Epiphany/state/scratch.md

# Scratch

Disposable working memory for one bounded rite.

## Current subgoal: subtraction audit

The fresh-package Ox17 deployment lane is paused. Do not compile, package,
deploy, or resume a historical Ox root until this audit has made the source
machine smaller and the canonical map explicitly reopens that lane.

## Triggering evidence

- Idunn's interrupted native build left three commit-keyed test targets of
  24 GiB, 27 GiB, and 27 GiB plus 19 GiB of release construction caches.
  All were dead compiler scratch and were removed on Yggdrasil; the Cargo
  target root returned to 4 KiB.
- One target consisted of 19 GiB `debug/deps`, 4.9 GiB incremental state, and
  388 MiB build-script output. Several individual test harnesses were
  500--700 MiB.
- `epiphany-core` declared 75 binary targets. The root release bundle declared
  another 26 targets, many by pointing at the same source files. Exact
  `1d5a1f17` reduced core to 30 binaries with zero duplicate owners and removed
  19,252 net non-vendor lines. The current cut reduces core again to its one
  explicit maintenance binary. Exact `a78c1802` deletes that ceremonial
  compaction checker as well. Exact `d2aee1ce` deletes the duplicate packaging
  CLI. Subsequent cuts leave 9 total Cargo executable
  targets across the workspace, with no duplicate binary-source owner.

The storage failure is evidence of source-shape failure. Build-profile flags
and janitors may reduce the symptom but cannot substitute for deleting code.

## Authority map

- Owner: each live organ or operator tool owns one executable boundary only
  when process isolation, privilege isolation, lifecycle ownership, or an
  independently deployable contract requires it.
- Inputs: the canonical runtime/service maps, Idunn's immutable release bundle,
  current systemd manifests, operator-tool call sites, and source-grounded test
  coverage.
- Outputs: a minimal release binary set and library/integration tests for
  verification that does not need a separately shipped process.
- Derived state: smoke runners, fixtures, benchmarks, and migration probes are
  test/development surfaces. They do not become runtime organs merely because
  Cargo can compile them as binaries.
- Forbidden writers: historical docs, stale smoke commands, and previous
  package manifests cannot preserve an executable that no live authority uses.
- Shared paths: development verification and Idunn acceptance must exercise the
  same library/runtime contracts without compiling duplicate wrappers.
- Cut line: delete unowned legacy executables; collapse table-shaped smoke
  families into ordinary tests; give each surviving production entrypoint one
  Cargo package owner; remove root/core duplicate bin declarations; then
  reassess crate boundaries and the release list. Do not add build cleanup or
  cache machinery as a substitute for this cut.

