Accept packaged resident retention proof

notes/epiphany-current-algorithmic-map.md

@@ -2136,5 +2136,15 @@ replace-and-delete transaction, so exact pressure/grant/ack/claim deletion and
 replacement of the one digest/count retention head cannot split. The head is
 not read by scheduling. Twenty resident Self tests and six swarm tests pass,
 including refusal of live/requeued authority and negative proof that retained
-history cannot create pending work. Exact packaged copied-state proof remains
-the acceptance boundary.
+history cannot create pending work.
+
+Exact `ed15f83a` closes the packaged boundary. Its 24-binary release is
+`sha256-4a4be03688eab1d1f7c13ac0057f0664c4658cab88471a0eac451a1d4607b85d`
+with witness
+`sha256-f163170174f022c124cc2f94d195639d02f65b79bac229af3efb8333176673c4`.
+Under an engaged copied-state brake, packaged Self retired two closed
+lifecycles/six exact envelopes into a revision-1 head with chain digest
+`sha256:69a2c5971430846590fe20ba32a1a9299726a51c997b9e9c07ec044ebbff34a6`.
+Two pending pressures survived, grants and acknowledgements remained empty,
+and replay did not advance the head. Resident lifecycle retention is accepted;
+the next retention owner must be mapped independently.

notes/fresh-workspace-handoff.md

@@ -1054,3 +1054,27 @@ replace-and-delete primitive and its stale-snapshot refusal proof. Twenty
 resident Self tests and six swarm binary tests pass, including negative proof
 that retention cannot create pending pressure/grants/acks or resurrect state.
 Package and copied-state proof remain before this slice is accepted.
+
+Exact `ed15f83a` packaged in 7m26s after one failed-closed cache repair. The
+first attempt found a stale cached source worktree whose `git-common-dir`
+pointed at a deleted prior clone. Only that exact
+`source-fb4097c8f489c830678f32a39e818cf462bff5c1fe853bc12d106184c9bfd571`
+directory was removed; Cargo home and target caches were preserved. The
+replacement package produced 24 binaries, release
+`sha256-4a4be03688eab1d1f7c13ac0057f0664c4658cab88471a0eac451a1d4607b85d`,
+and witness
+`sha256-f163170174f022c124cc2f94d195639d02f65b79bac229af3efb8333176673c4`.
+Independent packaged inspection accepted exact source, inventory, witness, and
+private-state exclusion without warnings.
+
+Receipts are in `.epiphany-run/resident-retention-ed15f83a/`. Under an engaged
+copied-state brake, the exact packaged Self compacted a portable fixture with
+two closed lifecycles and one requeued control. The head is revision 1,
+`retired_lifecycle_count=2`, `retired_envelope_count=6`, and chained digest
+`sha256:69a2c5971430846590fe20ba32a1a9299726a51c997b9e9c07ec044ebbff34a6`.
+The requeued control plus one independently ingested pending typed pressure
+survived; grants and acknowledgements are empty. A second exact packaged pass
+left the head unchanged. Active c005 remained running and untouched.
+
+Resident lifecycle retention is accepted. Next map coordinator receipt and
+semantic/runtime history references before choosing the next compaction owner.

