diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index 71fc5de8c..4a68d72d8 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -1,3 +1,7589 @@ +## 2026-08-26 — E-V4-EXECUTABLE-CONTENT-THREE-TIER-JIT-1 — V4 = V3 + executable content; learned encoding is an index never the authority; execution is population-masked; alpha IS the JIT profiler + +**Status:** DOCTRINE — [OPERATOR-RULED], same-day pair with +E-COUPLED-MATERIALS-NOT-A-CHOOSER-1. Full architecture + probe queue: +`r2il-machine-semantic-contract-v1.md` §7.8. +**Confidence:** High on the three doctrine sentences (rulings). The tier +table is grounded in shipped code (`ndarray::hpc::jitson_cranelift` behind +`jit-native`; `lance-graph-contract::jit::JitCompiler`; ogar-r2il exact +tables). Everything execution-shaped is CONJECTURE until +PROBE-R2IL-DECODE-AUTHORITY / -LIVE-REGFILE / -LANES / PROBE-OWL-RL-FIXPOINT +run. + +The three sentences: (1) **V4 = V3 + executable content** — same bytes, +same stride, same `ENVELOPE_LAYOUT_VERSION`; the version lives in the +resolver's capability, not the layout. (2) **The learned encoding (hexagon, +99.6% measured) is an INDEX, never the AUTHORITY** — hexagon proposes, +ogar-r2il's exact tables verify; the 0.4% tail fails loud and becomes +training signal, never a silent mis-execute. (3) **Execution is +population-masked, never per-row** — the interpreter's unit is +(program, mask); divergence is mask algebra. + +The closure that earns the entry: **tier-up needs a hotness counter and +`AlphaStamp.visits` already is one** — the meta-awareness plane and +profile-guided optimization are the same mechanism read at two rungs. And +the OWL arm is scope-fenced to **OWL RL only** (forward-chaining rules → +R2IL, fixpoint = empty delta mask); the ontology BAKE is the AOT tier, +R2IL the interpreter for post-bake rules, jitson the JIT for the hot ones. +Full DL / tableau reasoning is explicitly NOT promised. + +## 2026-08-26 — E-COUPLED-MATERIALS-NOT-A-CHOOSER-1 — closing an activation loop with an executive selector is the tempting wrong move; the transition must be a consequence of coupled cold/hot state + +**Status:** CORRECTION — [OPERATOR-RULED]. Records a formulation that was +proposed and rejected in session, plus the two-part diagnosis it replaces. +Detail: `r2il-machine-semantic-contract-v1.md` §7.7 (form + topology +falsifier); consumer half in MedCare-rs `2026-08-24-octopus-suction- +digestion-v1.md` §14 (per §7.6's responsibility cut). +**Confidence:** High on the rejection and on the census below; the coupled +mechanism itself is HYPOTHESIS until F-HOT-1/2 run. + +### The rejected shape, and why it is worth writing down + +`chooser(spine, alpha) -> next_address` — an executive holding both planes. +It reintroduces a scheduler the architecture does not have and makes the +next firing an *act of selection* rather than a *consequence of substrate +state*. It never reached a file (`grep -rli chooser` over MedCare-rs: 0 +hits); it is recorded because it is the obvious move a future session will +re-derive when told "close the loop". + +### Two census corrections that produced it + +Both were mine, both overreached, both are measured: + +- **"alpha is pure instrumentation"** — WRONG. `alpha.rs:192` holds the + spine as `base: &'a [NodeRow]`, an immutable slice *by type*, so a + writable plane at a canonical address is structurally required, not + optional. The implementation is contingent; the role is not. An EEG + electrode is instrumentation because the brain runs identically without + it — this does not have that relationship. Correct term: + **open-loop activation plane**. +- **"nothing reads alpha"** — WRONG in the other direction, in the same + turn. `medcare-first-thought/src/attention.rs:153` reads `scanpath()`; + `obo.rs:792` too. What is missing is narrower and sharper: alpha is read + to **project**, never to steer the next edge — and that is *deliberate*, + because `WatchedRows` mutates through a `RefCell` precisely so the walk + stays ignorant of it (*"a recorder that demanded `&mut self` would be a + change to the trait, and then every walk would know about it"*). The loop + is open BY DESIGN, and the openness is load-bearing. + +### The word "receipt" was carrying three meanings + +An earlier claim here — *"a discardable thing cannot be a receipt"* — is +withdrawn. It is true only for the durable sense. Three layers, no +contradiction between them: + +| layer | durability | +|---|---| +| alpha **state** — current activation | ephemeral, recomputable | +| alpha **delta/trace** — self-recording participation | ephemeral, recomputable | +| **merkle witness** — audit history | durable, tamper-evident | + +A CPU register records its value without surviving a reboot. The real +contradiction to refuse is only `alpha delta == durable witness`, which +this workspace already refuses on other grounds (MedCare commitment #7). + +**What survives the correction:** first-write-wins +(`a_revisit_keeps_the_first_stamp_and_does_not_grow_the_table`) is a +limitation of the TRACE layer, and it predicts *which* falsifier fails and +why — stage-localization cannot recover a later visit whose rung was +frozen at first touch. + +--- + +## 2026-08-25 — E-W0-THE-SPACE-ORDINAL-IS-A-RANK-RELATIVE-TO-A-TABLE-THE-CLASSID-NEVER-NAMES-1 — W0 run: zero custom spaces in 94,536 rows, so the defect is LATENT; but the mechanism is worse than the conjecture and blocks the mint's space axis anyway + +**Status:** FINDING — [MEASURED] (census over the full 4-binary corpus) ++ [FALSIFIED IN CODE] (a test against the shipped `CustomSpaceTable` API, +written, run green, reverted — no source change landed). +Closes plan `r2il-machine-semantic-contract-v1.md` W0 and open item O3. +**Confidence:** High. The census is exhaustive over the corpus; the +collision is demonstrated, not argued. + +### The census — the defect is LATENT, not live + +Every `at` field of all 94,536 ore rows decoded (16-byte `VarnodeFacet`, +lo-u16 of the classid word): + +| binary | rows | Ram | Register | Unique | Const | **Custom (≥4)** | +|---|---|---|---|---|---|---| +| `stress_test` | 10,003 | 3,423 | 2,461 | 3,064 | 1,055 | **0** | +| `stress_test_opt` | 7,554 | 2,826 | 2,364 | 1,485 | 879 | **0** | +| `vuln_test` | 4,409 | 1,488 | 1,231 | 1,242 | 448 | **0** | +| `build-script-build` | 72,567 | 26,886 | 19,370 | 18,011 | 8,300 | **0** | + +Union of discriminants across all four: `{0,1,2,3}`. **No custom space +occurs anywhere.** 0 malformed `at` fields. + +So W0's own kill condition — *"same `n`, different meaning across +binaries"* — is **unanswerable by census**: the population is empty. That +is a real result (the x86 lift never produces one here), not a null probe, +and it is why the question had to be taken to the code. + +### ⊘ My §3 conjecture named the WRONG mechanism, and the real one is worse + +The plan's §3 said `Custom(n)` is *"a per-binary ordinal lifted out of the +program"*. **Wrong.** The table is built by `CustomSpaceTable::from_arch` +from `ArchSpec.spaces` — per ARCHITECTURE, not per binary. Within one arch +every binary shares one table, so the ordinal IS stable across the four +binaries, exactly as a reading should be. + +The actual defect is one level up. `ordinal_of` is +`CUSTOM_ORDINAL_BASE + binary_search_position(raw)` — **the lo-u16 is the +RANK of the raw id inside whichever table interned it**, and the classid +does not name that table. Demonstrated against the shipped API: + +``` +arch_a = from_ids([10,20,30]) arch_b = from_ids([20,30,40]) + raw_of(4) = 10 raw_of(4) = 20 ← same ordinal, different space + ordinal_of(20) = 5 ordinal_of(20) = 4 ← same space, different ordinal +⇒ project(Custom(10), arch_a) and project(Custom(20), arch_b) + are BYTE-IDENTICAL VarnodeFacets. +``` + +And the raw `n` feeding that rank is itself order-dependent upstream — +two independent sources, both counters: `r2sleigh-lift/src/context.rs:147` +(`Custom(next_custom_space); next_custom_space += 1` — registration order +during ArchSpec construction) and `disasm.rs:91` (`Custom(idx)` — the raw +SLEIGH address-space table index, as a fallback). So the lo-u16 is a rank +over a counter: **two stages of order-dependence, zero of identity.** + +### Verdict — the space axis is BLOCKED from the `0xC4` mint as carved + +Not for the conjectured reason. The ratified law says *CLASSID SELECTS THE +READING*; a reading must be self-describing at the address. This one is +self-describing only **relative to an ArchSpec that is nowhere in the 16 +bytes**. Two facets from two arches collide on the same classid while +denoting different spaces — the classid stops being an address. + +- **Fixed spaces (0–3) are fine and stay.** They are architecture-invariant + by construction (`facet.rs:23-27` says so), self-describing, and are the + only ones this corpus uses. +- **The custom axis must not be minted at `0xC4` in its current carving.** + Options, none decided here: name the arch in the address; use the raw + SLEIGH space id rather than a rank; or move the custom space out of the + classid into the payload/edge. That is an OGAR mint question, not a + ruff-local one. + +**Prior art credited, not claimed:** `facet.rs:18-20` already carries a +`⚠ Known tension` doc comment recording that the space discriminant is a +shape ordinal in the lo half against OGAR's rule, and defers the carving +to PR 3. This entry supplies what that note lacked — the measurement, the +mechanism, and the collision. + +### Why this matters NOW rather than later + +The 6502/C64 arc is precisely where the latent case fires: a second +ArchSpec means a second table, and ordinal 4 would denote one space in the +x86 corpus and another in the 6502 corpus with nothing in the address to +tell them apart. The census says there is time to fix it; the mechanism +says the time is before the mint, not after. + +## 2026-08-25 — E-R2IL-MACRO-VOCABULARY-TRANSFERS-ACROSS-COMPILER-AND-LANGUAGE-1 — a macro vocabulary learned from two gcc binaries fires in unseen gcc code at −0.6% density and in unseen rustc code at −4.7%, both outside a marginal-preserving null + +**Status:** FINDING — [MEASURED] (held-out transfer + two pre-registered +shuffle nulls, 20 seeds each, over 4 binaries in 3 corpus configurations; +the shipped `probe_bpe_r2il_loco_microcode.rs` instrumented for the runs +and reverted — no source change landed, the probe's own 10 gates stayed +green throughout). +**Confidence:** High for the mechanism on this corpus. The generalization +beyond x86-64 / the pass-1 seven-opcode convention / chain-length-3 is +NOT measured and is not claimed. + +### The question this answers + +`E-BPE-OVER-DEFUSE-CHAINS-BEATS-LINEAR-AND-FITS-LOCO-1` measured 33 BPE +macros over R2IL def-use chains and their `ogar-loco` lane fit, on **2 +binaries**. It did not ask whether a macro means the same thing anywhere +else. That question is load-bearing for any design that treats a macro as +a placeable, addressable unit: a unit whose meaning is program-local is +content, not vocabulary. + +### The measurement + +Train on the two `stress_test` binaries ONLY (1,872 def-use chain +occurrences, 33 macros). Score each unseen corpus by macro-hit **density +per chain** — scale-free, so corpora of different size compare directly. + +| held-out | chains | density | vs train | coverage | macros hit | +|---|---|---|---|---|---| +| *(train: 2 × gcc `stress_test`)* | 1,872 | **2.529** | — | — | — | +| `vuln_test` — different C program, same gcc | 608 | **2.515** | **−0.6%** | 608/608 | 31/33 | +| `build-script-build` — serde_json, rustc/LLVM | 8,659 | **2.409** | **−4.7%** | 8,652/8,659 | 33/33 | + +### Both nulls, pre-registered before the runs + +- **Global null** — permute atoms ACROSS held-out chains; the global atom + multiset is preserved EXACTLY (asserted on every one of the 40 draws), + def-use adjacency destroyed. +- **Column null** (the one that does the work) — permute each POSITION + column among itself. Each position's opcode marginal is preserved + exactly, so *"position 0 is usually `int_add`"* cannot explain a win; + only which x, y and z sit TOGETHER is destroyed. + +| held-out | REAL | global null | column null | REAL in either range? | +|---|---|---|---|---| +| `vuln_test` | 2.515 | 1.664 [980..1034 hits] | 1.969 [1179..1232 hits] | **no / no** | +| Rust | 2.409 | 1.780 [15278..15496] | 2.009 [17327..17461] | **no / no** | + +Margin over the strict null: **+27.7%** (same compiler) → **+19.9%** +(across the language boundary). The cost of crossing is real and small; +the vocabulary is NOT a gcc idiom. + +Distribution-free ranges are reported deliberately: `I-NOISE-FLOOR-JIRAK` +forbids a classical σ claim here (weakly dependent bits), and +non-overlap of 20-draw ranges needs no such assumption. + +### ⊘ My own pre-registration was WRONG, in the hypothesis's favour + +Before the Rust run I recorded: *"Erwartung: schwächerer Transfer … +spürbarer Abfall der Dichte"*, and named the kill condition (REAL inside +the column-null range ⇒ the palette must be split per toolchain). +Measured: 4.7%, an order of magnitude smaller than "spürbar" implied, and +the kill condition did not fire. Recorded because a prediction that misses +in the direction you wanted is exactly the one a later reader must be able +to check. + +### Three deflations of the headline, stated rather than buried + +1. **33/33 is partly a sample-size effect, NOT a stronger transfer than + 31/33.** The two macros that missed `vuln_test` carry 6 and 2 training + occurrences and had 608 chances there against 8,659 here. Density is + the honest statistic, and it correctly shows the Rust corpus as the + HARDER one. +2. **The Rust sample is capped.** `R2IL_HARVEST_MAX_FUNCS=200` exhausted + at 200 of 548 `STT_FUNC` symbols — a first-200 slice with std/core + prelude bias. The three C binaries sat under the cap and were harvested + whole, so the four probes are not sampled identically. +3. **Coverage saturates and should not be quoted alone.** 608/608 looked + tautological for a 7-symbol alphabet; the column null reaches only + 564/608 (92.8%), which is what rescues it — but the margin is thin and + density carries the finding. + +### What this licenses, and what it does not + +**Licenses:** treating the R2IL macro vocabulary as a *shared* palette +rather than a per-binary or per-toolchain one — the `System[256] | +Learned[≤256] | Explore[≤256]` shape of the POC entry, with one mint +serving multiple programs. It is the empirical half of "R2IL is the +faithful vocabulary, BPE is recombination over it". + +**Does not license:** any mint (none performed), any claim about +architectures other than x86-64, any claim that a macro is *semantically* +the same across languages — this measures co-occurrence of an opcode +pattern, not that the pattern means the same thing to a reader. A +`(int_add, copy, store)` chain in Rust and in C are the same SHAPE; that +they are the same THOUGHT is a separate, unrun question. + +**Corpus:** `stress_test` (10,003 rows) · `stress_test_opt` (7,554) · +`vuln_test` (4,409, 41 fns) · `build-script-build` (72,567, 200 of 548 +fns). Harvested through `ruff_r2il`'s `harvest_r2il` (`--features lift`). +The probe's B7 fence — which recomputes the binary count live rather than +trusting a constant — correctly failed the moment a third binary entered, +which is how the corpus swap was confirmed real. + +## 2026-08-24 — E-R2IL-BPE-RECOMBINATION-FALSIFIERS-CONFIRMED-1 — the typed genetic recombination proposal's three §7 falsifiers all run green: splice points exist selectively (10.1%), recombination round-trips, and the counterfactual lane distinguishes at the real (v2-only) primitive level + +**Status:** FINDING — [MEASURED] (`PROBE-R2IL-BPE-RECOMBINATION-FALSIFIERS-1`, +4/4 gates, autoattended: Sonnet worker built + verified, orchestrator +independently re-ran to bit-for-bit identical output before landing). +**Confidence:** High for the mechanism on this corpus (same 2 binaries, +143 episodes, 33 learned macros as the parent POC); F3 is explicitly +scoped to the SHIPPED v2 half of the counterfactual lane only. + +Answers `.claude/plans/r2il-bpe-typed-genetic-recombination-v1.md` §7's +three named falsifiers, previously unrun: + +- **F1 (splice legality):** of 1,056 ordered pairs among the 33 learned + macros, **107 (10.1%)** admit ≥1 real type-legal splice point — a + genuine observed def-use edge from macro A's tail site into macro B's + head site, in the SAME episode (built from `extract_chains`'s own + dataflow walk, not re-derived). 949 pairs admit none. Real def-use + chains discriminate: neither uniformly entangled (splice never fires) + nor uniformly permissive (splice always fires) — both would have been + a weaker finding. Strongest legal pair `(7, 11)`, witnessed across 45 + disjoint episodes. +- **F2 (round-trip):** 5 sampled macros × {duplicate, delete, substitute} + produced 10 genuinely distinguishable decoded sequences and 5 + correctly-silent identity substitutions (can-fire + can-stay-silent + both hold). A corrupt-table falsifiability demo, mirroring the parent + POC's B4 `corrupt_demo` exactly, confirms the decode machinery is a + real falsifier here too. Every token in every recombination is a real + R2IL atom id or a real learned macro id — never invented. +- **F3 (counterfactual-lane distinguishability), RE-SCOPED to the + actually-shipped API:** `lance_graph_contract::counterfactual` has two + staged halves — v2 (`deposit_counterfactual`, + `FreeEnergyComparison::minority_wins()`) is REAL and shipped; v3 + (`CounterfactualMailbox`, `revise_if_minority_wins`, `awareness.revise`) + is `todo!()`-stubbed, BLOCKED on D-PERSONA-5 (the ractor outer-swarm). + This probe tests v2 ONLY — v3 is never instantiated or called (would + panic). Result: an ordinary evidence-matched baseline pair (both + minority and majority at the identical disjoint-episode count) correctly + produces `minority_wins()=false`; F1's strongest recombined splice pair + (45 pooled disjoint episodes) against the SAME weak majority produces + `minority_wins()=true`. The verdicts differ — real signal, not washed + out, at the primitive level that actually ships today. + +**Two design refutations recorded honestly in the file, not adjusted +away (both re-verified by the orchestrator, present in the committed +comments exactly as reported):** +1. First F3 pairing used the globally-strongest macro (90 disjoint + episodes) as the shared majority. BOTH scenarios lost + (`minority_wins()=false/false`) — real refutation of that PAIRING + (too strong a majority), not of the primitives: the raw + `FreeEnergyComparison` values already showed a real ~36× gap + (`f_minority_a=0.0524` vs `f_minority_b=0.0015`), just not crossing the + boolean threshold against that majority. +2. Second attempt used the two globally-WEAKEST macros (1 vs 2 disjoint + episodes) as the "evidence-matched" pair. It still flipped + (`wins_a=true`) because `TruthValue::revise`'s curve is steep between + N=1 and N=2 — "adjacent by rank" is not "evidence-matched." Traced to + `revise`'s symmetric weighted-average math: only an EXACT + disjoint-episode-count TIE produces identical `f` values, which is + what the final, committed pairing uses. + +**Process notes:** autoattended dispatch (one Sonnet worker, thoroughly +grounded brief pre-verifying the counterfactual API surface before +dispatch to avoid the worker hitting the BLOCKED v3 stubs); orchestrator +independently recompiled/re-ran to bit-for-bit identical output before +landing, per this session's standing rule of never trusting a worker's +self-report alone. + +**Fences:** no mint performed anywhere; no write to MUL, the autopoiesis +triangle, or any `ValueTenant`; `CounterfactualMailbox`/ +`revise_if_minority_wins` never called (would panic); this probe +generates falsifier EVIDENCE only, never an admission decision. + +**Files:** `probe_r2il_bpe_recombination_falsifiers.rs`, +`.claude/plans/r2il-bpe-typed-genetic-recombination-v1.md` (§7 updated +in place with these results, status line corrected). + +## 2026-08-24 — E-GIT-SOURCED-CRATE-CANNOT-PATH-DEP-OUTSIDE-ITS-REPO-1 (follow-up) — `cognitive-stack`'s OGAR deps fixed the same way; its `ndarray` dep left path-only, and why: a same-version git+path duplicate is a real type-identity hazard, not just style + +**Status:** FIX — [MEASURED] (`cargo check -p cognitive-stack` green, 4m52s +clean build under the new deps; `cargo check` also directly demonstrated +the hazard this entry warns about — see below). + +`crates/cognitive-stack` carried the identical escaping-path shape as +`lance-graph-ogar` before PR #1019 (`ogar-vocab`/`ogar-ontology`/ +`ogar-adapter-surrealql` all `path = "../../../OGAR/crates/..."`, from the +same 2026-07-07 "NO-PIN" policy note that also covered `symbiont`). +Switched to `git = "https://github.com/AdaWorldAPI/OGAR", branch = "main"` +— identical URL+branch to `lance-graph-ogar`'s own pin (which +`cognitive-stack` also depends on), so Cargo unifies both into ONE +resolved OGAR source. Safe specifically because `lance-graph` (also a +dependency here) has NO OGAR dependency at all — nothing else in the +graph could bring in a competing OGAR source. + +**`ndarray` was NOT switched — a first attempt was, and directly +demonstrated why not.** `lance-graph` (path-dep'd by `cognitive-stack`) +has its OWN escaping path dep on `ndarray` +(`crates/lance-graph/Cargo.toml`, gated behind the `ndarray-hpc` feature, +which is in `lance-graph`'s DEFAULT feature set), unfixed. Switching +`cognitive-stack`'s OWN direct `ndarray` dep to `git` while `lance-graph`'s +stayed `path` produced a build with **two distinct `ndarray v0.17.2` +package instances** (`git...?rev=0129b5c8...` — a pre-existing pinned +instance, likely from `p64`/`causal-edge` — plus a NEW +`git...#80f0b01f` branch-tracked instance, plus the still-present local +path instance) — visible directly in `cargo check`'s package list, their +`fractal` sub-crate duplicated the same way. Cargo treats path and git +sources as different identities even at the same version (the same +reason the `[patch]` sections elsewhere in this repo exist for +`lance-graph-contract`) — a real type-identity hazard if any code path +ever passes a value between the two instances, not merely a naming +inconsistency. It compiled anyway (Rust tolerates multiple crate +instances until a signature unifies them directly), which makes this an +easy footgun to miss: **a clean `cargo check` does not prove dependency +source unification.** Reverted before commit; `ndarray` stays `path` here. + +**The real fix is upstream, out of scope for this commit:** +`lance-graph`'s own `ndarray-hpc` feature (in its DEFAULT feature set) +still path-deps `ndarray` the same escaping way. This means the MAIN +`lance-graph` crate itself would fail the identical way `lance-graph-ogar` +did for any external `git` consumer that enables `ndarray-hpc` (or +anything requiring it) — currently LATENT, not yet triggered, because no +observed external consumer has needed that feature (MedCare-rs's Railway +break was specifically about `ogar-loco`, an unconditional dependency; +`ndarray-hpc` being optional means Cargo's resolver never touches the +escaping path unless the feature is actually activated). Flagged, not +fixed here — touching `lance-graph`'s default feature set is a bigger, +more sensitive change than this follow-up's scope. + +**Files:** `crates/cognitive-stack/Cargo.toml`. + +## 2026-08-24 — E-PHI-WEYL-STAMP-CASCADE-PRECISION-RULING-1 — φ-Weyl 2-level Morton stamp cascade: coprime strides give identical discrimination, gcd>1 strides concentrate, operator ruled PRECISION over amortization + +**Status:** FINDING — [MEASURED] (`PROBE-STAMP-MORTON-CASCADE-1`, 7/7). +Split out from the R2IL x BPE POC (`E-BPE-OVER-DEFUSE-CHAINS-BEATS-LINEAR- +AND-FITS-LOCO-1`) into its own PR — an orthogonal design decision that +muddied that POC's epistemic receipt (architecture review). + +Builds a 2-level Morton cascade over the shipped `Stamp(u64)` +(`source(id) = 1<<(id%64)`). **Measured: for a bijective id->leaf map, +every coprime stride gives IDENTICAL discrimination** (39/17/11/41 all +produce the same word counts and the same conservatism, M3) — φ-Weyl +(`LEVEL0=39`, since `round(64/φ)=40` is NOT coprime; `LEVEL1=17`; +`WEYL_OFFSET=21`) is adopted as the CANONICAL choice (`[FORMAL-SCAFFOLD]`'s +φ-Weyl pillar), explicitly NOT a measured performance win. **The measured +TENSION:** coprime strides maximize spread (65 words at N=143, maximum +discrimination); `gcd>1` strides concentrate (17 or 9 words, coarser +resolution). Anti-moiré wants discrimination, amortization wants +concentration — operator ruled PRECISION, so spread was chosen. On the +real 143-episode corpus: cascade pooled=143 dropped=0, vs shipped flat +Stamp pooled=64 dropped=79 (55.2% CHOICE-dropped) — reproduces +`PROBE-STAMP-CAPACITY-1`'s K3 finding exactly, zero-loss on the cascade +side (M4). **Load-bearing constraint made explicit:** a stamp address +must be a pure function of the SOURCE ID, never arrival order — an +arrival-indexed Weyl walk would make `disjoint()` order-dependent and +meaningless. + +**Correction on landing (codex review of the sibling POC PR, same finding +applies here since both probes share the file's history):** a prior +doc-comment claimed FINE-first's tier 0 "IS the shipped `Stamp`, +bit-identical." **Wrong post-φ-Weyl-adoption** — `root_leaf(0) = 21`, not +`0`. Corrected: tier 0 shares the shipped `Stamp`'s FOLD-CARDINALITY +SHAPE (one word, same mod-64 collision behavior) but is NOT bit-reusable +— a persisted `Stamp::source(id)` cannot be reinterpreted as this +cascade's root leaf without recomputing `root_leaf(id)`. M1/M4 compare +against the real `Stamp::source` directly (never `root_leaf`), so both +gates were unaffected by the doc-comment error; only the prose claim was +wrong, fixed before this file was split into its own PR. + +**Fences:** no shipped type modified (`Stamp`/`TruthValue`/`SpoHead`/ +`CausalEdge64` all read-only); `CascadeStamp` is a probe-local model, +input to the pending Step-2 stamp ruling, never the ruling itself; the +stamp tiers are an index over the `SpoHead` receipt stream, never a +second wire ABI; no OGAR mint anywhere in this file. + +**Files:** `probe_stamp_morton_cascade.rs`. + +## 2026-08-24 — E-BPE-OVER-DEFUSE-CHAINS-BEATS-LINEAR-AND-FITS-LOCO-1 — R2IL x BPE POC, corrected twice (codex review + architecture review): real per-occurrence immediates, per-merge-id amortization, and the 90-slot number demoted from "ceiling" to "one encoding's headroom" + +**Status:** FINDING — [MEASURED] (`PROBE-BPE-R2IL-LOCO-MICROCODE-1`, 10/10, +**re-measured after two review passes**). Originally landed with a +companion `PROBE-STAMP-MORTON-CASCADE-1` (7/7); the stamp-cascade design +fork was SPLIT OUT to its own PR per architecture review (orthogonal to +R2IL x BPE, muddied this entry's receipt) — see its own entry. +**Confidence:** High for the mechanism on this corpus (2 binaries, 143 +episodes, pass-1 seven-opcode convention); exploratory, not architectural, +for the three cross-codec invariants (INV1-3, explicitly labelled as such). + +**The architecture under test, operator-stated:** R2IL is the opcode — the +atomic, FAITHFUL vocabulary (thinking atoms + NARS; not P-code, not +SLEIGH). IR lands in V4, physically identical to V3 (16-byte content-blind +dock, classid selects the reading, no ENVELOPE_LAYOUT_VERSION bump). BPE +merges become candidate microcode macros — efficient recombination OVER +the faithful substrate. **R2IL carries faithfulness; BPE never needs to, +because it never has to be a second truth — B4's byte-exact round-trip is +the gate that keeps that boundary real.