From 96c80937a8bce5da485c1780a381044a5e385440 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 6 Sep 2026 11:55:32 +0000 Subject: [PATCH 1/6] plans: SPEC v1 for the NodeGuid::new repurpose audit (5+3 council, read-only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Operator asked for a repurpose audit of NodeGuid::new and for the 5+3 council to run without changing anything. This is Phase 0's artifact: the spec the council was cast against. No code, schema, bake or Cargo change — the deliverable is a verdict, and the operator's constraint is the reason the audit exists at all: "It's already in production, if you touch it it would change something you half understand." The spec carries a §0 RETRACTED READINGS table — four readings I produced before writing it, each FALSE, each recorded so the council does not re-derive them and no finding cites them as context. All four came from reading an accessor NAME or a byte HISTOGRAM instead of the class's declared schema. ogar-obo/src/layout.rs exists to prevent exactly that and says so: "the classid picks the reading … a reader never assumes a carve." Banking my own errors is cheaper than having five agents rediscover them. Frozen decisions F1-F8 include the operator's architecture as stated this session: the first two tenants are the distinguished name, the 4x24-bit Quad Identitaet is a VALUE tenant, the O(1) lookup is the quad, the depth-16 path (12+4) serves parent-child inheritance and HHTL nodes, and nobody walks anything. Gates G1-G5. G4 is the one that matters: the identity() readers must be split into ordering / uniqueness / display / SEQUENCE, because only the sequence bucket is a semantic blocker — a distinguished name sorts hierarchically rather than temporally, and that failure still compiles. Board hygiene same-commit: INTEGRATION_PLANS prepend, STATUS_BOARD D-NGN-AUDIT row. Supersession index regenerated after the board writes; byte-identical. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/INTEGRATION_PLANS.md | 26 ++ .claude/board/STATUS_BOARD.md | 1 + .../plans/nodeguid-new-repurpose-audit-v1.md | 241 ++++++++++++++++++ 3 files changed, 268 insertions(+) create mode 100644 .claude/plans/nodeguid-new-repurpose-audit-v1.md diff --git a/.claude/board/INTEGRATION_PLANS.md b/.claude/board/INTEGRATION_PLANS.md index e3549a12f..76ef9fe37 100644 --- a/.claude/board/INTEGRATION_PLANS.md +++ b/.claude/board/INTEGRATION_PLANS.md @@ -1,3 +1,29 @@ +## 2026-09-06 — `NodeGuid::new` repurpose AUDIT (5+3 council, READ-ONLY) → `.claude/plans/nodeguid-new-repurpose-audit-v1.md` + +SPEC v1 of a council convened to AUDIT — not implement — whether +`NodeGuid::new` can be repurposed from the V1 mint into a V3 cascade +constructor. **Operator constraint, verbatim: *"It's already in production, if +you touch it it would change something you half understand."*** Nothing is +built from this pass; the deliverable is a verdict. + +The spec carries a §0 **RETRACTED READINGS** table — four FALSE readings the +orchestrator produced before writing it (each from an accessor NAME or a byte +HISTOGRAM instead of the class's declared schema), banked so the council does +not re-derive them and no finding cites them as context. `ogar-obo/src/layout.rs` +exists to prevent exactly that failure and says so: *"the classid picks the +reading … a reader never assumes a carve."* + +Frozen (F1-F8) includes the operator's architecture: **first two tenants = the +distinguished name; the 4x24-bit Quad Identitaet is a VALUE tenant; the O(1) +lookup is the quad; the depth-16 path (12+4) serves parent-child inheritance +and HHTL; "Nobody walks anything."** Gates G1-G5 include G4, the +ordering/uniqueness/display/**sequence** classification of the identity() +readers — only the sequence bucket is a semantic blocker, because a DN sorts +hierarchically and that failure still compiles. + +Status: Phase 1 cast (5 savants). Consolidation to v2 and the 3 reviewers +follow. Superseded by v2/v3 when they land. + ## 2026-09-06 — temporal / delta / alpha staged plan → `.claude/temporal/09-plan.md` Staged and probe-gated: Stage 1 compact alpha resident form (no addressing, no diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 923c0781b..14177721f 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -20,6 +20,7 @@ identity) is real and probe-gated. | D-MW-P2 | **MemWAL crash-atomicity probe** (`crates/lance-graph/tests/memwal_atomicity_probe.rs`): the one measurement `.claude/temporal/08-memwal-vs-batchwriter.md` named as overturning its FOLD verdict — SIGKILL mid-flush on a 5 000-row put | **In PR** #1198. **GREEN.** A1 clean-drop control 5000; A2 SIGKILL sweep 5–500 ms → `0,0,0,5000,5000,5000,5000`. Boundary bracketed on both sides, no partial batch. FOLD stands. Scope recorded as NOT settled: one put, local store, no concurrent writers, no fencing path, and NOT the landing-rows-plus-frame-row composite (that is `LanceCycleWriter`'s, which has zero callers) | | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it | | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE | +| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **In PR** #1201, SPEC v1, council in flight. Phase 1 cast (5 savants); v2 consolidation + 3 reviewers pending. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) | | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** | | D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) | | D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites | diff --git a/.claude/plans/nodeguid-new-repurpose-audit-v1.md b/.claude/plans/nodeguid-new-repurpose-audit-v1.md new file mode 100644 index 000000000..07fb7d38d --- /dev/null +++ b/.claude/plans/nodeguid-new-repurpose-audit-v1.md @@ -0,0 +1,241 @@ +# SPEC v1 — `NodeGuid::new` repurpose audit (5+3 council, READ-ONLY) + +**Status:** SPEC v1, Phase 0. **Nothing is implemented. Nothing may be changed.