Accept Heartbeat retention and journal ownership

notes/epiphany-current-algorithmic-map.md

@@ -9,7 +9,7 @@
 - Forbidden writers: projection limits cannot masquerade as retention. Unknown directory names, symlinks, paths outside the canonical root, post-plan manifest changes, and the pulse containing the latest cognition artifact all fail closed before deletion.
 - Shared paths: explicit `retain-artifacts` and every resident heartbeat serve outcome call the same plan/reconcile primitive. A crash after plan commitment resumes that exact plan; already absent members are accepted, while surviving members must still match their planned manifests.
 - Cut line: the permanent one-directory-per-15-second growth path is removed. Process stdout/stderr logs remain a separate supervisor-owned rotation problem and are not deleted by heartbeat retention.
-- Verification layer: synthetic CultCache-backed tests prove hysteresis bounding and idempotence, changed-plan refusal with preservation, unknown-directory refusal before deletion, and protection of the latest cognition artifact. Live backlog reduction waits for exact packaging.
+- Verification layer: synthetic CultCache-backed tests prove hysteresis bounding and idempotence, changed-plan refusal with preservation, unknown-directory refusal before deletion, and protection of the latest cognition artifact. Exact packaged `16c4b19f` retired pulse directories 1-2 from a five-pulse copied-store fixture, retained 3-5 byte-identically, emitted its typed plan/receipt projection, and replay returned `within-bound` without another receipt.
 
 ## Runtime job and session closure ownership
 
@@ -2067,8 +2067,11 @@ work.
   path, and digest may be removed. Symlinks, non-directories, drift, and unknown
   members fail closed.
 - **Verification layer:** existing tests prove boundedness, idempotence,
-  exact-member refusal, and typed receipts. The remaining live audit must use
-  the packaged path, not invent a second cleaner.
+  exact-member refusal, and typed receipts. Exact packaged `16c4b19f` used the
+  same public command path to retire two witnessed directories from a
+  five-pulse copied-store fixture, preserve the remaining three, and replay as
+  `within-bound` without another receipt. Receipts are under
+  `.epiphany-run/heartbeat-retention-16c4b19f`.
 
 ### Resident Self lifecycle rows
 
@@ -2118,18 +2121,23 @@ work.
 
 ### Supervisor stdout/stderr
 
-- **Owner:** the daemon supervisor opens each service stdout/stderr path. A
-  launch truncates those files, but output during one long-lived process is
-  currently unbounded; the append-only fatal log is unbounded across launches.
-- **Forbidden writers:** an external truncator must not cut a file beneath an
-  inherited child descriptor. That can leave the writer at its old offset and
-  create sparse or misleading evidence.
-- **Intended boundary:** either the supervisor owns piped, bounded rotation with
-  nonblocking drains and crash-safe receipts, or the deployment service manager
-  owns rotation and the repo stops claiming file ownership. The infrastructure
-  runbook must decide this boundary before code changes. The configured
-  `gamecult-ops` drive is unavailable in this workspace, so this branch remains
-  deliberately uncut rather than guessed.
+- **Owner:** systemd-journald owns deployed Yggdrasil supervisor, semantic
+  projector, and workspace-coverage projector stream retention. Epiphany owns
+  typed service state, not a parallel filesystem log history.
+- **Inputs:** the supervisor policies bind managed child output to
+  `/dev/stdout` and `/dev/stderr`; `epiphany.service` explicitly binds its own
+  streams to the journal.
+- **Derived state:** journal rows are operational evidence. They cannot satisfy
+  service readiness, provider health, or typed completion.
+- **Forbidden writers:** Epiphany must not create parallel long-lived projector
+  log files under its state root, and no external truncator may cut a file
+  beneath an inherited child descriptor.
+- **Cut line:** `gamecult-ops` commit `059821f` removes all four projector
+  file-log paths from the Yggdrasil policy, names journald as the sole owner in
+  the deployment runbook, and passes the complete organizational operator
+  wiring suite. The optional supervisor fatal log is not configured by the
+  Yggdrasil unit; service failure is journal-owned too. Starfire's temporary
+  Windows shakedown logs remain bounded run receipts, not deployment truth.
 
 Resident lifecycle retention now follows this map. Resident Self's production
 serve/once owner applies a configurable closed-lifecycle bound (default 256).

notes/fresh-workspace-handoff.md

@@ -1028,16 +1028,23 @@ prepared/active launches, unconsumed acknowledgements, and brake/shutdown
 cancellations whose pressure was requeued. Negative proof must show retained
 history cannot create pending work or resurrect a coordinator turn.
 