** + +**Headline (B2/B3), relabeled — NOT unconditional compression +superiority (architecture review):** 33 BPE merges over 1,872 real +def-use chain occurrences achieve **113.4 tokens saved per merge**, vs +**50.1** for the same BPE algorithm run over the LINEAR opcode stream of +the same episodes. The prior "2.3x denser compression per +domain-vocabulary slot" framing OVERCLAIMED: the chain-occurrence input +(5,616 atom-slots) OVERLAPS — the same `Op` row can sit in more than one +def-use chain and gets counted more than once — while the linear input +(5,340 atoms) counts each row exactly once. Normalizing by merge count +does not remove that exposure-multiplicity confound. Corrected reading: +**"the def-use-chain carrier saves more tokens per merge on its own +(overlap-inflated) occurrence stream"** — an equal-source-budget control +would be needed before calling this true compression superiority. + +**★ The `FnIndex` "90 free slots" number is DEMOTED — it is the headroom +of ONE ENCODING CHOICE (one `FnIndex` minted per macro), NOT the +autopoiesis vocabulary ceiling (architecture review, the single most +important correction of this pass).** `StyleLane::{Learned,Explore}` are +`[u8; 12]` — 12 palette256-indexed slots, one per `StyleFamily` ordinal +(`lance-graph-contract/src/soa_view.rs:41`), each byte selecting one of +**256** entries in that lane's OWN palette — a separate 256-wide address +space per lane, unrelated to `FnIndex`'s domain band. `ogar-loco` ROUTES +R2IL x BPE microcode into those planes; it does not have to OWN one +`FnIndex` per macro to do so. The corrected architecture: +`System[256, native Rust, fixed] | Learned[≤256, R2IL x BPE] | +Explore[≤256, R2IL x BPE]` — `ogar-loco`'s domain band is one possible +ADDRESSING scheme over that space, not its size. B1 still correctly +measures 7 R2IL atoms + B2's 33 merges = 40 of 90 slots under THAT ONE +encoding; read every "90"/"50 free" number in the probe file as scoped to +it, never as a vocabulary bound. + +**B5 — the loco fit, RE-MEASURED (codex review, P2: `n_atoms - 1` is the +merge-tree's internal edge count, a structural constant, NOT the real +external `Call.values` arity, which comes from `Episode::ins` at the +opcode's actual operand sites):** of 33 learned macros, real-immediates +classification is 7 fit `Pairs` (≤1 real imm), **13 fit `Triples`** (was +26 under the wrong metric), **11 fit `Quads`** (was 0), **2 fit NONE** +(need >3 real immediates — was 0; ids 18 and 38). The "0 fit NONE" +framing was too triumphant, exactly as flagged — some real macros need +MORE than this pass-1 chain-length-3 extractor's span can address. +Immediates measured content-matched per occurrence (`macro_span_in_ +occurrence`, order-independent — a merge id need not survive to an +occurrence's FINAL encoding, so a final-stream walk silently undercounts; +first fix attempt hit exactly this and was corrected before landing); +worst-case taken per macro (conservative for a `Call`); 0 of 33 macros +showed variable real arity across their occurrences on this corpus. + +**B6 is candidate ranking, never admission.** MUL +(`contract::mul::GateDecision`/`Homeostasis`/`FlowState`) is the real +gate; the autopoiesis triangle (`ValueTenant::{FrozenStyle,LearnedStyle, +ExploreStyle}`) is **resonance-based thinking**, not an RL policy — +`PROBE-METACOGNITIVE-TRIANGLE-1` (#998) already proved `RungReceipt`-only +judging, `FreeEnergyComparison::minority_wins()`, and Explore running in a +**counterfactual lane** (`deposit_counterfactual` stamping `RawEdge -6`, +never observed truth). B6 ranks via shipped `TruthValue::revise`+`Stamp` +only; freeze/admit/promote/gate belong to MUL and the triangle, never +this probe. **Relabeled (codex review, P2):** B6's 27 groups are DISTINCT +FINAL-ENCODING SIGNATURES, not one-per-learned-macro (a group can bundle +several merge ids, or a merge id plus a leftover atom) — the earlier +label implied a 1:1 mint correspondence that doesn't hold. + +**Three exploratory cross-checks against shipped precedent (INV1-3):** +- **INV1 (HighHeelBGZ's stride-as-role):** 33 macros collapse into 21 + atom-multiset role classes, largest holds 4. +- **INV2 (bgz17 `LayeredScope`'s scent-prune-then-escalate):** of 5,054 + linear-window candidates, a cheap opcode-multiset check prunes 4,053 + (80.2%) before the expensive exact def-use walk runs on the 1,001 + survivors (414 truly chained, 587 coincidental). +- **INV3 (BGZ-HHTL-D's shared-palette amortization), RE-MEASURED (codex + review, P2: was grouped by B6's final-encoding signature — 27 groups, + not 33 macros — the wrong unit for "episodes-per-mint"):** now counted + per LEARNED MERGE ID directly (content-matched, same fix as B5): **33 + macros measured**, top-5 by occurrence carry episodes-per-mint + **[86, 90, 63, 80, 56]** (was [63,80,74,47,30] under the old grouping) — + real cross-episode amortization, now on the correct unit. + +**Process notes (autoattended, auto-resolve, two review passes):** +- Container restart lost the first BPE-probe worker's entire in-progress + write — re-dispatched from scratch. +- The re-dispatched worker introduced 2 real defects (an atom-count + conflation; several raw `Option`/tuple Debug-format leaks) — hand-fixed + by the orchestrator, reverified by recompiling rather than trusting + self-report. +- Meta-review (Opus) failed **four consecutive times** to a server-side + API 529 Overloaded outage — the PR was opened without it per operator + direction rather than holding indefinitely. +- **A live `codex` GitHub review on the opened PR caught 3 real P2 + defects** (the two re-measurements above, plus the same + final-encoding-vs-merge-id conflation appearing in both B6 and INV3) — + all three fixed and re-verified by full recompile + rerun against the + real corpus, not accepted on the reviewer's or a worker's word alone. +- **A separate architecture review caught the 90-slot framing + over-claim** (routing capacity mistaken for vocabulary ceiling) before + merge — fixed in both the probe's doc comments and this entry. + +**Fences:** no mint actually performed anywhere (no classid, no +vocabulary table, no learner subsystem, no write to any +`ValueTenant`/MUL/triangle type); `ogar-loco`, bgz17's cascade shape, +`highheelbgz`'s `SpiralAddress`, `BGZ-HHTL-D`, and `ruff_r2il` are all +MIRRORED/CITED, never imported; corpus is 2 binaries at the pass-1 +seven-opcode convention — nothing here is a claim about x86-64 in general; +V4 is physically V3 (no layout bump); this probe writes no bytes at rest; +B6 ranks candidates only, admission is MUL's/the triangle's. + +**Files:** `probe_bpe_r2il_loco_microcode.rs`. +## 2026-08-24 — E-GIT-SOURCED-CRATE-CANNOT-PATH-DEP-OUTSIDE-ITS-REPO-1 — `lance-graph-ogar`'s OGAR path deps could not resolve for ANY external `git` consumer; the "sibling-checkout" mental model does not survive a `git` dependency + +**Status:** FIX — [MEASURED] (verified: `cargo check` + `cargo test` +green, 72+ lib tests including the codebook COUNT_FUSE, all under the new +`git` deps). + +**Root cause, generic to every external consumer, not one project:** +`crates/lance-graph-ogar/Cargo.toml` depended on five OGAR crates via +`path = "../../../OGAR/crates/..."` — an escaping relative path, +justified by a documented "operator policy (2026-07-07): NO PINS" note +for this sandbox's local multi-repo layout. That policy is correct for a +LOCAL build (this session, tesseract-rs CI's sibling-checkout precedent) +but cannot survive `lance-graph-ogar` being pulled as a `git` dependency +by ANY external repo (`some-consumer -> lance-graph-ogar` via +`git = "https://github.com/AdaWorldAPI/lance-graph", branch = "main"`). +Cargo clones a git-sourced crate into its own opaque checkout cache +(`~/.cargo/git/checkouts/lance-graph-//`); a `path = +"../../../OGAR/..."` inside it resolves relative to THAT cache directory, +which has no OGAR sibling — nothing ever puts one there, regardless of +how fresh either repo is on GitHub or on the builder's disk. **A crate +with an escaping path dependency cannot be consumed via `git` by any +external repo, ever — this is a hard Cargo constraint, not a missing +setup step, and it affects every one of `lance-graph-ogar`'s consumers +identically**, not a single project's build. First checked "is OGAR +stale?" and ruled it out: local `/home/user/OGAR` matched `origin/main` +exactly, `ogar-loco` has been on `origin/main` since 2026-08-05 +(`89d0d3a9`). + +**Fix:** switched all five OGAR deps (`ogar-vocab`, `ogar-class-view`, +`ogar-ontology`, `ogar-loco`, `ogar-adapter-surrealql`) from `path` to +`git = "https://github.com/AdaWorldAPI/OGAR", branch = "main"`. +Verified `cargo check`/`cargo test` green standalone (this crate owns its +own `[workspace]` root); both git deps resolved to the identical rev +(`#719471db`) already referenced by the existing `[patch]` section, so no +new contract-source divergence was introduced. Tradeoff accepted +explicitly: the 2026-07-07 policy's "always current sibling, no +Cargo.lock pin" property is gone for this crate — a pin is now unavoidable +for external consumability. Local/in-sandbox dev is unaffected (same +public repo, still fetched/cached). + +**Known residue, NOT fixed here:** `symbiont` and `cognitive-stack` +(named in the same superseded comment as sharing this pattern) carry the +identical escaping-path shape and were left untouched — `symbiont` is +separately marked deprecated/operator no-go; `cognitive-stack` is +unaudited for external git-consumers. Tracked here so a future session +does not assume this fix covers them. + +**Fences:** no behavior change to OGAR's contract surface, only the +dependency SOURCE type; the `[patch]` section (already redirecting +`ogar-class-view`'s transitive `lance-graph-contract` onto the path copy) +is untouched and still correct, since patches redirect FROM a git source +TO a path source — the broken direction was the reverse (a path +dependency escaping a git-sourced crate), which `[patch]` cannot fix at +all (path dependencies are not patchable). + +**Files:** `crates/lance-graph-ogar/Cargo.toml`. + +## 2026-08-23 — E-ONE-RECEIPT-MANY-BORROWED-CONSUMERS-1 — the integration half of #1012: one versioned tokenization drives Tantivy, DeepNSM-v2 and a forward surface with zero re-tokenization, and the four gaps that stand between that and a carrier + +**Status:** FINDING — [MEASURED] (`PROBE-TOKEN-SEAM-1`, 37 gates, **13 +disable-runs each verified red-then-green**; two committed real corpora — the +in-tree KJV Genesis scene `PROBE-TOKEN-BPE-GEOMETRY-1` used, carried verbatim so +the numbers are comparable, and Project Gutenberg's *Alice* split into 300 +paragraphs, 75 514 B). The probe lives in `AdaWorldAPI/paperless-rs` +(`crates/paperless-token`, `docs/TOKEN-SEAM-ARCHITECTURE.md`) because it needs a +Tantivy dependency this workspace does not carry; this entry records the +**lance-graph-side** findings. +**This closes the integration half** of +`E-TOKEN-BPE-CAN-FIT-NOT-YET-BUY-1` (#1012). That verdict measured that BPE FITS +the `6×(8:8)` geometry and refused to buy a carrier. It did not ask whether one +tokenization can SERVE several consumers at once. It can. +**Confidence:** High for what is measured at these two corpus scales; the 8-bit +lane saturated at 75 KB, so nothing here is a scale claim. + +**Headline.** ONE tokenization per span drove all three consumers and each added +**zero** further tokenizations — not by discipline but by construction. Totals: +313 source tokenizations for 308 spans plus 5 deliberate fixtures, and 1 QUERY +tokenization on a deliberately separate counter (a query is different bytes; +folding it into one number would make the claim a lie). + +**The two facts that make it adoptable, and neither was designed for this:** + +1. **DeepNSM-v2's library is already tokenizer-free.** `parse_to_spo(&[Tagged])` + consumes `(WordId, Pos)` pairs and touches no string; the + `split_whitespace`/`normalise` logic lives ONLY in `examples/bible_wave.rs` + and `examples/genre_shapes.rs`. The seam needed **no change to the crate**. + The `(WordId, Pos)` boundary is the shipped seam and nobody had used it as + one. +2. **Tantivy structurally cannot own offsets.** Its indexer reads `Token::text` + and `Token::position`, uses `position_length` transiently, and reads + `offset_from`/`offset_to` NOWHERE outside its own tests. Offsets are consumed + only by snippet generation, which re-tokenizes the STORED text at query time. + An index cannot become the ABI here even by accident. + +**Measured, and the numbers are the point rather than the verdict:** + +| | KJV scene | Alice | +|---|---|---| +| bytes / spans / tokens | 1 126 / 8 / 354 | 75 514 / 300 / 37 149 | +| compression | 3.18× | **2.03×** | +| distinct ids used | 137 | **247 of 255** | +| resident lane bytes | 832 (74 % of source) | 55 572 (74 %) | +| receipt share of resident | 54 % | 30 % | +| particles/span p50/p95/max | 4 / 8 / 8 | 8 / 30 / 43 | +| tokens per lexical unit p50/max | 1 / 7 | 2 / 15 | +| tokens straddling a word boundary | 30 | 58 | + +- **The 8-bit lane SATURATES.** 247 of 255 ids on 75 KB of ordinary English, with + compression already fallen from 3.18× to 2.03×. The canon's answer — the hi + byte of each `(8:8)` pair as a PAGE lane, two separate bytes, never a widened + `u16` — is **untested**. Until it is measured no scale claim about token BPE + should be made, and this supersedes any reading of #1012's 3.35× as a + corpus-independent figure. +- **The resident lane is ~74 % of the source text, not a fraction of it**, and + at these span sizes **framing is 30–54 % of it**. A 56-byte receipt against + 12-byte particles means the RECEIPT's column layout matters more than the + particle's. #1012 could not see this — it had no receipt. +- **Cardinality is not 1:1 in either direction**, so a BPE↔`WordId` projection + is a real function, not a relabelling. Nothing in the seam assigns a `WordId` + to a BPE token; that would be a second vocabulary wearing DeepNSM's + coordinate system. +- **Byte offsets are DERIVED**, by prefix sum over a per-id decoded-length + table. The receipt stores no offset column at all. + +**Four lance-graph-side gaps, each named rather than worked around:** + +1. **No shipped token continuation mechanism anywhere.** The nearest precedent + in SHAPE is `rail_geometry::RailCarving::AxisSlab { reg, cont: Option }`, + which chains one register to one continuation and caps at `RAIL_MAX_DEPTH = 24` + levels — **below the measured p50 of 4 particles**, so it does not fit. The + probe uses a contiguous run (`first_particle + particle_count + token_count`). + Stated honestly there are TWO lawful framings and the trade is exact: + `particle_count` alone bounds the run and a PAD scan inside that bound is + already exact BECAUSE PAD is reserved (cost: one vocabulary slot, which at a + 255-cap that saturates is not free); or `token_count` costs 4 bytes and frees + the slot for a full 256-id alphabet. What is unlawful is inferring the end + from padding with no bound — measured, a lane-wide PAD scan overshoots + receipt 0 by 10 tokens straight into receipt 1. +2. **`ValueTenant` has no token variant** (16 discriminants, none for text), so a + lawful resident lane must implement `SoaEnvelope` or land as a new tenant. + The probe's lane is a probe-local `Vec` and says so. +3. **There is no callable part-of-speech surface, and the reason is a decision + already taken.** `coca_pos`/`archaic_pos`/`normalise` are byte-identical in + BOTH deepnsm-v2 examples, above a comment stating `deepnsm_v2::lexicon` was + DELETED after an audit found `lance-graph-planner`'s `insight_coca_read` + already grounds it. That grounding does not reach a lean consumer: + `insight_coca_read` is itself an **example binary**, in a crate carrying + `serde`/`serde_yml`/`tokio`/`ndarray`, and its master `lexicon.tsv` is absent + from this checkout. The probe restated the twenty-line tagger rather than + re-litigate the deletion — recorded so the next consumer has the evidence the + audit did not. +4. **The semantic half is unexercised.** `cam96_codebook.bin` / `cam96_codes.bin` + are release assets, absent here, so palette256² DISTANCE never ran. Only the + lexical/grammar half was measured. + +**Polars: refuted, and the honest form is weaker than the question invited.** A +sweep of nine checkouts found **zero** `polars` occurrences in any manifest or +source; every `DataFrame` mention is prose. `paperless-rs` and `tesseract-rs` +declare none of arrow/datafusion/lance/lancedb. There was nothing to remove. The +structured-evidence path is likewise not tabular algebra: +`lance-graph-arm-discovery` takes `Dataset { spec: FeatureSpec, rows: +Vec> }` — category-index rows against a schema. + +**Method note, and it is the transferable part.** An independent vacuity audit of +the finished probe found FIVE holes: a gate asserting byte counts but never span +counts (the CRLF bug that collapsed 300 spans into 1 would have re-passed it), a +threshold true by construction, an assertion about a type signature rather than +behaviour, an unconditional prefix check, and an unexercised ASCII-vs-Unicode +whitespace divergence. All five are fixed; four gained their own disable-runs; +the fifth is bounded by a measured count of 0. Separately, TWO disable-runs were +themselves wrong first — one relaxed a knob that does not bind on the fixture, +one targeted a mechanism the gate did not actually rest on — and an early batch +reported "no failure" six times in a row because the probe binary path was wrong +and nothing ran. **A knob that does not bind is not a disable; a fixture's SHAPE +is part of a test's coverage; and a null result is a claim about the apparatus +until proven otherwise.** + +**⚠ SELF-CORRECTION, same session, after being pointed at `ogar-doc-ir`.** Two +claims above were wrong and are corrected here rather than left standing: + +1. **The seam invented an identity that already existed.** The first cut minted + `source_id`/`span_id` integers. `ogar_doc_ir::DocIr` already answers all + three questions a tokenization receipt asks — `content_sha256` for WHICH + document, `(DocPage::number, Region::reading_order)` for WHICH span, and + `Region::text` for the span's canonical text. The probe was re-cut to read + them (`docir.rs`; gates `T-DOCIR` / `T-DOCIR-KEY` / `T-DOCIR-SPANS`, 41 + total, 18 disable-runs). Note the crate's own docs CORRECT its plan's first + sketch on what that hash is: a **per-acquisition dedup key**, not a + cross-retina identity — which is exactly the right reading for a receipt, + because you tokenize bytes. +2. **"The OCR boundary supplies no byte offsets" is RETIRED as a gap.** It + supplies no PAGE-wide offset and does not need to: a region owns its text, + so an offset is region-local, and `ogar-from-docv1::region_text` is where the + `leading_space`-aware join already happens. What remains is far smaller — a + sub-region span needs a non-zero `byte_from`, which the receipt already + carries and no producer emits. + +Also corrected: the `247 of 255` figure quoted above is the count of ids +APPEARING in the lane, not the vocabulary size. Measured, the trained table is +**full at 255/255** on Alice (and on the whole 170 KB file), and **180 of 255** +on the KJV fixture — where, as #1016's own record of that fixture says, the +CORPUS rather than the cap set it. The saturation conclusion holds and is +stronger; the number was the wrong quantity. + +**Untouched by this.** HHTL is address geometry and BPE is tokenization — +#1012's measured refutation of the merge tree as a radix prefix partition +stands. Content never travels in classid: the contract id is a FIELD on the +receipt, gated by a grep of the library's own non-comment source. +## 2026-08-23 — E-THE-SEVEN-OPCODE-PROJECTION-IS-NOT-X86-AND-THE-CHAIN-CARRIER-WINS-1 — four wave probes: the chain carrier confirmed, the vocabulary survives optimization, and the boundary that qualifies all of it + +**Status:** FINDING — [MEASURED] × 4 (`PROBE-R2IL-OPTIMIZATION-TRANSFER-1` 5/5, +`PROBE-R2IL-DEFUSE-MACROS-1` 6/6, `PROBE-R2IL-SLAG-BOUNDARY-1` 5/5, +`PROBE-STAMP-CAPACITY-1` 6/6). Autoattended wave: 6 slices — 4 Sonnet probe +workers, 1 Sonnet scribe, 1 Opus synthesis worker, 1 Haiku guarded executor for +the gate sweep. Orchestrator compiled centrally, adjudicated every gate, fixed +the P0s, and is the sole writer of this entry. +**Confidence:** High for these two binaries at the pass-1 convention. The +fourth finding is precisely the reason that qualifier is not boilerplate. + +**F-10 — the def-use chain carrier CONFIRMS its own prescription.** #1014 +concluded "the macro carrier must be the def-use chain, never the linear opcode +window." Run as code on the same 143 episodes: 1,872 length-3 def-use chains +collapse to **27 distinct signatures** against the window's **97** (3.6× tighter), +and the chain top-10 carries **0.887** of all occurrences against the window's +**0.505**. Decisively: **95.9%** of the top chain's occurrences skip at least one +intervening op (median span 6, max 148) — they are invisible to a window matcher +at any width the data would justify. The prescription was not merely reasonable; +it is measurably the better carrier. + +**F-9 — the idiom vocabulary survives optimization COMPLETELY (pre-registration +refuted in place).** TRAIN `stress_test` (71 fns / 3040 ops) vs held-out TEST +`stress_test_opt` (72 / 2300), same source, disjoint address keys. Predicted +PARTIAL survival on the theory that some top idioms are unoptimized-compilation +artifacts. Measured: **10/10** top-K transfer; of 64 TRAIN trigram types **61 +survive** (3 TRAIN-only) while TEST carries **94**, of which **33 are TEST-ONLY**. +The optimizer did not prune the vocabulary — it ADDED to it, while cutting +ops/function 42.82 → 31.94. The density half of the prediction held; the pruning +half was wrong and is recorded in the probe's own docs, not adjusted away. + +**F-11 — THE BOUNDARY, and it qualifies every finding in this arc.** The +harvest's addressed residual is **larger than its classified output**: +classified 17,557 rows vs residual count 36,747 (**ratio 0.478**), of which +**88.1%** is the single named reason `opcode_not_in_convention`; every +`by_address` shape sums EXACTLY to its `grouped` count. The furnace is behaving +correctly — the residual is convention-bounded and named, never dropped. But the +consequence is sharp: **F-1's 99.7%, F-2's type-collapse and F-10's chain +vocabulary are all measured over the seven-opcode projection, with roughly twice +that volume sitting outside it.** These are not claims about x86-64; they are +claims about a projection of two binaries. Stating that plainly is the finding. + +**F-12 — the stamp loss curve.** Through the shipped `Stamp`: loss is exactly 0 +for every N ≤ 64 and strictly positive past it — 33.3% at 96, **55.2% at 143**, +87.5% at 512. The 55.2% is the upper bound (every source hitting one macro); +#1014's measured ~26% is one real idiom appearing in fewer than all episodes. +Modelled 128/256-bit registers recover 15/0 dropped at N=143 — **modelled only, +not a proposal, not implemented, memory/cache/wire costs unmeasured.** Any width +change is the operator's ruling; this is input to it. + +**Wave-process notes worth keeping:** +- A worker caught an error in ITS OWN BRIEF: I specified the slag `by_address` + section as 5 columns; the file declares 4. It parsed what the file declares and + said so, rather than reconciling silently. That is the brief being wrong and + the guardrail working. +- The Haiku executor STOPPED at command 1 on a formatting failure (a worker file + landed after my format pass), wrote its receipt, attempted no fix, and escalated + — exactly its contract. Supervisor fixed and re-carded. +- Two pre-registrations were refuted across the wave (F-9 here, E3 in #1014). Both + recorded in place. A wave that never refutes a prediction is not measuring. + +**The meta-review changed the findings, not just the code.** A read-only Opus +reviewer returned FIX-THEN-LAND with 4 P0s: three gates that no input could fail +(one of which LABELLED a true-by-construction identity "the falsifier for this +whole section"), and this arc's own knowledge-doc header stating F-1 as an +unqualified claim about "real machine code" that the same document later +contradicts. Two findings were WEAKENED as a result and are recorded here in +their weakened form: **F-10 no longer claims "the prescription is confirmed"** — +the chain carrier's over-admission is 0 *by construction*, so what remains is an +uncontrolled concentration comparison (1,872 chain occurrences vs ~5,054 window +occurrences, no occurrence-matched control run); and **F-11's ratio compares ore +ROWS to residual COUNT UNITS**, which no gate establishes are the same unit, so +it is a magnitude comparison and is now labelled one. Every P0 and the +load-bearing P1s were fixed, every gate re-run green with strictly harder +assertions. A review that only confirms is not a review. + +**Files:** `probe_r2il_optimization_transfer.rs`, `probe_r2il_defuse_macros.rs`, +`probe_r2il_slag_boundary.rs`, `probe_stamp_capacity.rs`, +`.claude/knowledge/r2il-behavioral-carrier.md` (the consolidated reference, +F-1..F-12). + +## 2026-08-23 — E-REAL-CODE-INTERLEAVES-THE-OPCODE-MACRO-IS-NOT-A-DATAFLOW-PIPE-1 — the real FunctionBehavior episode measurement: 99.7% over-admission by opcode matching, and three structural facts the toy could not show + +**Status:** FINDING — [MEASURED] (`PROBE-R2IL-REAL-EPISODES-1`, 5/5, run +against the REAL ruff-side R2IL pass-1 harvest: 143 functions from real +x86-64 ELF64 binaries, 17,557 typed FlatFact rows, provenance FNV-pinned in +ruff's committed `.claude/harvest/r2il/PROVENANCE.md`; bulk stream from the +ruff GitHub Release `r2il-harvest-pass1`). +**This closes the named-not-built item** from +`E-HAPPY-PATH-RL-WOULD-HAVE-LEARNED-THE-CLOBBER-1` — the corpus was fetched, +never fabricated; the probe is env-gated (`R2IL_ORE_TSV`) and exits CORPUS +ABSENT rather than synthesize. +**Confidence:** High for these binaries at the pass-1 seven-opcode +convention; a 2-binary/143-function corpus is not "all real code." + +**Headline (E5):** of 380 real occurrences of the top recurring opcode +trigram `(int_add, copy, store)`, exactly **1 is dataflow-chained** and 379 +are NOT — a happy-path opcode matcher over-admits **99.7%** on real code. +Context base rate: 31.5% of ALL adjacent op pairs are def-use linked (SSA +coverage is total — 0 of 11,653 operand rows lack a ValueId — so this is a +dataflow fact, not missing coverage). The top idiom chains far BELOW base +rate: it is an ADDRESSING idiom (address computed, value staged, store +issued to memory), not a dataflow pipe. Real code interleaves independent +chains; **sequential adjacency is not composition**. The Phase-2 R6 toy +result (happy-path RL learns the clobber) is thus confirmed at real scale +and sharpened: on real machine code the macro carrier must be the DEF-USE +CHAIN, never the linear opcode window. + +**Refuted pre-registration, recorded (E3):** "real top-1 trigram count > +shuffled" FAILED (380 vs 387) — shuffling a copy/int_add-dominated marginal +CREATES monotone `(copy,copy,copy)` runs. The real structure is +TYPE-COLLAPSE: 97 distinct trigram types vs 264 under shuffle (>2.7x), and +the top-10 types carry 50.5% of real occurrences vs 33.6% shuffled. +Recurring idioms are real; top-1 occurrence count was the wrong statistic. + +**The stamp ceiling BINDS at real scale (E4):** with 143 episodes and +`Stamp`'s 64 bits, every widely-recurring macro measurably drops evidence — +`(int_add,copy,store)`: 64 revised, 23 CHOICE-dropped (e=0.999). The +modulo-64 conservatism is no longer a footnote: at real corpus size it +discards ~26% of the evidence for the widest idiom. Conservative (never +double-counts), but a real capacity note for Step-2's stamp residue item. + +**Reader validity (E1/E2):** the probe-local TSV reader is cross-validated +against ruff's INDEPENDENTLY COMMITTED census — 17,557 rows, 5 kinds, 9 +opcodes, all counts exact; 143 episodes across 2 binaries, 5,340 ops +partitioned. One misread caught by the gate: the TSV's kind column carries +CamelCase variant names, not Census's snake_case (the first E1 run failed — +the gate working). + +**Fences:** no `ruff_r2il` import (separate cargo workspace; schema cited, +E1 catches misreads); reading the evidence TSV here is a measurement, not a +re-ingest into ruff's pipeline; no mint, no BPE, no learner subsystem; the +R2IL x BPE / OGAR-loco / V4 synthesis remains a three-IF hypothesis. + +**Files:** `crates/lance-graph-planner/examples/probe_r2il_real_episodes.rs`. + +## 2026-08-23 — E-HAPPY-PATH-RL-WOULD-HAVE-LEARNED-THE-CLOBBER-1 — R2IL machine-state receipts are the falsification substrate the toy Phase-1 world could not provide + +**Status:** FINDING — [MEASURED] (`PROBE-R2IL-FRONTIER-PHASE2-1`, 7/7). +**Phase 2 of 2** — Phase 1 is `E-THE-FRONTIER-LEARNER-IS-ALREADY-SHIPPED-1` +(the loop = shipped `revise` + `Stamp` + CHOICE, nothing new). This entry +lifts that loop onto R2IL-shaped typed behavior ops and measures what the +richer vocabulary BUYS. +**Confidence:** High for the mechanism; the machine is a 4-register toy and +both oracles are probe-local (stated) — no claim about real binaries until +real `FunctionBehavior` episode streams are measured. + +**The headline (gate R6):** a "reckless" candidate macro computes the RIGHT +value into the WRONG register, clobbering callee-saved `r3`. The deliberately +sloppy happy-path oracle ("the doubled sum exists in SOME register") rewards +it until its NARS expectation reaches **e = 0.812 — ABOVE the 0.75 trust +bar** — and it is refused ONLY by the falsification intervention that checks +the actual contract (result in `r2` AND `r3` bit-preserved). Happy-path RL +would have learned the clobber. The falsification-first admission predicate +(`LearnedSurvivedTests`, #1011 F6) is not a nicety at the R2IL level — it is +the difference between a learned macro and a learned bug. + +**Why R2IL is richer (gate R1, measured not asserted):** Phase 1's op +vocabulary was style-local labels; R2IL's `FactKind` discipline +(Op / OperandIn / OperandOut / Edge / MemUse / MemDef / Predicate / +CallSite, mirrored from `ruff_r2il` at ruff `origin/main`) gives every op a +typed operand signature over Varnodes (space→offset→size). That is what +makes BEFORE + TYPED EDIT = AFTER checkable at the MACHINE-STATE level +(gate R2: `(7+5)*2 = 24` lands in `r2`, `r3 = 0xDEAD` preserved, +byte-identical replay) — the #1001 typed-receipt law extended to behavior. + +**The other gates:** R3 arms the trap (the sloppy signal raises BOTH +explorers' trust — reckless reaches e > 0.9); R4 the intervention admits +the lean macro and refuses the reckless one; R5 dispatch flips to the +cheaper PROVEN macro (2 ops); R7 fences with MEASURED sizes — `Vn` = 8 B, +`R2Op` = 28 B, `MachState` = 32 B. The R7 sizes are measured, not guessed: +the gate's first run FAILED on hand-guessed sizes (12/40), which is the +gate working. + +**Honesty box:** toy 4-register machine; both oracles probe-local; the +R2IL shapes are a cited probe-local MIRROR (ruff is a separate cargo +workspace — never imported); real-corpus `FunctionBehavior` episode streams +are NAMED, NOT BUILT (absent from this checkout); the V4 plane classid +remains provisional (O5 gate); the widened R2IL × BPE / OGAR-loco / V4 +synthesis stays a three-IF hypothesis — nothing here mints, reserves, or +decides it. + +**Files:** `crates/lance-graph-planner/examples/probe_r2il_frontier_phase2.rs`. + +## 2026-08-23 — E-THE-FRONTIER-LEARNER-IS-ALREADY-SHIPPED-1 — thinking styles are microcode; Autopoiesis-frontier reinforcement is NARS revise + CHOICE, and needs no new subsystem + +**Status:** FINDING — [MEASURED] (`PROBE-STYLE-MICROCODE-FRONTIER-1`, 9/9). +**Phase 1 of 2** — Phase 2 (R2IL as the richer op vocabulary) is RECORDED, +not built. +**Confidence:** High for the loop machinery; the world oracle is a toy +(stated), so no claim that any real style wins — production episodes are +Phase 2 material. + +### The operator's intent, mapped onto shipped machinery + +``` + "microcode for thinking styles" style = ORDERED GROUP of typed ops + (the B3 ordered-group result applied) + "runtime evolvement of outcome TruthValue::revise over per-style + revision" claims, Stamp-gated per episode + "resonance based thinking" dispatch = expectation() (CHOICE) + "frozen learned explore both groups RESIDENT over one op + superposition" vocabulary — a group distinction, + never a subsystem + "what is more efficient, measured op-count cost; takeover + reusing that" requires truth AND lower cost + Autopoiesis rung 4 of the content ladder + (StyleFamily macros + autopoiesis + triangle; StyleLane/cognitive_palette + ship the triangle lanes today) +``` + +### The headline: no learner subsystem exists, and none is needed + +Per-style learned state is exactly one shipped `TruthValue` (8 B) + one +shipped `Stamp` (8 B). The "reinforcement learning" is: + +- **Revision** — episode outcomes revise the style-level claim via the + SAME `revise()` that pools belief evidence, with the SAME + stamp-disjointness guard: a replayed episode is bit-inert (S4 — no + double-count, measured). +- **Choice** — dispatch is `expectation()` + measured cost: among styles + clearing the trust bar, the cheapest PROVEN one wins (S6: the lean + 3-op explorer overtook the 4-op incumbent — *"frozen learned explore + superposition of what is more efficient and reusing that"*, as a gate). +- **Admission** — freezing is the `LearnedSurvivedTests` predicate from + #1011 applied at the style level: high expectation AND a survived + falsification episode (S5). The cheapest-but-unsound explorer was + revised DOWN to e=0.07 and can neither freeze nor dispatch (S7) — + **repeats-but-fails cannot be reinforced**, F6 again, one level up. +- **Evolution** — mints NEW explore groups; frozen microcode is + bit-immutable (S8). The population does not move; the frontier does. + +No gradient, no bandit, no Q-table, no reward-model type (S9 pins the +sizes so a smuggled subsystem fails the gate). + +### Phase 2 — R2IL, recorded not built (operator: "R2IL is way richer") + +Where Phase 1's ops are #1001 view-edit atoms, R2IL carries +reconstructible typed BEHAVIOR — the `VarnodeFacet` typed drill, +`FlatFact` no-heap rows, intervention/counterfactual operations (the +four-plane DID plane). **The identical loop lifts onto it:** R2IL ops as +microcode members, episodes as interventions with observed consequences, +revision from outcome, freezing gated on surviving falsification. +Fences carried forward: the V4 classid stays provisional (O5 gate), no +R2IL type was imported in Phase 1, same-dock ≠ same-ClassView, and +behavior semantics stay V4's. Phase 2 begins only after this loop shape +is ruled sound. + +**The widened synthesis (operator, same session — recorded as HYPOTHESIS +in the mandated conditional phrasing):** `R2IL × BPE`, OGAR-loco macro, +**V4 as the thinking dynamic.** Precisely: IF measured recurrent typed +R2IL behavior requires a resident macro representation, the +recurrence/compression machinery MAY compress ordered groups of R2IL +transformations into reconstructible macros (token-BPE measured CAN-FIT; +the behavioral carrier stays UNDECIDED); IF that recurrence produces +reusable routing structure, OGAR-loco-shaped routing MAY carry it; and +V4-shaped behavior geometry is one possible future carrier for the +resulting thinking DYNAMICS. Three IFs, zero decisions: every admission +condition from the root order applies unchanged, and none of the three +is built, reserved, or minted. + +## 2026-08-23 — E-MEMBERSHIP-IS-PARTICIPATION-NOT-ANCESTRY-1 — multi-group membership proven on the simple primitive; behavioral compression stays UNDECIDED + +**Status:** FINDING — [MEASURED] (`PROBE-MULTI-GROUP-MEMBERSHIP-1`, 11/11). +Executes the operator's root order: exhaust MANY-TO-MANY GROUP MEMBERSHIP +before any behavioral compression carrier exists even as a proposal. +**Confidence:** High for the membership half. The behavioral half proves +MACHINERY only — its recurrence is a property of the mechanical driver, +deliberately, and production-scale recurrence is UNMEASURED and open. + +### The three things, kept distinct (the AD lesson, measured) + +``` + hierarchy gives scope / address (HHTL home) + membership gives participation (many-to-many relation rows) + masks give cheap selection (derived execution artifacts) +``` + +- **M1** — one resident item belongs to Group A AND Group B simultaneously, + and Group C is addable by appending ONE relation row; every canonical + byte stationary throughout. +- **M2** — `members`/`memberOf` are inverse VIEWS over ONE + `Membership { member_address, group_address, order? }` relation (a + probe-local shape, NOT a prescribed layout); no duplicated truth exists + to diverge. +- **M3** — a group's `RowFocusMask` is compiled FROM the relation, + deleted, and recompiled to identical coverage: the mask is a derived + execution artifact, never a semantic owner. +- **M4** — join + leave touch only membership rows; all resident docks + stay byte- and order-identical (F12 held). +- **M5 — the demarcation, now measured from the membership side too:** + a group's applicability inherits DOWN a region via `covers`, while a + cross-subtree member belongs with NO ancestry in any direction. + **GROUP MEMBERSHIP IS RELATION TOPOLOGY, NOT HHTL ANCESTRY.** + +### The behavioral half — #1001 receipts as the ONLY lawful source + +- **B1** — 26 receipts replay to the exact final state: + `BEFORE + TYPED EDIT = AFTER`, with REFUSED edits retained together with + their refusal. A trajectory, not a log. +- **B2** — recurrence measured, not assumed: 24 granted ops, 7 unique, + repeated 2- and 3-subsequences detected. **Honestly labelled:** the + recurrence is the mechanical driver's (same typed pattern per subject) — + it proves detection machinery, never that production behavior recurs. +- **B3** — the recurrent pattern becomes an ORDERED group over typed ops + (order is the only new ingredient vs an ordinary group): op REFERENCES + + positions, replayed by order to the exact typed sequence. Nothing + copied, nothing mutated, F3 held. +- **B4 — falsifier F6, run as code:** a `PushRungBand(9,9)` edit recurred + twice and was warrant-refused both times; the candidate filter (granted + receipts only) structurally never sees it. **Behavior that merely + repeats but repeatedly fails cannot be learned.** +- **B5 — the comparison:** raw receipts 624 B (AUTHORITATIVE; groups + reference, never replace), ordered group +288 B ON TOP. At this scale + grouping ADDS cost and buys only addressability of the recurrence. + +### The verdict line, verbatim as the root order requires + +``` + BEHAVIORAL COMPRESSION CARRIER: UNDECIDED +``` + +Admission conditions stand exactly as the operator listed them (typed-IR +source units, measured recurrence, exact reconstruction, order preserved, +applicability preserved, truth/provenance/warrants survive, falsification +history survives, no copy/repack, carrier follows measured distribution, +no second cognitive universe). No `BpeTable`, no token universe, no +learner, no V3/V4 sidecar, no speculative object fields — B-FENCE pins +the exact type sizes so a smuggled subsystem fails the gate. If +production recurrence turns out too rare, **the correct result is NO +BPE.** + +## 2026-08-23 — E-TOKEN-BPE-CAN-FIT-NOT-YET-BUY-1 — BPE fits the fixed 6×(8:8) geometry reconstructibly; the merge tree is measurably NOT HHTL ancestry; nothing yet justifies a production carrier + +**Status:** FINDING — [MEASURED] (`PROBE-TOKEN-BPE-GEOMETRY-1`, 8/8), on +ONE real fixture-scale corpus (the in-tree KJV Genesis 2–3 scene, 1125 +bytes). **Scope fence:** this is TOKEN BPE (intake tokenization into the +existing 12-byte payload) — NOT behavioral BPE (recurring typed #1001/R2IL +transformations), which remains a separate queued investigation. Results +do not transfer between the two in either direction. +**Confidence:** High for what is measured; every number is fixture-scale, +and the scale corpora (COCA, whole-KJV, R2IL streams, AST intake) are +ABSENT from this checkout — reported absent, never simulated. + +### The question and the verdict + +> Can BPE act as a reconstructible intake tokenizer over the fixed +> `6×(8:8)` geometry without changing HHTL, classid semantics, or the +> resident memory ABI? + +**CAN-FIT, NOT YET BUY.** It fits: 1125 bytes → 336 tokens (3.35×) at a +255-cap vocabulary, decoded byte-exact, packed into 28 resident `[u8;12]` +`Copy` particles, with no classid anywhere in the token path, no +token-object population proposed as canonical, no hash standing in for +content, and no ML machinery. Nothing at this scale justifies a +production token carrier. + +### The three readings, measured + +- **A — six independent pair subspaces:** works; slot-scoped word + vocabularies (sizes 25–31 here) fit the LO lane with the HI lane free + as a page. `u8:u8` stays two bytes, never a u16. +- **B — hierarchical/refinement pairs:** pair-ENCODABLE by construction + (every merge is `(left:right)`, both ids u8) — but **measurably NOT + lawful HHTL ancestry**: 3 same-depth token pairs are prefixes of each + other, so "siblings" OVERLAP. A binary merge DAG over strings is not a + radix prefix partition. **Encodability ≠ hierarchy** — the fence "do not + confuse a merge tree with the ontology tree" is now a measured fact, + not a warning. +- **C — BPE over already-lawful byte symbols:** the clean candidate. + Compression and reconstruction both green; cost reported as OPERATION + COUNTS (81852 encode probes, 1914 decode expansions), never wall time. + +### Measured surprises worth keeping + +1. **Scoped vocabularies LOST here** — per-chapter tables produced 19% + MORE tokens than one global table, against the intuition that a scoped + 256-entry codebook wins. Weak signal (two chapters of one book), but it + converts "scoped is obviously right" into "the comparison must be run + per real corpus." +2. **The vocabulary saturated at 180 of 255** — merging stopped when no + adjacent pair repeated ≥2×. The corpus, not the cap, set the vocab. +3. **Overflow is the norm, not the exception:** EVERY verse needs + continuation (p50=4, max=8 particles per verse). A + one-particle-per-item reading is refuted at verse granularity; any + production design must budget continuation rows from the start. +4. **No HHTL locality:** chapter token-usage Jaccard 0.32 with heavy + sharing — BPE stayed orthogonal to scope on this corpus, exactly as + the law assumes rather than hopes. + +### The authority order (the reconstruction law, enforced) + +``` + canonical source AUTHORITATIVE + tokenized form exact, reconstructible (measured byte-exact) + compressed shorthand must round-trip or is non-canonical +``` + +A token may accelerate access; it must not destroy the source semantics +required for reasoning. Falsifiers F4/F5/F13/F14 held structurally; F7 +(merge-tree-as-ancestry) was made to FAIL measurably, which is the fence +working. + +## 2026-08-23 — E-CONTENT-NEVER-TRAVELS-IN-CLASSID-1 — "not rail-expressible" never meant "therefore classid"; and the copula already had a shipped home + +**Status:** ROOT LAW (operator-issued) + FINDING — [MEASURED] +(`PROBE-COPULA-GROUP-MASK-1` 9/9, `PROBE-COPULA-DISTRIBUTION-1` 5/5). +Retracts the Step 2 ruling request's Item 1 recommendation in place. +**Confidence:** High for the law and for every falsifier listed. +Whole-corpus SCALE is explicitly OPEN and reported as blocked. + +### The retraction + +The Step 2 ruling request recommended `Copula → relation concept → +classid reference`. **Withdrawn.** C1–C4 established only +`COPULA ≠ RAIL PLACEMENT`; that does NOT establish `COPULA = CLASSID`. +Unrelated conclusions — and the leap between them was content drifting +into the reading selector, the exact smuggle the dock/route separation +exists to prevent. + +### The law (operator, 2026-08-23) + +``` + CONTENT NEVER TRAVELS IN CLASSID. + CLASSID SELECTS THE READING. + + classid = HOW these bytes may be read + HHTL = WHERE the resident thing lives + mask = WHAT part / group / region conducts + edges = HOW addressed things relate +``` + +No per-copula classids; no predicates, relation identity, group identity +or belief identity smuggled into classid — for copula or anything else. +Companion laws: SHARE THE HIERARCHY, NOT NECESSARILY THE PAYLOAD; AN INDEX +OR MASK MAY ACCELERATE THE ABI, IT MUST NEVER BECOME A SECOND ABI; +MEASURE THE DISTRIBUTION BEFORE BUYING THE REPRESENTATION. + +### ⊘ The answer was already shipped — and this arc failed to check first + +**`nars::facet_fold` (ENTROPY-MILESTONES M26) already carries the copula, +losslessly, in the resident M20 register, with ZERO classid involvement:** + +``` + CStmt {s, cop, p} ⟷ SpoFacet (12-byte content-blind register) + rail 0 subject s as (lo, hi) + rail 1 predicate (copula TAG, Rel lo) ← the copula lives HERE + rail 2 object p as (lo, hi) + rail 3 ew_subject (Rel hi, spare) ← Rel's u16 completes here +``` + +Re-verified over the measured corpus rather than trusted from its unit +tests: **16/16 statements round-trip byte-exact**, `Rel(u16)` payloads +included; five copulas on one `(s,p)` produce five DISTINCT registers, so +the discriminating information is resident bytes and nothing upstream is +consulted. **0 extra bytes** — it relabels a register the awareness plane +already holds. + +The intermediate `RelRow` hypothesis was therefore a proposal for shipped +code — precisely the rediscovery tax `CLAUDE.md` names: *"Proposing a type +that already exists is a 30-turn rediscovery tax — check first."* + +### The Active-Directory shape (the general topology finding, which stands) + +A DN homes an object; `member`/`memberOf` are NOT ancestry — inverse VIEWS +over ONE many-to-many relation between already-addressed objects. Measured +on shipped operators: copulas reconstruct exactly from resident row +content while the group reading is lossy BY DESIGN (`Rel(7)`/`Rel(12)` +share a group, stay distinct) (G-F1); members/memberOf are inverse views +with no duplicated canonical state (G-F2); a cross-subtree Sim pair is +expressible ONLY as a row — the hierarchy homes both ends, it does not +pretend to BE the relation (G-F4); ONE classid spans four differing +copulas (G-F5); regrouping is view-only (G-F6); truth/provenance ride the +CLAIM, never the classification (G-F8); and `group ∩ HHTL region ∩ +truth-condition` composes in one pass over borrowed rows (G-COMPOSE). + +**The demarcation this settles:** applicability and scope inherit up/down +HHTL; **the pairwise relation itself never does.** The Sim row is the +standing witness. + +### ⊘ A prediction of this arc's own, REFUTED by measuring it + +The addendum named the KJV corpus as the **Rel-heavy** regime that would +contrast with the Inh-dominated closure fixture. Measured, through the +REAL `stance::stream` producer on REAL KJV Genesis 2–3: + +| | Inh | Rel | Impl | Sim | +|---|---|---|---|---| +| closure fixture | 10 | 2 | 1 | 1 | +| **real KJV narrative** | **13** | **2** | **1** | **0** | + +**Inh 6× Rel.** Both corpora now measured lean the SAME way, so a +Rel-heavy regime is **UNDEMONSTRATED, not merely unmeasured** — a +materially different status. Relatedly, *"tactics Impl"* was a phantom: +`tactics` emits only `Inh`/`Sim`; the real `Impl` producer is `stance`. + +### Cost, measured and extended + +| representation | at measured shape | at t=10k | +|---|---|---| +| **`facet_fold`** | **0 extra bytes** | **0** | +| a `RelRow`-style row | 896 B (n=16) | grows with relations | +| dense 4-group bitmap | 164 B (t=18) | **50 MB** regardless of content | + +The fixture-scale surprise (dense beating sparse) **inverts** at real term +counts — and both lose to a fold that allocates nothing. + +### Blocked, and not fabricated + +The whole-KJV **scale** measurement cannot run: `data/coca/lexicon.tsv` +(Release `coca-codebook-v2`) and `pg10.txt → kjv_spo.tsv` are absent by +design. A hand-written corpus would be a fabricated measurement, so none +was produced. **Scale stays open; shape is measured.** Because the +recommended carrier is already shipped and costs nothing, the open scale +question does not gate adopting it — it gates only any future proposal to +replace it. + +## 2026-08-23 — E-HHTL-COMPILES-HIERARCHY-INTO-MASK-GEOMETRY-1 — the algebra is indifferent to WHY the hierarchy exists; and no copula is rail-expressible + +**Status:** FINDING — [MEASURED] (`PROBE-MASK-ALGEBRA-INVARIANCE-1`, 7/7). +Positive half completes `E-HIERARCHY-IS-THE-ADDRESS-SPACE-NOT-THE-ONTOLOGY-1`; +negative half CLOSES the `Copula` item Step 1 deferred. +**Confidence:** High for both halves. Novelty explicitly NOT claimed. + +### The formulation (operator, 2026-08-23) + +> **HHTL does not execute a tree. It compiles hierarchy into mask +> geometry.** Once hierarchy is mask geometry, the math stops caring why +> the hierarchy exists. + +A tree normally forces tree-shaped operations — traversal, recursion, +pointer chasing, ancestor tables. If every level obeys the same physical +grammar, ancestry stops being a pointer between heterogeneous objects and +becomes **a progressively constrained portion of one regular address**: + +``` + Universe xxxxxxxx xxxxxxxx … + Level 1 0011xxxx xxxxxxxx … + Level 2 001101xx xxxxxxxx … + Level 3 00110110 11xxxxxx … +``` + +Each deeper level merely FIXES MORE of the address, so `M0 ⊇ M1 ⊇ … ⊇ M5` +is nested restriction over fixed-width coordinates — the algebra can be +recursive without the implementation being recursively shaped. + +**The tree is semantic. The mask algebra is geometric.** + +### [MEASURED] Indifference to meaning (M1–M3) + +The same address pair, the same five operators (`covers` / +`common_prefix` / `intersect` / `union` / `difference`), interpreted as +six unrelated semantics — ontology depth, attention scope, causal +candidate region, belief generalization scope, episodic context, behaviour +applicability — returns **byte-identical results across all six**. Had they +diverged, the claim would be false. + +> **The ClassView cares what the bits mean. The algebra provably does not.** + +M2: six levels are six restrictions of ONE coordinate space, and +transitivity is FREE (`L0.covers(L5)` with no traversal of `L1..L4`). +M3: an internal node is another occupied COORDINATE, not another +representation — which is why connective tissue buys coordinates rather +than a second graph. + +**Prior art, stated honestly:** tries, radix trees, hierarchical bitmaps, +prefix routing, Morton coding, masked SIMD and succinct trees each contain +pieces of this. No novelty is claimed for the mechanism; what is measured +is that the *combination* holds within this ABI. + +### [MEASURED] No copula is rail-expressible (C1–C4) + +``` + RAILS unconditionally transitive (prefix containment IS transitivity) + antisymmetric (a strict ancestry order) + COMMITTED (RailPath = {len, slots} — no truth, no polarity) + + COPULAS selectively transitive (`transits()`: only Inh, Sim) + sometimes symmetric (Sim) + always DEFEASIBLE (a Belief carries (frequency, confidence)) +``` + +`Impl`/`Rel` fail on transitivity; `Sim` on symmetry; and `Inh` — the ONLY +rail-SHAPED copula — on defeasibility: + +> **A rail IS the taxonomy. A belief is a CLAIM ABOUT the taxonomy.** + +There is no slot in `RailPath` for *"`A is_a B` at confidence 0.85"*, so +storing a defeasible claim as a placement would silently promote a +hypothesis to structure. + +**Scope:** this is about RAILS. It does not prove `Copula` has no ABI home +anywhere — and indeed it has one (`E-CONTENT-NEVER-TRAVELS-IN-CLASSID-1`, +above: `facet_fold` into the M20 register). + +## 2026-08-23 — E-HIERARCHY-IS-THE-ADDRESS-SPACE-NOT-THE-ONTOLOGY-1 — HHTL is the universal address grammar, beneath the V3/V4 distinction; and globality is geometry ONLY WITH provenance + +**Status:** ROOT LAW proposed by the operator, with one part [MEASURED] +and one part [CONJECTURE] — the split is stated below rather than blurred. +**Confidence:** High for the address-space law and the measured corollary; +the universal-addressability claim is explicitly NOT demonstrated for +`Belief`. + +### The law (operator, 2026-08-23) + +> **Hierarchy is the address space, not the ontology.** +> +> HHTL need not claim that reality is a tree. It claims that every resident +> datum can receive a hierarchical address FROM WHICH non-hierarchical +> relations can be expressed **without changing its physical identity — and +> zero-copy where the carrier is ABI-resident.** + +**Why that qualifier is exact, not hedging.** Hierarchical addressability +by itself guarantees nothing about copies; the PHYSICAL ABI does. An +address over a non-resident carrier (an owned container, a materialized +window) is still an address, and it is still not zero-copy — which is +precisely the `WitnessStream` situation recorded in its own honesty note. +Keeping the two clauses separate stops the law from silently importing a +performance guarantee it does not itself supply. + +The Active Directory lesson, exactly. A DN gives an object a deterministic +hierarchical home — +`CN=Jan,OU=Engineering,DC=example,DC=com` — without asserting that +everything about Jan is ancestry. Group membership, manager links, ACLs and +mail routing are cross-links between objects that already have hierarchical +identities. The directory hierarchy solves **where**; the references solve +**how things relate**. + +``` + EVERY COGNITIVE DATUM GETS AN HHTL HOME. + + Relations may then: inherit · cross-link · point sideways · backward · + forward · contradict · support · cause · observe · intervene + — without changing the object's addressability. +``` + +**What this corrects (a narrowness in my own prior caution).** The earlier +entry `E-STREAM-ORDER-VS-PREFIX-TREE-NEITHER-ACCUMULATES-1` framed +"stream-order Markov" and "prefix-tree HHTL" as an opposition. Under this +law that opposition is **weaker than it was stated** — see that entry's own +regrade note. A temporal datum is not a separate non-HHTL universe; it can +be HHTL-addressed (`episode → version window → event region → event +identity`) with the signed ±i4 offsets as LOCAL traversal inside an +addressed neighborhood. Stream ordering remains temporal semantics; HHTL +gives it its home. The two are layered, not rival. Same for graphs: a node +has a canonical HHTL home while edges are `address A → address B`, and the +graph itself needs no tree structure at all — AriGraph, `CausalEdge`, +`EpisodicEdge`, anaphora pointers, support/premise relations and R2IL +operations can all point between HHTL-resident things. + +### HHTL is BENEATH the V3/V4 distinction + +``` + HHTL ADDRESS SPACE + │ + ┌─────────────┼─────────────┐ + V3 V3 V4 + state witness behavior + │ │ │ + ClassView ClassView ClassView + │ │ │ + route semantics route semantics route semantics +``` + +V3 and V4 do not own the railway. They are payload/read contracts for +objects that **already have a hierarchical home**. This is a cleaner +statement than the earlier "V4 may ride V3 routes" framing. + +### The brutal admission rule (the sharp test this gives us) + +> **If a datum exists but cannot be assigned a meaningful HHTL address +> without using `Vec` position as identity, it has not yet been normalized +> into the memory ABI.** + +This names precisely what was wrong with the withdrawn "trivial +per-arena-position address" proposal (`BELIEF-ABI-RESTORATION-1` Step 1, +recut): **`arena[37]` is not a semantic hierarchy — it is an implementation +accident wearing an HHTL costume.** A real address would land through +semantic coordinates (relation class → subject basin → predicate basin → +evidence context → instance; exact carving to be PROVEN, not invented). + +### The corollary, and where it breaks — [MEASURED] + +> **Evidence rises only as high in the HHTL tree as its independent support +> generalizes.