bytes) {\n eprintln!(\n \"RESOURCE=disk drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes} — this run starts under the floor; reds it produces are uninterpretable and must be re-run, not re-read\"\n );\n std::process::exit(1);\n }\n}\n\n/// The volume a path sits on, for the `drive=` field: the Windows drive\n/// (`C:\\`) or the POSIX root, whichever this platform gives.\n///\n\n[Showing lines 1-108 of 211. Use :109 to continue]"}],"details":{"truncation":{"content":"//! `xtask disk-floor` — record free space at run start, and refuse a run that\r\n//! starts under the floor (IR-59, the log-the-floor half).\r\n//!\r\n//! WHY THIS EXISTS: a full volume reds as a LINKER defect that names no disk —\r\n//! `LINK: fatal error LNK1318: Unexpected PDB error` (the parenthesised code\r\n//! varies), beside `LNK4209: debugging information corrupt`, and once as a\r\n//! `traceable-reqs check` PANIC with `os error 112`. Nothing in any of those\r\n//! says \"disk\". Two agents spent hours on a mechanism for one of them and\r\n//! neither read free space; the falsifier was one command away throughout.\r\n//!\r\n//! WHY IT IS A VERB AND NOT A LINE IN A SCRIPT: the entry's remedy asks for the\r\n//! reading in \"the rig/gate preflight path\", and there is no such path in the\r\n//! tree to amend — the gate legs that hit this ran as PLAIN SCRIPTS, authored\r\n//! per run, which is the entry's own second face. There is nothing to add a\r\n//! line to, so the verb IS the template: one command a rig script calls at run\r\n//! start, carrying the floor with it.\r\n//!\r\n//! ITS OUTPUT SHAPE IS GOLDEN'S, DELIBERATELY. The golden runner's preflight\r\n//! step prints `disk preflight: drive= free_bytes= floor_bytes=` and\r\n//! fails with `RESOURCE=disk drive= free_bytes= floor_bytes=`; this\r\n//! verb prints the same keys so one grep reads local rig logs and CI logs\r\n//! alike. (Cited by text, not by line number — that step moves.)\r\n// [impl->REQ-DISK-FLOOR-PREFLIGHT]\r\n\r\nuse std::path::{Path, PathBuf};\r\n\r\n/// The golden runner's floor, in bytes: the observed tens-of-GB full-suite\r\n/// footprint rounded up. Kept as the default so a local rig and a golden leg\r\n/// refuse at the same number rather than at two numbers.\r\npub const DEFAULT_FLOOR_GIB: u64 = 32;\r\n\r\nconst GIB: u64 = 1024 * 1024 * 1024;\r\n\r\n/// The preflight line, in the golden runner's key shape.\r\n///\r\n/// It is printed on EVERY run, passing or not: the point of this half is that\r\n/// \"was the disk full\" stays answerable after the fact, and a reading that only\r\n/// appears on refusal leaves every red already in hand uninterpretable.\r\npub fn preflight_line(drive: &str, free_bytes: u64, floor_bytes: u64, label: Option<&str>) -> String {\r\n let mut line =\r\n format!(\"disk preflight: drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes}\");\r\n if let Some(label) = label {\r\n // Multi-lane boxes put several rigs' readings in one log; without this\r\n // the readings are unattributable and read as one lane's history.\r\n line.push_str(&format!(\" label={label}\"));\r\n }\r\n line\r\n}\r\n\r\n/// Whether a run may start.\r\n///\r\n/// A floor of ZERO is print-only mode and never refuses — for informational\r\n/// call sites that want the reading recorded without owning a refusal. The\r\n/// default floor still refuses, which is golden parity and the\r\n/// `GATE_ABORTED_DISK_FLOOR` precedent.\r\npub fn admits(free_bytes: u64, floor_bytes: u64) -> bool {\r\n floor_bytes == 0 || free_bytes >= floor_bytes\r\n}\r\n\r\n/// `xtask disk-floor [--path ] [--floor-gb ] [--label ]`\r\n///\r\n/// EXIT: 0 when the run may start (always, under `--floor-gb 0`); 1 under the\r\n/// floor, with the golden runner's `RESOURCE=disk` diagnostic; 2 on usage.\r\npub fn disk_floor(args: &[String]) {\r\n let path = flag(args, \"--path\")\r\n .map(PathBuf::from)\r\n .unwrap_or_else(|| std::env::current_dir().expect(\"cwd\"));\r\n let floor_gib = match flag(args, \"--floor-gb\") {\r\n Some(v) => match v.parse::() {\r\n Ok(n) => n,\r\n Err(_) => {\r\n eprintln!(\"disk-floor: --floor-gb takes whole GiB, got {v}\");\r\n std::process::exit(2);\r\n }\r\n },\r\n None => DEFAULT_FLOOR_GIB,\r\n };\r\n let label = flag(args, \"--label\");\r\n\r\n let free_bytes = match fs2::available_space(&path) {\r\n Ok(n) => n,\r\n Err(e) => {\r\n eprintln!(\"disk-floor: cannot read free space at {}: {e}\", path.display());\r\n std::process::exit(2);\r\n }\r\n };\r\n let floor_bytes = floor_gib * GIB;\r\n let drive = drive_of(&path);\r\n\r\n println!(\r\n \"{}\",\r\n preflight_line(&drive, free_bytes, floor_bytes, label.as_deref())\r\n );\r\n // IR-46: one reading is an INSTANT, not headroom. A cold build's danger\r\n // window is its TAIL — the 2026-08-22 instance died linking the last and\r\n // largest artifact of a 74 GB pool while that same build drained the volume\r\n // out from under itself, and a reading taken before it looked fine.\r\n if !admits(free_bytes, floor_bytes) {\r\n eprintln!(\r\n \"RESOURCE=disk drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes} — this run starts under the floor; reds it produces are uninterpretable and must be re-run, not re-read\"\r\n );\r\n std::process::exit(1);\r\n }\r\n}\r\n\r\n/// The volume a path sits on, for the `drive=` field: the Windows drive\r\n/// (`C:\\`) or the POSIX root, whichever this platform gives.\r\n///\r","truncated":true,"truncatedBy":"lines","totalLines":211,"totalBytes":5026,"outputLines":108,"outputBytes":5026,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":211,"displayContent":{"text":"//! `xtask disk-floor` — record free space at run start, and refuse a run that\r\n//! starts under the floor (IR-59, the log-the-floor half).\r\n//!\r\n//! WHY THIS EXISTS: a full volume reds as a LINKER defect that names no disk —\r\n//! `LINK: fatal error LNK1318: Unexpected PDB error` (the parenthesised code\r\n//! varies), beside `LNK4209: debugging information corrupt`, and once as a\r\n//! `traceable-reqs check` PANIC with `os error 112`. Nothing in any of those\r\n//! says \"disk\". Two agents spent hours on a mechanism for one of them and\r\n//! neither read free space; the falsifier was one command away throughout.\r\n//!\r\n//! WHY IT IS A VERB AND NOT A LINE IN A SCRIPT: the entry's remedy asks for the\r\n//! reading in \"the rig/gate preflight path\", and there is no such path in the\r\n//! tree to amend — the gate legs that hit this ran as PLAIN SCRIPTS, authored\r\n//! per run, which is the entry's own second face. There is nothing to add a\r\n//! line to, so the verb IS the template: one command a rig script calls at run\r\n//! start, carrying the floor with it.\r\n//!\r\n//! ITS OUTPUT SHAPE IS GOLDEN'S, DELIBERATELY. The golden runner's preflight\r\n//! step prints `disk preflight: drive= free_bytes= floor_bytes=` and\r\n//! fails with `RESOURCE=disk drive= free_bytes= floor_bytes=`; this\r\n//! verb prints the same keys so one grep reads local rig logs and CI logs\r\n//! alike. (Cited by text, not by line number — that step moves.)\r\n// [impl->REQ-DISK-FLOOR-PREFLIGHT]\r\n\r\nuse std::path::{Path, PathBuf};\r\n\r\n/// The golden runner's floor, in bytes: the observed tens-of-GB full-suite\r\n/// footprint rounded up. Kept as the default so a local rig and a golden leg\r\n/// refuse at the same number rather than at two numbers.\r\npub const DEFAULT_FLOOR_GIB: u64 = 32;\r\n\r\nconst GIB: u64 = 1024 * 1024 * 1024;\r\n\r\n/// The preflight line, in the golden runner's key shape.\r\n///\r\n/// It is printed on EVERY run, passing or not: the point of this half is that\r\n/// \"was the disk full\" stays answerable after the fact, and a reading that only\r\n/// appears on refusal leaves every red already in hand uninterpretable.\r\npub fn preflight_line(drive: &str, free_bytes: u64, floor_bytes: u64, label: Option<&str>) -> String {\r\n let mut line =\r\n format!(\"disk preflight: drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes}\");\r\n if let Some(label) = label {\r\n // Multi-lane boxes put several rigs' readings in one log; without this\r\n // the readings are unattributable and read as one lane's history.\r\n line.push_str(&format!(\" label={label}\"));\r\n }\r\n line\r\n}\r\n\r\n/// Whether a run may start.\r\n///\r\n/// A floor of ZERO is print-only mode and never refuses — for informational\r\n/// call sites that want the reading recorded without owning a refusal. The\r\n/// default floor still refuses, which is golden parity and the\r\n/// `GATE_ABORTED_DISK_FLOOR` precedent.\r\npub fn admits(free_bytes: u64, floor_bytes: u64) -> bool {\r\n floor_bytes == 0 || free_bytes >= floor_bytes\r\n}\r\n\r\n/// `xtask disk-floor [--path ] [--floor-gb ] [--label ]`\r\n///\r\n/// EXIT: 0 when the run may start (always, under `--floor-gb 0`); 1 under the\r\n/// floor, with the golden runner's `RESOURCE=disk` diagnostic; 2 on usage.\r\npub fn disk_floor(args: &[String]) {\r\n let path = flag(args, \"--path\")\r\n .map(PathBuf::from)\r\n .unwrap_or_else(|| std::env::current_dir().expect(\"cwd\"));\r\n let floor_gib = match flag(args, \"--floor-gb\") {\r\n Some(v) => match v.parse::() {\r\n Ok(n) => n,\r\n Err(_) => {\r\n eprintln!(\"disk-floor: --floor-gb takes whole GiB, got {v}\");\r\n std::process::exit(2);\r\n }\r\n },\r\n None => DEFAULT_FLOOR_GIB,\r\n };\r\n let label = flag(args, \"--label\");\r\n\r\n let free_bytes = match fs2::available_space(&path) {\r\n Ok(n) => n,\r\n Err(e) => {\r\n eprintln!(\"disk-floor: cannot read free space at {}: {e}\", path.display());\r\n std::process::exit(2);\r\n }\r\n };\r\n let floor_bytes = floor_gib * GIB;\r\n let drive = drive_of(&path);\r\n\r\n println!(\r\n \"{}\",\r\n preflight_line(&drive, free_bytes, floor_bytes, label.as_deref())\r\n );\r\n // IR-46: one reading is an INSTANT, not headroom. A cold build's danger\r\n // window is its TAIL — the 2026-08-22 instance died linking the last and\r\n // largest artifact of a 74 GB pool while that same build drained the volume\r\n // out from under itself, and a reading taken before it looked fine.\r\n if !admits(free_bytes, floor_bytes) {\r\n eprintln!(\r\n \"RESOURCE=disk drive={drive} free_bytes={free_bytes} floor_bytes={floor_bytes} — this run starts under the floor; reds it produces are uninterpretable and must be re-run, not re-read\"\r\n );\r\n std::process::exit(1);\r\n }\r\n}\r\n\r\n/// The volume a path sits on, for the `drive=` field: the Windows drive\r\n/// (`C:\\`) or the POSIX root, whichever this platform gives.\r\n///\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108]},"fileSize":9437,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\xtask\\src\\diskfloor.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":211,"totalBytes":5026,"outputLines":108,"outputBytes":5026,"shownRange":{"start":1,"end":108},"nextOffset":109}}},"isError":false,"timestamp":1789483736214}}
{"type":"message","id":"91c30985","parentId":"21de4f5e","timestamp":"2026-09-15T14:48:56.216Z","message":{"role":"toolResult","toolCallId":"call_nFoNv8zrzhtHjqBnNgdnSZNP|fc_000c7cef03cac861016aa95ad81b5887d1b64780f9a0b8e70e","toolName":"grep","content":[{"type":"text","text":" 50| IR-85/95/96 are scoped diagnostic continuation, NOT budget widening or a load/disk diagnosis.\n*51| Todlando owns product-side IR-81/82/92 composition; #285's completion did not build IR-82's\n 52| predecessor record. Both builders are offline: existing briefs are delivered, unacknowledged,\n 53| and **not executing**. No board mutation or new run authorization is implied.\n 54|- **Small seam riders remain explicit:** next tooling intake weighs IR-5/6/10/11/32/37/47/58/94"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":1,"fileCount":1,"files":[".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","count":1}],"truncated":false,"displayContent":" 50│ IR-85/95/96 are scoped diagnostic continuation, NOT budget widening or a load/disk diagnosis.\n*51│ Todlando owns product-side IR-81/82/92 composition; #285's completion did not build IR-82's\n 52│ predecessor record. Both builders are offline: existing briefs are delivered, unacknowledged,\n 53│ and **not executing**. No board mutation or new run authorization is implied.\n 54│- **Small seam riders remain explicit:** next tooling intake weighs IR-5/6/10/11/32/37/47/58/94"},"isError":false,"timestamp":1789483736215}}
{"type":"message","id":"2c496d1b","parentId":"91c30985","timestamp":"2026-09-15T14:48:56.237Z","message":{"role":"toolResult","toolCallId":"call_eSJjaOjRS6EBKgWPWeZqMDVN|fc_000c7cef03cac861016aa95ad81b4487d1a48ceb1f04af34b7","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/\n## AGENTS.md\n 39|\n*40|- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the quest...\n 41|- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 ...\n 42|- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n 43|\n\n## .github/ci/\n### local-lane.py\n 10|Requires the gater's --hold-released acknowledgement. Reuses ws272-w0's quiet\n*11|meter, lane lock, identity scrub and disk-floor meter. Volume movement is aggregate\n*12|capacity evidence, NOT attribution to this lane. Census has the existing reaper's\n 13|explicit scope; an unavailable/incomplete census is never clearance.\n 14|\"\"\"\n 15|import argparse\n...\n 97|def observe_after(root, output, name, env, meter):\n*98| \"\"\"An unavailable disk observation must not prevent the independent reaper.\"\"\"\n 99| disk_ok = builders_ok = clear = False\n 100| try:\n 101| disk_ok = meter(name + \"-after-producer\")\n...\n 136| clear = census_clear(raw, code)\n*137| print(f\"LANE_CENSUS name={name} clear={str(clear).lower()} scope=existing-reaper\", flush=True)\n 138| return clear\n 139|\n 140|\n...\n 263| \"cleanup_errors\": cleanup_errors, \"survivors\": survivors,\n*264| \"scope\": \"sampled-descendants; post-leg reaper census is separate\"})\n 265| except OSError as error:\n 266| reason = f\"artifact-write-failed: {error}\"\n 267| print(reason, file=sys.stderr)\n...\n 283| raise ValueError(\"plan requires nonempty steps\")\n*284| names = {\"pool-claim\", \"pool-release\", \"before\", \"start\", \"lane\", \"plan\",\n 285| \"toolchain\", \"environment-scrub\", \"builders-before\", \"capacity\"}\n 286| for step in plan[\"steps\"]:\n 287| if not isinstance(step, dict):\n...\n 405| try:\n*406| released = subprocess.run([str(xtask), \"pool-release\", \"--pool\", str(target)], cwd=root, env=env, capture_output=True, text=True, timeout=30)\n*407| save(output / \"pool-release.json\", {\"exit\": released.returncode, \"stdout\": released.stdout, \"stderr\": released.stderr})\n 408| result = final_status(result, released.returncode == 0)\n 409| except (OSError, subprocess.TimeoutExpired) as error:\n 410| print(f\"POOL_RELEASE_UNPROVEN: {error}\", file=sys.stderr)\n### reaper-breadcrumb-census.ps1\n 30|.EXAMPLE\n*31| pwsh -File .github/ci/reaper-breadcrumb-census.ps1 -Ref origin/main\n 32|#>\n 33|[CmdletBinding()]\n 34|param(\n...\n 49| # A TIER-1 member is AUTH when every kill linked to the breadcrumb goes\n*50| # through the shared authenticated reaper, RAW when any linked kill is a bare\n 51| # `taskkill`/`kill`/local helper. RAW is the exposed set; the tier alone does\n 52| # not say that, because a fixed file still kills a breadcrumb-derived pid.\n 53| AUTH = 'reap::authenticated_kill|reap::reap_breadcrumb_daemon'\n...\n 66|\n*67|Write-Output \"CENSUS_TOOL=reaper-breadcrumb-census.ps1\"\n 68|Write-Output \"CENSUS_TOOL_VERSION=$ToolVersion\"\n 69|Write-Output \"CENSUS_RUNTIME=PowerShell/$($PSVersionTable.PSVersion) $((git --version))\"\n 70|Write-Output \"CENSUS_REF=$Ref\"\n### ws272-w0.py\n 38|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*39|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 40|# below must never be more lenient than the meter it stands in for.\n 41|FLOOR_BYTES = 32 << 30\n 42|# The perch identity a live agent's shell carries. A battery must never look\n...\n 161|\n*162|# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 163|def floor_verdict(raw, code):\n 164| \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 165| fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n...\n 198| result = subprocess.run(\n*199| [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w0\"],\n 200| cwd=root, capture_output=True, text=True,\n 201| )\n 202| raw, code = result.stdout + result.stderr, result.returncode\n...\n 279| parser.add_argument(\"--xtask\", type=Path,\n*280| help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 281| args = parser.parse_args()\n 282| if args.self_test:\n 283| self_test()\n### ws272-w1.py\n 44|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*45|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 46|# below must never be more lenient than the meter it stands in for.\n 47|FLOOR_BYTES = 32 << 30\n 48|# The perch identity a live agent's shell carries. A battery must never look\n...\n 167|\n*168|# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 169|def floor_verdict(raw, code):\n 170| \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 171| fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n...\n 204| result = subprocess.run(\n*205| [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w1\"],\n 206| cwd=root, capture_output=True, text=True,\n 207| )\n 208| raw, code = result.stdout + result.stderr, result.returncode\n...\n 285| parser.add_argument(\"--xtask\", type=Path,\n*286| help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 287| args = parser.parse_args()\n 288| if args.self_test:\n 289| self_test()\n### ws272-w2.py\n 51|ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n*52|# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 53|# below must never be more lenient than the meter it stands in for.\n 54|FLOOR_BYTES = 32 << 30\n 55|# The perch identity a live agent's shell carries. A battery must never look\n...\n 174|\n*175|# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 176|def floor_verdict(raw, code):\n 177| \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 178| fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n...\n 211| result = subprocess.run(\n*212| [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w2\"],\n 213| cwd=root, capture_output=True, text=True,\n 214| )\n 215| raw, code = result.stdout + result.stderr, result.returncode\n...\n 338| parser.add_argument(\"--xtask\", type=Path,\n*339| help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 340| args = parser.parse_args()\n 341| if args.self_test:\n 342| self_test()\n\n## crates/spt/tests/common/\n### mod.rs\n 15|\n*16|/// The authenticated breadcrumb reaper (`common::reap`) — every test that cleans\n 17|/// up a daemon/brain by its on-disk pid breadcrumb kills through it, so a freed\n 18|/// or recycled pid is refused instead of tree-killed.\n 19|pub mod reap;\n### reap.rs\n*1|//! The AUTHENTICATED breadcrumb reaper shared by the `spt` integration tests.\n 2|//!\n 3|//! An on-disk pid breadcrumb (`/daemon.pid`, the `pid` field of\n 4|//! `brain.ready`) is a NUMBER, not an identity. The process that wrote it exits;\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/.github/ci, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/common, .worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md, .worktrees/hertz-ir86-disk-delta/AGENTS.md, .worktrees/hertz-ir86-disk-delta/crates/spt/tests/projindex_writer_e2e.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":26,"fileCount":8,"files":[".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py",".worktrees/hertz-ir86-disk-delta/.github/ci/reaper-breadcrumb-census.ps1",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w0.py",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w1.py",".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w2.py",".worktrees/hertz-ir86-disk-delta/crates/spt/tests/common/mod.rs",".worktrees/hertz-ir86-disk-delta/crates/spt/tests/common/reap.rs",".worktrees/hertz-ir86-disk-delta/AGENTS.md"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","count":8},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/reaper-breadcrumb-census.ps1","count":3},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w0.py","count":4},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w1.py","count":4},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/ws272-w2.py","count":4},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt/tests/common/mod.rs","count":1},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt/tests/common/reap.rs","count":1},{"path":".worktrees/hertz-ir86-disk-delta/AGENTS.md","count":1}],"truncated":true,"displayContent":"# .worktrees/hertz-ir86-disk-delta/\n## AGENTS.md\n 39│\n*40│- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the quest...\n 41│- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 ...\n 42│- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n 43│\n\n## .github/ci/\n### local-lane.py\n 10│Requires the gater's --hold-released acknowledgement. Reuses ws272-w0's quiet\n *11│meter, lane lock, identity scrub and disk-floor meter. Volume movement is aggregate\n *12│capacity evidence, NOT attribution to this lane. Census has the existing reaper's\n 13│explicit scope; an unavailable/incomplete census is never clearance.\n 14│\"\"\"\n 15│import argparse\n │...\n 97│def observe_after(root, output, name, env, meter):\n *98│ \"\"\"An unavailable disk observation must not prevent the independent reaper.\"\"\"\n 99│ disk_ok = builders_ok = clear = False\n 100│ try:\n 101│ disk_ok = meter(name + \"-after-producer\")\n │...\n 136│ clear = census_clear(raw, code)\n*137│ print(f\"LANE_CENSUS name={name} clear={str(clear).lower()} scope=existing-reaper\", flush=True)\n 138│ return clear\n 139│\n 140│\n │...\n 263│ \"cleanup_errors\": cleanup_errors, \"survivors\": survivors,\n*264│ \"scope\": \"sampled-descendants; post-leg reaper census is separate\"})\n 265│ except OSError as error:\n 266│ reason = f\"artifact-write-failed: {error}\"\n 267│ print(reason, file=sys.stderr)\n │...\n 283│ raise ValueError(\"plan requires nonempty steps\")\n*284│ names = {\"pool-claim\", \"pool-release\", \"before\", \"start\", \"lane\", \"plan\",\n 285│ \"toolchain\", \"environment-scrub\", \"builders-before\", \"capacity\"}\n 286│ for step in plan[\"steps\"]:\n 287│ if not isinstance(step, dict):\n │...\n 405│ try:\n*406│ released = subprocess.run([str(xtask), \"pool-release\", \"--pool\", str(target)], cwd=root, env=env, capture_output=True, text=True, timeout=30)\n*407│ save(output / \"pool-release.json\", {\"exit\": released.returncode, \"stdout\": released.stdout, \"stderr\": released.stderr})\n 408│ result = final_status(result, released.returncode == 0)\n 409│ except (OSError, subprocess.TimeoutExpired) as error:\n 410│ print(f\"POOL_RELEASE_UNPROVEN: {error}\", file=sys.stderr)\n### reaper-breadcrumb-census.ps1\n 30│.EXAMPLE\n*31│ pwsh -File .github/ci/reaper-breadcrumb-census.ps1 -Ref origin/main\n 32│#>\n 33│[CmdletBinding()]\n 34│param(\n │...\n 49│ # A TIER-1 member is AUTH when every kill linked to the breadcrumb goes\n*50│ # through the shared authenticated reaper, RAW when any linked kill is a bare\n 51│ # `taskkill`/`kill`/local helper. RAW is the exposed set; the tier alone does\n 52│ # not say that, because a fixed file still kills a breadcrumb-derived pid.