Record singular Persona delivery authority

notes/epiphany-current-algorithmic-map.md

@@ -1026,6 +1026,15 @@ the mention pending with the terminal receipt bound into its next deterministic
 request identity. Resident Self cannot launch, block, or terminalize Persona
 work.
 
+Delivered speech has one local consequence owner. Exact `b3e9b229` deletes the
+standalone Persona delivery-evidence document and the conversation receipt's
+copied evidence-ID vector. Bifrost keeps the durable signed crossing request and
+receipt; the Persona social terminal folds that exact receipt into message ID,
+crossing receipt ID, and digest. Retention reloads and verifies the provider-
+owned pair and matches it against the terminal. Runtime is v36; the terminal
+and conversation execution schemas are v2. This is not an Atlas proof: live
+inter-swarm collaboration remains unrun.
+
 ## RepoModel projection
 
 RepoModel persistence is keyed by semantic identity: identity/body binding,

notes/epiphany-fork-implementation-plan.md

@@ -436,6 +436,13 @@ Cut in this order:
    caller was a fixture. Family launch CAS, model execution, and coordinator
    opening are the only runtime-physiology creation owners. The cut removes 96
    net maintained lines without a schema or Atlas change.
+   Exact `b3e9b229` deletes Persona's standalone delivery-evidence document and
+   the conversation receipt's copied evidence-ID vector. Bifrost owns the
+   durable signed crossing receipt; the Persona social terminal owns the local
+   delivered consequence and folds the exact message, crossing, and digest
+   identities into one receipt. Retention verifies that provider-owned receipt
+   directly. Runtime advances to v36 and both changed Persona documents make a
+   v2 hard cut. Atlas remains untouched and operationally unaccepted.
 3. **Baseline transaction landed at `9f7b164f`; operator routing at `587c56d2`; Resident continuation and keyed acceptance at `478fb923`:** baseline Body Modeling is now thread-free from unresolved Body obligation through Launch/Wait/Review and exact Mind admission. Resident and operator callers consume the same family projection and acceptance owner. Thread ID remains immutable pass provenance only.
 4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, worker launch, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry. Exact `b0a4978d` deletes the later duplicate launch-binding document entirely; the worker launch is the sole launch owner.
 5. **Continuation vocabulary landed at `e404c105` and was named truthfully at `fc5d1a4a`:** concrete pass families share one pure `EpiphanyAgentPassContinuationAction`; their semantic requests, projections, validators, and admission owners remain separate.

notes/fresh-workspace-handoff.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-24
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `fdefb889`
-Current pass: test-only runtime writers deleted; Ox17
+Latest committed implementation cut: `b3e9b229`
+Current pass: duplicate Persona delivery evidence deleted; Ox17
 remains paused
 
 ## Orientation
@@ -15,7 +15,7 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
 cognition without an explicit operator resumption.
 
 Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
-production symlink body and is inactive. Exact `fdefb889` is the current
+production symlink body and is inactive. Exact `b3e9b229` is the current
 build-affecting source. Historical live proofs remain evidence; they do not
 authorize the next capstone or Gate 1.
 
@@ -45,6 +45,21 @@ authorize the next capstone or Gate 1.
 
 ## What just landed
 
+Exact `b3e9b229` makes the Persona social terminal the sole local owner of a
+delivered speech consequence. The already-verified signed Bifrost receipt is
+folded directly into its message ID, crossing receipt ID, and exact receipt
+digest. The standalone `PersonaDiscordDeliveryEvidence` document, runtime
+registration/write/read path, and conversation receipt's copied evidence-ID
+vector are deleted. Retention reloads and cryptographically verifies the
+durable Bifrost request/receipt pair and matches that exact consequence against
+the terminal. Runtime advances to v36; social terminal and conversation
+execution advance to v2 with no compatibility reader. Core compiles, Persona
+consequence/retention passes 5/5, and the release-owned Persona service
+compiles. The cut removes 66 net maintained lines. Verification generated 3.1
+GiB across 7,791 files; cleanup restored the one 1.78 MB state inspector. Atlas
+is untouched. No live inter-swarm collaboration has run; component tests do not
+claim otherwise.
+
 Exact `fdefb889` deletes public `create_runtime_session` and
 `create_runtime_job` plus their exports. Every caller was a fixture. Production
 session/job creation already belongs to family launch CAS, exact model-execution

