@@ -1,3 +1,76 @@
+## 2026-09-07 — E-A-CONSUMER-THAT-OPENS-A-DATASET-HAS-ALREADY-LOST-1 — re-deriving a proven identity from outside the thing that proves it is the tell
+
+**Status:** FINDING, operator-caught (2026-09-07: *"that's not a convenience you're
+violating lance-graph 879 batchwriter SOA owned"*, then *"879 909..912 1049 1198"*).
+Verified against the merged code and the #879/#911/#912 arc entries.
+**Confidence:** High — every property below is quoted from the shipped module docs.
+
+**What I did.** Writing D-SPG-6 ("sealed batch per cycle"), I wrote a free
+`async fn seal_alpha_cycle` in a CONSUMER that did `Dataset::open` to read the
+version, computed `cycle = version + 1`, and `Dataset::write`-appended. I
+justified it as convenience — reaching for the `lance` umbrella crate because a
+neighbouring function already did. That framing was wrong twice over: it was not
+convenience, it was an ownership violation; and the DataFusion weight I was
+worrying about was a symptom, not the disease.
+
+**What already existed.** `LanceCycleWriter` (`lance-graph::graph::cycle_sink`,
+#911 → #912 Phase A) is the **SOLE application writer**, and the topology is
+enforced by the TYPE: non-`Clone` (a second handle cannot be minted),
+`commit_cycle(&mut self, …)` (two commits cannot interleave), one long-lived
+owned `Dataset` handle (no per-operation reopen). The 64k SoA owners are
+*"parallel PRODUCERS (fire-and-forget: they cast on behalf of their mailbox and
+receive no acknowledgement), never Lance writers"*.
+
+**The four properties my version lacked**, each hard-won in a review round:
+
+| shipped | mine |
+|---|---|
+| sole writer, non-`Clone`, owned handle | a second unowned writer, reopening per call |
+| producers cast, never write | consumer written as a Lance writer |
+| **no semantic change → no write → no version** (#911's empty-cycle versioning REMOVED) | wrote unconditionally — an empty saccade mints a version |
+| no rollback; durable `(cycle, batch_hash)`, reconcile FIRST, `HashConflict` fails closed | read-version-then-append: a TOCTOU |
+
+**The sharpest of them.** `Append` in Lance **rebases even on a single attempt**
+(strict no-rebase exists only for `Overwrite` — measured in
+`lance-9.0.0/src/io/commit.rs`). So my "refuse, not renumber" guard — read the
+version, compare, then append — *cannot do what its own error message claims*.
+#911 first fixed this with a compensating `Dataset::delete`; #912 then REMOVED
+that too, because a published manifest is HISTORY and a delete is another
+version, not a rollback. I had reinvented a mechanism that was already tried and
+already superseded.
+
+**The transferable tell, and it is cheap to check.**
+`sealed_version = base_version + 1` is recorded on the #911 entry as *"a verified
+identity, not an assumption"* — verified INSIDE the sink, which is what lets
+readers derive the cycle↔version mapping from the co-committed frame row with
+zero sidecar state. **I re-derived that identity from outside the component that
+proves it.** Whenever code computes `next = current + 1` for state another
+component owns, the question is not "is the arithmetic right" (it was) but "who
+is entitled to say this" — and if the answer is a type you did not call, the
+write is already an orphan. A consumer that reaches for `Dataset::open` has
+answered that question wrongly before writing a line.
+
+**Why the DataFusion weight was the symptom.** Bypassing the owned writer meant
+reaching for the `lance` umbrella crate, which drags the query engine in
+transitively. Operator, same session: *"datafusion does joins, we do masking Ops,
+no joins ever"* — a join materialises the rejected world (two relations in, a
+third out), which is the exact complement of `resident ⊗ A ⊗ B ⊗ C`. The
+crosswalk is the thing that LOOKS like a join (MONDO ↔ CUI ↔ LOINC ↔ SNOMED) and
+is a chain of masked equality sweeps (§3.2), so there is no join formulation to
+carry. Read against
+`E-TOPOLOGY-MASKS-MAGNITUDE-COMPOSE-NEVER-COLLAPSE-1` (same day): a query engine
+on this path is a fourth thing that collapses topology, masks and magnitude back
+into relational algebra.
+
+**Falsifier.** Any consumer-side `Dataset::open` / `Dataset::write` in the
+alpha/mask chain; any caller computing a version successor for state it does not
+own; any cast payload carrying owned rows rather than a `(mailbox, row-range,
+cycle)` descriptor. The withdrawn implementation is banked in the session
+scratchpad as the worked example rather than deleted, because the four-row table
+above is only legible next to the code that got each row wrong.
