From 20515d37d03f8d2899bf31c615cdc68873f74d4a Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Mon, 20 Jul 2026 04:00:35 +0100
Subject: [PATCH] Record canonical deployment artifact requirement

---
 notes/fresh-workspace-handoff.md |  17 +++++++++++++++++
 state/ledgers.msgpack            | Bin 545643 -> 546022 bytes
 state/map.yaml                   |   2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index 1f12c9e5..bbf7de89 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -3657,3 +3657,20 @@ result or unknown consequence. Accept only an exact signed live witness with
 all organs stable; on failure require the old generation to be completely
 active. Then prove complete and one-missing-provider Discord Status. Do not
 test Wake and do not reboot Yggdrasil.
+
+The exact 0e request (`seq268`, request digest `279d3a33...`) was granted once
+and failed safely before the actuator body at `2026-07-20T02:57:59Z`:
+`/usr/bin/env: bash\r: No such file or directory`. The manual ops-only install
+had compared Windows working-tree bytes to themselves rather than canonical Git
+blob bytes. Idunn's deployment brake was immediately re-engaged. The canonical
+swarm brake remained engaged. No cutover, unit installation, Body mutation,
+link change, or witness promotion began; the exact old bcff generation and all
+five organs remained active on unchanged PIDs.
+
+The repair is not an operator-memory rule. `gamecult-ops` commit `3676a61`
+rejects CRLF-contaminated actuator and unit inputs at bootstrap, while retaining
+the transactional cut from `64a0965`. Install the artifacts from a clean Linux
+checkout of exact `3676a61` and prove their bytes against canonical Git objects.
+The failed seq268 request is terminal and must never be replayed or regranted.
+Authorize only a new meaningful Epiphany successor, accept only its fresh exact
+request, and keep both brakes engaged except for that one bounded Idunn grant.
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index b6d2d23f23231ffad189d07bdf66de0387efbcd3..aed5703d755b8965c0c6a03a92914ee757e1edca 100644
GIT binary patch
delta 449
zcmXw!y-EW?6ouXR3u0@1#ZnT-L{>4KqBapk1;Os_?A^_n-I-*5Oe`dYg)d-UL9`Pr
z#9HtXEPMbPU&3qD;&5ON^WAg4?v_3umL3<Qg~pZ;TaERzw~4vq*Qe#E7e({eqsq;w
z60v@Kk~PJeX3el>pGTFs_ru}sOI_6Cs@SO3#fkXitT0W8drRjeJ*9UUs)Evw=wNq%
z(t{vy)T_sv@EbrvnXv?%1@y)O4M+yBjOIjQa2!F2I$!~(N~fmppl@tP>3mrAmI%B>
z?J}~UwDVZ-G1xh3?SX4kf;xxf(vz#fw()I9EOy8Nf73bUl&=1H6HJjpBC`x~(qwU5
zz*31yGcRb_W)!70$g$*pg|C|Km4imS5o5f@1%I&Pv;RX@gI1n9b%S?on3l>pl@!#3
sEcn2a3w1&NrJ)SYL)RL98W)Dlnv$o>f>1+C=`etO2Ff<cjtRc@4PyD7bpQYW

delta 67
zcmaF1Qt|aN#SLPNyhc_g##Y7_QO6iKf;=`WGZr#3ay3t7YM;u)2*e<o8Hibcm=%cG
NfS7&zR3?sV0RY9T6iEO8

diff --git a/state/map.yaml b/state/map.yaml
index cb2caaca..a56501d5 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -814,4 +814,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Install gamecult-ops commit 64a0965 on Yggdrasil so Idunn owns systemd units, binaries, links, lineage, and service restoration as one cutover transaction. Create one meaningful Epiphany successor to d841, revoke d841 release authority, authorize only the successor, and grant only its exact observed request for at most 15 minutes. Re-engage the Idunn brake at terminal or unknown consequence. Require exact live witness, stable old-generation rollback on failure, all organs active, and both brakes engaged. Then prove operator-safe Discord Status with complete and one-missing provider cases. Do not test Wake or reboot the host."
+  next_action: "Install canonical LF deployment artifacts from exact gamecult-ops 3676a61 on Yggdrasil and prove their bytes from a clean Linux Git checkout; CRLF artifacts are now rejected at bootstrap. Authorize only the Epiphany successor containing this failed-request evidence, observe its fresh request, and grant only that exact request for at most 15 minutes. Re-engage the Idunn brake at terminal or unknown consequence. Require exact live witness, stable old-generation rollback on failure, all organs active, and both brakes engaged. Then prove operator-safe Discord Status with complete and one-missing provider cases. Do not test Wake or reboot the host."