# TURNKEY #212 — never-executed cells, for the deployah hand-off Intake-checklist item (LIVE this milestone): the golden hand-off carries a list of cells that exist on the head but do NOT execute in a normal golden run, each with the reason and the direction it fails. A green run that never entered a cell is not evidence about that cell, and the point of this list is that nobody has to infer which greens are real. STATUS: W1, W2, W3 and W4 rows in (33 entries). W5 (#211) is still building — its rows get appended when it gates, and the list is not complete until they are. ## From #209 (fix/209-er-inbound-local-bypass) 1. **origin_subnets EMPTY arm — deliberately carries NO unit evidence.** Ruled with todlando at build time and recorded as an evidence-PLACEMENT decision, not an omission: a unit here would prove the helper rather than the product, so a green could survive a real product change. The falsifiable site is the int-stage hole-punch cell, which carries a subnet-scoped DENY and a closed node mode in the store and still admits a local send. If that int cell is skipped for any reason, this property has NO remaining witness — that is the failure direction. 2. **P16 pin (ER perch binds no relay listener) — an artifact probe, not a behaviour.** It asserts a registry ROW (PollListener::bind -> register_address; deliver_tcp resolves by it, so no row means no T-TCP). It reads `lookup_address`, deliberately NOT `resolve_address` — resolve sweeps stale entries pre-read, which would let the probe manufacture its own None and pass vacuously. It was made red on purpose during authoring (probing at a sibling id with a real address fails). Fails OPEN if the registry shape changes underneath it. 3. **Upgrade-boundary drain — unexercised by construction.** Rows spooled BEFORE the flip carry no admission stamp and drain ungated exactly once. No cell can witness this on a fresh tree, because a fresh tree has no pre-flip rows. It is named in the REQ title and in the fulfillment; it is a rollout fact for the field, not a test gap to close. 4. **The claim's scope boundary — outside what any cell can hold.** Admission runs in the AUTHORING process, so an old or modified binary, a direct write into the spool database, or a raw TCP connect to a relay listener never meets the gate. Same-user local code is outside the boundary, and the TOCTOU between the gate's path resolution and the delivery's own falls under it (accepted under rider R4). Stated in the published claim rather than pinned. 5. **The NTFS case-fold arm is asserted as a RESOLUTION fact, not a platform fact.** The cell asserts that both spellings resolve to one perch, which is true on this platform and portable as written. On a case-sensitive filesystem the other spelling is a genuinely different perch with no engine room at it — so the cell stays green for a different reason there. Worth knowing before reading a Linux golden run as corroboration of the Windows finding: it is not. ## From #190 (fix/190-read-frame-deadline) 6. **No production caller passes a deadline on a Whole carrier at c62904e7.** The rc pump, the peer pump and the digest pull all build `cold_start_pump`, and the two deadline-aware wrappers document that production passes `None`. The defect was filed as a LATENT unbounded read one construction away, not a field incident, and the int cell constructs the condition deliberately. Nothing in a normal golden run reaches the refusal arm. 7. **The `Whole` + `None` arm is a negative control against a fabricated default.** It passes on any tree where no default bound was invented — including trees where the fix is absent. Its green is only meaningful read TOGETHER with the `Whole` + deadline arm, which is the witnessed red. Do not report it as independent evidence. ## From #206 (fix/206-is-locked-posture) 8. **`int` is NOT activated on REQ-ACL-LOCKED-POSTURE, and no int evidence exists.** Deliberate: every arm is a decision over store state with no wire and no process boundary in it. Read the doc/impl/unit greens as the whole of the claim — there is no integration leg withheld or skipped, there is none. 9. **The derived surface set is proven against a FIXTURE table, not the shipped one.** This is the subtlest cell in the lane and it is worth understanding before trusting its green. `TABLE` is a const whose only default-on row is `DISCOVER`, so a reader hardcoded to "all surfaces except DISCOVER" agrees with every shipped row and NO test over `TABLE` can tell the two implementations apart. The cell therefore drives `lockable_in(table)` with an invented table whose default-on row is not DISCOVER. If that fixture is ever "simplified" to use the real table, the cell keeps passing and stops proving anything. 