state/map.yaml

@@ -52,7 +52,7 @@ current_status:
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
   competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
-  latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Mind/runtime writable epochs are v10/v35. The public CultNet catalog contains only three earned portable boundaries: exact OpenAI-compatible provider request, Persona state, and work-organ state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
+  latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Mind/runtime writable epochs are v10/v36. The public CultNet catalog contains only three earned portable boundaries: exact OpenAI-compatible provider request, Persona state, and work-organ state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
   fixed_routing_and_retention_cargo_cut: Exact ffd91c20 deletes EyesEvidencePacket.source_role_id, PersonaSocialMention.target_agent_id, and ResidentSelfRetentionHead.retained_at_millis. Each producer supplied one fixed or non-causal value and no consumer read it; the request/context, Persona queue plus turn request, and retention chain remain the real owners. Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the three consuming release entrypoints compile; consequential Persona, Research, and epoch-refusal proofs pass. The maintained source delta is 6 net deletions. Atlas is untouched; no live inter-swarm collaboration has run.
   provider_stream_authority_cut: Exact fe118e13 makes OpenAI/OpenRouter events and receipts transient transport values. The runtime immediately normalizes them into the single persisted native model event/receipt family used by tool continuation, assistant reconstruction, terminal validation, and bounded retention. Duplicate provider writes, registrations, archive requirements, schema IDs, two public schemas/index rows, and the include-only model-runtime shell are gone; the exact provider request remains durable. Runtime advances to v28 and the catalog drops to 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Atlas is untouched; live inter-swarm collaboration remains unproven.
   cultnet_catalog_authority_cut: Exact dbed11b3 and 8bb0719b delete the hand-maintained JSON shadow registry. The nonexistent runtime-event contract and obsolete public archived-session tombstone schema disappear first. Runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger schemas then disappear because no live CultNet provider carries them and several contradicted their Rust owners. Typed CultCache registration and owner-projected CultMesh state remain authoritative. The catalog has exactly three earned boundaries: the exact OpenAI-compatible provider request, gamecult.persona_state.v0, and epiphany.work_organ_state.v0. Parse/path/unindexed/forbidden-contract checks pass at 3/3/0/0/0. The cuts remove 850 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven.
@@ -108,6 +108,7 @@ current_status:
   soul_contract_cut: Exact f8974d52 deletes five prose-only Soul mutation contracts/constants: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. None had a typed document, schema, store, writer, reader, or test. The keyed RepoFrontierVerificationRequest and persisted SoulVerdictReceipt remain the actual request/result path. Core/release checks and focused verification 3/3 pass.
   eyes_contract_cut: Exact 201fa192 deletes three prose-only Eyes mutation contracts/constants/exports: generic evidence request, evidence review, and evidence refusal. Exact 83611f9b completes the cut by deleting the never-persisted EyesSourceLookupReceipt DTO and the duplicate EyesEvidencePacket. The real grant/tool chain is authenticated in place; the structured Research decision becomes keyed Mind evidence/observation writes under one validated atomic commit. Core check, full keyed Research lifecycle, replay, conflict, re-entry, and old-epoch refusal pass. Runtime advances to v35; the cut removes 205 net maintained lines. Atlas is untouched and remains operationally unaccepted.
   test_only_runtime_writer_cut: Exact fdefb889 deletes public create_runtime_session and create_runtime_job plus their exports. Every caller was a fixture; production session/job creation already belongs to family launch CAS, open_runtime_model_execution, and open_coordinator_run. OpenAI launch fixtures now use the real family preparation owner. Native-tool tests seed only their prerequisite documents locally rather than purchasing arbitrary production writers. Tool runtime 4/4, model runtime 8/8, OpenAI verification-request 1/1, and all affected production checks pass. The cut removes 96 net maintained lines; runtime_spine.rs is 9,347 physical lines with 50 public functions and 25 public structs. Verification generated 11.56 GiB across 17,633 files; cleanup restored the single 1.78 MB state inspector. No schema or Atlas path changed.
+  persona_delivery_evidence_cut: Exact b3e9b229 makes the Persona social terminal the sole local owner of delivered-speech consequence identity. It folds the already-verified signed Bifrost receipt into message ID, crossing receipt ID, and exact receipt digest. The standalone PersonaDiscordDeliveryEvidence document, runtime registration/write/read path, and conversation receipt evidence-ID vector are gone. Retention reloads and cryptographically verifies the durable provider-owned request/receipt pair, then matches that exact consequence against the social terminal. Runtime advances to v36; social terminal and conversation execution advance to v2 with no compatibility reader. Core compiles, Persona consequence/retention passes 5/5, and the release-owned Persona service compiles. The cut removes 66 net maintained lines; verification generated 3.1 GiB across 7,791 files and cleanup restored the single 1.78 MB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
   persona_social_cut: Pending mentions, immutable requests, terminal receipts, quarantine records, retention heads, and retention plans are separate keyed CultCache documents. Persona derives its own deterministic work identity, reserves and terminalizes through exact batch CAS, cites the exact request envelope as pass-input provenance, and retries failed mentions without a timestamp or global revision. No scheduler can launch, block, retain, or provide pass provenance for Persona work. Exact 3dda58a5 makes Resident Self the sole authenticated Bifrost-feedback polling/import owner and deletes the standalone ingress CLI, its static projections, its old Starfire snapshot replacement seam, and two command-only tests: 426 net deletions. Seven retained tests prove signed admission, target/provider substitution refusal, disclosure gating, recovery, and read-only provider-store import.
   operational_state:
     local_worktree: source_subtraction_commits_landed_ox17_and_deployment_paused
@@ -150,10 +151,10 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,347 physical lines, 50 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Sessions and jobs carry only lifecycle identity/status; terminal result documents own summaries and artifacts. Generic session/job creation is gone; real family launch, model execution, and coordinator owners create runtime physiology. All persisted family launch-binding documents, the standalone verdict-driven Modeling writer, coordinator artifact/status cargo, uninhabited aggregate state-model DTO families, public registered-type catalog, duplicate Eyes acceptance documents, and test-only arbitrary runtime writers are gone; immutable worker launches plus typed family requests and atomic admission receipts own launch ancestry and downstream work creation. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Resume the registered-document and test-liability audit after exact fdefb889. Delete only complete dead authority slices and tests with no consequential claim. Preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, terminal Self provenance, typed frontier planning, Persona consequences, exact native/provider requests, governed tool receipts, and the complete unrun Model Atlas vertical slice. Component tests are not collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
+  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,346 physical lines, 50 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Sessions and jobs carry only lifecycle identity/status; terminal result documents own summaries and artifacts. Generic session/job creation is gone; real family launch, model execution, and coordinator owners create runtime physiology. All persisted family launch-binding documents, the standalone verdict-driven Modeling writer, coordinator artifact/status cargo, uninhabited aggregate state-model DTO families, public registered-type catalog, duplicate Eyes acceptance documents, test-only arbitrary runtime writers, and duplicate Persona delivery evidence are gone; immutable worker launches plus typed family requests and atomic admission receipts own launch ancestry and downstream work creation. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Continue the registered-document and test-liability audit after exact b3e9b229. Delete only complete dead authority slices and tests with no consequential claim. Preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, terminal Self provenance, typed frontier planning, Persona consequences, exact native/provider requests, governed tool receipts, and the complete unrun Model Atlas vertical slice. Component tests are not collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
 
