commit - 5ba13c5d7937caa643a04594bd9be7ec3f26a4bc
commit + 8e964caf96f4c4f928cb51a7f4fd99288ec87914
blob - ace7588809cd7bf4b32fd77282e8d3b2f1936db2
blob + a4dfebc2d9945b992c6729ecd5a55fe48957ae9b
--- CONTEXT.md
+++ CONTEXT.md
@@ -47,6 +47,17 @@ _Avoid_: model turn, provider turn
 The conversation state as shaped for and sent to a provider's API.
 _Avoid_: history, context (alone)
 
+**System baseline**:
+The exact privileged instruction bytes that precede a Lead's Projection for
+one reset-bounded lifetime.
+_Avoid_: system prompt (when the composed whole is meant), context
+
+**System epoch**:
+One immutable, Journaled reset boundary containing the exact System baseline
+variants and admitted source snapshots from which Lead and Subagent requests
+are selected.
+_Avoid_: context epoch, chronological System message
+
 **Pending Projection**:
 The messages accepted during an active Lead Turn but not yet made durable;
 later Generations in that Turn see them, while abandonment discards them all.
@@ -61,6 +72,11 @@ _Avoid_: previous messages, cache index
 Replacing the active context with a model-written summary (`/compact`).
 _Avoid_: summarization (alone)
 
+**Retained Projection**:
+The provider-valid recent suffix that remains canonical when Compaction
+replaces an older Projection prefix.
+_Avoid_: history tail, retained context
+
 **Steer**:
 A queued user message delivered mid-turn alongside the next
 tool-result batch, journaled inside its turn.
blob - /dev/null
blob + 7ddc31488bf00265d19486e8af61d54c51f615e9 (mode 644)
--- /dev/null
+++ docs/adr/0008-immutable-system-epochs.md
@@ -0,0 +1,36 @@
+# Persist immutable System epochs at reset boundaries
+
+Status: accepted, 2026-07-17
+
+Fugu Journals admitted Project context and Compaction notes but historically
+rebuilt their privileged base with the current configuration and binary on
+resume. We will instead persist one complete, versioned System epoch at fresh
+Session, `/clear`, successful Compaction, and legacy migration boundaries.
+Each epoch stores exact full and no-external-context System baseline variants;
+current `project_context` policy selects a stored variant without deleting the
+other, while current Provider, Tool, credential, and authority configuration
+remains live.
+
+The epoch and its Projection reset form one atomic Journal unit. Automatic
+Compaction may carry an exact Retained Projection in that same unit; when a
+Turn is active, the unit remains provisional and replay applies it only with
+the matching successful Turn terminal. This preserves ADR-0005's all-or-
+nothing Turn transaction and cold Projection cursor across every cut.
+
+## Rejected alternatives
+
+- Chronological canonical System messages and live file observation: they
+  create provider-specific lowering, grow privileged context, and can promote
+  model-influenced file edits without the Owner's explicit `/clear` boundary.
+- Rebuilding stored variants on resume: this reintroduces the configuration
+  and binary drift the epoch exists to remove.
+- Stable Journal offsets for a retained suffix: storage layout, legacy
+  records, and partial tails must not become semantic identifiers.
+
+## Consequences
+
+Legacy Journals can be exact only after one additive migration epoch because
+their historical base is unknowable. External edits remain pending until the
+existing explicit admission boundary. No canonical Role, worker authority,
+file watcher, Provider-specific mid-conversation System lowering, or durable
+capability configuration is added.