+
+---
+
 ## 2026-09-07 — E-TOPOLOGY-MASKS-MAGNITUDE-COMPOSE-NEVER-COLLAPSE-1 — Mississippi Queen, TERNLOG chaining and BLASGraph pay for ONE operation, from three sides
 
 **Status:** OPERATOR RULING (2026-09-07, verbatim in substance), recorded on
 
@@ -10,7 +10,7 @@
 | D-SPG-3 | Rung × tenant cross via `mask_ternlog` on `words()`; `unlooked[D]` read (temporal 09 Stage 2) | ~~Queued~~ **Shipped 2026-09-07** (MedCare-rs `6bf7764`, `spog_masks::{rung_tenant_cell, unlooked}`; Sonnet worker from spec, orchestrator-gated: fmt/clippy clean, 11/11 incl. the Codex #1221 sibling-classid falsifier; mutation-fired: AND2→AND_ANDNOT2 in the cell fails the count test). Measured on the real image: 500 MONDO + 300 CUI claims at rung 3 → cell counts equal the materialized scanpath filter in all 16 tenants; `unlooked(disease) = disease − 500`, disjoint from `any_rung`, tiles the domain with the cell **⊘ 2026-09-07 (rebase onto `main` after #1220):** the cited MedCare-rs sha is on NO pushed ref. Checked against every `origin/*` ref of AdaWorldAPI/MedCare-rs at main `9f9b7be` (i.e. after #620 AND #621 merged): `git cat-file -t` reports MISSING for `6bf7764`, and `spog_masks` appears in no ref. The measurements below stand as reported by the session that ran them; the STATUS is regraded **Shipped-unpushed** — it is not verifiable from any public history until that branch is pushed. **⊘ 2026-09-07, later the same day: PUSHED** as MedCare-rs `e5febf9` on `origin/claude/medcare-rs-continue-ufsazd` (rebased onto `9f9b7be`; 11/11 after the rebase). Status: **Shipped** (pushed, PR open, merge pending #1221). | cell count == materialized scanpath filter; `AND_ANDNOT2 ≠ AND3` wherever `any_rung` non-empty |
 | D-SPG-4 | PROBE-CROSSWALK-MASK-1, gates (a)–(h), real image; W0 pins FK columns before timing | Queued (MedCare-rs probe; record here) | plan §6 |
 | D-SPG-5 | **Migrate the hand-rolled MedCare alpha onto the #1198 contract alpha** (operator 2026-09-07, spec F9): `attention::WatchedRows`' `RefCell<AlphaOverlay>` + `domain_rung` writer, `backreference::combined_base`, and the bare-overlay `nodesoa::alpha` writer all become consumers of `AlphaTunnel` lanes + `SpogTenants` G routing + `merge()`; frontier dispatch routes through tenants over `all-lanes.soa`; `reflection` = tenant `attended_mask` OR; `domain_rung` retired as rung writer | ~~Queued~~ **Partial 2026-09-07** — MedCare-rs #621 merged (`9f9b7be`). **Leg (i) SHIPPED:** `attention::WatchedRows` holds a `SpogTenants` built by `over_census`, `land()` claims at the CALLER's processing rung, `reflection(tenants, domain)` concatenates the shadows whose block resolves to that domain through the one `Domain::of_classid` mapping, and `domain_rung`/`rung_for` are gone — `origin/main` carries those names only inside a historical doc comment. The equivalence gate was met as stated: 48/48, with BOTH reflection tests and every order-sensitive `obo::` test unchanged. **Legs (ii)–(iv) NOT done**, measured on `origin/main` rather than assumed: `backreference::combined_base` still builds its own base (16 bare `AlphaOverlay` references); `medcare-nodesoa::alpha::{overlay_to_batch, write_alpha_overlay}` still take a bare overlay (15 references — and still ZERO callers outside their own module, so that leg migrates a writer nothing calls yet); `frontier_dispatch` still calls `dispatch_thought(base, …)` with no tenants. Two bare-overlay sites this row never named also remain: `medcare-cohorts::graph_feed` and `medcare-soa::patient` (1 reference each). **⊘ later the same day (this session): legs (ii)–(iv) SHIPPED** — MedCare-rs `e722dd1` (PR #622, draft, blocked on this PR): (ii) `claim_domain_and_patient` borrows the caller's `AlphaAllocation` and returns `SpogTenants::over_census` over the combined base, the patient = tenant `graph_of(patient_address)` (falsifier: `NoTenant` when its G is undeclared; `PatientSession` unchanged — it only hands out the allocation); (iii) `nodesoa::alpha::{tenants_to_batch, write_alpha_tenants}` over the new contract `SpogTenants::merged_rows` (this PR) — the bare-overlay pair stays as the single-overlay