@@ -6,7 +6,7 @@ Plans in #1667 (`d-rft-relalg-thought-git-frontier-v1.md`, `d-qsp-classview-quac
 |---|---|---|---|
 | **D-RFT-0 / D-QSP-0** | K3 normalization safety: rewrites keep SQL three-valued TRUE rows | Shipped (#1668; EXO-50 claim `session_01G22yT6htkcdyXsihxxXdrg/031`; `entries/2026-10-21-d-rft-0-kleene-normalization.md`): `normalize_kleene`; `SetNormalize` admits it under `ThreeValued`. MEASURED: PostgreSQL 16.14 = Kleene oracle = `normalize_kleene` on 2000/2000; the two-valued form is wrong on 474 | Kleene evaluator over random expressions + PostgreSQL differential; 5 disables red. Remainder open: NULL literals, `COALESCE`, nullable arithmetic, empty `SUM`, `COUNT(expr)` |
 | **D-QSP-0 remainder, slices 1–2** | slice 1: scalar aggregates under SQL NULL (empty / all-NULL `SUM` is NULL, `COUNT(x)` vs `COUNT(*)`, MIN/MAX/AVG); slice 2: NULL operands (`x = NULL`, `IN`/`NOT IN` with NULL, K3 AND/OR/NOT over TRUE/FALSE/UNKNOWN) | Shipped: slice 1 #1675 (`a55fc67`), board correction #1680 (`b306516`), slice 2 #1682 (`da9b755`; CI 18/18 green on head `96e8010`) (EXO-50 claims `session_013z2e1YXkm6o6HNrDn5BPWA/026`, `/031`; `entries/2026-10-21-d-qsp-0-scalar-aggregates-null.md`). Slice 1: Quack `lower_sum` + `sum_finish` over existing terminals. Slice 2: no `Filter` change; a NULL operand is a lane alias with an all-clear validity plane under `sql_where`. MEASURED (lab, not CI): PostgreSQL 16.15 = Quack on 3600/3600 aggregate queries and on the TRUE and FALSE planes of 2000 × 200 NULL-operand expressions. Not shipped: column-to-column comparison (G4), `COALESCE`/`NULLIF`, nullable arithmetic, subquery `NOT IN` | `tests/sql_aggregate_null.rs` (4 disables red); `tests/sql_null_operand.rs` (11 tests, 4 disables red); `examples/qsp_agg_pg_parity.rs`, `examples/qsp_null_operand_pg_parity.rs` (both SKIP without a server; not run in CI) |
-| **D-RFT-1** | typed composition: membership × role carriers over one slot coordinate; Distinct/Bag from the cardinality witness; NULL key matches nothing; XOR, seal mismatch, stale binding, bag overflow refused | Shipped, PROBE (#1681 `0f756b98`; follow-up #1685 In PR: reads the register — Distinct = `Page::roles`, Bag = AND + popcount on the support, 12.4 µs for 600 users, dense int8 tile GEMM 57.5 µs; EXO-50 claim `session_01G22yT6htkcdyXsihxxXdrg/036`; `crates/dir-rmap-probe/src/compose.rs`; `entries/2026-10-21-d-rft-1-typed-composition.md`). r2il polyfill: `IntXor`, `ANY`, `ALL` + procedures. MEASURED: PostgreSQL 16.14 lane equal over 600 users × 64 roles, bag 1421 = `count(*)`, distinct 1374 = `count(DISTINCT)`; composition 310 µs vs the same plan in direct SIMD 14 µs. Open correction #1686: on main `bool_or`/`bool_and` read NULL as FALSE and `count_distinct_sorted` counts NULL keys (review `GPT:gpt-ada-01/…-consolidated-review-01` item 2) | IAM diamond (Bag 2, Distinct 1); independent DFS oracle lane-equal; 7 compose + 5 r2il disables red |
+| **D-RFT-1** | typed composition: membership × role carriers over one slot coordinate; Distinct/Bag from the cardinality witness; NULL key matches nothing; XOR, seal mismatch, stale binding, bag overflow refused | Shipped, PROBE (#1681 `0f756b98`; follow-up #1685 merged (`3b723df1`): reads the register — Distinct = `Page::roles`, Bag = AND + popcount on the support, 12.4 µs for 600 users, dense int8 tile GEMM 57.5 µs; EXO-50 claim `session_01G22yT6htkcdyXsihxxXdrg/036`; `crates/dir-rmap-probe/src/compose.rs`; `entries/2026-10-21-d-rft-1-typed-composition.md`). r2il polyfill: `IntXor`, `ANY`, `ALL` + procedures. MEASURED: PostgreSQL 16.14 lane equal over 600 users × 64 roles, bag 1421 = `count(*)`, distinct 1374 = `count(DISTINCT)`; composition 310 µs vs the same plan in direct SIMD 14 µs. Correction #1686 merged (`d1b9c9d1`): `bool_or`/`bool_and` no longer read NULL as FALSE and `count_distinct_sorted` no longer counts NULL keys (review `GPT:gpt-ada-01/…-consolidated-review-01` item 2); cost breakdown #1688 (`0615b753`, entry `2026-10-21-d-rft-1-cost-breakdown.md`) | IAM diamond (Bag 2, Distinct 1); independent DFS oracle lane-equal; 7 compose + 5 r2il disables red |
 | **D-RFT-2..5, D-LFA-0** | substitution, recursion, frontier, replay; flow census | PROPOSAL (`entries/2026-10-21-d-rft-d-lfa-0-assessment.md`) | per-row falsifiers in the entry; unclaimed |
 | **D-LFA-1 / D-LFA-2** (amended 2026-10-21) | guarded-control verification of a Rubicon flow; integration with the existing drivers | PROPOSAL (plan amendment, `d-lfa-…-v1.md` § Amendment 2026-10-21; map `entries/2026-10-21-coresearch-plans-mapping-foresight.md`) | GKAT equivalence + separate no-commit-without-revision-and-MUL trace check; 3 disables; `GoTo`/`GoBack` refused; unclaimed |
 | **D-GKAT-0** | GKAT fixture probe: G1 factoring, G2 nondeterminism refusal, G5 declared atom bound | Shipped, PROBE (#1676, merged `6d7442c4`; EXO-50 claim `session_01VncKoyG6JkpsoqhqTGTv3f/026`, RESULT `/028`; `crates/gkat-probe`; `entries/2026-10-21-d-gkat-0-probe.md`). TEST-PINNED: Rubicon reference ≡ optimized, both safe; CHECK-authorized flows equivalent and unsafe; ≤ 8 tests (256 atoms) else refused. K3 guards are a leaf plus a validity bit and never read the payload of a NULL, as Quack's `sql_where` (#1679) | 3 flow disables + 15 checker disables red; independent bounded oracle; not a production verifier |
@@ -391,7 +391,7 @@ Plan: `.claude/plans/ce64-hypothesis-layers-v1.md`. Plateau: `.claude/knowledge/
 | **D-TGB-1** | slot pool, autonomous: taken by `branch`, freed by `squash`/`discard`/`land` (the write is the Rubicon decision, 2026-10-20) | Shipped (lab, #1630/#1631; `crates/thought-git-probe/src/slots.rs`). Slot pool only: no production land, rebase or persistence (D-TGB-2..5 Queued) | at 63 taken `branch` picks a FIFO or least-used candidate, squashes it along its dependency chain if it has one, else evicts it (DECISIONS 2026-10-20; was: squash unremarkable first, else refuse); stale handles refused; 6 tests |
 | **D-TGB-2** | `w_slot` lane labels (W = thought layer, not a pointer) qualified by base version / slot generation | Queued (lab) | no live cell carries a landed slot; old-generation edge refused |
 | **D-TGB-3** | `Commit` lands one sparse batch through `LanceCycleWriter`; `DurableRef` = dataset + `Ref::Version(branch, version)` | Queued (lab) | empty cycle writes nothing; re-submit reconciles; two branches at version 7 told apart |
-| **D-TGB-4** | receipt (base ref, program id, seeds, slot generation) instead of history | Shipped (#1674, `414377f3`; lab, `thought-git-probe/src/receipt.rs`, entry 2026-10-21-d-tgb-4-receipt-replay; 10 tests, 11 disables red) | replay from receipt reproduces writes cell for cell |
+| **D-TGB-4** | receipt (base ref, program id, seeds, slot generation) instead of history | Shipped (#1674, `414377f3`; lab, `thought-git-probe/src/receipt.rs`, entry 2026-10-21-d-tgb-4-receipt-replay; 10 tests, 11 disables red; correction #1684 `cdf29d74`: a sealed landing cannot be replaced or resealed, `landed` requires the write path's `CommitWitness` whose batch fold binds each cohort entry to its thought, malformed inputs refuse; entry § Correction) | replay from receipt reproduces writes cell for cell |
 | **D-TGB-5** | reads as resident folds: `checkout`/`log`/`diff`/`blame` | Queued (lab) | equal the oracle; durable `diff` equals Lance `delta()` |
 | **D-TGB-7** | reusable git API: verb trait + types in the contract, one implementation crate; phase-1 driver `ogar-loco` / `ActionDef`, ACT-R in phase 2; first runs may call the engine crates directly; stack below: datafrog > mask-risc > relalg > r2il | Queued (lab) | driver independence: two drivers with the same decisions give byte-identical cells, receipts, metadata rows |
 | **D-TGB-8** | abstraction API: Datalog rules over the metadata table on `datafrog`; ACT-R `Candidate` / intent as the decision vocabulary | Queued (lab, after D-TGB-7) | rule answers == direct scan; recorded intents replayed as verbs reproduce the run byte for byte |
 
@@ -0,0 +1,40 @@
+# 2026-10-23 — Recovery ledger revised against #1635–#1726
+
+**Status:** WORKING-MODEL (research document; board catch-up; no code changed).
