Epiphany/state/scratch.md

# Scratch

Disposable working memory for one bounded rite.

## Current subgoal: subtraction audit

The fresh-package Ox17 deployment lane is paused. Do not compile, package,
deploy, or resume a historical Ox root until this audit has made the source
machine smaller and the canonical map explicitly reopens that lane.

## Triggering evidence

- Idunn's interrupted native build left three commit-keyed test targets of
  24 GiB, 27 GiB, and 27 GiB plus 19 GiB of release construction caches.
  All were dead compiler scratch and were removed on Yggdrasil; the Cargo
  target root returned to 4 KiB.
- One target consisted of 19 GiB `debug/deps`, 4.9 GiB incremental state, and
  388 MiB build-script output. Several individual test harnesses were
  500--700 MiB.
- `epiphany-core` declared 75 binary targets. The root release bundle declared
  another 26 targets, many by pointing at the same source files. Exact
  `1d5a1f17` reduced core to 30 binaries with zero duplicate owners and removed
  19,252 net non-vendor lines. The current cut reduces core again to its one
  explicit maintenance binary. Exact `a78c1802` deletes that ceremonial
  compaction checker as well. Exact `d2aee1ce` deletes the duplicate packaging
  CLI. Subsequent cuts leave 9 total Cargo executable
  targets across the workspace, with no duplicate binary-source owner.

The storage failure is evidence of source-shape failure. Build-profile flags
and janitors may reduce the symptom but cannot substitute for deleting code.

## Authority map

- Owner: each live organ or operator tool owns one executable boundary only
  when process isolation, privilege isolation, lifecycle ownership, or an
  independently deployable contract requires it.
- Inputs: the canonical runtime/service maps, Idunn's immutable release bundle,
  current systemd manifests, operator-tool call sites, and source-grounded test
  coverage.
- Outputs: a minimal release binary set and library/integration tests for
  verification that does not need a separately shipped process.
- Derived state: smoke runners, fixtures, benchmarks, and migration probes are
  test/development surfaces. They do not become runtime organs merely because
  Cargo can compile them as binaries.
- Forbidden writers: historical docs, stale smoke commands, and previous
  package manifests cannot preserve an executable that no live authority uses.
- Shared paths: development verification and Idunn acceptance must exercise the
  same library/runtime contracts without compiling duplicate wrappers.
- Cut line: delete unowned legacy executables; collapse table-shaped smoke
  families into ordinary tests; give each surviving production entrypoint one
  Cargo package owner; remove root/core duplicate bin declarations; then
  reassess crate boundaries and the release list. Do not add build cleanup or
  cache machinery as a substitute for this cut.

