Document daemon memory ownership

notes/fresh-workspace-handoff.md

@@ -210,6 +210,9 @@ Git history and smoke artifacts carry routine proof. `state/evidence.jsonl` shou
 - The swarm brake currently reads `state/agent-swarm-paused.json` with `"paused": true` on Yggdrasil because the one-minute observation pulse exposed a clock-only ready backlog that could dispatch one Persona model turn per minute. Keep it paused until the initiative-engine eligibility cut is deployed and verified: elapsed wall-clock may advance recovery bookkeeping but cannot authorize a turn without a pending mention or fresh semantic pressure at or above the participant's interrupt threshold. The pulse is observation latency, not speech intent.
 - Native Persona state now has an honest typed split. Standard `gamecult.persona_state.v0` lives as its own global CultCache document; it is not squeezed into Void's narrower `void.*` aggregate. `npm run persona:migrate-portable` dry-runs by default and requires `--write`; canonical migration refuses non-canonical provenance and occupied targets, while `--projection-import` preserves projection/import payloads in the separate `voidbot.persona_state_projection_import` quarantine document without elevating them. Tengu's canonical JSON contained legacy `affect.stressResponses` outside the standard schema, so migration preserves each complete record under `anchoredThought.extensions.legacyStressResponse` while promoting its actionable meaning into a standard memory. All five local native Persona registry paths now end in `.cc`: Tengu is canonical standard state; Muninn, Sleipnir, and Hermodr are typed non-canonical imports; Metame remains typed Void state. The runtime JSON Persona source and extension-based compatibility branch are deleted. Original JSON files are import evidence only.
 - Yggdrasil matches that state as of deployed revision `13bdb7a`: all five native Persona registry paths are `.cc`, migrated files are owned by `voidbot:voidbot`, the full initiative and portable-migration smokes pass in the deployed scheduler container, and prompt assembly succeeds for Muninn, Sleipnir, Hermodr, Tengu, and メタめ with the correct authority language. Idunn's upstream comparison/deployment path is healthy and evaluates VoidBot on its bounded cadence. The swarm remains paused after these checks; do not interpret migration success as permission to resume autonomous traffic.
+- The resident daemon now owns Void physiology in-process. Every five minutes it derives sleep and speaking pressure from typed state plus moderation activity, applies only `update_sleep_cycle` and `update_speaking_pressure`, and may emit a typed sleep-maintenance intent. It does not launch PowerShell or a model. The Windows omnibus no longer contains the mood writer.
+- Revision `21d12a3` adds the portable memory-maintenance organ behind that intent. It commits `void-memory-maintenance-attempt:<napStartedAt>` before its single bounded text-model call, validates the complete proposed operation batch, applies only the allowed memory/incubation/agency/candidate family, requires zero remaining short-term memory, and records `void-memory-maintenance:<napStartedAt>` only on success. Failure is visible and cannot retry until a different nap. Idunn/Ygg live promotion and receipt verification are the immediate deployment check.
+- The one-minute Persona scheduler pulse is an observation clock, not an inference cadence. With the swarm brake present it returns before registry, Discord, embedding, storage, or dispatch work; current Ygg logs show `selected: []` and `queued: []`. Unprompted speech also has a separate global admission window. Do not cool token use by making observation blind; keep turn authorization at the initiative owner.
 - Deterministic state-packet assembly now lives in `persona-state-packet-projector.ts`, which takes typed state, registry/room evidence, pronoun guidance, curiosity facts, and an explicit observation time. The shell no longer owns section ordering or social-context composition. The downstream regex vocabulary cleaner was deleted: it was a symptom compensator rewriting ordinary words such as `witness` and `canary` after projection. A smoke proves literal source language survives the projector unchanged.
 - Optional model-backed state projection now crosses `persona-text-projection-actuator.ts`. That actuator alone owns Codex args/process lifetime, ordered fallback models, timeout, output decoding, retry classification, and model-output JSONL telemetry. Focused smoke proves it chooses the last visible agent message, retries capacity/429 failures, and refuses to classify prompt-contract failures as model availability problems. The heartbeat shell lost another 182 lines and now only supplies the completed projection prompt plus runtime config.
 - Final Persona turn composition now crosses `persona-turn-assembler.ts` for both queued turns and `--assemble-prompt` inspection. It owns conversation projection, jurisdiction-dive cadence, final prompt composition, and the deduplicated eight-image evidence budget. The shell acquires facts and the turn actuator queues the assembled result; neither may maintain a parallel opinion about the final prompt or evidence bundle.