** + +The prize is deleting a metadata system: no `enum Scope {Local, Regional, +Global}`, no global-concern score, no scheduler that "promotes" a belief. +Globality becomes geometry. `PROBE-EVIDENCE-RISES-BY-GENERALIZATION-1` +(7/7) measured it on shipped operators: + +- **[CODE]** The pieces already exist and were not written for this: + `AttentionFocusFacet::common_prefix` is the MEET (deepest focus covering + both, and it *never invents an address*); `RowFocusMask` is literally + "antichain of HHTL regions" with absorbing `union` and conservative + `difference`; `TruthValue::revise` (`nars/truth.rs:57`) pools by + `evidence_weight() = c/(1−c)`. +- **[MEASURED]** Support rises exactly as far as it generalizes (G1 one + basin stays local; G2 three independent siblings rise to the common + ancestor with pooled `c=0.9444 > 0.85`; G6 cross-region support rises + COARSER, never sideways), the operator can refuse (G7: no common ancestor + across classes ⇒ `None`), a dissenting region stays ADDRESSABLE instead + of being averaged away (G4), and nothing moves (G5: children byte- + identical; the parent acquires a derived reading at an address that + already existed — **children stay, parent learns**). +- **⚠ [MEASURED] THE BOUNDARY — G3.** *Geometry alone over-generalizes.* + One source observed through three sibling basins pools naively to + `c=0.9444` — **bit-identical to three genuinely independent sources.** + The two situations are *geometrically indistinguishable*. So: + + > `globality = geometry` is TRUE **only with provenance**. + + This is not a caveat, it is the load-bearing constraint: the hard problem + was never aggregation (NARS already revises correctly) but **independence + detection** — are these siblings independent evidence, or descendants of + one observation? That is exactly what `Stamp`'s `disjoint → revise / + overlap → CHOICE` guard protects today, and `spo::truth`'s revision doc + already states the precondition verbatim: *"combine two truth values with + **independent** evidence."* + +### The correct decomposition (with the operator's own correction applied) + +``` + NARS frequency observed proportion / effect estimate + NARS confidence effective evidence mass ← NOT frequency + HHTL address the scope at which it holds + HHTL ancestry how far that support generalizes +``` + +Frequency alone is not sample count; `evidence_weight() = c/(1−c)` in the +shipped `revise` confirms confidence is the evidence-mass side. + +### [CONJECTURE] — stated as such + +That **every** cognitive datum CAN receive a lawful HHTL address is not +demonstrated. For `Belief` specifically the audit found the opposite of a +demonstration: zero `FacetCascade`/`facet_classid` occurrences anywhere in +`nars/`. The law says such an address is *possible in principle*; whether +the semantic carving exists for beliefs is open, and is the real content of +`BELIEF-ABI-RESTORATION-1` Step 2. Nothing here mints a tenant, an address, +or a classid. + +**One consequence worth recording if the conjecture holds:** attention +would need no foreign mask representation at all — `Attention = set / +antichain / scoped difference of HHTL regions` is `RowFocusMask` as it +already ships; epistemic potholes become scoped ABSENCE within an addressed +universe (still the conservative P* reading, `RowFocusMask::difference` +keeps partially-overlapped entries whole); and R2IL applicability points +into the same coordinate grammar. `DATA` has an address, `ATTENTION` is +region selection, `UNKNOWN` is scoped absence, `BEHAVIOR` has applicability +routes, `PROVENANCE` points to evidence, `CAUSALITY` links resident state — +and C operates on the surviving addressed slices. +## 2026-08-23 — E-STREAM-ORDER-VS-PREFIX-TREE-NEITHER-ACCUMULATES-1 — the two closest shipped candidates for the belief tree-overlay delegation are different topologies, and NEITHER implements an accumulate-fold + +**Status:** FINDING (grounds and sharpens the `BELIEF-ABI-RESTORATION-1` +Step 1 audit's [ABSENT] verdict on the tree-overlay delegation mechanism; +does not overturn it). **⚠ PARTIALLY REGRADED 2026-08-23 — see the note +immediately below.** +**Confidence:** High for the [ABSENT] verdicts (the entry's actual result). +**Lowered for the "different topologies" FRAMING**, which overstated an +opposition. + +> **⊘ REGRADE (2026-08-23, `E-HIERARCHY-IS-THE-ADDRESS-SPACE-NOT-THE- +> ONTOLOGY-1`).** This entry framed candidate A (stream order over time) +> and candidate B (prefix tree over address) as an *opposition* — "a total +> order over TIME, a partial order over ADDRESS," presented as if a datum +> had to live in one universe or the other. **That framing is too strong.** +> Under the address-space law, hierarchy is the ADDRESS SPACE, not the +> ontology: a temporal datum is not a separate non-HHTL universe, it can be +> HHTL-addressed (`episode → version window → event region → event +> identity`) with the signed ±i4 offsets as LOCAL traversal *inside* an +> addressed neighborhood. Stream ordering remains temporal semantics; HHTL +> supplies its home. The two are **layered, not rival**, and no "separate +> temporal universe" needs to exist. +> +> **What survives the regrade unchanged — the entry's actual finding:** +> neither candidate implements a children-and-siblings accumulate fold +> (`fn accumulate` / `children.*sibling`: zero hits; +> `E-NO-BUNDLE-STANDING-WAVE-1` disclaims accumulation by name). Both +> [ABSENT] verdicts stand. Also unchanged: the withdrawal of the +> composition conclusion, and the fence against rebasing a version-ordered +> type to mean an address span — that fence is *strengthened* here, because +> the right move was never to re-scope `VersionRange` but to give the +> temporal datum its own address and leave time as time. + +**The question that prompted this.** Step 1 of `BELIEF-ABI-RESTORATION-1` +found that `Belief.rung`/`stamp`'s operator-ruled delegation — "rung = HHTL +tree depth, stamp = children-and-siblings accumulation, inherit from +parent" — names a mechanism that is currently prose and precedent, not +code (`.claude/plans/belief-abi-restoration-v1.md` §Step 1: zero +`FacetCascade`/`facet_classid` occurrences in `nars/`, zero `fn accumulate` +or `children.*sibling` hits in `lance-graph-contract/src/`). A follow-up +asked directly: is the "24×i4 Markov left-right-corner parsing" the +missing mechanism, compared against "AriGraph-style HHTL basins"? Grounding +both candidates in shipped code answers: **they are not rival +implementations of the same job — one is a total order over TIME, the +other a partial order over ADDRESS — and neither one accumulates.** + +**Candidate A — `deepnsm-v2::wave::WitnessStream` (the G24N4/Markov +reading).** `wave.rs` module doc, verbatim: *"Each versioned event owns its +`CausalWitnessFacet` loci; the wave **reads** a version-range window and +mutates nothing — there is no accumulator and no shared register. The +Markov property is STREAM ORDER (`E-MARKOV-TEMPORAL-STREAM-1`), never a +superposition into one carrier."* Concretely: `events: Vec<(u64, +CausalWitnessFacet)>` in append order; `ground_at`/`resolve_at` walk a +SIGNED OFFSET through that flat line within a version-visibility window +(`TemporalPov::at`). This is where left-corner parsing theory actually +enters the codebase — but only as a CITATION justifying the ±8 nibble +range (Manning & Carpenter 1997, IWPT-97 Table 7: max left-corner stack +depth over the whole binarized WSJ treebank is 8), never as an executing +parser. There is no tree here. `E-NO-BUNDLE-STANDING-WAVE-1` is a standing +refusal to accumulate, not an oversight. + +**Candidate B — `AttentionFocusFacet` (the AriGraph/HHTL-basin reading).** +`covers`/`common_prefix` (`attention_facet.rs:297,314`) give coarse→fine +PREFIX containment over the same 12-byte cascade — ancestor/descendant by +shared byte prefix, ordinal position, never stream position. +`common_prefix` computes the meet (deepest common ancestor) two focuses +share, which IS the shape a "rung = tree depth" claim would need to walk. +But nothing here sums, folds, or aggregates evidence across a node's +children into a parent value — `covers`/`common_prefix` answer "is A an +ancestor of B" / "what do A and B share", never "what do B's children +contribute to A". Grepped independently for this pass: zero `fn +accumulate` hits and zero `children.*sibling` hits anywhere under +`lance-graph-contract/src/attention_facet.rs`, `facet.rs`, or `hhtl.rs`. + +**A third, previously-conflated shipped thing, named so it stops being +confused with either candidate:** `insight_right_corner_read.rs` +(`lance-graph-planner/examples/`) is a REAL left-corner/right-corner SVO +clause parser running on real KJV text — but it is a `Basins`-driven token +scan with its own `RightCornerReason`/`Triple` types and touches +`CausalWitnessFacet`/G24N4 **not at all**. "Left-corner parsing" and +"G24N4" are two unconnected machines in this codebase; only `wave.rs`'s +module-doc citation bridges them, and only as a numeric-range +justification, not a shared mechanism. + +(A fourth precedent worth naming for completeness, since it was checked in +the same pass and is the closest thing to a REAL KJV+G24N4 example: +`probe_binding_not_heuristic.rs` resolves `Locus::Antecedent` — a single +locus, single-hop structural anaphora binding — on Gen 3:1/3:7. It proves +the chip is load-bearing, not decorative. It is not an accumulate-fold +either: it is a pointer write/read on one register, the same shape +`wave.rs`'s single-owner events already generalize.) + +**The consequence — and the inference NOT to draw.** The finding is +negative and stops there: + +``` + A is not the mechanism + B is not the mechanism + ⇒ WE DO NOT HAVE THE MECHANISM +``` + +**⇒ NOT `therefore A × B is the mechanism`.** An earlier revision of this +entry concluded that Step 3 must COMPOSE the two (a stream-order walk +bound to a tree address). **That leap is withdrawn.** "Neither of the two +things I checked is it" licenses no claim whatever about what it is; the +composition is one hypothesis among unknown others, and elevating it to +"what Step 3 must build" would smuggle a design decision in through a +negative result. + +**The specific danger that withdrawal avoids, recorded as a fence.** The +withdrawn composition proposed rebasing `WitnessStream` from VERSION +order into "address-scoped stream order," possibly repurposing +`VersionRange`. That is precisely the semantic type drift this +architecture exists to prevent: **time is time, address is address.** +Sharing a memory ABI does not make two topologies interchangeable, and a +`VersionRange` that sometimes means an address span is a type whose +meaning depends on who is holding it. Further: any future address-scoped +fold must be a BORROWED VIEW over ABI-resident rows — if it materializes +another `Vec<(u64, CausalWitnessFacet)>`, the memory escape has simply +re-entered through a different door (`E-TYPE-COMPLEXITY-EXPOSED-A-MEMORY- +ABI-ESCAPE-1`), and `wave.rs`'s own honesty note already records that +`WitnessStream` is TODAY *"a parallel OWNED container beside +`TemporalStream`, not a zero-copy projection."* + +**Two inherited assumptions this entry does not carry forward.** Neither +is established, and the negative finding does not support either: (a) +`rung = HHTL tree depth` — the answerable question is whether derivation +depth is reconstructible from SUPPORT topology, which needs no address at +all; (b) `stamp = commutative accumulation` — any replacement must +reproduce `Stamp`'s load-bearing IDENTITY semantics (disjointness, +overlap, source-set union, no double-count, `belief.rs:39-48`), and a +`vsa_bundle`-style fold is not automatically a source-set union. + +**Bounds respected:** no code changed by this finding; no tenant minted; +no mechanism proposed; no canonizing on either candidate. The open +questions this finding leaves are registered — explicitly as questions, +not a plan — in `.claude/plans/tarski-markov-hhtl-seam-v1.md`. + +## 2026-08-23 — E-TYPE-COMPLEXITY-EXPOSED-A-MEMORY-ABI-ESCAPE-1 — the clippy warning was the surface symptom; `BeliefArena` is an independent AoS cognitive population owner outside the canonical memory ABI + +**Status:** FINDING (operator-escalated; #1004 recut to a discovery receipt). +**Confidence:** High for the escape; the restoration is CHARTERED, not done. + +**The escalation, in order.** Clippy flagged `snapshot() -> +Vec<((u16,u16),u32,(f32,f32))>` in `probe_parallel_rung.rs`. First reading: +an accidental AoS copy — fixed with a borrowed digest witness. **Both +readings were too small.** The copy was inside an owner that is itself the +escape: `BeliefArena { entries: Vec }` with `Belief { stmt, truth, +stamp, rung, premises: Vec, .. }` (`belief.rs:89,129`) — a second +physical representation of cognition outside the canonical V3 LE substrate +(16-byte `classid + 6×(8:8)` docks, SoA lanes, zero-copy views). Removing +the snapshot removed a copy INSIDE the wrong representation. The hash +witness that replaced it was polish on the violation and is now DELETED; +G4 compares the rung-0 lane against the probe's own authored fixture, +bit-exact, borrowed, no snapshot, no digest. + +**Retracted phrasing:** an earlier version of this entry said *"BeliefArena +is not (yet) the canonical 4+12 LE SoA substrate"* — implying an SoA rewrite +is the fix. Wrong frame. The question is whether `BeliefArena` should +physically exist at all: the substrate already expresses relation +(node/edge geometry, SPO), support (`Locus::{SupportedBy,Supports}`), +contradiction (`Locus::Contradiction`), provenance (witness lanes), causal +reading (CE64), attention scope (focus facets). **Only the residue with no +ABI-native home after composing those deserves a new tenant.** Notably, the +sibling `TripletGraph { triplets: Vec, entity_index: +HashMap> }` (`triplet_graph.rs:86-93`) is the SAME +escape shape — "move belief into AriGraph" as it ships today would move it +between two violations. + +**The DOCK/ROUTE separation (operator-sharpened), now the reading of the +compatibility table:** + +``` + DOCK ABI 16 B LE = classid(4) + payload(12); content-blind storage + ↓ classid + ROUTE ABI G6D2 / G4D3 / G3D4 / G24N4 / Varnode space→offset→size drill + ↓ + SEMANTIC VIEW attention / TEKAMOLO / causal witness / R2IL / … +``` + +`VarnodeFacet` storing `offset_lo` before `offset_hi` is therefore NOT +malformed — byte-monotone prefix traversal is simply not its route +contract; its typed `prefixes()` drill is. CLASSID CHOOSES THE READING. +THE ROUTE CHOOSES THE TRAVERSAL. THE BYTES NEVER CHANGE SHAPE. + +**Evidence tiers, kept separate:** PROVEN — heterogeneous carvings share +one dock without changing it (`ValueTenant::CausalWitness` reads the same +16-byte lane as `G24N4` = 24 signed nibbles). STRONGLY SUPPORTED — V4 as +another tenant of the dock (`VarnodeFacet` is byte-for-byte the envelope, +and independently converged on the `G3D4` carving). NOT YET PROVEN — the +V4 persistence slot/tenant mint (`ruff_r2il` explicitly commits no storage +layout; the classid is PROVISIONAL, mint gated on O5). + +**Standing demotions and labels:** **B is removed from the architectural +alphabet** — A (address/mask/traversal) and C (pair-field compute) are +laws; a materialized rotation is an optional derived accelerator that must +EARN existence by measurement, since re-carving the dock is already an +unmaterialized rotation. `RowFocusMask::difference` potholes are a +**conservative candidate-unknown mask (P\*)**, never an exact epistemic +hole — refine before asserting absence. `FlatFact.a/b` are NOT free dock +capacity (per-`FactKind` semantics); an effect facet becomes ANOTHER +ADDRESSED ROW, per the furnace's own rule. The FNV residual grouping hash +is diagnostic bookkeeping only — if it ever becomes an address, key, +identity, token, or route, kill it. + +**#1004's honest scope (verdict C):** finding-only plateau. The probe now +carries the escape notice in place; the measured G1..G7 coexistence results +hold FOR THE ARENA'S OBJECT MODEL, and restating them over ABI-resident +state is the restoration charter's job. Falsifiers for that follow-up: +F1 no canonical population as `Vec` · F2 no nested `Vec` in a +population row · F3 reasoning over immutable ABI views · F4 index +delete/rebuild leaves state intact · F5 premises without per-belief heap +vectors · F6 no representation conversion between graph state and +reasoning · F7 classid+ClassView select interpretation over predefined LE +geometry · F8 same resident bytes consumed by attention/relational/ +epistemic/causal contracts · F9 no hash as cognitive representation · +F10 the population does not move; the view does. + +## 2026-08-23 — E-A-WARRANT-MUST-BE-ABLE-TO-SAY-NO-1 — the trajectory is reconstructible AND grounded; the warrant channel that could not refuse was the defect + +**Status:** FINDING (measured — `PROBE-WARRANTED-VIEW-TRACE-1`, 9/9 gates +green, `examples/probe_view_edit_trace.rs`). **Confidence:** High; the ABSENT +at the end bounds it precisely. + +**Three vicious invariants, all green.** Over the sealed field (2016 beliefs, +20 rows across rungs {1,2,3,4,6}), trajectory `A(10) -e1-> 4 -e2-> 10 -e3-> 4`: + +- **RECONSTRUCTION** — `replay(A, edits) == final` (T1), and stronger, + `replay(prefix[0..k])` equals the view actually observed at step k for EVERY + k (T2). An end-to-end match can hide two errors that cancel; a per-prefix + match cannot. All three edits invert step-by-step back to A exactly (T3). +- **GROUNDING** — every edit NAMES evidence from the sealed state (G1); + every named count re-verifies against that state (G3, 9 items recounted). +- **ANTI-HINDSIGHT** — `warrant_at(step, initial, prefix, edit, arena, ctx)` + has no parameter through which a later edit, the final view, or an outcome + could enter, and all warrants reproduce byte-equal from their prefix alone + (T4). `witness_fabric`'s `upto` discipline, transplanted. + +**THE CORRECTION THAT MATTERS — the first warrant channel could not say no.** +The draft `Warrant` carried `visible_before` / `rungs_before`: a DESCRIPTION +of the situation, which EVERY possible edit satisfies. It would have passed a +reconstruction suite while measuring nothing about justification — the exact +house anti-pattern (*"a guard that fires on everything carries exactly as much +information as one that never fires"*). The fix was not a stronger assertion +but a different object: `Evidence::{BeliefsAtRung{rung,count}, +RowsBoundAt{locus,count}}`, drawn from the sealed state, plus **G2, which +proves the channel can REFUSE** — an off-field `RungBand{50,60}` (above the +measured R6 ceiling) and an unbound `Locus::Contradiction` both come back +UNGROUNDED while the real trace stays fully grounded. + +**Why that gate is load-bearing for anything downstream.** Without G2, a +later BPE-style learner would compress a recurrent BAD habit exactly as +efficiently as a good one — the same `[e1,e2,e3]` subsequence looks identical +whether real evidence or circular reasoning drove it. G2 is the difference +between acquiring reasoning skill and acquiring superstition, and it belongs +BEFORE the learner, not after. + +**The remaining gap is now one arrow.** `Evaluation → Revision → warranted +ViewEdit`. A trace OBJECT exists; a trace PRODUCER does not — +F-REVISION-FOCUS-1 stays ABSENT and every trajectory here is AUTHORED by the +probe, not harvested from a running cognition. `BehaviorTrace` is probe-local +and is NOT proposed as a production type. Nothing is learned, compressed, +promoted, or recurrence-detected. + +## 2026-08-23 — E-THE-FIRST-PARTICLE-1 — the substrate changed how it looked at the problem and can say exactly what changed + +**Status:** FINDING (measured — `PROBE-FIRST-PARTICLE-1`, 5/5 gates green, +`examples/probe_first_particle.rs`). **Confidence:** High for the measured +claim; the scope fence is part of the finding. + +**The particle, as the #1001 charter's laws require it.** One observed chain +of 63 links, closed once — **2016 beliefs, sealed by digest** — holds live +activity at every rung 0..6 simultaneously: + +``` + R0 ▓ (63) R1 ▓ (62) R2 ▓▓▓ (121) R3 ▓▓▓▓▓▓▓ (230) + R4 ▓▓▓▓▓▓▓▓▓▓▓▓ (412) R5 ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ (632) R6 ▓▓▓ (496) +``` + +Over that field: + +``` + View A [BoundAt(SupportedBy), Band(0..=2)] → rows at rungs [1,1,2,2] + edits = [RemoveAt(1), Push(Band(4..=6))] + View B [BoundAt(SupportedBy), Band(4..=6)] → rows at rungs [4,4,6,6] +``` + +- `reconstruct(A, edits) == B` on BOTH layers (descriptor stack and lowered + visible set), and the inverse sequence restores A exactly. +- Arena digest, population digest, and base pointer identical after all + viewing: **56 B of descriptors moved; 10,240 B of population did not.** +- **Territories overlap and one contribution lives in two phases at once:** + windows low 0..=2 / mid 2..=5 / high 4..=6 are deliberately overlapping; + an R2 row is visible under low AND mid, an R4 row under mid AND high, with + exclusives on each side (P2). Not one-hot, executably. + +**The rung ceiling is a measured constraint, recorded rather than smoothed:** +`Stamp::source(id)` is `1 << (id % 64)` (`belief.rs:36-38`), so evidential ids +≥ 64 alias and the largest collision-free observed chain is 63 links → +Tarski ceiling `ceil(log2 63)` = **rung 6**. The charter's R2/R5/R8 example +was explicitly non-mandatory; this probe reaches its spread by derivation, +not by decorating rows with invented rungs. + +**Conservation laws exercised, none violated:** population not moved by an +attention change; rung activity not one-hot; the two selector families never +flattened into one meaning; the lowered view opaque while its contributing +layers stay identifiable; the edit changed the view, not the universe +underneath it; the change reconstructible. + +**Unchanged and restated:** F-REVISION-FOCUS-1 is ABSENT — `ViewEdit` is +probe-local; nothing here touches `RungElevator`, `StyleLane`, +`EpistemicMode`, or `temporal.rs`; territory windows are view selectors, not +identities; occupancy is semantic, not wall-clock; no behavioral BPE; Rubicon +persistence open. The next questions this makes askable — which edit +sequences recur, which survive grounding, which compress — belong to the +learner, which does not exist and is not implied to. +## 2026-08-23 — E-THE-VIEW-MOVES-THE-POPULATION-DOES-NOT-1 — three incompatible selector families compose over one stationary cognitive state, provenance intact, zero population copy + +**Status:** FINDING (measured — `PROBE-REVISION-ATTENTION-VIEW-1`, 8/8 gates +green). **Confidence:** High for what it measures; the scope fence below is +part of the finding, not a disclaimer. + +**Measured.** One `BeliefArena` holding rungs `[0, 1, 2]` and 16 stationary +`NodeRow`s (8 KiB). Three selector families with NO common representation — +`BoundAt(Locus)` (signed nibble in a 12-byte witness register, read through +`WitnessLens`), `RungBand{lo,hi}` (`u32` arena field), `GapSubject(u16)` +(scan-derived `Vec`) — compose into one narrowing view: + +``` + A [BoundAt(SupportedBy)] -> 8 rows + + Push(RungBand{1,2}) + B [BoundAt, RungBand] -> 4 rows + + Push(GapSubject(1)) + C [BoundAt, RungBand, GapSubject] -> 3 rows +``` + +- **Provenance survives.** 3 rows admitted, **4 blamed by exactly one** + selector, **9 by two or more** — non-uniform blame, so the channel carries + information. This is what a fused `union()`/`intersect()` on a packed mask + cannot answer, and it is retained because the plan is a stack of typed + descriptors while only the LOWERED artifact is opaque. +- **Zero population copy.** Population digest and base pointer byte-identical + across all three lowerings. Descriptors allocated: **36 B**, against 16 × 512 B + of population never touched. Reported separately, per the charter: the + invariant is zero POPULATION copy, not zero allocation. +- **Typed edit reconstructs exactly.** `BEFORE + EDIT == AFTER` on BOTH layers + (descriptor stack and lowered visible set), and the inverse `RemoveAt` + restores `BEFORE`. +- **Non-destructive.** Rung bands and population bytes unchanged after every + view change. Only visibility moved. +- **Controls.** Empty plan admits all 16; a contradictory plan admits 0. So the + composition can both speak and stay silent. + +**A measured surprise, kept visible rather than tidied away.** The first fixture +used `rcr_abduce` as the absence-shaped selector and the gate FAILED with +`gap=0`. Cause, measured not guessed: on a fully-closed transitive chain +`rcr_abduce` returns **20 candidates and ZERO gaps** — its gap channel fires on +a different condition (no shared middle / hub exclusion / budget), not on a +complete chain. `tr_diverge` on a siblingless focus emits the real +`ReasoningGap { kind: NoSibling, subject: Some(1) }`. The fix was to use the +call that actually produces the signal; the assertion was never weakened, and +the probe still prints `rcr_abduce`'s empty channel so a future reader sees the +distinction instead of rediscovering it. + +**What this does NOT establish**, stated because the charter demands nothing +stronger: no behavioral BPE (this is the receipt substrate only); no wall-clock +or thread parallelism (occupancy is semantic — `close_transitive` is a +sequential fixpoint); no Rubicon persistence (`KanbanMove` carries no attention +provenance, `calcify` is `todo!()`); and no production Revision surface — +**F-REVISION-FOCUS-1 is ABSENT** and the `ViewEdit` used here is an explicitly +probe-local adapter. `RungElevator` does not appear in this probe at all. + +**Existing-container audit ran first**, per the charter's probe law. +`contract::selection::{NamedView, ViewRegistry}` is the shipped precedent with +exactly the right two-layer shape — `union_of(&[ViewId]) -> WideFieldMask` +takes retained descriptor identities and returns one fused artifact. It was not +reused for one honest reason: it composes a SINGLE family over one +representation, and heterogeneity is the whole question. `CycleFrame` records a +cycle, `SupportReceipt` records support; neither is a view. The probe-local +`ViewPlan` follows `ViewRegistry`'s shape rather than inventing one, and does +not propose replacing it. + +**No `CommonMask` was built. No NOT/XOR was added.** The three families meet +only at the lowering boundary, as one `impl Fn(usize) -> bool` — the seam that +already exists seven times over in `witness_fabric`. + +## 2026-08-23 — E-AN-IMPORT-EDGE-IS-NOT-AN-ARCHITECTURAL-RELATION-1 — auditing "does A import B" and concluding "no architectural connection" erased a lineage documented in this repo's own docs + +**Status:** CORRECTION (operator-caught). **Confidence:** High — the erased +lineage is quoted below from `docs/architecture/`, in-repo, verifiable. + +**What happened.** Asked to audit the Ghidra/R2IL relation, this session +grepped `lance-graph-java` for imports of `ghidra`/`r2sleigh`/`sleigh`/`pcode`, +found none, cloned `r2sleigh`, found no `lance` dependency and only bit-width +masking, and wrote: *"Settled with evidence, so nobody builds a bridge to it +later."* **That sentence is retracted.** It converted a true dependency-level +negative into a false architecture-level negative, and it did so pre-emptively +— telling future sessions not to look. + +**What was actually there, in THIS repo, unread.** +`docs/architecture/ARC-B-OWNERSHIP-AND-ADDRESSING-REASSESSMENT.md` §7, titled +"THE GHIDRA / JAVA ABI STANDARD" (2026-08-19): + +> *"The external path is the reference discipline: `binary → Ghidra/SLEIGH/ +> P-code → r2sleigh → V4 R2IL`, with the domain oracle keeping semantic +> authority and the ABI exposing address + mask + view."* + +That section connects Ghidra, the Java ABI, and the address+mask+view +discipline — the exact three subjects being audited separately — and states a +falsifier and a debt against them. `EPIPHANIES.md:1145` +(`E-V4-IS-THE-100-PERCENT-TIER-V3-UNCHANGED-1`) is the ruling it references. + +**The four claims that must not be collapsed into one verdict:** + +| Claim | Verdict | +|---|---| +| direct code dependency `lance-graph-java → r2sleigh`/Ghidra | **ABSENT** — verified, and unsurprising: lance-graph-java is the ABI/execution membrane | +| cross-repo architectural lineage | **PRESENT** — ARC-B §7 above; ruff PR #94/#103/#104, all merged | +| directly reusable mask implementation inside r2sleigh | **ABSENT** — every `mask` there is bit-width/taint masking in the SSA lifter | +| reusable substrate pattern | **PRESENT and load-bearing** | + +**A dependency edge I also missed by auditing the wrong pair.