# doyle pre-gate of W1 #348 @44dafc4b (2026-09-25 ~13:20Z)
Read-only review at the pinned sha. #1, #3, #4 and #5 were re-read by doyle at 44dafc4b. Fix these on the lane while the int is held (see sibling-collision ruling, pending operator).

## MUST FIX
1. BLOCKER api/mod.rs:802 — the Wake tap fires on busy+payload reports of text CORE injected (peer envelopes). REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT (toml:7876) already states such reports happen and excludes them ("OWN-INJECTION EXCLUSION ... physically wrote into that session's PTY"). So a sibling's normal msg -> injected -> busy report -> Wake -> steal. That breaks R2-3, and shell frames break R2-1. Fix: the tap must reuse the EXISTING physical-write evidence (one matcher, not a second one). Where the tap then lives is yours; state it. Unit: a report whose payload equals a core-written delivery does not wake; real user input does.
2. MAJOR dispatch.rs:1411 — the demotion pre-check reads raw `read_rest` (None when rest_state is absent), while advertise uses `effective_rest_state` (void intent reads Active). A record with no rest_state (pre-D9-2, engine-room skeleton via create_anchored_skeleton + startup.rs:776 carry) advertises Active and never demotes. Use the effective reader (REQ-EFFECTIVE-INSTANCE-STATE). Unit on the absent-rest_state arm.
3. MAJOR resting.rs:1062 + startup.rs:776 — a legacy `dormant` left by the deleted Detach edge persists across upgrade. A SOLE instance, dormant from an old detach, auto-suspends under dormant-enable (your own test pins legacy -> Suspended). That contradicts overview.md:89 and the release note. Fix: a missing controlled instant fails WARM, like the missing dormancy anchor two lines above. And/or re-derive a legacy dormant with no active sibling to active on first boot. Repin the test.
4. MAJOR resting.rs:524 sibling_view_from — any row reading Status::Active counts, with no freshness/lease check. On hard loss of the active node the row never decays, so R3-1 "node loss VACATES" is not implemented. Name the mechanism that ages a lost node's Active row (visibility lease / epoch lease?) or build one. A unit either way.
5. MINOR resting.rs:43 — REQ tag at the file top (rule 1). Remove it; :170 carries the evidence.

## SHOULD FIX (say fixed / not, and why)
6. dispatch.rs:1403-1421 — the comment "race lands as harmless no-edge" is false: transition(Active, SiblingActivated) has no rank guard. Re-check rank inside the transition host, or correct the comment by replacement.
7. startup.rs:766 come_warm_landing stamps active+counter without request_advertise_now(). The docs promise "within one registry push".
8. wan.rs:1234 `sender_proven.unwrap_or(msg.from)` — an older sender's qualified `from` (ling@node) != bare target, so a same-id msg steals. Normalize to the bare id before compare.
9. Admission table — add rows: notif.rs:253 (busy-only, never steals), broker.rs:2371 engine-room briefing (RULED: a core-authored self-briefing spooled to the engine room's own perch at admit, coinciding with ComeWarm -> never classified, not a steal), broker.rs:5263 respool (empty sender), shellchan.rs:346 (empty sender), wan.rs:1085 trust warning (core-authored, never steals; moves to the now-signal in #346).