plan: open-ideas-fetch-v1 — three stale idea cards re-derived; D-OIF-1 ruled SUPERSEDED

.claude/board/EPIPHANIES.md

@@ -1,3 +1,56 @@
+## 2026-09-05 — E-THE-UNFINISHED-FUNCTION-WAS-NOT-THE-DEBT-1 — the execution model that needed `policy_hash_v1` never reached a binary, and neither has its replacement
+
+**Status:** FINDING (W0 production census, four read-only tracers + orchestrator verification of the contested fact; nothing compiled). Plan: `.claude/plans/open-ideas-fetch-v1.md` §2 (ruling A). Operator ruling the same day: planning migrates to `ogar-loco` / `ogar-r2il`; DataFusion is out; what exists gets a grace period; nothing new migrates to it.
+**Confidence:** High for every existence/absence/caller claim (each carries `file:line`; "production" was traced to a binary or axum handler, never inferred from `pub mod`, a feature flag, a registration helper, a test or a comment). The Dockerfile claim was verified by the orchestrator directly, not taken from a tracer.
+**Deliverables:** `D-OIF-1` (regraded Superseded) `D-OIF-1-DEC` (withdrawn).
+
+**The card said "registration". The first re-derivation said "the body". Both were one abstraction generation behind.** The question was never *which hash* — it was *whether anything still executes the plan that would call it*. Measured:
+
+- `ColumnMaskRewriter` has one non-test constructor in seven repos, `MedCare-rs/crates/medcare-server/src/routes/patient.rs:150`, behind `#[cfg(feature = "lance-phase2-rbac")]` (`:85`) and `?source=lance` (`:52-53`). The feature is default-off (`Cargo.toml:215`) and **no Dockerfile enables it** (`docker/Dockerfile.railway:175` etc. build `lance-phase2,reasoning`). Its decoder `record_batch_to_patient` (`:200-211`) returns `None` unconditionally. No user has ever received a masked row.
+- The rewriter is post-hoc by construction: `rewrite_plan` (`callcenter/src/policy.rs:210`) substitutes expressions above the scan and never writes `TableScan.projection` (`:226-241` only reads it). The forbidden column is materialized from Lance, then overwritten — the exact shape the projection invariant forbids.
+- `RedactionMode::Hash` (`policy.rs:130-140`) binds a UDF whose `invoke` is `Err(NotImplemented)` (`:339`); `register_vsa_udfs` (`vsa_udfs.rs:574`) has zero callers anywhere.
+
+**The half that keeps this from being a tidy retirement story:** the canonical replacement is also unenforced. `lance-graph-rbac::authorize()` / `authorize_scoped()` (`authorize.rs:66,182`), `contract::ClassRbac` (`rbac.rs:143`), `ActionInvocation::commit_via` (`action.rs:327`) and `lance-graph-ogar::OgarRbac` (`rbac_impl.rs:38`) have **zero non-test callers**; `effective_mask` is not an identifier in any `.rs`; there is no `ogar-rbac` crate (`ogar-auth` is password/TOTP only). The one real `surface ∩ role` fail-closed projection (`a2ui-server/src/project.rs:70-83`) lives in a crate with no binary and no dependent. MedCare's live gate is the entity-string `Policy` returning an `AccessDecision` with no mask (`patient.rs:280`); its column projection (`views/project.rs:229`) is a **view** mask with no role operand. And the one mask fold that exists, `authorize_scoped` (`authorize.rs:190-216`), returns `FieldMask::FULL` on non-Allow — fail-open in the mask value.
+
+**So the sentence that is earned is narrower than the one proposed.** Not "the model that needed the function had disappeared" — it never arrived. **The unfinished function was not the debt. The debt is that field-level authorization has no enforced owner on any production path, and the DataFusion rewriter was a second, wrong-layer answer to that vacancy — a storage/query-layer patch for an authorization-layer hole.** Finishing the function would have made the wrong layer *look* finished.
+
