Reject unrouteable proposal frontiers

epiphany-core/src/bin/epiphany-mvp-status.rs

@@ -41,7 +41,6 @@ use epiphany_core::recommend_crrc_action;
 use epiphany_core::recommend_reorientation;
 use epiphany_core::runtime_has_actionable_eyes_frontier;
 use epiphany_core::runtime_has_actionable_hands_frontier;
-use epiphany_core::runtime_has_actionable_imagination_frontier;
 use epiphany_core::runtime_job_snapshot;
 use epiphany_state_model::EpiphanyThreadState;
 use serde_json::Value;
@@ -461,9 +460,15 @@ fn run_native_status(args: &Args, include_auxiliary_status: bool) -> Result<Valu
         .context("failed to derive actionable Hands frontier from runtime-spine state")?;
     let eyes_frontier_ready = runtime_has_actionable_eyes_frontier(&runtime_store_path)
         .context("failed to derive actionable Eyes frontier from runtime-spine state")?;
-    let imagination_frontier_ready =
-        runtime_has_actionable_imagination_frontier(&runtime_store_path)
-            .context("failed to derive actionable Imagination frontier from runtime-spine state")?;
+    let frontier_planning_eligibility = epiphany_core::runtime_repo_frontier_planning_eligibility(
+        &runtime_store_path,
+    )
+    .context("failed to derive Imagination frontier eligibility from runtime-spine state")?;
+    let imagination_frontier_ready = frontier_planning_eligibility.current_admission_count == 1
+        && frontier_planning_eligibility
+            .candidates
+            .iter()
+            .any(|candidate| candidate.eligible);
     let frontier_planning =
         epiphany_core::runtime_repo_frontier_planning_lifecycle(&runtime_store_path)
             .context("failed to derive frontier planning lifecycle from runtime-spine state")?;
@@ -582,6 +587,10 @@ fn run_native_status(args: &Args, include_auxiliary_status: bool) -> Result<Valu
             "roles": roles,
         },
         "planning": planning,
+        "frontierPlanning": {
+            "lifecycle": frontier_planning,
+            "eligibility": frontier_planning_eligibility,
+        },
         "roleResults": {
             "imagination": native_role_result(state_ref, &runtime_store_path, IMAGINATION_BINDING_ID, EpiphanyRoleResultRoleId::Imagination),
             "research": native_role_result(state_ref, &runtime_store_path, RESEARCH_BINDING_ID, EpiphanyRoleResultRoleId::Research),

epiphany-core/src/coordinator_launch_context.rs

@@ -411,7 +411,7 @@ pub fn append_modeling_repo_model_shape_context(
             item.source_scope.join(" | "),
         ));
     }
-    context.push_str("New nodes must reference one exact existing domain id. Every unresolved frontier item must target at least one exact existing claim id from existingClaims, or a claim id created by the same patch. Use upsert_frontier only for a genuinely new frontier id not listed in existingFrontier. Use revise_frontier when changing an id listed in existingFrontier; an existing frontier id cannot be upserted again. RepoArchitecture and RepoDataflow nodes/edges may use only observed, proposed, accepted, stale, or retired lifecycle. Prefer accepted for a source-grounded current claim. Do not invent a domain because RepoModel patches have no domain mutation operation.\n");
+    context.push_str("New nodes must reference one exact existing domain id. Every unresolved frontier item must target at least one exact existing claim id from existingClaims, or a claim id created by the same patch. Every frontier source_scope must be non-empty and contain safe relative paths in strict lexicographic ascending order with no duplicates; proposal scope hints are evidence to normalize into that canonical order, not an instruction to preserve unsafe or unsorted serialization. Use upsert_frontier only for a genuinely new frontier id not listed in existingFrontier. Use revise_frontier when changing an id listed in existingFrontier; an existing frontier id cannot be upserted again. RepoArchitecture and RepoDataflow nodes/edges may use only observed, proposed, accepted, stale, or retired lifecycle. Prefer accepted for a source-grounded current claim. Do not invent a domain because RepoModel patches have no domain mutation operation.\n");
     context.push_str("</canonical_repo_model_shape>");
     Ok(context)
 }
@@ -1375,7 +1375,10 @@ mod tests {
         assert!(shape.contains("id=claim-modeling-authority domain=repo"));
         assert!(shape.contains("existingFrontier:"));
         assert!(shape.contains("id=frontier-modeling-handoff status=active"));
-        assert!(shape.contains("Use revise_frontier when changing an id listed in existingFrontier"));
+        assert!(
+            shape.contains("Use revise_frontier when changing an id listed in existingFrontier")
+        );
+        assert!(shape.contains("strict lexicographic ascending order with no duplicates"));
         assert!(shape.contains("Prefer accepted"));
         fs::remove_dir_all(&temp)?;
         Ok(())