\n 53│ AUTH = 'reap::authenticated_kill|reap::reap_breadcrumb_daemon'\n │...\n 66│\n*67│Write-Output \"CENSUS_TOOL=reaper-breadcrumb-census.ps1\"\n 68│Write-Output \"CENSUS_TOOL_VERSION=$ToolVersion\"\n 69│Write-Output \"CENSUS_RUNTIME=PowerShell/$($PSVersionTable.PSVersion) $((git --version))\"\n 70│Write-Output \"CENSUS_REF=$Ref\"\n### ws272-w0.py\n 38│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n *39│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 40│# below must never be more lenient than the meter it stands in for.\n 41│FLOOR_BYTES = 32 << 30\n 42│# The perch identity a live agent's shell carries. A battery must never look\n │...\n 161│\n*162│# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 163│def floor_verdict(raw, code):\n 164│ \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 165│ fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n │...\n 198│ result = subprocess.run(\n*199│ [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w0\"],\n 200│ cwd=root, capture_output=True, text=True,\n 201│ )\n 202│ raw, code = result.stdout + result.stderr, result.returncode\n │...\n 279│ parser.add_argument(\"--xtask\", type=Path,\n*280│ help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 281│ args = parser.parse_args()\n 282│ if args.self_test:\n 283│ self_test()\n### ws272-w1.py\n 44│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n *45│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 46│# below must never be more lenient than the meter it stands in for.\n 47│FLOOR_BYTES = 32 << 30\n 48│# The perch identity a live agent's shell carries. A battery must never look\n │...\n 167│\n*168│# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 169│def floor_verdict(raw, code):\n 170│ \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 171│ fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n │...\n 204│ result = subprocess.run(\n*205│ [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w1\"],\n 206│ cwd=root, capture_output=True, text=True,\n 207│ )\n 208│ raw, code = result.stdout + result.stderr, result.returncode\n │...\n 285│ parser.add_argument(\"--xtask\", type=Path,\n*286│ help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 287│ args = parser.parse_args()\n 288│ if args.self_test:\n 289│ self_test()\n### ws272-w2.py\n 51│ACTIVE_STATES = (\"in_progress\", \"queued\", \"waiting\", \"pending\", \"requested\")\n *52│# The same floor xtask disk-floor enforces (32 GiB); the bootstrap reading\n 53│# below must never be more lenient than the meter it stands in for.\n 54│FLOOR_BYTES = 32 << 30\n 55│# The perch identity a live agent's shell carries. A battery must never look\n │...\n 174│\n*175│# [impl->REQ-DISK-FLOOR-PREFLIGHT]\n 176│def floor_verdict(raw, code):\n 177│ \"\"\"Render GiB from xtask's own byte reading, never a second disk probe.\"\"\"\n 178│ fields = dict(re.findall(r\"\\b(free_bytes|floor_bytes)=(\\d+)\", raw))\n │...\n 211│ result = subprocess.run(\n*212│ [str(xtask), \"disk-floor\", \"--path\", str(root), \"--label\", \"ws272-w2\"],\n 213│ cwd=root, capture_output=True, text=True,\n 214│ )\n 215│ raw, code = result.stdout + result.stderr, result.returncode\n │...\n 338│ parser.add_argument(\"--xtask\", type=Path,\n*339│ help=\"prebuilt disk-floor meter; defaults to this lane's debug xtask\")\n 340│ args = parser.parse_args()\n 341│ if args.self_test:\n 342│ self_test()\n\n## crates/spt/tests/common/\n### mod.rs\n 15│\n*16│/// The authenticated breadcrumb reaper (`common::reap`) — every test that cleans\n 17│/// up a daemon/brain by its on-disk pid breadcrumb kills through it, so a freed\n 18│/// or recycled pid is refused instead of tree-killed.\n 19│pub mod reap;\n### reap.rs\n*1│//! The AUTHENTICATED breadcrumb reaper shared by the `spt` integration tests.\n 2│//!\n 3│//! An on-disk pid breadcrumb (`/daemon.pid`, the `pid` field of\n 4│//! `brain.ready`) is a NUMBER, not an identity. The process that wrote it exits;","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1789483736237}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_RUQAXfBjPnV1INLph0xhaIJa|fc_000c7cef03cac861016aa95ae3e3d087d18c64a2dfc907eea0","toolName":"read","startedAt":"2026-09-15T14:49:07.959Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-73:raw"},"intent":"Reading present sweep rulings"},"id":"20fa5f6c","parentId":"2c496d1b","timestamp":"2026-09-15T14:49:07.959Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_zEXFwESrtfpBOQukzVmbY14n|fc_000c7cef03cac861016aa95ae3e3e087d19baee385c7d2545d","toolName":"grep","startedAt":"2026-09-15T14:49:07.959Z","args":{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py"},"intent":"Checking runner output encoding"},"id":"89c2769b","parentId":"20fa5f6c","timestamp":"2026-09-15T14:49:07.959Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_T9CXtsYjnGboTR5fqDSE539b|fc_000c7cef03cac861016aa95ae3e3e887d1a77c5ad1a3bafa95","toolName":"grep","startedAt":"2026-09-15T14:49:07.960Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.r…"},"intent":"Checking source residual anchors"},"id":"0013b2d8","parentId":"89c2769b","timestamp":"2026-09-15T14:49:07.960Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ZywYtTguOUFa0Wh2mjdUkPzO|fc_000c7cef03cac861016aa95ae3e3ec87d1a14fa8d859a628fd","toolName":"read","startedAt":"2026-09-15T14:49:07.960Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs:175-230"},"intent":"Reading failure context source"},"id":"68ba0d8b","parentId":"0013b2d8","timestamp":"2026-09-15T14:49:07.960Z"}
{"type":"message","id":"cb27d754","parentId":"68ba0d8b","timestamp":"2026-09-15T14:49:07.960Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Reading relevant status header**"},{"type":"toolCall","id":"call_RUQAXfBjPnV1INLph0xhaIJa|fc_000c7cef03cac861016aa95ae3e3d087d18c64a2dfc907eea0","name":"read","arguments":{"i":"Reading present sweep rulings","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-73:raw"},"intent":"Reading present sweep rulings"},{"type":"toolCall","id":"call_zEXFwESrtfpBOQukzVmbY14n|fc_000c7cef03cac861016aa95ae3e3e087d19baee385c7d2545d","name":"grep","arguments":{"i":"Checking runner output encoding","pattern":"reconfigure|encoding|never.started|all-targets|enumerat|between|before-producer|after-producer","path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","case":false,"gitignore":false,"skip":null},"intent":"Checking runner output encoding"},{"type":"toolCall","id":"call_T9CXtsYjnGboTR5fqDSE539b|fc_000c7cef03cac861016aa95ae3e3e887d1a77c5ad1a3bafa95","name":"grep","arguments":{"i":"Checking source residual anchors","pattern":"fn kill_pid|fn kill_pid_tree|expected|authenticated|before.*repo|outside|premise|rev-parse","path":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","case":false,"gitignore":false,"skip":null},"intent":"Checking source residual anchors"},{"type":"toolCall","id":"call_ZywYtTguOUFa0Wh2mjdUkPzO|fc_000c7cef03cac861016aa95ae3e3ec87d1a14fa8d859a628fd","name":"read","arguments":{"i":"Reading failure context source","path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs:175-230"},"intent":"Reading failure context source"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":6829,"output":325,"cacheRead":123520,"cacheWrite":0,"totalTokens":130674,"reasoningTokens":11,"cost":{"input":0.06829,"output":0.01625,"cacheRead":0.12351999999999999,"cacheWrite":0,"total":0.20806}},"stopReason":"toolUse","timestamp":1789483736265,"responseId":"resp_000c7cef03cac861016aa95ad877e887d1b0f18b90cd31f18f","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95ada2d1487d1a28ea3159b5c4a54","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVrjxfiPmHr6H_R7mdccGDHRxXwIMqe13ZAC2BehZZv3BwAKajLZeW2WJTEKv4dridXuUb1SDqNIrQifjv7sq-1J6rwHCaJDWf-g-GvtqVuvMInrfI4BKG1jKMnFPWGZKq4SCixlcXlgskX7jyxU52uN-yySvJ4pW1e3xpJ9PoXwUeC6NwNvYKmnvCDFjZtQ-zdka-SUY5tZOpqrm5XJTpgEsV6KTVFbZKcnkeLUSq-u5_Qq9AqqijzayGb6BUXgtYqdpcPI-zWJQn81yhoN6yCHAHZR786WeollvwdDyLT47NljsVK9_hnDHKCesAGkuVgqpRq5NRMXjc-u2GDVvOaFYLk8NKzaOL_zCmpqo1XiXnCkKun4bTmg2p3M4LJCVvywVrqf7qgFWMcEs5yZKzqtpVeDfJawNNg5dFq4ogzzaL-UGoQevBMpBLEu-5gaENeu6o1SlmAItxGbBHZT4TSfFKb-8GM9Yvswe5Evmdpe0RwmN6LkHugkrOROFga28C-R9los3r9gXtYRqLF8XajOB1aQLoNCnz2BPaKT-624-wmRx8QoKjxiGXCqZkgL5o7tr88zjj91mfaVIs1VBMls7hmyLMLEzmOIDnHzZJzaFRCb89eVPNyCeLE-Er5L1fINl45EsLXJFPuaZHFd2cflWZ9KM87LXQDH7D8_1lDSMItvmw0XkxqvuPDrss2Vgz-Fc7k7TZsc-eDNlgiBPX8AjV_ACyK1xhLoC0rOJIdBu__Qpwwo6Z4H1S7JcHea5eUUtaxaqxnPzYiB8av70eQBX3ouWzz1Cp5c8Pufoh3xAwXx-3xZjWUPH2XXylUIdybSBRVnLwazdFbRGxv21erk-uMMjIHwNe6eSngmgpJwpwk3nmyWrmloBtbilv9T_S-_2fBdUZ1Uhugn9Tx9-NnWgmwb8HgcXhePP5qZYkJp83qwoxUWPYsYRabf7mGxxecN4KY_IFilTc1ej63Ulis6VpG6l5zMD_3SvOu1sYCcbsgxd3KvlO76W4Tn1J-_yaQNQS5VWM_AtjHlN5aDJUX40AGM2GF_KCl6wdzwoHfoKHrUH6-TdLwwgqkdjNvg2IjvWuiEVk_St6u3QHy9sIxC1GEFXpDfe-jtlwwqNOhvUDx2wekSAXLxYgdW6ukunD2rQjWPj-Cu81Ey0iXom3d8x9rqNYW8dl_BSxgp_eCiSzOy1GDKughsb4E9n9nfqLj6AW3VrWVFf5RFaV6FFOwFPCyXjjaPTtxZRWJboMrieyUU4MRdvun0VdvB62R7S-96Ku2MNCygTH8opMjk6Ql7JDp0jvfmOrXoF6oI7i-SD9naGPftbvZjdabWRsnGxssX","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Reading relevant status header**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ae3e3d087d18c64a2dfc907eea0","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading present sweep rulings\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:1-73:raw\"}","call_id":"call_RUQAXfBjPnV1INLph0xhaIJa","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ae3e3e087d19baee385c7d2545d","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking runner output encoding\",\"pattern\":\"reconfigure|encoding|never.started|all-targets|enumerat|between|before-producer|after-producer\",\"path\":\".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_zEXFwESrtfpBOQukzVmbY14n","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ae3e3e887d1a77c5ad1a3bafa95","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking source residual anchors\",\"pattern\":\"fn kill_pid|fn kill_pid_tree|expected|authenticated|before.*repo|outside|premise|rev-parse\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs;.worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_T9CXtsYjnGboTR5fqDSE539b","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95ae3e3ec87d1a14fa8d859a628fd","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading failure context source\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs:175-230\"}","call_id":"call_ZywYtTguOUFa0Wh2mjdUkPzO","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":11692.346700012684,"ttft":1943.2808000147343,"completedAt":1789483747958,"contextSnapshot":{"promptTokens":130349,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"b35bd236","parentId":"cb27d754","timestamp":"2026-09-15T14:49:07.972Z","message":{"role":"toolResult","toolCallId":"call_RUQAXfBjPnV1INLph0xhaIJa|fc_000c7cef03cac861016aa95ae3e3d087d18c64a2dfc907eea0","toolName":"read","content":[{"type":"text","text":"# Infra register — CI / build-pipeline debt\n\nOperator-ruled 2026-08-02: infrastructure and CI-pipeline work items live HERE, not on the\n`spt-bs-releases` board. The board carries product surface the operator triages; this register\ncarries what the gater triages. **Mandate: doyle sweeps this file at every milestone intake and\nevery release close, and composes ripe entries into waves/milestone riders.** An entry leaves\nthis file only by being built (link the lane) or being retired with a stated reason.\n\nEntry format: status · origin · what/why · trigger condition (what makes it ripe) · size guess.\n\nLast sweep: **2026-09-11, v0.69.0 RELEASE CLOSE — FULL REGISTER**, source `e5a2fed9`.\nAll **97 entries (IR-1–97, including headingless IR-31)** read in two disjoint ranges; audit\npopulation checked for missing/duplicate IDs (97 rows, 97 unique, zero missing). Per-entry\ntrigger and disposition evidence: `.spt/preserved/infra-close069-20260911/audit.json`.\nUNKNOWN means no qualifying event established, not a disproved trigger or a discharged debt.\n\n- **Release facts, not a blanket green:** v0.69.0 at `16df0e41`, counter **105**, Latest,\n 11 assets; #294 and all eight members DONE. Explicit operator SHIP overrode the known\n sync-cell red at candidate `a9e786b2`; the release neither classifies nor closes that defect.\n Source closeout: releases#294 comment **5628538587**. The scoped four-package `--lib` battery\n passed **121/121**; push CI **34550282074** passed **3167 Windows units**, then failed the\n END disk floor (**15,360,114,688 < 34,359,738,368 bytes**). Release build **34550300527**\n succeeded. Earlier PR unit-red logs remain unavailable/cause-unclassified. These are separate\n verdict objects; no pass substitutes for a red, missing specimen, or unexecuted acceptance.\n- **Close already-built work, retain residuals:** IR-1/4 stale unlanded headers reconciled to\n their landed rider and recorded golden exercise. IR-66 CLOSED using its existing two-platform\n gates and WEBSERVE satisfaction ruling. IR-73 CLOSED: eight post-checkout sites plus both\n docs-floor rereads are present; IR-86 retains sizing/dependency debt. Other established\n BUILT/RETIRED decisions stand. IR-18's deferred consolidation and IR-53/62's narrower\n touch-triggered siblings remain carried; closing their built halves does not erase those.\n- **Do not redispatch existing implementations:** IR-26 build-side identity is committed,\n but claim-time observation and old-reader issues remain; IR-29's first fix landed, later\n rung faces remain; IR-33's 16 MiB CLI stack exists, acceptance/margin reconciliation remains.\n IR-57 `pick-audit`, IR-59 `disk-floor`, and IR-46 workflow floor tokens exist; residual adoption\n and receipt reconciliation are the work. IR-69's original product lane landed; #243 residuals\n remain. IR-83's universal LAN-only prescription is superseded by IR-89's layer-specific box\n proof. IR-89's next-golden trigger has fired; exact step acceptance still needs reconciliation,\n not a second guard implementation or renewed operator permission.\n- **IR-92 stays OPEN:** core#215 shipped the documentation/register rider, NOT the product\n remedy; core#217 is the separate brainread audit. `try_spt_hosted_inject` still lacks the\n MSG_IN publisher. Deployah corrected comment **5628532753** in place and confirmed readback.\n Inject coverage, relay publication ordering and per-msg-id exact-once are distinct obligations.\n- **Next-intake composition, owned by doyle until accepted:** hertz's driver/workflow package\n takes IR-31/46/59/60/76/86/87/90/97: aggregate capacity, truthful producer status, existing\n quiet-window contract, independent rendezvous clocks, and mandatory between-run identity\n census. IR-88 adopts the already-proven prebuilt release-before-delete recipe; IR-64 remains\n a separate operator capacity decision. No new loaded comparison before these prerequisites.\n Hertz's lifecycle package retains IR-7/17/20/22/25/34/35/55/63/79/80; guard adoption must\n distinguish unwinding from hard process death. IR-74/75 ride the next Linux box audit.\n IR-85/95/96 are scoped diagnostic continuation, NOT budget widening or a load/disk diagnosis.\n Todlando owns product-side IR-81/82/92 composition; #285's completion did not build IR-82's\n predecessor record. Both builders are offline: existing briefs are delivered, unacknowledged,\n and **not executing**. No board mutation or new run authorization is implied.\n- **Small seam riders remain explicit:** next tooling intake weighs IR-5/6/10/11/32/37/47/58/94\n (IR-37 upstream release is not downstream adoption: golden still requests 0.2.0).\n IR-93 remains a separate symbol-packaging decision before a release-workflow rider, not a\n property proven by a successful release build. All other open entries retain their recorded\n trigger, residual, and owner where named; the complete audit records each, not a sampled set.\n- **Cleanup is mitigation, not closure:** 38 clean merged worktrees and classified obsolete\n artifacts removed; dirty/unmerged/retained evidence preserved. Net free-space change\n **4,532,350,976 bytes**, ending **83,382,472,704 bytes** (concurrent-activity caveat).\n `.spt/cleanup-20260911.json` is the receipt. Root-target and CI-debug reclaims are separate\n earlier measurements, not additions to that net. IR-14/26/27/49 remain structurally OPEN.\n\n### Intake addendum — hosted-relay diagnostic capacity hold (2026-09-11)\n\nSourced C: free samples around the intake, each named by file: **19,260,395,520 bytes at\n03:02:33Z** (post-merge run 34556292801, unit job `FLOOR_END`, RED against the\n34,359,738,368-byte floor); **19,907,792,896 bytes at 07:09:57Z**\n(`.spt/preserved/todlando-pool-reclaim-20260911/before.json`); **191,756,984,320 bytes** after\ndeployah's three authorized target reclaims (`.spt/preserved/deployah-rca-reclaim-20260911/reap-results.json`:\nrca-base +11,461,189,632, rca-head +11,371,200,512, gate-293c +94,256,648,192 observed);\n**247,894,224,896 bytes at 08:39:20Z** (hertz, GetDiskFreeSpaceExW, during post-merge run\n\n[Showing lines 1-73 of 6938. Use :74 to continue]"}],"details":{"truncation":{"content":"# Infra register — CI / build-pipeline debt\r\n\r\nOperator-ruled 2026-08-02: infrastructure and CI-pipeline work items live HERE, not on the\r\n`spt-bs-releases` board. The board carries product surface the operator triages; this register\r\ncarries what the gater triages. **Mandate: doyle sweeps this file at every milestone intake and\r\nevery release close, and composes ripe entries into waves/milestone riders.** An entry leaves\r\nthis file only by being built (link the lane) or being retired with a stated reason.\r\n\r\nEntry format: status · origin · what/why · trigger condition (what makes it ripe) · size guess.\r\n\r\nLast sweep: **2026-09-11, v0.69.0 RELEASE CLOSE — FULL REGISTER**, source `e5a2fed9`.\r\nAll **97 entries (IR-1–97, including headingless IR-31)** read in two disjoint ranges; audit\r\npopulation checked for missing/duplicate IDs (97 rows, 97 unique, zero missing). Per-entry\r\ntrigger and disposition evidence: `.spt/preserved/infra-close069-20260911/audit.json`.\r\nUNKNOWN means no qualifying event established, not a disproved trigger or a discharged debt.\r\n\r\n- **Release facts, not a blanket green:** v0.69.0 at `16df0e41`, counter **105**, Latest,\r\n 11 assets; #294 and all eight members DONE. Explicit operator SHIP overrode the known\r\n sync-cell red at candidate `a9e786b2`; the release neither classifies nor closes that defect.\r\n Source closeout: releases#294 comment **5628538587**. The scoped four-package `--lib` battery\r\n passed **121/121**; push CI **34550282074** passed **3167 Windows units**, then failed the\r\n END disk floor (**15,360,114,688 < 34,359,738,368 bytes**). Release build **34550300527**\r\n succeeded. Earlier PR unit-red logs remain unavailable/cause-unclassified. These are separate\r\n verdict objects; no pass substitutes for a red, missing specimen, or unexecuted acceptance.\r\n- **Close already-built work, retain residuals:** IR-1/4 stale unlanded headers reconciled to\r\n their landed rider and recorded golden exercise. IR-66 CLOSED using its existing two-platform\r\n gates and WEBSERVE satisfaction ruling. IR-73 CLOSED: eight post-checkout sites plus both\r\n docs-floor rereads are present; IR-86 retains sizing/dependency debt. Other established\r\n BUILT/RETIRED decisions stand. IR-18's deferred consolidation and IR-53/62's narrower\r\n touch-triggered siblings remain carried; closing their built halves does not erase those.\r\n- **Do not redispatch existing implementations:** IR-26 build-side identity is committed,\r\n but claim-time observation and old-reader issues remain; IR-29's first fix landed, later\r\n rung faces remain; IR-33's 16 MiB CLI stack exists, acceptance/margin reconciliation remains.\r\n IR-57 `pick-audit`, IR-59 `disk-floor`, and IR-46 workflow floor tokens exist; residual adoption\r\n and receipt reconciliation are the work. IR-69's original product lane landed; #243 residuals\r\n remain. IR-83's universal LAN-only prescription is superseded by IR-89's layer-specific box\r\n proof. IR-89's next-golden trigger has fired; exact step acceptance still needs reconciliation,\r\n not a second guard implementation or renewed operator permission.\r\n- **IR-92 stays OPEN:** core#215 shipped the documentation/register rider, NOT the product\r\n remedy; core#217 is the separate brainread audit. `try_spt_hosted_inject` still lacks the\r\n MSG_IN publisher. Deployah corrected comment **5628532753** in place and confirmed readback.\r\n Inject coverage, relay publication ordering and per-msg-id exact-once are distinct obligations.\r\n- **Next-intake composition, owned by doyle until accepted:** hertz's driver/workflow package\r\n takes IR-31/46/59/60/76/86/87/90/97: aggregate capacity, truthful producer status, existing\r\n quiet-window contract, independent rendezvous clocks, and mandatory between-run identity\r\n census. IR-88 adopts the already-proven prebuilt release-before-delete recipe; IR-64 remains\r\n a separate operator capacity decision. No new loaded comparison before these prerequisites.\r\n Hertz's lifecycle package retains IR-7/17/20/22/25/34/35/55/63/79/80; guard adoption must\r\n distinguish unwinding from hard process death. IR-74/75 ride the next Linux box audit.\r\n IR-85/95/96 are scoped diagnostic continuation, NOT budget widening or a load/disk diagnosis.\r\n Todlando owns product-side IR-81/82/92 composition; #285's completion did not build IR-82's\r\n predecessor record. Both builders are offline: existing briefs are delivered, unacknowledged,\r\n and **not executing**. No board mutation or new run authorization is implied.\r\n- **Small seam riders remain explicit:** next tooling intake weighs IR-5/6/10/11/32/37/47/58/94\r\n (IR-37 upstream release is not downstream adoption: golden still requests 0.2.0).\r\n IR-93 remains a separate symbol-packaging decision before a release-workflow rider, not a\r\n property proven by a successful release build. All other open entries retain their recorded\r\n trigger, residual, and owner where named; the complete audit records each, not a sampled set.\r\n- **Cleanup is mitigation, not closure:** 38 clean merged worktrees and classified obsolete\r\n artifacts removed; dirty/unmerged/retained evidence preserved. Net free-space change\r\n **4,532,350,976 bytes**, ending **83,382,472,704 bytes** (concurrent-activity caveat).\r\n `.spt/cleanup-20260911.json` is the receipt. Root-target and CI-debug reclaims are separate\r\n earlier measurements, not additions to that net. IR-14/26/27/49 remain structurally OPEN.