+**Correction, same day (operator): the first pass committed the repo-boundary error.** It read zero call sites *inside lance-graph* as a production verdict for a deliberately cross-repo substrate — the same category error lance-graph-java PR #76 had just corrected for `WideFieldMask` one layer down. Three verdicts struck: "`try_advance_phase` has no production entry point" (bardioc `substrate-b` is a binary over `MailboxSoA<32>` gating every move on the contract's `KanbanColumn::can_transition_to`, `substrate-b/src/kanban.rs:103-120`, with `KanbanShaderSink` tagging emissions by phase); "`ogar-loco` has one live consumer" (blockly-rs, the thinking palette, is a direct first-class consumer — `blockly-web` axum binary, `Cargo.toml:40`); "`ogar-r2il` is probe-only" (it is the R2IL→loco bridge over r2sleigh's live `r2il` crate, and the lance-graph-java lineage consumes R2IL/SSA in-process via `ruff_r2il` — a direct Cargo dep is not the falsifier). The RBAC zero-caller verdict is therefore *rescoped* to the nine repos scanned, never stated globally. **Law: for a cross-repo substrate, production reachability terminates at deployed consumers, not at the repository boundary.** The correction sharpens the ruling: DataFusion planning/policy is grace-period archaeology beside an execution architecture that already has real consumers; `policy_hash_v1` would migrate semantics backwards into it.
+
+**What holds, so it is not dragged into the retirement:** the Rubicon lifecycle is SoA-owned and checked — `Planning → CognitiveWork` is a one-way edge in `KanbanColumn`'s DAG (`kanban.rs:98-106`), consulted by `try_advance_phase` (`soa_view.rs:314`) with no mutation on refusal (`:329-346`); the `KanbanActor` actor is deleted while `kanban_actor.rs` lives on as the read-only meta-awareness census (`PhaseCensus`/`mul_target`, composed by `cycle_driver.rs:805`, read by the awareness rungs — first wording here said "tombstone"; corrected same day on operator input); no `Baton` type, no `CollapseGateEmission`, no `CommitHook` exists. RBAC holds no Kanban state; lifecycle code makes no authorization decision; `ogar-loco`/`ogar-r2il` contain no authorization vocabulary. Three v3 docs still name the deleted actor as owner — regraded in place this PR.
+
+**Chronology, so the lesson is not misread as "old code went obsolete":** idea → scaffold (`policy.rs`) → feature-gated integration attempt (MedCare `lance-phase2-rbac`) → never deployed, terminally stubbed → architecture moved elsewhere (operator ruling: loco/r2il; projection-side masking) → the stub falsely reads as unfinished debt. The tree shows no once-live DataFusion masking architecture that was later superseded; it shows an attempted one that accumulated scaffolding and never acquired an execution path. **A conspicuous stub attracts implementation work even when the architecture around it never achieved reality.** Adjudication note: the independent #1188 census reached the same ruling but compressed "not live" into "does not exist" at two points (the MedCare constructor; whole-module removal) — the reachability proof above is what makes the narrower cone (remove Hash + UDF, freeze the rest under grace) the safe one.
+
+**Rule extracted:** before giving an unfinished function a body, trace the *plan* that would execute it to a deployed consumer — in whatever repo it lives; the repository boundary is not the falsifier. A `cfg(feature)` that no Dockerfile sets, a decoder that returns `None`, and a registration helper with no caller are three independent proofs of the same thing, and any one of them ends the "which algorithm" discussion before it starts. "Superseded" is not a verdict about the code; it is a verdict about whether anything reaches it.
+
+---
+
+## 2026-09-05 — E-A-COLUMN-OF-INDICES-INTO-A-CODEBOOK-THAT-DOES-NOT-EXIST-1 — three stale idea cards, each wrong about its own blocker
+
+**Status:** FINDING (structural — grep + read of the current tree; nothing compiled). Plan: `.claude/plans/open-ideas-fetch-v1.md`.
+**Confidence:** High. Existence and absence claims carry file:line. Caller/reader counts are **grep censuses**, stated as such with their scope: `crates/lance-graph-callcenter/src/vsa_udfs.rs:574` (`register_vsa_udfs`) has zero call sites outside its definition across `crates/**/*.rs`; `ewa_sandwich(` has zero call expressions outside `crates/jc/` and `sigma_propagation.rs`; the only σ writers are `crates/cognitive-shader-driver/src/backing.rs:310` (`set_sigma`, the shim loop) and `crates/cognitive-shader-driver/src/backing.rs:347` (`set_sigma`, a test); the only σ readers are `crates/lance-graph-planner/examples/blw_tenant.rs:190` (`o.sigma[row]`) and `crates/lance-graph-planner/examples/blw_rows.rs:289` (`o.sigma[row]`). Nothing compiled.
