Huginn/docs/eureka-body-map.md

eureka-body: map (Imagination, 2026-10-08)

Status: map, Imagination (imagination-eureka-body), session self-2026-10-08. Campaign eureka-body in Eureka's mind (instance eureka). Target in force eureka-body:target:r1, whose doc is Huginn docs/eureka-self-cut.md at 570f369 (map r4 of 2026-10-01). This page keeps body facts, the model page (step 0b) and rationale. Questions, cut specs, follow-ups and rulings are typed documents in the mind; read them by id. Self commits this page where the target doc lives (Huginn docs/), probably as docs/eureka-body-map.md.

Revised 2026-10-09 (Modeling, session self-2026-10-09-morning) after leaf-into-huginn (Huginn afc35f9) and the Epiphany body teardown (gamecult-ops 9c12adb; leftovers in follow-up eureka-body:follow_up:epiphany-body-leftovers). Pinned heads and facts F1-F14 are as read on 2026-10-08 and keep their tense; each carries a note where a cut has since changed it. F15-F17 are new.

Revised again on 2026-10-09 by Imagination (imagination-brake-stop, session self-2026-10-09-eureka) at Huginn df7507b, after leaf-into-huginn, mind-authority, mind-control-store and run-kind had merged. New facts are F18-F20, which name the owner of the brake stop. The Brake, Units and run rows changed, and a rationale section was added.

Pinned heads (fetched 2026-10-08 ~12:10 UTC)

Repo	Ref	Commit	Note
Huginn	origin/main = local main, F:\Projects\Huginn, clean	6b496eb	last commit 2026-10-02; deployed daemon is 107552d (docs-only diff to main)
Epiphany	origin/main	ef956865	was Huginn's leaf pin (no pin since afc35f9); local checkout is on codex/eureka-pipeline-state 4006b14b. GitHub isArchived: false
CodexConnector	origin/main	3ddc12e	local checkout is on codex/ghostlight-release-binding 6519289; Ghostlight pins 68fe94b
gamecult-ops	origin/main	7e23387	clean
Bifrost	origin/main	160fac2	clean
Eureka (forge)	main	0bb414d	scratch clone, removed after
Idunn	origin/main	6667f0f	read only; not a campaign repo

Body facts

Each line: what was run, where, result.