\r\n\r\n### Intake addendum — hosted-relay diagnostic capacity hold (2026-09-11)\r\n\r\nSourced C: free samples around the intake, each named by file: **19,260,395,520 bytes at\r\n03:02:33Z** (post-merge run 34556292801, unit job `FLOOR_END`, RED against the\r\n34,359,738,368-byte floor); **19,907,792,896 bytes at 07:09:57Z**\r\n(`.spt/preserved/todlando-pool-reclaim-20260911/before.json`); **191,756,984,320 bytes** after\r\ndeployah's three authorized target reclaims (`.spt/preserved/deployah-rca-reclaim-20260911/reap-results.json`:\r\nrca-base +11,461,189,632, rca-head +11,371,200,512, gate-293c +94,256,648,192 observed);\r\n**247,894,224,896 bytes at 08:39:20Z** (hertz, GetDiskFreeSpaceExW, during post-merge run\r","truncated":true,"truncatedBy":"lines","totalLines":6938,"totalBytes":6169,"outputLines":73,"outputBytes":6169,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6938,"displayContent":{"text":"# Infra register — CI / build-pipeline debt\r\n\r\nOperator-ruled 2026-08-02: infrastructure and CI-pipeline work items live HERE, not on the\r\n`spt-bs-releases` board. The board carries product surface the operator triages; this register\r\ncarries what the gater triages. **Mandate: doyle sweeps this file at every milestone intake and\r\nevery release close, and composes ripe entries into waves/milestone riders.** An entry leaves\r\nthis file only by being built (link the lane) or being retired with a stated reason.\r\n\r\nEntry format: status · origin · what/why · trigger condition (what makes it ripe) · size guess.\r\n\r\nLast sweep: **2026-09-11, v0.69.0 RELEASE CLOSE — FULL REGISTER**, source `e5a2fed9`.\r\nAll **97 entries (IR-1–97, including headingless IR-31)** read in two disjoint ranges; audit\r\npopulation checked for missing/duplicate IDs (97 rows, 97 unique, zero missing). Per-entry\r\ntrigger and disposition evidence: `.spt/preserved/infra-close069-20260911/audit.json`.\r\nUNKNOWN means no qualifying event established, not a disproved trigger or a discharged debt.\r\n\r\n- **Release facts, not a blanket green:** v0.69.0 at `16df0e41`, counter **105**, Latest,\r\n 11 assets; #294 and all eight members DONE. Explicit operator SHIP overrode the known\r\n sync-cell red at candidate `a9e786b2`; the release neither classifies nor closes that defect.\r\n Source closeout: releases#294 comment **5628538587**. The scoped four-package `--lib` battery\r\n passed **121/121**; push CI **34550282074** passed **3167 Windows units**, then failed the\r\n END disk floor (**15,360,114,688 < 34,359,738,368 bytes**). Release build **34550300527**\r\n succeeded. Earlier PR unit-red logs remain unavailable/cause-unclassified. These are separate\r\n verdict objects; no pass substitutes for a red, missing specimen, or unexecuted acceptance.\r\n- **Close already-built work, retain residuals:** IR-1/4 stale unlanded headers reconciled to\r\n their landed rider and recorded golden exercise. IR-66 CLOSED using its existing two-platform\r\n gates and WEBSERVE satisfaction ruling. IR-73 CLOSED: eight post-checkout sites plus both\r\n docs-floor rereads are present; IR-86 retains sizing/dependency debt. Other established\r\n BUILT/RETIRED decisions stand. IR-18's deferred consolidation and IR-53/62's narrower\r\n touch-triggered siblings remain carried; closing their built halves does not erase those.\r\n- **Do not redispatch existing implementations:** IR-26 build-side identity is committed,\r\n but claim-time observation and old-reader issues remain; IR-29's first fix landed, later\r\n rung faces remain; IR-33's 16 MiB CLI stack exists, acceptance/margin reconciliation remains.\r\n IR-57 `pick-audit`, IR-59 `disk-floor`, and IR-46 workflow floor tokens exist; residual adoption\r\n and receipt reconciliation are the work. IR-69's original product lane landed; #243 residuals\r\n remain. IR-83's universal LAN-only prescription is superseded by IR-89's layer-specific box\r\n proof. IR-89's next-golden trigger has fired; exact step acceptance still needs reconciliation,\r\n not a second guard implementation or renewed operator permission.\r\n- **IR-92 stays OPEN:** core#215 shipped the documentation/register rider, NOT the product\r\n remedy; core#217 is the separate brainread audit. `try_spt_hosted_inject` still lacks the\r\n MSG_IN publisher. Deployah corrected comment **5628532753** in place and confirmed readback.\r\n Inject coverage, relay publication ordering and per-msg-id exact-once are distinct obligations.\r\n- **Next-intake composition, owned by doyle until accepted:** hertz's driver/workflow package\r\n takes IR-31/46/59/60/76/86/87/90/97: aggregate capacity, truthful producer status, existing\r\n quiet-window contract, independent rendezvous clocks, and mandatory between-run identity\r\n census. IR-88 adopts the already-proven prebuilt release-before-delete recipe; IR-64 remains\r\n a separate operator capacity decision. No new loaded comparison before these prerequisites.\r\n Hertz's lifecycle package retains IR-7/17/20/22/25/34/35/55/63/79/80; guard adoption must\r\n distinguish unwinding from hard process death. IR-74/75 ride the next Linux box audit.\r\n IR-85/95/96 are scoped diagnostic continuation, NOT budget widening or a load/disk diagnosis.\r\n Todlando owns product-side IR-81/82/92 composition; #285's completion did not build IR-82's\r\n predecessor record. Both builders are offline: existing briefs are delivered, unacknowledged,\r\n and **not executing**. No board mutation or new run authorization is implied.\r\n- **Small seam riders remain explicit:** next tooling intake weighs IR-5/6/10/11/32/37/47/58/94\r\n (IR-37 upstream release is not downstream adoption: golden still requests 0.2.0).\r\n IR-93 remains a separate symbol-packaging decision before a release-workflow rider, not a\r\n property proven by a successful release build. All other open entries retain their recorded\r\n trigger, residual, and owner where named; the complete audit records each, not a sampled set.\r\n- **Cleanup is mitigation, not closure:** 38 clean merged worktrees and classified obsolete\r\n artifacts removed; dirty/unmerged/retained evidence preserved. Net free-space change\r\n **4,532,350,976 bytes**, ending **83,382,472,704 bytes** (concurrent-activity caveat).\r\n `.spt/cleanup-20260911.json` is the receipt. Root-target and CI-debug reclaims are separate\r\n earlier measurements, not additions to that net. IR-14/26/27/49 remain structurally OPEN.\r\n\r\n### Intake addendum — hosted-relay diagnostic capacity hold (2026-09-11)\r\n\r\nSourced C: free samples around the intake, each named by file: **19,260,395,520 bytes at\r\n03:02:33Z** (post-merge run 34556292801, unit job `FLOOR_END`, RED against the\r\n34,359,738,368-byte floor); **19,907,792,896 bytes at 07:09:57Z**\r\n(`.spt/preserved/todlando-pool-reclaim-20260911/before.json`); **191,756,984,320 bytes** after\r\ndeployah's three authorized target reclaims (`.spt/preserved/deployah-rca-reclaim-20260911/reap-results.json`:\r\nrca-base +11,461,189,632, rca-head +11,371,200,512, gate-293c +94,256,648,192 observed);\r\n**247,894,224,896 bytes at 08:39:20Z** (hertz, GetDiskFreeSpaceExW, during post-merge run\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":6938,"totalBytes":6169,"outputLines":73,"outputBytes":6169,"shownRange":{"start":1,"end":73},"nextOffset":74}}},"isError":false,"timestamp":1789483747971}}
{"type":"message","id":"becd9462","parentId":"b35bd236","timestamp":"2026-09-15T14:49:07.978Z","message":{"role":"toolResult","toolCallId":"call_ZywYtTguOUFa0Wh2mjdUkPzO|fc_000c7cef03cac861016aa95ae3e3ec87d1a14fa8d859a628fd","toolName":"read","content":[{"type":"text","text":"impl PullLink {\n…\n fn pull(\n…\n ) -> (spt_daemon::sync::SyncPullReport, SyncServeOutcome) {\n…\n let skip: Vec = serve_brain\n…\n .expect(\"stream snapshot\")\n .streams\n .iter()\n .map(|s| s.stream_id)\n .collect();\n\n let mut req_brain = connect_retry(&self.requester);\n let conn = req_brain\n .net_dial(addr, Some(MintedOp::new(Minter::Cli, op())))\n .expect(\"dial\");\n let refs_owned: Vec = refs.iter().map(|r| r.to_string()).collect();\n let req_root = self.requester_root.clone();\n let scratch_req = self.scratch.join(\"req\");\n let open_op = MintedOp::new(Minter::Pump, op());\n let puller = thread::spawn(move || {\n let cs = ContextStore::open_or_init_in(&req_root).unwrap();\n request_sync(\n &mut req_brain,\n conn.conn_id,\n &refs_owned,\n open_op,\n &cs,\n &scratch_req,\n )\n .expect(\"pull\")\n });\n\n let (stream, origin) = wait_for_stream_except(&mut serve_brain, &skip);\n let cs = ContextStore::open_or_init_in(&self.responder_root).unwrap();\n let outcome = serve_sync(\n &mut serve_brain,\n stream,\n &origin,\n 0,\n &cs,\n policy,\n &self.scratch.join(\"serve\"),\n )\n .expect(\"serve\");\n (puller.join().expect(\"pull thread\"), outcome)\n }\n}\n\n// [unit->REQ-INST-5] two-tier sync over the wire: a- + p- land\n// byte-identical at the requester, while an unsynced mind (fail-closed: no\n// membership list) and a hidden one are refused SERVER-SIDE even when named in\n// the request — under the handshake-proven origin, never payload bytes.\n// [unit->REQ-NET-3]\n// [unit->REQ-HAZARD-WAN-ORIGIN-AUTH]\n#[test]\nfn two_tier_sync_lands_and_gate_refuses_server_side() {\n let _home = init_home();\n let dir = tempfile::tempdir().expect(\"tempdir\");\n let (name_a, name_b) = (unique_name(), unique_name());\n let _broker_a = net_broker(&name_a, &dir.path().join(\"a\"));\n let _broker_b = net_broker(&name_b, &dir.path().join(\"b\"));\n let (root_a, root_b) = (dir.path().join(\"tracked-a\"), dir.path().join(\"tracked-b\"));\n let scratch = dir.path().join(\"scratch\");\n let mut b_from_a = PullLink {\n requester: name_b.clone(),\n…\n };\n…\n}\n\n[Showing lines 174-233 of 629. Use :234 to continue]"}],"details":{"truncation":{"content":" .expect(\"stream snapshot\")\r\n .streams\r\n .iter()\r\n .map(|s| s.stream_id)\r\n .collect();\r\n\r\n let mut req_brain = connect_retry(&self.requester);\r\n let conn = req_brain\r\n .net_dial(addr, Some(MintedOp::new(Minter::Cli, op())))\r\n .expect(\"dial\");\r\n let refs_owned: Vec = refs.iter().map(|r| r.to_string()).collect();\r\n let req_root = self.requester_root.clone();\r\n let scratch_req = self.scratch.join(\"req\");\r\n let open_op = MintedOp::new(Minter::Pump, op());\r\n let puller = thread::spawn(move || {\r\n let cs = ContextStore::open_or_init_in(&req_root).unwrap();\r\n request_sync(\r\n &mut req_brain,\r\n conn.conn_id,\r\n &refs_owned,\r\n open_op,\r\n &cs,\r\n &scratch_req,\r\n )\r\n .expect(\"pull\")\r\n });\r\n\r\n let (stream, origin) = wait_for_stream_except(&mut serve_brain, &skip);\r\n let cs = ContextStore::open_or_init_in(&self.responder_root).unwrap();\r\n let outcome = serve_sync(\r\n &mut serve_brain,\r\n stream,\r\n &origin,\r\n 0,\r\n &cs,\r\n policy,\r\n &self.scratch.join(\"serve\"),\r\n )\r\n .expect(\"serve\");\r\n (puller.join().expect(\"pull thread\"), outcome)\r\n }\r\n}\r\n\r\n// [unit->REQ-INST-5] two-tier sync over the wire: a- + p- land\r\n// byte-identical at the requester, while an unsynced mind (fail-closed: no\r\n// membership list) and a hidden one are refused SERVER-SIDE even when named in\r\n// the request — under the handshake-proven origin, never payload bytes.\r\n// [unit->REQ-NET-3]\r\n// [unit->REQ-HAZARD-WAN-ORIGIN-AUTH]\r\n#[test]\r\nfn two_tier_sync_lands_and_gate_refuses_server_side() {\r\n let _home = init_home();\r\n let dir = tempfile::tempdir().expect(\"tempdir\");\r\n let (name_a, name_b) = (unique_name(), unique_name());\r\n let _broker_a = net_broker(&name_a, &dir.path().join(\"a\"));\r\n let _broker_b = net_broker(&name_b, &dir.path().join(\"b\"));\r\n let (root_a, root_b) = (dir.path().join(\"tracked-a\"), dir.path().join(\"tracked-b\"));\r\n let scratch = dir.path().join(\"scratch\");\r\n let mut b_from_a = PullLink {\r\n requester: name_b.clone(),\r","truncated":true,"truncatedBy":"lines","totalLines":456,"totalBytes":2355,"outputLines":60,"outputBytes":2355,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":629,"displayContent":{"text":"impl PullLink {\n…\n fn pull(\n…\n ) -> (spt_daemon::sync::SyncPullReport, SyncServeOutcome) {\n…\n let skip: Vec = serve_brain\n…\n .expect(\"stream snapshot\")\r\n .streams\r\n .iter()\r\n .map(|s| s.stream_id)\r\n .collect();\r\n\r\n let mut req_brain = connect_retry(&self.requester);\r\n let conn = req_brain\r\n .net_dial(addr, Some(MintedOp::new(Minter::Cli, op())))\r\n .expect(\"dial\");\r\n let refs_owned: Vec = refs.iter().map(|r| r.to_string()).collect();\r\n let req_root = self.requester_root.clone();\r\n let scratch_req = self.scratch.join(\"req\");\r\n let open_op = MintedOp::new(Minter::Pump, op());\r\n let puller = thread::spawn(move || {\r\n let cs = ContextStore::open_or_init_in(&req_root).unwrap();\r\n request_sync(\r\n &mut req_brain,\r\n conn.conn_id,\r\n &refs_owned,\r\n open_op,\r\n &cs,\r\n &scratch_req,\r\n )\r\n .expect(\"pull\")\r\n });\r\n\r\n let (stream, origin) = wait_for_stream_except(&mut serve_brain, &skip);\r\n let cs = ContextStore::open_or_init_in(&self.responder_root).unwrap();\r\n let outcome = serve_sync(\r\n &mut serve_brain,\r\n stream,\r\n &origin,\r\n 0,\r\n &cs,\r\n policy,\r\n &self.scratch.join(\"serve\"),\r\n )\r\n .expect(\"serve\");\r\n (puller.join().expect(\"pull thread\"), outcome)\r\n }\r\n}\r\n\r\n// [unit->REQ-INST-5] two-tier sync over the wire: a- + p- land\r\n// byte-identical at the requester, while an unsynced mind (fail-closed: no\r\n// membership list) and a hidden one are refused SERVER-SIDE even when named in\r\n// the request — under the handshake-proven origin, never payload bytes.\r\n// [unit->REQ-NET-3]\r\n// [unit->REQ-HAZARD-WAN-ORIGIN-AUTH]\r\n#[test]\r\nfn two_tier_sync_lands_and_gate_refuses_server_side() {\r\n let _home = init_home();\r\n let dir = tempfile::tempdir().expect(\"tempdir\");\r\n let (name_a, name_b) = (unique_name(), unique_name());\r\n let _broker_a = net_broker(&name_a, &dir.path().join(\"a\"));\r\n let _broker_b = net_broker(&name_b, &dir.path().join(\"b\"));\r\n let (root_a, root_b) = (dir.path().join(\"tracked-a\"), dir.path().join(\"tracked-b\"));\r\n let scratch = dir.path().join(\"scratch\");\r\n let mut b_from_a = PullLink {\r\n requester: name_b.clone(),\r\n…\n };\n…\n}","startLine":157,"lineNumbers":[157,null,165,null,169,null,172,null,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,null,238,null,327]},"fileSize":24288,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\spt-daemon\\tests\\sync.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":629,"totalBytes":2355,"outputLines":60,"outputBytes":2355,"shownRange":{"start":174,"end":233},"nextOffset":234}}},"isError":false,"timestamp":1789483747978}}
{"type":"message","id":"b31af738","parentId":"becd9462","timestamp":"2026-09-15T14:49:07.986Z","message":{"role":"toolResult","toolCallId":"call_zEXFwESrtfpBOQukzVmbY14n|fc_000c7cef03cac861016aa95ae3e3e087d19baee385c7d2545d","toolName":"grep","content":[{"type":"text","text":" 35|def save(path, value):\n*36| path.write_text(json.dumps(value, indent=2) + \"\\n\", encoding=\"utf-8\")\n 37|\n 38|\n 39|# [impl->REQ-LOCAL-GATE-EXECUTION-EVIDENCE]\n...\n 100| try:\n*101| disk_ok = meter(name + \"-after-producer\")\n 102| except OSError as error:\n 103| print(f\"DISK_OBSERVATION_UNPROVEN: {error}\", file=sys.stderr)\n 104| try:\n...\n 133| raw, code = f\"CENSUS_UNPROVEN: {error}\\n\", REFUSED\n*134| (output / f\"{name}.raw\").write_text(raw, encoding=\"utf-8\")\n*135| (output / f\"{name}.exit\").write_text(f\"{code}\\n\", encoding=\"utf-8\")\n 136| clear = census_clear(raw, code)\n 137| print(f\"LANE_CENSUS name={name} clear={str(clear).lower()} scope=existing-reaper\", flush=True)\n 138| return clear\n...\n 166| row, admitted = {\"name\": name, \"error\": str(error), \"sample\": \"UNAVAILABLE\"}, False\n*167| with (output / \"capacity.jsonl\").open(\"a\", encoding=\"utf-8\") as stream:\n 168| stream.write(json.dumps(row) + \"\\n\")\n 169| return admitted\n 170|\n...\n 257| (output / f\"{name}.exit\").write_text(\n*258| f\"{code}\\n\" if code is not None else \"UNOBSERVED\\n\", encoding=\"utf-8\")\n 259| save(output / f\"{name}.observation.json\", {\n 260| \"producer_exit\": code, \"launch_failed\": launch_failed, \"stop_reason\": reason,\n 261| \"elapsed_seconds\": time.monotonic() - started,\n...\n 322| root = Path(__file__).resolve().parents[2]\n*323| plan = json.loads(args.plan.read_text(encoding=\"utf-8\"))\n 324| validate_plan(plan)\n 325| target, xtask, output = root / \"target\", args.xtask.resolve(), args.output.resolve()\n 326| if not xtask.is_file() or not (target / \"debug/deps\").is_dir() or not (target / \".rustc_info.json\").is_file():\n...\n 351| save(output / \"toolchain.json\", {\"stdout\": actual.stdout, \"stderr\": actual.stderr, \"exit\": actual.returncode})\n*352| cached = json.loads((target / \".rustc_info.json\").read_text(encoding=\"utf-8\"))\n 353| cached_outputs = cached.get(\"outputs\", {}).values()\n 354| if actual.returncode or actual.stdout != plan[\"rustc_version\"] or not any(row.get(\"success\") is True and row.get(\"stdout\") == actual.stdout for row in cached_outputs):\n 355| raise ValueError(\"toolchain differs from allocated warm cache; allocation invalid\")\n...\n 389| break\n*390| inventory = json.loads((output / f\"{name}-inventory.stdout\").read_text(encoding=\"utf-8\"))\n 391| save(output / f\"{name}-selection.json\", selected_inventory(inventory))\n 392| else:\n 393| argv = step[\"argv\"]\n...\n 413| try:\n*414| (output / \"lane.exit\").write_text(f\"{result}\\n\", encoding=\"utf-8\")\n 415| except OSError as error:\n 416| print(f\"LANE_STATUS_WRITE_FAILED: {error}; producer/driver exit={result}\", file=sys.stderr)\n 417| result = final_status(result, False)"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\.github\\ci\\local-lane.py","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":10,"fileCount":1,"files":[".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","count":10}],"truncated":false,"displayContent":" 35│def save(path, value):\n *36│ path.write_text(json.dumps(value, indent=2) + \"\\n\", encoding=\"utf-8\")\n 37│\n 38│\n 39│# [impl->REQ-LOCAL-GATE-EXECUTION-EVIDENCE]\n │...\n 100│ try:\n*101│ disk_ok = meter(name + \"-after-producer\")\n 102│ except OSError as error:\n 103│ print(f\"DISK_OBSERVATION_UNPROVEN: {error}\", file=sys.stderr)\n 104│ try:\n │...\n 133│ raw, code = f\"CENSUS_UNPROVEN: {error}\\n\", REFUSED\n*134│ (output / f\"{name}.raw\").write_text(raw, encoding=\"utf-8\")\n*135│ (output / f\"{name}.exit\").write_text(f\"{code}\\n\", encoding=\"utf-8\")\n 136│ clear = census_clear(raw, code)\n 137│ print(f\"LANE_CENSUS name={name} clear={str(clear).lower()} scope=existing-reaper\", flush=True)\n 138│ return clear\n │...\n 166│ row, admitted = {\"name\": name, \"error\": str(error), \"sample\": \"UNAVAILABLE\"}, False\n*167│ with (output / \"capacity.jsonl\").open(\"a\", encoding=\"utf-8\") as stream:\n 168│ stream.write(json.dumps(row) + \"\\n\")\n 169│ return admitted\n 170│\n │...\n 257│ (output / f\"{name}.exit\").write_text(\n*258│ f\"{code}\\n\" if code is not None else \"UNOBSERVED\\n\", encoding=\"utf-8\")\n 259│ save(output / f\"{name}.observation.json\", {\n 260│ \"producer_exit\": code, \"launch_failed\": launch_failed, \"stop_reason\": reason,\n 261│ \"elapsed_seconds\": time.monotonic() - started,\n │...\n 322│ root = Path(__file__).resolve().parents[2]\n*323│ plan = json.loads(args.plan.read_text(encoding=\"utf-8\"))\n 324│ validate_plan(plan)\n 325│ target, xtask, output = root / \"target\", args.xtask.resolve(), args.output.resolve()\n 326│ if not xtask.is_file() or not (target / \"debug/deps\").is_dir() or not (target / \".rustc_info.json\").is_file():\n │...\n 351│ save(output / \"toolchain.json\", {\"stdout\": actual.stdout, \"stderr\": actual.stderr, \"exit\": actual.returncode})\n*352│ cached = json.loads((target / \".rustc_info.json\").read_text(encoding=\"utf-8\"))\n 353│ cached_outputs = cached.get(\"outputs\", {}).values()\n 354│ if actual.returncode or actual.stdout != plan[\"rustc_version\"] or not any(row.get(\"success\") is True and row.get(\"stdout\") == actual.stdout for row in cached_outputs):\n 355│ raise ValueError(\"toolchain differs from allocated warm cache; allocation invalid\")\n │...\n 389│ break\n*390│ inventory = json.loads((output / f\"{name}-inventory.stdout\").read_text(encoding=\"utf-8\"))\n 391│ save(output / f\"{name}-selection.json\", selected_inventory(inventory))\n 392│ else:\n 393│ argv = step[\"argv\"]\n │...\n 413│ try:\n*414│ (output / \"lane.exit\").write_text(f\"{result}\\n\", encoding=\"utf-8\")\n 415│ except OSError as error:\n 416│ print(f\"LANE_STATUS_WRITE_FAILED: {error}; producer/driver exit={result}\", file=sys.stderr)\n 417│ result = final_status(result, False)"},"isError":false,"timestamp":1789483747985}}
