Make resident pressure replay idempotent

epiphany-core/src/resident_self.rs

@@ -66,6 +66,15 @@ impl ResidentSelfPressure {
         }
         Ok(())
     }
+
+    fn has_same_producer_identity(&self, other: &Self) -> bool {
+        self.schema_version == other.schema_version
+            && self.pressure_id == other.pressure_id
+            && self.kind == other.kind
+            && self.provenance_ref == other.provenance_ref
+            && self.objective == other.objective
+            && self.private_state_exposed == other.private_state_exposed
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
@@ -821,7 +830,7 @@ fn enqueue_resident_self_pressure_idempotent(
 ) -> Result<bool> {
     let cache = state_cache(path)?;
     if let Some(existing) = cache.get::<ResidentSelfPressure>(&pressure.pressure_id)? {
-        if existing == *pressure {
+        if existing.has_same_producer_identity(pressure) {
             return Ok(false);
         }
         return Err(anyhow!(
@@ -1545,6 +1554,66 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn producer_pressure_replay_ignores_observation_time() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = temp.path().join("resident-self.cc");
+        let mut pressure = ResidentSelfPressure {
+            schema_version: RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(),
+            pressure_id: "admitted-model-direction-consideration-request-1".into(),
+            kind: "admitted-model-direction-consideration".into(),
+            provenance_ref: "cultcache://admitted-model-direction-consideration/request-1".into(),
+            objective: "Launch the exact typed request.".into(),
+            created_at_millis: 1,
+            status: "pending".into(),
+            consumed_by_grant_id: None,
+            private_state_exposed: false,
+        };
+        assert!(enqueue_resident_self_pressure_idempotent(
+            &store, &pressure
+        )?);
+        pressure.created_at_millis = 2;
+        assert!(!enqueue_resident_self_pressure_idempotent(
+            &store, &pressure
+        )?);
+        assert!(
+            heartbeat_issue_resident_self_grant(&store, "heartbeat-1", "action-1", 3)?.is_some()
+        );
+        pressure.created_at_millis = 4;
+        assert!(!enqueue_resident_self_pressure_idempotent(
+            &store, &pressure
+        )?);
+        Ok(())
+    }
+
+    #[test]
+    fn producer_pressure_replay_rejects_changed_authority() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = temp.path().join("resident-self.cc");
+        let mut pressure = ResidentSelfPressure {
+            schema_version: RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(),
+            pressure_id: "admitted-model-direction-consideration-request-1".into(),
+            kind: "admitted-model-direction-consideration".into(),
+            provenance_ref: "cultcache://admitted-model-direction-consideration/request-1".into(),
+            objective: "Launch the exact typed request.".into(),
+            created_at_millis: 1,
+            status: "pending".into(),
+            consumed_by_grant_id: None,
+            private_state_exposed: false,
+        };
+        assert!(enqueue_resident_self_pressure_idempotent(
+            &store, &pressure
+        )?);
+        pressure.objective = "Substitute different work.".into();
+        assert_eq!(
+            enqueue_resident_self_pressure_idempotent(&store, &pressure)
+                .unwrap_err()
+                .to_string(),
+            "resident Self producer pressure identity collision"
+        );
+        Ok(())
+    }
+
     struct FakePorts {
         brake: bool,
         next_pid: u32,

epiphany-core/src/runtime_spine.rs

@@ -10545,6 +10545,18 @@ pub(crate) mod tests {
         .expect("autonomous Modeling grant");
         assert_eq!(grant.pressure_kind, "repo-frontier-proposal-modeling");
         assert!(grant.provenance_ref.ends_with(&selection.request_id));
+        assert_eq!(
+            crate::ingest_resident_self_domain_pressure(
+                &resident_store,
+                &store,
+                &feedback_store,
+                "proposal-runtime-autonomous-bridge",
+                "GameCult/Epiphany",
+                &workspace,
+                1_752_796_804_000,
+            )?,
+            0
+        );
 
         let before = std::fs::read(&store)?;
         let mut forged = proposal;

notes/epiphany-current-algorithmic-map.md

@@ -1226,6 +1226,22 @@ Hands consumes.
 This map must change when ownership changes. Historical scars belong in git,
 evidence, or an explicitly archived note—not in the machine's Modeling state.
 
+### Resident producer replay identity
+
+Resident domain ingestion is an at-least-once producer. The source request ID,
+kind, provenance, objective, schema, and privacy boundary own pressure identity.
+`created_at_millis` records the first observation; `status` and
+`consumed_by_grant_id` belong to the heartbeat lifecycle. They are not producer
+identity and cannot make an identical later ingestion conflict or recreate work.
+
+`enqueue_resident_self_pressure_idempotent` therefore accepts an existing row
+only when its immutable producer fields match, regardless of later observation
+time or grant consumption. It still rejects any same-ID substitution of kind,
+provenance, objective, schema, or privacy authority. The shared path applies to
+admitted-model direction, autonomous proposal Modeling, and Imagination
+consideration pressure. Verification replays after timestamp change and after
+heartbeat consumption, and retains a hostile changed-objective collision.
+
 ## Exact release build cache ownership
 