** ruff PR #94 +(merged) ships `crates/ruff_r2il`, workspace-excluded, which **path-deps the +`r2sleigh` sibling checkout** and whose `vocab.rs` *"feeds lance-graph's +`ogar_codebook` read-only"*, with a *"16-byte V3-shaped `VarnodeFacet`"*. So a +real code edge exists — `ruff_r2il → r2sleigh` and `ruff_r2il → lance-graph` — +just not on the `lance-graph-java → r2sleigh` pair this session chose to test. +PR #94 names its own origin as a *"three-repo Phase Zero audit (ruff frontends +/ r2sleigh's typed surface / lance-graph V3 ABI)"*. + +**The two laws that transfer (and the honest tier of each):** +- **[SHIPPED] Mask-native execution** — lance-graph-java: descriptors compose + with zero membrane crossings, one fused terminal, `materializeRows()` the + only named materialisation, enforced reflectively in test. +- **[SHIPPED] Typed behavioural IR** — ruff_r2il: `FunctionBehavior` over + `SsaArtifact`, lossless/zero-copy, `harvested = classified + residual`, + `dropped == 0` by construction, no catch-all slag variant, and SPO demoted to + *"an optional lossy projection, never the behavioral truth"*. +- **[ARCHITECTURAL TRANSFER]** masking as zero-copy attention conductivity; + BPE-style compression over behavioural IR. +- **[NOT YET PROVEN]** a production behavioural-BPE learner joining the two. + Corroborating: PR #103's headline (*zero reconstruction mismatches across + 35,946 matched op sites*) is explicitly scoped by its own body to the + oracle's `permissive_convention` and proves the reconstruction MECHANISM — + the shipped `minimal_pass_one` measures `matched = 0` and round-trips + through accounting, not matching. PR #103 also lists codebook wiring + (`ogar_codebook`) as still open. + +**The lesson, generalised.** "No reusable primitive" and "no architectural +connection" are different findings with different evidence. A grep for import +edges can only ever settle the first. Before writing an absence verdict about +a *relation*, search this repo's own `docs/architecture/` and board for the +relation by NAME — the answer here was two directories away the whole time. + +**Reflexive note.** The failure has the same shape as the one this session was +convened to fix: reducing a structured relation to a single scalar test +(one grep, one boolean) and reporting the scalar as the whole answer. + +## 2026-08-23 — E-TWO-KEY-ELEVATION-WINDOW-IS-NARROW-AND-THE-CORPUS-STRADDLES-IT-1 — one `RungElevator` actuator path is driven end-to-end; the two shipped rules that must agree for elevation overlap in only a ~0.125-wide band, and both negative controls fall on opposite sides of it + +**Status:** FINDING (measured — `PROBE-REVISION-RUNG-ACTUATOR-1`, 19/19 gates +green). **Confidence:** High for the measurements; reproducible from the +commit. **Scope:** this probe establishes one concrete `RungElevator` +actuator path and measures the overlap of two existing heuristics around +that actuator. It does **not** establish a canonical metacognitive +controller. + +**The actuator path, driven.** The chain receipt → membrane → +`InnerCouncil::from_signals` → `CollapseHint` → `mul::GateDecision` → +`KanbanColumn::advance_on_gate` → `MailboxSoaOwner::try_advance_phase`, plus +the rung arm via `RungElevator::apply_delta` — **its first caller outside the +type's own unit tests** (an `examples/` caller, not a production-path one). +The same correction applies to #998's `MailboxSoA::promote_family` +(`mailbox_soa.rs:829`): its exhaustive call census is unit tests plus one +example, never `src/` — "first production-path call" was wrong wording and is +retracted here. Everything after the membrane is shipped machinery; the only +novel logic is `signals_from(&CycleEvidence)`, pure measured ratios with no +tuned constants. + +**THE HEADLINE — the two keys barely overlap.** Operator-pinned rule: +`CollapseHint::RungElevate` is qualitative INTENT, `rung_delta(emergence, +coherence)` decides whether the shift is EARNED; elevation requires both. +`measure_two_key_window` sweeps the task-unresolved axis at saturated +coverage and measures where they agree: + +``` + task-unresolved <0.316 → Balanced / Flow (settle) + 0.316 … 0.600 → Catalyst / RungElevate, rung_delta = 0 + 0.600 … 0.725 → Catalyst / RungElevate, rung_delta = +1 ← the ONLY window + 0.725 … → Guardian / Fanout, rung_delta = +1 +``` + +**Both negative controls are real fixtures on opposite sides of the window, +and the second one the run found rather than the design anticipating it:** +- **G16** (mid stall, task-u 0.564): intent key OPEN (RungElevate), earned key + CLOSED (delta 0) → held. RungElevate is not a magic elevator button. +- **G18** (deep stall, task-u 0.768): earned key OPEN (delta +1), intent key + CLOSED (Fanout) → held. **The council refuses to deepen from overwhelming + ignorance** — it asks for evidence instead. Guardian dominates Catalyst + above u ≈ 0.727 regardless of how saturated coverage is. + +**F14, stated as measured:** `Contextual → Analogical` changes the recipe set +returned by the shipped rung-dependent selection path (`Recipe::admissible_at` +/ `RungLevel::admissible_recipes`, consumed by the live +`StyleStrategy::recipes_for_at`) from **11 to 24**; the 13 added +Control-bucket kernels all fire on the measured stalled fixture, and CAS's +grid changes `[0,0,1,1] → [0.25,0.5,0.5,0.75]`. That is the whole result — it +is not translated into an epistemic or metacognitive claim. + +**THE SHARPEST THING THE AUDIT FOUND — the Evaluation fork exists in the +type system and nothing can drive it.** `KanbanColumn` already has the shape +the architecture needs: `Evaluation → [Commit, Plan, Prune]`, with `Plan → +Planning` documented as *"re-plan: re-enter Planning carrying the witness +(the 'act differently next time' exit)"* (`kanban.rs:56-58,101-109`). So the +re-run is ALREADY represented without a central scheduler — as a DAG edge. +But `advance_on_gate` (`kanban.rs:146-153`), the only shipped lowering, is +degenerate at `Evaluation`: `Flow` takes the first non-`Prune` ⇒ **always +`Commit`**; `Block` ⇒ `Prune`; `Hold` ⇒ stay. **`Plan` is structurally +unreachable through the gate** (grep: it is a transition target only in +`#[cfg(test)]` and two examples, never production `src/`). The three-way +deliberative fork collapses to commit-or-veto. And nothing reaches +`Evaluation` anyway — `cognitive_pass` filters `phase() != CognitiveWork` +(`cycle_driver.rs:719`), and `shade_owner`, the only production caller of +`advance_on_gate`, is reachable only from that loop: **the `Evaluation → +{Commit, Plan, Prune}` decision has no shipped production caller.** + +**A focus-of-attention representation EXISTS and must not be re-invented.** +`contract::attention_facet::{AttentionFocusFacet, RowFocusMask, FocusAxis}` +— *"Where focus landed or was projected"* (`attention_facet.rs:178`), breadth +as covered POPULATION not entry count — with `contract::rubicon_witness` as +its read-only instrument. Zero callers outside its own crate. Its constraint +is already written: *"It READS. It never moves anything… An overlay that +DRIVES a transition from a focus reading has rebuilt the scheduler this +substrate removed"* (`rubicon_witness.rs:26-31`). Its falsifier `D-ACR-8` is +two-sided and **queued, not run**. Unresolved placement question: +`rubicon_witness` measures the Heckhausen crossing at `Planning → +CognitiveWork`, while the pre-collapse deliberative surface in the target +architecture is `Evaluation → Commit` — two Rubicons or one mis-placed +label, unanswered. + +**Also established:** `Commit` is DECLARED, not implemented (`calcify` is a +`todo!()`, D-ATOM-5), so the Rubicon's irreversibility today is the DAG +legality table, not calcification; `RubiconPhase` (`cognitive-compiler`) is a +SEPARATE enum in a scaffold crate with zero cross-references to +`KanbanColumn`; and no `src/` file mentions both a Revision symbol and +`KanbanColumn` — Revision does not touch the phase machine in production. + +**Audit hygiene note:** one lane cited this probe's own header as +corroborating evidence for the absence of a focus mechanism. That is +circular — the header is this session's own text — and the citation was +struck. The absence claims above rest on call censuses, not on the probe's +self-description. + +**NOT OBSERVED / OUT OF SCOPE.** This probe has no observer capable of +establishing problem-texture discrimination, resonance behavior, MUL +grounding behavior, or Frozen/Learned/Explore superposition. Its observation +surface does not contain them; this bounds the probe, and is not a result +about the architecture either way. + +**Anti-conflation note.** The probe's `RungLevel` / `RungElevator` vocabulary +is unrelated to `lance_graph_planner::temporal`'s `QueryReference` / +`EpistemicMode`; no conversion or call path exists between them. Worth +stating only because both spell it "rung" — a census of every rung-named +surface found nine distinct vocabularies and zero conversions across this +pair (every `QueryReference::at` / `EpistemicMode::for_rung` call site passes +a literal or a local `const`). + +**FOLLOW-UP OBSERVATION (recorded, not addressed).** The live driver +numerically materializes `RungLevel` into `ThoughtCtx.rung` +(`driver.rs:569-577` `elevator.on_gate(gate) as u8` → `driver.rs:978` +`ctx.rung = rung`). `ThoughtCtx` documents `1..=9` +(`recipe_kernels.rs:58-59`, default `1`) while `RungLevel` contains +`Surface = 0`, so `Surface` can be materialized as `0`. No semantic failure +was demonstrated here and this PR does not alter it; whether `0` has +behavioral consequences or is stale documentation is for a later falsifier. + +**Behavioral learning: no production path exists.** +`ScaffoldCompiler::synthesize` returns `Err(CompileError::NotImplemented)` +unconditionally (`cognitive-compiler/src/lib.rs:155`), and `elixir-template` +/ `template-runtime` / `template-equivalence` / `cognitive-compiler` are all +in the root `Cargo.toml` `exclude` array. `witness_fabric::ForesightSample` +(`:1704`) is a correctly-shaped, hindsight-blind prediction-vs-outcome +primitive whose every caller is in its own `#[cfg(test)]` module — test-only, +not a live learning receipt. The honest claim is therefore *future* +behavioral learning will need equivalent prediction-time provenance; nothing +today can establish that property. + +**Temporal placement (narrow).** `temporal.rs` = query-level admission of +historical knowledge, tested, no production caller. `witness_fabric` = a +SEPARATE shipped grounding mechanism whose hindsight discipline is enforced +by API shape (the outcome is unreachable from the call signature) — this is +the load-bearing one. temporal → Revision = BLOCKED / absent +(`counterfactual.rs:335-336`, D-ATOM-5 / D-PERSONA-5). `temporal.rs` does not +currently participate in the cognitive loop, and nothing in this probe +touches it. + +**G19, the honest null:** this corpus's reachable exhaustion depths STRADDLE +the window (0.564 < [0.600, 0.725] < 0.768), so the earned-elevation arm +(F4/F6) is driven by a clearly-labelled synthetic evidence state at the +window midpoint. Everything downstream of `CycleEvidence` is the same shipped +path either way. Whether a ~0.125-wide window is the intended design or an +accident of two independently-authored rules is an OPEN QUESTION this probe +raises and does not answer — it is measured, not judged. + +**A corrected premise (the self-falsifier fired, as designed).** The first +draft used {naked-only, naked+hidden-ALL-units} and asserted a deep +both-policy stall; `derive_both_stall` panicked. A sweep showed why: +naked+hidden-over-all-units solves EVERY uniqueness-preserving reduction of +the #997 puzzle (`hidden_stall` reachable set = `[0]`; only 7 clues are +removable before uniqueness breaks), so with that pair "the admitted family +is exhausted" is UNREACHABLE and the whole escalation arm has no receipt. The +family is now {naked-only, naked+hidden-ROWS-only} — a real, sound, +oracle-checked technique with a narrower scan scope — under which exhaustion +is reachable at task-u ∈ {0.564, 0.754, 0.768}. + +**The membrane is task-normalized, deliberately the harsher reading.** +coherence = what the policy explained *of its own task* (cells empty at cycle +start), never *of the board*: "24 of 81 board cells" conflates the reasoning's +competence with the puzzle's generosity in givens; "24 of the 55 I was asked +to resolve" is a statement about the reasoning. It yields SMALLER coherence +than the board reading — the stricter choice, not the flattering one. + +**F14's actuator is shipped, not invented.** No kernel `gate()` reads +`ctx.rung` (verified negative). The real rung-capability gate is +`Recipe::admissible_at` / `RungLevel::admissible_recipes` (monotone, +test-pinned, consumed by the live `StyleStrategy::recipes_for_at`): elevating +Contextual → Analogical takes admissible recipes **11 → 24**, and all 13 +newly-admitted Control-bucket kernels (RTE HTD MCP CR LSI PSO CDI CWS SSR ETD +IDR SPP DTMF) actually FIRE on the stalled context — work refused at the prior +rung. Second arm: `Cas`'s shipped `hdr_level` grid re-quantizes the SAME field +`[0,0,1,1]` → `[0.25,0.5,0.5,0.75]` across the same boundary. + +**F5's evidence-thin vs evidence-saturated split is visible in the log:** at +IDENTICAL unresolved count, coverage 14/31 → Fanout and coverage 19/31 → +RungElevate. The distinction the operator asked for is measured, not +hand-picked; Fanout terminates honestly when coverage saturates ("cannot +gather more" is a no-op, not a loop). + +**CE64 non-interference is proven ACTIVELY, not by absence-of-import** (the +#998 approach, strengthened): a live edge carrying +`CausalTopology::IndirectUnknownIntermediates` + `ReasoningBand::Causal` is +lens-verified pre-flight, passed through the entire loop, and asserted +byte-identical after (F7/F8, raw `0x7000000000000000`). F9 goes further: +Direct vs IndirectUnknownIntermediates yield IDENTICAL verdicts — epistemic +topology does not secretly act as a scheduling trigger. + +**Two-`GateDecision` trap, recorded:** `mul::GateDecision` (Flow/Hold/Block, +String reasons) feeds `advance_on_gate`; the UNRELATED +`collapse_gate::GateDecision` (byte struct) feeds `RungElevator::on_gate`. +Same name, same crate, no conversion exists. This probe uses the mul one for +phase and `apply_delta` for rung — navigating the trap rather than tripping it. + +**Gates green (19/19):** F1 Flow-on-progress; F2/F15 triangle success → +elevation NEVER requested ("a different way of thinking" ≠ "a more powerful +level"); F3 unwarranted TCF singleton is no lever; F5 Fanout = breadth only, +phase held; G16/G18 the two negative controls; G19 the straddle; F4/F6 earned +elevation, rung only, triangle bytes identical; F14 the capability delta; +F7/F8/F9 CE64 untouched and not a trigger; F10 owner-locality; F11 read-only +witnesses; F13 observer-insufficiency → gather, never escalate; F12 full-run +determinism; G17 membrane monotonicity + regime discrimination. + +**Next slice (named, not hidden):** repeated-elevation dynamics, +Evaluation→Commit calcify, and the long-run fate of a +held-with-two-key-disagreement owner — the owner that wants depth and has not +earned it currently stays held at full coverage forever. + +## 2026-08-23 — E-SUDOKU-COGNITIVE-CORPUS-1 — the first real corpus through the dispatch bridge: a real puzzle, warranted end-to-end, and TCP/TCF/CUR still collide under real data + +**Status:** FINDING (measured — `PROBE-SUDOKU-COGNITIVE-CORPUS-1`, run +against a real, independently-solved puzzle). **Confidence:** High; +reproducible from the commit. + +**The first real corpus through `PROBE-RECIPE-DISPATCH-BRIDGE-1` (#996).** +`crates/lance-graph-ogar/examples/sudoku_cognitive_corpus_probe.rs` runs the +Sudoku Wikipedia article's example puzzle through naked-single constraint +propagation (ordinary, correct Rust — not claimed to be "solved by the +recipe kernels"), with every elimination event ALSO dispatched through a +real `kernel(id)` — `TCP`(5)/`TCF`(20)/`CUR`(26), the exact three recipes +`PROBE-RECIPE-EXECUTION-1` (#995) found collapsing into one coarse +signature under a synthetic battery — chosen per event by which real peer +group (row/column/box) has the fewest remaining unsolved cells. + +**The load-bearing check: PASS.** This puzzle solves completely by naked +singles alone — 51 assignments, 81/81 cells — and every single one is +warranted: verified against an INDEPENDENT full backtracking solve +(`backtracking_solve`, sharing no code with the propagation loop). 282 +elimination events were dispatched through real kernels alongside the +solving, never driving it. + +**The re-test: TCP/TCF/CUR still collide, even under real puzzle-derived +data.** 107/88/87 dispatches respectively, each producing only 2 distinct +(fired, Δconfidence-sign) signatures across the entire real corpus — +identical to the synthetic-battery result. This distinguishes the "genuine +no-op / coarse-signature-too-blunt" collision class from the "different +labels, actually-different-behaviour" class the session's own analysis +predicted might exist: real, varied, puzzle-derived candidate sets (2-9 +candidates per cell, real entropy variation) did NOT separate these three — +the collision is a property of the recipes' effect at THIS signature +granularity, not an artifact of the synthetic battery being unrepresentative. + +**The generalization:** + +> A synthetic test battery and a real corpus answering the SAME collision +> question is itself informative regardless of the answer. Had real data +> separated TCP/TCF/CUR, that would have indicted the synthetic battery as +> too narrow. It did not — which instead strengthens the claim that these +> three recipes' effects, at this signature granularity, are genuinely +> close, not merely under-tested. + +**Scope, honestly held:** naked-single propagation only (no hidden singles, +pairs, X-wing, …). The recipe dispatch is a measured side channel over real +state, not a claim that the kernels perform or could perform Sudoku-specific +reasoning — their pruning logic is generic and confidence-shaped, unrelated +to digit legality. + +Cross-ref: `E-RECIPE-DISPATCH-BRIDGE-1` (the bridge this corpus runs +through), `E-RECIPE-EXECUTION-SEPARABILITY-1` (the collision this re-tests). +## 2026-08-23 — E-METACOGNITIVE-TRIANGLE-ARROW-1 — the triangle was write-only: nothing ever READ `StyleLane::Frozen` to choose reasoning, and `promote_family` had zero production callers; both half-arrows now close through the SHIPPED Revision/counterfactual surface + +**Status:** FINDING (measured — `PROBE-METACOGNITIVE-TRIANGLE-1`, 12/12 gates +green). **Confidence:** High; reproducible from the commit. + +**The audit finding (4 Sonnet survey lanes + direct reads, main @ f5e27c9d).** +The autopoiesis triangle's storage and mechanics are complete and tested +(`StyleLane`, the three `ValueTenant` lanes at 152/164/176, +`MailboxSoA::{set_style_lane, set_style_atom, promote_family}`, +`MailboxSoaView::{style_lane_at, triangle_at}`) — but the CONTROL LOOP did +not exist anywhere: (a) no code read `StyleLane::Frozen` to choose how to +reason; (b) no code consumed a receipt of a reasoning run to decide +keep/explore/promote — the teacher probe computed decisions from fresh grades +and bypassed `promote_family` (zero callers outside its unit tests). This is +`persona-vs-rung-ladder.md` O6 ("triangle structure unbuilt"), now measured. +Premise correction recorded: the CE64 59..60 factual lens is +`CausalTopology::{Direct, IndirectKnownIntermediates, +IndirectUnknownIntermediates, Unknown}` — "IntermediateKnown/Unknown" was +brainstorm prose, not the type. + +**The probe** (`crates/cognitive-shader-driver/examples/ +probe_metacognitive_triangle.rs`) closes the loop once, falsifier-first, on +the Sudoku corpus: Frozen lane READ → lower rung runs the policy it names → +`RungReceipt` (warranted assignments, fixed point, unresolved count, kernel +side-channel) → higher rung assesses the RECEIPT (its signature carries no +Grid — the meta pass's object is the reasoning, never the puzzle) → +Explore/Learned writes → held-out comparison → the first production-path +`promote_family` call → the NEXT run literally reads the promoted Frozen +lane and solves what previously stalled. + +**The Revision hinge is the SHIPPED surface, not a local pseudo-Revision** +(operator correction mid-build: "revision.rs / counterfactual.rs already +exists" — verified: v2 lane real and tested, v3 lane `todo!()` on +D-PERSONA-5). TryExplore is declared a split (frozen commitment = majority +pole, explore hypothesis = minority pole); `deposit_counterfactual` stamps a +`RawEdge` with the −6 mantissa, so the whole Explore arm runs in the +counterfactual lane — never observed truth. Each A-vs-B comparison is a +`FreeEnergyComparison` (residual F = unresolved/81) ruled by +`minority_wins()`; the verdict is a `RevisionOutcome` +(`MajorityHolds` → promotion refused on the base held-out; +`Revised` → `promote_family` on the stall held-out, then the mantissa clears +to 0 per `revise_if_minority_wins`'s documented step-5 protocol). Not +called: the two `todo!()` bodies (`CounterfactualMailbox::*`, +`revise_if_minority_wins` itself) — the probe exercises the decision shape +through the shipped pure pieces and does not fake the actor arm. The +invariant this buys: **exploration may be destructive inside the +counterfactual lane; commitment may not be destructive without warrant.** + +**TCP/TCF/CUR as the first metacognitive event, resolved WITHOUT touching +`delta_conf`.** The #995/#997 coarse-signature collision is re-observed live +(side-channel, cloned candidate sets only): where all three kernels see the +same n≥3 set with identical `(fired, sign Δconf))`, the exact +`(len_before, len_after)` transitions already separate TCF (→singleton) from +TCP/CUR (→identity); the meta verdict is `ObserverInsufficient { colliding: +[5,20,26], exact_separates: [20] }` — request a richer receipt, never mutate +recipe semantics for telemetry. TCF's manufactured singleton (n=3 → 1, zero +exclusion warrants) is classified `UnwarrantedCertainty` and refused as +truth; the cell stays unresolved. Every digit actually committed carries ≥1 +named exclusion warrant and matches the independent backtracking oracle. + +**Gates green (12/12):** F1 keep-frozen on progress; F2 stall → TryExplore; +F4 degenerate explore stays silent (minority does not win → no Learned +write); F5 minority wins → Learned recorded; F6 held-out non-reproduction → +`MajorityHolds`/refuse; F7 held-out reproduction → `Revised`/promote (first +production-path `promote_family`); read-side arrow (next run reads promoted +Frozen, 0 unresolved); counterfactual lane (−6 stamped, 0 cleared on +Revised); F8 `ObserverInsufficient`; F3/F15 unwarranted certainty refused + +warrant-per-commit; F13 bystander row byte-identical; F14 full-loop +determinism. Deferred with scope notes: F9 (reason-context equivalence), +F10/F11 (Revision→Kanban hinge — the `verdict_from → select_tactic` +"designed, not wired" edge is deliberately the NEXT slice); F12 holds by +construction (no `causal_edge` import; CE64 59..63 untouched). + +## 2026-08-23 — E-RECIPE-DISPATCH-BRIDGE-1 — the `FnIndex -> kernel(id)` seam is built and identity-preserving for all 34 ids; one receipt now spans both instruction ranges + +**Status:** FINDING (measured — `PROBE-RECIPE-DISPATCH-BRIDGE-1`, run against +real code). **Confidence:** High; reproducible from the commit. + +**Closes the seam `PROBE-RECIPE-EXECUTION-1` (#995) left open.** #995 called +`kernel(id)` directly — never through an `ogar_loco::Call`. This probe +(`crates/lance-graph-ogar/examples/recipe_dispatch_bridge_probe.rs`) builds +the missing arm: given a `Call` whose `FnIndex` is a minted recipe op, +`recipe_of(f)` resolves the id, `kernel(id)` is invoked via `run_with`, and +the result is recorded alongside ordinary shared-core execution in ONE trace. + +**Three falsifiers, all green:** +- **Part 1 — identity, all 34 ids.** For every `id in 1..=34`: routed through + the bridge (`op_of(id)` → `Call` → interpret → `recipe_of` → `kernel(id)`) + vs. called directly on an identical starting `ThoughtCtx`, bypassing the + bridge entirely. `Outcome` (`PartialEq`) and the resulting `ThoughtCtx` + (`Debug`-compared) are identical on **all 34** — no id resolves to the + wrong kernel, no operand corruption, no gate skipped. +- **Part 2 — determinism under replay**, bridged, 4-slot focus battery: + byte-identical traces across two runs, 4 sampled ids. +- **Part 3 — one canonical receipt spanning both instruction ranges**: a + single 7-call program interleaves shared-core arithmetic (`NUMBER`, `ADD`) + with two recipe dispatch calls (`RTE`, `ASC`), producing ONE ordered trace + — `shared-core, shared-core, shared-core, recipe, shared-core, shared-core, + recipe` — the shape #992's `TraceEvent` and #995's per-kernel signature + never combined into. + +**Layering held, as directed:** `ogar_loco` was NOT touched (stays zero-dep, +recipe-blind); `lance_graph_contract::recipe_kernels` was NOT touched (stays +zero-dep, loco-blind). The bridge is a small adapter living entirely in +`lance-graph-ogar` — the one crate the workspace already lets depend on both +— not a new generic `DomainDispatch` trait (deferred until a second domain +vocabulary needs one). + +**What remains explicitly unbuilt, by design:** the recipe operand's real +address resolution against the basin-local attention-focus codebook +(`recipe_vocab.rs`'s own module doc: *"the basin that owns the prefix owns +the resolution"*). This probe stands in with a small, honestly-labelled +focus-slot array — the identity/determinism/composition questions it answers +do not depend on how the focus address was resolved. + +Cross-ref: `E-RECIPE-EXECUTION-SEPARABILITY-1` (the semantics this bridges +to), `E-OGAR-LOCO-INTERPRETER-RUN-1` (the shared-core half). + +## 2026-08-23 — E-RECIPE-EXECUTION-SEPARABILITY-1 — the 34 recipes already have real, tested execution semantics (`kernel(id)`/`Tactic::apply`); 23/34 are separable by state transition, 11 collapse into 15 coarse-signature collisions + +**Status:** FINDING (measured — `PROBE-RECIPE-EXECUTION-1`, run against real +code). **Confidence:** High; reproducible from the commit. + +**Correction to `PROBE-LOCO-INTERPRETER-1`'s KC1 framing** (`.claude/ +brainstorms/2026-08-22-behavioral-ir-fathoming.md` §F1, `AdaWorldAPI/ +lance-graph` PR #992): "the recipes' semantics live in `ThoughtCtx`/ +`recipe_dispatch` wiring, out of scope" read as "not built yet." They are +built and tested: `lance-graph-contract::recipe_kernels.rs` carries all 34 as +real `impl Tactic` blocks (`apply(&mut ThoughtCtx) -> Outcome`), dispatchable +via `kernel(id: u8) -> Option<&'static dyn Tactic>` / `all_kernels() -> +[&'static dyn Tactic; 34]`, id space `1..