Epiphany/notes/epiphany-current-algorithmic-map.md

# Epiphany Current Algorithmic Map

## Causal work identity and creation provenance

- Owner: `causal_work_identity` derives durable request identity for Proposal Modeling, Research, frontier Planning, PlanMind, and Admitted Model Direction.
- Inputs: runtime identity plus the immutable admitted cause specific to each typed family. Proposal content, model/frontier hashes, accepted result identity, candidate digest, and Mind admission receipts may participate. Coordinator thread and timestamps may not.
- Outputs: deterministic typed request IDs consumed by direct and resident launch paths.
- Derived state: creation thread and request time are provenance. Job, process, grant, model-execution, and tool IDs identify attempts beneath the request and cannot redefine it.
- Forbidden writers: current coordinator thread, resident projection, retry path, launch callback, and worker output cannot fork, invalidate, or restore a request identity.
- Shared paths: a request may cross coordinator incarnations while the current admitted thread carries transport. Launch refuses byte-identically if stale provenance attempts to replace that carrier thread.
- Cut line: family-local causal hash formulas and downstream thread-restoration behavior are removed. Distinct request structs remain explicit; this is a shared invariant, not a stringly request registry.
- Verification layer: full core tests cover direct/resident generation, hostile causal substitution, current-thread transport, and byte-identical stale-thread refusal.

## Immutable public source identity

- Owner: `ImmutableGithubSource` owns component validation, composite parsing, lowercase revision canonicalization, repository/source rendering, and round-trip identity.
- Inputs: GitHub owner, repository, exact 40-hex commit, and bounded canonical repository path.
- Outputs: one typed identity used by Modeling source selection, Eyes provider execution, and Mind receipt authentication.
- Derived state: raw-content URL and receipt display fields. Network policy, grant authorization, content bounds, digest verification, and receipt lifecycle remain with their existing owners.
- Forbidden writers: provider output and mutually consistent JSON fields cannot define or weaken immutable source identity.
- Shared paths: uppercase provider input canonicalizes to the same lowercase source reference that Modeling stores and Mind authenticates.
- Cut line: the runtime-only composite parser and provider-local component/path validators are deleted.
- Verification layer: typed table tests reject mutable revisions, ambiguous repositories, traversal, empty segments, and invalid characters; governed public-tool tests still prove exact grant and receipt binding.

## Heartbeat pulse-artifact retention ownership

- Owner: heartbeat Continuity owns retirement of its own closed `pulse-NNNNNN` artifact directories. Status display limits and Idunn process supervision own no deletion authority.
- Inputs: the canonical heartbeat artifact root, direct pulse directory sequences, exact recursive file manifests, the latest cognition artifact reference, a recent-pulse count, and a bounded retirement batch size.
- Outputs: a typed retention plan committed before deletion and a typed completion receipt after every planned directory is absent. Plans and receipts retain exact directory names, manifest roots, file counts, and byte counts without retaining private artifact bodies.
- Derived state: the active artifact count is bounded by recent count plus one hysteresis batch. The default 256 recent pulses and 64-pulse batch keep at most 320 active directories between retention runs.
- Forbidden writers: projection limits cannot masquerade as retention. Unknown directory names, symlinks, paths outside the canonical root, post-plan manifest changes, and the pulse containing the latest cognition artifact all fail closed before deletion.
- Shared paths: explicit `retain-artifacts` and every resident heartbeat serve outcome call the same plan/reconcile primitive. A crash after plan commitment resumes that exact plan; already absent members are accepted, while surviving members must still match their planned manifests.
- Cut line: the permanent one-directory-per-15-second growth path is removed. Process stdout/stderr logs remain a separate supervisor-owned rotation problem and are not deleted by heartbeat retention.
- Verification layer: synthetic CultCache-backed tests prove hysteresis bounding and idempotence, changed-plan refusal with preservation, unknown-directory refusal before deletion, and protection of the latest cognition artifact. Exact packaged `16c4b19f` retired pulse directories 1-2 from a five-pulse copied-store fixture, retained 3-5 byte-identically, emitted its typed plan/receipt projection, and replay returned `within-bound` without another receipt.

## Runtime job and session closure ownership

- Owner: the worker runtime terminalizes its own outer role job and inner model job. Continuity owns runtime-session completion after every job in that session is terminal.
- Inputs: worker success, ordinary runtime error, timeout, and the session-local job set. Coordinator status is an observer of these typed documents, not a writer.
- Outputs: exactly one terminal job result per job, a `Completed` session, and one deterministic `session.completed` runtime event sourced from Continuity.
- Derived state: `*Running`, open-job count, and active-session count are projections. Adapter-status refreshes may change unrelated store bytes on restart and are not job authority.
- Forbidden writers: coordinator restart/status code cannot synthesize worker results or pretend a session closed. A repair loop cannot hide a dead worker. New jobs cannot enter a completed session.
- Shared paths: bounded and unbounded worker execution use the same result-sealing primitive; explicit session closure uses the same terminal-job predicate for coordinator, resident, and model-adapter sessions.
- Cut line: sessions no longer remain permanently active merely because creation was implemented before completion. Closure refuses any queued, running, or review-waiting session-local job; exact closure replay is idempotent.
- Verification layer: a byte-identical disposable copy of sealed v28 reproduced the dead Imagination job. Authenticated `55660d78` terminalized it as failed, restart could not create a second result, and the new Continuity primitive closed all four sessions from four active to zero while preserving sealed v28 unchanged.

## Proposal frontier routeability invariant

Proposal Modeling admission and Self planning selection now share one boundary:
an admitted frontier `source_scope` must be non-empty safe relative paths in
strict lexicographic ascending order with no duplicates. Modeling may normalize
proposal scope hints into that canonical form; it must not preserve arbitrary
serialization order. `runtime_repo_frontier_planning_eligibility` projects the
same predicate per active Imagination frontier, alongside challenge and
dependency blockers, so operator status describes the exact selector reality.

Proposal Evolution also requires `status=active`. Mind acceptance is the
proposal's admission decision; persisting it as merely proposed creates a dead
document that Self cannot select and proposal Evolution cannot revise. The
eligibility projection includes unresolved proposed Imagination frontier as a
diagnostic candidate with `statusValid=false`, but only active frontier can be
eligible. This projection observes the wound; admission prevents it.

Proposal Evolution also requires exact canonical routeable organ identity:
`Hands`, `Eyes`, or `Imagination`. The field remains a string in the portable
RepoModel, but Mind admission owns the executable subset and refuses lowercase,
unknown, or merely display-shaped labels. Planning eligibility includes a
case-mismatched Imagination-shaped legacy document only to project
`recommendedNextOrganValid=false`; it never case-folds that document into
authority. v25 proved why: lowercase `imagination` was admitted but invisible to
Self's exact selector.

Owner: Mind admission owns whether proposal frontier state may enter the model.
Self only selects admitted routeable state. `source_scope` is no longer assumed
routeable merely because its individual paths are safe. Invalid ordering is
rejected before mutation; no repair loop or selector exception may launder it.

## Coordinator cold start and source-regather ownership

- Owner: typed `UserObjectiveIntake` owns first objective/state creation. It is
  seed-only, atomic, idempotent for identical input, and refuses replacement.
- Eyes owns source gathering. An accepted CRRC `Regather` judgment becomes
  `RegatherManually`, which Self maps to Research; the continuity judge does not
  recursively relaunch itself after its judgment is accepted.
- Modeling owns Body mapping only after source inspection. Research, Modeling,
  and Verification share bounded repository read/Git tools; tool receipts are
  operator-safe evidence while direct thought stays sealed.
- Mind owns admission. Provider JSON Schema is a formatting projection, not
  authority. Canonical worker-result parsing, exact launch Body-basis replay,
  and Mind review/admission decide whether a RepoModel patch exists.
- The model may name additional evidence, but it does not own transport
  provenance. The OpenAI runtime adds the immutable request-chain reference to
  the typed role result before persistence. Mind still requires the admission
  review to bind that exact non-empty result evidence set.
- Derived state: status, role boards, and coordinator decisions read one
  canonical typed role/reorient result path. Display synthesis cannot remember
  a finding that coordinator signals forget, or vice versa.
- Forbidden writers cut: sibling-path local-Verse inference, fake checkpoint
  preparation, recursive reorientation after accepted regather, duplicate
  display/coordinator result readers, and JSON null treated as a state patch.
- Failure lifecycle: failed and completed-unreviewable results require an
  explicit supersession receipt before relaunch. Exact repeat is idempotent;
  conflicting acceptance authority is refused.
- Live shakedown evidence: the authenticated model runtime completed
  source-grounded Modeling passes with typed repository reads and emitted a
  reviewable Body-bound `repoModelPatch`. Admission remains the proof layer;
  prose summaries and successful model transport do not make the patch true.

## Observation and bootstrap authority correction (2026-07-12)

- Owner: diagnostics only project persisted CultMesh state; they never initialize it.
- Bootstrap owns static policy, topology, schema, brake, and organ-contract declarations. It does not own daemon liveness or provider availability.
- Daemons own heartbeat/status documents. Missing status produces no observed daemon row; declared targets remain separate and are never promoted to presence or `ready` by a reader or seeder.
- The provenance-free v0 Odin advertisement, Eve surface, and daemon-tool families are quarantined legacy vocabulary. Live provider directories return no rows from them; missing provider state produces no synthetic row.
- Forbidden writers removed in this pass: read-command calls to `seed_epiphany_local_verse_context`, loader fallback constructors, and bootstrap's default-ready daemon-status loop.
- Next authority cut: requester commands may author intents, but Bifrost, GitHub, tool providers, Eve providers, and daemon lifecycle owners must author their own response receipts.

## Declared topology versus observed presence (updated 2026-07-15)

- Owner of declaration: explicit bootstrap persists seven faculty routes, desired private-Verse addresses, and daemon/Eve targets as configuration.
- Owner of presence: a provider-authored daemon status/heartbeat is the only input that creates an observed daemon row.
- Outputs keep the distinction in their names: `declaredFacultyCount`, `declaredPrivateVerseRouteCount`, `declaredDaemonTargetCount`, and `observedDaemonCount`.
- Restart-policy sight may enumerate desired targets with `daemonStatus=unobserved`; that supports Idunn reconciliation but does not materialize a daemon.
- Prompt context labels topology as declared routes and targets. It cannot imply those addresses are inhabited.
- Forbidden substitutions: topology rows cannot become daemon or agent counts; daemon heartbeats cannot become agent counts; configured private-Verse ids cannot become active Verse counts.
- Cut line: the synthetic `unknown_daemon_status` constructor is deleted. A fresh bootstrap has seven declared targets and zero observed daemons; one persisted provider status yields exactly one observed daemon.

## Bifrost body-change request path (2026-07-12)

- Owner: the calling Hands/requester owns the body-change intent.
- Inputs: repository, branch, change summary, justification, changed paths, verification/review receipt references, authors, and credit subjects.
- Output: one persisted `gamecult.bifrost.body_change_publication_intent`; command status is `pending-bifrost`.
- Derived sight: requester-owned receipt-directory and publication surfaces show the pending intent and the absence of a provider response. There is no local Bifrost ledger or closure oracle.
- Forbidden writers: the requester CLI no longer constructs or writes Bifrost acceptance, ledger attribution, GitHub publication, PR, commit, publication URL, or credit receipts.
- Response owners: Bifrost may answer with its publication receipt; the GitHub publication adapter may answer only after real substrate evidence exists.
- Negative proof: after request submission, latest intent is present while latest Bifrost publication and GitHub publication receipts are absent.
- There is no Epiphany-local `bifrost-ledger` or accounting closure surface.
  Missing provider response remains missing with no local follow-up command.
  Provider closure requires a future authenticated provider ingress/admission
  witness; typed local document presence is insufficient.

## Daemon tool request path (2026-07-12)

- Owner: the requesting agent owns the invocation intent; the advertised host daemon owns the response receipt.
- Input: a persisted capability plus requester identity, requester cluster, payload reference, and bounded reason/summary.
- Output: one `epiphany.cultmesh.daemon_tool_invocation_intent`, status `pending-provider`, and the host daemon id as `responseOwner`.
- Unknown host status does not block request queuing and is never promoted by the requester.
- Forbidden writers: `invoke-tool` cannot accept or synthesize receipt id/status, result reference, or result summary; it no longer executes local readback functions and labels them daemon results.
- Negative proof: request intent persists, latest provider receipt remains absent, and response-shaped CLI fields are refused.

## Daemon lifecycle request and heartbeat paths (updated 2026-07-15)

- Owners: Self/operator requests intervention; Idunn owns poke intent, command-attempt receipt, restart policy, and backoff; `epiphany-cluster-daemon` alone owns its provider heartbeat/status envelope.
- Inputs: persisted provider status, the heartbeat observed before intervention, restart policy, scheduler staleness observation, and the real command result.
- Outputs: immutable poke intent/receipt v1 events plus an atomically advanced chronological latest pointer. Exit zero yields `awaiting-provider-heartbeat`; command failure yields `restart-failed`.
- Derived state: scheduler staleness, lifecycle attention, receipt-directory resolution, and Idunn backoff are observations of provider state and attempts. They are not provider status.
- Forbidden writers: poke callers and the supervisor cannot assign provider status, operator action, or `last_heartbeat_utc`; command success cannot mint `ready`; stale status cannot be resolved by a heartbeat older than the completed attempt.
- Shared paths: manual reconcile and scheduled reconciliation use the same attempt primitive. Both retain restart pressure until a provider-authored heartbeat causally newer than the completed attempt proves recovery.
- Cut line: the supervisor's provider-status writer and synthetic heartbeat advancement are removed. Generated attempts use unique identities; exact retry is idempotent, identity collision is refused, and delayed replay cannot rewind `latest`.
- Verification: the survival rehearsal preserves the provider envelope across two successful restart commands, observes two distinct awaiting receipts, then publishes a real provider heartbeat and proves receipt resolution plus failure-count reset.

## Provider discovery and heartbeat authority (updated 2026-07-15)

- Owner: `epiphany-cluster-daemon` owns only its liveness heartbeat/status envelope. No central process currently owns provider advertisement, Eve composition, or hosted-tool availability.
- Inputs: heartbeat accepts persisted topology identity and daemon-local liveness evidence. Topology `eve_surface_id` is routing/address metadata only; it is not proof that a surface exists.
- Outputs: heartbeat writes liveness only. Live Odin, Eve, and tool directories remain empty until a future provider-authored contract is admitted.
- Derived state: topology, labels, expected routes, and test-only templates may describe stable addresses and legacy shape. They cannot become provider presence, composition content, supported actions, or executable capability.
- Forbidden writers: generic bootstrap, heartbeat, query CLI, and central template builders cannot publish the provenance-free v0 Odin advertisement, Eve surface, or daemon-tool families. Live consumers ignore those families, and explicit bootstrap retires any stale rows of exactly those types.
- Cut line: `publish_epiphany_cultmesh_provider_state` and the heartbeat call to it are deleted. The seven centrally synthesized surfaces and their tool claims are no longer live state.
- Re-admission invariant: provider discovery returns only after an owning provider emits a provenance-bearing typed contract whose origin can be verified; actions additionally require a real dispatcher and receipt path.

## Persona feedback and typed Imagination consideration boundary (updated 2026-07-18)

- Eve is presentation only. Epiphany has no Eve connection intent or receipt
  document, writer, reader, prompt projection, query action, receipt-directory
  row, or tool claim. Presentation connectivity cannot admit feedback or become
  cognition authority.
- Daemon-tool invocation requests likewise remain pending until the advertised host daemon or authenticated ingest boundary supplies the typed response. Local response construction/writing/validation is test-only; aggregate smoke and receipt-directory projection prove intent-present/receipt-missing instead of manufacturing host acceptance.
- Idunn deployment and aftercare outcomes have no local production writer. The synthetic deployment-config family smoke and its green aggregate MVP-gate handoff are deleted; config audit/runbook remain pre-deployment surfaces, while typed Idunn readers await genuine daemon-authored ingest.
- Bifrost artifact-acceptance and metrics requests remain open until actual Bifrost/Maintainer receipts are ingested. The stale response-closing request-family smokes, accounting bundle, wrapper mode, and aggregate green gate are deleted.
- Repo-work readiness reports are sight only. The generic readiness-review approval command and writer are deleted because one caller supplied four unresolved reviewer labels. `repo.readiness_review_request` now assigns routing to Self, lists Maintainer/Soul/Mind/Bifrost as independent required reviewers, and names no readiness-approval owner; typed review readers await genuine multi-organ/provider evidence.
- Interpreter Brief is preparation cargo authored by Imagination from accepted public pressure. It requests Mind interpretation and remains `interpretation_admitted=false`; it is not Mind-owned state until a genuine Mind path supplies and admits interpretation evidence.
- Repo collaboration policy/topic files are proposals, not live social or renderer contracts. Imagination authors them, Persona owns discussion, Persona/Mind review policy, Mind admits repo policy, Bifrost owns publication, and requested public-room/Eve-surface identifiers remain unpublished until provider receipts exist. Epiphany does not own downstream Eve/TUI/GUI composition.
- The deterministic `repo.tool_capabilities` and `repo.eve_surface` safe families are deleted. Expected tool ids and invented surface/row/lowering catalogs cannot substitute for host advertisements or provider-published composition graphs. Live paths are typed tool requests/host receipts, Odin discovery, authenticated Bifrost feedback delivery, and provider-owned publication.
- `repo.body_manifest` is deleted. An unconsumed `epiphany.toml` that invents Body/Verse/Eve identity and capability hints is not observed runtime state or admitted birth configuration. Runtime state, repo birth receipts, and provider advertisements own those facts.
- Doctrine update requests split authority: Imagination authors, Self routes, Maintainer reviews, Soul verifies, Mind admits doctrine state, and Hands mutates `AGENTS.md` under receipts. There is no Maintainer/Mind composite owner or OR gate.
- Closure has no substring authority. Worklog, planning/checklist notes, managed/status sections, and task cards are explicitly presentation-only; closure relies on committed target/path/blob evidence instead of treating formatting text as Soul truth.
- Deployment requests split Self routing from independent Maintainer/Soul/Mind/Bifrost review and Idunn-only execution. Maintainer review cannot impersonate Idunn deployment; only Idunn deployment and aftercare receipts prove outcomes.
- PR requests split Self routing, Bifrost publication gating, Hands execution, and GitHub provider outcomes. GitHub receipt authorship does not grant publication-policy authority.
- Artifact acceptance requests split Self routing, Maintainer acceptance decisions, and Bifrost accounting. Acceptance receipts and accounting ledger rows no longer claim one composite owner.
- Metrics requests split Self routing, Bifrost accounting custody, and Maintainer review-load evidence. Spend/review receipts are observations and grant no spend or ledger authority.
- `repo.planning_brief` is deleted. It contained no candidate work-item records and let copied global catalog/schema/closure constants self-attest as per-item planning and readiness evidence. The live preparation chain is consensus draft -> interpretation request -> objective draft -> Mind adoption.
- There is no aggregate repo-swarm MVP gate. The former smoke manually aggregated fixture summaries into green rows and `demoReady=true`; it and its wrapper are deleted. Whole-organism readiness requires a live-fire path whose claimed consequences are observed at their owning boundaries.
- Bifrost owns authenticated Persona-feedback admission. Its signed packet is
  feedback-only pressure, not an Eve connection, Persona command, objective, or
  work proposal.
- Self owns an immutable Imagination consideration request binding one admitted
  feedback packet digest to one exact admitted Modeling revision/hash/receipt
  and one fixed question enum. Feedback prose is transported only as quoted
  evidence.
- Imagination owns a proposal-only consideration candidate with `suggest`,
  `hold`, or terminal `no_fit` disposition. The candidate has no state patch,
  model patch, frontier candidate, Hands route, release, or deployment mouth.
- A separate Self review request is required before a suggestion may enter
  Modeling review. It grants proposal-review authority only; it does not mutate
  the map or adopt work.
- Eve and Persona render or discuss derived results. They do not own admission,
  cognition, result completion, or adoption. The former Eve-dependent feedback
  and synthetic consensus-receipt shapes are obsolete.

## Public-proof submission boundary (2026-07-12)

- Request source: an existing redacted `repo_work_public_proof` document is the complete pending publication cargo.
- Consumer command: `bifrost-public-proof` selects that proof and reports `pending-bifrost`; it writes no new receipt.
- Bifrost owner: ledger attribution, review and credit receipt binding, public destination, publication URL, publication status, and final receipt.
- Forbidden writers: the caller-facing command rejects all Bifrost result fields and leaves publication coordinates null.
- Negative check: absence of a pending proof fails without writing a publication receipt; response-shaped fields are rejected before mutation.

## Bifrost accounting request boundaries (2026-07-12)

- Artifact acceptance source: Mind-admitted `repo.artifact_acceptance_request`; caller output is pending `Maintainer/Bifrost` with null acceptance coordinates.
- Metrics source: Mind-admitted `repo.metrics_request`; caller output is pending `Bifrost/Maintainer` with null accounting coordinates.
- Forbidden artifact writers: caller cannot provide artifact/proof/review/ledger/receipt/status/accepted-by results.
- Forbidden metrics writers: caller cannot provide accepted artifact, model spend, review load, credit, proof, summary, receipt, or status results.
- Negative proof: missing requests fail without receipt mutation and response-shaped arguments fail before lookup or write.

## Operator snapshot authority boundary (2026-07-12)

- Owner: operator snapshot adapter owns only a bounded summary of an edge status artifact.
- Runtime spine owns daemon-tool execution intent and receipt truth.
- Forbidden projection: `/tools/invocations` JSON cannot be promoted into canonical daemon-tool schemas by snapshot import.
- Output explicitly returns null tool intent/receipt fields and `toolInvocationAuthority=runtime-spine-only`.
- Negative proof: forged accepted tool JSON produced a snapshot but no canonical intent or receipt.

## Fixture store quarantine (2026-07-12)

- `epiphany-verse-query smoke` owns synthetic contract fixtures only.
- Its only writable body is `.epiphany-smoke/verse-query-default/local-verse.ccmp` with runtime `verse-query-default-smoke`.
- Generic local Verse bootstrap owns policy, declared topology, initial brake,
  and organ contracts only. It does not publish Odin provider
  advertisements, Eve surfaces, or daemon-hosted tools. Those families require
  provider publication; discovery preserves their absence.
- Bootstrap receives the authenticated repository Body domain explicitly and
  stamps that exact domain into every cluster declaration. Cluster topology no
  longer owns a compiled workstation path; seed commands fail closed when the
  Body domain is absent or is not a non-empty `repo:` domain. Stored topology is
  the only live source for downstream liveness, policy, Eve, and tool routing.
- The generic Verse query CLI has no provider-advertisement preview or Odin
  publication command. Provider bodies must publish their own discovery state;
  central declared topology cannot be lowered into `active`/`daemon-live`
  compatibility presence.
- `epiphany-cluster-daemon` owns heartbeat liveness only. Heartbeat/serve does
  not publish Odin advertisements, Eve surfaces, or hosted tools. The former
  daemon-ID-bounded central publisher is deleted.
- Cluster daemons never bootstrap the local Verse and never load its full
  context. They require persisted topology, read narrow liveness, then write
  only their bounded heartbeat. Explicit operator bootstrap
  owns policy/topology/contract initialization.
- `epiphany-daemon-supervisor` also requires explicit persisted bootstrap for
  every production lifecycle, policy, scheduler, runbook, audit, status, and
  control path. Only its two synthetic audit-smoke commands may initialize
  fixtures, and only beneath `.epiphany-smoke`.
- In `epiphany-verse-query`, only explicit seed commands and the fixed
  quarantined smoke initialize local Verse state. Every operator/requester
  mutation requires persisted status and topology before writing its bounded
  brake, poke, tool, Eve, Bifrost, metrics, artifact, or feedback document.
- Coordinator launch-context assembly also requires persisted status and
  topology. Rendering a worker prompt cannot initialize shared state. Its
  standalone smoke accepts no path arguments and writes only beneath
  `.epiphany-smoke`.
- Bifrost publication/GitHub/public-proof/artifact/metrics response constructors
  are test-only. Production
  retains typed schemas and readers for provider-authored ingest, but no local
  shipped binary owns or writes those response documents.
- Bulk seven-daemon `ready` construction/writing is also test-only. Production
  loaders enumerate topology keys without manufacturing status; only narrow
  single-daemon heartbeat/observation writers remain. Aggregate synthetic
  readiness exists solely inside the fixed Verse smoke body.
- Topology-derived Odin advertisement, Eve surface, and tool-capability builders
  survive only as test fixtures for legacy v0 document shapes. Live consumers
  ignore provenance-free v0 rows, and explicit bootstrap retires them. Topology
  `eve_surface_id` remains address metadata, not availability evidence.
- Generic bootstrap owns declarations and initial control state, not operator
  observation. The template-based operator-status writer and its writerless
  schema/context/prompt/reader family are deleted. Operator snapshots remain
  source-artifact-derived documents.
- Agent-state SoA sync requires an existing bootstrapped Verse before mirroring
  the persisted agent store. SoA report is filesystem-pure on a missing store.
  Wrapper mode `agent-state-soa` explicitly composes sync then report; the
  report itself never refreshes canonical state.
- Merely naming a CultMesh store does not create its body. Query, cluster-daemon,
  and daemon-supervisor parsers perform no filesystem writes; missing status or
  topology prerequisites preserve absence because CultCache pulling bypasses
  lock acquisition when the backing file is absent. Full context query refuses
  a nonexistent store. Explicit bootstrap or a real writer owns body creation;
  individual loaders do not carry duplicate absence compensators.
- Store/runtime overrides fail before fixture seeding or receipt construction.
- Negative proof: targeting `state/local-verse.ccmp` was rejected and its SHA-256 did not change.
- Positive proof: the built-in quarantined smoke completes successfully and reports its quarantine coordinates.

## Operator-run completion receipt boundary (2026-07-12)

- Intent owner: operator orchestration writes run id, mode, roots, limits, and artifact coordinates before execution.
- Completion evidence: matching latest intent plus a valid JSON result inside the canonical artifact root, modified at or after intent creation.
- Receipt status is derived as `completed`; callers cannot submit status.
- Forbidden evidence: missing, non-JSON, pre-intent, out-of-root, or mismatched-run artifacts.

## Daemon-supervisor install authority boundary (2026-07-12)

- Plan commands force non-execution and may only write planned artifacts/receipts.
- Execute commands force execution intent and must pass the existing elevation gate before service-manager mutation.
- Wrapper command identity matches the Rust command exactly; no hidden `--execute-install` switch selects reality.
- Ambiguous install aliases are not accepted.
- Negative proof: hostile plan flag cannot mutate; execute without elevation produces an explicit refusal receipt.

## Standalone receipt fixture boundaries (2026-07-12)

- Deployment-family fixture receipts live only in a disposable repo under `<root>/.epiphany-smoke`.
- Weksa fixture receipts live only at `.epiphany-smoke/weksa-interlingua/local-verse.ccmp`.
- Neither smoke accepts a caller-selected receipt store.
- Redirect arguments fail before synthetic receipt construction.

This is the source-grounded map of the live machine. Historical route and
bridge anatomy belongs in git history and evidence ledgers, not here.

## Objective

Epiphany is a native typed organism. Persistent Mind, coordinator policy,
worker lifecycle, organ receipts, prompt context, operator surfaces, and Verse
publication are owned by Epiphany Rust/CultCache/CultMesh/CultNet organs.
Vendored Codex retains Codex-native behavior and the OpenAI-compatible
authentication/model-transport reliquary. It owns no Epiphany state, prompt,
scheduler, route, notification, or interface contract.

## Authority Map

| Owner | Inputs | Outputs | Invariant |
|---|---|---|---|
| `epiphany-state-model` | typed state fields | `EpiphanyThreadState` and prompt projection | State is typed; rendering is not authority. |
| `coordinator_state_transaction.rs` | expected state, next state, typed companion envelopes | one atomic canonical-state transaction | Sole production writer of `THREAD_STATE_KEY`; companions cannot impersonate state. |
| `coordinator_state.rs` | current state plus validated ordinary update | proposed next state and transaction request | Owns update meaning, not persistence. |
| `coordinator_launch.rs` | validated launch plan, state, runtime envelopes | state-plus-launch transaction request | Launch constructs runtime companions; the transaction owner commits them. |
| `coordinator_acceptance.rs` | reviewed finding, Mind review, commit receipt | state-plus-Mind-witness transaction request | Acceptance owns admission meaning; the transaction owner commits its witnesses. |
| `thread_state_store.rs` | typed state entry | low-level CultCache codec/read access | Substrate, not policy; it exposes no production writer. |
| `coordinator_service.rs` | state/runtime store paths and typed commands | state update, launch, accept, interrupt results | Facade routes typed work; it contains no policy or protocol mapping. |
| `surfaces/*` | native state, runtime snapshots, pressure/freshness inputs | scene, jobs, roles, planning, context, graph, CRRC, coordinator recommendations | Read surfaces derive; they do not mutate. |
| `runtime_spine.rs` | typed launch/result/receipt documents | CultCache runtime records | Runtime lifecycle and evidence are durable typed documents. |
| `mind_gateway.rs` and coordinator acceptance | worker findings and proposed patches | review, rejection, or state-commit receipts | Worker thought cannot write Mind directly. |
| `substrate_gate.rs` | bounded access intent | scoped access grant/refusal | Repository access and state admission are separate authorities. |
| `eyes_gateway.rs` | inspected source under a grant | evidence review/packet/refusal | Looked-at truth carries provenance. |
| `hands_gateway.rs` | approved action intent | patch/command/commit/PR receipts | Consequence is bounded, attributable, and reviewable. |
| `soul_gateway.rs` | claimed consequence plus evidence | verdict/refusal receipt | Work is not true merely because it ran. |
| `continuity_gateway.rs` | rupture/checkpoint/recovery facts | continuity receipts | Survival state is explicit, not transcript residue. |
| `heartbeat_state.rs` and daemon binaries | durable schedule/liveness policy | pulses, launch pressure, sleep/rumination state | Scheduling is physiology, not project truth. |
| `cultmesh_integration.rs` and `epiphany-verse-query` | typed local documents | private/local/public Verse projections | Visibility never creates authority or declassifies private state. |
| Persona loop | state projection, stimulus, semantic recall | natural speech plus interpreted candidate actions | Imagination projects; Persona speaks; Mind interprets. |
| vendored Codex | Codex sessions and OpenAI-compatible auth/model transport | Codex behavior and model transport | No Epiphany protocol or durable Epiphany state crosses this boundary. |

## Primary State Flow

```mermaid
flowchart LR
    I["Typed intent or worker finding"] --> G["Mind gateway review"]
    G -->|reject| R["Typed rejection receipt"]
    G -->|admit| V["State validation"]
    V --> C["Single coordinator commit path"]
    C --> S["Native thread-state CultCache"]
    S --> P["Derived native surfaces"]
    P --> O["Coordinator / operator / Eve projections"]
```

`coordinator_state_transaction::{open_coordinator_state_transaction,
commit_coordinator_state_transaction}` is the single persistence owner.
Ordinary updates, launch transactions, and accepted findings construct their
domain-specific next state or companion documents, then submit them to that
owner. It rejects stale expected state, refuses companion envelopes that target
the canonical key, and commits state plus companions in one prepared batch.
`thread_state_store.rs` retains typed codec/read access only; its production raw
writers and their public exports are deleted. A source guard rejects any second
production `THREAD_STATE_KEY` writer. `EpiphanyCoordinatorService` is the narrow
caller-facing facade.

