Map runtime-owned Imagination output

notes/epiphany-current-algorithmic-map.md

@@ -3714,3 +3714,39 @@ payload. This proves the decision-input cut at the deployed CultCache layer,
 not merely by source inspection: unrelated typed cargo can neither steer the
 decision nor be silently repaired by it. Receipts live under
 `.epiphany-run/narrow-verse-readers-ec54666c`.
+
+## Runtime-owned Imagination candidate publication
+
+The Imagination consideration result already entered through
+`put_runtime_role_worker_result`, which authenticates the current request,
+candidate causal fields and timestamp, deterministic candidate identity, exact
+single launch binding, worker launch document hash, Imagination role/binding,
+runtime/thread identity, current model projection, and absence of foreign
+authority cargo. Before `ff9dacf1`, that owner persisted the generic result and
+terminal process claim but not the candidate it had just authenticated.
+Resident fulfillment consequently required a typed candidate envelope with no
+production writer; tests supplied one directly and concealed the cut.
+
+Runtime result admission now owns one atomic publication:
+
+- Inputs: exact request, candidate bytes, launch binding, worker launch,
+  process claim, and current model projection.
+- Outputs: immutable worker result, terminal process claim, and exact typed
+  `ImaginationConsiderationCandidate` companion in one snapshot-fenced CAS.
+- Derived state: resident fulfillment observes the admitted result/candidate;
+  it does not write either document.
+- Forbidden writers: resident settlement, review routing, tests, and operator
+  projections cannot synthesize the candidate companion.
+- Cut line: an existing candidate without its worker result is an orphan and
+  refuses admission; exact result replay requires the persisted companion to
+  remain equal.
+
+The focused atomic/idempotent, orphan-refusal, and receipt-free resident tests
+pass, and the full core library passes 670 tests with one intentional ignore.
+Exact Linux release
+`sha256-6d237cda95de91d999de7403d843507fac89f1f2c091b114957a33118063a03b`
+with witness
+`sha256-3b37136d34e4d4b886544102ec43a258510e246d762640a686b02b29fb13fafc`
+passed 24-binary inspection and a copied c006 braked-once zero-exit gate without
+changing runtime, Mind, or Heartbeat stores. A genuine packaged model-produced
+consideration remains the verification layer for the new writer.

notes/fresh-workspace-handoff.md

@@ -1,5 +1,46 @@
 # Fresh workspace handoff
 
+## Runtime-owned Imagination candidate publication packaged - 2026-08-11
+
+The Imagination option-generation audit found a production ownership hole:
+runtime result admission authenticated the request, candidate, launch binding,
+worker launch, model projection, and foreign-cargo exclusion, but persisted only
+the generic worker result. Resident fulfillment required a separate typed
+candidate envelope that tests wrote by hand. No production owner existed.
+
+Exact pushed `ff9dacf1` makes the existing runtime result-admission CAS own the
+candidate companion alongside the worker result and terminal process claim.
+Exact replay requires the companion to remain byte-equal. A pre-existing orphan
+candidate refuses the worker result without writing it. The resident settlement
+test no longer seeds candidate state manually. Focused atomic, orphan, and
+receipt-free settlement tests pass; the full core library passes 670 tests with
+one intentional cross-process helper ignored.
+
+Exact `ff9dacf1` packages 24 Linux binaries as release
+`sha256-6d237cda95de91d999de7403d843507fac89f1f2c091b114957a33118063a03b`
+with witness
+`sha256-3b37136d34e4d4b886544102ec43a258510e246d762640a686b02b29fb13fafc`.
+The release build took 5m11s with zero warnings and exact packaged inspection
+passed. One rejected launch accidentally retained stale `ec54666c` source after
+a bad expanded fetch SHA; it was stopped immediately and its logs/output remain
+quarantined in the same receipt directory. The corrected source volume was
+authenticated to the full `ff9dacf1` SHA before the accepted build. Receipts are
+under `.epiphany-run/linux-package-ff9dacf1`.
+
+On copied c006 volumes, the exact release published and `epiphany-swarm once`
+exited zero under the cognitive brake at resident revision 34 with no active
+turn. Runtime, Mind, and Heartbeat stores were byte-identical; only resident
+provider-readiness metadata advanced to the new release identity. The stopped
+one-shot then projected `warming`, correctly refusing to impersonate a live
+provider. Receipts are under `.epiphany-run/imagination-ff9dacf1`.
+
+Source and package ownership are accepted. A genuine model-produced copied
+turn remains required: admit one fresh Persona-feedback consideration through
+the existing typed ingress, run exact `ff9dacf1`, and prove result plus candidate
+appear atomically while model/frontier/Hands/release/deployment authority stays
+unchanged. Do not use a fixture candidate writer. Actual c006 remains exact
+`c9a2a979`, alive and braked. Yggdrasil never builds.
+
 ## Exact local-Verse reader isolation accepted - 2026-08-11
 