 Release construction has two serialized cache authorities. The graph cache is

notes/fresh-workspace-handoff.md

@@ -1,58 +1,47 @@
 # Fresh Workspace Handoff
 
-## Current authority — 2026-08-07
+## Current authority — 2026-08-08
 
-The active branch is `codex/epiphany-shakedown-live`. Exact pushed commit
-`49233e9c155199355f1729e0a19a9778e947e9f2` packages all 21 shipped binaries as
-`sha256-d24a05f98b3f653f904b425d87f93668e944db8e7975ce1c0564f5ef55ace7db`
+The active branch is `codex/epiphany-shakedown-live`. Exact pushed release
+`15a740f261d24484f9bc4da7454a021b732ad548` is authenticated as
+`sha256-c3dbcc6bc2f4dced43253e517415548cf87d1a131b4bf3441d07fec89e444ccd`
 with witness
-`sha256-46181cce86b725a237eb1c82e5b68be2f9d01e3afa9c5e82cef67dfe3053b751`.
-Independent inspection accepts the exact commit, runtime, binary set, bytes,
-release identity, and witness; private state is absent.
+`sha256-42ed5d0bfb652520290c868a0dfd13271a1743adf53c1ed7fa95d0117fff509d`.
+Its 21 binaries contain no private state. The stable graph and exact-source
+caches reduce a documentation/state-only successor package to 1.24 seconds.
 
-Release construction has one Cargo graph owner. Its cache identity is the root
-`Cargo.lock` bytes, target triple, and toolchain fingerprint. One exclusive
-graph lock covers build through binary copy. Source materialization has a
-separate repository-bound persistent detached worktree and exclusive lock.
-Each package run force-checks the exact commit, cleans the main worktree and
-recursive submodules, and verifies owner, HEAD, status, and submodule identity
-with Windows long-path support before Cargo starts. Commit identity remains
-release authority; neither cache is allowed to claim it.
+Fresh runtime `F:\Projects\.epiphany-runtime\shakedown\live-20260808-v31`
+accepted initial and proposal-bound Modeling for thread
+`shakedown-v31-rupture-closure-implementation-r1`. The generic user proposal
+lawfully derived a direct Hands gate, but that gate remains inert because this
+objective requires the autonomous Imagination-origin path and dedicated Mind
+adoption before Hands.
 
-Measured build boundaries:
+Resident ingestion then committed the admitted-model direction request and
+pressure. A standard heartbeat selected that pressure. The next resident cycle
+failed before launch because replay recreated the same producer pressure ID
+with a later `created_at_millis`; full document equality misclassified that
+ordinary replay as an identity collision.
 
-- A cold unified graph built in 15m43s.
-- Reusing dependencies across a random checkout path took 8m53s because every
-  local/path crate received a new absolute source path.
-- The persistent exact-source checkout populated those local artifacts in
-  9m17s.
-- Exact `8bb8b7d3` then crossed a documentation/state-only commit through the
-  same checkout and graph. Cargo completed in 29.92s; independent inspection
-  authenticated all 21 binaries, release
-  `sha256-b300b3e729767929f938c0f70b3b20241c4fa6b94cfff116b4932c270e64f738`,
-  witness
-  `sha256-b09403ff3e48fd3387dd4fa31b6c8f9921edab1e1ec7f97bb661f0de74c881b9`,
-  and absence of private state. Steady-state cross-commit reuse is proven.
-
-The prior live runtime is sealed at `live-20260807-v30`. Its model-only thread
-proved the source gap: job opening and failed/cancelled snapshot interpretation
-exist, but the live Body still lacks a proven automatic terminal-worker writer
-to completed Reorientation/Verification closure. That thread exhausted its
-authority and must not receive another manual-regather consent.
+The current worktree repairs ownership in `resident_self.rs`: producer replay
+compares immutable producer identity, while timestamp and pressure lifecycle
+remain derived/mutable. Changed objective, provenance, kind, schema, identity,
+or privacy authority still collide. All 15 resident-Self tests pass, and the
+autonomous promotion integration proves ingestion after heartbeat consumption
+returns zero without recreating work.
 
 ## Next action
 
-1. Package this current-Mind successor through the proven stable caches and
-   authenticate it.
-2. Publish only that exact authenticated successor into a fresh v31 runtime with
-   physically separate runtime, Verse, coverage, repository-Body, and release
-   stores. Carry only canonical `agents.cc` forward.
-3. Open a new typed implementation objective for rupture-to-closure. Prove
-   proposal-bound Modeling, canonical Imagination, dedicated Mind adoption,
-   exact adopted-plan Hands authority, one deliberate bounded-worker failure,
-   typed terminalization, restart/recovery, and Soul-verifiable closure.
-4. Continue the readiness campaign through Persona public consequence,
-   retention bounds, endurance/resource plateau, and Linux/Yggdrasil cognition.
+1. Commit and push the resident-pressure replay repair.
+2. Package and independently authenticate the exact commit through the stable
+   caches; preserve v31 as failure evidence and publish into fresh v32.
+3. Re-run pressure ingestion twice, heartbeat selection, and resident launch.
+   Prove autonomous direction consideration, proposal-bound Modeling,
+   canonical Imagination, dedicated Mind adoption, and exact Hands authority.
+4. Deliberately fail one bounded worker and prove typed terminalization,
+   restart/recovery, Reorientation, and Soul-verifiable closure.
+5. Continue through Persona consequence, retention, endurance/resource
+   plateau, and Linux/Yggdrasil cognition.
 