10. **`ACCESS_LOCKED`'s caveat has a counter-factual-silent arm.** Where the chain already refuses that node DISCOVER, the caveat would be a wrong correction, so only the claim is emitted. A run that never reaches a still-findable endpoint exercises only the silent half. ## From #210 (fix/210-ruleset-presentation) 11. **The pipe guard is written for a case that cannot occur today.** No subject, surface or provenance word can carry a `|` at present. The escape and its pin are deliberately built ahead of the first value that could break the grid, so this cell proves a property nothing currently exercises in the field. 12. **The name-resolution degrade is the arm that matters and the easiest to read wrongly.** An unnameable node renders its FULL 64-hex — never blank, never an error, never truncated, because a truncated hash IS the defect being fixed. A golden run on a box that can name every node in its roster exercises only the RESOLVED branch. The degrade branch's witness is the pin, not the run. 13. **The resolver reads `load_existing`, never `load_or_create`.** Rendering a table must not MINT this node's identity as a side effect. On a box with no node identity yet, the self-label is simply absent and every row degrades to hex — which is correct behaviour, not a failure to resolve. ## From #208 (fix/208-session-scoped-briefing) 14. **The sweep is scoped to UNDELIVERED rows, and that scope is what bounds the blast radius.** A delivered briefing is history and cannot participate in the defect, so it is left exactly where it is. This is also why releases#177's e2e twin is unaffected — its rows are delivered — and that twin was run as its own gate leg rather than reasoned about. If a future change widens the sweep to delivered rows, that twin is the cell that will tell you. 15. **Legacy unstamped rows are dropped once, deliberately.** Rows minted before the session stamp existed are treated as stale at the first new-session sweep. On this box that was six real rows spanning sixteen days. It is a one-time drop, not an accident. ## From #213 (fix/153-update-refusal-exit) 16. **`int` is NOT activated, and the owed proof is FIELD ACCEPTANCE — the largest unexecuted claim in this milestone. It is TWO conditions, not one, and they are opposites.** Both `REQ-UPDATE-REFUSAL-EXIT-DISTINCT` (#213) and `REQ-ADAPTER-FLOOR-VS-STAGED-CORE` (#159) defer to the same live leg — one owed proof, not two — but a roll that exercises neither floor condition proves nothing about either lane. No lane can gate it and no rig can simulate it; activating `int` anywhere would either pre-fail the row or invite a simulation that proves nothing. **(i) The ADMIT case (#159's).** An adapter whose declared `min_spt_core_version` the RUNNING core does not satisfy but the INCOMING core does. Pre-fix this is refused in-cycle and the run then activates that very core, leaving the old adapter on it ungated. Post-fix it must be ADMITTED, and its registry record must register at the new version — the record matters as much as the admission, because fixing only the pre-swap peek would admit it and then refuse at the record, leaving live files new and the record old. **(ii) The STILL-REFUSED case (#213's).** An adapter whose floor NEITHER core satisfies. It must still refuse — and the refusal must render REFUSED rather than FAILED, and exit 3 rather than 1. Field verification needs an adapter manifest built for each condition; neither arises by itself on a healthy fleet, which is exactly why this has never been executed. **Prior art for the happy path only (deployah, KITSUBITO, 2026-08-04):** a real composite roll landed new core and new adapters in one invocation — broker 0.40.0 → 0.53.0 with the daemon pid changing, claude-spt 0.25.31 → 0.26.1, omp-spt 0.3.16 → 0.3.32 — post-state captured independently of that run's exit code, which was flattened and is not evidence. It shows the composite does what it claims **when nothing is near a floor**, at a v0.53.0-era baseline. It exercises NEITHER condition above and does not discharge the leg. Cite it as prior art for the happy path or not at all — the filer offered it and declined the credit themselves. 