{"type":"message","id":"aeeea946","parentId":"b31af738","timestamp":"2026-09-15T14:49:08.030Z","message":{"role":"toolResult","toolCallId":"call_T9CXtsYjnGboTR5fqDSE539b|fc_000c7cef03cac861016aa95ae3e3e887d1a77c5ad1a3bafa95","toolName":"grep","content":[{"type":"text","text":"# .worktrees/hertz-ir86-disk-delta/crates/\n\n## spt-store/src/\n### proc.rs\n 45|// [impl->REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP]\n*46|pub fn kill_pid(pid: u32) {\n 47| if pid == 0 {\n 48| return; // never a real per-process target (see is_process_alive)\n 49| }\n...\n 429|// [impl->REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN]\n*430|pub fn kill_pid_tree(root: u32) {\n 431| if root == 0 {\n 432| return;\n 433| }\n...\n 779| // it. It composes table-presence with a start-time read, and `/proc` answers\n*780| // both for a zombie — so before this it reported `Present(our_own_birth)`,\n 781| // which passes the custody pair test and reads HELD for a corpse. Every\n 782| // consumer that asks \"is this recorded process still ours\" then answers YES\n 783| // forever on Linux: relay-death convergence never fires, and the endpoint\n...\n 928| #[test]\n*929| fn kill_pid_tree_kills_the_whole_subtree() {\n 930| let mut parent = spawn_two_level_tree();\n 931| let ppid = parent.id();\n 932| // Wait for the child to appear under the parent, then capture its pid.\n\n## spt-daemon/src/\n### registryhost.rs\n 1121|/// derivation injected so a unit test can count it. Derivation spawns git\n*1122|/// (`remote`/`rev-parse`) per call, so the RAW cwd string is deduped BEFORE\n 1123|/// `derive` runs — a ledger heavy with duplicate cwds derives once per DISTINCT\n 1124|/// cwd per round, not once per row (the post-self-hash v0.37.0 CPU floor: ~200\n 1125|/// derivations per pump round on a 12-perch box). The pid-level dedup stays as\n...\n 1354| // The layout mirrors the real one (releases#178): `$SPT_HOME` holds the owlery\n*1355| // AND the engine room's sequestered cwd, while user projects live OUTSIDE it.\n 1356| // The old fixture put the projects inside the same dir it used as the exclusion\n 1357| // base — harmless while the base was the owlery, but it would read as \"every\n 1358| // project is internal\" now that the base is the home itself.\n...\n 1362| std::fs::create_dir_all(&perch).unwrap();\n*1363| // Real project dirs OUTSIDE any repo → project_id_for_dir falls back to the\n 1364| // folder name (no remote, no git toplevel).\n 1365| let work = root.join(\"work\");\n 1366| for p in [\"alpha\", \"beta\", \"gamma\"] {\n...\n 1368| }\n*1369| // PREMISE, asserted rather than assumed: this fixture tree is OUTSIDE any git\n 1370| // toplevel. project_id_for_dir tries `git remote get-url origin` FIRST, so a\n 1371| // tempdir that lands inside a checkout derives THAT repo's remote for every\n 1372| // fixture dir and collapses alpha/beta/gamma to one id — the assertions below\n...\n 1386| std::fs::create_dir_all(&psyche).unwrap();\n*1387| // The engine room's sequestered cwd: under the home, OUTSIDE the owlery. This\n 1388| // is the row that would have been GOSSIPED TO THE NETWORK as a project named\n 1389| // `cwd` before the widening.\n 1390| let er = home.join(\"engineroom\").join(\"cwd\");\n### projwriter.rs\n 706| /// `home` is a SUBDIRECTORY of the temp root, not the root itself, so that\n*707| /// the fixture's project workdirs can sit OUTSIDE it — which is the real\n 708| /// layout (user projects do not live under `$SPT_HOME`) and the only one\n 709| /// that still exercises project derivation now that `internal_root` is the\n 710| /// home rather than the owlery (releases#178). With workdirs inside the\n...\n 773| /// A plain (non-git) project dir whose folder name becomes the id.\n*774| /// Rooted OUTSIDE `home`: a user project under `$SPT_HOME` is spt-internal\n 775| /// and derives no project at all (releases#178).\n 776| fn project_dir(&self, name: &str) -> PathBuf {\n 777| let dir = self.root.join(\"workdirs\").join(name);\n...\n 798| let dir_b = fx.project_dir(\"proj-b\");\n*799| // PREMISE, asserted rather than assumed: these fixture dirs are OUTSIDE any git\n 800| // toplevel. project_id_and_display_for_dir tries `git remote get-url origin`\n 801| // FIRST, so a tempdir that lands inside a checkout derives THAT repo's remote —\n 802| // the display assertion below then reads \"spt-core\" and reds as a writer defect"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs, .worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":12,"fileCount":3,"files":[".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs",".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs","count":4},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs","count":5},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","count":3}],"truncated":false,"displayContent":"# .worktrees/hertz-ir86-disk-delta/crates/\n\n## spt-store/src/\n### proc.rs\n 45│// [impl->REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP]\n *46│pub fn kill_pid(pid: u32) {\n 47│ if pid == 0 {\n 48│ return; // never a real per-process target (see is_process_alive)\n 49│ }\n │...\n 429│// [impl->REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN]\n*430│pub fn kill_pid_tree(root: u32) {\n 431│ if root == 0 {\n 432│ return;\n 433│ }\n │...\n 779│ // it. It composes table-presence with a start-time read, and `/proc` answers\n*780│ // both for a zombie — so before this it reported `Present(our_own_birth)`,\n 781│ // which passes the custody pair test and reads HELD for a corpse. Every\n 782│ // consumer that asks \"is this recorded process still ours\" then answers YES\n 783│ // forever on Linux: relay-death convergence never fires, and the endpoint\n │...\n 928│ #[test]\n*929│ fn kill_pid_tree_kills_the_whole_subtree() {\n 930│ let mut parent = spawn_two_level_tree();\n 931│ let ppid = parent.id();\n 932│ // Wait for the child to appear under the parent, then capture its pid.\n\n## spt-daemon/src/\n### registryhost.rs\n 1121│/// derivation injected so a unit test can count it. Derivation spawns git\n*1122│/// (`remote`/`rev-parse`) per call, so the RAW cwd string is deduped BEFORE\n 1123│/// `derive` runs — a ledger heavy with duplicate cwds derives once per DISTINCT\n 1124│/// cwd per round, not once per row (the post-self-hash v0.37.0 CPU floor: ~200\n 1125│/// derivations per pump round on a 12-perch box). The pid-level dedup stays as\n │...\n 1354│ // The layout mirrors the real one (releases#178): `$SPT_HOME` holds the owlery\n*1355│ // AND the engine room's sequestered cwd, while user projects live OUTSIDE it.\n 1356│ // The old fixture put the projects inside the same dir it used as the exclusion\n 1357│ // base — harmless while the base was the owlery, but it would read as \"every\n 1358│ // project is internal\" now that the base is the home itself.\n │...\n 1362│ std::fs::create_dir_all(&perch).unwrap();\n*1363│ // Real project dirs OUTSIDE any repo → project_id_for_dir falls back to the\n 1364│ // folder name (no remote, no git toplevel).\n 1365│ let work = root.join(\"work\");\n 1366│ for p in [\"alpha\", \"beta\", \"gamma\"] {\n │...\n 1368│ }\n*1369│ // PREMISE, asserted rather than assumed: this fixture tree is OUTSIDE any git\n 1370│ // toplevel. project_id_for_dir tries `git remote get-url origin` FIRST, so a\n 1371│ // tempdir that lands inside a checkout derives THAT repo's remote for every\n 1372│ // fixture dir and collapses alpha/beta/gamma to one id — the assertions below\n │...\n 1386│ std::fs::create_dir_all(&psyche).unwrap();\n*1387│ // The engine room's sequestered cwd: under the home, OUTSIDE the owlery. This\n 1388│ // is the row that would have been GOSSIPED TO THE NETWORK as a project named\n 1389│ // `cwd` before the widening.\n 1390│ let er = home.join(\"engineroom\").join(\"cwd\");\n### projwriter.rs\n 706│ /// `home` is a SUBDIRECTORY of the temp root, not the root itself, so that\n*707│ /// the fixture's project workdirs can sit OUTSIDE it — which is the real\n 708│ /// layout (user projects do not live under `$SPT_HOME`) and the only one\n 709│ /// that still exercises project derivation now that `internal_root` is the\n 710│ /// home rather than the owlery (releases#178). With workdirs inside the\n │...\n 773│ /// A plain (non-git) project dir whose folder name becomes the id.\n*774│ /// Rooted OUTSIDE `home`: a user project under `$SPT_HOME` is spt-internal\n 775│ /// and derives no project at all (releases#178).\n 776│ fn project_dir(&self, name: &str) -> PathBuf {\n 777│ let dir = self.root.join(\"workdirs\").join(name);\n │...\n 798│ let dir_b = fx.project_dir(\"proj-b\");\n*799│ // PREMISE, asserted rather than assumed: these fixture dirs are OUTSIDE any git\n 800│ // toplevel. project_id_and_display_for_dir tries `git remote get-url origin`\n 801│ // FIRST, so a tempdir that lands inside a checkout derives THAT repo's remote —\n 802│ // the display assertion below then reads \"spt-core\" and reds as a writer defect"},"isError":false,"timestamp":1789483748029}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uhzDd3jpEYAFswTRgjE8QsuG|fc_000c7cef03cac861016aa95aeff1dc87d1b940b9235eee1e3a","toolName":"read","startedAt":"2026-09-15T14:49:20.285Z","args":{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6500-6504:raw"},"intent":"Recovering final long recurrence"},"id":"4dd9df42","parentId":"aeeea946","timestamp":"2026-09-15T14:49:20.285Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_TNybKMJryhyJJNkPGh4ZAF2P|fc_000c7cef03cac861016aa95aeff1ec87d196cdf6b02ee80794","toolName":"read","startedAt":"2026-09-15T14:49:20.286Z","args":{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py:360-427"},"intent":"Reading runner result sequencing"},"id":"d526d750","parentId":"4dd9df42","timestamp":"2026-09-15T14:49:20.286Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_XdFhbTE66F0huPTSLvvyYtf9|fc_000c7cef03cac861016aa95aeff1f487d18ee0f70b611ed076","toolName":"grep","startedAt":"2026-09-15T14:49:20.286Z","args":{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/killscoping.rs;.worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs"},"intent":"Checking scope gate alternate names"},"id":"d6332a7a","parentId":"d526d750","timestamp":"2026-09-15T14:49:20.286Z"}
{"type":"message","id":"b21eb200","parentId":"d6332a7a","timestamp":"2026-09-15T14:49:20.286Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Reading IR107 amendment**"},{"type":"toolCall","id":"call_uhzDd3jpEYAFswTRgjE8QsuG|fc_000c7cef03cac861016aa95aeff1dc87d1b940b9235eee1e3a","name":"read","arguments":{"i":"Recovering final long recurrence","path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6500-6504:raw"},"intent":"Recovering final long recurrence"},{"type":"toolCall","id":"call_TNybKMJryhyJJNkPGh4ZAF2P|fc_000c7cef03cac861016aa95aeff1ec87d196cdf6b02ee80794","name":"read","arguments":{"i":"Reading runner result sequencing","path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py:360-427"},"intent":"Reading runner result sequencing"},{"type":"toolCall","id":"call_XdFhbTE66F0huPTSLvvyYtf9|fc_000c7cef03cac861016aa95aeff1f487d18ee0f70b611ed076","name":"grep","arguments":{"i":"Checking scope gate alternate names","pattern":"taskkill|wmic|pkill|scop","path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/killscoping.rs;.worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs","case":false,"gitignore":false,"skip":null},"intent":"Checking scope gate alternate names"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":4800,"output":292,"cacheRead":130176,"cacheWrite":0,"totalTokens":135268,"reasoningTokens":93,"cost":{"input":0.048,"output":0.0146,"cacheRead":0.130176,"cacheWrite":0,"total":0.192776}},"stopReason":"toolUse","timestamp":1789483748062,"responseId":"resp_000c7cef03cac861016aa95ae4494c87d1afc2e253424806c1","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95ae7396087d1acc69579fe703d17","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVrv4SI16cOeoxJwAQziF-IweOzrT73vdiEnWZCwEW5Bp7cwul_tcU4Q0mBhy5arkMVFhKUMW4YnSkntFbhGdElU9NDB057Bh35Gah84z4khHacQwBhqjjttXVs4_C91d8EFLvrmpVwMy12stRA_6byIOEhUXcGBzvZe3Z-a7YdnGNl2mlDk1Zx0SRdbk5dPvRu7MpIDrLQGh-MkU85u5Mvw2dV3oRpyB4XjNI-UrJ4MOyeS1urCj99gk8lsj7XnanRY3k5RygQJQvhfUBwOrglFVB6eX2OflYYZgsGpXE45EwUswHauCectkkHI42NZDTssLrI_6LMz8EXF1YxdYmqDtzW4tiz7G3Hdom7BZz2maxNN8-oknqVZwFRy_LKs9Nx1D-5plXUQnxbGKXZRzgPEU9JslTHLRyPXbdyNHrkQEF4R1YqdDCZ98ICpBHheFvq4NuMOKbdx3DM08ZFlwAry857QNOq2o6jCh04Q5oLmcJKd3cU-KzYB4x-G8J_hxMq2lIjROgOWZ0-MBtpiCApt7xMr8Zs5sETxz-F_qA0ZDHfS7SaeqHXyKnD3PVX1B1n09qhXFowniRJSSSEI2btuDVj1FW5YzFhynybciH7TcgRfR_fgoY6BqtahI32bKzn8oMStETC6hqAWFO2a8sJCppuYnaNcOC2w-ZOCCYpQrqpMjv2Ty5VE9FEcHbn883lQjcuA8pW46g3dKXhOogMhOKgCJqwRrMRFibUpuUcYnpt0Vep1Q2A53o0nr8EebRrc9H6SiD28TPLdbkmI86kGzSPoKB2h6RmKVwCPZhrMebtms3SCUIJ3o-cifPkA_AZv-3T73VaYu9M8EDZLinIa37xRjeMBJiLOrYB250mkwf7ovBzLcv_-O2ZpTuJDKl-8RKSEP93C4UQSkWk5buP-yOHe2OSORayhOw3afJSgxeq_3SGHVi6Ab1Tv5v9KB6pa7Z_Wd3He7hSgP3aTXCPxHuQm98fTzP-6JmKc6HS4LSSSQppQfc9_wY4slpwTQ5AYEUd4km-o7OvmJguCb0C_0CFYwnFwFtCP7eAPI0_7OUyf1BsFh8hMrgiAxioPdnztH3nVJPuUAIFJkfEPtBiVNDzAvBHBmoMM4CAFVk5WtvluAVpfAbAV9FopYJtEepUp8K1vP0QTTGRSPgxTQFDiEsQYTJADDmE1Nj64J6d2fAzoRFyzhk2c0gd7HUPojFkT7WOA4YpeNjRj8Omak2lXfZBlcTs1KAB8EMdVPAX0RChXvDfX3anJcg-bDcssW0dUi8jUR-L7onBaJyWEMQa2XW5ceOy856BFD9KjqTHIWLuFdkNpswU_nMnRHkjR8rdr9pzBEV_-u6ETZ4HzLHZePd5SwHRnW2ejcp3ZP8fSpx-RXBjmsPMNpY5Gc9qNCXQDsnOXtQIZqoC6W5mC0zEAQpkwNkQCAxAbPBpm48HAdWCqmGvwJHXVEqgt8E_6yFos20FW5O-BCos0mG2S7Q7pueMhAzWDd0FmSjb9_p-hxb1Kq5YMH_fhzSvVk2dc4e_7GJQyO08jTh0oKe2pGiVTE-xs2k_P7UHqAApLNOgqR3nCm7c08L8rRgS3YLI9e8CWpbDuEHV_nmUp5YohwL9bOblhTICANHuZ8hYloZFn76_2XEORLgrkON2FybxpWAplug03IMqhcXolhQBECuG3IKPuB9lVw2d_LjRpm3ca3sao5yTGbN4uv0j-TJfgB06IW6U4sHpOGV2edckIpXZPAzdCmi3lPjuFXpIcdY_BSCFK6ev2Ycn02cuEEvRdG5_c3IHR1AKCx41syDFB0AITbUrkjpjE4Tog2LSVOk8o-8anPYNX2jp7bB_zJ_dwbcno","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Reading IR107 amendment**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aeff1dc87d1b940b9235eee1e3a","type":"function_call","status":"completed","arguments":"{\"i\":\"Recovering final long recurrence\",\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md:6500-6504:raw\"}","call_id":"call_uhzDd3jpEYAFswTRgjE8QsuG","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aeff1ec87d196cdf6b02ee80794","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading runner result sequencing\",\"path\":\".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py:360-427\"}","call_id":"call_TNybKMJryhyJJNkPGh4ZAF2P","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"read","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95aeff1f487d18ee0f70b611ed076","type":"function_call","status":"completed","arguments":"{\"i\":\"Checking scope gate alternate names\",\"pattern\":\"taskkill|wmic|pkill|scop\",\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/killscoping.rs;.worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs\",\"case\":false,\"gitignore\":false,\"skip\":null}","call_id":"call_XdFhbTE66F0huPTSLvvyYtf9","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"grep","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":12200.329499989748,"ttft":3183.192000001669,"completedAt":1789483760284,"contextSnapshot":{"promptTokens":134976,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"a4b8d049","parentId":"b21eb200","timestamp":"2026-09-15T14:49:20.299Z","message":{"role":"toolResult","toolCallId":"call_uhzDd3jpEYAFswTRgjE8QsuG|fc_000c7cef03cac861016aa95aeff1dc87d1b940b9235eee1e3a","toolName":"read","content":[{"type":"text","text":" window-5 and window-6 admission census records were silently OVERWRITTEN by the later windows\n writing the same path, so those two ENDs stand on the transcript alone, not on a record. · **Size:** one env line in the rig\n (done); two comment lines in tests; one filename in the rig.\n\n- **Instances 9-11, all 2026-09-12, #304 W-2 (one night, three different surfaces).** NINTH (doyle's gate leg, 03:20Z): `cargo ... | tail` over non-interactive ssh to kitsubito returned 0 while cargo was off PATH in the non-login shell — already named in releases#304 comment 5643115673 and filed here for the count. TENTH (hertz, 05:30Z, while writing register entries about instruments that lie): `traceable-reqs check 2>&1 | tail -20; echo \"CHECK_EXIT=$?\"` printed `CHECK_EXIT=0` — tail's exit over a checker that exits 1, i.e. a 312-finding red read as clean. He re-ran it only because the register had made him suspicious of his own zero, which is the entry doing its job and not a skill. ELEVENTH (todlando, 05:20Z, a NEW surface — the harness itself): `cargo nextest run ... | tail -30` wedged at `--list --format terse`; he killed cargo and nextest by pid, and the HARNESS task summary then reported \"completed (exit code 0)\" because the pipeline's exit is tail's. A killed run with ZERO tests executed was rendered as a success by a first-party tool — the same generalisation IR-116 instance 2 forced. Near-miss in the same arm: a 0-byte output file read as the wedge when it is just tail buffering until EOF. Fix adopted: the rerun writes to a file and the verdict reads the file; no pipe between a test runner and a verdict.\n\n[Showing lines 6500-6504 of 6938. Use :6505 to continue]"}],"details":{"truncation":{"content":" window-5 and window-6 admission census records were silently OVERWRITTEN by the later windows\r\n writing the same path, so those two ENDs stand on the transcript alone, not on a record. · **Size:** one env line in the rig\r\n (done); two comment lines in tests; one filename in the rig.\r\n\r\n- **Instances 9-11, all 2026-09-12, #304 W-2 (one night, three different surfaces).** NINTH (doyle's gate leg, 03:20Z): `cargo ... | tail` over non-interactive ssh to kitsubito returned 0 while cargo was off PATH in the non-login shell — already named in releases#304 comment 5643115673 and filed here for the count. TENTH (hertz, 05:30Z, while writing register entries about instruments that lie): `traceable-reqs check 2>&1 | tail -20; echo \"CHECK_EXIT=$?\"` printed `CHECK_EXIT=0` — tail's exit over a checker that exits 1, i.e. a 312-finding red read as clean. He re-ran it only because the register had made him suspicious of his own zero, which is the entry doing its job and not a skill. ELEVENTH (todlando, 05:20Z, a NEW surface — the harness itself): `cargo nextest run ... | tail -30` wedged at `--list --format terse`; he killed cargo and nextest by pid, and the HARNESS task summary then reported \"completed (exit code 0)\" because the pipeline's exit is tail's. A killed run with ZERO tests executed was rendered as a success by a first-party tool — the same generalisation IR-116 instance 2 forced. Near-miss in the same arm: a 0-byte output file read as the wedge when it is just tail buffering until EOF. Fix adopted: the rerun writes to a file and the verdict reads the file; no pipe between a test runner and a verdict.\r","truncated":true,"truncatedBy":"lines","totalLines":439,"totalBytes":1636,"outputLines":5,"outputBytes":1636,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":6938,"displayContent":{"text":" window-5 and window-6 admission census records were silently OVERWRITTEN by the later windows\r\n writing the same path, so those two ENDs stand on the transcript alone, not on a record. · **Size:** one env line in the rig\r\n (done); two comment lines in tests; one filename in the rig.\r\n\r\n- **Instances 9-11, all 2026-09-12, #304 W-2 (one night, three different surfaces).** NINTH (doyle's gate leg, 03:20Z): `cargo ... | tail` over non-interactive ssh to kitsubito returned 0 while cargo was off PATH in the non-login shell — already named in releases#304 comment 5643115673 and filed here for the count. TENTH (hertz, 05:30Z, while writing register entries about instruments that lie): `traceable-reqs check 2>&1 | tail -20; echo \"CHECK_EXIT=$?\"` printed `CHECK_EXIT=0` — tail's exit over a checker that exits 1, i.e. a 312-finding red read as clean. He re-ran it only because the register had made him suspicious of his own zero, which is the entry doing its job and not a skill. ELEVENTH (todlando, 05:20Z, a NEW surface — the harness itself): `cargo nextest run ... | tail -30` wedged at `--list --format terse`; he killed cargo and nextest by pid, and the HARNESS task summary then reported \"completed (exit code 0)\" because the pipeline's exit is tail's. A killed run with ZERO tests executed was rendered as a success by a first-party tool — the same generalisation IR-116 instance 2 forced. Near-miss in the same arm: a 0-byte output file read as the wedge when it is just tail buffering until EOF. Fix adopted: the rerun writes to a file and the verdict reads the file; no pipe between a test runner and a verdict.\r","startLine":6500,"lineNumbers":[6500,6501,6502,6503,6504]},"fileSize":676479,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\docs\\INFRA-REGISTER.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":6938,"totalBytes":1636,"outputLines":5,"outputBytes":1636,"shownRange":{"start":6500,"end":6504},"nextOffset":6505}}},"isError":false,"timestamp":1789483760299}}
{"type":"message","id":"44719d7a","parentId":"a4b8d049","timestamp":"2026-09-15T14:49:20.307Z","message":{"role":"toolResult","toolCallId":"call_TNybKMJryhyJJNkPGh4ZAF2P|fc_000c7cef03cac861016aa95aeff1ec87d196cdf6b02ee80794","toolName":"read","content":[{"type":"text","text":"def main():\n parser = argparse.ArgumentParser(description=__doc__)\n…\n claimed = False\n result = 0\n try:\n if not w0.preflight() or not census(root, output, \"before\", env):\n raise ValueError(\"quiet-window or scoped census refused\")\n save(output / \"builders-before.json\", builder_snapshot())\n if not w0.disk_floor(root, output, \"start\", xtask):\n raise ValueError(\"disk floor refused\")\n result, ok = run_producer(root, output, \"pool-claim\", [str(xtask), \"pool-claim\", \"--pool\", str(target), \"--label\", \"local-lane\"], 30, env, lambda: meter(\"claim\"))\n claimed = result == 0\n result = final_status(result, ok)\n if not claimed:\n # A terminated claim writer may have persisted ownership before exit.\n # Do not release an unproven claim: it may still belong to another lane.\n print(\"POOL_CUSTODY_UNPROVEN: claim did not complete successfully; \"\n \"inspect POOL-OWNER.json before any takeover or deletion\", file=sys.stderr)\n for step in plan[\"steps\"]:\n if result:\n break\n name = step[\"name\"]\n if not w0.preflight() or not meter(f\"{name}-before\") or not census(root, output, f\"{name}-before-census\", env):\n result = REFUSED\n break\n if \"nextest\" in step:\n listing, argv = selected_commands(step[\"nextest\"])\n result, ok = run_producer(root, output, name + \"-inventory\", listing, step[\"timeout_seconds\"], env, lambda: meter(name + \"-inventory\"), json_stdout=True)\n after_ok = observe_after(root, output, name + \"-inventory\", env, meter)\n ok = ok and after_ok\n if result or not ok:\n result = final_status(result, ok)\n break\n inventory = json.loads((output / f\"{name}-inventory.stdout\").read_text(encoding=\"utf-8\"))\n save(output / f\"{name}-selection.json\", selected_inventory(inventory))\n else:\n argv = step[\"argv\"]\n result, ok = run_producer(root, output, name, argv, step[\"timeout_seconds\"], env, lambda: meter(name))\n after_ok = observe_after(root, output, name, env, meter)\n result = final_status(result, ok and after_ok)\n if result:\n break\n except (OSError, ValueError, psutil.Error, subprocess.TimeoutExpired) as error:\n print(f\"LANE_OBSERVATION_FAILED: {error}\", file=sys.stderr)\n result = final_status(result, False)\n finally:\n # Release through the prebuilt executable; this driver never deletes target.\n if claimed:\n try:\n released = subprocess.run([str(xtask), \"pool-release\", \"--pool\", str(target)], cwd=root, env=env, capture_output=True, text=True, timeout=30)\n save(output / \"pool-release.json\", {\"exit\": released.returncode, \"stdout\": released.stdout, \"stderr\": released.stderr})\n result = final_status(result, released.returncode == 0)\n except (OSError, subprocess.TimeoutExpired) as error:\n print(f\"POOL_RELEASE_UNPROVEN: {error}\", file=sys.stderr)\n result = final_status(result, False)\n lock.close()\n try:\n (output / \"lane.exit\").write_text(f\"{result}\\n\", encoding=\"utf-8\")\n except OSError as error:\n print(f\"LANE_STATUS_WRITE_FAILED: {error}; producer/driver exit={result}\", file=sys.stderr)\n result = final_status(result, False)\n return result if result >= 0 else 128 - result\n\n\nif __name__ == \"__main__\":\n try:\n sys.exit(main())\n except (OSError, ValueError, subprocess.TimeoutExpired) as error:\n print(f\"LANE_REFUSED: {error}\", file=sys.stderr)\n sys.exit(REFUSED)"}],"details":{"totalLines":426,"displayContent":{"text":"def main():\n parser = argparse.ArgumentParser(description=__doc__)\n…\n claimed = False\r\n result = 0\r\n try:\r\n if not w0.preflight() or not census(root, output, \"before\", env):\r\n raise ValueError(\"quiet-window or scoped census refused\")\r\n save(output / \"builders-before.json\", builder_snapshot())\r\n if not w0.disk_floor(root, output, \"start\", xtask):\r\n raise ValueError(\"disk floor refused\")\r\n result, ok = run_producer(root, output, \"pool-claim\", [str(xtask), \"pool-claim\", \"--pool\", str(target), \"--label\", \"local-lane\"], 30, env, lambda: meter(\"claim\"))\r\n claimed = result == 0\r\n result = final_status(result, ok)\r\n if not claimed:\r\n # A terminated claim writer may have persisted ownership before exit.\r\n # Do not release an unproven claim: it may still belong to another lane.\r\n print(\"POOL_CUSTODY_UNPROVEN: claim did not complete successfully; \"\r\n \"inspect POOL-OWNER.json before any takeover or deletion\", file=sys.stderr)\r\n for step in plan[\"steps\"]:\r\n if result:\r\n break\r\n name = step[\"name\"]\r\n if not w0.preflight() or not meter(f\"{name}-before\") or not census(root, output, f\"{name}-before-census\", env):\r\n result = REFUSED\r\n break\r\n if \"nextest\" in step:\r\n listing, argv = selected_commands(step[\"nextest\"])\r\n result, ok = run_producer(root, output, name + \"-inventory\", listing, step[\"timeout_seconds\"], env, lambda: meter(name + \"-inventory\"), json_stdout=True)\r\n after_ok = observe_after(root, output, name + \"-inventory\", env, meter)\r\n ok = ok and after_ok\r\n if result or not ok:\r\n result = final_status(result, ok)\r\n break\r\n inventory = json.loads((output / f\"{name}-inventory.stdout\").read_text(encoding=\"utf-8\"))\r\n save(output / f\"{name}-selection.json\", selected_inventory(inventory))\r\n else:\r\n argv = step[\"argv\"]\r\n result, ok = run_producer(root, output, name, argv, step[\"timeout_seconds\"], env, lambda: meter(name))\r\n after_ok = observe_after(root, output, name, env, meter)\r\n result = final_status(result, ok and after_ok)\r\n if result:\r\n break\r\n except (OSError, ValueError, psutil.Error, subprocess.TimeoutExpired) as error:\r\n print(f\"LANE_OBSERVATION_FAILED: {error}\", file=sys.stderr)\r\n result = final_status(result, False)\r\n finally:\r\n # Release through the prebuilt executable; this driver never deletes target.\r\n if claimed:\r\n try:\r\n released = subprocess.run([str(xtask), \"pool-release\", \"--pool\", str(target)], cwd=root, env=env, capture_output=True, text=True, timeout=30)\r\n save(output / \"pool-release.json\", {\"exit\": released.returncode, \"stdout\": released.stdout, \"stderr\": released.stderr})\r\n result = final_status(result, released.returncode == 0)\r\n except (OSError, subprocess.TimeoutExpired) as error:\r\n print(f\"POOL_RELEASE_UNPROVEN: {error}\", file=sys.stderr)\r\n result = final_status(result, False)\r\n lock.close()\r\n try:\r\n (output / \"lane.exit\").write_text(f\"{result}\\n\", encoding=\"utf-8\")\r\n except OSError as error:\r\n print(f\"LANE_STATUS_WRITE_FAILED: {error}; producer/driver exit={result}\", file=sys.stderr)\r\n result = final_status(result, False)\r\n return result if result >= 0 else 128 - result\r\n\r\n\r\nif __name__ == \"__main__\":\r\n try:\r\n sys.exit(main())\r\n except (OSError, ValueError, subprocess.TimeoutExpired) as error:\r\n print(f\"LANE_REFUSED: {error}\", file=sys.stderr)\r\n sys.exit(REFUSED)\r","startLine":313,"lineNumbers":[313,314,null,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426]},"fileSize":22224,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\.github\\ci\\local-lane.py"}}},"isError":false,"timestamp":1789483760306}}
