Record test-only state surface cut

notes/epiphany-current-algorithmic-map.md

@@ -823,6 +823,12 @@ dispatches to the existing family-specific admission function, emits the same
 family event cargo, and refreshes status once. The target is in-process control
 flow only: it owns no durable state, scheduling, callback table, or CAS law.
 
+Exact `fca516f5` narrows the adjacent inspection surface. Resident-provider
+documents are validated and loaded only inside their readiness owner. Resident
+Self exposes no generic terminal-receipt reader; the consequential verifier
+reads the exact typed envelope. RepoModel basis currentness is checked through
+the cache-owned complete-view validator, with no second path-based assembler.
+
 ## Canonical authority map
 
 | Owner | Inputs | Outputs | Invariant |

notes/epiphany-fork-implementation-plan.md

@@ -249,7 +249,11 @@ result/stop/admit/status skeleton once, and retain family-specific admission
 without adding persisted or registry state. Exact `1a9dec56` lands that cut.
 Continue with a class audit of test-only public readers and validators; demote
 interfaces needed only by consequential Core proofs, and delete those that
-merely manufacture a second authority.
+merely manufacture a second authority. Exact `fca516f5` lands that class cut:
+the terminal-receipt proof now reads the typed envelope in its test, RepoModel
+currentness uses the live cache validator, and resident readiness internals are
+private. Continue at the crate-root export boundary; deterministic causal-ID
+helpers used only inside Core should not masquerade as a public library API.
 
 Resident startup now has one health decision. `derive_resident_cognition_readiness`
 loads the exact provider row, probes the process singleton, and obtains the

notes/fresh-workspace-handoff.md

@@ -2,10 +2,10 @@
 
 Updated: 2026-08-25
 Branch: `codex/epiphany-shakedown-live`
-Latest committed Epiphany source cut: `1a9dec56`
+Latest committed Epiphany source cut: `fca516f5`
 Current connector source: `6dc80f6d266db4d82566d2434adcc55a48e8ecad`
-Current pass: family review has one common consequence pipeline; audit
-test-only public readers and validators as one class next.
+Current pass: test-only state readers and path validators are gone; audit the
+crate-root export boundary for internal causal-identity helpers next.
 Ox17 and Atlas Gate 1 remain paused
 
 ## Orientation
@@ -17,7 +17,7 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
 cognition without an explicit operator resumption.
 
 Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
-production symlink body and is inactive. Exact `1a9dec56` is the current
+production symlink body and is inactive. Exact `fca516f5` is the current
 build-affecting source on this branch. Historical live proofs remain evidence;
 they do not authorize the next capstone or Gate 1.
 
@@ -47,6 +47,17 @@ they do not authorize the next capstone or Gate 1.
 
 ## What just landed
 
+Exact `fca516f5` removes the test-only Resident Self terminal-receipt reader and
+the path-based RepoModel basis validator, and makes resident-provider document
+validation/loading private to their owning module. The supersession test now
+reads the exact typed terminal envelope directly; the Atlas basis test uses the
+production cache validator after refreshing its snapshot. No terminal-receipt,
+private-state, duplicate-owner, or complete-basis proof was dropped. The cut
+removes eight maintained lines net and four false public surfaces. Resident
+readiness passes 9/9, current work 3/3, the Atlas basis test passes, and Core
+checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup
+restored the exact authenticated state inspector.
+
 Exact `1a9dec56` collapses five copies of coordinator review physiology into
 one typed flow: exact result read, operator pause, family admission, event
 append, and status refresh. A private in-process target selects Research,

