---
name: rt-a4a-minter-namespace-blocker
description: RT-A4a (REQ-OPID-MINTER-NAMESPACE / ADR-0034) BUILT — minter enum {Legacy,Cli,Pump,Rc,Shell,Wake}; MintedOp newtype threads minter through brain/daemon; 8 production stamp sites. The two map-misses (shellchan, forward_wake) taught: tag names the SEQ SOURCE, never the subsystem.
metadata:
  type: project
---

REMOTE-TRUTH A-4a (minter-namespace the broker effect-journal key) — BUILT on the
corrected model (branch remote-truth; left dirty for todlando to commit). ADR-0034
Decision 1 + Amendment 1 (@a09381e) + Amendment 2 + Addendum (@602beda / doyle).

**Final model (all my recon leans, doyle-ruled):**
- Enum `Minter { Legacy, Cli, Pump, Rc, Shell, Wake }` — TEXTUAL `as_tag`/`from_tag`
  (no numeric discriminant; key hashes the enum). Psyche/Epoch DROPPED (they are the
  `EpochSource` notif/lease domain, never `apply_once` producers — `from_tag("psyche")==None`
  is a test). `EffectKey{class,minter,op}` struct. Wire = additive `Option<Minter>` on the
  4 msg.rs reqs; broker materializes Legacy at decode. `MintedOp{minter,seq}` newtype
  threads the minter through brain/daemon (NOT wire structs) so forgot-to-stamp is uncompilable.

**THE governing rule (doyle, learned from TWO map-misses):** a minter tag names the
**minting SOURCE (the seq's counter origin)**, NEVER the subsystem/file the call lives in.
Subsystem-based stamping is the named anti-pattern — it caused both misses.

**8 production stamp sites (site → minter → seq source):**
- wansend.rs wan_rest_with / wan_shell_link_with → Cli → cli-ops.json epoch
- rc.rs request_attach_endpoint → Rc → rc OpMinter (random 63-bit base)
- attach.rs serve controller input (no_ack) + pending flush → Rc → operator AttachRecord op_id
- pump/mod.rs PeerIo::open_op (feeds request_sync/request_update) → Pump → pump-ops.json
- shellchan.rs deliver_stdin_pending → Shell → spool row_id (NEVER re-minted; the durable id)
- shellwake.rs forward_wake → Wake → now_ms() (its OWN source; NOT shell — the 6th variant)

**The two map-misses the "complete" ruling maps omitted** (both found by MY exhaustive
sweep, both live journaled producers): (1) shellchan spool delivery — collision with rc ops
on same shell_sid, a real bug; (2) shellwake::forward_wake request_rest — collision-immune by
magnitude but still needs a tag. Lesson: request_rest has TWO callers (wansend=Cli,
shellwake=Wake); the seq source, not the helper, decides the tag.

Gates all green: effect::(12) nethost::(8) broker::(22), spt --bin spt(323), clippy -D
warnings clean (both crates all-targets), traceable-reqs 401/401 exit 0. RED-first proved
for recover_is_migration_free + shellchan_and_rc_same_session_dont_collide by temporarily
collapsing EffectKey Eq/Hash to ignore minter (old 2-tuple) → assert_ne fails at the bug.