state/map.yaml

@@ -35,10 +35,10 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart are proven. Exact 9f369528 makes build_cache_root own Cargo home and proves 10.17s warm packaging with Cargo at 1.38s. Exact c930f505 release sha256-cd684079eec277bbb434f147c4f6c679553780230822f9d30f0810ec0988100a moves Unix resident role locks beside mounted stores. Live copied-state proof refused a second resident owner across containers with byte-identical state, allowed Heartbeat tick and bounded serve under its distinct lock, and stopped resident Self with exit zero/final braked. Retention, long-duration plateau, log ownership, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart are proven. Exact 9f369528 makes build_cache_root own Cargo home and proves 10.17s warm packaging with Cargo at 1.38s. Exact c930f505 proves cross-container resident ownership. Exact ed15f83a release sha256-4a4be03688eab1d1f7c13ac0057f0664c4658cab88471a0eac451a1d4607b85d proves packaged resident lifecycle retention: two closed lifecycles became one non-authority digest/count head, pending pressure survived, grants/acks stayed absent, and replay was idempotent. Coordinator/runtime/log retention, long-duration plateau, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge.
   latest_phase: Commit 76afdaf0 moved release construction, filesystem verification, and witness inspection out of monolithic epiphany-core into epiphany-release-construction; core retains only CultMesh publication, load, and authentication. The bootstrap dependency graph excludes epiphany-core, all 19 construction tests pass, and the full core test harness compiles. Exact Linux bootstrap fell from 7m57s to 30.24s cold and 4.40s warm. Exact source 76afdaf0 then produced warning-free 24-binary release sha256-30caab9ef1ea89f9a885d87832b1e312a35288ec3f895bd5b0e83f7f7a6a1aec with witness sha256-89c2ad604254faec3e1e01f753b5dff38a402f43d009074ba4b47b1ec46fdecf. Independent inspection accepted the 12m16s cold build and the identical 10.16s warm replay with Cargo at 0.82s. The packaged full publisher accepted the narrow constructor's witness and changed c005 local-verse.cc from SHA-256 b160c610988753278afbad7f5bad436193144a92e9fd506982099ad58d213909 to 83ed430f5bf0c33996d7c4ee7bf0fa6c9f5f80bc8db94621395ea560852cae81 without body activation.
   operational_state:
-    local_worktree: resident_lifecycle_retention_source_proven
+    local_worktree: resident_lifecycle_retention_packaged_proven
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
@@ -68,8 +68,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: authenticated_9b8df0b4_c005_bound_to_eyes_tools_nervous_system_with_217dd_and_bd96305e_helpers_running
-  unresolved_authority: Resident Self lifecycle rows and coordinator run receipts are unbounded and require typed non-authority accumulators plus exact reference-aware deletion. Supervisor stdout/stderr are truncated only at launch and unbounded during a long-lived process; the fatal log is append-only. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Package and inspect the resident lifecycle retention body, then exercise it on copied state and prove the bounded retention head cannot create pending work or resurrect a coordinator turn. After that source-ground coordinator receipt references, settle supervisor log ownership with the infrastructure runbook, run a packaged Heartbeat retention proof, and measure idle/active endurance.
+  unresolved_authority: Coordinator run receipts and broader semantic/runtime histories remain unbounded and require owner-specific typed non-authority accumulators plus exact reference-aware deletion. Supervisor stdout/stderr are truncated only at launch and unbounded during a long-lived process; the fatal log is append-only. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential.
+  next_action: Source-ground every coordinator receipt reference and semantic/runtime retention owner before editing, then implement the smallest reference-safe compaction slice. After that settle supervisor log ownership with the infrastructure runbook, run a packaged Heartbeat retention proof, and measure idle/active endurance.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -86,7 +86,7 @@ organ_readiness:
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
   mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
-  continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Resident lifecycle retention now has one production Self-owned route, an exact-snapshot atomic delete-and-replace primitive, a bounded digest/count head with no scheduling cargo, and negative tests refusing live or requeued authority; packaged proof remains open. Coordinator receipt/log retention and the long-duration plateau remain open.
+  continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention: a copied-state fixture retired two closed lifecycles/six exact envelopes into revision-1 digest sha256:69a2c5971430846590fe20ba32a1a9299726a51c997b9e9c07ec044ebbff34a6, preserved two pending pressures, emitted no grant or acknowledgement, and replay did not advance the head. Coordinator/runtime/log retention and the long-duration plateau remain open.
   nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. It also proves detached model workers cannot survive a one-shot container PID 1 exit. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing at a measured 109887488-byte peak. Modeling job commit spent 160183ms in two cold Repository Body scans. A source cut now reuses one private index across both equality scans; 25 focused observer tests pass and a live-worktree mechanism benchmark reduced the pair from 3832ms to 1537ms. Packaged coordinator timing remains open. Authenticated d910158f isolates Self policy behind one root-graph optional coordinator feature; warm policy invalidation is 6.02s. Root Linux packaging is 12m33s cold and 9.08s warm with persistent caches. Long-duration pressure and resource plateau remain open. Yggdrasil is not a release forge at its current memory budget.
 
 forbidden_actions: