Epiphany/notes/fresh-workspace-handoff.md

# Fresh Workspace Handoff

## Organizational product posture and current release blockers — 2026-07-18

This is not a special dogfood experiment. Epiphany's normal organizational
product is a resident swarm that persistently models its authorized domain,
derives bounded direction from that map, autonomously imagines improvements and
features, and exposes a repository Persona through which the organization can
converse and provide attributed feedback. Instructions are optional pressure;
they are not the only source of useful work. Feedback is likewise pressure, not
Mind adoption, Hands authority, Bifrost release authority, or Idunn deployment
authority.

The signed VoidBot -> Bifrost -> Epiphany feedback path and the resident
Self -> Imagination proposal-only path are implemented locally. The four
structural release blockers identified in the first Soul audit are now closed
in source and local proof:

- admitted feedback now lives in a dedicated `persona-feedback.cc` store, not
  shared local Verse; classification is exact and Imagination has no direct
  Persona-reply route;
- Eve connection/consensus intent and receipt authority, writers, projections,
  tool claims, tests, and smoke binaries are deleted;
- Bifrost sidecar release is exact-authority/digest bound, Node is digest-pinned,
  Idunn alone invokes deployment, and daemon-owned typed RUDP health feeds the
  existing Idunn supervisor target;
- `scripts/smoke-persona-feedback-org-path.ps1` passed the real VoidBot writer ->
  Bifrost sign -> Rust ingress -> resident consideration -> coordinator launch ->
  proposal validation path for public, organization, and private feedback while
  Mind, release, local Verse, and public stores remained byte-identical.

Live Yggdrasil deployment and the Starfire-offline Discord rehearsal remain
pending; source proof is not deployment proof.

Do not describe this as an experiment-only capability after these blockers are
closed. The bounded autonomous loop is the product.

## Workspace coverage storage cut is founded, not migrated — 2026-07-17

Live Yggdrasil evidence rejects `c94fa580` as a deployment candidate. During
that candidate, `body.cc` was rewritten by workspace-projection activity rather
than repository observation. The rewrite is attributable to the surviving
coverage writers sharing the Body store; it is not evidence that the Body
observer changed repository substrate. Body owns observed substrate only:
binding, immutable observations/manifests, and the current Body head.

Commit `261c7bc8` lands the replacement foundation. A runtime-side immutable
`epiphany.runtime.workspace_coverage_store_binding.v0` route and store-local
`gamecult.epiphany.workspace_coverage_store_binding.v0` bind a separate
transactional `workspace-coverage` store to runtime, swarm, workspace,
canonical path and file identity, exact repository Body route/envelope,
Body-binding hash, and repository source identity. Transactional keyed
CultCache admission is pinned beneath it. This is routing and storage
foundation, not completion: obligation, plan, claim, attempt, recovery,
checkpoint, progress, terminal receipt, coverage head, and retirement writers
have not yet been migrated from Body/local Verse.

Authority map:

- Owner: the workspace-coverage store owns projection lifecycle and proof;
  repository Body owns observations only.
- Inputs: the exact pinned Body route/binding and current observation basis,
  sealed inclusion/projection/model plan, authenticated launch/provider
  incarnation, Idunn recovery authority, and waited Qdrant readback.
- Outputs: immutable obligation/plan and claim/attempt/recovery history,
  checkpoint/progress events and heads, terminal receipt/coverage head, and
  retirement history.
- Derived state: current claim, progress, coverage, warming, active, and query
  eligibility are joins over those records plus freshly revalidated Body and
  Qdrant; no store path or old head is truth by itself.
- Forbidden writers: Body observer/bootstrap cannot write projection state;
  projector/checkpoint/recovery cannot write Body; local Verse, Idunn,
  heartbeat, health, deploy scripts, Qdrant, and presentation cannot advance
  coverage heads.
- Shared path: prepare, acquire, each waited batch/readback, resume/recovery,
  final whole-scroll, health, and readiness resolve the same runtime binding,
  reopen exact Body read authority, and transact only through the pinned
  coverage store. Checkpoint and progress must admit atomically.
- Cut line: migrate every projection envelope and bootstrap the binding, switch
  authority once, then remove Body/Verse writers and readers. Preserve exact
  signed envelope identities where predecessor digests depend on them. There
  is no dual-read or missing-binding fallback.

Next: perform that writer/bootstrap migration, prove Body bytes remain unchanged
through projection, and only then build a new live Yggdrasil candidate. Keep
`c94fa580` rejected; do not lengthen a timeout or reinterpret its rewrite as an
observer fault.

## Signed Yggdrasil deployment admission cut complete locally — 2026-07-17

The failed GPU pressure run was a pipeline-contract failure, not a CUDA
failure. The GTX 1080 previously sustained near-full duty, but the monolithic
workspace projection published no durable Qdrant progress before the shell
deadline. The replacement executor now checkpoints bounded batches, resumes
from authenticated checkpoints after restart, and exposes checkpoint-derived
progress independently of its heartbeat. Aggregate health is `warming` only
while exact managed-process lineage, fresh signed heartbeat, and authenticated
checkpoint advancement remain inside the 300-second no-advance lease. Only the
terminal current receipt/head can produce `active`; the deploy shell has no
projection wall-clock verdict.

The cross-repo deployment authority cut is implemented and Soul passes it.
Epiphany signs runtime health with exact release id, witness, source commit,
deployment request id, process incarnation, and sequence. Idunn verifies the
pinned public-only host anchor and persists generic health as observation only.
Promotion reads `idunn.signed_health_admission.v1`, requires it to match the
current health observation, expire within 180 seconds, and join the exact
monotonic `idunn.current_deployment_request.v1` head plus its Bifrost-authorized
`idunn.deployment_request.v2`. Health/admission and request/head transitions use
cross-process CultCache compare-exchange over exact prior envelopes. CultCache
now writes a synced unique temporary file and atomically replaces the live
store without a delete gap. Concurrent N+1/N+2 admission proof finishes at
N+2; equal-second request IDs no longer decide authority lexicographically.

First trust enrollment refuses any pre-existing app-owned private identity when
no root anchor exists. One `enroll-trust-anchor` process creates the signer and
exports its public anchor; root then pins only that public document as
`root:idunn 0640`. Later deployments must byte-match it. The deploy actuator
uses Idunn's typed verifier with the exact request/release tuple; journal prose,
generic health, and `warming` cannot promote.

Local proof: Epiphany runtime-health 8, workspace-progress 13,
workspace-projector 22, host-identity 3, supervisor 17; Odin core 15 and Idunn
45 all pass. Gamecult shell syntax passes under Git Bash. Final hostile Soul
audit reports no P0/P1. Next: commit/push all three repos, deploy updated Odin/
Idunn to Yggdrasil first, then Bifrost-authorize and Idunn-deploy the exact
Epiphany commit. Verify live signed warming, batchwise Qdrant growth, GPU duty,
terminal exact-request active admission, and restart resume. No reboot is
authorized.

## Live Body-grounded admission rite — 2026-07-16

Thread `readiness-grounding-20260716` now has a typed, immutable user objective
and an accepted code-grounded Eyes result. Cold-start objective intake, explicit
local-Verse path ownership, source tools for Eyes/Modeling, canonical result
readers, failed-result supersession, reorient auto-acceptance, and the
CRRC-regather handoff to Eyes are implemented in the current worktree.

The live rite exposed output-contract wounds one at a time. Modeling operations,
frontier items, nodes, edges, profiles, anchors, code refs, observations, and
evidence now have provider-facing typed shapes matching canonical ingress;
explicit null no longer impersonates a reviewable state patch. Failed worker
output is terminally sealed with a bounded diagnostic rather than marked
complete. The stale OpenAI-runtime Modeling fixture now carries and echoes a
Body basis and passes again.

No current Modeling admission exists yet. After the Body was committed at
`f574a194`, Modeling completed a source-grounded typed proposal over the
repository Body. Mind correctly refused it because ordinary `Evolution` also
carried `upsert_frontier`, which requires an explicit frontier request. The
prompt now makes the invariant explicit: ordinary Evolution changes nodes and
edges only. Commit this small correction, rebuild the coordinator, supersede
the refused result, and relaunch in `--mode run` with the accepted Eyes basis.
Make no source edits between the final Body observation and Mind admission.
Only after Mind accepts an exact Body-basis RepoModel patch should
`epiphany-memory-semantic repository-readiness` be run with local Ollama
`qwen3-embedding:0.6b`, 1024 dimensions, and the runtime spine.

The next nodes/edges-only proposal reached Mind and exposed one further missing
launch input: the worker invented a workspace-derived domain id and used
`active` lifecycle, while the canonical revision-0 RepoModel has domain `repo`
and permits only observed/proposed/accepted/stale/retired for repo profiles.
`<canonical_repo_model_shape>` now carries exact current revision/hash, existing
domains, and lifecycle law into every Modeling launch. The rejected result is
already superseded. Rebuild/commit this context change, then relaunch once.

Exact remaining sequence:

1. finish tests/format/docs and commit so the Body is stable;
2. relaunch Modeling against thread `readiness-grounding-20260716`;
3. inspect only the operator-safe role finding, then auto-accept if its Body
   basis, RepoModel patch, and state patch are typed and current;
4. run the live repository-readiness join and preserve its projection;
5. investigate the provider failure only through typed request/receipt
   diagnostics if it repeats; raw worker thought remains sealed.

## Counterfeit planning writers cut - 2026-07-15

Modeling and Eyes traced the repo-frontier planning family and found a typed but
disconnected island. Self's deterministic planning request is real. The
Imagination candidate and Mind Adopt/Refuse/Hold documents were only authored
by tests or arbitrary callers through public persistence functions. Generic
Imagination `statePatch.planning` is a separate thread-state vocabulary, not a
repo-frontier candidate. Adopt suppressed future request selection but changed
no RepoModel bytes and affected no Hands route.

The public candidate/adoption writers are removed; their internal functions are
temporary test scaffolding, not production authority. The full source-grounded
replacement map is `notes/repo-frontier-planning-authority-map.md`. Build the
real nerve using the claim-repair shape: Self request, coordinator-owned typed
Imagination projection and request-keyed launch binding, exclusive immutable
result echo containing the candidate, then Mind-only correlated
Adopt/Refuse/Hold. Adopt must produce a narrow admitted model transition and
downstream Hands truth; Refuse/Hold remain inert receipts. Delete the remaining
fixture writers when that lands. Core verification is green at 319 passed, one
ignored.

## Eyes-to-Modeling claim correction nerve complete - 2026-07-15

The Aetheria-shaped corrective nerve is now closed from immutable Eyes
contradiction through Modeling proposal to Mind admission. A claim repair launch
may produce one immutable role-worker result carrying the exclusive
`claimRepairRequestId` echo and `RepairClaim` purpose. Result schema and worker
output contract are versioned v1; admission receipts and their contract are v3.
Malformed RepairClaim results carrying proposal/frontier echoes, Verification
authority, state patches, or self patches are rejected before persistence.

Mind replays the current repair request, challenge, Eyes packet and admissions,
the unique coordinator launch binding, exact worker launch document hash and
typed projection, runtime/thread identity, model base, target node hash, and
exact evidence set. It permits exactly one `ReviseNode`; the challenged `claim`
text must change while id, domain, profile, kind, creation time, and lifecycle
remain invariant. Review, next model, and receipt still share the model CAS.
Challenge resolution is derived from the target node hash changing; there is no
repair flag or cleanup writer. Exact retry validates the persisted receipt and
current admitted model. Hostiles cover swapped request, adjacent/missing
evidence, extra operation, wrong target, unchanged/timestamp-only claim,
identity/lifecycle mutation, state/self authority smuggling, forged launch hash,
and counterfeit retry receipt with byte-identical refusal. Soul passed the
final boundary; the core library is green at 318 passed, one ignored.

Next: bind Self's existing frontier planning request to a real Imagination result
and Mind Adopt/Refuse/Hold admission, then build the production semantic index
over typed graph claims so Modeling's persistent map becomes searchable body
knowledge rather than a scan-heavy archive.

## Runtime worker results are actually immutable - 2026-07-14

Eyes found that the document called an immutable role-worker result was still
published through ordinary CultCache `put`, allowing a second payload at the
same runtime job identity to replace the thought before Mind admission. The
writer is now absent-only: an exact retry converges without rewriting bytes;
any different result at the same job fails without mutation; concurrent loss
reloads and accepts only exact equality. The full core library passes at 316
passed, one ignored. Claim-repair result correlation may now rely on one
persisted worker result rather than a politely named mutable slot.

## Modeling claim-repair launch authority landed - 2026-07-14

The inert `RepoModelClaimRepairRequest` now reaches Modeling through one
coordinator-owned typed context projection and one immutable, request-keyed
launch binding. The coordinator reconstructs the projection from current
canonical state; callers cannot prepopulate it, combine it with proposal
Modeling authority, substitute any causal field, or spend one repair request
twice. The launch document hash binds the exact effective document delivered to
the worker. This slice still grants no RepoModel write authority.

The launch race exposed a deeper state-transaction fault: two coordinators could
validate the same logical state and both publish. `CoordinatorStateTransaction`
now captures one exact typed cache image, validates the canonical state by
polymorphic `(type, key)` identity, and commits state plus companions through one
backing-store CAS. Immutable companions are absent-only or byte-equivalent
retries with the persisted timestamp preserved. Explicit captured replacements
may replace only the exact envelope observed at open. Imported nondefault host
state may seed an absent store once. Focused hostile tests prove one race winner,
no losing job/request/event/runtime link, immutable collision no-write behavior,
captured-replacement contention, and same-key/different-type coexistence. Soul
re-reviewed the repaired proof surface and passed it; the full core library is
green at 314 passed, one ignored.

Next: make the Modeling result echo this repair request exclusively, then add a
dedicated narrow patch purpose and Mind admission that replays the full chain and
requires the exact challenged claim bytes to change. No other result or model
revision may clear challenge pressure.

## Modeling name authority correction - 2026-07-14

Modeling is the standing embodied organ that models the Body. Proprioception is
a retired legacy name, not a parallel faculty or worker posture. The global
Codex doctrine had missed this migration and could still force Self to dispatch
`Proprioception` workers; runtime work-loop telemetry also targeted the retired
stage name. Both are corrected to Modeling. Keep legacy string handling only
where it migrates old persisted agent identity into Modeling, and keep old prose
only where it is clearly historical evidence.

## Current orientation — 2026-07-12

### Aetheria organ-structure evidence — 2026-07-13

Task `019f3fe1-9f69-74e3-97fb-a18490d72119` supplied strong positive evidence
for the Epiphany hypothesis without requiring raw worker-thought inspection.
Modeling maintained concrete migration bodies across Aetheria, EveUnity, and
CultLib; Eyes found CultCache crash consistency and SoA ownership skew; Hands
landed bounded disjoint changes; Soul rejected a registry repair that still
allowed readers to observe partial refresh; Imagination corrected a roadmap
that called unfinished migration complete; Self preserved dependency order and
kept unrelated compile skew out of coherent commits.

Prompt forms worth preserving:

- require the exact compile boundary and deletion line when research expands;
- give Hands hostile negative acceptance criteria, not only a desired output;
- explicitly allow a worker to stop and name a missing substrate primitive;
- review diffs against authority and concurrency invariants after tests pass.

The primary lesson is not Modeling persistence in isolation. The organ structure
changed the quality of the engineering: discoveries altered plans, plans bounded
disjoint cuts, Soul could reject a plausible green fix, Imagination could reject
roadmap mythology, and Self preserved dependency order without flattening those
different judgments into one running narrative. This is positive evidence for
durable organ-to-organ cognition, not merely for role-flavored prompting.

That lesson now has a concrete corrective nerve. Eyes can persist an immutable
`RepoModelClaimChallenge` against one serialized claim at one exact admitted
model revision. Runtime-spine admission replays the canonical Eyes packet,
unique current Mind receipt, model identity, and claim hash in one absent-only
CAS. Self uses the same validated challenge predicate for Imagination planning,
Hands route selection, and actionable-Hands status; only frontier targeting the
challenged claim is withheld. Eyes never writes RepoModel, and no challenge ids
were stuffed into the graph. Core proof is 304 passed/1 ignored and independent
Soul review passes. Next build a typed Modeling challenge-repair request and
Mind admission path so evidence can reshape the shared map, then let Self and
Imagination revise the campaign from that repaired substrate.

The first repair foundation is now inert and exact. A challenge remains live
across unrelated RepoModel revisions while its target claim bytes are unchanged;
an unrelated edit can no longer launder Eyes pressure away. Self can persist one
`RepoModelClaimRepairRequest` binding the challenge and Eyes packet, original
and unique current admissions, current model and claim, runtime/thread, and
affected frontier hashes in one CAS. It deliberately has no repair patch
purpose, result echo, worker launch authority, or Mind admission effect. Core
proof is 306 passed/1 ignored and Soul passes. Next wire coordinator-owned typed
Modeling launch projection/binding and exclusive result correlation before
introducing any repair actuator.

Do not substitute the first linear frontier identity proof for that larger
lesson. `Modeling -> Mind -> Self -> Hands -> Soul -> Modeling` proves that one
wound can retain causal identity. The awakened anatomy also needs typed backward
pressure: Eyes findings that challenge model claims, Imagination revisions that
change campaign shape, Soul rejections that create new evidence requirements,
and Self rerouting based on those admitted artifacts. Modeling is the shared
situational substrate, not the whole organism and not the product.

Persistence is the connective-tissue gap exposed by that success. Modeling's
repo anatomy, confirmed/changed/invalidated claims, freshness, frontier, and
semantic-index consequences must live in typed searchable state; Self must route
from those artifacts; later Hands and Soul prompts must receive the relevant
frontier and evidence. Otherwise an excellent coordinator can perform the
structure transiently, but the next awakened Self inherits only the applause.

The first safe piece of that connective tissue is now implemented. The existing
memory-graph aggregate owns a revisioned, hashed RepoModel plus typed migration
frontier; exact frontier claim IDs precede BM25 ranking; dependency prerequisites
precede dependents under budget; and the frontier's body, question, gap, status,
dependencies, and recommended organ enter dynamic role context. Canonical state
cannot be reverse-built from thread graphs, replaced by raw refresh/bootstrap,
or lost to concurrent valid patches: CultCache now provides exact-envelope CAS
and insert-if-absent beneath its cross-process sidecar lock, with hostile race
proofs. Soul rejected two earlier cuts before accepting this authority boundary.

The first causal-identity slice of that Aetheria loop is now closed. Modeling
emits a typed `RepoModelPatch`; Mind admits the exact immutable worker result,
patch bytes, evidence, review, and replacement model under one conditional
store transaction; Self selects one eligible Active frontier item from the
admitted current model; and the resulting route freezes model revision/hash,
item hash, claims, dependency order, and path scope. Hands intent, review,
Substrate grant, frontier authority, patch, command, and commit documents are
immutable insert-once records. Soul receives a typed verification request bound
to that complete chain. A later typed Modeling request binds the accepted Soul
result and permits exactly one verdict-incorporation revision of the same item:
`pass` yields `Resolved`; `needs-review`, `needs-evidence`, or `fail` yields
`Blocked`. Self derives Hands readiness from the same selection predicate, so
Blocked/Resolved items cannot be routed and no default implementation authority
survives without an admitted actionable frontier.

Soul found and forced cuts of four plausible green bypasses before accepting
the slice: ordinary Evolution could mutate routed frontier lifecycle; Hands
receipts and their intent/review/grant foundation were mutable by identity; the
Modeling request trusted caller-supplied temporal acceptance; and a split model
admission/thread-state commit could wedge on retry. Evolution is now barred
while a current-model route exists and cannot manufacture Blocked or terminal
frontier lifecycle. Every causal companion uses absent-only cross-process CAS
with exact retry. Final verdict admission replays the full authority and
consequence chain immediately before the model CAS. Verification acceptance is
reloaded from canonical thread state, and stable review identity makes the
split commit recoverable. Hostile substitution, stale-model, counterfeit,
concurrent-writer, crash-window retry, pass/nonpass, and nonselection tests are
green; the full core library proof is 303 passed and 1 ignored.

