# Round 5 — implementation audit against `endpoint digest --json` @ `80b610d` **Form:** audit, not review — does claude-spt's code (shipped healer + the planned `--follow` rewrite) do what this page says, and where does the page fail to say what our code needs to know. Filed seeds (hub contamination; no durable id for injected entries / preamble turns) excluded. ## Headline: our shipped healer is the publisher the new rule exists to stop The page now says: *"Programmatic consumers: use the default depth. `--last` is a human / one-shot flag … a non-default `--last` is a write into shared daemon state."* `interrupt_watch` does exactly the prohibited thing: `spt endpoint digest --last 12 --json`, every 15s, per hosted live endpoint, for the life of every live session. It is not an edge case — it is our only digest consumer, and it runs continuously on every node. **And the trace I sent yesterday was claude-spt contaminating itself.** Both depths in it are ours: | Frame | Depth | Source | |---|---|---| | 1 (`turns=6`) | 6 | `adapter/claude-spt.toml` → `[digest] window_turns = 6` — our configured default | | 2 (`turns=12`) | 12 | `interrupt_watch::WINDOW = 12` — our watcher's `--last` pull | So the observed oscillation is our own default projection being republished at our own watcher's depth, every 15s. Any third-party follower of a claude-spt endpoint has been riding that. (The 6→ `window_turns` mapping is inference from our manifest; decidable inside `digesthub.rs`.) ## Finding 1 — the page's own escape hatch is uncomposed, and it is the fix Two true statements, never joined: - *"Programmatic consumers: use the default depth."* - *"an adapter's `[digest]` config can change that default"* (default-depth row). Compose them and an adapter author gets the answer: **configure the default you need, then pull without `--last`.** That is the sanctioned way to have a deeper window without becoming the publisher — and it is exactly our fix (raise `window_turns` 6 → 12, drop `--last` from the watcher; correctness from the v0.25.1 buried-marker RCA preserved, writes into shared state eliminated). I only found it because I had our manifest open while reading. A reader without it takes "use the default depth" as "you cannot have the depth you need" and either violates the rule knowingly or regresses their correctness. **Suggest one clause on the default-depth row:** *if you are an adapter and your consumer needs a different depth, set it in `[digest]` rather than passing `--last`.* **Corollary worth stating in the same breath:** a programmatic consumer that is *not* the endpoint's adapter cannot set the default and therefore genuinely cannot get a non-default depth without contaminating others. For them the rule is a hard constraint, not a preference. The page should say so rather than let them infer that some flag must exist. ## Finding 2 — correcting my own round-4 certification (torn-down ⇒ empty ⇒ safe) I certified to you that our healer was "safe by luck" against the teardown trap: an empty digest parses to `None`, and `heal_decision(None, …)` HOLDs. **That certification was broader than the facts now support.** The grounding in this revision — the digest projects from on-disk records, so a torn-down endpoint *with history* serves real last-known content indefinitely — means the empty case is only the record-less one. Audited the actual path: for a torn-down endpoint whose frozen final window contains an interrupt marker and whose last turn shows no agent activity, `heal_decision` returns `should_mark_idle = true` and the healer fires one `state idle` against a dead endpoint. The heal-once latch bounds it to a single write, and the frozen content never changes so it never re-arms — so the impact is one futile state write, not a loop. Exposure is narrow (the watcher dies with its translate host, so it needs an endpoint torn down while its host survives). **Low severity, but my earlier "safe" was reasoning from a premise this revision falsified, and I would rather correct it than let it stand.** ## Finding 3 — the follow rewrite is blocked on Finding 1, not on preference `--follow` ignores `--last` and always uses the default depth. So the follow leg's window *is* `window_turns`. At today's 6 the migration would silently narrow our marker-detection window from 12 to 6 — a correctness regression against the v0.25.1 RCA, invisible in testing because it only bites when messages pile up between an Esc and the heal tick. Raising the default first makes the migration viable; without it, follow is not a drop-in. This is the page working as intended: it told me the constraint before I wrote the code. ## Audited clean (stated so the clean parts are on the record too) - **Preamble turns.** The new text notes a preamble turn (`input: null`) is where `Boundary` entries live. Our marker scan is `input → as_str → is_interrupt_marker`, and a `null` input yields `false` via `unwrap_or(false)` — no panic, no false marker. Correct by construction. - **Provenance.** Our activity test counts `Agent`/`ToolSprint` only and never `Context`/`Boundary` (the v0.25.2 fix) — matches the page's predicate exactly. - **Trailing non-JSON.** We read only the first JSON value; the page's stderr-clean guarantee makes that belt-and-braces, not required. - **Marker-turn handling.** We never read the marker turn itself as a resume whatever is filed onto it, which is the same rule the page derives from injected entries carrying no `seq`. ## Where the page still does not say what our code needs Our interrupt detection rests on a **harness marker string appearing in `Turn.input`** (`[Request interrupted by user`). No entry kind represents an interrupt, so the contract cannot express the thing our watchdog exists to detect, and we depend on transcript text the page does not promise is stable. I raised this in round 1 and it was reasonably left out of scope — recording it here as a standing dependency rather than a defect, because the audit form is where it belongs: if that string ever changes, our healer silently stops healing and nothing on this page would have warned us.