Forbidden writers:

- worker result payloads;
- operator display JSON;
- Codex rollouts or Codex thread objects;
- derived scene/coordinator/context projections;
- heartbeat telemetry;
- CultMesh mirrors and public Verse documents.

## Worker And Receipt Flow

```mermaid
flowchart LR
    C["Self / coordinator"] --> L["Typed worker launch request"]
    L --> RS["Runtime spine"]
    RS --> M["Model runtime"]
    M --> F["Typed role or reorient finding"]
    F --> MG["Mind review"]
    MG --> SC["State commit receipt"]
    SC --> S["Native thread state"]
```

`runtime_spine.rs` registers and persists worker launch requests, worker
results, Mind reviews, Mind commit receipts, Eyes packets, Substrate Gate
grants, Hands consequence receipts, Soul verdicts, Continuity receipts, and
coordinator run receipts. `EpiphanyCoordinatorService` now accepts one `store`
path for canonical state and its atomic runtime/witness companions. The native
status mouth exposes the same boundary as one `--store` argument. Document
families remain typed and separately owned inside the cache; filesystem path
plurality no longer pretends to be an authority boundary.

## Hands → Soul → Modeling Loop

1. Self emits a bounded Hands gate with requested paths and required receipts.
2. Substrate Gate records the access grant.
3. Hands records intent/review plus patch, command, and commit receipts.
4. `coordinator_launch_context.rs` builds sealed work-loop telemetry from that
   receipt chain for Soul.
5. Soul emits a verdict receipt against the actual consequence.
6. Modeling receives the verified consequence and proposes a map/state patch.
7. `coordinator_acceptance.rs` commits an admitted proposal with its Mind
   review/commit witnesses before Self routes another Hands turn.

The repo-work scheduler obeys the same order. After a branch-local execute
receipt it stops at `await-modeling`; it cannot invoke closure or manufacture
Modeling/Mind evidence. `epiphany-work close` requires explicit model
authorship, model reference, verdict, and finding before it can admit a map.
Deterministic checks remain Soul evidence, not a substitute for Modeling. The
verified consequence now crosses an explicit
`epiphany.modeling.repo_work_request.v0` boundary authored by Self. The request
is immutable, references the passing Soul receipt, commit, and changed paths,
and grants Modeling interpretation authority without granting Self authority to
write the result. A Modeling finding is refused unless it answers that exact
request and matches its verified consequence. The current close command writes
both phase documents from explicit CLI cargo; scheduler launch and asynchronous
result collection remain the next cut.

Soul verification is now an explicit phase of the shared closure pipeline.
`epiphany-work verify` and the first post-execution scheduler pulse run only
that phase: deterministic verification, immutable Soul verdict, and immutable
Self-to-Modeling request. Modeling absence or a non-passing Modeling verdict can
no longer make Soul report failure. The partial closure artifact is
`status=awaiting-modeling`; overview and later scheduler pulses preserve that
gate rather than mistaking file existence for Mind admission. The scheduler
source contains neither the Modeling finding writer nor map admission.

Repo work now has a native third worker launch kind beside generic role and
reorientation work: `repo-work-modeling`. It runs through the existing
`epiphany-openai-runtime`, carries the immutable request plus the bounded
Soul-verified commit diff, and requires
`epiphany.worker.repo_work_modeling_result.v0`. The runtime—not Self—converts
model output directly into the canonical `RepoWorkModelingFinding`. Scheduler
pulses launch one detached runtime job, wait without duplication, consume only
the typed finding, and then resume the existing immutable Mind/map admission.
A non-passing finding is immutable and stops for reviewed revision rather than
being overwritten or silently retried.

The former direct CLI writer is cut. `epiphany-work close --model-authored ...`
may no longer create a Modeling finding; closure can only reread the canonical
runtime document. The obsolete direct-CLI closure smoke was deleted. A live
negative probe returned exit 1 for forged passing CLI cargo while leaving the
typed request awaiting its real Modeling worker.

Detached worker physiology is now Idunn-owned. `epiphany-work` opens the typed
runtime job and invokes `epiphany-daemon-supervisor service-launch`; it contains
no child-process `spawn`. The supervisor launches the existing model runtime,
owns Windows hidden-process behavior, redirects stdout/stderr to explicit
artifacts, and publishes an
`epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` containing service and
process identity. Self receives that receipt ID as routing evidence only. Live
item `idunn-owned-modeling` crossed this boundary and reached the Bifrost gate.

The current Modeling request is owned by
`epiphany.modeling.repo_work_route.v0`, not the filesystem closure projection.
Generation zero lands atomically with its Soul-backed request. A later
generation can advance only through `advance_repo_work_modeling_route`: the
current finding must exist and be non-passing, the new request must preserve
item/Soul/commit/paths, and a Mind acceptance must grant only
`repoWork.modelingRoute`. Request, Mind review, and stable route pointer commit
in one CultCache batch; old request/finding documents remain immutable.
`epiphany-work revise-modeling --review-ref ... --rationale ...` is the explicit
review mouth. Scheduler job IDs include the route generation and derive the
stable route key from the item, so neither close JSON nor an old completed job
can select current work.

Before any Modeling runtime job is opened, the exact consumer executable runs
`preflight` against the actual runtime store. Its own schema registry must read
the store and advertise the required route, request, finding, and worker-launch
types. Preflight hashes both executable bytes and the ordered supported schema
catalog. Idunn refuses a typed launch without the passing schema flag,
executable SHA-256, schema-catalog SHA-256, witness ID, and required document
list; all are persisted in the daemon service lifecycle receipt. The preflight
ID is correctly a witness, not a fake independent receipt. Preflight precedes
`open_runtime_spine_heartbeat_job`, so stale consumers leave no queued corpse.

The
accepted interpretation is persisted as
`epiphany.modeling.repo_work_finding.v0`; it references the passing Soul verdict,
commit, and changed paths. Mind rereads that typed receipt and the admitted repo
map plus CultMesh projection carry its receipt ID.

The canonical repo-work map entry is `epiphany.repo_work.map_entry.v0` in the
same runtime CultCache. `commit_repo_work_map_admission` validates it against
the persisted Modeling finding, then publishes the map entry, Mind review, and
Mind commit in one prepared batch. The former bespoke
`.epiphany/state/repo-work-map.msgpack` owner is deleted. CultMesh remains a
projection after admission and cannot repair or override the canonical entry.

Closure phase documents are immutable by stable receipt ID. An identical retry
reuses the existing Soul verdict and Modeling finding, rereads an already
admitted Mind/map batch, and regenerates only operator/CultMesh projections.
Conflicting same-ID Soul, Modeling, or map cargo is refused; no reconciliation
loop may overwrite the earlier truth.

Manual edits and programmatic actions converge at the same receipt and Mind
admission boundaries. A later action cannot retroactively make an unrecorded
consequence valid.

## Read And Recommendation Flow

`epiphany-mvp-status` reads the unified native coordinator store.
It derives:

- scene via `surfaces/scene.rs`;
- pressure via `surfaces/pressure.rs`;
- freshness via `surfaces/freshness.rs`;
- jobs via `surfaces/jobs.rs`;
- role board via `surfaces/role_board.rs`;
- planning via `surfaces/planning.rs`;
- reorientation via `surfaces/reorient.rs`;
- CRRC via `surfaces/crrc.rs`;
- coordinator status via `surfaces/coordinator.rs`.

`epiphany-mvp-coordinator` consumes that native status shape. Requested Hands
paths come from the scene checkpoint/frontier. Revision comes from
`/scene/scene/revision`. There is no Codex `read.thread.epiphanyState` fallback.

## Persona Flow

```mermaid
flowchart LR
    T["Typed Persona state + visible stimulus"] --> PR["Imagination Projector"]
    PR --> PE["Persona turn"]
    PE --> IN["Mind Interpreter"]
    IN --> CA["Candidate actions / memory proposals"]
    CA --> G["Review and external authority gates"]
```

Semantic memory recall is a bounded context input, not a state writer. Outside
world actions pass through Bifrost identity/governance and Heimdall capability
proofs. Persona speech audits are typed CultMesh witnesses; public speech does
not expose private worker or operator state.

## Heartbeat And Daemon Physiology

`heartbeat_state.rs`, `epiphany-heartbeat-store`,
`epiphany-daemon-supervisor`, and `epiphany-cluster-daemon` own scheduling and
liveness. A lane is not relaunched while its prior turn is active. Cooldown
begins after completion. Idle physiology may ruminate, distill memory, or dream
without claiming project-state authority.

Idunn owns daemon survival. Self and Downstream consumers may inspect and recommend; they do
not become alternate daemon keepers.

## Verse And Interface Projection

CultMesh is the preferred local typed interface over CultCache/CultNet.

- `epiphany-internal`: private thoughts, reviews, receipts, and local organ
  coordination;
- `gamecult-local`: trusted operator-safe GameCult sharing;
- `epiphany-global`: public dreams and Persona/public discussion documents.

Eve/CultUI surfaces lower typed CultMesh composition/state. Renderers and
wrappers do not own the projected truth.

## Codex Boundary

The following are structurally absent:

- `thread/epiphany/*` requests and notifications;
- `ThreadEpiphany*` protocol DTOs and generated bindings;
- `Thread.epiphanyState` in Codex app-server payloads;
- Epiphany rollout migration or replay;
- app-server phase-6 Epiphany smokes;
- Codex-backed MVP status/interruption;
- `epiphany-codex-bridge`.

Native coordinator/status projections emit `state`, not the deleted Codex
`Thread.epiphanyState` spelling. Source guards reject that compatibility field
and reject the old two-store status flags.

Codex app-server protocol has no dependency on `epiphany-state-model`.
App-server has no Epiphany state-model/core/bridge dependency. Negative source
checks in native launch/coordinator code reject renewed Codex route authority.

## Verification Layers

| Claim | Evidence layer |
|---|---|
| State mutation law | `state_update.rs` and coordinator-state unit tests |
| Worker/Mind admission | runtime-spine and coordinator-acceptance tests |
| Read-only derived surfaces | focused `surfaces/*` tests |
| Native status/interrupt | `epiphany-mvp-status` tests and executable smoke paths |
| Hands/Soul loop | Hands receipt tests plus coordinator launch-context tests |
| Protocol starvation | source scans, app-server compile, generated-schema equivalence |
| Verse privacy/authority | CultMesh/Verse focused smokes and typed receipt readbacks |
| Public crossings | Persona mouth contract smokes: fail-closed eligibility, single-crossing receipt binding, and private-state seals; no provider-readiness projection |

### Persona mouth / provider-readiness boundary

Owner: the participating Bifrost/provider boundary owns the consequence of a
public crossing. Epiphany owns only Persona speech eligibility and artifact
binding.

Inputs: one eligible Discord, Reddit, or named future-surface request plus the
configured actuator coordinates and target-shaped identity/capability
references.

Outputs: one validated transport/request receipt bound to that one
speech/request artifact.

Derived state: the receipt is artifact-local evidence of the named consequence.
It does not derive provider inventory, liveness, capability, readiness,
publication, or future operability. Missing evidence remains unknown.

Forbidden writers: MVP status, wrapper summaries, fixture aggregators,
sibling-path/executable probes, subprocess exit status, parseable JSON, and
caller-supplied booleans cannot write provider readiness.

Shared paths: Discord, Reddit, and future-surface mouths all use the same
fail-closed eligibility-to-receipt boundary, but each single-mouth smoke proves
only its own crossing. No cross-mouth aggregate remains.

Deletion line: remove the sibling advertisement subprocess projection, both
aggregate smoke binaries, aggregate output fields, and status/wrapper
presentation. Retain only the scoped mouth consequence receipts.

Repo-work map admission is a canonical generation-bound transaction. A map
entry names its `RepoWorkModelingRoute` and generation; the runtime spine loads
that route and admits only a passing immutable finding selected by the route's
current request. CLI closure is a caller of this invariant, not its owner.
Non-passing findings and stale generations therefore cannot become durable Mind
state even through a forged-looking admission call.

The model runtime has a deterministic generation-retry proof at
`epiphany-openai-runtime/src/lib.rs`: both findings pass through the production
assistant-result parser and runtime-owned finding writer. Generation zero is
non-passing, Mind alone advances the route, generation one is passing and
admitted, and a stale generation-zero admission is refused. This proves typed
handoff and ownership without provider/network variance. The remaining smoke
boundary is process composition through `epiphany-work revise-modeling`, the
scheduler's consumer preflight, and Idunn's child lifecycle receipt.

Scheduler dry-run is now an authority projection rather than a vague promise.
When a current typed Modeling request has no finding or job, its
`advancedResult` names the current route, generation, request, generation-bound
job id, required preflight, and Idunn lifecycle ownership without opening a job
or spawning a process. A disposable authority test drives the production
revision mouth and scheduler and proves generation one is selected. The final
process proof must compare this projection with a real preflighted Idunn launch
receipt; it must not add a fake production runtime mode.

The physical comparison passes. A real generation-one scheduler pulse matched
the deterministic route/request/job projection, consumer preflight
fingerprinted the executable and compiled schema catalog, Idunn persisted the
launch lifecycle receipt, and the detached model runtime completed a passing
typed finding with empty stderr. A later scheduler dry-run saw that finding as
`admit-modeling`; it did not relaunch generation zero. This closes the
generation-retry authority path. Re-enter through a source-grounded Perfect
Machine audit rather than adding more closure machinery.

## Current Cut Line

Keep:

- native typed state and runtime stores;
- explicit organ gates and receipts;
- native coordinator/status surfaces;
- CultMesh/CultNet/Eve projection;
- Codex-compatible auth/model transport where still required.

Cut or correct next:

- current plans and handoff prose that still describe deleted Codex routes or
  bridge files as live mechanisms;
- wrapper arguments named for Codex when they no longer cross a Codex boundary;
- compatibility-shaped JSON field names inside native-only operator artifacts
  when no external contract requires them;
- misleading state/runtime store path names;
- any remaining full-context serializer or summary that duplicates typed owner
  state instead of projecting it narrowly.

## Native Heartbeat Service Boundary

The refreshed Perfect Machine audit selects runtime physiology as the next
organ boundary. `epiphany-heartbeat-store serve` now owns a native interval
loop around the existing `run_void_routine_store` primitive. It writes one
iteration directory per pulse, emits only a compact pulse receipt containing
artifact identity and success, supports bounded clean shutdown through
`--max-iterations`, and contains no child-process spawn or second state writer.
Heartbeat owns pulse timing; the next cut is to launch this binary through
Idunn and prove restart/resume, swarm-brake observability, and lifecycle
readback before demoting the PowerShell rumination vigil.
That cut is now proven. An engaged brake produced two compact refused pulses
without terminating `serve`; releasing it let the same persisted store complete
a routine. Idunn then launched two pulses and a separate one-pulse restart from
that store with empty stderr and lifecycle receipts. The attached PowerShell
vigil is deleted. The remaining service boundary is durable Idunn policy and
operator readback: advertise/configure the heartbeat service through typed
daemon state so restart intent survives beyond one explicit `service-launch`.
Source inspection corrected the proposed owner: standing daemon restart policy
requires a topology daemon and liveness status, while heartbeat is an
Idunn-managed child service. The durable owner must therefore be a typed
managed-service desired-state document keyed by service id. It delegates all
starts to the existing service lifecycle primitive and must not invent an
`epiphany-daemon-heartbeat` topology identity.
The typed desired-state surface is now implemented as
`epiphany.cultmesh.managed_service_policy.v0`, persisted at a service-id key.
`epiphany-daemon-supervisor managed-service-policy` writes command, args, cwd,
enabled/restart/backoff intent, sealed log refs, and the latest lifecycle
witness; `managed-service-read` projects desired state plus
`latestLifecycle`. It deliberately reports process observation as unknown
until a real reconcile probe exists, so an old launch receipt cannot claim the
service is alive.
That probe now exists. `managed-service-reconcile` reads only the service policy
and lifecycle history, observes the latest PID through the native platform
process API, applies enabled/restart-mode/cooldown decisions, and delegates a
restart to `service_launch`. Launch receipt ids now carry attempt time, so
restarts preserve history. Live root
`C:\Users\Meta\AppData\Local\Temp\epiphany-managed-reconcile-8e3d7cc5fe0b4c5fa38b18b3d00cea0c`
proved restart receipt
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783858125893`
and PID `19736` were observed alive after the prior process was killed. Next
fold this reconcile into Idunn's own serve loop and cut the full-context Verse
load from service launch.
Both cuts are landed. Service plan/launch now load only the typed swarm brake
and rely on their own typed writers to open/register the store; they do not
reseed or serialize the local Verse. `managed-service-serve` is a distinct Idunn
loop from standing-daemon `serve`, so child service desired state is not blocked
by absent topology restart policies. Live root
`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75`
proved PID `44276` was observed alive without duplication, then after forced
death the next pulse launched PID `40532` under unique receipt
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`.
The next boundary is provider-owned Eve sight over managed service desired/observed
state.
That first sight boundary is now implemented. `observe_native_process` moved
from the supervisor binary into a shared narrow core organ. Query aliases
`managed-services` and `idunn-services` join typed
service policy with latest lifecycle history and native observation, then read
only the compact heartbeat serve pulse line from the sealed stdout artifact.
Live row PID `25236` transitioned from `READY/alive` to `ATTN/dead` while
retaining pulse `completed`, iteration `1`, and lifecycle receipt
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859373793`.
No command args or routine payloads are projected. Next merge these rows into
the main provider-owned Eve composition rather than keeping a specialist query only.

## Semantic Projector Executor Authority

Canonical Mind and Modeling admission own projection demand. Their transaction
writes the exact semantic-projection obligation beside the canonical source
head; neither Idunn nor the projector may invent that demand. Idunn owns the
decision to assign an executor or fence an abandoned executor. The projector
owns only the claim-bound Qdrant mutation, post-write observation, attempt
terminalization, and exact success receipt.

The execution chain is now:

`canonical obligation -> Idunn acquisition CAS -> consumed executor grant + running claim/attempt -> epoch-isolated Qdrant synchronization -> canonical authority reauthentication -> terminal claim/attempt + exact receipt CAS`.

Acquisition binds scope, obligation, executor identity and incarnation,
purpose, Idunn incarnation, predecessor claim, and resulting claim epoch in one
consumed typed grant. `execute` cannot reopen an exact succeeded claim;
`repair` requires that exact predecessor. The execution CLI accepts a claim id,
not an executor label, and authenticates the consumed authority behind the
claim before touching Qdrant. Acquisition reauthenticates the complete sealed
canonical input and carries its authority envelopes through the same CAS, so a
persisted historical obligation cannot reopen an advanced source head.

Running-claim recovery reloads the exact Idunn poke intent/receipt and a
provider-authored immutable heartbeat event from CultMesh. It requires an
`awaiting-provider-heartbeat` lifecycle result followed by a newer ready
heartbeat for the replacement provider incarnation, hashes those source
envelopes, requires the heartbeat to name the exact restart receipt as its
startup cause, and consumes a typed recovery authorization in the same CAS that
fails the abandoned attempt and advances the claim epoch. The old executor can
thereafter write only its physically isolated abandoned Qdrant namespace and
cannot terminalize the active CultCache claim.

Projection health, elapsed time, process status, command exit, Qdrant counts,
CultMesh mirrors, Eve, and swarm overview remain derived sight. They cannot
create an obligation, grant, claim, attempt, success receipt, recovery, or
query admission. Initial execution, retry, repair, and recovered execution all
use the same claim-authenticating execution primitive; only acquisition and
recovery differ in how Idunn establishes the claim authority.

Verification covers concurrent acquisition with one winner and no issued
litter, predecessor/epoch ordering, purpose separation, claim-authority
authentication, evidence field substitution, lifecycle/heartbeat causal
ordering, recovery single use, and the inability of the recovery command to
execute projection work itself.

The packaged workstation body now contains the single projector owner, Idunn
supervisor, and semantic query verifier. Task Scheduler owns current-user
after-login presence of the foreground Idunn reconciler; the reserved typed
policy owns the exact projector launch shape; Idunn seals the launch receipt;
and the projector authenticates that receipt before taking the host-wide
canonical-store-pair singleton. `gamecult-ops` separately owns the foreground
Yggdrasil tunnel that exposes Qdrant on workstation loopback. Canonical store
and Qdrant placement remain one topology; dual projectors are forbidden.

Provider correlation is derived sight. The service-status projection reports
`provider-correlated` or `provider-degraded`, never semantic readiness. Query
admission authenticates the newest exact obligation/current/success chain and
alone owns readiness. Deployment proof uses the packaged verifier with explicit
`EPIPHANY_QDRANT_URL` and `EPIPHANY_OLLAMA_BASE_URL`; both Mind and Modeling
queries have returned semantic ranking under those explicit coordinates.

Stopping the scheduled reconciler does not kill its detached projector child.
Process ancestry is therefore current observation, not durable ownership, and
a task restart can reuse an already-running child. The missing proof is a real
operator-approved reboot/logon cycle that observes both tasks restored, the
tunnel ports live, a fresh post-boot reconciler -> exactly-one-projector chain,
a new launch-correlated provider heartbeat, and semantic ranking from both
packaged queries. This proves after-login physiology only. Reboot is outside
agent authority until the operator grants that exact host-wide action.

## Coordinator action authority and smoke boundary (2026-07-15)

The production coordinator now derives one path:
`typed status/evidence -> coordinator action -> shared action arm -> optional Hands gate`.
Typed status and accepted evidence own action selection; Hands/Substrate review
owns permission. Current typed thread state, accepted role results, and review
evidence are inputs. The action, run receipt, and optional Hands gate are
outputs. Smoke fixtures and scenario controls are derived verification state.

Production callers, wrappers, fixture flags, and smoke helpers are forbidden
writers of action, `canAutoRun`, review requirements, bootstrap state, and Hands
permission. The seven former production fixture flags and their override/helper
paths are deleted. The dedicated smoke creates fixtures only under
`.epiphany-smoke/mvp-coordinator`, then exercises the shared typed paths; it
rejects attempts to reintroduce those flags.

Future audit frontier, not established anatomy: sibling Bifrost subprocess JSON
used by readiness needs a focused identity/schema/provenance audit before any
cut or confirmed finding.

## Freshness -> reorientation authority (2026-07-15)

```text
canonical retrieval state -----------------------> retrieval judgment --+
legacy graph checkpoint + churn + frontier -----> legacy graph judgment -+--> reorientation decision --> CRRC/coordinator/launch
positive watcher changes ------------------------> watcher judgment -----+
durable investigation checkpoint ---------------------------------------+
```

`derive_freshness` owns the first three judgments. Retrieval Ready becomes
Clean only with an empty dirty-path set; otherwise it derives Stale. The legacy
thread graph can prove Stale from explicit frontier pressure, but cannot prove
Clean/Ready because it has no legal Modeling writer and cannot see canonical
RepoModel admission. Missing authority stays Missing/Unknown. Watcher silence stays
Unavailable/Unknown because no continuity receipt exists; Changed is positive
evidence. `surfaces/jobs.rs` consumes the same graph judgment for remap work.

`recommend_reorientation` alone owns Resume/Regather. Resume requires a
resume-ready investigation checkpoint, retrieval Clean, graph Clean, and a
watcher that is Clean or Unknown. Any retrieval/graph non-clean value or
watcher Dirty/Stale/Changed forces Regather. Path matches, status labels,
worker-launch documents, coordinator rows, and CRRC recommendations are derived
consumers and forbidden decision writers.

Canonical RepoModel is the admitted map, not the repository Body. Its exact
revision/hash and Mind-issued `RepoModelAdmissionReceipt` prove map identity
only. Future Ready additionally requires a nervous-system-owned, continuity-
bearing Body observation and retrieval coverage bound to the same source
generation; Mind derives readiness from that exact join. Legacy graph
checkpoints retain only checkpoint identity and frontier content; churn retains
understanding and diff pressure. Neither can publish graph freshness or a graph
revision. Generic thread patches, watcher silence, snapshot source metadata,
and unrelated thread revisions are forbidden readiness writers. Until every
authority is present and current, Unknown is the truthful result.

## Repository Body observation substrate (2026-07-15)

`repository_body_observer.rs` owns bounded `git_worktree` observation. A
separate bind command consumes the existing validated runtime swarm binding and
pins a caller-supplied workspace ID, exact runtime/swarm/source-identity hash,
canonical Git root, object format, scope, and ignore policy; observe cannot mint
identity. One observation-owned disposable index/object quarantine is initialized
with `read-tree`; two complete `git add --all -- .`/`write-tree`/staged-entry/
raw-byte manifest scans against that same private index must agree. The second
scan may reuse Git's verified index stat cache, but it still enumerates the whole
Body and cannot publish unless its tree and raw manifest exactly equal the first.
The index is deleted with the observation session and never becomes durable
truth. CultCache MessagePack persists immutable
generations and an exact-CAS current head; unchanged raw manifest preserves the
generation. The observer makes no historical continuity claim and has no Ready field.
Sparse checkout fails closed, submodules are gitlink-only, and RepoModel/
retrieval/scheduler/Mind integration is absent. The CultCache store must remain
outside the observed worktree so observer writes cannot become observed input.
Machine-global excludes are disabled during observation. Only accepted stable
observations persist; failed/unstable attempts return errors and advance no
head. HEAD absence counts as unborn only when a symbolic ref is proven absent.
Every Git subprocess strips ambient repository, worktree, object, ref,
namespace, index, shallow/graft, and injected-config environment authority.
The index owns ignore-aware UTF-8 path, Git mode, and gitlink enumeration; its
clean-filtered tree OID is auxiliary. Raw regular-file bytes and lengths, or
non-followed symlink-target bytes, feed ordered typed entries. A domain-separated
SHA-256 root over workspace, scope policy, and those entries is authoritative
Body identity. Manifest, observation, and manifest-root head land in one CAS.
Gitlinks remain nonrecursive. Unsafe or unrepresentable paths fail closed.

The bind rite also writes one immutable runtime-side
`RuntimeRepositoryBodyStoreBinding`. It names the canonical external Body-store
locator and hashes the exact Body binding while repeating runtime, swarm, and
workspace identity. Every read reopens the Body store and validates that chain.
One runtime cannot silently switch between Body stores; relocation or replacement
requires a future explicit migration receipt.

Every coordinator-owned Modeling launch now obtains a typed
`RepositoryBodyObservationBasis` before the worker thinks. The immutable launch
binds runtime/swarm/workspace/scope, Body-binding hash, observation
generation/id/root, and scan interval. Modeling output contract v3 requires the
worker-authored exact echo; result ingress rejects missing or substituted basis.
Non-Modeling launches and results cannot carry it. Mind review v1 and admission
receipt v5 preserve the same basis. Admission validates exact
launch/result/review equality and the referenced immutable historical Body
artifacts before copying it into the CAS receipt. It does not resample current
Body. Direct Mind adoption and legacy migration remain explicitly ungrounded.

## Mind readiness join boundary (2026-07-15)

A truthful whole-repository readiness join does not yet exist. Body-grounded
RepoModel admission now exists; Mind must own a
derived `RepositoryReadinessProjection`; Body observation, Modeling, retrieval,
semantic projection, schedulers, watchers, jobs, and UI are forbidden writers.
Its required inputs are a fresh validated Body observation, the canonical
RepoModel plus its exact Mind admission receipt carrying its Body basis,
the authenticated Modeling semantic projection receipt for that admitted model,
and exact workspace-retrieval coverage bound to the same Body manifest and a
named inclusion policy. Derivation must retry if any participating head advances.

The join is a race-bounded operation: observe Body root R1, validate every exact
artifact against R1, then observe again and require R2=R1 before emitting an
`observed-ready-at` receipt whose truth interval ends at the second scan. Later
reads must revalidate rather than present it as timeless Ready. A→B→A is harmless
when all artifacts are content-addressed to A. Gap-free watcher or journal
continuity is not required and cannot prove truth after its own final event.
Legacy retrieval `Ready`, empty dirty paths, timestamps, watcher silence, Git
tree or HEAD OIDs, Qdrant existence, counts, and unrelated generations are not
substitutes. Watchers and Hands receipts may trigger recomputation but cannot
replace either Body observation. The lossy JSON workspace manifest remains cache metadata, not
coverage authority. Semantic-projector Ready remains exact query eligibility for
the admitted RepoModel projection; it does not prove repository Body coverage.

## Counterfeit workspace retrieval organ removed (2026-07-15)

The old `retrieval.rs` module was not wired to any runtime, CLI, scheduler, or
app-server caller. It stored JSON under `CODEX_HOME`, identified files by
path/size/mtime/chunk count, used different filesystem walkers for exact and
semantic search, named Qdrant collections from workspace path plus model, and
could emit `Ready` from a missing manifest or query-time BM25. It had no Body,
runtime, swarm, workspace, policy, content-root, or observed point-set binding.
The module and re-exports are deleted. Legacy `EpiphanyRetrievalState` remains
presentation-only: clean `Ready` projects Missing, and its index job is
unavailable and unowned; dirty/stale data may warn but cannot authorize coverage.

The replacement starts from an authenticated historical Body manifest,
classifies every entry under one versioned inclusion policy, verifies eligible
live bytes against Body hashes, builds a Body-root/policy/index-epoch isolated
Qdrant projection, observes its deterministic point set, and only then publishes
an immutable CultCache coverage receipt. Qdrant remains disposable.

## Body-bound workspace coverage substrate (2026-07-15)

`workspace_retrieval_coverage.rs` now defines the truthful contract boundary
without pretending the projector exists. Obligation derivation reloads the exact
historical Body manifest through the authenticated runtime Body-store route;
callers cannot hand it a manifest-shaped claim. One versioned policy classifies
every ordered Body entry and seals the complete classification set into the
obligation. A separate projection plan seals chunker, projection, embedding, and
expected point-set identity, while deriving its physical Qdrant collection from
the Body-bound authority instead of accepting a caller-selected namespace.

Receipts validate only when an exact Qdrant scroll observation matches that
sealed plan, and heads join one workspace, obligation, plan, and receipt. This
module has no store writer, Qdrant actuator, query gate, or readiness writer.
The next organ must own CAS persistence and execution: verify eligible bytes
against the historical Body hashes, project, scroll-observe, then atomically
publish the receipt/head. Until then coverage remains absent.