This is still not the whole Aetheria lesson. It proves durable causal identity
and backward Soul pressure, not the complete multi-organ correction ecology.
Eyes challenges and Imagination campaign revisions still need typed admission
and Self routes. The older `RepoWorkModelingRequest/Route/Finding` path is also
misnamed parallel closure machinery: it models one already-executed work item,
not repository anatomy. Preserve useful plan/execute receipts, but converge
that workflow on canonical RepoFrontier route/Hands/Soul/Modeling authority and
demote `RepoWorkMapEntry` to derived closure history. Do not let item-slug routes
or the legacy special Modeling worker close work independently of RepoModel.

Stage 1 of that convergence is now landed in the worktree and Soul-approved.
The parallel authority was cut before its replacement was enabled. Legacy
RepoWork Modeling request/route/finding/map types, worker launch, OpenAI ingress,
runtime writers, manual generation retry, Mind plan-adoption type, independent
Hands grant, CultMesh overview/readiness/public-proof writers, and closure
contract corpse are deleted. `epiphany-work` is an 82-line quarantine mouth:
every mutation/scheduling/publication command refuses before substrate access;
overview emits only an explicit `historical-only` non-authoritative projection.
Verse query cannot turn historical map rows into current gates, actions,
closure, acceptance, pending Bifrost requests, or accounting. Legitimate
Bifrost artifact-acceptance and metrics receipts still produce accounting rows
without consulting RepoWork history. The authoritative serial proof is core
294 passed/1 ignored, epiphany-work 1 passed, Verse query 13 passed, OpenAI
runtime 8 passed; independent Soul verdict is PASS.

The temporary outage is intentional. Do not resurrect old plan/run/adopt/
execute/close code to restore motion. The next build begins from the authority
map in `notes/repo-work-canonical-convergence.md`: inert proposal -> ordinary
Modeling frontier admission -> typed Self planning request -> Imagination plan
candidate -> Mind plan adoption -> distinct Self execution route -> canonical
Hands/Soul/verdict-incorporation chain. Plan readiness does not belong in
`RepoFrontierStatus`, and a generic phase router has not earned existence.

The typed pre-Hands planning foundation is now implemented and Soul-approved.
`RepoFrontierWorkProposal` is immutable, content-hashed, runtime-bound, rejects
marked private state, and has an explicit inert contract. It cannot create a
frontier or route. `RepoFrontierPlanningRequest` is a distinct Self document:
it validates the canonical model and admission, chooses the deterministic first
dependency-ready Active Imagination frontier, freezes item hash/source scope,
and uses current-model CAS. `RepoFrontierPlanCandidate` binds that request and
revalidates model/admission/item/scope; safe paths must be contained by the
frozen scope and checks/stop/rollback lists must contain real text. Mind plan
adoption binds exact candidate bytes and current anatomy. `Adopt` owns one
deterministic model+frontier claim; concurrent candidates produce one winner,
while Hold/Refuse cannot squat the reserved claim prefix. Exact retries
revalidate current state. Nothing in this foundation emits an execution route,
Hands authority, or frontier lifecycle change. Full core proof is 296 passed
and 1 ignored; independent Soul verdict is PASS.

Proposal-to-frontier admission is now explicit and Soul-approved. Direct User
intake writes one immutable, payload-hashed, nonprivate proposal bound to the
persisted runtime and thread; repository/workspace remain provenance, not
counterfeit authority. Coordinator selection is immutable, exact-time, and
race-safe. The coordinator launch transaction is the sole writer of a typed
`proposalModelingContext` projection inside the persisted Modeling launch
document; it atomically seals that document's MessagePack SHA-256 in an
immutable job/request/proposal launch binding. Prompt prose and result echoes
are correlation only. Admission reconstructs and compares the exact proposal,
selection, projection, patch base, launch hash, job, binding, runtime, and
thread chain. Ordinary Evolution cannot mutate frontier. Proposal Evolution
gets exactly one frontier operation and it must be one proposal-citing
`UpsertFrontier`; it emits no plan, route, Hands authority, or lifecycle
decision. Core proof is 302 passed/1 ignored, OpenAI runtime proof is 8 passed,
and final independent Soul verdict is PASS. Hostile proofs cover privacy
laundering, changed selection time, concurrent selection, corrupt persisted
contracts and hashes, caller-prepopulated context, stale base, swapped launch
and companions, duplicate backend binding, dual authority echoes, request
reuse, delimiter injection, and byte-identical no-write refusals.

The next artifact-contract audit then cut `epiphany.persona_chat.v0`: its live
writer and catalog had disagreed on field vocabulary, evidence fields, and
lifecycle closure. The writer is now typed Rust with closed
draft/blocked/posted status, the schema is strict and complete, and legacy
snake_case survives only on read. Proprioception then identified and Hands
rebuilt the larger false surface. `epiphany.persona_surface.v0` is now a strict,
content-free projection of discriminated artifact and consequence-owner action
references. It reports rejected rows and source failures as attention, while
owning neither speech eligibility nor Mind/Bifrost/provider consequences.
Reddit and Other now have strict typed Rust artifacts and registered schemas;
Other ends at a crossing request and can never claim publication. Its surface
action remains absent until a typed intent contract actually exists.

This reinforces the Aetheria lesson: Modeling found the catalog fiction, Hands
cut the producer boundaries, and Soul-shaped negative checks caught content
leakage and false consequence ownership. Persistent anatomy lets the next Hands
pass start at the wound instead of ceremonially rediscovering the body.

The following Aetheria-shaped pass cut two Idunn split truths. Swarm overview
now consumes the same managed-child sight as the specialist Idunn view, but
exports typed rows only; Gjallar/Eve remain downstream lowerers. Enabled child
readiness requires native process executable identity matching the lifecycle
receipt, so PID reuse cannot counterfeit life. Separately,
`deployment-aftercare-audit` no longer accepts raw caller response files, and
readiness no longer launders its cached projection. Typed Idunn deployment and
aftercare receipts must resolve and bind across identity, runtime, Verse,
result/ref, runbook, source commit, and current HEAD.

The next Modeling pass repaired the targeting organ itself. Memory-graph v1
binds repo anatomy to the actual state-store identity, accepted revision, and
SHA-256 source bytes. Cache presence, path/symbol locators, and serialized
freshness no longer make anatomy Ready. Launch and explicit refresh share one
validator; missing/changed node, edge, or link anchors stale their summaries.
There is still no production semantic index for graph claims, so Modeling index
availability is honestly unavailable rather than inferred from code search.

The repo-work adoption authority rebuild is now implemented. `run_adopt`
consumes an immutable typed `RepoWorkPlanAdoptionReview` bound to exact
workspace, plan/run paths and SHA-256 bytes, action, command, commit message,
changed paths, queued Hands review, and Substrate grant. It atomically creates
an immutable `RepoWorkHandsGrant` plus approved Hands review; Refuse/Hold,
counterfeit digests, swapped paths, and same-ID replacement are rejected.
`run_tick` can only report `awaiting-mind-review`. `run_execute` rereads the
whole chain and revalidates persisted Substrate authority before PowerShell.
Soul closure now reloads typed runtime truth and cross-binds it to the execute
receipt; a swapped valid adoption chain fails. Six compiled smokes that taught
the deleted caller-writable `mindAdoptionDecision` model were removed.

Next architectural cut: finish the Aetheria lesson rather than polishing this
gate. The proposal now reaches Modeling as an exact contestable artifact, but
the larger corrective ecology is still incomplete. Add typed Eyes challenges
that can invalidate model claims and create evidence pressure without direct
RepoModel write authority; then bind the existing planning request to an
Imagination worker result and Mind adoption. A production semantic index over
typed graph claims remains required so those organs can retrieve the living
migration map instead of rediscovering it from files. Memory-graph freshness is
substrate; durable multi-organ correction is the organism.

Epiphany is in an authority-provenance purification pass. The live question is not whether a command can produce a plausible document; it is whether the subsystem writing that document owns the fact it asserts.

The confirmed conceptual substitutions have been cut:

- read-only Verse diagnostics no longer seed or promote the state they inspect;
- Bifrost publication, public-proof publication, artifact acceptance, and metrics callers submit requests without manufacturing provider receipts;
- daemon tool invocation, Eve connection, and daemon poke callers submit intents without manufacturing provider acceptance or lifecycle results;
- Persona feedback no longer manufactures Imagination consensus;
- arbitrary operator-snapshot JSON cannot be promoted into canonical tool intent or receipt state;
- operator-run completion is derived from a fresh, contained result artifact rather than caller status;
- daemon service plan/execute authority is encoded by explicit command identity;
- synthetic receipt smokes are confined beneath `.epiphany-smoke`.
- generic local Verse bootstrap no longer publishes provider advertisements,
  Eve surfaces, or hosted tools; provider absence survives bootstrap.
- the central `provider-advertisements` / `publish-odin` compatibility mouth is
  deleted; only provider-owned bodies may publish presence to Odin.
- bulk and daemon-bounded central provider-state writers are deleted. Each
  `epiphany-cluster-daemon` heartbeat publishes liveness only; it cannot turn
  topology into an advertisement, Eve composition, or hosted-tool claim.
- cluster daemons do not bootstrap or query the full Verse. Missing persisted
  topology is a pre-write refusal; explicit operator bootstrap owns shared
  policy, topology, contracts, and brake initialization.
- daemon-supervisor production commands likewise require persisted bootstrap
  and cannot create shared state. Its two audit-smoke fixture initializers are
  hard-confined beneath `.epiphany-smoke`.
- query-CLI requester/operator mutations also require persisted bootstrap.
  Only explicit seed commands and the fixed aggregate smoke may initialize the
  shared local Verse.
- worker launch-context rendering requires the existing Verse and cannot seed
  it. The prompt-context smoke accepts no destination and is fixed beneath
  `.epiphany-smoke`.
- orphaned Bifrost/GitHub/Maintainer response and Imagination consensus
  constructors/writers are test-only. The aggregate smoke proves requests stay
  pending; production keeps readers for externally provider-authored documents.
- bulk seven-daemon readiness construction/writing is test-only. Production
  loaders enumerate topology; the aggregate smoke owns a fixed-store local
  fixture helper, while real liveness remains single-daemon authored.
- topology-derived provider builders survive only as test fixtures for legacy
  v0 shapes. Live consumers ignore provenance-free v0 Odin/Eve/tool rows;
  explicit bootstrap deletes stale rows of exactly those families. Topology
  `eve_surface_id` is address metadata only, not surface availability.
- bootstrap no longer writes default operator status. The dedicated writer was
  a dead `ready` template, so the writer and its now-ownerless schema/context/
  prompt/reader family are deleted. Source-derived operator snapshots remain.
- agent-state SoA sync requires bootstrap; report preserves missing filesystem
  state. The wrapper explicitly composes sync then report rather than hiding a
  refresh inside readback.
- query, cluster-daemon, and daemon-supervisor argument parsing no longer creates
  store parents. CultCache's single-file backing store returns empty before
  taking a lock when its file is absent, so all readers preserve filesystem
  absence without per-loader guards. Full context projection refuses a missing
  Verse; explicit bootstrap or a real writer owns CultMesh body creation.
- the generic `epiphany-eve-provider` CLI is deleted: caller-supplied provider
  identity/status was not provider participation. Eve requests remain pending;
  local response construction/writing is test-only until a real target daemon
  or authenticated ingest boundary owns the receipt.
- daemon-tool response construction/writing is also test-only. No shipped host
  daemon currently responds; the aggregate smoke proves a pending intent and a
  missing host receipt rather than fabricating Hands acceptance.
- the deployment-config family smoke and its aggregate MVP-gate row are deleted:
  they fabricated Idunn `deployed`/`complete` receipts. Epiphany exposes config
  audit/runbook requests and typed Idunn readers, but no local deployment or
  aftercare response writer.
- the artifact-acceptance/metrics response-closing smokes, Bifrost accounting
  bundle, wrapper mode, and aggregate green gate are deleted. Their request
  cargo remains open until genuine Bifrost/Maintainer response ingest.
- generic repo-work readiness approval is deleted. The former command accepted
  four arbitrary strings as Maintainer/Soul/Mind/Bifrost reviews; readiness
  remains sight-only and the request family awaits genuine reviewer evidence.
- the aggregate repo-swarm MVP gate and wrapper are deleted. It painted green
  rows from prior smoke summaries and local fixtures rather than exercising one
  live end-to-end organism. Use focused tests plus live-fire evidence instead.
- the fresh-repo MVP smoke is deleted. Its disposable Git operations were real,
  but its PR, maintainer-review, merge, Bifrost, and Soul evidence was supplied
  by the same local caller rather than those owning bodies.
- `epiphany-work publish` and `sync` are deleted. The first promoted arbitrary
  receipt strings into publication authority; the second promoted arbitrary
  merge strings plus Git ancestry into merge authority. Bifrost intent,
  provider receipts, and read-only ancestry are separate paths.
- legacy `work-publish-*.json` and `work-sync-*.json` are no longer read by
  overview, readiness, scheduling, receipt-chain, or proof-bundle paths. Dead
  writer artifacts cannot remain living authority; closed work waits at
  `awaiting-publication` until an owner-aligned provider projection exists.
- `epiphany-hands-action record-pr` is deleted. Caller-transcribed PR and
  Bifrost fields cannot create Hands publication proof; PR construction and
  persistence are test-only pending an authenticated adapter owner.
- ownerless provider-result actuators are no longer public production API.
  Eve/daemon-tool acceptance, Bifrost publication/GitHub/public-proof/artifact/
  metrics results, and Imagination consensus constructors/writers are
  `cfg(test)`; production retains their typed readers for real ingest.
- repo closure no longer accepts caller echoes of Modeling model ref, verdict,
  finding, authorship, or summary. The scheduler no longer transcribes them.
  Full closure reads the immutable runtime-spine Modeling finding directly.
- repo closure no longer accepts caller-selected verification commands or an
  optional source-grounding flag. Soul uses fixed Git consequence inspection,
  mandatory grounding, and fails when typed plan/family evidence is absent.
- callers cannot overwrite Soul verdict narration or choose Mind's immutable
  admission revision. Soul derives the explanation; initial map admission is
  revision zero and later evolution uses typed Modeling route generations.
- Hands binaries no longer construct Substrate Gate grant structs inline.
  Grants are non-exhaustive externally and come from narrow fixed-policy
  constructors owned by the `substrate_gate` module.
- Hands persistence resolves its grant rather than trusting an ID label. Grant
  identity/scope/operations/paths and approved review must match each intent
  and patch/command/commit consequence; grants are immutable.
- cluster-daemon heartbeat no longer accepts caller liveness or note fields.
  A successful owning-body heartbeat derives `ready`; degraded/down require
  observed supervisor or timeout evidence.
- verse-query's mega-smoke no longer writes synthetic Idunn service runbooks or
  lifecycle receipts into its selected store and then verifies its own state.
  Focused daemon-supervisor smokes own quarantined lifecycle fixtures.
- daemon-supervisor smoke confinement is real containment, not component-name
  matching: parent traversal and stores outside workspace `.epiphany-smoke`
  are refused before fixture seeding.
- Thirty-two repo-family and survival smokes no longer accept an independent
  deletion root. They derive `.epiphany-smoke` only after canonicalizing the
  selected repo root; `--smoke-root` is rejected before creating its target.
- Idunn lifecycle receipts no longer accept caller-transcribed executable/schema
  hashes, witness identity, required types, or a preflight-pass bit. Repo work
  consumes the runtime's real preflight directly; Idunn reports process facts.
- Windows service install exit zero is `install-command-succeeded`, not
  `installed`. Single-service completion requires SCM status/reconcile; cluster
  completion requires the observed cluster service audit and cannot cite an
  earlier copy of its own execution-audit verdict.
- Service lifecycle projection selects the actual latest family event. An old
  attention receipt no longer masquerades as current state after recovery;
  newer failures still surface immediately.
- The lifecycle `latest` mirror is event-time-owned, not last-writer-wins.
  Invalid/reversed timestamps are refused and delayed old receipts cannot move
  the mirror backward.
- Scheduler `latest` is likewise completion-time-owned. Tick timestamps are
  validated, reversed intervals are refused, and delayed replay cannot rewind
  the scheduler projection.
- `hands-action-gate/latest` is creation-time-owned. Delayed mirror replay
  cannot advertise obsolete actuator scope or record-pass commands as current.
- `role-review-event/latest` is creation-time-owned. Delayed acceptance or
  supersession readbacks cannot rewind Self/operator coordination context.
- `coordinator-run-receipt/latest` is creation-time-owned. Delayed runs cannot
  replace the current final action or artifact projection.
- Work-loop telemetry is now validated internal evidence and production-time
  ordered. Delayed or wrong-Verse packets cannot replace Soul/Modeling's
  current Hands consequence chain; future receipt lower bounds are refused.
- Repo-work map `latest` is Mind-admission-time-owned. Delayed older projections
  cannot rewind the queue map, and mirroring before admission is refused.
- Repo-work overview global `latest` is generation-time-owned. Delayed overview
  transport cannot make an obsolete queue gate or next move current.
- Repo-work readiness global `latest` is generation-time-owned. Delayed
  sight-only reports cannot replace current proof visibility.
- The writerless `repo_work_readiness_review` document family is deleted from
  schema registration, exports, loaders, receipt directory, swarm overview,
  TUI, and Bifrost accounting. Real review receipts retain their owners.
- Repo-work public-proof global `latest` is generation-time-owned. Delayed
  proof transport cannot replace the current commit/hash evidence projection.
- Agent-state SoA `latest` is generation-time-owned and local-area confined;
  delayed summaries cannot rewind prompt/swarm self-knowledge.
- Operator snapshots are validated internal-Verse observations and `latest` is
  generation-time-owned; delayed status transport cannot rewind the observed
  coordinator/runtime surface.
- Operator-run receipt admission resolves its intent by `run_id`, not by the
  unrelated global latest mirror. Intent/receipt mirrors are validated and
  owner-time ordered; concurrent runs retain independent identity.
- Prompt assembly joins Eve and daemon-tool receipts to intents only by matching
  `intent_id`; independent latest mirrors can no longer fabricate a causal
  completion in model context.
- Bifrost prompt/accounting chains follow typed intent -> publication -> GitHub
  receipt identity. Independent latest documents cannot close publication,
  lend review/credit counts, or supply a counterfeit public reference.
- Collaboration accounting follows consensus `feedback_id`; unrelated latest
  consensus cannot close another Persona feedback lane or lend public refs.
- Artifact-acceptance and metrics receipts still lack an explicit repo-work
  request/map identity. Do not infer it from item/workspace/branch/commit;
  accounting keeps these lanes open with `requestIdentity=missing` while still
  showing provider receipt proof completeness. Repair the Bifrost-owned
  contracts before claiming concurrent-safe closure.
- Repo-work queue receipts carry typed queue/selected row objects. Swarm stop
  classification no longer reparses `QUEUE-RUN | key=value` TUI prose; legacy
  or hostile strings cannot steer gate, blocker, item, branch, or next move.
- Receipt-directory runbook selection uses typed `service_id` only. It no
  longer recovers service ownership by splitting human route prose at `::`.
- Deployment operational audit and runbook read one typed TOML model. Substring
  presence, comments, wrong sections, and silent watched-ref/script defaults no
  longer substitute for valid deployment configuration.
- Repo-work deployment closure uses that same typed model and semantic
  predicates; the duplicate substring validator is deleted.
- Secret-policy request closure parses typed TOML and validates request,
  antecedent, receipt, security-packet, and authority semantics. Comment prose
  cannot counterfeit secret/write/deployment denials.
- Dependency-policy request closure parses typed TOML for supply-chain scope,
  receipts, evidence requirements, and authority seals; comment prose cannot
  counterfeit package/lockfile/network/CI denials.
- Deployment-request closure parses typed TOML for Idunn ownership,
  antecedents, receipts, deployment packet, and authority seals; comment prose
  cannot counterfeit SSH/push/deployment denials.
- Verse-query smoke reset proves the exact built-in path and canonical strict
  containment beneath `.epiphany-smoke` immediately before recursive deletion.
- The four typed closure contract families live in
  `epiphany_work/closure_contracts.rs`; `epiphany-work` is their orchestrator.
  The module is parent-private and preserves family-specific predicates rather
  than exporting generic policy machinery.
- Bifrost provider receipt contracts still lack provider timestamp/revision.
  Do not invent consumer-side ordering; repair that in a Bifrost-owned schema.

