feat(guix): carry prebuilt runtime and recover preserved state

1 files changed, 23 insertions, 6 deletions

diff --git a/docs/MAP.txt b/docs/MAP.txt
index 6f5e13d..de546b8 100644
--- a/docs/MAP.txt
+++ b/docs/MAP.txt
@@ -15,7 +15,7 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 FILE MAP
 
-    Public tree: every tracked file, including this map.
+    Public tree: every tracked file plus pending Guix source/docs and this map.
     Static inventory; update when public paths change. Root: stack/.
     Private/generated trees below list roles only; contents stay unlisted.
 
@@ -67,6 +67,7 @@ stack/  Personal service source, build recipes and recovery tooling.
 |   |-- CHAT-OPENSSL-MIGRATION.txt  OpenSSL crypto migration evidence, dependencies, reviewed exceptions.
 |   |-- CHAT-PRODUCTION.txt  Chat release packaging, HTTPS activation, owner setup, production recovery.
 |   |-- CONFIGURATION.txt  Supported root settings, validation, public/private state boundaries.
+|   |-- GUIX.txt  Experimental Guix capsule, canonical-store bootstrap, gates and blockers.
 |   |-- LINTING.txt  Strict Rust/browser checks, generated-code limits, justified exceptions.
 |   |-- MAP.txt  This public-file tree and private/runtime directory roles.
 |   |-- OPERATIONS.txt  Stack development, encrypted backup/restore, host setup, deployment.
@@ -90,6 +91,17 @@ stack/  Personal service source, build recipes and recovery tooling.
 |   |   |   `-- supervisord.conf  Run nginx and fcgiwrap inside the cgit container.
 |   |   `-- chat/  Prebuilt chat image recipe.
 |   |       `-- Containerfile  Package prebuilt static chat server and web/crypto assets.
+|   |-- guix/  Experimental Guix runtime and recovery capsule tooling.
+|   |   |-- bootstrap.sh  Root-owned canonical closure installation; refuse managed/foreign stores.
+|   |   |-- build.sh  Capture Guix channels; build canonical runtime pack; probe Podman info.
+|   |   |-- bundle.sh  Validate paired release; wrap encrypted backup, release and bootstrap.
+|   |   |-- containers.conf  Guix-only PATH-selected conmon/crun and rootless networking.
+|   |   |-- manifest.scm  Guix packages for the portable container/runtime tools.
+|   |   |-- restore.sh  Check capsule/host, decrypt safe restore, require images, start production.
+|   |   |-- run.sh  Select content-addressed Guix runtime; launch stack with explicit root.
+|   |   |-- test-bootstrap.sh  Real bootstrap in isolated filesystem using synthetic closure packs.
+|   |   |-- test-recovery.sh  Synthetic release activation, resume, intent/locks and private-state preservation.
+|   |   `-- test.sh  Bootstrap, immutable cleanup, integrity, overwrite refusal and launcher fixtures.
 |   |-- searxng/  Search service configuration.
 |   |   `-- settings.yml  SearXNG defaults: private instance, rate limiting, HTML search.
 |   |-- Caddyfile  Production domain routing, HTTPS, WKD and service reverse proxies.
@@ -100,11 +112,11 @@ stack/  Personal service source, build recipes and recovery tooling.
 |   `-- stack.service  Systemd user boot unit for ~/stack start/stop.
 |-- src/  Management executable source.
 |   |-- app/  Management command implementation modules.
-|   |   |-- archive.rs  Consistent snapshots, encrypted exports and validated directory restores.
+|   |   |-- archive.rs  Consistent snapshots, encrypted exports, legacy Caddy layout and validated restores.
 |   |   |-- chat.rs  Chat build/package artifacts, container settings and owner administration.
 |   |   |-- cli.rs  Management subcommands, flags and argument validation.
-|   |   |-- files.rs  Safe filesystem/archive operations, manifests and hashes.
-|   |   |-- images.rs  Export/import exact container images; enforce platform and content locks.
+|   |   |-- files.rs  Safe filesystem/archive operations, manifests, hashes and runtime copies.
+|   |   |-- images.rs  Export/import saved images with archive-only policy, platform and content locks.
 |   |   |-- process.rs  Run child processes; capture output and report failures/status.
 |   |   |-- project.rs  Discover/lock project; settings, Podman commands, service lifecycle.
 |   |   |-- release.rs  Build checked release archives; validate/install production artifacts.
@@ -152,7 +164,7 @@ PRIVATE AND GENERATED PATHS — NOT PUBLIC SOURCE
     .env                 Sole private root configuration; never commit.
     .git/                Local Git objects, refs, hooks and repository settings.
     .tools/              Downloaded toolchains, build tools, sources and caches.
-    bin/                 Prebuilt management/chat commands and packaged chat assets.
+    bin/                 Prebuilt management/chat commands, launcher and Guix pack.
     dist/                Locally built release tarballs and checksum files.
     node_modules/        Locked npm development dependencies; recreated by npm ci.
     target/              Cargo build output, WASM targets and generated rustdoc.
@@ -166,10 +178,15 @@ PRIVATE AND GENERATED PATHS — NOT PUBLIC SOURCE
         repos/           Served bare Git repositories; separate from root .git/.
         searxng/         Runtime search configuration and persistent service files.
       exports/           Encrypted application backups and checksum files.
+      guix/              Unpacked content-addressed runtime packs; old packs retained.
       incoming/          Copied release archives and temporary deployment bootstrap.
       podman/            Recreated container storage/run state; never transfer as backup.
       graphify/          Public-source graph index, visual map and extraction artifacts.
 
     Other var/ paths may hold generated fixtures or temporary work. This map does
     not enumerate private files. Backups must keep .env and var/data; public Git
-    alone cannot recover services. See OPERATIONS.txt.
+    alone cannot recover services. See OPERATIONS.txt and GUIX.txt.
+
+    Experimental host integration: /gnu/store holds canonical Guix packages;
+    /gnu/.stack-runtimes holds root-owned package install records and lock.
+    Neither holds application configuration, databases or TLS keys.