### Projector authority map

Repository Body owns observed substrate only: its binding, immutable
observations/manifests, and current Body head. Projection activity must not
rewrite `body.cc`. Live Yggdrasil candidate `c94fa580` falsified the old shared-
store ownership by attributably rewriting `body.cc` while projection ran; it
remains rejected.

Commit `261c7bc8` adds the pinned transactional store foundation. The runtime
record `epiphany.runtime.workspace_coverage_store_binding.v0` selects one
canonical store path and file identity while sealing the exact repository Body
route/envelope and Body-binding hash. The store-local
`gamecult.epiphany.workspace_coverage_store_binding.v0` repeats runtime, swarm,
workspace, file identity, Body-binding hash, repository source identity,
projection scope, and backend. `open_workspace_coverage_authority` validates
both bindings and returns the owned transactional store together with exact
read-only Body authority. A naked path is never sufficient.

The workspace-coverage store owns obligation, plan, immutable claim/attempt and
recovery history, current-claim authority, checkpoint events/head, progress
events/latest, terminal receipt, coverage head, and retirement history. Qdrant
is disposable derived state. This ownership is the target, not yet the live
implementation: commit `261c7bc8` provides bindings and transactional keyed
storage, but existing projector writers still persist projection records in
Body or local Verse.

Inputs are the exact pinned Body route/binding and current observation basis,
sealed policy/plan/model identity, authenticated managed launch and provider
incarnation, exact Idunn recovery evidence, and waited Qdrant readback. Outputs
are the typed lifecycle/proof records above. Current claim, progress, coverage,
warming, active, readiness, and query eligibility are derived joins; none may
be manufactured by a path, heartbeat, Qdrant count, or stale head.

Forbidden writers are explicit: Body observer/bootstrap never writes projection
state; projector/checkpoint/recovery never writes Body; local Verse retains
managed process lifecycle but not coverage progress; Idunn, deploy scripts,
health, heartbeat, Qdrant, Eve, and swarm overview cannot advance coverage
authority.

The shared execution path resolves the runtime coverage binding, opens exact
Body read authority, then acquires against the exact current Body chain,
verify every included live file against its historical length and SHA-256,
derive deterministic chunks and UUIDv5 point descriptors, embed and write into
a claim/epoch-fenced plan collection, scroll the whole collection with typed
payloads, then terminal-CAS success in the coverage store after reopening and
reauthenticating the still-current Body head. Plans
must seal an ID-to-payload binding root; equal counts or equal IDs do not prove
the indexed content. Receipt/head constructors and writers remain projector-
private. Live query eligibility re-observes Qdrant; a stored receipt proves only
that one exact observation completed.

Each waited batch/readback must transactionally admit its checkpoint event/head
and derived progress event/latest together in the coverage store. Cross-store
atomicity is not invented: Body is authenticated before the coverage CAS and
reopened afterward; if it moved, the projection evidence remains historical and
cannot become current. Claim authority is scoped to Body generation so an old
running claim cannot block new Body work. Same-Body abandoned-owner recovery
remains possible only through exact Idunn predecessor termination and
replacement authority.

Migration/cut line: quiesce projection, create and bind the coverage store,
copy projection envelopes from Body and progress envelopes from Verse while
preserving exact envelopes/digests, validate every chain, activate the runtime
binding as the single authority switch, then CAS-remove legacy records. After
activation legacy residue is inert. Missing binding, divergent sources, or
partial migration fail closed. No dual-read or fallback path survives. Every
bootstrap/deploy path must create the bound store before service start.

The execution path is reachable only through the reserved packaged workspace-
coverage projector managed by Idunn. It validates plan-sealed text hashes and vector
dimensions, creates or authenticates one exact managed claim/epoch Qdrant
collection, writes no empty upsert, whole-scrolls typed payloads, rejects cyclic
pagination plus duplicate/extra/missing/substituted points, and terminal-CASes
the receipt/head against the exact current Body authority, immutable plan,
running claim/attempt, and prior coverage head acquired at start. A CAS loser
cannot mint a receipt; failure can terminalize after Body advance.

The dedicated workspace-coverage projector binds claims to an authenticated
executor incarnation and reserved managed-process launch. Its pulse has an exact
`Current` result and rematerializes text through the authenticated historical
Body session rather than caller-supplied bytes. Abandoned-claim recovery admits
only immutable host-signed termination, one causally linked replacement launch,
and that replacement's latest signed ready heartbeat before one Body-store CAS.
Time, Qdrant state, generic policy, process guesses, and caller strings are not
abandonment authority. If Body advanced, recovery terminalizes the stale claim
and lets normal acquisition derive a new plan; it never resurrects stale work.

### Dedicated service and exact semantic proof

The dedicated service is now a real reserved managed body, not a generic job.
Its policy fixes the packaged sibling executable and exact runtime/Verse/
Qdrant/Ollama arguments. Startup authenticates the policy-bound launch receipt,
PID, executable hash, runtime identity, immutable Body-store route, and one
host-wide singleton. Claims and attempts bind that executor incarnation and
startup receipt.

Each pulse reloads only the persisted current Body basis, resolves the mutable
Ollama tag to its installed artifact digest, and probes dimensions. An exact
head/obligation/plan/receipt fast path returns Current without reading worktree
files. Needed work opens one authenticated Body read session, verifies every
eligible file and chunk, embeds only after claim acquisition, and observes both
typed payloads and exact stored vectors. Receipt identity includes the vector-
binding set; wrong, missing, nonfinite, or wrong-dimensional vectors cannot mint
success. Body history derives retirement candidates for terminal non-current
claim collections; current and running collections are preserved, and Qdrant
deletion requires exact managed metadata.

Recovery is present through Idunn's reserved reconciliation path. Launch,
heartbeat, and termination serialize through one per-launch process-evidence
head. Host-signed termination binds host+boot incarnation, exact native process
identity, executable, policy, and launch; it may seal death before heartbeat one
without turning timeout or PID absence into authority. One termination admits
one causal replacement slot. Recovery then requires the replacement's latest
signed ready heartbeat and commits failed history, epoch+1 successor, and an
immutable evidence-digest receipt in one Body CAS. PID reuse, access failure,
indeterminate observation, stale ready replay, and timeout remain inadmissible.

### Resident organizational Self

Resident wake scheduling has one owner. The standard heartbeat consumes one
pending typed pressure and atomically emits one single-consumption Self grant;
`epiphany-swarm` does not invent work from an idle loop. Accepted pressure is
bounded to operator objective, Body-map drift, and reviewable Imagination
proposal documents. Persona feedback remains persisted pressure and cannot
become a resident grant or coordinator objective; it enters Imagination only
through the separate typed consideration carrier. Those documents request
attention only. They
cannot adopt Mind state, authorize Hands, publish a release, or deploy it.

Resident Self owns the grant-to-coordinator process transaction. Its inputs are
the authenticated packaged-release witness, separate resident/runtime/Verse/
Mind stores, the heartbeat grant, the swarm brake, and exact process
observations. It outputs an immutable preparation, child claim, exact active
turn lease, coordinator terminal receipt binding, and terminal acknowledgement
back to heartbeat. The active turn and cooldown are derived from that chain;
PID, exit code, journal output, and an unbound coordinator receipt are sight,
not completion authority.

Preparation and grant consumption share one CAS. The packaged coordinator must
claim the preparation before cognition, binding process id, creation token,
executable path and digest, grant, and launch digest. Resident Self then
acknowledges exactly that claim. Completion requires the same turn, grant,
launch digest, release identity, and coordinator receipt. Brake or timeout
drains the exact process and cannot silently abandon a live lease. A prepared
launch survives scheduler restart: an unclaimed preparation safely retries the
same grant and launch contract, while a claimed preparation reattaches only to
the exact process incarnation recorded by the packaged child before cognition.

Forbidden writers are the old source-tree/Cargo `epiphany-swarm` wrapper,
`epiphany-work` queue machinery, free-running heartbeat loops, Persona,
Imagination, Modeling, coordinator artifacts, process exit, systemd, and
presentation projections. Direct operator objectives and domain-derived
pressure use the same pressure -> heartbeat grant -> preparation -> child claim
-> lease -> exact receipt -> terminal acknowledgement path. The cut line removes
the former `online`, `run`, `run-queue`, and `pulse` authority and packages the
swarm, coordinator, model runtime, and tool spine as witnessed sibling binaries.

Verification belongs at the typed transition layer: CAS-loss and replay tests,
store-separation checks, packaged-witness authentication, brake/timeout process
timeline tests, child-claim-before-cognition proof, exact receipt substitution
rejection, and negative scans proving no runtime Cargo or historical queue path
survives. A nonblocking trust seam remains: the parent currently compares its
post-launch process observation with the child's atomic claim. The claim closes
child bootstrap authority, but a future hardening pass should replace parent
observation trust with an OS-authenticated parent/child launch channel where the
host supports one; it is not permission to accept PID-only identity.

### Resident deployment and organizational loop

Heartbeat `serve` owns one physiology sequence: reconcile an exact terminal
acknowledgement; retain pressure under the brake; refuse replacement while a
coordinator is active; emit one grant when clear and pressured; otherwise run
bounded void/sleep work. Restart resumes typed state rather than inferring
completion from exit codes or journals.

`epiphany-swarm status` is a non-actuating join over exact
runtime/release/witness/source identity, packaged siblings, physical store
separation, heartbeat and Self freshness/coherence, lease sight,
runtime-scoped brake, writable workspace, and credential posture. The daemon
supervisor remains the sole signed Idunn health writer and may aggregate the
exact heartbeat/Self provider pair. Wrong-release evidence contradicts;
missing evidence warms; stale or incoherent evidence degrades. Readiness,
health, systemd, and PID sight cannot write deployment admission.

Provider liveness is owned by each role's cross-process singleton beside its
mounted store. The provider's CAS-replaced readiness row binds that live role
to exact release, witness, source, executable, status, monotonic sequence, and
bounded freshness. PID/creation-token observation is same-namespace diagnostic
evidence; it is not a cross-container liveness owner because PID namespaces do
not preserve that observation. Each predicate samples its evaluation time only
after loading the exact provider row; release authentication time cannot make a
concurrent refresh appear future-dated. Readiness may accept only a narrowly
bounded future skew around that observation and must still reject a genuinely
future-dated row. Status and supervisor aggregation share this derivation.
Neither a fresh row without the role lock nor a role lock without the exact
fresh row can become ready.

Exact packaged `16407f7e` proves the two-container implementation. With
Heartbeat and resident Self in distinct PID namespaces, a third observer
projected `active` with both providers fresh. Stopping only Heartbeat immediately
projected `warming` and named `role-singleton` while its identity row was still
fresh; restarting that exact container restored `active`. Actual c006 now runs
the same release under brake and projects `active` with no reasons. Receipts are
under `.epiphany-run/readiness-16407f7e` and
`.epiphany-run/c006-readiness-16407f7e`.

### Narrow Idunn lifecycle brake sight

Managed-task install/control, service-runbook construction, and repo-work
service audit own lifecycle effects or lifecycle evidence. Their only local
Verse gate is the canonical swarm brake. They load that one typed family and
delegate to the shared lifecycle-brake predicate; they do not materialize
daemon topology, provider state, tools, Eve surfaces, or unrelated receipts.
Cluster reconciliation and cluster runbook paths retain the broader context
only where their outputs actually enumerate daemon rows. The cut line removes
full-context reads from the four narrow lifecycle commands without changing the
brake decision or granting a new writer.

Yggdrasil separates provenance from Body. `/srv/epiphany/source/current` is
immutable release source. `/var/lib/gamecult/epiphany/workspace` is the writable
domain Body carrying repository binding, persistent Modeling map, Mind state,
and Hands consequences. Service authority is split as follows:

- `epiphany.service`: supervisor/projector and signed aggregate health;
- `epiphany-heartbeat.service`: heartbeat pressure, state, and grants;
- `epiphany-swarm.service`: resident-Self state and bounded coordinator turns.

Coordinator, model runtime, and tool spine are witnessed bounded children.
Deployment authenticates them, preserves coverage checkpoints across retries,
initializes heartbeat, manages the three units together, waits for typed
readiness, and crosses admission only through Idunn.

```text
domain Body -> persistent Modeling map -> Self pressure -> Imagination proposal
     ^                 ^                                         |
     |                 +-- Self proposal-review request ----------+
     |                            ^                                v
     |  signed feedback -> Self consideration -> Imagination candidate
     |                                                   Mind review/adoption
     |                                                           |
     +---------------- Hands consequence <- explicit route -------+
                                   |
                          Bifrost exact release
                                   |
                            Idunn deployment
```

Every arrow is a typed request or receipt. Persona owns conversation;
Modeling owns the persistent map; Imagination proposes; Mind adopts, refuses,
or holds; Hands changes the Body only through an explicit route; Bifrost and
Idunn separately own release and deployment. Operator silence permits bounded
observation, map maintenance, rumination, and proposals. It grants none of the
later consequences.

The frontier-planning substrate is already complete below the MVP mouth.
`runtime_spine.rs::select_and_commit_repo_frontier_planning_request` selects one
admitted, unchallenged active Imagination frontier. `coordinator_launch.rs`
transports that exact request only through an exclusive Imagination launch and
persists its launch binding. `commit_repo_frontier_plan_mind_request` binds the
immutable Imagination result and candidate to a dedicated Mind request;
`EPIPHANY_MIND_ROLE_BINDING_ID` owns that review launch.
`commit_repo_frontier_plan_decision` then revalidates the entire causal chain and
atomically adopts or refuses it against the current model.

Self now observes this chain through
`runtime_repo_frontier_planning_lifecycle`, a read-only projection whose stages
are derived from the canonical request, launch bindings, immutable worker
results, Mind request, and decision receipt. The MVP coordinator advances each
stage only through the established commit primitive: select planning, launch
exclusive Imagination, request Mind review, launch the dedicated reviewer, and
commit Mind's decision. Failed Imagination or Mind jobs become explicit review
stages rather than remaining indistinguishable from running jobs. A terminal
Hold or Refuse suppresses immediate replanning of the same current authority.
Exact packaged `c35272c9` proves the live chain through the Mind boundary: fresh
accepted Modeling minted one typed Imagination frontier, Self selected it over
older CRRC regather display state, Imagination completed, and Self committed the
dedicated Mind request without adopting the candidate or granting Hands
authority. Mind launch, judgment, and decision commit remain next.

Selected user proposals are also native Self input. The runtime projection
`runtime_pending_repo_frontier_proposal_modeling_request` returns the single
validated selection with no launch binding. Coordinator status routes that
authority before generic regather. The MVP no longer rewrites an
`awaitFrontierProposal` action from a CLI flag; an optional request ID is only
an equality assertion over Self's derived request. This cuts the split owner
exposed when exact `881b2b1a` saw the live v23 proposal but remained in manual
regather.

Proposal Modeling receives the canonical RepoModel shape, including current
domain, claim, and frontier identity. `existingFrontier` is the operation
boundary: `upsert_frontier` creates only a genuinely new id, while
`revise_frontier` changes an id already owned by Modeling. Admission still
fail-closes both mistakes. This context is required because exact `737f2b94`
correctly routed a live proposal but the worker, deprived of the frontier
inventory, attempted to upsert an existing item and was rejected.

The autonomous proposal crossing is source-grounded in
`runtime_spine.rs`, `admitted_model_direction_consideration.rs`,
`coordinator_launch.rs`, and `repo_model_gateway.rs`. A deployment-configured
`RuntimeRepositoryDomainBinding` immutably joins the runtime/swarm/workspace to
the exact repository Body binding. It names organizational jurisdiction only;
it is not proof of a Git remote. Self promotion reloads the exact direction
request/result, worker result and launch, admitted model receipt, domain
binding, and Body-owned canonical Git root, then one preserved-authority CAS
creates an inert frontier proposal and its Modeling selection. The generic
proposal mouth rejects Imagination provenance so it cannot substitute for this
causal crossing.

One admitted Imagination result may expose at most three `option_drafts`.
`MAX_OPTION_DRAFTS` is the single owner of that fan-out bound: the declared
worker output schema rejects a larger array before admission, and
`validate_result` rejects any substituted or legacy result that exceeds it.
Promotion remains one preserved-authority CAS per option and resident ingestion
still exposes only the current unbound selection. Scheduler ordering is not a
backpressure substitute; the producer itself is bounded so one model turn
cannot mint an unbounded durable proposal/selection/pressure queue.

Proposal Modeling is structurally bounded: its sole frontier upsert must
recommend `Imagination` and carry no adopted plan. Proposal Evolution is
insert-only. Ordinary Modeling has one separate standing transition: the typed
`checkpoint-update-needed` verdict asserts that the Body map contains a future
design gap and must mint exactly one new active, unadopted frontier recommending
`Imagination`, with no unresolved dependencies, safe non-empty source scope,
and evidence grounded in the result. `checkpoint-ready` and `regather-needed`
cannot mutate frontier. `nextSafeMove` is display-only. Therefore map
direction can become an inspectable proposal and planning request, but not a
Hands route. The full-chain hostile test supplies an exact proposal-citing
Modeling result that recommends direct Hands; Mind admission rejects it before
mutation, the store remains byte-identical, and Hands authority remains absent.
Only the existing explicit Mind adoption transition may create the route that
Hands consumes.

Self remains a router, not a prose interpreter. Once Mind accepts the ordinary
future-gap patch, the existing frontier-planning eligibility projection sees
the typed active frontier and launches Imagination before generic CRRC or
manual regather. Modeling owns representation of the gap; Imagination owns
possible futures; Mind alone may adopt one; Hands receives no authority from
this transition.

This map must change when ownership changes. Historical scars belong in git,
evidence, or an explicitly archived note—not in the machine's Modeling state.

### Resident producer replay identity

Resident domain ingestion is an at-least-once producer. The source request ID,
kind, provenance, objective, schema, and privacy boundary own pressure identity.
`created_at_millis` records the first observation; `status` and
`consumed_by_grant_id` belong to the heartbeat lifecycle. They are not producer
identity and cannot make an identical later ingestion conflict or recreate work.

`enqueue_resident_self_pressure_idempotent` therefore accepts an existing row
only when its immutable producer fields match, regardless of later observation
time or grant consumption. It still rejects any same-ID substitution of kind,
provenance, objective, schema, or privacy authority. The shared path applies to
admitted-model direction, autonomous proposal Modeling, and Imagination
consideration pressure. Verification replays after timestamp change and after
heartbeat consumption, and retains a hostile changed-objective collision.

Resident cancellation owns retry admission for a failed bounded coordinator
turn. In the same CAS that clears the exact active lease and writes its typed
terminal acknowledgement, cancellation verifies the grant still owns the
source pressure and returns that pressure from `consumed` to `pending`. It does
not mint the retry grant. The standard heartbeat remains the sole scheduler and
may issue a new grant with a new identity for the same exact pressure after it
has reconciled the terminal turn. A failed launch can therefore recover without
operator pressure duplication or an authority-bypassing coordinator call.
Grant identity includes the pressure-local attempt ordinal as well as heartbeat
schedule and action identity. Historical grants remain immutable receipts; a
retry cannot collide with its predecessor even when heartbeat reconciles the
failed turn and schedules the replacement within the same physiological action.
Concurrent issuers still derive the same next ordinal and contend on the one
pending-pressure CAS, so attempt identity does not weaken single consumption.

Typed pressure does not own a new coordinator thread. Imagination
consideration, admitted-model direction consideration, and autonomous proposal
Modeling requests each carry the implementation thread that owns their causal
state. Resident preparation reloads that exact request from the runtime store,
verifies its runtime identity against the immutable identity of that mounted
runtime store, and binds its thread into the coordinator argv. The release
publication runtime is a separate authority: it authenticates the packaged
binary body but does not decide which cognitive runtime owns a typed request.
This distinction matters in the live Starfire topology, where release runtime
`epiphany-starfire-linux` mounts the Eyes cognition store whose identity is
`epiphany-starfire-linux-eyes-tools`. Comparing a request to the release
runtime falsely rejects valid local cognition; comparing it to its own store
still refuses a request imported from a foreign runtime.

The live identity matrix is explicit:

- packaged-release witness runtime authenticates the binary publication;
- mounted runtime-store identity owns coordinator execution, request identity,
  runtime mutation, and the coordinator's `--runtime-id`;
- mounted runtime-store identity also owns the local-Verse brake namespace for
  Heartbeat scheduling, resident Self, and its coordinator child. Each resident
  process resolves that identity from the immutable runtime envelope;
  release/provider identity cannot choose a second kill switch merely because
  it authenticated the binary;
- cognition readiness projects mounted cognition as `runtimeId`, authenticated
  binary provenance separately as `releaseRuntimeId`, and reads the brake only
  under mounted cognition. Operator sight and resident actuation therefore
  observe the same kill switch;
- Persona feedback target identity belongs to the feedback crossing contract
  and is not silently rewritten when cognition mounts a narrower runtime.

Plain operator objectives also execute against the mounted cognitive runtime
and derive `resident-self-thread-{cognitive-runtime}`. They do not get a second
runtime truth merely because no typed domain request supplied one.
The prepared argv is then the single source for child launch and lease thread
identity. Only plain operator objectives use the resident runtime thread.
`epiphany-swarm` no longer reconstructs a fixed thread after preparation.

An Imagination direction result may contain several option drafts. Autonomous
promotion gives every option its own proposal, provenance binding, and explicit
proposal-Modeling request. These are selected work items, not candidates still
awaiting preference. `runtime_pending_repo_frontier_proposal_modeling_request`
therefore schedules the oldest unclaimed request by `selected_at`, then stable
request ID. A launch binding removes only its exact request from the pending
queue, exposing the next. Resident ingestion queries that same head and emits
pressure for only that request. It does not mirror every selected request into
a second independently ordered pressure queue. Self owns queue order; it does
not silently discard or rank Imagination's already-selected options, and
heartbeat owns opportunity without acquiring a second scheduling opinion.

Resident terminal success is also pressure-specific. For a
`repo-frontier-proposal-modeling` grant, a zero-exit coordinator receipt proves
only that the bounded coordinator process ended cleanly; it does not prove the
requested Modeling work reached a typed terminal result. The resident active
turn therefore remains the sole acknowledgement owner after coordinator exit.
For every typed lane it asks one runtime-spine-owned verifier whether the exact
request has one authenticated terminal worker result. The verifier replays the
same immutable runtime admission path that owns worker launch role/binding,
request/runtime/thread/job identity, launch projection, foreign-cargo
exclusion, and typed companion persistence. Proposal Modeling adds its exact
selection, proposal payload, autonomous origin chain, launch binding, immutable
launch Body basis, Evolution patch, and proposal-citing frontier contract.
Delayed fulfillment does not re-read the current external Body status: that
mutable eligibility belongs to Mind admission, which separately revalidates the
live Body binding before changing RepoModel. An autonomous proposal may return
to Imagination or route to Eyes for more evidence, but cannot route directly to
Hands or smuggle an adopted plan before Mind adoption. Missing
terminal evidence is `awaiting-fulfillment`: the active lease remains live and
cannot be retained, relaunched, acknowledged, or requeued. A later serve cycle
consumes the route exactly once when the typed evidence appears. Brake,
shutdown, or timeout while waiting uses the existing cancellation CAS to close
the lease once and return its exact pressure to Heartbeat; invalid or
substituted evidence closes as `unfulfilled`. Coordinator process closure is
therefore evidence, never cognitive completion authority.

A failed coordinator receipt cannot erase a valid typed completion. This
matters when a continuation launch claims a proposal immediately before an
already-enqueued proposal grant is delivered: the second coordinator correctly
refuses the duplicate launch, while the first detached worker may still finish
the exact request. Resident settlement records that grant as `fulfilled`, not
as the failed process status. Continuation ingress may derive
`reviewModelingResult` only when the failed receipt, its exact resident grant
and launch digest, one terminal acknowledgement, the authenticated proposal
fulfillment, and the current Modeling job link all agree, and no acceptance
receipt already exists. The job link is launch authority; its result ID remains
unset until acceptance and is not pre-acceptance evidence. The failed process receipt remains process evidence;
the typed result owns cognitive review readiness. This route cannot launch a
second worker or continue into Hands.

Receipt-derived launch actions are revalidated at preparation. A terminal role
result overtakes an older `launchResearch`, `launchModeling`, or
`launchVerification` continuation before process creation. Resident Self then
atomically marks the exact unlaunched grant `superseded`, leaves its consumed
pressure closed, and emits one Heartbeat acknowledgement bound to the
originating receipt. The stale receipt remains evidence but no longer owns a
launch; Heartbeat may then schedule the current typed review pressure. This is
grant-owned closure, not deletion or retry repair.

Exact packaged `6dd9b132` proves that ownership cut live. One autonomous
proposal Modeling coordinator exited while its detached worker continued; Self
held the same lease as `awaiting-fulfillment`. Runtime later admitted one exact
`checkpoint-update-needed` result whose proposal-citing frontier routed to
Eyes. Self consumed it once, wrote one `planned` acknowledgement, terminalized
the exact grant, and persisted cooldown. Continued serve cycles produced no
second result or acknowledgement, and SIGTERM ended braked with exit zero.

Resident Self now owns only the mapping from grant provenance to a typed runtime
request reference and the lease transition driven by the verdict. It does not
scan worker rows or recreate candidate/result policy. No claimant means
Pending; one authenticated claimant means Fulfilled; item errors, missing or
swapped launches/bindings, missing companions, foreign cargo, and multiple
claimants fail closed. Replaying a result already persisted by runtime admission
is validation-only: exact idempotence performs no write, while a missing
companion or changed envelope refuses before mutation.

Terminal completion owns its cooldown in that same resident-state and
acknowledgement CAS. `next_eligible_at_millis` is persisted from the configured
cooldown before the active lease disappears. The serve loop's sleep is only a
process-efficiency detail; restart cannot become a second eligibility owner.
The shared preparation primitive reloads the persisted state and refuses every
grant before that deadline, so `serve`, `once`, and crash/restart do not need
separate cooldown opinions.

One Heartbeat coordinator turn owns at most one resident grant. Grant issuance
first loads every persisted grant and refuses if any grant already names the
requesting schedule/action, whether consumed or not. It also refuses any other
unconsumed grant plus prepared or active Self authority, then atomically advances
the singleton `ResidentSelfState` revision with the exact pressure-to-grant
transition. Persisted grant identity is the lifetime cardinality fence; the
state-envelope CAS is the concurrency fence. Completion, cancellation, cooldown
expiry, restart, or later pressure cannot restore grant authority to the same
Heartbeat turn. Pressure arriving after that turn spent its grant stays pending
until Heartbeat consumes the exact terminal acknowledgement and schedules a
different coordinator turn.

Each `ResidentSelfHeartbeatGrant` owns its irreversible terminality. Completion
and cancellation write the exact grant's terminal timestamp and status in the
same snapshot-fenced CAS that clears its active lease. Pending-grant selection
and Heartbeat issuance read that grant-owned fact before considering the mutable
`consumed_at_millis` marker. `ResidentSelfTerminalAck` is no longer a launch
authority; it is Heartbeat-facing notification and provenance. Its absence or
qualified lifecycle retirement cannot resurrect a grant. The consumed marker
proves preparation consumed launch authority; clearing it cannot reopen a
terminal grant after completion, cancellation, restart, stale-envelope
resolution, or marker regression.

Imagination candidate time is part of that causal contract. A candidate must
have a valid RFC3339 timestamp at or after its request timestamp. A
well-shaped candidate from before the request cannot close resident authority.

Typed resident launches run the bounded coordinator in planning mode so an
ordinary operator objective cannot silently become actuation. Request-owned
lanes that already carry their own authority therefore act through exclusive
startup handlers before the generic planning loop: Imagination consideration,
admitted model-direction consideration, and proposal-bound Modeling each load
their exact request and launch only that request's worker. Proposal Modeling
must not depend on the later generic `launchModeling` action loop; planning mode
intentionally stops before that loop actuates. Its startup handler creates the
exact `RepoFrontierProposalModelingLaunchBinding` that resident fulfillment
then verifies.

Role tool authority belongs to the role-scoped adapter, not to resident Self.
Resident preparation therefore does not append a blanket `--no-auto-tools`:
Modeling and Eyes must be able to inspect their Body through the adapter's
read-only grants, while the adapter still refuses tools outside the launched
organ contract. Live v41 proved the distinction: tool-starved Modeling twice
returned an empty non-typed payload; the same bounded recovery with native
tools produced a grounded typed result.

Output shape must also match launch authority. Ordinary Modeling with no typed
proposal, claim-repair, or verdict request exposes only node/edge evolution in
its output schema. Frontier operations remain available only behind the typed
authority fields whose exact identities Mind validates. This moves the first
line of defense from a prose warning plus downstream rejection into the model's
declared output contract; Mind remains the final admission owner.

Live v42 proves that contract end to end: ordinary resident Modeling received
read-only source tools, grounded its map in inspected repository paths, emitted
only generic node/edge evolution, and reached Mind RepoModel admission. The next
split is downstream. CRRC still derives resumability from the thread state's
durable investigation checkpoint, while Modeling acceptance commits RepoModel
admission plus observation/evidence state and does not establish that
checkpoint. Consequently accepted Modeling can leave `prepareCheckpoint` true
and trigger another generic Modeling launch. Neither generic `statePatch` nor
the worker may become a second checkpoint owner. A typed proposal now asks the
frontier-planning circuit to choose one authority: either Mind admission derives
the continuity checkpoint deterministically from accepted RepoModel evidence,
or CRRC consumes canonical RepoModel admission directly. Canonical Imagination
and dedicated Mind must adopt the choice before Hands changes the seam.

Fresh v49 proves the current planning path through canonical Imagination and
dedicated Mind adoption. Its six safe paths are the complete implementation
owner set at that revision; the previously named vendored app-server owner does
not exist. The route is nevertheless preserved as incomplete evidence because
the machine itself lacked the newly required relinquishment transaction when
Mind adopted that plan. Historical route authority is never widened after the
fact.

The live repair boundary is split deliberately. `hands_gateway.rs` defines the
immutable refusal receipt. `runtime_spine.rs::relinquish_repo_frontier_hands_route`
requires exactly one still-current route/authority/intent/review/grant chain,
requires at least one safe missing path outside the adopted scope, and refuses
to run after patch, command, commit, or PR consequences exist. Hands attests
inability; it does not revise RepoModel. In the same compare-and-swap, Mind
writes its review and admission receipts, retires the exact frontier through
`RepoModelPatchPurpose::RelinquishFrontierRoute`, emits the next Modeling
projection obligation, and records the companion relinquishment receipt. The
route and authority remain immutable historical evidence. Their old
model revision/hash can no longer validate after the retirement admission, so
they are structurally unable to authorize edits. Native status projects the
latest relinquishment; `epiphany-hands-action record-refusal` is the operator
mouth. Generic Modeling admission explicitly rejects this Mind-owned purpose,
and the full consequence/Soul path remains the only route to a `Resolved`
frontier.