=34` — the SAME id space +`lance-graph-ogar::recipe_vocab::op_of`/`recipe_of` uses for the `FnIndex` +mapping (`FnIndex(0x90 + id - 1)`), verified by a round-trip assertion, not +assumed. + +**KC1 reframed and measured**, `crates/lance-graph-ogar/examples/ +recipe_execution_probe.rs`: given the SAME starting `ThoughtCtx` (a 4-context +battery — hot/cold/empty/neutral), do different recipe ids produce +observably different state transitions? Signature deliberately coarse (fired +/ Δconfidence sign / which fields changed / candidate-count-delta sign) so +raw float noise cannot manufacture false separability. Result: **23/34 +distinguishable across the whole battery; 11 collapse into 15 pairwise +collisions** (e.g. `ARE`/`ZCF`/`HKF`/`MCP` all "fire" but change nothing +observable on any context tested; `RCR`==`IRS`==`TCA`). Measured, not quoted: +31/34 `KernelMaturity::Operational`, 14/34 can move `confidence` at all; +restricting to Operational-only kernels barely moves the rate (23/31). + +**The generalization:** + +> A crate's own hedge ("out of scope for this run") can read, to a later +> session, as "does not exist" rather than "not pulled into THIS probe." The +> two are different claims with different next actions — the first says +> "build it," the second says "wire it in" — and conflating them costs a +> session the correct next step. + +**What this does NOT establish:** an `ogar_loco::Call`/`FunctionBody` → +`kernel(id)` dispatch bridge. No `FnIndex` in `RECIPE_OP_BASE..RECIPE_OP_END` +is invoked by any interpreter today (`PROBE-LOCO-INTERPRETER-1`'s interpreter +still covers only the shared core). That bridge is now a small, well-scoped +task — the id mapping is already verified consistent, so it is wiring, not +missing semantics. + +Cross-ref: `E-OGAR-LOCO-INTERPRETER-RUN-1` (the KC1-untested finding this +corrects), fathoming report §F1a. + +## 2026-08-22 — E-HHTL-NAMES-TWO-STRUCTURES-1 — "HHTL" is a homonym: the cascade key's `(X;Y)` tile and `NiblePath`'s subClassOf router are different objects, and conflating them produced five false structural claims in one session + +**Status:** FINDING (the collision is documented on both sides; the *cost* is +measured on one session's output). **Confidence:** High — every claim below was +checked against the cited line by a council code-truth pass (inventory 17/17). + +Two shipped structures wear the same name: + +| "HHTL" as… | is | where | +|---|---|---| +| the cascade key's coordinate reading | `(X;Y)` per `(part_of:is_a)` tile — `part_of` = X = hi byte, `is_a` = Y = lo byte | `E-V3-BASINS-ARE-MEREOLOGY-NOT-LABELS` (:12055) | +| the Abstammung router | `NiblePath` — the `subClassOf` (P279) path, DOLCE basins 0..3, `mask-inherits-as-delta`, "walking DOWN the path is IS-A inheritance", ONE tree axis only | `hhtl.rs:1-38,56,176` | + +**The first is an address; the second is a taxonomy walk.** A containment +hierarchy (book ⊃ chapter ⊃ verse) belongs to neither by default — it is +**mereology**, which `le-contract.md:56` carries in the *other byte of the same +pair*, and reading it onto the taxonomy axis is silently type-wrong. + +**Measured cost.** A session addressing the KJV corpus used the name as though +it denoted one hierarchical path and produced five structural claims, every one +false: that HHTL is the Book·Chapter·Verse path; that Book·Chapter "lands +exactly" on HEEL (numerology over a self-chosen `ceil(log16 n)` carving); that +the translation lane lives in the classid; that a CAM-PQ code could ride in the +key tail; and that "MailboxId IS the NiblePath" is settled (it is flagged +DOC-ONLY, `tenants.md` §7.3). None survived a read of the definitions. + +**The generalization:** + +> A name that denotes two structures is not a documentation problem, it is a +> **type collision with no compiler behind it**. The two readings share a width +> (12 bytes) and a carving (`6×(8:8)`), so every syntactic check passes and only +> semantics disagree — which is precisely the class of error no gate catches. + +Practical consequence: when a design sentence contains "HHTL", say **which** — +cascade-key `(X;Y)` or `NiblePath` — or the sentence is ambiguous. Nearest prior +art is a "nibble homonym" table (`handovers/2026-08-21-2200:110-114`) and a +traced collision section (`ATTENTION_MASK_AUDIT_2026_08_21.md:75`); neither +names this pair, which is why it is banked here. + +Cross-ref: `E-V3-PART-OF-IS-A-TILE` (:12266), `E-FACET-8-8-ALWAYS` (:12088), +`knowledge/ast-as-partof-isa-address.md:23-28` (the 3/4/6 count distinction). + +## 2026-08-22 — E-A-CONSTANT-OFFSET-CANNOT-ALIGN-TWO-VERSIFICATIONS-1 — the versification map's KJV side is exact, and 51 of its offsets address a verse that does not exist; the shape, not the values, is the defect + +**Status:** FINDING (arithmetic on the map's own columns — no scoring +involved). **Confidence:** High for the 51; the head/tail split (22) reuses the +original detector's cheap prefix-anchor signal and is a diagnosis, not a proof. + +**The map is right where it can be.** `rosetta-pd-bundle/versification_map.tsv` +declares `kjv_verse_count` for every (lane, book, chapter); it matches the +actual KJV lane for **3,567 / 3,567** rows (1,189 chapters × 3 lanes), with no +gaps, no extras, and a dense KJV lane (count == max verse number everywhere). +The offset census reproduces its report exactly (luther1545 36 / +elberfelder1905 3 / bkr 8). + +**51 rows declare an offset that cannot be applied end-to-end:** 47 have +`kjv_verse_count + offset > lane_verse_count`; 4 have `1 + offset < 1`. The +dominant cluster is luther1545 Psalms carrying `offset=+1` on chapters where +**both lanes have identical verse counts** — self-contradictory: an endpoint +must fall off. + +**Psalm 84, the report's own worked receipt, shows why.** Luther counts the +superscription as v1, so `+1` is correct for KJV v1–v10 — but the lane has +**dropped KJV v11** ("For the Lord God is a sun and shield"), so KJV v12 +aligns at `+0`. The detection is linguistically right; the *carrier* cannot +hold the answer. + +**The generalization:** + +> An integer offset is position made portable by arithmetic. It cannot express +> either degenerate case an alignment actually needs — an **address with no +> witness**, or a **witness with no address** — so on any interior insertion or +> deletion it is forced to pick a number that is right for part of the chapter +> and wrong for the rest. + +This is also why the map's measured payoff is thin (+21 verses, 0.14 pp over +the naive join): where an offset was found, it is partly wrong. The report's +caveat covers whole-*chapter* divergence and explicitly observed none; the +failure here is intra-chapter verse loss, which that model does not name. + +**Operator ruling arising (2026-08-22):** *when referencing other versions you +can never use token position — always the verse ADDRESS, distinguished-name +style.* Alignment across lanes is a relation between addresses, including the +two degenerate forms; repairing individual offset rows keeps the shape that +cannot represent them. + +Corroborating contrast from the same pass: the Composite Gospel Index carries +601 references as `Book.Chapter.Verse` ranges rather than offsets, is versified +against **RSV**, and **600 of 601 resolved against the KJV lane on first +contact** (the single failure is a typed book mismatch, +`hasReference="Matt.4.33-Mark.4.34"` under `isPartOf="#Mark"`). An address +ported across versifications; an offset did not. + +**Cross-refs — same asset, distinct defect classes** (added by the 5+3 council so the +asset's finding history does not fragment across four ids): `E-VERSIFICATION-IS-PER-EDITION-NOT-PER-TRADITION-1` (:7487) and `E-A-MARGIN-IS-NOT-A-QUALITY-SCORE-1` (:5813) find *value* and *confidence-column* defects in this same map; this entry finds the **carrier shape** defect. `E-RCC-1-FOUR-LANES-ONE-KEY-1` (:7499) is the design the map serves. + +Artifacts + full defect census: `.claude/handovers/2026-08-22-corpus-addressing-session-to-next.md`. + +## 2026-08-22 — E-A-DOC-COMMENT-CAN-GIVE-THE-WRONG-REASON-FOR-A-CORRECT-GUARD-1 — the guard was right, the justification was false, and the test read the justification +## 2026-08-23 — E-OGAR-LOCO-INTERPRETER-RUN-1 — the missing interpreter was built, ran, and a real ABI property surfaced + +**Status:** FINDING (measured — `PROBE-LOCO-INTERPRETER-1`, pre-registered in +`.claude/brainstorms/2026-08-22-behavioral-ir-fathoming.md` §F, was actually +run). **Confidence:** High; reproducible from the commit. + +`AdaWorldAPI/OGAR` branch `claude/probe-loco-interpreter-1` adds +`crates/ogar-loco/examples/interpret_probe.rs`: a minimal interpreter for +`ogar_loco::FunctionBody` over its shared computational core (arithmetic, +logic, variables, IF/IF_ELSE/REPEAT/WHILE/REPEAT_UNTIL). Corpus: four +hand-authored real algorithms (GCD, summation, FizzBuzz-style classification, +Collatz step counts), 44 real inputs total, each run twice. + +Results: KC2 (determinism) PASS, KC3 (median episode length ≥5) PASS at +median=23, KC4 (traces are input-dependent, not `ladder_program()`'s static +ordering) PASS with 44 distinct sequences across 44 episodes — the single +most-likely-to-kill condition did not fire. All 44 episodes independently +correct against ground-truth arithmetic. KC1 (the 34 lance-graph-ogar recipes +have separable executable effects) explicitly NOT TESTED — the probe covers +only the shared core below `DOMAIN_FLOOR`. + +**The genuine surprise was in building it, not in running it:** the shared +core's own declared `pushes_result` table marks `VAR_SET`/`VAR_CHANGE` as +*pushing* a result (chainable-assignment semantics), and there is no +`DROP`/`POP` primitive. `ogar_loco::statements::statement_bounds` (whole-body +segmentation, built for step-mask masking) therefore correctly *refuses* +(`DanglingOperands`) any ordinary imperative "set a; set b; …" sequence, +because nothing consumes the leftover pushed values. This is not a bug in +`statement_bounds` or in the probe — masking and execution are different +questions — but it means `statement_bounds` cannot be reused unmodified as a +learned-macro unit boundary, since it refuses on exactly the bodies real +programs are made of. The interpreter therefore does not use +`statement_bounds` for dispatch; it walks each function body as one linear +program-counter pass (treating `VAR_SET`/`VAR_CHANGE` as void), using a local +backward operand-span scan only where `WHILE`/`REPEAT_UNTIL` must re-run a +condition. + +**Consequence for the fathoming report (`AdaWorldAPI/lance-graph` PR #989):** +§F was rewritten to §F1 with these results; §H ("if it fails") does not +apply — the falsifier survived. §G's sketch (learned macro as a `MacroId` +reference, deopt-shaped fallback, never a new opcode) is now reasoning about +a substrate with a confirmed-executing IR underneath it, still [H] pending +KC1. + +**The generalization:** a crate's own declared semantic table (here, +`pushes_result`) can encode a design intent (chainable assignment) that no +consumer has ever exercised against a real multi-statement program — so its +correctness as a MASKING primitive and its usability as an EXECUTION +primitive are separate claims, and the first building of a real interpreter +is where the gap between them becomes visible. + +**Status:** FINDING (measured — the mutation was run and initially did NOT +fire). **Confidence:** High; reproducible from the commit. +**Relation:** second instance, same day, of the family opened by +`E-A-DOC-PRECEDENCE-CLAIM-CAN-PASS-EIGHT-GREEN-TESTS-1` — but a **different +mechanism**, so it is filed separately rather than folded in. There the claim +was untested; here it was *false*, and the code it justified was *correct*. + +`rubicon_witness::breadth_bits` computes `log2(1 + coverage(mask))`. The `1 +` +is load-bearing. Its doc comment explained why: + +> the `1 +` is what keeps **empty** (`0.0`) distinct from **exact** (`1.0`) — +> without it both would read `0.0` + +**That is wrong.** Without the offset, empty reads `log2(0) = -inf` and exact +reads `log2(1) = 0.0` — already distinct. The assertion written from that +explanation (`breadth_bits(empty) < breadth_bits(exact)`) therefore passes +**with or without** the guard, because `-inf < 0.0` holds. + +The offset's real job is **finiteness**: `-inf` in a mean carries the whole +[`FocusTrace::breadth`] with it, so a single unsampled moment would make an +entire phase read as infinitely narrow. Correct guard, false reason, and a test +that tested the reason. + +Exposed by a mutation that removed the `1 +` and watched **all eight tests stay +green**. The fix was to correct the comment in place (with the error recorded, +not deleted) and add the assertion the real property needs: a trace holding one +real focus and one empty sample must report a **finite** breadth, strictly +between the two. + +**The generalization:** + +> A doc comment does not only make CLAIMS that need testing — it supplies the +> REASON a test author writes their assertion from. A false reason yields a +> true-but-inert assertion, and inert assertions are invisible: they pass, they +> look like coverage, and they sit next to a guard they do not guard. + +Practical consequence: when a guard is small and "obviously" necessary +(`1 +`, `saturating_`, a `+ 1`, a clamp), the mutation to run is **deleting the +guard**, not exercising its stated purpose. If nothing goes red, the stated +purpose is not the actual purpose — and the comment is the first suspect, not +the last. + +Both instances this session share one method note: the finding only exists +because the mutation was **executed**. Neither would have survived a reading. + +## 2026-08-22 — E-A-DOC-PRECEDENCE-CLAIM-CAN-PASS-EIGHT-GREEN-TESTS-1 — a two-gate ORDER is unfalsifiable until a fixture trips both + +**Status:** FINDING (measured, this session — the mutation was run, not +reasoned about). **Confidence:** High; the instance is reproducible from the +commit. + +`recipe_vocab::refusal_of` (D-ACR-9 second half) applies two gates and its doc +committed to a precedence: *"a recipe that is both too deep AND ungrounded +reports `AboveCeiling`, deterministically."* Eight tests were green, including +one written specifically for the refusal surface, asserting all three variants +fire. + +**Swapping the two checks changed nothing.** All eight still passed. The +`AboveCeiling` assertion used a fully grounded fixture, so `nan_disqualifier` +returned `None` for every recipe and the order could never be observed. The +claim was **doc-only** while looking tested. + +The fix was a fixture, not a rewrite: search `dispatch_order()` for an id where +`rung(id) > ceiling` **and** `nan_disqualifier(&holed, id).is_some()` — recipe +17 (CDI, Revision, rung 6) under an emptied belief set — and assert the outer +gate is what gets reported. The mutation then fired with exactly that id named. + +**The generalization, and it is the point:** the falsifiability rule already +says *"a doc-comment claim is not a behaviour"* and *"a guard needs a +can-it-fire test"*. This instance adds the case those two do not cover — **a +claim about the INTERACTION of two guards that each fire correctly on their +own.** Every individual variant here had a real fixture; what had none was the +overlap. So: + +> When a function applies N gates and documents which one wins, the test suite +> needs a fixture in the INTERSECTION. Fixtures that trip one gate each prove +> the gates, never the precedence — and N passing single-gate tests read +> exactly like coverage. + +The overlap fixture is also the one that must be searched for rather than +hardcoded: writing `op_of(17)` would pin a recipe id that a re-tiering moves, +and the search doubles as the anti-vacuity assertion (`.expect("some deep +recipe must also read the emptied beliefs")`). + +Method note: the only reason this was caught is that the mutation was +**executed**. Eight green tests plus a plausible doc sentence is precisely the +shape that survives review. + +## 2026-08-22 — E-BPE-IS-RHYME-VQ-IS-THE-MECHANISM-FOR-6X2X8BIT-1 — the 256:256 tile codebooks are VQ-lineage; BPE shares numerology, not mechanism + +**Status:** FINDING (literature-grounded, arxiv-grounder run 2026-08-22; graded +per-claim in the run's report). **Confidence:** High for the disanalogy; the +three probes below are the promotion path for anything stronger. + +Asked (operator): does `6×2×8bit` (6× 256:256 centroid tiles) have synergies +with Byte Pair Encoding? Answer: **RHYME, not mechanism.** + +- BPE (Gage 1994; Sennrich 2016, arXiv:1508.07909) is a **frequency-greedy + adjacent-pair merge** approximating an entropy/prefix code — Huffman/LZ + lineage ("Tokenization and the Noiseless Channel", arXiv:2306.16842). Its + merge tree carries **no containment semantics**, its tokens are + variable-length, its process is serial and corpus-global. +- The facet's codebooks are **nearest-centroid quantization over a fixed + 4-ary hierarchy** — VQ lineage. The honest literature bridge for `↑n` + (exponential space at additive path cost) is **residual / tree-structured + VQ** (RVQ: hierarchical codebooks, log-time tree search) and VQ-VAE + (learned codebook as tokenizer) — not BPE. Unigram-LM (Kudo 2018) is the + one tokenizer-family member with a comparable fixed-cardinality global + objective, but it optimizes segmentation likelihood, not distortion. +- Named hazards of naive "BPE-ification": cross-axis merges on co-occurrence + where no adjacency exists; loss of `is_ancestor_of` (BPE guarantees no + subsumption); frequency-optimal replacing distance-optimal under lookups + that assume distance coherence; a shared vocabulary violating + classid-scoped codebooks. + +**⊘ Provenance note, same day (transcript audited after the fact — the run's +own limits, so nobody cites this entry as more than it is):** the agent made +**9 real WebSearches and ZERO WebFetches**, and every citation checked +(`1508.07909`, `2306.16842`, `1910.13267`, `2305.07185`, `2602.22958`) appears +in a tool RESULT before it appears in the report — so nothing is fabricated, +but the evidence is **search-snippet level, never a paper read end-to-end**, +and several anchors are secondary summarizer pages rather than primary +sources. Its `[G]` grades are therefore over-graded by its own charter; read +them as strong `[H]`. Second limit, and the sharper one: it made **no Read or +Grep of the local files offered to it** (`facet.rs`, `attention_facet.rs`, +`ogar-loco/src/lib.rs`, OGAR `CLAUDE.md`), so every claim about OUR side is +the prompt's framing echoed back, not independent verification. What the run +genuinely establishes is the **BPE side** and the disanalogy; that our +codebooks are VQ-lineage remains our own (well-sourced, in-repo) claim, not +this run's finding. + +Pre-registered probes (run before any code moves): (1) RVQ-vs-current +retrain of ONE axis under the 4-level constraint, measured on containment + +retrieval; (2) does distance-trained k-means already concentrate density on +the high-frequency `(coarse,fine)` pairs a BPE allocator would pick — +if yes, reallocation buys nothing; (3) containment-violation rate of a +BPE-trained table vs the centroid tree on the same address stream. + +## 2026-08-22 — E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1 — nine workspace members are in no CI job at all, and adding one to `members` adds it to nothing + +**Status:** FINDING (measured; every claim is a grep over `.github/workflows/` +and root `Cargo.toml`). **Confidence:** High. **Supersedes the cause** given in +`E-A-CRATE-WITH-ZERO-CONSUMERS-IS-BUILT-BY-NOTHING-AND-CAN-BE-MERGED-BROKEN-1` +(same day, same session, mine). + +That entry explained a crate that did not compile at `main` by saying a crate +with zero consumers is in nobody's build graph. **That is wrong.** +`crates/lance-graph-hydrate` is listed in `[workspace] members` (root +`Cargo.toml:25`); `cargo build --workspace` would compile it. The explanation +was plausible, fitted the symptom, and was never checked against the manifest. + +**The actual mechanism.** No workflow in this repo runs `--workspace` or +`--all`. Every gate names one crate by path: + +``` +build.yml:78 cargo build --manifest-path crates/lance-graph/Cargo.toml +rust-test.yml cargo test --manifest-path crates//Cargo.toml (×14) +style.yml:75+ cargo clippy --manifest-path crates//Cargo.toml (×6) +style.yml:150+ cargo fmt --manifest-path crates//Cargo.toml (×3) +``` + +`style.yml:152` even says so in a comment: *"`cargo fmt --all` never reaches +it."* The gate is a **hand-maintained allowlist**. Membership in +`[workspace] members` is therefore not a build guarantee — it is a lockfile and +`-p` convenience, nothing more. + +**Measured scope, not just my crate.** Of 25 members, ELEVEN appear in no +workflow. Two of those (`lance-graph-catalog`, `lance-graph-planner`) are +dependencies of `lance-graph`, so their LIBS compile inside a gated build +(their tests still never run). The remaining NINE are gated by nothing at all: + +``` +lance-graph-benches lance-graph-rbac +neural-debug lance-graph-ontology +lance-graph-archetype lance-graph-consumer-conformance +sigma-tier-router cognitive-shader-driver +lance-graph-hydrate +``` + +`lance-graph-hydrate` was simply the one that a semver-compatible upstream +change (`object_store 0.13.2` moving `get`/`put` onto `ObjectStoreExt`) happened +to break. Nine crates carry the same exposure; nothing about this was specific +to having no consumer. + +**Why the wrong cause was attractive** — worth naming, because it is the +Kahneman System-1 shape the workspace already warns about: the crate's own +`lib.rs` prominently says it has zero consumers, so a consumer-shaped +explanation was *pre-loaded* by the file being read. It explained the symptom +without contradicting anything visible, which is exactly when a claim needs its +own check and does not get one. The check was one grep of `Cargo.toml`. + +**The durable fix is a gate, not a consumer.** Landing +`VersionedGraph::hydrate_from` (this branch) does make `lance-graph-hydrate` a +dependency of a gated crate, so its lib will now compile in CI — but that is a +side effect, and it leaves its TESTS ungated and the other eight untouched. +The fix is a workflow line per crate, or one `--workspace` job. Filed as +`ISSUES.md` `ISS-CI-GATE-IS-AN-ALLOWLIST-NINE-MEMBERS-UNGATED`. + +**Outcome, same day (PR #984):** both, and the count above was wrong. A +workflow line per crate for every member — each measured locally before its +gate was armed — PLUS `cargo build --workspace` as the net that covers future +members without a line. Wrong count because the member check extracted with +`"crates/[a-z0-9-]+"`: no underscore, so `crates/surreal_container` was +invisible to it, and `tools/dto-class-check` is not under `crates/` at all. +Eleven, not nine. A membership check blind to two of its inputs is this +entry's own defect class, one level up, in the instrument rather than the +workflow — which is the part worth carrying forward. + +## 2026-08-22 — E-A-CRATE-WITH-ZERO-CONSUMERS-IS-BUILT-BY-NOTHING-AND-CAN-BE-MERGED-BROKEN-1 — the hydration crate did not compile at `main`, and its own doc says why nobody found out + +**Status:** ⊘ SUPERSEDED SAME-DAY by +`E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1` — the measured +breakage is real and unchanged; the MECHANISM named below ("zero consumers ⇒ +not in the build graph") is WRONG. `lance-graph-hydrate` is a workspace +MEMBER. Kept in place per append-only; read the successor for the cause. +**Confidence:** High on the failure, RETRACTED on the cause. + +`crates/lance-graph-hydrate` was minted 2026-08-17 (PR #957 + follow-ups) as +the generic object-store → local-volume hydration lifecycle, with a 5+3 +hardening council on it. Its `lib.rs` states plainly that it has no consumer +yet — the deferral of `ISS-HYDRATE-DIR-AND-FILE-DUPLICATE-THEIR-STAGING-BODIES` +is even justified by that fact (*"cheap only while this crate had zero +consumers"*). + +**Measured 2026-08-22, on a clean checkout of `origin/main` (#981):** + +``` +cargo build -p lance-graph-hydrate +error[E0599]: no method named `get` found for reference `&dyn ObjectStore` +... 5 errors, in the LIB, not the tests +``` + +`object_store 0.13.2` — the version the workspace lockfile already pins, on +`main`, unchanged by this branch — moved `get`/`put` off the base +`ObjectStore` trait onto an extension trait `ObjectStoreExt`. The fix is two +`use` lines. `cargo fmt -p lance-graph-hydrate` also rewrites four of its +files, so it was merged unformatted as well. + +**The finding is not the breakage; it is the mechanism that hid it.** A crate +with zero consumers is not in any consumer's build graph. Nothing that CI +actually runs reaches it, so a semver-COMPATIBLE upstream change (0.13.x, no +major bump, no lockfile movement) silently invalidated it and no gate fired. +The absence of a consumer was recorded in the crate's own doc as a *cost +tradeoff* — it is also, and more importantly, a **verification hole**: the +crate's tests pass only in the one command nobody runs. + +Two consequences, both narrow: + +1. **A mint without a consumer needs an explicit build gate**, or it is + documentation with a `Cargo.toml`. Either land the first consumer in the + same arc, or add the crate to whatever CI job actually compiles. +2. **"Hardened by a 5+3 council" is orthogonal to "builds."** The council + reviewed intent, duplication, and doctrine conformance — all real, all + preserved by this fix. None of that is a compiler. + +Corrected in the same commit that gives the crate its first mechanism with a +consumer path (`archive::hydrate_archive`), so the hole closes rather than +being recorded and left open. + +## 2026-08-21 — E-ATTENTION-MASK-IS-A-RENAME-REGISTER-FILE-NOT-A-RESIDUE-CARRIER-1 — the fourth homonym collision of this arc, and the only one where the shipped type is COMPLETE for a different contract + +**Status:** FINDING (D-ACR-0, report-only deliverable; every claim a read of +the file named or a stated grep). **Confidence:** High — the caller count is a +workspace-wide grep plus three sibling repos; the origin is the shipped type's +own originating plan, quoted. + +`alpha-channel-rung-overlay-v1.md` §1 piece E graded +`cognitive-shader-driver/src/attention_mask.rs` + `attention_mask_actor.rs` +*"shipped; unaudited for this use"* — the use being the operator's +eye-tracking residue carrier. The audit +(`.claude/ATTENTION_MASK_AUDIT_2026_08_21.md`) returns **both** branches of the +falsifier at once, and the second is the load-bearing one. + +**EXISTS-UNCALLED.** Three hits outside the two files, all non-consumers: two +`pub mod` lines in `lib.rs`, and `mailbox_soa.rs:11` — a doc comment stating +the *opposite* (*"wrap, **NO AttentionMask/LRU**, NO cross-cycle rollup"*). +`MedCare-rs` / `OGAR` / `ndarray`: 0 files each. + +**And it is a different mechanism wearing the name.** The shipped type is a +complete implementation of `causaledge64-mailbox-rename-soa-v1.md` §4 — +*"AttentionMask SoA — the session-ephemeral **rename register file**"*: wide +identity (`u32` OGIT domain / `WitnessId` / `StyleId`) → scarce narrow slot +(5-bit G / 6-bit W / 8-bit style), LRU **because slots are scarce**. That is a +COMPRESSION concern. "Attention" there means *which identities are currently +resident in the slot file* — cache occupancy, not where the eye looked. A +residue carrier runs the opposite direction (visited address → recorded), is +keyed by the graph's own address rather than `MailboxId`, and is discardable +whole precisely because nothing is scarce. + +Three properties settle it independently of provenance: keyed by `MailboxId` +(no `NodeGuid`/`NiblePath`/classid anywhere in the file); **not a mask** — +`Vec` with `.iter().find` / `.min_by_key` / `.filter().count`, +i.e. O(n) linear scan per operation, no bitset, no set algebra; and it records +occupancy, never a trajectory (`last_touched_cycle` is overwritten on each +`touch`, so the previous look is gone). + +**Why this one is worse than the three homonyms before it.** §3a separated four +"witness" surfaces, §3k four "nibble" encodings, §3l three "hydration" +meanings — in each, the collision was between things that plainly did +different jobs once named. Here the shipped type is *finished and correct for +its own contract*, so it reads as available. The near-miss is the trap: +"shipped" invited reuse, and reuse would have folded a compression register +file into an attention overlay. + +**Consequence, recorded so D-ACR-1 does not re-derive it:** piece E regrades +from *"shipped; unaudited for this use"* to ***"shipped for a DIFFERENT use; +uncalled; not a basis for piece D."