diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index c513cd73..1f12c9e5 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -3616,3 +3616,44 @@ typed signing purpose to
 requires canonical positional MessagePack at signed-health ingress and samples
 admission time at millisecond precision, preventing semantically equivalent
 wire encodings and second truncation from changing later digest/read truth.
+
+## Organizational mode and transactional deployment correction (2026-07-20)
+
+Epiphany's autonomous organizational posture is ordinary product behavior, not
+a dogfood exception. Modeling maintains the persistent typed map of the
+authorized organizational domain. Self derives direction and bounded pressure
+from that map plus attributed feedback. Imagination may propose improvements
+and features without waiting for a direct instruction. Persona is the
+organization-wide conversational membrane through which people can inspect,
+challenge, and refine those proposals. Feedback remains pressure: it cannot
+adopt Mind, grant Hands, Wake, release, deployment, or public-speech authority.
+
+The exact d841 deployment reached package completion but failed before
+promotion because the candidate `epiphany-operator-command` required
+`--provider-ttl-millis` while the installed systemd unit was an older
+generation. Idunn recorded failure without restoring the active chain. No new
+release or deployment witness was promoted. The old bcff generation was then
+explicitly restored: supervisor, operator command, Heartbeat, swarm, and the
+supervisor-owned semantic projector are active from the old release with zero
+restart growth. The canonical Epiphany all-scope brake and Idunn deployment
+brake are engaged; swarm reports braked.
+
+The root fault was split generation authority: bootstrap owned the four unit
+files while deployment owned binaries, links, and lineage. `gamecult-ops`
+commit `64a0965` makes one Idunn transaction snapshot, promote, or restore all
+four unit files together with Body, app/source links, lineage state,
+enablement, and prior active organs. Generic cleanup no longer acts as a second
+service-restoration owner. Rollback verifies prior unit bytes and active states
+and returns a distinct critical failure if restoration is incomplete. A
+filesystem/fake-systemd failure-injection harness models the d841 incompatibility
+and proves exact restoration plus loud rollback failure. Focused operator
+wiring and rollback checks pass; the commit is pushed.
+
+Next: install exact ops `64a0965` on Ygg without opening either brake. Create a
+meaningful Epiphany successor to d841, revoke d841 authority, authorize only
+that successor, observe its fresh request, and grant exactly that request for
+no more than fifteen minutes. Re-engage the Idunn brake immediately on terminal
+result or unknown consequence. Accept only an exact signed live witness with
+all organs stable; on failure require the old generation to be completely
+active. Then prove complete and one-missing-provider Discord Status. Do not
+test Wake and do not reboot Yggdrasil.
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index 9ec44ba2..b6d2d23f 100644
Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ
diff --git a/state/map.yaml b/state/map.yaml
index 1fa8c937..cb2caaca 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -814,4 +814,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Migrate Bifrost and VoidBot to consume the explicit Epiphany Status v2 sealed result using the generated golden fixture, then provision the operator service's Idunn query/anchor/admission/lineage arguments on Yggdrasil and deploy through Bifrost/Idunn under the engaged brake. Run operator-safe Discord Status proof with complete and one-missing provider cases. Missing provider assertion remains explicit absence. Do not test Wake or reboot the host."
+  next_action: "Install gamecult-ops commit 64a0965 on Yggdrasil so Idunn owns systemd units, binaries, links, lineage, and service restoration as one cutover transaction. Create one meaningful Epiphany successor to d841, revoke d841 release authority, authorize only the successor, and grant only its exact observed request for at most 15 minutes. Re-engage the Idunn brake at terminal or unknown consequence. Require exact live witness, stable old-generation rollback on failure, all organs active, and both brakes engaged. Then prove operator-safe Discord Status with complete and one-missing provider cases. Do not test Wake or reboot the host."