Order Hands gate mirrors by creation time

epiphany-core/src/cultmesh_integration.rs

@@ -2986,7 +2986,14 @@ pub fn write_epiphany_cultmesh_hands_action_gate(
     let mut node = open_epiphany_cultmesh_node(&store_path, gate.runtime_id.clone())?;
     let gate_key = epiphany_cultmesh_hands_action_gate_key(&gate.gate_id);
     let written = node.put(gate_key.as_str(), &gate)?;
-    node.put(EPIPHANY_CULTMESH_HANDS_ACTION_GATE_LATEST_KEY, &written)?;
+    let current_latest = node.get::<EpiphanyCultMeshHandsActionGateEntry>(
+        EPIPHANY_CULTMESH_HANDS_ACTION_GATE_LATEST_KEY,
+    )?;
+    if current_latest.as_ref().is_none_or(|current| {
+        hands_action_gate_event_key(&written) >= hands_action_gate_event_key(current)
+    }) {
+        node.put(EPIPHANY_CULTMESH_HANDS_ACTION_GATE_LATEST_KEY, &written)?;
+    }
     node.flush()?;
     Ok(written)
 }
@@ -3208,9 +3215,22 @@ fn validate_hands_action_gate(gate: &EpiphanyCultMeshHandsActionGateEntry) -> Re
             "Hands action gate CultMesh mirror has an empty path, receipt, or command argument"
         ));
     }
+    DateTime::parse_from_rfc3339(&gate.created_at_utc).map_err(|error| {
+        anyhow!("Hands action gate CultMesh mirror has invalid created at: {error}")
+    })?;
     Ok(())
 }
 
+fn hands_action_gate_event_key(
+    gate: &EpiphanyCultMeshHandsActionGateEntry,
+) -> (DateTime<FixedOffset>, &str) {
+    (
+        DateTime::parse_from_rfc3339(&gate.created_at_utc)
+            .expect("validated Hands action gate timestamp"),
+        gate.gate_id.as_str(),
+    )
+}
+
 fn validate_role_review_event(event: &EpiphanyCultMeshRoleReviewEventEntry) -> Result<()> {
     if event.private_state_exposed {
         return Err(anyhow!(
@@ -7682,6 +7702,33 @@ mod tests {
                 .is_some()
         );
 
+        let mut newer = gate.clone();
+        newer.gate_id = "hands-intent-newer:hands-review-newer".to_string();
+        newer.hands_intent_id = "hands-intent-newer".to_string();
+        newer.hands_review_id = "hands-review-newer".to_string();
+        newer.created_at_utc = "2026-06-18T01:00:00Z".to_string();
+        write_epiphany_cultmesh_hands_action_gate(&store, newer.clone())?;
+
+        let mut delayed = gate.clone();
+        delayed.gate_id = "hands-intent-delayed:hands-review-delayed".to_string();
+        delayed.hands_intent_id = "hands-intent-delayed".to_string();
+        delayed.hands_review_id = "hands-review-delayed".to_string();
+        delayed.created_at_utc = "2026-06-17T23:00:00Z".to_string();
+        write_epiphany_cultmesh_hands_action_gate(&store, delayed)?;
+        assert_eq!(
+            load_latest_epiphany_cultmesh_hands_action_gate(&store, "epiphany-test")?,
+            Some(newer)
+        );
+
+        let mut invalid_time = gate.clone();
+        invalid_time.gate_id = "hands-intent-invalid:hands-review-invalid".to_string();
+        invalid_time.hands_intent_id = "hands-intent-invalid".to_string();
+        invalid_time.hands_review_id = "hands-review-invalid".to_string();
+        invalid_time.created_at_utc = "not-a-time".to_string();
+        let err = write_epiphany_cultmesh_hands_action_gate(&store, invalid_time)
+            .expect_err("invalid Hands gate time must be refused");
+        assert!(err.to_string().contains("invalid created at"));
+
         let mut leaked = gate;
         leaked.private_state_exposed = true;
         let err = write_epiphany_cultmesh_hands_action_gate(&store, leaked)

notes/conceptual-substitution-audit-2026-07-12.md

@@ -521,3 +521,13 @@ start/completion/next-wake values, reject completion before start, and order the
 latest mirror by `(completion time, iteration, receipt ID)`. A planned wake may
 be overdue when a long tick completes; lateness remains observable rather than
 being rejected as impossible.
+
+## Last writer presented as current Hands gate
+
+The operator-safe `hands-action-gate/latest` mirror was overwritten by arrival
+order. Although runtime-spine receipts remain the real action authority, a
+delayed older mirror could advertise obsolete paths and a stale record-pass
+command as the current actuator route. Hands gate mirrors now require a valid
+RFC3339 creation time and advance `latest` only by `(creation time, gate ID)`.
+Tests prove delayed older gates remain historical and malformed gate time is
+refused.

notes/fresh-workspace-handoff.md

@@ -134,6 +134,8 @@ The confirmed conceptual substitutions have been cut:
 - Scheduler `latest` is likewise completion-time-owned. Tick timestamps are
   validated, reversed intervals are refused, and delayed replay cannot rewind
   the scheduler projection.
+- `hands-action-gate/latest` is creation-time-owned. Delayed mirror replay
+  cannot advertise obsolete actuator scope or record-pass commands as current.
 
 The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it.
 

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; Idunn lifecycle and scheduler latest mirrors are validated event-time projections rather than attention- or arrival-owned state. Continue auditing other projection/cache latest mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.
+  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; Idunn lifecycle, scheduler, and Hands gate latest mirrors are validated event-time projections rather than arrival-owned state. Continue auditing other security- or actuation-relevant latest mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.