## Immediate audit order

1. Done in the current worktree: Persona social state is keyed and separately
   owned; the final heartbeat scheduler module, binary, schema, service, store,
   deployment path, pacing/history, stale repair, and acknowledgement consumer
   are deleted. Resident Self owns the complete grant lifecycle directly.
2. Done: delete `runtime_store_migration`, its receipt registration, and its
   test. The approved migration has no writable migrator.
3. Done: delete the local PowerShell operator wrapper, direct Persona/operator
   binaries, shipped `verse-query` control plane, and all Epiphany-owned
   Rider/Unity integration. Brokkr owns Unity through CultMesh/Eve; a future
   Rider daemon owns Rider.
4. Done: reduce `epiphany-core` from 30 binary targets to zero. The final
   compaction helper duplicated the existing state view plus Git inspection
   and did not earn an executable boundary.
5. Done: delete the callerless Persona mouth/permit identity executables, their
   release roles, and enrollment wrappers. Purpose-specific identities remain;
   separate setup processes do not.
6. Done: delete the standalone Persona feedback ingress, its release role, and
   old Starfire snapshot seam. Resident Self already owns the authenticated
   Bifrost import.
7. Done: delete the three unadmitted Atlas daemon shells and release roles;
   retain typed library owners until Gate 1 proves the minimum process topology.
8. Done: delete the callerless frontier-proposal wrapper and release role;
   typed proposal intake and selection remain in Self/runtime.
9. Done: delete the host-identity command and private-custody implementation;
   retain only Bifrost public-anchor verification plus deterministic test fixtures.
10. Done: delete the callerless Hands consequence recorder, release role,
   command-description handshake, and main-only tests. It executed nothing;
   the coordinator now reports `awaitingHandsExecutor`, while exact typed
   receipt-chain admission remains for a future real actuator.
11. Done: delete three redundant helper-spelling/cache-policy tests and the
   single-use Git argument helper while retaining source-cache recovery,
   cache-separation, tool-loop transition, and terminal-failure proofs.
12. Done: collapse the generic public host-identity verifier into Bifrost
   feedback admission. CultNet owns the shared public shapes; exact legacy
   domains and anchor bytes remain compatible; generic aliases, exports, and
   setup fixtures are gone.
13. Done: audit the Persona Discord permit process. Bifrost's live delivery
   tool consumes its short-lived request-bound signature, and the distinct key
   is an earned privilege boundary. Retain it; repair the missing Ygg unit and
   stale Starfire endpoint through Idunn before Persona consequence readiness.
14. Done: delete the 366-line pre-compaction phrase checker and its Cargo
   target. Agents inspect the existing state status and Git owners directly.
15. Done: delete `epiphany-package`. `epiphany-release` already owns the same
   package/inspect operations plus publish, and no live caller names the leaf
   wrapper.
16. Done: audit `epiphany-release-construction` tests by externally
   consequential claim. Delete implementation spelling, mirrored constants,
   deterministic self-equality, source-shape assertions, and duplicate proof;
   preserve exact
   CAS, conflict, substitution, concurrency, lifecycle, and re-entry proofs.
   The semantic-memory/workspace-coverage projection stack and its local daemon
   supervisor were deleted at `856648de` after proving that no sealed reasoning
   projection consumed them.
17. Done: delete the coordinator runtime-options factory and its field-assignment
   test, the literal-membership stop test, the credential predicate test
   duplicated by file-level permissions proof, and same-call cache equality.
18. Done: audit `repository_body_observer` tests and private helpers by exact
   Body consequence. Preserve authentication, read-only loading, raw-byte and
   hostile-Git sight, immutable binding, conflict, tamper, and generation proof.
   Exact `79292fe3` makes one authenticated snapshot own route, binding,
   observation, and manifest validation; duplicate store reopens, a private
   scanner-session test, and fixture-wide route assertions are gone.
19. Done: audit the `runtime_spine.rs` public surface by live non-test caller,
   persisted document owner, and external consequence. Exact `25d4d1fa`
   deletes twenty-four callerless public functions, the tool-status DTO, and
   the wholly unconsumed Hands route-relinquishment lifecycle: 800 source
   lines with no replacement. The surviving keyed lifecycle still proves
   atomic Hands-to-Verification admission and concurrent Persona/Hands writes.
20. Done: exact `1fea7bde` deletes the last callerless Hands receipt-chain
   reader and timestamp selector, then demotes the summary to private atomic-
   commit cargo: 77 lines.
21. Done: exact `40d00bc5` collapses the 100-line planning-eligibility tableau
