@@ -1,3 +1,13 @@
+## 2026-08-02 — E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1 — MedCare is integrated through consumer-pull; the host-side actor/manifest scaffold froze on its birth day
+
+**Status:** FINDING (six-agent read-only investigation + unshallowed git history, HEAD `71d1db1`). **Confidence:** High — every claim carries a commit sha or file:line; contradicting prose ledgers were checked against code. Plan: `.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`.
+
+**The finding.** lance-graph does NOT contain "one incomplete MedCare runtime" — it contains **two lineages**. The LIVE one is consumer-pull: MedCare-rs `medcare-bridge` → vendored `lance-graph-ogar` → `MedcareBridge = UnifiedBridge<HealthcarePort>` (collapse commit `ddb6c840`, 2026-06-21; deprecated alias since `10e717d4`) → OGAR canonical Health codebook (`0x0901–0x090C`; the contract mirror verified in sync slot-for-slot; the 7-alias-vs-12-slot gap is INTENTIONAL per OGAR `ports.rs:598-606`). The DEAD one is the host-side scaffold born in the sprint-7 wave (2026-05-13, `927788e9`/`3f67aed6`) and **never functionally touched again**: `modules/medcare/manifest.yaml` is compile-time parsed (`contract/build.rs`) into `MANIFEST_METADATA` whose ONLY caller is a test; its richest fields (entity codes 100–105, all five `action_capabilities`, `actor.message_type`) are parsed then DISCARDED pre-codegen; `rbac_policy: medcare_policy` names a nonexistent symbol; `CallcenterSupervisor::spawn_consumer_actor` unconditionally spawns `StubConsumerActor` (`supervisor.rs:369`); `DispatchToG` returns `DispatchNotImplemented` before any child actor for every non-Health envelope; `MedcareConsumerActor` has ZERO constructors repo-wide; and the manifest's declared `MedCareActor`/`MedCareMessage` exist in NEITHER repository (verified against the MedCare-rs sibling directly).
+
+**Load-bearing distinctions this pins:** (a) TWO same-named `UnifiedBridge` types — ogar's `<P: PortSpec>` resolver (NO authorize method) vs callcenter's `<B: NamespaceBridge>` authorize/audit wrapper — never composed, and currently UNCOMPOSABLE (callcenter has zero dep on lance-graph-ogar); classify composition as later hardening, never as a shipped edge. (b) `lance-graph-ogar` is workspace-EXCLUDED — a green parent-workspace build compiles none of it (`--manifest-path` required; 83 tests green there). (c) The audit default is `NoopAuditSink` + `SuperDomain::Unknown`/salt 0 with swallowed emit errors, and `MEDCARE_AUDIT_SALT` is read fail-open then discarded — for a HIPAA-regime domain, "configured" vs "recording" is indistinguishable (P0 candidate). (d) Retention 2190d (`StepDomain::Medcare`, tested) vs 3650d (manifest, dead) is the DOCUMENTED open question OQ-2 (HIPAA vs BMV-Ä §57), not an accident. (e) `Anamnese`/`Ueberweisung` are first-class consumer concepts (97/81 refs) with no port alias / no canonical id at all — a real canon gap, not naming noise. (f) A third, unreconciled `.grok/` lineage (Zone-3 via spear, 2026-05-08) contradicts both.