** +The deliverable of this council is an AUDIT — a verdict on whether +`NodeGuid::new` can be repurposed, at what cost, and what would break. No +code, no bake, no schema edit lands from this pass. + +**Operator constraint, verbatim (2026-09-06):** *"It's already in production, +if you touch it it would change something you half understand."* The audit +exists BECAUSE the understanding is incomplete. A savant that proposes an +edit has misread this line. + +--- + +## 0. RETRACTED READINGS — do NOT rediscover these as findings + +The orchestrator produced four wrong readings before this spec. They are +recorded so the council does not spend a lens re-deriving them, and so no +finding cites them as prior context. **Each is FALSE:** + +| # | wrong reading | corrected by | +|---|---|---| +| R1 | "the 12+4 is `in_family`/`out_family`, and the edge block content is a degree histogram, therefore the 12+4 the operator described is V1 naming" | operator: the 12+4 is about **value** bytes, not the edge block. Two different regions. | +| R2 | "no path exists in any row; a DN cannot be derived from the bake" | measured false — see §2 M4/M5 | +| R3 | "edge targets live in side tables (`ro_edges`); consumers walk `ZIPPER_ISA_DEPTH`" | targets are in the value slab's edge lanes; operator: **"Nobody walks anything"** | +| R4 | "the key is `classid(4) + 4×u24`, i.e. the quad IS the key" | operator: **"4x24bit identity is in the value tenant of the SoA"** — the quad is a VALUE tenant, not the key | + +**Method note for every savant:** R1–R4 were each produced by reading +accessor NAMES or byte-occupancy STATISTICS instead of the class's declared +schema. `ogar-obo/src/layout.rs` exists to prevent exactly this and says so: +*"the classid picks the reading … a reader never assumes a carve."* Any +finding in this council that rests on a field name or a histogram, rather +than on a declared schema or an operator ruling, is malformed. + +--- + +## 1. FROZEN DECISIONS (cite-only; flag as VIOLATES with evidence, never re-open) + +1. **F1 — V1 is banned for new mints.** lance-graph `CLAUDE.md` § CANON: + *"forbidden for new units"*; MedCare `Cargo.toml:139` records the operator + ruling *"V1/V2 are completely deprecated — ANY default is Always V3, period."* +2. **F2 — the stride is canon.** `NODE_ROW_STRIDE = 512`, `key(16) | edges(16) + | value(480)`. Every tail variant is a READING of the same bytes; + `TailVariant::is_layout_preserving` returns `true` unconditionally + (`canonical_node.rs:1290+`). No `ENVELOPE_LAYOUT_VERSION` bump is available + as a lever, and none is needed. +3. **F3 — RESERVE, DON'T RECLAIM.** A zero tier means *not consulted*, never + *compacted away*. +4. **F4 — the classid picks the reading.** `ogar-obo/src/layout.rs` + `row_schema_of(concept)`; `ClassView::edge_codec_flavor` for the edge block. +5. **F5 — operator architecture, stated 2026-09-06, FROZEN:** + - **the first two tenants are the distinguished name** + - **the 4×24-bit Quad Identität is in a VALUE tenant of the SoA** + - **lookup-wise the O(1) is in the quad 4×24 bit** + - the depth-16 path (12 + 4 second tenant) is used for **parent–child + inheritance and HHTL nodes** + - **"Nobody walks anything."** +6. **F6 — the V3 generation marker is `0x1000` in the LOW u16**, canon + `domain:appid` in the HIGH u16 (`canonical_node.rs:94-118`: + `CLASSID_OSINT_V3 = 0x0701_1000`, `CLASSID_FMA_V3 = 0x0A01_1000`, + `CLASSID_CPIC_V3 = 0x0E01_1000`). +7. **F7 — the lo-u16 app prefixes `0x0005` / `0x0009` are pre-flip artifacts** + (operator, this session). They are NOT evidence of a live allocation table. +8. **F8 — do not touch bodyhelix / adjacent older bakes** (operator): they work, + re-baking is out of scope, and they are the one place V1 may legitimately remain. + +--- + +## 2. INPUT INVENTORY (file:line — all verified this session) + +### 2.1 The subject + +| item | location | shape | +|---|---|---| +| `NodeGuid::new` | `lance-graph-contract/src/canonical_node.rs:200-224` | `(classid u32, heel u16, hip u16, twig u16, family u32, identity u32)`; asserts family/identity ≤ 24 bits; writes `c[0..4] h[4..6] p[6..8] t[8..10] f[10..13] i[13..16]` | +| `NodeGuid::local` | `canonical_node.rs:228` | default-class bootstrap: identity only | +| `mint_for` | `canonical_node.rs:368` | dispatches on `TailVariant`; **V2 and V3 share one arm** → `new_v2`, asserting family/identity ≤ `0xFFFF` | +| `TailVariant` | `canonical_node.rs:1275` | V1 `family(u24)·identity(u24)` / V2 `leaf·family·identity 3×u16` / V3 = *"the `(part_of:is_a)` 8:8 tile"* | +| accessors whose MEANING a repurpose changes | `canonical_node.rs:240,245,250,256,262,268,305,513,521,527,534` | `classid family identity heel hip twig local_key leaf family_v2 identity_v2 local_key_v2` | +| `CascadeShape` | `lance-graph-contract/src/facet.rs:395-409` | `G6D2` (6×2, shift `i>>1`) / `G4D3` (4×3, divides `i/3`, `is_byte_aligned=false`) / `G3D4` (3×4, shift `i>>2`); `ROTATIONS` = all three; **G·D = 12 each** | +| feature gates | `lance-graph-contract/Cargo.toml:42,54,69` | `default = ["guid-v3-tail"]`; `guid-v3-tail = ["guid-v2-tail"]` | + +### 2.2 The producer's declared carve (authoritative) + +`ogar-obo/src/layout.rs` `OBO_CORE_ROW`, with `lib.rs` `EDGES_OFFSET=16`, +`VALUE_OFFSET=32`, `NODE_ROW_STRIDE=512`, `edges.rs` `LANE_BYTES=16`, +`LINKS_PER_LANE=4`, `EDGE_LANE_COUNT=23`, `EDGE_SLOT_COUNT=92`: + +``` +key [0..16] classid(4) + 12 +edges [16..32] row[EDGES_OFFSET + Predicate as usize] = per-predicate DEGREE +value [32..512] + entity_type slab 96 → abs 128, u16 + edge_lanes slab 112 → abs 144, 23 lanes × 16 B, runs to end of row + each lane = classid(4) + 4×u24 ("under the G2 grace carving") +``` + +### 2.3 Measurements taken this session (reproducible) + +- **M1** MedCare mint ratio: **44** `NodeGuid::new` call sites vs **1** real + `NodeGuid::mint_for(` call site (`medcare-cohorts/src/differential.rs:944`). +- **M2** `identity()` readers off a key: MedCare **66**, lance-graph **5**, + tesseract-rs **0**, stockfish-rs **0**. `family()`: 2 / 8 / 0 / 0. +- **M3** stockfish-rs does NOT enable `guid-v3-tail` → its one mint is forced V1. +- **M4** `all-lanes-domain-v0.1.0/all-lanes.soa` (S3, 762,041 rows × 512 B): + key facet bytes 4..9 populated with a descending profile; bytes 10,11 always + zero; 13,14,15 dense. +- **M5** value-slab depth probe over 24,000 sampled rows: tenant-1 (abs 76..88) + contiguous-prefix depth histogram `1→10 … 4→3578 … 12→28`; **when tenant-1 is + full at 12, tenant-2 depth is 4 in 27 of 28 rows** (one at 5); max total 17. +- **M6** classid generations coexist in one bake: `0x9101 0x9202 0x970d 0x9811` + (new 91..9E) alongside `0x0315 0x0304 0x0309` (retired `0x03`), plus `0x9303` + which `ogar-vocab` asserts must stay a hole. ~8,996 of 18,000 sampled rows + were on `0x03`. +- **M7** MedCare app prefixes: `MEDCARE_APP_PREFIX = 0x0005` + (`class_registry.rs:314`, pinned to `HealthcarePort::APP_PREFIX` by a + conformance test) vs hardcoded `APP_PREFIX = 0x0009` + (`medcare-server/src/views/addressed.rs:156`). +- **M8** patient addressing: `patient_guid` (`medcare-soa/src/patient.rs:189`) + mints `CLASSID_DEFAULT` (0) with family/identity split of a 48-bit id; + `bake_node_rows` (`medcare-cohorts/src/node_bake.rs:50-73`) mints the DISEASE + classid with `family=0`, `identity=demo_patient_id`, `edges: EdgeBlock::default()`. +- **M9** cohort size: **750** (15×50), ids `1..=750`, + `DEMO_PATIENT_ID_BASE = 9_100_000`, reserved block `9_000_000..=9_999_999` + (fits one u24). MedCare `CLAUDE.md` says "1,200" — drift. +- **M10** `patient` is ALREADY minted `0x0901` in `ogar-vocab` with + `class_ids::PATIENT` and `HealthcarePort::class_id("Patient")`. + +--- + +## 3. THE PROPOSED RESOLUTION (what the council audits — NOT what it builds) + +**Claim under audit (C):** `NodeGuid::new` can be retired as a *V1 mint* and +repurposed as *the* V3 cascade constructor, without a stride change and +without an `ENVELOPE_LAYOUT_VERSION` bump, because: + +- C1 — the key's 12 post-classid bytes are the same 12 bytes every + `CascadeShape` carves (`G·D = 12`), so the shape is a READING (F2). +- C2 — V1's `family(u24)·identity(u24)` occupies bytes 10..13 and 13..16, so + under a 2-byte rail grid rail 4 = `(byte12, byte13)` **straddles the two u24 + fields**; a flat u24 cannot carry a rail. +- C3 — per F5 the identity is NOT in the key: the quad is a value tenant and + the first two tenants are the DN. So a repurposed key carries cascade/DN + addressing, and `identity()`-off-the-key becomes meaningless. +- C4 — the cost is therefore concentrated in M2's readers (66 + 5) and M1's + mint sites (44), not in the layout. + +**The audit must return a verdict on C, not implement it.** + +--- + +## 4. NON-GOALS + +- **N1** Any code, schema, bake or Cargo change. Read-only pass (operator). +- **N2** Re-litigating F1–F8. Frozen; verify compliance only. +- **N3** Designing the patient classid mint. Separate, operator-gated. +- **N4** bodyhelix / older bakes (F8). +- **N5** The `0x03` vs `91..9E` generation mix (M6) — surfaced, not resolved here. +- **N6** Proposing a new tenant, shape, or accessor. A savant wanting to + redesign files ONE `RISK` finding and stops (harness rule). + +--- + +## 5. PRE-REGISTERED GATES (for the AUDIT artifact, not for code) + +- **G1** Every claim in ratified v3 carries `file:line` or a named measurement + (M1–M10), or is labelled CONJECTURE. +- **G2** No claim contradicts F1–F8 without an explicit VIOLATES finding. +- **G3** The verdict on C is one of: `REPURPOSABLE-AS-SPECIFIED` / + `REPURPOSABLE-WITH-AMENDMENTS` (each amendment named) / `NOT-REPURPOSABLE` + (with the blocking mechanism named at file:line). +- **G4** The M2 reader census is classified into + *ordering / uniqueness / display / **sequence*** — only the fourth is a + semantic blocker (a DN sorts hierarchically, not temporally, and that + failure still compiles). +- **G5** Zero files modified by this pass. `git status` clean but for the + audit document itself. + +--- + +## 6. PER-SAVANT QUESTION SETS + +### S1 — prior art (`prior-art-savant`) +1. Has a `NodeGuid::new` repurpose/retirement already been proposed, ruled on, + or partially landed anywhere in `.claude/board/`, `.claude/plans/`, or + `EPIPHANIES.md`? Cite the E-id / plan row. +2. Does `ISS-V1-TAIL-RESIDUE` or any open issue already own this? Its scope? +3. Is there prior art for a class whose key carries cascade while identity + lives in a value tenant (F5's shape)? Where? +4. Any DUPLICATE of the M1 44:1 finding already recorded? + +### S2 — iron rules (`iron-rule-savant`) +1. Does claim C violate `I-LEGACY-API-FEATURE-GATED`? Specifically: do the + V1 accessors (`family`/`identity`/`local_key`) become same-name-different- + semantics under a repurpose — the exact 5-instance Sprint-11 anti-pattern? +2. Does C violate F2 (layout-preserving) at any point? YES/NO + evidence. +3. Does C violate `RESERVE, DON'T RECLAIM` (F3)? +4. Does the V2/V3 shared mint arm (`canonical_node.rs:368+`, u16 