board: post-merge hygiene for #1185 (D-OIF-1 ruled SUPERSEDED)

.claude/board/LATEST_STATE.md

@@ -332,6 +332,47 @@ Also removed one dead declaration that blocked the sweep: `container_bs/mod.rs`
 
 (#1100 opened for the one-file subset of this and closed unmerged, superseded.)
 
+---
+## 2026-09-05 — #1185 MERGED (f8b629a3): D-OIF-1 ruled SUPERSEDED + the cross-repo reachability law — DOC/BOARD ONLY
+
+| PR | merge | content |
+|---|---|---|
+| **#1185** | `f8b629a3` | `open-ideas-fetch-v1` (D-OIF-0..7): three stale `IDEAS.md` cards re-derived. **D-OIF-1 ruled A — SUPERSEDED**, `D-OIF-1-DEC` withdrawn: no hash is built because no deployed consumer reaches the DataFusion masking path. Records the cross-repo reachability law, the `kanban_actor.rs` read-only-meta-awareness correction, and (post-#1190) the CLAUDE.md pin ruling caught up to lance 11 / lancedb 0.38. |
+
+**Contract inventory net delta: none** (DOC/BOARD ONLY). No code, no hash, no
+deletion; `policy.rs` and `rls.rs` are frozen grace-period, not removed.
+
+**The ruling.** `ColumnMaskRewriter`'s only non-test constructor in nine scanned
+repos is MedCare `routes/patient.rs:150`, behind default-off `lance-phase2-rbac`
+that no Dockerfile enables, behind `?source=lance`, ending in a decoder stub
+returning `None`; and it redacts ABOVE the scan (`policy.rs:210` never writes
+`TableScan.projection`). Operator ruling the same day: planning migrates to
+`ogar-loco` / `ogar-r2il`, DataFusion is grace-period, nothing new migrates to
+it — so a hash body was barred independently of the census.
+
+**Three verdicts struck mid-PR, and why that matters more than the ruling.** The
+first census asked "who calls this inside lance-graph?" and read zero local call
+sites as production absence — the same category error lance-graph-java #76 had
+just corrected for `WideFieldMask` one layer down. Operator-corrected: **for a
+cross-repo substrate, production reachability terminates at deployed consumers,
+not at the repository boundary.** Struck: `try_advance_phase` "has no production
+entry point" (bardioc `substrate-b`); `ogar-loco` "one live consumer"
+(blockly-rs); `ogar-r2il` "probe-only" (the R2IL→loco bridge over r2sleigh's live
+IR). The RBAC zero-caller finding is now *scoped* to the nine repos, never
+stated globally.
+
+**Also corrected:** `kanban_actor.rs` is not a tombstone — the actor was deleted,
+the FILE is live read-only meta-awareness (`PhaseCensus` / `mul_target` /
+`parse_kanban_step`, re-exported at `lib.rs:82`, consumed by `cycle_driver.rs:805`
+and named as precedent by `rubicon_witness.rs:32` and `rung_horizon.rs:5`).
+
+**Open, NOT closed by this PR:** field-level authorization has no enforced owner
+on any scanned production path (`authorize`/`authorize_scoped`/`commit_via`/
+`OgarRbac` all zero non-test callers; `effective_mask` is not an identifier; no
+`ogar-rbac` crate). Recorded as the missing implementation on the canonical
+`ClassRbac × ClassView × WideFieldMask` path. `D-OIF-2-DEC` and `D-OIF-5-DEC`
+remain operator decisions; no D-OIF worker has run.
+
 ---
 ## 2026-09-05 — #1187 MERGED (a9d3da0a): D-LNC-1 — lance 9 → 10, lancedb 0.33 → 0.37.1
 

.claude/board/PR_ARC_INVENTORY.md

@@ -1,3 +1,13 @@
+## 2026-09-05 — lance-graph PR #1185 (merged `f8b629a3`, branch `claude/open-ideas-fetch-v1`) — D-OIF-1 ruled SUPERSEDED; the cross-repo reachability law
+
+- **Added:** `.claude/plans/open-ideas-fetch-v1.md` (D-OIF-0..7, §2 = the D-OIF-1 retirement ruling with tree verdict / obligation table / remove-grace-retain cone / layer audit / stale-claim list); `EPIPHANIES` `E-A-COLUMN-OF-INDICES-INTO-A-CODEBOOK-THAT-DOES-NOT-EXIST-1` and `E-THE-UNFINISHED-FUNCTION-WAS-NOT-THE-DEBT-1`; `ISSUES` `ISS-PIN-RULING-PROSE-DRIFTS-BEHIND-THE-MANIFEST`; four `IDEAS.md` entries + three in-place status flips; `STATUS_BOARD` D-OIF-0..7 + three `-DEC` rows.
+- **Ruled:** **D-OIF-1 = A, SUPERSEDED / retirement plan.** `D-OIF-1-DEC` (hash family + key) **withdrawn** — no hash chosen because no hash is built. First removal PR (later, its own) is `RedactionMode::Hash` + `NotYetWiredHashUdf` only; the rest of `policy.rs` / `rls.rs` is frozen grace-period until MedCare retires `lance-phase2-rbac`.
+- **Corrected (the durable half):** the first census committed the repo-boundary error — zero call sites *inside lance-graph* read as production absence, for a deliberately cross-repo substrate. Three verdicts struck on operator input (Rubicon via bardioc `substrate-b`; `ogar-loco` via blockly-rs; `ogar-r2il` as the R2IL→loco bridge over r2sleigh), and the law recorded: **production reachability terminates at deployed consumers, not at the repository boundary.** Second correction: `kanban_actor.rs` is live read-only meta-awareness (`PhaseCensus`, rungs 0–9), not a tombstone — the ACTOR was deleted, the FILE is a consumer surface.
+- **Also:** post-#1190, `CLAUDE.md` § Key Dependencies caught up to `lance = "=11.0.0"` / `lancedb = "=0.38.0"`; the E-PIN-LANCE9-… ruling regraded on its lance/lancedb coordinates only, its datafusion half verbatim. Two consecutive bumps had left the ruling lines stale across a full major.
+- **Deferred:** `D-OIF-2-DEC` (σ provenance) and `D-OIF-5-DEC` (edge `M` source) — operator decisions; no worker dispatched. Field-level RBAC enforcement recorded as the missing implementation on the canonical path, deliberately not built here.
+- **Docs:** `.claude/v3/{COMPONENT-MAP, knowledge/mailbox-kanban-model, knowledge/write-on-behalf}` regraded on the deleted-actor claim; `LATEST_STATE` dated correction on the `commit_via` / `OgarRbac` shipped-enforcement claim.
+- **Confidence:** High on every existence/absence claim (each carries `file:line`; the census scope — nine repos — is stated in the plan, and the RBAC absence is scoped to it, never global). Medium on the grace-period cone's removal ORDER, which depends on a MedCare-side feature retirement this repo does not control.
+
 ## 2026-09-05 — lance-graph PR #1187 (merged `a9d3da0a`, branch `claude/lance-10-bump`) — D-LNC-1: lance 9 → 10, lancedb 0.33 → 0.37.1
 
 - **Added:** `lance*` / `lance-namespace` / `lance-arrow` `=9.0.0` → `=10.0.0` (root table + `lance-graph-catalog`, `lance-graph`, `holograph`); `lancedb` `=0.33.0` → `=0.37.1` (`default-features = false`). Exact pins stay exact because lancedb 0.37.1 itself demands `lance =10.0.0`; arrow 58 / datafusion 54 unchanged (the ceiling is lance-wide, #1182).