## Immediate audit order

1. Done in the current worktree: Persona social state is keyed and separately
   owned; the final heartbeat scheduler module, binary, schema, service, store,
   deployment path, pacing/history, stale repair, and acknowledgement consumer
   are deleted. Resident Self owns the complete grant lifecycle directly.
2. Done: delete `runtime_store_migration`, its receipt registration, and its
   test. The approved migration has no writable migrator.
3. Done: delete the local PowerShell operator wrapper, direct Persona/operator
   binaries, shipped `verse-query` control plane, and all Epiphany-owned
   Rider/Unity integration. Brokkr owns Unity through CultMesh/Eve; a future
   Rider daemon owns Rider.
4. Done: reduce `epiphany-core` from 30 binary targets to zero. The final
   compaction helper duplicated the existing state view plus Git inspection
   and did not earn an executable boundary.
5. Done: delete the callerless Persona mouth/permit identity executables, their
   release roles, and enrollment wrappers. Purpose-specific identities remain;
   separate setup processes do not.
6. Done: delete the standalone Persona feedback ingress, its release role, and
   old Starfire snapshot seam. Resident Self already owns the authenticated
   Bifrost import.
7. Done: delete the three unadmitted Atlas daemon shells and release roles;
   retain typed library owners until Gate 1 proves the minimum process topology.
8. Done: delete the callerless frontier-proposal wrapper and release role;
   typed proposal intake and selection remain in Self/runtime.
9. Done: delete the host-identity command and private-custody implementation;
   retain only Bifrost public-anchor verification plus deterministic test fixtures.
10. Done: delete the callerless Hands consequence recorder, release role,
   command-description handshake, and main-only tests. It executed nothing;
   the coordinator now reports `awaitingHandsExecutor`, while exact typed
   receipt-chain admission remains for a future real actuator.
11. Done: delete three redundant helper-spelling/cache-policy tests and the
   single-use Git argument helper while retaining source-cache recovery,
   cache-separation, tool-loop transition, and terminal-failure proofs.
12. Done: collapse the generic public host-identity verifier into Bifrost
   feedback admission. CultNet owns the shared public shapes; exact legacy
   domains and anchor bytes remain compatible; generic aliases, exports, and
   setup fixtures are gone.
13. Done: audit the Persona Discord permit process. Bifrost's live delivery
   tool consumes its short-lived request-bound signature, and the distinct key
   is an earned privilege boundary. Retain it; repair the missing Ygg unit and
   stale Starfire endpoint through Idunn before Persona consequence readiness.
14. Done: delete the 366-line pre-compaction phrase checker and its Cargo
   target. Agents inspect the existing state status and Git owners directly.
15. Done: delete `epiphany-package`. `epiphany-release` already owns the same
   package/inspect operations plus publish, and no live caller names the leaf
   wrapper.
16. Done: audit `epiphany-release-construction` tests by externally
   consequential claim. Delete implementation spelling, mirrored constants,
   deterministic self-equality, source-shape assertions, and duplicate proof;
   preserve exact
   CAS, conflict, substitution, concurrency, lifecycle, and re-entry proofs.
   The semantic-memory/workspace-coverage projection stack and its local daemon
   supervisor were deleted at `856648de` after proving that no sealed reasoning
   projection consumed them.
17. Done: delete the coordinator runtime-options factory and its field-assignment
   test, the literal-membership stop test, the credential predicate test
   duplicated by file-level permissions proof, and same-call cache equality.
18. Done: audit `repository_body_observer` tests and private helpers by exact
   Body consequence. Preserve authentication, read-only loading, raw-byte and
   hostile-Git sight, immutable binding, conflict, tamper, and generation proof.
   Exact `79292fe3` makes one authenticated snapshot own route, binding,
   observation, and manifest validation; duplicate store reopens, a private
   scanner-session test, and fixture-wide route assertions are gone.
19. Done: audit the `runtime_spine.rs` public surface by live non-test caller,
   persisted document owner, and external consequence. Exact `25d4d1fa`
   deletes twenty-four callerless public functions, the tool-status DTO, and
   the wholly unconsumed Hands route-relinquishment lifecycle: 800 source
   lines with no replacement. The surviving keyed lifecycle still proves
   atomic Hands-to-Verification admission and concurrent Persona/Hands writes.
20. Done: exact `1fea7bde` deletes the last callerless Hands receipt-chain
   reader and timestamp selector, then demotes the summary to private atomic-
   commit cargo: 77 lines.
21. Done: exact `40d00bc5` collapses the 100-line planning-eligibility tableau
   and its two DTOs onto the shared actionable-frontier predicate. Hands and
   Imagination retain the same unchallenged-target rule; the keyed lifecycle
   proof passes.
22. Done: exact `ac6455c5` demotes the three individual archive actuators and
   removes five always-noop transaction callbacks. Their retention owners keep
   the exact snapshot/CAS fences; no caller can inject a transaction opinion.
23. Done: exact `6e600e8d` rebuilds the broad proposal/Hands/Persona proof from
   the real admitted Imagination direction chain, then deletes the test-only
   user proposal intake, generic writer and selector, four source variants,
   constant provenance/privacy/public-source fields, compatibility hash branch,
   and provider schema branching. Mind/runtime epochs advance to v5/v8.
24. Done: exact `82f4733d` removes `desired_outcome` (always the proposal
   body), `scope_hints` (always empty), and `proposed_at` (copied from the exact
   bound Imagination result) from proposal state, payload identity, and the
   sealed Modeling projection: 37 net deletions. Mind/runtime epochs are v6/v9.
25. Done: exact `6fbd8184` removes repository/workspace/thread/runtime mirrors
   from inert proposal content. The atomic Modeling request owns the coordinates;
   autonomous validation derives that request from binding runtime plus proposal
   identity and checks it against exact Body/domain and Imagination provenance.
   Mind/runtime epochs are v7/v10.
26. Next: resume the public runtime-spine and test-liability audit by live owner
   and consequential invariant.
27. Run focused tests after each cut. Only after source subtraction stabilizes
   should Idunn's build scratch contract be reconsidered.