Recover the orphaned council SPEC v1, and correct #1201's arc entry

.claude/board/EPIPHANIES.md

@@ -1,3 +1,46 @@
+## 2026-09-07 — E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1 — the check that certified the loss it was run to prevent
+
+**Status:** FINDING, measured. The orphaned commit was recovered; the board it
+mis-recorded is corrected in the same PR (#1217).
+**Confidence:** High — `git merge-base --is-ancestor` and `git fsck` both
+executed, and the recovered commit is byte-identical to what was written.
+
+**What happened.** `.claude/plans/nodeguid-new-repurpose-audit-v1.md` — SPEC v1
+of the 5+3 council auditing a `NodeGuid::new` repurpose — was committed
+(`3dd98b2b`), then orphaned by a `git checkout -B <branch> origin/main` run
+while it was still unmerged. It never reached `main`.
+
+**The check I ran was real, and it certified the loss.** Before the *second*
+reset I ran `git log --oneline origin/main..claude/great-curie-d2ufyl`, read the
+empty output as "nothing unmerged to preserve", and proceeded. The output was
+empty **by construction**: an earlier reset had already re-pointed the branch AT
+`origin/main`, so the range was empty precisely BECAUSE work had just been
+orphaned. **The symptom of the failure is indistinguishable from the all-clear.**
+
+**The rule.** `origin/main..<branch>` answers "what does this branch carry that
+main does not" — a question about the branch's CURRENT tip, which a reset has
+already destroyed. The check has to run BEFORE the reset, or against
+`git reflog <branch>`, which is the only local record that survives one. State
+the same thing positively: **verify unmerged work against a ref the operation
+you are about to perform cannot move.**
+
+**The second half — a stale record that no gate could catch.** The board then
+recorded the opposite of the truth: #1201's arc entry carried a self-correction
+saying that PR "merged MIXED" because the spec commit was pushed to it
+afterwards. It was not; #1201 merged hygiene-only, exactly as its own body said,
+and for a day `LATEST_STATE` and `PR_ARC_INVENTORY` cited a plan file that
+existed nowhere. **The citation-decay gate could not see it, because the board
+cited a PATH, not a SYMBOL** — an absent file reads as a valid reference where
+an absent symbol does not. Same shape as the citation-decay failure on #1203,
+one level up: a coordinate in a moving frame, trusted as an anchor.
+
+**Consequence, narrow and mechanical:** a board citation to a plan or artifact is
+only as strong as something that fails when the target is gone. Until a
+path-existence check exists, a PR that adds a board reference to a file should
+be the same PR that adds the file — never a later one, and never a claim that a
+prior PR added it.
+
+---
 ## 2026-09-07 — E-A-PLAN-INVENTORY-FINDS-THE-BOARD-LAGS-THE-TREE-IN-BOTH-DIRECTIONS-1 — status cells decay at the rate of the tree, not of the file
 
 **Status:** FINDING, measured (five read-only Sonnet agents; every claim below re-verified by the orchestrator at a tree line, not a tag-file line). Full census: `.claude/board/PLAN-INVENTORY-2026-09-07.md`; evidence: `exec-runs/plan-inventory-2026-09-07-*.md`.

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,36 @@
+## 2026-09-06 — `NodeGuid::new` repurpose AUDIT (5+3 council, READ-ONLY) → `.claude/plans/nodeguid-new-repurpose-audit-v1.md`
+
+SPEC v1 of a council convened to AUDIT — not implement — whether
+`NodeGuid::new` can be repurposed from the V1 mint into a V3 cascade
+constructor. **Operator constraint, verbatim: *"It's already in production, if
+you touch it it would change something you half understand."*** Nothing is
+built from this pass; the deliverable is a verdict.
+
+The spec carries a §0 **RETRACTED READINGS** table — four FALSE readings the
+orchestrator produced before writing it (each from an accessor NAME or a byte
+HISTOGRAM instead of the class's declared schema), banked so the council does
+not re-derive them and no finding cites them as context. `ogar-obo/src/layout.rs`
+exists to prevent exactly that failure and says so: *"the classid picks the
+reading … a reader never assumes a carve."*
+
+Frozen (F1-F8) includes the operator's architecture: **first two tenants = the
+distinguished name; the 4x24-bit Quad Identitaet is a VALUE tenant; the O(1)
+lookup is the quad; the depth-16 path (12+4) serves parent-child inheritance
+and HHTL; "Nobody walks anything."** Gates G1-G5 include G4, the
+ordering/uniqueness/display/**sequence** classification of the identity()
+readers — only the sequence bucket is a semantic blocker, because a DN sorts
+hierarchically and that failure still compiles.
+
+Status: **HELD at Phase 2.** Phase 1 has RETURNED (all five savants);
+consolidation into draft v2 is held on a VIOLATES against frozen decision F5
+(*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches
+`inherited_part_of` — which is the operator's to rule, not the orchestrator's to
+resolve. Do NOT re-cast Phase 1, and do not cast the three reviewers (Phase 3)
+until that ruling lands; the strict order is the harness's anti-mush protocol.
+Draft v2 also owes F9, the #1202 dating rule. Phase numbering is the 5+3
+harness's single 0-5 ladder (`.claude/agents/5plus3-council.md`), stated in the
+plan's own header. Superseded by v2/v3 when they land.
+
 ## 2026-09-06 — temporal / delta / alpha staged plan → `.claude/temporal/09-plan.md`
 
 Staged and probe-gated: Stage 1 compact alpha resident form (no addressing, no

.claude/board/LATEST_STATE.md

@@ -204,6 +204,28 @@ writing nothing, reconcile-unavailable ⇒ `Ambiguous`). `#911 → #912 →
 valve (no artifact-backed change ⇒ no sink call ⇒ no version), `1d416704` is
 fence hardening, neither a migration regression.
 