17. **The filed face of #153 was measured FIXED before the lane opened** and is explicitly out of scope: `UPDATE_FINISH_REFUSED` has returned 3 since v0.50.0 and is pinned non-zero from an endpoint context. Nothing in this lane touches it. #153 itself is CUT; #213 carries the real class one layer down. 18. **`Rejected` and `Quarantined` both answer 1, by ruling rather than by accident.** The discriminant is decline-versus-fault, NOT whether bytes moved — a tempting wrong rule that `ApplyStagedOutcome`'s own doc comment ("nothing swapped") will invite the next reader to re-litigate. That doc sentence is about blast radius, not outcome class. ## From #173 (fix/173-firewall-rule-reconcile) 19. **The unelevated arm of the wiring cell is SKIPPED on an elevated box, loudly, and must be.** An elevated install with the firewall gate off would repoint the host's product rule onto a throwaway temp-dir binary — breaking a self-hosted runner's own inbound with a green test. The always-run gated arm (`SPT_INSTALL_NO_FIREWALL` + a required `INSTALL_FIREWALL_GATED` announcement) is what CI leans on; it proves the call happened while touching nothing. 20. **The netsh/WFP effector is NEVER exercised by CI and is field-verified only.** The reconcile DECISION is pure and unit-pinned across missing / correct / stale-path / elevation-denied; the Windows effector arm beneath it is deliberately thin and deliberately untested in CI, because gating CI on elevation is worse than not gating it. 21. **The unelevated install does NOT write a durable verdict, and that is a ruling not a gap.** The inbound record is pinned to the binder's pid AND image with validity re-derived at read time, so a record authored by a short-lived installer would be discarded as Unknown by every reader — a warning nobody sees. The installer prints loudly instead; the durable record stays the daemon's, which is the only process that can honestly pin one. 22. **The field specimen is a FIELD SPECIMEN, not a gate artifact.** The defect's live witness is this node's own `inbound.json` (`path_mismatch`, an actions-runner `rule_path`, the installed binder as `running_path`) and the warning rendering on `spt subnet status`. It was re-measured independently at gate time. The lane's own red proves the WIRING; it does not re-prove the field condition. ## From #159 (fix/159-adapter-floor-staged-core) The milestone's other half of the FIELD-ACCEPTANCE leg is entry 16 above — one owed proof shared with #213, not two. 23. **The unparseable-metadata arm (c) is very nearly UNREACHABLE BY CONSTRUCTION, and the requirement says so on purpose.** `composite_abort_on_failure` is true for both FetchApply and Fetch, so a malformed stage aborts the run before the adapters leg exists at all. The arm is defence-in-depth against a state the run should already have refused, and it is documented that way because an arm with no field history is one the next reader deletes as dead code. Its failure direction is not a wrong answer in the field; it is removal during a cleanup. 24. **Two of the lane's cells are GREEN AT BOTH of its commits and are therefore never witnessed failing anywhere in their own history** — the property pin driving the peek and the record at the same basis over one manifest, and `no_stage_degrades_to_the_running_core`. Each was MADE RED ON PURPOSE once during authoring, with the panic quoted in the commit body; the peek/record demonstration reproduced the gater's own pre-correction shape (thread one site, leave the other baking `env!`, and the cell catches it). **The demonstration is in the commit bodies, not in any run** — golden re-executes the green and can never re-execute the proof that the green can red. Without those bodies the pins are indistinguishable from asserting two constants are equal. 25. **The two degrade arms take the SAME ACTION and differ only in their WORDS.** An empty `product_version` and an absent stage both fall back loudly to the running-CLI compare; the operator's next step is what differs, which is why the diagnostics are distinct. No behavioural assertion can separate them — only the text can — so a change that merges the two wordings passes every behavioural cell in the lane while destroying the distinction the lane exists for. ## From W4 lane 1 (fix/w3-line-safety-attr — the attr codec) 26. **The ADAPTER half of this contract has no cell in this repository, by construction.