Post-merge records for #1217

.claude/board/LATEST_STATE.md

@@ -1,3 +1,32 @@
+## 2026-09-07 — #1217 MERGED (b518dbf1): the orphaned SPEC v1, recovered — and the check that certified its loss
+
+| PR | merge | content |
+|---|---|---|
+| **#1217** | `b518dbf1` | `.claude/plans/nodeguid-new-repurpose-audit-v1.md` (SPEC v1, `D-NGN-AUDIT`, recovered from `git fsck`); `EPIPHANIES` `E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1`; `INTEGRATION_PLANS` prepend; dated corrections to the #1201 record in `LATEST_STATE` + `PR_ARC_INVENTORY`. |
+
+**Contract inventory net delta: none.** No type, no API, no layout, no code.
+
+The spec was orphaned by a `git checkout -B <branch> origin/main` while unmerged,
+and `git log origin/main..<branch>` read EMPTY — not as evidence of safety but
+*by construction*, because an earlier reset had already re-pointed the branch.
+Use `git merge-base --is-ancestor` or the reflog: a ref the operation cannot
+move. The #1201 entry's "merged MIXED" self-correction is retracted; it merged
+hygiene-only, as its body said.
+
+Append-only mechanics adjudicated (two review bots asked for opposite changes on
+one line): `LATEST_STATE` dated sections are historical ⇒ restore + PREPEND;
+`PR_ARC_INVENTORY` ⇒ *"corrections append as new dated lines"*, in place;
+`STATUS_BOARD` ⇒ live dashboard, one row per D-id, in-place lifecycle.
+
+`D-NGN-AUDIT` remains **HELD at Phase 2** on the F5 VIOLATES — the operator's to
+rule. Measured for whoever rules it: the `wave.abi` path reads gz-TSV sidecar
+HashMaps (`obo_full_edges`, `obo_ro_edges`), NOT the declared `edge_lanes` slab
+and NOT DataFusion — the same class
+`E-EVERY-DOMAIN-IS-A-TABLE-AND-A-CROSSWALK-IS-A-CHAIN-OF-MASKS-1` names, with
+`obo_store.rs` among its six cited sites. SPEC §2's `canonical_node.rs` line
+numbers are stale after the `mint_for` V2/V3 drift; re-anchor to symbols before
+Phase 3.
+
 ## 2026-09-07 — plan inventory landed: `PLAN-INVENTORY-2026-09-07.md` + the V3 folder now sees the harvest
 
 - **New board document:** `.claude/board/PLAN-INVENTORY-2026-09-07.md` — 211 plans (149 OPEN / 13 CLOSED / 9 SUPERSEDED / 40 AMBIGUOUS), V3 waves W0–W6, ENTROPY M1–M27, W1a/W1b/W1.5 + jc pillars vs code, top-level `.claude/*.md` (71; 9 orphans), board dashboards. Mints no D-ids (a snapshot, not a plan). Evidence: five verbatim tag-files under `exec-runs/plan-inventory-2026-09-07-*.md`.