The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it.

Static cluster topology is declaration, not attendance. Bootstrap persists seven
faculty routes and desired private-Verse/daemon/Eve addresses, but missing
provider status now produces zero observed daemon rows. Topology and overview
publish explicitly declared counts separately from `observedDaemonCount`;
daemon heartbeat sight never claims an agent count. Restart-policy rows may say
`unobserved` for a desired target so Idunn can reconcile it without inventing a
body. Prompt context names these as declared routes/targets. The deleted
`unknown_daemon_status` constructor cannot put seven empty helmets on the roll.

The Epiphany-local `bifrost-ledger` mouth is deleted. It assigned external owners
and accounting closure from response-shaped documents found in a shared local
store without authenticated provider ingress. Requester-owned publication and
public-proof intents plus Persona feedback remain. Provider response absence now
has no local closure or audit route. Do not restore a ledger projection until an
ingress receipt binds provider identity/contract, transport session, exact
payload hash/document id, correlation, target runtime/Verse, admission time, and
verification result.

## Authority map

- Request owners write intents and requests.
- Provider bodies write acceptance, execution, lifecycle, and result receipts.
- Diagnostics read persisted facts; absence remains absent or unknown.
- Adapters may project edge state but cannot promote it into canonical provider truth.
- Smoke fixtures may manufacture synthetic state only inside fixed disposable roots.
- `swarm overview` owns no operational fact and performs no scheduling, publication, deployment, lifecycle, admission, or provider acceptance.

## Rehydrate

Read, in order:

1. `state/map.yaml`
2. `notes/epiphany-current-algorithmic-map.md`
3. `notes/conceptual-substitution-audit-2026-07-12.md`
4. `notes/receipt-writer-provenance-audit-2026-07-12.md`
5. `notes/epiphany-fork-implementation-plan.md`

Then run:

```powershell
cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-state -- status
```

Historical implementation detail belongs in git history, smoke artifacts, and the evidence ledger. Do not restore deleted writers or requester-authored receipts from old proof prose.

## Next real move

Continue the modeling pass beyond receipt writers. Tool-request,
metrics-request, artifact-acceptance-request, and credit-request closure now use
typed family contracts and cannot accept comment-counterfeit execution, spend,
acceptance, or credit seals.
Inventory remaining substring closure families and production paths where a
projection, cache, adapter, scheduler, coordinator, or compatibility surface
asserts a fact owned elsewhere. For each candidate, name the owner, allowed
inputs, emitted state, forbidden writers, and negative proof before changing
code. Also audit remaining non-receipt smoke binaries for path escape or
destructive scope.

`epiphany-repo-personality-smoke` reset is now canonically confined beneath
`.epiphany-smoke`; fixed default provenance no longer authorizes recursive
deletion. Continue the same resolved-containment audit across remaining smoke
reset helpers.

The 32 repeated timestamped family/lifecycle smokes no longer reset occupied
leaves. They atomically claim a fresh directory with `create_dir` and fail on
collision, removing their recursive-delete authority entirely.

Seven UUID-scoped temp helpers now use exclusive `create_dir`, not
`create_dir_all`; a pre-existing leaf is refused before work and can no longer
be adopted and later deleted.
Three coordinator launch-context test leaves were corrected as well. The full
Rust source search now contains no generated `temp_dir()` leaf adopted through
`create_dir_all`.

Publication-request closure is now typed and guarded against regaining
substring authority. Current structural count: nine typed high-authority
families, 704 remaining closure substring assertions, and 1,458 contract-organ
lines.

The former 1,458-line `closure_contracts.rs` slab is now a two-line private
facade over `closure_contracts/external_governance.rs` and
`closure_contracts/operations.rs`. Keep new contracts with their consequence
owner; do not reunify the slab or widen its parent-private API.

Sync-request closure is now typed within external governance and guarded
against substring fallback. Current count: ten typed high-authority families
and 667 remaining closure substring assertions.

External-governance counterfeit fixtures now live in the dedicated lexical
`external_governance_tests.rs`; production contract anatomy is 668 lines and
the six semantic counterfeit tests remain private and passing, including the
explicit sync push-grant attack fixture.

Provider chronology remains externally blocked for a precise reason: Bifrost
receipt contracts expose no provider timestamp or monotonic revision, so local
`latest` mirrors only know arrival order. Do not invent chronology locally. The
33 duplicate `#[cfg(test)]` residues found around provider writers/re-exports
were removed; one test gate remains on every test-only item.

All seven Bifrost/GitHub mirror loader APIs are now named
`load_arrival_latest_*`; no misleading `load_latest_*` aliases remain. The
persisted `/latest` key spelling is retained as external storage compatibility,
not interpreted as provider chronology.
The Bifrost ledger report also uses `arrival_latest_*` typed fields and
`arrivalLatestBifrost*` JSON keys; no old report aliases remain.
`EpiphanyCultMeshContext`, prompt assembly, and Verse consumers now also use
`arrival_latest_bifrost_*`; persisted storage strings retain `/latest`.
The Rust constant identifiers are now `*_ARRIVAL_LATEST_KEY` too; only their
external string values retain the `/latest` storage spelling.
Regression test `bifrost_mirrors_name_arrival_order_without_rewriting_storage_keys`
guards honest Rust vocabulary and the seven stable persisted keys together.

PR-request closure is now typed within external governance and protected by the
class no-substring guard plus an explicit malicious GitHub-grant fixture.
Current count: eleven typed high-authority families and 620 remaining closure
substring assertions.

Maintainer-review closure is now typed and class-guarded. Current count: twelve
typed high-authority families and 582 remaining substring assertions. The
explicit malicious maintainer-approval fixture now passes as a negative proof.

Verification-request closure is now typed and class-guarded. Current count:
thirteen typed high-authority families and 543 remaining substring assertions.
The explicit malicious Soul-verdict fixture now passes as a negative proof.

Closure-domain authority now has a physical workflow owner.
`closure_contracts/workflow.rs` owns typed verification request closure and
`workflow_tests.rs` owns its counterfeit-Soul-verdict fixture. The facade
composes workflow beside external governance and operations. Direct `rustfmt`
is required for these lexically included files because Cargo fmt does not find
them. Next, type and move one adoption/scheduling/work-order family into
workflow rather than feeding the external drawer. External governance should
converge on tooling plus publication/accounting; operations retains
policy/deployment.

Work-order closure is now typed inside that workflow owner. The old substring
path could accept a commented Hands denial beside a real authority grant; the
malicious fixture and generic class guard now make that impossible. Fourteen
high-authority families are typed and 507 substring assertions remain. Next
inspect adoption versus scheduling and convert the authority-bearing family
with its own negative proof.

Scheduling won that comparison because it directly names Self's queue gate,
pulse, next family, and queue-selection receipt. Its closure is now typed under
workflow ownership; a malicious commented queue denial cannot conceal a real
mutation grant, and the family is in the no-substring class guard. Fifteen
high-authority families are typed and 477 substring assertions remain. Next
type adoption, the remaining untyped workflow gate in this chain.

Adoption closure is now typed under workflow ownership as well. The decision
contract, review/state receipts, input requirements, authority denials, and
private seal are read as actual TOML fields; blank input references are
rejected. A malicious commented state-commit denial cannot hide a real grant,
and adoption is in the class guard. Sixteen high-authority families are typed
and 447 substring assertions remain. The complete adoption/scheduling/work-
order/verification chain now has one physical workflow owner.

The old residual counter was diff-derived and has been retired. Direct source
inventory now reports 426 `content.contains` occurrences across sixteen
remaining closure families. Objective Draft has moved into a new physical
`preparation.rs` owner because it is Imagination cargo, not workflow or
external governance. Its typed closure and malicious fixture prevent a
commented adoption denial from hiding a real grant. Seventeen high-authority
families are typed. Continue from the source-derived family inventory, not the
historical counter.

The readiness-review hydra is cut. Self owns routing; Maintainer, Soul, Mind,
and Bifrost are independent required reviewers; `readiness_approval_owner` is
explicitly `none` because no local aggregate writer exists. Typed external-
governance closure and a counterfeit-approval fixture protect that boundary.
Eighteen high-authority families are typed; direct source inventory reports 363
substring occurrences across fifteen remaining families.

Interpreter Brief no longer steals Mind's name. Deterministic Imagination
lowering now emits an Imagination-authored request for Mind interpretation with
`interpretation_admitted=false`; it does not claim Mind authored or owns an
interpretation that Mind never produced. Preparation owns its typed closure and
counterfeit-state-authority fixture. Nineteen high-authority families are typed;
direct source inventory reports 303 substring occurrences across fourteen
remaining families.

Planning Brief is mapped for deletion, not typing. It contains no candidate
work-item records; copied global schema/catalog/closure doctrine is read back as
`safeFamilyPlanning`, letting catalog completeness impersonate item planning.
Remove the family, generator, closure/readback, dedicated smoke, and readiness
dependency together. Preserve consensus -> interpretation request -> objective
draft -> Mind adoption. Do not replace it with another per-item catalog dump.

That deletion is complete. The generator, closure/readback, readiness row,
Verse classification, CLI advertisement, and 679-line dedicated smoke are
gone; 1,393 source lines were removed without an adapter. No production source
references remain. Direct inventory now reports 183 substring occurrences
across twelve families.

Collaboration policy/topic no longer pretend deterministic repo files are live
Persona/Eve contracts. Imagination authors proposals; Persona owns discussion;
Persona/Mind review policy; Mind admits it; Bifrost publishes. Requested public
room and Eve surface ids remain unpublished until provider receipts exist, and
downstream rendering is explicitly irrelevant. A new typed collaboration
closure domain protects both families. Twenty-two high-authority families are
typed; direct inventory reports 124 substring occurrences across ten families.

The fake provider catalogs are deleted. `repo.tool_capabilities` advertised
expected tools without a host receipt; `repo.eve_surface` invented a live
surface/rows/lowering catalog without provider publication. Dispatch,
generators, closure, Verse classification, CLI help, and both dedicated smokes
are gone—1,188 source lines, no adapters. Real tool requests/host receipts,
Odin discovery, Eve connection receipts, and provider-owned composition remain.
Direct inventory is 71 occurrences across eight families.

`repo.body_manifest` is deleted as a daemon diorama: it invented Body/Verse/Eve
identity and capabilities in an unconsumed `epiphany.toml`. Runtime state,
provider advertisements, and repo birth receipts remain authoritative. A fresh
patch-placement error that put collaboration `[policy]` fields in the manifest
generator was repaired; a direct generator unit test proves the fields now
belong to collaboration policy and the deleted manifest family is rejected.
The recursive legacy smoke timed out and spawned nested Cargo trees, so it was
not treated as proof. Direct inventory is 56 occurrences across seven families.

Doctrine review no longer has a `Maintainer/Mind` composite owner or OR gate.
Imagination authors, Self routes, Maintainer reviews, Soul verifies, Mind admits
doctrine state, and Hands mutates `AGENTS.md` under receipts. Typed operations
closure and a counterfeit-Hands fixture protect the chain. The remaining
source inventory is 17 occurrences across six presentation families.

The six presentation families are now explicitly `presentationOnly=true` and
share no formatting assertions. Common commit/path/blob evidence remains the
closure proof; summaries, headings, markers, and checkboxes no longer
impersonate Soul authority. A whole-function regression test proves zero
`content.contains` calls remain in closure.

The beyond-closure scan has started. Deployment request no longer has an
`Idunn/Maintainer` composite owner: Self routes, Maintainer/Soul/Mind/Bifrost
review independently, and Idunn alone executes and authors deployment/aftercare
outcomes. A generic patch briefly struck secret-policy fields; compilation
caught it before tests, the fields were restored, and exact deployment tests
plus the full baseline pass.

PR request no longer has a `Bifrost/GitHub` composite owner. Self routes,
Bifrost owns the publication gate, Hands performs bounded PR action, and GitHub
only supplies provider outcomes. The GitHub receipt ledger row is now
GitHub-owned. Nine external-governance fixtures, 259 library tests, and all
binaries pass.

Consensus Brief keeps its honest draft/unconverged semantics but no longer
proves them with substring presence. Preparation owns its typed consensus,
Imagination route, inputs, authority, and privacy closure; a malicious comment
cannot counterfeit adoption denial. Twenty high-authority families are typed;
direct source inventory reports 278 substring occurrences across thirteen
remaining families.

The latest structural count is 32 closure family branches, 744 remaining
substring assertions in the closure region, and 1,284 lines in
`closure_contracts.rs`. Do not blindly generate a struct forest for every
presentation-only family. The eight converted high-authority families are
covered by `typed_closure_families_have_no_substring_authority`; prioritize the
next consequence-bearing request and require a named owner.

## Verification baseline

Artifact acceptance is split: Self routes, Maintainer decides acceptance,
Bifrost records accounting, and the typed request requires the acceptance
receipt. Operator receipt and accounting rows report those separate owners.
Nine external-governance fixtures, 259 library tests, and all binaries pass.

Metrics/accounting no longer has a `Bifrost/Maintainer` composite or OR gate.
Self routes, Bifrost accounts, Maintainer owns review-load evidence, and spend/
review-load receipts are required observations without authorizing spend or
ledger mutation. Contract catalogue and operator rows use the same ownership.

The last completed code pass had 259 library tests passing and all binaries compiling. Re-run focused checks for the next touched surface; use the full library/binary baseline before committing a new architectural cut.

Secret and dependency policy requests no longer use a
`Maintainer/Soul/Bifrost` pseudo-owner or Maintainer-or-Soul seal. Self routes,
Mind admits policy, and Maintainer review, Soul verification, Mind admission,
and Bifrost publication review are separately required. Dependency policy also
requires supply-chain audit evidence. The next conceptual-substitution targets
are the surviving composite decision fields in external governance and the
composite owner labels in operator projections.

Artifact acceptance, PR publication, and readiness seals are now aligned with
their split request bodies. Maintainer acceptance cannot substitute for Bifrost
accounting; Maintainer review cannot substitute for Bifrost publication, Hands
execution, or GitHub provider evidence; and readiness approval is Maintainer-
owned instead of ownerless. The unresolved external-governance field is
upstream sync's `operator_or_maintainer_authority_required`; trace its actual
effect owner before deciding whether it is alternate human authority or another
collapsed obligation.

That trace is complete: `repo.sync_request` performs no sync effect. It asks
Bifrost for an upstream ancestry proof after publication and separately
requires Maintainer review evidence. The fictional operator-or-maintainer gate
is removed; the request still denies merge, push, sync, and Hands authority.
Next inspect composite owner labels in operator projections, starting with rows
that may be interpreted as decision or execution ownership.

Receipt-directory projection cleanup has started. Eve connection rows now name
the target provider cluster rather than `Odin/Eve`; work-loop telemetry names
Self rather than its Hands/Soul/Modeling stage route. The next projection scar
is `repo_work_stage_for_family`: it groups distinct collaboration and governance
families under composite owners. Split those stage groups by actual family
authority; do not merely rename the composites.

The stage groups are now split per safe family, with regression coverage for
tool host, Imagination draft, Mind admission, Maintainer decision, Hands
execution, Bifrost proof/accounting/publication, Soul verification, Self
scheduling, and Idunn deployment ownership. Dependency policy and readiness
are explicitly classified instead of falling through to Unknown. Next trace
the remaining composite owner labels in repo-work readiness rows around the
Idunn/Soul, Soul/Bifrost, and four-reviewer projections.

Those readiness rows are split: Idunn owns aftercare evidence, Soul verifies;
Soul owns redaction and readiness sight; Maintainer owns readiness approval;
Bifrost owns publication review; the four required reviewers are an explicit
list. Next cut arrow-shaped handoffs such as `Persona->Imagination` out of owner
fields and preserve them only as routes.

Arrow-shaped owner values are now gone. Self owns intake-consensus readback and
publishes the Persona-to-Imagination handoff separately; feedback ledger rows
use their source Persona id; Bifrost owns consensus accounting. Continue the
conceptual-substitution scan beyond owner strings: look for status, route,
receipt, or cache fields that borrow consequence authority from another organ.

The first non-owner substitution is cut in `repo.tool_request`. The old
`requesting_agent="repo Persona/Self"` and `requester_owns_request=false` shape
is replaced by requester body identity, Self routing, Persona pressure
provenance, target-host execution ownership, and requester execution denial.
The typed closure now validates the identity and authority split. Continue
looking for fields where observation, request, admission, and effect ownership
are collapsed under innocent-sounding status or cache names.

Maintainer review is no longer substitutable by generic human response. Both
the Maintainer review request and doctrine update request now require explicit
Maintainer review, matching their receipt contracts and reviewer topology.
Continue auditing remaining OR-shaped fields, but distinguish legitimate input
alternatives (for example token count or cost summary) from authority gates.

Two further OR substitutions are cut. Consensus drafts require additional
public feedback rather than "human or Persona review"; Mind/Bifrost remain the
gates. Deployment requests require both script hash and script-review ref,
because identity and approval are distinct proofs. Continue classifying the
remaining OR-shaped fields by what invariant each alternative actually proves.

Deployment git identity is also split. Requests now require both watched ref
and source commit SHA, matching Idunn's receipt. A branch/ref identifies the
mutable trigger path; the commit SHA identifies deployed bytes. Do not collapse
them back into one convenient string.

Metrics packet completeness is now explicit: token summary, cost availability
status, review duration, and review-event count are separate requirements.
This permits honest unavailable pricing without treating cost and tokens—or
duration and event count—as interchangeable. Next inspect projected accounting
status to ensure receipt presence cannot close a row whose required dimensions
are absent.

That projection check is implemented. Bifrost metrics receipts now expose the
four typed dimensions; old receipts deserialize with absent optional fields but
remain incomplete. A negative projection test proves a receipt with IDs and
summary but no token evidence cannot report complete proof. Continue with
scheduler/cache projections that derive consequential status from presence.

The first scheduler substitution is cut. `heartbeat_status_projection` no
longer translates a readable state document into `status=ready`. It reports
store state as `missing` or `loaded` and derives separate scheduler physiology
as `unconfigured`, `active`, or `attention` from participants and pending-turn
state. The focused library suite, all-bin check, and native heartbeat smoke pass.
Continue through cache/freshness projections; do not let existence, successful
decode, or a latest mirror impersonate current consequence authority.

Operator cache readback is also purified. `epiphany-operator-run latest` joins
the latest intent to its exact receipt by `run_id`; a new intent cannot borrow
an older latest completion. Its statuses are lifecycle facts (`missing`,
`requested`, `completed`, `attention`, `orphaned-receipt`), never generic
`ready`. `epiphany-operator-snapshot latest` reports present state as `loaded`.
Negative unit coverage proves intent presence is only requested and mismatched
receipt identity cannot close it. Both native smokes, 259 library tests, focused
binary tests, and the all-bin check pass.

Rider bridge topology no longer claims readiness from path existence. Rider is
`discovered`, solutions are `found`, and repository topology is `gitDetected`;
the native bridge smoke passes with the renamed evidence states.

Unity bridge uses the same boundary: project version parsing is `pinned`, exact
editor path discovery is `resolved`, and the editor package predicate is named
`present`. Operability belongs to the subsequent `runStatus` receipt. The
native Unity bridge smoke, 259 library tests, and all-bin check pass.

The generic Persona Other mouth no longer models accepted Bifrost requests as
posts. Recent speech tracks `crossing_recorded` and
`same_target_crossing_count`; actual publication still requires an external
transport receipt. The old v0 `sameTargetPostCount` spelling is serialization-
only compatibility. Native Other-mouth smoke, 259 library tests, and all-bin
compilation pass.

