State: Joystick H1 is the active cut; Ghostlight canaries demoted behind it

Points at campaign joystick:campaign:self; flags the 1086aee deploy fact as
last-recorded (2026-08-22, ~100 commits behind HEAD); drops the stale E:
path and repixelizer-venv rehydrate command from the handoff.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

notes/fresh-workspace-handoff.md

@@ -1,6 +1,6 @@
 # Fresh Workspace Handoff
 
-This is the re-entry packet for `E:\Projects\Heimdall`.
+This is the re-entry packet for this repo (path: whatever the checkout is; it has moved drives before).
 
 It is intentionally short. Historical proof belongs in git history and the
 distilled `state/evidence.jsonl` ledger; the shared architecture belongs in
@@ -25,8 +25,18 @@ Get-Content '.\state\evidence.jsonl' -Tail 8
 
 Do not trust this file for the exact live HEAD. Always check git.
 
+## Active Work
+
+Joystick H1 is the active, M1-critical cut (operator ruling 2026-10-18):
+campaign `joystick:campaign:self`, target `joystick:target:r1`, branch
+`eureka/joystick-h1`. Read the campaign and target in the typed mind; do not
+re-derive them here. The Ghostlight KLTST canaries below stay open, behind H1.
+
 ## Current Orientation
 
+Deploy facts below are last-recorded, from 2026-08-22 (`1086aee`); HEAD has
+moved ~100 commits past it. Check Yggdrasil, not this file, for what runs.
+
 - Yggdrasil runs Heimdall
   `1086aee01169bf60e8a492b2740db1c6f3e8cabf` with CultLib
   `5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9`
@@ -171,6 +181,8 @@ Do not trust this file for the exact live HEAD. Always check git.
 
 ## Next Real Move
 
+Joystick H1 first (see Active Work). Everything below is the standing queue.
+
 Do not continue implementation automatically from a rehydrate-only request.
 
 The Idunn/swarm health transport cut is live. Do not regress Heimdall to

state/branches.json

@@ -12,6 +12,15 @@
         "docs/implementation-plan.md"
       ],
       "notes": "Current mainline. Repixelizer is the first auth-blank binding target; StreamPixels is the migration and boundary stress test."
+    },
+    {
+      "id": "eureka/joystick-h1",
+      "hypothesis": "One locked refresh primitive plus a Joystick OAuth provider in Heimdall lets StreamPixels ingest Joystick without ever presenting a provider refresh token.",
+      "status": "active",
+      "artifacts": [
+        "state/map.yaml"
+      ],
+      "notes": "Campaign joystick:campaign:self, target joystick:target:r1. Hands owns code in a separate worktree."
     }
   ]
 }

state/map.yaml

@@ -59,13 +59,14 @@ data_flow:
     - reject per-request auth round-trip chatter
 
 active_subgoals:
-  - Pressure the deployed Ghostlight gamecult.heimdall.access integration with two- and eight-account human canaries.
+  - ACTIVE, M1-critical (operator ruling 2026-10-18): Joystick H1, campaign joystick:campaign:self (branch eureka/joystick-h1). Joystick OAuth provider, joystick as a streampixels viewer provider, one locked refresh primitive for every provider replacing refreshLinkedIdentityCredentialIfNeeded.
+  - OPEN, behind H1: pressure the deployed Ghostlight gamecult.heimdall.access integration with two- and eight-account human canaries.
   - Keep the shared architecture explicit and separate from app profiles.
   - Preserve the default boundary that app-domain data remains app-owned.
   - Align the plan to Heimdall as a Yggdrasil-hosted authority service.
   - Publish Heimdall daemon health and boundary state for Idunn/Odin without moving auth truth out of Heimdall.
   - Verify the Discord and Patreon Repixelizer auth paths with real provider credentials, stable signing, persistent storage, and live browser callback verification.
-  - Wire StreamPixels through Heimdall for Twitch/YouTube viewer identity and managed creator-provider credentials without moving StreamPixels domain state into Heimdall.
+  - Wire StreamPixels through Heimdall for Twitch/YouTube (Joystick joins under H1) viewer identity and managed creator-provider credentials without moving StreamPixels domain state into Heimdall.
 
 accepted_design:
   - `gamecult.heimdall.access` owns access-gate representation and browser navigation semantics; it has no access-grant or provider-state authority.
@@ -125,5 +126,5 @@ rejected_paths:
     reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
 
 current_status:
-  summary: Yggdrasil runs the gamecult.heimdall.access plugin and encrypted loopback begin, complete, refresh, and logout plane at 1086aee01169bf60e8a492b2740db1c6f3e8cabf. Odin returns all four redacted discovery records, Ghostlight resolves the boundary through Odin, and live anonymous auth.begin is accepted without exposing claims or secrets.
-  next_action: Run separate-account KLTST completion, refresh, logout, privacy, and stale-attempt canaries through the deployed Ghostlight Eve host; keep provider credential rotation on the operator list because prior tool output exposed OAuth secrets.
+  summary: Active work is Joystick H1 (campaign joystick:campaign:self). Last recorded Yggdrasil deploy (not verifiable from this repo; HEAD is far past it, see git): Yggdrasil runs the gamecult.heimdall.access plugin and encrypted loopback begin, complete, refresh, and logout plane at 1086aee01169bf60e8a492b2740db1c6f3e8cabf. Odin returns all four redacted discovery records, Ghostlight resolves the boundary through Odin, and live anonymous auth.begin is accepted without exposing claims or secrets.
+  next_action: Land Joystick H1 per campaign joystick:campaign:self and target joystick:target:r1 (worktree and branch eureka/joystick-h1). Then, still open, run separate-account KLTST completion, refresh, logout, privacy, and stale-attempt canaries through the deployed Ghostlight Eve host; keep provider credential rotation on the operator list because prior tool output exposed OAuth secrets.