• F1 Huginn never left Epiphany (at 6b496eb; cut at afc35f9, no build edge remains). grep epiphany crates/*/Cargo.toml (Huginn 6b496eb): crates/huginn-mind/Cargo.toml:22 pins epiphany-pipeline by git at Epiphany ef956865. Cargo.lock:376-378 carries the git source. The map-r4 cut leaf-into-huginn was never specified; no cut_spec for it exists in any campaign (query of cut_spec headers under eureka-substrate and eureka-body).
• F2 Leaf users in Huginn. pub use epiphany_pipeline; at crates/huginn-mind/src/lib.rs:62; direct use epiphany_pipeline in huginn-mind admission.rs:33 (26 mentions), docs.rs:9, fixtures.rs:7, index.rs:10,157, mind.rs:16 (9), query.rs:28,624, receipt.rs:19,50-52,314, refusal.rs:6, rows.rs:15, wire.rs:9; through the re-export huginn_mind::epiphany_pipeline:: in eureka-state src/lib.rs:29, src/main.rs:25, tests/client.rs:17, tests/common/mod.rs:16, tests/mcp.rs:14,539; huginn-daemon src/daemon.rs:7,220,688,718,747, src/index/mod.rs:102, src/semantic_tests.rs:13, src/serve.rs:71,551. Prose: README.md:64, AGENTS.md:18.
• F3 The leaf at the pin (now Huginn crates/eureka-pipeline, afc35f9). Epiphany ef956865: epiphany-pipeline/Cargo.toml (lib epiphany_pipeline, deps anyhow, chrono, cultcache-rs at CultLib 8fc74c7 = Huginn's own CultLib pin, rmp-serde, schemars, serde; dev serde_json), epiphany-pipeline/src/lib.rs (schema-publication test reads CARGO_MANIFEST_DIR/../schemas/cultnet at lib.rs:2725). schemas/cultnet/ holds 13 epiphany.pipeline.*.v2 schemas, epiphany.work_organ_state.v0, gamecult.persona_state.v0, index.json, README; schemas/README.md.
• F4 Mind deployment. ssh yggdrasil: huginn.service active, ExecStart /opt/gamecult/huginn/current/huginn-daemon --state-root /var/lib/gamecult/huginn --instance eureka --bind 10.77.0.1:17872 ...; current -> releases/107552dc... (Huginn merge of huginn-admission-rules; on 2026-10-08 main added docs only, and since then main has moved code: see F17). UFW admits 17872/udp on wg-gamecult from 10.77.0.2 only (runbook huginn-yggdrasil.md:38,124). The daemon has no peer authentication (serve.rs: one session per peer, max_peers = 256); any reachable peer admits as any faculty.
• F5 Epiphany residue on Yggdrasil (12:13 UTC, before the teardown; what the teardown left is follow-up eureka-body:follow_up:epiphany-body-leftovers). Units epiphany.service, epiphany-swarm.service, epiphany-heartbeat.service inactive/dead; epiphany-model-connector.service loaded, disabled. Users epiphany (988; groups epiphany-state, bifrost-feedback-readers) and epiphany-model (984; group gamecult-model); no process runs as either. Roots and sizes: /srv/epiphany 6.8G, /srv/epiphany-model-connector 16G, /var/lib/gamecult/epiphany 1.9G (body.cc, heartbeat.cc, codex-home, artifacts, capstones), /var/lib/gamecult/epiphany-model-connector 28K, /etc/gamecult/epiphany (bifrost-persona-feedback-anchor.msgpack, credentials/, idunn-provider-projection-anchor.cc, mcp.toml), /etc/gamecult/epiphany-model-connector (connection.key). Manifests /srv/odin/deploy-manifests/epiphany, epiphany-capstone-17, epiphany.capstone-17.yggdrasil.yaml, epiphany-ox17, epiphany.ox17.yggdrasil.yaml, epiphany-swarm.service, epiphany.yggdrasil.Dockerfile. /etc/gamecult/idunn/daemon-health-trust.cc contains the string epiphany. About 24.7 GB in all.
• F6 What the live crossing still names. /etc/systemd/system/bifrost-persona-mouth.service carries flags --epiphany-persona-mouth-trust-anchor, --epiphany-persona-permit-rudp, --epiphany-persona-permit-trust-anchor, --epiphany-runtime-id epiphany-starfire. gamecult-ops runbooks/bifrost-persona-feedback-yggdrasil.md:17 names /etc/gamecult/epiphany/bifrost-persona-feedback-anchor.msgpack, :45 the installed /usr/local/sbin/bifrost-authorize-epiphany-release (sealed historical name), :67 the feedback target --persona-id epiphany --repo GameCult/Epiphany --runtime-id epiphany-yggdrasil. These belong to the mouth rebinding, not to the teardown.
• F7 Nothing Epiphany runs on Starfire. Get-Process, Get-ScheduledTask, Get-Service filtered on epiphany|eureka|persona|bifrost: empty. The permit issuer the crossing expects on Starfire is not running, so the mouth cannot obtain a permit today.
• F8 Idunn still lists Epiphany. Idunn deploy/legacy/README.md:51-52 lists targets epiphany, epiphany-capstone-17; deploy/legacy/idunn-yggdrasil:126-135 dispatch, :312,:321 restart/deploy cases; deploy/legacy/idunn-yggdrasil.sudoers:10-11,19. The precedent for retirement is the same file's "Retired targets" (bifrost-persona-feedback, 2026-09-30). Idunn is not one of eureka-body's repos.
• F9 Codex is dead in practice. Idunn docs/migration.md:49-55: "The operator is not returning to Codex"; the deployed daemon failed with 401 token_expired. On Yggdrasil codex-connector.service is disabled, inactive since 2026-09-05 21:54 UTC, and nothing listens on 4103. Ghostlight's codex-connector library dependency is pinned at 68fe94b, so a kit lift does not move Ghostlight.
• F10 CodexConnector at origin/main 3ddc12e (2026-09-13): src/lib.rs 1,958, daemon.rs 1,180, provider_backend.rs 1,463, idunn_health.rs 1,396, main.rs 188, deployment/idunn/recipe.toml. Contract types: CodexProviderRequest lib.rs:76-94, CodexInputItem :212-229 (UserText, AssistantText, ToolCall, ToolResult; no reasoning item), CodexTransportInvocation :238-245 (no max_cost_usd), CodexTransportOutcome::Completed :449-462 (tokens, no cost), CodexRefusal :464-474 (no Budget). Schema ids gamecult.codex.*.v2 lib.rs:51-55.