state/map.yaml

@@ -115,7 +115,7 @@ current_status:
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. Exact edb5c3a3 deletes the launch, heartbeat, and terminal-result family identity mirrors: the sealed typed launch owns live pass identity and the archived attempt owns historical request identity. Exact cabdd6c3 separates immutable coordinator incarnation basis/terminality from minimal model-session admission and removes the remaining session prose, clocks, dead states, redundant options, and whole-store coordinator snapshot. Exact a46725a1 reduces runtime jobs to Queued/Completed/Failed admission latches and removes timestamp selection from Research. Exact 10a70afc derives job role/session ownership from sealed launches and model bindings, leaving the generic job as identity plus status. Exact 53e869c0 removes generic job-result evidence/artifact mirrors; exact 8eaa96c5 stops persisting generic result documents for structured worker decisions; exact 2c3335dc deletes the generic result family entirely and makes typed decisions, model receipts/failures, job status, and process claims own their respective terminal facts. Exact dbb00c2b retains the minimal live/archive session pair for explicit phase closure and retired-identity refusal while deleting display echoes and a wrapper. Exact 24023265 makes the sealed Verification projection the sole Hands receipt input and deletes the duplicate live reread path. Exact a01c6842 deletes the coordinator's same-function always-approved Hands review, derives consequence authority through route/intent/grant identities, and refuses ambiguous receipt sets instead of selecting by timestamp. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
   competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
-  latest_phase: Fresh-package Ox17 and Model Atlas Gate 1 remain paused while source subtraction continues. Exact a721b763 leaves one canonical native model request/event/receipt family, one model-adapter package owning native contracts plus pure provider lowering, a direct temporary OpenRouter release edge, and a lean authenticated CodexConnector client ABI. The independent CodexConnector daemon owns Codex caller admission, credential custody, provider transport, replay, and transport receipts; Yggdrasil runs it as its own service and Idunn target for Ghostlight, while a live Epiphany caller remains unaccepted. Keyed typed Mind, sealed reasoning bases and decision contexts, exact strong-read batch CAS, state-driven work, direct Body-to-Modeling flow, family-owned admission, Persona state, Hands consequences, Verification audits, and decision-preserving archival remain authoritative. Runtime events, role lanes, timestamps, global revisions, aggregate RepoModel authority, provider-event mirrors, embedded Codex transport, and the one-file OpenAI adapter package own no behavior. The optional epiphany-openai-runtime package remains earned because it isolates model and Persona orchestration from seven unrelated root release binaries. Exact 8086d66f folds single-consumer release construction beneath Core's packaged-release owner and deletes its package target. Exact 1e66e770 deletes the producerless Hands receipt constructors while retaining real consequence admission. Exact fab6a59a deletes the never-called Idunn runtime-health signer/aggregate/RUDP module. Exact 200732e9 deletes the adjacent producerless Idunn provider-health store. Exact 1e4fa533 narrows packaged-release exports to real consumers. Exact e905dcd9 inlines the canonical protected-surface list into the default brake. Exact f962c0bc deletes the test-only resident-provider aggregate, its dead boolean predicate wrapper, and the duplicate test that alone kept the second decision path alive. Exact d0a317bd deletes five family review-ID wrappers and makes one current-work snapshot plus one shared attempt rule own review dispatch. Exact 1a9dec56 collapses the five duplicated review consequence branches into one pipeline while retaining five exact family admission owners. Continue with a class audit of test-only public readers and validators rather than picking them off accidentally one at a time.
+  latest_phase: Fresh-package Ox17 and Model Atlas Gate 1 remain paused while source subtraction continues. Exact a721b763 leaves one canonical native model request/event/receipt family, one model-adapter package owning native contracts plus pure provider lowering, a direct temporary OpenRouter release edge, and a lean authenticated CodexConnector client ABI. The independent CodexConnector daemon owns Codex caller admission, credential custody, provider transport, replay, and transport receipts; Yggdrasil runs it as its own service and Idunn target for Ghostlight, while a live Epiphany caller remains unaccepted. Keyed typed Mind, sealed reasoning bases and decision contexts, exact strong-read batch CAS, state-driven work, direct Body-to-Modeling flow, family-owned admission, Persona state, Hands consequences, Verification audits, and decision-preserving archival remain authoritative. Runtime events, role lanes, timestamps, global revisions, aggregate RepoModel authority, provider-event mirrors, embedded Codex transport, and the one-file OpenAI adapter package own no behavior. The optional epiphany-openai-runtime package remains earned because it isolates model and Persona orchestration from seven unrelated root release