form; (iv) `FrontierDispatch::tenants()`, the per-G reading of the agnostic dispatcher's scanpath (the dispatcher itself stays agnostic — `dispatch_thought` is upstream). Gates: first-thought 49/49, nodesoa 15+8, clippy 0. **Still open from the count above:** the two sites `graph_feed` / `medcare-soa::patient` (1 reference each) — **read, same hour: both are DOC COMMENTS, not code** (`graph_feed.rs:4313` describes what the debugger reads; `medcare-soa/src/patient.rs:179` is a doc link, and a stale one — it names `medcare_nodesoa::alpha::AlphaOverlay`, a path that moved upstream in #1112). Zero code references ⇒ the F9 residue is **0**; D-SPG-5 reads **Shipped**. What stays open is F5's scalar-vs-SIMD cell question (operator) and the stale doc link (trivial, MedCare-side). | tenant reflection == `domain_rung` reflection as sets ×8 domains; stamps carry ladder rungs 1..=9 |
-| D-SPG-6 | Sealed batch per cycle: `merge()` → `node_rows_to_batch` → one append; `cycle = version + 1` | Queued (MedCare-rs) | two cycles = two versions; a read at v never sees v+1; `enable_stable_row_ids` grep-fenced |
+| D-SPG-6 | ~~Sealed batch per cycle: `merge()` → `node_rows_to_batch` → one append; `cycle = version + 1`~~ **⊘ RE-SCOPED 2026-09-07 (operator: "879 909..912 1049 1198" — the batch writer is SoA-owned).** The write was never MedCare's. `LanceCycleWriter` (`graph::cycle_sink`, #911 → #912 Phase A) is the **SOLE application writer** (non-`Clone`, `commit_cycle(&mut self, …)`, one owned long-lived `Dataset` handle); SoA owners are fire-and-forget PRODUCERS that `cast` and are never Lance writers; `sealed_version = base_version + 1` is a **verified identity inside that sink**, not caller arithmetic; and **no semantic change → no write → no version** (#911's empty-cycle versioning was REMOVED). Correct scope: MedCare's alpha cycle CASTS a descriptor `(mailbox, dirty row-range, cycle)` — never owned rows — and reads back via `temporal::QueryReference::at` + deinterlace. | **Blocked (lance-graph), not queued (MedCare-rs)** — the gap is upstream and already on the ledger: `LanceShardSink` does not exist (#879 honesty ledger: "durability FAKE"), and the read side is unwired (#1198: `deinterlace` has no production caller, `cast()` has zero production call sites). A withdrawn consumer-side implementation is banked in the session scratchpad as the worked example of the violation. | ~~two cycles = two versions; a read at v never sees v+1; `enable_stable_row_ids` grep-fenced~~ — re-registered when the cast path is wired: an empty cycle performs ZERO Lance operations (`CommitOutcome::NoChange`), a re-submitted identical batch reconciles (`Reconciled`), and a same-cycle different-hash batch fails closed (`HashConflict`) |
 | D-SPG-7 | ogar-r2il consumer (`RANK` + `TERNLOG 0x86`) via `lance-graph-ogar` | Queued — gates on D-SPG-4 | lifted program survivor mask == hand chain bit-for-bit |
 | D-SPG-8 | DataFusion containment (`with_row_id`/`with_row_addr` OFF + red-if-flipped test) | ~~Queued~~ **Shipped 2026-09-07** — MedCare-rs #621 merged (`9f9b7be`). Production registers `LanceTableProvider::new(ds, /* with_row_id */ false, /* with_row_addr */ false)` (`medcare-server/src/state.rs:945`), and the red-if-flipped test OBSERVES that call site instead of building its own provider: `row_identity_columns_are_absent_from_the_registered_provider` (`:1264`) reads the schema of the table `AppState::build_session_context` actually registered, and asserts a hand-built identity-on provider over the SAME dataset carries exactly two more columns — two-sided, so the silent half is a measurement and not a statement about an empty schema. Its own doc records that an earlier draft hardcoded the flags in the test and stayed GREEN when production was flipped; the disable run is what caught it. The pre-existing grep fence `row_identity_containment::no_lance_row_identity_consumer_exists` (`:1609`) stays sharp because the test deliberately never spells either column name in code. **Gate met:** the scan schema carries neither identity column, and a flip is detectable. | scan schema carries neither `_rowid` nor `_rowaddr` |