Order lifecycle mirrors by event time

epiphany-core/src/cultmesh_integration.rs

@@ -8,6 +8,8 @@ use crate::default_substrate_gate_cultnet_contracts;
 use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
+use chrono::DateTime;
+use chrono::FixedOffset;
 use cultcache_rs::CultSoaColumnValues;
 use cultcache_rs::DatabaseEntry;
 use cultcache_rs::SoaDocument;
@@ -3519,10 +3521,17 @@ pub fn write_epiphany_cultmesh_daemon_service_lifecycle_receipt(
     let mut node = open_epiphany_cultmesh_node(store_path, runtime_id)?;
     let receipt_key = epiphany_cultmesh_daemon_service_lifecycle_receipt_key(&receipt.receipt_id);
     let written = node.put(receipt_key.as_str(), &receipt)?;
-    node.put(
+    let current_latest = node.get::<EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry>(
         EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_LATEST_KEY,
-        &written,
     )?;
+    if current_latest.as_ref().is_none_or(|current| {
+        daemon_service_lifecycle_event_key(&written) >= daemon_service_lifecycle_event_key(current)
+    }) {
+        node.put(
+            EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_LATEST_KEY,
+            &written,
+        )?;
+    }
     node.flush()?;
     Ok(written)
 }
@@ -3990,6 +3999,19 @@ fn validate_daemon_service_lifecycle_receipt(
             return Err(anyhow!("daemon service lifecycle receipt missing {label}"));
         }
     }
+    let started_at = DateTime::parse_from_rfc3339(&receipt.started_at_utc).map_err(|error| {
+        anyhow!("daemon service lifecycle receipt has invalid started at: {error}")
+    })?;
+    if let Some(completed_at) = receipt.completed_at_utc.as_deref() {
+        let completed_at = DateTime::parse_from_rfc3339(completed_at).map_err(|error| {
+            anyhow!("daemon service lifecycle receipt has invalid completed at: {error}")
+        })?;
+        if completed_at < started_at {
+            return Err(anyhow!(
+                "daemon service lifecycle receipt completed before it started"
+            ));
+        }
+    }
     if !receipt.required_document_types.is_empty()
         && (!receipt.schema_preflight_passed
             || receipt.executable_sha256.trim().is_empty()
@@ -4003,6 +4025,22 @@ fn validate_daemon_service_lifecycle_receipt(
     Ok(())
 }
 