** The doc stage publishes the ` ` attribute rule that a clean-room decoder implements; our suite can only ever prove OUR escaper/decoder pair agree. Conformance lives in the adapters (perri's scoped decode is already field-deployed). This matters more here than for a normal additive attribute: for a trust-warning attribute, **being ignored IS the failure**, so an adapter that safely ignores an unknown attribute is precisely how a security caution goes missing. 27. **The "SEVEN lines" figure is a measurement at ONE advisory, not an invariant.** It was measured at the red on 2026-08-21 under the default advisory; the count varies with the operator override, which is why the requirement is worded "no attribute value can split the frame" and not as a number. A golden green does not re-prove seven, and nobody should re-quote seven as a property of the fix. ## From W4 lane 2 (fix/168-taught-monic-command) 28. **No cell EXECUTES the taught command.** The cells assert that the taught string IS the constructor's output — `Trigger::sender(peer)` serialized through the same serde `--triggers` is parsed back through — which is strictly stronger than a copy-compare, but nothing in this lane drives the real verb and then asserts the warning actually stops. Failure direction is exactly the defect this lane repaired: a change to the verb's ARGUMENT SURFACE (rather than to the trigger serde) leaves the taught command syntactically well-formed, still passing these cells, and dead again in the field. 29. **The `UnnamedOn` negative arm passes at the RED sha and at the fix sha, which is what makes it a CONTROL rather than corroboration.** It asserts `!w.contains("monic add")` because that arm has no endpoint id to name. Read as "the untouched arm stayed untouched"; never cite it as independent evidence that the fix works — an unchanged green is equally consistent with the change not having reached that arm. ## From W4 lane 3 (fix/74-interior-space-runs — the xtask check itself) 30. **A = 0 is a statement about THE GATE'S REACH, not about the tree — and the reach was MEASURED at the head gate and is roughly HALF the scope the requirement names.** Nominal scope is `crates/spt/src` + `crates/spt-daemon/src`, excluding `cfg(test)`, the assert family and raw strings, and the census was taken at c62904e7 plus lane 3 ALONE. At the assembled head the check was proven NOT to reach a landed defect: an eaten continuation injected into #206's `ACCESS_LOCKED` composer (cli.rs:18950, rendered run of 10, mutation proven landed) produced `xtask check: OK`, while the identical mutation before broker.rs's latch produced exit 1 naming the site — treatment and control differing only in WHERE. Cause, read from the source: the scan latches on the FIRST column-0 `#[cfg(test)]` and never resumes, on the premise that such a module runs to end of file; cli.rs carries EIGHT with production code after each. **MEASURED POPULATION, and the first figure was corrected downward before it left this file:** 88,042 lines sit after a first latch, but 66,637 of those are TRAILING TEST MODULES — out of scope under the old rule and the new one alike, so never a loss. **The production code the latch actually hid is 21,405 lines across SIX files** (cli.rs 19,918 · pump/mod.rs 1,184 · main.rs 159 · lib.rs 100 · conn.rs 43 · seedproofx.rs 1), i.e. cli.rs is 93% of it. Quote 21,405; quote 88,042 only with "of which 66,637 were never in scope" beside it. It also explains why the seven findings are all in cli.rs and none in the daemon — the daemon regions were never blind. The fix (skip the module by brace depth, resume after) plus a re-census landed as lane-3 fallout on this milestone: **census over the newly-opened region A = 0 · B = 7 · C = 0**, seven deliberate alignments, each verified against SOURCE rather than against the rendered line, each taking a per-site marker with a reason token. 31. **The check refuses only the JOIN variant of an eaten continuation, deliberately.** A continuation dies two ways: backslash deleted AND lines joined puts the indentation inside the sentence (refused), while deleting the backslash alone keeps the newline and the indentation arrives as LEADING whitespace (NOT refused, because a help block legitimately indents every line). Half the class is out of reach by design; the module doc and the requirement both say so, so greping the requirement id must not be read as the class being closed. 32. **The real-workspace bin-name cell is deliberately the WEAKEST and is asserted LAST.