@@ -1,3 +1,47 @@
+## ISS-NO-NON-LINUX-TARGET (2026-09-06) — OPEN
+
+**Neither filed issue covers the defect that opened this one, and the difference
+is the generalization.** `crates/lance-graph-hydrate/src/release.rs` gated three
+sites `#[cfg(unix)]` and called `libc::posix_fadvise` / `libc::POSIX_FADV_DONTNEED`
+inside them. `posix_fadvise` is **Linux/Android, not POSIX-universal** — Apple's
+libc does not declare it — so the crate fails to compile on macOS with
+`error[E0425]: cannot find function 'posix_fadvise' in crate 'libc'`. `cfg(unix)`
+reads as "has fadvise" and is not.
+
+Why the two existing issues miss it:
+
+- `ISS-NO-AARCH64-RUNNER` is about target **arch**. This is target **OS**: the cfg
+  selection was proved two-sidedly on the pinned 1.98.1 toolchain with a `#![no_std]`
+  rustc probe — `x86_64-apple-darwin` excludes the Linux arm, `x86_64-unknown-linux-gnu`
+  selects it. An x86 macOS runner would have caught this; an aarch64 *Linux* one
+  would not.
+- `ISS-EXCLUDED-CRATES-UNBUILT` is about the **member list**. `lance-graph-hydrate`
+  is a workspace member, compiled and linted by CI on every PR. The crate list was
+  never the gap here.
+
+**The accurate statement is the union, not either half:** CI compiles exactly ONE
+`(target_os, target_arch, crate-list)` tuple — `(linux, x86_64, members)`. Every
+`cfg` block outside it is text the parser skips. The three defects found this week
+each fall in a different one of those three axes, which is why fixing one axis would
+not have caught the other two.
+
+**Found the same way as the other two:** by q2's newly-ungated `macos-latest` job —
+a downstream consumer's CI doing this repo's job, for the third time in one week.
+Nothing in this repo's own CI was capable of seeing it.
+
+**Fixed here** (the point repair): the three sites are gated
+`#[cfg(any(target_os = "linux", target_os = "android"))]` with a fallback arm for
+macOS/BSD, and the doc comment records the rule — *widen this gate only to targets
+whose libc actually declares the call*. 39/39 crate tests green on Linux.
+
+**Not fixed here:** the axis. A `runs-on: macos-latest` job, or a cheap
+`cargo check --target x86_64-apple-darwin` on the existing x86 runners, is a CI
+policy change and an operator call. Note the cheap form needs
+`rustup target add --toolchain 1.98.1 <target>` — installing a target for the
+DEFAULT toolchain while the repo pins 1.98.1 produces a `can't find crate for 'core'`
+that reads like a broken probe rather than a missing std; that cost a turn this
+session.
+
 ## ISS-NO-AARCH64-RUNNER (2026-09-06) — OPEN
 
 **Every `#[cfg(target_arch = "aarch64")]` block in this repo is unverified, because
 
@@ -52,13 +52,73 @@ a slot-allocation one, and is not evidence against this address.
 **Validated on `197ef083d`:** `read_mode_blocks_v3_routes_v3_tail_and_the_blocks_domain`
 passes inside 1319 contract lib tests; `test`, `member-tests`, `clippy`,
 `format`, `linux-build`, `test-with-coverage`, `no-shrink` and
-`regenerate-and-diff` all green. `citation-decay` is red on `origin/main`
-too — 12 findings, byte-identical, measured on a clean worktree of each; none
-of them cites into `LATEST_STATE.md`, so this prepend moved nothing under an
-anchor. Its prescribed fix (line number → stable anchor) means editing past
-entries in `EPIPHANIES.md` / `AGENT_ORCHESTRATION_LOG.md`, which the
-append-only rule forbids — a standing tension for the board sweep, not for a
-contract-crate PR.
+`regenerate-and-diff` all green.
+
+**`citation-decay` — the first diagnosis here was WRONG, corrected in place
+because it was never true of this branch.** It read: *red on `origin/main`
+too, 12 findings byte-identical, none citing into `LATEST_STATE.md`.* That
+described one run and was then carried forward instead of re-read. On
+`dcfc820d` the gate reported **1 NEW decay** and it was this branch's:
+registering the class inserted 18 lines above the const-assert block in
+`canonical_node.rs`, moving `size_of::<NodeRow>() == 512` from `:735` to
+`:753`, and `ISSUES.md:1537` (ISS-MAILBOXSOA-ROW-COST-VS-512B-CANON) cited
+that coordinate. Nothing in `ISSUES.md` changed; the branch moved the thing it
+pointed at.