+
+`.claude/research/2026-10-recovery/LEDGER-REVISION-2026-10-23e.md` maps 85
+merged PRs (`main` at `19c1324a`) onto the open list of revision (d). OGAR and
+ndarray had no merges in the window.
+
+- **Main finding:** the six decisions of 2026-10-20 are recorded (#1640) but
+  only D-RA-2 is executed (#1654/#1655). ACTION-GATE (`action.rs:266` `commit`
+  still exists; `required_role: None` skips RBAC in both gates), FLOAT-REFS
+  (`lance-graph/Cargo.toml:58` pulls `lance-graph-r2il`, and through it OGAR
+  `main`, unconditionally; no `fold` feature), WIRE-50 (presence contract
+  only test-local) and O30 (no `SourceRef` of the ruled shape) have no code.
+  They need execution, not further decisions (K19).
+- **Closed (C53–C72):** six decisions recorded; D-RU U1–U3; ARM-B-PREPARE for
+  uniform demand; D-CMR-1/2/6; D-RA-2; the no-ms rule and zero-copy joins;
+  K3 normalization; D-QSP-0 slices 1–2 with corrections; D-RFT-1 at 12 µs
+  after the cost breakdown; D-TGB-4 with its commit-witness correction; GKAT;
+  math compiler stage B / E1; D-MPS-9 oracle; D-DRMC-0..5; the lance-cache
+  agent cards; the Palette256 measured verdicts (P-E2, P-D3 pass; P-D4 and its
+  refit fail; P-S2: compose chains do not survive two hops); revision (d)'s
+  three stale STATUS rows.
+- **Corrected from (d):** D-CGW-4's `Reaction::verdict` is called
+  (`pearl.rs:259-263`); what is missing is the `Causes` promotion gate.
+- **New open:** CERT-COMPILER for DR64, DRMC probes X6/X7/X8/X16/X18,
+  frame-seal owner, Palette256 G5 and P-D4-B, D-RU-4 failed gate, D-CMR-2b
+  remedy, D-QSP remainder, D-LFA-1/2, D-MPS-9 remainder, math-compiler P0 gates,
+  thought-git end state (proof artifact), tuple-site backlog, missing STATUS
+  rows (D-DRMC, D-QR family, Palette256 probes).
+- **Links:** K20 (WIRE-50 + ISA-LEGACY in one PR), K21 (`DurableRef` →
+  `SourceRef` → commit-witness anchor is one type family), K22 (admission at
+  four layers), K23 (count invocation and allocation boundaries first), K24,
+  K25.
+- **Applied here:** STATUS rows D-RFT-1 (#1685, #1686, #1688 merged) and
+  D-TGB-4 (#1684 correction), by a Haiku `spec-editor` from an exact spec;
+  diff read before commit.
+
+OPEN: Q1 `DurableRef` home; Q2 CERT-COMPILER scope; Q3 frame-seal owner; Q4
+Palette256 G5; Q5 thought-git proof metric; Q6 D-CMR-2b remedy.
@@ -25,11 +25,12 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-442 entries, 2026-08-06 .. 2026-10-23.
+443 entries, 2026-08-06 .. 2026-10-23.
 
 | date | entry id | finding | file |
 |---|---|---|---|
 | 2026-10-23 | `ps2-compose-chain-preregistration` |  | [2026-10-23-ps2-compose-chain-preregistration.md](2026-10-23-ps2-compose-chain-preregistration.md) |
+| 2026-10-23 | `ledger-revision-1635-1726` |  | [2026-10-23-ledger-revision-1635-1726.md](2026-10-23-ledger-revision-1635-1726.md) |
 | 2026-10-22 | `probes-pd4-pe2-pd3` |  | [2026-10-22-probes-pd4-pe2-pd3.md](2026-10-22-probes-pd4-pe2-pd3.md) |
 | 2026-10-22 | `pal256-salience-mp3-probe` |  | [2026-10-22-pal256-salience-mp3-probe.md](2026-10-22-pal256-salience-mp3-probe.md) |
 | 2026-10-22 | `pal256-nars-bayes-evidence-contract` |  | [2026-10-22-pal256-nars-bayes-evidence-contract.md](2026-10-22-pal256-nars-bayes-evidence-contract.md) |