Planning failure has two adjacent authorities. The generic runtime job owns
process and transport terminal status. The typed role result owns what Self may
infer about a faculty outcome. `runtime_repo_frontier_planning_lifecycle` reads
the latter by exact planning request or launch job identity; it deliberately
does not treat an arbitrary failed process as an Imagination judgment. A worker
adapter that rejects a malformed planning candidate must therefore persist both
receipts: the generic failed job and a non-executable typed Imagination result
with `item_error`, exact launch job identity, and no candidate cargo. Without
that projection, a dead failed job remains `ImaginationRunning` and the current
planning request has no lawful review or retry transition. Native interrupt is
not the missing owner: it may stop or block a binding, but it cannot fabricate
the faculty result that Self's lifecycle consumes.

The repair must not collapse retry scheduling into the semantic planning
request. The current request ID is a deterministic function of runtime, thread,
model, and frontier identity; it describes *what* is being planned. A retry is
an attempt to execute that same authority, not a new semantic request and not a
mutation of the old launch receipt.

- Owner: the model adapter owns syntactic ingress and must canonicalize
  set-shaped candidate fields such as safe paths before validation. Ordering is
  serialization, not Imagination authority. Mind still owns whether the
  resulting canonical paths stay within the request ceiling.
- Owner: the model adapter also owns one non-executable typed role failure when
  candidate parsing or validation fails. It binds the exact worker launch job,
  carries `item_error`, carries no candidate or foreign authority cargo, and is
  adjacent to—not replaced by—the generic failed runtime-job receipt.
- Owner: Self owns attempt scheduling. An explicit reviewed failure may
  authorize a new immutable attempt for the same semantic planning request.
  Attempt identity and launch binding must be unique and monotonic; the prior
  launch and failure remain immutable evidence.
- Derived state: planning lifecycle reads the latest lawful attempt while
  retaining earlier failures. `ImaginationFailed` is a review boundary, not an
  implicit retry and not a terminal judgment on the frontier itself.
- Forbidden writers: native interrupt cannot author faculty failure; generic
  job status cannot become Imagination truth; a new launch cannot overwrite the
  old binding; and retry cannot mint a new model/frontier authority or bypass
  the current request's Body hashes.
- Negative checks: malformed output yields both failure receipts; no retry is
  launchable before explicit failure review; exactly one next attempt becomes
  launchable afterward; stale or substituted review identity is refused; prior
  failed attempts cannot later supply a candidate or override the successful
  attempt.

Live v50 exposed a missing-context fault at the Imagination boundary. Runtime
spine already enforces that every candidate `safe_paths` entry equals an
immutable planning `source_scope` entry or descends from one. The model-facing
schema described only a non-empty string array, and the runtime output contract
asked for identity echo without stating the ceiling. Two consecutive canonical
Imagination attempts therefore expanded scope and failed closed with no
candidate cargo. The repair belongs at context ownership: the schema and
runtime contract now state that safe paths are a sorted, duplicate-free
narrowing of source scope, and adjacent useful files belong in stop conditions.
The validator remains unchanged and Mind retains final admission authority.

Fresh v51 moved the same immutable planning authority past that ceiling and
exposed the next retry invariant. Self correctly names attempt zero
`repo-frontier-planning-launch-<request>` and later immutable attempts
`repo-frontier-planning-launch-<request>-attempt-<ordinal>`. Result validation
nevertheless required the attempt-zero record ID for every successful result.
Consequently failures and reviews could schedule retries, but no retry could
ever become a valid Imagination result. Validation now derives the expected
record ID from the persisted binding's attempt ordinal. The regression test
proves failure, explicit review, suffixed retry binding, successful result
persistence, and transition to `ImaginationResultReady` without relaxing any
other causal identity.

Fresh v52 then proved that full retry path live: the same planning authority
produced a valid typed candidate, dedicated Mind adopted it, RepoModel advanced
to revision 5, and the substrate derived `Hands=true`. A separately launched
proposal-bound Modeling result became stale at that admission and was correctly
rejected. Coordinator action ordering nevertheless treated its reviewed failure
as a demand for a new proposal before consulting the newer actionable Hands
frontier. This let stale worker history preempt current Mind authority. The
coordinator now excludes exactly the state `(reviewed proposal failure, current
Hands frontier)` from stale-result recovery, allowing the existing Hands branch
to own the decision. Without a Hands frontier, the consumed proposal still
fails closed at `awaitFrontierProposal`; ordinary non-proposal failures still
route back to Modeling.

## Supervisor execution-amendment authority

Owner: Mind owns a single-use repair when an immutable adopted plan contains a
non-executable command that cannot bind an already-observed Hands consequence.
The original Imagination plan and Self route remain immutable evidence.

Inputs: one exact current route, the exact current frontier-item hash, hashes of
the original action and command, authenticated supervisor actor/command/admission
and packet provenance, one replacement action and command, rationale, and an
operator-owned timestamp.

Outputs: one new RepoModel revision plus Mind review, admission, execution-
amendment, and Modeling-projection receipts in one compare-and-swap. Self must
derive a fresh route from the amended model; the old route cannot become current
again. Hands command receipts bind `effective_command`, and the gate projects
both original and effective values for inspection.

Forbidden writers: generic Modeling admission cannot carry the amendment
operation; Hands cannot substitute a command; a stale route cannot be amended;
and an already-amended plan cannot be amended again. The amendment is not a
repair loop and does not erase failed Soul launches or historical Hands receipts.

Verification layer: focused derivation tests prove exact success, original-plan
preservation, single-use refusal, and generic-purpose refusal. The Hands receipt
test proves a mismatched stated command leaves the store byte-identical before
the exact command succeeds. Live v53 now proves the amended route through exact
Hands receipts and an accepted Soul result at thread-state revision 31.

Self resolves the complete Soul lifecycle before generic CRRC/regather routing.
A pending or running Soul job routes only to result observation. A completed,
accepted Soul result routes according to its verdict: bounded missing evidence
may return to Hands, while an accepted pass or non-pass awaiting model
incorporation routes Modeling. CRRC cannot mint a replacement Hands gate while
Soul is running or after Soul has established the newer causal boundary.

## Soul provenance classification for adopted frontier plans

Owner: the immutable `RepoFrontierPlanDecisionReceipt` owns the provenance of
an adopted plan. Its Mind-worker result ID is an audit reference, not an organ
classifier. All new plan-decision RepoModel admissions therefore carry
`RepoModelAdmissionSource::FrontierPlanDecision`, regardless of whether Mind or
an authenticated operator supplied the decision.

Soul selects and verifies provenance by typed route anatomy. A non-empty
`frontier_plan_decision_id` requires the exact decision receipt, Adopt verdict,
admission receipt binding, pre-admission model revision/hash and frontier
identity, admission-purpose planning/candidate identity, post-admission route
model revision/hash, and exact Mind-worker result/job or authenticated-operator source. Only an
ordinary worker-result admission may require the Modeling acceptance,
Mind-state-commit, and gateway-review chain. Execution amendments retain their
separate exact receipt chain.

Derived state: `RepoModelAdmissionReceipt.result_id` remains inspectable but no
longer decides which organ admitted the model. Existing v53 evidence is not
rewritten: its explicit `frontier_plan_decision_id` selects the correct typed
validation path despite the legacy generic `WorkerResult` source tag.

Forbidden writer: Soul cannot infer Modeling from result presence, and a plan
decision cannot bypass provenance merely because its admission and review
contain a model-produced result. Missing, substituted, non-Adopt, or
route-mismatched decisions fail closed before worker launch. The decision's
pre-adoption frontier-item hash is deliberately not equated with the route's
post-adoption frontier-item hash; Mind's admitted patch is the transition that
changes that item.

## Long-lived runtime root-session ownership

- Owner: Runtime Continuity owns the canonical `epiphany-main` root session;
  coordinator launches consume that identity but cannot decide its lifetime.
- Inputs: the exact typed root session, its deterministic Continuity completion
  event, archive absence, terminal job set, repair timestamp/reason, and the
  full runtime snapshot.
- Outputs: ordinary session closure refuses the root without changing bytes. A
  narrow repair replaces only an invalidly Completed root as Active and deletes
  only its exact completion event in one snapshot-fenced CultCache mutation.
- Derived state: `active_sessions` is status projection, not leaked-work
  authority. Open job status owns whether work is live.
- Forbidden writers: generic close-session, retention, operator tidiness, and
  session-count heuristics cannot terminalize or recreate the root. A repair
  cannot infer authority from timestamps, a missing event, an archive, or an
  open job.
- Shared paths: coordinator heartbeat preparation and all later cognitive jobs
  use `EPIPHANY_RUNTIME_ROOT_SESSION_ID`; the packaged runtime CLI delegates to
  the same strict repair primitive.
- Cut line: the production string literal and generic closure authority are
  removed. The preserved c007 invalid completion is repaired only after this
  exact source is packaged and authenticated.
- Verification: generic closure leaves root bytes unchanged; incomplete or
  hostile completion families refuse; exact repair removes the event, restores
  Active, accepts a subsequent job, replays idempotently, and loses a concurrent
  full-snapshot fence rather than merging authority.

Resident coordinator Body readiness separately proves the required external
`git` executable before singleton acquisition or pressure consumption. Missing
Body capability is a startup refusal, not a reason to hammer one immutable
typed request through process-failure retries.

## Exact release build cache ownership

The root release-bundle manifest owns release profile policy. Measured on the
exact 21-binary bundle after touching `epiphany-core/src/lib.rs`, release
incremental reduced rebuild time from 7m04s to 31.47 seconds and is therefore
enabled in `[profile.release]`. An independent `rust-lld` trial reached 29.34
seconds, only 2.13 seconds faster, while depending on host-specific Windows
linker discovery; it remains an experiment rather than repository policy.
Fresh-target timings (1226.69 seconds with the default linker, 1097.14 with
`rust-lld`) calibrate clean-build cost but do not override the iteration-path
decision.

Release construction has two serialized cache authorities. The graph cache is
identified only by the frozen root `Cargo.lock`, target triple, and installed
toolchain fingerprint. It owns Cargo outputs and holds an exclusive graph lock
through compilation and binary copying. Source commit identity does not
partition this cache and never becomes derived build authority.

The source cache is identified by canonical repository identity. It owns one
persistent detached worktree so unchanged tracked files retain stable paths and
timestamps across commits. Before every build it exclusively locks that source,
pre-cleans cached submodules, checks out the exact parent commit, updates only
changed submodule pins without forcing unchanged worktrees, re-cleans the main
tree and recursive submodules, and verifies repository ownership, HEAD, status,
and submodule identity with long-path-aware Git commands. It remains locked
until the release has copied and witnessed every binary. No concurrent packager
can mutate source or graph outputs during that interval. Submodule mtimes and
Cargo fingerprints are cache mechanics, never release identity.

The release witness remains the only packaged-output authority: exact commit,
runtime, target, toolchain, sorted binary roles, lengths, and byte digests.
Caches accelerate reconstruction; they cannot certify it.

Exact `0ef0c0b8` is the accepted no-force source-preparation proof. The
source-changing pass compiled only six first-party crates and no vendored or
external crate, reducing Cargo time from `a4756857`'s 11m04s to 7m19s. An
identical replay completed in 5.8s wall / 0.77s Cargo and reproduced release
`sha256-032af7baa251caf32c1843eeace8990001557fe916988d8d1e2f0a27093a2b36`
and witness
`sha256-c0b8dbac33f821e9adc15218ea22a9133e0b9ea78f1981916b403fcad79f3d3b`
exactly across all 24 binaries. Receipts are under
`.epiphany-run/linux-package-0ef0c0b8` and its `-warm` sibling.

Exact `8bb8b7d3` is the steady-state acceptance proof. After the stable source
cache's one-time local population, a documentation/state-only successor kept
the same graph and checkout identity; Cargo completed the exact release build
in 29.92 seconds. Independent witness inspection still authenticated all 21
binaries and rejected any notion that cache reuse could substitute for release
identity.

The release publisher executable is part of this mechanism and must be
bootstrapped after its cache implementation changes. On 2026-08-08 an older
publisher was still launching an ephemeral `ep-src-*` checkout and a
commit-partitioned target directory; it was terminated after 12.8 minutes while
still compiling. Rebuilding the publisher from exact `8a9439ca` took 3m49s.
The current publisher then reused the persistent source/graph authorities and
packaged the 21-binary core-change release in 6m46s of Cargo work. An identical
warm package completed Cargo in 1.48s and the full hash/copy/witness path in
18.669s. Benchmark command lines and resolved cache paths are therefore part of
release-cache evidence; source code alone does not prove the active packager.

The cache does not erase crate invalidation. Exact `58f42b6a` changed
`epiphany-core` and required 6m50s of Cargo work; its successor `5f09d35a`
changed only `epiphany-mvp-coordinator`, reused the core artifact, and completed
Cargo in 29.58s. The current iteration bottleneck is the broad recompilation
and relink fan-out of the monolithic core crate. Incremental release reuse,
linker choice, or a deliberate authority-based crate split must be benchmarked
as separate release-contract changes rather than mixed into a cognition fix.
Exact `ecfff489` confirmed the slow case at 7m04s of Cargo work. The active
release rustc command had no incremental directory, and the root bundle built
all 21 binaries. Release incremental compilation and `rust-lld` therefore have
separate measurable hypotheses; an authority-based core crate split remains the
larger structural option if those two changes do not materially reduce edits to
the current monolith.

Exact `6f3cdc61` sharpened the remaining ownership defect. The stable source and
graph caches were active and third-party dependencies stayed warm, yet one core
schema/routing change rebuilt the four first-party libraries and all 21 root
release binaries in 6m59s. The root `epiphany-release-bundle` is one Cargo
package whose package-wide dependency list includes `epiphany-core` and every
adapter/runtime crate; 19 of its 21 binary sources directly import
`epiphany_core`. A changed core artifact therefore invalidates almost the whole
release bundle even when the changed authority belongs only to coordinator
routing.

The intended split follows authority rather than file size. Stable coordinator
state/view contracts must live below a volatile Self policy leaf. Runtime-spine
persistence, Persona/transport, repository observation, and release tooling
must not depend on that leaf. Only status/coordinator consumers should relink
when Self policy changes. Removing the root mega-package eventually requires
the release packager to build and witness binaries from their owning packages;
the witness remains the cross-package release authority. A compatibility
re-export from `epiphany-core` would preserve the invalidation edge and is not a
completed split.

Exact `0f0b006d` tested the tempting manifest-only cut and rejected it. The
packager grouped binaries under three independently locked owner manifests and
shared one target directory. Cold core completed in 8m02s; the OpenAI owner
then resolved its own graph and began compiling `epiphany-core` again. The run
was terminated at 16m53s before the tool owner could repeat the same wound, and
`a1a43892` reverted the cut. Separate owner lock universes are therefore not the
crate split. The viable design must keep one Cargo dependency graph while
moving volatile coordinator policy and the coordinator/status binary consumers
out of the stable core compilation unit.

The local replacement implements that single-graph boundary. Stable coordinator
DTOs live in `surfaces/coordinator_contract.rs` and remain available to core
state/projection organs. Routing functions live in the separately compiled
`epiphany-self-policy` leaf and are not re-exported through core. Core disables
autobin discovery and explicitly declares all 74 retained non-coordinator
binaries. The root release graph exposes `epiphany-mvp-coordinator` only behind
optional feature `coordinator-runtime`; that feature alone enables the policy
dependency. The packager first builds ordinary bins without the feature, then
builds only coordinator with it under the same root lock and target directory.
Target-cache identity depends on target and toolchain, not lockfile bytes;
Cargo fingerprints changed dependencies, while `--locked` and the release
witness retain build and publication authority.

Launch latency is a separate whole-store-read wound. The live runtime store was
about 40 MiB, and post-Soul Modeling launch took roughly 50-90 seconds before
the detached model process appeared. `launch_role` currently reads coordinator
state, assembles memory context, reloads RepoModel shape, commits/reloads the
Soul-to-Modeling request and route, reads telemetry, writes telemetry, and then
commits the job through path-based helpers. Each helper may independently
construct and pull the append-only CultCache store. The next launch-path cut is
one transaction-scoped typed read view plus explicit write boundaries, with
phase timings at the same owner seams. A cache wrapper that leaves repeated
whole-store pulls authoritative would merely hide the smell.

## Runtime-spine keyed storage ownership

The live 83 MiB runtime spine still uses
`SingleFileMessagePackBackingStore`. Every coordinator launch opens a complete
snapshot and its identity-scoped state/job CAS reads, decodes, sorts, encodes,
and replaces that whole file. Fresh v53 timings isolate the cost: state load
79ms, dynamic context 66ms, role augmentation 1.053s, job commit 51.482s,
total 52.680s. Prompt assembly is not the bottleneck.

CultCache already owns the standard replacement:
`RedbMessagePackBackingStore` stores each polymorphic `(type, key)` identity as
an independent MessagePack row and performs the same exact batch-CAS checks in
one redb transaction. Epiphany must promote that existing backend rather than
inventing a cache, journal, sidecar, or second persistence protocol.

Owner: one runtime-spine storage binding selects the physical backend for the
entire store. All runtime state, jobs, results, events, Mind admissions,
Hands/Soul receipts, and coordinator transactions resolve through that owner.

Migration inputs are an immutable single-file snapshot, its byte digest and
entry count, an empty destination, and the destination file identity. The
output is one redb store plus a typed migration receipt binding source hash,
sorted envelope identities/digests, destination identity, and completion time.
The old `.cc` file becomes sealed evidence and cannot remain a live fallback.

Forbidden writers: no runtime or coordinator helper may instantiate
`SingleFileMessagePackBackingStore` directly after a redb binding is selected;
no path may silently infer a backend from whichever decoder succeeds; and no
dual-write or reconciliation loop may create two authorities. All direct and
programmatic launch/result/admission paths use the same backend factory and CAS
primitive.

Negative verification must prove stale CAS refusal, immutable identity
collision refusal, migration equivalence for every envelope, absence of writes
to the sealed source, crash-safe destination recovery, and a live-sized job
commit that no longer scales with total historical store bytes.

Historical transaction benchmarking after implementation corrected the causal
map. Exact surviving batches around live job `972f4e31` take roughly
0.8-1.0s through the legacy snapshot backend and 0.02-0.03s through keyed redb.
Keyed CAS is a valid secondary optimization, but it cannot explain or remove a
51.482s coordinator bucket by itself. Live migration is therefore not yet
authorized by performance evidence.

The Modeling-only pre-transaction owner is Repository Body observation. It
builds two isolated Git indexes/trees and two complete raw SHA-256 manifests,
then admits only exact equality. On the current 3,994-file Body, an authenticated
release observation took 92.30s. The isolated Git add/write-tree portion takes
about 1.62s; serial raw file reads and metadata dominate. Manifest entries are
independent after typed index parsing, so bounded parallel construction changes
only execution order. Per-file before/after metadata checks, raw hashes,
deterministic sorting, manifest-root derivation, the second full scan, and exact
equality remain owners. The measured parallel observation is 49.52s. A future
cut that reuses hashes or weakens the second scan requires a new explicit
freshness authority; it must not be smuggled in as a cache.

## Cross-host Persona consequence nerve

Owner: Starfire Persona owns cognition, Interpreter effects, and the signed
`epiphany.persona_discord_delivery_request.v0`. Yggdrasil Bifrost owns Discord
actuation, its private execution journal, and the signed
`bifrost.persona_discord_delivery_receipt.v0`. The existing Starfire permit
issuer owns the final five-second consequence authorization from the canonical
CultMesh brake.

Inputs: one exact signed Persona request, one Bifrost trust binding for the
admitted target runtime/Persona/channel, one purpose-specific Bifrost permit
request identity, the canonical Starfire brake document, and the two
purpose-specific public receipt/permit anchors. Runtime identity must be data
bound by those anchors and deployment configuration; `epiphany-yggdrasil` is no
longer a valid compiled assumption while cognition resides on Starfire.

Signal path: Epiphany sends the signed request as a typed CultNet raw document
over RUDP. Bifrost verifies and persists it before processing. Immediately
before Discord actuation Bifrost requests the existing short-lived permit from
Starfire and durably records permit consumption before the provider call.
Bifrost returns the terminal signed receipt as a separately typed CultNet raw
document. Epiphany persists and verifies that receipt before creating delivery
evidence and terminalizing the heartbeat request.

Derived state: RUDP connection/ack state is transport-only. The request is an
inert proposal until a permit exists. The permit authorizes one bounded attempt
but is not delivery evidence. Only the signed Bifrost receipt can prove
`completed`, `failed`, or terminal-`unknown` consequence.

Forbidden writers: SFTP may not copy either live `.cc` store; Bifrost private
execution state and Discord credentials may not cross to Starfire; Epiphany
cannot manufacture a receipt; Bifrost cannot manufacture or extend a permit;
and an `unknown` journal/receipt cannot be retried automatically. Running the
Bifrost mouth on Starfire would move crossing authority and is not an accepted
shortcut.

Shared paths: first delivery, restart recovery, duplicate request replay,
expired request, braked permit refusal, provider failure, and terminal receipt
replay all use the same typed request/permit/receipt identities. The local
stores are durable endpoint state beneath the network contracts, not the
crossing themselves.

Verification layer: Rust/TypeScript interop fixtures must prove exact tuple and
wire compatibility; RUDP smokes must prove request persistence, permit
correlation, signed receipt return, replay idempotence, and substituted
runtime/channel/signature refusal. Live proof requires one reserved Persona
turn to reach model terminal, signed request, released-brake permit, Discord
message ID/URL, signed Bifrost receipt, Epiphany delivery evidence, and
heartbeat terminal receipt without exposing private state.

## Verdict-bound Modeling output authority

Live v53 exposed a missing typed boundary after Soul acceptance. The
coordinator committed an exact `RepoFrontierModelingRequest` and rendered it in
dynamic context, but the persisted worker launch did not carry that identity.
The model runtime therefore exposed the generic Modeling schema, and a worker
could choose ordinary Evolution before Mind rejected it. Context was correct;
schema authority was not.

Owner: the typed worker launch carries the exact
`repo_frontier_modeling_request_id` returned by the request-commit boundary.
The model runtime specializes its provider schema from that field: exact ID
echo, verdict-incorporation purpose, non-empty evidence, and exactly one
`revise_frontier` operation. Prompt text is derived explanation, not authority.
Ordinary Modeling retains its generic schema. Mind still validates route,
verdict receipt, frontier identity, hashes, evidence, and mutation content at
admission. The old path can no longer spend a model turn producing Evolution
under verdict authority and rely on a later rejection to discover the mismatch.

Exact `61e8be38` proved that operation-level restriction is necessary but not
sufficient. The inherited frontier-item output schema omitted `adopted_plan`.
A schema-conforming `revise_frontier` therefore implicitly replaced an adopted
plan with absence, and Mind correctly rejected it as alteration of execution
anatomy. Verdict Modeling launch authority must carry both the exact request
and exact routed item, not merely request identity. The provider schema must
const-bind all identity anatomy, including the complete adopted plan, while
leaving only status, evidence references, gap, and update timestamp writable.
The completed worker result is immutable invalid evidence and cannot be made
valid by changing admission after the fact. Supersede it only when the corrected
launch/schema boundary is ready, then run one new inference.

## Launch-owned Mind decision identity (2026-08-09)

Owner: the authenticated `RepoFrontierPlanMindContextProjection` in the worker
launch owns Mind request, planning request, Imagination result, candidate, and
candidate-digest identity. The Mind model owns only the judgment and rationale;
its JSON echoes are formatting cargo and cannot select executable identity.

Current mechanism: `complete_worker_job_from_assistant_text` passes the exact
launch projection to `role_worker_result_from_ingress`. The adapter constructs
`RepoFrontierPlanMindDecision` identity fields and the outer request echo from
that projection. A decision without Mind launch context becomes a typed item
error. `put_runtime_role_worker_result` retains its exact persisted-request,
launch-binding, launch-document hash, role, runtime, thread, and candidate
validation; no admission check was weakened.

Forbidden writer: `RoleWorkerResultIngress` no longer deserializes Mind identity
fields into authority. A model may print counterfeit IDs, but they are ignored.
This replaces the live failure mode where two validly launched resident Mind
attempts failed closed because the model imperfectly recopied long immutable
identities. The failed results remain sealed evidence and cannot be rewritten.

Verification layer: `mind_ingress_derives_immutable_identity_from_launch_context`
feeds five substituted identities and proves the emitted typed decision carries
only the canonical launch identities. All 15 `epiphany-openai-runtime` library
tests pass. Exact Linux package `bd96305e` live-proved the boundary: typed review
superseded failed job `8e5952fb`, authorized retry `2d2a3e8b` completed with the
canonical request and candidate identities, and Self atomically committed adopt
decision `repo-frontier-plan-decision-e7d7f3c7...`. The lifecycle is terminal;
no tools or external consequence occurred.

## Starfire package cache physiology (2026-08-09)

Owner: the persistent Docker source, graph, and Cargo-home volumes own reusable
build products. The exact release witness still owns package identity. Free disk
and cache presence are preconditions for the fast path, not release evidence.

A full `C:` disk exposed the physical failure boundary: the shared Windows
Codex target occupied roughly 276 GiB, rustc faulted with SIGBUS, and Docker's
backend also faulted until targeted Cargo cleanup restored about 252 GiB free
and only the `docker-desktop` WSL body was restarted. The recovered package
then paid a 25m12s cold release compile plus a 33.53s isolated coordinator pass.

An identical package against `epiphany-linux-package-source`,
`epiphany-linux-package-cache`, and `epiphany-linux-cargo-home` completed in
9.65 seconds wall. Cargo phases were 0.81s and 0.65s and the run reproduced
release `sha256-01dbed4b...` and witness `sha256-c3ab5a60...`. Therefore normal
shakedown iteration must retain those volumes and inspect disk/cache health
before compilation. Routine cache destruction, commit-partitioned graph caches,
or Yggdrasil builds are forbidden writers of iteration latency.

State stewardship currently sits outside that warm release surface. Building
the unshipped `epiphany-state` binary against the same exact source and graph
still recompiled a second dependency universe and took 7m11s merely to append a
typed evidence record. This is not a request for another cache. Either the state
steward must ship in the owned release graph or its narrow typed write port must
move into an already-shipped native owner; canonical Mind maintenance must not
require a second monolithic core build.

## Live route relinquishment and stale CRRC fallback (2026-08-09)

The adopted frontier candidate carried its own negative transition: discard the
planning draft if later admitted evidence proves the coordinated resident
circuit already exists. By Hands-gate time, canonical c005 state did prove that
circuit, while the typed receipt bodies needed to reconcile the later evidence
were outside the route's two safe paths. Hands made no file or command
consequence and emitted refusal `hands-refusal-4cd85889...` naming the missing
artifact scope. Mind-owned relinquishment `7b846272...` atomically retired route
`817bf422...`, advanced RepoModel from revision 2 to 3, and preserved the adopted
route as immutable history.

The status owner now compares the latest bound reorientation job `updated_at`
with the latest typed relinquishment `relinquished_at`. No relinquishment keeps
the ordinary CRRC path. After relinquishment, a missing or older reorientation
job makes manual-regather pressure stale. Coordinator status preserves the raw
CRRC source projection but feeds routing `Continue` with no scene action to
Self. A newer reorientation result retains ordinary manual-regather authority.

The focused policy regression passed 1/1. A collision-safe copy of the c005
`eyes-tools` store derived `awaitFrontierProposal`, `canAutoRun=false`, and
target Imagination while source signals still published raw CRRC
`regatherManually`. The live c005 store was never mounted. CRRC therefore owns
continuity observation, Self owns routing, and relinquishment is the causal
boundary preventing dead continuity history from impersonating current Eyes
pressure.

## Build runner and dependency-graph authority receipt (2026-08-09)

The persistent target is useful only when the build process names it as
`CARGO_TARGET_DIR`; mounting a volume at `/target` alone carries no authority.
One rejected invocation silently compiled into `/workspace/target` for 17m48s
before operator intervention stopped it. A cached `CARGO_HOME` must also not
cover `/usr/local/cargo`, where the image keeps its Rust proxies. The working
contract uses a separate cache mount, explicit target directory, and explicit
Rust proxy path. It rebuilt the current coordinator in 37.55s with dependencies
warm.

The root manifest now declares every first-party Epiphany crate as one Cargo
workspace and the root lockfile is the sole resolution owner. Seven child locks
and three dead child patch declarations are deleted. Vendored Codex and
CultCache are explicitly excluded because they own nested workspaces. A release
contract test rejects any omitted first-party member or regrown child lock.

`epiphany-state` stays with its narrow owner, `epiphany-core`; placing it in the
root release-bundle package was tested and rejected because package-level
dependencies would preserve the monolith. The native packager instead builds
that package/bin explicitly on its existing target and witnesses it as required
role `state-steward`. The release bundle therefore grows from 22 to 23 binaries
without creating a second graph or a duplicate executable owner.

Measured proof: the one-time workspace migration compiled first-party crates in
5m02s; the identical locked policy test then passed in 4.47s. The core-owned
state steward built in 23.20s on that graph and served a status read in 1.12s
including container startup. Eighteen release-contract tests pass. Their
one-time dev harness cost 5m33s, identical warm execution cost 4.43s, and a
subsequent packager source edit rebuilt/tested in 20.10s. Exact release witness
authority remains unchanged; a clean 23-binary package is the next boundary.

The first clean-package attempt exposed a lock migration incompatibility before
release construction. Fresh resolution selected `allocative 0.3.6` beside
vendored Starlark's older `hashbrown` integration; Rust rejected the missing
`Allocative` implementation. The lock owner now retains the previously proven
`allocative 0.3.4`, `allocative_derive 0.3.3`, and `ctor 0.1.26`. A locked
release-target check traversing Starlark through Codex login and
`epiphany-openai-auth-spine` completed successfully in 3m16s. This is lockfile
compatibility authority, not a source patch or relaxed gate.

### Single deterministic packaged build authority

The original packaged-release path invoked Cargo three times against one target
directory: the broad root binary graph, the coordinator feature graph, and the
core-owned state steward. Cargo correctly rebuilt when each command changed the
selected feature set, so the cache oscillated instead of warming. Exact source
`e9465c11` took 24m22s cold (17m03s root plus 6m38s state) and 28m30s on an
identical cached rerun (21m04s root, 34.62s coordinator, 6m42s state).

The two runs also yielded different valid authenticated releases. Twenty-one of
23 binaries were byte-identical; only the two `epiphany-openai-runtime`
binaries differed, including different ELF build IDs and code bytes. Release
incremental codegen is therefore not an admissible input to witnessed output.

