Carry continuation failure review authority

epiphany-core/src/resident_self.rs

@@ -2052,6 +2052,7 @@ pub fn prepare_resident_self_launch(
         *mode_index = "execute".into();
         argv.extend([
             "--auto-review".into(),
+            "--supersede-failed-results".into(),
             "--required-action".into(),
             required_action,
         ]);
@@ -5069,6 +5070,10 @@ mod tests {
         assert_eq!(resident_prepared_launch_thread_id(&prepared)?, "thread-1");
         assert!(prepared.argv.windows(2).any(|pair| pair == ["--mode", "execute"]));
         assert!(prepared.argv.iter().any(|arg| arg == "--auto-review"));
+        assert!(prepared
+            .argv
+            .iter()
+            .any(|arg| arg == "--supersede-failed-results"));
         assert!(prepared.argv.windows(2).any(|pair| {
             pair == ["--required-action", "reviewModelingResult"]
         }));

notes/epiphany-current-algorithmic-map.md

@@ -3607,7 +3607,8 @@ Mind review into another grant, so a brake release could not advance c006.
 - Outputs: at most one idempotent
   `coordinator-internal-continuation` pressure. Its launch is objective-free,
   uses the receipt thread and mounted cognitive runtime, executes exactly one
-  step with auto-review, and carries the receipt-derived required action.
+  step with auto-review and typed failed-result supersession, and carries the
+  receipt-derived required action.
 - Derived state: receipt reason prose, rendered status, pulse artifacts,
   readiness rows, timers, and operator projections are observations. They do
   not create continuation authority.
@@ -3623,11 +3624,23 @@ Mind review into another grant, so a brake release could not advance c006.
   execute mode only when its exact action is safe. Before any action match, the
   coordinator rederives live status; disagreement emits a no-consequence
   required-action refusal, closes the stale pressure, and publishes the newly
-  derived action without executing it.
+  derived action without executing it. If Mind rejects a terminal role result,
+  the coordinator's existing failure-review owner supersedes that exact result
+  and derives fresh work in the same bounded run; process failure is not the
+  rejection protocol.
 - Verification: 30 resident tests and all 18 coordinator tests pass. Exact
   receipt replay creates one pressure and one objective-free execution argv;
   repeated ingestion is idempotent; a Hands final action creates no pressure;
   and source order proves required-action refusal precedes every action effect.
 
-Packaging and copied-c006 turnover remain required before this source cut is
-accepted live. Actual c006 remains on exact `16407f7e`, braked and unchanged.
+Exact `4d6d269f` packaged the first cut as 24 binaries, release
+`sha256-ff371697ce78a1daa3322c0cac988582d548747ae7fddbfb1d9f5626a37d3344`,
+and witness
+`sha256-44c9d61787520a2f38fad1362230d283954a6019fd392600fe112115ca22c0fa`.
+Copied c006 proved the one pending pressure and zero grants under brake, then
+exposed the missing supersession launch context: Mind correctly rejected an
+unanchored Modeling patch, but twelve process-failed attempts requeued the same
+pressure before intervention. The copied brake is engaged and those receipts
+are preserved. Package and replay the supersession fix from a fresh pre-fault
+clone before acceptance. Actual c006 remains on exact `16407f7e`, braked and
+unchanged.

notes/fresh-workspace-handoff.md

@@ -1,5 +1,36 @@
 # Fresh workspace handoff
 
+## Copied continuation exposed missing failure-review context - 2026-08-11
+
+Exact `4d6d269f` packaged 24 Linux binaries as
+`sha256-ff371697ce78a1daa3322c0cac988582d548747ae7fddbfb1d9f5626a37d3344`
+with witness
+`sha256-44c9d61787520a2f38fad1362230d283954a6019fd392600fe112115ca22c0fa`
+and no warnings. A clean stopped snapshot of actual c006 was copied into three
+named volumes with byte-identical manifests; the exact actual owners restarted
+unchanged with exit-zero stop receipts. Under the copied brake, exact typed
+inspection found one pending `coordinator-internal-continuation` pressure from
+receipt `coordinator-run-linux-eyes-tools-c005-1786396551246`, required action
+`reviewModelingResult`, zero continuation grants, revision 26, and no active
+turn.
+
+After copied brake release, Heartbeat granted the pressure exactly once, but
+Mind rejected the Modeling patch because `nodes[2]` had neither anchors nor a
+source-hash anchor. The continuation launch omitted the coordinator's existing
+`--supersede-failed-results` authority, so the rejection escaped as process
+failure and Heartbeat issued twelve attempts before intervention. The copied
+brake is engaged; attempt receipts and snapshots are under
+`.epiphany-run/continuation-4d6d269f`. Actual c006 remained braked on exact
+`16407f7e`.
+
+The source repair adds typed failed-result supersession only to receipt-bound
+internal continuations. Mind still rejects the malformed aggregate; coordinator
+failure review owns supersession and derives fresh work. The exact resident
+argv test and all 18 coordinator tests pass. Commit and package this repair,
+then replay from a fresh pre-fault clone. Require one rejection/supersession,
+a newer causal receipt and grant, no process-failure retry loop, and zero
+Hands/Persona/deployment consequence.
+
 ## Internal cognition continuation implemented; live proof pending - 2026-08-11
 
