Accept resident maintenance cadence proof

notes/epiphany-current-algorithmic-map.md

@@ -3966,10 +3966,11 @@ state is now the sole final-action owner for these review paths.
   own what may be retired, not how often a stable runtime is rescanned.
 - Inputs: cognitive brake, shutdown signal, resident revision, prepared/active
   lease state, and producer-owned typed source stores.
-- Outputs: the first stable braked revision receives normal bounded
-  maintenance; later identical braked pulses only observe/reconcile resident
-  authority and publish operator physiology. New domain and continuation
-  pressure are ingested only after brake release.
+- Outputs: maintenance runs on startup, resident revision change, or a bounded
+  60-second deadline. Stable braked pulses only observe/reconcile resident
+  authority and publish operator physiology. Stable released polls still scan
+  producer ingress at the configured wake cadence, but do not repeat retention.
+  New domain and continuation pressure are ingested only after brake release.
 - Derived state: poll interval, readiness projection, and pulse count are not
   retention or cognition-ingress authority.
 - Forbidden writers: a braked pulse cannot bind a new repository domain,
@@ -3978,9 +3979,11 @@ state is now the sole final-action owner for these review paths.
 - Shared paths: brake and shutdown use the same ingress refusal boundary;
   prepared/active child reconciliation remains live so the brake can drain and
   terminalize exact existing authority.
-- Cut line: unconditional retention scans no longer repeat at an unchanged
-  braked revision, and `cycle` no longer runs repository/domain/continuation
-  ingress while braked.
+- Cut line: unconditional retention scans no longer follow poll cadence, and
+  `cycle` no longer runs repository/domain/continuation ingress while braked.
 - Verification: exact packaged `3f37503e` on copied 23 MiB runtime state held
   revision and runtime/local-Verse hashes stable, created no grant, exited zero,
   and measured 0.29-0.33% CPU at one-second cadence versus prior 10-24% spikes.
+  Exact packaged `f04abd6b` then proved released sleeping at five-second
+  cadence: 91 process ticks over 30 seconds (about 3.0% of one core), stable
+  revision/runtime hash, no grant, restored brake, and clean exit zero.

notes/fresh-workspace-handoff.md

@@ -34,6 +34,30 @@ revision remained 66, runtime SHA-256 remained
 under `.epiphany-run/linux-package-3f37503e`; stopped benchmark container logs
 remain on `epiphany-braked-cadence-resident-3f37503e`.
 
+Released idle exposed the same cadence coupling outside the brake: at a
+deliberately aggressive five-second poll, stable sleeping Self still paid a
+large full-store retention scan on every pulse. Pushed `f04abd6b` makes
+maintenance depend on startup, resident revision change, or a bounded
+60-second maintenance deadline. Pressure ingress still runs at the configured
+poll cadence, so wake latency and producer evidence ownership are unchanged.
+Exact release
+`sha256-544b95404d9445b2af0fdd67495bcff5f284ab2d2a29e16450e90d50f72a3f84`
+and witness
+`sha256-79639e35da79f7038111234fa33e21829e88eddcb77eb702f8f53f5369e9def3`
+passed 24-binary inspection with zero warnings; warm Cargo took 4.33s. On the
+same copied 23 MiB runtime, a released 30-second window at five-second cadence
+used 91 process clock ticks, about 3.0% of one core, and slept near 0% between
+scans. Revision stayed 66, no grant appeared, runtime SHA-256 remained
+`3cc2ef56...0bc6`, the brake was restored, and SIGTERM exited zero. At the
+production 15-second poll this scan cost scales to roughly 1% of one core.
+
+The live Yggdrasil Persona boundary was also rechecked read-only. The exact
+mouth service is active, enabled, restart-free, and listening on
+`10.77.0.1:17876`; `/srv/bifrost/env/persona-delivery.env` remains absent or
+empty, and no other root-managed bot-token file was found. This is still an
+external credential decision, not corrupted runtime state. Do not fabricate or
+borrow a bot identity.
+
 ## Runtime-owned proposal Modeling first-result accepted - 2026-08-11
 
