Record resident PID 1 reaper proof

notes/epiphany-current-algorithmic-map.md

@@ -4326,3 +4326,33 @@ Soul binding, and split-admission replay.
   and the hostile unrelated-action regression. Resident safe-continuation
   routing excludes manual regather. c010 remains alive, braked, and without an
   active lease after native Imagination produced no admitted work.
+
+## Resident PID 1 owns adopted worker reaping (2026-08-11)
+
+- Owner: resident Self owns OS cleanup for model-worker grandchildren that its
+  bounded coordinator children orphan into resident PID 1.
+- Inputs: typed `EpiphanyRuntimeWorkerProcessClaim` rows and the kernel's exact
+  child/exit relation. Claims are sorted for deterministic inspection.
+- Outputs: exact nonblocking `waitpid(pid, WNOHANG)` for claimed worker PIDs.
+  `ECHILD` and a still-running child are clean no-ops.
+- Derived state: runtime job, result, process-claim, archive, and coordinator
+  receipt documents remain cognitive evidence. Reaping changes none of them.
+- Forbidden writers: retention, PID age, executable-name scans, generic
+  `waitpid(-1)`, and coordinator receipt settlement may not decide which worker
+  process to reap.
+- Shared paths: every resident once/serve cycle reaps before maintenance can
+  archive the exact claim. Known coordinator children remain owned and reaped
+  through their `Child::try_wait` handles.
+- Cut line: add no signal-handler policy, global scavenger, retry writer, or
+  process-name registry. The typed runtime claim supplies identity; the kernel
+  supplies parenthood and terminality.
+- Verification: c010 exposed six defunct adopted workers. Exact `465af24d`
+  passes six focused Windows process tests, nine swarm tests, and the Unix
+  exact-child test on Starfire. Its authenticated 24-binary release is
+  `sha256-089e000511f0420bfaab1136952b8cf94677a72d5c30a3fb3e6a26996bd3726f`
+  with witness
+  `sha256-20ca293589b33d3b2e6ea5a7411db544741fe18360ecbd4423cdfa000d1ad7c6`.
+  Live c011 restarted braked at revision 372 with zero zombies. One genuine
+  packaged worker terminalization followed by a zero-zombie PID 1 inspection
+  remains the live acceptance gate; failed-closed attempts that launch no
+  worker do not count.

notes/fresh-workspace-handoff.md

@@ -3967,3 +3967,36 @@ operator objective text cannot impersonate approval. c010 is therefore
 correctly alive, idle, and braked at revision 372. Continue retention,
 supervisor/log ownership, and endurance. A live regather is a separate operator
 decision or a future mapped typed operator-ingress cut.
+
+## Resident PID 1 worker reaping cut — 2026-08-11
+
+Live c010 process inspection found six defunct `epiphany-model-*` processes
+adopted by resident `epiphany-swarm` PID 1. Runtime and artifact retention were
+bounded, but the operating-system child lifecycle was not. Exact `465af24d`
+makes resident Self enumerate typed runtime worker process claims and call
+exact `waitpid(pid, WNOHANG)` for those claimed PIDs before every once/serve
+cycle and before retention. It does not use process-name discovery or
+`waitpid(-1)`, and it cannot steal the known coordinator children still owned
+by `NativePorts` `Child` handles. Reaping mutates no CultCache authority.
+
+Six focused Windows process-observation tests and all nine swarm tests pass.
+The Unix-only exact-child test passed 1/1 on Starfire. Exact release
+`sha256-089e000511f0420bfaab1136952b8cf94677a72d5c30a3fb3e6a26996bd3726f`
+with witness
+`sha256-20ca293589b33d3b2e6ea5a7411db544741fe18360ecbd4423cdfa000d1ad7c6`
+contains 24 authenticated binaries and no build warnings. Receipts are under
+`.epiphany-run/forge-crosscommit-465af24d`; the container named
+`epiphany-linux-package-465af24d-rejected-stale-source` is a sealed rejected
+attempt that packaged d3 after a checkout syntax failure and was never
+published.
+
+c010 Heartbeat and Self stopped by SIGTERM at exit zero. c011 runs the exact
+465 package on the same named state/workspace/Codex volumes, is braked at
+resident revision 372, and has no active lease or defunct child. One manual
+regather attempt and one replacement objective attempt both failed closed
+before worker launch: the current action is `awaitFrontierProposal`, terminal
+sessions cannot be reused, and immutable typed objective intake cannot be
+substituted. Do not manufacture a claim to satisfy the smoke. The remaining
+acceptance gate is the next genuine packaged worker lifecycle: after normal
+terminalization, resident PID 1 must return to zero zombies. Keep c011 braked
+until such typed work exists.