`build_required_release_siblings` now has one process owner. It selects
`epiphany-release-bundle` and `epiphany-core`, selects
`epiphany-release-bundle/coordinator-runtime` once, names all 23 required
binaries explicitly. Follow-up coordinator and state-steward Cargo commands
are forbidden writers and have been deleted. The root manifest is the release
profile owner; construction no longer overrides its incremental policy through
the environment. Incremental artifacts are cache state, never witness
authority: the packaged binaries and typed witness remain the authenticated
output. All 20 focused packaged-release tests pass.

Exact source `2f2cf6f8` paid a one-time 6m47s cache migration after removing the
construction override. Its identical replay completed in 8.76s wall time with
Cargo at 0.77s and reproduced the exact 24-binary release
`sha256-6cfafa4f3918a96a9ed7c080f6b52ed9e2ed750e7fad51f83f86354c1e90033a`
and witness
`sha256-f20677a44d0e29960f43d70091cacaab182e6939220a2173c3bf449392b427d9`.
This proves deterministic no-change replay. A real core-source delta must still
beat the 5m02s `acd91e6e` baseline before the source-changing iteration fault is
closed; core ownership must not be split merely to move that proxy.

### Sole packaged executable owner

The first single-process proof exposed a deeper split. Selecting
`epiphany-release-bundle` and `epiphany-core` together compiled overlapping bin
names into the same output paths. Cargo warned that this collision may become a
hard error. The cold run took 36m55s and the identical warm run took 11.05s
(Cargo 1.26s), so graph warming was fixed, but four output files changed and the
witness did not reproduce.

Packaged executable selection now belongs only to `epiphany-release-bundle`.
It declares all 23 targets, including `epiphany-state`, from their owning source
paths and selects the core library as a dependency. `epiphany-core` binary
targets remain developer entry points; the core package is not selected as a
release writer. The forbidden state is two selected packages writing one
release filename. Nineteen focused tests prove the command contains one package
selector and no `epiphany-core` package argument. Exact warning-free Linux and
byte-identical warm witness proof remain open.

### Deterministic warm release proof

Exact source `9b8df0b4` completed the corrected package in 12m46s with no Cargo
output-collision warnings. The resulting 23-binary release is
`sha256-d13927303c957db6799135a61ce6a2899235c397b525968be0bffc3b5ad2a831`;
its witness is
`sha256-d07277cb5f142a4cc90e9364da0bd058eeba8c524eaf8c00bd9d55f088c78de0`.
Native inspection accepted exact source, inventory, sibling hashes, and private
state exclusion.

The identical warm replay used the same source, Cargo home, and graph cache. It
completed in 10.73s total with Cargo at 0.97s and reproduced the release and
witness identifiers exactly. This closes the package-speed and deterministic
artifact boundary: one workspace lock, one Cargo process, one graph, one
selected package, 23 explicit outputs, and non-incremental release codegen.

Native publication inserted the release entry and head into c005's existing
local Verse without stopping its resident process. Publication changes release
availability; it does not own executable replacement. Continuity now owns the
next boundary: supervised stop, authenticated body replacement, restart on the
same typed stores, and proof that Self resumes the existing frontier.

### Operator projection and resident topology ownership

`epiphany-mvp-status` owns read-only coordinator projection. It may execute an
already-present optional projection helper, but it cannot construct one.
Missing Heartbeat, Persona, or Void helpers therefore derive an unavailable
auxiliary panel. `--coordinator-only` omits those panels and reads the accepted
coordinator state directly; observation can no longer summon Cargo. The status
binary is an explicit release sibling so deployed operator sight is part of the
authenticated body rather than a workstation accident.

Resident Self has four distinct store roles. `release_store` authenticates the
running body; `runtime_store` owns nervous-system and coordinator state;
`local_verse_store` owns the coordination providers and brake; and
`agent_memory_store` owns Mind material. These paths may share a directory, but
they are not interchangeable. In c005, the accepted Eyes-to-Hands chain owns
the `/state/eyes-tools/` runtime, local Verse, and Mind. The main local Verse
still owns release publication. The old `/state/runtime.cc` is no longer a
resident cognition owner; it is retained evidence only.

Docker SIGTERM currently reaches `epiphany-swarm` PID 1, but `serve` owns an
unconditional loop followed by blocking `thread::sleep` and installs no signal
observer. Docker therefore escalates to SIGKILL and records exit 137. Graceful
shutdown work must assign one signal owner, make sleep interruptible, and define
how an active exact child is drained or terminalized before claiming closure.

### Release-construction bootstrap authority

Exact `f00c8279` packages the build-free status projector as the 24th binary.
The cold package compiled its one deterministic release graph in 18m44s and
produced release `sha256-a7c4c2e3...` with witness `sha256-e9984086...` without
warnings. The identical warm replay took 10.64s total, Cargo 0.92s, and
reproduced both identifiers exactly. Independent native inspection accepted
both copies. Publication changed c005's main local Verse hash from
`d88bb300...dcf0d` to `b160c610...3909` without activating the new body.

The remaining cold iteration tax precedes that graph. `epiphany-release` owns
package, inspect, and publish commands but imports all implementation through
`epiphany-core::packaged_release`; obtaining the publisher therefore compiled
the monolithic core for 7m57s before the package command compiled core again.
Release construction and filesystem witness inspection need a narrow owner.
Live CultMesh publication is a distinct authority and may continue through the
core document catalog. The deletion line is the core-owned construction module:
construction logic must not remain duplicated behind a new wrapper, and a
bootstrap packaging tool must not depend on monolithic `epiphany-core`.

Commit `76afdaf0` completes that cut. `epiphany-release-construction` owns the
typed entries plus package/build/hash/copy/witness/inspect path. Core re-exports
those contracts and owns only CultMesh publication, load, and authenticated
lookup. The standalone `epiphany-package` CLI therefore cannot publish live
state and its dependency graph contains no `epiphany-core`. The shipped
`epiphany-release` CLI retains publication and consumes the same constructor
types. All 19 moved tests pass and the core test harness compiles.

On the existing Starfire dependency cache, exact cold bootstrap fell from
7m57s to 30.24s and warm bootstrap to 4.40s. Exact `76afdaf0` packaging produced
release `sha256-30caab9e...a1aec` and witness `sha256-89c2ad60...fdecf` in
12m16s of Cargo work without warnings. Its warm replay took 10.16s total, Cargo
0.82s, and reproduced both identifiers. Independent inspection accepted both.
The packaged full publisher accepted the narrow tool's witness and advanced the
resident release Verse hash from `b160c610...3909` to `83ed430f...ae81`.

Routine operator sight must consume an already-built `epiphany-state` binary.
On Starfire, the shared Codex target is the developer/operator binary cache;
falling back to `cargo run` without naming it created a second repository-local
debug graph and turned a read-only status check into 61 seconds of compilation.
The existing shared binary returned the same typed state in 37.9ms. This is an
operator-instruction ownership fault, not evidence that the deterministic
release graph should be split. Exact-source release worktrees are likewise
forge-owned: transient fixture code may not be written into them and then
"restored," because byte restoration does not restore Cargo fingerprint state.

## Continuity retention authority map

Retention is not a janitor allowed to erase old-looking rows. Each store owner
may retire only authority that its live readers can no longer interpret as
work.

### Heartbeat artifacts

- **Owner:** Heartbeat owns pulse artifact retirement and its typed
  plan/receipt chain.
- **Inputs:** exact pulse directories outside the newest configured window.
- **Outputs:** a CAS-published plan and receipt naming the exact members.
- **Derived state:** pulse history is diagnostic evidence; the in-store history
  projection is independently capped at 128 entries.
- **Forbidden writers:** filesystem cleanup outside Heartbeat must not decide
  pulse liveness or manufacture retention receipts.
- **Deletion line:** only plan members that still match their witnessed type,
  path, and digest may be removed. Symlinks, non-directories, drift, and unknown
  members fail closed.
- **Verification layer:** existing tests prove boundedness, idempotence,
  exact-member refusal, and typed receipts. Exact packaged `16c4b19f` used the
  same public command path to retire two witnessed directories from a
  five-pulse copied-store fixture, preserve the remaining three, and replay as
  `within-bound` without another receipt. Receipts are under
  `.epiphany-run/heartbeat-retention-16c4b19f`.

### Resident Self lifecycle rows

- **Owner:** resident Self owns pressures, Heartbeat grants, child claims, and
  terminal acknowledgements in `resident-self.cc`. Heartbeat may consume an
  acknowledgement through the typed CAS function; it does not own arbitrary
  deletion from the resident store.
- **Inputs:** one fully closed lifecycle: a consumed terminal acknowledgement,
  its consumed grant, the pressure still bound to that grant in a final
  consumed state, and any child claim bound to the same launch.
- **Outputs:** a typed retention head/receipt preserving a digest and count of
  retired lifecycle identities while carrying no scheduling authority.
- **Derived state:** closed lifecycle history is evidence only. Pending
  pressures, unconsumed grants, prepared launches, active leases, and
  unconsumed acknowledgements remain live authority.
- **Forbidden writers:** retention cannot change pressure status, clear an
  active/prepared lease, consume an acknowledgement, or infer closure from age.
  Brake and shutdown cancellations requeue their pressure and are not closed
  merely because they emitted a terminal acknowledgement.
- **Shared path:** completion, failure, timeout, brake, and shutdown all reach
  the same lifecycle-closure predicate after Heartbeat consumption; no manual
  cleanup path may bypass it.
- **Deletion line:** remove exact witnessed envelopes atomically only when the
  current state has no prepared or active reference to the grant and no
  pending acknowledgement exists. The test-only
  `ResidentSelfRuntimeReceipt` type is not a live retention target.
- **Verification layer:** negative tests must prove that a retention head alone
  cannot create pending pressure, issue a grant, satisfy an acknowledgement,
  or resurrect a coordinator turn.

### Coordinator receipts

- **Owner:** the runtime spine owns coordinator run receipts. Resident Self
  stores only the latest receipt identity and terminal acknowledgements may
  reference an exact receipt.
- **Inputs:** receipts older than the retained frontier and unreferenced by
  the configurable newest window or explicit IDs supplied from current
  resident state and pending acknowledgements. Retention refuses prepared or
  active launch authority.
- **Outputs:** a typed accumulator preserving terminal counts/digests without
  pretending to be a runnable receipt.
- **Forbidden writers:** resident retention cannot delete runtime receipts;
  runtime compaction cannot guess that cross-store references are dead.
- **Deletion line:** runtime replaces the singleton head and deletes exact old
  receipt envelopes in one full-snapshot-fenced transaction. Unknown runtime
  rows remain byte-identical.

### Supervisor stdout/stderr

- **Owner:** systemd-journald owns deployed Yggdrasil supervisor, semantic
  projector, and workspace-coverage projector stream retention. Epiphany owns
  typed service state, not a parallel filesystem log history.
- **Inputs:** the supervisor policies bind managed child output to
  `/dev/stdout` and `/dev/stderr`; `epiphany.service` explicitly binds its own
  streams to the journal.
- **Derived state:** journal rows are operational evidence. They cannot satisfy
  service readiness, provider health, or typed completion.
- **Forbidden writers:** Epiphany must not create parallel long-lived projector
  log files under its state root, and no external truncator may cut a file
  beneath an inherited child descriptor.
- **Cut line:** `gamecult-ops` commit `059821f` removes all four projector
  file-log paths from the Yggdrasil policy, names journald as the sole owner in
  the deployment runbook, and passes the complete organizational operator
  wiring suite. The optional supervisor fatal log is not configured by the
  Yggdrasil unit; service failure is journal-owned too. Starfire's temporary
  Windows shakedown logs remain bounded run receipts, not deployment truth.

Resident lifecycle retention now follows this map. Resident Self's production
serve/once owner applies a configurable closed-lifecycle bound (default 256).
CultCache commit `fecc17c` adds a complete-snapshot-fenced single-file
replace-and-delete transaction, so exact pressure/grant/ack/claim deletion and
replacement of the one digest/count retention head cannot split. The head is
not read by scheduling. Twenty resident Self tests and six swarm tests pass,
including refusal of live/requeued authority and negative proof that retained
history cannot create pending work.

Exact `ed15f83a` closes the packaged boundary. Its 24-binary release is
`sha256-4a4be03688eab1d1f7c13ac0057f0664c4658cab88471a0eac451a1d4607b85d`
with witness
`sha256-f163170174f022c124cc2f94d195639d02f65b79bac229af3efb8333176673c4`.
Under an engaged copied-state brake, packaged Self retired two closed
lifecycles/six exact envelopes into a revision-1 head with chain digest
`sha256:69a2c5971430846590fe20ba32a1a9299726a51c997b9e9c07ec044ebbff34a6`.
Two pending pressures survived, grants and acknowledgements remained empty,
and replay did not advance the head. Resident lifecycle retention is accepted;
the next retention owner must be mapped independently.

## Runtime and coordinator retention authority map

The copied c005 runtime store currently contains 22 coordinator run receipts,
20 jobs/results, 7 sessions, 482 runtime events, 13 native plus 13 OpenAI model
requests (about 2.9 MiB of duplicated prompt cargo), 72 model stream events, 13
receipt pairs, 7 worker launches, and the accepted Mind/Modeling/Hands frontier.
These are not one retention family merely because they share a file.

### Coordinator run receipts

- **Owner:** the runtime spine writes `EpiphanyCoordinatorRunReceipt`; the
  resident Self process is its only live authority consumer.
- **Live input path:** after an active child exits zero, Self scans receipts for
  the exact `thread_id` plus `resident_launch_digest`, then validates the full
  launch contract before emitting its terminal acknowledgement. A receipt is
  not present while the child is still active; a valid terminal receipt is
  therefore the newest receipt at the completion boundary.
- **Other references:** resident state records the latest receipt ID and
  terminal acknowledgements record their source ID. CultMesh Hands gates and
  role-review events also carry the ID, but source inspection finds no lookup
  from those mirrors back into the runtime receipt store; each mirror is a
  self-contained provenance projection.
- **Derived state:** old coordinator receipts are historical evidence after
  resident terminal acknowledgement. Their artifact references do not own the
  referenced files and cannot be used as a file-retention decision.
- **Output:** one runtime-owned typed accumulator head with cumulative terminal
  counts and a chained digest. It is never returned by
  `coordinator_run_receipts` and cannot satisfy resident completion.
- **Preservation set:** retain a configurable newest global window (default
  256) plus any explicit IDs supplied by a cross-store caller. The newest
  receipt is always retained, even if the configured historical window is
  zero, because it may be crossing the child-exit/terminal-ack seam.
- **Forbidden writers:** resident Self cannot directly delete runtime rows;
  CultMesh projection, artifact cleanup, and wall-clock age cannot decide
  receipt liveness.
- **Deletion line:** exact old receipt envelopes and replacement of the one
  accumulator head must share a full-snapshot-fenced transaction. Unknown
  runtime rows remain byte-identical.
- **Negative verification:** the accumulator alone must not appear in receipt
  enumeration, match a thread/launch digest, terminalize a lease, or change the
  accepted coordinator frontier.

### Session, job, event, model, and tool history

- **Owner:** runtime session closure owns the eventual archive boundary. Model
  transport owns request/event/receipt families only while a request can still
  receive stream events or construct a tool follow-up. Tool follow-up directly
  reloads the original native model request and its tool intent/receipt chain.
- **Current authority:** open sessions/jobs, waiting review, accepted role
  results, pending tool intents, current Self/Mind requests, and the coordinator
  thread state remain live. `runtime_spine_status` and operator list commands
  currently enumerate complete history; those counts are observation, not a
  right to keep unbounded authority forever.
- **Deletion line:** no broad runtime or semantic compaction until a typed
  archived-session summary owns the closed family and all cross-family IDs
  needed by the accepted frontier are explicitly preserved. Model requests
  must not be removed merely because a model receipt exists; tool follow-up and
  review/recovery readers must first be closed.

Source inspection after the accepted `6dd9b132` fulfillment run sharpens that
boundary. `EpiphanyRuntimeSession` is currently a job-admission owner, not a
complete storage generation. The runtime spine gives every job, generic job
result, and runtime event an explicit `session_id`; worker launch requests and
typed role/reorient results join through `job_id`; coordinator run receipts
also carry `session_id`. Those families have a typed path back to one session.

The model/tool families do not yet share that path:

- Native and OpenAI model requests carry `conversation_id` and `request_id`,
  but no runtime session or job identity. Worker request IDs happen to contain
  a sanitized job ID and worker conversations happen to name a role binding;
  both are naming conventions, not retention authority.
- Native and OpenAI stream events and model receipts join exactly to their
  request by `request_id`. A terminal event closes transport production, but
  the native model request remains live while tool follow-up may reload it.
- Tool intents join to a model request only when they came from a model tool
  call. Tool receipts join exactly to an intent. Direct tool intents have no
  session/job owner at all.
- Runtime events emitted by the OpenAI runner name the session and job, but do
  not authenticate which model request/event envelope they describe. Human
  summaries and key-shape conventions cannot be promoted into a deletion
  graph.
- `EpiphanyRuntimeJobResult` may cite `openai-request:<id>` as an evidence ref,
  but this is an artifact/evidence string, not a typed immutable membership
  edge and is not present on every model execution path.

The semantic families in the same `.cc` file are not session exhaust. Repo
model admissions, frontier requests/routes, Hands/Soul receipts, Persona
effects, memory graph/projection state, and accepted typed worker results may
remain current Mind or consequence authority after the process session closes.
Physical co-location is not ownership. Runtime archive must therefore leave
semantic documents byte-identical unless an owning semantic compactor proves
its own replacement contract. Conversely, if a retained semantic document
still resolves an execution request/result by ID, that exact execution
envelope remains live and runtime archive must refuse it rather than leave an
ID-shaped hole that a later row could impersonate.

The intended archive cut is now explicit:

- **Owner:** one runtime-spine `ArchivedRuntimeSession` tombstone owns permanent
  death of an exact completed session. Session status, operator counts, age,
  and a digest-only retention head are no longer archive owners.
- **Inputs:** the exact completed session; only terminal session-local jobs;
  their typed job/launch/result/event closure; explicit model-execution
  bindings to session and job; terminal native/OpenAI request streams and
  receipts; fully receipted tool intents; coordinator receipts not live across
  resident state; and a full-store scan proving no retained semantic/runtime
  document references a member selected for retirement.
- **Outputs:** one typed tombstone containing the session identity, terminal
  outcome/counts, exact retired-family counts, a chained digest of exact
  retired envelopes, and the retention timestamp; plus deletion of those exact
  envelopes in the same full-snapshot-fenced transaction.
- **Derived state:** runtime history counts and old stream text are observation
  only after archival. The tombstone is evidence and an ID-reuse barrier; it
  cannot satisfy a job, model request, tool call, coordinator receipt, or
  semantic review.
- **Forbidden writers:** model transport, tool runtime, coordinator receipt
  retention, resident lifecycle retention, semantic projection, wall-clock
  cleanup, and operator commands cannot mark a session archived or infer
  membership from prefixes, timestamps, summaries, conversation names, or
  evidence strings.
- **Shared paths:** every native/OpenAI model execution must publish the same
  typed request-to-session/job binding at request creation; every model-derived
  and direct tool execution must publish an exact execution owner before an
  intent can become pending. Bounded and unbounded runners use the same write
  primitive. Legacy unbound rows are retained and make their candidate session
  ineligible; migration may add a binding only from independently authenticated
  typed evidence.
- **Cut line:** first add the missing typed model/tool ownership edges and make
  request/intent creation atomic with them. Then add the archive tombstone and
  one snapshot-fenced replace/delete primitive. Do not begin with a generic
  age window, a key-prefix crawler, or a repair registry assembled after the
  fact.
- **Negative verification:** an archived tombstone blocks recreation of its
  session; missing/duplicate/foreign bindings refuse archive; a nonterminal
  stream or unreceipted tool intent refuses archive; a retained semantic
  reference refuses deletion; stale snapshots refuse; unknown rows and live
  sessions remain byte-identical; the tombstone cannot resurrect work; and
  exact replay is idempotent.

The first ownership edge is now implemented. Runtime spine owns
`EpiphanyRuntimeModelExecutionBinding` and one `open_runtime_model_execution`
CAS. That transaction validates one native/provider request pair, preserves an
exact runtime identity/session fence, and atomically publishes the session,
queued job, deterministic opened event, immutable binding, and both request
envelopes. The OpenAI runtime cannot begin transport before this succeeds.
Collision, foreign request shape, concurrent session mutation, or terminal
session state leaves no partial job/event/request family. Legacy standalone
request writers remain available only as unbound compatibility surfaces; their
rows are deliberately ineligible for archival. Core hostile membership tests,
the CultNet Hello/catalog tests, and all 15 OpenAI runtime library tests pass.

Tool execution ownership now shares the same cut. Runtime spine owns
`EpiphanyRuntimeToolExecutionBinding`. One CAS publishes an intent with its
exact session/job edge; model-derived intents additionally require the exact
native/provider model execution binding and request family in the fence.
Direct intents require an explicit session/job owner. The tool runtime rejects
an unbound intent before native or MCP execution. Its terminal receipt is also
immutable: runtime spine validates adapter/server/tool identity and publishes
it under a CAS fence containing the exact binding and intent. A hostile or
duplicate receipt cannot become closure evidence. Core tests prove model,
direct, foreign, missing, hostile-receipt, and replay cases; all 15 OpenAI
runtime tests and all 10 tool-runtime tests pass without warnings.

The next archive prerequisite is retained-reference classification. Before a
session family can be deleted, source inspection must enumerate which semantic
documents resolve session job, worker result, model request, tool intent, or
receipt IDs at read time. Those readers either preserve exact execution
members or must first own a self-contained immutable evidence projection. No
generic string scan or age rule may substitute for typed references.

That classification exposed and repaired the archive-unit fault. Worker model
sessions were formerly role-long (`openai-worker-session-{binding}`), so future
workers kept the session live forever and a session tombstone could never
bound the dominant prompt/stream family. Worker execution now derives one
session from the exact outer worker `job_id`; all model/tool-followup jobs for
that worker share it, while later workers receive different sessions.
Successful completion closes the inner model session after the outer typed
worker result is admitted. Tool-loop stall and round-limit closure first write
failed receipts for the exact unexecuted pending intents, then fail the outer
worker and close the same inner session. Tests prove terminal outer job,
terminal tool receipt, and completed unique inner session. Conversation-wide
model sessions remain intentionally long-lived and cannot be archived until
their own owner closes them.

The initial tombstone can therefore be narrow and honest: archive only a
completed session whose jobs are model-adapter jobs, each job has an explicit
model execution binding and terminal result, every model stream is terminal,
and every tool binding is receipted. Outer worker launch/results and all
semantic/Mind/consequence families remain untouched. The tombstone must retain
the exact session, job/result, model-request, and tool-intent identities as an
ID-reuse barrier plus counts and a digest of bulky retired envelopes.

That narrow owner now exists in source as
`EpiphanyArchivedRuntimeSession` and `archive_completed_model_session`.
Runtime spine admits only the closed model-generation shape above, verifies the
native/provider terminal streams and receipts plus every bound tool receipt,
and refuses outer worker/coordinator membership. One full-snapshot-fenced
replacement writes the exact-ID tombstone and deletes only its enumerated inner
execution envelopes. Tombstone IDs block later session, job, model-request, or
tool-intent aliasing; the tombstone itself is never enumerated as runnable
authority. Stale-snapshot, missing-tool-receipt, byte-identity, idempotence, and
ID-reuse negatives pass.

`retain_completed_model_sessions` selects only completed generations whose
jobs are all model-adapter jobs with explicit model bindings, orders them by
session closure time, and keeps at least the newest even when configured zero.
Resident Self invokes it beside coordinator-receipt retention only after the
shared no-active/no-prepared authority gate. The default retained window is
256. A two-generation test proves the older generation becomes a tombstone and
the newest remains live. Exact package and copied-state proof remain required;
conversation-wide sessions and semantic history remain separate owners.

Source commit `c137e16b` packages the owner but is not an accepted release: its
24-binary build emitted one unused-import warning in the tool-runtime binary.
That import belonged exclusively to `cfg(test)` and has been moved there; the
production check and all four tool-runtime binary tests pass. Exact repackaging
of the follow-up commit is required before live archive evidence.

Follow-up `cce2b8ac` is accepted. Its exact warning-free package contains 24
binaries under release
`sha256-1f29f33c495e8ba79ce8e23c1ac923c4ffcd5d86c97632a17d44566669de481e`
and witness
`sha256-25e48f9c79c51cd9853e826e2f9dfdb3b2570006fd37138fd36ac1555bc075e7`.
On copied live state, two genuine terminal model generations supplied a
newest-at-one test. Packaged Self retired the older exact 29-envelope family
into tombstone digest
`sha256:fc3658898d383333edff411f64999af7890cdeaf8fdce737589bc5667f65db33`,
preserved the newer generation, left zero pending tools, refused old-session
identity reuse, and replayed without moving the runtime file hash. All 1,427
pre-existing envelopes survived and no pre-existing authority envelope changed.
Narrow model-generation retention is accepted; semantic and conversation-wide
families remain separate owners.

The live fixture exposed an adjacent boundary fault. The `model-turn` CLI reads
JSON, and the published `epiphany.model_request.v0` schema is object-shaped,
but direct deserialization into the DatabaseEntry type expects its positional
CultCache array. JSON ingress must use an explicit schema-shaped boundary DTO
that rejects unknown/malformed fields and converts into the typed persisted
request. CultCache serialization remains the persistence owner; JSON does not
get to reshape it.

The implemented CLI boundary now owns JSON syntax only. It first requires an
object with an exact string `schema_id`, then deserializes into one of two
`deny_unknown_fields` DTOs matching the published native and OpenAI request
schemas. Their three published input variants convert into the corresponding
typed adapter request. The adapter request then enters the unchanged runtime and
CultCache persistence path.

- Owner: the published CultNet JSON schema owns accepted boundary shape; the
  typed adapter request owns runtime meaning; DatabaseEntry owns persistence.
- Inputs: one native or provider object with the exact schema ID and published
  fields.
- Output: an `EpiphanyModelRequest` or `EpiphanyOpenAiModelRequest` with
  persistence-only fields left at typed defaults.
- Forbidden cargo: positional CultCache arrays, unknown top-level or variant
  fields, malformed variants, unsupported schema IDs, and `ToolCall` until a
  published contract owns it.
- Shared path: both native and provider objects converge on the existing model
  runtime after conversion; neither can deserialize persistence representation
  directly.
- Verification: all nine binary tests pass, including both positive object
  shapes and negative array/unknown/ToolCall cases. Exact package inspection and
  copied-live execution remain required before acceptance.

Exact `eea15e82` closes that acceptance boundary. Its authenticated 24-binary
release is
`sha256-6a45bef43ef9f4ecbdc2ba69b8dfee9edf9bb085ce0d482c1ad1649b35464186`
with witness
`sha256-088393f4eb9784819250f6a6b44d73bc92c9d889c4eaa2a0a13868c6c71f7cda`.
A published native object completed on copied live state through direct Responses
transport and persisted its exact typed request. The positional persistence
array failed before mutation, produced no request identity, and preserved the
runtime file hash exactly. The boundary is accepted live.

The coordinator receipt accumulator is implemented in source. Runtime owns the
typed head, cumulative status counts, chained digest, and full-snapshot-fenced
replacement/deletion. Resident Self supplies the cross-store preservation set
from pending terminal acknowledgements and `last_coordinator_receipt_id` before
resident lifecycle retirement; it does not write or delete runtime rows
directly. Retention is forbidden while active-turn or prepared-launch authority
exists, closing the interval where a child may have written its terminal
receipt but Self has not yet observed exit. The default window is 256 and the
newest receipt survives even when the configured window is zero. CultCache's production non-owning redb handle
now exposes the same fenced compaction primitive as the snapshot and owned-redb
backends. Unit tests prove stale-snapshot refusal, explicit-ID preservation,
zero-window newest preservation, stable replay, and that the head cannot
deserialize or enumerate as runnable coordinator receipt authority.

Exact source `16c4b19f` produced warning-free 24-binary release
`sha256-6cd1907a87d37cd4517e3f1d3541ecee6595480c21401f977f51f63e929a8ef8`
with witness
`sha256-c9f4f8ba962bd97674c5e178a67a881b592af5833048029cd11805604bd6c17e`.
Under copied engaged-brake state and a retention window of one, packaged Self
retired 21 receipts, preserved the newest receipt and a deliberately old
receipt named by both resident state and a pending acknowledgement, and wrote
revision-1 digest
`sha256:63587221d745315af81c705824d16313d2f748b6ff9840a2b4152127a6758fbd`.
All 720 unrelated runtime envelopes retained digest
`sha256:c21a12653ce1bf0e64342c6fcbf98d006aeb8fa707de69527886db20e4c20e1c`;
resident pressure/grant/ack/claim counts did not change; active and prepared
authority stayed absent. Exact replay did not advance the head or create work.
Receipts are under `.epiphany-run/coordinator-retention-16c4b19f` and package
construction/inspection under `.epiphany-run/linux-package-16c4b19f`.

Coordinator receipt retention is accepted. It does not pretend to solve
runtime session/model/event/tool retention.

## Remaining semantic and conversation retention owner map

The remaining histories are not one family and must not share a generic age
deleter.

### Semantic projection lifecycle

- Owner: each canonical Mind or Modeling source store owns its semantic
  obligations, scope claim, executor grants, attempts, recovery authorizations,
  and index receipts. The semantic executor owns physical Qdrant epoch cleanup
  only after canonical evidence proves an epoch is inactive.
- Live inputs: the authenticated current source head and its exact obligation;
  the singleton scope claim; any running attempt; the grant or recovery
  authorization named by that claim; and the exact succeeded attempt/receipt
  admitted by the current query-readiness gate.
- Retirable inputs in the current safe cut: only older obligations whose source
  generation is no longer the authenticated head and which have no attempt,
  receipt, executor grant, or recovery authorization. Attempted generations
  remain durable until physical retirement has its own crash-safe obligation.
- Output: one typed per-scope retention head with cumulative type/status counts,
  retired generation count, and chained digest, replacing the exact old
  lifecycle envelopes under the source store's full-snapshot fence. It is
  evidence only and cannot deserialize as obligation, claim, grant, attempt,
  authorization, or receipt.
- Fail-closed cut: skip logical retirement while the current scope claim or its
  attempt is running. Never retire the current obligation, scope claim, current
  claim authority, or current readiness receipt. Unknown rows remain
  byte-identical.
- Physical cut: after logical retirement proves an epoch inactive, Qdrant may
  delete only points carrying that exact retired
  `(obligation_id, claim_id, claim_epoch)` namespace. It cannot infer deletion
  from age or collection membership, cannot touch the active receipt namespace,
  and cannot decide query readiness. A missing backend leaves harmless garbage,
  not incorrect canonical state.
- Negative proof: the retention head cannot make query readiness true, cannot
  acquire/recover a claim, and cannot resurrect an obligation. Current semantic
  query results remain identical; stale CAS refuses; unrelated canonical rows
  and the active physical epoch remain byte-identical.