Persona Aquarium bubbles no longer accept caller-authored readiness. The CLI
has no `--status`; successful writes derive `projected`; the strict intent
schema has no status field; and the output schema permits only `projected`.
Native smoke returns that value and an explicit `--status ready` invocation is
rejected. The 259 library tests and all-bin check pass.

Three live Epiphany-shaped read-only organs (Eyes, Proprioception, Soul) were
used as prompt-quality probes. They converged on caller status impersonating
character physiology. `epiphany-character-loop` no longer accepts `--status`,
constructs no fake heartbeat participant, derives stimulus `received`, and
reports activation `unknown` without scheduler evidence. Its packet now matches
the registered `schemaVersion`. Proprioception also found and removed the stale
repo-intake consensus status argument and demoted aggregate Persona status from
`ready` to `loaded`. Persona prompts now explicitly separate candidate, bubble,
eligibility, Mind admission, and Bifrost/provider delivery ownership. Native
negative/smoke checks, 259 library tests, 32 work tests, and all-bin compilation
pass. Operator correction: Modeling's mandatory typed patch is intentional
because the live searchable body map is its product; confirmation passes must
bank freshness and source-grounded map confidence. Improve the patch vocabulary,
do not add a no-state-change escape. Continue the P0 Discord/Reddit arbitrary-
JSON publication receipt cut found by Eyes and Soul.

That P0 cut is complete. Epiphany now validates Bifrost's real Discord/Reddit
publication output: exact action/outcome, target, provider id or URL, canonical
crossing receipt id, and returned provenance bound to the speech audit and
authority inputs. Discord fallback IDs are deleted. Native hostile smokes prove
exit-zero `{}` cannot publish. Posted artifacts count as history only when their
embedded receipt binds back to the artifact target and audit; forged
`status=posted` files do not count. The remaining Bifrost seam is command
cardinality: Epiphany inherits a CultMesh command id, so the coordinator must
ensure one typed command id per crossing rather than letting multiple posts share
one canonical `crossing_<command>` receipt.

## Repo frontier planning launch artery (2026-07-15)

Self's planning request is now v1 and binds the exact current RepoModel,
admission receipt, actionable Imagination frontier, runtime identity, and
authoritative thread. Coordinator launch commit replays that entire chain from
one transaction snapshot, forbids caller-authored planning projection and
mixed Modeling/repair/planning authority, injects the typed Imagination context,
and atomically persists a request-keyed
`RepoFrontierPlanningLaunchBinding`. Its SHA-256 covers the exact launch bytes
stored for the worker. Hostile tests cover swapped model/admission/frontier/
scope/organ/runtime/thread fields, wrong role/binding, prepopulated projection,
dual authority, single-use replay, and two concurrent launches; only one wins
and the loser leaves no job, worker launch, or opened event. Full core proof:
322 passed, 1 ignored. Next build the exclusive immutable Imagination result
echo carrying the typed candidate, then Mind-only Adopt/Refuse/Hold admission
and the narrow Adopt model transition that makes Hands routing true.

The immutable Imagination result slice is now complete. Runtime role result v2
adds an exclusive `frontier_planning_request_id` plus dedicated canonical
MessagePack `RepoFrontierPlanCandidate`. Persistence replays the exact planning
request, request-keyed launch binding, stored launch-document hash/projection,
runtime/thread, current model/admission/frontier, deterministic candidate
identity, and bounded safe paths. Planning results reject generic state, Self,
RepoModel, Verification, and Modeling authority cargo before writing. The
OpenAI ingress uses a specialized planning schema, supplies candidate
schema/contract itself, derives candidate identity from semantic cargo, and
does not expose generic patch mouths. The candidate remains embedded in the
immutable result; no standalone candidate document is written. Proof: core
325 passed/1 ignored; OpenAI runtime 9 passed; hostile missing/swapped request,
missing/adjacent/escaped candidate, wrong role, generic patch smuggling, exact
retry, and immutable collision checks pass. Next implement Mind-only terminal
decision plus the dedicated Adopt RepoModel transition from Imagination to
Hands, then delete the old internal candidate/adoption fixture writers.

## Prompted frontier admission review and canonical adoption (2026-07-15)

The repo-frontier planning nerve is complete and the preceding “Next implement
Mind” sentence is superseded. Self binds one exact admitted model/frontier
request; coordinator atomically binds the Imagination launch; Imagination
persists one immutable result with its sole embedded candidate; the runtime
derives a CAS-bound Mind review request; coordinator atomically launches a
bounded non-embodied admission-review procedure; that procedure returns one
immutable typed Adopt/Refuse/Hold judgment; and Mind's admission transaction
replays the entire chain before consequence.

Refuse and Hold are inert terminal receipts. Adopt atomically installs the exact
candidate and provenance on the canonical frontier, emits specialized review
and admission receipts, and alone changes Imagination to Hands. Self derives the
route from that model. Hands intent binds route, candidate hash, plan action,
and safe paths; Soul admission requires the exact plan command and receives the
checks, stop conditions, rollback steps, and commit message. Modeling may close
the frontier after Soul verdict only while preserving adopted execution anatomy.
There is no standalone candidate/adoption truth and no caller-authored decision.

Mind remains persistent state and admission authority, not an embodied chatty
lane. The prompted model call is explicitly a bounded admission-review
procedure serving Mind, with no heartbeat, lane memory, `roleAccept`,
`selfPatch`, or foreign organ patch mouths.

Hostile coverage includes swapped causal ids/hashes/jobs, failed worker output,
foreign cargo, duplicate/racing launch and terminal claims, generic adoption
bypass, post-adoption execution-anatomy mutation, and same-path command
substitution. The composed happy path proves Adopt through exact Hands command,
Verification/Soul, accepted Modeling incorporation, Resolved closure, and
byte-identical plan survival. Final proof: core 330 passed with one intentional
cross-process helper ignored; OpenAI runtime library 10 passed, both runtime
binary suites passed 6 each, and all core binaries check. Soul's final landing
audit passed. Exact concurrent admission retries are forced through a two-party
pre-CAS barrier in test builds; the loser reloads and authenticates the winner's
entire immutable decision/admission chain. The synchronization hook is compiled
only for tests, so production exposes no executable seam at the commit boundary.
The next organ is the production semantic index over typed graph claims so
Modeling owns a live persistent searchable Body map instead of making Hands
rediscover the repository.

The selected semantic substrate is Qdrant: available locally in Docker and
intended on the new Yggdrasil host (64 GB RAM, GTX 1080 for embedding/model
workers). It is a rebuildable projection, never canonical Mind or Modeling
truth. CultCache/CultMesh remains authoritative. Use separate typed Mind and
Modeling namespaces/collections or equivalently hard query partitions so
private doctrine/memory cannot leak into Hands Body retrieval and repository
claims cannot silently become doctrine. Every point must retain source document
id, schema version, canonical hash, provenance, authority/visibility scope, and
embedding-model version.

## Shared Mind/Modeling semantic nerve (2026-07-15)

The Qdrant organ is now live rather than planned. `semantic_backend.rs` is the
single typed Qdrant/Ollama wire boundary; workspace retrieval consumes it and
the previous local transport copy is gone. The memory graph derives stable
Mind/Modeling projection documents, stores locator/hash/provenance payloads in
physically separate collections, validates collection metadata from Qdrant,
synchronizes only exact swarm/partition scope, reloads every candidate from
current canonical state, and falls back to typed BM25 without losing truth.
Projection receipts are typed CultCache documents outside RepoModel.

`epiphany-memory-semantic` provides canonical index/context commands.
`epiphany-repo-model-bootstrap` atomically admits the initial RepoModel from
typed thread-state through runtime-spine ownership and ignores stale sibling
graph stores. The tracked schema-v0 `state/memory-graph.msgpack` is deleted.

Live local proof against Docker Qdrant v1.17.1 and Ollama
`qwen3-embedding:0.6b` (1024 dimensions) indexed 43 Mind documents into
`epiphany_mind_v1` and 3 fresh Modeling documents into
`epiphany_modeling_v1`. Four stale Modeling points were removed. Semantic
queries render canonical typed packets, ignore payload prose, exclude stale
summary descendants, and report whether semantic ranking or BM25 fallback ran.

Persona's private cache substitution is cut: its chunk schema, duplicated
Qdrant/Ollama clients, reindex-on-recall path, direct payload rendering, and
`epiphany_persona_memory_v0` collection are deleted. Heartbeat Persona recall
uses the shared Mind projection restricted to Persona's canonical domain. The
actual Modeling organ-state was also repaired: four surviving Proprioception
phrases in identity/goal/memory prose are now Modeling, validation is clean,
and the Mind collection was rebuilt from that repaired state.

Next: schedule projection refresh as completion-gated physiology, publish typed
projection health through CultMesh/Eve, and refresh the stale source anchors
that leave the current Body map honestly thin. Do not let the scheduler,
Qdrant, Yggdrasil, or presentation become state authority.

## Semantic completion-law correction (2026-07-15)

The first scheduling map exposed two surviving substitutions before daemon
work began. Persona recall derived a swarm namespace from fixed organ agent
ids, which are identical across Epiphany swarms; and Qdrant failure still used
the unconstrained canonical planner. Both are cut. `state/agents.msgpack` now
contains the immutable typed swarm identity `gamecult.epiphany.main`; Persona
recall and the semantic CLI require that exact document, and the Mind
collection was rebuilt under that scope with 43 documents. Canonical fallback
uses the same partition-constrained planner as semantic success.

`memory_graph::semantic_index` now defines typed projection obligation and
attempt documents, exact source-head and receipt causality fields, and pure
derived `pending|failed|stale|ready` health/query-eligibility law with hostile
mismatch tests. These types are foundation, not a readiness claim: runtime
admission does not yet atomically emit obligations, indexing does not yet claim
and discharge them, queries do not yet require the newest exact success, and
CultMesh/Idunn wiring deliberately remains absent. The next cut is canonical
admission ownership, not a polling loop.

## Atomic semantic admission (2026-07-15)

The causal cut is now implemented. Runtime-spine is immutably bound to the
canonical agent-Mind swarm identity. All three RepoModel writers atomically
companion canonical admission with one exact Modeling projection obligation;
the live legacy runtime was explicitly migrated without rewriting its model or
migration receipt. Mind self-patch and lifecycle admission now use a fixed-role
generation CAS that writes canonical rows, generation witness, persisted Mind
admission receipt, and Mind obligation together. Every extension re-hashes the
canonical rows and authenticates the prior witness. Bootstrap/import/repair/raw
replacement/trait seeding cannot write after a generation exists.

Core proof for the landed atomic admission pass: 343 tests passed, 0 failed, 1
intentional ignore; all binaries compile; the OpenAI runtime suites pass 22
tests. The current `state/agents.msgpack` has now been admitted without row
mutation as generation 1 under swarm `gamecult.epiphany.main`, with immutable
witness `mind-generation-eb394e34-1c73-5d0a-8691-6ff1ba6145a4`, its Mind
admission receipt, and its exact projection obligation. Repeating the migration
is idempotent and validation remains clean. Next replace the direct projector
CLI with restart-safe scope claims, attempt/terminal receipt CAS, observed
zero-document synchronization, and exact query eligibility; then add
CultMesh/Idunn physiology.

## Restart-safe semantic projector and gated query (2026-07-15)

The projection executor now serializes each `(swarm, partition)` mutation scope
with a durable executor-bound claim and fencing epoch. An internal recovery
transition proves that an abandoned attempt can be failed and fenced, but it is
not exposed until Idunn supplies typed stale/recovery authority; arbitrary peers
cannot steal a live scope. Terminal success requires the same live claim, exact
bound receipt, unchanged canonical source envelopes, and observed Qdrant scope.
The raw indexer and ordinary receipt writer are no longer public authority
surfaces. Empty projections bypass Ollama and delete only their exact scope.
Non-empty projections observe exact IDs and typed payload identities after
synchronization.

Query gating is live in the CLI and Persona heartbeat. Without the newest exact
obligation/success pair they use canonical BM25 without contacting Ollama or
Qdrant. With the pair they use Qdrant only for ranking, reload canonical typed
documents, and ignore payload prose. The live `gamecult.epiphany.main` Mind and
Modeling obligations were discharged through the protocol: 43 Mind documents
and 3 Modeling documents, both 1024-dimensional. Repeated execution returned
the same immutable receipts. Core proof: 349 passed, 0 failed, 1 intentional
ignore; all binaries type-check.

Next: derive and publish provider-owned health through CultMesh, make Idunn own
projector process survival/restart and explicit fenced recovery routing, then
run the deployability audit against daemon packaging, configuration, and live
Yggdrasil assumptions. Neither CultMesh nor Idunn may mint readiness.

## Physical semantic fence correction (2026-07-15)

Hostile recovery review found that the logical claim epoch fenced CultCache
terminal receipts but did not fence the Qdrant actuator. A resumed old process
could still mutate the shared `(swarm, partition)` points after replacement.
The physical projection is now isolated by exact obligation, claim id, and
claim epoch in its UUIDs, typed payload, mutation/observation filters, success
receipt v1, and opaque-readiness-selected query filter. Old receipt v0 decodes
only for migration inspection and cannot become ready. A second process cannot
share a running claim merely by reusing its executor label.

The readiness loader now authenticates the full persisted success chain:
obligation, succeeded scope claim, exact claim id/epoch on the receipt, and the
claim's succeeded attempt. Hostile substituted claim, epoch, and attempt
evidence fails closed. The live Mind and Modeling projections were rebuilt into
claim-owned namespaces (43 and 3 documents at 1024 dimensions), and exact live
queries used Qdrant ranking while resolving canonical documents. Core proof is
353 passed, 0 failed, 1 intentional ignore.

Deployment Eyes found the live boundary: local Qdrant and Ollama work, but no
Epiphany/Idunn projector service is installed. New Yggdrasil has healthy GPU
Ollama, Odin, and Idunn, but no Qdrant, Epiphany artifact/config, or projector
target. Local Qdrant is unexpectedly published on all host interfaces. Do not
deploy dual projectors or silently move canonical Mind/Modeling stores.

Next: cut Idunn supervisor writes to provider-owned daemon heartbeat/status;
then publish derived semantic health through CultMesh and add typed Idunn
executor/recovery authority plus open-obligation discovery. Recovery remains
withheld until that authority exists.

## Idunn/provider-status ownership cut (2026-07-15)

The supervisor no longer writes provider heartbeat/status. Idunn owns only
staleness observation, immutable poke intent/receipt events, restart command
execution, policy, and backoff. The target `epiphany-cluster-daemon` remains the
sole production owner of its status, operator action, and heartbeat timestamp.
Command exit zero now records `awaiting-provider-heartbeat`, never `ready`, and
restart pressure remains until a provider heartbeat newer than the completed
attempt proves recovery.

Poke intent/receipt v1 binds the pre-intervention heartbeat and request,
attempt, and completion times. Immutable identity and chronological `latest`
advance in one CAS: exact retry is idempotent, collision is refused, and late
replay cannot rewind sight. Receipt-directory resolution is derived only; it
cannot repair provider truth. The bounded survival rehearsal proves two
successful restart commands leave the provider envelope unchanged and produce
distinct awaiting receipts, then a real provider heartbeat resolves the
lifecycle observation and clears restart pressure.

Renderer-neutral semantic projection health now leaves the provider through
CultMesh as non-authoritative local-area sight. Publication reauthenticates the
sealed Mind or Modeling input, persisted obligation, canonical authority
envelopes, and—when ready—the complete succeeded claim/attempt/receipt chain.
The mirror carries only pending/failed/ready, canonical fingerprints,
bounded counts, provider/incarnation identity, and timestamps; it carries no
error text, path, command, payload prose, or readiness capability. Immutable
events plus a per-swarm/partition chronological CAS prevent a delayed writer
from rewinding latest sight. `epiphany-memory-semantic health` repairs the
mirror independently, and `epiphany-verse-query semantic-health` reads a named,
compact report without touching canonical state. A stale sealed input is
refused rather than published as if it described the current canonical head.

## Idunn semantic executor authority cut (2026-07-15)

Executor labels no longer open semantic mutation authority. Idunn acquisition
now atomically writes a consumed typed executor grant, a scope claim, and its
running attempt against the exact persisted obligation and predecessor claim.
The grant binds executor incarnation, purpose, Idunn incarnation, predecessor
status/id/epoch, and resulting claim id/epoch. `execute` cannot repair a
succeeded claim; `repair` requires that exact succeeded predecessor. The
projector CLI now requires the acquired claim id and authenticates its consumed
grant before Qdrant work or terminalization. Acquisition reauthenticates the
whole sealed canonical input and carries its authority envelopes through the
same CAS, so an old persisted obligation cannot mint against an advanced head.

Fenced recovery now consumes typed evidence rather than free-form reason text.
The CultMesh bridge authenticates the exact immutable Idunn poke intent and
successful `awaiting-provider-heartbeat` receipt, plus a provider-authored ready
heartbeat event that causally follows receipt completion and names the
replacement provider incarnation. The heartbeat must also name that exact
restart receipt as its startup cause. Their envelope digests enter a consumed
recovery authorization. One CAS fails the abandoned attempt, advances the
epoch, creates the replacement claim/attempt, and records that authorization.
Recovery rotates authority only; it cannot execute projection or mint success.
Provider heartbeat events are immutable and their latest pointer advances
monotonically per daemon/incarnation.

Authority map: canonical Mind/Modeling admission owns obligations; Idunn owns
executor assignment and explicit recovery decision; the projector owns claim-
bound mutation and terminal evidence; the query gate alone authenticates
readiness. Health, liveness, timers, command exits, Qdrant state, CultMesh,
Eve, and swarm overview remain derived sight and forbidden writers. Initial
execution, retry, repair, and recovered execution share the same claim-
authenticating projector primitive.

## Workstation semantic projector service body (2026-07-15)

The open-obligation pulse and single process owner are now implemented as one
workstation-local `epiphany-memory-semantic-projector` body managed by Idunn.
Its constructor requires two distinct canonical files--one Mind store and one
Modeling runtime store--and refuses unless their sealed inputs name the exact
partitions and the same immutable swarm. It takes a host OS singleton for that
canonical pair before minting its process-stable provider/executor incarnation.
Mind and Modeling remain separate authorities, claims, collections, and
receipts; they merely share one survival body.

Every pulse reloads both canonical inputs. It stores no open-obligation queue
and allows at most one global action, rotating fairly between actionable
partitions. Ready, foreign-running, and stale inputs never execute. A succeeded
claim is not itself terminal evidence: valid receipt-v2 health derives Ready,
while an exact authority-authenticated succeeded claim whose receipt is legacy
or invalid derives Repair and acquires the typed Idunn repair path. Pending and
failed inputs acquire exact Idunn execute authority before using the one
crate-private executor. A running claim owned by the current provider
incarnation resumes directly without minting a second grant; a foreign running
claim remains pressure until exact recovery. Overlapping pulses return busy,
and the serve cooldown begins only after the bounded pulse completes. A fault
loading one source does not turn the other source into false readiness or hide
its valid action.

The old production mouths are gone: `epiphany-memory-semantic` no longer has an
`index` arm or claim flag, there is no public raw execute function, and the
supervisor no longer exposes general semantic acquisition. Recovery remains a
narrow supervisor action. It authenticates the abandoned claim, exact Idunn
lifecycle intent/receipt, and causally linked replacement-provider heartbeat,
then rotates claim authority only. The running service recognizes that exact
recovered claim as its own and resumes it on a later ordinary pulse.

Idunn owns a specialized reserved service-policy writer for fixed service id
`epiphany-memory-semantic-projector-service`. It derives the packaged sibling
binary, fixed executor identity, both canonical stores, infinite serve shape,
and restart-always policy. The generic managed-service writer refuses that
reserved id; callers cannot substitute a command, service id, restart mode, or
finite child lifetime. Existing Idunn managed-service reconciliation owns
process survival and lifecycle receipts. The OS singleton prevents a service
and an interactive process from simultaneously owning the same canonical pair.

Provider heartbeat and per-partition semantic health remain derived sight.
Heartbeat `ready` means the body owns its singleton, validated the source pair,
and completed a healthy pulse/publication pass; it is not semantic query
readiness. Only the canonical success chain admits query. Pulse JSON, health,
heartbeat, Qdrant, Ollama, Eve, and swarm overview cannot create obligations,
grants, recovery, terminal evidence, or readiness.