binaries. Exact 8086d66f folds single-consumer release construction beneath Core's packaged-release owner and deletes its package target. Exact 1e66e770 deletes the producerless Hands receipt constructors while retaining real consequence admission. Exact fab6a59a deletes the never-called Idunn runtime-health signer/aggregate/RUDP module. Exact 200732e9 deletes the adjacent producerless Idunn provider-health store. Exact 1e4fa533 narrows packaged-release exports to real consumers. Exact e905dcd9 inlines the canonical protected-surface list into the default brake. Exact f962c0bc deletes the test-only resident-provider aggregate, its dead boolean predicate wrapper, and the duplicate test that alone kept the second decision path alive. Exact d0a317bd deletes five family review-ID wrappers and makes one current-work snapshot plus one shared attempt rule own review dispatch. Exact 1a9dec56 collapses the five duplicated review consequence branches into one pipeline while retaining five exact family admission owners. Exact fca516f5 deletes two test-only state readers/path validators and makes two resident-readiness internals private while preserving exact typed proofs. Continue by auditing the crate-root export boundary rather than leaving internal deterministic helpers dressed as public APIs.
   execution_binding_authority_cut: Exact ce6bff12 reduces model and tool execution bindings to the only facts they own. A model binding maps one native request to its runtime session and job; a tool binding maps one typed intent to its runtime session and job. Provider identity, source worker, reasoning basis, and model-request ancestry are no longer copied into bindings or compared through timestamp-shaped API arguments. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation reload the exact native request or tool intent. Runtime writable state advances to v37. Core, epoch refusal, transcript-free decision audit, OpenAI tool continuation, and the release-owned tool runtime pass. The cut removes 67 net source lines and leaves runtime_spine.rs at 9,300 physical lines with 50 public functions and 25 public structs. Verification generated 12.713 GiB across 19,134 files; Cargo cleanup restored the single 1.78 MiB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
   provider_transport_boundary_cut: Exact ed7357a2 removes Codex transport from Epiphany's compiled body. The complete epiphany-openai-codex-spine package, codex-login/codex-client graph, CODEX_HOME/auth.json readiness, direct Codex HTTP/SSE, and Codex credential creation/argv are gone. Model and Persona entrypoints use the lean typed client from exact CodexConnector 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 over authenticated loopback MessagePack; Connector owns Codex auth, transport, replay, and exact native/provider digest receipts. Epiphany retains sealed native/provider requests, strict schema/call-ID projection, tool continuation, decision admission, and typed receipt evidence. OpenRouter remains one direct ureq/Rustls boundary with its own credential and terminal-tool dialect. Model receipts advance to v1 and runtime to v38; caller identity, both request digests, and cached-token usage survive transcript deletion. The maintained non-lock source shrinks by 857 lines and Cargo.lock drops 4,830 lines. Core 150/150, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, exact launch checks, and focused no-deps Clippy pass. Two focused build roots totaling 10.8 GiB were removed; only the exact 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E remains. Atlas is untouched and no collaboration acceptance is claimed.
   provider_request_authority_cut: Exact c37cae8b replaces the durable generic OpenAI-shaped request with a closed provider-request document. The consumer adapter now lowers the canonical native request directly to either the exact final `CodexProviderRequest` or the exact OpenRouter request before inference and decision-context sealing. The release edge no longer performs Codex schema, tool, call-ID, or output-format lowering; it supplies the already sealed Codex request to the authenticated Connector invocation. Runtime and decision-context writable schemas advance to v47/v3 with no compatibility reader. Exact 87ea81db pins current Connector source 6dc80f6d266db4d82566d2434adcc55a48e8ecad and deletes Epiphany's obsolete 106-line public schema for the dead generic request, leaving two earned portable CultNet contracts. Connector separates contract-only, client, and daemon compile surfaces; Epiphany uses the contract-only surface in the adapter and the client surface only at the release edge. The Epiphany source cuts remove 125 net maintained lines; Core 152/152, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, and Connector contract/client/daemon 8/8, 10/10, 29/29 pass. Atlas is untouched and no live collaboration acceptance is claimed.
@@ -226,7 +226,7 @@ current_status:
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   vendored_codex_eviction: Exact 7a125d78 deletes all 3,592 tracked vendored Codex files and 851,099 lines after Cargo metadata and manifest/source guards prove no build consumer. The seven dirty files contained only rustfmt and blank-line churn, so no semantic work was discarded or preserved as a counterfeit artifact. The root workspace exclusion, obsolete AGENTS search recipes, vendor-specific license clauses, and two superseded live migration notes are gone. The independent Connector contract remains the sole Codex-facing compile dependency. Gamecult-ops exact cb63e77 corrects the Yggdrasil inventory from the extinct Epiphany-branded/Ghostlight-owned daemon to the independent `yggdrasil-codex-connector` Idunn target. Historical archive notes and the explicitly dated June Body whitepaper remain inert history. No compilation or deployment mutation was required.
