Merge nucleic/lucid-river-toad-6efj into dev

spikes/README.md

@@ -133,10 +133,18 @@ class, confirming §13.1's retraction against the machine rather than against an
 answering through both faces — and `ListSessions()` (slot 6) returned S_OK. So hand-written
 `ComImport` is sufficient and the C++/WinRT shim §13.1 mused about is not needed.
 
-It returned **0 sessions**, though, so the entry-struct layout (inline `wchar_t` buffers, the same
-shape `ListContainers` uses) is still untested. Run `--session --keep --internal-call` to create a
-session, re-adopt it through the internal interface, and exercise it — that combination is §2.3's
-reattach story end to end, and it also answers the handoff question below. `wsl --shutdown` after.
+Re-run as `--session --keep --internal-call`, `ListSessions` returned the live session by name
+(`#6 "nucleic-spike"`), so the entry-struct layout — inline `wchar_t` buffers, the same shape
+`ListContainers` uses — marshals as declared. **Enumeration is proven.**
+
+That run also turned up a trap worth knowing before writing any of this into brokerd:
+`OpenSessionByName` failed **`0x80070542`** on the session `ListSessions` had just listed.
+That is `ERROR_BAD_IMPERSONATION_LEVEL` — the service impersonates the caller to resolve a
+*per-user* session, and .NET hands COM proxies `RPC_C_IMP_LEVEL_IDENTIFY` by default. A security
+error that reads exactly like "not found", and only on the methods reattach needs. The probe now
+raises the proxy blanket to `RPC_C_IMP_LEVEL_IMPERSONATE`; brokerd should call
+`CoInitializeSecurity` at startup instead, **before** its first COM call — including the compat
+SDK's, or it fails `RPC_E_TOO_LATE`. `wsl --shutdown` to clean up after `--keep`.
 
 The hypothesis was that one of those objects also implements the internal interface — COM
 objects routinely expose several — so `--internal` activates each and QIs for the internal IIDs.