   and its two DTOs onto the shared actionable-frontier predicate. Hands and
   Imagination retain the same unchallenged-target rule; the keyed lifecycle
   proof passes.
22. Done: exact `ac6455c5` demotes the three individual archive actuators and
   removes five always-noop transaction callbacks. Their retention owners keep
   the exact snapshot/CAS fences; no caller can inject a transaction opinion.
23. Done: exact `6e600e8d` rebuilds the broad proposal/Hands/Persona proof from
   the real admitted Imagination direction chain, then deletes the test-only
   user proposal intake, generic writer and selector, four source variants,
   constant provenance/privacy/public-source fields, compatibility hash branch,
   and provider schema branching. Mind/runtime epochs advance to v5/v8.
24. Done: exact `82f4733d` removes `desired_outcome` (always the proposal
   body), `scope_hints` (always empty), and `proposed_at` (copied from the exact
   bound Imagination result) from proposal state, payload identity, and the
   sealed Modeling projection: 37 net deletions. Mind/runtime epochs are v6/v9.
25. Done: exact `6fbd8184` removes repository/workspace/thread/runtime mirrors
   from inert proposal content. The atomic Modeling request owns the coordinates;
   autonomous validation derives that request from binding runtime plus proposal
   identity and checks it against exact Body/domain and Imagination provenance.
   Mind/runtime epochs are v7/v10.
26. Done: exact `2dfd8c72` deletes the test-only Eyes claim-challenge side
   channel. No live agent pass produced it; one fixture authored both evidence
   and challenge, then invoked the sole writer and asserted its own gating.
   Exact keyed claim/frontier envelopes still refuse stale Planning and Hands
   admission. External evidence must now flow into Modeling and change the
   keyed model itself. The cut removes 465 net source lines; Mind/runtime are
   v8/v11 and claim-obligation documents are v3.
27. Done: exact `3eca3394` deletes the thirteen-field aggregate runtime status
   DTO, its full session/job/tool scans, and the unconsumed coordinator summary
   member plus standalone JSON status artifact. Live readiness consumers need
   only the immutable runtime identity; schema preflight reads the canonical
   registered type catalog directly. The cut removes 96 net source lines and
   one public struct. `runtime_spine.rs` is 10,132 lines.
28. Done: exact `27c8389c` collapses the prepared-heartbeat wrapper into the
   exact envelope batch every caller actually consumes. Its unread full job
   clone and one public struct are gone; the job document remains inside the
   atomic prepared batch. Ten net source lines are removed.
29. Done: exact `bda8d8c6` deletes twelve duplicate aggregate-Mind fields from
   the role-launch contract and every constructor. Every producer supplied
   empty defaults, and the sealed reasoning basis already owns the exact typed
   Mind projection. Launch authority now carries only identity plus its
   family-specific context. The cut removes 255 net source lines.
30. Done: exact `5ed5ca88` internalizes typed-request fulfillment. The request
   reference, process-status classifier, fulfillment function, attempt reader,
   and evidence DTO are crate-only; no external consumer existed. The DTO's
   unread request-ID mirror and one helper-spelling classifier test are gone.
   Exact job/result fulfillment, archive validation, refusal filtering, and
   Resident Self recovery remain. The cut removes 31 net source lines, two
   public functions, and one public struct.
31. Done: exact `7cf6d45c` makes the archived model-session tombstone private
   and minimal. Seven write-only summaries, a duplicate archive/session ID,
   and the unused retention timestamp are gone. The tombstone retains only the
   retired session/job/model/tool identities needed to prevent resurrection
   plus the digest of the exact deleted envelopes. Runtime epoch is v12. The
   cut removes 59 net source lines and one public struct.
32. Done: exact `09001d89` minimizes the decision-bearing archived worker
   attempt without reducing audit reach. Duplicate archive/job identity,
   archive timestamp, retired-type/count summaries, and unused retention
   return vectors are gone. Exact request/terminal identity, deletion digest,
   decision context, structured role result, and terminal job records remain.
   Runtime epoch is v13 and archived-worker schema/type is v2. The cut removes
   41 net source lines.
33. Done: exact `ce306e23` preserves Atlas's inter-swarm publication,
   projection, verification, impact, wake, transport, brake, and Eve path while
   deleting the duplicate Atlas-specific offer/claim write intents, commit APIs,
   registry entries, and two tests. Modeling/RepoModel is the sole offer/claim
   author. Runtime epoch is v14; 593 net source lines are gone.
34. Done: exact `5d507bfd` reduces the autonomous Imagination-to-Modeling origin
   binding from 22 duplicate fields to six causal join fields. Owning proposal,
