diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index 26ff88f1..97924b1b 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -2255,3 +2255,23 @@ hostility, and Idunn accidentally treating warming as active.
 The current live run remains diagnostic evidence only until its terminal
 workspace receipt, exact aggregate RUDP health, and deployment witness land.
 No reboot is authorized.
+
+Checkpoint implementation cut: the authoritative batch checkpoint lives in
+the repository Body CultCache, not the local Verse. It is admitted by one CAS
+against unchanged Body/obligation/plan/running claim/running attempt and a
+claim-scoped checkpoint head. Each checkpoint carries a contiguous canonical
+plan range plus the exact ordered point, payload-hash, and vector-hash bindings
+read back from Qdrant after a waited upsert. The signed Verse progress event
+references the checkpoint's exact CultCache envelope digest; neither a random
+provider hash nor Qdrant operation text is evidence. Terminal readiness still
+requires the existing whole-collection scroll and receipt/head CAS.
+
+Same-claim retry may continue only from a contiguous authenticated checkpoint
+chain whose batches still re-observe exactly in Qdrant. Recovery uses a new
+claim epoch and new epoch-fenced collection. A successor may authenticate and
+copy predecessor checkpoint batches into its own collection after exact death
+and recovery proof, then emit new-claim checkpoints citing the source envelope;
+it never mutates or inherits the old collection. If live external evidence is
+missing or changed, it restarts from zero. Required backend cuts are a single
+bounded waited upsert, exact retrieve-by-ID with vectors/payloads, and a common
+readback/checkpoint primitive for newly embedded and recovered copied points.
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index 37a9a71a..59921a7f 100644
Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ
diff --git a/state/map.yaml b/state/map.yaml
index 987a5c1e..a7ca7589 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -4,6 +4,7 @@ experiment:
   modeling_body_grounding: "Every coordinator-owned Modeling launch observes and carries one typed RepositoryBodyObservationBasis before worker thought. The immutable launch binds runtime/swarm/workspace/scope, Body-binding hash, observation generation/id/root, and scan interval. Modeling output contract v3 requires the exact worker-authored echo; ingress reloads the immutable launch and rejects missing/swapped basis, while non-Modeling cargo is forbidden. Mind admission review v1 and receipt v5 preserve that basis; admission validates exact launch/result/review equality plus the immutable historical Body artifacts, then copies it into the CAS receipt. Admission never samples current Body as a substitute. Direct Mind plan adoption and legacy migration remain explicitly ungrounded."
   workspace_retrieval_coverage: "The production-unwired retrieval.rs oracle is deleted. Legacy EpiphanyRetrievalState is presentation-only: clean Ready projects Missing and its indexing job is unavailable/unowned. Native coverage binds an authenticated Repository Body manifest, exhaustive versioned inclusion policy, deterministic chunks/point payloads, immutable Ollama tag+artifact digest identity, vector dimensions, exact Qdrant point/payload/vector observations, and one terminal-CAS receipt/head. A read-only live evidence reader now re-scrolls the exact compatible collection, recomputes payload/vector bindings, and byte-revalidates the entire authority chain after the external read. Coverage success proves only this exact Body projection; Mind alone may join it with the other repository authorities."