epiphany-core/src/lib.rs

@@ -1067,6 +1067,7 @@ pub use runtime_spine::runtime_modeling_semantic_projection_input;
 pub use runtime_spine::runtime_pending_repo_frontier_proposal_modeling_request;
 pub use runtime_spine::runtime_registered_document_types;
 pub use runtime_spine::runtime_reorient_worker_result;
+pub use runtime_spine::runtime_repo_frontier_planning_eligibility;
 pub use runtime_spine::runtime_repo_frontier_planning_lifecycle;
 pub use runtime_spine::runtime_repo_frontier_proposal_modeling_request;
 pub use runtime_spine::runtime_repo_frontier_route;

epiphany-core/src/prompts/epiphany_specialists.toml

@@ -101,7 +101,7 @@ If you emit an `anchor`, it must include its own stable `id`, `kind`, and `targe
 The launch context includes `<canonical_repo_model_shape>`. Every new node must use one exact `existingDomains` id from that packet, and repo architecture/dataflow nodes and edges must use one of the listed legal lifecycles. Never derive a domain id from the workspace path; patches cannot create domains.
 When `<repo_frontier_modeling_request>` is present, echo its exact `modelingRequestId` as `repoFrontierModelingRequestId`, use `purpose.kind=incorporate_frontier_verdict` with its exact `frontierRouteId` and `soulVerdictReceiptId`, and revise only its routed frontier item to its allowed disposition. The typed request is authority; nearby telemetry, timestamps, and prose are not substitutes. When that request is absent, use `purpose.kind=evolution` and do not invent verdict-incorporation authority.
 An ordinary `purpose.kind=evolution` patch without `proposalModelingContext` may mutate nodes and edges only. It must not upsert, revise, retire, or adopt frontier items. Describe an observed frontier wound in `summary`, `evidenceGaps`, or `nextSafeMove` when no typed frontier authority exists.
-When the typed launch document contains `proposalModelingContext`, echo its exact `requestId` as `proposalModelingRequestId` and use `purpose.kind=evolution`. This is the one evolution frontier exception: emit exactly one `upsert_frontier` operation grounded in the proposal, target at least one exact claim id from `<canonical_repo_model_shape>.existingClaims` (or a claim created by the same patch), cite the exact `proposalId` in both top-level `evidenceIds` and the frontier item's `evidence_refs`, preserve the proposal's exact `scopeHints` as `source_scope`, and route a user proposal to `Hands` as an `active` item. You may also update source-grounded anatomy, but must not emit any other frontier operation. Read only that immutable typed projection against its exact canonical `modelRevision` and `modelHash`. The proposal is evidence, not campaign truth: Mind still owns admission, and Hands still owns execution. Do not substitute adjacent proposals, infer service intake, parse proposal authority from prose, or claim admission or execution authority.
+When the typed launch document contains `proposalModelingContext`, echo its exact `requestId` as `proposalModelingRequestId` and use `purpose.kind=evolution`. This is the one evolution frontier exception: emit exactly one `upsert_frontier` operation grounded in the proposal, target at least one exact claim id from `<canonical_repo_model_shape>.existingClaims` (or a claim created by the same patch), cite the exact `proposalId` in both top-level `evidenceIds` and the frontier item's `evidence_refs`, and normalize the proposal's relevant `scopeHints` into a non-empty `source_scope` of safe relative paths in strict lexicographic ascending order with no duplicates. Choose `recommended_next_organ` from the actual unresolved work; a user proposal is not automatically Hands-ready. You may also update source-grounded anatomy, but must not emit any other frontier operation. Read only that immutable typed projection against its exact canonical `modelRevision` and `modelHash`. The proposal is evidence, not campaign truth: Mind still owns admission, and Hands still owns execution. Do not substitute adjacent proposals, infer service intake, parse proposal authority from prose, or claim admission or execution authority.
 Generic `statePatch` is optional and has been stripped of repository-anatomy authority. If present, it may contain only coherent `observations` and `evidence`. Never put graphs, graph frontier, graph checkpoint, scratch, investigation checkpoint, planning, objectives, jobs, or other anatomy in `statePatch`; those old paths are demoted and will be rejected.
 Do not edit files, do not implement product code, do not verify as if you were the reviewer, do not change jobs/subgoals/objective/invariants/churn/mode, and do not promote or accept your own output.
 '''