Deployment is deliberately not live. The chosen topology is the workstation
beside its canonical stores, with Yggdrasil permitted to supply embedding over
WireGuard. Current local inspection found Docker container `voidbot-qdrant`
stopped with exit code 143. Its name records foreign ownership, so Epiphany did
not restart, adopt, reconfigure, or claim it. No semantic projector service
policy has been published and no restart proof has been claimed. Moving only
the projector to Yggdrasil or starting a second partition/projector body remains
forbidden.

Next: establish explicit Qdrant ownership and a live workstation-reachable
endpoint, confirm collection compatibility and the Yggdrasil Ollama route,
then publish the reserved projector policy. Run one bounded live pulse, prove
both derived health rows and provider heartbeat, kill the body once, and prove
Idunn restart plus causally linked heartbeat/recovery/resumption. This is a
preflight and survival proof, not permission to call deployment complete.

## Managed semantic launch authority rebuild (2026-07-15)

Deployment inspection found incompatible lifecycle stories. The packaged
managed-service launcher spawned an infinite child and wrote a mutable v0
event, while semantic recovery expected a completed daemon-poke receipt from a
blocking restart command. That command could never truthfully witness this
service.

The authority is now one causal chain. The reserved managed policy is desired
state. Idunn preallocates a UUID, injects it into the child, spawns once, and
atomically writes an immutable v1 lifecycle receipt binding child PID, spawn
completion, exact policy id and envelope digest, fixed projector daemon, and
startup correlation. Failed persistence kills and waits for the child. The
child authenticates that receipt against the current policy before constructing
the service body or publishing a pulse or heartbeat. A launch receipt proves
spawn completion, never readiness.

Semantic recovery authorization is v2 and consumes only the current policy,
its exact launch receipt, and a strictly later correlated provider heartbeat.
Advancing policy invalidates an older launch receipt. Daemon poke remains an
operator intervention surface for ordinary daemons but cannot authorize
semantic recovery. Hostile tests cover unrelated heartbeat, policy advance,
successful exact recovery, and single-use refusal. Full library proof is 371
passed/1 ignored; supervisor tests are 7/7; all binaries compile.

Infrastructure truth also changed. The retired local `voidbot-qdrant` must stay
stopped. Shared Yggdrasil Qdrant is authoritative and reaches this workstation
through the ops tunnel at `127.0.0.1:16333`; Yggdrasil Ollama is reachable at
`http://10.77.0.1:11435`. Both Epiphany collections are green 1024-dimensional
cosine collections using `qwen3-embedding:0.6b`.

Next: publish the reserved policy and place both the managed-service reconciler
and Qdrant tunnel under durable Idunn/OS survival ownership. Live proof must
cover real child handshake, bounded pulse, heartbeat and health, forced
restart/correlation, singleton refusal, and safe exact recovery/resumption
where an abandoned claim can be created without forging canonical work.

## Live semantic projector proof and canonical purification (2026-07-15)

The reserved policy is live against shared Yggdrasil Qdrant through
`127.0.0.1:16333` and Yggdrasil Ollama through `10.77.0.1:11435`. Live launch
pressure exposed three fossils that narrow tests had not reached:

- local Verse still contained the deleted ownerless
  `epiphany.cultmesh.operator_status`; an explicit backed-up migration removed
  its one key instead of registering extinct authority;
- both canonical stores contained v0 claims/attempts and index receipts from
  before Idunn fencing; explicit migration atomically retired those rows from
  active authority rather than inventing missing incarnation or grant fields;
- Mind and Modeling canonical cache catalogs registered claims, attempts, and
  receipts but not the executor-grant/recovery types now written into the same
  physical stores; both readers now register the whole semantic authority
  family.

CultCache now provides an atomic exact-envelope batch deletion primitive for
these migrations. The projector launch receipt also binds executable SHA-256,
and the child verifies both its own PID and its bytes against that receipt
before constructing the service body. Health publication errors are bounded in
the pulse output instead of disappearing into a count.

Fresh Idunn-granted projection rebuilt Mind (43 documents) and Modeling (3
documents), both 1024-dimensional and query-eligible. Live semantic context
queries ranked canonical documents for both partitions while ignoring Qdrant
payload text. A clean steady pulse inspected both sources, remained idle, and
published a ready heartbeat with no source or health faults. A second
interactive projector was refused by the host singleton. Killing child PID
22992 caused the reconciler to launch PID 29868 with receipt
`daa89e4f-4301-40eb-aa87-5b52c5017221`; the typed service-status readback proved
the new ready heartbeat names that exact receipt and executable hash.

Full proof is 375 library tests passed/1 ignored, 7/7 supervisor tests, and all
binaries compiling. The live child and reconciler remain running, but survival
is not yet deployable physiology: reconciler PID 22072 and SSH tunnel PID 22728
are detached processes, not durable OS-owned services. The existing generic
Windows `sc.exe create` path is not sufficient because this console binary does
not implement the Windows service-control handshake. Build a real service host
or explicit Task Scheduler owner with restart policy, give the Qdrant tunnel
the same durable treatment, and prove startup/reboot recovery. Live abandoned
claim recovery remains unproven; use a safe fixture rather than forging work.

## Windows survival authority rebuild (2026-07-15)

The workstation survival cut rejected the generic Windows SCM path. The
Epiphany binaries are ordinary console programs and never implemented the
Windows service-control dispatcher, so `sc.exe create`, elevated service
runbooks/audits, cluster-service install/control, and `swarm-online-runbook`
were presentation of authority the body did not possess. Those routes and
their old receipts are historical evidence only; they must not steer current
deployment, readiness, or follow-up work.

Host survival is now deliberately narrower and honest. Current-user tasks
`Epiphany-Idunn-Managed-Service-Reconciler` and
`GameCult-Yggdrasil-Tunnel` run as Meta with `InteractiveToken`/Limited
privilege, `AtLogOn` plus a one-minute recurring recovery trigger,
restart-on-failure at one-minute intervals for 999 attempts, `IgnoreNew`, zero
execution limit, and exact direct foreground actions. Task Scheduler owns
process presence after login. It does not own projector children or semantic
state. Idunn still owns the managed-service reconciliation loop and projector
launch/restart correlation. `gamecult-ops` owns the Yggdrasil tunnel profile
and foreground SSH process; Epiphany merely consumes the pinned local Qdrant
ports. No wrapper, detached grandchild, or service-manager receipt is a second
survival owner.

Live recurrence proof killed reconciler PID 24152 and observed exactly one
replacement PID 25428. Killing projector PID 29868 then caused Idunn to launch
PID 19888 with launch receipt `4d406060-6582-473a-9322-9f4ccc8b322f`;
ready heartbeat `79fe3143-28a8-40fe-9547-0287159082e6` names provider
incarnation `projector-59217a66-e3e2-44c3-b000-36af3d43b043` and the exact
startup correlation. Tunnel recurrence killed SSH PID 22652 and observed PID
30444 start at 11:37:44 with Qdrant REST healthy.

The pre-reboot deployment repair then packaged
`epiphany-memory-semantic.exe` beside the release supervisor and projector,
deployed the rebuilt supervisor, and left
`Epiphany-Idunn-Managed-Service-Reconciler` Running. Deployment queries must
receive the real transport coordinates explicitly through
`EPIPHANY_QDRANT_URL` and `EPIPHANY_OLLAMA_BASE_URL`; ambient defaults are not
deployment proof. With those variables set, both packaged Mind and Modeling
queries returned semantic ranking. The provider status command no longer calls
that sight `ready`: it returns `provider-correlated` or `provider-degraded`, is
explicitly non-authoritative, and points to semantic query admission as the
only readiness owner.

One process-lifecycle scar matters for the reboot audit. Stopping the Task
Scheduler reconciler leaves its already-detached projector child alive. A
current parent PID is therefore derived process sight, not durable custody, and
a stop/start rehearsal can accidentally reuse the old child. The real proof
must observe a fresh post-boot scheduler -> reconciler -> exactly-one-projector
chain, a new launch-correlated provider heartbeat, and successful packaged
Mind and Modeling query admission after the tunnel returns.

The limitation is part of the contract: this is after-login recovery, not
pre-login, boot-time, machine-wide, or Windows-service operation. The remaining
Soul proof is a real reboot/logon cycle showing both scheduled tasks running,
the tunnel ports restored, one Idunn-managed projector child, and a fresh
launch-correlated provider heartbeat followed by semantically ranked packaged
Mind and Modeling queries. Reboot remains a host-wide action requiring exact
live operator permission. Do not spend another pass polishing the dead SCM
rite.

## Isolated semantic abandoned-claim recovery proof (2026-07-15)

The feature-gated native `epiphany-semantic-recovery-smoke` closes the recovery
fixture wound without forging canonical Mind or Modeling work. It creates
GUID-scoped Mind, Modeling, and Verse stores. A real projector acquires epoch 1,
stalls against a fixture-local endpoint, and is killed. The supervisor then
consumes the exact current semantic policy, managed-service lifecycle receipt,
and provider heartbeat to recover epoch 2. A replacement real projector
consumes that recovery authorization through the common execution path.

Typed read-only inspection proves the abandoned attempt is failed, the recovery
authorization is consumed, the epoch-2 claim remains running under the
replacement incarnation, and the old owner cannot authenticate it. Actual
semantic readiness and query eligibility are present. Wrong-heartbeat and
single-use attempts fail without changing canonical fixture bytes.

The Qdrant collections use GUID names, are preflighted absent, and are deleted
and verified absent by exact 404. The smoke accepts no live/default Mind,
Modeling, or Verse stores and exposes no fixture-only mutation mouth. Passing
artifact:
`C:\Users\Meta\AppData\Local\Temp\epiphany-semantic-recovery-1152736f-b8a2-4cf0-ab24-c8a3993a0eb7\proof.json`.

This proves the exact recovery/resumption and fencing path. It does not prove
global deployability. The remaining deployment evidence is still the real
reboot/logon survival cycle above.

## Runtime surface capability purification (2026-07-15)

The systemic surface audit separated a real local projection from false wire
authority. Commit `65445623` remains valid: it rebuilt
`epiphany.persona_surface.v0` as a strict, content-free MVP-status projection
over typed Persona artifact references, registered the real Reddit and Other
artifact schemas, and kept speech eligibility, Mind admission, Bifrost
acceptance, publication, and provider delivery outside the projection. Those
schemas remain discoverable vocabulary and local projection validators. That
does not make the projection a CultNet runtime capability.

All seventeen unbacked `epiphany.surface.*` mutation contracts and their dead
runtime constants are now removed. None had a typed document writer, Snapshot
resolver, or action dispatcher; the compound MVP-status JSON was not a
substitute for those owners. Runtime Hello and runtime status now derive the
current executable mutation-contract list instead of trusting the historical
`supported_document_types` stored in runtime identity. The live canonical
store still carries that old field as inert history, but it cannot decide wire
or status truth. A real canonical hello-frame contained zero
`epiphany.surface.*` capabilities after the cut.

Re-admission is deliberately expensive: an owning organ must prove
`provider publish -> typed CultMesh document -> Snapshot -> schema validation
-> Eve lowering`. Any advertised action additionally needs a real typed
dispatcher and receipt path. Schema registration alone proves vocabulary, not
runtime support.

The adjacent central Eve substitution is cut. The generic provider publisher
and its heartbeat call are deleted; a cluster heartbeat now owns liveness only.
Live Odin, Eve, and daemon-tool directories expose no provenance-free v0 rows,
and explicit bootstrap retires stale rows of those exact families. The stable
topology `eve_surface_id` remains routing/address metadata and proves neither
presence nor composition. Provider availability can return only through an
owning provider's provenance-bearing typed contract; advertised actions also
need a real dispatcher and receipt path.

This does not replace the current deployment next action: complete the real
Windows reboot/logon proof for Task Scheduler, the Yggdrasil tunnel, Idunn, and
the launch-correlated semantic projector heartbeat.

## Production coordinator fixture authority cut (2026-07-15)

The production `epiphany-mvp-coordinator` is again a scheduler, not a smoke
ventriloquist. Typed coordinator status and accepted evidence own the selected
action. The normal `continueImplementation` arm remains the single shared path
that may produce a Hands gate, but caller fixture text can no longer force that
arm or suppress review.

- Owner: typed coordinator status plus accepted role/evidence state owns the
  next action; Hands/Substrate review owns implementation permission.
- Inputs: the selected runtime store, current typed thread state, accepted role
  results, and explicit review state.
- Outputs: coordinator steps, final action, run receipt, and a Hands gate only
  when the typed action reaches the shared implementation arm.
- Derived state: smoke scenarios, fixture workspaces, forced pressure, source
  drift, and dry-compaction observations are verification cargo only.
- Forbidden writers: production CLI flags, callers, wrappers, and fixture
  helpers cannot choose coordinator action, mark it auto-runnable, waive
  review, seed canonical scheduler state, or manufacture a Hands gate.
- Shared paths: production and smoke exercise the same typed status/action and
  Hands-gate machinery after their inputs exist; the smoke does not add a
  second decision owner.
- Cut line: all production fixture flags, overrides, and helpers were deleted.
  Fixture assembly lives in `epiphany-mvp-coordinator-smoke`, confined to
  `.epiphany-smoke/mvp-coordinator`.

Negative proof rejects all seven retired flags at the production mouth while
the dedicated smoke remains inside its fixed root. No legacy flag can target a
caller-selected runtime store. Eyes has banked one adjacent candidate, not a
completed finding: sibling Bifrost subprocess JSON still participates in a
readiness view and needs a focused audit for typed provider identity and
provenance before any cut is justified.

The deployment next action is unchanged and permission-bound: only with exact
live operator approval may the real reboot/logon proof run. It must establish
the restored tasks and tunnel, a fresh reconciler -> exactly-one-projector
chain, launch-correlated provider sight, and admitted semantic queries. Do not
infer reboot authority from this scheduler cleanup.

## Bifrost readiness projection deletion (2026-07-15)

Epiphany no longer treats a sibling Bifrost path, executable presence, exit
zero, parseable JSON, or caller-supplied readiness booleans as provider sight.
The `epiphany-mvp-status` sibling subprocess projection and its `bifrostBridge`
output are deleted, as are `epiphany-bifrost-bridge-status-smoke`, the aggregate
Persona readiness fields, and wrapper readiness summaries. Missing authenticated
typed provider evidence remains unknown.

The surviving Persona Discord, Reddit, and future-surface paths are mouths, not
Eyes. Epiphany owns speech eligibility and may invoke a configured Bifrost
actuator for one named crossing. A validated returned receipt is bound only to
that speech/request artifact as evidence of the single consequence; it cannot
establish provider inventory, liveness, capability, readiness, publication, or
future operability. The cross-mouth aggregate is deleted. Each Persona mouth
tests only its own fail-closed eligibility, target-bound receipt shape, and
private-state sealing.

Authority map: the participating Bifrost/provider boundary owns consequence
truth; one eligible crossing request and configured actuator coordinates are
inputs; one artifact-scoped transport/request receipt is the output; global
readiness is not derived. MVP status, wrapper summaries, cross-mouth aggregators,
sibling-path probes, and caller booleans are forbidden readiness writers. All
three mouths retain the same eligibility-to-receipt boundary without sharing
consequence authority. The deletion line was the sibling readiness projector,
both aggregate smoke binaries, aggregate output fields, and status presentation.

The deployment next action remains unchanged and permission-bound: do not
reboot without exact live operator approval. With that approval, prove both
scheduled tasks and the tunnel return after logon, establish a fresh reconciler
-> exactly-one-projector chain and launch-correlated heartbeat, then obtain
semantic ranking from packaged Mind and Modeling queries using the explicit
Qdrant and Ollama endpoints.

## Freshness and reorientation authority repair (2026-07-15)

The freshness surface no longer converts missing evidence into confidence.
Retrieval `Ready` is Clean only when `dirty_paths` is empty; a Ready label with
one or more dirty paths derives Stale and therefore cannot authorize Resume.
The legacy thread graph projection cannot produce `Ready`. Explicit frontier
dirty paths, open questions, or open gaps prove Stale; otherwise it is
Missing/Unknown because legacy checkpoint identity cannot see canonical
RepoModel admission. A watcher
with no buffered changes is also unknown/unavailable:
there is no watcher generation, cursor, start boundary, or continuity receipt
from which silence could prove cleanliness. Observed changes remain valid
positive evidence.

`recommend_reorientation` now owns the whole Resume/Regather verdict. Resume
requires a resume-ready investigation checkpoint, retrieval Clean, graph
Clean, and watcher Clean or Unknown. Retrieval or graph values other than
Clean, and watcher Dirty/Stale/Changed, force Regather with explicit reasons.
Path overlap remains explanatory derived state; it cannot rescue a stale or
unknown map. `epiphany-mvp-status`, worker launch, coordinator, and CRRC all
consume this decision. `surfaces/jobs.rs` consumes the same derived graph
freshness judgment for graph-remap work instead of maintaining a second churn
string tribunal.

Authority map: `derive_freshness` owns freshness judgment from canonical
retrieval state, explicit legacy frontier pressure, and
positive watcher observations. `recommend_reorientation` owns the action.
Their outputs are derived read projections and one reorientation decision.
Watcher silence, MVP mappings, jobs, worker launch, coordinator, and CRRC are
forbidden readiness/action writers. All launch and operator paths share the
same derivation and decision primitives.

The ungrounded `churn.graph_freshness` and
`graph_checkpoint.graph_revision` fields were deleted. Checkpoints retain
identity and frontier content; churn retains understanding, diff, warning, and
unexplained-write evidence. Canonical RepoModel revision/hash plus its exact
Mind-issued `RepoModelAdmissionReceipt` proves only admitted map identity.
Future observed-ready-at also requires fresh Body observations bracketing exact
Body-grounded model admission and retrieval coverage for one manifest root;
Mind derives the joined projection. Do not build a bridge from snapshot
metadata, watcher silence, timestamps, or historical event continuity.

## Repository Body substrate landed (2026-07-15)

Native `repository_body_observer.rs` and `epiphany-repository-body` expose an
explicit runtime-bound bind step, observe, pure status, and smoke for
`git_worktree` state. Bind pins caller workspace ID to the existing validated
runtime/swarm/source identity plus canonical Git root and policy. Two equal
isolated Git-index scans feed immutable CultCache observations/current-head CAS.
Unchanged raw manifest does not advance generation; missing status creates no
store. The observer makes no historical continuity claim and has no Ready field. Sparse checkout is
rejected, submodules are gitlink-only, and downstream joins remain absent.
The CultCache store is required to live outside the observed worktree.
Canonical path checks run before any bind/store write, global excludes are
disabled, and corrupt/non-commit HEAD fails closed. This slice persists accepted
stable observations only; failed attempts advance no head.
All Git calls share one sanitizer that removes ambient Git repository/object/
ref/index/namespace and injected-config authority before applying explicit
observation policy.
The isolated index enumerates ignore-aware UTF-8 paths/modes/gitlinks, but its
clean-filtered tree OID is auxiliary. Raw file bytes (or non-followed symlink
target bytes) feed an ordered manifest whose domain-separated SHA-256 root is
the authoritative Body identity. Manifest, observation, and manifest-root head
commit atomically. Gitlinks are nonrecursive; unrepresentable paths fail closed.
Bind now installs one immutable runtime-side Body-store route containing the
canonical external locator and exact Body-binding hash. Reads validate runtime,
swarm, workspace, path, and Body binding; a runtime cannot substitute a second
Body store. The route is the locator nerve used by the grounded chain below.

## Modeling thinks from an authenticated Body observation (2026-07-15)

Coordinator-owned Modeling launch observes the bound repository before worker
thought and seals a typed `RepositoryBodyObservationBasis` into the immutable
launch. Modeling output contract v3 requires an exact worker-authored echo.
Result ingress reloads the launch and refuses missing, swapped, or non-Modeling
basis cargo. Mind admission review v1 and receipt v5 carry the same basis; the
admission CAS validates launch/result/review equality and the referenced
historical Body artifacts before copying it into the receipt. It never samples
current Body as a substitute. A valid historical basis remains admissible after
the repository changes because it proves what Modeling saw, not timeless
freshness. Direct Mind adoption and legacy migration remain explicitly
ungrounded rather than manufacturing retroactive evidence.