+
+**The lesson (generalizes):** when a repo hosts a consumer-shaped scaffold AND the consumer separately pulls the repo's libraries, the scaffold can freeze at birth while every ledger keeps narrating it as "the integration" — dormancy is invisible in prose because infra work *around* the frozen files (branch names, "first-thought loop" commits) keeps the term alive. The falsifier that cut through: per-file `git log` dormancy (81 days = age of the file) + constructor-count (zero) + the two-repo actor-name check. Also: the clone was SHALLOW (5 grafted roots, 11-day window) — `git fetch --unshallow` converted a "between 06-23 and 06-26 per prose" estimate into the exact commit `ddb6c840` two days earlier. **Archaeology on a shallow clone is prose archaeology; unshallow first.**
+
 ## 2026-08-02 — E-D-MBX-SPINE-IS-STRAIGHT-TRACK-VERSION-IS-NOT-A-FLEET-STEP-SIGNAL-1 — the D-MBX production ownership map is ratified, and P4's fleet-wide fan-step is corrected to sparse sealed-transition application
 
 **Status:** RATIFIED (operator ruling, 2026-08-02) + CORRECTION of a same-session drift. **Confidence:** High for the ownership map (verified against `Cargo.toml` deps) and the sparse correction (it removes a direct contradiction with `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`). Documentation-only — no Rust/tests changed. Recorded in `.claude/plans/cycle-loop-closure-driver-v1.md` §3, §9–§11.
 
@@ -1,3 +1,27 @@
+## 2026-08-02 — medcare-consumer-pull-thinking-proof v1 — ACTIVE (the single active MedCare plan after the two-lineage investigation) — main thread
+
+**Plan:** `.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`
+Consolidation of the 2026-08-02 six-agent read-only MedCare/Healthcare
+investigation (HEAD `71d1db1`, git unshallowed to 4162 commits). Verdict:
+**two lineages, not one incomplete runtime.** LIVE = consumer-pull (MedCare-rs
+`medcare-bridge` → vendored `lance-graph-ogar` → `UnifiedBridge<HealthcarePort>`
+→ OGAR canon `0x0901–0x090C`; bridge migration COMPLETED at `ddb6c840`
+2026-06-21, `MedcareBridge` deprecated alias only). DEAD = host-side
+manifest/supervisor/actor scaffold (frozen since birth 2026-05-13; manifest
+compile-time-parsed but runtime-orphaned; `MedcareConsumerActor` never
+constructed; supervisor hard-codes `StubConsumerActor`; Dispatch rejected
+pre-child; `MedCareActor`/`MedCareMessage` exist in NEITHER repo;
+`medcare_policy` symbol nonexistent). Two same-named, never-composed
+`UnifiedBridge` types (ogar resolver — no authorize; callcenter authorize/audit
+— no ogar dep) classified as LATER hardening, not a proof prerequisite.
+**Active proof target:** one real medical thought over the live consumer-pull
+path — HealthcarePort classids → cognitive-shader-driver + REAL MailboxSoA
+(closing the qualia-extractor honesty gap) → owner_adapter cast → PR #879
+sparse cycle loop; falsifiers F1–F4 incl. the currently-ABSENT fail-closed
+unknown-actor test. `ogar-obo` (MONDO/HPO/Uberon/PATO — verified real, zero
+consumer edges) = optional slice only. Older MedCare plans classified in the
+plan's §8 ledger (completed / dormant-decision-required / stale-but-unmarked).
+
 ## 2026-08-02 — cycle-loop-closure-driver v1 — PLANNED / CONJECTURE (the seam that makes persist_sink load-bearing at 64k) — main thread
 
 **Plan:** `.claude/plans/cycle-loop-closure-driver-v1.md`
 
@@ -1,3 +1,8 @@
+## 2026-08-02 — branch `claude/medcare-rs-continue-ufsazd` — MedCare two-lineage investigation CONSOLIDATED → one active plan (consumer-pull thinking proof)
+
+- Six-agent read-only investigation (code inventory · callcenter/policy · manifest→runtime chain · plans archaeology · git history · tests+build) + main-thread cross-repo verification (OGAR + MedCare-rs siblings) + `git fetch --unshallow` (5 grafted roots → 4162 commits). Full verdict in `EPIPHANIES.md` `E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1`; classification + proof target in **`.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`** (ACTIVE — the single active MedCare plan; INTEGRATION_PLANS prepended).