notes/voidbot-current-system-map.md

@@ -323,25 +323,24 @@ Within the Postgres path, the implementation is split on purpose now too:
 11. It intentionally does not materialize `.json`, load `.msgpack`, read the legacy moderation monolith, or let the child edit state directly.
 12. Before applying model output, the runner enforces speech-pressure accountability. Active self/world advocacy pressures at 0.55 intensity or higher with no matching live queued candidate are projected as `speechPressureObligations`; model output must queue a candidate or cool/retire the pressure instead of returning silent `[]`. Deferred candidates do not satisfy that pressure by themselves, and an older spoken candidate does not keep satisfying a still-active pressure forever.
 
-## Flow 6: Mood And Sleep Runtime
+## Flow 6: Physiology Runtime
 
-1. The Windows scheduled task `GameCult Local Orchestrator` is enabled, and it invokes the Void mood drift organ when that organ is due.
-2. `scripts/simulate-void-mood.mjs` reads typed documents from `.voidbot/private/void-self-state.cc`.
-3. It updates `void.scheduled_runtime.sleepCycle` and `void.scheduled_runtime.speakingPressure` through `update_sleep_cycle` and `update_speaking_pressure` operations, with active advocacy pressure weighted strongly enough to raise speaking pressure earlier instead of staying a private sulk until the seam is already overripe.
-4. It writes `.voidbot/status/void-mood-drift.json`.
-5. When sleep is active, the script invokes `scripts/run-void-memory-maintenance.ps1` once per nap to force typed distillation/pruning.
-6. The old memory-organ script family, legacy state template, and legacy context exporter have been deleted.
+1. The resident `apps/persona-scheduler` daemon invokes `void-physiology-organ.ts` on its own five-minute cadence, independent of whether Persona initiative is paused.
+2. The organ reads typed documents from `.voidbot/private/void-self-state.cc`, derives the most recent speech time from typed receipts, and observes the moderation lock through narrow injected ports.
+3. It updates only `void.scheduled_runtime.sleepCycle` and `void.scheduled_runtime.speakingPressure` through `update_sleep_cycle` and `update_speaking_pressure` operations. Active moderation freezes sleep transitions but does not prevent pressure observation.
+4. When a nap has short-term residue, physiology emits a typed memory-maintenance intent. It does not perform memory policy, launch PowerShell, or call a model.
+5. The Windows omnibus mood writer has been removed. Legacy mood scripts may remain as fixtures or manual compatibility bodies, but they are not a deployed recurrence or runtime owner.
 
 ## Flow 7: Typed Memory Maintenance
 
-1. `scripts/run-void-memory-maintenance.ps1` is invoked by mood drift during sleep, and can also be run manually for fixtures.
-2. It reads `.voidbot/private/void-self-state.cc` through the typed self-state service.
-3. It writes `.voidbot/status/void-memory-maintenance-context.json` with prompt-facing relative chronology and only typed memory/incubation/agency/candidate surfaces.
-4. It loads `prompts/void-memory-maintenance.md` and asks Codex for operation proposals unless `-SkipModel` is set.
-5. The parent runner rejects any operation outside memory lifecycle, incubation, agency pressure, or candidate-intervention maintenance.
-6. The parent runner applies allowed operations through `scripts/void-self-state.mjs`.
-7. In sleep mode, the context carries `sleepDirective.forceDistillation` when there is short-term memory pressure. A real model pass that returns no operations under pressure fails visibly, and any real sleep pass that leaves short-term memory behind fails instead of letting yesterday's residue haunt the state. The fixture smoke exercises this path with a fake Codex child so the parent validation and application machinery are tested without relying on live inference.
-8. This is the replacement path for sleep/distillation and agency work: model-owned proposals crossing the typed operation boundary, not deterministic repair code editing state.
+1. `void-memory-maintenance-organ.ts` consumes a typed physiology intent containing the nap start and short-term pressure count.
+2. It checks typed scheduled-run receipts, then records `void-memory-maintenance-attempt:<napStartedAt>` before inference. This makes one attempt per nap structurally enforceable even when inference fails or returns malformed output.
+3. `void-memory-maintenance-projector.ts` builds bounded prompt context with relative chronology, one explicit operation timestamp, and only typed memory/incubation/agency/candidate surfaces.
+4. `void-memory-text-actuator.ts` performs one tool-free OpenAI-compatible text request with a bounded completion budget and returns model text only.
+5. The organ parses the entire response as a JSON operation array, validates every item against the canonical self-state operation schema, and rejects operations outside the explicit maintenance family before applying any item.
+6. It applies allowed operations through the typed self-state service, reloads state, and fails visibly unless all short-term residue is gone.
+7. Only a fully successful transaction records `void-memory-maintenance:<napStartedAt>`. A later physiology pulse for the same nap returns an already-attempted or already-completed result without inference.
+8. The PowerShell runner remains fixture/manual compatibility material only; it is not the daemon runtime owner.
 