Current source grounds this cut: readiness and execution authenticate the
current obligation and singleton scope claim, while attempts and receipts are
enumerated history filtered back to that chain. The executor grant and recovery
authorization are claim authorities and therefore enter the preservation set
through the claim rather than through recency.

### Persona conversation lifecycle

- Owner: Heartbeat owns whether the Persona turn is terminal and no longer
  schedulable. Runtime owns the Projector/Persona/Interpreter stage receipts,
  effect document, effect intents, delivery evidence, terminal model receipt,
  and conversation execution receipt. Bifrost crossing stores own signed
  request/receipt audit evidence. No one store can infer whole-chain closure
  alone.
- Live inputs: a reserved/nonterminal `PersonaTurnRequest`, missing conversation
  execution receipt, started effect intent, pending signed delivery, absent or
  unverified crossing receipt, or terminal Heartbeat state still needed for
  reconciliation.
- Retirable family: only a turn with exact model terminal, effect document and
  stage receipts, terminal Heartbeat receipt, terminal conversation execution
  receipt, every effect intent terminal, and any external consequence bound to
  signed terminal delivery evidence. Failed/unknown delivery remains durable
  non-retry evidence, not disposable failure noise.
- Required tombstone: exact turn/request/effect/stage/delivery identities and
  terminal outcome must remain sufficient to reject replay after detailed rows
  retire. Deleting runtime rows without this identity barrier would let
  `execute_persona_model_turn` recreate a previously consequential turn.
- Shared cut: terminalization and later reconciliation must consult the same
  archived-turn barrier. Runtime retention cannot delete Heartbeat or Bifrost
  rows; their owners need corresponding bounded audit policies before the whole
  conversation family is physically bounded.

Persona conversation retention therefore follows semantic lifecycle retention.
It requires a cross-store preservation map and replay barrier; it is not a safe
extension of completed model-session archival.

### Persona conversation retention implementation

The production Persona service now runs one shared retention primitive in both
loop and `--once` modes before selecting new work. Heartbeat remains the owner:
it first persists an exact cleanup plan inside the singleton state, including
the terminal receipt digest and exact runtime/request/receipt envelope
identities and hashes. Runtime, Epiphany delivery-request, and Bifrost
delivery-receipt stores each delete only those named envelopes under their full
snapshot fence and replace a singleton typed local cleanup receipt. A retry
that finds detail already absent must authenticate that exact local receipt;
absence cannot impersonate successful cleanup.

Only `delivered`, `silence`, and `dropped` turns with an exact conversation
receipt, full three-stage model chain, exact effect document, terminal effect
intents, and (for speech) a verified signed completed delivery request/receipt
qualify. Failed or unknown delivery, retained mentions, blocked/quarantined
pressure, missing detail, started or ambiguous effects, feedback, Persona
state, semantic memory, relationship memory, and disclosure/consent state are
outside the deletion set.

After every planned store cleanup is receipted, Heartbeat atomically removes
the exact terminal requests, clears the plan, and advances a cumulative
chained-digest head with a monotonic `through_reserved_at` frontier. Reservation
and state validation reject any nonterminal turn at or behind that frontier.
The head is death evidence only; it cannot model a turn, issue a signed
delivery request, satisfy a crossing receipt, or reschedule speech. A crash
before the Heartbeat commit leaves terminal authority and the exact plan for
retry. A crash after it cannot replay the retired turn.

Three focused retention tests pass: bounded terminal detail with stable replay
and hostile old-request rejection; preservation of an older failed/retained
turn while a neighboring clean turn retires; and refusal to accept already
absent detail without the exact store cleanup receipt. The full core library is
green at 646 passed / 1 ignored, the OpenAI runtime is green at 15 passed, and
the production Persona daemon compiles.

Exact `44230a05` packaged copied-state proof accepts the cut. Release
`sha256-aed15bfb419c6c76ad09e1020e0c3e3d0f6dee52f5d615e18bbc61095aa76ea9`
with witness
`sha256-77d3b45e2cd48f5785f02539ba92238013f2385537a776d45514ac13e704706e`
retired one signed completed speech family and eight exact runtime envelopes.
The newer dropped turn, failed retained turn, signed unknown/quarantined turn,
pending delivery turn, blocked pressure, and pending model evidence survived.
All five stores and their typed inspection were byte-identical on replay.

A forced read-only receipt-store replacement failed after runtime and request
cleanup. Heartbeat still held the exact plan and terminal turn, the local
runtime/request cleanup receipts authenticated the partial progress, and no
head existed. A normal retry deleted the exact crossing receipt, cleared the
plan, removed the old terminal turn, and advanced one revision. Thus a crash
cannot turn partial deletion into completion, and the accepted frontier plus
reservation validation prevents either reservation or repost of the retired
turn. Receipts are under `.epiphany-run/persona-retention-44230a05`.

### Starfire Persona-permit firewall ownership

- Owner: gamecult-ops exact `6ee08a4` owns one Windows PersistentStore rule;
  Windows projects it into ActiveStore. Epiphany release paths are not owners.
- Inputs: local WireGuard address `10.77.0.2`, Yggdrasil peer `10.77.0.1`, UDP
  permit port 17877, Public profile, and interface `wg-gamecult-starfire`.
- Output: one enabled inbound allow rule named
  `Epiphany-Persona-Permit-Yggdrasil`, scoped to that exact tuple.
- Derived state: ActiveStore is the live projection of PersistentStore;
  application-path Query User rules are unwanted derived OS prompts and have no
  release or permit authority.
- Forbidden writers: authenticated release publication, executable relocation,
  the Persona permit daemon, and Bifrost cannot create broader firewall policy
  or replace the stable host rule.
- Shared path: initial installation and reconciliation use
  `allow-starfire-epiphany-persona-permit.ps1`; live verification reads both
  policy stores plus their address, port, and interface filters.
- Cut line: remove every per-program permit rule and retain only the stable
  WireGuard-scoped tuple. WireGuard membership remains transport identity, not
  a substitute for CultNet signatures or permit validation.
- Verification: exact matching PersistentStore and ActiveStore rows exist;
  zero application filters target the permit executable; the automatic/running
  WireGuard service owns `10.77.0.2/24`. The earlier authenticated cross-host
  probe proves the rule carries the typed protocol without broadening it.

Live receipts are under `.epiphany-run/firewall-bffbaa45`. A non-elevated
reconciliation attempt was denied before mutation and left identical snapshots;
it is recorded as a negative authority check, not misreported as idempotence.

### Coordinator runtime-session closure and retention gap

The broad runtime-history remainder is not an unclassified pile. Exact
model-adapter generations are already bounded by
`archive_completed_model_session`: it validates terminal jobs, native/provider
request streams and receipts, tool bindings/intents/receipts, and runtime events,
then replaces that exact family with `EpiphanyArchivedRuntimeSession` under one
full-snapshot fence. Outer-worker and coordinator authority is deliberately
refused.

The live missing family is native coordinator sessions. The coordinator creates
`coordinator-{thread_id}` plus a `coordinator.started` event and eventually
writes `EpiphanyCoordinatorRunReceipt`, but it never calls
`close_runtime_session`. These sessions therefore remain falsely `Active`
after process-terminal evidence exists. Receipt retention can later remove the
receipt, but completed-session retention cannot select the session because it
requires a nonempty model-adapter job family. This is both unbounded growth and
a false liveness projection.

Authority map for the cut:

- Owner: runtime spine owns one atomic coordinator-run terminalization
  transaction. Neither resident Self nor the artifact writer closes the runtime
  session.
- Inputs: exact active coordinator session envelope; exact terminal coordinator
  receipt bound to its session and thread; the absence of session jobs; existing
  coordinator-started events; one terminal timestamp.
- Outputs: in one full-snapshot-fenced replacement, persist the immutable run
  receipt, mark the session `Completed`, and publish exactly one deterministic
  `session.completed` event.
- Derived state: coordinator JSON/text artifacts and runtime status projections
  describe the committed terminal transaction; they do not terminalize it.
- Forbidden writers: `put_coordinator_run_receipt` followed by a separate close,
  receipt retention, resident acknowledgement, process exit, and artifact
  existence may not independently decide session death.
- Shared paths: every successful native coordinator exit mode uses the same
  finalizer. Legacy active coordinator sessions may be repaired only from one
  exact matching terminal receipt, no jobs, and the authenticated coordinator
  event shape.
- Retention owner: completed coordinator-session archival owns the whole exact
  session family, including its coordinator receipt and runtime events. Generic
  coordinator-receipt retention must preserve receipts still named by a live or
  completed runtime session; it owns only receipts outside a session family.
- Cut line: remove the coordinator binary's standalone receipt write. Do not
  teach model-session archival to ignore coordinator receipts or infer closure
  from age. Do not leave two independent deleters able to retire the same
  receipt.
- Verification: atomic stale-snapshot refusal; exact replay idempotence; legacy
  repair refusal for zero/multiple/mismatched receipts or any job; active and
  newest-session preservation; exact old family replacement; unrelated runtime
  byte identity; tombstone refusal of session/job recreation; and copied exact
  package proof that terminal coordinator sessions plateau without changing
  resident authority.

The first owner cut is implemented. `finalize_coordinator_run` validates the
exact active jobless session and absence of partial terminal authority, then
uses CultCache's full-snapshot-fenced replace-and-append transaction to persist
the receipt, Completed session, and deterministic completion event together.
Exact replay returns the same terminal session; a changed snapshot, a session
job, partial prior receipt/event, or non-Active state refuses every write. The
coordinator now derives runtime status after this transaction. CultCache exact
`e1fc4c0` owns the new primitive for snapshot, keyed, and owned-keyed stores;
its hostile concurrency test proves an unknown row invalidates the transaction.
The full core library passes 647 tests with one intentional ignored helper.

The remainder of the owner cut is now implemented. Runtime retention first
repairs only exact legacy jobless coordinator sessions: one matching receipt,
an exact `coordinator-{thread_id}` binding, and authenticated start events are
required before the session and deterministic completion event are replaced in
one full-snapshot transaction. Zero, multiple, or mismatched receipts, any job,
foreign events, or a stale snapshot refuse without mutation.

Completed coordinator-session archival is a distinct exact-family validator,
not a relaxation of model-session archival. It consumes the Completed session,
its one bound receipt, and all authenticated start/completion events, then
replaces those envelopes with one `EpiphanyArchivedRuntimeSession`. Its retired
type counts and digest cover that exact family; unrelated runtime envelopes are
outside the cut. Tombstone replay requires the family to remain absent, so the
archive cannot coexist with recreated session authority.

Deletion ownership is ordered and explicit. Resident Self supplies the receipt
IDs that remain live across stores. Completed-session retention runs first and
excludes those families. Generic coordinator-receipt retention then derives all
receipt IDs bound to any surviving runtime session and preserves them in
addition to resident liveness; it owns only orphan receipts. A receipt can no
longer be independently retired while its session survives.

The verification layer now covers exact repair and archive replay, ambiguous
legacy refusal with an identical snapshot, cross-store preservation, newest
retention, generic-retention refusal to consume a session-bound receipt,
unrelated-envelope byte identity, tombstone recreation refusal, and hostile
concurrent-event CAS refusal. Focused coordinator tests pass 58/58; the full
core library passes 649 tests with one intentional ignore; both swarm binary
suites and the coordinator release target are green. Exact package and copied
live plateau proof remain the acceptance boundary.

Copied-live execution exposed a surviving opening/exit split after that map.
The coordinator binary still created `EpiphanyRuntimeSession` and
`coordinator.started` in separate calls, reused an existing Active session on
the same thread, and invoked `finalize_coordinator_run` only at the bottom of
the success path. Any ordinary error after opening could therefore leave false
Active authority; repeated use of the thread could append start events and
produce the ambiguous receipt family observed in copied c005 state.

The corrected authority map is:

- Owner: runtime spine owns both boundaries of a normal coordinator run.
- Inputs: exact runtime identity, unique thread/session pair, objective, start
  timestamp, and later either the success receipt or the captured run error.
- Outputs: opening atomically appends the Active session plus deterministic
  start event; every normal exit atomically appends one terminal receipt plus
  completion event while replacing the session as Completed.
- Derived state: CLI errors and process exit codes report the terminalized
  failure; they do not own session status.
- Forbidden writers: the coordinator binary no longer separately creates a
  session, appends retry start events, or reuses an existing thread authority.
  A catch-all error wrapper may construct the failed receipt but can only close
  through `finalize_coordinator_run`.
- Shared paths: successful plan/default execution and every ordinary post-open
  error share the runtime finalizer. Failure before atomic opening writes no
  session family. Hard kill after opening remains Continuity recovery work.
- Cut line: remove `ensure_runtime_session`, the fallback UUID start event, and
  success-only ownership of terminalization.
- Verification: opening is single-use and full-snapshot fenced; an unrelated
  concurrent event leaves neither proposed session nor start event; conflicting
  typed/operator intake returns an error only after one failed receipt,
  completion event, and Completed session exist.

Corrected source verification passes 59 focused coordinator tests, 17 native
coordinator-binary tests, both 8-test swarm suites, and 650 core library tests
with one intentional ignore. Exact corrected packaging and copied-live replay
remain open.

Exact corrected package `497df458` closes that acceptance boundary. A live
post-open input failure terminalized before returning exit 1. Braked Self then
repaired and archived an older receipt-grounded legacy family, retained the
newer failed family, and projected one remaining Completed session with no jobs
or actionable frontiers. Replay and 26 further serve cycles preserved runtime
SHA-256 `669f3de5...5461` exactly; the short soak stayed near 28 MiB and stopped
on SIGTERM with exit zero. This proves the retention head/archive cannot
resurrect coordinator work and normal error exits do not leak false liveness.

The remaining cut is intentionally narrower: abrupt process death can occur
after atomic opening and before the coordinator can author any terminal
receipt. Retention has no authority to guess that boundary. Continuity must
bind the opened session to exact process or resident lease identity, prove that
identity dead, and terminalize or quarantine the session through a dedicated
receipt-grounded recovery path before retention can see it as closed.

#### Receipt-free coordinator death authority map

- Owner: resident Self owns the exact child lease and its process-incarnation
  observation; runtime Continuity owns terminal recovery of the corresponding
  orphaned coordinator session.
- Inputs: the persisted active resident lease, its immutable child claim and
  terminal grant, an exact `Missing` or `Exited` observation for that process
  incarnation, and the runtime's matching Active coordinator session plus
  deterministic start event.
- Outputs: one typed coordinator-death recovery receipt and one deterministic
  recovery event, atomically replacing the runtime session as Completed. Self
  then uses its existing exact-grant cancellation transaction to requeue the
  pressure.
- Identity split: the cognitive thread remains request-owned context. A
  resident coordinator session is a distinct run incarnation derived from the
  exact resident launch digest; ordinary non-resident runs retain the simple
  `coordinator-{thread}` identity. Requeue therefore creates a new session
  without rewriting or reusing the cognitive thread.
- Derived state: timestamps, session age, receipt absence, PID presence, and
  operator projections remain observations only. None can establish death.
- Forbidden writers: retention, legacy coordinator repair, the coordinator
  itself after death, generic runtime session closure, and timeout policy may
  not synthesize this terminal family. A normal coordinator receipt and a
  death-recovery receipt are mutually exclusive.
- Shared paths: zero exit without a receipt, nonzero exit without a receipt,
  and restart observation of a missing exact child share one settlement
  classifier. Death before runtime opening proves that exact incarnation family
  wholly absent and requeues without inventing runtime state. Death after
  opening uses the recovery transaction. Normal exits with an exact fully bound
  run receipt retain the normal finalizer path.
- Typed-work boundary: authenticated terminal typed fulfillment lets the
  death-recovery authority close the original grant exactly once without a
  duplicate launch. No typed attempt permits canonical requeue. A typed launch
  attempt without terminal fulfillment remains active and
  `awaiting-fulfillment`; Continuity does not yet own orphan-worker terminality
  or supersession, so timeout or brake cannot manufacture a retry.
- Cut line: replace direct receipt-free resident cancellation with runtime
  recovery followed by canonical resident cancellation, and stop using the
  cognitive thread as the resident run identity; do not add an age-based
  scavenger or let session retention repair Active state.
- Verification: exact lease/claim/session/thread/objective/start-event binding,
  hostile substitution refusal, live or indeterminate process refusal,
  single-use replay, full-snapshot CAS refusal, mutual exclusion with normal
  receipts, restart recovery, pressure requeue without grant resurrection, and
  eventual archive of the recovered terminal family.

Retry artifacts are grant-incarnation-owned rather than thread-owned. Prepared
argv carries `artifact_root/{grant_id}`, so a new launch on the same cognitive
thread cannot erase the prior attempt's sealed directory.

Source verification for this cut is complete: the serial core suite passed 653
tests with one intentional ignore, followed by all 17 coordinator-binary tests
and all 8 swarm tests. The detached receipt is
`.epiphany-run/continuity-death-recovery-source`; stderr is empty and exit is
zero. Exact packaging and copied-live process-death falsification remain the
acceptance boundary.

### Semantic logical lifecycle implementation

`retain_memory_semantic_projection_lifecycles` now realizes the safe unattempted
portion of the logical half of
the semantic retention map in each canonical source store. Its one snapshot is
the authority basis for current-obligation equality, canonical authority
equality, singleton claim/attempt authentication, historical lifecycle
classification, prior-head validation, and the final fenced replacement. The
production semantic projector calls it once per exact source input after the
synchronous projection pulse and before health publication. The default
retained window is 256 generations; a non-positive configured window is refused
at argument parsing.

Preserved state is explicit rather than inferred from recency: the canonical
input obligation; the obligation named by the singleton scope claim; that
claim's exact attempt and authenticated grant/recovery authority; and the
current readiness family protected by those identities. Any running current
claim refuses the whole mutation. Any other same-scope obligation at or beyond
the canonical input generation also refuses the whole mutation, including when
it would fall inside the configured recent window. This prevents a stale caller
from blessing a future row through retention.

Retirable state is limited to lower-generation obligations outside the
preservation set that have no attempt, receipt, executor grant, or recovery
authorization. The one CAS deletes only those exact unattempted obligations and
replaces the singleton typed retention head. Unknown families and the scope
claim remain byte-identical. Attempted history remains intact because the
digest-only head cannot preserve the physical Qdrant namespace needed later.
Retention faults are reported as degraded daemon physiology; they neither
change projection completion nor suppress the health projection.

Four focused tests prove stale-snapshot refusal, unrelated-row identity,
idempotent replay, type separation, running-authority refusal, exact current
ready-chain preservation, and rejection of hostile future generations even
inside the recent window. A warning-free production binary check covers the
daemon wiring. Exact packaged copied-live proof remains the acceptance boundary;
physical Qdrant epoch cleanup remains a distinct executor-owned action.

The first exact packaged copied-state run exposed a catalog crossing omitted by
the initial map. Logical retention writes into the canonical Mind and Modeling
stores, so every general reader of those stores must recognize the evidence-head
schema even though only the retention owner may write or interpret it. The
projector cache already registered the head; `agent_memory_cache` and
`runtime_spine_cache` did not, causing current semantic input/health reads to
refuse the entire store after the first successful retirement. Both canonical
source catalogs now register the head as evidence-only. Projection-input tests
persist a head and prove current Mind and Modeling derivation remains unchanged.
This is schema legibility, not shared decision authority.

### Accepted semantic logical-retention boundary

Exact pushed source `b1e8c89a` is accepted live. Its warning-free 24-binary
release is
`sha256-3ce86fa7ce0ce15d78756d1f57b56e972d9bc37be3115b302ec567ce5e9b202e`
with witness
`sha256-fb1dd5599340a2e94600994d68661ed53820ba7fc605ac5b753f5e9632b46baf`.
On pristine copied state it retired exactly three superseded unattempted
Modeling obligations, changed no unrelated envelope, preserved all 20 Mind
envelopes byte-identically, preserved exact semantic health, and replayed with
zero retention mutation. Receipts live under
`.epiphany-run/semantic-retention-b1e8c89a` and
`.epiphany-run/linux-package-b1e8c89a`.

### Semantic physical-retirement authority map

- Owner: canonical logical retention emits immutable physical-retirement
  authority; the semantic executor owns exact Qdrant deletion; the canonical
  source store owns terminal receipt admission.
- Inputs: an exact historical obligation and attempt namespace, exact collection
  identity, swarm and partition, obligation ID, claim ID and epoch, plus the
  canonical retention authorization proving that namespace inactive.
- Outputs: one durable retryable physical-retirement obligation, deletion of
  only points matching the full namespace, and one terminal receipt recording
  observed/deleted count and completion time.
- Derived state: the cumulative logical retention head remains evidence only.
  It is not a retry address and cannot authorize backend deletion.
- Forbidden writers: backend age scans, current collection configuration, and
  inferred naming conventions cannot invent historical identity. Logical
  retention cannot delete an attempted lifecycle before durable physical
  authority exists. Qdrant failure cannot alter semantic readiness.
- Shared paths: every daemon pulse retries the same pending typed obligations.
  Only a terminal physical receipt permits later logical compaction of that
  attempted family; receipt retention is a later bounded cut.
- Cut line: do not mass-delete attempted history or infer an old collection from
  current configuration. The current attempt schema does not yet persist the
  collection/configuration identity required for failed partial writes; resolve
  that ownership seam from source before implementation.

Source inspection resolved the first half of that seam. The Qdrant endpoint and
collection are selected by `MemorySemanticIndexConfig` in the resident projector
body, after Idunn previously created the attempt. The attempt therefore owned
claim/epoch identity but not the physical address used by its writes. Acquisition
now receives the same exact config used by execution and persists both endpoint
and collection on the attempt before backend I/O. Execution compares its live
config with that acquired namespace and terminally fails the claim before any
backend call when they differ. Migrated historical attempts retain empty paired
fields rather than receiving invented history; they remain non-retirable until
operator-grounded evidence can name their old backend.

This is only the address-ownership foundation. The next cut must atomically emit
typed physical-retirement obligations for inactive attempted epochs, process
only obligations whose endpoint is permitted by current projector policy, and
admit exact deletion receipts before logical lifecycle compaction.

The typed physical cut is now implemented in source. A full-snapshot-fenced
authorization pass considers only generations below the retained window and
refuses future or running authority. Each exact terminal attempt must retain its
authenticated Idunn grant or recovery authorization. The immutable retirement
obligation binds the old source obligation, attempt, claim and epoch, swarm and
partition, Qdrant endpoint and collection, plus a digest over current canonical
authority and the exact historical lifecycle rows. A changed timestamp replays
the existing obligation rather than minting a new identity.

The executor first requires the recorded endpoint and collection to equal the
current managed projector configuration. Foreign persisted endpoints are
refused before backend reads. It then reauthenticates the source rows and digest,
scrolls only the full five-field namespace `(swarm, partition, obligation,
claim, epoch)`, deletes those exact point IDs, rescrolls to prove absence, and
appends a terminal receipt under a full-snapshot fence. Backend failure writes
no receipt and preserves retry authority. Logical compaction accepts attempted
history only when every attempt has a matching terminal physical receipt; it
then retires lifecycle and cleanup documents into the cumulative head in the
same fenced compaction.

The daemon runs authorization and pending cleanup before logical retention on
each pulse. The endpoint gate is deliberately policy-bound: a historical
endpoint no longer present in current managed policy remains pending rather
than turning canonical state into arbitrary network deletion authority. Exact
package and copied-live Qdrant proof remain the acceptance boundary.

Exact `6bc3ec3f` closes that boundary. Release
`sha256-fb1bf9258a7d977fd92d6f8ee17bb540fa870477cdf1d3cea9707ec8d582d4aa`
with witness
`sha256-b42dba7296739dc48ecf0d8014a16f9d232cd723ed0292830d50879f546c0e6d`
passed exact 24-binary inspection. In copied live state, the packaged daemon
deleted two points in the exact old `(swarm, partition, obligation, claim,
epoch)` namespace while preserving a same-obligation foreign epoch and a
same-claim foreign obligation. It compacted all logical and physical lifecycle
rows only after the terminal receipt; replay was inert. With Qdrant absent, the
same package preserved the durable obligation without a receipt or attempted
logical compaction; restart consumed that same authority and completed exactly
once. Ordinary Mind health and all canonical hashes remained unchanged.

Semantic retention is therefore bounded at both logical and physical layers for
new namespace-bearing attempts. Historical migrated attempts without recorded
endpoint/collection remain deliberately durable; no inference path may retire
them. This is honest residual evidence, not active growth. The next retention
organ is Persona conversation history, followed by the remaining broad organ
matrix and stable Starfire network ownership.

The copied-live physical audit sharpened the next ownership boundary. A durable
physical-retirement obligation must be emitted before an attempted lifecycle can
retire. It must carry exact collection name, obligation ID, claim ID, claim
epoch, partition/swarm, and the canonical retention authorization that proved
the namespace inactive. The semantic executor alone may delete points matching
that entire namespace and then write a terminal receipt. Backend failure leaves
the obligation pending and cannot affect readiness. The logical retention owner
must preserve attempted lifecycle until that obligation exists; a cumulative
digest is evidence, not a retry address.
### Typed attempts own retry eligibility

The c006 live run exposed a split between typed runtime authority and resident
cancellation. A coordinator process receipt owns process closure, but it does
not own whether a typed request may launch again. The immutable typed launch
and runtime-owned fulfillment chain own that decision.

- Receipt binding is structural: exact session incarnation, thread, grant,
  launch, policy, argv, objective, release, and executable digests. Terminal
  status is classified only after that binding succeeds.
- A successful coordinator receipt with no observed attempt may briefly retain
  the active lease while asynchronous typed publication arrives.
- Once an exact typed attempt exists, missing terminal fulfillment remains
  `awaiting-fulfillment`, including across brake, shutdown, or timeout. Those
  signals cannot manufacture supersession.
- A hostile terminal typed claimant closes the exact resident grant as
  `unfulfilled` and leaves its pressure consumed. It cannot become another
  Heartbeat grant.
- Generic cancellation may return a typed pressure to Heartbeat only when no
  immutable typed attempt exists. Explicit runtime-owned supersession remains
  the sole route to a later attempt.

The negative verification is the c006 failure shape itself: a fully bound
`failed` coordinator receipt plus an invalid terminal proposal Modeling result
must settle once, must not crash resident Self, and must not issue attempt
three. Exact live replay remains the package acceptance boundary.
# Accepted typed-attempt terminality and c006 settlement — 2026-08-10

- Owner: runtime spine owns whether typed worker output is authentic; resident
  Self owns settlement of the exact grant and pressure after coordinator process
  closure.
- Inputs: the exact active lease and grant, structurally bound coordinator
  receipt, immutable typed launch attempt, and runtime-owned fulfillment result.
- Outputs: fulfilled work closes normally; hostile terminal output closes the
  exact grant as `unfulfilled`; pending attempted work retains its active lease.
- Derived state: coordinator success is a classification after binding, not part
  of receipt identity. Heartbeat acknowledgement is notification, not authority
  to recreate a typed attempt.
- Forbidden writers: generic cancellation cannot return a pressure after an
  immutable typed attempt exists; Heartbeat cannot issue a replacement attempt
  from a terminal acknowledgement; a failed coordinator receipt cannot bypass
  structural binding.
- Shared paths: `once` and `serve` use the same settlement path. Copied and actual
  c006 replay used exact packaged `c693aaea` and converged at resident revision
  22 with no third grant under the cognitive brake.
- Cut line: source `c693aaea`; release `sha256-fd46323a`; witness
  `sha256-8ad95c0a`. Exact pre/post receipts are under the c006 intervention and
  replay directories named in the fresh-workspace handoff.
- Verification layer: 654 core tests plus nine swarm tests; exact 24-binary
  package inspection; copied active-attempt settlement; actual corrupted-state
  intervention; two bounded actual Heartbeat pulses with brake present and grant
  absent.

# Heartbeat graceful shutdown authority map — 2026-08-10

- Owner: the Heartbeat serve process owns its termination signal and the point
  at which its scheduling loop stops.
- Inputs: SIGINT/SIGTERM, the current atomic pulse transaction, the configured
  interval, and an optional bounded iteration ceiling.
- Outputs: no new pulse after shutdown is observed, interruptible idle wait, one
  final `epiphany.heartbeat.serve_receipt.v0` with `shutdownRequested=true`, and
  process exit zero.
- Derived state: Docker stop timeout is supervision pressure only; it is no
  longer the termination mechanism. A signal cannot roll back an in-flight
  atomic pulse and therefore takes effect at the next transaction boundary.
- Forbidden writers: Docker's eventual SIGKILL, artifact sequence, provider
  readiness, and the resident Self process do not decide Heartbeat closure.
- Shared paths: bounded completion and signal completion converge on the same
  final typed serve receipt. Every interval wait observes the same atomic signal
  owner.
- Cut line: install one process-local signal owner before entering `serve`; stop
  before the next pulse after a signal and replace every blocking interval sleep
  with a signal-aware wait. Do not add persisted shutdown authority or a repair
  loop.
- Verification layer: pure stop/wait tests, focused Heartbeat binary tests, then
  exact packaged Linux serve under the copied c006 cognitive brake with SIGTERM,
  exit zero, final shutdown receipt, and no new grant.

# Orphan worker Continuity authority map — 2026-08-10

Current mechanism: the coordinator persists an immutable runtime worker launch,
spawns `epiphany-openai-runtime run-worker` with an activation-capability digest,
then waits for the child-authored exact process claim before presenting the
preimage. The worker cannot enter watchdog, provider, model, or tool paths before
activation. Runtime result admission atomically replaces the active claim with
`terminal-result`; generic runtime completion atomically replaces it with
`terminal-failure`; resident Continuity may replace it with `terminal-death`
only after exact native process observation.