+- Headline: **bridge migration COMPLETED** (`ddb6c840` 2026-06-21, `MedcareBridge` = deprecated alias over `UnifiedBridge<HealthcarePort>`; codebook mirror verified in sync with OGAR); **host-side manifest/supervisor/actor lineage DORMANT since birth 2026-05-13** (manifest runtime-orphaned; `MedcareConsumerActor` never constructed; `StubConsumerActor` hard-coded; Dispatch rejected pre-child; `MedCareActor`/`MedCareMessage` in neither repo; `medcare_policy` nonexistent). Two same-named, uncomposable `UnifiedBridge` types = later hardening. **Active target: one real medical thought over the live consumer-pull path into the #879 cycle loop** (F1–F4 falsifiers, incl. the ABSENT Healthcare fail-closed unknown-actor test). P0 candidates surfaced: NoopAuditSink-by-default for a HIPAA-regime domain; fail-open discarded `MEDCARE_AUDIT_SALT`. Open decisions carried (§6): OQ-2 retention 2190/3650, `Ueberweisung`/`Anamnese` canon gap, dead-lineage retire/revive, `.grok/` lineage.
+
 ## 2026-08-02 — branch `claude/medcare-rs-continue-ufsazd` — PR #879 review round: recovery/data-integrity holes fixed + scope honesty (grain-of-salt audit)
 
 Operator-forwarded review (grain of salt); each finding verified against code before acting. **Accepted + fixed (all real):**
 
@@ -0,0 +1,144 @@
+# medcare-consumer-pull-thinking-proof-v1 — one real medical thought through the already-live OGAR consumer path
+
+> **Status:** ACTIVE (consolidation + proof target). **Date:** 2026-08-02.
+> **Supersedes as the single active MedCare plan:** the host-side
+> manifest/supervisor/actor revival implied by `pr-e-1-manifest-modules.md`,
+> `pr-g1-manifest-modules.md`, `pr-g2-ractor-supervisor.md §8` (those specs stay
+> as historical records; see §3). Grounded in the 2026-08-02 read-only
+> investigation (six-agent sweep + unshallowed git history, HEAD `71d1db1`).
+> **Separation of concerns:** lance-graph is PUBLIC; MedCare-rs is PRIVATE. This
+> plan names consumer crates/tests structurally only — no clinical schema
+> detail, no sourcing/licensing reasoning, ever (MedCare-rs commitment #9).
+
+## 1. Canonical classification (the investigation's verdict, pinned)
+
+There are **two MedCare integration lineages, not one partially-assembled path**:
+
+| Surface | Classification | Evidence |
+|---|---|---|
+| Bridge migration (`MedcareBridge = UnifiedBridge<HealthcarePort>`) | **COMPLETED** — deprecated compatibility alias only | commit `ddb6c840` (2026-06-21) collapsed the last bespoke per-tenant bridge; `#[deprecated]` landed `10e717d4` (2026-06-22) |
+| Healthcare codebook promotion (`0x0901–0x090C`, 7 port aliases) | **COMPLETED** — canon in OGAR `ogar_vocab`; `contract::ogar_codebook` is a **verified wire-compatible mirror** (checked slot-for-slot this pass) | OGAR `ports.rs:286-309`, `lib.rs:1262-1273`; the 7-vs-12 gap is **intentional** (harvest mints carry no OGIT entity → no alias; pin at `ports.rs:598-606`) — do NOT create a Healthcare subset codebook |
+| OGAR vocabulary plug-ins (`ogar-vocab`, `ogar-obo`, `ogar-fma`, `ogar-cpic`, ClassView, DDL adapters) | **EXISTING SUBSTRATE** — available plug-in infrastructure, NOT part of the live MedCare execution path (no `MedCare-rs → ogar-obo` edge exists; verified) | OGAR `crates/ogar-obo` (MONDO/HPO/Uberon/PATO); consumer grep clean |
+| Host-side manifest/supervisor/actor path | **DORMANT** — decision required before any revival (see §3) | frozen since birth 2026-05-13 (81 days at investigation HEAD) |
+| Callcenter authorization/audit composition (`callcenter::UnifiedBridge<B>` ⊗ `ogar::UnifiedBridge<P>`) | **LATER integration + hardening** — conceptually right, **currently unbuildable** (callcenter has zero dep on lance-graph-ogar); not a prerequisite for the first thought | dep-graph verified |
+| Real cognitive thought over MedCare data (shader-driver / MailboxSoA) | **ACTIVE PROOF TARGET** — this plan's §4 | the honest gap: cognition, not plumbing |
+| Generic manifest-driven actor factory | **POST-PROOF generalization** (only if §3 rules "revive") | — |
+
+## 2. The live path (build on THIS)
+
+```
+MedCare-rs (private)
+  └─ crates/medcare-bridge ──(vendor/lance-graph softlink)──►
+       lance_graph_ogar::MedcareBridge = UnifiedBridge<HealthcarePort>
+         ├─ entity()/entity_by_uri() — namespace-locked, codebook synthesis
+         ├─ ogar_vocab::ports::HealthcarePort  (class_id("Patient")=0x0901, APP_PREFIX=0x0005)
+         └─ OntologyRegistry (TTL hydration)
+  └─ crates/medcare-rbac ──► ogar-vocab (direct)
+```
+
+Compiles and is tested on the consumer side (`healthcare_hydrate.rs` scope-lock)
+and on this side (`bridge_scope_lock.rs`, `medcare_bridge_conforms`, all green —
+NOTE: `lance-graph-ogar` is workspace-EXCLUDED; test via
+`--manifest-path crates/lance-graph-ogar/Cargo.toml`, a green parent-workspace
+build proves nothing about it).
+
+## 3. The dead lineage (dormant — do NOT revive to prove thinking)
+
+```
+modules/medcare/manifest.yaml → build.rs → MANIFEST_METADATA ╳ (one caller: a test)
+CallcenterSupervisor::spawn_consumer_actor → StubConsumerActor  (unconditional)
+DispatchToG: Health → ok; ALL else → DispatchNotImplemented (child never reached)
+MedcareConsumerActor — never constructed; all 8 arms tracing::debug! + TODO
+manifest actor.type = MedCareActor / MedCareMessage — exist in NEITHER repo
+rbac_policy: medcare_policy — symbol does not exist
+entity codes 100–105 / action_capabilities / actor.message_type — parsed then DISCARDED
+```
+
+Reviving this is **not a wiring patch — it would be a new implementation based
+on a stale declaration.** The literal MedCare surfaces that ARE live and useful
+as workbench material — `StepDomain::Medcare::profile()`, `medcare_ontology()`,
+the ontology_table/conformance fixtures, `ConsumerEnvelope` types — may be
+reused as proof fixtures, but are NOT the canonical runtime composition and
+must not be presented as such.
+
+**Open decision (operator):** retire vs revive. If revived: a real typed actor
+factory keyed on live types, never on the fictional YAML names; and the
+manifest either emits everything it declares or stops declaring it.
+
+## 4. The proof target — first medical thought (the drill hole)
+
+```
+MedCare-rs medical input (existing schema surface, private side)
+  → existing OGAR HealthcarePort bridge  (classid resolution, namespace lock)
+  → existing MedCare-rs RBAC or a narrow proof policy   (fail-closed)
+  → cognitive-shader-driver + REAL MailboxSoA           (the honest gap)
+  → non-vacuous medical cognitive result                 (falsifier below)
+  → owner_adapter::emit_bootstrap_intent / BatchWriter   (write-on-behalf cast)
+  → cycle_driver (PR #879): collect → seal (one WAL write) → apply sparse → next intent
+```
+
+A small direct adapter is acceptable. The known seam: `MailboxSoaView::qualia()`
+is deferred; `run_cognitive_work_gated`'s caller-extractor bridges it today —
+the proof should read gate inputs from the REAL SoA qualia column, closing the
+"extractor-fed" honesty gap in the #879 ledger.
+
+**Falsifiers (per the P0 falsifiability rule):**
+- F1 — the cognitive result is **non-vacuous**: two different medical inputs
+  produce two different gate outcomes (discriminates; not a constant).