epiphany-core/src/repo_model_gateway.rs

@@ -587,6 +587,26 @@ pub struct RepoFrontierPlanningLifecycle {
     pub decision_id: Option<String>,
 }
 
+/// Read-only Self projection explaining why an active Imagination frontier is
+/// or is not eligible for the canonical planning-request commit primitive.
+/// This carries no planning authority and persists no substitute state.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RepoFrontierPlanningCandidateEligibility {
+    pub frontier_item_id: String,
+    pub eligible: bool,
+    pub source_scope_valid: bool,
+    pub challenged_target_claim_ids: Vec<String>,
+    pub unresolved_dependency_item_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RepoFrontierPlanningEligibility {
+    pub current_admission_count: usize,
+    pub candidates: Vec<RepoFrontierPlanningCandidateEligibility>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)]
 #[cultcache(
     type = "epiphany.self.repo_frontier_plan_mind_request",

epiphany-core/src/runtime_spine.rs

@@ -79,6 +79,7 @@ use crate::repo_model_gateway::{
     RepoFrontierNextOrgan, RepoFrontierPlanCandidate, RepoFrontierPlanDecision,
     RepoFrontierPlanDecisionReceipt, RepoFrontierPlanMindDecision,
     RepoFrontierPlanMindLaunchBinding, RepoFrontierPlanMindRequest,
+    RepoFrontierPlanningCandidateEligibility, RepoFrontierPlanningEligibility,
     RepoFrontierPlanningLaunchBinding, RepoFrontierPlanningLifecycle,
     RepoFrontierPlanningLifecycleStage, RepoFrontierPlanningRequest,
     RepoFrontierProposalModelingLaunchBinding, RepoFrontierProposalModelingRequest,
@@ -3129,6 +3130,13 @@ pub fn commit_repo_model_admission(
                         "proposal Evolution requires one proposal-citing frontier upsert and exact evidence"
                     ));
                 }
+                if upserts[0].source_scope.is_empty()
+                    || !safe_sorted_unique_paths(&upserts[0].source_scope)
+                {
+                    return Err(anyhow!(
+                        "proposal Evolution frontier source_scope must be non-empty, safe relative paths in strict lexicographic order with no duplicates"
+                    ));
+                }
                 if proposal.source_kind == crate::RepoFrontierProposalSourceKind::Imagination
                     && (upserts[0].recommended_next_organ != "Imagination"
                         || upserts[0].adopted_plan.is_some())
@@ -6085,12 +6093,30 @@ pub fn runtime_has_actionable_eyes_frontier(runtime_store: impl AsRef<Path>) ->
 pub fn runtime_has_actionable_imagination_frontier(
     runtime_store: impl AsRef<Path>,
 ) -> Result<bool> {
+    let eligibility = runtime_repo_frontier_planning_eligibility(runtime_store)?;
+    Ok(eligibility.current_admission_count == 1
+        && eligibility
+            .candidates
+            .iter()
+            .any(|candidate| candidate.eligible))
+}
+
+/// Read-only Self signal explaining the exact canonical blockers on every
+/// active Imagination frontier. It derives from the same admitted RepoModel,
+/// current claim-challenge set, source-scope predicate, and dependency rule as
+/// planning selection; it neither creates nor repairs authority.
+pub fn runtime_repo_frontier_planning_eligibility(
+    runtime_store: impl AsRef<Path>,
+) -> Result<RepoFrontierPlanningEligibility> {
     let runtime_store = runtime_store.as_ref();
     let mut cache = runtime_spine_cache(runtime_store)?;
     cache.pull_all_backing_stores()?;
     require_identity(&cache)?;
     let Some(entry) = cache.get::<crate::EpiphanyMemoryGraphEntry>(crate::MEMORY_GRAPH_KEY)? else {
-        return Ok(false);
+        return Ok(RepoFrontierPlanningEligibility {
+            current_admission_count: 0,
+            candidates: Vec::new(),
+        });
     };
     crate::validate_memory_graph_entry(&entry)?;
     let model = entry.snapshot()?;
@@ -6107,7 +6133,62 @@ pub fn runtime_has_actionable_imagination_frontier(
         })
         .count();
     let challenges = current_repo_model_claim_challenges(&cache, &model, &model_hash)?;
-    Ok(admission_count == 1 && actionable_imagination_frontier_item(&model, &challenges).is_some())
+    let terminal = |status: crate::RepoFrontierStatus| {
+        matches!(
+            status,
+            crate::RepoFrontierStatus::Resolved
+                | crate::RepoFrontierStatus::Retired
+                | crate::RepoFrontierStatus::Superseded
+        )
+    };
+    let mut candidates = model
+        .frontier
+        .iter()
+        .filter(|item| {