{"type":"message","id":"b7717992","parentId":"44719d7a","timestamp":"2026-09-15T14:49:20.323Z","message":{"role":"toolResult","toolCallId":"call_XdFhbTE66F0huPTSLvvyYtf9|fc_000c7cef03cac861016aa95aeff1f487d18ee0f70b611ed076","toolName":"grep","content":[{"type":"text","text":" 717|///\n*718|/// The scope is ruled rather than convenient: CLI help and CLI stdout/stderr,\n 719|/// AND the daemon's operator diagnostics — which is one surface WIDER than the\n 720|/// original brief's \"the xtask public-help gate\", because the five literals that\n 721|/// re-opened this class lived in daemon diagnostics and the narrower home could\n...\n 1257|///\n*1258|/// Section-scoped: a `rev` in some other table (a `[dependencies]` git dep, say)\n 1259|/// is not a patch pin and must not answer for one.\n 1260|// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN]\n 1261|fn patched_git_rev(cargo_toml: &str, krate: &str) -> Option {\n...\n 2818| }\n*2819| // Scope the dummy seed to a child process, never the parallel test host.\n 2820| let child = std::process::Command::new(std::env::current_exe().unwrap())\n 2821| .args([\"--exact\", TEST, \"--nocapture\"])\n 2822| .env(CHILD, \"1\")\n...\n 3576| println!(\n*3577| \"total {} across {} pool(s); {} reclaimable in this sweep's scope\",\n 3578| gib(total),\n 3579| rows.len(),\n 3580| gib(reclaimable)\n\nSkipped missing paths: .worktrees/hertz-ir86-disk-delta/crates/xtask/src/killscoping.rs"}],"details":{"scopePath":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\hertz-ir86-disk-delta\\crates\\xtask\\src\\main.rs","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":4,"fileCount":1,"files":[".worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs"],"fileMatches":[{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/main.rs","count":4}],"truncated":false,"displayContent":" 717│///\n *718│/// The scope is ruled rather than convenient: CLI help and CLI stdout/stderr,\n 719│/// AND the daemon's operator diagnostics — which is one surface WIDER than the\n 720│/// original brief's \"the xtask public-help gate\", because the five literals that\n 721│/// re-opened this class lived in daemon diagnostics and the narrower home could\n │...\n 1257│///\n*1258│/// Section-scoped: a `rev` in some other table (a `[dependencies]` git dep, say)\n 1259│/// is not a patch pin and must not answer for one.\n 1260│// [impl->REQ-CI-LOAD-BEARING-PATCH-PIN]\n 1261│fn patched_git_rev(cargo_toml: &str, krate: &str) -> Option {\n │...\n 2818│ }\n*2819│ // Scope the dummy seed to a child process, never the parallel test host.\n 2820│ let child = std::process::Command::new(std::env::current_exe().unwrap())\n 2821│ .args([\"--exact\", TEST, \"--nocapture\"])\n 2822│ .env(CHILD, \"1\")\n │...\n 3576│ println!(\n*3577│ \"total {} across {} pool(s); {} reclaimable in this sweep's scope\",\n 3578│ gib(total),\n 3579│ rows.len(),\n 3580│ gib(reclaimable)","missingPaths":[".worktrees/hertz-ir86-disk-delta/crates/xtask/src/killscoping.rs"]},"isError":false,"timestamp":1789483760322}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_lZZ5udOyvgROdDavakstsbxV|fc_000c7cef03cac861016aa95af9f05487d1bd4a2dbe427daa0e","toolName":"yield","startedAt":"2026-09-15T14:52:11.187Z"},"id":"3e973037","parentId":"b7717992","timestamp":"2026-09-15T14:52:11.187Z"}
{"type":"message","id":"af075406","parentId":"3e973037","timestamp":"2026-09-15T14:52:11.188Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Compiling 67-row account list**"},{"type":"toolCall","id":"call_lZZ5udOyvgROdDavakstsbxV|fc_000c7cef03cac861016aa95af9f05487d1bd4a2dbe427daa0e","name":"yield","arguments":{"type":null,"data":{"summary":"Read IR71–137 through amendments: all 67 IDs accounted for. Best small residual is IR90's test-side mid-run disk context, not another generic disk-floor tool. IR82 remains unbuilt but already belongs to todlando's composition. IR109 retirement is genuinely open but broad (312 legacy tags). Several tempting tickets are already built: IR92 inject publication, IR104 pin, IR107 premise assertions, IR135/136 and IR137. Windows investigations remain held; IR86 closure stays with Main.","files":[{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","description":"Entire assigned IR71–137 population read, including late reversals and final corrections; also read current sweep composition at lines 1–57."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs","description":"Lines 75–110 implement IR92's successful-inject observation-only MSG_IN publication despite stale OPEN register language."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs","description":"Line 476 still overwrites daemon.pid without predecessor preservation: IR82 remedy remains absent."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs","description":"Lines 114–123 still silently return port0 when ephemeral posture wins; IR78 remains a tiny touch-triggered notice."},{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs","description":"Lines 194–208 retain stream-name predicate; lines 264–310 distinguish repository-wide retired-call scan from hand-listed semantic policy registry. IR94 remains a real classifier gap."},{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs","description":"Existing disk-floor implementation at lines 64–102; must reuse, not redispatch under IR90."},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","description":"Lines 360–398 already admit/census/meter before and observe after producers; 402–410 release through prebuilt xtask."},{"path":".worktrees/hertz-ir86-disk-delta/traceable-reqs.toml","description":"Line25 still module_banner='accept': IR109 transitional exemption remains live."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs","description":"PullLink failure sites at approximately 187–211 still use bare expect('pull')/expect('serve'), without current free-space context."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs","description":"Lines1369ff already assert no-repository fixture premise requested in IR107."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","description":"Lines799ff already assert no-repository fixture premise requested in IR107."},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs.sh","description":"Lines5–6 centralize installed CI checker pin0.4.1; supports spent IR75/104 original remedies and landed IR135."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs","description":"kill_pid(pid) at46 and kill_pid_tree(root) at430 remain bare-number primitives; do not infer IR81 primitive cutover from authenticated consumer repairs."},{"path":".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md","description":"Lines26–80 already document quiet-window/ancestry boundaries; IR137 discipline follows at81ff."}],"architecture":"Register headings are historical handles, not current state. Driver safeguards, product primitives, test fixtures, box configuration, and exercised workflow receipts are separate seams. Existing local-lane already composes floor/census/prebuilt-release mechanisms; inject already owns publication; serving fixture already composes broker/seed/docs planes. Remaining work must target residual callers/context or reconcile receipts, not recreate these modules.","report":"Scope and evidence: R below means .worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md. Other paths are relative to that same fixed worktree. Read-only source/record investigation only: no execution, process/service probes, tests, builds, lint, edits, or new files. Existing receipts are quoted as recorded evidence, not rerun or independently reverified. Known landed SHAs supplied by Main/user are treated as ground truth.\n\nRANKED ACTIONABLE RESIDUALS\n1. IR90 — RIPE-NOW, small residual implementation. Trigger is explicitly 'now' (R5425), reinforced by next-intake composition R43–47 and measured disk-full product-shaped refusal R5341–5356. Already-built prerequisite: crates/xtask/src/diskfloor.rs:64–102 and .github/ci/local-lane.py:360–398. Unbuilt specific seam: crates/spt-daemon/tests/sync.rs:187–211 still turns request_sync/serve_sync errors into bare expect('pull')/expect('serve'); inspected sync/twohost files have no free-space diagnostic. Owner: hertz test/driver package. Smallest next step: scope a test-side error-context helper/caller change that reports actual temp/store-volume free bytes on the real error, then assess remaining rig-start adopters against existing disk-floor. Do NOT build a second floor meter or claim local-lane lacks pre/post readings. Execution proof waits for authorized window.\n2. IR82 — RIPE composition, small product change, EXISTING OWNER NOT NEW DISPATCH. Ruled remedy and owner at R4650–4682; prior #285 completion explicitly did not build it (R51). Source still unconditional std::fs::write at crates/spt-daemon/src/daemon.rs:476. Owner todlando, product pid-identity composition. Minimal next step: acknowledge/take the existing assignment, implement the stipulated predecessor record plus one-generation pidfile retention; keep socket liveness and countable DAEMON_AUTOSTART unchanged. Not an incident-cause closure.\n3. IR109 — RIPE-NOW dedicated retirement lane, NOT SMALL. R6569–6587 ratifies temporary #304 exception and explicitly orders separate relocation lane. traceable-reqs.toml:25 still accepts module banners; checker pin0.4.1 now actually exists in .github/ci/traceable-reqs.sh:6. Owner doyle intake/traceability maintainer (implementation owner not named). Minimum next step: obtain exact current legacy-tag population, relocate actual evidence tags and remove acceptance key as one dedicated lane. Historical312 is not a fresh census. Never 'fix' by re-pinning or broadening exemption.\n4. IR89, with IR83 — RIPE-NOW RECEIPT-ONLY first. R5185–5199 explicitly says the next-golden trigger has already fired and workflow is LANDED. Owner hertz workflow / doyle acceptance. Minimum next step: recover exact A/B pre-ceremony probe-step execution/skipped/failed receipts from an already completed golden (S5 overall green is not enough), plus direction-witness LIST/real-body evidence for IR83. No box change or second UDP guard. This is the cheapest immediate closure work.\n5. IR92, IR104, IR107, IR135/136 — RIPE-NOW RECORD RECONCILIATION, not implementation. See complete dispositions below. Especially IR92 source directly contradicts both its heading and R39–41. Review relevant existing consumer/acceptance receipts and correct scope/status; do not recreate injected MSG_IN publication or premise assertions.\n\nCONDITIONAL SMALL RIDERS, NOT UNCONDITIONAL DISPATCHES\n• IR78: docshost.rs:114–123 confirms silent override persists; exact trigger R4099–4101 is next docshost touch or a new explicit-port belief incident. Owner docshost product maintainer; one notice naming both env vars when a supplied override loses. No fresh trigger proved in this sweep.\n• IR94: brainread.rs:194–208 still keys lifetime policy on serve_*_feed/serve_attach; :264–310 scans all Rust for general symbols but retains specific policy files/functions. Exact trigger R5668–5671: next brainread/xtask touch, mandatory before bounded serve_sync migration. Owner tooling/hertz with todlando semantic census. Minimal next step on that touch: behavior-derived fail-unclassified population and printed census, not merely append serve_sync to another whitelist.\n• IR71/72/77/93/111 likewise remain genuine touch-triggered work, not ripe because OPEN.\n\nCOMPLETE PER-ID DISPOSITIONS (67 IDs)\n71 — TOUCH-TRIGGERED. Persisted controller-release breadcrumb still owed; next controller lifecycle/breadcrumb touch or PR174 barrier timeout. R3888–3911. No fresh trigger established.\n72 — TOUCH-TRIGGERED. Named perch/seat custody read model; next roster/status change or another rig needing named-holder reap. R3912–3945. Do not substitute process-wide daemon status.\n73 — COMPLETED. Eight checkout/floor reorder sites and both docs rereads built; remaining capacity/coupling belongs IR86. R3946–3969.\n74 — TOUCH-TRIGGERED / historical box state UNKNOWN. Next Linux rig/box-audit lifecycle work, not authorization to sweep live /tmp now. 21,643 homes is dated measurement, not current count. R3970–3983.\n75 — ORIGINAL INSTANCE SPENT; RECEIPT/status reconciliation. Missing Linux checker is superseded by IR135's hand-install and real0.4.1 smoke (R6916–6918), plus centralized installed pin. Do not install it again based on 127 from August. Future box-audit/version admission remains discipline. R3984–3998.\n76 — PARTLY BUILT, TOUCH-TRIGGERED residual. Existing ws272 drivers carry three-arm gate and GOLDEN-CI.md:26–80 quiet/ancestry contract; local-lane reuses gate. Dedicated CI foreign-builder count/CPU census and universal brief/template adoption not established here. Current heavy Windows hold is binding, not a request for more code. R3999–4042.\n77 — TOUCH-TRIGGERED. Spawn/child-entry/readiness timing split; next boot/brainproc-ready or family rider. R4043–4074.\n78 — TOUCH-TRIGGERED confirmed residual; tiny notice, source docshost.rs:114–123. R4075–4102.\n79 — TOUCH-TRIGGERED lifecycle package. Common authenticated breadcrumb reaper exists, but it is not a Drop guard and does not prove panic-safe adoption. Original first four tests yielded no Drop/DaemonReaper match; no complete22-site current census claimed. Next common touch, and distinguish unwind from hard process death (R47–49). R4103–4183.\n80 — BLOCKED Windows measurement / partially classified fixture family. Late amendments identify cmd→ping wrapper fixture, direct production spawn,12-member noisy OS partition; not an undiagnosed product leak and no count-only progress claim. Residual population unclassified; existing ENV-read fix already built. R4184–4465. Coordinate with108, not duplicate work.\n81 — OPEN product primitive + gate residual, existing owners. proc.rs:46/:430 remain bare-number signatures; consumer authenticated reaper and adapter9c87372 do not finish signature cutover. Todlando product, hertz gate; trigger next proc/xtask gate touch. Adapter half closed. R4466–4590.\n82 — RIPE assigned product composition, unbuilt source; see rank2. R4591–4696.\n83 — OPEN direction-witness durability/acceptance; BOX half spent. Universal LAN-only rule explicitly superseded; no new operator/ACL action. Reconcile current LIST/NOT-A-WITNESS enforcement and reverse real-body witness; co-own with89. R4697–4833.\n84 — ORIGINAL STAMP BUILT; residual follow-up only. Stamp landed with entry; all-arm regression enforcement remains a separately named follow-up. Historical65s question must not be reopened without IR89's later attribution (three faces of firewall/ACL/shared-path cause). R4834–4883, R5217ff.\n85 — BLOCKED diagnostic continuation. Cap changes already built; arm1 void, old-sha slowdown only proves head growth unnecessary. Needs IR90 guard and authorized no-CI/no-main-push window; AB then BA, not repeated AB. Do not identify Defender from correlation or widen caps. R4884–5043.\n86 — MAIN-OWNED. Both floors and inline delta known landed (5e05f02d/0cda6235/82333ca1). Do not redispatch. Main must reconcile final automation plus independent docs-dependency slice before retirement; no closure conclusion delegated here. R5044–5092.\n87 — TOUCH-TRIGGERED unresolved scheduling seam. Next golden/twohost touch; old R294 recurrence includes own PR starving roleA, not only foreign runs. Minimum existing-lane decision is partner-start barrier/separate rendezvous scheduling contract, not larger pairing timeout. R5093–5145. Current source choreography not exhaustively re-audited.\n88 — BUILT in current local-lane; TOUCH/receipt residual elsewhere. local-lane.py:402–410 invokes prebuilt xtask. Reconcile runbook/all other teardown adopters only when touched. Preserve exe AND DLL if claiming runnable retention, otherwise archival. R5146–5182.\n89 — RECEIPT-ONLY ripe; boxes applied and guard landed; exact golden probe-step acceptance missing from record. See rank4. R5183–5338.\n90 — RIPE-NOW residual error context/start adoption, not new floor machinery. See rank1. R5339–5427.\n91 — CLOSED.18 cited files tracked in place;543 uncited artifacts preserved, root-specific ignores. R5428–5481.\n92 — SOURCE-BUILT; stale register requires reconciliation. inject.rs:75–110 publishes exactly on Some((true,_)), observation-only, target/peer/msg-id present; no fresh publisher implementation. Relay ordering/per-message exact-once assertion obligations remain separate, not automatically closed by this source read. R5482–5613.\n93 — TOUCH-TRIGGERED / packaging decision required. PDB retention/install or symbol store; next installer/release packaging touch. Successful release build is not symbol availability. R5614–5642.\n94 — TOUCH-TRIGGERED actual gate blind spot; see conditional rider. R5643–5672.\n95 — PARTLY INSTRUMENTED, diagnostic continuation/triage UNKNOWN. Original comparison has already run; no blanket317-site edit. Historical321 population approximate,15 outside classifier unclassified; retained exchange-correlated create/retire trace is separate product design, not two-IPC reuse. Needs selected diagnostic intake, not budget retuning. R5673–5927.\n96 — BLOCKED/cause UNKNOWN. Candidate-vs-diagnostic differential confounded by97; diagnostic pool deleted, next candidate discriminator requires rebuild and authorized quiet heavy window. R5928–5963; preserved CLASSIFICATION-AMENDMENT-2-doyle.md and reclaim receipts remain evidence.\n97 — PARTLY BUILT procedure. local-lane.py:380–398 already performs before/after producer census; exclusive START/END token discipline remains runtime adoption. No new repeated-run experiment authorized; observe actual launch not announcement. R5964–6006.\n98 — INSTANCE FIXED; TOUCH-TRIGGERED class. Original UTF8 correction qualified; next driver rendering touch must preserve crash/never-started outcomes. local-lane's UTF8 artifact writes are not proof of universal console safety, but do not re-fix the preserved driver. R6007–6030.\n99 — CLASSIFIED NOT-PRODUCT, built repairs; RECEIPT reconciliation. Spectator EOF unpromised; journal op reuse fixed.103 supplies successful five-arm receipt for attach half; do not repeat withdrawn opener diagnosis or repair spectator EOF as product. New EOF tests inherit contract-reading rule. R6031–6109.\n100 — PARTLY BUILT census discipline; operator setting TOUCH-TRIGGERED. lane_run ancestry/blind-path corrections documented; analyzer targetDir recommendation still separate operator choice. Current lock holder/live status UNKNOWN, no probe allowed. R6110–6169.\n101 — HISTORICAL REPAIRS BUILT; recurring inventory/assembly discipline. Six callers fixed, escaper coverage restored, integration repin existed; #304 now landed. Future lane must compile its own all-targets and inspect losing-side assertions; do not redispatch304 assembly commands. R6170–6234.\n102 — INSTANCE RULE APPLIED; recurring assignment discipline. Committed-only assembly/status-per-file; old0.4.0 upgrade ask superseded by0.4.1/135. No instrument implementation proved. R6235–6267.\n103 — FIXED rig; PARKED hazard NOT RIPE.0845e68d five-arm green plus trace; served-set population scoped clean. Equal wall-ms seat generation is explicitly unmeasured/noREQ/no build until field/cell collision. R6268–6337.\n104 — COMPLETED consumed upstream fix; status-only reconciliation. Current centralized pin0.4.1 satisfies stated closes-when-pin-main trigger. No checker-root workaround. R6338–6366.\n105 — INSTANCE FIXED (28d4eb68), ongoing authoring discipline. Read fixture and redirect target, shorten blind interval only if recurrence demands; no tool lane. R6367–6418.\n106 — INSTANCE CLOSED, procedure adoption. START/END population enumeration clause remains template-touch item; do not call handed set exhaustive. This sweep accounts all67 IDs explicitly. R6419–6449.\n107 — FIXED original driver AND requested premise assertions. registryhost.rs:1369ff/projwriter.rs:799ff already carry premise assertions; Linux consumer attempt2 unchanged candidate green documented. Later Windows identity-contaminated attempt stays VOID; corrected Windows receipt not claimed by this entry. Artifact filename/driver universality may need receipts, not another two-module patch. R6450–6544.\n108 — RIPE BACKLOG DISCRIMINATOR, BLOCKED current Windows hold. Today's findings-backlog sweep meets listed trigger (R6564–6565), but no run allowed. Reuse80 fixture diagnosis; run single-cell identity/tree discriminator later. Do not claim four stable leaks: fourth-run amendment changes membership. R6545–6566.\n109 — RIPE dedicated312-tag retirement, broad, see rank3. R6567–6588.