• F11 gamecult-ops Epiphany tooling, before the teardown (git ls-files | grep -i epiphany, 7e23387): compose/epiphany.capstone-17.yggdrasil.yaml 38, compose/epiphany.yggdrasil.Dockerfile 55, runbooks/epiphany-yggdrasil-deploy.md 196, runbooks/epiphany-starfire-bifrost-crossing.md 101 (live crossing binding, kept), scripts bootstrap-epiphany-yggdrasil.sh 134, check-epiphany-yggdrasil.sh 136, construct-epiphany-image-yggdrasil.sh 91, deploy-epiphany-yggdrasil.sh 499, deploy-epiphany-capstone-17-transaction-yggdrasil.sh 5, deploy-epiphany-capstone-17-yggdrasil.sh 79, epiphany-capstone-17-connector-bridge-yggdrasil.sh 50, provision-epiphany-provider-health-yggdrasil.sh 116, seal-epiphany-capstone-failure.sh 67, test-deploy-epiphany-yggdrasil-order.sh 144, test-epiphany-container-promotion.sh 47, systemd/epiphany.service 31, systemd/epiphany-swarm.service 34; kept for the mouth cut: allow-starfire-epiphany-persona-permit.ps1, bifrost-authorize-epiphany-release.sh, configure-voidbot-epiphany-feedback-target-yggdrasil.sh. Inventory prose: inventory.md:581-588 (Starfire as Epiphany body), :726-730 (archived Verse residue), :773-785 (intended Epiphany deployment body). docs/repo-census-2026-09/ is history.
• F12 Eureka repo (forge main 0bb414d) carries the charters and doctrine (PR #3 landed). Epiphany citations remain: README.md:63,86-87,95, SKILL.md:3,8-9,146, every charter's line 14 ("Self-improvement law (Epiphany epiphany_doctrine.md)"), agents/hands.md:28, agents/soul.md:48, agents/life.md:24, doctrine/persona.md:3,13, doctrine/CLAUDE.md:31,229,233, doctrine/colossus.md:47,51 (lore, kept).
• F13 eureka-substrate specs written against Epiphany. cut-mind-authority.r1 and cut-run-kind.r1 have repo GameCult/Epiphany, base ef956865; cut-huginn-persona-state.r2 base bf73c42; cut-doctrine-persona-in-huginn.r2 gamecult-ops base 2aeb7364. None has a report. Since leaf-into-huginn they point at a repo nothing builds from; mind-authority and run-kind have r2 specs against Huginn (see Undone).
• F14 Discord developer policy on training with message content: the policy page (support-dev.discord.com article 8563934450327) answered 403 to a fetch on 2026-10-08. Self's recollection, unverified: the policy forbids using message content obtained through the API to train AI models without express permission. An Eyes pass must verify before question persona-trace-retention is ruled.
• F15 Selection order is admission ordinal. CultLib packages/cultnet-rs/src/selection.rs:1998-2005 (order_rows: ordinal, then schema id, then record key; reversed when descending). So "newest" is descending: true, limit: 1, and a run label needs no order of its own.
• F16 Huginn's leaf holds leaf-key-bound. crates/eureka-pipeline/src/lib.rs at afc35f9: SUBJECT_LOCAL_MAX (:898), RESOLUTION_LOCAL_MAX derived from it (:912), Sha::names_same_commit (:272). The literal 64 at :915 (the root bound in the fits-Short assert) is follow-up eureka-substrate:follow_up:leaf-bound-hygiene. leaf-key-bound landed at Epiphany ef956865 and came in with the leaf.
• F17 The live Huginn release is still 107552dc. Read-only ssh yggdrasil readlink /opt/gamecult/huginn/current on 2026-10-09: releases/107552dc4b27b8856b043616ae74c2ebe7908b66. Main (afc35f9) is ahead of it by the leaf move and the relicense; no deploy has happened since.
• F18 At Huginn df7507b nothing stops a unit of hers. Read from git show df7507b: on 2026-10-09 (Imagination imagination-brake-stop). crates/mind-body holds control.rs, cli.rs, main.rs and lib.rs. cli::run (cli.rs:40-61) dispatches show, brake hold, brake release and dial set. brake hold is ControlWriter::open(&path)?.set_brake(false, ..) (cli.rs:53) and does nothing else. git grep systemctl over crates/mind-body finds nothing. The binary sets umask 077 and calls cli::run with the root CONTROL_ROOT (main.rs:21-37). The window probe runs the real binary with brake release and brake hold 100 times (tests/control.rs:573-581), so a hold that ran systemctl would run it in the verify container. No launch.rs exists yet: the Launcher is cut mind-launch. RunTurn and RunOperator carry NAMES (crates/eureka-pipeline/src/lib.rs:507-508).
• F19 Yggdrasil has no unit, user or control store of hers. Read-only ssh yggdrasil as gamecultadmin on 2026-10-09:
  • systemctl list-units --all 'mind-*' and list-unit-files 'mind-*' both list nothing.
  • ls /etc/gamecult/minds gives "No such file or directory". command -v mind-control finds nothing. id mind-eureka gives "no such user".
  • The host runs systemd 257 (257.13-1~deb13u1). systemctl --help lists stop UNIT... and "--no-block Do not wait until operation finished", so a stop waits by default.
  • systemctl stop --no-ask-password 'zz-probe-none@eureka:*.service' as non-root returned 0: a glob that matches no loaded unit is a no-op. systemctl is-active 'huginn*.service' matched by glob (active).
  • Operators act through sudo: the gamecult-ops runbook huginn-yggdrasil.md:86 uses sudo systemctl stop huginn, and /etc/sudoers.d/ holds 90-gamecultadmin.
• F20 The ruling decides when the stop happens. Ruling eureka-body:ruling:self-run-actuator says: "Holding the brake stops running units (systemctl stop; SIGTERM exits 143 with the turn unfinished, section 1.4)". It cites the OpenClaw inbox incident: a stop sent as a message was not acted on in time, and the process was killed at the host (prior-art file lines 323-325, secondary). Cut mind-wake r2 has the waker return Held before any query, admission or unit call, and lists "the waker ... ending a live run" among its forbidden writers.

