task 77: bind Lens proof to r21

docs/tasks/77-lens-garden.md

@@ -1,7 +1,7 @@
 # 77 — The lens: a human-first garden over a git vault
 
-Status: **r18 packaged and installed on x86_64; source HEAD is r19; AArch64 is
-declared but not yet proven.** Last checked 2026-08-24.
+Status: **r21 is signed, archived and installed on x86_64; the same source is
+packaged for AArch64 but not device-exercised.** Last checked 2026-08-25.
 Owner: Rook, under Casey's direction. Repo: `~/Projects/souveraine-lens`
 (gitea `Fimeg/souveraine-lens`, branch `primary`).
 
@@ -50,16 +50,18 @@ analyzed by my agent for connections."*
       paths + edge publisher.
 - [x] Folder/subcategory support + inbox capture (commit `61cf534`).
 - [x] Edge publisher executable (commit `c71c7e4`) — fixes run 1632's exit 126.
-- [x] r18 (`0.1.r18.g1eb2840df769-1`) is signed in the internal
+- [x] r21 (`0.1.r21.gf01a2fcb2b1e-1`) is signed in the internal
       `souveraine-x86_64` archive and installed as a pacman-owned x86_64 binary
-      on the laptop.
+      on the laptop; `pacman -Qkk` reports 17 files and 0 altered files.
 - [x] Internal edge repo DB wiring exposes `souveraine-lens` by name.
-- [ ] Package r19 (`216faea`) from current `primary`; the installed and indexed
-      package remains r18.
-- [ ] Prove the AArch64 job builds and publishes an AArch64 package. A workflow
-      and sysroot path are source state, not an install or runtime result.
-- [ ] Exercise r19 from its package on the laptop; verify folder tree, capture →
-      inbox, linking, named agents, amend step-up, and link-preserving moves.
+- [x] The distribution manifest owns `souveraine-lens` for x86_64 and AArch64,
+      and both producer jobs refuse artifacts outside that contract.
+- [x] CI run 2180 built, signed and published x86_64 and AArch64 r21 packages;
+      AArch64 remains package proof, not installation or runtime proof.
+- [x] The exact r21 SHA passed the public-candidate source gates in run 2195.
+- [ ] Exercise r21 from a newly started packaged process on the laptop; verify
+      folder tree, capture → inbox, linking, named agents, amend step-up, and
+      link-preserving moves.
 
 ## Evidence
 
@@ -69,27 +71,29 @@ analyzed by my agent for connections."*
   `68-shared-household-state.md`, `FIRST-CLASS-APPS.md`,
   `SHARED-STATE-ARCHITECTURE.md`; kiyoshi (`~/Projects/references/kiyoshi/`)
   is the visual reference — sampled, not copied.
-- CI run 1632 failed only at the publish step (exit 126, non-executable
-  publisher); build, makepkg and sign all passed before it.
-- On 2026-08-24, `pacman -Q` and `pacman -Qo /usr/bin/souveraine-lens` both
-  reported `souveraine-lens 0.1.r18.g1eb2840df769-1`; `file` identified the
-  owned binary as x86-64. `pacman -Si` found the same signed package in
-  `souveraine-x86_64`.
-- The component repo's `primary` branch is at its nineteenth commit,
-  `216faea`; that newer source is not the installed package above.
+- Gitea Actions run 2180 is green on `primary` at `f01a2fcb2b1e`; its edge
+  release contains r21 packages and detached archive signatures for both
+  architectures. Run 2195 is green on the exact `public` candidate SHA.
+- On 2026-08-25, the package signature verified against the Souveraine archive
+  key. `pacman -Q` reported `souveraine-lens 0.1.r21.gf01a2fcb2b1e-1`, and
+  `pacman -Qkk` reported 17 files with 0 altered files.
+- Lens processes already running during the upgrade were deliberately left
+  alone. They retain their old in-memory image until Casey reopens them; the
+  r21 package is installed, not yet newly launched and exercised.
+- The internal public candidate exists and is green. No anonymous Lens Forge
+  repository exists yet; publication remains owned by the central rail.
 
 ## Remaining work
 
-1. Land the Lens producer/package declarations and pre-publish manifest gates,
-   then run CI on `primary` for r19.
-2. Confirm x86_64 and AArch64 artifacts and signatures independently. Do not
-   infer AArch64 install or runtime behavior from the cross-build path.
-3. Upgrade the laptop by package and exercise the r19 UI and limb.
-4. Project `souveraine-lens` to the public Forge before changing Cargo or
-   PKGBUILD source URLs to a public repository.
-5. The shared-task lane when TASK-68's authority shape lands (the agent assigns
+1. Reopen the packaged r21 process and exercise its UI and limb on the laptop.
+2. Do not infer AArch64 install or runtime behavior from the green cross-package
+   path; exercise it on a declared AArch64 target when that deployment is wanted.
+3. Project `souveraine-lens` to the public Forge through the central
+   publication rail before changing Cargo or PKGBUILD source URLs to a public
+   repository.
+4. The shared-task lane when TASK-68's authority shape lands (the agent assigns
    human tasks through the vault; the lens surfaces them as notes).
-6. The "agent analyzes dumped ideas for connections" lane — substrate-side,
+5. The "agent analyzes dumped ideas for connections" lane — substrate-side,
    over the limb; not built.
 
 ## Connections