Todlando signoff handoff — 2026-09-06, operator-requested omp-spt 0.9.0 update

Immediate return task (doyle delivery17): #189 landed; main was17815c9c. Rebase PR#190 docs/nits-0672 onto17815c9c AFTER resume, not before shutdown. Worktree .worktrees/docs-nits-0672. Local commit30411838 already includes the requested recorded-cwd anchor sentence; not pushed. Remote PR#190 still hasd5b0a123. Use an explicit old-head lease when eventually pushing. The anchor is beside the project-tier paragraph; after rebase, keep it beside the no-project-anchor clause from#276. No newREQ. Existing tag covers it. Anchor treqs/mdbook gates passed, actual exit files read. Original five-item docs gate also passed; PR body .spt/pr-body.txt inside docs worktree contains details. Update PR scope/provenance for anchor and rebased SHA, then follow doyle's ff gate. Do NOT amend/rebase it pre-signoff: doyle explicitly deferred until after the update.

#276 DONE: PR#186 landed ff on main914805d112b82088595e6b0e70dde7c6dd9327c6. Doyle confirms both OS green on rebased head and1/1 pick. No more work there.

#277 + #279 DONE as code/gates, awaiting PR gate/rollout:
PR https://github.com/BigscreenVR/spt-bs-core/pull/191
branch fix/277-iolog-seq-reset; worktree .worktrees/iolog-277
commit f94520082a126ce71fe31777312d5ce1ee6fb08f; base914805d1
CI34034857393 queued at handoff. No merge performed.
Ten scoped files. iolog reads tail bytes/drop fragment/lossy decode. One full byte-prefix integrity scan per append detects every non-increase and global max (first<last alone is UNSOUND for1,2,1,3); no persistent sidecar/cache. Repair under exclusive lock renumbers retained file-order rows above global max, preserves exact JSON payload bytes, checks exhaustion before mutation. Position trim keeps1000 above1250. Public read_after_at now returns IoLogRead{rows,head} from one shared-lock snapshot; all callers migrated. API uncapped quiet/oversized cursor returns true head; capped remains last-delivered to avoid loss. Session stale cursor resync regression. Lazy reserved_bind_refusal FnOnce probes only reserved IDs; both bind/listen callsites migrated; ordinary real-bind stderr test.

Final Windows AND kitsubito gates on914805d1 passed: own-pool claim, disk floor, treqs, workspace-bins prebuild, xtask check, clippy -p spt-store -p spt --all-targets -- -D warnings,24 store units,40 API BINARY units (--bin spt, not --lib),7 real CLI e2es, mdbook. All20 final aligned-*.exit files read0. Four mutations red100 and restored: UTF8 falsehead0 vs32; value-filter retention; oversized/stale cursor3vs2 and99999vs1; eager ordinary-ID probe. Entire final gate run after mutation restoration. PR body records the JIT mutation nuance: independent full append scan means restoring ONLY tail read_to_string no longer itself mints1; direct tail-reader assertion catches it. Worker_seq census: whole decimal .wseq, no tailseek, not kin. No live log or deployed binary modified; live field acceptance remains after core rollout/restart (unique seq count == events; next append max+1).

Evidence Windows: .worktrees/iolog-277/.spt/gate/aligned-*.{raw,exit}; pre-alignment and mutation records retained alongside. Linux: /home/reavus/spt-w1/.worktrees/iolog-277/.spt/gate/aligned-*.{raw,exit}. Linux branch gate/iolog-277 remains at base914805d1 with exact applied patch, no commit; own target pool. Aligned patch SHA2565355b3f3f225c4e490b05964d539f48ecc7653a47c16305185e5cd80f241e37a. Both worktrees own independent pools; never share targets. No Linux/Windows jobs still running at handoff. Temporary mutation edits are all gone. Formatting initially expanded346 files; all336 unrelated formatter-only files were restored, six small files re-applied in original style, leaving ten intended files before gates. Do NOT cargo fmt --all again: baseline is not globally formatted.

Todo bridge warning: eval's tool.todo mutations did not persist into Main's list; use direct todo calls. xd report filed.

Broader queue after resumed docs/PR gates: #280 MSG_IN from api-listen relay edge, then W0. Do not silently conflate #277 with adapter wake parsing or digest sequence. W0 changes remain UNVALIDATED in .worktrees/ws272-w0; see that worktree's .spt/w0-hold-state.txt. Includes serving registry, ADR0056 routing precedence, ADR0058 kind-independent ttl_ms/audience amendment, reserved-hostname warnings, and driver free-GB/floor rider. No W0 cargo/analyzer ran in this session. Preserve all that work and coordinate scheduling with doyle before validation. Prior todo hold notes are stale on the global release hold (deployah already published0.67.1), but W0 still follows the thin-lane queue.

Operator explicitly requested signoff at a good point; doyle will confirm offline and run spt endpoint resume todlando promptly. Notify doyle BEFORE invoking spt endpoint shutdown todlando. Own identity confirmed by spt whoami --json: todlando/live_agent. Shutdown is graceful and fires final context save; do not use endpoint stop or erase.

RESUMED UPDATE — 2026-09-06 ~13:21Z (supersedes heads and shutdown uncertainty above):
Doyle confirmed OFFLINE13:06:39Z, resumed session21 at13:08Z, ONLINE13:08:12Z. Do not sign off again without a new instruction.

#190: local30411838 rebased to bb25787aee5e809b1ab00581c4e990b158af05f3 on17815c9c04be73bfb63a3649071d6101dbd131e5. Exact old d5b0a123 lease succeeded and remote was read. Anchor is immediately before the landed #276 no-anchor paragraph, lines242-254. PR body updated. resume-pick-audit:1 match,123/123,digest3a113d322fd2; resume-traceability and resume-mdbook both0; all three exit files read. Doyle CONTENT PASS. CI34035348763 was queued. Landing order #191 -> #192 (hertz floor trio) -> #190. Await doyle's NAMED post-two-landings target; one more rebase with explicit bb25787aee5e809b1ab00581c4e990b158af05f3 lease.

#191 handback COMPLETE: current published head b1ce4bafd91958a628abb1858c81c8f744bd27a9 on same914805d1, one amended commit,10 files580+/121-. Restore both assertions in engineroom::tests::the_perch_minting_verbs_admit_the_reserved_id_only_as_a_completion: refusal contains spt rc engine-room; Some(refusal)==engineroom::reserved_id_refusal(er). Ordinary-id panic-closure cell retained. No new runtime change. Full two-OS71-test evidence belongs to prior f9452008, NOT relabeled.
First attempt5bfb4155 omitted the engineroom:: qualifier; clippy and nextest compile-exited101, no tests executed. Told doyle immediately; not landable. Those six raw/exit files retained under review-at5bfb4155-*.
Fresh b1ce4baf Windows review-clippy.exit=0; review-engineroom.exit=0 (14 run/14 passed/742 skipped, both requested cells executed); review-traceability.exit=0. All exit files and both requested raw logs read. Paths .worktrees/iolog-277/.spt/gate/review-{clippy,engineroom,traceability}.{raw,exit}. Temporary review-gate.ts removed. Exact5bfb4155 lease push succeeded; remote SHA read. CI34035777704 queued; previous34035628117 cancelled. PR body contains current SHA, exact fresh gates, original two-OS attribution, initial compile-failure provenance, and explicit accepted cost sentence.
Doyle accepted the declared JIT deviation: one full read per append under exclusive lock; steady-state1250-row retention bound (~2MB on his measured log), endpoint comparison misses1,2,1,3. PR wording preserves honest caveats: ordinary retention compaction still applies; legacy oversized logs scan fully until retention succeeds. He ff's only after fresh CI green plus these two leg exits. Final report was delivered (DISPATCH_RESULTS).

#280 READ-ONLY SCOPE: created .worktrees/relay-msg-in-280, branch fix/280-relay-msg-in, base17815c9c. No source edits, target pool, or builds. Source confirms missing publish in startup.rs deliver closure1057-1061; add existing crate::cli::publish_msg_io(id, IO_KIND_MSG_IN, from, body), not a new emitter. That helper is pub(crate), uses default_bus registering LastMsgSink and IoLogSink. Poll's CURRENT requirement tag is REQ-IO-MSG-EDGES (issue's taxonomy citation is stale). Relay::drain_backlog filters notifgate before callback; pump_once passes live TCP pair to same callback then drains backlog. LastMsgSink maps MSG_IN to Direction::In and records peer/payload/time into last-msg-in.json; no consumer edit indicated.
Agreed real seam per issue: io_events_undriven_kinds_e2e.rs, api listen --once, both backlog and live must yield exactly one MSG_IN in receiver log; check LastMsg consumer; remove new publish to mutation-prove red. Existing rig has real daemon and DISTINCT live owner pids; preserve this. listen needs api --adapter mock listen bob --parent-pid <daemon-owned bob pid> --session-id SID_B --once; no live-capable manifest needed. Pre-spool backlog; for live use public spt_msg::deliver::deliver_tcp after listener registration, require true and no spool fallback. PollListener registers bound TCP address before READY and first200ms pump; avoid launching a second CLI after READY as sole barrier (startup can exceed window). Existing files read: startup904-1100, delivery714-770, cli11037-11054, relay44-104, iobus255-293/default_bus372-377, lastmsg68-84/read_at143-146, fixture1-313/358-428, listen_seed_retry setup/sessionfallback, listener79-166, deliver_tcp102-128. No test written yet. Preserve receiver log+peer+payload assertions, verify newest LastMsg, filter held notices before event; frames contract already correct, no docs change required.
Current todo39/65 done,0open,26blocked. #280 paused for prioritized handback; next is ordered docs rebase when doyle names tip, then #280 implementation/gates. W0 stays parked/unvalidated until doyle schedules it; old global BOX HOLD reasons are stale.