Accept braked resident physiology cut

notes/epiphany-current-algorithmic-map.md

@@ -3960,3 +3960,27 @@ terminal review continuation, then `awaitFrontierProposal`; no second review
 grant appeared. Runtime had zero open jobs, Hands/Eyes remained false, the copy
 was braked, and both owners exited zero. Post-transaction typed coordinator
 state is now the sole final-action owner for these review paths.
+## Braked resident maintenance and ingress cadence
+
+- Owner: the resident serve loop owns maintenance cadence; retention organs
+  own what may be retired, not how often a stable runtime is rescanned.
+- Inputs: cognitive brake, shutdown signal, resident revision, prepared/active
+  lease state, and producer-owned typed source stores.
+- Outputs: the first stable braked revision receives normal bounded
+  maintenance; later identical braked pulses only observe/reconcile resident
+  authority and publish operator physiology. New domain and continuation
+  pressure are ingested only after brake release.
+- Derived state: poll interval, readiness projection, and pulse count are not
+  retention or cognition-ingress authority.
+- Forbidden writers: a braked pulse cannot bind a new repository domain,
+  derive resident pressure, import Bifrost delivery, or create a grant. It also
+  cannot erase producer-owned evidence waiting in runtime or crossing stores.
+- Shared paths: brake and shutdown use the same ingress refusal boundary;
+  prepared/active child reconciliation remains live so the brake can drain and
+  terminalize exact existing authority.
+- Cut line: unconditional retention scans no longer repeat at an unchanged
+  braked revision, and `cycle` no longer runs repository/domain/continuation
+  ingress while braked.
+- Verification: exact packaged `3f37503e` on copied 23 MiB runtime state held
+  revision and runtime/local-Verse hashes stable, created no grant, exited zero,
+  and measured 0.29-0.33% CPU at one-second cadence versus prior 10-24% spikes.

notes/fresh-workspace-handoff.md

@@ -1,5 +1,39 @@
 # Fresh workspace handoff
 
+## Braked resident physiology no longer runs cognition ingress - 2026-08-11
+
+Actual c006 remains exact `c9a2a979`, alive, cognitively braked, and untouched.
+Its eight-hour endurance window held resident revision 34 with no active turn,
+no restart, and no OOM, but read-only sampling exposed sustained resident CPU
+spikes between roughly 9% and 24% at the shakedown's one-second idle cadence.
+
+The first owner cut, pushed as `7a8ef10d`, stops repeated runtime/session,
+lifecycle, and worker-attempt retention after the first stable braked revision.
+That reduced some spikes but left roughly 6-12% CPU. A readiness-publication
+cadence hypothesis was packaged and falsified without improvement, then
+reverted by `11a9e05c`; do not resurrect it as the explanation.
+
+Source inspection found the real hot owner inside `epiphany-swarm::cycle`:
+the brake already blocked Bifrost import, but repository-domain binding plus
+domain-pressure and coordinator-continuation ingestion still ran on every
+braked pulse. Pushed `3f37503e` makes brake and shutdown block all new cycle
+ingress while preserving state load and prepared/active child reconciliation.
+Producer-owned typed evidence remains in its source store until release; the
+brake does not delete it or synthesize a terminal state.
+
+Exact release
+`sha256-aec4ed9382adb45e354f00a7af330c5b28e45d07900175f4bb8dfb4535cb6624`
+and witness
+`sha256-348ae07ed5cda07b350d13aa02620286f80cd7cbce9c9b7dc0e562c59fe8600b`
+passed 24-binary inspection with zero warnings; warm Cargo took 3.13s. On the
+same copied 23 MiB runtime store and one-second loop, six consecutive samples
+were 0.29-0.33% CPU at about 47 MiB, down from 10-24% and 80-93 MiB. Resident
+revision remained 66, runtime SHA-256 remained
+`3cc2ef56...0bc6`, cognitive local-Verse SHA-256 remained
+`d1efda5f...f395`, no grant appeared, and SIGTERM exited zero. Receipts are
+under `.epiphany-run/linux-package-3f37503e`; stopped benchmark container logs
+remain on `epiphany-braked-cadence-resident-3f37503e`.
+
 ## Runtime-owned proposal Modeling first-result accepted - 2026-08-11
 