 ### Memory Lifecycle
 

notes/voidbot-daemon-organ-migration-map.md

@@ -41,7 +41,7 @@ The disabled tasks are not standby owners. The listed organs currently have no r
 ## Cut Sequence
 
 1. Portable Void physiology is live in the daemon with injected typed state/moderation ports and maintenance intent; the Windows omnibus mood writer is deleted.
-2. Extract memory-maintenance context, model actuator, validation, and typed-operation application from `run-void-memory-maintenance.ps1`; let physiology emit maintenance intent to that organ.
+2. Portable memory maintenance is daemon-owned: physiology emits a typed nap intent; the memory organ owns bounded context projection, one text-model attempt per nap, whole-batch operation validation, typed application, and residue verification. The attempt receipt is committed before inference, so failure cannot become a periodic retry furnace.
 3. Split `run-void-moderator-rumination.ps1` into shared Discord/context sources plus separate moderation-heartbeat and person-shaped rumination coordinators.
 4. Add serialized daemon cadence for those three Void-owned organs, with independent due state, timeout, and telemetry. Do not route them through Persona initiative.
 5. Give Bifrost dispatch to a Bifrost-owned resident worker.

state/evidence.jsonl

@@ -443,3 +443,4 @@
 {"ts":"2026-07-16T06:05:00Z","type":"architecture","status":"ok","note":"Live pulse audit found GameCult Local Orchestrator plus Void mood, moderation rumination, operations watchdog, and Bifrost dispatch tasks all disabled on Starfire; Yggdrasil had no corresponding workers beyond Persona scheduler and Bifrost web. Authority map assigns moderation/rumination/physiology/memory to VoidBot daemon, Bifrost dispatch to Bifrost daemon, and health/restart supervision to Idunn/ops. The Windows omnibus must not be revived."}
 {"ts":"2026-07-16T06:20:00Z","type":"implementation","status":"ok","note":"Void physiology extracted into a pure domain and typed daemon organ. It derives speech timing from canonical receipts, emits only update_sleep_cycle/update_speaking_pressure operations, freezes sleep while moderation is active, and returns memory-maintenance intent without launching PowerShell or owning memory policy. Resident daemon schedules it independently of the paused Persona swarm; typecheck and focused smoke pass."}
 {"ts":"2026-07-16T06:30:00Z","type":"verification","status":"ok","note":"Idunn deployed 15a7c58. Live physiology entered a due nap, wrote typed sleep/speaking pressure, and emitted one sleep_short_term_pressure intent while Persona scheduling remained paused. Four later one-minute observations did not rerun the five-minute organ; docker top showed only resident Node and no PowerShell/model child. The competing void-mood-drift definition was then deleted from the Windows omnibus."}
+{"ts":"2026-07-16T03:51:18Z","type":"implementation","status":"ok","note":"Portable Void memory maintenance is daemon-owned at 21d12a3: physiology emits typed nap intent; the organ pre-records one attempt per nap, bounds tool-free text inference, validates the full typed operation batch, requires zero short-term residue, and never automatically retries."}