+**Deliverables (plan `open-ideas-fetch-v1`):** `D-OIF-0` `D-OIF-1` `D-OIF-1-DEC` `D-OIF-2` `D-OIF-2-DEC` `D-OIF-3` `D-OIF-4` `D-OIF-5` `D-OIF-5-DEC` `D-OIF-6` `D-OIF-7`.
+
+Fetching the three highest-value Open cards from an 82-day-stale `IDEAS.md` produced the same shape three times: **the card names a blocker that is not the blocker.**
+
+| card | named blocker | measured blocker |
+|---|---|---|
+| `IDEA-POLICY-HASH-UDF` | "UDF registration" | the **body** — the UDF is bound as an object in the `Expr` (`policy.rs:137`) and executes without by-name registration (`register_vsa_udfs` has zero callers and its UDFs still run); `invoke_with_args` simply returns `NotImplemented` |
+| `IDEA-B1-HARDWARE-BACKENDS` | "waits on ndarray AMX/MKL" | the **shape** — a 2×2 f64 sandwich has no 16×16 tile mapping; and `ewa_sandwich(` has **zero production call expressions** (all four "callers" are doc comments), so any faster kernel is a home without a consumer |
+| `IDEA-CAUSAL-EDGE-TENSOR-SIDECAR` | "design the 9-byte sidecar" | it **shipped**, as a SoA column (`mailbox_soa.rs:125-133`, `bindspace.rs:54-58`) — the card never learned; what is missing is the **codebook** the column indexes |
+
+### The sharp one
+
+Every production row carries `sigma = 0`, documented as "untrained / first centroid" (`bindspace.rs:54`). The `SigmaCodebook` those bytes index is claimed to live in the contract (`sigma_propagation.rs:73`), in `lance-graph-cognitive` (`contract/src/splat.rs:308`), and to be built offline by `jc` (`arm-discovery/aerial/codebook.rs:16`). `grep -rn SigmaCodebook crates/` returns the two doc lines and nothing else; `lance-graph-cognitive/src` has zero hits; `jc` holds the *viability probe* and no builder. **Three claimed homes, zero implementations, one live column of references into them.** Its writers are the write-shim loop (`backing.rs:310`) and one test that writes `9`; its readers are two examples that dump the byte.
+
+Two further inconsistencies ride on the same claim: the σ provenance is written two incompatible ways — *fitted* by k-means (`sigma_codebook_probe.rs`) vs *declared* from the typed value's `(PropertyKind, Marking, SemanticType)` tuple (`sigma_propagation.rs:74-77`) — and two viability numbers are cited for one probe: `R²=0.9949` (`bindspace.rs:39,57`) vs `ρ=0.9973` (`arm-discovery/src/lib.rs:13`), where the probe computes R² (`:317`) and `0.9973` is elsewhere the 3σ constant and an unrelated Spearman band.
+
+### The generalizable rule
+
+**A ledger entry's stated blocker decays faster than its stated goal.** The goal ("hash the column", "propagate Σ faster", "index Σ per edge") survived 4 months; every *mechanism* claim attached to it was stale. So: before acting on an idea card, re-derive its blocker from the tree — the cost is a grep, the alternative is building registration that was never missing, hardware backends for a 3-scalar kernel, or a second projection of a byte that already has a column. The `IDEAS.md` "Status" field should carry the *measured* blocker with a date, and the plan re-derivation is the entry, not a preamble to it.
+
+Also recorded, because it changes what is owed: an unkeyed 64-bit hash of an identifier column is a lookup table wearing a redaction's name — the v1 target named in `policy.rs:275` ("FNV-64") is the option the plan recommends against (`D-OIF-1-DEC`).
+
+Cross-ref: `E-A-RULED-HOME-NEEDS-A-FIRST-CONSUMER-OR-IT-IS-A-VACANCY-1` (the batched kernel's sequencing); `I-VSA-IDENTITIES` (indices, not content — why the column is right and the sidecar was wrong); `E-A-GATE-INHERITS-THE-BLIND-SPOT-OF-WHOEVER-WROTE-IT-1` (the same day's other instance of a written mechanism outliving its truth).
 ## 2026-09-05 — E-VERSIONED-GRAPH-OVERWRITES-SO-ROW-ADDRESSES-ALIAS-ACROSS-VERSIONS-1 — the D-LNC-2 probe found four wrong claims in the plan it was written to execute
 
