# W1 #348 STOP-AND-REFER: sibling instances cannot coexist in one subnet's registry (todlando, 2026-09-25 ~13:15Z)

## What happened
Two-host int (`crates/spt-daemon/tests/twohost_axes.rs`, authored, untracked, NOT committed) was dry-run on one box with two daemons over 127.0.0.1. Pairing worked. Cell 1 failed: B's Wake never reached A. Both logs print:
`REGISTRY_COLLISION:twohost:endpoint id 'axes-ep' already exists in this subnet on node(s): <peer>`

## Mechanism (read, file:line at 9ac79808)
- `registryhost.rs:751-771` `advertise_local` sends EVERY own row through `advertise_if_visible` → `SubnetRegistry::join_endpoint` (`spt-net registry.rs:753-771`).
- `join_endpoint` (REQ-INST-9, the D3d bare-id collision check) refuses whenever ANY other node holds a row for the id, Offline rows included. The refused row is merged neither locally nor pushed.
- Result: once a node has learned its sibling's row, it can never advertise its own row for that id again. The first round of each side got through only because both were in flight before either side held the other's row.
- The #348 units never hit this path: they feed rows straight into `apply_feed_batch`, whose receive path uses `merge_instance`.

## Why it is not W1-local
- REQ-INST-9 is a deliberate guard: two DIFFERENT endpoints minted with the same bare name in one subnet. Today the registry cannot tell "a different endpoint with the same name" from "another instance of the SAME endpoint".
- No sanctioned second-instance path exists: `instantiate-anywhere` is reserved-but-refusing (`grants.rs:21,40`). So at this sha, multi-node siblings of one id are effectively unshipped in a single subnet.
- The whole INSTANCE-AXES milestone (and #345's resolver "the unique active instance") presumes they coexist.

## Options (my read; the ruling is yours)
1. **Discriminate at join.** A row joins as a sibling when it proves it is the same endpoint: same home/anchor subnet AND the same mind branch (`a-<id>`), or a per-endpoint identity token minted at creation and carried in `info.json` + `Instance`. It collides only when the proof is absent or differs. Needs a new field and its own REQ. Cleanest, but it is a new decision class.
2. **Collision check at MINT only.** Move REQ-INST-9's refusal from every advertise round to endpoint creation/rename (`spt endpoint create`/`rename`/`fork`, which already collision-check). `advertise_local` then uses `merge_instance`. Smaller change, but a same-name endpoint minted while partitioned would silently merge as a "sibling".
3. **Defer the int.** Land W1 impl+units now; the int rung waits on a sibling-coexistence request, which could be a new W0 of INSTANCE-AXES. treqs stays red on the 3 int stages until then.

## State held
- Lane head 44dafc4b (impl 9ac79808 + ring unit). twohost_axes.rs is kept UNTRACKED: its int tags would turn treqs green on a red test.
- One-box commands and results: role A panicked at cell 1 (`did not converge within 15000 ms: B's wake reached A`), exit 101, 16 s. Role B timed out downstream, exit 101. Registration barrier 159-160 ms. No METRIC lines yet.