asserts) + contradict F1's "always V3"? VIOLATES or CONFIRMS. + +### S3 — code truth (runtime-archaeologist charter, via `general-purpose`) +1. Verify EVERY file:line in §2. Report each as CODED / CLAIMED / ABSENT. +2. Is `NodeGuid::new` reachable from any PRODUCTION path in lance-graph + itself (not tests, not MedCare)? Cite call sites. +3. Are the 66 M2 readers real reads of `key.identity()`, or do some read a + different `identity()`? Give the true count. +4. Does anything in-tree already consume `CascadeShape::G4D3`? file:line. +5. Is `ZIPPER_ISA_DEPTH` / `inherited_part_of` reachable from a production + route, or dormant? (F5 says nobody walks — verify the CODE agrees.) + +### S4 — cascade impact (`cascade-impact-savant`) +1. Enumerate every file/test/doc/board row that MUST change if C lands. + Split mandatory-pre-merge vs informational-follow-up. +2. Which of the M2 readers fall in each G4 bucket (ordering / uniqueness / + display / sequence)? Name the sequence ones at file:line — they are the + blocking set. +3. Which committed golden fixtures or `.soa` artifacts would be invalidated? +4. Does any CROSS-REPO consumer (tesseract-rs, stockfish-rs, lance-graph-java, + a2ui-rs, OGAR) read a `NodeGuid` field that C changes? + +### S5 — different views (`creative-explorer-savant`) +1. What is the strongest reading under which C is the WRONG move — i.e. what + does V1's `family`/`identity` split buy that a cascade reading loses? +2. Is there a second-order consequence of C that the spec has not named? +3. Given F5, is "repurpose `NodeGuid::new`" even the right unit of change, or + is the real unit something else? (Name it. Do NOT design it.) +4. What would make this audit's verdict WRONG in six months? + +--- + +## 7. Council roster (8) + +**Phase 1 — the 5 (parallel, Sonnet, read-only):** S1 `prior-art-savant`, +S2 `iron-rule-savant`, S3 `general-purpose` (runtime-archaeologist charter), +S4 `cascade-impact-savant`, S5 `creative-explorer-savant`. + +**Phase 3 — the 3 (parallel, on draft v2 ONLY):** `overclaim-auditor`, +`dilution-collapse-sentinel`, `firewall-warden`. + +Savants are READ-ONLY and write no repo file. The orchestrator is the sole +writer. No savant runs `cargo` (shared `target/`, workspace rule). From 70dd3067a7af58efc39983944ce6594900755128 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 14:21:26 +0000 Subject: [PATCH 2/6] =?UTF-8?q?board:=20#1201=20merged=20hygiene-only=20?= =?UTF-8?q?=E2=80=94=20the=20SPEC=20v1=20commit=20was=20orphaned,=20not=20?= =?UTF-8?q?merged?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The arc entry for #1201 carried a self-correction saying the PR "merged MIXED" because the council SPEC v1 commit was pushed to it after its body was written. Measured today, that correction was itself wrong: `git merge-base --is-ancestor 3dd98b2b origin/main` says NO, and neither the plan file nor its INTEGRATION_PLANS prepend nor its STATUS_BOARD D-NGN-AUDIT row is on main. #1201 merged hygiene-only, exactly as its own body said. The commit was orphaned by a `git checkout -B origin/main` run while it was still unmerged. Recovered from `git fsck --lost-found` and cherry-picked forward, so nothing is lost — but for a day the board cited a plan file that existed nowhere, which is the failure the citation gate exists to catch and could not, because the citation was to a path rather than a symbol. The generalizable half, recorded in the entry: `git log origin/main..` returning EMPTY is not evidence that nothing is unmerged. After a reset it is empty by construction, and that is precisely the moment work has been orphaned. The check belongs before the reset, or against the reflog. Board hygiene same-commit: PR_ARC_INVENTORY correction line appended (the entry stays; it is the receipt), LATEST_STATE row and narrative corrected. Supersession index regenerated after the board writes; byte-identical. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/LATEST_STATE.md | 8 +++++--- .claude/board/PR_ARC_INVENTORY.md | 14 ++++++++++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/.claude/board/LATEST_STATE.md b/.claude/board/LATEST_STATE.md index 564825868..ed3b8f7e7 100644 --- a/.claude/board/LATEST_STATE.md +++ b/.claude/board/LATEST_STATE.md @@ -200,11 +200,13 @@ fence hardening, neither a migration regression. | PR | merge | content | |---|---|---| -| **#1201** | `54285a42` | #1199 post-merge records; `.claude/plans/nodeguid-new-repurpose-audit-v1.md` (5+3 council SPEC v1, READ-ONLY audit); `INTEGRATION_PLANS` + `STATUS_BOARD` D-NGN-AUDIT. | +| **#1201** | `54285a42` | #1199 post-merge records. **Hygiene-only** — the SPEC v1 commit did NOT land here (corrected 2026-09-07; see the arc entry). | **Contract inventory net delta: none.** No type, no API, no layout. The PR -merged MIXED despite its body saying hygiene-only — the spec commit was pushed -after that sentence was written; see the arc entry. The council is HELD at +merged hygiene-only, as its body said. An earlier record here claimed it merged +MIXED with the council SPEC v1; measured 2026-09-07, that commit was never an +ancestor of `main` — it was orphaned by a branch reset and has since been +recovered and cherry-picked forward. The council is HELD at Phase 2 on a VIOLATES against a frozen decision (`GET /views/graph/wave.abi` reaches `inherited_part_of`, contradicting *"Nobody walks anything"*), which is the operator's to rule on. Draft v2 additionally owes F9, the dating rule from diff --git a/.claude/board/PR_ARC_INVENTORY.md b/.claude/board/PR_ARC_INVENTORY.md index 0b1746468..1216a49b3 100644 --- a/.claude/board/PR_ARC_INVENTORY.md +++ b/.claude/board/PR_ARC_INVENTORY.md @@ -186,6 +186,20 @@ - **Confidence:** High on every file:line (S3 verified the entire §2 inventory CODED, no row wrong). The audit itself reaches NO verdict yet — Phase 2 is held, and nothing was implemented. +- **CORRECTION 2026-09-07 — the SPEC v1 commit did NOT land in #1201.