 Actual c006 remains exact `c9a2a979`, alive and cognitively braked. All live

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Exact pushed d4907ee8 completes the proposal Modeling single-consumption review cut. Exact Linux release sha256-81b4c14f0201f21adf8001f5dc5da81760697b03020fb4c2d6cb0e627efe16a0 with witness sha256-5cf073e22a6d8fa93b5b7409c6a68f2f88d792dd9786c65e49000967ba61ea21 passed 24-binary inspection with zero warnings and warm Cargo 6.97s. On fresh copied state, request repo-frontier-proposal-modeling-507ad0a7dda5c8cc076b910f02d19c196b4cd5bb63e06ab25724aaac148897f8 launched exactly one outer Modeling job ebadfc7b-189c-4ac6-80c0-879ddb695cb5, received exactly one terminal review continuation, and the post-transaction receipt published awaitFrontierProposal. No second review grant appeared. Runtime ended with zero open jobs and Hands=false/Eyes=false; the copied cognitive brake was restored and both owners exited zero. Actual c006 was untouched.
+  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Its eight-hour braked endurance held revision 34 with no active turn/restart/OOM but exposed 9-24% resident CPU spikes at one-second shakedown cadence. Exact pushed 3f37503e separates physiology from cognition ingress: stable braked revisions no longer repeat full runtime/lifecycle/attempt retention, and brake/shutdown block repository-domain binding plus domain and coordinator-continuation pressure ingestion while preserving exact prepared/active child reconciliation. Exact Linux release sha256-aec4ed9382adb45e354f00a7af330c5b28e45d07900175f4bb8dfb4535cb6624 with witness sha256-348ae07ed5cda07b350d13aa02620286f80cd7cbce9c9b7dc0e562c59fe8600b passed 24-binary inspection with zero warnings and warm Cargo 3.13s. On copied 23 MiB runtime state at one-second cadence, six samples held 0.29-0.33% CPU and about 47 MiB; resident revision 66 and exact runtime/local-Verse hashes stayed unchanged, no grant appeared, and SIGTERM exited zero. Actual c006 was untouched.
   operational_state:
     local_worktree: exact_acd91e6e_imagination_runtime_owned_causality_live_accepted
     operator_wireguard: restored
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_alive_braked_revision_34_after_two_receipt_bound_continuation_grants
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact d4907ee8 proposal Modeling publication and single-consumption review as accepted. Continue the copied autonomous turnover from typed awaitFrontierProposal and inspect the next organ/action without recreating consumed proposal or review authority. Preserve zero external consequence. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
+  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact 3f37503e braked resident physiology and exact d4907ee8 proposal single-consumption review as accepted. Continue the copied autonomous turnover from typed awaitFrontierProposal or select the next still-partial organ without recreating consumed proposal/review authority. Preserve zero external consequence. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -88,7 +88,7 @@ organ_readiness:
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
   mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
   continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention. Exact 16c4b19f packages coordinator receipt retention without resurrection. Exact 75b84180 packaged Linux proves worker start gating, claimed/active orphan death recovery, canonical resident requeue, and one distinct same-request retry without dual live authority. Exact 7637b1cf packages and proves atomic generic job/result/event plus terminal-failure process closure, canonical resident settlement, and a distinct same-request retry with no dual live authority. Exact 2e66433f packaged Self proves admitted-model-direction valid-result-before-receipt closes once without retry. Exact 52ee6b53 packages the corrected full-backing resident retention fence. Exact 53678374 packages authenticated failed and fulfilled outer-worker archival: window one retires only the older exact seven-envelope family, retained authority stays live, archived failure cannot resurrect, and archived fulfillment remains queryable. Direct packaged proposal Modeling and deployed journald ownership are accepted. Exact a4756857 packages CultCache 0ba8745 and proves named-volume publication across forty SIGKILL writers plus ten million concurrent lockless reads; copied c006 once and SIGTERM restart remain braked and clean. Its unconsumed nonterminal grant exactly matches Heartbeat's running coordinator turn and is coherently held by the brake.
-  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Yggdrasil is not a release forge at its current memory budget.
+  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement. Exact 3f37503e makes the brake a true cognition-ingress boundary and proves 0.29-0.33% copied resident CPU at one-second cadence with stable authority hashes and clean shutdown. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Yggdrasil is not a release forge at its current memory budget.
 
 forbidden_actions:
   - Do not issue a speculative deployment grant.

state/scratch.md

@@ -4,9 +4,20 @@ Disposable working memory for one bounded rite.
 
 ## Current Subgoal
 
-Continue the copied autonomous turnover from the accepted single-consumption
-proposal Modeling review boundary. Keep actual c006 alive and cognitively
-braked; Yggdrasil never builds.
+Continue organ shakedown after accepting exact braked resident physiology.
+Keep actual c006 alive and cognitively braked; Yggdrasil never builds.
+
+## Accepted braked physiology cut
+
+Exact pushed `3f37503e`, release
+`sha256-aec4ed9382adb45e354f00a7af330c5b28e45d07900175f4bb8dfb4535cb6624`,
+witness `sha256-348ae07ed5cda07b350d13aa02620286f80cd7cbce9c9b7dc0e562c59fe8600b`
+stops stable braked retention repetition and blocks repository/domain/
+continuation ingress under brake. On copied 23 MiB runtime state at one-second
+cadence, six samples held 0.29-0.33% CPU and about 47 MiB. Revision 66 and
+runtime/local-Verse hashes stayed exact, no grant appeared, and SIGTERM exited
+zero. The readiness-pacing hypothesis did not move CPU and was reverted; the
+ingress scan was the real owner.
 
 ## Accepted live boundary