   request, result, worker, Body, domain, and Modeling documents now supply the
   values the binding previously mirrored. Runtime epoch is v15; 60 net source
   lines are gone.
35. Done: exact `6ccc7dd2` deletes the 20-field transient Hands receipt-chain
   summary. The commit owner derives Verification work directly from the typed
   patch, command, and commit receipts. No schema or test was added; 43 net
   source lines are gone.
36. Done: exact `6831eb69` reduces the Proposal-Modeling launch binding from
   twelve persisted fields to four and replaces global binding scans with exact
   key reads. Request and launch documents remain the owners of the removed
   mirrors. Runtime epoch is v16; 71 net source lines are gone.
37. Done: exact `b0a4978d` deletes the Proposal-Modeling launch-binding type
   entirely. The immutable worker launch owns request, job, role, binding, and
   sealed document identity; current-work, admission, coordinator actuation, and
   archival now consume it directly. Runtime epoch is v17; 70 net source lines
   are gone.
38. Done: exact `07529fb5` collapses the single-consumer
   `epiphany-state-model` package into a plain Core-owned module. Unused
   JsonSchema/TypeScript derives, `schemars`, `ts-rs`, duplicate graph
   re-exports, stale WebSocket patch pins, and 99 lockfile lines are gone. The
   commit removes 201 maintained lines net and one Cargo package without a
   schema-epoch change.
39. Done: exact `edb5c3a3` deletes the eight optional family request-ID mirrors
   from the generic worker launch and heartbeat options, then deletes the same
   echoes plus Body-basis and route echoes from terminal role results. The
   sealed typed launch owns live family identity; archived attempts own retained
   request identity. Runtime is v39, the role-result contract is v5, and 443 net
   maintained lines are gone.
40. Done: exact `cabdd6c3` splits coordinator incarnation authority from generic
   model sessions. Model sessions now contain only identity plus active/completed
   admission state. An immutable coordinator-run basis records exact launch
   provenance; deterministic typed terminality plus its full receipt or death
   recovery owns terminal outcome. Competing outcomes collide on one semantic
   identity without a whole-store snapshot. Runtime is v40. The one-field model
   session options wrapper, duplicated prose/timestamps, four dead session
   states, and the dead snapshot-append helper are gone; 62 maintained lines are
   removed net.
41. Done: exact `a46725a1` removes `EpiphanyRuntimeJob` creation/update clocks
   and the unwritten Running, WaitingForReview, and Cancelled states. Jobs are
   now only Queued/Completed/Failed admission latches. Frontier Research derives
   authority from the exact attempt set and refuses multiple live or successful
   authorities instead of choosing the newest timestamp. Runtime is v41; 67
   maintained lines are removed net.
42. Done: exact `10a70afc` reduces `EpiphanyRuntimeJob` to identity plus status.
   Sealed launches own outer-worker role, model bindings own model-session
   membership, and outer workers belong structurally to the root session. Jobs
   and generic results lose role/session mirrors; results also lose their empty
   metadata map. Session closure, tool ownership, and retention derive exact
   joins; duplicate results refuse instead of sorting by time. Runtime is v42;
   73 maintained lines are removed net.
43. Done: exact `53e869c0` removes evidence/artifact mirrors from generic
   runtime job results and completion options. Structured role/reorientation
   outcomes remain their sole owners; failure physiology retains its terse
   summary, next move, completion time, verdict, and optional context. Runtime
   is v43; 51 maintained lines are removed net.
44. Done: exact `8eaa96c5` stops persisting generic job results when an exact
   typed role/reorientation outcome exists. Job/process terminalization CAS
   strong-reads and byte-identically replays that structured envelope. Fulfilled
   archives retain context plus the full typed result, not a generic companion.
   Runtime is v44 and archived attempts are v3. The source delta is +7 lines for
   the exact CAS fence while deleting the durable duplicate authority.
45. Next: determine whether the residual generic result contract can disappear
   entirely. Map model transport to its native receipt/failure, model-backed
   outer failure to EpiphanyModelPassFailure, process death to its exact claim,
   and reorientation failure to its context/model failure before cutting it.
46. Continue the public runtime-spine and test-liability audit by live owner
   and consequential invariant. Do not subtract the unrun Atlas vertical slice;
   no inter-swarm collaboration has yet been exercised. Streamline it only
   around its one end-to-end authority map.
47. Run focused tests after each cut. Only after source subtraction stabilizes
   should Idunn's build scratch contract be reconsidered.