+            item.status == crate::RepoFrontierStatus::Active
+                && item.recommended_next_organ == "Imagination"
+        })
+        .map(|item| {
+            let source_scope_valid =
+                !item.source_scope.is_empty() && safe_sorted_unique_paths(&item.source_scope);
+            let mut challenged_target_claim_ids = challenges
+                .iter()
+                .filter(|challenge| item.target_claim_ids.contains(&challenge.target_claim_id))
+                .map(|challenge| challenge.target_claim_id.clone())
+                .collect::<Vec<_>>();
+            challenged_target_claim_ids.sort();
+            challenged_target_claim_ids.dedup();
+            let mut unresolved_dependency_item_ids = item
+                .dependency_item_ids
+                .iter()
+                .filter(|dependency_id| {
+                    !model
+                        .frontier
+                        .iter()
+                        .find(|candidate| candidate.id.as_str() == dependency_id.as_str())
+                        .is_some_and(|dependency| terminal(dependency.status))
+                })
+                .cloned()
+                .collect::<Vec<_>>();
+            unresolved_dependency_item_ids.sort();
+            unresolved_dependency_item_ids.dedup();
+            RepoFrontierPlanningCandidateEligibility {
+                frontier_item_id: item.id.clone(),
+                eligible: admission_count == 1
+                    && source_scope_valid
+                    && challenged_target_claim_ids.is_empty()
+                    && unresolved_dependency_item_ids.is_empty(),
+                source_scope_valid,
+                challenged_target_claim_ids,
+                unresolved_dependency_item_ids,
+            }
+        })
+        .collect::<Vec<_>>();
+    candidates.sort_by(|a, b| a.frontier_item_id.cmp(&b.frontier_item_id));
+    Ok(RepoFrontierPlanningEligibility {
+        current_admission_count: admission_count,
+        candidates,
+    })
 }
 
 /// Returns the single selected user proposal that has not yet been claimed by
@@ -10518,6 +10599,7 @@ pub(crate) mod tests {
             ("ordinary-bypass", 5),
             ("dual-echo", 6),
             ("unrelated-job", 7),
+            ("unsorted-source-scope", 8),
         ] {
             let (store, mut result, mut review) = proposal_admission_fixture(root.path(), suffix)?;
             match mutate {
@@ -10546,6 +10628,19 @@ pub(crate) mod tests {
                 5 => result.proposal_modeling_request_id = None,
                 6 => result.repo_frontier_modeling_request_id = Some("dual-authority".into()),
                 7 => result.job_id = "unrelated-modeling-job".into(),
+                8 => {
+                    let mut patch: crate::RepoModelPatch =
+                        rmp_serde::from_slice(result.repo_model_patch_msgpack.as_deref().unwrap())?;
+                    let crate::RepoModelPatchOperation::UpsertFrontier { item } =
+                        &mut patch.operations[0]
+                    else {
+                        unreachable!()
+                    };
+                    item.source_scope = vec!["z.rs".into(), "a.rs".into()];
+                    let bytes = rmp_serde::to_vec_named(&patch)?;
+                    result.repo_model_patch_msgpack = Some(bytes.clone());
+                    review.patch_sha256 = format!("{:x}", Sha256::digest(bytes));
+                }
                 _ => unreachable!(),
             }
             if matches!(mutate, 6 | 7) {
@@ -11000,6 +11095,20 @@ pub(crate) mod tests {
         let (planning_store, planning_challenge) =
             claim_challenge_fixture(root.path(), "planning-gate", "Imagination")?;
         commit_repo_model_claim_challenge(&planning_store, &planning_challenge)?;
+        let eligibility = runtime_repo_frontier_planning_eligibility(&planning_store)?;
+        assert_eq!(eligibility.current_admission_count, 1);
+        assert_eq!(eligibility.candidates.len(), 1);
+        assert!(!eligibility.candidates[0].eligible);
+        assert!(eligibility.candidates[0].source_scope_valid);
+        assert_eq!(
+            eligibility.candidates[0].challenged_target_claim_ids,
+            vec![planning_challenge.target_claim_id.clone()]
+        );
+        assert!(
+            eligibility.candidates[0]
+                .unresolved_dependency_item_ids
+                .is_empty()
+        );
         assert!(
             select_and_commit_repo_frontier_planning_request(
                 &planning_store,