-  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. Session/job documents carry lifecycle identity and status; terminal job results carry summaries, evidence, artifacts, and decision-context identity. Completed model-session retention writes one private resurrection tombstone; archived worker retention keeps exact request/terminal identity, deletion digest, decision context, structured result, and terminal job records. Mind/runtime writable epochs are v10/v35. Runtime identity and swarm binding retain explicit epoch fields; their child physiology, Hands consequence, and repository-frontier documents rely on CultCache type/schema identity rather than carrying fixed duplicate metadata. Sealed worker contexts keep exact model-input schema and contract. Autonomous proposal promotion commits one proposal/request pair; the request owns its exact origin identities. Research coverage derives from the exact structured result and `Eyes.frontier_research` commit receipt, not a companion packet. Family launch CAS, model execution, and coordinator opening are the only session/job creation owners. The spine is 9,347 physical lines with 50 public functions and 25 public structs. Continue subtraction by tracing each public surface and verifier to a live consumer and consequential invariant; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
+  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. Session/job documents carry lifecycle identity and status; terminal job results carry summaries, evidence, artifacts, and decision-context identity. Completed model-session retention writes one private resurrection tombstone; archived worker retention keeps exact request/terminal identity, deletion digest, decision context, structured result, and terminal job records. Mind/runtime writable epochs are v10/v36. Runtime identity and swarm binding retain explicit epoch fields; their child physiology, Hands consequence, and repository-frontier documents rely on CultCache type/schema identity rather than carrying fixed duplicate metadata. Sealed worker contexts keep exact model-input schema and contract. Autonomous proposal promotion commits one proposal/request pair; the request owns its exact origin identities. Research coverage derives from the exact structured result and `Eyes.frontier_research` commit receipt, not a companion packet. Persona delivery consequence identity belongs to the social terminal while Bifrost retains the signed crossing request/receipt. Family launch CAS, model execution, and coordinator opening are the only session/job creation owners. The spine is 9,346 physical lines with 50 public functions and 25 public structs. Continue subtraction by tracing each public surface and verifier to a live consumer and consequential invariant; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.