- Owner: the worker runtime owns claiming its exact native process incarnation
  before model or tool work. Runtime Continuity owns activation, terminalization,
  and exact-death recovery of that claim. Resident Self only decides whether the
  authenticated typed request is fulfilled after those runtime facts exist.
- Inputs: immutable worker launch/job, captured PID/creation token/executable,
  explicit activation bound to that claim, native exact-process observation,
  and authenticated terminal worker result.
- Outputs: `claimed` before consequence-capable work, `active` only after one
  explicit activation, then exactly one `terminal-result`, `terminal-failure`,
  `terminal-death`, or `terminal-unactivated`. A terminal failure/death/
  unactivated attempt may be superseded by a distinct job/binding incarnation
  without deleting the prior launch family.
- Derived state: coordinator artifact PID and detached `Child` handle are
  diagnostic only. Request identity remains retry-stable; launch, worker claim,
  process, session, and artifact directory are attempt-incarnation state.
- Forbidden writers: receipt absence, coordinator death alone, elapsed time,
  generic resident cancellation, and `roleFailureReview` prose cannot declare an
  orphan worker dead or authorize a retry. A worker without an activated exact
  claim cannot invoke model/tools or publish a terminal result.
- Shared paths: proposal Modeling, Imagination consideration, and admitted model
  direction must use the same worker start gate and terminal claim primitive.
  The worker itself claims before all provider/tool routes; no coordinator-only
  happy path may bypass it.
- Cut line: implemented in `runtime_spine.rs`, `epiphany-openai-runtime`, the
  coordinator launcher, and resident Self. `roleFailureReview` no longer owns
  proposal retry. All three typed lanes consult exact process terminality, and
  dead runtime-link projections are demoted before planning a replacement.
  Generic job completion now owns one snapshot-fenced write of the runtime job,
  generic result, completion event, and terminal-failure claim. The remaining
  cut is packaged Linux falsification, not another retry policy.
- Verification layer: kill before claim, after claim/before activation, after
  activation/before result, and after valid result/before coordinator receipt;
  prove no model/tool work before activation, no dual live attempts, same typed
  request with distinct attempt/process/artifact identities, exact replay, and
  retention non-resurrection across all three typed lanes. Source evidence now
  includes exact process/result race tests, activation CLI ordering, typed retry
  for proposal/Imagination/model direction, stale-link demotion, canonical Self
  settlement, core 661 passed/1 ignored, swarm 9, coordinator 17, and OpenAI
  runtime 15+10+10. Exact 75b84180 package inspection authenticates 24 binaries,
  release sha256-3959bcb3, witness sha256-6e34eb0a, and zero warnings. Packaged
  Linux proves terminal-unactivated without provider work, durable claimed and
  active orphan shapes after SIGKILL/no OOM, native terminal-death, canonical
  requeue, and one same-request distinct retry without dual live authority. The
  retry exposed an activated generic-failure path that left its claim active;
  exact pushed 7637b1cf now closes that path atomically. Its authenticated Linux
  package has release sha256-fa3a1e15, witness sha256-f5c3a576, 24 binaries,
  and zero warnings. Fresh copied state proves model-transport failure produces
  one Failed job plus terminal-failure claim, canonical resident settlement
  requeues once, and a distinct same-request attempt receives its own process
  and terminal authority while the first remains terminal. Valid-result-before-
  receipt and retention replay remain the open boundaries.

## Receipt-free typed fulfillment settlement owner

- Owner: resident Self owns whether a dead receipt-free coordinator completes,
  waits, or cancels its exact grant. The swarm binary owns native observation
  and supplies policy inputs only.
- Inputs: exact resident lease and grant, authenticated runtime-owned typed
  fulfillment, exact coordinator incarnation, native child observation,
  shutdown/brake/timeout, time, and cooldown.
- Outputs: fulfilled evidence plus exact coordinator death recovery closes the
  original grant `recovered-fulfilled`; pending live worker authority remains
  awaiting; terminal unfulfilled authority follows canonical cancellation.
- Derived state: binary outcome projection and Heartbeat visibility do not own
  settlement. A consumed pressure is historical request authority, not a retry
  queue entry.
- Forbidden writers: binary-local classifiers, receipt absence alone, elapsed
  time, and terminal acknowledgement presence cannot manufacture completion or
  retry.
- Shared paths: `once` and `serve` both enter the same resident function through
  `cycle`; all three typed request families use runtime-owned fulfillment.
- Cut line: delete the private binary settlement function and cancellation
  classifiers; resident Self performs recovery and the exact grant CAS.
- Verification: admitted-model-direction result before coordinator receipt,
  exact missing-child recovery, one recovered-fulfilled grant, consumed
  pressure, byte-identical replay refusal, and no Heartbeat retry. Source passes
  661 core tests with one ignore plus seven swarm tests. Exact package and copied
  Linux proof remain.

Exact `2e66433f` closes the source and Linux function-level gate. Its release is
`sha256-1863385b` with witness `sha256-02f1d04f`, 24 binaries, and zero warnings.
The Linux fixture proved fulfillment with zero coordinator receipts, one
recovered-fulfilled original grant, consumed pressure, byte-identical replay
refusal, exact closed-lifecycle retention, and no retry before or after
retention. The fixture linked exact pushed source; it did not execute the
packaged swarm CLI. Direct packaged-binary provenance remains open alongside
the proposal Modeling and Imagination variants.

### Packaged settlement and co-resident retention fence

The exact `2e66433f` packaged `epiphany-swarm` now directly proves the
admitted-model-direction case: zero coordinator receipts plus authenticated
typed fulfillment and exact process death settle the original grant as
`recovered-fulfilled`, keep its pressure consumed, clear active authority, and
exit zero. Exact packaged repository-Body bind/observation supplies the domain
authority, and cognitive runtime identity remains distinct from release
provenance throughout the run.

Resident lifecycle retention owns deletion of only pressure/grant/ack/claim
families and replacement of its singleton head. Its compare-and-swap fence,
however, must be the complete physical backing snapshot because resident
provider readiness legitimately shares the file. An owner-only snapshot is not
a full-snapshot fence and caused deterministic refusal after readiness was
published. The source cut reads every envelope for the fence, selects only
closed lifecycle envelopes for deletion, and preserves the co-resident row
byte-identically. Core 662/1 ignored and swarm 7 pass; copied exact-source replay
retired the packaged lifecycle and produced no retry. Exact packaging of this
fence remains the next gate.

Exact `52ee6b53` closes that packaging gate. Release `sha256-24a8faee` and
witness `sha256-c1d0f4f1` authenticate 24 binaries with zero warnings. A first
packaged cycle created the real co-resident readiness shape while settling the
zero-receipt typed result. After Heartbeat consumed the ack, a second packaged
cycle with retention zero retired the lifecycle and exited sleeping without a
replacement grant. Replay had neither retired work nor retry authority. The
full-backing fence is therefore accepted; Imagination and proposal Modeling
remain independent typed-fulfillment variants, not reasons to reopen retention
ownership.

The Imagination variant now has the same complete source-level proof. Runtime
accepts fulfillment only after the exact request, model basis, deterministic
candidate, launch binding, worker launch hash, and terminal role result agree.
Resident Self then settles the zero-receipt dead coordinator once, terminalizes
the original grant `recovered-fulfilled`, preserves consumed pressure, refuses
replay byte-identically, and permits lifecycle retirement without reopening a
grant. This changes no owner or production mechanism; it closes the missing
variant test. Exact packaged Imagination state remains the next evidence gate.

Exact packaged `52ee6b53` closes the Imagination evidence gate. The fresh Linux
state carried the complete runtime-owned candidate chain and zero coordinator
receipts; packaged Self settled the original grant `recovered-fulfilled` and
packaged retention later removed the Heartbeat-consumed lifecycle without
reopening authority. This proves the candidate companion remains producer-owned:
the first fixture attempt without it failed closed before resident settlement.
Proposal Modeling remains separate because its fulfillment validator also owns
the immutable proposal payload, Modeling context, and Evolution patch shape.

The proposal Modeling variant now crosses the full resident boundary in source
verification by reusing the runtime admission fixture rather than copying its
policy. Runtime remains owner of proposal/request/payload, Body-bound launch
context and hash, successful Modeling result, Evolution patch, and the single
safe routeable frontier. Resident Self sees only authenticated fulfillment and
owns exact zero-receipt death settlement, replay refusal, lifecycle retirement,
and non-resurrection. Core 663/1 ignored and swarm 7 pass. Direct packaged proof
still requires Linux-native construction because the worker launch's Body basis
cannot truthfully be minted under a Windows path and rebound later.

## Outer worker-attempt retention authority map

### Implemented failure-family cut

`resident_self::live_resident_self_typed_request_ids` is the cross-store
liveness owner: every surviving typed grant preserves its request. After
resident lifecycle compaction, `epiphany-swarm` passes that set to
`retain_failed_runtime_worker_attempts`. Runtime spine then retains the newest
configured failed attempts and may atomically replace an older exact family
with `EpiphanyArchivedRuntimeWorkerAttempt`. The archive accepts only one of
the three resident typed request echoes, a failed/cancelled runtime job, and an
exact terminal-death, terminal-unactivated, or terminal-failure claim with its
terminal authority. It deletes only the matching launch, claim, lane binding,
job, generic result, and job events under the full physical snapshot fence.
The request and all unrelated envelopes remain live.

### Fulfillment-capable tombstone cut

`archive_fulfilled_runtime_worker_attempt` first asks the runtime-owned typed
fulfillment verifier to authenticate the complete live attempt. It requires a
Completed generic job and a terminal-result claim bound to that exact result.
Proposal Modeling additionally requires exact Mind admission before the worker
scaffolding stops being the only owner of its patch. The atomic archive records
request kind, request ID, job ID, result ID, terminal status, exact retired type
counts, and chained digest. `runtime_typed_request_fulfillment` recognizes that
narrow tombstone only when no live launch, claim, or worker result coexists.
Thus resident settlement sees the same fulfillment before and after retention.
Producer-owned semantic companions and admission receipts are not retirement
cargo.

The all-lane source proof is now closed. Imagination and admitted model
direction each pass through real resident grant settlement, Heartbeat ack
consumption, and lifecycle deletion before worker archival; their candidate or
direction companion remains byte-identical and the tombstone answers the same
fulfillment query. Failed retention enumeration sorts exact terminal claims,
keeps the configured newest attempt, and archives the older eligible family.
The worker job is explicitly distinct from the coordinator's jobless
Continuity session; mixing those authorities is rejected.

Before retirement, runtime spine now authenticates the immutable failed launch
with the same lane facts that made it admissible: persisted typed request,
producer proposal where applicable, exact role/binding, runtime and thread,
launch-document digest, and exact typed context projection. Proposal Modeling
also binds repository/workspace/payload and Body-bearing Modeling carrier;
Imagination binds its one launch record and request/model projection; admitted
model direction binds the request/model projection directly. Failed terminal
status is not permission to launder malformed launch state into a tombstone.
Model-direction result admission now checks the same projected model hash.

- Owner: `runtime_worker_attempt` owns one immutable outer worker attempt's
  typed request association and process-status semantics. Runtime spine retains
  the CultCache transaction primitives for claim, result, and archival commits.
  Resident Self supplies cross-store liveness but cannot delete runtime rows.
- Inputs: exact typed request identity; worker launch; lane-specific launch
  binding; process claim; terminal role result and typed companion; runtime job
  and terminal events; downstream result references; resident prepared/active
  lease and terminal-ack liveness.
- Outputs: one per-attempt typed archive tombstone committed atomically with
  deletion of that exact attempt family. Retry and fulfillment readers consume
  the tombstone as terminal evidence for only its request/job/result tuple.
- Derived state: a cumulative retention head may count archives but cannot own
  attempt death or request fulfillment. Missing launch/claim/result rows are not
  evidence by themselves.
- Forbidden writers: completed model-session archival, coordinator receipt
  retention, resident lifecycle retention, semantic retention, wall-clock age,
  and artifact cleanup cannot retire outer worker authority. No generic sweep
  may delete a claim or result independently.
- Shared paths: proposal Modeling, Imagination consideration, and admitted model
  direction use one exhaustive typed-request projection, the same status
  predicates, the same archive commit primitive, and common launch/claim/job
  invariants, with lane-specific binding/companion validators.
- Cut line: archive only exact launch, terminal claim, terminal result,
  lane-specific attempt binding/companion, and terminal job/event rows. Preserve
  request, proposal, model, admission, and unrelated runtime families until a
  separately mapped lifecycle owns them. The tombstone must be written in the
  same full-snapshot CAS as deletion.
- Demotion: serialized process-status strings are wire representation, not local
  policy owners. Resident recovery, coordinator retry, runtime fulfillment, and
  retention derive their decisions from `WorkerProcessStatus`. Per-consumer
  request-family arrays no longer decide which typed work exists.
- Verification layer: terminal-result/failure/death attempts; prepared/active/
  unconsumed-ack refusal; downstream-reference refusal; stale snapshot race;
  unknown-row byte identity; retry after archived failure; fulfillment after
  archived success; duplicate archive replay; and negative proof that restoring
  or deleting one old envelope cannot resurrect work.

The completed-session archive remains separate and accepts only terminal
`openai-model-adapter` jobs. Outer worker attempts are owned by the dedicated
per-attempt archive above; retry and fulfillment readers consume its tombstone
rather than inferring state from independently missing claim/result rows.

## CultCache single-file publication substrate

Single-file CultCache publication is owned by the exclusive writer. It encodes
one complete sorted snapshot, stages it beside the destination, syncs the staged
file, atomically replaces the destination, and then performs the parent
directory durability barrier. The committed destination is never deliberately
removed before replacement. A post-replacement durability error is ambiguous
commit evidence: callers must reread typed identity before considering any
retry; the error itself cannot authorize a duplicate consequence.

- Owner: `SingleFileMessagePackBackingStore::write_all_unlocked`, while holding
  the destination's exclusive sibling lock.
- Inputs: the complete encoded snapshot, canonical destination, and existing
  sibling directory.
- Outputs: one old-or-new complete destination snapshot; the next exclusive
  write also removes abandoned regular staging siblings named exactly
  `<destination>.<UUID>.tmp`.
- Derived state: staging files and the sibling lock are mechanics, never typed
  recovery, replay, or work authority.
- Forbidden writers: destination truncation/removal, lockless repair, stale
  staging publication, wildcard temp deletion, or error-code-driven retry.
- Shared paths: single-file push, delete, conditional replacement, append, and
  compaction all converge on the same publisher and cleanup boundary.
- Cut line: cleanup is confined to the destination parent and exact destination
  prefix plus valid UUID suffix; foreign names, other stores, directories, and
  symlinks survive. The F: bind is not repaired by this cleanup and remains
  rejected as a mutable authority substrate.
- Verification layer: exact packaged writers killed across randomized publish
  boundaries, concurrent lockless decoding, reopen after every kill, monotonic
  typed counts, file mode/ownership, abandoned-staging cleanup, and explicit
  negative preservation of foreign siblings.

The exact Starfire Docker Desktop `F:` bind failed this layer: during packaged
writer interruption a lockless reader observed an empty published snapshot,
even though the later store decoded. Capability probes for rename and directory
fsync were therefore insufficient. A Docker named volume passed sixty
independent randomized writer kills and 5,000,000 concurrent lockless reads
without an empty, partial, undecodable, or regressing snapshot. Mutable resident
state must use the accepted Linux volume substrate; the Windows bind may carry
immutable package inputs and receipts, not live CultCache authority.

Exact source `a4756857` packages CultCache `0ba8745` as release
`sha256-b2e2793e` with witness `sha256-4bdb22ff`. On a fresh named volume,
forty continuously writing packaged process incarnations were killed at real
publication boundaries and all exited 137. Exact packaged status decoded after
each and never regressed. The concurrent lockless verifier completed 10,000,000
reads spanning 102-201 envelopes without an empty or invalid sight. The next
successful write left 200 typed events, mode 0644, uid/gid 0, and no regular
UUID staging sibling while preserving foreign-store, unknown-suffix, directory,
and symlink lookalikes.

### Braked grant / Heartbeat coordination evidence

Copied c006 proves the storage and process restart body while preserving the
existing pending authority. Heartbeat owns one running coordinator turn and the
resident store owns its exact proposal grant. Typed payload inspection proves
the grant is unconsumed and nonterminal, with exact Heartbeat schedule/action
equality. Resident Self therefore correctly has no prepared or active lease and
no child claim yet. The cognitive brake holds the grant without destroying or
launching it; Heartbeat's initiative-frozen projection is expected physiology,
not stale-turn evidence. Generic age repair or orphan terminalization would be
corruption here.

### Direct proposal Modeling closure

The Linux-native `53678374` fixture now constructs the remaining strong lane
without rebinding Windows-authored Body evidence. `commit_coordinator_job_launch`
owns the generation-one Body carrier and exact proposal launch binding;
`put_runtime_role_worker_result` authenticates the immutable proposal/request,
payload, context, launch hash, result, and one safe proposal-citing frontier;
`commit_repo_model_admission` owns Evolution adoption. Resident Self sees only
that runtime-owned fulfillment and closes its zero-receipt jobless coordinator
incarnation `recovered-fulfilled`.

Packaged resident lifecycle retention then deletes only the consumed
pressure/grant/ack family. Explicit worker archival replaces eight launch/job/
claim/result/binding/event envelopes with the proposal tombstone while leaving
the proposal, request, admitted model, frontier, and Mind receipt live.
`runtime_typed_request_fulfillment` returns the same request/job/result tuple
before and after that archive. The next Heartbeat grant names the independently
created admitted-model-direction request, proving causal forward routing rather
than proposal resurrection.

### Exact packaged retention evidence

Exact `53678374` closes the Linux package gate. Release `sha256-5d50fa7d` and
witness `sha256-1814d2b7` authenticate 24 binaries and zero warnings. On copied
state bound to an exact generation-one Repository Body, packaged swarm window
one archived the older of two failed proposal-Modeling attempts and the older
of two fulfilled admitted-model-direction attempts. Each archive replaced
seven exact envelopes with one tombstone; the configured newest family stayed
live. The failed tombstone does not satisfy attempt-exists. The fulfilled
tombstone returns the same exact job/result through
`runtime_typed_request_fulfillment` as the retained live family. Both packaged
cycles exited zero under the cognitive brake, so no coordinator or worker was
launched as an accidental side effect.

The live construction also falsified several invalid fixture shapes: a
Body-less Modeling carrier, a direction launch projecting the wrong model, a
worker without a terminal job family, and a worker job placed in the jobless
resident coordinator session. Production gates refused each shape. The
accepted fixture uses authenticated Body state, the exact persisted model,
distinct worker and coordinator sessions, a claimed/active worker incarnation,
typed result admission, generic job completion, and closed resident authority.

## Actual c006 braked endurance plateau

The deployed physiology now has a long-duration proof for the exact latest
body, not merely older idle and active releases.

- Owner: Heartbeat owns scheduling pulses; resident Self owns the active-turn
  state machine; the cognitive swarm brake owns whether either may launch new
  cognition. The detached monitor owns observation only.
- Inputs: exact `16407f7e` Heartbeat and Self executables, authenticated release
  and witness, separate role-singleton locks, named-volume state, and the
  engaged cognitive brake.
- Outputs: Heartbeat pulse projections, resident operator projections,
  process/resource samples, store-size observations, and one final exact
  packaged readiness projection.
- Derived state: CPU, RSS, block I/O, pulse count, and store sizes are sight.
  They do not schedule, brake, complete, retain, or repair work.
- Forbidden writers: the monitor cannot release the brake, author grants,
  alter resident state, restart owners, or interpret growth as permission to
  compact authority.
- Shared paths: all 923 observed pulses traversed the production Heartbeat serve
  loop and every resident observation came from the production Self serve
  projection. Final readiness used the same packaged binary and mounted stores.
- Cut line: there is no watchdog or repair writer in the plateau. Any stopped
  owner, grant, lease, revision change, wrong brake, or readiness degradation
  fails the rite and preserves the receipts.
- Verification: 30 samples spanning iterations 573-1496 contain zero invariant
  violations. `/state` stayed exactly 18,161,109 bytes and `/workspace` exactly
  114,209,526 bytes. Heartbeat RSS stayed 28.63-28.88 MiB and resident RSS
  54.11-55.50 MiB. Both containers remained alive. Final readiness was
  authenticated, brake-engaged, `active`, and reason-free.

Receipts live under `.epiphany-run/c006-endurance-16407f7e`. The next broad
gate is autonomous frontier turnover across Self, Eyes, Modeling, Imagination,
and Mind; it must first run on copied exact state and must not acquire Hands or
Persona consequence authority.

## Receipt-bound internal cognition continuation

The first live frontier audit found a scheduling silence, not a permission
failure. A proposal-Modeling worker fulfilled its typed request and resident
Self correctly closed that grant, but the exact coordinator receipt ended at
`reviewModelingResult`. No domain-pressure owner converted that already-derived
Mind review into another grant, so a brake release could not advance c006.

- Owner: the exact fully resident-bound coordinator receipt owns one proposed
  internal continuation. The coordinator remains the owner of live action
  derivation; Heartbeat owns delivery order only.
- Inputs: the last settled receipt ID in resident state, the matching runtime
  receipt, its authenticated thread and final action, terminal typed role state
  for wait-to-review transitions, and the current planning lifecycle.
- Outputs: at most one idempotent
  `coordinator-internal-continuation` pressure. Its launch is objective-free,
  uses the receipt thread and mounted cognitive runtime, executes exactly one
  step with auto-review and typed failed-result supersession, and carries the
  receipt-derived required action.
- Derived state: receipt reason prose, rendered status, pulse artifacts,
  readiness rows, timers, and operator projections are observations. They do
  not create continuation authority.
- Forbidden writers: idle polling, retention, old role lanes, Hands, Persona,
  deployment, and external consequence paths cannot create these pressures.
  The safe action vocabulary excludes `continueImplementation`, Persona,
  deployment, waiting states, and failure-review actions.
- Shared paths: proposal Modeling review, Research/Modeling/Verification launch
  and review, and successful Imagination-to-Mind planning stages use the same
  receipt-to-pressure primitive. Wait receipts become review pressure only
  after their exact typed result is terminal.
- Cut line: there is no generic coordinator retry loop. A continuation starts
  execute mode only when its exact action is safe. Before any action match, the
  coordinator rederives live status; disagreement emits a no-consequence
  required-action refusal, closes the stale pressure, and publishes the newly
  derived action without executing it. If Mind rejects a terminal role result,
  the coordinator's existing failure-review owner supersedes that exact result
  and derives fresh work in the same bounded run; process failure is not the
  rejection protocol.
- Verification: 30 resident tests and all 18 coordinator tests pass. Exact
  receipt replay creates one pressure and one objective-free execution argv;
  repeated ingestion is idempotent; a Hands final action creates no pressure;
  and source order proves required-action refusal precedes every action effect.

Exact `c9a2a979` packages the corrected path as 24 binaries, release
`sha256-78b09d7c32867c71d593951f328a191b7261600a1d9e81d7fdcd35ce7414f218`,
and witness
`sha256-ddf32da018f5a53eb87f3ed5b87ccfa57616203970d6fdab9641ee1ac8f71f24`.
On fresh copied c006, one old receipt created grant 23; Mind rejected the
unanchored Modeling patch; coordinator failure review superseded it once inside
a successful new receipt; that receipt created distinct grant 27; and the
second run rederived `awaitFrontierProposal` and recorded a no-consequence
required-action refusal. Both grants completed. No process-failure retry
occurred, resident state ended idle at revision 34, and all existing
Hands/Persona/deployment envelopes remained byte-identical. The copied brake is
engaged and both copied owners exited zero.

The same body then replaced the two actual c006 provider processes without
changing their named stores. Bounded release reproduced the causal shape:
grant 44 wrote one exact failed-result supersession inside receipt
`coordinator-run-linux-eyes-tools-c005-1786407375735`; that receipt created
distinct grant 48; and its coordinator refused stale `reviewModelingResult`
because the live action was `awaitFrontierProposal`, with consequence `none`,
before completing receipt
`coordinator-run-linux-eyes-tools-c005-1786407379115`. Both exact grants are
terminal completed, resident state is idle at revision 34, the four protected
Hands/Persona/deployment-family envelopes are byte-identical, and final
authenticated readiness is active, brake-engaged, and reason-free. Actual
receipt-bound turnover is accepted.

## Narrow local Verse decision inputs

Aggregate local Verse context is an operator and topology projection, not a
default decision input. A command may read it only when its output genuinely
depends on several state families.

- Owner: each typed state family owns the decisions made from that family.
- Inputs: the single-daemon restart-policy writer reads one exact daemon-status
  envelope plus explicit CLI policy fields.
- Outputs: one daemon restart policy bound to the status-owned daemon and
  cluster identity.
- Derived state: Persona, Hands, receipt, telemetry, and unrelated daemon rows
  remain projection data and cannot influence this write.
- Shared paths: `policy` and `write-policy` converge on the same writer.
- Cut line: `write_policy` no longer calls
  `query_epiphany_local_verse_context`; reconciliation and runbook construction
  retain aggregate reads because they enumerate policies, statuses, topology,
  and brake scope.
- Verification: the exact loader returns only the requested typed envelope and
  remains non-creating on an absent store; a source-boundary test refuses
  aggregate-query regression in `write_policy`.

Direct `reconcile` also reads only one exact daemon status, one exact policy,
and the canonical brake. Its consequence helper accepts the brake itself, not
an aggregate context. Scheduler tick and cluster runbook keep aggregate context
because their output enumerates multiple daemon policies, statuses, topology
rows, and brake scope. Focused tests prove the direct source boundary and that
the narrow brake input preserves lifecycle-poke refusal semantics.

Single-target `epiphany-verse-query poke-daemon` follows the same cut. Exact
daemon status owns target identity, the canonical brake owns refusal, topology
rows supply only the requested display metadata, and the exact immutable intent
owns post-write confirmation. Two aggregate queries and the obsolete
context-shaped brake/topology wrappers are deleted. Bulk poke and triage remain
aggregate enumeration paths. The complete 19-test verse-query binary suite
passes without warnings.

The full classified batch then passed 669 library tests with one intentional
ignore, 29 daemon-supervisor tests, and 19 verse-query tests. Detached logs and
exit-zero status live under `.epiphany-run/narrow-verse-readers-161c6ec8`.

Exact pushed `ec54666c` packages that cut as Linux release
`sha256-4d7347980f2fad658ebc6206b0435f29e1151cfbb75ec2806a8df2d5eb7f63bd`
with witness
`sha256-d5e6671cd70e1aeb3df21d1e69fb015b831e2c63c272d7ef3e3bf5f61aac15d1`.
The copied live gate added one valid Hands daemon status to two copies of actual
c006 local-Verse state, then added a registered but deliberately undecodable
Mind-contract payload to only one copy. Exact packaged status, policy, direct
reconciliation, and single-target poke paths produced the same decisions on
both copies; reconciliation differed only by observation time. Every input
envelope remained byte-identical through the writes, including the hostile
payload. This proves the decision-input cut at the deployed CultCache layer,
not merely by source inspection: unrelated typed cargo can neither steer the
decision nor be silently repaired by it. Receipts live under
`.epiphany-run/narrow-verse-readers-ec54666c`.

## Runtime-owned Imagination candidate publication

The Imagination consideration result already entered through
`put_runtime_role_worker_result`, which authenticates the current request,
candidate causal fields and timestamp, deterministic candidate identity, exact
single launch binding, worker launch document hash, Imagination role/binding,
runtime/thread identity, current model projection, and absence of foreign
authority cargo. Before `ff9dacf1`, that owner persisted the generic result and
terminal process claim but not the candidate it had just authenticated.
Resident fulfillment consequently required a typed candidate envelope with no
production writer; tests supplied one directly and concealed the cut.

Runtime result admission now owns one atomic publication:

- Owner: authenticated runtime launch context owns candidate causality;
  runtime terminal admission owns publication and timestamp; Imagination owns
  only semantic proposal content.
- Inputs: exact request and quoted evidence, model-supplied disposition/title/
  summary/rationale/options/uncertainties/recommended route, launch binding,
  worker launch, process claim, and current model projection.
- Outputs: immutable worker result, terminal process claim, and exact typed
  `ImaginationConsiderationCandidate` companion in one snapshot-fenced CAS.
  Runtime derives request, feedback, packet, room, visibility, classification,
  model, evidence-reference, contract, deterministic candidate, and timestamp
  fields; none are model echoes.
- Derived state: resident fulfillment observes the admitted result/candidate;
  it does not write either document.
- Forbidden writers: model output, resident settlement, review routing, tests,
  and operator projections cannot synthesize candidate identity or evidence
  provenance. Model output cannot choose an arbitrary evidence identifier.
- Shared paths: direct provider completion and replay both use
  `role_worker_result_from_ingress` followed by
  `put_runtime_role_worker_result`; coordinator finalization independently
  CAS-fences only its exact session so concurrent worker publication does not
  become a false conflict.
- Cut line: an existing candidate without its worker result is an orphan and
  refuses admission; exact result replay requires the persisted companion to
  remain equal. The old candidate-causality output fields are absent from the
  model schema rather than tolerated and checked downstream.
- Verification layer: hostile model JSON containing every former causal field
  and a substituted evidence reference produces a candidate whose complete
  causal body comes from the authenticated request. Unrelated runtime writes
  coexist with coordinator finalization while an exact session race refuses.

The focused atomic/idempotent, orphan-refusal, and receipt-free resident tests
pass, and the full core library passes 670 tests with one intentional ignore.
Exact Linux release
`sha256-6d237cda95de91d999de7403d843507fac89f1f2c091b114957a33118063a03b`
with witness
`sha256-3b37136d34e4d4b886544102ec43a258510e246d762640a686b02b29fb13fafc`
passed 24-binary inspection and a copied c006 braked-once zero-exit gate without
changing runtime, Mind, or Heartbeat stores.

The genuine packaged gate is now closed under exact `acd91e6e`, release
`sha256-1c5a16efdfd02e453df0fc53c81cf1848ccaaca72e53c528f3385da9c8725085`,
witness
`sha256-b592d64ed0d0c3b7b1ef858ae96533a6e890e3805de94cf2aa6438b99eb39401`.
Fresh copied c006 admitted one signed Bifrost public-feedback packet, issued one
Heartbeat grant, completed Imagination job
`12b670b7-e942-4390-98d7-54ab57908947`, and settled Self exactly once without
retry. Runtime ended with zero open jobs and no actionable Hands or Eyes
frontier. Mind, Body, workspace coverage, and workspace Git state stayed exact;
a braked restart issued no grant and resurrected no work. The rejected
`af2581b5` and `b661ec4b` runs remain receipts for the full-snapshot and
model-authored-provenance faults instead of being rewritten into victory prose.

## Atomic legacy coordinator repair

Legacy coordinator repair is one Continuity transaction over the complete
observed runtime snapshot. It is not a loop of independently committed family
repairs.

- Owner: runtime Continuity owns the batch decision under one full-snapshot
  fence.
- Inputs: active legacy coordinator sessions, their sole exact receipts,
  joblessness, coordinator-started event families, and immutable runtime
  identity.
- Outputs: every eligible session becomes Completed and receives its
  deterministic completion event in one CAS.
- Derived state: deterministic session ordering affects returned presentation
  only; it owns no partial commit boundary.
- Forbidden writers: an earlier valid family cannot publish before every
  observed candidate family validates.
- Cut line: any ambiguous receipt, foreign job, malformed start family, or
  concurrent snapshot change refuses the whole batch without mutation.
- Verification: exact `aa841873` adds a valid family before an ambiguous family
  and proves the complete pre/post snapshot remains byte-identical. The full
  core library passes 670 tests with one intentional ignore.