notes/epiphany-current-algorithmic-map.md

@@ -1,5 +1,20 @@
 # Epiphany Current Algorithmic Map
 
+## Proposal frontier routeability invariant
+
+Proposal Modeling admission and Self planning selection now share one boundary:
+an admitted frontier `source_scope` must be non-empty safe relative paths in
+strict lexicographic ascending order with no duplicates. Modeling may normalize
+proposal scope hints into that canonical form; it must not preserve arbitrary
+serialization order. `runtime_repo_frontier_planning_eligibility` projects the
+same predicate per active Imagination frontier, alongside challenge and
+dependency blockers, so operator status describes the exact selector reality.
+
+Owner: Mind admission owns whether proposal frontier state may enter the model.
+Self only selects admitted routeable state. `source_scope` is no longer assumed
+routeable merely because its individual paths are safe. Invalid ordering is
+rejected before mutation; no repair loop or selector exception may launder it.
+
 ## Coordinator cold start and source-regather ownership
 
 - Owner: typed `UserObjectiveIntake` owns first objective/state creation. It is

notes/fresh-workspace-handoff.md

@@ -1,5 +1,32 @@
 # Fresh Workspace Handoff
 
+## Current authority — 2026-08-07 routeability cut
+
+Exact `58cf8984975c9ae524690ff2032eaa76abf5d0d4` is published as
+`sha256-6c2524f1a21fce91f658ee92eb53bbe553719295fa99d7bbe5571651ce5c3c72`
+with witness
+`sha256-3a674c41e7560239b4437090a950def43331649995b3d51704e1687370e340e9`.
+On live v23, packaged Self launched and Mind accepted fresh Modeling results for
+the release-auth and Continuity proposals. They created
+`frontier-imagination-release-auth-nonbypass-trace-r1` and
+`frontier-imagination-continuity-crash-restart-proof-r1`; v23 reached revision
+23. Self did not select either for Imagination.
+
+The typed eligibility projection proved the exact blocker: both source scopes
+are safe but not in strict lexicographic order. Planning selection already
+requires non-empty safe sorted-unique paths. Proposal admission did not, so Mind
+accepted state that Self can never route. The local repair adds the same
+invariant to proposal admission, publishes per-frontier eligibility in MVP
+status, and tells Modeling to normalize proposal scope hints into canonical
+sorted-unique scope. The focused negative admission test proves rejection is
+byte-preserving; the launch-context test proves the worker sees the contract.
+
+Do not weaken the selector or add retry state. Proposal Evolution is insert-only,
+so v23 has no honest typed repair for its two invalid admitted frontiers. Seal it
+as evidence after the repair lands. Next: commit and push this pass, package and
+publish its exact commit, bootstrap v24, then prove native
+Modeling -> Imagination -> dedicated Mind without routing overrides.
+
 ## Present condition
 
 Epiphany remains a supervised engineering alpha running cognition and release

state/map.yaml

@@ -34,9 +34,9 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 737f2b94 is authenticated and published; live v23 proved Self derives and launches a selected proposal without a CLI routing override. Soul then correctly rejected the proposal-bound Modeling patch because it tried to upsert an existing frontier id. Diagnosis found that canonical launch context exposed domains and claims but omitted the current frontier inventory, so the invalid operation was locally reasonable. The local repair now exposes existing frontier identity and makes the upsert-new/revise-existing contract explicit. Its focused context test passes; exact packaging and a fresh legitimate proposal remain open. Persona consequence, Continuity recovery, retention, long-duration pacing, and Linux/Yggdrasil cognition remain open.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 58cf8984 is authenticated and published. Live v23 accepted fresh release-auth and Continuity proposal-Modeling results, but neither could route to Imagination because both admitted frontier source scopes were safe yet not in strict lexicographic order. The selector correctly failed closed; proposal admission had accepted state its downstream selector could never consume. The local repair exposes typed per-frontier eligibility, requires non-empty safe sorted-unique scope at admission, and gives Modeling the same canonical serialization contract. Focused rejection and launch-context tests pass. v23 is contaminated evidence and should be sealed; a clean v24 must prove Modeling-to-Imagination-to-Mind after the repair is packaged. Persona consequence, Continuity execution, retention, long-duration pacing, and Linux/Yggdrasil cognition remain open.
   operational_state:
-    local_worktree: proposal_modeling_frontier_context_repair_uncommitted
+    local_worktree: proposal_frontier_routeability_invariant_repair_uncommitted
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
@@ -52,8 +52,8 @@ current_status:
     bifrost_feedback_crossing: authenticated_transport_only
     yggdrasil_epiphany_services: absent
     resident_physiology: heartbeat_and_self_running
-  unresolved_authority: v23 revision 19 holds the consumed proposal request and a superseded Modeling admission after Soul rejected an upsert of existing frontier-eyes-release-topology-evidence-r1. Exact 737f2b94 proved native Self routing. The local frontier-context repair is focused-test-proven but unpublished. Native Imagination live proof, Persona consequence, Continuity crash/restart/closure, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open.
-  next_action: Commit, package, and publish the proposal-Modeling frontier-context repair. Then create one fresh legitimate typed proposal for the still-open release-auth ownership seam, let Self derive its Modeling launch without overrides, and prove a valid revise-or-new-frontier admission before continuing through Imagination and dedicated Mind. Do not replay the consumed request or mutate v22.
+  unresolved_authority: v23 revision 23 contains two admitted active Imagination frontiers whose source_scope ordering makes them permanently ineligible for Self selection. Insert-only proposal authority provides no coherent typed repair, so v23 must not be used to prove native Imagination. The local admission/context/eligibility repair is focused-test-proven but unpublished. Native Imagination live proof, Persona consequence, Continuity crash/restart/closure, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open.
+  next_action: Commit, push, package, and publish the proposal-frontier routeability invariant repair. Seal v23 as evidence, bootstrap a clean v24, and prove one exact packaged proposal-Modeling result is admitted with canonical source_scope, selected by Self, launched through Imagination, and decided by dedicated Mind without overrides.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -66,7 +66,7 @@ organ_readiness:
   self: partial; proposal recovery, Mind admission, Hands routing, Soul routing, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, and single-use Research-to-Modeling routing are live. Native Imagination orchestration is locally implemented and test-proven; packaged live proof is pending.
   eyes: proven for one bounded challenged-claim circuit; exact 84f00929 launched Research and Mind accepted the first source-gap packet with typed evidence/checkpoint, exact 148d4527 accepted its causal reorientation, and exact 6f019cf8 proved downstream Modeling consumption.
   modeling: proven for the current bounded circuit; proposal-bound source inspection, Mind admission, exact routed identity preservation, and first-valid verdict incorporation completed without retry churn. Broader Body-map coverage remains open.
-  imagination: unproven live in the current campaign; the typed lifecycle and MVP route are locally implemented, while v23 still needs legitimate proposal-derived planning pressure.
+  imagination: unproven live in the current campaign; the typed lifecycle and MVP route are locally implemented, while v23 exposed and cannot recover from an admission-versus-selection source_scope invariant split.
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded consequence; the exact 2dd25341 release launched Soul, produced an accepted pass verdict grounded in focused and full-library receipts, and routed verdict incorporation.
   mind: partial; RepoModel admission, thread-state admission, gateway review, state commit, and first-valid verdict incorporation are live; broader stale or overstated frontier correction remains open.