-Coordinator receipt deletion remains forbidden until resident/current-frontier
-and recovery references are mapped. Supervisor stdout/stderr truncate at
-launch but grow without bound during a long-lived process; the fatal log grows
-across launches. Do not truncate beneath inherited child file descriptors.
-`E:\Projects\gamecult-ops` is unavailable in this workspace, so log ownership
-must wait for the infrastructure runbook rather than being guessed.
+Coordinator receipt, Heartbeat artifact, and deployment log ownership are now
+settled. Exact packaged `16c4b19f` retired pulse directories 1-2 from a
+five-pulse copied-store fixture, retained 3-5 byte-identically, emitted the
+typed retention receipt, and replayed `within-bound` without another receipt.
+Receipts are under `.epiphany-run/heartbeat-retention-16c4b19f`.
 
-Next: implement the resident lifecycle retention organ and its negative tests,
-then audit coordinator references, packaged Heartbeat retention, supervisor log
-ownership, and the measured idle/active endurance plateau.
+The live infrastructure repo is `F:\Projects\gamecult-ops`. Commit `059821f`
+makes systemd-journald the sole Yggdrasil owner for supervisor and projector
+stdout/stderr: both projector policies bind `/dev/stdout` and `/dev/stderr`,
+the unit explicitly selects journal streams, and no parallel long-lived files
+remain under the Epiphany state root. The optional fatal log is not configured
+by the Yggdrasil unit. The full organizational operator wiring suite passes.
+Do not reintroduce external truncation beneath inherited descriptors.
+
+Next: run the measured idle/active endurance plateau, then continue the
+remaining organ coordination audit. Broad session/model/event/tool compaction
+still waits for typed archived-session ownership.
 
 Resident lifecycle retention is now implemented in source. Resident Self's
 serve/once owner invokes a configurable `--retained-closed-lifecycles` bound

state/map.yaml

@@ -35,7 +35,7 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, and exact ed15f83a resident lifecycle retention are proven. Exact 16c4b19f release sha256-6cd1907a87d37cd4517e3f1d3541ecee6595480c21401f977f51f63e929a8ef8 proves packaged coordinator receipt retention: 21 old receipts became one non-authority digest/count head, the newest and an explicitly cross-store-referenced old receipt survived, 720 unrelated runtime envelopes remained byte-identical by digest, and replay was idempotent without creating work. Broader runtime/log retention, packaged Heartbeat retention, long-duration plateau, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, and exact 16c4b19f coordinator receipt retention are proven. Packaged 16c4b19f also proves Heartbeat pulse-artifact retention and idempotent replay. Gamecult-ops 059821f makes journald the sole Yggdrasil supervisor/projector stream-retention owner. Broad session/model/event/tool retention, the long-duration plateau, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge.
   latest_phase: Commit 76afdaf0 moved release construction, filesystem verification, and witness inspection out of monolithic epiphany-core into epiphany-release-construction; core retains only CultMesh publication, load, and authentication. The bootstrap dependency graph excludes epiphany-core, all 19 construction tests pass, and the full core test harness compiles. Exact Linux bootstrap fell from 7m57s to 30.24s cold and 4.40s warm. Exact source 76afdaf0 then produced warning-free 24-binary release sha256-30caab9ef1ea89f9a885d87832b1e312a35288ec3f895bd5b0e83f7f7a6a1aec with witness sha256-89c2ad604254faec3e1e01f753b5dff38a402f43d009074ba4b47b1ec46fdecf. Independent inspection accepted the 12m16s cold build and the identical 10.16s warm replay with Cargo at 0.82s. The packaged full publisher accepted the narrow constructor's witness and changed c005 local-verse.cc from SHA-256 b160c610988753278afbad7f5bad436193144a92e9fd506982099ad58d213909 to 83ed430f5bf0c33996d7c4ee7bf0fa6c9f5f80bc8db94621395ea560852cae81 without body activation.
   operational_state:
     local_worktree: coordinator_receipt_retention_packaged_proven
@@ -68,8 +68,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: authenticated_9b8df0b4_c005_bound_to_eyes_tools_nervous_system_with_217dd_and_bd96305e_helpers_running
-  unresolved_authority: Coordinator receipt retention is accepted. Broader semantic/runtime histories remain unbounded pending a typed archived-session owner. Supervisor stdout/stderr are truncated only at launch and unbounded during a long-lived process; the fatal log is append-only. Packaged Heartbeat retention ownership and long-duration resource plateau remain unproven. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Settle supervisor stdout/stderr/fatal-log ownership from source and infrastructure runbooks, then audit packaged Heartbeat artifact retention before editing. Preserve active c005 and do not compact session/model/event/tool history until typed archived-session ownership exists. After bounded retention is accepted, run measured idle and active endurance plateau and continue the remaining organ coordination matrix.
+  unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, and deployed supervisor/projector log retention are accepted. Broader semantic/runtime histories remain unbounded pending a typed archived-session owner. The long-duration idle/active resource plateau remains unproven. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential.
+  next_action: Run a measured idle and active endurance plateau on copied or isolated authenticated Starfire state, preserving active c005. Record process RSS/CPU, store and artifact growth, bounded retention behavior, and clean shutdown/restart over a duration long enough to expose monotonic growth. Then continue the remaining organ coordination matrix. Do not compact session/model/event/tool history until typed archived-session ownership exists.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.