diff --git a/epiphany-core/src/bin/epiphany-verse-query.rs b/epiphany-core/src/bin/epiphany-verse-query.rs index 7243bc15..e496fb4d 100644 --- a/epiphany-core/src/bin/epiphany-verse-query.rs +++ b/epiphany-core/src/bin/epiphany-verse-query.rs @@ -7765,24 +7765,7 @@ fn service_lifecycle_receipt_for_directory<'a>( receipts: &'a [EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry], cluster: bool, ) -> Option<&'a EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry> { - latest_service_lifecycle_attention_receipt(receipts, cluster) - .or_else(|| latest_service_lifecycle_receipt(receipts, cluster)) -} - -fn latest_service_lifecycle_attention_receipt<'a>( - receipts: &'a [EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry], - cluster: bool, -) -> Option<&'a EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry> { - receipts - .iter() - .filter(|receipt| is_cluster_service_lifecycle_receipt(receipt) == cluster) - .filter(|receipt| { - receipt.private_state_exposed - || service_lifecycle_status_needs_attention(&receipt.status) - }) - .max_by(|left, right| { - service_lifecycle_receipt_sort_key(left).cmp(&service_lifecycle_receipt_sort_key(right)) - }) + latest_service_lifecycle_receipt(receipts, cluster) } fn latest_service_lifecycle_receipt_for_action<'a>( @@ -9716,3 +9699,63 @@ fn required_list(values: &Option>, message: &str) -> Result EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry { + EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry { + schema_version: EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_SCHEMA_VERSION + .to_string(), + receipt_id: id.to_string(), + service_id: "epiphany-daemon-supervisor-service".to_string(), + scheduler_id: "epiphany-daemon-supervisor".to_string(), + runtime_id: "projection-test".to_string(), + daemon_selector: "epiphany-daemon-self".to_string(), + action: "windows-service-reconcile".to_string(), + status: status.to_string(), + command: "powershell.exe".to_string(), + args: Vec::new(), + cwd: None, + process_id: None, + exit_code: Some(0), + started_at_utc: completed_at.to_string(), + completed_at_utc: Some(completed_at.to_string()), + operator_artifact_ref: format!("test://{id}"), + private_state_exposed: false, + notes: Vec::new(), + executable_sha256: String::new(), + schema_catalog_sha256: String::new(), + preflight_witness_id: String::new(), + required_document_types: Vec::new(), + schema_preflight_passed: false, + } + } + + #[test] + fn lifecycle_directory_uses_new_recovery_over_old_failure() { + let receipts = vec![ + receipt("old-failure", "query-failed", "2026-07-13T01:00:00Z"), + receipt("new-recovery", "in-sync", "2026-07-13T02:00:00Z"), + ]; + let selected = service_lifecycle_receipt_for_directory(&receipts, false).unwrap(); + assert_eq!(selected.receipt_id, "new-recovery"); + assert!(!service_lifecycle_status_needs_attention(&selected.status)); + } + + #[test] + fn lifecycle_directory_does_not_hide_new_failure_behind_old_recovery() { + let receipts = vec![ + receipt("old-recovery", "in-sync", "2026-07-13T01:00:00Z"), + receipt("new-failure", "query-failed", "2026-07-13T02:00:00Z"), + ]; + let selected = service_lifecycle_receipt_for_directory(&receipts, false).unwrap(); + assert_eq!(selected.receipt_id, "new-failure"); + assert!(service_lifecycle_status_needs_attention(&selected.status)); + } +} diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 5a99f9f5..f3ffc4b5 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -490,3 +490,14 @@ and its smoke manufactured that verdict. The requirement is now `cluster-windows-service-audit: complete`, emitted by actual SCM enumeration. The negative smoke corrupts that observed audit and proves the execution audit becomes incomplete; a copied prior conclusion has no authority. + +## Historical failure presented as current lifecycle state + +The service lifecycle directory selected the newest attention-worthy receipt +before considering the actual newest receipt. Because lifecycle receipts have +no resolution relation, an old failure remained the displayed present forever +after a newer successful reconcile. The reducer now selects the latest event +for each service family; attention is derived from that event. History retains +older failures without letting them impersonate current state. Adversarial +tests prove a newer recovery supersedes an old failure and a newer failure is +not hidden by an old recovery. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 831f48bf..0cfcfa00 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -125,6 +125,9 @@ The confirmed conceptual substitutions have been cut: `installed`. Single-service completion requires SCM status/reconcile; cluster completion requires the observed cluster service audit and cannot cite an earlier copy of its own execution-audit verdict. +- Service lifecycle projection selects the actual latest family event. An old + attention receipt no longer masquerades as current state after recovery; + newer failures still surface immediately. The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index d1e9084e..5c4126b1 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index c1b61b83..521de5eb 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; cluster heartbeat is derived; query smoke cannot author Idunn truth; smoke roots are contained; Idunn no longer republishes caller preflight testimony; install command success is not installed state; cluster execution audit depends on SCM observation rather than its own prior verdict. Continue auditing service configuration claims and projection selection for requested-versus-observed substitution, then inspect remaining caches/adapters and destructive path consumers. + next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; Idunn lifecycle facts are observation-grounded; install command success is not installed state; cluster execution audit depends on SCM observation; lifecycle projection selects the actual latest event instead of pinning historical failure. Continue auditing projection/cache latest-mirror semantics, service configuration claims, adapters, and destructive path consumers for borrowed authority.