+fn daemon_service_lifecycle_event_key(
+    receipt: &EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry,
+) -> (DateTime<FixedOffset>, &str) {
+    let event_time = receipt
+        .completed_at_utc
+        .as_deref()
+        .map(DateTime::parse_from_rfc3339)
+        .transpose()
+        .expect("validated lifecycle completion timestamp")
+        .unwrap_or_else(|| {
+            DateTime::parse_from_rfc3339(&receipt.started_at_utc)
+                .expect("validated lifecycle start timestamp")
+        });
+    (event_time, receipt.receipt_id.as_str())
+}
+
 pub fn epiphany_cultmesh_daemon_tool_invocation_intent_from_capability(
     intent_id: impl Into<String>,
     requesting_agent_id: impl Into<String>,
@@ -7132,6 +7170,21 @@ mod tests {
             ids,
             vec!["service-lifecycle-first", "service-lifecycle-second"]
         );
+        assert_eq!(
+            load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt(
+                &store,
+                "epiphany-test"
+            )?,
+            Some(second.clone())
+        );
+
+        let mut delayed_first = first.clone();
+        delayed_first.receipt_id = "service-lifecycle-delayed-first".to_string();
+        write_epiphany_cultmesh_daemon_service_lifecycle_receipt(
+            &store,
+            "epiphany-test",
+            delayed_first,
+        )?;
         assert_eq!(
             load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt(
                 &store,
@@ -7142,6 +7195,66 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn service_lifecycle_receipt_refuses_invalid_or_reversed_time() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = temp
+            .path()
+            .join("epiphany-service-lifecycle-invalid-time.ccmp");
+        let mut receipt = EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry {
+            schema_version: EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_SCHEMA_VERSION
+                .to_string(),
+            receipt_id: "service-lifecycle-invalid-time".to_string(),
+            service_id: "epiphany-daemon-supervisor-service".to_string(),
+            scheduler_id: "epiphany-daemon-supervisor".to_string(),
+            runtime_id: "epiphany-test".to_string(),
+            daemon_selector: "epiphany-daemon-supervisor".to_string(),
+            action: "windows-service-status".to_string(),
+            status: "running".to_string(),
+            command: "powershell.exe".to_string(),
+            args: Vec::new(),
+            cwd: None,
+            process_id: None,
+            exit_code: Some(0),
+            started_at_utc: "not-a-time".to_string(),
+            completed_at_utc: None,
+            operator_artifact_ref: "test://invalid-time".to_string(),
+            private_state_exposed: false,
+            notes: Vec::new(),
+            executable_sha256: String::new(),
+            preflight_witness_id: String::new(),
+            required_document_types: Vec::new(),
+            schema_preflight_passed: false,
+            schema_catalog_sha256: String::new(),
+        };
+        assert!(
+            write_epiphany_cultmesh_daemon_service_lifecycle_receipt(
+                &store,
+                "epiphany-test",
+                receipt.clone(),
+            )
+            .is_err()
+        );
+        receipt.started_at_utc = "2026-07-13T02:00:00Z".to_string();
+        receipt.completed_at_utc = Some("2026-07-13T01:00:00Z".to_string());
+        assert!(
+            write_epiphany_cultmesh_daemon_service_lifecycle_receipt(
+                &store,
+                "epiphany-test",
+                receipt,
+            )
+            .is_err()
+        );
+        assert!(
+            load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt(
+                &store,
+                "epiphany-test"
+            )?
+            .is_none()
+        );
+        Ok(())
+    }
+
     #[test]
     fn service_execution_audit_checks_expose_operator_artifact_refs() -> Result<()> {
         let report = epiphany_service_execution_audit_report(&[

notes/conceptual-substitution-audit-2026-07-12.md

@@ -501,3 +501,13 @@ for each service family; attention is derived from that event. History retains
 older failures without letting them impersonate current state. Adversarial
 tests prove a newer recovery supersedes an old failure and a newer failure is
 not hidden by an old recovery.
+
+## Last writer presented as latest lifecycle event
+
+The lifecycle `latest` mirror was overwritten on every write. A delayed retry
+or replay of an older receipt could therefore move the stored present backward
+even though immutable history contained the correct ordering. Lifecycle writes
+now validate RFC3339 start/completion timestamps, reject completion before
+start, and update the mirror only when `(event time, receipt ID)` is not older
+than the current mirror. A delayed old receipt remains in history without
+becoming current.

notes/fresh-workspace-handoff.md

@@ -128,6 +128,9 @@ The confirmed conceptual substitutions have been cut:
 - Service lifecycle projection selects the actual latest family event. An old
   attention receipt no longer masquerades as current state after recovery;
   newer failures still surface immediately.
+- The lifecycle `latest` mirror is event-time-owned, not last-writer-wins.
+  Invalid/reversed timestamps are refused and delayed old receipts cannot move
+  the mirror backward.
 
 The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it.
 

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; Idunn lifecycle facts are observation-grounded; install command success is not installed state; cluster execution audit depends on SCM observation; lifecycle projection selects the actual latest event instead of pinning historical failure. Continue auditing projection/cache latest-mirror semantics, service configuration claims, adapters, and destructive path consumers for borrowed authority.
+  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; Idunn lifecycle facts are observation-grounded; lifecycle reducers and the stored latest mirror are event-time-owned rather than attention- or arrival-owned. Continue auditing other projection/cache latest mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.