** It would read identical against a function that always returned an empty list. The load-bearing cells feed an INVENTED collision, and one names BOTH real counterparts so it fails if either stops existing under that name. The gate also refuses an EMPTY target list rather than passing it. Enumeration is binding: `cargo metadata --no-deps`, never `[[bin]]` manifest stanzas, which cannot see an autodiscovered `src/bin/*.rs` and would certify an absence they cannot observe. 33. **The `cfg(test)` latch had a measured BLIND ZONE and the fix for it is only proven by a witnessed red.** The first marker at ANY indentation used to end the scan; broker.rs's first is indented at 2660 on a production helper while the real module is at 8182, so the scan stopped there — 4 files and 6,375 lines of production code unscanned, 5,523 of them in broker.rs. Only a column-0 marker ends it now, and a cell pins both directions. Carry this because **A = 0 before the fix and A = 0 after it are the same number for opposite reasons**: the unchanged count proves nothing, and only the red witnessed inside the newly-opened region proves the region is reachable. ## From W5 / #211 (fix/211-intra-node-self) 34. **The `--node` help text on all six flags is HELD BY NO GATE, and this was measured rather than assumed.** todlando reported `xtask gen` as owed and predicted the docs-drift gate would red until it ran; he then RAN it and it produced NO CHANGE — the generated CLI reference carries no per-flag help for the `endpoint access` subcommands at all, so there was never any drift to gate on. That is an independent instance of **IR-52** ("docs-site CLI reference renders SHALLOW; help text below the rendered depth is outside the drift gate, unit-held per-REQ or held by nothing"), reached from the other end. Consequence for a reader of this list: the taught spelling an operator meets in `--help` — `its pubkey hex, self for this node, or a node name` — is covered by neither the drift gate nor spacerun, so **a future edit that breaks it reds nothing**. The lane was asked for a cheap unit pin over the clap help string; if it is not there, this row is the only witness. ## Known reds that are NOT this milestone's, with their measured classification - 3x `DAEMON_STOP_REFUSED` — inherited agent-identity env, env-differential proven. The gate rig scrubs OWL_SESSION_ID / SPT_AGENT_ID / SPT_ENDPOINT_ID; a runner that does not will reproduce these. Not a product red. - 1x ring reply-timeout load cell — structurally settled: `Refused` is unreachable under an isolated SPT_HOME. Load-shaped, passes isolated. - 3x fresh-pool mock-session fixture reds at ~9ms — prebuilt-fixture class; real durations on re-run are 2.3s / 3.6s. A 9ms "failure" here is the fixture not being built yet. - `failedaddr` TTL cell reds on any box under ~10m01s uptime (IR-53, landed) — Windows `Instant` counts from boot, so a cold runner manufactures this red. Fixed, but the mechanism is worth carrying: a cold CI runner is a red-manufacturing condition. - `cli::tests::adapter_translate_proof_gates_on_commit` fails under a `--bins`-only invocation because `translate_proof_fixture.exe` is not built by it — and the test says so in its own message. Prebuild it (`cargo build -p spt --bin translate_proof_fixture`) and it passes; this is why suite counts read 652 passed / 1 failed in some runs and 653 / 0 in others. Same suite, not a discrepancy. ## One thing to know before you run anything on this package **`cargo test -p spt --bins` can wedge indefinitely on this codebase; `cargo nextest` does not.** Filed as IR-55. Measured 2026-08-22: bare `cargo test` hung twice (once for 24 minutes at 13.5s CPU — blocked, not spinning), while the same 653 tests under `cargo nextest run -p spt --bins --no-fail-fast` completed in 22.2 seconds, 653 passed, 0 skipped. The cause is a test leaking a `findstr .` child under headless conhost — `findstr` with no file argument blocks on stdin forever — and a single-process harness lets that one leak block every test after it. **Golden already runs nextest, so golden is not exposed**; the exposure is to anyone reaching for bare `cargo test` locally. Two corrections worth carrying from that investigation, because both are the kind of mistake that looks like a finding: the tests at the stall frontier are CASUALTIES, not culprits — each passes in isolation in milliseconds, and skipping one merely moves the frontier. And a hypothesis that the gate's identity-env scrub was responsible is NOT supported: the isolation runs were performed with the scrub applied and passed.