+## 2026-09-07 — CORRECTION to the #1201 entry below: it merged HYGIENE-ONLY
+
+| PR | merge | content |
+|---|---|---|
+| **#1201** | `54285a42` | #1199 post-merge records **only**. The council SPEC v1 did NOT land here. |
+
+The #1201 section below says the PR "merged MIXED" because the SPEC v1 commit
+was pushed to it. **That is false**, measured 2026-09-07:
+`git merge-base --is-ancestor 3dd98b2b origin/main` → NO, and neither the plan
+file, nor its `INTEGRATION_PLANS` prepend, nor its `STATUS_BOARD` `D-NGN-AUDIT`
+row was present on `main`. #1201 merged hygiene-only, exactly as its own body
+said — the body was right and the entry's self-correction was wrong.
+
+The commit was orphaned by a `git checkout -B <branch> origin/main` run while it
+was still unmerged; recovered from `git fsck --lost-found` and cherry-picked
+forward in #1217. Finding + the generalizable rule:
+`EPIPHANIES.md` `E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1`.
+
+The section below is left **verbatim**, wrong sentence included — it is the
+receipt, and this file is append-only (`CLAUDE.md`: *"never edit past entries
+except the Status / Confidence lines"*). Read it through this correction.
+
 ## 2026-09-06 — #1201 MERGED (54285a42): #1199's records + the council SPEC v1
 
 | PR | merge | content |

.claude/board/PR_ARC_INVENTORY.md

@@ -186,6 +186,20 @@
 - **Confidence:** High on every file:line (S3 verified the entire §2 inventory
   CODED, no row wrong). The audit itself reaches NO verdict yet — Phase 2 is
   held, and nothing was implemented.
+- **CORRECTION 2026-09-07 — the SPEC v1 commit did NOT land in #1201.** The
+  "Added" line above says it "landed in it afterwards, making it MIXED". Measured
+  after a branch reset: `git merge-base --is-ancestor 3dd98b2b origin/main` says
+  NO, and neither the plan file, the `INTEGRATION_PLANS` prepend nor the
+  `STATUS_BOARD` `D-NGN-AUDIT` row is present on `main`. **#1201 merged
+  hygiene-only after all** — its own body was right and this entry's correction
+  was wrong. The commit was orphaned by a `git checkout -B <branch> origin/main`
+  run while it was unmerged; recovered from `git fsck --lost-found` and
+  cherry-picked forward, so the content is not lost — but for one day the board
+  cited a plan file that existed nowhere.
+  **The generalizable half:** `git log origin/main..<branch>` returning EMPTY is
+  not evidence that nothing is unmerged — it is empty *by construction* after a
+  reset, which is exactly when work has just been orphaned. The check has to run
+  BEFORE the reset, or against the reflog. This entry stays; it is the receipt.
 
 ## 2026-09-06 — lance-graph PR #1199 (merged `ef724878`, branch `claude/great-curie-d2ufyl`) — the `AlphaMask::zip` guard that was compiled out of release
 

.claude/board/STATUS_BOARD.md

@@ -20,6 +20,7 @@ identity) is real and probe-gated.
 | D-MW-P2 | **MemWAL crash-atomicity probe** (`crates/lance-graph/tests/memwal_atomicity_probe.rs`): the one measurement `.claude/temporal/08-memwal-vs-batchwriter.md` named as overturning its FOLD verdict — SIGKILL mid-flush on a 5 000-row put | ~~**In PR** #1198~~ **Shipped** (#1198 merged `3797237b`; cell regraded 2026-09-07 plan inventory). **GREEN.** A1 clean-drop control 5000; A2 SIGKILL sweep 5–500 ms → `0,0,0,5000,5000,5000,5000`. Boundary bracketed on both sides, no partial batch. FOLD stands. Scope recorded as NOT settled: one put, local store, no concurrent writers, no fencing path, and NOT the landing-rows-plus-frame-row composite (that is `LanceCycleWriter`'s, which has zero callers) |
 | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it |
 | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE |
+| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **HELD at Phase 2**, PR #1217. Phase 1 RETURNED (all 5 savants); consolidation is held on a VIOLATES against frozen decision F5 (*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches `inherited_part_of` — which is the operator's to rule, not the orchestrator's to resolve. **Do NOT re-cast Phase 1, and do not cast the 3 reviewers until that ruling lands.** Draft v2 also owes F9 (the #1202 dating rule). The spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) |
 | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** |
 | D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) |
 | D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites |