# W3 feat/322-adapter-peer-propagation — JIT (todlando, 2026-09-24 ~10:50Z)
Dispatch: doyle msg PSPWZWYU (10:43Z). Worktree .worktrees/322-adapter-peer-propagation, branch off 6c95d691 (W2 head, PR #252 gating) — NOT main. If W2 gate forces change, doyle says; rebase.
BOX RULE: NO local cargo on hfenduleam until doyle clears (#252 Windows unit live). Read/author only. Pool not yet claimed (claim from worktree with prebuilt main xtask.exe when cleared).
Issues: releases#322 (adapter updates stage across subnet like core; update-on-demand checks peers first; `--remote` = force release channel), releases#264 (`spt adapter add <name> --via-subnet|-vs`: roster in peer-pump registry entry; install from first peer holding it; subnet-installed adapter keeps updating via p2p; `adapter list` "available" section = W8 rendering, only DATA PATH here).
CONTEXT.md:703 "update source" ruling: order pinned -> learned -> other peers -> release channel, core AND adapters; --remote forces channel, --via-subnet forces peers only. (sources.json = W4 #339; W3 = peers-before-repo without the source store.)
JIT-PLAN W3 bullets (.spt/preserved/331/JIT-PLAN.md):
- Peer-pump registry entry publishes adapter roster (name, kind, version, .spt sha256, signing_key if declared).
- AdapterQuery/AdapterOffer + W1 FetchAsset `adapter:<name>` (UpdAsset reserves adapter:<name> -> cache adapters/<name>.spt).
- Requester verifies: declared key when present (detached sig like gh_release) else roster sha over authenticated peer stream. request_asset has NO digest gate + ignores Done{total} -> caller verifies BEFORE staging. PR body: trust argument + cite MANIFEST.md trust paragraph (~757 "Trust — optional signing, fail-closed").
- `spt adapter add <name> --via-subnet|-vs` installs from first peer holding it; `adapter add/update` try peers before declared repo; record install source on registry record; `--remote` forces repo.
- Serve side needs the .spt bytes: retain installed adapter archive in release cache (adapters/<name>.spt) on install/update so a peer can serve it.
- Int on two-daemon rig using hertz H3 fixtures crates/spt/tests/peer_rig/{adapter.rs MockAdapter (signed_by, archive, roster_row), inproc.rs, wait.rs StreamCursor, signing.rs, bundle.rs}: B installs mock adapter A holds; then updates from A when A newer. Rig never ran in CI -> if int reds INSIDE rig, tell doyle immediately (routes to hertz).
- REQs FIRST in toml; tags same commit; treqs 0.4.1 exit 0; assert [[requirements]] header count == id count after any toml merge; clippy --workspace --all-targets -D warnings; never cargo fmt; trailer `Co-authored by: todlando`.
FIRST STEPS after wake: read W1 code (propagate.rs request_asset/serve side, UpdAsset in spt-net net/update.rs, pump registry entry publish in spt-daemon pump), read peer_rig/*.rs, read cli.rs adapter add (~21100) + update_one_adapter; design + mint REQs; author; wait for box clear.
Pending lane closes: W2 after #252 lands -> pool-release .worktrees/335-adapter-leg/target with prebuilt main xtask.exe, classify+reap, worktree remove; kitsubito ~/spt-w1 pool label w2-335-kitsubito release.
If #252 Windows unit reds with DLL/link (0xc0000142) = VOID (hertz contention 10:39Z), doyle reruns.
## doyle rulings 10:51Z (msg 573UIF5R) — DESIGN GO with conditions
(1) W2 REQ groups ride W3 toml commit (DONE in worktree): PARALLEL+PRUNES -> self-update; PARALLEL+EXEC-BIT -> adapter-harness-contract; EXEC-BIT -> install-bootstrap. PR body: say these are W2 riders + why (rule 7; not re-pushing #252 mid-CI).
(2a) TOFU LOUD: print anchor at install (adapter, key id, WHICH peer); store it so adapter list / update status can show it later.
(2b) Unsigned subnet install says so on stderr (like ADAPTER_UPDATE_UNSIGNED); PR body trust argument vs MANIFEST.md trust paragraph.
(2c) Verify sha==offer BEFORE staging; CAP the serve-side read (peer-triggered now) — serve refuses archive over cap.
(2d) PR body: peer sha newer-but-unknown vs repo declared version — which wins; never downgrade (W5 shape).
Box: STILL HOLD; hertz gets window first (H2 compile), me second.
## doyle 10:57Z (5WKZ2VL7): W2 LANDED main=6c95d691. Branch base = main now.
- TODO W2 lane close: pool-release .worktrees/335-adapter-leg/target (prebuilt xtask), classify+reap, worktree remove; kitsubito ~/spt-w1 pool release (label w2-335-kitsubito).
- F1 (fold into W3, W2-adjacent commit): entry_exec containment LEXICAL — `{adapter_dir}/../victim` passes starts_with. Verify first, then canonicalise or refuse `..` component. Module doc claims otherwise.
- F2: amend REQ-ADAPTER-UPDATE-PARALLEL title: drop "finish in about max not sum" stopwatch wording -> state-gated evidence (PARALLEL_WALL printed unasserted).
- Box: hertz first (H2 compile); start cargo when hertz says done or doyle pings.
## STATUS ~11:25Z
- W3 authored + committed c2ca0761 on b4490c4f (branch feat/322-adapter-peer-propagation, NOT pushed, NOT compiled). treqs pre-int: only int missing; int = crates/spt/tests/adapter_peer_e2e.rs (two real daemons, CLI-level: add -vs, peers-first update, --remote, tamper).
- Also: dispatch classify "adapter_query" -> Update family (would be dropped as stranger otherwise!). W2 riders F1 (canonical inside()) + F2 (title) + groups done.
- W2 lane closed on hfenduleam: pool released, target reaped (free +93.65 GB during reap, not solely attributable), worktree removed. kitsubito ssh TIMED OUT 11:2xZ -> retry pool release later.
- NEXT when box clear: pool-claim .worktrees/322-adapter-peer-propagation/target (prebuilt main xtask), cargo build/clippy, fix compile, run unit (spt-net registry/replicate/update, spt-daemon relcache/propagate/dispatch, spt-runtime entry_exec, spt cli/wansend new tests) + int adapter_peer_e2e; `cargo run -p xtask -- gen` to regen docs-site/src/cli/reference.md (new flags); `--version` smoke (clap stack overflow risk from new args); treqs exit 0; push + PR (body: trust argument vs MANIFEST.md trust para, TOFU loud, peer-vs-channel rule never downgrade, W2 riders).

## 11:45Z: rebased onto c185326b -> debd44f9, pushed, PR core #255 open (uncompiled flagged in body). Waiting box-free from doyle for cargo --jobs 2. Give doyle F1 unit RAW output.

## 12:00Z: run 35995451280 @98ae312e in progress. Land order #256 -> IR-146(c) -> W3: REBASE (not merge) W3 onto new main tip before handoff. Handoff incl F1 unit raw output (get from Windows/Linux unit log).

## 12:10Z doyle LVRZ7LZJ: box window GRANTED after run 35996160079 Windows unit JOB terminal (read the job). Conditions: own-worktree pool claim, --jobs 2, release at close; NEGATIVE CONTROL first on adapter_peer_e2e (break assert -> RED -> restore -> GREEN, report test id + broken assert); xtask gen then READ diff; report neg red, green, gen diffstat; then rebase on main tip + hand off.

## 12:45Z HANDED OFF W3: head 66bf3c00 on main 9aa011ac pushed; negctl red + restored green + gen done; pool released. Pending: re-rebase if IR-146(c) lands first; doyle gate; finding re gh_release PENDING/dead ADAPTER_INSTALLED arm offered as issue.

## 12:40Z doyle TGJ34O6T: HANDOFF ACCEPTED @66bf3c00. Finding filed by doyle (not me). Do NOT re-rebase until doyle says main final (#258 then IR-146). W4 feat/339-update-sources: branch off FINAL main only when doyle releases; reading allowed.

## 13:25Z W3 rebased+pushed f772bcc9 on main 70e17bac (doyle gate PASSING); PR body fixed. Awaiting CI on f772bcc9 + doyle land sha -> branch W4 off it.

## 13:40Z pushed b69a0922: help-text tracker codes removed + adapter_peer_e2e added to HEAVY (nextest.toml + golden.yml); xtask check exit 0. Awaiting CI + land.