## Readiness join remains deliberately impossible (2026-07-15)

Modeling audited the next ownership seam after the Body observer landed. Mind is
the only coherent owner for a derived repository-readiness projection, but the
remaining input required to emit observed-ready-at does not exist yet: exact
workspace-retrieval coverage for that same Body manifest. RepoModel admission
is now grounded to its exact pre-thought Body observation. The existing
semantic projector proves exact query eligibility for an admitted RepoModel
projection; the legacy workspace retrieval JSON manifest proves only path/size/
mtime/chunk cache agreement. Do not join its `Ready` label, empty dirty paths,
watcher silence, Git OIDs, timestamps, counts, or Qdrant presence into repository
readiness. Historical continuity was audited and rejected as another conceptual
substitution. The correct join observes Body root R1, validates every artifact,
observes R2, and emits only a time-bounded result when R1=R2. Watchers and Hands
receipts trigger recomputation; they never replace either observation. Build
order is now typed Body-bound retrieval coverage, the Mind-owned race-safe join,
then deletion of local interpretations.

## False workspace retrieval authority cut (2026-07-15)

`retrieval.rs` was production-unwired: no runtime caller, JSON manifest
persistence, path/size/mtime/chunk identity, divergent exact/semantic walkers,
path-derived Qdrant collections, and counterfeit `Ready` from missing manifests
and query-time BM25. The module and public re-exports are deleted. Legacy thread
`EpiphanyRetrievalState` is presentation-only: clean `Ready` projects Missing
and its indexing job is unavailable/unowned; explicit dirty/stale input may warn
but cannot prove coverage. The live RepoModel semantic projector remains intact.

Next build: consume an authenticated historical Body manifest, classify every
entry under one versioned policy, verify eligible bytes against Body hashes,
project into a Body-root/policy/epoch isolated collection, observe the exact
expected point set, and publish an immutable CultCache coverage receipt. Do not
resurrect the JSON manifest as a compatibility source.

## Body-bound coverage contracts landed (2026-07-15)

The native coverage substrate now admits only an authenticated historical Body
manifest, exhaustively classifies its entries under a versioned policy, and
seals Body/policy/classification identity into an immutable obligation. A typed
projection plan binds the exact expected point set and derives an epoch-isolated
Qdrant collection from Body plus projection/embedding authority; the caller has
no collection-name lever. Receipt/head validators require an exact scroll-
observed point set and exact obligation/plan join.

This is contract substrate, not operational coverage. There is deliberately no
persistence writer, projector, Qdrant call, query eligibility path, or readiness
join. Next action: build the single CAS-owned projector/store path that verifies
eligible live bytes against the selected Body manifest, executes the sealed
plan, scroll-observes the physical point set, and only then publishes the
receipt and head.

Projector ownership is now mapped before implementation. Persist all coverage
state in the Repository Body store so terminal success can CAS against the exact
current Body head; never create a runtime-store coverage oracle. Add a sealed
claim/attempt lifecycle, verified historical-byte reads, deterministic UUIDv5
point descriptors, and a plan-sealed ID-to-payload binding root. Whole-
collection typed scroll must reject duplicate, extra, missing, or payload-
mismatched points before terminal success. Qdrant writes outside the CAS may
leave orphan namespaces after races or crashes, but those namespaces own no
readiness.

The sealed acquisition/failure foundation is now implemented but intentionally
unwired. It authenticates current Body authority, verifies bytes, excludes
empty/oversize/non-UTF-8 files, derives named UTF-8-safe line chunks, and CAS-
installs immutable obligation/plan with a running claim/attempt in the Body
store. Exact failure may terminalize after Body advance; no code can publish a
coverage receipt/head. Next work must add observed-binding Qdrant execution,
terminal-success CAS, and abandoned-claim recovery before choosing either a
dedicated coverage service (preferred for ownership clarity) or a strictly
separated lane in the reserved memory semantic-projector process. No CLI shim.

## Exact coverage execution port (2026-07-15)

The crate-private projector now executes a sealed plan through the shared typed
Qdrant boundary. It validates text hashes and vector dimensions, authenticates
exact collection metadata, skips empty upserts, observes the whole typed
collection, rejects cyclic page offsets and duplicate/extra/missing/substituted
point payloads, and publishes receipt/head only through an exact terminal CAS
over Body authority, obligation, plan, claim, attempt, and the prior coverage
head seen at acquisition. Body advance and stale-head competitors cannot mint
success; ordinary failures terminalize the exact running attempt.

This is still sealed foundation, not operational coverage. The dedicated
workspace-coverage service is now the chosen owner, but claims first need an
authenticated executor incarnation/startup receipt. Its pulse also needs an
exact already-current classification and sealed chunk-text rematerialization.
Recovery must consume a newer latest reserved-service launch plus its correlated
ready heartbeat and fence the old claim in one Body-store CAS. Timeouts, generic
managed policy, Qdrant contents, and process guesses are forbidden recovery
authority. If Body advanced, terminalize the obsolete claim and acquire a fresh
plan; never resurrect it.

## Dedicated workspace coverage service proof (2026-07-16)

The dedicated service, binary, reserved supervisor policy, and specialized
CultMesh launch contract now exist. Generic policy and caller-selected command,
workspace, Body store, collection, or dimensions are rejected. Launch receipt,
PID, executable hash, runtime identity, immutable Body route, and host singleton
are authenticated before projection.

The service resolves the configured Ollama tag to its installed immutable
artifact digest on every pulse, probes its dimensions, and uses an exact Current
fast path that reads no repository files. Needed projection uses one
authenticated Body read session, verifies source bytes/chunks, embeds only after
claim acquisition, whole-scrolls Qdrant payloads plus vectors, and binds exact
point/payload/vector observations into the receipt before terminal CAS. Body
history owns retirement of terminal non-current claim collections; deletion is
metadata-gated and idempotent. Raw backend/filesystem errors no longer leak into
the operator-safe pulse projection.

Proof: 424 library tests passed, one ignored; core and OpenAI runtime all-target
checks passed. The ignored live smoke then passed against local Qdrant 1.17.1
and Ollama `qwen3-embedding:0.6b` (artifact digest
`ac6da0dfba84a81fdbfbaf330198c33cd77c4cdfc53e8bc50eb581914a15621d`,
1024 dimensions), proved exact vector observation and Current classification,
deleted its GUID-scoped collection, verified no coverage collection remained,
and restored the preflight-stopped Qdrant container state.

Recovery remains absent on purpose. A newer launch plus ready heartbeat is not
death evidence. Next build: strengthen native process observation with host+
boot and process-instance identity, then let the supervisor publish one
immutable termination observation bound to the exact old launch/PID/executable/
policy/heartbeat/provider. Only that proof plus a current replacement launch may
authorize one Body-store recovery CAS. Do not add timeout recovery.

The native process-instance probe foundation is now implemented and locally
proved. Windows uses PID + process-creation FILETIME + canonical executable,
compares exact identity through a held query/synchronize handle before
alive/exited classification, and separates Toolhelp absence, access denial, and
indeterminate query failure. Linux uses boot id + proc starttime + executable
and recognizes exact zombie exit; other Unix targets refuse to claim Linux
evidence. The old PID-only projection has no `Dead` state. This substrate does
not itself authorize recovery. Next build the enrolled OS-host identity and
specialized reserved launch/heartbeat and termination documents; only then wire
the Body recovery CAS.

The enrolled host-incarnation foundation is also implemented. Its single
non-workspace CultCache record owns an Ed25519 public identity and protected
private seed; opening validates the exact type/key/schema, platform binding,
public/private match, and immutable singleton shape. Enrollment refuses any
existing store and never regenerates malformed state. Windows uses CurrentUser
DPAPI with UI disabled and the deliberately limited assurance label
`os_user_installation_bound_best_effort`; Linux uses 0700/0600 state plus
machine-id binding and declares its cloneable baseline. No code calls this
physical-machine identity. Next remove reserved coverage authority from generic
lifecycle/heartbeat and replace it with identity-bound signed documents.

Those specialized documents are now implemented but not yet wired. The launch
is a mandatory host-signed CultMesh record over exact current reserved policy,
host record digest, boot, PID incarnation, executable path/digest, provider
incarnation, and ephemeral provider public key. The provider heartbeat is
ephemeral-key signed, binds the exact launch envelope and same tuple, and owns a
strict per-launch sequence/time CAS. Validation rechecks the current specialized
policy but does not reread the historical executable path, so deletion cannot
erase evidence. Focused hostile tests reject forged signatures, sequence gaps,
identity collisions, wrong supervisor/status/runtime, and tuple drift.

Next migrate the supervisor and projector together: fixed-size provider seed
frame over reserved-child stdin, exact process capture, signed launch persist,
child launch authentication, specialized heartbeat publication, then generic
writer rejection for reserved coverage. Do not let the new and old documents
remain co-owners after that cut.

The migration cut is now implemented and verified. Reserved-child stdin carries
one fixed binary launch-id/seed frame and requires EOF; all nonreserved service
stdin is null. Supervisor captures the spawned process incarnation, sends the
secret, host-signs/CAS-persists the specialized launch, and kills/waits on any
failure. The projector authenticates host, current policy, boot, exact process,
launch digest, and derived provider key before service construction, then emits
only specialized signed heartbeats. Generic lifecycle and daemon-heartbeat
writers reject the reserved coverage identities, and the old generic coverage
authenticator is deleted. Coverage claim/attempt v1 now binds
`managed_process_launch_id`, refusing semantic reinterpretation of v0 state.

The new native `epiphany-host-identity enroll|status` actuator explicitly
enrolled this Windows installation at the default LocalAppData DPAPI store;
status reopened identity
`17f041421045aa66d4c8ab0488f462dbb5ea1a7d8507dbf75216f5ec368dbb7a`.
Next implement immutable Idunn termination observation before replacement spawn,
then the exact Body recovery CAS. Timeout recovery remains forbidden.

Immutable termination evidence is now implemented. The only public writer uses
native boot/process observation; the injectable source is private to tests. A
host-signed per-launch record binds the exact current policy envelope, exact
specialized launch, exact per-launch latest signed heartbeat, enrolled host,
expected boot/PID generation/path, observed outcome, and optional exact exit or
replacement material. Publication exact-CASes those three source envelopes and
an absent immutable termination key. There is no latest termination pointer.
Alive, inaccessible, indeterminate, unknown boot, host mismatch, collision, or
moved source state refuses. Authentication reconstructs the complete persisted
chain instead of blessing the signed blob by itself.

Next wire Idunn ordering and Body recovery: predecessor termination must persist
before replacement spawn; replacement signed ready must exist before one atomic
v1 claim/attempt terminalize-and-reacquire CAS. Add negative ordering and stale-
Body tests before calling recovery operational.

The deployment next action is unchanged and permission-bound. Do not reboot
without exact live operator approval. With that approval, run the real
reboot/logon recovery proof already specified above.

## Workspace coverage exact Body recovery and Idunn reconciliation (2026-07-16)

The abandoned-claim path is typed end to end. Recovery refuses caller-owned
Body paths, reopens the runtime's authenticated Body route/basis, joins current
Body, obligation, plan, claim, and attempt, authenticates the old launch plus
immutable host-signed termination, and accepts only a causally linked
replacement launch whose current signed heartbeat is `ready`. One exact Body
CAS archives the failed owner, advances the fencing epoch, installs the
successor claim/attempt, and writes an immutable recovery receipt binding the
old claim, termination envelope, replacement launch envelope, ready heartbeat
envelope, and successor authority. Restart authentication reconstructs both
CultMesh evidence and current Body authority.

Reserved launch schema v1 adds a signed causal replacement edge. Its writer
exact-CASes a singleton `replacement-for/<old-launch>` slot with exact
termination and launch state. A second replacement refuses; the supervisor
kills a spawned loser when persistence loses CAS.

Idunn branches workspace coverage away from generic lifecycle PID receipts. It
persists or reuses termination, reuses a causal replacement after interruption,
otherwise launches through the fixed stdin/bootstrap path, waits for the exact
latest signed ready heartbeat, then invokes Body recovery. Initial/pre-claim
launches use the same specialized authority.

Proof passed: 5 process-document/recovery tests, 14 supervisor tests, 15
projector tests plus 1 ignored live Qdrant/Ollama test, and all-target check.

Next cut: termination v0 still requires a provider heartbeat. A child dying
after launch persistence but before heartbeat sequence one strands the chain.
Rebuild termination so signed launch plus enrolled host/boot/process observation
is sufficient, with heartbeat optional additional evidence. Then run a
GUID-scoped live initial launch -> death -> replacement -> Body recovery smoke.
Reboot/logon proof remains permission-bound.

## Pre-readiness workspace coverage death is recoverable (2026-07-16)

The heartbeat prerequisite was rebuilt, not relaxed with nullable fields alone.
Each specialized launch owns one typed process-evidence head. Launch initializes
it; every signed heartbeat advances it by exact CAS; termination advances and
seals it by exact CAS. Termination v1 uses signed launch plus enrolled
host/boot/process observation as sufficient death proof and includes heartbeat
id/digest only when the head names a current signed heartbeat. Heartbeat after
termination refuses, so publication and death cannot win on separate keys.

Focused proof now includes death before heartbeat sequence one, successful
heartbeat-free termination authentication, and refusal of a late heartbeat.
All six process-document/recovery tests, fourteen supervisor tests, fifteen
projector tests plus one ignored live test, and all-target check pass.

Next: create/run a GUID-scoped live smoke through real packaged supervisor and
projector binaries, local Qdrant/Ollama, exact child kill, causal replacement,
epoch+1 recovery, and restart-time receipt authentication. Restore the prior
Qdrant container state afterward. Reboot/logon remains permission-bound.

## Live packaged workspace coverage recovery proof (2026-07-16)

Feature-gated binary `epiphany-workspace-coverage-recovery-smoke` constructs
GUID-scoped repo/runtime/Body/Verse state, uses the real packaged supervisor and
projector siblings, warms local Ollama, derives its exact fenced Qdrant collection names, launches
through specialized bootstrap, catches the epoch 1 claim, kills the exact child,
runs Idunn reconciliation, verifies epoch 2 authority and fresh-store-reopen
recovery receipt authentication, kills the replacement, and removes only its
exact owned collections. Process cleanup revalidates the signed launch's native
incarnation before issuing any kill.

Passed proof:
`C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json`

Receipt: `2b44f28f-7c0f-4ad2-aefe-d7c8222e8642`. The proof binds executable
SHA-256 `d262b7f49d45f15c31589bdfb591988cabcfa9ba65564d3e61493dc00b072093`,
the exact embedded smoke-source digest, source head, and dirty tracked-source
diff digest. It verifies both owned collections absent before emitting success.
Operator orchestration restored the
local Qdrant container to its prior stopped state; that is not a harness claim.

The live rite exposed two real defects and did not pass until both were cut.
Windows boot identity no longer opens privileged PID 4; it queries native
kernel boot time and a focused test proves availability/stability under the
current normal user. Recovery no longer deadlocks its successor: the exact v3
replacement incarnation may resume its own running claim, while a wrong
incarnation remains contended. The harness uses file-backed supervisor output
because Windows grandchildren can retain captured pipe handles, and it has
exact-incarnation process cleanup and exact-owned-collection cleanup guards.

Verification: five native process-observation tests, six process/recovery tests,
fourteen supervisor tests, fifteen projector tests plus one ignored live test,
and feature-enabled all-target check pass. The separate live Qdrant/Ollama
projection test passed before the recovery smoke.

Next: audit deployability against the swarm readiness plan and live host state.
Do not conflate code-complete physiology with the permission-bound reboot/logon
proof; no reboot without explicit live operator approval.

## Fresh deployability audit (2026-07-16)

The host is operational after current-user login, not yet deployable as one
proven artifact generation. `GameCult-Yggdrasil-Tunnel` and
`Epiphany-Idunn-Managed-Service-Reconciler` are enabled/running; the Yggdrasil
Qdrant tunnel and Ollama endpoint are live; packaged Mind and Modeling queries
return semantic ranking. Local retired Qdrant remains stopped. This is real
current-boot physiology.

Four non-permission wounds remain. Installed supervisor/projector binaries
predate recovery commit `34802407`; Task Scheduler pins one mutable supervisor
path while Idunn discovers siblings by filename/existence, so mixed generations
are possible; Mind has no race-bounded whole-repository readiness join; and the
old readiness plan described already-landed June work as future work. The plan
now contains the live evidence matrix. Packaging must become an immutable typed
commit-addressed release witness consumed by Task Scheduler and Idunn. Mind
readiness must join fresh Body R1/R2, exact Body-grounded RepoModel admission,
live Modeling semantic eligibility, and live workspace-coverage Qdrant evidence.
Stored coverage `Current` is not sufficient.

The constant `queryAdmission=false` and supervisor fields naming an external
readiness authority are removed from sight-only projector/health/status
projections. Those surfaces never evaluated query admission and therefore have
no opinion. Query-time reauthentication remains the semantic admission owner.

After the witnessed release is deployed, prove exact current-boot recurrence
and Mind/Modeling query ranking. A reboot/logon proof remains the sole
permission-bound host gate; do not reboot without explicit live approval.

## First witnessed deployment (2026-07-16)

The release packager failed closed three times before publication and exposed
three substrate wounds: Git rejected verbatim/deep Windows worktree paths,
Cargo could not traverse the remaining deep vendor path, and the exact commit
did not contain `epiphany-core/Cargo.lock`. The final machine uses normalized
canonical package paths, short temporary exact-source/build roots, initialized
pinned submodule bodies, and a tracked lockfile with `--locked`. It builds from
a detached worktree at the witnessed commit; caller-supplied binaries have no
entry path.

Published release:

- source commit: `dd80f4a51c18425a6665710698a357be61154abf`
- release id: `sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923`
- witness digest: `sha256-f0394590e2e9762b7cb1579f6a06db009f4701730fe1b44ea0f20c1175aee04a`
- package root: `E:\Projects\EpiphanyAgent\.epiphany-run\releases\dd80f4a51c18425a6665710698a357be61154abf\sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923`

The typed semantic-projector policy now names the witnessed role path. Task
Scheduler pins the witnessed supervisor plus release id/digest. Reconciler PID
`21228` launched direct-child projector PID `22736`; both witnessed Mind and
Modeling query gates returned semantic ranking. After exact-path verification,
PID `22736` was killed once; Idunn launched direct child PID `19748` with new
launch receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat
`4fc91977-b635-474b-812b-c364847e2b4b`, and executable SHA-256
`1060dd64e8c2b520ec8744b67e8306db04a6618d463fc2117c352adf9e30e6b0`,
which equals the witnessed file. Task result `0x800710E0` remains the expected
IgnoreNew recurrence refusal while the foreground task is running.

The installed sibling-generation gate is closed for the current boot. Next:
build Mind's whole-repository observed-readiness join. Reboot/logon remains
permission-bound.

## Semantic receipt-v2 live migration wound (2026-07-16)

The first readiness release exposed an honest migration failure. Receipt v2
correctly made the old v1 Mind/Modeling receipts ineligible, but pulse
classification returned `Succeeded` from claim status before deriving receipt
health. Both partitions therefore stayed idle and packaged queries fell back to
canonical BM25. `Succeeded` is removed as a pulse state. Valid v2 terminal
evidence derives `Ready`; a same-obligation succeeded predecessor with missing,
legacy, or invalid receipt evidence derives `Repair`.

Repair is not opened by claim shape alone. Classification and acquisition share
one predicate that authenticates the consumed executor grant or recovery
authorization plus the exact succeeded attempt/claim binding. The repair grant
advances the epoch. A failed repair becomes a failed current claim and retries
through the ordinary execute path at the next epoch. Tests cover forged
authority refusal, v1 repair acquisition, failed repair, execute retry, v2
terminal success, final Ready, and empty-v2 Ready/nonqueryable stability. Soul
approved; the full library suite is 466 passed, 2 intentionally ignored.

