From bae9d338e4a3d1e06b4342acc5cb5ef0c5ecde0d Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Mon, 24 Aug 2026 01:20:59 +0200
Subject: [PATCH] Record sole Proposal launch authority

---
 notes/epiphany-current-algorithmic-map.md  |  18 +++++++++--------
 notes/epiphany-fork-implementation-plan.md |   7 ++-----
 notes/fresh-workspace-handoff.md           |  22 ++++++++++-----------
 state/ledgers.msgpack                      | Bin 694225 -> 694871 bytes
 state/map.yaml                             |  10 +++++-----
 state/scratch.md                           |  13 ++++++++++--
 6 files changed, 39 insertions(+), 31 deletions(-)

diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md
index 997f0eee..3a177b32 100644
--- a/notes/epiphany-current-algorithmic-map.md
+++ b/notes/epiphany-current-algorithmic-map.md
@@ -1,8 +1,8 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-24
-Latest committed implementation cut: `6831eb69` on `codex/epiphany-shakedown-live`
-Current worktree cut: Proposal-Modeling launch-binding subtraction; Ox17 remains paused
+Latest committed implementation cut: `b0a4978d` on `codex/epiphany-shakedown-live`
+Current worktree cut: Proposal-Modeling launch-authority deletion; Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
 proof chronology belong in git, `state/ledgers.msgpack`, and bounded smoke
@@ -212,11 +212,13 @@ Body/domain binding, and canonical Modeling request; validation reads those
 facts from their owning immutable documents instead of copying them into the
 join record.
 
-Proposal-Modeling launch provenance is also a narrow join. Exact `6831eb69`
-reduces its persisted binding from twelve fields to schema, request ID, job ID,
-and exact launch-document digest. The request owns proposal/runtime/thread; the
-launch owns role/binding/document; the binding key derives from the job ID.
-Fulfillment and archival read that exact key rather than scanning every binding.
+Proposal-Modeling has no second launch record. Exact `b0a4978d` deletes the
+persisted binding after its minimized form proved to own nothing. The immutable
+worker launch carries the typed request reference, job, role, binding, and sealed
+document; current-work, retry counting, fulfillment, coordinator actuation, and
+archival all read that owner directly. Body Modeling, Planning, PlanMind,
+Imagination consideration, and Reorientation bindings remain under the same
+audit; family-specific semantic requests remain mandatory.
 
 Bifrost owns its private feedback-signing identity. Exact `94098223` deletes
 Epiphany's host-identity executable and the private signer, persisted identity,
@@ -827,7 +829,7 @@ Accepted through the local `5b799b12` source boundary:
 
 Open before Model Atlas Gate 1 resumes:
 
-1. let Idunn compile, test, and seal exact build-affecting source `6831eb69`;
+1. let Idunn compile, test, and seal exact build-affecting source `b0a4978d`;
 2. use that exact package in private fresh-store Ox17; stop after three
    provider failures total, and prove direct Body Modeling, typed
    refusal-to-retry if exercised, Hands through Verification, exact context
diff --git a/notes/epiphany-fork-implementation-plan.md b/notes/epiphany-fork-implementation-plan.md
index 26da65b4..e9956fe7 100644
--- a/notes/epiphany-fork-implementation-plan.md
+++ b/notes/epiphany-fork-implementation-plan.md
@@ -224,7 +224,7 @@ Delete or demote:
 
 Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
 1 paused. Continue the source-subtraction and test-authority audit from exact
-`6831eb69`. The current sequence has deleted the semantic-memory/workspace-coverage
+`b0a4978d`. The current sequence has deleted the semantic-memory/workspace-coverage
 projection system, its local daemon supervisor, and the surviving generic
 RepoModel profile, impossible lifecycle, producerless receipt/summary, and
 decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
@@ -302,10 +302,7 @@ Cut in this order:
    admission are landed. Current-work no longer reads the external Body store;
    status consumes the shared projection.
 3. **Baseline transaction landed at `9f7b164f`; operator routing at `587c56d2`; Resident continuation and keyed acceptance at `478fb923`:** baseline Body Modeling is now thread-free from unresolved Body obligation through Launch/Wait/Review and exact Mind admission. Resident and operator callers consume the same family projection and acceptance owner. Thread ID remains immutable pass provenance only.
-4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, exact launch binding, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry.
-   Exact `6831eb69` later reduces that launch binding from twelve mirrored fields
-   to request ID, job ID, and exact launch digest under its schema; validators
-   fetch the deterministic job-derived key directly.
+4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, worker launch, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry. Exact `b0a4978d` deletes the later duplicate launch-binding document entirely; the worker launch is the sole launch owner.
 5. **Continuation vocabulary landed at `e404c105` and was named truthfully at `fc5d1a4a`:** concrete pass families share one pure `EpiphanyAgentPassContinuationAction`; their semantic requests, projections, validators, and admission owners remain separate.
 6. **Dormant claim-repair authority deleted at `20dd66c8`:** no request/binding/context schema, runtime carrier, coordinator branch, result cargo, export, or model lowering survives. The independent Eyes challenge fact remains. The same pass fixed two-snapshot Body/Proposal launch derivation and stress-proved single Proposal launch 20/20.
 7. **Frontier-verdict Modeling landed at `d367e525`:** one exact Soul verdict
diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index f5b09382..25a05264 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -2,8 +2,8 @@
 