*** §1's six-of-nine count is unchanged — +E existing was never the claim that E fits. `D-ACR-1` starts clean, which is a +better position than a partial fit; and the governing choice rules the shipped +shape out anyway, since a per-entry linear scan is the exact +*"64,000 objects and 64,000 crossings"* shape `lance-graph-java`'s +`Predicate.java` calls catastrophic, not a starting point that optimises into +`Mask × ClassView/WideFieldMask → Mask` compliance. + +**Two dead surfaces measured in passing**, both matching shapes the +falsifiability rule already names: `plasticity_residual: u8` is declared and +initialised to `0` and **never read, never written non-zero** (two grep hits +total) — a field that only holds its zero value carries no information, the +`closed_class_guess` 150/150 shape; and `AttentionMaskMsg::BindReply` carries +three fields to a handler that returns `NoOp`. + +**One superseded plan step, flagged rather than queued:** the originating §4 +specifies a **singleton** actor (*"one global instance per session"*), and +`attention_mask_actor.rs:2` still calls the concrete ractor binding +*"sprint-12+ work"*. Finishing it as written would rebuild the singleton the +V3 mailbox ruling removed (`E-CE64-MB-4`, one-writer-per-mailbox). Treat that +line as superseded, not pending. + +**A measured constraint this hands to D-ACR-1.** Its scope says *"composable +with `WideFieldMask`"*. Measured: `WideFieldMask` positions are `u8` — +universe capped at **256**, with a loud `UniverseExceedsSocCap` refusal above +it; its sibling `FieldMask` is `u64`/`MAX_FIELDS = 64` and **silently drops** +positions `>= 64`. A row population is neither. So "composable" cannot mean +"the same type", and §6 **Y2**'s parked `RowFocusMask × WideFieldMask` basis +collision is not a subtle semantic worry — it is a **cardinality mismatch with +a hard, loud cap on one side**. D-ACR-1 must state its basis and its +composition operator before composing, or it inherits one of two accidents: +loud refusal past 256 (borrowing the wide cap) or silent truncation past 64 +(borrowing the narrow rule). +## 2026-08-21 — E-FROM-V1-DROPS-PROVENANCE-AND-THE-COUNCIL-CAUGHT-THE-CONTRACT-ABOUT-TO-TRUST-IT-1 — three BLOCK(P0)s in one 5+3 run, and the sharpest one falsified the spec's own asymmetry claim against the code it cited + +**Status:** FINDING (D-ACR-7 council, spec ratified as +`.claude/plans/dacr7-band-reading-contract-v1.md`; every claim verified at +source in Phase 4). **Confidence:** High. + +The D-ACR-7 reading contract (which lens wrote CE64 bits 59..63 — +`TrustTexture` vs `CausalTopology` on 59-60, `ReasoningBand` presence on +61-63) went through the full 5+3 council. Three BLOCK(P0)s were raised and all +three survived verification; none was argued away. + +**BLOCK 1 (overclaim, the consequential one): "V3's bytes were never temporal" +is false for populated instances.** `CausalEdgeV3::from_v1(e, target)` +(`edge_v3.rs:117`) has **no provenance parameter** and copies truth/spare as a +raw bit copy (`:138-139`). The reassuring comment above it — "under the v1 +layout every one of these accessors is a documented zero stub" — is a +**compile-time feature condition, not a runtime provenance guarantee**: a CE64 +of v1/unknown provenance (bits 61-63 aliasing `temporal >= 512`) lifted under +a v2 build carries the stale bits into V3 byte 9, and the result is +**indistinguishable from a clean register**. The draft had declared +`EdgeProvenance::V3Register` "always readable" — the exact plausible-wrong- +answer the contract exists to refuse, at its own core. Resolution: +`V3Register` means *"the caller asserts this register was minted clean"*, +never *"V3 registers are clean"*; unstated origin = `Unknown` = refuse; the +`from_v1` provenance drop is filed as a `causal-edge` follow-up, not patched +from the contract side. The v1 trap thus applies to BOTH carriers — on CE64 +directly, on V3 **transitively through the lift**. + +**BLOCK 2 (overclaim): a gate contradicted the fix that preceded it, and +another gate was a tautology.** After the council split the resolver +(total `ClassView::band_reading` lookup / fallible `BandReading::project`), +G5's carried-forward text ("an undeclared one errors") contradicted the total +half — split into G5a (total: zero-fallback, no error) / G5b (fallible: +`Err(UndeclaredClass)` must fire). And G10a ("project is a pure function of +its arguments") fed the same input to the same function twice — the +vacuous-assertion house pattern, deleted. Only G10b survives: compare +`CausalEdge64::truth()` vs `CausalEdgeV3::truth_raw()` on the same edge +post-`from_v1` — which tests the exact bit-copy site BLOCK 1 indicted, is +hosted in `causal-edge` (both crates' zero-dep postures hold — measured: +BOTH refuse the other as a dependency, `causal-edge/Cargo.toml:20-23` +explicitly), and closes a **measured missing test**: `edge_v3.rs`'s module doc +claims truth/spare survive the round trip byte-exact, and no test asserts it. + +**BLOCK 3 (firewall): the consolidation dropped board hygiene entirely.** +Draft v2 contained zero occurrences of any board file — Savant 4 had answered +the hygiene question in full, and Phase-2 consolidation lost the finding. The +loss-prevention phase lost a finding; recorded as such, restored as the spec's +§6′ commitment table. + +**Meta-catch worth keeping:** the same reviewer caught the fix ledger claiming +a citation correction it had not applied ("fixed in §2.5" while §2.5 still +read the old span) — the draft's own "measured, not assumed" standard applied +to the draft. And the council's scope itself was corrected mid-flight by the +operator (CE64 = muscle memory, `CausalEdgeV3` = granularity), a gap **no +savant could have caught** because the v1 spec never mentioned V3 and savants +answer only their question sets — the spec-writing phase is the only place +scope errors can be prevented, which is why Phase 0 is "where the real work +happens." + +Sibling finding folded in rather than given its own id: `TrustTexture` is a +**×4 homonym with three arities** (4/4/5/3 — `causal-edge/layout.rs:141`, +`contract/mul.rs:82`, `planner/mul/trust.rs:30` with `Dissonant` +unrepresentable in 2 bits, `arigraph/orchestrator.rs:114`), against +`TYPE_DUPLICATION_MAP.md:9`'s stale "×2"; lines 9, 16 and 19 of that doc must +change together. + +## 2026-08-21 — E-THE-ATTENTION-ATOM-WAS-ALREADY-SHIPPED-WHAT-WAS-MISSING-WAS-A-COMPOSITION-THAT-IS-NOT-OR-1 — D-ACR-1's basis is a reuse, and the only real gap was that every set operation in the crate is a bitset union + +**Status:** FINDING (D-ACR-1, implemented; 14 new tests green, 1194 contract +tests green, clippy clean). **Confidence:** High — the atom's existence is a +read of `facet.rs`; the container's absence is a stated grep. + +D-ACR-1 was written as *"the one missing primitive"*. Half of that is right, +and the half that is wrong is the more useful half. + +**The atom already existed, exactly.** `contract::facet::FacetCascade` is +`facet_classid(4) | 6×(8:8) = 16 B` with `CascadeShape::G6D2` — literally the +`6 × 2 × u8` shape D-ACR-1 needed, with `index`/`group_of`/`level_of`/`shift` +shipped, `tier_bytes()` ordered coarse-first (`[t0.hi, t0.lo, …]`), and two +existing readings to copy the pattern from (`awareness_facet::SpoFacet`, +`tekamolo_facet::TekamoloFacet(pub FacetCascade)`). **Zero new bytes were +needed and none were added.** Proposing a new 12-byte type here would have been +the "type that already exists" rediscovery tax `CLAUDE.md` §Consult names. + +**What was genuinely absent is narrower and sharper: a composition that is not +a bitset union.** Measured — every `union`/`intersect` in the contract crate is +a bit operation over *field positions*: `FieldMask` (u64, `MAX_FIELDS = 64`), +`WideFieldMask` (u8 positions, capped at 256 with a loud +`UniverseExceedsSocCap`), `StepMask` (u64), `rbac`. **Not one of them composes +addresses.** And a bit-OR of two addresses is not a coarser focus — it is a +*third address neither side ever visited*. That is the defect the container had +to avoid, and it is now a test (`composition_is_not_a_blind_or`: OR-ing +`0b01` and `0b10` yields `0b11`, and the union must NOT contain it). + +**The composition that IS right was already in the canon, one type over.** +`NiblePath::is_ancestor_of` is coarse→fine prefix containment with an +**explicit** depth field. Reusing that rule on the 12-unit ladder gives +`covers`, and reusing its explicit-depth discipline avoids a real trap: +inferring the wildcard boundary from zero bytes would collide with the +zero-fallback ladder, where `0` is a legitimate *dormant tier*, not a +terminator. So `depth` lives OUTSIDE the 12 bytes and the wire shape stays +exactly `6 × 2 × u8`. + +**This is also the answer to ">256 rows".** The `u8` per level bounds *axis +resolution* (256 centroids), never population: one shallow facet is a wildcard +over an unbounded subtree. Measured in a test — a depth-2 focus covers 65,536 +addresses across only the two units varied, and a container holds 1000 distinct +entries where `FieldMask` would stop at 64 and `WideFieldMask` at 256. **The +container does not index rows at all**, which is why neither cap transfers. + +**Content-blindness had to be defended twice in one deliverable.** A first +draft named the axes `Heel/Hip/Twig/Leaf/Family/Identity` — baking the cascade +reading into the low-level type, which is exactly what `FacetCascade`'s own +contract forbids (*"only the CONSUMER projects meaning onto the bytes"*). The +operator caught it while raising a second candidate reading (six **ontology +scopes**: disease/anatomy/process/substance/evidence/context). Both readings +now live only in a test, over byte-identical input, proving the projection is +free — and `FocusAxis` is `Axis0..Axis5`, a position. The general lesson is the +one this arc keeps paying for: **the moment a second plausible reading appears, +any name in the substrate is a premature commitment to the first.** Four +homonym collisions (witness / nibble / hydration / attention-mask) were the +expensive form of this; naming the axes would have been the fifth, minted by +us rather than inherited. + +**Deferred, named rather than silently absent:** `RowFocusMask::difference` +keeps a partially-overlapped entry whole. Subtracting a subtree from a prefix +requires enumerating siblings — inventing addresses the focus never visited — +so splitting waits for a real consumer that needs it. `D-ACR-1`'s scope line +also asks for composability with `WideFieldMask`; per D-ACR-0's measurement +that is a **cardinality mismatch** (positions ≤ 256 vs an unbounded population) +and remains §6 **Y2**'s parked basis collision — this deliverable states its +own basis and does not cross into the other. + +## 2026-08-21 — E-HHTL-IS-MINTED-IN-THE-ARTIFACT-NOBODY-CITES-1 — "zero on every baked row in both production bakes" is precise about the two it names and silent about the third, where the five OBO namespaces are 100% minted + +**Status:** FINDING (measured directly on the pinned `.soa` bytes, SHA-256 +verified against `MedCare-rs/data/config/bakes.tsv`). **Confidence:** High — +every number is a count over 512-byte rows, tiers read at bytes 4..10. + +The board headline (`INTEGRATION_PLANS.md` ARC-B entry) and +`EPIPHANIES.md:899` both state HHTL is **"zero on every baked row in both +production bakes"**, citing `ogar-obo` (68,797 rows) and MedCare's +`join-map.md` (68,797 rows). Both citations are correct. **Both describe the +same artifact set of two.** A third pinned artifact exists: + +| artifact | rows | HHTL != 0 | +|---|---:|---:| +| `obo-core.soa` | 68,797 | **0 (0.00%)** | +| `spine.soa` | 7,641 | **0 (0.00%)** | +| `all-lanes.soa` | 770,360 | **164,031 (21.29%)** | + +Per lane in `all-lanes.soa`: **MONDO `0x0301` 32,095 rows 100% · HPO `0x0302` +19,836 100% · UBERON `0x0303` 14,975 100% · PATO `0x0304` 1,887 100% · +ICD-10-GM `0x030F` 16,905 100% · OMIM `0x0319` 18,712 100% · OPS `0x0311` +98.9% · Orphanet `0x0317` 67.6%**; LOINC / CUI / RxNorm / FMA ~0%. + +**Why this matters and is not a footnote:** the five 100%-minted namespaces are +exactly the ones a DisMech overlay grounds against. The generalized claim +("HHTL is dormant, the gap is mint + read") licenses a session to skip HHTL +entirely; the measured claim says HHTL is available **if a reader names +`all-lanes.soa`** and unavailable **if it names `obo-core.soa`**. So *which +artifact a consumer reads* is a first-class design decision, not a detail — and +a ladder level claiming "+ HHTL topology" must state its artifact or it is +measuring nothing. + +**The generalization error is the transferable part.** Two independent +citations agreeing is evidence about the *rows they counted*, not about the +artifact set. Two sources counting the same 68,797 rows is ONE measurement +reported twice. Before promoting "on every row" from "on these rows", enumerate +the artifacts, not the citations. + +**⊘ CORRECTION 2026-08-21 (same day, operator-prompted) — the entry above +measured ONE of TWO readings.** Operator: *"Obo HHTL ist meines Wissens mit +zipper bereits indirekt hydriert."* Correct. The census above counted the +**cascade tiers** (bytes 4..10); `rails::HhtlMode::of_row` PREFERS the +**RailHead** reading and uses Cascade only as the fallback. Measured on the +Zipper rail registers (`rails.rs:130-147`): MONDO **32,094/32,095**, HPO +**19,835/19,836**, UBERON **14,973/14,975** (plus 8,525 `part_of`, the only +lane with mereology), PATO 1,886/1,887 — median logical-DN depths 6/7/8/5, and +264 rows deep enough to use the continuation slab. So the OBO hierarchy IS +hydrated, indirectly, exactly as stated. `obo-core.soa`/`spine.soa` remain zero +on BOTH readings. New in this correction: cascade and rail are **independent** — +Orphanet (14,063 cascade) and OMIM (18,712) carry **zero** rail DN, so a +prefix-containment consumer silently gets depth 0 there. **The lesson compounds +the entry's own:** it is not enough to enumerate the artifacts — a claim about +a field must also name which READING of it was counted, when the accessor +picks between two registers. Full table: plan §8a ⊘ correction. + +Cross-ref: `.claude/plans/dismech-causality-v3-v1.md` §8a; ARC-B +`docs/architecture/ARC-B-OWNERSHIP-AND-ADDRESSING-REASSESSMENT.md:23` (regraded +in place: its conclusion holds for `obo-core`/`spine`, needs the `all-lanes` +qualifier); `EPIPHANIES.md:899`. + +## 2026-08-21 — E-THE-ORACLE-POPULATION-IS-64-PERCENT-AND-A-GATE-HARDCODES-THE-OTHER-36-1 — a third of the "known intermediates" name no intermediate, and the gate that would have caught it asserts the wrong number + +**Status:** FINDING (measured three independent ways on `/workspace/dismech` +@`557e15436`, 1,968 disorder files). **Confidence:** High — the three methods +agree exactly. + +The DisMech supervision story rests on `INDIRECT_KNOWN_INTERMEDIATES` being a +population where "the source names the mediators, so they can be hidden and +recovery measured" (`E-DISMECH-CORPUS-CENSUS-1`). Measured, **only 2,449 of +3,825 (64.0%) such edges actually name one.** 1,376 (36.0%) carry the label and +an absent or empty mediator list. + +Three methods, agreeing: (a) a line-oriented per-edge walk — **2,449** edges +over **534** disorder files, 3,714 mediator strings; (b) key-occurrence count — +`intermediate_mechanisms:` appears **2,525** times with **0** inline empty +lists, and 2,525 = 2,449 + 74 + 1 + 1, exactly the per-bucket split; +(c) `contract::dismech_evidence.rs:155-176` at the narrower +`pathophysiology[].downstream[]` scope — **1,347 of 3,844 (35.0%)** empty. + +**Consequences.** The held-out corpus is **2,449 edges over 534 diseases**, so +a 20% split is ~490 edges / ~107 diseases, not the 774 a 3,869 denominator +implies. And **74 `INDIRECT_UNKNOWN_INTERMEDIATES` edges DO name mediators** — +a source contradiction the four-label taxonomy does not anticipate; they must +be removed from any restraint control or they will read as hallucinated +closure by the benchmark's own definition. + +**The gate that should have caught this hardcodes the wrong number.** +`MedCare-rs/.claude/plans/dismech-missing-links-v1.md` Gate W1.1 asserts +`known_links.tsv == 3.869` — unsatisfiable on any corpus revision. Its own +instruction is *"stoppen und melden, nicht die Zahl anpassen"*, so this entry +is the report, not an edit. + +**Transferable:** a label that asserts a property and a field that carries it +are two different measurements. Counting the label is not counting the data — +and a supervision corpus sized from the label is oversized by exactly the rows +where the source labelled but did not fill. + +Cross-ref: `.claude/plans/dismech-causality-v3-v1.md` §3a; `E-DISMECH-CORPUS-CENSUS-1`. +## 2026-08-21 — E-V4-IS-THE-100-PERCENT-TIER-V3-UNCHANGED-1 — operator ruling: V4 is a SIBLING for lossless/special-need coverage, not a successor + +**Status:** RULING `[operator]` — explicit in-session decision, verbatim below. +**Confidence:** the ruling is authoritative; the CONSEQUENCES I draw from it are +marked separately and several are open questions, not inferences to act on. + +**The ruling, verbatim (operator, 2026-08-21):** +> *"Meine Auffassung ist, V4 ist für R2IL 100% coverage und andere Special +> needs. V3 wie bisher."* +> ("V4 is for R2IL 100% coverage and other special needs. V3 as before.") + +**What it settles.** V4 is **real and additive** — a sibling tier for workloads +requiring lossless / 100 % coverage, NOT a replacement for V3. **V3 is +explicitly unchanged** ("wie bisher"). The two coexist; V4 serves what V3's +deliberately projective design does not. + +**Storno — this corrects my own entry from earlier today.** +`E-R2IL-VARNODEFACET-IS-A-G3-CARVING-AND-0xC4-WOULD-BIRTH-A-CLASS-INTO-IT-1` +argued the "V4" label "should not be adopted" on three grounds. Regraded, not +deleted: +1. *"reverses the ratified no-V4 verdict"* — **superseded.** The plan's + `:112` verdict ("V3 is sufficient. No V4.") was a session verdict; this is + an operator ruling, and rulings are frozen while verdicts are revisable. + The plan's §22.5 stop condition is now SUPERSEDED, not violated. The plan + text needs the correction appended. +2. *"V4 already denotes the dialectic-engine V4 field-search slice"* — + **STANDS as a hygiene item only**, downgraded from architecture objection. + `E-DIA-V4-FIELD-SEARCH-LOOP-1` is a plan V-slice ordinal in a different + subsystem; the two are contextually separable but a future session grepping + "V4" will hit both. Disambiguation owed (suggest: "V4 tier" vs "V4 slice"). +3. *"implies V3-superseded"* — **WRONG, and the ruling says so directly.** + "V3 wie bisher" is the explicit denial. This was my strongest objection and + it was the one built on an assumption the operator did not share. + +**Consequence for the G3 carving question — the frame changes, and this is the +part worth reading twice.** §3a's *"new classes MUST NOT be born into G1–G3"* +is a **V3** rule. If R2IL is a V4 tenant, §3a does not govern it, and the whole +carving question I posed — re-carve / named-exception / defer — was posed +inside the wrong frame. `VarnodeFacet`'s 3×32 density is then not a V3 +violation needing an exception; it is **the reason R2IL is V4 in the first +place**. [MY INFERENCE, not the operator's words — flagged as such.] + +**Consequence for `E-ADDRESS-FROM-THE-THING-NOT-THE-ACCIDENT-1` — its own +falsifier is PARTIALLY triggered.** That entry pre-registered: *"if a gate is +legitimately cleared by a fix that leaves the address derived from layout … +this entry is scoped down to the other instance."* The ruling does not say +"G3 is correct for R2IL" — it relocates R2IL to a tier whose carving discipline +is not yet stated. So the spatial instance is **suspended, not refuted**, +pending V4's actual layout. The temporal instance (F-ORD) is untouched and +still stands on its own measurement. Scoping down now would be premature; +scoping down later may be correct. + +**What the ruling does NOT say — open, do not invent answers:** +- **V4's layout.** Facet width, carving discipline, whether rails apply at all, + whether the 512-byte row stride is reused. Unknown. +- **Where V4 lives.** Contract crate? Separate module? A ClassView read-mode? + Unknown. +- **What "andere Special needs" enumerates.** R2IL is one named tenant; the + set is open. +- **How a reader routes V3 vs V4.** By classid? By domain byte (0xC4 is + already the R2IL destination)? By an explicit tier discriminator? Unknown — + and this is the question that most affects whether existing readers break. +- **Whether the `0xC4` mint is a V3 mint or a V4 mint.** Given the ruling, it + is presumably V4 — but the domain enum lives in the V3-shaped + `ogar_codebook` mirror, so the interaction needs stating. + +**Cross-refs:** the two entries this corrects/suspends (both 2026-08-21), +`le-contract.md` §3 (L1–L8) + §3a (G1–G3), ruff plan +`r2il-behavioral-ir-v1.md` `:112` + §22.5 (both now superseded, correction +owed in-repo), `ogar_codebook.rs:112-117` (0xC4 BinaryLifting), +`E-DIA-V4-FIELD-SEARCH-LOOP-1` (the name collision), +`E-V3-FACET-4-PLUS-12` (the V3 lock that stays untouched). + +**⊘ STORNO 2026-08-21 (operator correction, same day) — objection 2 above is +RETRACTED; there is no name collision and no disambiguation is owed.** +`dialectic-engine-v1.md`'s `V0…V5` are **integration-plan STEPS, like its own +`S1…S11`** — §4 is literally headed "Build order", and `V4` there is one stage +("the 64k SIMT lowering … only after V0–V3 green at small scale"), the fifth of +six. A step ordinal and a substrate tier are not two meanings of one label +competing for a namespace; they are two independent counters that never address +the same kind of thing. `E-DIA-V4-FIELD-SEARCH-LOOP-1` inherits the STEP +meaning — it names a finding from that stage — so it was never evidence of a +tier collision either. **Nothing should be renamed**, and a future session must +not read line 30's "disambiguation owed" as a live item; acting on it would +rewrite a correct plan to resolve a conflict that does not exist. What this +leaves: all three of my objections to the V4 label are now retracted, two as +superseded by the ruling and this one as simply mistaken about what the source +document says. The G3 reframing (below) and the five open questions are +unaffected — they never rested on this point. + +## 2026-08-21 — E-ADDRESS-FROM-THE-THING-NOT-THE-ACCIDENT-1 — the two blocked gates are one failure on two axes + +**Status:** SYNTHESIS / CONJECTURE — my cross-reading of two independently +authored, independently measured docs. **Not an operator ruling and not a new +rule**; both constituent findings are separately graded FINDING and stand on +their own if this framing is rejected. **Confidence:** the two instances are +High (source-read, measured); the UNIFICATION is Medium — it is a lens, and +its value is that it makes one test serve two gates. + +**The one sentence.** *An address must be derived from what the thing IS, +never from the accident of how it was laid out or when it showed up.* + +**Two gates are currently blocked, in two different repos, by two different +sessions, and they are the same failure rotated 90°:** + +| | SPATIAL — the carving | TEMPORAL — the landing | +|---|---|---| +| where | ruff `VarnodeFacet` / PR3 `0xC4` mint | lance-graph-java GridLake / F-ORD | +| the accident | a **flat contiguous register** (3×32, G3) — no byte axis, so no rail exists to address it by | a key **minted from completion order** (`collect_casts` mints `stream_position`) — so identity encodes *when*, not *what* | +| the symptom | ClassView cannot project rails; `group_of` is not a shift; saturates silently with no cascade spill | same work, two runs, two publication identities — measured hashes 2604999916736672513 vs 4858955943411201665 | +| the doc's own exit | "**cosine-replacement** palette256 (L4)" — content-derived addressing (`le-contract.md` §3a) | "**identity-derived** or otherwise deterministic" — required property #1 (correction spec §12) | + +**The tell that this is convergence, not my imposition:** the two docs were +written by different sessions for different subsystems and neither cites the +other, yet both name their exit with the same word-family — *cosine-**replacement*** +(derive the address from content) and *identity-**derived*** (derive the key +from identity). Nobody coordinated that. + +**The test, usable at either gate, in one question:** +> If I re-ran this with the bytes laid out differently, or the workers +> finishing in a different order, would the address change? +> +> **Yes → the address is coming from the accident.** No → it comes from the +> thing. + +**What this does NOT license.** It does not decide either gate. Specifically: +(a) it does not say `VarnodeFacet` must re-carve — a varnode genuinely needs +64 bits of offset plus a size, `6×(8:8)` cannot hold that, and the +`identity_quad` G2 precedent (`E-IDENTITY-QUAD-4X24-RATIFIED-PERMANENT-1`) +exists precisely so a permanent honest wide resident can be **named** rather +than hidden; (b) it does not prescribe F-ORD's fix mechanism, which A2/A3 +deliberately left unprescribed (four candidates, per-workload). The lens +sharpens the question; the operator still answers it. + +**Falsifier — what would retire this entry.** If a gate is legitimately +cleared by a fix that leaves the address derived from layout or schedule (e.g. +an operator ruling that a G3 carving is permanently correct for R2IL *because* +of its density, or an F-ORD resolution that canonicalises arrival order as +semantically meaningful), then the "accident" framing is wrong for that +instance and this entry is scoped down to the other one — or dropped. Two +instances is a pattern, not a law; a third independent instance would raise +confidence, a counter-example would end it. + +**Cross-refs:** `E-R2IL-VARNODEFACET-IS-A-G3-CARVING-AND-0xC4-WOULD-BIRTH-A-CLASS-INTO-IT-1` +(the spatial instance, same day), `le-contract.md` §3a G1–G3 + the L4 exit, +`E-IDENTITY-QUAD-4X24-RATIFIED-PERMANENT-1` (the named-exception precedent), +lance-graph-java `.claude/plans/mask-native-navigation-correction-v1.md` §12 +(F-ORD/F-LAND split, the five frozen landing-key properties) + the Lotus +F-ORD defect pin, `ogar_codebook.rs:112-117` (the 0xC4 destination). + +## 2026-08-21 — E-ABBREVIATION-GREP-MANUFACTURED-AN-ABSENCE-1 — I reported a shipped 15-module subsystem as non-existent because `fn .*ppr` matches `approx`, and a `head` limit hid the real hits + +**Status:** FINDING (self-inflicted, caught by the operator pointing at +`E-ARIGRAPH-IS-AN-ISLAND`). **Confidence:** High — the mechanism is +reproducible in one line. + +**What I claimed, in a deliverable handed to the operator:** *"the assumption +is stale — no `ppr`, `personalized_page*`, `bm25`, `rrf`, or `community` +function exists in the workspace… AriGraph appears only as narrative in doc +comments."* + +**What is actually there:** `crates/lance-graph/src/graph/arigraph/` — **15 +modules, ~327 KB** — `ppr.rs` (`PersonalizedPageRank`, +`personalized_pagerank()`), `bm25.rs` (`Bm25Index::{build,score,rank}`), +`rrf.rs` (`reciprocal_rank_fusion()`), `community.rs` (`Communities`), +`markov_soa.rs`, `episodic.rs` (`EpisodicBasins`), `witness_corpus.rs`, +`retrieval.rs`, `triplet_graph.rs`, `orchestrator.rs`, and five more, all +re-exported from `mod.rs`. + +**The mechanism, in two compounding parts.** + +1. **The abbreviation collided with a common word.** My pattern was + `fn .*ppr\|fn .*bm25\|fn .*rrf\|fn .*community`. `"ppr" in "approx"` is + **`True`** — `a-p-p-r-o-x`. Every `fn approx(a, b, tol)` test helper in + `jc`, `holograph`, and `sigker` matched. The real functions matched + *nothing*, because they are spelled out — `personalized_pagerank`, + `reciprocal_rank_fusion` — and `bm25` lives in the TYPE name, not the + function name. +2. **`head -20` then converted noise into a false negative.** `community.rs` + genuinely had 5 matching lines. They were pushed off the end of the output + by the `approx` flood. I read "nothing relevant in the first 20 lines" as + "absent." + +Neither part is sufficient alone: a noisy pattern with full output would have +shown the real hits; a clean pattern with a `head` limit would have found them +first. **A pattern with a high false-positive rate and an output limit are +individually survivable and jointly a lie.