Operational evidence before the fix: release
`sha256-6f9ab4848207a110e7e3836f41e6a74c0f463369ad4b04ce2d0d3831a6b262ae`
from commit `360dcb43` launched witnessed Idunn PID `29476` and direct child
projector PID `22840`, but both packaged semantic queries fell back because the
v1 receipts had no migration path. The next action is to commit this repair,
package/deploy a successor witnessed release, observe v2 semantic ranking, then
derive the first live whole-repository readiness projection. Reboot/logon still
requires explicit live operator approval.

## Mind whole-repository readiness join (2026-07-16)

The missing join now exists in source. `repository_readiness.rs` is Mind's sole
owner for a historical `gamecult.epiphany.repository_readiness_projection.v0`.
It derives every authority decision from raw snapshots and observations: fresh
Body R1, one canonical RepoModel, exactly one current v5 admission whose
historical Body basis is authenticated, the exact succeeded Modeling semantic
chain, live semantic vectors, live workspace coverage bound to R1, fresh Body
R2 with equal content identity, repeated live observations, and one complete
closing runtime-store snapshot. The final projection append uses CultCache's
new full-snapshot conditional append, so a concurrent unknown receipt or
obligation defeats the write. Stored readiness is historical evidence only and
cannot admit a later query or readiness answer.

Semantic receipts are now v2 and seal the deterministic post-scroll vector
binding root. Old, malformed, substituted, or stale receipts cannot grant query
eligibility. Exact empty projections may terminal-succeed once while remaining
non-queryable, avoiding a retry wound. Both semantic and workspace live readers
revalidate their persisted authority after Qdrant observation.

CultCache envelope identity is now the tuple `(type, key)`, not delimiter
concatenation, and `append_if_snapshot_unchanged` compares the complete
canonical snapshot beneath the single-file exclusive lock. Soul approved the
join after hostile passes for alien keys, duplicate grounded/ungrounded
admissions, forged raw semantic heads, receipt cross-field substitution,
historical Body failure, Body/authority drift, R1-bound coverage ordering, CAS
refusal, and exact concurrent idempotence.

Verification: 21/21 CultCache tests and 465/465 Epiphany library tests passed;
two existing live tests remain intentionally ignored. Next: commit/push the
CultCache submodule and parent changes, package a new witnessed release, deploy
it, then derive the first live whole-repository projection. Reboot/logon remains
permission-bound and requires explicit live operator approval.

## Yggdrasil live-deployment authority map (2026-07-16)

Live Epiphany deployment proof belongs on new Yggdrasil, not Starfire. The live
host already runs Idunn (`idunn-yggdrasil.service`), Bifrost, Odin/Hermodr,
Qdrant, and GPU-backed Ollama locally. Epiphany is not yet deployable there:
there is no Epiphany Idunn target, ops manifest/unit, immutable release body, or
daemon-owned aggregate `idunn.daemon_health.v1` publication.

Two ownership gaps must close before the target is enabled. Epiphany's semantic
projection health is component sight and cannot stand in for whole-runtime
health; the managed-service supervisor must join the authenticated packaged
release with current semantic and workspace-coverage child lineage and publish
one explicit CultNet/RUDP health contract. Separately, Bifrost's real GitHub
crossing receipts are not consumed by Idunn: Idunn currently observes
`origin/main` as desired revision without proving that Bifrost authorized that
exact commit. The new chain is Bifrost exact repository/ref/SHA authority ->
Idunn frozen deployment request/artifact -> guarded ops actuator -> immutable
release and deployed manifest -> daemon-published runtime health. Branch
movement, actuator environment variables, process liveness, and component
health are forbidden substitutes.

The intended Ygg body uses `/srv/build/Epiphany` as Idunn's mutable upstream
clone, immutable application releases below `/srv/epiphany/app/releases`, an
immutable deployed source Body below `/srv/epiphany/source/releases`, canonical
state below `/var/lib/gamecult/epiphany`, local Qdrant at `127.0.0.1:6333`, and
local Ollama at `127.0.0.1:11434`. Actual publication must cross live Bifrost;
actual deployment must be requested through live Idunn. Manual SSH deployment
is not acceptable evidence. No host reboot is authorized.

Source implementation now closes the Epiphany-owned half. The managed-service
supervisor publishes exact `idunn.daemon_health.v1` over CultNet/RUDP only
after joining the authenticated packaged release with the exact two reserved
projectors. Semantic and workspace lineage require current policy, the exact
packaged executable, launch-time process incarnation, correlated ready
heartbeat, and bounded freshness. Proven stale v2 lineage may be replaced only
through its persisted process identity; authentication uncertainty cannot kill.
Legacy v1 lifecycle receipts are read-only and enter a typed non-killing
retirement path before a v2 launch. Full library verification is 475 passed,
2 intentional live-endpoint ignores.

The adjacent source bodies are also prepared. Bifrost main commit `3bd250f`
publishes `bifrost.repository_release_authority.v1`, binds one canonical
repository/ref/SHA to a completed crossing receipt and exact GitHub proof, and
forbids simultaneous live authorities for the same ref. Odin's Ygg worktree
adds a scoped `yggdrasil-epiphany` target, selects the unique live Bifrost
authority rather than branch head, freezes it through deployment request and
artifact state, and revalidates at the privileged actuator boundary. The ops
body builds exact initialized source through a separate builder identity,
root-seals immutable source/application releases, starts Epiphany against
Ygg-local Qdrant and Ollama, requires post-candidate Idunn RUDP acceptance, and
only then publishes the v2 deployment witness. These source bodies are not yet
live on Ygg; bootstrap and deployment remain the next phase.

## Yggdrasil GPU pressure exposed missing progress authority (2026-07-17)

The live authority chain now reaches Yggdrasil. Bifrost authorized exact
Epiphany main commit `586147a751c6eec2d59cd8dc10bd17ce0d02a4d1`; Idunn fetched that exact
upstream commit, built it in the pinned Rust container, installed immutable
release `sha256-a5a43af6d2502377d2078dcb42ab98088f4a812487217436ec1af0ddd0d26b3d`,
and started both local projectors against Ygg-local Qdrant and GPU-backed
Ollama. Mind completed its first pulse, reported `providerStatus=ready`, and
published 215 vectors. Workspace coverage is a real 3,956-file Body pressure
run; a local line-based estimate is 14,734 UTF-8 chunks.

The GTX 1080 is genuinely used: the workspace projector sustains roughly
93-100% compute utilization at 2,419 MiB VRAM. The prior 32-text HTTP batches
could monopolize one request for more than thirty minutes. Commit `586147a7`
bounds batches at four; live Ollama receipts now complete continuously in
roughly 0.7-1.7 seconds per call at about 53-63 calls/minute. This proves useful
forward GPU work, not merely allocation. It also proves the full first pass is
roughly an hour at the current hardware ceiling, longer than Idunn's 50-minute
deployment-health wall clock.

Do not fix that by increasing the wall clock. The current execution primitive
embeds the entire sealed plan into memory, then performs Qdrant publication and
verification, and only returns to the binary afterward. The binary therefore
emits no signed provider heartbeat during the long pulse. Ollama logs,
`nvidia-smi`, process existence, elapsed time, and Qdrant point counts cannot
become progress authority.

Authority map for the repair:

- Owner: the authenticated workspace-coverage projector owns domain progress;
  Idunn owns deployment admission, and the supervisor only derives aggregate
  health.
- Inputs: exact packaged release/policy/managed launch, provider incarnation,
  claim and attempt epoch, sealed plan, Body observation/generation, immutable
  embedding artifact/dimensions, and acknowledged durable Qdrant checkpoint.
- Outputs: an append-only provider-signed
  `epiphany.workspace_coverage.projection_progress.v0` event plus CAS latest
  pointer. It binds sequence/time, exact authority identities, phase,
  completed/total units, and the currently bounded backend operation.
- Derived state: `warming` requires a fresh independent process heartbeat and
  fresh monotonically advancing exact-lineage progress. `stalled` follows an
  expired named operation/no-advance deadline. `active` still requires the
  canonical receipt/head and live verification; progress at 100% is not
  readiness.
- Forbidden writers: Idunn, deploy scripts, supervisor, Ollama logs, GPU
  telemetry, stdout, Qdrant counts, running claims, and free-running heartbeat
  churn cannot advance progress.
- Shared path: first projection, ordinary Body change, retry, and authenticated
  successor recovery use the same durable batch/checkpoint primitive.
- Cut line: split monolithic embed/upsert/verify execution at deterministic
  durable boundaries; keep liveness heartbeat independent; remove total wall
  duration as the health verdict. A successor launch cannot inherit work
  without an explicit authenticated resume/checkpoint contract.

Negative proof must cover frozen progress with live heartbeats, stale heartbeat
with advancing progress, replay across launch/Body/plan/model/release, sequence
or count regression, mutable totals, progress without acknowledged Qdrant
durability, 100% without a valid receipt, deleted/substituted collections,
restart inheritance without recovery authority, concurrent owners, clock
hostility, and Idunn accidentally treating warming as active.

The current live run remains diagnostic evidence only until its terminal
workspace receipt, exact aggregate RUDP health, and deployment witness land.
No reboot is authorized.

Checkpoint implementation cut: the authoritative batch checkpoint lives in
the repository Body CultCache, not the local Verse. It is admitted by one CAS
against unchanged Body/obligation/plan/running claim/running attempt and a
claim-scoped checkpoint head. Each checkpoint carries a contiguous canonical
plan range plus the exact ordered point, payload-hash, and vector-hash bindings
read back from Qdrant after a waited upsert. The signed Verse progress event
references the checkpoint's exact CultCache envelope digest; neither a random
provider hash nor Qdrant operation text is evidence. Terminal readiness still
requires the existing whole-collection scroll and receipt/head CAS.

Same-claim retry may continue only from a contiguous authenticated checkpoint
chain whose batches still re-observe exactly in Qdrant. Recovery uses a new
claim epoch and new epoch-fenced collection. A successor may authenticate and
copy predecessor checkpoint batches into its own collection after exact death
and recovery proof, then emit new-claim checkpoints citing the source envelope;
it never mutates or inherits the old collection. If live external evidence is
missing or changed, it restarts from zero. Required backend cuts are a single
bounded waited upsert, exact retrieve-by-ID with vectors/payloads, and a common
readback/checkpoint primitive for newly embedded and recovered copied points.

The first bounded-batch pressure run terminated exactly as the model predicted.
At `2026-07-17T01:23:50+02:00`, after 50 minutes of candidate-health waiting,
Idunn stopped Epiphany, left `/srv/epiphany/deploy/deployment.env` absent, and
reported `Idunn did not publish exact-candidate Epiphany daemon-health proof`.
Ollama had completed 3,389 embed HTTP calls since candidate startup. After the
Mind projection calls, that represents roughly 13.3k workspace chunks—about
90% of the estimated 14,734-chunk Body. The GPU remained usefully saturated,
but the monolithic executor had not yet upserted the accumulated workspace
vectors, so Qdrant's inherited Modeling collection remained at 22 points and
the hour of partial work was discarded. This is the live falsification of the
current execution/deployment contract. Do not reinterpret it as an Ollama or
GPU failure and do not repair it by lengthening the total wall timeout.

## Live projector checkpoint integration landed (2026-07-17)

Epiphany main commit `7362e54b` replaces the production monolithic workspace
executor. The live path now processes sealed plan-order batches of at most 128
points, performs a waited Qdrant upsert, reads those exact IDs back with payload
and vector, admits a provider-signed Body checkpoint, and publishes progress
only from that admitted checkpoint. Restart authenticates the complete
genesis-to-head checkpoint chain against current Body, claim, attempt, plan,
launch, and host authority; it re-observes every checkpointed batch before
resuming at the next ordinal.

Terminal receipt/head proof remains separate. It reconstructs independent
payload/vector expectations from the authenticated full checkpoint chain,
requires complete contiguous plan coverage, and rejects cycles, gaps,
overlaps, duplicate checkpoint or Qdrant rows, missing/extra points, and any
payload/vector substitution during the final whole scroll. The previous
circular final-vector comparison was found by Soul and cut before commit.

The provider heartbeat is now an independent signed 10-second nerve and keeps
publishing while projection blocks. Heartbeat publication, sequence, or local
projection-lock failure terminates the whole provider process; a projector may
not continue acting after losing its liveness organ. Pulse refusal remains an
operator projection and no longer contaminates heartbeat status.

Focused proof: 10 checkpoint tests, 17 projector tests, 3 service tests, the
reserved supervisor-argument test, and production checks for both projector and
supervisor binaries pass. The old all-at-once executor survives only under
`cfg(test)` for legacy pre-embedded invariant tests; it is absent from the
deployed body. The next authority cut is Idunn and aggregate health: consume the
exact provider progress document with a no-advance lease, never a generic job
progress noun or total projection wall clock.

Live storage pressure later exposed that the production cadence still admitted
one immutable Redb checkpoint/progress transaction per point despite the
128-point batch contracts. The cadence now aliases the shared checkpoint maximum
of 128 and is compile-time constrained by Qdrant's same 128-point transport
ceiling. Durability still follows waited upsert plus exact payload/vector
readback; only the authenticated commit unit changed. Existing one-point chains
remain valid predecessors for later larger batches when their exact Qdrant
collection survives. A progress store whose collection is absent must not be
resumed from counts alone.

## Organizational Epiphany is the product, not a remote-control experiment (2026-07-18)

The Yggdrasil deployment is the first ordinary organizational Epiphany body.
It must remain awake without continual instruction: Modeling persistently maps
the bounded domain into typed Mind state, Self extrapolates pressure and
direction from that map, and Imagination authors inspectable improvement and
feature proposals. This initiative is advisory until the appropriate adoption
and consequence authorities act; operator inactivity permits observation,
modeling, and proposals, not merge, publication, deployment, or scope growth.

The repository Persona is the organization's shared social crossing. Members
may talk to it, correct it, and provide feedback through ordinary Discord
conversation. Persona owns discussion and legibility. Conversation produces
typed feedback pressure for Modeling, Imagination, and Mind review; it does not
directly mutate canonical Mind, invoke Hands, authorize a release, or command
Idunn. Authenticated operational capabilities such as brake, objective intake,
adoption approval, release authorization, and deployment remain distinct typed
Bifrost routes with explicit receipts. VoidBot observes the room and Bifrost
routes the typed crossing; do not invent a second Discord bot or grant ordinary
chat ambient actuator authority.

The July 22 continuity criterion is stronger than remote command. Yggdrasil
must host the resident scheduler/coordinator, model runtime, tool spine, Persona
crossing, writable domain worktree, persistent Mind/Modeling state, and local
credentials. Starfire may be absent through August 5. The offline rehearsal
must prove conversation/feedback -> persistent domain map -> Imagination
proposal -> explicit adoption/review -> Hands consequence -> Bifrost exact
release authority -> Idunn deployment receipt, plus the negative that
conversation alone cannot cross any later boundary.

Live observation on 2026-07-18 sharpened the deployment boundary. Exact release
`0601e280480cccc28209fbf0630e921f3ef9056d` kept its projector incarnation alive
and advanced the Qdrant workspace collection from 1,621 to 3,278 points after
the foreground Idunn deploy actuator was no longer present. `deployment.env`
remained absent and Idunn correctly raised `dependency-unavailable` because it
could not establish release freshness. A surviving candidate and advancing
checkpoint are resumable work evidence, not deployment admission. After the
provider reaches terminal projection, the same exact authorized release must
re-enter Idunn's deployment transaction and earn the typed deployment witness;
no observer, systemd state, Qdrant count, or journal line may synthesize it.

## Resident organizational Self ownership (2026-07-18)

The resident cognition cut now has a concrete authority boundary. Standard
heartbeat alone converts one pending typed pressure into one single-consumption
Self scheduling grant. Resident Self alone turns that grant into one exact
coordinator process lease. The coordinator, model runtime, and tool spine keep
their existing authorities; the resident scheduler does not absorb them.

Inputs are an authenticated packaged-release witness, physically separate
resident/runtime/Verse/Mind stores, the swarm brake, exact process observation,
and typed operator-objective, Body-map-drift, Persona-feedback, or
Imagination-proposal pressure. Outputs are immutable pressure/grant,
preparation, child-claim, active-lease, coordinator-receipt binding, and
heartbeat terminal-ack documents. Active status and cooldown are derived from
that chain. Process exit, logs, Persona speech, proposal text, systemd state,
Eve/Gjallar projection, and Qdrant progress are forbidden writers.

All wake sources share one path: pressure -> heartbeat grant -> prepared launch
-> packaged coordinator child claim before cognition -> exact process lease ->
bound coordinator terminal receipt -> terminal acknowledgement. Preparation
and grant consumption use one CAS; brake and timeout drain the exact observed
process; coordinator exit zero without its exact receipt fails. The old
source-tree/Cargo swarm wrapper and its `online`, `run`, `run-queue`, `pulse`,
and `epiphany-work` queue authority are outside the live body. Packaging now
requires witnessed sibling roles for swarm, coordinator, model runtime, and the
Codex MCP tool spine.

Verification must remain at these typed transitions: CAS/replay, store
separation, release witness, child-claim-before-cognition, exact process
identity, brake/timeout timelines, receipt substitution, and absence of runtime
Cargo/queue paths. One nonblocking hardening note remains: the parent currently
correlates its post-launch process observation with the child's atomic claim.
That is stronger than PID custody and fails closed, but it should eventually be
replaced by an OS-authenticated parent/child launch channel where available.

This is cognition bootstrap, not deployment admission. Ygg release
`0601e280480cccc28209fbf0630e921f3ef9056d` remains a live advancing candidate
until Idunn publishes the exact typed deployment witness; resident service
installation, writable domain custody, credentials, Persona/Discord ingress,
and the Starfire-offline rehearsal remain required.

## Resident physiology and Ygg service body prepared locally (2026-07-18)

Heartbeat `serve` is now the single resident physiology loop: it reconciles an
exact terminal acknowledgement first, retains pressure while braked, emits at
most one grant while clear, never replaces an active coordinator, and performs
bounded void/sleep work only while idle. Restart resumes the typed chain rather
than guessing from process or journal sight. Heartbeat is a required witnessed
release sibling; coordinator and resident Self require the exact authenticated
runtime and an explicit provider.

`epiphany-swarm status` is non-actuating sight. Its typed resident-readiness
document binds runtime id, release id, release witness, source commit, packaged
binaries, physical store separation, heartbeat/Self freshness and coherence,
active lease sight, runtime-scoped brake, writable workspace, and credential
posture. The existing daemon supervisor remains the sole signed Idunn health
writer and may aggregate the exact heartbeat/Self provider pair. Readiness,
systemd, and PID sight cannot admit deployment.

The matching `gamecult-ops` cut defines three narrow services:
`epiphany.service` owns supervisor/projector execution and signed aggregate
health; `epiphany-heartbeat.service` owns heartbeat state and grants; and
`epiphany-swarm.service` owns resident-Self state and bounded coordinator
launches. Coordinator, model runtime, and tool spine remain witnessed child
siblings. Yggdrasil's writable organizational Body is
`/var/lib/gamecult/epiphany/workspace`; immutable
`/srv/epiphany/source/current` is release provenance. Bootstrap prepares
protected stores and service-user credentials. Deployment authenticates the
sibling set, initializes heartbeat, manages all three units transactionally,
preserves coverage checkpoints across retries, waits for typed readiness, and
lets Idunn write `deployment.env` only after admission.

This is ordinary organizational Epiphany. Persistent Modeling maps the bounded
domain; Self derives bounded attention pressure from map drift; Imagination
authors inspectable improvements and feature proposals; the organization talks
to the repository Persona through existing VoidBot/Bifrost Discord ingress.
Feedback and proposals may request cognition. They cannot adopt Mind state,
invoke Hands, authorize Bifrost release, or command Idunn. Those are separate
typed crossings and receipts.

