# Third blind read: `endpoint digest --json` @ `a477e59` (PR #41)

**Reader:** perri · delta sections only · run-identity and exit-0 seeds excluded as instructed.

## 1. What I would build

A **follow-primary consumer with a resubscribe loop**, plus a slow unconditional snapshot pull that
is doing *two* jobs: the correctness belt from the 1-2-3 discipline, and my wedge detector (the
alive-but-silent case the page names). Concretely: subscribe → apply base at `from == 0` → apply
each delta by truncate-to-`from` + append → dedupe within the stream on `(turn index, entry index)`
with the trailing entry replaced in place → on exit, resubscribe **with backoff** (see 3c) → never
branch on the exit code. Snapshot path keeps `--after` cursoring on the highest agent-produced `seq`,
`after_predates_window` as the missed-rows signal, and the `(version, max seq)` pair as an
optimization only.

The 1-2-3 numbering is the right shape: it makes the belt a *step*, not a footnote, so a reader
cannot adopt the cheap half and skip the load-bearing half. `--last`/`--after` marked "ignored under
`--follow`" and the always-full-base rule both land — nothing left to infer there.

## 2. What I would still have to infer

- **"Default window depth" is never given a value or a way to query it.** It is now load-bearing
  (referenced by `--last`, and a follow subscription "always uses the default window depth"), so I
  cannot size a buffer, cannot predict how much history a base update carries, and cannot tell
  whether my retained view is deeper than the server's. I would hard-code a guess.
- **`--follow` against an endpoint that is torn down** (not the daemon — the *endpoint*). Does the
  stream end, or hold open forever on a dead endpoint? On a branch named `teardown-authority` this
  is the question I most want answered, and a watchdog that follows a torn-down endpoint waiting for
  activity that can never come is precisely the failure my component exists to prevent.
- **Backoff policy on resubscribe** — see 3c; the page gives the instruction without the constraint.
- **Which window depth the pair is computed over.** `max seq` is "highest agent-produced seq" in the
  returned window, so comparing a pair captured under `--last 1` against one under default depth is
  a false negative. I infer "hold the depth constant"; unstated.

## 3. Reads as safe, but is not

**(a) Step 2 names the partial-turn seam as *the* place the pair is blind. There is a second one, and
it is my v0.25.2 failure class.** `Boundary`/`Context` entries carry no `seq` — the page says so
itself two paragraphs down ("a `Boundary`/`Context` can appear in a window without moving any
`seq`"). So a change consisting *only* of injected entries never moves `max seq`, on a **closed**
turn as much as an open one. In the same restart-collision conjunction step 2 describes, the pair
matches on both halves while an `echo_mirror` or a `/clear` boundary has landed. That is exactly the
content that black-holed my endpoint for 37 minutes: injected entries that mean something changed
while every agent-produced number sits still. Step 2 currently reads as an exhaustive statement of
the blindness; a consumer who satisfies it believes they are covered. Suggest generalizing rather
than adding a case: *the pair only detects changes that move a committed agent-produced `seq`;
injected entries and open-turn content are both invisible to it, which is why step 3 is mandatory.*

**(b) `(turn index, entry index)` is stable within a stream, not across snapshot pulls.** The
de-dupe paragraph sits in the general section and reads as a universal key, but a *window index*
shifts as turns age out of the window. Under `--follow` that is safe, because a slide forces a
`from == 0` full replace — the page says so. A **snapshot** poller has no such signal: between two
pulls the window can slide and every turn index silently renumbers, so a consumer keying dedupe or
"already handled this" state on turn index mis-keys after any slide, with no error. Suggest scoping
the paragraph explicitly to a follow stream, and pointing snapshot consumers at the durable
identities they already have: `input_seq` for a turn and `seq` for agent-produced entries.

**(c) "Treat 'follow exited' as 'resubscribe'" invites a hot loop against a down daemon.** If the
daemon is stopped, the subscription drops immediately, and a consumer that follows the instruction
literally resubscribes immediately — spinning as fast as the process can spawn, against exactly the
condition (daemon down) where it does the most harm. The instruction is right; it needs the
constraint attached: resubscribe with backoff, and treat a subscription that ends *before* its base
update as a failed attempt rather than a normal end. One clause on the same line prevents a class of
consumer that is only visible in production as CPU burn.

## Verdict

The three inputs from the last round all landed correctly, and the follow section is now
implementable cold end to end. **(a) is the one I would fix before merge** — not because it is new
physics, but because step 2 currently reads as exhaustive and it is not, and the gap it leaves open
is the same one that has already cost this fleet a silent 37-minute delivery outage. (b) and (c) are
one clause each.