state/map.yaml

@@ -36,19 +36,19 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Exact 78ca972b binds autonomous proposal promotion to the admitted model-direction request thread instead of the mutable singleton coordinator projection; copied exact c008b replay is byte-identical and hostile partial-family state refuses. Exact d3e433fc extends the same owner to proposal Modeling launch after resident projection transition. Its warning-free 24-binary release sha256-11be5dae8429fcb6c604a15e8e122869f3ee60b9699831329b49fb62c1689768 with witness sha256-217eafc8752d16fb249aad69b5dfc312e5fd507d2c05bff1cf5a1dbcc1b5ab32 packaged in 20.96 seconds. Live c010 recovered the exact dead prior worker claim, restored cognitive thread linux-eyes-tools-c005, completed the stranded proposal Modeling request once, accepted two exact review continuations, completed two native admitted-direction Imagination turns, and completed two resulting proposal Modeling families. One first Modeling attempt failed on an exact upstream HTTP 503; Continuity made one retry eligible and it settled without dual authority. The second Imagination turn produced no new admitted work, so released Heartbeat returned to routine physiology. The brake is engaged at resident revision 372 with no active lease. Yggdrasil never builds.
+  latest_phase: Live c010 inspection found six defunct model-worker grandchildren adopted by resident PID 1. Exact 465af24d makes resident Self enumerate typed runtime worker process claims and call exact nonblocking waitpid only for those claimed PIDs before each once/serve cycle and before retention. Coordinator Child handles remain separately owned. Six Windows process tests and nine swarm tests pass; the Unix exact-child test passes 1/1 on Starfire. The warning-free 24-binary Linux release sha256-089e000511f0420bfaab1136952b8cf94677a72d5c30a3fb3e6a26996bd3726f with witness sha256-20ca293589b33d3b2e6ea5a7411db544741fe18360ecbd4423cdfa000d1ad7c6 is authenticated and live as c011. c010 stopped both owners at exit zero. c011 restarted braked at resident revision 372 with zero defunct children. A stale-source packaging attempt was stopped and sealed before publication. Two direct cognition attempts failed closed before worker launch because immutable session/objective and current-action gates refused substitution. The remaining acceptance gate is one genuine packaged worker lifecycle returning resident PID 1 to zero zombies. Yggdrasil never builds.
   operational_state:
-    local_worktree: clean_at_pushed_d3e433fc_after_live_c010_proof
+    local_worktree: clean_at_pushed_465af24d_before_c011_mind_receipt
     operator_wireguard: restored
     starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
     starfire_runtime_identity: epiphany-starfire
-    starfire_swarm_brake: engaged_at_c010_phase_boundary_revision372
-    starfire_release: exact_d3e433fc_sha256_11be5dae_live_c010
+    starfire_swarm_brake: engaged_at_c011_reaper_phase_boundary_revision372
+    starfire_release: exact_465af24d_sha256_089e0005_live_c011
     starfire_repository_body: bound_and_observed
     starfire_verse_topology: bound_to_current_repository_body
-    starfire_native_status: authenticated_active_c010_braked_no_lease
+    starfire_native_status: authenticated_active_c011_braked_no_lease_zero_zombies
     bifrost: exact_cb3239aa_f67f5122_native_runtime_active_on_yggdrasil
     bifrost_persona_feedback: ready_on_yggdrasil
     bifrost_feedback_binding: gamecult_aquarium_to_epiphany_starfire
@@ -68,9 +68,9 @@ current_status:
     starfire_linux_role_cognition: eyes_and_modeling_tools_results_and_acceptance_proven_zero_consequence
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
-    resident_physiology: c010_exact_d3e433fc_alive_braked_revision372_after_causal_thread_recovery_two_reviews_and_two_native_imagination_turns
+    resident_physiology: c011_exact_465af24d_alive_braked_revision372_with_claim_bound_pid1_reaper_and_zero_zombies
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, deterministic incremental release construction, and canonical-brake refusal of direct daemon lifecycle actuation are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep c010 alive and the cognitive brake engaged. The idle regather boundary is source-grounded: regatherManually is an operator approval boundary, not Heartbeat pressure, and Self must not synthesize Eyes or Reorientation work from it. Do not add an automatic route or translate generic operator objective text into approval. Continue bounded retention and supervisor/log ownership, then measured idle and active endurance. A future live regather requires an explicit operator decision through the existing approval contract or a separately mapped typed operator ingress. Do not build on Yggdrasil.
+  next_action: Keep exact c011 alive and the cognitive brake engaged. The source, package, Linux kernel helper, clean restart, and zero-zombie idle gates are accepted. At the next genuine typed worker route, release only for that bounded lifecycle, require the worker to terminalize normally, then prove resident PID 1 returns to zero defunct children before accepting the reaper cut. Do not forge runtime claims, replace immutable objective intake, reuse terminal coordinator sessions, or reinterpret awaitFrontierProposal as manual regather. After that proof inspect the next typed action and continue broader organ coverage. Do not build on Yggdrasil.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.