The model page (step 0b)

One row per persistent kind this body introduces or changes. Rows for the thirteen pipeline kinds are in Huginn docs/eureka-substrate-map.md.

Kind	Identity (what names it)	Lifecycle (what happens over time)	Authority (who decides)
Pipeline wire ids	epiphany.pipeline.<kind>.v2, epoch epiphany.pipeline.epoch.v2, defined by the leaf, the Huginn crate crates/eureka-pipeline (lib eureka_pipeline), ids unchanged.	Renamed once to eureka.pipeline.<kind>.v3 by one mind.redb migration, at the next breaking leaf change or before the first hosted mind (ruling wire-names-rename-before-hosting). Adding the run kind or the Mind authority variant is additive (old stored documents decode; no migration), so it does not trigger the rename; a field added with the leaf's = absent marker is additive too (leaf-read-anchors r2: old bytes decode, empty fields encode byte-identically, golden/envelopes.txt gains lines and loses none); a field added any other way would.	Huginn owns the leaf. The migration is a live-mind upgrade, which is the operator's (mind-rules-which-forks).
Leaf crate and schema catalogue	Huginn crates/eureka-pipeline, schemas/cultnet/ (13 pipeline schemas, gamecult.persona_state.v0, index, README). epiphany.work_organ_state.v0 dies: no reader outside Epiphany (grep, F1/F3).	Landed at Huginn afc35f9 (leaf-into-huginn). Wire pinned by crates/eureka-pipeline/golden/envelopes.txt and the opt-in stored_documents_read_back. Huginn is AGPL-3.0-only (ruling eureka-body:ruling:leaf-relicensed-agpl).	Huginn. Forbidden: any Cargo source resolving into GameCult/Epiphany (nothing-runs-from-epiphany).
run	<instance>:run:<label> (cut-run-kind r2). Label mind-<YYYYMMDD>T<HHMMSS><mmm>Z from mind-launch's run_label; two launches in one millisecond produce the same key with different content, which admission answers Conflict, so the name stays injective. Order is admission ordinal (F15), not label.	Each wake opens a PersonaTurn run with no claims (ruling eureka-substrate:ruling:every-wake-a-run); the Persona tool opens SelfRun runs with claims; both go through open_and_launch, and the unit starts only after the run commits (the run is the grant). The Self in a unit admits under its label and ends it Recorded { reason }. The waker withdraws a run whose unit is not alive past a 120 s grace (replaces the 24 h rule). Cadence comes from the newest PersonaTurn run's admitted_at, found through the turn and operated_by aliases, not started_on (a date cannot carry seconds).	Opening: open_and_launch, called by the waker for PersonaTurn and by the Persona tool for SelfRun. Ending: the Self that worked it; the waker only withdraws dead ones. Concurrency of live runs: at most one in-force SelfRun of hers per instance; open_and_launch answers Busy to a second (ruling one-live-self-run, cut mind-launch r2). A unit stopped by a brake hold leaves its run in force until the waker's first sweep after release. Forbidden: Hands, Soul, Imagination, Life.
Repetition breaker	No state of its own (rulings self-waker, merge-gate-own-soul). Trip condition derived from the item's ended SelfRun runs: last 3 empty, or 10 of the last 50. A run is empty when no non-run document citing the item has an ordinal in its window (its admission up to the next run's, or now).	Evaluated in open_and_launch when a Self run claims the item, not by the waker. When tripped, it admits one question labelled breaker-<item local> under the item's campaign, raised_in the item, and launches nothing; the existing blocked-spec recipe then removes the item from the queue. Answered by a ruling or withdrawn; either reopens the item.	open_and_launch admits the question; any Self may answer it (substrate-internal, mind-rules-which-forks).
Brake	One document per instance in a root-owned CultCache store /etc/gamecult/minds/<instance>/control.cc, type eureka.control.brake.v1 { released: bool, set_at, set_by }.	Replaced whole by the operator's CLI; never appended. Absent or undecodable reads as held. mind-control brake hold writes it held and then, in the same command, stops her running units: systemctl stop (blocking) over mind-self@<i>:* and mind-persona@<i>:*, through SystemdLauncher::stop_all (cut brake-stop; ruling self-run-actuator; F18-F20).	Operator only (ruling brake-dial-root-store-now); her units read it, and the file is not writable by any user she runs as. The hold is the one stopper of her units.
Burn-rate dial	Same store, eureka.control.burn_rate.v1 { heat, base_cooldown_s, base_run_usd, set_at, set_by }; heat in 0.05..=2.0.	Replaced whole by the CLI. Absent or out of bounds reads as heat 0, which launches nothing (fail closed, LiteLLM scar rider of ruling connector-owner). Schedules and her own rest arrive later as follow-up burn-schedule-and-rest.	Operator. Derived (never stored): wake cadence base_cooldown_s / heat, per-run cap --max-budget-usd = base_run_usd × heat, per-request max_cost_usd.