.claude/board/PR_ARC_INVENTORY.md

@@ -1,3 +1,64 @@
+## 2026-09-07 — lance-graph PR #1217 (merged `b518dbf1`, branch `claude/great-curie-d2ufyl`) — a commit orphaned by a reset, and a board that recorded the opposite
+
+- **Added:** `.claude/plans/nodeguid-new-repurpose-audit-v1.md` (5+3 council SPEC v1
+  for the `NodeGuid::new` repurpose audit, READ-ONLY, `D-NGN-AUDIT`), recovered
+  from `git fsck --lost-found` and cherry-picked — content identical to what was
+  written, nothing re-derived. Plus `EPIPHANIES`
+  `E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1`, the `INTEGRATION_PLANS`
+  prepend, the `STATUS_BOARD` `D-NGN-AUDIT` row, and a dated correction to the
+  #1201 record in both `LATEST_STATE` and this file.
+- **The finding.** SPEC v1 was committed (`3dd98b2b`) and then orphaned by a
+  `git checkout -B <branch> origin/main` run while it was still unmerged. It
+  never reached `main`. **The check that was supposed to prevent this certified
+  the loss instead:** `git log origin/main..<branch>` returned EMPTY, which was
+  read as "nothing unmerged" — but it was empty *by construction*, because an
+  earlier reset had already re-pointed the branch AT `origin/main`. The symptom
+  of the failure is indistinguishable from the all-clear. Correct check:
+  `git merge-base --is-ancestor <branch> origin/main`, or the reflog — a ref the
+  operation you are about to perform cannot move. (Applied to this PR's own
+  branch restart, which is how it should be read.)
+- **Corrected, about #1201.** That entry carried a self-correction saying the PR
+  "merged MIXED" because the spec commit was pushed to it. **False** — the
+  commit was never an ancestor of `main`, and #1201 merged hygiene-only exactly
+  as its own body said. The body was right; the correction was wrong. Both
+  records now carry dated corrections and the historical entries are left
+  verbatim.
+- **Locked (append-only mechanics, adjudicated against the rule text when two
+  review bots asked for opposite changes on the same line).** `LATEST_STATE`'s
+  dated per-PR sections are historical ⇒ restore verbatim and PREPEND the
+  correction; `PR_ARC_INVENTORY` has its own narrower rule (*"corrections append
+  as new dated lines"*) ⇒ append in place; `STATUS_BOARD` is a live dashboard
+  with an in-place lifecycle (`Queued → In progress → In PR → Shipped`) ⇒ one row
+  per D-id, never a prepended duplicate. CodeRabbit withdrew both findings it had
+  raised against the latter two and banked all three as repo learnings.
+- **The miss worth keeping.** `D-NGN-AUDIT` is recorded in THREE files and the
+  first pass updated two — the plan index still read "Phase 1 cast" while the
+  dashboard said HELD at Phase 2, which would have invited re-casting a council
+  that had already reported. **A review finding names a symptom in one file; the
+  fix is the fact, and the fact has to be chased to every record that states it.**
+- **What the citation gate could NOT catch:** the board cited a PATH, not a
+  symbol, so a plan file that existed nowhere read as a valid reference for a
+  day. An absent symbol fails citation-decay; an absent path does not. Same shape
+  as #1203's failure, one level up.
+- **Deferred / NOT in scope:** the council stays HELD at Phase 2 on the F5
+  VIOLATES (`wave.abi` → `inherited_part_of` vs *"Nobody walks anything"*),
+  which is the operator's to rule. Measured en route and recorded for whoever
+  rules it: that path reads gz-TSV sidecar HashMaps (`obo_full_edges`,
+  `obo_ro_edges`), **not** the declared `edge_lanes` slab and **not** DataFusion
+  — pre-flip residue and a second projection of edges the row already carries.
+  Note `E-EVERY-DOMAIN-IS-A-TABLE-AND-A-CROSSWALK-IS-A-CHAIN-OF-MASKS-1`
+  (operator-ruled, landed in #1218 and merged into this branch) names the same
+  class from the other end: *something decided once upstream, re-derived at read
+  time, per row* — and `obo_store.rs` is one of its six cited sites.
+- **Also flagged, not acted on:** 42 commits of drift moved `canonical_node.rs`
+  by +142 lines on `mint_for`'s V2/V3 arm — the exact unit three savants named.
+  SPEC §2's line numbers there are stale; Phase 3 should not be cast against v1
+  as written, and re-anchoring §2 to symbols is cheaper than re-running S3.
+- **Confidence:** High on every git fact (each executed, not inferred) and on the
+  three append-only readings (each quoted from `CLAUDE.md` and accepted by the
+  reviewer that had argued the opposite). The audit itself still reaches NO
+  verdict — nothing was implemented.
+
 ## 2026-09-07 — lance-graph PR #1211 (merged `c3bb095b`, branch `claude/ndarray-simd-tract-o3jfrn`) — the V1 guard was tested; the V3 guard that replaced it was not
 
 - **Added:** three tests in `crates/lance-graph-contract/src/canonical_node.rs`

.claude/board/STATUS_BOARD.md

@@ -20,7 +20,7 @@ identity) is real and probe-gated.
 | D-MW-P2 | **MemWAL crash-atomicity probe** (`crates/lance-graph/tests/memwal_atomicity_probe.rs`): the one measurement `.claude/temporal/08-memwal-vs-batchwriter.md` named as overturning its FOLD verdict — SIGKILL mid-flush on a 5 000-row put | ~~**In PR** #1198~~ **Shipped** (#1198 merged `3797237b`; cell regraded 2026-09-07 plan inventory). **GREEN.** A1 clean-drop control 5000; A2 SIGKILL sweep 5–500 ms → `0,0,0,5000,5000,5000,5000`. Boundary bracketed on both sides, no partial batch. FOLD stands. Scope recorded as NOT settled: one put, local store, no concurrent writers, no fencing path, and NOT the landing-rows-plus-frame-row composite (that is `LanceCycleWriter`'s, which has zero callers) |
 | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it |
 | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE |
-| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **HELD at Phase 2**, PR #1217. Phase 1 RETURNED (all 5 savants); consolidation is held on a VIOLATES against frozen decision F5 (*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches `inherited_part_of` — which is the operator's to rule, not the orchestrator's to resolve. **Do NOT re-cast Phase 1, and do not cast the 3 reviewers until that ruling lands.** Draft v2 also owes F9 (the #1202 dating rule). The spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) |
+| D-NGN-AUDIT | **`NodeGuid::new` repurpose audit** (5+3 council, `.claude/plans/nodeguid-new-repurpose-audit-v1.md`): can the V1 mint be repurposed as the V3 cascade constructor? READ-ONLY — operator: *"it's already in production, if you touch it it would change something you half understand."* | **HELD at Phase 2**; SPEC v1 SHIPPED in #1217 (`b518dbf1`). Phase 1 RETURNED (all 5 savants); consolidation is held on a VIOLATES against frozen decision F5 (*"Nobody walks anything"*) — `GET /views/graph/wave.abi` reaches `inherited_part_of` — which is the operator's to rule, not the orchestrator's to resolve. **Do NOT re-cast Phase 1, and do not cast the 3 reviewers until that ruling lands.** Draft v2 also owes F9 (the #1202 dating rule). The spec was orphaned by a branch reset before #1201 merged and recovered on 2026-09-07; #1201 itself merged hygiene-only. Spec carries a §0 retracted-readings table (4 false orchestrator readings, banked so they are not re-derived) |
 | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** |
 | D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) |
 | D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites |