Require exclusive coordinator test temp ownership

epiphany-core/src/coordinator_launch_context.rs

@@ -726,7 +726,7 @@ mod tests {
     fn launch_context_persists_on_runtime_worker_request() -> anyhow::Result<()> {
         let temp =
             std::env::temp_dir().join(format!("epiphany-bridge-launch-context-{}", Uuid::new_v4()));
-        fs::create_dir_all(&temp)?;
+        fs::create_dir(&temp)?;
         let runtime_store = temp.join("runtime-spine.msgpack");
         let state = EpiphanyThreadState {
             revision: 7,
@@ -802,7 +802,7 @@ mod tests {
             "epiphany-launch-context-unbootstrapped-{}",
             Uuid::new_v4()
         ));
-        fs::create_dir_all(&temp)?;
+        fs::create_dir(&temp)?;
         let runtime_store = temp.join("runtime-spine.msgpack");
         let local_verse_store = local_verse_store_path(&runtime_store);
         let state = EpiphanyThreadState {
@@ -826,7 +826,7 @@ mod tests {
     #[test]
     fn verification_launch_context_includes_hands_receipt_chain() -> anyhow::Result<()> {
         let temp = std::env::temp_dir().join(format!("epiphany-hands-context-{}", Uuid::new_v4()));
-        fs::create_dir_all(&temp)?;
+        fs::create_dir(&temp)?;
         let runtime_store = temp.join("runtime-spine.msgpack");
         initialize_runtime_spine(
             &runtime_store,

notes/conceptual-substitution-audit-2026-07-12.md

@@ -869,6 +869,11 @@ helpers now use `create_dir`, so cleanup authority exists only after exclusive
 creation succeeds. Source search finds no remaining `env::temp_dir()` helper
 that adopts its generated leaf with `create_dir_all`.
 
+The same audit found three coordinator launch-context tests with the identical
+UUID/adoption pattern. They also now claim their leaves with `create_dir`.
+Generated temp ownership is consistent across the full Rust source tree, not
+merely production binaries; tests do not receive imaginary cleanup authority.
+
 ## Unresolved: provider receipts without chronology
 
 Bifrost body-change/GitHub publication receipts are externally owned and their

notes/fresh-workspace-handoff.md

@@ -257,6 +257,9 @@ collision, removing their recursive-delete authority entirely.
 Seven UUID-scoped temp helpers now use exclusive `create_dir`, not
 `create_dir_all`; a pre-existing leaf is refused before work and can no longer
 be adopted and later deleted.
+Three coordinator launch-context test leaves were corrected as well. The full
+Rust source search now contains no generated `temp_dir()` leaf adopted through
+`create_dir_all`.
 
 The latest structural count is 32 closure family branches, 744 remaining
 substring assertions in the closure region, and 1,284 lines in

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution pass. Eight high-authority closure families are typed and guarded against regaining substring authority. The closure region still has 32 family branches and 744 substring assertions while closure_contracts.rs is 1,284 lines; do not substitute a blind struct forest for coherent ownership. Prioritize consequence-bearing request families, collapse shared syntax only when a named invariant earns it, and leave presentation-only markdown checks out of policy machinery. Repo-personality and verse-query smoke recursive deletion are canonically confined; 32 timestamped smokes have no recursive-delete path; seven UUID temp helpers require exclusive creation before cleanup. Continue auditing remaining reset helpers for provenance substituted for resolved scope. Operational/evidence/self-state and operator mirrors follow owned clocks; identity chains are typed; scheduling/runbook selection do not parse prose; writerless readiness-review is deleted. Bifrost provider receipts still need provider chronology. Continue auditing evidence/security mirrors and adapters for borrowed authority.
+  next_action: Continue the conceptual-substitution pass. Eight high-authority closure families are typed and guarded against regaining substring authority. The closure region still has 32 family branches and 744 substring assertions while closure_contracts.rs is 1,284 lines; do not substitute a blind struct forest for coherent ownership. Prioritize consequence-bearing request families, collapse shared syntax only when a named invariant earns it, and leave presentation-only markdown checks out of policy machinery. Repo-personality and verse-query smoke recursive deletion are canonically confined; 32 timestamped smokes have no recursive-delete path; all ten generated UUID temp leaves across binaries and coordinator tests require exclusive creation before cleanup. Continue auditing remaining reset helpers for provenance substituted for resolved scope. Operational/evidence/self-state and operator mirrors follow owned clocks; identity chains are typed; scheduling/runbook selection do not parse prose; writerless readiness-review is deleted. Bifrost provider receipts still need provider chronology. Continue auditing evidence/security mirrors and adapters for borrowed authority.