Record aggregate memory subtraction

notes/epiphany-current-algorithmic-map.md

@@ -1,8 +1,8 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-23
-Latest committed implementation cut: `5b799b12` on `codex/epiphany-shakedown-live`
-Current worktree cut: Ox16 scope-authority reconciliation and Ox17 preparation
+Latest committed implementation cut: `39dd9fdb` on `codex/epiphany-shakedown-live`
+Current worktree cut: heartbeat concurrency-domain audit; Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
 proof chronology belong in git, `state/ledgers.msgpack`, and bounded smoke
@@ -279,6 +279,21 @@ The attempt aggregate centralizes exact request association and typed terminal
 classification. Archived fulfilled attempts must retain recoverable decision
 authority, not merely an ID/digest tombstone.
 
+Heartbeat is scheduling physiology only. Exact `d1685df8` deletes its
+personality, appraisal, rumination, dreaming, void-routine cognition, and
+memory-graph paths. Exact `39dd9fdb` deletes the parallel agent-memory
+identity/generation store, utterance vector, and generic self-patch admission.
+When no explicit typed pressure exists, heartbeat sleeps and authors no Mind
+state.
+
+One conflict domain remains under audit: `EpiphanyHeartbeatStateEntry` stores
+participant scheduling together with pending Persona mentions, Persona turn
+requests, blocked social pressure, and Persona retention state. These are not
+one invariant. Collection members must become keyed identities so Persona
+transport cannot make an unrelated Hands or Modeling scheduling mutation stale.
+Ghostlight scene scheduling embedded in the Epiphany heartbeat executable also
+requires an explicit owner or deletion.
+
 ## RepoModel and semantic projection
 
 RepoModel persistence is keyed by semantic identity: identity/body binding,

notes/fresh-workspace-handoff.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-23
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `5b799b12`
-Current worktree: Ox16 scope-authority reconciliation and Ox17 preparation
+Latest committed implementation cut: `39dd9fdb`
+Current worktree: heartbeat concurrency-domain audit; Ox17 remains paused
 
 ## Orientation
 
@@ -480,10 +480,25 @@ their obsolete tests are gone. Modeling retrieval now derives only live
 RepoArchitecture/RepoDataflow documents from the complete exact keyed
 RepoModel basis. Native core check passes and the library suite passes 472/472.
 
-Next delete heartbeat personality/rumination `selfPatch` consumers, then the
-aggregate agent-memory identity/generation store they alone preserve. Do not
-run a full-workspace compile, package, deployment, or Ox root until the
-subtraction audit closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16.
+Exact `d1685df8` deletes heartbeat aggregate cognition: personality/mood timing,
+appraisal, rumination, dreaming, the void routine, and its memory graph. Exact
+`39dd9fdb` deletes the remaining agent-memory identity/generation store, the
+64-float utterance vector, generic `selfPatch` decoding/admission, the phantom
+sleep-distillation contract, stale aggregate/thread schemas, and nine more
+constructor/static-vector tests. Native role ingress now refuses unknown model
+cargo instead of accepting forbidden identity and silently ignoring it. Core
+passes 455/455 and the provider runtime passes 27/27. The obsolete repository-
+local Cargo target was 2.5 GiB and was removed; compilation remains in the
+shared target.
+
+Next map every writer of the heartbeat singleton. Scheduling fields currently
+share one CAS identity with pending Persona mentions, Persona turn requests,
+blocked social pressure, and Persona retention state. Split those collection
+members by semantic identity so Persona transport cannot contend with unrelated
+organ scheduling, and decide whether Ghostlight scene scheduling belongs in
+Epiphany. Do not run a full-workspace compile, package, deployment, or Ox root
+until the subtraction audit closes. Never resume Ox10, Ox12, Ox13, Ox15, or
+Ox16.
 