 The post-endurance audit found actual c006 coherently asleep but unable to turn

state/map.yaml

@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_16407f7e_alive_braked_revision_26_after_one_fulfilled_proposal_modeling_grant_and_923_pulse_endurance
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, and Docker named-volume atomic snapshot visibility are accepted live. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Commit and package the receipt-bound internal cognition continuation cut using the persistent Starfire cache. On copied c006 require the stranded reviewModelingResult receipt to create exactly one objective-free continuation grant, admit or refuse the exact Modeling result through Mind, advance to a genuinely newer causal receipt/grant, and preserve zero Hands/Persona/deployment consequence. Only after copied acceptance replay a bounded actual-c006 brake window and re-engage the brake. Yggdrasil never builds.
+  next_action: Commit and package the continuation failure-review context repair. Recopy pristine braked c006 and require the malformed Modeling patch to be rejected and superseded once inside a successful bounded coordinator receipt, then require a genuinely newer causal receipt/grant without process-failure requeue or Hands/Persona/deployment consequence. Only after copied acceptance replay a bounded actual-c006 brake window and re-engage the brake. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.

state/scratch.md

@@ -4,53 +4,38 @@ Disposable working memory for one bounded rite.
 
 ## Current Subgoal
 
-Autonomous frontier turnover after exact `16407f7e` c006 endurance.
+Replay copied c006 after repairing missing continuation failure-review context.
 
-## Current mechanism
+## Live finding
 
-1. `ingest_resident_self_domain_pressure` creates pressure only for an admitted
-   model-direction consideration request, the oldest unlaunched proposal
-   Modeling request, or admitted Persona feedback consideration.
-2. Heartbeat owns oldest-pending pressure selection and atomically consumes it
-   into one exact grant.
-3. Resident Self launches the coordinator against the typed request. Typed
-   worker output is sufficient to settle that grant.
-4. The coordinator's own status derivation then owns the next internal action,
-   but no nervous-system owner currently converts that exact safe continuation
-   into another pressure.
+Exact `4d6d269f` created one correct receipt-bound pressure and no grant under
+brake. After release, Mind rejected the old Modeling result because its patch
+would create an unanchored node. The continuation argv lacked
+`--supersede-failed-results`; coordinator therefore terminalized as failed and
+resident Self requeued the same pressure twelve times before the copied brake
+intervened.
 
-Actual c006 proves the seam: proposal Modeling job
-`5ff2704b-64eb-42f1-9ca4-ca7144e33ae4` fulfilled and Self closed the grant at
-revision 26. Exact packaged coordinator status now says
-`reviewModelingResult`; runtime has no actionable Hands or Eyes frontier,
-Imagination eligibility is empty, planning is terminal, and resident pressure
-is empty. Releasing the brake cannot advance the machine.
+## Authority map for the repair
 
-## Authority map before implementation
-
-- Owner: Self's source-grounded coordinator decision owns which internal
-  cognition transition is next. The exact runtime result/request/state revision
-  own the decision's identity. Heartbeat owns only delivery order.
-- Inputs: authenticated runtime identity/thread, exact current RepoModel and
-  admission receipt, typed worker results and launch bindings, acceptance or
-  supersession receipts, current coordinator state revision, and brake.
-- Outputs: at most one idempotent internal-cognition continuation pressure
-  naming the exact decision basis. It may launch only the already-derived safe
-  coordinator action.
-- Derived state: rendered status, role-board prose, Heartbeat pulse artifacts,
-  and provider rows are observations and cannot create continuation authority.
-- Forbidden writers: timers, generic idle polling, old lane status, operator
-  projections, and resident lifecycle retention cannot invent or retry work.
-  Hands, Persona, deployment, and external consequence actions are excluded
-  from autonomous continuation.
-- Shared paths: proposal Modeling review/admission, Eyes gathering, causal
-  Modeling, Imagination planning, Mind review, and typed decision commit must
-  use the same decision identity and single-consumption pressure primitive.
-- Cut line: do not add a blind coordinator wake loop or treat every completed
-  worker as a generic retry. If coordinator decision derivation cannot be made
-  a narrow core-owned typed projection, stop and move the owner rather than
-  copying binary status logic into resident Self.
-- Verification: actual c006 remains braked. First prove on copied exact state
-  that the stranded result creates one continuation, settles once, advances to
-  a genuinely new causal decision, never emits Hands/Persona authority, and
-  cannot resurrect after retention or restart.
+- Owner: Mind owns patch admission and rejection. Coordinator failure review
+  owns superseding the exact rejected role result. Heartbeat owns neither.
+- Inputs: the exact terminal Modeling result, its admission error, the existing
+  coordinator supersession contract, the receipt-derived required action, and
+  a one-step execution bound.
+- Outputs: one typed role-failure supersession followed by a successful bounded
+  coordinator receipt whose newly derived action can become a distinct causal
+  pressure.
+- Derived state: process exit, resident cancellation, retry count, and error
+  log are evidence of the missing context; they are not rejection authority.
+- Forbidden writers: Mind may not accept the malformed aggregate; resident
+  Self and Heartbeat may not invent a replacement result or generic retry
+  policy; timers may not heal the loop.
+- Shared paths: every safe receipt-bound role review launch carries the same
+  existing failed-result supersession capability. Direct operator runs retain
+  their explicit policy choice.
+- Cut line: add the existing coordinator capability to continuation argv. Do
+  not weaken memory-graph validation or add another retry state machine.
+- Verification: exact argv test plus all coordinator tests; package once; copy
+  pristine braked c006 again; require one rejection/supersession, a successful
+  receipt, a genuinely newer pressure/grant, no process-failure loop, and zero
+  Hands/Persona/deployment consequence.