** The + "Added" line above says it "landed in it afterwards, making it MIXED". Measured + after a branch reset: `git merge-base --is-ancestor 3dd98b2b origin/main` says + NO, and neither the plan file, the `INTEGRATION_PLANS` prepend nor the + `STATUS_BOARD` `D-NGN-AUDIT` row is present on `main`. **#1201 merged + hygiene-only after all** — its own body was right and this entry's correction + was wrong. The commit was orphaned by a `git checkout -B origin/main` + run while it was unmerged; recovered from `git fsck --lost-found` and + cherry-picked forward, so the content is not lost — but for one day the board + cited a plan file that existed nowhere. + **The generalizable half:** `git log origin/main..` returning EMPTY is + not evidence that nothing is unmerged — it is empty *by construction* after a + reset, which is exactly when work has just been orphaned. The check has to run + BEFORE the reset, or against the reflog. This entry stays; it is the receipt. ## 2026-09-06 — lance-graph PR #1199 (merged `ef724878`, branch `claude/great-curie-d2ufyl`) — the `AlphaMask::zip` guard that was compiled out of release From 92eb2f96242136235e99d6ab8fb6fca05c2d0281 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 14:24:34 +0000 Subject: [PATCH 3/6] plans: give D-NGN-AUDIT a home in the plan that owns it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI's "New plans carry D-ids" gate (added in the drift since #1203) failed on the restored SPEC v1. It was right: the D-id existed only as a STATUS_BOARD row, never in the plan itself, so the plan was invisible to the supersession index's coverage column — it had nothing to count. Reproduced locally with `python3 .claude/tools/plan_dids.py ` before the fix (exit 1, "MISSING D-id") and after (exit 0). One D-id, and the plan now says why: a council produces one indivisible answer — a repurpose is sound or it is not — so the reasons are that answer's body, not separable sub-deliverables. Also corrects the STATUS_BOARD row's PR pointer, which still read #1201. The spec never merged there; it is in #1217. Supersession index regenerated after the board write; byte-identical. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/STATUS_BOARD.md | 2 +- .claude/plans/nodeguid-new-repurpose-audit-v1.md | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 14177721f..ee0482401 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -20,7 +20,7 @@ identity) is real and probe-gated. | D-MW-P2 | **MemWAL crash-atomicity probe** (`crates/lance-graph/tests/memwal_atomicity_probe.rs`): the one measurement `.claude/temporal/08-memwal-vs-batchwriter.md` named as overturning its FOLD verdict — SIGKILL mid-flush on a 5 000-row put | **In PR** #1198. **GREEN.** A1 clean-drop control 5000; A2 SIGKILL sweep 5–500 ms → `0,0,0,5000,5000,5000,5000`. Boundary bracketed on both sides, no partial batch. FOLD stands. Scope recorded as NOT settled: one put, local store, no concurrent writers, no fencing path, and NOT the landing-rows-plus-frame-row composite (that is `LanceCycleWriter`'s, which has zero callers) | | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it | | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE | -| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **In PR** #1201, SPEC v1, council in flight. Phase 1 cast (5 savants); v2 consolidation + 3 reviewers pending. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) | +| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **In PR** #1217, SPEC v1, council in flight (the spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only). Phase 1 cast (5 savants); v2 consolidation + 3 reviewers pending. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) | | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** | | D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) | | D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites | diff --git a/.claude/plans/nodeguid-new-repurpose-audit-v1.md b/.claude/plans/nodeguid-new-repurpose-audit-v1.md index 07fb7d38d..46894edac 100644 --- a/.claude/plans/nodeguid-new-repurpose-audit-v1.md +++ b/.claude/plans/nodeguid-new-repurpose-audit-v1.md @@ -1,5 +1,10 @@ # SPEC v1 — `NodeGuid::new` repurpose audit (5+3 council, READ-ONLY) +**Deliverable:** `D-NGN-AUDIT` — the audit verdict itself, not a change. One +D-id, because the council produces one indivisible answer: a repurpose is +sound, or it is not, and the reasons are that answer's body rather than +separable sub-deliverables. Tracked in `.claude/board/STATUS_BOARD.md`. + **Status:** SPEC v1, Phase 0. **Nothing is implemented. Nothing may be changed.** The deliverable of this council is an AUDIT — a verdict on whether `NodeGuid::new` can be repurposed, at what cost, and what would break. No From 7c056f401a2bcbefaaddb2d716e6d37a8df550a9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 17:18:05 +0000 Subject: [PATCH 4/6] =?UTF-8?q?board:=20three=20codex=20P2s=20=E2=80=94=20?= =?UTF-8?q?the=20heading,=20the=20dashboard,=20and=20the=20missing=20EPIPH?= =?UTF-8?q?ANIES=20entry?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All three verified against the files before fixing; all three were right. 