 Updated: 2026-08-24
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `6831eb69`
-Current worktree: documentation/evidence for Proposal-Modeling launch-binding subtraction;
+Latest committed implementation cut: `b0a4978d`
+Current worktree: documentation/evidence for Proposal-Modeling launch-authority deletion;
 Ox17 remains paused
 
 ## Orientation
@@ -15,7 +15,7 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
 cognition without an explicit operator resumption.
 
 Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
-production symlink body and is inactive. Exact `6831eb69` is the current
+production symlink body and is inactive. Exact `b0a4978d` is the current
 build-affecting source. Historical live proofs remain evidence; they do not
 authorize the next capstone or Gate 1.
 
@@ -45,14 +45,14 @@ authorize the next capstone or Gate 1.
 
 ## What just landed
 
-Exact `6831eb69` reduces the Proposal-Modeling launch binding from twelve
-persisted fields to four: schema, exact request ID, job ID, and launch-document
-digest. The request owns proposal/runtime/thread identity; the launch owns
-role/binding/document identity; the CultCache key derives from the job ID.
-Fulfillment and archival now fetch that exact document rather than scanning all
-bindings. The full keyed retry/admission/archive lifecycle and old-epoch refusal
-pass, OpenAI runtime checks cleanly, and 71 net source lines are gone. Runtime
-writable state is v16.
+Exact `b0a4978d` deletes the Proposal-Modeling launch-binding document family.
+The immutable worker launch already owns the exact typed request reference, job,
+role, binding, and sealed launch document. Current-work, retry counting,
+fulfillment, coordinator actuation, and archival now consume it directly. The
+registry entry, launch-digest mirror, deletion choreography, and operator JSON
+echo are gone. The broad keyed lifecycle, coordinator target, OpenAI runtime,
+and old-epoch refusal pass. The cut removes 70 net source lines and advances
+runtime writable state to v17.
 
 Exact `6ccc7dd2` deletes the private 20-field Hands receipt-chain summary. The
 Hands commit owner now derives the deterministic Verification request directly
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index f930b7b5955c05d13b57431f349e595e8443fc58..7a88c2d5273481dc23dd5412a1988e74d9375a1a 100644
GIT binary patch
delta 651
zcmYjOO=}cE6m-__^&*}ExjgU|X2LMLniv&P@DL<1Xz<{zxBJa*Yky2$_v~gw$iahu
zAj{yNP(eXFdGqc`@a8}9jk_xzitc`NRaaI2_^|Qw^Tx-u<Vun6+!#Fney0C!`009b
zlq7fG%zJO=y@b)NXBp=h=NT6m7a5lrm%q$={X6q(r(cV_xS8eKSur>)20KOG{(h9K
zpZw}Qdw48lgi$Vrx3;zwC^Q%`K%5{Pkgt3YCfoBo)@}?&)J{&ak#?#(Dlcn`E<!1+
zHVud}B7u$ptajS!SE!)$WT7HI<-MOdB!eMr!XfMH6Km@zMh0Q#=_OMa`VhQ9mgDPe
zq^X!mcvNGEyp~AlB&P7fk5VAMnZnXf3c@J}C=4@}QY(wMLDs~~m~~Gv5hFGGAbss3
zM@gZqO{tCP;-ozG#0f?81YA!oqV{efFGx=GR2aVF0;lJ=pfsV3rhR|fU)%qm%f<vX
z5Cx5qWgl1Q?(YJ1Z(8=<+4V+cSa~_=ven!+RH7^BDNfl+)7~5Q*V}Jx|LW_lMQems
zaJyXp1FxDC4vcW!ak1OuuSsFoig9QEpX(>+NwePH(W;weZ2<%!I6njL5b(G%T5_n>
JpVmsp%|CkY=sy4e

delta 73
zcmcb<MeE{vtql^4+y=&0rp8gn7`Udb+pNr3$jE5ZJe8?^Dib3RgJ@<TW&vVWAZ7z%
Rb|B^eV$SVTnYe7G0swRj7OMaN

diff --git a/state/map.yaml b/state/map.yaml
index 0e0339be..891350db 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -52,11 +52,11 @@ current_status:
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
   competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
-  latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Runtime status aggregates, global revisions, generic role/event authority, duplicate prompt-state cargo, and Epiphany-owned Rider/Unity organs are absent. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. Completed model-session tombstones retain only resurrection fences and an exact deletion digest. Archived worker attempts retain the exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records needed for audit. Mind/runtime writable epochs are v8/v16; archived-session schema is v1 and archived-worker-attempt schema/type is v2. Old writable stores refuse with no migrator or dual reader. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
+  latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Runtime status aggregates, global revisions, generic role/event authority, duplicate prompt-state cargo, and Epiphany-owned Rider/Unity organs are absent. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. Completed model-session tombstones retain only resurrection fences and an exact deletion digest. Archived worker attempts retain the exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records needed for audit. Mind/runtime writable epochs are v8/v17; archived-session schema is v1 and archived-worker-attempt schema/type is v2. Old writable stores refuse with no migrator or dual reader. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
   atlas_authoring_cut: Exact ce306e23 preserves the complete inter-swarm Atlas vertical slice while deleting its duplicate local offer/claim authoring authority. Ordinary Modeling through RepoModel operations is the sole owner of provider offers and consumer claims; Atlas retains signed publication, trust, transport, deterministic projection, Soul verification, Self impact admission, Resident Self wake, brakes, and Eve lowering. Two direct write-intent types, their runtime commit APIs and registry entries, 518 planner lines, and two tests that animated only that duplicate path are gone. The runtime proof now creates offers/claims through RepoModel before proving exact verification admission and Body-drift refusal. The cut removes 593 net source lines; the three-repository direct/transitive Modeling proof passes. These are component proofs only: no live inter-swarm collaboration has yet run, so the Atlas vertical slice remains protected until Gate 1 exercises it end to end. Runtime writable epoch is v14.
   autonomous_proposal_binding_cut: Exact 5d507bfd reduces Self's autonomous Imagination-to-Modeling origin binding from a 22-field duplicate archive to six causal join fields: schema, exact direction-result identity, selected option ordinal, worker job identity, and exact worker-result/launch digests. Proposal identity and payload, direction request, runtime/thread, typed model projection, Body/domain binding, selected option content, and canonical Modeling-request identity are checked directly from their owning immutable documents. The atomic proposal plus binding plus Modeling-request commit and its broad keyed-lifecycle proof remain; 60 net source lines are gone. Runtime writable epoch is v15.
   hands_verification_derivation_cut: Exact 6ccc7dd2 deletes the 20-field transient Hands receipt-chain summary. The Hands commit owner now derives the exact Verification request directly from the persisted patch, command, and commit receipts plus the frontier authority; no copied schema, job, grant, command-output, Git, path, summary, or timestamp fields mediate that handoff. Atomic Hands-to-Verification admission and the concurrent Persona/Hands lifecycle proof remain. The cut removes 43 net source lines without adding state, schema, or tests.
-  proposal_modeling_launch_binding_cut: Exact 6831eb69 reduces the Proposal-Modeling launch binding from twelve persisted fields to four: schema, exact request ID, job ID, and launch-document digest. The request owns proposal/runtime/thread identity, the launch owns role/binding/document identity, and the CultCache key is derived from the job ID. Fulfillment and archival now fetch that exact key instead of scanning all bindings. The full keyed lifecycle, retry/admission/archive path, old-epoch refusal, and OpenAI runtime check pass; 71 net source lines are gone. Runtime writable epoch is v16.
+  proposal_modeling_launch_authority_cut: Exact b0a4978d deletes the Proposal-Modeling launch-binding document family after exact 6831eb69 exposed that even its four-field form owned nothing. The immutable worker launch already carries the exact request reference, role, binding, job identity, and sealed typed document. Current-work, retry counting, fulfillment, archival, and coordinator actuation now consume that owner directly; the registry entry and operator JSON echo are gone. The keyed lifecycle, coordinator target, OpenAI runtime, and old-epoch refusal pass; 70 net source lines are gone. Runtime writable epoch is v17.
   supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle.
   launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
   operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
@@ -118,10 +118,10 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,917 lines, 55 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Continue splitting only by deleting callerless or duplicate authority; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Resume the public runtime-spine and test-liability audit after exact 6831eb69. Trace each remaining public API and verifier to a live owner and consequential invariant; preserve the unrun inter-swarm Atlas vertical slice while deleting duplicate authority, callerless mouths, checked mirrors, duplicate prompt-state cargo, and tests of implementation spelling. Preserve immutable runtime identity, exact job/session terminality, sealed typed reasoning projections, decision contexts and failures, model/tool bindings and receipts, atomic Hands-to-Verification admission, conflict/replay, Resident Self recovery, identity-resurrection fences, and durable structured decisions. Do not mistake component tests for inter-swarm acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
+  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,879 lines, 55 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Five persisted family launch-binding types remain beside the immutable worker launch and must prove unique authority or be deleted. Continue splitting only by deleting callerless or duplicate authority; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Continue the launch-authority deletion after exact b0a4978d. Audit Body Modeling, Planning, PlanMind, Imagination consideration, and Reorientation bindings against the immutable worker launch; delete every field and document family whose attempt, request, role, timestamp, projection, or failure ancestry is already derivable from the launch, runtime job/result, typed request, or admission refusal. Keep family-specific semantic requests and validation; do not create a generic registry or mutable role-lane owner. Preserve the unrun inter-swarm Atlas vertical slice and do not mistake component tests for acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
 
-  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. It exposes no aggregate status head, global revision, generic role patch, caller-authored mutation surface, duplicate prompt-state projection, or public typed-fulfillment machinery. Completed model-session retention writes one private resurrection tombstone. Archived worker retention writes one decision-bearing historical record with exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records; duplicate IDs, timestamps, count summaries, and returned archive vectors own nothing and are absent. Mind/runtime writable epochs are v8/v16, archived-session schema is v1, archived-worker-attempt schema/type is v2, and claim-obligation schema is v3. The spine is 9,917 lines with 55 public functions and 25 public structs. Continue subtraction by tracing each remaining public surface and verifier to a live consumer and consequential invariant; do not replace deleted authority with registries, adapters, compatibility readers, or summary DTOs.
+  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. It exposes no aggregate status head, global revision, generic role patch, caller-authored mutation surface, duplicate prompt-state projection, or public typed-fulfillment machinery. Completed model-session retention writes one private resurrection tombstone. Archived worker retention writes one decision-bearing historical record with exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records; duplicate IDs, timestamps, count summaries, and returned archive vectors own nothing and are absent. Mind/runtime writable epochs are v8/v17, archived-session schema is v1, archived-worker-attempt schema/type is v2, and claim-obligation schema is v3. The spine is 9,879 lines with 55 public functions and 25 public structs. Continue subtraction by tracing each remaining public surface and verifier to a live consumer and consequential invariant; do not replace deleted authority with registries, adapters, compatibility readers, or summary DTOs.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.
 
diff --git a/state/scratch.md b/state/scratch.md
index 3c05e004..b3a51381 100644
--- a/state/scratch.md
+++ b/state/scratch.md
@@ -206,9 +206,18 @@ and janitors may reduce the symptom but cannot substitute for deleting code.
    twelve persisted fields to four and replaces global binding scans with exact
    key reads. Request and launch documents remain the owners of the removed
    mirrors. Runtime epoch is v16; 71 net source lines are gone.
-37. Next: resume the public runtime-spine and test-liability audit by live owner
+37. Done: exact `b0a4978d` deletes the Proposal-Modeling launch-binding type
+   entirely. The immutable worker launch owns request, job, role, binding, and
+   sealed document identity; current-work, admission, coordinator actuation, and
+   archival now consume it directly. Runtime epoch is v17; 70 net source lines
+   are gone.
+38. Next: apply the same ownership test to Body Modeling, Planning, PlanMind,
+   Imagination consideration, and Reorientation launch bindings. Delete the
+   family when the worker launch and typed request already own its facts; do not
+   create generic launch authority.
+39. Continue the public runtime-spine and test-liability audit by live owner
    and consequential invariant. Do not subtract the unrun Atlas vertical slice;
    no inter-swarm collaboration has yet been exercised. Streamline it only
    around its one end-to-end authority map.
-38. Run focused tests after each cut. Only after source subtraction stabilizes
+40. Run focused tests after each cut. Only after source subtraction stabilizes
    should Idunn's build scratch contract be reconsidered.