   workspace_coverage_projector: "The dedicated workspace-coverage projector is the only coverage writer. Its reserved supervisor/CultMesh policy fixes the packaged sibling binary and exact runtime/Verse/Qdrant/Ollama args; generic policy, arbitrary command, workspace, Body-store, collection, and dimension inputs are forbidden. The binary authenticates current policy-bound launch receipt, PID, executable hash, runtime id, and host singleton before the service derives the immutable Body route. One persisted Body basis plus one authenticated read session prepares verified UTF-8 chunks; an exact Current fast path reads no worktree files. Claims/attempts bind exact managed-process launch and executor incarnation. Every pulse re-resolves the mutable Ollama tag to its installed artifact digest, probes dimensions, embeds only after claim acquisition, writes an epoch-fenced managed Qdrant collection, whole-scrolls typed payloads and unnamed vectors, rejects cyclic offsets and duplicate/extra/missing/substituted/nonfinite/wrong-dimension/wrong-vector points, then terminal-CASes receipt/head against exact Body/plan/claim/prior-head authority. Body history owns bounded retirement of terminal non-current collections; running/current collections are preserved and deletion requires exact managed metadata. Idunn recovery uses specialized process authority only: immutable exact predecessor termination must exist before a host-signed replacement launch can claim the one replacement slot; the replacement's latest signed heartbeat must be ready; one Body CAS then terminalizes the abandoned claim/attempt, advances the fencing epoch, and persists an immutable recovery receipt binding old claim, termination, replacement launch, ready heartbeat, and successor claim. Live Yggdrasil pressure exposed one remaining authority split: execution is monolithic, accumulates every embedding before durable Qdrant publication, and emits its signed provider heartbeat only after the potentially hour-long pulse returns. Ollama logs and GPU utilization are observation only. The next owner is a separate provider-signed projection-progress document bound to exact launch, claim/attempt epoch, sealed plan, Body generation, model artifact, and durable checkpoint; heartbeat remains liveness, progress proves advancing work, and receipt/head alone prove Current. Idunn must derive warming only from the authenticated join and a per-operation no-advance deadline, never from a larger total wall timeout. Query admission remains absent."
+  workspace_coverage_checkpoint: "The durable batch checkpoint belongs in the repository Body CultCache beside obligation/plan/claim/attempt authority; local Verse progress only references its exact CultCache envelope digest. The projector embeds one canonical contiguous plan batch, performs one waited Qdrant upsert, reads exactly those IDs back with payloads and vectors, compares exact payload and submitted-vector hashes, then provider-signs and Body-CAS-admits a checkpoint containing the exact ordered point/payload/vector bindings. A claim-scoped checkpoint head chains exact sequence, predecessor id+envelope digest, plan ordinals, cumulative/total count, collection, Body/plan/model/claim/attempt/launch authority, and provider incarnation. The CAS expects unchanged Body, obligation, plan, running claim, running attempt, and prior checkpoint head. Batch checkpoints never replace terminal whole-scroll verification or receipt/head. Same-claim retry resumes only from an authenticated contiguous chain re-observed live in Qdrant; an acknowledged write lacking a checkpoint is retried idempotently. Recovery always uses a new epoch-fenced collection: after exact predecessor termination and recovery authority, the successor may re-observe and copy authenticated predecessor batches into its new collection and issue new-claim checkpoints citing their source checkpoint envelopes. Missing or changed external evidence restarts from zero. No successor mutates or inherits the predecessor collection."
   repository_readiness_join: "Mind owns the implemented race-bounded RepositoryReadinessProjection operation. It freshly observes Body R1; derives canonical RepoModel, the unique current v5 Body-grounded admission, and the complete succeeded Modeling semantic chain from one raw opening CultCache snapshot; authenticates live semantic vectors and live workspace coverage bound to R1; observes Body R2 and requires the same content identity/root; repeats both live reads; derives the closing authority from one raw full snapshot; and atomically appends a historical observed-ready-at projection only if that complete snapshot is unchanged. Stored projections never grant current readiness. A→B→A is acceptable only as equal content-addressed endpoints. CultCache now fences full-snapshot cardinality with tuple (type,key) identity. Legacy retrieval Ready, timestamps, watcher silence, Git OIDs, collection existence/counts, Hands receipts, Eve/Gjallar, and prior readiness projections are forbidden substitutes."
   coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output."
   modeling_admission_dogfood: "Source-grounded Modeling now completes with typed Body-basis ingress and substantial RepoModel node/edge proposals, proving the source/tool/output path. Mind first refused an ordinary Evolution patch that attempted unrequested frontier mutation, then refused a nodes/edges-only patch whose invented workspace-derived domain and Active lifecycle violated the canonical aggregate. Both were superseded through typed admission-rejection review. Modeling launch context now carries the current model revision/hash and exact existing domain ids plus legal repo lifecycles; Evolution mutates nodes/edges only and frontier mutation remains request-bound. A fresh run against the post-fix Body is still required before repository readiness can join."