1. LATEST_STATE's #1201 heading still read "#1199's records + the council SPEC v1" directly above the row correcting exactly that claim. A reader scanning by heading received the false merge history the commit exists to repair — the sharpest of the three, because the correction was sitting one line under the thing it contradicted. 2. STATUS_BOARD's D-NGN-AUDIT row still read "Phase 1 cast; v2 consolidation + 3 reviewers pending". Phase 1 has RETURNED; the council is held at Phase 2 on a VIOLATES against F5 that is the operator's to rule. The dashboard is what a later session reads first, so a stale phase there invites re-casting five savants that already reported. The row now says HELD, why, and — explicitly — do not re-cast Phase 1 and do not cast the reviewers until the ruling lands. 3. No EPIPHANIES entry for the correction. CLAUDE.md's board-hygiene table requires a finding/correction to prepend one in the SAME commit, and the generalizable half was living only in an arc entry, which is organized by PR rather than by finding. Added E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1: `origin/main..` answers a question about the branch's CURRENT tip, so after a reset it is empty by construction — the symptom of the loss is indistinguishable from the all-clear. Verify unmerged work against a ref the operation cannot move. It carries the second half too, which no gate catches today: the board cited a PATH, not a symbol, so a plan file that existed nowhere read as a valid reference for a day. An absent symbol fails citation-decay; an absent path does not. Gates run locally: plan_dids exit 0; append-only verified by line count (EPIPHANIES 27617 -> 27661, PR_ARC unchanged); supersession index regenerated AFTER the board writes — EPIPHANIES is one of its inputs — and byte-identical. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/EPIPHANIES.md | 44 +++++++++++++++++++++++++++++++++++ .claude/board/LATEST_STATE.md | 2 +- .claude/board/STATUS_BOARD.md | 2 +- 3 files changed, 46 insertions(+), 2 deletions(-) diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index 551a2f91f..858f8e1a4 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -1,3 +1,47 @@ +## 2026-09-07 — E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1 — the check that certified the loss it was run to prevent + +**Status:** FINDING, measured. The orphaned commit was recovered; the board it +mis-recorded is corrected in the same PR (#1217). +**Confidence:** High — `git merge-base --is-ancestor` and `git fsck` both +executed, and the recovered commit is byte-identical to what was written. + +**What happened.** `.claude/plans/nodeguid-new-repurpose-audit-v1.md` — SPEC v1 +of the 5+3 council auditing a `NodeGuid::new` repurpose — was committed +(`3dd98b2b`), then orphaned by a `git checkout -B origin/main` run +while it was still unmerged. It never reached `main`. + +**The check I ran was real, and it certified the loss.** Before the *second* +reset I ran `git log --oneline origin/main..claude/great-curie-d2ufyl`, read the +empty output as "nothing unmerged to preserve", and proceeded. The output was +empty **by construction**: an earlier reset had already re-pointed the branch AT +`origin/main`, so the range was empty precisely BECAUSE work had just been +orphaned. **The symptom of the failure is indistinguishable from the all-clear.** + +**The rule.** `origin/main..` answers "what does this branch carry that +main does not" — a question about the branch's CURRENT tip, which a reset has +already destroyed. The check has to run BEFORE the reset, or against +`git reflog `, which is the only local record that survives one. State +the same thing positively: **verify unmerged work against a ref the operation +you are about to perform cannot move.** + +**The second half — a stale record that no gate could catch.** The board then +recorded the opposite of the truth: #1201's arc entry carried a self-correction +saying that PR "merged MIXED" because the spec commit was pushed to it +afterwards. It was not; #1201 merged hygiene-only, exactly as its own body said, +and for a day `LATEST_STATE` and `PR_ARC_INVENTORY` cited a plan file that +existed nowhere. **The citation-decay gate could not see it, because the board +cited a PATH, not a SYMBOL** — an absent file reads as a valid reference where +an absent symbol does not. Same shape as the citation-decay failure on #1203, +one level up: a coordinate in a moving frame, trusted as an anchor. + +**Consequence, narrow and mechanical:** a board citation to a plan or artifact is +only as strong as something that fails when the target is gone. Until a +path-existence check exists, a PR that adds a board reference to a file should +be the same PR that adds the file — never a later one, and never a claim that a +prior PR added it. + +--- + ## 2026-09-07 — E-PLUG-AND-PLAY-IS-THE-DECLARATION-NOT-A-TABLE-1 — my fix rebuilt the lockstep it was closing **Status:** FINDING, measured. Fixed in this PR (7 tests, both guards disable-verified). diff --git a/.claude/board/LATEST_STATE.md b/.claude/board/LATEST_STATE.md index ed3b8f7e7..43f809d4b 100644 --- a/.claude/board/LATEST_STATE.md +++ b/.claude/board/LATEST_STATE.md @@ -196,7 +196,7 @@ writing nothing, reconcile-unavailable ⇒ `Ambiguous`). `#911 → #912 → valve (no artifact-backed change ⇒ no sink call ⇒ no version), `1d416704` is fence hardening, neither a migration regression. -## 2026-09-06 — #1201 MERGED (54285a42): #1199's records + the council SPEC v1 +## 2026-09-06 — #1201 MERGED (54285a42): #1199's records (hygiene-only; the SPEC v1 did NOT land here — corrected 2026-09-07) | PR | merge | content | |---|---|---| diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index ee0482401..e5e476cfc 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -20,7 +20,7 @@ identity) is real and probe-gated. | D-MW-P2 | **MemWAL crash-atomicity probe** (`crates/lance-graph/tests/memwal_atomicity_probe.rs`): the one measurement `.claude/temporal/08-memwal-vs-batchwriter.md` named as overturning its FOLD verdict — SIGKILL mid-flush on a 5 000-row put | **In PR** #1198. **GREEN.