The same genuine core delta proves restored release-profile ownership under
source change. Persistent-cache packaging completed in 37.27s wall/Cargo
29.54s versus the prior 5m02s baseline, producing 24-binary release
`sha256-dd4f05cb2e7f1b26156e7c9d5ed58f6d97ce5808d123b1bec343bfac59bf2ce7`
and witness
`sha256-793b29fcb7af4f8314a46f0fe0013cc8f5f382e7490a32c160385d29359adca5`
with zero warnings. An identical replay completed in 8.65s wall/Cargo 0.69s
and reproduced both identifiers exactly. Incremental cache state therefore
accelerates construction without becoming release authority.

## Governed directory inventory sight

Directory observation is a bounded source faculty, not Heartbeat authority.

- Owner: the native `epiphany_source` adapter owns workspace-confined,
  read-only directory observation.
- Inputs: one canonical path beneath the worker workspace plus explicit depth,
  entry, and sample ceilings.
- Outputs: deterministic counts of entries, files, directories, symlinks, and
  regular-file bytes; bounded path samples; and explicit entry/depth
  truncation state.
- Derived state: samples are presentation evidence. Aggregate totals are
  admissible only when `complete=true`; neither totals nor filenames decide
  whether a Heartbeat grant is live or terminal.
- Forbidden writers: shell execution, symlink traversal, outside-workspace
  reads, mutation, operator-supplied counts, and arbitrary CultCache
  inspection are absent from this organ.
- Shared paths: Eyes, Modeling, and Soul receive the same model-tool contract,
  native execution path, and completeness rule.
- Cut line: `directory_inventory` is general source sight beside `read_file`;
  it is not a special Heartbeat inspector and cannot become a second state
  authority.
- Verification: focused tests prove exact totals, deterministic order,
  confinement, and explicit truncation. Exact packaged `31dcd351` invoked the
  tool in copied live cognition and measured 72 directories, 74 files, and
  3,975,362 bytes with `complete=true`. Modeling refused to infer post-brake
  grant terminality from artifact names, preserving the ownership boundary.

## Grant-owned resident lifecycle sight

Resident lifecycle observation and scheduling now read the same authority.

- Owner: each exact `ResidentSelfHeartbeatGrant` owns its consumed and terminal
  state; `ResidentSelfState` owns whether that grant is prepared or active.
- Inputs: one explicitly bound resident store, an optional exact grant ID, and
  a bounded recent-row limit.
- Outputs: typed pressure/schedule/action identity, consumed and terminal
  timestamps/status, active/prepared flags, and derived `launchable` state.
- Derived state: the projection is read-only evidence. Terminal acknowledgements,
  retention heads, filesystem artifacts, and pulse names cannot decide whether
  a grant may launch.
- Forbidden writers: the tool adapter cannot discover sibling stores, inspect
  generic CultCache cargo, mutate resident state, or infer authority from
  filenames.
- Shared paths: Heartbeat issuance, pending-grant selection, and projection all
  use `resident_self_grant_is_pending`; there is no observer-only definition of
  launchability.
- Cut line: the native `epiphany_state.resident_grant_lifecycle` tool is exposed
  only to Eyes, Modeling, and Soul and only when the authenticated resident
  launch forwards its exact state-store binding.
- Verification: exact `34d75d05` unit coverage proves an older terminal grant
  remains non-launchable beside a later retry. Exact packaged copied cognition
  observed the same shape; after three strict duplicate-field result failures,
  attempt four admitted typed evidence and resident Self terminalized the exact
  original grant once under the brake. No new grant appeared.

The three failed attempts are not accepted reliability evidence. The next cut
belongs to role-result schema construction/model ingress: preserve strict
duplicate-field rejection while making the first model-produced result conform
to its one-owner schema.

## Runtime-owned proposal Modeling publication

Proposal Modeling owns semantic frontier judgment, not RepoModel causality.

- Owner: authenticated runtime launch context owns request/proposal identity,
  model base, Body observation basis, patch identity, deterministic frontier
  identity, evidence binding, and publication time. Modeling owns only the
  closed `proposalFrontierDraft` plus ordinary role verdict/summary sight.
- Inputs: one immutable proposal Modeling request and launch context, the
  current RepoModel projection, and one strict semantic draft.
- Outputs: one ordinary role result containing a runtime-composed
  `RepoModelPatch` with exactly one active frontier upsert.
- Derived state: provider response-format strictness is derived recursively
  from the closed schema. Every constant declares its JSON type; this is a
  provider contract, not a relaxation of runtime admission.
- Forbidden writers: the model cannot author request IDs, proposal IDs, Body
  basis, patch IDs, base hashes/revisions, timestamps, evidence provenance, or
  arbitrary patch operations. A retry parser cannot merge duplicate fields or
  repair missing anatomy.
- Shared paths: direct provider completion and replay both pass through
  `role_worker_result_from_ingress` and existing runtime role-result admission.
- Cut line: the generic proposal full-`RepoModelPatch` schema is absent.
  Legacy non-proposal Modeling schemas remain separate and retain their
  downstream gates.
- Verification: exact `e723058a`, release
  `sha256-6428f9194c261806a8859ccff9efeb9bb041a0103c5bbd8fac617aae265a651e`,
  witness
  `sha256-7ee2e14548bad526e946fbd79b555b7891d2eb6e2917856fefb1ebb7aeebd995`
  produced one first-attempt outer Modeling result on fresh copied state, zero
  open jobs, and no Hands/Eyes authority. The copied owners stopped at exit
  zero under the restored brake.

The proposal grant and outer worker are single-attempt proven. Downstream
coordinator review is not yet single-consumption proven: the live run emitted
two receipt-bound `reviewModelingResult` continuation grants for the same
proposal-bound result before settlement. That route is the next ownership cut.

### Receipt-bound role review continuation

- Owner: the runtime-linked role result owns when review becomes runnable;
  resident Self owns idempotent conversion of the exact coordinator receipt
  into one continuation pressure.
- Inputs: exact last coordinator receipt, authoritative thread runtime link,
  and runtime job/result terminal status.
- Outputs: no pressure while the result is pending; one deterministic
  `{receipt_id, review_action}` pressure after terminal publication.
- Derived state: a receipt's `review*Result` string is intent, not readiness.
- Forbidden writers: coordinator final-action prose, pulse timing, cooldown,
  and process exit cannot make a pending result reviewable.
- Shared paths: direct `reviewResearchResult`, `reviewModelingResult`, and
  `reviewVerificationResult` receipts use the same terminal predicate as
  `waitFor*Result` conversion.
- Cut line: review actions are removed from the unconditional direct-action
  set. The terminal predicate reads through the runtime-spine cache, which owns
  every schema in the heterogeneous store; the thread-only cache is not a
  runtime-store reader.
- Verification: focused coverage proves a pending direct review receipt emits
  no continuation, then the same exact receipt emits one after its linked job
  and typed result become terminal; repeated ingestion remains idempotent.
  Thirty resident tests pass. Exact packaged copied replay remains required.

Exact packaged `9f597ca2` proved the pending gate but exposed a second owner:
the role-review transaction updated typed coordinator state, while its run
receipt retained the action captured before the transaction. Receipt action is
now refreshed from post-transaction coordinator status after successful role
acceptance, failure supersession, or admission rejection. The receipt remains
the continuation source, but can no longer ask Heartbeat to replay an action
the same transaction already consumed. Exact packaged `d4907ee8` proved this
cut live on copied state: one proposal grant, one outer Modeling job, one
terminal review continuation, then `awaitFrontierProposal`; no second review
grant appeared. Runtime had zero open jobs, Hands/Eyes remained false, the copy
was braked, and both owners exited zero. Post-transaction typed coordinator
state is now the sole final-action owner for these review paths.
## Braked resident maintenance and ingress cadence

- Owner: the resident serve loop owns maintenance cadence; retention organs
  own what may be retired, not how often a stable runtime is rescanned.
- Inputs: cognitive brake, shutdown signal, resident revision, prepared/active
  lease state, and producer-owned typed source stores.
- Outputs: maintenance runs on startup, resident revision change, or a bounded
  60-second deadline. Stable braked pulses only observe/reconcile resident
  authority and publish operator physiology. Stable released polls still scan
  producer ingress at the configured wake cadence, but do not repeat retention.
  New domain and continuation pressure are ingested only after brake release.
- Derived state: poll interval, readiness projection, and pulse count are not
  retention or cognition-ingress authority.
- Forbidden writers: a braked pulse cannot bind a new repository domain,
  derive resident pressure, import Bifrost delivery, or create a grant. It also
  cannot erase producer-owned evidence waiting in runtime or crossing stores.
- Shared paths: brake and shutdown use the same ingress refusal boundary;
  prepared/active child reconciliation remains live so the brake can drain and
  terminalize exact existing authority.
- Cut line: unconditional retention scans no longer follow poll cadence, and
  `cycle` no longer runs repository/domain/continuation ingress while braked.
- Verification: exact packaged `3f37503e` on copied 23 MiB runtime state held
  revision and runtime/local-Verse hashes stable, created no grant, exited zero,
  and measured 0.29-0.33% CPU at one-second cadence versus prior 10-24% spikes.
  Exact packaged `f04abd6b` then proved released sleeping at five-second
  cadence: 91 process ticks over 30 seconds (about 3.0% of one core), stable
  revision/runtime hash, no grant, restored brake, and clean exit zero. A
  second exact braked process start held the same authority/hashes at 0.36%
  sampled CPU and exited zero again, proving startup stewardship without
  resurrection.

## Superseded admitted-model-direction authority

- Owner: runtime RepoModel owns whether an
  `AdmittedModelDirectionConsiderationRequest` still names the current exact
  model revision and hash. Resident Self owns terminalization of the exact
  Heartbeat grant; neither scheduler timing nor coordinator prose decides
  supersession.
- Inputs: a structurally valid typed request, current RepoModel snapshot, exact
  resident grant and active lease, and the exact bound coordinator receipt.
- Outputs: a superseded request terminalizes that exact grant once with status
  `superseded` and the real receipt ID. The consumed pressure stays consumed;
  failure count does not advance and Heartbeat cannot issue a replacement
  grant from the dead authority.
- Derived state: request age, the `stale` error text, cooldown, receipt action,
  and operator projection are observations only.
- Forbidden writers: resident retry policy, error-string parsing, Heartbeat
  cadence, and a generic stale-work cleanup pass cannot decide typed request
  death or create a retry.
- Shared paths: settlement checks supersession before fulfillment and checks it
  again after a failed fulfillment read, covering a concurrent RepoModel
  advance without weakening the ordinary exact-result verifier.
- Cut line: the old invalid-fulfillment cancellation path no longer requeues a
  structurally valid request whose model binding has been superseded. Historical
  `epiphany-work` acceptance remains inert and is not a fallback workflow.
- Verification: focused source proof passes 31 resident tests, four
  admitted-model-direction contract tests, and all eight swarm tests. Exact
  `b81b59a7` packages as release
  `sha256-7c1a739c4b287c49051ab7aaab9a9541320f2d768e6b846d84b7bf290acbecc2`
  with 24 binaries and zero warnings. A purpose-built copied CultCache fixture
  advanced RepoModel from revision 1 to 2 behind one active exact request; the
  packaged resident emitted one `superseded` terminal acknowledgement bound to
  the real receipt, left runtime bytes unchanged, and exact packaged Heartbeat
  produced no replacement grant while braked or released. Receipts live under
  `.epiphany-run/b81-superseded-fixture`.

## Canonical brake ownership of daemon actuation

- Owner: the canonical CultMesh swarm-brake document owns whether Idunn may
  perform daemon lifecycle actuation during a shakedown pause. Idunn owns the
  restart decision only after that brake permits it.
- Inputs: canonical brake identity and owner, status, all-scope affected
  runtime, protected surfaces, exact daemon status, typed restart policy or
  explicit operator override, cooldown, and force/staleness signal.
- Outputs: an engaged brake containing `daemon.lifecycle_poke` refuses before
  intent publication or process execution. A permitted attempt emits one poke
  intent, native process result, receipt, and updated retry policy.
- Derived state: `requesting_agent_id`, CLI command text, status projections,
  and tool-directory rows are provenance or sight; none can release the brake.
- Forbidden writers: direct `reconcile --restart-command`, scheduled tick,
  generic service launch, v0 daemon capabilities, and compatibility wrappers
  cannot remove a protected surface or infer permission from an all-scope
  brake. Unauthenticated v0 tool capabilities remain ignored and publish no
  invocation command.
- Shared paths: explicit engagement and engaged-brake adoption both use
  `canonical_epiphany_swarm_brake_protected_surfaces`; direct and scheduled
  reconciliation converge on `assert_swarm_brake_allows_daemon_poke` before
  `run_restart_command`.
- Cut line: canonical engagement no longer replaces the default surface set
  with a list that omits `daemon.lifecycle_poke`. No second actuator gate or
  Hands impersonation was added.
- Verification: exact packaged `3fdff19f` passes the full Verse smoke. Forced
  reconciliation with operator-supplied `/bin/sh` against quarantined copied
  state exits 1 with the canonical-brake refusal, preserves the CultCache hash
  byte-for-byte, and creates no marker. Its 24-binary release is
  `sha256-bd0062904fa8e7097946c6fd735191de43ff04a89d1c3c29c0c86f876815fb31`;
  witness
  `sha256-a051980f70b13d9dafa014fedc7fc636eb075a9fc85dc53e3a94081bcc3fe3e0`.

## Non-repository process actuator ownership

- Owner: each process family retains its existing consequence owner. Forge
  commands belong to explicit release construction; resident cognition launches
  only witnessed coordinator/model binaries; Persona launches the configured
  Bifrost crossing under speech audit and capability reference; Idunn owns
  typed service/restart actuation; Rider and repo birth are explicit operator
  utilities; process observation is sight only; Unity owns editor execution.
- Inputs: explicit CLI action or typed resident/crossing policy, witnessed or
  discovered executable, scoped workspace/project, owner-specific arguments,
  and the corresponding brake/permit where the path is unattended.
- Outputs: owner-specific receipts or bounded artifacts. None of these paths
  becomes generic Hands authority, and the ignored v0 daemon tool directory
  publishes no invocation command.
- Derived state: wrapper modes, command previews, IDE paths, and process
  observations are operator sight. They cannot synthesize cognition, crossing,
  deployment, or editor authority.
- Forbidden writers: generic Unity caller arguments cannot replace
  `-executeMethod`; Rider cannot open outside the project; repo birth cannot
  mutate branches without explicit create/switch flags; Persona cannot bypass
  Bifrost identity/capability arguments; release and observation helpers cannot
  enter the resident scheduler.
- Shared paths: generic Unity execution validates caller arguments before the
  internal command builder; named probes alone derive
  `GameCult.Epiphany.Unity.EpiphanyEditorBridge.RunProbe` and its artifact
  contract.
- Cut line: `-executeMethod` joined the bridge-owned flag set. The old smoke
  happy path that blessed caller-authored method execution was replaced with a
  hostile refusal plus an exact named-probe positive. No generic actuator
  registry or compensating Hands gate was added.
- Verification: exact source `d7957b42` passes two Unity bridge owner tests and
  the full Windows bridge smoke. A rebuilt standalone bridge executable
  (SHA-256
  `e4a4c50eb575005f956cedb625386ec263cb973b08e8f51348cab539ef728034`)
  refuses the resolved-editor hostile dry-run exit 1 before writing a command
  artifact. Receipt:
  `.epiphany-run/unity-execute-method-refusal-5ccf4cf8-exact`.

## Soul verdict ownership and causal consumption

- Owner: the coordinator's atomic Mind acceptance transaction creates a Soul
  verdict from one authenticated Verification finding. The verdict is terminal
  acceptance evidence, not an independently writable runtime command.
- Inputs: the exact runtime worker result and launch contract, typed
  verification request, frontier route, current item/model, accepted result
  receipt, and exact Hands consequence chain.
- Outputs: one immutable Soul verdict prerequisite; later Modeling derives a
  typed frontier request and Mind may incorporate only the matching disposition.
- Derived state: general Verse context and receipt-directory projections are
  operator/prompt sight. They do not decide the verdict or its consequence.
- Forbidden writers: external callers and unrelated runtime families cannot
  publish a standalone Soul verdict. The former public writer is compiled only
  for focused crate fixtures and is absent from the production API.
- Shared paths: frontier Modeling request creation and verdict incorporation
  both reload and compare the exact result, request, route, model/item, verdict,
  acceptance, and evidence chain.
- Cut line: remove the public re-export and production compilation of
  `put_soul_verdict_receipt`; retain no compatibility writer.
- Verification: ten `verdict` library tests, the focused atomic Soul acceptance
  test, and production library check pass. Mixed request, route, result, and
  illegal frontier edits remain byte-identical refusals.

Exact source `9370e47a` packages this ownership as 24-binary release
`sha256-fe3e6c2465017f45649bef61fed1e54b5502f7963c83526fd1f5a791a7a35ac8`
with witness
`sha256-712372f40acd4250c54d4d328a79195d6c955cd9c22e7024abb51c038b043942`.
The release graph contains no standalone Soul-verdict actuator.

## Mind state-witness transaction ownership

- Owner: `commit_state_with_mind_witness` owns the coordinator state CAS and
  its exact `MindGatewayReview`, `MindStateCommitReceipt`, and organ-specific
  prerequisite envelopes.
- Inputs: expected coordinator state snapshot, next state, exact gateway
  review, matching state-revision commit receipt, and typed prerequisites.
- Outputs: one snapshot-fenced coordinator state transition with its complete
  Mind witness family, or no mutation.
- Derived state: standalone review and commit reads are evidence inspection;
  neither document is an independent state-admission command.
- Forbidden writers: production callers cannot insert a Mind review or commit
  receipt outside the coordinator state transaction. The narrow fixture writers
  compile only under crate tests and are absent from the public API.
- Shared paths: native role acceptance, reorientation acceptance, and split
  model-admission completion converge on the same transaction primitive.
- Cut line: remove production compilation and public re-export of both raw
  writer functions; retain no compatibility route.
- Verification: the atomic state-and-Mind-witness test, the historical-family
  fixture test, and warning-free production library check pass.

Exact source `d4f4f145` packages the Mind portion as 24-binary release
`sha256-b2490d04a1151d10b8a81b79cd7e56d5544d502829b9b51e1af6cea3a5477d11`
with witness
`sha256-3ac4f12aebe70ae854b9156969ee374838c1e48461357a57632035a18bafd058`.

The same owner governs accepted Research and Reorientation prerequisites:
`EyesEvidencePacket` and `ContinuityRecoveryReceipt` publish only in the state
transaction and their direct writers are test-only. SubstrateGate is explicitly
outside this cut because its coordinator and Hands producers own independent
access grants before acceptance. Seven coordinator-acceptance tests prove the
shared transaction, invalid-witness refusal, prerequisite co-publication, exact
Soul binding, and split-admission replay.

## Resident directive versus canonical objective ownership

- Owner: canonical coordinator state owns the long-lived thread objective;
  resident Self's exact prepared launch owns one resident turn directive.
- Inputs: standalone startup may supply a typed user-objective intake. Resident
  startup supplies an exact preparation or its canonically promoted active
  lease, grant, child claim, process identity, launch digest, objective digest,
  and argv objective.
- Outputs: standalone intake atomically seeds state plus `UserObjectiveIntake`.
  Resident bootstrap emits authenticated per-turn command context and leaves the
  canonical objective byte-identical.
- Derived state: coordinator argv `--objective` is a carrier. It is not itself
  permission to replace Mind state.
- Forbidden writers: a resident directive cannot call the seed-only objective
  intake, replace canonical state, or rely on an absent legacy intake envelope.
  A foreign objective cannot pass the prepared-launch digest checks.
- Shared paths: objective authentication reads either side of the single
  prepared-to-active CAS, so parent acknowledgement cannot race away the
  authority. Plain operator pressures use resident authentication; typed
  proposal/consideration continuations remain objective-free; standalone
  coordinator startup retains initial intake.
- Cut line: branch objective handling on authenticated resident bootstrap
  evidence instead of unconditionally calling `intake_user_objective`.
- Verification: c008 attempt 1 failed closed and terminalized without external
  consequence. Focused tests prove exact resident objective acceptance, foreign
  objective refusal, and unchanged standalone seed-only replacement refusal.
  Exact a07f6541 c008b authenticated live attempt 2 across launch promotion,
  preserved the canonical objective, and settled it once at revision 320.

### Admitted causal thread owns autonomous promotion and proposal Modeling launch

- Owner: the runtime-spine promotion transaction owns publication of the exact
  proposal, autonomous binding, and proposal-Modeling selection companion
  family under one full-snapshot fence.
- Inputs: the accepted model-direction request/result, immutable model
  admission, current Body binding, selected option, and any exact existing
  companion family. The admitted request supplies the causal thread identity;
  the singleton coordinator projection supplies only the current state value.
- Outputs: either the complete matching three-envelope family or a fail-closed
  refusal with no substituted/partial adoption.
- Derived state: the singleton `EpiphanyThreadStateEntry.thread_id` is a mutable
  coordinator projection. It is not the owner of already-admitted proposal
  lineage and may transition through the resident orchestration thread between
  promotion, retry, and launch.
- Forbidden writers: Heartbeat, resident recovery, retry launch, retention, and
  the current singleton thread projection cannot rewrite causal request,
  proposal, binding, or selection identity.
- Shared paths: initial promotion and replay use the same exact-family equality
  and CAS primitive. Initial proposal Modeling launch and an exact retry after
  process terminality both restore the admitted cognitive thread through the
  ordinary coordinator transaction.
- Cut line: derive promotion companions and proposal Modeling launch provenance
  from the admitted request thread. Delete the mutable-singleton equality veto;
  retain exact equality across request/proposal/runtime/repository/workspace,
  caller state, and full companion family. Do not add a retry compensator.
- Verification: exact 78ca972b reproduced the c008b collision on copied state,
  proved the only divergent field was causal thread identity, replayed the
  complete family without a write, and refused a hostile partial family. Exact
  d3e433fc adds the launch-transition test and packages as release
  `sha256-11be5dae8429fcb6c604a15e8e122869f3ee60b9699831329b49fb62c1689768`
  with witness
  `sha256-217eafc8752d16fb249aad69b5dfc312e5fd507d2c05bff1cf5a1dbcc1b5ab32`.
  Live c010 restored `linux-eyes-tools-c005`, launched a fresh exact Modeling
  worker after the old claim became `terminal-death`, settled the stranded
  request once, accepted its review, completed native admitted-direction
  Imagination, and completed two resulting proposal Modeling families. The
  brake is engaged at revision 364 with no active lease.

## Manual regather authority boundary (2026-08-11)

- Owner: the operator owns approval to cross a current Self-derived
  `regatherManually` boundary. Self owns the recommendation; Heartbeat owns only
  typed scheduling pressure.
- Inputs: the exact current coordinator action and one explicit
  `--approve-manual-regather` launch capability. The approval helper refuses
  every other current action.
- Outputs: one launch-local rewrite to `launchResearch`, consumed once by the
  coordinator loop. It does not create durable resident pressure.
- Derived state: Heartbeat's `reorientation` work-role label and coordinator
  scene projections are observations, not grant authority.
- Forbidden writers: Heartbeat, resident Self, historical failed
  Reorientation, generic operator objective text, and retry loops may not mint
  manual approval or Eyes pressure.
- Shared path and cut line: direct coordinator operation currently carries the
  explicit approval flag. Any future resident operator path must define typed,
  authenticated approval ingress and make the flag only its launch carrier; it
  must not parse prose or auto-convert idle status.
- Verification: source inspection confirms exact-action refusal, single use,
  and the hostile unrelated-action regression. Resident safe-continuation
  routing excludes manual regather. c010 remains alive, braked, and without an
  active lease after native Imagination produced no admitted work.

## Governed source-tool authority gap (2026-08-11)

The transport body is broader than the admitted source faculty. The generic
MCP runtime can call configured subprocess or HTTP providers, while live Eyes,
Modeling, and Soul requests advertise only workspace-confined `read_file`,
`directory_inventory`, `git_show`, typed Hands-receipt reads, and the exact
resident-grant projection. No public-source tool is currently model-visible.

- Owner: the immutable Substrate Gate grant created with an exact worker launch
  must own which governed source operations that job may invoke.
- Inputs: exact runtime job, launch binding and role; exact tool server/name;
  and a fixed tool-to-operation classification owned by the source boundary.
- Outputs: runtime admission accepts a model-derived tool intent only when the
  exact launch grant names its required operation. Public evidence additionally
  carries provider, repository, immutable revision, path, and content digest.
- Derived state: MCP configuration, model-visible tool definitions, tool-call
  JSON, and transport reach are capability projections or protocol cargo. None
  grants source access by existing.
- Forbidden writers: a model-selected tool name, generic MCP endpoint, prompt
  instruction, runtime binding, or Eyes packet may not synthesize Substrate
  authority. Arbitrary URLs and redirects are not public-source identity.
- Shared paths: Eyes, Modeling, and Soul must receive source tools only through
  the same launch-grant and runtime-intent admission primitive. Local and public
  source operations differ in provider policy but share the grant check.
- Cut line: publish an immutable grant for every launch that advertises source
  tools; reject an intent before adapter/network execution when its exact grant
  lacks the mapped operation. Then add one bounded provider-shaped public source
  operation rather than exposing the generic MCP transport as evidence authority.
- Verification layer: focused grant/intent tests must refuse absent, foreign,
  role-swapped, job-swapped, and operation-missing grants byte-identically. The
  packaged Linux circuit must admit one immutable public source through Eyes and
  Mind while an ungranted public request produces no network consequence.

Current source enforces this map. Research, Modeling, and Verification launches
publish exact read grants; Research alone receives `publicSourceRead` and the
model-visible `epiphany_public.github_file` tool. Runtime admission follows the
inner model binding back to the outer typed worker launch and exact grant before
persisting an intent or executing an adapter. Public GitHub results become
`EyesSourceLookupReceipt` only after the full worker/model/tool/grant family and
the provider/repository/commit/path/content digest are reauthenticated inside
the same full-snapshot CAS that admits the Eyes packet into Mind. Generic MCP
transport and result JSON remain transport cargo, not evidence authority.

## Resident PID 1 owns adopted worker reaping (2026-08-11)

- Owner: resident Self owns OS cleanup for model-worker grandchildren that its
  bounded coordinator children orphan into resident PID 1.
- Inputs: typed `EpiphanyRuntimeWorkerProcessClaim` rows and the kernel's exact
  child/exit relation. Claims are sorted for deterministic inspection.
- Outputs: exact nonblocking `waitpid(pid, WNOHANG)` for claimed worker PIDs.
  `ECHILD` and a still-running child are clean no-ops.
- Derived state: runtime job, result, process-claim, archive, and coordinator
  receipt documents remain cognitive evidence. Reaping changes none of them.
- Forbidden writers: retention, PID age, executable-name scans, generic
  `waitpid(-1)`, and coordinator receipt settlement may not decide which worker
  process to reap.
- Shared paths: every resident once/serve cycle reaps before maintenance can
  archive the exact claim. Known coordinator children remain owned and reaped
  through their `Child::try_wait` handles.
- Cut line: add no signal-handler policy, global scavenger, retry writer, or
  process-name registry. The typed runtime claim supplies identity; the kernel
  supplies parenthood and terminality.
- Verification: c010 exposed six defunct adopted workers. Exact `465af24d`
  passes six focused Windows process tests, nine swarm tests, and the Unix
  exact-child test on Starfire. Its authenticated 24-binary release is
  `sha256-089e000511f0420bfaab1136952b8cf94677a72d5c30a3fb3e6a26996bd3726f`
  with witness
  `sha256-20ca293589b33d3b2e6ea5a7411db544741fe18360ecbd4423cdfa000d1ad7c6`.
  Live c011 restarted braked at revision 372 with zero zombies. Typed operator
  proposal `operator-c011-worker-reaper-live-proof-20260811` then drove the
  real route through Modeling request `repo-frontier-proposal-modeling-1c15a1d0...`,
  Heartbeat, Self, the packaged coordinator, and adopted model-worker PID 152.
  The worker terminalized normally, Self settled at revision 376, and the next
  resident cycle removed PID 152 from the process table with no defunct child.
  The Modeling review continuation completed; the brake engaged at revision
  381 before the next admitted-direction Imagination worker launch. The reaper
  owner is therefore accepted at source, package, Linux helper, and genuine
  coordinated runtime layers.

The same owner then survived a second distinct live worker family. The exact
admitted-direction Imagination request `c72af0e16fbc...` launched worker PID
275 after its preserved Heartbeat grant was released. Self held typed
fulfillment authority until the result terminalized, settled at revision 384,
and the next cycle reaped PID 275. Resident PID 1 again had no defunct child.
Heartbeat returned to routine physiology and the result produced no further
admitted work. This closes the successful-path reaper gate across Modeling and
Imagination without adding a lifecycle-specific process rule.
## Causal current-frontier Research routing - 2026-08-11

- Owner: the exact actionable Eyes frontier in the uniquely admitted current
  RepoModel owns whether Self must launch Research.
- Inputs: current model revision/hash and admission receipt; exact frontier item
  id/hash/local source scope and strict immutable GitHub evidence refs;
  authoritative runtime identity; creation-thread provenance; typed Research
  worker launch; accepted Eyes packet source job.
- Outputs: one immutable `RepoFrontierResearchRequest`, its exact typed launch
  projection, and an uncovered/covered readiness decision.
- Derived state: request `thread_id` records the coordinator incarnation that
  created it but is not request identity or liveness authority. Historical
  `research_result_accepted` is evidence about an old pass, and a terminal
  `Completed` role binding is evidence about its old job; neither owns the
  current frontier. Only a currently `Pending` or `Running` Research job
  suppresses another launch.
- Forbidden writers: mutable coordinator thread state, timestamps, generic
  accepted Research state, and unrelated Eyes packets cannot invalidate,
  replace, or consume current readiness. Worker prompts cannot invent a public
  target; only a canonical immutable ref already admitted in frontier evidence
  enters the Research launch.
- Shared path: status, direct coordinator execution, and resident execution use
  the same current-frontier selector and worker-launch carrier.
- Cut line: only an accepted Eyes packet whose source job carries the exact
  current request may cover the frontier. Model or frontier advance makes the
  old request inert.
- Verification: deterministic selection/replay across a coordinator-thread
  transition, strict public-ref projection, exact carrier validation, exact
  packet coverage, historical-acceptance routing, the full 680-test core pass,
  24 Self-policy tests, and 39 OpenAI runtime tests are green. Exact packaged
  copied-state public Eyes-to-Mind proof remains open.