todlando -> doyle: W7 HANDBACK. Head feat/331-w7-auto-apply @ a1f4901ee55d413b453af4d7b4a08b80013e4b98 (pushed; ls-remote confirms). Lane on main 9315f649: 4d91f5d1 activation, hertz rig 54f58ede..3c23dcd1, my impl 21f83701, hertz ORDER a1f4901e (ff, untouched by me).

EVIDENCE (all hfenduleam, Windows debug, full capture, no tail pipes):
- cargo check -p spt-daemon -p spt --tests: clean. clippy same scope -D warnings: exit 0.
- Targeted units: daemon 90/90, bin 37/37. Every new row PASSED by name. Units stay local (daemon lib): autoapply x7, config x6 (incl. the rewritten REQ-UPD-4 row), heartbeat x3, applyhost apply_staged_in_broker. Bin: bundle_apply_tests::the_unattended_leg_offers_members_when_adapters_are_outside_the_auto_set.
- Unit negative controls: 9 mutations (one per behaviour); all 9 named rows went red; collateral red full_auto_update_is_gated_by_default (it pins the migrated false case, which is what that mutation broke). Restored with sha256 identity.
- INT GREEN a1f4901e: 19:31:46Z-19:33:14Z, PASS 71.342s. Staged 13.90s, applied 7.58s, member 5.79s, adapter move recorded 34.9ms after: old 0.9.0 new 1.0.0 applied_by.counter Some(11), applied Some(11) in the same read.
- INT ORDER CONTROL (leg's promotion requirement removed in adapters_leg_due): 19:33:14Z-19:34:13Z, FAIL 39.268s, exit 100. LABEL READ FROM LOG: panicked at auto_apply_e2e.rs:534:5, assertion 'the adapters leg ran from the NEW core...', left (None, Some(11)) right (Some(11), Some(11)). Deterministic in effect, not inconclusive: the member registered 848.5us after the apply wait, so the mutated leg ran PRE-swap and recorded counter None. So your value-source fallback was not needed. Restored with sha256 identity, tree clean.
- Earlier green at 21f83701 (pre-ORDER rig) 74.475s, the pair against your red at 3c23dcd1.
- treqs check: exit 0, all 8 stages. Placement note: still 5 files not placement-judged, the SAME COUNT you saw at 3c23dcd1. I did not verify it is the same SET: count equality is not identity. All my tags are in .rs files.

VARIANT DECISION: SPLIT, applyhost::apply_staged_in_broker. Reasons in its doc: apply_staged would self-dial (a brain-role client of itself, a 300-try connect against its own accept path, a restart verb answered by its own dispatch). apply_staged_daemonless restarts nothing, so the old brain would keep running under an open trial. The split shares prepare_apply + swap_and_record byte-for-byte with both CLI paths and only swaps the signal transport, to the BrainRestart object the KIND_BRAIN_RESTART handler raises anyway. Swap target = brainproc::canonical_exe() (one OnceLock capture shared with the supervisor). Prior version = the brain-announced coordinator image.

OTHER CHOICES FOR YOUR REVIEW: the broker WATCHES the release cache (2s) rather than taking a new brain->broker verb, so one watcher covers every stager (pump, heartbeat, an operator's own fetch). Retries are capped at 3 per version. The watcher never swaps under an open AppliedPending trial. broker_* classes in the set are accepted config but OFFERED until #334 (auto_applies = in set AND brain-only). The heartbeat rides UpdateWorker::poll_wake (polled every tick), so its period is its own clock; jitter comes from std RandomState (no new dep). The brain's launch path passes via env SPT_BRAIN_EXE, not argv, for N-1 argv compat. The adapters leg is due only on Applied{staged v} with the bundle staged; the new brain spawns hidden 'spt update land-bundle'; marker releases/bundle-landed.json.

NOT RUN: Linux / kitsubito (apply time there unmeasured; the rig comment says so). The heartbeat's live fetch child (no rig can reach a release channel). Units cover argv, jitter and the no-exe path only.

Pool .worktrees/w7-updater/target is still claimed (14.7 GB allocated). I'll release and tear down with the IR-150 three numbers at lane close, after your gate.