Map coordinator runtime session ownership

notes/epiphany-current-algorithmic-map.md

@@ -2711,6 +2711,60 @@ Live receipts are under `.epiphany-run/firewall-bffbaa45`. A non-elevated
 reconciliation attempt was denied before mutation and left identical snapshots;
 it is recorded as a negative authority check, not misreported as idempotence.
 
+### Coordinator runtime-session closure and retention gap
+
+The broad runtime-history remainder is not an unclassified pile. Exact
+model-adapter generations are already bounded by
+`archive_completed_model_session`: it validates terminal jobs, native/provider
+request streams and receipts, tool bindings/intents/receipts, and runtime events,
+then replaces that exact family with `EpiphanyArchivedRuntimeSession` under one
+full-snapshot fence. Outer-worker and coordinator authority is deliberately
+refused.
+
+The live missing family is native coordinator sessions. The coordinator creates
+`coordinator-{thread_id}` plus a `coordinator.started` event and eventually
+writes `EpiphanyCoordinatorRunReceipt`, but it never calls
+`close_runtime_session`. These sessions therefore remain falsely `Active`
+after process-terminal evidence exists. Receipt retention can later remove the
+receipt, but completed-session retention cannot select the session because it
+requires a nonempty model-adapter job family. This is both unbounded growth and
+a false liveness projection.
+
+Authority map for the cut:
+
+- Owner: runtime spine owns one atomic coordinator-run terminalization
+  transaction. Neither resident Self nor the artifact writer closes the runtime
+  session.
+- Inputs: exact active coordinator session envelope; exact terminal coordinator
+  receipt bound to its session and thread; the absence of session jobs; existing
+  coordinator-started events; one terminal timestamp.
+- Outputs: in one full-snapshot-fenced replacement, persist the immutable run
+  receipt, mark the session `Completed`, and publish exactly one deterministic
+  `session.completed` event.
+- Derived state: coordinator JSON/text artifacts and runtime status projections
+  describe the committed terminal transaction; they do not terminalize it.
+- Forbidden writers: `put_coordinator_run_receipt` followed by a separate close,
+  receipt retention, resident acknowledgement, process exit, and artifact
+  existence may not independently decide session death.
+- Shared paths: every successful native coordinator exit mode uses the same
+  finalizer. Legacy active coordinator sessions may be repaired only from one
+  exact matching terminal receipt, no jobs, and the authenticated coordinator
+  event shape.
+- Retention owner: completed coordinator-session archival owns the whole exact
+  session family, including its coordinator receipt and runtime events. Generic
+  coordinator-receipt retention must preserve receipts still named by a live or
+  completed runtime session; it owns only receipts outside a session family.
+- Cut line: remove the coordinator binary's standalone receipt write. Do not
+  teach model-session archival to ignore coordinator receipts or infer closure
+  from age. Do not leave two independent deleters able to retire the same
+  receipt.
+- Verification: atomic stale-snapshot refusal; exact replay idempotence; legacy
+  repair refusal for zero/multiple/mismatched receipts or any job; active and
+  newest-session preservation; exact old family replacement; unrelated runtime
+  byte identity; tombstone refusal of session/job recreation; and copied exact
+  package proof that terminal coordinator sessions plateau without changing
+  resident authority.
+
 ### Semantic logical lifecycle implementation
 
 `retain_memory_semantic_projection_lifecycles` now realizes the safe unattempted

notes/fresh-workspace-handoff.md

@@ -1925,3 +1925,26 @@ under `.epiphany-run/firewall-bffbaa45`. Active c005 was untouched.
 
 Next: map bounded runtime model event/session/tool history and its
 non-resurrection boundary before editing. Yggdrasil never builds.
+
+## Coordinator runtime-session retention gap mapped — 2026-08-10
+
+Existing `archive_completed_model_session` already owns the exact closed
+model-adapter family, including native/provider streams and tool evidence. It
+correctly refuses outer-worker and coordinator authority. The actual remaining
+growth fault is upstream: `epiphany-mvp-coordinator` creates a
+`coordinator-{thread_id}` runtime session and start event, then writes a
+terminal coordinator receipt without ever closing the session. The store keeps
+false `Active` sessions indefinitely; generic receipt retention may later
+remove their only terminal evidence.
+
+The next cut is an atomic runtime-spine finalizer for receipt + completed
+session + deterministic completion event. Completed coordinator-session
+archival then owns that exact family, including its receipt. Generic receipt
+retention must preserve every receipt still named by a live/completed session
+and own only orphans; two deleters may not race for the same authority. Legacy
+repair is permitted only from one exact matching terminal receipt, no jobs, and
+the authenticated coordinator event shape. Do not weaken model-session
+refusals or infer terminality from age.
+
+Next: implement the owner cut with hostile CAS/replay/legacy tests, then package
+and prove copied-state plateau. Preserve active c005. Yggdrasil never builds.

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Starfire's stable Persona-permit firewall authority is accepted from gamecult-ops 6ee08a4 and authoritative live state. The same exact enabled local rule exists in both PersistentStore and ActiveStore: inbound Public UDP 17877, local 10.77.0.2, remote 10.77.0.1, interface wg-gamecult-starfire. Zero per-release permit application rules exist. WireGuard is automatic/running with the exact local address. A non-elevated reconciliation attempt was refused before mutation and preserved identical snapshots.
+  latest_phase: Runtime-history mapping found the remaining live growth fault: exact model-adapter sessions are already fully archived, but native coordinator sessions write terminal receipts without closing their runtime session and remain falsely Active forever. The next cut atomically owns receipt plus session completion plus completion event, then lets one coordinator-session archive own the whole old family. Generic receipt retention must preserve receipts still named by runtime sessions.
   operational_state:
     local_worktree: persona_conversation_retention_accepted_clean
     operator_wireguard: restored
@@ -69,8 +69,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: authenticated_9b8df0b4_c005_bound_to_eyes_tools_nervous_system_with_217dd_and_bd96305e_helpers_running
-  unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, deployed supervisor/projector log retention, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, and stable Starfire firewall ownership are accepted. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. Broader model event/session/tool history remains separately bounded only by completed-session retention. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Map bounded runtime model event/session/tool history ownership and its non-resurrection cut, then implement the smallest coherent retention pass. Preserve active c005 and exact prior receipts. Yggdrasil never builds.
+  unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, deployed supervisor/projector log retention, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, and completed model-adapter session archival are accepted. Native coordinator sessions remain falsely Active after a terminal receipt and therefore cannot retire. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
+  next_action: Implement atomic coordinator receipt/session closure and single-owner completed coordinator-session archival with hostile replay, CAS, legacy repair, and non-resurrection tests. Preserve active c005 and exact prior receipts. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.