state/map.yaml

@@ -14,19 +14,14 @@ objective:
     Aetheria lore, while keeping the system understandable enough to modify
     safely.
   current: >
-    Keep the paused MiMo repo Face swarm cold while scheduler eligibility is
-    repaired. The observation pulse must never authorize a model turn by itself;
-    only explicit attention or fresh semantic pressure may create turn intent.
-    Continue verifying the new canonical
-    Bifrost/CultMesh speech route proves itself in ordinary turns. MiMo can run
-    Face/persona heartbeat jobs and produce usable `SAY` blocks, ambiguous
-    multi-context `SAY` output is retried or dropped instead of completed
-    invisibly, and Discord delivery now targets a CultMesh URI instead of the
-    old Bifrost HTTP/token shortcut. Bifrost advertises `discord.post` command
-    metadata through its provider surface, VoidBot writes typed command
-    documents, Bifrost writes typed receipts, and a bounded Weksa live-fire post
-    verified visible Discord delivery. If this route regresses, pause with the
-    swarm brake and fix the typed command path rather than restoring shortcuts.
+    Keep the Persona swarm paused while the daemon organ migration continues.
+    The one-minute resident pulse is observation latency and must not authorize
+    inference by itself. Portable physiology now owns sleep and speaking
+    pressure, and portable memory maintenance consumes its typed nap intent with
+    one pre-receipted model attempt per nap and no automatic retry. Verify that
+    organ through Idunn's upstream deployment path, then split the legacy
+    moderation PowerShell body into shared evidence sources plus separate
+    daemon-owned moderation-heartbeat and person-shaped rumination coordinators.
 
 constraints:
   - VoidBot's deployed runtime lives on Yggdrasil and deployment is owned by Idunn from upstream pushes; local workspaces are not deployment targets.
@@ -80,6 +75,8 @@ active_subgoals:
   - `inspection-participant-factory.ts` owns the inert synthetic initiative participant used only by `--assemble-prompt`. It explicitly carries zero dynamic heat/response pressure and empty evidence/receipt state, reads no live scheduler state, and cannot queue work.
   - `persona-scheduler-runner.ts` owns one complete typed observation/selection/dispatch tick in-process. Resident `index.ts` serializes direct runner calls and no longer spawns a TypeScript child per minute. Pause and disabled controls return before registry, Discord, embedding, provider, or dispatch work. `persona-participant-dispatcher.ts` owns participant-spec projection and live repo-Persona/Void dispatch; `persona-prompt-inspection.ts` owns explicit inspection; `scripts/run-repo-face-heartbeats.ts` is CLI only.
   - `bifrost-governance-source.ts` owns the remaining Bifrost digest CLI adapter and converts command or parse failures into typed error topics. Persona prompt composition receives governance facts without knowing Bifrost process mechanics; `scripts/run-repo-face-heartbeats.ts` may not invoke the Bifrost CLI directly.
+  - `void-physiology-organ.ts` is the daemon-owned policy boundary for Void sleep and speaking pressure. It reads typed state and moderation activity through injected ports, writes only typed runtime operations, and emits a memory-maintenance intent without performing memory policy or inference.
+  - `void-memory-maintenance-organ.ts` consumes that intent and owns one bounded maintenance transaction per nap: it records an attempt receipt before inference, projects bounded typed context, accepts only the explicit memory/incubation/agency/candidate operation family, validates the whole batch before application, requires short-term residue to reach zero, and then records success. A failed or malformed pass cannot retry during the same nap. `void-memory-text-actuator.ts` is the narrow OpenAI-compatible text port; it receives one complete prompt, exposes no tools, and caps completion output.
   - `initiative-engine.ts` is the only writer of scheduler state fields and history. Reconciliation, controls, pause/disabled skips, stale-turn recovery witnesses, semantic pressure, attention consumption, queue transitions, and tick finalization all cross named engine commit primitives. Queue/context actuators return results and cannot patch participants or history directly.
   - `turn-actuator.ts` owns lowering an assembled Persona prompt and evidence bundle into the canonical worker `ContextBundle` and approved `repo-face-rumination` job. It owns the worker actor, command, request ID, approval defaults, and `createJob` call, then returns only a queue receipt. The orchestration shell chooses no queue mechanics and the actuator cannot read Persona or initiative state.
   - `turn-routing.ts` owns deterministic Persona channel policy: newest pending-attention preference, default/threshold fallback, snapshot neighborhoods, low-threshold topic projection, and bounded channel-speed projection. Prompt renderers consume a `PersonaChannelPlan`; they do not recompute routing or scheduler speed.