Connector request and transcript items	Request: (caller_runtime_id, request_id), the replay key the daemon already keeps (replay.cc). Items: UserText, AssistantText, ToolCall, ToolResult, plus ReasoningState { provider, model, opaque } (ruling connector-opaque-state-item). Contract ids become provider-neutral gamecult.model.*.v3 (follow-up connector-contract-untyped); the connector serves Ghostlight too, so not eureka.*.	Invocation expires at expires_at_unix_ms; replay record per key; restart-era Indeterminate. The caller stores the transcript and replays it verbatim; foreign-tagged reasoning state inside an in-flight tool exchange is refused typed; completed-turn foreign state is settled per provider in the connector cut (follow-up connector-reasoning-state-cheap-providers).	The connector produces, reads or refuses reasoning bytes; callers never branch on provider.
Connector spend ledger	gamecult.model.caller_spend.v1 keyed by caller runtime id and window start, in each daemon's state root.	Rolled per window; refusal Budget at the cap; durable, and a missing ledger refuses the request.	Each daemon writes its own; the root caller config sets the cap.
Persona turn traces	Empty: question persona-trace-retention. Candidate: per turn, the request digest, the transcript items and the typed output, keyed by the turn's run.	Empty: how long they are kept, whether Discord-sourced content may enter a training export (F14).	Empty: who may export them.
Persona state	gamecult.persona_state.v0, one per mind, personaId = instance (cut-huginn-persona-state r2, eureka-substrate).	Replaced whole under CAS with a receipt; she may rewrite any field (identity-write-all-visible).	The Persona organ is the only writer.
Identity diffs	The pair of receipts of two consecutive Persona puts whose identity fields (publicName, publicDescription, presentation, values) differ. Derived, not stored.	Composed by the Persona organ at put time and sent as one delivery request through the crossing; a failed post is retried by Bifrost's delivery journal, not by her.	Persona organ composes; Bifrost posts under the permit. No rate limit.
Discord body surfaces	Outbound: crossing ids epiphany.persona_discord_delivery_request.v0 and ..._permit.v0, agent epiphany.Persona, runtime epiphany-starfire (F6), renamed to eureka.* and eureka-yggdrasil in the mouth rebinding (mouth-crossing-on-yggdrasil). Inbound: Bifrost persona-feedback deliveries for target epiphany (F6). Persona-session tools reach both (body-includes-discord).	Request, permit, post, receipt (Bifrost journal). Inbound deliveries: unprobed who records that a delivery was answered; run-is-the-grant forbids her organ from holding that fact. Blocks the Persona cuts only, not the cuts admitted today.	Bifrost owns posting and delivery records; her permit issuer grants while the brake is released.
Units and instance templates	mind-wake@<instance>.timer/.service, mind-self@<instance>:<label>.service, mind-persona@<instance>:<label>.service (one-shot per Persona turn; RuntimeMaxSec set at install bounds a hung unit), mind-permit@<instance>; users mind-<instance> (organs) and mind-<instance>-self (Self runs); state /var/lib/gamecult/minds/<instance>/; control /etc/gamecult/minds/<instance>/. Instance eureka.	Hand-installed by gamecult-ops now; Idunn targets declared before the first hosted member, which deletes the hand install (mind-units-templated-interim).	gamecult-ops installs; Idunn later. Starting: open_and_launch through SystemdLauncher::start, as her users, who are granted start only. Stopping: only the operator's brake hold, as root (cut brake-stop). The unit-level brake gate and the start-only grant are follow-up mind-units-brake-gate. None of this exists on Yggdrasil yet (F19).
Self-run credential	CLAUDE_CODE_OAUTH_TOKEN in a root-0600 EnvironmentFile per instance.	Created by claude setup-token; rotated by the operator.	Open: question self-run-token-reach. The Self run's claude process can read its own environment, so token-out-of-her-reach holds only if the operator names this unit (F4 of the prior-art file, follow-up token-reach-two-units).
Wake frame	Fixed prompt frame (provenance, jurisdiction, brake obedience) in /etc/gamecult/minds/<instance>/wake-frame.md, root-owned. Composed by the Persona organ from host config; the waker passes the unit only the instance and the run label.	Changed only by an install.	Host config (ruling self-waker rider 2); never a file her runs merge into.
Epiphany residue	F5, F8, F11, as they stood before the teardown.	Teardown landed (gamecult-ops 9c12adb); what it did not name is follow-up eureka-body:follow_up:epiphany-body-leftovers; the repo is archived last.	gamecult-ops for host and repo tooling; Idunn for its legacy target list (follow-up).

