Record credentialed browser acceptance

notes/fresh-workspace-handoff.md

@@ -893,6 +893,29 @@ seconds, produced three appraisals and nine validated stage receipts, and
 atomically committed revision 1. One credentialed rendered-browser journey
 remains pending; invitations have not been rotated or consumed.
 
+Release `9f991e4ce6ee7ca6c33cfc97f86dda4c05992caa` was driven through the first
+credentialed rendered-browser journey. That journey exposed a real approval
+bug: the registry normalizes the campaign seed before persistence, while the
+recovery guard compared it with the pre-normalized preview. The server refused
+selection and preserved the preview, but left the valid new store unowned. The
+guard now compares the persisted seed with the same registry-normalized value,
+and a valid-approval regression test covers campaign ownership and preview
+consumption. The unowned test store is preserved outside the campaign namespace
+under `acceptance/quarantine`.
+
+The fixed browser journey compiled a grounded Aetheria preview, displayed its
+material gaps and branch assumptions before mutation, approved and selected it,
+refused two impossible claims without rolling or advancing revision, previewed
+an admissible DC 10 social attempt, rolled server-side, committed exactly one
+revision, and surfaced only the bounded observed fact. Fork and reset each
+published and selected exactly once. After a daemon restart, the HttpOnly
+session returned to the selected reset branch with all three owned campaigns
+and continuity intact. Starfire PID 5368 serves seven campaigns from release
+`9f991e4` with zero staging directories and executable SHA-256
+`b4e8a68006a46d32c712c4ebc21ec19d7de2a73165ea62645e87cb76e731c68a`.
+One invite is consumed; the second remains unused. Remote Odin replication is
+still the only known deployment degradation.
+
 ## Warnings
 
 - Keep persistent state small. Git history and artifacts own chronology.

state/evidence.jsonl

@@ -116,3 +116,4 @@
 {"ts":"2026-08-18T21:21:11Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 4995f261f68809857dbed620561e53b80198bd0f with executable SHA-256 1e1d46c549bd91feac58523861268797114e83a942e79d9c13de8bfc5fa96ea5 and rollback ca9c1ccbfaac8026bee9554d7244ed75931b5104. Typed health, manifest, executable hash, PID 25136, four persisted campaigns, DeepSeek readiness, and served asset index-B_0anyiQ.js agree. Fission free text is bounded before retrieval or inference. Generated openings and roles are now session-owned server state selected by opaque IDs; forged or cross-opening selection is rejected, and the selected role's validated capabilities, obligations, evidence, and model receipts survive into the approval preview. The full workspace passed 139 core and 14 daemon tests plus the strict browser build. Invitations were neither rotated nor consumed. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}
 {"ts":"2026-08-18T21:30:27Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 90e7ca38a2b4b1a2ca36228d7d248ee2fe6cae2f with executable SHA-256 ad2964c05fed28fa54ab4a5619406eeecd43bb37c96713085f18ec1cbf8c44c1 and rollback 4995f261f68809857dbed620561e53b80198bd0f. Typed health, manifest, executable hash, PID 27412, four persisted campaign directories, zero .creating-* directories, and DeepSeek readiness agree. Campaign initialization now commits seed and provenance atomically in a non-discoverable staging namespace before UUID publication; failed creation leaves no registry or filesystem residue, and failed approval keeps its exact preview retryable. The full workspace passed 140 core and 15 daemon tests. Invitations were neither rotated nor consumed. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}
 {"ts":"2026-08-18T21:43:19Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 53f3f0cc3165bef6d68a6edc4d4ffbbc16dc7fd8 with executable SHA-256 a4bbc699bcb120b3e2d546ee3f60491b36ecbb30013f60af58216ad2043426dc. Typed health, executable hash, PID 7868, four recovered campaign directories, zero .creating-* directories, and DeepSeek readiness agree. Fork and reset lifecycle receipts now enter their staging stores before atomic publication, and a deliberate receipt collision proves failure leaves no filesystem or registry residue. Campaign selection reloads stale canonical auth state once and preserves concurrent session changes. The full workspace passed 141 core and 16 daemon tests. A fresh four-actor live Persona wave completed in 10.39 seconds, produced three appraisals and nine validated stage receipts, and atomically committed revision 1. The unauthenticated rendered page loaded without console errors; malformed anonymous JSON returned 401. Invitations were neither rotated nor consumed. One credentialed rendered journey remains pending. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}
+{"ts":"2026-08-18T21:56:28Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 9f991e4ce6ee7ca6c33cfc97f86dda4c05992caa with executable SHA-256 b4e8a68006a46d32c712c4ebc21ec19d7de2a73165ea62645e87cb76e731c68a. The first credentialed rendered-browser journey exposed and then verified the repair of a registry-normalization mismatch in campaign approval recovery. The fixed journey compiled and approved a grounded preview, refused impossible teleportation and nonexistent-equipment claims without mutation, previewed and atomically resolved a server-side d20 attempt from revision 0 to 1, published fork and reset branches exactly once, and preserved session selection and all three owned campaigns across daemon restart. The release recovered seven total campaign directories with zero .creating-* directories, DeepSeek ready, PID 5368, and no browser console warnings. The refused-approval test store was moved intact outside the campaign namespace into acceptance/quarantine. One invite was consumed for this acceptance journey; the second remains unused and the invite blob was not rotated. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}