 **Status:** FINDING (measured, `crates/lance-graph/tests/lance_row_identity_probe.rs`, lance 10.0.0, both disable arms verified red-then-green).

.claude/board/IDEAS.md

@@ -87,6 +87,38 @@ Agents filter by `@`-mention or domain to see what's theirs.
 
 (Prepend new ideas here with today's date. Format:)
 
+## 2026-09-05 — Σ-propagation: the batched `F64x8` kernel is the real lever; AMX/MKL was the wrong shape for a 2×2
+
+`[P2 @savant-architect @sentinel-qa domain:codec D-OIF-4 D-OIF-5]`
+
+Re-derived from the tree while fetching `IDEA-B1-HARDWARE-BACKENDS`. The kernel is 2×2 f64 (`sigma_propagation.rs:210-227`, 12 mul + 6 add); an AMX tile is 16×16 bf16/int8 and an MKL `dgemm` call costs more than the 18 flops. `F64x8` carries non-FMA `Mul`/`Add` on all four backends (`simd_avx512.rs:446-448`), so eight edges per instruction with **bit identity** to the scalar kernel is reachable as plain consumer code in `jc` — no ndarray change. The catch that decides sequencing: `ewa_sandwich(` has **zero production call expressions** outside `jc` + the contract; every "caller" is a doc comment. So the kernel ships only paired with the hop re-quantization probe that decides whether `MailboxSoA::apply_edges` may advance `sigma[row]`. Plan: `open-ideas-fetch-v1.md` §3.
+
+**Status:** Open — In plan (`D-OIF-4`, `D-OIF-5`); `D-OIF-5-DEC` (where an edge's `M` comes from — the `CausalEdge64` v2 spare is 3 bits) is the operator's.
+
+## 2026-09-05 — The σ column indexes a codebook that exists in three doc comments and zero crates
+
+`[P1 @truth-architect @integration-lead domain:codec D-OIF-0 D-OIF-2 D-OIF-3]`
+
+`BindSpace.fingerprints.sigma` (`bindspace.rs:54-58`) and `MailboxSoA.sigma` (`mailbox_soa.rs:125-133`) shipped the 1-byte index the `IDEA-CAUSAL-EDGE-TENSOR-SIDECAR` card was still designing. The `SigmaCodebook` it references is claimed to live in the contract (`sigma_propagation.rs:73`), in `lance-graph-cognitive` (`contract/src/splat.rs:308`), and to be built offline by `jc` (`arm-discovery/aerial/codebook.rs:16`) — `grep -rn SigmaCodebook crates/` finds only the two doc lines. Every production row carries `sigma = 0`, "first centroid" of a codebook with no centroids. Two provenance stories coexist — fitted (k-means, `sigma_codebook_probe.rs`) vs declared (typed-value tuple, `sigma_propagation.rs:74-77`) — and two viability numbers are cited for one claim (`R²=0.9949` vs `ρ=0.9973`). Plan: `open-ideas-fetch-v1.md` §4.
+
+**Status:** Open — In plan (`D-OIF-0` re-runs the probe; `D-OIF-2` the type + builder; `D-OIF-3` the first real writer). `D-OIF-2-DEC` (fitted vs declared) is the operator's.
+
+## 2026-09-05 — `ndarray::simd::ternlog` ⋂ the §14 voxel cube: the "other 18 cells" are one named immediate each
+
+`[P2 @simd-savant @kernel-membrane-warden domain:mask]`
+
+lance-graph-java's `mask-risc-lowering-v1.md` §14 prices a 3-state × 3-tier voxel cube as 9 built primitives with "the other 18 cells ANDs of three". `ndarray::simd::ternlog::{AND3, AND2_ANDNOT, AND_ANDNOT2, …}` (ndarray #299 arc, parity-tested over all 256 immediates on six backends) makes each of those cells ONE instruction with a NAME. Partly realized already: `lance-graph-planner/examples/probe_nxg_hist_1.rs:51-136` calls `mask_ternlog::<AND_ANDNOT2>` / `<AND3>` by name (E-NXG-2/3). What is still open: (a) §14's arithmetic assumes cell = 3 ANDs — restate it as 1 ternlog and re-price; (b) `ogar_loco::TERNLOG = FnIndex(0x86)` still has no consumer, and the immediate byte IS the call value — the lowering from a §14 cell to a loco call is a table, not code. Interacts with `D-MRL-G2` (mask spans the class's rows or all rows), which is the operator's.
+
+**Status:** Open (research; blocked on `D-MRL-G2`).
+
+## 2026-09-05 — Citations should carry the path the decay gate can resolve, or the gate sees 7 % of them
+
+`[P2 @doctrine-keeper domain:board]`
+
+The `citation-decay` gate (#1168/#1170) measured **2314 citations / 37 OK / 124 DECAYED / 2153 UNVERIFIABLE** — 93 % unverifiable because the house style cites bare basenames (`policy.rs:137`) that no scanner can resolve to a file. The gate is honest about it (unverifiable never fails). Two possible remedies, neither taken yet: (1) a convention — cite `crate/path.rs:LINE` for anything under `crates/`, basename-only allowed inside a plan that names its crate once in a header; (2) a resolver in the gate that tries `**/<basename>` and treats a UNIQUE hit as resolvable, a non-unique one as unverifiable. (2) needs no behaviour change from writers and is measurable (how many of the 2153 become OK vs DECAYED). Recommend (2) first, then decide (1) on the numbers.
+
+**Status:** Open.
+
 ## 2026-06-15 — Research synergy: CLAM residue ladder ⋂ knee/hip attractor basins (HHTL cascade in REVERSE, fine→coarse ascent)
 
