# doyle ruling on W0 #354 census + picks (2026-09-26)
All seven picks are ACCEPTED as written, with the answers and conditions below. Build.

## The three asks
- **(5) subject = the spanned endpoint:** ACCEPTED as a per-ENDPOINT rule on the target node, keyed by the id (not a SenderEndpoint subject). It states exactly the operator's "endpoint X may / may not span to node B". Fork is the precedent. `default_on: false` = the standard mode chain, as ruled (R4-3). Row desc is operator-language; keep yours.
- **(6) sibling WAKE/SUSPEND:** NOT in W0. Handoff is #349 (B). Build the bypass site so B only has to stamp `sender_proven` on RestRecord and nothing else. Name that one-line seam in the lane notes, for B.
- **(7) picker:** BOTH row kinds. The operator's shape: "Span to node" → a list of the nodes the endpoint can span to. A local row offers it too; its list excludes this node and any node already hosting an instance.

## Conditions
1. **held_elsewhere counts Offline rows,** consistent with REQ-INST-9 ("a resting endpoint still owns its name"). The refusal text names `spt endpoint span <id>`. A unit per mint site (3).
2. **Bypass unit set:**
   - a sibling MSG under a CLOSED node posture is allowed and reports `Allow(Sibling)`;
   - under the engine-room inbound lock, a sibling MSG is still refused (step 0 precedes);
   - an equal id with a different uid is not bypassed;
   - an absent uid on either side is not bypassed.
3. **The uid is not a secret, and is not described as one.** CONTEXT.md states R4-6 plainly: holding the mind = may become a sibling; the uid distinguishes identity, it does not authenticate. You write that CONTEXT section as the doc stage (define: endpoint uid, span, sibling bypass, trust boundary; and amend the instantiate-anywhere line: a same-identity instance on a new node is now `span` under ENDPOINT_SPAN, while fresh-spawn by another node's AGENT stays deferred). I gate the wording.
4. **Fork re-mint + rename carry:** a unit each. The dead registry `rename_endpoint`: record it in the lane notes as a flag only; do not touch it.
5. **Pre-existing hazard, recorded, not built:** a node bridging two subnets that each hold a DIFFERENT endpoint named the same pulls both a-<id> minds. That exists before W0. Note it in the lane notes; I file it in the infra/findings register.
6. **Int, two-host:**
   - span B from A (remote arm) with ENDPOINT_SPAN open → both rows coexist, and neither log shows REGISTRY_COLLISION across ≥3 advertise rounds;
   - the same with the target posture closed and no rule → `SPAN_REFUSED` (whatever your token is), nothing spawned;
   - a different-uid same-name endpoint still collides.

   Then W1's held int (twohost_axes.rs) runs on top of W0 in the same rig.
7. REQs: mint the 6 you listed. First lane commit: doc/impl/unit on all; int on SIBLING-JOIN + SPAN-VERB. Commit refs: (releases#354).