 Exact pushed `ec54666c` packages 24 Linux binaries as release

state/map.yaml

@@ -36,9 +36,9 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Exact c9a2a979 remains live and braked on actual c006 at resident revision 34. Exact ec54666c packages as Linux release sha256-4d7347980f2fad658ebc6206b0435f29e1151cfbb75ec2806a8df2d5eb7f63bd with witness sha256-d5e6671cd70e1aeb3df21d1e69fb015b831e2c63c272d7ef3e3bf5f61aac15d1. On copied named-volume state, restart-policy writing, direct single-daemon reconciliation, and single-target Verse poke produced identical decisions with and without a deliberately malformed unrelated registered-family envelope; every original row, including the hostile envelope, remained byte-identical. All surviving aggregate readers own explicit multi-family projections.
+  latest_phase: Exact c9a2a979 remains live and braked on actual c006 at resident revision 34. Exact ff9dacf1 moves Imagination candidate persistence into the runtime-owned worker-result CAS: result, terminal process claim, and typed candidate companion now publish atomically; orphan companion state refuses admission. All 670 active core tests pass with one intentional ignore. Exact Linux release sha256-6d237cda95de91d999de7403d843507fac89f1f2c091b114957a33118063a03b with witness sha256-3b37136d34e4d4b886544102ec43a258510e246d762640a686b02b29fb13fafc passed 24-binary inspection and copied c006 braked once with zero exit and byte-identical runtime, Mind, and Heartbeat stores.
   operational_state:
-    local_worktree: exact_ec54666c_narrow_verse_reader_package_and_hostile_cargo_gate_accepted
+    local_worktree: exact_ff9dacf1_imagination_candidate_atomic_writer_packaged_copied_brake_gate_accepted
     operator_wireguard: restored
     starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
     yggdrasil: canonical_small_public_crossing_body
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_alive_braked_revision_34_after_two_receipt_bound_continuation_grants
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, and Docker named-volume atomic snapshot visibility are accepted live. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake; the accepted ec54666c cut changes operator query/supervisor paths and does not justify resident-provider churn. Map the next incomplete organ boundary in Imagination option generation from typed request through authenticated candidate without adoption or Hands authority, then run one bounded copied-state package proof before any actual wake. Yggdrasil never builds.
+  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. On copied state only, create one fresh admitted Persona-feedback consideration request through existing typed ingress, run exact packaged ff9dacf1 through the real model provider, and require worker result plus candidate companion to appear atomically while model, frontier, Hands, release, and deployment authority remain byte-identical. Do not manufacture the candidate with a fixture writer. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -83,7 +83,7 @@ organ_readiness:
   self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, and causal Research/Soul-to-Modeling routing are live. Broader autonomous frontier turnover remains open.
   eyes: proven for one bounded Windows challenged-claim circuit and one coordinated Linux resident circuit. Linux Eyes job eaf25324 invoked exactly three governed native read-only source tools, completed a typed role result, and was accepted as evidence ev-research-856fb6d1 with no external consequence. Broader source coverage remains open.
   modeling: proven for the current bounded Windows circuit and the causal Linux resident Eyes-to-Modeling route. Modeling job 3333e537 invoked three governed read-only tool rounds, completed typed result result-worker-3333e537, and was accepted as ev-modeling-11da531d. Modeling acceptance is newer than Research and modelingResultAcceptedAfterResearch is true, proving the single-use causal route was consumed. Broader Body-map coverage remains open.
-  imagination: proven for three bounded live circuits plus exact packaged receipt-free settlement. Fresh authenticated request/model/candidate/launch/result state with zero coordinator receipts closed the original resident grant recovered-fulfilled, retained the lifecycle without retry, and never adopted the proposal or granted Hands. Broader option generation remains open.
+  imagination: proven for three bounded live circuits plus exact packaged receipt-free settlement. Fresh authenticated request/model/candidate/launch/result state with zero coordinator receipts closed the original resident grant recovered-fulfilled, retained the lifecycle without retry, and never adopted the proposal or granted Hands. Exact ff9dacf1 makes runtime admission the atomic writer of result, terminal process claim, and typed candidate companion, and refuses orphan companion state; genuine packaged model-produced option generation through that writer remains open.
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
   mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.