Record missing runtime Body binding

notes/fresh-workspace-handoff.md

@@ -3078,3 +3078,14 @@ and rolled back. The successor is crossing Bifrost and Idunn under the all-scope
 brake. Next action: monitor only that exact transaction and require the live
 verification layer above before beginning the ordinary organizational product
 rehearsal. No host reboot is authorized.
+
+Live certification refused `84e648eb` at the correct boundary. The supervisor
+selected the terminal-observer path but emitted `terminal-observation-refused`:
+the Ygg runtime has no repository Body-store binding, so it cannot authenticate
+which repository Body the historical terminal sight belongs to. Idunn withheld
+the deployment witness. The exact Bifrost authority was revoked and only Idunn
+transaction PGID `1597264` was terminated; rollback left `epiphany.service`
+inactive with no current link, active-release document, or deployment witness.
+The next cut is not an observer bypass. Modeling must identify the owner of the
+typed runtime-to-repository Body binding and make that binding available to
+terminal observer authentication, preserving projector-only coverage authority.

state/map.yaml

@@ -796,4 +796,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Exact successor 84e648eb is committed and is crossing Bifrost/Idunn under the all-scope brake; candidate cb665dc6 has been revoked and rolled back. Monitor only the exact Idunn transaction and require live evidence that authenticated terminal sight selects the terminal-observer path, emits terminal-observer-alive without any recovery directive, and preserves the immutable historical terminal sight. Then require three stable services, typed resident readiness, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Live candidate 84e648eb was refused because the Ygg runtime has no repository Body-store binding; its exact Bifrost authority was revoked, exact Idunn PGID 1597264 was terminated, and rollback removed the service/current link/active release/deployment witness. Map the typed runtime-to-repository Body binding owner and feed that binding into terminal observer authentication; do not weaken the observer or let terminal sight fall through to recovery. Then recertify an exact successor under the all-scope brake before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."