Correct receipt projection ownership

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -6738,7 +6738,11 @@ fn receipt_directory_report(
         &mut tui_rows,
         ReceiptDirectoryRow {
             family: "eve-connection".to_string(),
-            owner: "Odin/Eve".to_string(),
+            owner: context
+                .latest_eve_connection_receipt
+                .as_ref()
+                .map(|receipt| receipt.target_cluster_id.clone())
+                .unwrap_or_else(|| "target-provider".to_string()),
             document_kind: "epiphany.cultmesh.eve_connection_receipt.v0".to_string(),
             latest_id: context
                 .latest_eve_connection_receipt
@@ -7014,7 +7018,7 @@ fn receipt_directory_report(
         &mut tui_rows,
         ReceiptDirectoryRow {
             family: "work-loop".to_string(),
-            owner: "Hands/Soul/Modeling".to_string(),
+            owner: "Self".to_string(),
             document_kind: "epiphany.cultmesh.work_loop_telemetry.v0".to_string(),
             latest_id: context
                 .latest_work_loop_summary

notes/conceptual-substitution-audit-2026-07-12.md

@@ -1340,3 +1340,21 @@ contained by `origin/main`; it explicitly denies merge, push, and sync. The
 operator half of the old OR seal was fictional. The contract now names Bifrost
 as proof owner and independently requires the Maintainer review receipt. Actual
 publication and push remain outside this request family.
+
+## Projection labels are not topology diagrams
+
+The receipt directory labeled Eve connection receipts `Odin/Eve`, although the
+receipt belongs to its target provider and Odin only supplies rendezvous. The
+row now uses the receipt's target cluster id, falling back to `target-provider`
+when absent. Downstream Eve/CultUI lowering remains provider-owned and Epiphany
+does not infer a presentation runtime from the receipt family name.
+
+Work-loop telemetry was labeled `Hands/Soul/Modeling`, turning its stage route
+into a pseudo-owner. Self's coordinator/nervous-system path writes the telemetry;
+the source and target stages remain in status/route fields. The row now reports
+Self as owner.
+
+The repo-work stage lens still contains composite labels for grouped safe-action
+families (`Persona/Odin/Eve` and `Mind/Soul/Maintainer`). Those groups combine
+families with different authorities and need to be split by family rather than
+given a more attractive shared label.

notes/fresh-workspace-handoff.md

@@ -482,3 +482,10 @@ requires Maintainer review evidence. The fictional operator-or-maintainer gate
 is removed; the request still denies merge, push, sync, and Hands authority.
 Next inspect composite owner labels in operator projections, starting with rows
 that may be interpreted as decision or execution ownership.
+
+Receipt-directory projection cleanup has started. Eve connection rows now name
+the target provider cluster rather than `Odin/Eve`; work-loop telemetry names
+Self rather than its Hands/Soul/Modeling stage route. The next projection scar
+is `repo_work_stage_for_family`: it groups distinct collaboration and governance
+families under composite owners. Split those stage groups by actual family
+authority; do not merely rename the composites.

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the beyond-closure composite-owner purge. repo.sync_request is now correctly modeled as Bifrost-owned ancestry proof with separate Maintainer review evidence and no operator, push, merge, sync, or Hands authority. Next inspect and repair composite owner labels in operator projections, starting with rows that could be mistaken for decision or execution ownership. Distinguish participant lists from owners and preserve closure's zero-substring invariant.
+  next_action: Continue the projection-owner purge. Receipt directory now assigns Eve connection receipts to the target provider cluster rather than Odin/Eve and assigns work-loop telemetry to Self rather than its Hands/Soul/Modeling route. Next split repo_work_stage_for_family's composite collaboration and governance stage groups by actual safe-family authority; do not rename a mixed group into another pseudo-owner. Preserve closure's zero-substring invariant.