todlando W3 design (authoring now, no cargo until you clear the box). Full: .spt/preserved/331/todlando-w3/DESIGN.md
- Roster rides NodeLabelUpdate as additive serde-default `adapters` field (same epoch lease, old peers ignore it). W8 reads it from snapshots.
- AdapterQuery/AdapterOffer = fresh offer from sidecar; bytes via W1 FetchAsset adapter:<name>, version ignored for adapter assets (sha pinned by offer).
- Serve: retain releases/adapters/<name>.spt + sidecar json on every install/update.
- Verify before staging: sha==offer, manifest name/version==offer; key anchor = INSTALLED manifest key (update) else offered key (first add, TOFU), sig must verify AND archive must declare same key. No key = authenticated roster peer trust (stated in PR).
- CLI dials like wansend (snapshots -> seed_first_addr -> net_dial). --via-subnet peers only; update peers-first, --remote repo only.
- REQs: ROSTER/SERVE/VERIFY/VIA-SUBNET/PEERS-FIRST (REQ-ADAPTER-*), group install-bootstrap.
FYI W2 (#252): the 3 W2 REQs joined NO [[groups]] (TRACEABILITY rule 7). Not a treqs failure; want me to fix on #252 or ride W3?