Map Idunn managed service policy boundary

notes/epiphany-current-algorithmic-map.md

@@ -362,6 +362,12 @@ that store with empty stderr and lifecycle receipts. The attached PowerShell
 vigil is deleted. The remaining service boundary is durable Idunn policy and
 operator readback: advertise/configure the heartbeat service through typed
 daemon state so restart intent survives beyond one explicit `service-launch`.
+Source inspection corrected the proposed owner: standing daemon restart policy
+requires a topology daemon and liveness status, while heartbeat is an
+Idunn-managed child service. The durable owner must therefore be a typed
+managed-service desired-state document keyed by service id. It delegates all
+starts to the existing service lifecycle primitive and must not invent an
+`epiphany-daemon-heartbeat` topology identity.
 
 This map must change when ownership changes. Historical scars belong in git,
 evidence, or an explicitly archived note—not in the machine's proprioception.

notes/fresh-workspace-handoff.md

@@ -2202,6 +2202,12 @@ had empty stderr and compact clean closure receipts. Lifecycle receipt ids are
 The old `tools/epiphany_ruminate_until.ps1` attached loop is deleted. Next give
 Idunn a durable typed heartbeat service policy/readback so restart intent and
 current pulse status survive beyond an explicit operator `service-launch`.
+Do not reuse `epiphany.cultmesh.daemon_restart_policy` for this. Inspection of
+`epiphany-daemon-supervisor::write_policy` and scheduler reconciliation shows
+that family requires a standing topology daemon plus daemon liveness status.
+Heartbeat is an Idunn-managed child service. Add a typed managed-service
+desired-state policy keyed by service id, and have reconciliation delegate to
+the existing `service-launch` lifecycle owner.
 
 ## Immediate Re-entry Instruction
 

notes/perfect-machine-audit-roadmap.md

@@ -102,8 +102,12 @@ refusals, resumes from the same persisted store, and can be launched again by
 Idunn without duplicate pending turns. The heartbeat binary owns pulse timing
 and typed heartbeat receipts. Idunn owns child launch, stdout/stderr artifacts,
 and lifecycle receipts. Self remains only the routing organ consuming heartbeat
-pressure. The remaining step is durable Idunn restart policy and compact
-operator readback for the heartbeat service, not another explicit launch smoke.
+pressure. Existing `epiphany.cultmesh.daemon_restart_policy` is not the right
+owner for the remaining step: it is keyed to standing topology daemons and
+their liveness status. The heartbeat loop is an Idunn-managed child service.
+The missing owner is a typed managed-service desired-state policy keyed by
+service id, plus compact operator readback; do not forge an eighth standing
+daemon to reuse the daemon policy table.
 
 ### Owner
 
@@ -128,6 +132,15 @@ operator readback for the heartbeat service, not another explicit launch smoke.
 - Idunn service lifecycle receipt and sealed stdout/stderr artifacts;
 - explicit clean shutdown or failure status.
 
+### Durable service policy requirement
+
+Add one typed Idunn managed-service policy with owner `Idunn` and key
+`service_id`. It may read the desired command/args/cwd, enabled state, restart
+mode, cooldown/backoff, expected heartbeat store, stdout/stderr artifact refs,
+and latest lifecycle receipt. It emits desired-state readback and delegates
+every actual start/restart to the existing service lifecycle launch primitive.
+It does not own heartbeat scheduling state, daemon topology, or routine output.
+
 ### Forbidden writers
 
 - PowerShell wall-clock loops deciding heartbeat truth;

state/map.yaml

@@ -659,4 +659,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Give Idunn durable typed ownership of the native heartbeat service beyond one explicit `service-launch`. Publish/configure the heartbeat serve command through existing daemon restart policy and operator readback surfaces, expose last pulse/brake/clean-stop state without opening routine payloads, and prove Idunn can reconcile/restart it from persisted heartbeat state without duplicate pending turns.
+  next_action: Add the missing typed Idunn managed-service desired-state policy keyed by service id; do not forge a topology daemon or reuse standing-daemon restart policy. Persist heartbeat serve command/args/cwd, enabled/restart/backoff intent, heartbeat store and sealed log refs, reconcile by delegating to the existing service-launch lifecycle primitive, and expose compact desired/actual/last-pulse readback before proving unattended restart.