-Do not read raw worker transcripts, mutate sealed runtimes, approve manual
-regather on v30, or start concurrent Cargo against the release cache.
+Do not execute v31's direct Hands gate, read raw worker transcripts, mutate
+sealed runtimes, or start concurrent Cargo against the release cache.

state/map.yaml

@@ -34,15 +34,15 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. The complete 21-binary release builds through one frozen graph cache and one repository-bound persistent exact-source checkout. Exact 8bb8b7d3 proved steady-state cross-commit packaging: Cargo completed in 29.92s after a documentation/state-only commit, down from 8m53s with random checkout paths and 15m43s cold. Its independently authenticated release is sha256-b300b3e729767929f938c0f70b3b20241c4fa6b94cfff116b4932c270e64f738 with witness sha256-b09403ff3e48fd3387dd4fa31b6c8f9921edab1e1ec7f97bb661f0de74c881b9. The completed model-only v30 circuit established the rupture-to-closure source gap and exhausted its authority. The next live runtime must route a fresh implementation objective through canonical Imagination, dedicated Mind, adopted-plan Hands, deliberate failure/restart, and Soul closure. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 15a740f2 packages 21 independently authenticated binaries as sha256-c3dbcc6bc2f4dced43253e517415548cf87d1a131b4bf3441d07fec89e444ccd with witness sha256-42ed5d0bfb652520290c868a0dfd13271a1743adf53c1ed7fa95d0117fff509d. Stable graph and exact-source caches reduce a documentation/state-only successor package to 1.24 seconds. Fresh v31 proved initial and proposal-bound Modeling, then exposed a resident-Self replay defect before autonomous Imagination launch: producer pressure identity incorrectly included mutable timestamp and lifecycle state. The current worktree repairs replay identity and passes all 15 resident-Self tests plus the autonomous promotion integration. Exact packaging and a fresh v32 live replay remain required before resuming the implementation chain. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open.
   operational_state:
-    local_worktree: pending_current_mind_boundary_commit_after_8bb8b7d3_cache_proof
+    local_worktree: resident_pressure_replay_repair_verified_pending_commit
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
     starfire_runtime_identity: epiphany-starfire
     starfire_swarm_brake: released
-    starfire_release: authenticated_8bb8b7d3_steady_state_cache_proven_pending_current_mind_successor
+    starfire_release: authenticated_15a740f2_v31_release; replay_repair_successor_pending
     starfire_repository_body: bound_and_observed
     starfire_verse_topology: bound_to_current_repository_body
     starfire_native_status: supervised_shakedown_active
@@ -52,8 +52,8 @@ current_status:
     bifrost_feedback_crossing: authenticated_transport_only
     yggdrasil_epiphany_services: absent
     resident_physiology: heartbeat_and_self_running
-  unresolved_authority: v30 proved the manual-regather actuator exactly once and proved it does not persist as ambient routing authority. The consented Eyes-to-Modeling pass still found no source-proven terminal worker writer or automatic rupture-to-continuity/Soul closure path, and Self returned to regatherManually. The current model-only thread cannot lawfully enter Imagination or Hands. Canonical Imagination, dedicated Mind adoption, exact adopted-plan Hands binding, deliberate worker failure/restart/closure, Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open.
-  next_action: Open a new typed implementation objective for the missing rupture-to-closure path. Route the admitted absence through canonical Imagination and dedicated Mind before Hands; then deliberately fail one bounded worker and prove terminal failure, restart/recovery, and Soul-verifiable closure. Do not approve manual regather again on the completed model-only thread.
+  unresolved_authority: v31's generic user proposal produced a lawful direct Hands gate, but the active objective requires the autonomous Imagination-origin path and dedicated Mind adoption, so that gate remains inert. Resident ingestion committed the correct admitted-model direction request and heartbeat selected its pressure, but the next resident cycle failed because replay compared a newly observed timestamp and mutable lifecycle as producer identity. The repair is locally verified but not yet packaged or proven live. Canonical Imagination, dedicated Mind adoption, exact Hands binding, deliberate worker failure/restart/closure, Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open.
+  next_action: Commit and package the resident-pressure replay repair, preserve v31 as failure evidence, and prove repeated ingestion plus heartbeat-to-resident launch in fresh v32. Then continue the autonomous Imagination-to-Modeling-to-Mind-to-Hands chain and deliberate failure/restart/Soul closure.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.