   unresolved_authority: `runtime_spine.rs` remains the largest central liability; it still mixes immutable identity, minimal model sessions/jobs, process claims, model/tool execution binding, family admission, consequence receipts, retention, and resurrection fences. Exact a01c6842 removes the counterfeit Hands review; route, Substrate Gate grant, minimal intent, frontier authority, and exact consequences now own that chain. No production actuator authors those receipts, so the coordinator truthfully stops at `awaitingHandsExecutor`. Exact c37cae8b closes the two-stage Codex request seam, exact 7a125d78 removes the excluded implementation corpse, exact 7374be5e removes split-snapshot current-work projection, exact 5f1bea39 removes the second fulfillment/replay store snapshot, and exact 2bcbf268 makes current work the sole coordinator scheduling projection. Ghostlight exact 8e7d980 pins the same Connector source contract. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Continue source subtraction from exact 1a9dec56 with one class audit: public readers and validators whose only consumers are tests or their own module. Start with `ResidentProviderReadiness::validate`, `load_resident_provider_readiness`, `resident_self_terminal_receipts`, and `RepoModelBasis::validate_current`. Demote an interface when a consequential verifier still needs it inside Core; delete it when the test merely animates a second authority or can assert through the owning projection. Preserve exact private-state, duplicate-owner, terminal-receipt, and RepoModel basis proofs. Do not touch Model Atlas behavior, introduce test-only production helpers, or let unrelated dirty formatting enter the commit.
+  next_action: Continue source subtraction from exact fca516f5 at the crate-root export boundary. The six deterministic causal-work identity functions are consumed only inside `epiphany-core`; demote the module re-export and functions to crate visibility without changing their digest law or call sites. Then inspect the remaining one-consumer root exports by class, checking the full workspace before deleting or demoting anything. Do not touch Model Atlas behavior or stage unrelated dirty formatting.
   single_snapshot_current_work_cut: Exact 7374be5e makes one pulled CultCache snapshot the sole input to Mind assembly, keyed RepoModel assembly, current-work Research and Planning lifecycles, Hands readiness, Modeling launches, reasoning-basis assembly, and Reorientation request projection. Three path-based wrappers and numerous repeated open/pull sequences are gone; Research and Verification admission also reuse their already authenticated cache for review and public-source consequence checks. The public Codex Connector client remains the earned ABI stub: deleting it would duplicate authenticated encryption and framing in every consumer, while no daemon/auth/HTTP/SSE implementation compiles into Epiphany. The cut is one net maintained line smaller, adds no schema, dependency, target, or process, and passes Core check, current-work 3/3, reasoning-context 8/8, Reorientation 1/1, Mind determinism 1/1, and RepoModel determinism 1/1. The focused run produced 2.0 GiB across 2,867 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
   single_snapshot_fulfillment_cut: Exact 5f1bea39 makes typed fulfillment replay consume the caller's already pulled runtime Mind snapshot. Research, Verification, Proposal Modeling, PlanMind continuation, fulfilled-worker archival, and Resident Self completion no longer reopen the same `.cc` file while validating one immutable result. The generic path-based fulfillment wrapper is deleted. The public provider-runtime role-result function remains the sole path-based CAS writer; cache-local fulfillment can only replay the exact result already present in its supplied snapshot. The cut adds 17 maintained lines net to remove repeated physical reads while adding no schema, dependency, target, process, or decision authority. Core check, current-work 3/3, reasoning-context 8/8, structured-failure refusal, and the release-owned swarm entrypoint pass. Verification produced 2.2 GiB across 3,189 files; cleanup restored the exact authenticated state inspector.
   single_projection_coordinator_cut: Exact 2bcbf268 makes the current-work projection the sole scheduling input for operator status and Resident Self. An accepted reorientation decision's real manual-regather obligation is projected once with Body, Research, Planning, Modeling, Verification, Imagination, and Hands work. Status no longer opens and assembles Mind separately, and Resident Self no longer hard-codes a contradictory Continue value. `EpiphanyCrrcAction`, its five impossible transition variants, the parallel coordinator-input field, and the second Mind read are gone. The existing reorientation lifecycle now proves the durable regather decision reaches the user-visible coordinator action. The cut removes 12 maintained lines net, adds no persisted schema, dependency, target, or process, and passes Core check, current-work 3/3, Reorientation 1/1, operator-sanitization 1/1, and the release-owned coordinator compile. Verification produced 1.6 GiB across 2,924 files; cleanup restored the exact authenticated state inspector.