 `[P3 @cascade-architect @savant-research domain:codec]`
@@ -1061,7 +1093,7 @@ bgz17 crate as the substrate.
 
 ### IDEA-B1-HARDWARE-BACKENDS — AMX/MKL hardware backends for sigma_propagation (PR #322)
 
-**Status:** Open 2026-05-05
+**Status:** Reshaped 2026-09-05 — AMX/MKL rejected for the 2×2 kernel (shape mismatch); superseded by the `F64x8` batched kernel, plan `open-ideas-fetch-v1.md` §3 (`D-OIF-4`/`D-OIF-5`)
 **Priority:** P3
 **Source:** PR #322 explicit "What this PR does NOT do"
 **Author's words:** "No hardware backends (AMX/MKL via ndarray #119/#121). That's B1.5 follow-up."
@@ -1125,7 +1157,7 @@ bgz17 crate as the substrate.
 
 ### IDEA-CAUSAL-EDGE-TENSOR-SIDECAR — CausalEdgeTensor as 9-byte sidecar (CausalEdge64 + 1 byte Σ index) (PR #288)
 
-**Status:** Open 2026-05-05
+**Status:** Implemented-in-part 2026-09-05 — the 1-byte index shipped as a SoA column (`mailbox_soa.rs:133`, `bindspace.rs:58`), NOT as a sidecar; the codebook it indexes is OPEN, plan `open-ideas-fetch-v1.md` §4 (`D-OIF-2`/`D-OIF-3`)
 **Priority:** P2
 **Source:** PR #288 (sigma codebook probe conclusion)
 **Author's words:** "Mit diesem Probe-Resultat kann jetzt `CausalEdgeTensor`-Variante als 9-Byte-Sidecar (`CausalEdge64` + 1 Byte Σ-Codebook-Index) entworfen werden, ODER äquivalent über Schemasidecar Block 14/15. Caller-Wahl, beide architektonisch tragbar."
@@ -1161,7 +1193,7 @@ bgz17 crate as the substrate.
 
 ### IDEA-POLICY-HASH-UDF — policy_hash_v1 UDF registration (PR #301)
 
-**Status:** Open 2026-05-05
+**Status:** Superseded 2026-09-05 (ruling A) — the DataFusion masking path has no deployed consumer and the operator ruled DataFusion out of planning; retirement plan in `open-ideas-fetch-v1.md` §2 (`D-OIF-1`); `D-OIF-1-DEC` withdrawn
 **Priority:** P2
 **Source:** PR #301
 **Author's words:** "`NotYetWiredHashUdf` binds at plan time, returns `NotImplemented('policy_hash_v1 UDF not yet registered')` at execute. Plans build; execution fails loud."