+
+Fixed in `91fb4234` the way the gate's own error text prescribes — *"THE FIX
+IS NOT TO CORRECT THE LINE NUMBER"* — by naming the assert block through the
+symbols around it, so the next insertion above it does not re-break the
+citation. Green since: `0 new decay(s), 147 pre-existing`. The "append-only
+forbids the fix" tension recorded above was therefore a false dilemma: an
+anchor repair changes a citation's ADDRESS, not a past entry's claim, and is
+what the gate asks for.
+
+**The transferable rule:** *"red on the base too"* is a claim about ONE run,
+not a standing property. It expires the moment the branch adds a line above a
+cited symbol — precisely what a `--since`-diffing gate exists to catch.
+
+## 2026-09-06 — #1209 MERGED (f1336b66): the temporal architecture was measured against the wrong store
+
+| PR | merge | what landed |
+|---|---|---|
+| **#1209** | `f1336b66` | Three probes (`canonical_witness_identity_probe`, `v3_mint_reachability_probe`, `test_e_old_diff_tripartite`) + four `STATUS_BOARD` rows (D-TEMPORAL-1 / -1a / D-V3-MINT-1 / D-TEMPORAL-2) + the `SUPERSESSION-INDEX` regeneration the gate required. No source changes. |
+
+**Ruling: R4 with an R1 core.** Two representations coexist by construction —
+store **A** (canonical temporal/cognitive persistence, `graph/cycle_sink.rs`,
+PR #911) and store **B** (`VersionedGraph`/`NodeSchema`, `node_id:u32` + planes
++ seals). A's architecture survived the lance 9→11 migration byte- and
+semantic-intact; its concrete writer `LanceCycleWriter` remains DORMANT (zero
+non-test callers, per D-MW-P2). Do not read "architecture survived" as
+"production wired".
+
+**The correction this PR exists for:** an earlier pass in the same session
+measured store B and reported it as THE addressed architecture, concluding the
+spine "terminates at `u32 node_id`". That was the wrong store — `cycle_sink.rs`
+had never been opened. Its birth commit states the invariant outright ("one
+detached cycle batch → ONE official Lance commit → exactly one real
+DatasetVersion base+1") with `payload: FixedSizeBinary(512)` documented as
+`key(16) | edges(16) | value(480)`.
+
+**No A↔B membrane was ever designed**, and the chronology forecloses one: B was
+born 2026-03-16 (`270b703c` / `229db767`), ~5 months before A and before
+`NodeGuid` itself. The deleted `contract/src/identity.rs` (`e8060589`) says it
+plainly — *"the cold path keys nodes by `node_id:u32` today … neither is a
+stable, globally-referenceable id. `NodeGuid` fills that gap."* The workspace
+answered B's identity gap by minting a SEPARATE identity, not by extending B.
+Zero commits in 5 387 ever touch `NodeGuid` and `versioned.rs`/`columnar.rs`
+together; `node_id` has no in-repo producer; B is `WriteMode::Overwrite`n
+wholesale each round. **Consequence: do NOT add a `NodeGuid` column to B, and do
+NOT invent a mapping.** B's `node_id:u32` is a projection-local coordinate of a
+GraphBLAS/fingerprint snapshot, not an architectural deficiency.
+
+**Measured, not inferred:** V3 rail (`CLASSID_OSINT_V3`) byte-exact through two
+cycles and a reopen, `payload[0..16] == G.as_bytes()`, each cycle minting exactly
+`base+1`; V1 legacy control likewise; 23/23 `cycle_sink` invariant tests green on
+lance 11 (lost-ACK reconciles, hash conflict fails closed, stale horizon fenced
+writing nothing, reconcile-unavailable ⇒ `Ambiguous`). `#911 → #912 →
+1d416704` are three SEPARATE events and all coherent: #912 is an admission
+valve (no artifact-backed change ⇒ no sink call ⇒ no version), `1d416704` is
+fence hardening, neither a migration regression.
 
 ## 2026-09-06 — #1201 MERGED (54285a42): #1199's records + the council SPEC v1
 
 
@@ -1,3 +1,80 @@
+## 2026-09-06 — lance-graph PR #1209 (merged `f1336b66`, branch `claude/ndarray-simd-tract-o3jfrn`) — the temporal architecture, measured against the wrong store first
+
+- **Added:** `crates/lance-graph/tests/canonical_witness_identity_probe.rs` (3
+  tests), `crates/lance-graph-contract/tests/v3_mint_reachability_probe.rs` (2),
+  `crates/lance-graph/tests/test_e_old_diff_tripartite.rs` (1), four
+  `STATUS_BOARD` rows, and the `SUPERSESSION-INDEX` regeneration. No source
+  changes — this PR measures, it does not migrate.
+- **Corrected, about this session's own earlier reporting:** a first pass traced
+  `VersionedGraph`/`NodeSchema` and reported it as the addressed architecture,
+  concluding the spine "terminates at `u32 node_id`" and that the last link "was
+  never built". Wrong store: `graph/cycle_sink.rs` (#911) had not been opened.
+  The operator named the failure mode before the evidence did — *"we may be
+  debugging the migration while accidentally treating a secondary
+  VersionedGraph/BLASGraph representation as the architecture."*
+- **The V1/V3 two-rail control was operator-mandated and earned its keep
+  immediately.** The first fixture used `NodeGuid::new` — the V1 (deprecated)
+  constructor — so it would have proven the live rail nothing. Rewritten to mint
+  through `mint_for(classid_read_mode(c).tail_variant, …)`. It then failed twice,
+  both times on MY assertions, not the store: `local_key_v2` was expected to
+  separate keys differing only in `leaf`, and must not — `leaf` is the 4th HHTL
+  routing tier (bytes 10..12), part of the addressing PREFIX, deliberately
+  outside the basin-local key (bytes 12..16). **Both facts are now pinned**, so
+  "use the V3 accessor" is recorded as TWO choices and picking the wrong V3 one
+  fails like picking the V1 one.
+- **Pinned false-green (D-TEMPORAL-1a):** 256 V3 addresses differing only in
+  `leaf` → 256 distinct raw keys, 256 distinct `to_hex_v2()`, **1** distinct
+  `identity()`. The miniature of the measured OBO incident (60 478 rows → 658
+  apparent identities on a byte-exact round trip). Byte fidelity does not imply
+  address fidelity.
+- **Checked rather than assumed (D-V3-MINT-1):** `mint_for`'s V2/V3 arm is gated
+  on `guid-v2-tail`, absent from `default`; the registry's V3 entries are gated
+  on `guid-v3-tail`, present. A contradiction was one step from being reported —
+  and does not exist: `guid-v3-tail = ["guid-v2-tail"]` (`Cargo.toml:69`).
+  Measured `tail_variant=V3 / guid-v2-tail=true / leaf_is_live=true`.
+- **CodeRabbit finding, CONFIRMED and fixed (`91cfe1c1`):** the removal probe
+  could pass without validating removal handling. `graph_seal_check` returns on
+  its FIRST divergence while walking `to_seals`, so on `V1={A,B,D} → V2={A,B',C}`
+  the update to `B` or the insert of `C` tripped it before the removal branch
+  (`versioned.rs:632-637`) ran — the assertion held with that branch deleted.
+  Added `V3={A,B'}` (a removal-ONLY transition). The isolation also SHARPENED the
+  blind spot: for a pure removal `GraphDiff` is entirely empty AND its own
+  `seal_status` reads `Wisdom`, while `graph_seal_check` calls the same pair
+  `Staunen` — the two surfaces disagree.
+- **CodeRabbit finding, DECLINED with evidence** (reply on
+  `#discussion_r3944816260`): "prepend new board rows above the existing
+  `D-LNC-*` entries". The `CLAUDE.md` prepend rule names its scope —
+  `EPIPHANIES` / `PR_ARC_INVENTORY` / `INTEGRATION_PLANS` / `AGENT_LOG`, the
+  chronological logs. `STATUS_BOARD` is a dashboard grouped by plan and is not in
+  that list; the last three commits to the section (`8078b69e`, `01569280`,
+  `5fe1ffae`) all APPEND. The finding did catch a real defect, just not the one
+  it named: the rows were originally inserted mid-table because the patch
+  anchored on a convenient unique string. Moved to the append point.
+- **Own prediction falsified by CI:** the PR body claimed
+  `SUPERSESSION-INDEX.md` needed no regeneration, reasoning a STATUS_BOARD-only
+  change could not move it. `regenerate-and-diff` went red within a minute —
+  `crates/` is also an index input, and the new probe calls `persist_cycle`, a
+  ruled symbol, moving its reference count 10 → 11. Fixed in `01829f6a`; body
+  corrected.
+- **Locked:** R4 with an R1 core (see `LATEST_STATE`). Historical snapshot
+  comparison is the correctness ORACLE for the changed set — `inserted`/`updated`
+  from `GraphDiff`, `removed` derivable from the same two seal maps `diff()`
+  already materialises before discarding their difference. Native lance delta is
+  an optional accelerator measured against that, never the architecture; D-LNC-5a's
+  RED is a statement about `DatasetDelta`'s configuration needs, not about store A.
+- **Deferred:** `test_c_cycle_payload_roundtrip.rs`, written by the probe fleet
+  and deliberately NOT landed — D-TEMPORAL-1 already proves the stronger V1/V3
+  result, and a second green test of the same claim adds review cost without
+  adding a falsifier.
+- **NOT proven, and the caveat must ride with any citation:** production
+  reachability. `LanceCycleWriter` has zero non-test callers. The architecture
+  survived; the writer is dormant.
+- **Confidence:** High on the byte/address/semantic results (all locally
+  executed, each failing at least once first). Medium on "no membrane was ever
+  intended" — grounded in chronology, a deleted design doc and exhaustive
+  negative greps, but no doc ever states the relationship positively, because A
+  did not yet exist when B was built.
+
 ## 2026-09-06 — lance-graph PR #1201 (merged `54285a42`, branch `claude/great-curie-d2ufyl`) — #1199's records, and the SPEC v1 that made it mixed
 
 - **Added:** #1199's post-merge records (`PR_ARC_INVENTORY` entry + the
 
@@ -21,6 +21,10 @@ identity) is real and probe-gated.
 | D-GTM-0n / P3 | **Ternlog chaining amortization** (`ndarray/examples/ternlog_amortization_probe.rs`, re-run `--release` 2026-09-06): does chaining pay on THIS mask shape? Pre-registered pass criterion = per-constraint cost flat in K, with a **K=1 control** (nothing to chain ⇒ no win) | **GREEN, bounded.** `T3/T1` bottoms at **0.50** by K=8; T3 total flat in K (57.6 ns @ K=4 → 54.1 ns @ K=32, 16× more constraints). K=1 control reads **1.03** as it must. Two bounds ride with the number and may not be dropped when it is cited: the win is **L2-residency-contingent** (bandwidth `138→15 GB/s` past L2, ratio back to 1.03 at a 512 KiB mask), and mask loses to sparse below **0.1%** active. **Does NOT retire the standing caveat** — 2× on one of three passes still cannot account for 5×. Gates Stage-3 SPEED claims only; the shape/correctness case never depended on it |
 | D-ALPHA-1b | **`AlphaMask::zip` release-mode length guard** (`lance-graph-contract/src/alpha.rs`): the only guard was `debug_assert_eq!`, compiled out in release, so mismatched-length operands produced a mask claiming `self.len` addresses over the SHORTER operand's word count — `count`/`is_empty` under-report silently, `contains`/`materialize_ordinals` panic at a distance | **Fixed** — promoted to `assert_eq!`. Defect reproduced in release BEFORE the fix (the `should_panic` falsifier reported "test did not panic as expected"); two-sided falsifiers both disable-verified. No API change, no external callers. Stage 1b of `.claude/temporal/09-plan.md`, now DONE |
 | D-LNC-7 | **One-WAL ruling**: `LanceCycleWriter`'s watermark WAL vs lance MemWAL — `applied_through` ≡ index catch-up position; two under one commit = two truths. Plan recommends keep-ours until D-LNC-3, then re-decide | **Operator decision** |
+| D-TEMPORAL-1 | **Canonical witness identity probe** (`crates/lance-graph/tests/canonical_witness_identity_probe.rs`): does canonical address identity survive the A-store round trip on lance 11? `NodeGuid → NodeRow → NodeRowPacket::as_le_bytes → cycle commit → drop writer → reopen → scan_image`. Minted through `mint_for(classid_read_mode(c).tail_variant, …)`, never a hardcoded constructor | **GREEN, both rails.** V3 (`CLASSID_OSINT_V3`): payload bytes byte-exact across two cycles and a reopen; `payload[0..16] == G.as_bytes()`; value slab survived (so equality is not a zero-match); each cycle minted exactly `base+1`; head recovered at V2 after restart. V1 legacy control (`CLASSID_OSINT`) round-trips too. **Scope:** proves byte and address fidelity of the store; does NOT prove production reachability — `LanceCycleWriter` still has zero non-test callers (see D-MW-P2) |