@@ -244,6 +244,7 @@ current_status:
   resident_provider_aggregate_cut: Exact f962c0bc deletes `ResidentProviderHealth`, `authenticate_resident_provider`, the dead `provider_matches_authority` boolean wrapper, and one duplicate predicate test. The deleted aggregate had no production caller; one module-local test alone animated it. Live startup remains owned by `derive_resident_cognition_readiness`, which loads the exact resident provider document, probes the process singleton, and reports the actual failed authority predicates through `provider_is_fresh`. The surviving tests assert exact predicate failures, bounded clock skew, release/process/brake binding, CAS, and private-state refusal. The cut removes 204 maintained lines net. Resident readiness passes 9/9 and the release-owned swarm checks cleanly. Verification generated 2.012 GiB across 2,823 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
   single_projection_family_review_cut: Exact d0a317bd deletes five public one-caller review-job-ID wrappers. A coordinator review dispatch now pulls one `EpiphanyCurrentWorkProjection`, keeps the established Research, Verification, proposal Modeling, Body Modeling, and frontier-verdict Modeling family order, and passes the selected exact job to the existing family result/admission owner. `EpiphanyAgentPassAttemptProjection::review_job_id` owns the shared rule that only a Review attempt exposes its job identity. No registry, persisted schema, or generic admission path is added. The cut removes 33 maintained lines net. Current-work tests pass 3/3 and the release-owned coordinator checks cleanly. Verification generated 1.451 GiB across 2,554 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
   family_review_consequence_cut: Exact 1a9dec56 replaces five copies of coordinator review physiology with one exact-result read, one operator-stop path, one family admission dispatch, one event append, and one status refresh. A private in-process `FamilyReviewTarget` selects Research, Verification, proposal Modeling, Body Modeling, or frontier-verdict Modeling from the already pulled current-work projection. It owns no persisted state, scheduling, callbacks, or admission logic; each match arm still calls the existing family CAS owner and preserves the prior event cargo and Modeling priority. The cut removes 39 maintained lines net. Coordinator binary tests pass 4/4 without warnings. Verification generated 1.609 GiB across 2,145 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
+  test_only_state_surface_cut: Exact fca516f5 removes the test-only `resident_self_terminal_receipts` reader and `EpiphanyRepoModelBasis::validate_current` path wrapper, and makes `ResidentProviderReadiness::validate` plus `load_resident_provider_readiness` private to their owning module. The current-work verifier reads and decodes the exact typed terminal envelope; the Atlas verifier refreshes its existing cache and calls the production complete-basis validator. Private-state, duplicate-owner, terminal-receipt, and complete RepoModel-basis proofs remain. The cut removes eight maintained lines net and four false public surfaces. Resident readiness passes 9/9, current work 3/3, the Atlas basis test passes, and Core checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
 
   runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, minimal model sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. The sealed typed worker launch owns live pass-family identity and outer-worker role. Model execution bindings own model-session membership; outer-worker root membership is structural. Archived worker attempts retain exact request kind/ID, deletion digest, decision context, and full typed structured outcome after live launch deletion, including typed failures. Model sessions carry only grouping identity plus the active/completed phase latch; completed-session retention derives its exact jobs from model bindings and writes one private tombstone containing retired identities plus the deletion-chain digest. The live and archived documents protect distinct admission and resurrection invariants and do not duplicate decision cargo. Runtime jobs carry only job identity plus the Queued/Completed/Failed latch. No job clock, role/session mirror, intermediate status, generic terminal-result document, latest-result selector, or model-turn identity echo participates in causality. Typed role/reorientation outcomes own structured terminal decisions and atomically close their job/process physiology; native model receipt/failure records own model-pass terminality; process claims own process death. Verification reasons from the exact route, authority, intent, patch, command, and commit bodies sealed in its basis and has no review document or live receipt-reread tool. Mind/runtime writable epochs remain v11/v47; archived worker attempts are v3. Family launch CAS, model execution, and coordinator basis admission are the only session/job creation owners. Continue subtraction through the remaining single-caller runtime-spine surfaces; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.