+- F2 — the classid on the thought's carrier is the OGAR canon (`0x0901`-family
+  via `HealthcarePort::class_id`), not a local literal.
+- F3 — the intent round-trips: cast in cycle N is collected, sealed (exactly one
+  WAL write) and applied in N+1; unrepresented owners byte-identical.
+- F4 — the policy leg is fail-closed: an unrecognized actor/role against the
+  Healthcare classid is DENIED (this test is currently ABSENT — finding h).
+
+## 5. Optional OBO slice (only if it makes the proof observably medical)
+
+`ogar-obo` exists (MONDO/HPO/Uberon/PATO). If the proof wants a visibly
+clinical hop: `HealthcarePort::Diagnosis → MONDO term → optional HPO phenotype
+→ cognitive operation`. No full vocabulary hydration, no ontology federation,
+no cathedral. Skip entirely if F1–F4 pass without it.
+
+## 6. Open decisions carried (not blocked on — the proof proceeds around them)
+
+1. **OQ-2 retention:** 2190d (`StepDomain::Medcare`, tested) vs 3650d
+   (manifest, dead path) — HIPAA 6yr vs BMV-Ä §57 10yr. Operator/regulatory.
+2. **`Ueberweisung` / `Anamnese` canon:** first-class consumer concepts;
+   `anamnesis` = `0x0908` (no port alias), `Ueberweisung` has NO canonical id.
+   OGAR-side mint decision.
+3. **Dead-lineage retire/revive** (§3).
+4. **Bridge composition edge** (callcenter⊗ogar) — later hardening.
+5. **`.grok/` Zone-3/spear lineage** — unreconciled third model; needs a ruling
+   or a staleness banner.
+6. **Audit default = `NoopAuditSink`** with `SuperDomain::Unknown`/salt 0 and
+   swallowed emit errors — for a HIPAA-regime domain, "configured" and
+   "recording" are indistinguishable. P0 candidate, own PR.
+
+## 7. Exclusions (scope fence)
+
+- NO manifest/supervisor/actor revival for the proof.
+- NO new Healthcare subset codebook; NO local classid literals.
+- NO callcenter⊗ogar dependency edge as a proof prerequisite.
+- NO provisional-intent recovery ledger in #879: pre-commit failure → publish
+  nothing, mutate nothing, retry the byte-identical frozen cycle (`SealFailure`);
+  post-commit crash → recover committed history (`recover_fleet` + watermarks).
+  Committed-history recovery and ordinary failed-write recomputation stay
+  SEPARATE mechanisms. (Latency figures floating in review prose for these two
+  paths are **claimed, unverified** — nothing here measured them; do not cite.)
+- NO clinical schema detail or sourcing/licensing reasoning in this public repo.
+
+## 8. Status ledger for the older documents
+
+| Doc | Disposition |
+|---|---|
+| `pr-e-1-manifest-modules.md`, `pr-g1-manifest-modules.md`, `pr-g2-ractor-supervisor.md` | historical — describe the dormant lineage |
+| `pr-e1-medcare-super-domain.md` | historical + carries the open OQ-2 |
+| `foundry-consumer-parity-v1.md`, `foundry-roadmap.md`, `MEDCARE_POLICY_GAP.md`, `td-super-domain-subcrates.md` | stale-but-unmarked (investigation §8-P3); banner candidates |
+| `ogar-sink-in-and-consumer-bridge-removal-v1.md` | substantially DONE (the `ddb6c840` collapse) |
+| `lance-graph-in-medcare-rs-v1.md`, `unified-bridge-consumer-migration-v1.md` | partially landed; remaining items fold into §6 here |
+| `.grok/board/*` | unreconciled second lineage; §6.5 |
+
+**The central realignment:** OGAR and the bridge pattern are NOT the unfinished
+part. The unfinished part is **cognition and composition**. Prove one real
+medical thought through the already-live consumer path, then generalize the
+exact seam that worked.