🌊 Wave 2026-07-11 · beacon-auth inert on RX (P1) + hello.t27 ghost spec (P1) + self_healing cooldown truncation (P2)

[gHashTag]

Autonomous wave audit of the under-covered modules (discovery.rs, daemon.rs, wire.rs) and the .t27 specs themselves. Full report on branch feat/wave-report-2026-07-11:

docs/WAVE_REPORT_2026-07-11.md
https://github.com/gHashTag/tri-net/blob/feat/wave-report-2026-07-11/docs/WAVE_REPORT_2026-07-11.md

Honesty preface (grounded by command)

• main @6850649 does NOT build: cargo build on a clean clone -> 4 errors, first in build.rs:29-30 (E0308/E0599). Build script fails before gen/rust is reached. Fixes tracked in unmerged build(pipeline): pinned-t27c gen/rust + physical drift-guard (запрет писать в репо неправильно) #60/🌊 Wave 2026-07-10 · fix(build): зелёная библиотека + отчёт волны (closes-partial #58) #59.
• 68 .t27 specs · 101 #[test] (no tests/ dir) · 9 of 68 gen modules linked into src/lib.rs.

New weak spots (none overlap #59/#67/#63/#65)

#	Weak spot	Sev	File:line
1	HELLO auth (verify_mac/is_fresh) called only in #[test]; RX loop feeds ETX unverified; E3.1 guard keys on FrameKind::Hello but live beacons ride as FrameKind::Data+HELLO_TYPE -> guard never fires	P1	discovery.rs:114,120; trios_meshd.rs:183-186; router.rs:404 vs 368-377
2	hello.t27 ghost spec (13-byte MAC-less) diverged from live ts+MAC discovery.rs; gen/rust/hello.rs unreferenced -> SSOT broken	P1	specs/hello.t27:8-10; discovery.rs:22; lib.rs:3-5
3	Universal hardcoded HELLO_MAC_KEY default; daemon passes None	P2	discovery.rs:13-16,82; trios_meshd.rs:301
4	self_healing.t27 masks last_attempt to 8 bits -> cooldown bypassed; own can_recover_cooldown test contradicts arithmetic (evidence spec tests not executed; ties #61)	P2	specs/self_healing.t27:15,50,188
5	Spec-coverage illusion: only 9/68 gen modules linked; discovery.rs+daemon.rs unspecced & outside drift-guard	P2	lib.rs:10-47; spec-drift-guard.yml:55
6	Non-constant-time MAC compare (self.mac == expected)	P2	discovery.rs:116
7	ETX floor-bias + coarse calc_etx buckets -> boundary route-flap	P2	specs/etx.t27:37,45,59-69

Prescriptions (spec-first; no hand-Rust)

RFC 8967/9467 (Babel MAC + replay counter, per-association keys), BFD RFC 5880 (full-width timers), RFC 8439 (constant-time tag), WMEWMA SenSys 2003 (unbiased ETX). 4-sprint plan (identity+integrity / path-diversity+self-heal / hardening / verification-parity) with E-ids and measurable acceptance criteria + 3 cooperation lanes in the report.

Draft PR follows. Draft only — human merge per docs/AUTONOMOUS.md.

phi^2 + phi^-2 = 3