\n110 — HISTORICAL fold ruled / no second implementation. Final amendment chooses surviving REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM+pure seam, removes duplicate IDs/netsh ADR; Linux ten-cell gap qualified. #304 shipped; completion reconciliation rather than recreate W2. R6589–6617.\n111 — TOUCH-TRIGGERED UDP rule-observation backlog. ActiveStore effective state vs by-name presence; next inbound-rule wave or CIM query generalization. No live fallback/rule changes authorized; current box state unknown. R6618–6639.\n112 — TOUCH-TRIGGERED two-fixture hermeticity; existing nextest gate correct. No cargo-test-lib rerun or gate conversion now. R6640–6659.\n113 — PROCEDURE / next mutation-driver touch. Trap/finally plus next-arm pristine bytes/oid and assertion-local negative outcome; no new mutation window. R6660–6681.\n114 — PROCEDURE / shared-state arm trigger. One writer, fetcher-owned before/after census and timestamped coordination; original scope rationale void. No new firewall experiment. R6682–6690.\n115 — PROCEDURE / next firewall census. Same-dump port+program controls, full reaching conjunction and per-agent exits; late event-log amendment forbids using events as delete direction proof. R6691–6700.\n116 — PROCEDURE / next watchdog. Actual post-state, owned identities; both script echo and harness success were false kill claims.137 during compile was VOID not product red. R6701–6711.\n117 — PROCEDURE / requirement/prediction authoring. Refutable branches and code-violable invariant; no measured local latency threshold in product. R6712–6720.\n118 — PROCEDURE / next capture/filter. Flush/stop writer before reading and live positive-control/raw schema; no new instrument project. R6721–6729.\n119 — PROCEDURE plus BLOCKED OPERATOR receipt. Empty-dir route control and complete teardown rules stand. Credential rotation is separate operator item releases#304 comment5643876746; this register records no completion, so unknown and not authority to rotate. R6730–6740.\n120 — INSTANCE DISCRIMINATED, ongoing claim discipline. Second Windows host and Linux contrast supplied missing axes; no platform investigation to repeat. R6741–6750.\n121 — INSTANCE FIXED v7, recurring rig/byte-reader discipline. Audited delivered set, no arm-id patch against frozen v6; raw byte and leading-dash safeguards on next authoring touch. R6751–6768.\n122 — REPEAT-FIELD TRIGGER, current closure UNKNOWN/receipt-first. Original stop refusal intentional and cannot be bypassed. Later133 owned-shutdown proof demonstrates successor cleanup, but does not alone reconcile every122 identity invariant. Owner hertz rig; inspect accepted successor/receipts before any repeat-field authorization, never PID-only automation. R6769–6781.\n123 — FIXED successor, mechanism-only OPEN. Return/log channel correction already exists, frozenr10 unchanged; no new code. R6782–6793.\n124 — REPEAT-FIELD TRIGGER, supersession reconciliation needed. Original driver creates daemon on setup-never-ran cleanup. Do not patch preserved2e3aec1b or assume latest accepted successor retains defect; inspect current successor's no-setup branch before field. R6794–6805.\n125 — UNKNOWN mechanism; receipt-first with124. Original false-negative sweep, NOT falseCLEAR; slash comparison is unconfirmed candidate. Later132 adds stronger identity seam. Need exact successor predicate/known-present proof, not a guessed path-normalization patch. R6806–6816.\n126 — ORIGINAL budget shape superseded by134's qualified clock design. No second independent budget fix; future field repinning/authorization remains separate. R6817–6827, R6901–6913.\n127 — CORRECTED/QUALIFIED preserved M3; class touch-triggered. Whole nested-value assignment + native flags readback already measured. R6828–6836.\n128 — CORRECTED/QUALIFIED M5 and N publisher; class touch-triggered. Typed null/empty seam and overwrite-rename already changed; original123 arms invalid. R6837–6846.\n129 — CORRECTED/QUALIFIED twice, latest promotion Read-Json-DateKindString discriminator. No repeat implicit-date repair against preserved predecessor. R6847–6856.\n130 — AUTHORIZED CORRECTION, final retry receipt UNKNOWN in entry. Two-line qualificationHome rename directed, fresh-root result explicitly separate. Minimum is locate that receipt/successor before claiming fix or redispatching. R6857–6866; AZLCQNZL-* preserved references.\n131 — CORRECTED/QUALIFIED no-mutation preflight. Child env scrub and invalid Stop-Transcript removal passed; strict seed guard intact. R6867–6877; VGCTKD7A-preflight-clean-* receipts.\n132 — CORRECTED/QUALIFIED birth-aware admission.14 controls and17-hit live read recorded; current product/box state not inferred. R6878–6888.\n133 — COMPLETED correction with genuine promotion0/owned shutdown. Later failed field handoff separate, no promotion rerun. R6889–6900.\n134 — CORRECTION QUALIFIED, future FIELD BLOCKED/repin-only.630s design and receipt/clock controls already built; candidate/packet/nonce/driver/runner repin is one future amendment requiring separate grant. Independent candidate product query-timeout finding M5XKQ2DN remains separate; cannot close it using instrument repair. R6901–6913.\n135 — LANDED52d56248; RECEIPT-ONLY integration execution. Centralized precheck/install and Linux controls built; live token/private build deliberately unexercised and provisioning is optional operator decision. Do not redispatch version diagnostic. R6914–6920.\n136 — LANDED84e20ddd; completed shared composition, adoption touch-triggered. S5 initial fix/cross-host green distinct from later Linux shared-fixture proof (seven unopted twohost cases compile-only). Future URL fixture uses ServingFixture; no duplicate helper. R6921–6931.\n137 — RETIRED8bb0feb4 byYPLFG3CG, no tracked launcher callsite. OMP harmless-child receipt is not reproduction of Claude Code failure. Reopen only owned new callsite/contrary evidence, never unused helper. R6932–6937.\n\nBOTTOM LINE: no Windows investigation should begin under CI34983756975 hold. Receipt reconciliation can proceed read-only now. IR90 residual and existing-owner IR82 are the strongest small implementation candidates; IR109 is real but not a small rider. IR78/94 are valid conditional seams, not proof that an immediate dispatch is owed. IR86 retirement must remain Main's slice-by-slice decision."},"error":null}}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":2169,"output":5603,"cacheRead":134784,"cacheWrite":0,"totalTokens":142556,"reasoningTokens":96,"cost":{"input":0.02169,"output":0.28015,"cacheRead":0.134784,"cacheWrite":0,"total":0.436624}},"stopReason":"toolUse","timestamp":1789483760331,"responseId":"resp_000c7cef03cac861016aa95af08e6887d1a6c6a9bfd94d57ae","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_000c7cef03cac861016aa95af3074887d19c9bfa0e9267c124","type":"reasoning","content":[],"encrypted_content":"gAAAAABqqVr5d_C3uAwPyYbraVuR9D3vSRzjWD80ZeEfZMgZXxRpcqdXA3KOpVDMdllZ-QurxwpkWwhWoLP_XcygqZAEDytEdgMJbXP_sWkQkXWtPTSdECgNqJRxH2IUBHLyjX-SOLQbEklhNZ4FpCVgk95i9NYXbl3pCxMx8wT_xg22K2lERLKQxSS0a1i3C39SsXhruu-GW1d_RBmYa8DazGwpyMJIxqpSOCwesKQm0fNuzVRAhdFObd2ytRJmNTCL73c1F6GbkXETU8RTB7Jf7S8CBiSrcAOvuyLwotvseeOY0a8zGovagb1KGsD1kGA-F7_SqOmVHL2h0p-blhb8pn-2CP5iGucYNY-HgyUl24CvSfBJrtdFj6ApNTaiMxJDy0yCLdGwu9ZTfHIcyLtiIO82wuVRAFmjsd9nO0axH2ibUHlNYBh0KhEVe2H7XfILTGa84xOmd0yQLHmgOmEi5Ic8t7amiOXN3Rt37h_PKYxHdteSsbBWVNRIQZLTMwYi6nmXASACRbJBGM8iwK1wzr_OezVkyKuTD342GKOCaDaxF2Yp6ESRei_dVcfm_5nmmgpjJnHKmWuyXsKrTglvmiwCQUsgirwA_L7psDA8tCyRp1Qv9QEq-1gBI614Hu5jVhV1gCYVKpQUEu6K1Z_ARTtXA3pCF1ntKSLx3I3RKZTwHXjWD34KRqyrTlQqO7u6aaYTcIVfW-uC4XJMfzNIEb87xEtGZSg_XF-Y7PtVTT-fy-nJI2-DLsgET8nCqwPBMpIpPQ7B7kc9PjE1Ia6l7gmJiDRSQ0hniaGrn556i1_6nrb1E-8_2a8sOcCGmWKNWqOV_NjltbGFw9GodBchiv8WSEELkgsFxSo9BMU4V_13QcLlXM2G8yLUrqkWxgrQoLodGFMy_JCStfKjRYDCrGPB0ty8dv1QuUrKnTbF2Wo5xg4wQ7StdrWN6UPvIFkRe77QzjLFjkYe2ch5fX2nOy3tKXM1Gbh-hFlTGO2OIYBJVyWgH66WHluzxhBtgsX1X6hDl5MZ-hVwj-7hsFK6JNtLZUu37Qje599ejCavKnj9_QTZQ7bVkm86IL8tJNgYXfJX1SuZ2rH_RZzEhxHQckLs-b9dQ2g100vL_qFiAaxPhOcj9c-jE1dVkKU8fcCXmca5mqedrW6wGxfs1fk7FR6-d41lXNxFOeFmF0cpAhWs2Hf6wSHDpFILhRGALaOAwwnZkafDFu8mu90Rp1QdyW1wx2SW2K6SXRbHs3B_Qdma8F-d8uEHGbAJLNRc4gSe6iYm1cXdWUmRVlZaCNA_c9WlcwxRgzbJBYrONjMzyVKBXyGu46_-pWFBKPa5SsrqA2_fuo2iyjeD0Ik73ut-MnexsJeE1bLMy5NJRSov3mUfL9O1VcMhtGp19iV1d56qYgCHAWY7iq44k65EN1tMEYhnNbTIe-TB4RwaHADGeSm5fFWlXRWREzVe3p5dLpzHYits7BRdcpJzyDMSGJeVe593OPHLA1esfDEZMvmn7h0DLEmpAQX9B5btB4GbxFkUCTJXs37hKiqf4RD2cfZw0LsMXGvA-PH-k5HU3R03j8giU9Wdlptm1itwXZpfKZMYyDPlhlhsmfLATTfEMlx66PKVpsL0TBf20s55Q7mzbAuHDF18_UxAtRrEqPBG8iyFYwvOeKkAJg5lfch3Nl2Y78tb-4lCxxkERhSwfroczoZ86slWUZchv_H8q4y_u-Ex_JDWzXtsDnsRGJjtgHJqRsadZScqFGy9mm1Cm7UBnRaGJlx3xSkNxAbMc4lUA8ehKWwcbBaBObjiABUx3kmPkYkG16JtShtKEtC_sLMK-UHOcDJ-w3TPz3WQ5tmsukKH4cw2_4mCeyiO4rkqVzhtzjf5AgVRVKZcER0RWIXJ8qgGspH7gWA=","internal_chat_message_metadata_passthrough":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"summary":[{"type":"summary_text","text":"**Compiling 67-row account list**"}],"metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}},{"id":"fc_000c7cef03cac861016aa95af9f05487d1bd4a2dbe427daa0e","type":"function_call","status":"completed","arguments":"{\"type\":null,\"data\":{\"summary\":\"Read IR71–137 through amendments: all 67 IDs accounted for. Best small residual is IR90's test-side mid-run disk context, not another generic disk-floor tool. IR82 remains unbuilt but already belongs to todlando's composition. IR109 retirement is genuinely open but broad (312 legacy tags). Several tempting tickets are already built: IR92 inject publication, IR104 pin, IR107 premise assertions, IR135/136 and IR137. Windows investigations remain held; IR86 closure stays with Main.\",\"files\":[{\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md\",\"description\":\"Entire assigned IR71–137 population read, including late reversals and final corrections; also read current sweep composition at lines 1–57.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs\",\"description\":\"Lines 75–110 implement IR92's successful-inject observation-only MSG_IN publication despite stale OPEN register language.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs\",\"description\":\"Line 476 still overwrites daemon.pid without predecessor preservation: IR82 remedy remains absent.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs\",\"description\":\"Lines 114–123 still silently return port0 when ephemeral posture wins; IR78 remains a tiny touch-triggered notice.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs\",\"description\":\"Lines 194–208 retain stream-name predicate; lines 264–310 distinguish repository-wide retired-call scan from hand-listed semantic policy registry. IR94 remains a real classifier gap.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs\",\"description\":\"Existing disk-floor implementation at lines 64–102; must reuse, not redispatch under IR90.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py\",\"description\":\"Lines 360–398 already admit/census/meter before and observe after producers; 402–410 release through prebuilt xtask.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/traceable-reqs.toml\",\"description\":\"Line25 still module_banner='accept': IR109 transitional exemption remains live.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs\",\"description\":\"PullLink failure sites at approximately 187–211 still use bare expect('pull')/expect('serve'), without current free-space context.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs\",\"description\":\"Lines1369ff already assert no-repository fixture premise requested in IR107.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs\",\"description\":\"Lines799ff already assert no-repository fixture premise requested in IR107.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs.sh\",\"description\":\"Lines5–6 centralize installed CI checker pin0.4.1; supports spent IR75/104 original remedies and landed IR135.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs\",\"description\":\"kill_pid(pid) at46 and kill_pid_tree(root) at430 remain bare-number primitives; do not infer IR81 primitive cutover from authenticated consumer repairs.\"},{\"path\":\".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md\",\"description\":\"Lines26–80 already document quiet-window/ancestry boundaries; IR137 discipline follows at81ff.\"}],\"architecture\":\"Register headings are historical handles, not current state. Driver safeguards, product primitives, test fixtures, box configuration, and exercised workflow receipts are separate seams. Existing local-lane already composes floor/census/prebuilt-release mechanisms; inject already owns publication; serving fixture already composes broker/seed/docs planes. Remaining work must target residual callers/context or reconcile receipts, not recreate these modules.\",\"report\":\"Scope and evidence: R below means .worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md. Other paths are relative to that same fixed worktree. Read-only source/record investigation only: no execution, process/service probes, tests, builds, lint, edits, or new files. Existing receipts are quoted as recorded evidence, not rerun or independently reverified. Known landed SHAs supplied by Main/user are treated as ground truth.\\n\\nRANKED ACTIONABLE RESIDUALS\\n1. IR90 — RIPE-NOW, small residual implementation. Trigger is explicitly 'now' (R5425), reinforced by next-intake composition R43–47 and measured disk-full product-shaped refusal R5341–5356. Already-built prerequisite: crates/xtask/src/diskfloor.rs:64–102 and .github/ci/local-lane.py:360–398. Unbuilt specific seam: crates/spt-daemon/tests/sync.rs:187–211 still turns request_sync/serve_sync errors into bare expect('pull')/expect('serve'); inspected sync/twohost files have no free-space diagnostic. Owner: hertz test/driver package. Smallest next step: scope a test-side error-context helper/caller change that reports actual temp/store-volume free bytes on the real error, then assess remaining rig-start adopters against existing disk-floor. Do NOT build a second floor meter or claim local-lane lacks pre/post readings. Execution proof waits for authorized window.\\n2. IR82 — RIPE composition, small product change, EXISTING OWNER NOT NEW DISPATCH. Ruled remedy and owner at R4650–4682; prior #285 completion explicitly did not build it (R51). Source still unconditional std::fs::write at crates/spt-daemon/src/daemon.rs:476. Owner todlando, product pid-identity composition. Minimal next step: acknowledge/take the existing assignment, implement the stipulated predecessor record plus one-generation pidfile retention; keep socket liveness and countable DAEMON_AUTOSTART unchanged. Not an incident-cause closure.\\n3. IR109 — RIPE-NOW dedicated retirement lane, NOT SMALL. R6569–6587 ratifies temporary #304 exception and explicitly orders separate relocation lane. traceable-reqs.toml:25 still accepts module banners; checker pin0.4.1 now actually exists in .github/ci/traceable-reqs.sh:6. Owner doyle intake/traceability maintainer (implementation owner not named). Minimum next step: obtain exact current legacy-tag population, relocate actual evidence tags and remove acceptance key as one dedicated lane. Historical312 is not a fresh census. Never 'fix' by re-pinning or broadening exemption.\\n4. IR89, with IR83 — RIPE-NOW RECEIPT-ONLY first. R5185–5199 explicitly says the next-golden trigger has already fired and workflow is LANDED. Owner hertz workflow / doyle acceptance. Minimum next step: recover exact A/B pre-ceremony probe-step execution/skipped/failed receipts from an already completed golden (S5 overall green is not enough), plus direction-witness LIST/real-body evidence for IR83. No box change or second UDP guard. This is the cheapest immediate closure work.\\n5. IR92, IR104, IR107, IR135/136 — RIPE-NOW RECORD RECONCILIATION, not implementation. See complete dispositions below. Especially IR92 source directly contradicts both its heading and R39–41. Review relevant existing consumer/acceptance receipts and correct scope/status; do not recreate injected MSG_IN publication or premise assertions.\\n\\nCONDITIONAL SMALL RIDERS, NOT UNCONDITIONAL DISPATCHES\\n• IR78: docshost.rs:114–123 confirms silent override persists; exact trigger R4099–4101 is next docshost touch or a new explicit-port belief incident. Owner docshost product maintainer; one notice naming both env vars when a supplied override loses. No fresh trigger proved in this sweep.\\n• IR94: brainread.rs:194–208 still keys lifetime policy on serve_*_feed/serve_attach; :264–310 scans all Rust for general symbols but retains specific policy files/functions. Exact trigger R5668–5671: next brainread/xtask touch, mandatory before bounded serve_sync migration. Owner tooling/hertz with todlando semantic census. Minimal next step on that touch: behavior-derived fail-unclassified population and printed census, not merely append serve_sync to another whitelist.\\n• IR71/72/77/93/111 likewise remain genuine touch-triggered work, not ripe because OPEN.\\n\\nCOMPLETE PER-ID DISPOSITIONS (67 IDs)\\n71 — TOUCH-TRIGGERED. Persisted controller-release breadcrumb still owed; next controller lifecycle/breadcrumb touch or PR174 barrier timeout. R3888–3911. No fresh trigger established.\\n72 — TOUCH-TRIGGERED. Named perch/seat custody read model; next roster/status change or another rig needing named-holder reap. R3912–3945. Do not substitute process-wide daemon status.\\n73 — COMPLETED. Eight checkout/floor reorder sites and both docs rereads built; remaining capacity/coupling belongs IR86. R3946–3969.\\n74 — TOUCH-TRIGGERED / historical box state UNKNOWN. Next Linux rig/box-audit lifecycle work, not authorization to sweep live /tmp now. 21,643 homes is dated measurement, not current count. R3970–3983.\\n75 — ORIGINAL INSTANCE SPENT; RECEIPT/status reconciliation. Missing Linux checker is superseded by IR135's hand-install and real0.4.1 smoke (R6916–6918), plus centralized installed pin. Do not install it again based on 127 from August. Future box-audit/version admission remains discipline. R3984–3998.\\n76 — PARTLY BUILT, TOUCH-TRIGGERED residual. Existing ws272 drivers carry three-arm gate and GOLDEN-CI.md:26–80 quiet/ancestry contract; local-lane reuses gate. Dedicated CI foreign-builder count/CPU census and universal brief/template adoption not established here. Current heavy Windows hold is binding, not a request for more code. R3999–4042.\\n77 — TOUCH-TRIGGERED. Spawn/child-entry/readiness timing split; next boot/brainproc-ready or family rider. R4043–4074.\\n78 — TOUCH-TRIGGERED confirmed residual; tiny notice, source docshost.rs:114–123. R4075–4102.\\n79 — TOUCH-TRIGGERED lifecycle package. Common authenticated breadcrumb reaper exists, but it is not a Drop guard and does not prove panic-safe adoption. Original first four tests yielded no Drop/DaemonReaper match; no complete22-site current census claimed. Next common touch, and distinguish unwind from hard process death (R47–49). R4103–4183.\\n80 — BLOCKED Windows measurement / partially classified fixture family. Late amendments identify cmd→ping wrapper fixture, direct production spawn,12-member noisy OS partition; not an undiagnosed product leak and no count-only progress claim. Residual population unclassified; existing ENV-read fix already built. R4184–4465. Coordinate with108, not duplicate work.\\n81 — OPEN product primitive + gate residual, existing owners. proc.rs:46/:430 remain bare-number signatures; consumer authenticated reaper and adapter9c87372 do not finish signature cutover. Todlando product, hertz gate; trigger next proc/xtask gate touch. Adapter half closed. R4466–4590.\\n82 — RIPE assigned product composition, unbuilt source; see rank2. R4591–4696.\\n83 — OPEN direction-witness durability/acceptance; BOX half spent. Universal LAN-only rule explicitly superseded; no new operator/ACL action. Reconcile current LIST/NOT-A-WITNESS enforcement and reverse real-body witness; co-own with89. R4697–4833.\\n84 — ORIGINAL STAMP BUILT; residual follow-up only. Stamp landed with entry; all-arm regression enforcement remains a separately named follow-up. Historical65s question must not be reopened without IR89's later attribution (three faces of firewall/ACL/shared-path cause). R4834–4883, R5217ff.\\n85 — BLOCKED diagnostic continuation. Cap changes already built; arm1 void, old-sha slowdown only proves head growth unnecessary. Needs IR90 guard and authorized no-CI/no-main-push window; AB then BA, not repeated AB. Do not identify Defender from correlation or widen caps. R4884–5043.\\n86 — MAIN-OWNED. Both floors and inline delta known landed (5e05f02d/0cda6235/82333ca1). Do not redispatch. Main must reconcile final automation plus independent docs-dependency slice before retirement; no closure conclusion delegated here. R5044–5092.\\n87 — TOUCH-TRIGGERED unresolved scheduling seam. Next golden/twohost touch; old R294 recurrence includes own PR starving roleA, not only foreign runs. Minimum existing-lane decision is partner-start barrier/separate rendezvous scheduling contract, not larger pairing timeout. R5093–5145. Current source choreography not exhaustively re-audited.\\n88 — BUILT in current local-lane; TOUCH/receipt residual elsewhere. local-lane.py:402–410 invokes prebuilt xtask. Reconcile runbook/all other teardown adopters only when touched. Preserve exe AND DLL if claiming runnable retention, otherwise archival. R5146–5182.\\n89 — RECEIPT-ONLY ripe; boxes applied and guard landed; exact golden probe-step acceptance missing from record. See rank4. R5183–5338.\\n90 — RIPE-NOW residual error context/start adoption, not new floor machinery. See rank1. R5339–5427.\\n91 — CLOSED.18 cited files tracked in place;543 uncited artifacts preserved, root-specific ignores. R5428–5481.\\n92 — SOURCE-BUILT; stale register requires reconciliation. inject.rs:75–110 publishes exactly on Some((true,_)), observation-only, target/peer/msg-id present; no fresh publisher implementation. Relay ordering/per-message exact-once assertion obligations remain separate, not automatically closed by this source read. R5482–5613.\\n93 — TOUCH-TRIGGERED / packaging decision required. PDB retention/install or symbol store; next installer/release packaging touch. Successful release build is not symbol availability. R5614–5642.\\n94 — TOUCH-TRIGGERED actual gate blind spot; see conditional rider. R5643–5672.\\n95 — PARTLY INSTRUMENTED, diagnostic continuation/triage UNKNOWN. Original comparison has already run; no blanket317-site edit. Historical321 population approximate,15 outside classifier unclassified; retained exchange-correlated create/retire trace is separate product design, not two-IPC reuse. Needs selected diagnostic intake, not budget retuning. R5673–5927.\\n96 — BLOCKED/cause UNKNOWN. Candidate-vs-diagnostic differential confounded by97; diagnostic pool deleted, next candidate discriminator requires rebuild and authorized quiet heavy window. R5928–5963; preserved CLASSIFICATION-AMENDMENT-2-doyle.md and reclaim receipts remain evidence.\\n97 — PARTLY BUILT procedure. local-lane.py:380–398 already performs before/after producer census; exclusive START/END token discipline remains runtime adoption. No new repeated-run experiment authorized; observe actual launch not announcement. R5964–6006.