Record Idunn unit custody boundary

notes/fresh-workspace-handoff.md

@@ -3674,3 +3674,20 @@ checkout of exact `3676a61` and prove their bytes against canonical Git objects.
 The failed seq268 request is terminal and must never be replayed or regranted.
 Authorize only a new meaningful Epiphany successor, accept only its fresh exact
 request, and keep both brakes engaged except for that one bounded Idunn grant.
+
+The next exact successor `20515d37` produced fresh request seq269 and entered
+the corrected LF actuator, but failed at candidate unit installation because
+Idunn's `ProtectSystem` namespace made `/etc/systemd/system` read-only. Rollback
+hit the same boundary and correctly returned CRITICAL/status 125 rather than
+claiming complete restoration. The unit writes never began, so the prior unit
+bytes remained intact; app/source pointers and lineage remained bcff, and the
+old supervisor, operator, Heartbeat, swarm, semantic projector, and workspace
+projector restarted from bcff. Both brakes are engaged and Idunn is stable.
+
+The missing authority is now explicit. `gamecult-ops` commit `a281e38` grants
+the Idunn service sandbox write custody only to the four named Epiphany unit
+files; it does not grant broad `/etc/systemd/system` access. Focused operator
+wiring tests require those exact paths and reject directory-wide custody. Next
+install exact a281e38 under both brakes, verify the Idunn restart and old body,
+then use only a fresh exact Epiphany successor/request. Seq269 is terminal and
+must never be replayed or regranted.

state/map.yaml

@@ -814,4 +814,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Install canonical LF deployment artifacts from exact gamecult-ops 3676a61 on Yggdrasil and prove their bytes from a clean Linux Git checkout; CRLF artifacts are now rejected at bootstrap. Authorize only the Epiphany successor containing this failed-request evidence, observe its fresh request, and grant only that exact request for at most 15 minutes. Re-engage the Idunn brake at terminal or unknown consequence. Require exact live witness, stable old-generation rollback on failure, all organs active, and both brakes engaged. Then prove operator-safe Discord Status with complete and one-missing provider cases. Do not test Wake or reboot the host."
+  next_action: "Install exact gamecult-ops a281e38 on Yggdrasil so Idunn's ProtectSystem sandbox grants write custody only to the four named Epiphany unit files; verify canonical LF bytes, exact drop-in, stable Idunn restart, both brakes, and old bcff organs. Authorize only the next Epiphany successor containing seq269 evidence, observe a fresh request, and grant only that exact request for at most 15 minutes. Re-engage the Idunn brake at terminal or unknown consequence. Require exact live witness or complete proven old-generation rollback. Then prove operator-safe Discord Status with complete and one-missing provider cases. Do not test Wake or reboot the host."