Live source `0601e280480cccc28209fbf0630e921f3ef9056d`, release
`sha256-f9fbc9c17cfc4038c49f77dd2a238d487b723600127a982dc4ae2ab98b308a77`,
and projector PID `145165` remain the sole first-projection owner. Its Qdrant
collection advanced beyond 6,585 points. `deployment.env` and the foreground
Idunn actuator remain absent, so this is resumable provider evidence, not
admission. Do not interrupt it. After terminal proof, re-enter the exact release
through Idunn, then authorize and deploy the coordinated resident generation.
Before July 22, run Starfire-offline proof of feedback -> persistent map ->
bounded Imagination proposal -> explicit adoption/review -> Hands -> Bifrost ->
Idunn, including the negative that conversation alone crosses no later gate.

The immediate live wound precedes that work. The workspace projector is the
lifetime owner of `workspace-coverage.cc`, but the supervisor currently opens
that private store to discover and perform recovery. Replace that transitive
authority leak with a provider-signed claim sight published immediately after
acquisition and a host-signed recovery directive consumed by the replacement
projector. Heartbeat remains liveness only. The supervisor must never open or
mutate the coverage store; it declares recovery only after authenticating the
replacement claim sight. Keep Epiphany and Idunn stopped on Yggdrasil until the
corrected exact release is authorized through Bifrost and deployed through
Idunn. No host reboot is authorized.

## Workspace-coverage recovery ownership cut complete locally (2026-07-18)

The supervisor no longer opens or mutates `workspace-coverage.cc`, directly or
through an imported recovery helper. The lifetime projector owner publishes a
provider-signed claim sight before its first backend operation. Claim sight is
keyed to the exact current Body observation and generation and binds the exact
launch, provider key, coverage-store binding/file/route, Body basis, claim,
attempt envelope, plan, and recovery lineage. A signed sight from an older Body
is not current recovery authority.

After exact termination and replacement readiness, the supervisor publishes
one immutable host-signed recovery directive. It binds the authenticated old
claim sight, termination, replacement launch, readiness heartbeat, Body, and
coverage route by exact envelope digests. Reconciliation reauthenticates and
returns the same signed directive byte-for-byte; a later heartbeat cannot
rewrite it, and conflicting lineage is refused. Provider heartbeats now retain
immutable per-heartbeat evidence beside the latest pointer because durable
termination and recovery documents may cite an earlier heartbeat. Causally safe
bounded retirement remains future work; naive deletion is forbidden.

The replacement projector authenticates the directive and performs the
recovery CAS through its already-held `WorkspaceCoverageAuthority`. Recovery is
idempotent across the CAS-to-successor-sight crash window: an exact committed
successor and receipt are returned on replay, then ordinary acquisition
republishes successor claim sight. A directive naming readiness heartbeat H
remains valid when the same launch/provider has advanced normally to ready
H+1. Heartbeat remains liveness evidence and does not own the lease.

Focused proof passes: eight process-document tests, the exclusive lifetime
owner test, supervisor authority-order/prohibition test, pre-checkpoint sight,
stale-Body refusal, H/H+1 consumption, immutable directive reissue, conflicting
lineage refusal, exact CAS replay, successor sight publication, `cargo check
--bins`, and `git diff --check`. Soul found no remaining P0/P1/P2. This code is
ready to commit and push, then cross Bifrost/Idunn as an exact release while the
host remains braked.

## Live deployment and reconciliation split follow-up (2026-07-18)

Commit `0601e280480cccc28209fbf0630e921f3ef9056d` is pushed, is the sole current
Bifrost release authority, and is running through Idunn on Yggdrasil as release
`sha256-f9fbc9c17cfc4038c49f77dd2a238d487b723600127a982dc4ae2ab98b308a77`.
The detached deployment request remains in progress and `deployment.env` is
absent, so terminal admission is not yet proven. Projector PID `145165` has
remained stable; `body.cc` remained 612,961 bytes; the dedicated coverage store
remained 79,712,256 bytes while its typed state advanced; and the current Qdrant
collection advanced from 193 to 1,621 points. GPU samples show the embedding
model resident and useful intermittent load. Do not interrupt this sole owner
merely because the first full projection is slow.

Live stdout exposed a remaining conceptual substitution: every healthy claim
was routed through the termination writer and projected as
`awaiting-exact-termination`. The writer refused ExactAlive, so private state
remained safe, but alive, inaccessible, and indeterminate sight were collapsed
into dishonest recovery pressure. The local uncommitted correction gives the
supervisor one typed non-mutating process observation before recovery:
ExactAlive reports `observed-alive`; uncertain sight reports
`observation-degraded`; authority drift reports `observation-refused`; only
proven terminal sight reaches termination, replacement, readiness, and
directive.

The cut also seals the restart timeline. Claim sight is re-read after immutable
termination to close the pre-first-claim race. A persisted replacement without
a directive is recognized only through exact old-launch, termination, policy,
and causal replacement bindings. The supervisor observes that exact replacement
alive, selects a fresh signed ready heartbeat under the existing 180-second
lease, then re-observes the process immediately at the directive actuation
boundary. Terminal or uncertain replacement sight produces no directive,
termination write, or second launch. Recovery resumption, newly launched
replacement, and immutable directive replay share the same final gate.

Focused proof passes: ten workspace process-document tests, eight supervisor
workspace-reconciliation tests, all-bin check, diff check, and final Soul audit
with no P0/P1/P2. Behavioral injection proves ExactAlive-to-Missing across the
readiness window performs zero directive/termination/launch writes, while
ExactAlive-to-ExactAlive performs exactly one directive write. Commit and push
this cut next; do not replace the live release until its current projection has
landed terminal proof or a real failure requires recovery.

## Current organizational Yggdrasil deployment (2026-07-18)

This section supersedes earlier live-PID and release-progress instructions.
Release `0601e280480cccc28209fbf0630e921f3ef9056d`, projector PID `145165`, and
their Qdrant counts are historical evidence only. The old deployment transaction
was terminated through its rollback boundary, its release authority was revoked,
and its missing final witness must not be reinterpreted as admission.

The ordinary organizational feedback path is live on Yggdrasil. VoidBot runs as
its host service identity with portable observer-group access and writes atomic
typed observations through the exact Idunn-admitted CultLib runtime. Bifrost is
healthy, bound to six organization channels, and publishes daemon-owned RUDP
health accepted by Idunn. A labeled bound fixture became an immutable admission
receipt with `grantsWorkAuthority=false` and `grantsAdoptionAuthority=false`; an
unbound fixture was refused. Conversation remains feedback pressure only.

Idunn and Bifrost deployment authority were repaired from the coherent Odin
schema branch. Idunn now kills timed-out Unix command process groups, treats an
absent deployment witness as first-deployment state while refusing corrupt
witnesses, and rehydrates its preserved typed store. Bifrost's release runtime
uses pinned commits and publishes an exact deployed-revision witness. VoidBot
`7c6f0e9e77ef9d2361c9b7a8368f9fdb0b754458` is deployed and witnessed.

Epiphany `37df884c6411da10196e59b741a538f792deeee5` is authorized through Bifrost
and is being deployed only through Idunn. The canonical writable Body is
`/var/lib/gamecult/epiphany/workspace`; immutable release provenance is not a
substitute. The actuator now writes an engaged typed `scope=all` swarm brake
before starting any Epiphany service. Releasing that brake is a separate
operator action. Until Idunn admits exact signed aggregate health and publishes
`/srv/epiphany/deploy/deployment.env`, the candidate is not deployed.

## Resident organizational product and authority correction (2026-07-18)

Epiphany's resident organizational behavior is the product posture, not a
special dogfood mode. A swarm may continuously map its authorized domain and,
from the current admitted model, ask Imagination for bounded proposals without
waiting for a chat instruction. Organization feedback through the repository
Persona is additional attributed pressure, not the ignition key and never
adoption or action authority.

The old `body-map-drift` pressure was a false measurement: it hashed only the
current RepoModel and compared it to no Body or prior model. It is replaced in
`epiphany-core/src/resident_self.rs` by
`admitted-model-direction-consideration`, bound to the exact current admitted
model revision/hash and unique admission receipt and emitted only while no
terminal direction consideration exists. Imagination remains proposal-only.

Package construction and application-owned state publication are separate;
Bifrost owns release crossing and Idunn owns deployment. Verifier/status reads
consume immutable provider snapshots without acquiring writer locks. Resident
readiness joins separately owned release, runtime/Verse, provider, Mind, and
brake facts and grants no cognition or action authority. An engaged brake still
permits daemon supervision, leases, health, liveness, and read-only sight while
blocking cognition launches, cognitive-work scheduling, Hands consequences,
publication, and deployment actuation.

Exact candidate `9165862cce09739a62b20c0c7728ccceb71cfc2f` crossed Bifrost and
built immutable release
`sha256-39eed3817a10325b39b7f223fb2919c5959c88443ef82d9cc1497f6af631f365`
with witness
`sha256-9ad9cfe17fcabffb84fb392cbd5ecc1e8823482a338b38ced52e1020532e80c6`.
It was not deployed. Startup exposed three faults, so all candidate services
and the Idunn transaction were terminated through rollback. There is no
deployment witness or active-release pointer. The immutable package and stable
compiler cache remain reusable evidence only.

The successor source cuts those faults at their owners. Heartbeat reads only
its typed identities from the mixed heartbeat/readiness store and writes exact
owner entries with CAS, preserving foreign readiness. CultCache now provides a
typed in-memory envelope load primitive for this shared-store view. Cold Self
without thread state emits no direction request yet instead of failing. A
`heartbeat.scheduler` brake blocks cognitive scheduling but does not block
daemon lifecycle physiology; explicit daemon lifecycle surfaces still do.
Focused proofs pass and the full core library reports 570 passed, zero failed,
one ignored.

Candidate `86d702002acee8321438f32fb9cf69a29a667d70` built and sealed immutable
release `sha256-da19a70a7e8c0229cd59b292bf5867fd1e97fa40643ab772e918c5d49dd7ff22`
with witness
`sha256-62c65d813837dd4a939e941d798d0842ee5f6c77cddaa645f2c47a18b7c3ec44`.
It was not deployed. Projection and Heartbeat were healthy and braked, but
resident Self found a second cold-start path: feedback-driven Imagination
consideration required thread state before a thread existed. Idunn was
terminated through rollback; all services are inactive and no deployment or
active-release witness exists. The immutable package is evidence only.

That second path now treats absent thread state as a missing prerequisite: it
emits no request, writes nothing, preserves admitted feedback, and retries on a
later pulse. The causal smoke explicitly requires its fixture thread. Focused
Imagination tests, resident-Self tests, and all-bin compilation pass.

Exact successor `aa3d2330062a34145cb70b527e02fa00215eac1b` was revoked before
deployment because packaging repeated the release-root staging permission
failure with no predecessor alive. This killed the cleanup-race hypothesis.
The real fault was the builder's long-lived write lease over the shared
root-owned release directory.

Packaging is now source-generation scoped. The packager stages beneath the
exact commit directory and atomically renames the final release within that
same directory, so canonical witness paths do not move. Idunn keeps the shared
release root root-owned and grants the builder only that exact commit directory;
cleanup seals it root-owned and removes only its nested staging. Package tests
pass 12/12, all binaries compile, and the actuator passes remote Bash syntax.

Next action: commit and push the generation-scoped Epiphany and ops cuts,
install the exact root-owned actuator, then authorize and cross the new exact
commit through Bifrost and Idunn while braked. Verify the typed brake, exact
release/witness bindings, all three service owners, signed Idunn health, local
Qdrant/Ollama routes, and final deployment witness. Then run the Starfire-offline
rehearsal before 2026-07-22: organization feedback -> persistent Modeling map ->
bounded Imagination proposal -> explicit review/adoption -> Hands consequence ->
Bifrost release -> Idunn deployment, plus replay/tamper refusal and the negative
chat-only path. No host reboot is authorized.

## Generation handoff and resident mixed-store cut (2026-07-18)

Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` proved generation-scoped
packaging and sealed immutable release
`sha256-fe7f25ff60d84ae9316d7b4aa2833bd5d1b65189c9d08cc64e903a83d8f35268`.
Its first application publication failed because the exact commit parent was
still builder-owned mode 0750; cleanup sealed that parent and an automatic
retry reused the exact package and started all three services. The actuator now
seals the exact generation parent root-owned mode 0755 before handing
publication to the application owner.

The candidate was not deployed. Projection and Heartbeat were healthy and
braked, but resident Self treated the shared resident/readiness CultCache store
as if every row belonged to Self and rejected the legitimate provider-readiness
document. The exact process group was terminated, all services were stopped,
`active-release.env` was removed, and no deployment witness exists. Resident
Self now loads only its six owned typed families into its in-memory view,
rejects duplicate owned identities, and leaves foreign readiness rows intact.
Focused resident proof passes 12/12; full core proof passes 572/572 with one
ignored.

Next action: commit and push both cuts, install the exact ops actuator on
Yggdrasil, revoke obsolete Bifrost authority, authorize the new exact Epiphany
commit, and let Idunn deploy under the engaged brake. Require the immutable
package/witness, all three healthy service owners, signed aggregate health, and
`deployment.env`; then prove the ordinary organization loop and its negative
authority boundaries. No host reboot is authorized.

## Managed-policy rotation preserves historical process evidence (2026-07-19)

Exact candidate `2d4c92d24c2007858914d352b5892f599e6a20e9` sealed release
`sha256-1dd1271405e82958df2c03133b0d89d2555a8a3c7013486e1c41465ec84f6b3c`
and witness
`sha256-e01803545e557488cf2a0a42c31bb65e17ff7ead21790d7c982216901d94e12b`.
The generation handoff and resident mixed-store repairs held: all three services
started, Heartbeat remained braked, and resident Self remained stably braked.
Workspace coverage did not launch because its prior signed launch was checked
against the newly written current managed policy and became impossible to
observe, terminalize, or replace. The exact transaction was rolled back,
Bifrost authority revoked, services stopped, active pointer removed, and no
deployment witness exists.

The source authority is now split correctly. Historical host-signed launch
evidence remains authentic across policy rotation and may prove only exact
process identity and immutable termination. New process admission still
requires the exact current policy digest. Reconciliation terminalizes the stale
identity without deleting history, then launches a causally bound replacement
under the current policy. Public current-process observation continues to reject
stale launches. Focused process tests pass 11/11, supervisor authority tests
pass 24/24, full core passes 573/573 with one ignored, and all binaries compile.

Next action: commit/push the successor, cross its exact SHA through Bifrost and
Idunn under brake, and require historical terminal evidence, current-policy
replacement launch, three stable services, signed aggregate health, and the
final deployment witness before rehearsing Starfire-independent operation.

Candidate `b5405beaa95cddc837f3b7a7ca268ac9b5ae4502` then proved the historical
authenticator shipped but exposed an ordering fault: reconciliation asked
provider claim sight to authenticate before it inspected the supervisor-owned
latest launch. Claim sight correctly rejected the stale policy, so the new
rotation branch was unreachable. The candidate was rolled back, its authority
revoked, services stopped, active pointer removed, and no deployment witness
exists. Reconciliation now loads latest launch and completes stale-policy
rotation before current claim authentication. Provider claim state participates
only after a current-policy launch exists. Supervisor proof passes 24/24 and
full core remains 573/573 with one ignored.

Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` then crossed the first two
rotation cuts: supervisor PID `1147968` launched replacement workspace
projector PID `1148157`, and the replacement published advancing ready
heartbeats under the new policy while the brake held. Recovery still stalled
because the old Body claim was readable only through current-claim
authentication, which correctly rejected its historical launch before the
mismatch branch could issue a recovery directive. The candidate was rolled
back and revoked; no deployment witness exists.

Claim sight now has separate current and recovery readers. Current
authentication remains mandatory for provider projection work and refuses a
stale launch. Recovery authentication proves only the old signed
claim/Body/route lineage. Supervisor recovery and directive writing use that
historical reader, while the replacement launch and ready heartbeat remain
bound to the current policy. The atomic lease-transfer path also authenticates
the old launch historically. The full causal test now performs real policy
rotation and proves current refusal, historical recovery, directive fencing,
lease transfer, successor current sight, exact replay, and tamper refusal. Full
core passes 573/573 with one ignored; all binaries compile.

Candidate `351355d3baee2d475f84168136380d2f50197ef8` reached live runtime with all
three service owners active and the brake engaged, but emitted
`authenticated claim sight does not name the current managed launch`. The old
claim named the original historical launch while successive failed deployment
attempts had created a valid signed chain of replacement generations. Recovery
still required the current launch to be the old claim's direct child. The exact
Idunn process group was terminated, services stopped, active pointer and
witness removed, and Bifrost authority revoked; no deployment witness exists.

Recovery now proves ancestry rather than pretending retries did not happen.
It walks backward from the selected current-policy launch to the claimed
historical launch, authenticating every host-signed launch, exact parent
termination id and envelope digest, and termination-before-child chronology.
It refuses cycles, missing ancestors, broken edges, and a non-current endpoint.
Directive writing, directive receipt verification, atomic lease transfer, and
supervisor crash-resume use the same lineage proof. The supervisor publishes
the actual lineage error instead of collapsing it into a generic mismatch.
The causal test now includes an intermediate failed-deployment generation and
passes the complete recovery transaction. Full library passes 573/573 with one
ignored; supervisor authority tests pass 24/24.

Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` crossed the lineage gate and
supervisor published recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d`
from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch
`9414c32f-f53c-450c-bc19-a69f5ba04a29`. The projector still refused every
pulse because it authenticated current successor claim sight before consuming
the directive that creates that successor. Supervisor replayed the exact
directive safely, revealing a circular ordering fault rather than missing
evidence. The candidate was rolled back and revoked; no deployment witness
exists.

Projector pulse now authenticates and consumes a replacement-addressed recovery
directive before retirement or ordinary projection work. The atomic recovery
transaction is already exact-replay idempotent, so no speculative current-claim
query is needed in front of it. Current claim sight is recovery output, not
recovery input. A source-order test makes the authority ordering explicit. Full
library passes 574/574 with one ignored; supervisor authority tests pass 24/24.

## Ordinary organizational product and current readiness refusal (2026-07-19)

The Yggdrasil body is the normal organizational Epiphany product, not a special
experiment or dogfood mode. Persistent Modeling maps the authorized domain.
Resident Self may derive direction from the admitted map and ask Imagination
for bounded proposals without waiting for an instruction. Organization members
talk to the repository Persona; their attributed conversation becomes
additional feedback pressure. Conversation is not the ignition key and cannot
adopt Mind state, authorize Hands, grant Persona public speech, cross Bifrost,
or ask Idunn to deploy. Those remain distinct explicit authorities.

Exact candidate `9e1fa0f527b3bff2c5a709eff640b0d8d2f3b82d` consumed recovery
directive `6f1dc0c8-b8a5-48d0-add5-761b17368fbf`, replaced historical claim
`c6df4335-7080-4d5f-80fc-4fa18a9d16ce` with current claim
`2a355736-3792-4f0f-8633-a246219bcf1b`, and completed a 14,793-point local
Qdrant projection through Yggdrasil's GTX 1080-backed Ollama route. Its three
service owners remain active with zero restarts and the all-scope deployment
brake engaged. It is not deployed: Idunn's exact transaction PGID `1245215`
still owns the candidate, `deployment.env` is absent, and typed resident
readiness remains `warming` because both provider comparisons refuse.

Both provider rows continue to refresh, name the exact release
`sha256-0a15262fd4c240a0131755aa6eb63b4eb7feff12e7cc4f49128fbb001887b1f2`,
witness `sha256-49ae1afcf11d18c0e2807ea53f54dba35df4280f6596e848c5cfc50328e01aea`,
source commit, executable, and local status `ready`. The old diagnostic
`stale or release-substituted` collapses owner, runtime, release, witness,
source, executable, provider status, process incarnation, future time, and
freshness into one useless phrase. Replace that opaque boolean with the same
fail-closed predicates plus operator-safe failed-predicate names; do not relax
admission. Keep the bounded diagnosis window while the Idunn transaction and
brake remain exact. If transaction ownership or the brake disappears, or any
protected surface actuates, use the existing rollback boundary immediately.