\\n98 — INSTANCE FIXED; TOUCH-TRIGGERED class. Original UTF8 correction qualified; next driver rendering touch must preserve crash/never-started outcomes. local-lane's UTF8 artifact writes are not proof of universal console safety, but do not re-fix the preserved driver. R6007–6030.\\n99 — CLASSIFIED NOT-PRODUCT, built repairs; RECEIPT reconciliation. Spectator EOF unpromised; journal op reuse fixed.103 supplies successful five-arm receipt for attach half; do not repeat withdrawn opener diagnosis or repair spectator EOF as product. New EOF tests inherit contract-reading rule. R6031–6109.\\n100 — PARTLY BUILT census discipline; operator setting TOUCH-TRIGGERED. lane_run ancestry/blind-path corrections documented; analyzer targetDir recommendation still separate operator choice. Current lock holder/live status UNKNOWN, no probe allowed. R6110–6169.\\n101 — HISTORICAL REPAIRS BUILT; recurring inventory/assembly discipline. Six callers fixed, escaper coverage restored, integration repin existed; #304 now landed. Future lane must compile its own all-targets and inspect losing-side assertions; do not redispatch304 assembly commands. R6170–6234.\\n102 — INSTANCE RULE APPLIED; recurring assignment discipline. Committed-only assembly/status-per-file; old0.4.0 upgrade ask superseded by0.4.1/135. No instrument implementation proved. R6235–6267.\\n103 — FIXED rig; PARKED hazard NOT RIPE.0845e68d five-arm green plus trace; served-set population scoped clean. Equal wall-ms seat generation is explicitly unmeasured/noREQ/no build until field/cell collision. R6268–6337.\\n104 — COMPLETED consumed upstream fix; status-only reconciliation. Current centralized pin0.4.1 satisfies stated closes-when-pin-main trigger. No checker-root workaround. R6338–6366.\\n105 — INSTANCE FIXED (28d4eb68), ongoing authoring discipline. Read fixture and redirect target, shorten blind interval only if recurrence demands; no tool lane. R6367–6418.\\n106 — INSTANCE CLOSED, procedure adoption. START/END population enumeration clause remains template-touch item; do not call handed set exhaustive. This sweep accounts all67 IDs explicitly. R6419–6449.\\n107 — FIXED original driver AND requested premise assertions. registryhost.rs:1369ff/projwriter.rs:799ff already carry premise assertions; Linux consumer attempt2 unchanged candidate green documented. Later Windows identity-contaminated attempt stays VOID; corrected Windows receipt not claimed by this entry. Artifact filename/driver universality may need receipts, not another two-module patch. R6450–6544.\\n108 — RIPE BACKLOG DISCRIMINATOR, BLOCKED current Windows hold. Today's findings-backlog sweep meets listed trigger (R6564–6565), but no run allowed. Reuse80 fixture diagnosis; run single-cell identity/tree discriminator later. Do not claim four stable leaks: fourth-run amendment changes membership. R6545–6566.\\n109 — RIPE dedicated312-tag retirement, broad, see rank3. R6567–6588.\\n110 — HISTORICAL fold ruled / no second implementation. Final amendment chooses surviving REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM+pure seam, removes duplicate IDs/netsh ADR; Linux ten-cell gap qualified. #304 shipped; completion reconciliation rather than recreate W2. R6589–6617.\\n111 — TOUCH-TRIGGERED UDP rule-observation backlog. ActiveStore effective state vs by-name presence; next inbound-rule wave or CIM query generalization. No live fallback/rule changes authorized; current box state unknown. R6618–6639.\\n112 — TOUCH-TRIGGERED two-fixture hermeticity; existing nextest gate correct. No cargo-test-lib rerun or gate conversion now. R6640–6659.\\n113 — PROCEDURE / next mutation-driver touch. Trap/finally plus next-arm pristine bytes/oid and assertion-local negative outcome; no new mutation window. R6660–6681.\\n114 — PROCEDURE / shared-state arm trigger. One writer, fetcher-owned before/after census and timestamped coordination; original scope rationale void. No new firewall experiment. R6682–6690.\\n115 — PROCEDURE / next firewall census. Same-dump port+program controls, full reaching conjunction and per-agent exits; late event-log amendment forbids using events as delete direction proof. R6691–6700.\\n116 — PROCEDURE / next watchdog. Actual post-state, owned identities; both script echo and harness success were false kill claims.137 during compile was VOID not product red. R6701–6711.\\n117 — PROCEDURE / requirement/prediction authoring. Refutable branches and code-violable invariant; no measured local latency threshold in product. R6712–6720.\\n118 — PROCEDURE / next capture/filter. Flush/stop writer before reading and live positive-control/raw schema; no new instrument project. R6721–6729.\\n119 — PROCEDURE plus BLOCKED OPERATOR receipt. Empty-dir route control and complete teardown rules stand. Credential rotation is separate operator item releases#304 comment5643876746; this register records no completion, so unknown and not authority to rotate. R6730–6740.\\n120 — INSTANCE DISCRIMINATED, ongoing claim discipline. Second Windows host and Linux contrast supplied missing axes; no platform investigation to repeat. R6741–6750.\\n121 — INSTANCE FIXED v7, recurring rig/byte-reader discipline. Audited delivered set, no arm-id patch against frozen v6; raw byte and leading-dash safeguards on next authoring touch. R6751–6768.\\n122 — REPEAT-FIELD TRIGGER, current closure UNKNOWN/receipt-first. Original stop refusal intentional and cannot be bypassed. Later133 owned-shutdown proof demonstrates successor cleanup, but does not alone reconcile every122 identity invariant. Owner hertz rig; inspect accepted successor/receipts before any repeat-field authorization, never PID-only automation. R6769–6781.\\n123 — FIXED successor, mechanism-only OPEN. Return/log channel correction already exists, frozenr10 unchanged; no new code. R6782–6793.\\n124 — REPEAT-FIELD TRIGGER, supersession reconciliation needed. Original driver creates daemon on setup-never-ran cleanup. Do not patch preserved2e3aec1b or assume latest accepted successor retains defect; inspect current successor's no-setup branch before field. R6794–6805.\\n125 — UNKNOWN mechanism; receipt-first with124. Original false-negative sweep, NOT falseCLEAR; slash comparison is unconfirmed candidate. Later132 adds stronger identity seam. Need exact successor predicate/known-present proof, not a guessed path-normalization patch. R6806–6816.\\n126 — ORIGINAL budget shape superseded by134's qualified clock design. No second independent budget fix; future field repinning/authorization remains separate. R6817–6827, R6901–6913.\\n127 — CORRECTED/QUALIFIED preserved M3; class touch-triggered. Whole nested-value assignment + native flags readback already measured. R6828–6836.\\n128 — CORRECTED/QUALIFIED M5 and N publisher; class touch-triggered. Typed null/empty seam and overwrite-rename already changed; original123 arms invalid. R6837–6846.\\n129 — CORRECTED/QUALIFIED twice, latest promotion Read-Json-DateKindString discriminator. No repeat implicit-date repair against preserved predecessor. R6847–6856.\\n130 — AUTHORIZED CORRECTION, final retry receipt UNKNOWN in entry. Two-line qualificationHome rename directed, fresh-root result explicitly separate. Minimum is locate that receipt/successor before claiming fix or redispatching. R6857–6866; AZLCQNZL-* preserved references.\\n131 — CORRECTED/QUALIFIED no-mutation preflight. Child env scrub and invalid Stop-Transcript removal passed; strict seed guard intact. R6867–6877; VGCTKD7A-preflight-clean-* receipts.\\n132 — CORRECTED/QUALIFIED birth-aware admission.14 controls and17-hit live read recorded; current product/box state not inferred. R6878–6888.\\n133 — COMPLETED correction with genuine promotion0/owned shutdown. Later failed field handoff separate, no promotion rerun. R6889–6900.\\n134 — CORRECTION QUALIFIED, future FIELD BLOCKED/repin-only.630s design and receipt/clock controls already built; candidate/packet/nonce/driver/runner repin is one future amendment requiring separate grant. Independent candidate product query-timeout finding M5XKQ2DN remains separate; cannot close it using instrument repair. R6901–6913.\\n135 — LANDED52d56248; RECEIPT-ONLY integration execution. Centralized precheck/install and Linux controls built; live token/private build deliberately unexercised and provisioning is optional operator decision. Do not redispatch version diagnostic. R6914–6920.\\n136 — LANDED84e20ddd; completed shared composition, adoption touch-triggered. S5 initial fix/cross-host green distinct from later Linux shared-fixture proof (seven unopted twohost cases compile-only). Future URL fixture uses ServingFixture; no duplicate helper. R6921–6931.\\n137 — RETIRED8bb0feb4 byYPLFG3CG, no tracked launcher callsite. OMP harmless-child receipt is not reproduction of Claude Code failure. Reopen only owned new callsite/contrary evidence, never unused helper. R6932–6937.\\n\\nBOTTOM LINE: no Windows investigation should begin under CI34983756975 hold. Receipt reconciliation can proceed read-only now. IR90 residual and existing-owner IR82 are the strongest small implementation candidates; IR109 is real but not a small rider. IR78/94 are valid conditional seams, not proof that an immediate dispatch is owed. IR86 retirement must remain Main's slice-by-slice decision.\"},\"error\":null}","call_id":"call_lZZ5udOyvgROdDavakstsbxV","internal_chat_message_metadata_passthrough":{"create_time":1789483760.719006,"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"},"name":"yield","metadata":{"turn_id":"f5651149-1a96-440f-bbcb-72125617c760"}}]},"duration":170852.42059999704,"ttft":2727.532000005245,"completedAt":1789483931186,"contextSnapshot":{"promptTokens":136953,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"f54b765c","parentId":"af075406","timestamp":"2026-09-15T14:52:11.190Z","message":{"role":"toolResult","toolCallId":"call_lZZ5udOyvgROdDavakstsbxV|fc_000c7cef03cac861016aa95af9f05487d1bd4a2dbe427daa0e","toolName":"yield","content":[{"type":"text","text":"Result submitted."}],"details":{"data":{"summary":"Read IR71–137 through amendments: all 67 IDs accounted for. Best small residual is IR90's test-side mid-run disk context, not another generic disk-floor tool. IR82 remains unbuilt but already belongs to todlando's composition. IR109 retirement is genuinely open but broad (312 legacy tags). Several tempting tickets are already built: IR92 inject publication, IR104 pin, IR107 premise assertions, IR135/136 and IR137. Windows investigations remain held; IR86 closure stays with Main.","files":[{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","description":"Entire assigned IR71–137 population read, including late reversals and final corrections; also read current sweep composition at lines 1–57."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/inject.rs","description":"Lines 75–110 implement IR92's successful-inject observation-only MSG_IN publication despite stale OPEN register language."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/daemon.rs","description":"Line 476 still overwrites daemon.pid without predecessor preservation: IR82 remedy remains absent."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/docshost.rs","description":"Lines 114–123 still silently return port0 when ephemeral posture wins; IR78 remains a tiny touch-triggered notice."},{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/brainread.rs","description":"Lines 194–208 retain stream-name predicate; lines 264–310 distinguish repository-wide retired-call scan from hand-listed semantic policy registry. IR94 remains a real classifier gap."},{"path":".worktrees/hertz-ir86-disk-delta/crates/xtask/src/diskfloor.rs","description":"Existing disk-floor implementation at lines 64–102; must reuse, not redispatch under IR90."},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/local-lane.py","description":"Lines 360–398 already admit/census/meter before and observe after producers; 402–410 release through prebuilt xtask."},{"path":".worktrees/hertz-ir86-disk-delta/traceable-reqs.toml","description":"Line25 still module_banner='accept': IR109 transitional exemption remains live."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/tests/sync.rs","description":"PullLink failure sites at approximately 187–211 still use bare expect('pull')/expect('serve'), without current free-space context."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/registryhost.rs","description":"Lines1369ff already assert no-repository fixture premise requested in IR107."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-daemon/src/projwriter.rs","description":"Lines799ff already assert no-repository fixture premise requested in IR107."},{"path":".worktrees/hertz-ir86-disk-delta/.github/ci/traceable-reqs.sh","description":"Lines5–6 centralize installed CI checker pin0.4.1; supports spent IR75/104 original remedies and landed IR135."},{"path":".worktrees/hertz-ir86-disk-delta/crates/spt-store/src/proc.rs","description":"kill_pid(pid) at46 and kill_pid_tree(root) at430 remain bare-number primitives; do not infer IR81 primitive cutover from authenticated consumer repairs."},{"path":".worktrees/hertz-ir86-disk-delta/docs/GOLDEN-CI.md","description":"Lines26–80 already document quiet-window/ancestry boundaries; IR137 discipline follows at81ff."}],"architecture":"Register headings are historical handles, not current state. Driver safeguards, product primitives, test fixtures, box configuration, and exercised workflow receipts are separate seams. Existing local-lane already composes floor/census/prebuilt-release mechanisms; inject already owns publication; serving fixture already composes broker/seed/docs planes. Remaining work must target residual callers/context or reconcile receipts, not recreate these modules.","report":"Scope and evidence: R below means .worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md. Other paths are relative to that same fixed worktree. Read-only source/record investigation only: no execution, process/service probes, tests, builds, lint, edits, or new files. Existing receipts are quoted as recorded evidence, not rerun or independently reverified. Known landed SHAs supplied by Main/user are treated as ground truth.\n\nRANKED ACTIONABLE RESIDUALS\n1. IR90 — RIPE-NOW, small residual implementation. Trigger is explicitly 'now' (R5425), reinforced by next-intake composition R43–47 and measured disk-full product-shaped refusal R5341–5356. Already-built prerequisite: crates/xtask/src/diskfloor.rs:64–102 and .github/ci/local-lane.py:360–398. Unbuilt specific seam: crates/spt-daemon/tests/sync.rs:187–211 still turns request_sync/serve_sync errors into bare expect('pull')/expect('serve'); inspected sync/twohost files have no free-space diagnostic. Owner: hertz test/driver package. Smallest next step: scope a test-side error-context helper/caller change that reports actual temp/store-volume free bytes on the real error, then assess remaining rig-start adopters against existing disk-floor. Do NOT build a second floor meter or claim local-lane lacks pre/post readings. Execution proof waits for authorized window.\n2. IR82 — RIPE composition, small product change, EXISTING OWNER NOT NEW DISPATCH. Ruled remedy and owner at R4650–4682; prior #285 completion explicitly did not build it (R51). Source still unconditional std::fs::write at crates/spt-daemon/src/daemon.rs:476. Owner todlando, product pid-identity composition. Minimal next step: acknowledge/take the existing assignment, implement the stipulated predecessor record plus one-generation pidfile retention; keep socket liveness and countable DAEMON_AUTOSTART unchanged. Not an incident-cause closure.\n3. IR109 — RIPE-NOW dedicated retirement lane, NOT SMALL. R6569–6587 ratifies temporary #304 exception and explicitly orders separate relocation lane. traceable-reqs.toml:25 still accepts module banners; checker pin0.4.1 now actually exists in .github/ci/traceable-reqs.sh:6. Owner doyle intake/traceability maintainer (implementation owner not named). Minimum next step: obtain exact current legacy-tag population, relocate actual evidence tags and remove acceptance key as one dedicated lane. Historical312 is not a fresh census. Never 'fix' by re-pinning or broadening exemption.\n4. IR89, with IR83 — RIPE-NOW RECEIPT-ONLY first. R5185–5199 explicitly says the next-golden trigger has already fired and workflow is LANDED. Owner hertz workflow / doyle acceptance. Minimum next step: recover exact A/B pre-ceremony probe-step execution/skipped/failed receipts from an already completed golden (S5 overall green is not enough), plus direction-witness LIST/real-body evidence for IR83. No box change or second UDP guard. This is the cheapest immediate closure work.\n5. IR92, IR104, IR107, IR135/136 — RIPE-NOW RECORD RECONCILIATION, not implementation. See complete dispositions below. Especially IR92 source directly contradicts both its heading and R39–41. Review relevant existing consumer/acceptance receipts and correct scope/status; do not recreate injected MSG_IN publication or premise assertions.\n\nCONDITIONAL SMALL RIDERS, NOT UNCONDITIONAL DISPATCHES\n• IR78: docshost.rs:114–123 confirms silent override persists; exact trigger R4099–4101 is next docshost touch or a new explicit-port belief incident. Owner docshost product maintainer; one notice naming both env vars when a supplied override loses. No fresh trigger proved in this sweep.\n• IR94: brainread.rs:194–208 still keys lifetime policy on serve_*_feed/serve_attach; :264–310 scans all Rust for general symbols but retains specific policy files/functions. Exact trigger R5668–5671: next brainread/xtask touch, mandatory before bounded serve_sync migration. Owner tooling/hertz with todlando semantic census. Minimal next step on that touch: behavior-derived fail-unclassified population and printed census, not merely append serve_sync to another whitelist.\n• IR71/72/77/93/111 likewise remain genuine touch-triggered work, not ripe because OPEN.\n\nCOMPLETE PER-ID DISPOSITIONS (67 IDs)\n71 — TOUCH-TRIGGERED. Persisted controller-release breadcrumb still owed; next controller lifecycle/breadcrumb touch or PR174 barrier timeout. R3888–3911. No fresh trigger established.\n72 — TOUCH-TRIGGERED. Named perch/seat custody read model; next roster/status change or another rig needing named-holder reap. R3912–3945. Do not substitute process-wide daemon status.\n73 — COMPLETED. Eight checkout/floor reorder sites and both docs rereads built; remaining capacity/coupling belongs IR86. R3946–3969.\n74 — TOUCH-TRIGGERED / historical box state UNKNOWN. Next Linux rig/box-audit lifecycle work, not authorization to sweep live /tmp now. 21,643 homes is dated measurement, not current count. R3970–3983.\n75 — ORIGINAL INSTANCE SPENT; RECEIPT/status reconciliation. Missing Linux checker is superseded by IR135's hand-install and real0.4.1 smoke (R6916–6918), plus centralized installed pin. Do not install it again based on 127 from August. Future box-audit/version admission remains discipline. R3984–3998.\n76 — PARTLY BUILT, TOUCH-TRIGGERED residual. Existing ws272 drivers carry three-arm gate and GOLDEN-CI.md:26–80 quiet/ancestry contract; local-lane reuses gate. Dedicated CI foreign-builder count/CPU census and universal brief/template adoption not established here. Current heavy Windows hold is binding, not a request for more code. R3999–4042.\n77 — TOUCH-TRIGGERED. Spawn/child-entry/readiness timing split; next boot/brainproc-ready or family rider. R4043–4074.\n78 — TOUCH-TRIGGERED confirmed residual; tiny notice, source docshost.rs:114–123. R4075–4102.\n79 — TOUCH-TRIGGERED lifecycle package. Common authenticated breadcrumb reaper exists, but it is not a Drop guard and does not prove panic-safe adoption. Original first four tests yielded no Drop/DaemonReaper match; no complete22-site current census claimed. Next common touch, and distinguish unwind from hard process death (R47–49). R4103–4183.\n80 — BLOCKED Windows measurement / partially classified fixture family. Late amendments identify cmd→ping wrapper fixture, direct production spawn,12-member noisy OS partition; not an undiagnosed product leak and no count-only progress claim. Residual population unclassified; existing ENV-read fix already built. R4184–4465. Coordinate with108, not duplicate work.\n81 — OPEN product primitive + gate residual, existing owners. proc.rs:46/:430 remain bare-number signatures; consumer authenticated reaper and adapter9c87372 do not finish signature cutover. Todlando product, hertz gate; trigger next proc/xtask gate touch. Adapter half closed. R4466–4590.\n82 — RIPE assigned product composition, unbuilt source; see rank2. R4591–4696.\n83 — OPEN direction-witness durability/acceptance; BOX half spent. Universal LAN-only rule explicitly superseded; no new operator/ACL action. Reconcile current LIST/NOT-A-WITNESS enforcement and reverse real-body witness; co-own with89. R4697–4833.\n84 — ORIGINAL STAMP BUILT; residual follow-up only. Stamp landed with entry; all-arm regression enforcement remains a separately named follow-up. Historical65s question must not be reopened without IR89's later attribution (three faces of firewall/ACL/shared-path cause). R4834–4883, R5217ff.\n85 — BLOCKED diagnostic continuation. Cap changes already built; arm1 void, old-sha slowdown only proves head growth unnecessary. Needs IR90 guard and authorized no-CI/no-main-push window; AB then BA, not repeated AB. Do not identify Defender from correlation or widen caps. R4884–5043.\n86 — MAIN-OWNED. Both floors and inline delta known landed (5e05f02d/0cda6235/82333ca1). Do not redispatch. Main must reconcile final automation plus independent docs-dependency slice before retirement; no closure conclusion delegated here. R5044–5092.\n87 — TOUCH-TRIGGERED unresolved scheduling seam. Next golden/twohost touch; old R294 recurrence includes own PR starving roleA, not only foreign runs. Minimum existing-lane decision is partner-start barrier/separate rendezvous scheduling contract, not larger pairing timeout. R5093–5145. Current source choreography not exhaustively re-audited.\n88 — BUILT in current local-lane; TOUCH/receipt residual elsewhere. local-lane.py:402–410 invokes prebuilt xtask. Reconcile runbook/all other teardown adopters only when touched. Preserve exe AND DLL if claiming runnable retention, otherwise archival. R5146–5182.\n89 — RECEIPT-ONLY ripe; boxes applied and guard landed; exact golden probe-step acceptance missing from record. See rank4. R5183–5338.\n90 — RIPE-NOW residual error context/start adoption, not new floor machinery. See rank1. R5339–5427.\n91 — CLOSED.18 cited files tracked in place;543 uncited artifacts preserved, root-specific ignores. R5428–5481.\n92 — SOURCE-BUILT; stale register requires reconciliation. inject.rs:75–110 publishes exactly on Some((true,_)), observation-only, target/peer/msg-id present; no fresh publisher implementation. Relay ordering/per-message exact-once assertion obligations remain separate, not automatically closed by this source read. R5482–5613.