 Actual c006 remains exact `c9a2a979`, alive and cognitively braked. All live

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Its eight-hour braked endurance held revision 34 with no active turn/restart/OOM but exposed 9-24% resident CPU spikes at one-second shakedown cadence. Exact pushed 3f37503e separates physiology from cognition ingress: stable braked revisions no longer repeat full runtime/lifecycle/attempt retention, and brake/shutdown block repository-domain binding plus domain and coordinator-continuation pressure ingestion while preserving exact prepared/active child reconciliation. Exact Linux release sha256-aec4ed9382adb45e354f00a7af330c5b28e45d07900175f4bb8dfb4535cb6624 with witness sha256-348ae07ed5cda07b350d13aa02620286f80cd7cbce9c9b7dc0e562c59fe8600b passed 24-binary inspection with zero warnings and warm Cargo 3.13s. On copied 23 MiB runtime state at one-second cadence, six samples held 0.29-0.33% CPU and about 47 MiB; resident revision 66 and exact runtime/local-Verse hashes stayed unchanged, no grant appeared, and SIGTERM exited zero. Actual c006 was untouched.
+  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Its eight-hour endurance exposed 9-24% resident CPU spikes at one-second shakedown cadence without authority drift. Exact pushed 3f37503e blocks repository/domain/continuation cognition ingress under brake while preserving exact active/prepared child reconciliation; copied braked CPU fell to 0.29-0.33%. Exact pushed f04abd6b makes retention maintenance run on startup, resident revision change, or a bounded 60-second deadline rather than every poll. Exact Linux release sha256-544b95404d9445b2af0fdd67495bcff5f284ab2d2a29e16450e90d50f72a3f84 with witness sha256-79639e35da79f7038111234fa33e21829e88eddcb77eb702f8f53f5369e9def3 passed 24-binary inspection with zero warnings and warm Cargo 4.33s. On copied 23 MiB state, released sleeping Self at five-second cadence used 91 process clock ticks over 30 seconds (about 3.0% of one core), held revision 66 with no grant and exact runtime hash, restored the brake, and exited zero. Live Yggdrasil reinspection confirms the Persona mouth is healthy/listening but its root-managed delivery credential remains absent or empty; no owned alternate bot token was found. Actual c006 was untouched.
   operational_state:
     local_worktree: exact_acd91e6e_imagination_runtime_owned_causality_live_accepted
     operator_wireguard: restored
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_alive_braked_revision_34_after_two_receipt_bound_continuation_grants
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact 3f37503e braked resident physiology and exact d4907ee8 proposal single-consumption review as accepted. Continue the copied autonomous turnover from typed awaitFrontierProposal or select the next still-partial organ without recreating consumed proposal/review authority. Preserve zero external consequence. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
+  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact f04abd6b resident maintenance/ingress cadence and exact d4907ee8 proposal single-consumption review as accepted. Persona public consequence remains an external credential decision; do not fabricate or borrow a bot identity. Continue the copied autonomous turnover from typed awaitFrontierProposal or select the next still-partial organ without recreating consumed proposal/review authority. Preserve zero external consequence. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -88,7 +88,7 @@ organ_readiness:
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
   mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
   continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention. Exact 16c4b19f packages coordinator receipt retention without resurrection. Exact 75b84180 packaged Linux proves worker start gating, claimed/active orphan death recovery, canonical resident requeue, and one distinct same-request retry without dual live authority. Exact 7637b1cf packages and proves atomic generic job/result/event plus terminal-failure process closure, canonical resident settlement, and a distinct same-request retry with no dual live authority. Exact 2e66433f packaged Self proves admitted-model-direction valid-result-before-receipt closes once without retry. Exact 52ee6b53 packages the corrected full-backing resident retention fence. Exact 53678374 packages authenticated failed and fulfilled outer-worker archival: window one retires only the older exact seven-envelope family, retained authority stays live, archived failure cannot resurrect, and archived fulfillment remains queryable. Direct packaged proposal Modeling and deployed journald ownership are accepted. Exact a4756857 packages CultCache 0ba8745 and proves named-volume publication across forty SIGKILL writers plus ten million concurrent lockless reads; copied c006 once and SIGTERM restart remain braked and clean. Its unconsumed nonterminal grant exactly matches Heartbeat's running coordinator turn and is coherently held by the brake.
-  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement. Exact 3f37503e makes the brake a true cognition-ingress boundary and proves 0.29-0.33% copied resident CPU at one-second cadence with stable authority hashes and clean shutdown. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Yggdrasil is not a release forge at its current memory budget.
+  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement. Exact 3f37503e makes the brake a true cognition-ingress boundary and proves 0.29-0.33% copied resident CPU at one-second cadence. Exact f04abd6b decouples maintenance from polling and proves released sleeping CPU about 3.0% at five-second cadence with stable authority, no grant, restored brake, and clean shutdown. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Yggdrasil is not a release forge at its current memory budget.
 
 forbidden_actions:
   - Do not issue a speculative deployment grant.

state/scratch.md

@@ -9,15 +9,16 @@ Keep actual c006 alive and cognitively braked; Yggdrasil never builds.
 
 ## Accepted braked physiology cut
 
-Exact pushed `3f37503e`, release
-`sha256-aec4ed9382adb45e354f00a7af330c5b28e45d07900175f4bb8dfb4535cb6624`,
-witness `sha256-348ae07ed5cda07b350d13aa02620286f80cd7cbce9c9b7dc0e562c59fe8600b`
-stops stable braked retention repetition and blocks repository/domain/
-continuation ingress under brake. On copied 23 MiB runtime state at one-second
-cadence, six samples held 0.29-0.33% CPU and about 47 MiB. Revision 66 and
-runtime/local-Verse hashes stayed exact, no grant appeared, and SIGTERM exited
-zero. The readiness-pacing hypothesis did not move CPU and was reverted; the
-ingress scan was the real owner.
+Exact pushed `3f37503e` blocks cognition ingress under brake; exact pushed
+`f04abd6b` makes runtime maintenance follow startup, resident revision, or a
+60-second deadline rather than poll cadence. Exact `f04abd6b` release
+`sha256-544b95404d9445b2af0fdd67495bcff5f284ab2d2a29e16450e90d50f72a3f84`
+and witness `sha256-79639e35da79f7038111234fa33e21829e88eddcb77eb702f8f53f5369e9def3`
+passed 24-binary inspection. Braked copied state held 0.29-0.33% CPU at
+one-second cadence; released sleeping state used 91 process ticks over 30
+seconds at five-second cadence (about 3.0% of one core). Revision 66, runtime
+hash, and no-grant state stayed exact; the brake was restored and both proofs
+exited zero. The readiness-pacing hypothesis did not move CPU and was reverted.
 
 ## Accepted live boundary