** A1 clean-drop control 5000; A2 SIGKILL sweep 5–500 ms → `0,0,0,5000,5000,5000,5000`. Boundary bracketed on both sides, no partial batch. FOLD stands. Scope recorded as NOT settled: one put, local store, no concurrent writers, no fencing path, and NOT the landing-rows-plus-frame-row composite (that is `LanceCycleWriter`'s, which has zero callers) | | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it | | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE | -| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **In PR** #1217, SPEC v1, council in flight (the spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only). Phase 1 cast (5 savants); v2 consolidation + 3 reviewers pending. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) | +| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **HELD at Phase 2**, PR #1217. Phase 1 RETURNED (all 5 savants); consolidation is held on a VIOLATES against frozen decision F5 (*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches `inherited_part_of` — which is the operator's to rule, not the orchestrator's to resolve. **Do NOT re-cast Phase 1, and do not cast the 3 reviewers until that ruling lands.** Draft v2 also owes F9 (the #1202 dating rule). The spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) | | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** | | D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) | | D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites | From 03e6dbea073f6dc2819dde200cee51c7e26db677 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 17:20:17 +0000 Subject: [PATCH 5/6] board: restore the #1201 entry verbatim and prepend the correction instead MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit and codex gave opposite instructions on the same line — codex asked me to rename the stale #1201 heading in place, CodeRabbit to restore the entry and prepend a dated correction. Adjudicated against CLAUDE.md rather than by picking a bot, and they split three ways: - **LATEST_STATE — CodeRabbit is right, and codex's fix pushed me further into the violation.** The #1201 block is a DATED HISTORICAL section, and the rule is "never edit past entries except the Status / Confidence lines". I had edited the row, the narrative and then the heading. All three are restored; the section is now byte-identical to `aeebfb23`, verified by comparison, wrong sentence included — it is the receipt. A dated correction section sits ABOVE it, which is what reverse-chronological ordering is for and which also meets codex's actual concern: a reader scanning by heading now hits the correction first. - **PR_ARC_INVENTORY — CodeRabbit is wrong.** Its rule is not the general one: "APPEND-ONLY; only the Confidence line is updatable; **corrections append as new dated lines**". A dated correction line appended inside the entry is precisely what is prescribed. Unchanged. - **STATUS_BOARD — CodeRabbit is wrong.** It is a live dashboard, not a historical ledger: the hygiene table specifies "row (status = Queued -> In progress -> In PR -> Shipped)", an explicit in-place lifecycle. A prepended duplicate row would give one D-id two statuses. Unchanged. (That thread is also already marked outdated.) Also CodeRabbit on the plan: its premise — that the spec "mixes implementation status with council stages" — is false; Phase 0/1/2/3 are one ladder, the 5+3 harness's own. But nothing said so, which is why two reviewers read it as two systems. The spec now states the ladder and points at the harness. Gates: plan_dids exit 0; LATEST_STATE grew 3462 -> 3482; supersession index regenerated after the board writes, byte-identical. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/LATEST_STATE.md | 32 +++++++++++++++---- .../plans/nodeguid-new-repurpose-audit-v1.md | 9 ++++++ 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/.claude/board/LATEST_STATE.md b/.claude/board/LATEST_STATE.md index 43f809d4b..7e23fbd1e 100644 --- a/.claude/board/LATEST_STATE.md +++ b/.claude/board/LATEST_STATE.md @@ -196,17 +196,37 @@ writing nothing, reconcile-unavailable ⇒ `Ambiguous`). `#911 → #912 → valve (no artifact-backed change ⇒ no sink call ⇒ no version), `1d416704` is fence hardening, neither a migration regression. -## 2026-09-06 — #1201 MERGED (54285a42): #1199's records (hygiene-only; the SPEC v1 did NOT land here — corrected 2026-09-07) +## 2026-09-07 — CORRECTION to the #1201 entry below: it merged HYGIENE-ONLY | PR | merge | content | |---|---|---| -| **#1201** | `54285a42` | #1199 post-merge records. **Hygiene-only** — the SPEC v1 commit did NOT land here (corrected 2026-09-07; see the arc entry). | +| **#1201** | `54285a42` | #1199 post-merge records **only**. The council SPEC v1 did NOT land here. | + +The #1201 section below says the PR "merged MIXED" because the SPEC v1 commit +was pushed to it. **That is false**, measured 2026-09-07: +`git merge-base --is-ancestor 3dd98b2b origin/main` → NO, and neither the plan +file, nor its `INTEGRATION_PLANS` prepend, nor its `STATUS_BOARD` `D-NGN-AUDIT` +row was present on `main`. #1201 merged hygiene-only, exactly as its own body +said — the body was right and the entry's self-correction was wrong. + +The commit was orphaned by a `git checkout -B origin/main` run while it +was still unmerged; recovered from `git fsck --lost-found` and cherry-picked +forward in #1217. Finding + the generalizable rule: +`EPIPHANIES.md` `E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1`. + +The section below is left **verbatim**, wrong sentence included — it is the +receipt, and this file is append-only (`CLAUDE.md`: *"never edit past entries +except the Status / Confidence lines"*). Read it through this correction. + +## 2026-09-06 — #1201 MERGED (54285a42): #1199's records + the council SPEC v1 + +| PR | merge | content | +|---|---|---| +| **#1201** | `54285a42` | #1199 post-merge records; `.claude/plans/nodeguid-new-repurpose-audit-v1.md` (5+3 council SPEC v1, READ-ONLY audit); `INTEGRATION_PLANS` + `STATUS_BOARD` D-NGN-AUDIT. | **Contract inventory net delta: none.