Rationale

Why the order is leaf, teardown, control, wake

The four specs admitted today depend on nothing the operator has to rule except the wake target. leaf-into-huginn removed the only build edge into Epiphany and is the base every Huginn-side body cut needs (the run kind re-pointed, Persona state, the v3 rename); it landed at afc35f9. The teardown removed the 24.7 GB (F5) and the tooling that would otherwise be re-read by every later pass; it landed at gamecult-ops 9c12adb. The control store comes before the waker because the waker's first rule is "read the brake before any consequence". The waker raises wake-target, because the operator's 2026-10-03 ruling (body-includes-discord, "the Persona session, which is also what drives the Self") and the Defaulted self-waker ("starts at most one Self run") read differently.

One crate for her organs

Her organs live in Huginn's workspace (organ-homes-huginn). They share the control reader, the client and the instance templating, and they deploy together. So they are one crate, mind-body, with one binary per earned process (mind-control for the root CLI, mind-wake; the Persona organ and permit issuer later), not a crate per organ. The crate name is instance-generic because the units are templates.

Who stops her units when the brake is held

Ruling self-run-actuator says holding the brake stops her running units. Three cuts each held part of that and none held all of it (finding cut-mind-control-store.s1.brake-hold-stops-no-units). The control-store CLI writes the brake. mind-launch owns the unit actuator, which had start and alive. mind-wake reads the brake. The stop now has one owner: the operator's mind-control brake hold. It writes the brake held and then, in the same command, runs SystemdLauncher::stop_all, a blocking systemctl stop over the instance's mind-self@ and mind-persona@ units (cut brake-stop).