+| D-TEMPORAL-1a | **Pinned false-green: the V1 accessor on a V3 key.** 256 V3 addresses varying only in `leaf` → 256 distinct 16-byte keys, 256 distinct `to_hex_v2()`, but **1** distinct `identity()`. Byte fidelity does not imply address fidelity | **Pinned as a positive assertion.** Also pins the second half, which is not a defect: `local_key_v2` yields **1** across the same set BY CONSTRUCTION — `leaf` is the 4th HHTL routing tier (bytes 10..12), part of the addressing prefix, deliberately outside the basin-local key (bytes 12..16). So "use the V3 accessor" is two choices, not one, and the wrong V3 one fails like the V1 one. Do not update the numbers if the assertion breaks — re-audit the call sites |
+| D-V3-MINT-1 | **V3 mint reachability** (`crates/lance-graph-contract/tests/v3_mint_reachability_probe.rs`): `mint_for`'s V2/V3 arm is gated on `guid-v2-tail`, which is NOT in `default`; the registry's V3 entries are gated on `guid-v3-tail`, which is. Two different features, so premise and conclusion can come apart — is a V3-registered classid silently minted into the deprecated V1 layout? | **GREEN — no defect.** `guid-v3-tail = ["guid-v2-tail"]` (`Cargo.toml:69`), so the implication holds. Measured, not inferred: `tail_variant=V3 guid-v3-tail=true guid-v2-tail=true leaf_is_live=true`, key bytes show the V2/V3 carving with `leaf` live at byte 10. Discriminator is `leaf` (the V3 arm feeds it to `new_v2`; the V1 fallback discards it), so the probe stays valid if the feature graph is ever flattened |
+| D-TEMPORAL-2 | **Old-path tripartite change set** (`crates/lance-graph/tests/test_e_old_diff_tripartite.rs`): can store B's snapshot comparison produce `inserted / updated / removed` without any lance delta API? `V1={A,B,D}`, `V2={A,B',C}` | **GREEN.** `inserted={C}` and `updated={B}` from `GraphDiff`; `removed={D}` DERIVED from the same two seal maps `diff()` already materialises (`versioned.rs:550-554`) before discarding the difference — so the missing `removed_nodes` field is an **API omission, not information loss**. Seal gate two-sided AND isolated: the `Staunen` arm runs on a THIRD version `V3={A,B'}` whose only change is dropping `C` — on `V1→V2` that assertion was CONFOUNDED, because `graph_seal_check` returns on its FIRST divergence while walking `to_seals`, so `B`'s update or `C`'s insert trips it before the removal branch (`versioned.rs:632-637`) runs at all, and it would have passed with removal detection deleted (caught by a CodeRabbit finding on #1209). Self-compare ⇒ `Wisdom`. Sharper blind spot now pinned: for a PURE removal `GraphDiff` is entirely empty and its own `seal_status` reads `Wisdom`, contradicting `graph_seal_check`'s `Staunen` on the same version pair. Anti-vacuity: unchanged `A` appears in neither set. Blind spot pinned — if a `removed_nodes` field lands, the assertion must be re-pinned deliberately. **Consequence: historical snapshot comparison is the correctness ORACLE; native lance delta is an optional accelerator, never the architecture** |
 
 ## bindspace-mailbox-soa-wiring-v1 (D-ids minted 2026-09-05 with the plan)
 
 
@@ -53,7 +53,7 @@ coverage instead.
 | `StepMask` | BLOCKED | — | 3 | 9 | 4 |
 | `commit_to_l4` | BLOCKED | — | 2 | 2 | 0 |
 | `dispatch_busdto` | BLOCKED | — | 3 | 8 | 5 |
-| `persist_cycle` | BLOCKED | — | 10 | 8 | 5 |
+| `persist_cycle` | BLOCKED | — | 11 | 8 | 5 |
 | `CognitiveMarkers` | REPURPOSE | `Commit` | 1 | 0 | 0 |
 | `DominoCascade` | REPURPOSE | `Commit` | 7 | 1 | 0 |
 | `GateDecision` | REPURPOSE | — | 25 | 27 | 24 |