** No type, no API, no layout. The PR -merged hygiene-only, as its body said. An earlier record here claimed it merged -MIXED with the council SPEC v1; measured 2026-09-07, that commit was never an -ancestor of `main` — it was orphaned by a branch reset and has since been -recovered and cherry-picked forward. The council is HELD at +merged MIXED despite its body saying hygiene-only — the spec commit was pushed +after that sentence was written; see the arc entry. The council is HELD at Phase 2 on a VIOLATES against a frozen decision (`GET /views/graph/wave.abi` reaches `inherited_part_of`, contradicting *"Nobody walks anything"*), which is the operator's to rule on. Draft v2 additionally owes F9, the dating rule from diff --git a/.claude/plans/nodeguid-new-repurpose-audit-v1.md b/.claude/plans/nodeguid-new-repurpose-audit-v1.md index 46894edac..10df668cc 100644 --- a/.claude/plans/nodeguid-new-repurpose-audit-v1.md +++ b/.claude/plans/nodeguid-new-repurpose-audit-v1.md @@ -5,6 +5,15 @@ D-id, because the council produces one indivisible answer: a repurpose is sound, or it is not, and the reasons are that answer's body rather than separable sub-deliverables. Tracked in `.claude/board/STATUS_BOARD.md`. +**Phase numbering — ONE ladder, not two.** Every "Phase N" in this spec and in +both board entries is the 5+3 harness's own stage +(`.claude/skills/5plus3` / `.claude/agents/5plus3-council.md`): **0** write the +spec · **1** cast the five savants · **2** consolidate into draft v2 · **3** +cast the three reviewers on v2 ONLY · **4** fix · **5** ratify to v3 and land. +There is no separate implementation-status numbering to confuse it with, and the +strict order is the anti-mush protocol — Phase 3 never runs before Phase 2 +closes. + **Status:** SPEC v1, Phase 0. **Nothing is implemented. Nothing may be changed.** The deliverable of this council is an AUDIT — a verdict on whether `NodeGuid::new` can be repurposed, at what cost, and what would break. No From 5e6069f627d8ade6e1fc8ab622def1cb03518600 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 17:22:41 +0000 Subject: [PATCH 6/6] =?UTF-8?q?board:=20the=20third=20record=20of=20the=20?= =?UTF-8?q?same=20fact=20=E2=80=94=20INTEGRATION=5FPLANS=20still=20said=20?= =?UTF-8?q?Phase=201?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit caught what I missed: D-NGN-AUDIT is recorded in THREE places, and I updated two. STATUS_BOARD and the spec both say HELD at Phase 2; the INTEGRATION_PLANS entry still read "Phase 1 cast (5 savants). Consolidation to v2 and the 3 reviewers follow." A later session reading the plan index rather than the dashboard would have re-cast a council that already reported. Edited in place rather than prepended, and the distinction is the one this PR has been arguing all along: this entry is THIS PR's own unmerged content (added in 96c80937, verified absent from aeebfb23), so it is a draft being corrected, not a merged historical record being rewritten. Append-only governs what has landed. The lesson worth keeping is about the shape of the miss, not the text: one fact lived in three records, and updating "the board" meant updating whichever file the finding pointed at. A finding names a symptom; the fix is the fact, and the fact has to be chased to every place it is written down. Gates: supersession index regenerated after the board write, byte-identical; INTEGRATION_PLANS grew 3355 -> 3362. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EfrUJH3UNnv5NpDH4jDGHq --- .claude/board/INTEGRATION_PLANS.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.claude/board/INTEGRATION_PLANS.md b/.claude/board/INTEGRATION_PLANS.md index 76ef9fe37..d66c97241 100644 --- a/.claude/board/INTEGRATION_PLANS.md +++ b/.claude/board/INTEGRATION_PLANS.md @@ -21,8 +21,15 @@ ordering/uniqueness/display/**sequence** classification of the identity() readers — only the sequence bucket is a semantic blocker, because a DN sorts hierarchically and that failure still compiles. -Status: Phase 1 cast (5 savants). Consolidation to v2 and the 3 reviewers -follow. Superseded by v2/v3 when they land. +Status: **HELD at Phase 2.** Phase 1 has RETURNED (all five savants); +consolidation into draft v2 is held on a VIOLATES against frozen decision F5 +(*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches +`inherited_part_of` — which is the operator's to rule, not the orchestrator's to +resolve. Do NOT re-cast Phase 1, and do not cast the three reviewers (Phase 3) +until that ruling lands; the strict order is the harness's anti-mush protocol. +Draft v2 also owes F9, the #1202 dating rule. Phase numbering is the 5+3 +harness's single 0-5 ladder (`.claude/agents/5plus3-council.md`), stated in the +plan's own header. Superseded by v2/v3 when they land. ## 2026-09-06 — temporal / delta / alpha staged plan → `.claude/temporal/09-plan.md`