• Synchronous, not on the waker's next tick. The ruling's own precedent is a stop that had to happen at the host. A stop sent as a message was not acted on in time (F20). The waker's next tick comes one timer interval later, and mind-wake r2 already keeps the waker away from units while the brake is held. Prior art agrees. systemctl stop waits for its job unless --no-block (F19). kubectl drain cordons the node and then evicts its pods. supervisorctl stop waits through stopwaitsecs and then kills. In each, the operator's command does the stop; no reconciler's next pass does.
• Write first, then stop, and stop even if the write failed. This is cordon before drain. A unit that starts after the write must already see the brake held. Stopping is always the safe direction, so a failed write does not skip it.
• Privilege. The hold runs as root because the store is root-owned, and root needs no polkit rule to stop a system unit. Her users get start only (follow-up mind-units-brake-gate), so no organ of hers can stop or restart around the operator.
• Stop is not on the Launcher port. stop_all is a method on SystemdLauncher itself, called only from main.rs. Code that holds a Launcher, such as open_and_launch or the waker, cannot reach it. The stop patterns come from the same templates as start, so the units stopped are exactly the ones started.
• Not a mind client. A Self run killed by a hold cannot record its own end. Its run stays in force until the waker's sweep after release withdraws it, so the operator's CLI never talks to the mind.
• One race the CLI cannot close. A launch can read Released, then the hold writes and stops, then the launch starts its unit. The unit's own ExecCondition= on the brake closes that, so the gate belongs with the units install (follow-up mind-units-brake-gate), not in a second stopper.
• Idunn. Her Self and Persona units are one-shot jobs. Idunn's continuity restarts installed daemons, so stopping one of these jobs is not a continuity decision. When Idunn targets replace the hand install, Idunn must not restart a unit the hold stopped.

Why the kit keeps its Codex backend

Idunn's migration doc says Codex is dead (F9). The kit is lifted out of CodexConnector, and the Codex backend's existing tests are the only proof that the lift is behaviour neutral. Keeping the backend compiling costs nothing; deploying it is not proposed.

Undone (not mapped this pass)

In dependency order, with what blocks each:

1. eureka-substrate re-points, admitted 2026-10-09 against Huginn: mind-authority r2 (landed on branch eureka-substrate/mind-authority, Soul pending), run-kind r2 (absorbs huginn-mind-self-kinds: AlreadyClaimed, the run's resolution row, the claims edge; question persona-turn-run is ruled by every-wake-a-run), huginn-persona-state r3, doctrine-persona-in-huginn r3. leaf-key-bound landed at Epiphany ef956865 and came in with the leaf (F16). leaf-read-anchors r2 (absorbs huginn-read-anchors, withdrawn), ops-read-anchors-upgrade r2 and context-pack-reads r2 were admitted 2026-10-09; leaf-read-anchors depends on mind-authority merging.
2. connector-kit-lift, connector-spend, connector-reasoning-item, connector-contract-v3, claude-connector, openai-compatible-connector: blocked on the kit repo joining the campaign (follow-up body-campaign-repos).
3. self-run-unit and skill-mind-self (Eureka): blocked on self-run-token-reach and wake-target. mind-launch r2 (Huginn df7507b, unblocked: the one-live-self-run ruling answered its question), then brake-stop r1 and mind-wake r2, which both depend on it.
4. mind-units-install (gamecult-ops): after 3; needs body-repos-on-forge.
5. mind-persona and mouth-rebinding (Huginn, Bifrost): blocked on wake-target, persona-trace-retention, the inbound-delivery cell, and the connector cuts.
6. doctrine-repoint (Eureka, F12), epiphany-archive (last).

Admitted this pass (receipts in the mind)

Specs, in dependency order: eureka-body:cut_spec:cut-leaf-into-huginn.r1, cut-epiphany-body-teardown.r1 (independent), cut-mind-control-store.r1, cut-mind-wake.r1 (superseded by r2 on 2026-10-09). Questions: eureka-body:question:wake-target, self-run-token-reach, persona-trace-retention. Follow-ups: eureka-body:follow_up:substrate-specs-repoint, body-campaign-repos. H9 sources exist at Epiphany ef956865: notes/huginn-organ-cut.md, eureka-body-plane-cut.md, eureka-pipeline-state-cut.md, eureka-pipeline-state-target.md, eureka-query-prior-art.md, eureka-read-side-cut.md, postmortem-eureka-schema-phase.md. Huginn carries an AGPL-3.0 LICENSE and the workspace license is AGPL-3.0-only (rulings license-split, eureka-body:ruling:leaf-relicensed-agpl).