🌊 Wave 2026-07-11 · audit discovery/daemon/wire + .t27 specs — beacon-auth inert (P1), hello.t27 ghost (P1)

[gHashTag]

Draft-only wave report. Does not touch code — adds docs/WAVE_REPORT_2026-07-11.md. Closes-partial #68.

What this wave found (new; no overlap with #59/#67/#63/#65)

Audited the modules prior waves under-covered — discovery.rs, daemon.rs, wire.rs — and the .t27 specs themselves.

P1 · Beacon authentication is inert on the live datapath. Hello::verify_mac and Hello::is_fresh are invoked only inside #[test]. The daemon RX loop (trios_meshd.rs:183-186) parses a beacon and feeds reports_hearing(me) straight into the ETX table with no MAC/freshness/replay check. The E3.1 src-spoof guard (router.rs:404) keys on FrameKind::Hello, but live beacons are sent as FrameKind::Data + app-layer HELLO_TYPE=0 (send_direct, router.rs:368-377), so the guard never fires. A session-holding neighbor can inflate/replay heard[] and steer routes — the exact W2 insider E2 claims to stop. (RFC 8967/9467.)

P1 · hello.t27 is a stale ghost spec. It models a 13-byte, MAC-less, timestamp-less, 3-neighbor beacon; the live discovery.rs beacon is [src][seq][ts:8][n][heard][mac:16]. gen/rust/hello.rs is generated, drift-green, and referenced by nothing. Beacon security lives outside the SSOT, so "fix = edit .t27 + regenerate" cannot currently be applied to it.

Plus 5×P2: hardcoded universal MAC key; self_healing.t27 cooldown timestamp truncation (with a spec test its own arithmetic contradicts — ties #61); spec-coverage illusion (9/68 gen modules linked, discovery/daemon unspecced); non-constant-time MAC compare; ETX floor-bias/bucket flap.

Honesty (grounded by command, 2026-07-11)

• main @6850649 does NOT build: cargo build -> 4 errors, first in build.rs (E0308/E0599). Not claiming main green. Repair owned by build(pipeline): pinned-t27c gen/rust + physical drift-guard (запрет писать в репо неправильно) #60/🌊 Wave 2026-07-10 · fix(build): зелёная библиотека + отчёт волны (closes-partial #58) #59.
• 68 specs · 101 #[test] · 9/68 gen modules linked into lib.rs — all verified via command, none fabricated.
• No hardware flashed/ordered/measured. Draft only, never merge, per docs/AUTONOMOUS.md.

Deliverables in report

7-row weak-spots heatmap (file:line + E-id) · science->prescription with primary refs · 4-sprint plan with measurable acceptance criteria · 3 parallel cooperation lanes · boundary section.

phi^2 + phi^-2 = 3

🤖 Generated with Claude Code

[gHashTag]

Triage — KEEP

Verdict from cascade analysis: KEEP, awaiting caskade merge.

Root cause of red CI (build + test (-sim baseline)): committed gen/rust/ on feature branches with expanded module set contains E0425 defects from three optimizer scan bugs in t27c (const_propagate, copy_propagate, dead_store_elim not recursing into control-flow bodies). Not a defect in this PR — this PR is docs-only and has no code paths affected.

Cascade to unblock (all three DRAFT):

1. t27#1461 — mut-inference (base t27/master)
2. t27#1462 — recursive optimizer scan (stacked on #1461), verified −182 errors cross-env (linux sandbox 28 / macOS arm64 26, ±2 epsilon)
3. tri-net#80 — regen gen/rust/ on feat branches with new t27c

Once #80 lands, baseline CI on this PR goes green automatically. No action required on this PR — it stays DRAFT until human merge.

Realm-check discipline: numbers above measured on commit SHA bbaaa4a1 in t27, cargo check --lib grep count ^error\[E. Not fabricated.

phi^2 + phi^-2 = 3