\n93 — TOUCH-TRIGGERED / packaging decision required. PDB retention/install or symbol store; next installer/release packaging touch. Successful release build is not symbol availability. R5614–5642.\n94 — TOUCH-TRIGGERED actual gate blind spot; see conditional rider. R5643–5672.\n95 — PARTLY INSTRUMENTED, diagnostic continuation/triage UNKNOWN. Original comparison has already run; no blanket317-site edit. Historical321 population approximate,15 outside classifier unclassified; retained exchange-correlated create/retire trace is separate product design, not two-IPC reuse. Needs selected diagnostic intake, not budget retuning. R5673–5927.\n96 — BLOCKED/cause UNKNOWN. Candidate-vs-diagnostic differential confounded by97; diagnostic pool deleted, next candidate discriminator requires rebuild and authorized quiet heavy window. R5928–5963; preserved CLASSIFICATION-AMENDMENT-2-doyle.md and reclaim receipts remain evidence.\n97 — PARTLY BUILT procedure. local-lane.py:380–398 already performs before/after producer census; exclusive START/END token discipline remains runtime adoption. No new repeated-run experiment authorized; observe actual launch not announcement. R5964–6006.\n98 — INSTANCE FIXED; TOUCH-TRIGGERED class. Original UTF8 correction qualified; next driver rendering touch must preserve crash/never-started outcomes. local-lane's UTF8 artifact writes are not proof of universal console safety, but do not re-fix the preserved driver. R6007–6030.\n99 — CLASSIFIED NOT-PRODUCT, built repairs; RECEIPT reconciliation. Spectator EOF unpromised; journal op reuse fixed.103 supplies successful five-arm receipt for attach half; do not repeat withdrawn opener diagnosis or repair spectator EOF as product. New EOF tests inherit contract-reading rule. R6031–6109.\n100 — PARTLY BUILT census discipline; operator setting TOUCH-TRIGGERED. lane_run ancestry/blind-path corrections documented; analyzer targetDir recommendation still separate operator choice. Current lock holder/live status UNKNOWN, no probe allowed. R6110–6169.\n101 — HISTORICAL REPAIRS BUILT; recurring inventory/assembly discipline. Six callers fixed, escaper coverage restored, integration repin existed; #304 now landed. Future lane must compile its own all-targets and inspect losing-side assertions; do not redispatch304 assembly commands. R6170–6234.\n102 — INSTANCE RULE APPLIED; recurring assignment discipline. Committed-only assembly/status-per-file; old0.4.0 upgrade ask superseded by0.4.1/135. No instrument implementation proved. R6235–6267.\n103 — FIXED rig; PARKED hazard NOT RIPE.0845e68d five-arm green plus trace; served-set population scoped clean. Equal wall-ms seat generation is explicitly unmeasured/noREQ/no build until field/cell collision. R6268–6337.\n104 — COMPLETED consumed upstream fix; status-only reconciliation. Current centralized pin0.4.1 satisfies stated closes-when-pin-main trigger. No checker-root workaround. R6338–6366.\n105 — INSTANCE FIXED (28d4eb68), ongoing authoring discipline. Read fixture and redirect target, shorten blind interval only if recurrence demands; no tool lane. R6367–6418.\n106 — INSTANCE CLOSED, procedure adoption. START/END population enumeration clause remains template-touch item; do not call handed set exhaustive. This sweep accounts all67 IDs explicitly. R6419–6449.\n107 — FIXED original driver AND requested premise assertions. registryhost.rs:1369ff/projwriter.rs:799ff already carry premise assertions; Linux consumer attempt2 unchanged candidate green documented. Later Windows identity-contaminated attempt stays VOID; corrected Windows receipt not claimed by this entry. Artifact filename/driver universality may need receipts, not another two-module patch. R6450–6544.\n108 — RIPE BACKLOG DISCRIMINATOR, BLOCKED current Windows hold. Today's findings-backlog sweep meets listed trigger (R6564–6565), but no run allowed. Reuse80 fixture diagnosis; run single-cell identity/tree discriminator later. Do not claim four stable leaks: fourth-run amendment changes membership. R6545–6566.\n109 — RIPE dedicated312-tag retirement, broad, see rank3. R6567–6588.\n110 — HISTORICAL fold ruled / no second implementation. Final amendment chooses surviving REQ-WEB-LAN-BOOTSTRAP-FIREWALL, W1 CIM+pure seam, removes duplicate IDs/netsh ADR; Linux ten-cell gap qualified. #304 shipped; completion reconciliation rather than recreate W2. R6589–6617.\n111 — TOUCH-TRIGGERED UDP rule-observation backlog. ActiveStore effective state vs by-name presence; next inbound-rule wave or CIM query generalization. No live fallback/rule changes authorized; current box state unknown. R6618–6639.\n112 — TOUCH-TRIGGERED two-fixture hermeticity; existing nextest gate correct. No cargo-test-lib rerun or gate conversion now. R6640–6659.\n113 — PROCEDURE / next mutation-driver touch. Trap/finally plus next-arm pristine bytes/oid and assertion-local negative outcome; no new mutation window. R6660–6681.\n114 — PROCEDURE / shared-state arm trigger. One writer, fetcher-owned before/after census and timestamped coordination; original scope rationale void. No new firewall experiment. R6682–6690.\n115 — PROCEDURE / next firewall census. Same-dump port+program controls, full reaching conjunction and per-agent exits; late event-log amendment forbids using events as delete direction proof. R6691–6700.\n116 — PROCEDURE / next watchdog. Actual post-state, owned identities; both script echo and harness success were false kill claims.137 during compile was VOID not product red. R6701–6711.\n117 — PROCEDURE / requirement/prediction authoring. Refutable branches and code-violable invariant; no measured local latency threshold in product. R6712–6720.\n118 — PROCEDURE / next capture/filter. Flush/stop writer before reading and live positive-control/raw schema; no new instrument project. R6721–6729.\n119 — PROCEDURE plus BLOCKED OPERATOR receipt. Empty-dir route control and complete teardown rules stand. Credential rotation is separate operator item releases#304 comment5643876746; this register records no completion, so unknown and not authority to rotate. R6730–6740.\n120 — INSTANCE DISCRIMINATED, ongoing claim discipline. Second Windows host and Linux contrast supplied missing axes; no platform investigation to repeat. R6741–6750.\n121 — INSTANCE FIXED v7, recurring rig/byte-reader discipline. Audited delivered set, no arm-id patch against frozen v6; raw byte and leading-dash safeguards on next authoring touch. R6751–6768.\n122 — REPEAT-FIELD TRIGGER, current closure UNKNOWN/receipt-first. Original stop refusal intentional and cannot be bypassed. Later133 owned-shutdown proof demonstrates successor cleanup, but does not alone reconcile every122 identity invariant. Owner hertz rig; inspect accepted successor/receipts before any repeat-field authorization, never PID-only automation. R6769–6781.\n123 — FIXED successor, mechanism-only OPEN. Return/log channel correction already exists, frozenr10 unchanged; no new code. R6782–6793.\n124 — REPEAT-FIELD TRIGGER, supersession reconciliation needed. Original driver creates daemon on setup-never-ran cleanup. Do not patch preserved2e3aec1b or assume latest accepted successor retains defect; inspect current successor's no-setup branch before field. R6794–6805.\n125 — UNKNOWN mechanism; receipt-first with124. Original false-negative sweep, NOT falseCLEAR; slash comparison is unconfirmed candidate. Later132 adds stronger identity seam. Need exact successor predicate/known-present proof, not a guessed path-normalization patch. R6806–6816.\n126 — ORIGINAL budget shape superseded by134's qualified clock design. No second independent budget fix; future field repinning/authorization remains separate. R6817–6827, R6901–6913.\n127 — CORRECTED/QUALIFIED preserved M3; class touch-triggered. Whole nested-value assignment + native flags readback already measured. R6828–6836.\n128 — CORRECTED/QUALIFIED M5 and N publisher; class touch-triggered. Typed null/empty seam and overwrite-rename already changed; original123 arms invalid. R6837–6846.\n129 — CORRECTED/QUALIFIED twice, latest promotion Read-Json-DateKindString discriminator. No repeat implicit-date repair against preserved predecessor. R6847–6856.\n130 — AUTHORIZED CORRECTION, final retry receipt UNKNOWN in entry. Two-line qualificationHome rename directed, fresh-root result explicitly separate. Minimum is locate that receipt/successor before claiming fix or redispatching. R6857–6866; AZLCQNZL-* preserved references.\n131 — CORRECTED/QUALIFIED no-mutation preflight. Child env scrub and invalid Stop-Transcript removal passed; strict seed guard intact. R6867–6877; VGCTKD7A-preflight-clean-* receipts.\n132 — CORRECTED/QUALIFIED birth-aware admission.14 controls and17-hit live read recorded; current product/box state not inferred. R6878–6888.\n133 — COMPLETED correction with genuine promotion0/owned shutdown. Later failed field handoff separate, no promotion rerun. R6889–6900.\n134 — CORRECTION QUALIFIED, future FIELD BLOCKED/repin-only.630s design and receipt/clock controls already built; candidate/packet/nonce/driver/runner repin is one future amendment requiring separate grant. Independent candidate product query-timeout finding M5XKQ2DN remains separate; cannot close it using instrument repair. R6901–6913.\n135 — LANDED52d56248; RECEIPT-ONLY integration execution. Centralized precheck/install and Linux controls built; live token/private build deliberately unexercised and provisioning is optional operator decision. Do not redispatch version diagnostic. R6914–6920.\n136 — LANDED84e20ddd; completed shared composition, adoption touch-triggered. S5 initial fix/cross-host green distinct from later Linux shared-fixture proof (seven unopted twohost cases compile-only). Future URL fixture uses ServingFixture; no duplicate helper. R6921–6931.\n137 — RETIRED8bb0feb4 byYPLFG3CG, no tracked launcher callsite. OMP harmless-child receipt is not reproduction of Claude Code failure. Reopen only owned new callsite/contrary evidence, never unused helper. R6932–6937.\n\nBOTTOM LINE: no Windows investigation should begin under CI34983756975 hold. Receipt reconciliation can proceed read-only now. IR90 residual and existing-owner IR82 are the strongest small implementation candidates; IR109 is real but not a small rider. IR78/94 are valid conditional seams, not proof that an immediate dispatch is owed. IR86 retirement must remain Main's slice-by-slice decision."},"status":"success"},"isError":false,"timestamp":1789483931189}}
{"type":"message","id":"ef613f00","parentId":"f54b765c","timestamp":"2026-09-15T14:52:11.234Z","message":{"role":"user","content":"Current interruptible wait interrupted: IRC message from parent agent `Main`.\n\nParent IRC message:\n\nIR75 own probe: bare ssh reavus@kitsubito \"traceable-reqs --version\" exited127 at14:49Z; explicit /home/reavus/.local/bin binary probe running. Do NOT retire installation ticket as executable driver availability without PATH qualification. IR86 docs decoupling proven at currentgolden597–668; gitblamec3b5feec2, so retire all3+coupling.","attribution":"agent","timestamp":1789483801591,"steering":true}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_W0mnbKcNLcYvlSABje4LBLDs|fc_000c7cef03cac861016aa95b9d74b087d194c6e491b41f87cb","toolName":"hub","startedAt":"2026-09-15T14:52:17.429Z","intent":"Correcting checker availability disposition"},"id":"0475fd65","parentId":"ef613f00","timestamp":"2026-09-15T14:52:17.429Z"}
{"type":"message","id":"38b977b3","parentId":"0475fd65","timestamp":"2026-09-15T14:52:17.431Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_W0mnbKcNLcYvlSABje4LBLDs|fc_000c7cef03cac861016aa95b9d74b087d194c6e491b41f87cb","name":"hub","arguments":{"i":"Correcting checker availability disposition","op":"send","to":"Main","message":"Accepted correction: IR75 remains OPEN PATH/driver-availability residual; my 'original instance spent' was too broad. IR135 real-binary smoke establishes installed binary only, not bare non-login invocation. Use your 14:49Z bare-ssh exit127 as ripe trigger; smallest next step inspect actual Linux driver launch/PATH and choose explicit binary path or declared PATH, not reinstall blindly. IR86 defer-to-Main row superseded by your current docs-decoupling proof c3b5feec2."},"intent":"Correcting checker availability disposition"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":25213,"output":138,"cacheRead":117504,"cacheWrite":0,"totalTokens":142855,"cost":{"input":0.25213,"output":0.006900000000000001,"cacheRead":0.117504,"cacheWrite":0,"total":0.37653400000000004}},"stopReason":"toolUse","timestamp":1789483931230,"responseId":"resp_000c7cef03cac861016aa95b9ba3a087d1bf0e104f5075dc74","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_000c7cef03cac861016aa95b9d74b087d194c6e491b41f87cb","type":"function_call","status":"completed","arguments":"{\"i\":\"Correcting checker availability disposition\",\"op\":\"send\",\"to\":\"Main\",\"message\":\"Accepted correction: IR75 remains OPEN PATH/driver-availability residual; my 'original instance spent' was too broad. IR135 real-binary smoke establishes installed binary only, not bare non-login invocation. Use your 14:49Z bare-ssh exit127 as ripe trigger; smallest next step inspect actual Linux driver launch/PATH and choose explicit binary path or declared PATH, not reinstall blindly. IR86 defer-to-Main row superseded by your current docs-decoupling proof c3b5feec2.\"}","call_id":"call_W0mnbKcNLcYvlSABje4LBLDs","internal_chat_message_metadata_passthrough":{"create_time":1789483932.051836,"turn_id":"700134a6-a600-4248-b585-f291f6056216"},"name":"hub","metadata":{"turn_id":"700134a6-a600-4248-b585-f291f6056216"}}]},"duration":6196.342299997807,"ttft":2246.6656999886036,"completedAt":1789483937428,"contextSnapshot":{"promptTokens":142717,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"45801255","parentId":"38b977b3","timestamp":"2026-09-15T14:52:17.433Z","message":{"role":"toolResult","toolCallId":"call_W0mnbKcNLcYvlSABje4LBLDs|fc_000c7cef03cac861016aa95b9d74b087d194c6e491b41f87cb","toolName":"hub","content":[{"type":"text","text":"Delivered to 1 peer(s):\n- Main: injected"}],"details":{"op":"send","from":"RegisterLater","to":"Main","receipts":[{"to":"Main","outcome":"injected"}]},"isError":false,"timestamp":1789483937432}}
{"type":"message","id":"f2220883","parentId":"45801255","timestamp":"2026-09-15T14:52:17.472Z","message":{"role":"user","content":"Current interruptible wait interrupted: IRC message from parent agent `Main`.\n\nParent IRC message:\n\nExplicit ssh /home/reavus/.local/bin/traceable-reqs --version returned0.4.1 exit0. Barecommand still127. IR75 installed symptom closed but real driver/PATH adoption remains unless explicitpath proven; label conditional, no reinstall.","attribution":"agent","timestamp":1789483845909,"steering":true}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uIfBvkOo82aWlG7xXcioQ4P2|fc_000c7cef03cac861016aa95ba355e087d1975856b326c78644","toolName":"yield","startedAt":"2026-09-15T14:52:33.332Z"},"id":"5de87dab","parentId":"f2220883","timestamp":"2026-09-15T14:52:33.332Z"}
{"type":"message","id":"cee3a30f","parentId":"5de87dab","timestamp":"2026-09-15T14:52:33.332Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_uIfBvkOo82aWlG7xXcioQ4P2|fc_000c7cef03cac861016aa95ba355e087d1975856b326c78644","name":"yield","arguments":{"type":null,"data":{"summary":"Correction to prior 67-ID report: IR75 installation is proven complete, but bare-command availability is not. Keep driver/PATH adoption conditional; no reinstall. Main's IR86 source proof discharges docs coupling as well as three landed slices.","files":[{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","description":"IR75 disposition corrected using Main's supplied paired SSH receipts; IR86 delegated closure updated using Main's supplied coupling proof."}],"architecture":"An installed executable, its availability through a launcher's PATH, and a driver's successful use are separate facts. Explicit-path version success cannot establish bare-command availability.","report":"This amendment supersedes only IR75 and the provisional IR86 caveat in my prior complete67-ID report; all other dispositions remain.\n\nIR75 — INSTALLATION SYMPTOM CLOSED; DRIVER/PATH ADOPTION CONDITIONAL. Main measured bare ssh reavus@kitsubito \"traceable-reqs --version\" exit127 at14:49Z; explicit /home/reavus/.local/bin/traceable-reqs --version returned0.4.1, exit0. Thus the binary exists and works, but the non-login bare invocation cannot find it. Neither observation proves what every actual gate driver invokes. Owner hertz Linux driver/box-audit seam. Smallest next step: read the intended current driver's command and launch environment; if it relies on bare traceable-reqs under that PATH, adopt the existing explicit path or documented PATH setup. If it already uses the explicit binary successfully, only reconcile the receipt. No reinstall and no unconditional new lane based on the historical missing-install wording. Parent-provided paired receipts are evidence; I performed no live execution.\n\nIR86 — Main reports current golden.yml:597–668 proves docs decoupling, attributed to c3b5feec2. Alongside known landed Linux floor5e05f02d, Windows floor0cda6235 and inline delta82333ca1, Main concludes all three slices plus coupling discharged. My earlier warning to investigate coupling is superseded by that source proof; retirement remains Main-owned."},"error":null}}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":396,"output":472,"cacheRead":142592,"cacheWrite":0,"totalTokens":143460,"cost":{"input":0.00396,"output":0.0236,"cacheRead":0.142592,"cacheWrite":0,"total":0.170152}},"stopReason":"toolUse","timestamp":1789483937469,"responseId":"resp_000c7cef03cac861016aa95ba1b96487d1856e26b206e9f448","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_000c7cef03cac861016aa95ba355e087d1975856b326c78644","type":"function_call","status":"completed","arguments":"{\"type\":null,\"data\":{\"summary\":\"Correction to prior 67-ID report: IR75 installation is proven complete, but bare-command availability is not. Keep driver/PATH adoption conditional; no reinstall. Main's IR86 source proof discharges docs coupling as well as three landed slices.\",\"files\":[{\"path\":\".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md\",\"description\":\"IR75 disposition corrected using Main's supplied paired SSH receipts; IR86 delegated closure updated using Main's supplied coupling proof.\"}],\"architecture\":\"An installed executable, its availability through a launcher's PATH, and a driver's successful use are separate facts. Explicit-path version success cannot establish bare-command availability.\",\"report\":\"This amendment supersedes only IR75 and the provisional IR86 caveat in my prior complete67-ID report; all other dispositions remain.\\n\\nIR75 — INSTALLATION SYMPTOM CLOSED; DRIVER/PATH ADOPTION CONDITIONAL. Main measured bare ssh reavus@kitsubito \\\"traceable-reqs --version\\\" exit127 at14:49Z; explicit /home/reavus/.local/bin/traceable-reqs --version returned0.4.1, exit0. Thus the binary exists and works, but the non-login bare invocation cannot find it. Neither observation proves what every actual gate driver invokes. Owner hertz Linux driver/box-audit seam. Smallest next step: read the intended current driver's command and launch environment; if it relies on bare traceable-reqs under that PATH, adopt the existing explicit path or documented PATH setup. If it already uses the explicit binary successfully, only reconcile the receipt. No reinstall and no unconditional new lane based on the historical missing-install wording. Parent-provided paired receipts are evidence; I performed no live execution.\\n\\nIR86 — Main reports current golden.yml:597–668 proves docs decoupling, attributed to c3b5feec2. Alongside known landed Linux floor5e05f02d, Windows floor0cda6235 and inline delta82333ca1, Main concludes all three slices plus coupling discharged. My earlier warning to investigate coupling is superseded by that source proof; retirement remains Main-owned.\"},\"error\":null}","call_id":"call_uIfBvkOo82aWlG7xXcioQ4P2","internal_chat_message_metadata_passthrough":{"create_time":1789483938.097905,"turn_id":"feb802e4-cd2f-4be2-bd1c-048455b5c143"},"name":"yield","metadata":{"turn_id":"feb802e4-cd2f-4be2-bd1c-048455b5c143"}}]},"duration":15860.694199979305,"ttft":1883.6034999787807,"completedAt":1789483953331,"contextSnapshot":{"promptTokens":142988,"nonMessageTokens":10342,"compactionEpoch":0}}}
{"type":"message","id":"978d97b3","parentId":"cee3a30f","timestamp":"2026-09-15T14:52:33.333Z","message":{"role":"toolResult","toolCallId":"call_uIfBvkOo82aWlG7xXcioQ4P2|fc_000c7cef03cac861016aa95ba355e087d1975856b326c78644","toolName":"yield","content":[{"type":"text","text":"Result submitted."}],"details":{"data":{"summary":"Correction to prior 67-ID report: IR75 installation is proven complete, but bare-command availability is not. Keep driver/PATH adoption conditional; no reinstall. Main's IR86 source proof discharges docs coupling as well as three landed slices.","files":[{"path":".worktrees/hertz-ir86-disk-delta/docs/INFRA-REGISTER.md","description":"IR75 disposition corrected using Main's supplied paired SSH receipts; IR86 delegated closure updated using Main's supplied coupling proof."}],"architecture":"An installed executable, its availability through a launcher's PATH, and a driver's successful use are separate facts. Explicit-path version success cannot establish bare-command availability.","report":"This amendment supersedes only IR75 and the provisional IR86 caveat in my prior complete67-ID report; all other dispositions remain.\n\nIR75 — INSTALLATION SYMPTOM CLOSED; DRIVER/PATH ADOPTION CONDITIONAL. Main measured bare ssh reavus@kitsubito \"traceable-reqs --version\" exit127 at14:49Z; explicit /home/reavus/.local/bin/traceable-reqs --version returned0.4.1, exit0. Thus the binary exists and works, but the non-login bare invocation cannot find it. Neither observation proves what every actual gate driver invokes. Owner hertz Linux driver/box-audit seam. Smallest next step: read the intended current driver's command and launch environment; if it relies on bare traceable-reqs under that PATH, adopt the existing explicit path or documented PATH setup. If it already uses the explicit binary successfully, only reconcile the receipt. No reinstall and no unconditional new lane based on the historical missing-install wording. Parent-provided paired receipts are evidence; I performed no live execution.\n\nIR86 — Main reports current golden.yml:597–668 proves docs decoupling, attributed to c3b5feec2. Alongside known landed Linux floor5e05f02d, Windows floor0cda6235 and inline delta82333ca1, Main concludes all three slices plus coupling discharged. My earlier warning to investigate coupling is superseded by that source proof; retirement remains Main-owned."},"status":"success"},"isError":false,"timestamp":1789483953333}}
{"type":"custom","customType":"session_exit","data":{"reason":"dispose","kind":"normal","recordedAt":"2026-09-15T14:59:11.226Z"},"id":"bea715ab","parentId":"978d97b3","timestamp":"2026-09-15T14:59:11.226Z"}