# W0 #354 lane notes (todlando, 2026-09-26)

Flags and seams the W0 build records but does not build. Doyle files the hazards.

## 1. FLAG: the registry's `rename_endpoint` has no production caller
`spt-net/src/net/registry.rs` `rename_endpoint` (the per-subnet rename with its
own collision check) is reached by no production path. `cmd_rename` checks only
`has_branch(a-<new>)` and moves the mind (`ContextStore::rename_endpoint`); the
registry converges when the renamed perch re-advertises and ghost-heal marks the
old id Offline. W0 leaves it alone, as ruled (condition 4). The mind rename
carries the endpoint uid (unit `a_rename_carries_the_uid`).

## 2. HAZARD (pre-existing, recorded, not built): a bridging node pulls two different minds with one name
REPLACED 2026-09-26 (todlando; the earlier text claimed the requester pulls
every `a-<id>` in the registry — measured false in the span rig dry run).

Before R4-8: the requester asked for a bootstrap `a-<id>` only when its OWN
visibility listed the id in that subnet, so a node that never hosted the id
pulled nothing (and a fresh span target stayed NoMind forever). R4-8 (doyle,
REQ-SYNC-BOOTSTRAP-OWNER-SCOPE) makes bootstrap refs owner-scoped: with no
local vis entry the requester gates on roster membership only and the
responder's `allows()` (the owner's sync list) decides.

The hazard AFTER R4-8: a node in two subnets, each holding a DIFFERENT
endpoint named the same, now bootstrap-pulls `a-<id>` from both. The minds
merge per file by version vector and surface concurrent-write conflicts,
including on `endpoint-uid` (the reconcile skips it as `UidExcluded`, so no
model picks one). W0 does not build a guard for it; doyle files it.

## 3. SEAM for B (#349): sibling WAKE/SUSPEND
The sibling bypass is ONE site: `access_check_with_sender`
(`spt-store/src/gate.rs`), step 1b, after the engine-room lock and before every
rule tier. It fires only when the caller passes a daemon-stamped
`sender_proven`. Today only MSG (`receive_wan`) and the presence probe do.

B's whole job for sibling WAKE/SUSPEND is one line of wire plus one call:
- stamp `sender_proven` on `RestRecord` (the sending daemon, from the
  session-proven sender, the same way `WanMessage.sender_proven` is stamped);
- at `resthost.rs` (the WAKE/SUSPEND gate), call `access_check_with_sender(...,
  rec.sender_proven.as_deref(), None)` instead of `access_check(...)`.
Nothing else: the bypass, its uid test and its units already exist.

## 4. Other W0 decisions worth knowing
- Ghost-heal keeps the uid the erased perch's last row carried. An Offline row
  with no uid would read as a name clash to a live sibling.
- The picker's remote-row "Instantiate locally" (a same-id local copy) is
  replaced by "Span to node": for a remote row it could only ever mint a
  colliding endpoint, which the held-elsewhere refusal now refuses anyway.
- The uid is minted at the HOSTING bind (`establish_perch`, both arms), not in
  the `endpoint create/start` skeleton writer: every skeleton reaches the bind,
  and one mint site is easier to keep honest than two.