 ## Operational state that matters
 

state/map.yaml

@@ -48,7 +48,7 @@ current_status:
   package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged.
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
-  latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 1d5a1f17 removed 19,252 net non-vendor lines, exact 387afe49 removed 25,317, exact bf516f99 removed 2,701, and exact 360073a3 removes another 1,726. The latest cut deletes the global Mind semantic corpus, agent-memory graph profile, dual-store projector policy, two-source pulse fairness, legacy semantic migrators, the one-variant partition type, unused semantic traits, and tests that protected those dead mechanisms. Modeling retrieval now has one exact keyed RepoModel basis, one corpus, one collection, and one pulse input. Native core check passes and the library suite passes 472/472. Next delete heartbeat personality/rumination selfPatch inputs and the aggregate agent-memory identity/generation store they preserve. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
+  latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 1d5a1f17 removed 19,252 net non-vendor lines, exact 387afe49 removed 25,317, exact bf516f99 removed 2,701, exact 360073a3 removed 1,726, exact d1685df8 removed 4,389, and exact 39dd9fdb removes 6,433 net lines. The latest cuts delete heartbeat-authored personality, appraisal, rumination, dreaming, void-routine cognition, the aggregate agent-memory identity/generation store, the 64-float utterance vector, generic selfPatch decoding/admission, phantom sleep-distillation contracts, stale aggregate/thread schemas, and tests that only copied DTOs or inspected static contract vectors. Heartbeat now schedules explicit pressure only; keyed Mind owns durable Persona memory. Native core check passes, the library suite passes 455/455, and the provider-runtime suite passes 27/27. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
   operational_state:
     local_worktree: subtraction_commit_360073a3_pushed_modeling_only_semantic_projection_verified_ox17_and_deployment_paused
     docker_engine_access: starfire_compiler_retired_all_yggdrasil_epiphany_transient_containers_volumes_package_roots_and_per_run_test_target_removed_future_idunn_epiphany_builds_native_rust_1_95_0_via_gamecult_ops_89f0d78
@@ -90,8 +90,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: `agent_memory` still exposes a parallel durable role-memory aggregate, swarm identity, generation head, and generic selfPatch lifecycle beside keyed Mind Persona documents. Heartbeat still reads that aggregate to synthesize personality, appraisal, rumination, and self-modification pressure. Several tests prove those aggregate shapes rather than a live decision-admission invariant. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until that owner is resolved. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Delete heartbeat aggregate personality/rumination and generic selfPatch consumers, then delete the agent-memory identity/generation store and tests that only preserve it. A test survives only when it falsifies a named live invariant at its owning boundary. Do not run a full-workspace compile, package, deployment, or Ox root before this subtraction audit closes.
+  unresolved_authority: `EpiphanyHeartbeatStateEntry` is still one singleton CAS document containing participant scheduling, history, pending Persona mentions, Persona turn requests, blocked social pressure, and Persona retention state. That shared identity can make social transport mutations contend with unrelated organ scheduling, contrary to the disjoint-document concurrency law and the Persona/Hands non-blocking invariant. Ghostlight scene scheduling also remains embedded in Epiphany's heartbeat binary and requires an ownership verdict. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until this scheduler/social conflict domain is cut or explicitly justified. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Map every writer of the heartbeat singleton, split Persona social queue/turn/retention documents from scheduling physiology by semantic identity, and decide whether Ghostlight scene scheduling belongs in Epiphany at all. Cut obsolete writers and constructor-shaped tests before adding replacement code. A test survives only when it falsifies a named live invariant at its owning boundary. Do not run a full-workspace compile, package, deployment, or Ox root before this subtraction audit closes.
 
 active_subgoals:
   - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.

state/scratch.md

@@ -51,13 +51,12 @@ and janitors may reduce the symptom but cannot substitute for deleting code.
 
 ## Immediate audit order
 
-1. In progress: exact `360073a3` deletes the global Mind semantic corpus,
-   agent-memory graph profile, dual-store projector policy, two-source pulse
-   fairness, legacy semantic migrators, and tests that protected those dead
-   authorities. Modeling retrieval now has one exact keyed RepoModel basis,
-   one corpus, one collection, and one pulse input. Next cut heartbeat's
-   aggregate personality/rumination and generic `selfPatch` consumers, then
-   delete the aggregate identity/generation store they preserve.
+1. In progress: exact `d1685df8` and `39dd9fdb` delete heartbeat cognition,
+   aggregate agent memory, utterance state, generic `selfPatch`, phantom
+   sleep-distillation contracts, and constructor-shaped tests. Next map the
+   heartbeat singleton writers and split Persona social queue/turn/retention
+   collection members from scheduling physiology. Decide whether Ghostlight
+   scene scheduling belongs in Epiphany or should be deleted from this Body.
 2. Done: delete `runtime_store_migration`, its receipt registration, and its
    test. The approved migration has no writable migrator.
 3. Done: delete the local PowerShell operator wrapper, direct Persona/operator