** + +**The rule.** *Searching for a function's NAME is not searching for a +CAPABILITY.* Before reporting a subsystem absent, search the **filesystem** for +it — `find . -path "*arigraph*"` would have ended this in one call, needed no +guess about spelling, and cost less than the grep did. Names encode an author's +abbreviation preference; directories encode the subsystem. Corollaries: + +- An abbreviation of ≤4 characters is a **substring**, not a token. Check it + against ordinary vocabulary before trusting it (`ppr`⊂`approx`, + `rrf`, `cam`⊂`camera`, `ppr`⊂`suppress`). +- **Never conclude absence from a limited-output search.** Absence is a claim + about the whole set; a `head` reads a prefix of it. Re-run with a `-c` count + or no limit before writing "does not exist". +- **Absence and unwiring have opposite remedies.** Absent ⇒ build the organs. + Unwired ⇒ build nothing, close the seam. I recommended the expensive one. + +**This is the second instance of a named class.** The board already carries +*"a false negative manufactured by the intake"* (the sorted-histogram gate that +discarded which cell mapped to which offset, codex P1 on #876). Same class, +different mechanism: there the intake destroyed structure before comparison; +here the intake's own noise outran the output window. Two instances with +disjoint mechanisms make it a pattern rather than an anecdote: **the intake is +part of the measurement, and it fails silently in whichever direction nobody +checked.** + +**What the correct answer would have been**, and it was already on this board +under `E-ARIGRAPH-IS-AN-ISLAND`: every AriGraph module exists and tests green; +the chain is open at the joints; `HotWitness` is `todo!()`; +`Ee→EW64(hot)+WitnessCorpus(cold)` is the unwired task. *"The most expensive +kind of gap: invisible in green suites (every crate passes; the system doesn't +do the thing) because the integrating seam was never built."* I cited that +entry as prior art for a different claim **without reading it** — and it +contained the correction to the claim I was making in the same breath. + +## 2026-08-21 — E-ACADEMIC-CARVE-UNDERFILLS-ROWS-ARE-NOT-WORDS-1 — 20,845 COCA rows are 18,559 distinct words, so the 80×256 academic carve fills 90.6% and basins 73..79 are empty + +**Status:** FINDING (measured on the committed +`crates/deepnsm/word_frequency/academic_20k.csv`, produced while building the +deepnsm-v2 academic codebook for S3). **Confidence:** High — a count over a +committed file, reproducible with `csv.DictReader` and a `set`. + +**The falsified claim** is in `plans/causal-rung-standing-wave-v1.md:465`: + +> **Vocabulary 4096 → 20k academic:** **fits** the palette256² pair carve +> NATIVELY — 20480 = 80×256, `(basin, identity) = (id>>8, id&0xFF)` + +It does not fit. It under-fills. + +| | measured | +|---|---| +| rows in `academic_20k.csv` | 20,845 | +| **distinct surface forms** | **18,559** | +| duplicate rows (same word, different `Pos`) | **2,286 (11.0%)** | +| `PaletteVocab::ACADEMIC_20K` reserved slots | 20,480 | +| **carve fill** | **18,559 / 20,480 = 90.6%** | +| last id 18,558 lands at | basin **72**, slot 126 | +| **empty basins** | **73..79 (7 of 80)** | + +**The inference that produced the error is arithmetic on the wrong noun.** +`plans/deepnsm-morton-comma-facet-v1.md:140` records "20,845 rows" and calls +them "the 20k most-frequent COCA-Academic words". 20,845 > 20,480, so the carve +looks like it fits with 365 to spare. But `PaletteVocab::from_frequency_ranked` +admits by **surface form**, deduplicating (`duplicates_keep_first_id` is its own +pinned test), and COCA lists a word once per part of speech. The same plan file +even notes the multiplicity two paragraphs later — *"The `Pos='v'` rows in +`academic_20k.csv` (thousands of verbs)"* — without drawing the consequence for +the carve. **The fact was present, the subtraction was not.** + +**Why no test caught it, and this is the reusable half.** The crate's own +`academic_20k_carve_spans_80_basins` asserts exactly the property that fails on +real data — `pair("w20479") == Some((79, 255))`, i.e. basin 79 is reached — and +it passes, because its fixture is `(0..20480).map(|i| format!("w{i}"))`: +**20,480 synthetic words that are all-distinct by construction.** The real +input is 11% duplicates. A dedupe-sensitive property was tested on a +duplicate-free fixture, so the test could only ever confirm the arithmetic it +was written from. + +This is the fixture-shape failure this board already carries in other clothes +(a single-band fixture cannot see a multi-band defect; a justified page cannot +exercise the ragged branch). Stated for this class: **when the code under test +deduplicates, filters, or otherwise reduces its input, a fixture with nothing to +reduce measures the reservation, not the fill.** The falsifier is one line — +give the fixture a duplicate and assert the admitted count drops. + +**What is NOT claimed.** 90.6% fill is not by itself a defect: `RESERVE, DON'T +RECLAIM` is canon, and a partially-filled carve with `(basin, slot) = (id>>8, +id&0xFF)` is correct, addressable, and stable. Nothing needs to move. What must +change is the **claim**: the carve is under-filled by 1,921 slots, seven basins +are empty, and any design that assumed basin 79 is populated — or that reads +basin occupancy as a frequency signal — is reasoning from a number the data +never supported. Whether to fill the tail (a larger COCA slice, or admitting +`(word, Pos)` pairs rather than surface forms) is a deliberate decision with a +semantic cost either way, not a gap to be quietly padded. + +> **⊕ CORRECTED SAME-DAY (2026-08-21, codex P1 on #975 + the operator's +> "wieso pyyaml — hattest du nicht für dismech-rs schon was für Rust +> gebaut").** The counts above came from a throwaway Python line-scanner and +> were **wrong**. Codex caught it structurally without needing the corpus: +> the module documents `pathophysiology[].downstream[]` as a SUBSET with +> **2,497** mediator-bearing edges, and I had written **2,489** corpus-wide — +> *a subset cannot exceed the whole*. Re-measured with the parser that +> already existed (`dismech_oracle_census`, dismech-rs, over +> `graph::build_causal_graph`), cross-checked against an independent pyyaml +> structural parse — identical on every figure: +> +> | quantity | line-scan (wrong) | structural (authoritative) | +> |---|---:|---:| +> | label-KNOWN with ≥1 mediator | 2,489 | **2,512** (63.1%) | +> | label-KNOWN naming nothing | 1,489 (37.4%) | **1,466** (36.9%) | +> | distinct mediator strings | 3,048 | **3,095** | +> | exact node references | 45 (1.5%) | **45** (1.5%) — unchanged | +> | groundable by label alone | 59.4% | **59.3%** (1,834) | +> | ungrounded prose | 40.6% | **40.7%** (1,261) | +> | oracle diseases | not measured | **549** | +> | `UNKNOWN_INT` that DO name mediators | **missed entirely** | **92** | +> +> There is no contradiction once the number is right: 2,512 corpus-wide vs +> 2,497 in the downstream subset, the 15 sitting in `influences_mechanisms` +> (115) and `sequelae` (19). **Every qualitative claim survives** — the +> mediators are prose, the oracle is ~⅔ of the label-KNOWN set, the +> label-only edges need a third bucket. The magnitudes moved by <1%. +> +> **Two lessons, and the second is the expensive one.** (1) A line-oriented +> YAML walk is a parser you did not write and cannot test; it fails silently +> on shapes you did not imagine. (2) **The repository already had the +> structural parser** — `model::parse_disorder_raw` is serde_yaml over a +> committed type and `graph::build_causal_graph` already carries +> `intermediate_mechanisms: Vec` on the edge. The right answer was +> one `cargo run` away, is sub-second against pyyaml's two minutes, and is +> now committed and re-runnable instead of living in a `/tmp` script. *A +> measurement a committed parser can make must not be made by an ad-hoc +> script.* This is the same family as +> `E-ABBREVIATION-GREP-MANUFACTURED-AN-ABSENCE-1` two entries up — reaching +> for an improvised tool over the one the repo already ships — twice in one +> session, which makes it the session's dominant failure mode rather than an +> incident. +> +> **A third finding neither pass had:** 92 `INDIRECT_UNKNOWN_INTERMEDIATES` +> edges DO name mediators. The source contradicts its own label. They are +> neither oracle nor restraint control, and left in the control they read as +> hallucinated closure by the benchmark's own definition. + +**Artifact.** The derived codebook was uploaded round-trip-verified to S3 at +`lance-graph/codebooks/deepnsm-v2-academic-coca-v1/` (TSV + source CSV + +manifest), with the shortfall stated in the file's own header so a consumer +cannot pin it without reading it. It reports 18,559 entries; it does not pad. + +## 2026-08-21 — E-DISMECH-KNOWN-INTERMEDIATES-ARE-PROSE-NOT-IDENTITIES-1 — the 3,978-edge "ORACLE population" is 2,489 edges, and its mediators are 5-word prose, not node references + +**Status:** FINDING (measured on upstream `monarch-initiative/dismech`, the same +2,100-file ephemeral `/tmp` corpus as `E-DISMECH-CORPUS-CENSUS-1`). +**Confidence:** High — every number is a count, and the first count was WRONG +in a way worth recording (below). + +**This CORRECTS one sentence of `E-DISMECH-CORPUS-CENSUS-1`** (append-only: that +entry is not edited). Its census is right and stands — 9,073 / 4,539 / 3,978 / +408, total 17,998. What it also said is this: + +> `IndirectKnownIntermediates` (3,978) is the ORACLE population — **the source +> names the mediators, so they can be hidden and recovery measured.** + +The source mostly does not name them, and where it does, they are not +identities. + +| | measured | +|---|---| +| `INDIRECT_KNOWN_INTERMEDIATES` edges | 3,978 | +| ...carrying >=1 named intermediate | **2,489** | +| ...with **no** `intermediate_mechanisms` key at all | **1,489 (37.4%)** | +| total intermediate strings | 3,424 (distinct 3,048) | +| strings per edge | mean 1.38, max 4 | +| **strings that are an exact node reference** | **45 / 3,048 (1.5%)** | +| string length | median 4 words, mean 5.2, max 39 | + +A representative mediator: *"Classical-pathway inhibition yields serum +resistance, permitting spirochete survival during hematogenous dissemination."* +That is a sentence, not an address into the 48,467 distinct mechanism/target +names the corpus carries. + +**Three consequences, in decreasing obviousness.** + +1. **The oracle population is 2,489, not 3,978** — a 37.4% overstatement. The + 1,489 key-less edges are `KNOWN_INTERMEDIATES` **in label only**: the authors + asserted mediators exist and did not write them down. They are neither + oracle nor restraint control. Scored as positives they are unrecoverable and + depress every metric; scored as negatives they punish a correct answer. They + need a **third bucket**, or they poison the gold set. (This is the standing + iron falsifier *"unknown intermediates are treated as negative examples"*, + reached from an unexpected direction — via the KNOWN label, not the unknown + one.) + +2. **`Recall@k` over a mediator-identity candidate list has nothing to score + against.** At 1.5% exact reference there is no identity-typed gold. A gold + set must be MADE, and the making must not leak: grounding the 3,048 prose + strings by **label matching alone** shares no machinery with DeepNSM or + AriGraph, so it cannot launder the answer into the evaluation. Measured + headroom against the 48,467 names: exact (normalized) 204 (6.7%), a corpus + name is a substring 1,190 (39.0%), token-Jaccard >= 0.5 415 (13.6%) — + **1,809 groundable (59.4%), 1,239 ungrounded prose (40.6%)**. ~1,800 gold + mediators over ~2,489 supervised edges is enough to separate ablation + levels. **The 40.6% residue must be reported, not dropped** — dropping it + silently inflates every Recall@k, which is the vacuous-fence pattern this + board already carries under a different name. + +3. **`DismechTopology::source_knows_intermediates()` is correctly implemented + and its second doc sentence is not.** The function answers *"does the source + CLAIM to know"*, which is a question about the label and is exactly right. + Its doc then says *"This is what separates the oracle population from the + restraint control"* — and that is the falsified claim, because the + label-KNOWN population is not the oracle population. `LATEST_STATE.md` + carries the same overstatement ("the 3,978-edge ORACLE population"). **No + bits move and no API changes**; the correction is to the claim, and the + consumer that builds the oracle set must additionally require a non-empty + `intermediate_mechanisms`, which the contract crate cannot see because it is + deliberately source-side only. + +**A free by-product, needing no grounding at all:** predicting the 4-way +`CausalTopology` of a masked edge is a benchmark over all **17,998** labelled +examples with a stated majority-class prior of 50.4% (DIRECT). It can run +before any grounding lands and calibrate the harness — which is worth having +precisely because the identity benchmark now needs a build step first. + +**The method note, which generalizes past DisMech.** The first run of this +measurement returned *"4 of 3,978 carry a named intermediate"* and I nearly +recorded that. It was false: YAML block-list items sit at the SAME indent as +their key, and the sibling-scan broke on `indent <= key_indent`, so it stepped +off the list before reading a single item. The tell was the shape of the +result — a 0.1% rate on a field the corpus populates 2,489 times is not a +finding, it is a parser that missed. **A count that collapses to near-zero on a +field the schema clearly uses is a claim about the reader, not the corpus** — +the same rule this board already states for null probe results, applied to +counting rather than to timing. Reading three raw blocks cost thirty seconds +and moved the answer by a factor of 622. +## 2026-08-21 — E-R2IL-VARNODEFACET-IS-A-G3-CARVING-AND-0xC4-WOULD-BIRTH-A-CLASS-INTO-IT-1 + +**Status:** FINDING (measured at file:line this session, after rebasing +`claude/ruff-r2il-lancegraph-3tdt8d` onto `main` @ `8a93423`). +**Confidence:** High for the layout arithmetic and the §3a rule text (both +read from source); the CONSEQUENCE is a gate question for PR3, deliberately +not pre-decided here. + +**The finding.** `ruff_r2il::facet::VarnodeFacet` (`facet.rs:36-48`) carves its +16 bytes as `classid: u32` + `offset_lo: u32` + `offset_hi: u32` + `size: u32`. +The 12-byte payload is therefore **3 × 32-bit contiguous = exactly `le-contract.md` +§3a's G3 "wide-quad"** (`:82`, `96 ✓`) — the axis-LESS grace carving, not the +axis-grouped `3×(8:8:8:8)` L6/`CascadeShape::G3D4` shape. It carries no rail: +there is no `X:Y` byte pair anywhere in it. + +Today this is invisible and legal: `PROVISIONAL_R2IL_VARNODE = 0x0000` +(`facet.rs:21`) puts every varnode in the **default class** — the CANON +zero-fallback ladder's "no prefix routing (dormant)" state, which is not a +minted class at all. + +**Why the mint changes its status.** `lance_graph_contract::ogar_codebook` +already names the destination in source (`ogar_codebook.rs:112-117`): *"`0xC4XX` +— Binary lifting … the R2IL container concepts mint here in the ruff PR3 arc, +**replacing `PROVISIONAL_R2IL_VARNODE = 0x0000`**"*. The moment that mint lands, +the facet stops being the dormant default and becomes a **real, addressed class +whose payload is G3** — and §3a is explicit (`le-contract.md:104`): *"New classes +MUST NOT be born into G1–G3; the waiting room is not a destination."* + +So PR3 as currently specified would, without a deliberate decision, do the one +thing §3a names. Three legible resolutions, none prescribed here: +(a) re-carve the payload onto a rail shape before minting (e.g. the L4 +`6×(u8:u8)` reading, which would make space/offset/size rail-addressable); +(b) mint and take a **named ratified exception**, the way +`ISS-IDENTITY-QUAD-WIDE-CARVING-HOME` did for `identity_quad` in G2 (operator, +2026-08-17) — that precedent exists precisely for a permanent, honest resident; +(c) keep `0x0000` and defer the mint until the carving question is settled. +The honest-cost accounting §3a already demands applies either way: a 64-bit +varnode offset genuinely needs 64 bits, so (a) is a real design question about +whether offset belongs in the facet at all, not a mechanical re-slice. + +**Two things this session checked that are NOT defects, recorded so they are +not re-investigated:** + +1. **The ruff SPO intake arms do not use the R2IL/r2sleigh format — correctly.** + `ruff_{cpp,csharp,python,ruby,sqlalchemy}_spo` depend on `ruff_spo_triplet` + only; none depends on `r2il`/`r2ssa`/`ruff_r2il`. That is the plan's two-arm + split (`ruff/.claude/plans/r2il-behavioral-ir-v1.md:320`): structural + (AST → `ModelGraph` → `expand()` → `Vec`) beside behavioral + (machine code → R2IL/SSA), converging only at OGAR/ClassView. Feeding R2IL + into an AST harvest would be the "backdoor opcode vocabulary" the plan + forbids at `:335`. Consistent with this board's own line 9347. +2. **`ruff_spo_address` having zero in-ruff dependents is not dead code.** It is + consumed CROSS-REPO by OGAR `ogar-from-ruff` (`Cargo.toml:35`, a git dep on + ruff `main`; `mint.rs:35` imports `{Facet, Mint, mint_with_classid}`). The + in-ruff dependent count is the wrong measurement for a producer crate. + +**Correction of this session's own prior statement (storno).** Earlier this +session I reported PR3's home as an OPEN question — "slot in `ogar_codebook` +versus a new `ogar-r2il` crate, your call" — and leaned slot. That was wrong on +the facts available: the decision was already made and landed. `BinaryLifting` +(`0xC4`) is in the mirrored `ConceptDomain` enum on both sides, is pinned by +`reserved_empty_domains_agree_across_the_mirror`, and +`E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1` (2026-08-18) already states *"the +R2IL container-concept mints under 0xC4 arrive with the ruff arc's PR3 and will +rebase trivially on this."* No `ogar-r2il` crate was ever proposed anywhere +(zero hits across `ruff/` and `OGAR/`). **The lesson is the process one:** the +finding was reachable only by reading the board AFTER the rebase — I formed a +conclusion from the ruff tree alone and presented a settled decision as open. +Rebase, then read EPIPHANIES/plans, THEN conclude. + +**⚠ NAMING — a sibling session is calling `ruff_r2il` "V4"; the INSIGHT is +right and the LABEL is wrong, and they must not be collapsed into each other.** +Reported mid-session: *"another session called `ruff_r2il` V4, just because the +IR format is way denser from the perspective of a compiler substrate."* The +density observation is **correct and is the same fact as this entry's finding** +— R2IL's address space genuinely is denser than a rail shape can express (a +varnode needs a 64-bit offset plus a size; `6×(u8:u8)` cannot hold that), which +is exactly WHY `VarnodeFacet` ended up carved as G3. Two sessions reached one +fact from opposite sides. Preserve that. + +The LABEL collides three ways and should not be adopted: + +1. **It reverses a ratified verdict without falsifying it.** The r2il plan's own + `:112` reads *"Verdict: V3 is sufficient. **No V4.** The hypothesis stands + un-falsified"*, restated as stop condition §22.5 (`:397`, "no V4; variable + arity already routed upstream"). Nothing measured since has falsified it — + PR2's oracle went the other way, reconstructing 35,946 op sites with zero + mismatches *through V3 routes*. A version bump needs a falsifier, not a + density impression. +2. **"V4" already denotes something else here.** `E-DIA-V4-FIELD-SEARCH-LOOP-1` + (2026-07-23) is the dialectic-engine's **V4 foveated field-search slice** — a + plan V-slice number in `dialectic-engine-v1.md`, an unrelated subsystem. A + second meaning on the same token divides the search surface for every future + session, which is the duplicate-id failure this board already fights. +3. **It implies V3-superseded, which no ruling supports.** V3 is a LAYOUT canon + (4+12 content-blind facet, 512-byte row, classid canon-high). Density is not + a property of the canon; it is a property of ONE CLASS's carving choice + *inside* it. That is precisely what §3a's G-carvings and the `identity_quad` + named exception exist to express. + +**The honest reframing:** R2IL is not a new substrate version — it is a **dense +class whose carving question is open** (the three options above). If the density +is genuinely permanent and irreducible, the sanctioned vocabulary for saying so +is a **named ratified G3 exception** in the `ISS-IDENTITY-QUAD-WIDE-CARVING-HOME` +mould, not a version number. Route the disagreement to the operator as a carving +ruling; do not let either session settle it by naming. + +**Cross-refs:** `le-contract.md` §3a (G1–G3 + the `identity_quad` named +exception), `E-IDENTITY-QUAD-4X24-RATIFIED-PERMANENT-1` (the exception +precedent), `E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1` (the 0xC4 sync), +`E-V3-FACET-4-PLUS-12`, `ogar_codebook.rs:112-117`, ruff +`crates/ruff_r2il/src/facet.rs:21,36-48`, ruff plan `r2il-behavioral-ir-v1.md` +PR3 + O5. + +## 2026-08-20 — E-DISMECH-CORPUS-CENSUS-1 — the DisMech corpus measured: 87.2 MB of strings, of which the entire causal semantics is bits + codebook ordinals + +**Status:** FINDING (measured on upstream `monarch-initiative/dismech`, 2,100 +disorder files, fetched ephemeral to `/tmp` — never committed, per the +`/tmp`-fixture rule). **Confidence:** High — every number is a count. + +**Total string bytes across all properties: 87,222,222.** The top ~27 +properties by volume are free text (descriptions / snippets / explanations / +reference titles). Everything that carries CAUSAL SEMANTICS is tiny. + +**`causal_link_type` is EXACTLY the four `CausalTopology` states** — measured, +not assumed, so the CE64 bits 59+60 mapping is source-authoritative and needs +no inference from confidence, edge count, or predicate name: + +| state | count | +|---|---| +| DIRECT | 9,073 | +| INDIRECT_UNKNOWN_INTERMEDIATES | 4,539 | +| INDIRECT_KNOWN_INTERMEDIATES | 3,978 | +| UNKNOWN | 408 | +| **total causal edges** | **17,998** | + +**The two experimental populations this hands us (better than hiding paths):** +`IndirectKnownIntermediates` (3,978) is the ORACLE population — the source +names the mediators, so they can be hidden and recovery measured. +`IndirectUnknownIntermediates` (4,539) is the RESTRAINT CONTROL — the source +itself does not know, so a reasoner that "recovers" a mediator there is +hallucinating closure. Success is therefore two-sided: recovery sensitivity +AND epistemic restraint. + +**Every evidence enum is bits:** `supports` 4 (2 b), `evidence_source` 5 (3 b), +`modifier` 7 (3 b), `frequency` 19 (5 b), `treatment_effect` 5, +`genetic[].relationship_type` 10, `prevalence[].measure_type` 8. +⚠ `phenotypes[].category` is **261 distinct — OVER the 255 `Codebook` cap**, +and its top values include both `Neurologic` AND `Neurological`: lexical noise +inside an "enum". It needs normalization or a deliberate split, never a silent +widening (`Codebook::intern` returning `None` IS the split signal). + +**Bibliography — LLM-generated, so identity must not be the title.** 131,904 +reference-title occurrences over 31,361 distinct (4.21x reuse); 12,124,736 B +inline -> 3,051,438 B deduped (74.8% saved); with a u32 key per occurrence, +3,579,054 B total = 3.4x smaller. A stable key ALREADY exists on ~104,700 +occurrences: PMID (dominant), DOI, ORPHA, CGGV, ClinicalTrials, URL. So the +key is `(namespace, id)` — never a hash of the title, because wording drifts +between regenerations while the citation does not. + +**"MONDO-derived" applies to the DISORDERS, not the EDGE ENDPOINTS.** Measured +prefix distribution over edge endpoints: no prefix at all **25.2%**, HP 24.9%, +GO 11.6%, NCIT 10.5%, hgnc 7.6%, CL 7.3%, **MONDO only 4.4%**, UBERON 3.3%, +CHEBI 3.1%, NCBITaxon/ECTO/RO 2.0%. OBO_CORE's five namespaces cover **32.7%**. +This is the single largest correction to the DisMech-overlay plan: grounding +cannot lean on MONDO. + +**Deterministic resolution ladder — no LLM used.** Phenotypes carry NO CURIE at +all (25,120 entries, 0.0%), so the mapping must be MADE. Against the real +HP/MONDO/UBERON/PATO labels: + +| population | exact | +case/punct | +singular | RESOLVED | unresolved | +|---|---|---|---|---|---| +| phenotype labels (25,120) | 55.3% | 23.2% | 2.1% | **80.7%** | 19.3% (3,647 distinct) | +| unprefixed endpoints (30,872) | 25.6% | 9.9% | 0.9% | **36.4%** | 63.6% (11,385 distinct) | + +**The unresolved tails are three DIFFERENT kinds, not one backlog:** +(a) provenance leaking into the endpoint slot — `Orphanet` (120), `OMIM` (32), +`ClinGen` (23) are database names, not concepts; (b) qualified mechanism +PROPOSITIONS — `Impaired Terminal Electron Transfer and ATP Synthesis` (24), +`Impaired Neurodevelopment` (20) — genuinely DisMech-local, and must not be +bullied into an ontology node; (c) lexical variants of real concepts. Note +`Sensorineural Hearing Loss` and `Sensorineural hearing loss` BOTH fail, so +they are a SYNONYM miss (HPO's own label is "Sensorineural hearing +impairment"), not a case miss — the next deterministic rung is the synonym +table, before any model is invoked. + +**⚠ PHENOTYPES NEED THEIR OWN RESOLUTION DOMAIN (operator, confirmed by +measurement).** Collapsing HP with MONDO does not merely strip edges — it +MISROUTES them, which is harder to detect. Measured: **1,169 labels exist in +more than one namespace, 1,129 of them HP+MONDO**. Of 19,738 resolved +phenotype labels, **26.2% landed in MONDO rather than HP**, and **23.7% +(4,678) are genuinely ambiguous** — a collapsed resolver picks by insertion +order, silently reattaching a phenotype edge to a same-named disease node. +HP must be scoped FIRST, with any cross-namespace fallback deliberate. + +**UBERON is the capstone, measurably:** 10 collisions across 14,975 UBERON +labels = **0.07%**. Anatomy is near-collision-free exactly where phenotype and +disease are not, so it is the one layer safe to anchor against. + +> **⊘ ARCHITECTURAL CONCLUSION CORRECTED (2026-08-20, same day, measured).** +> **The MEASUREMENTS above stand unchanged** — 1,169 multi-namespace labels, +> 26.2% mis-landing, 23.7% ambiguous, UBERON at 0.07%. What is corrected is +> the word **"OWN"**: the sanctioned abstraction already exists and this entry +> did not know it. +> +> `medcare-cohorts/src/quad_tenant.rs` ships `Domain` (8 variants) with a +> classid→domain map, an enforced two-witness contract (classid AND TUI must +> agree), and `FacetRegime::PerRowTui` for the CUI horseshoe: +> +> | Domain | vocabularies mapped | +> |---|---| +> | `Domain::Phenomenology` | HP | +> | `Domain::Anatomy` | **UBERON + FMA** | +> | `Domain::Disease` | MONDO + ICD-10-GM + ORDO + OMIM + DECIPHER | +> | `Domain::Lab` / `Substance` / `Procedure` | LOINC / ATC+RxNorm+Gelbe Liste / OPS | +> | `Imaging`, `BiologicalProcess` | declared, no vocabulary yet | +> +> So the corrected statements are: +> +> - *Phenotype resolution must be constrained to the existing +> `Domain::Phenomenology`; **HP is its currently populated single-facet +> vocabulary, not a new resolution domain.*** +> - *Anatomy resolution targets `Domain::Anatomy` (UBERON **and** FMA); +> UBERON's 0.07% collision rate makes it a strong current +> projection/anchor, **not the semantic domain itself**.* +> +> **Why this pedantry earns its place:** the board is executable archaeology. +> Left as written, "HP needs its own resolution domain" is precisely how a +> later session mints an `HpResolutionDomain` beside the already-built +> `Domain::Phenomenology` — the duplicate-vocabulary failure this workspace +> has now recorded several times. Append-only: the original claim is regraded +> here, not deleted. + +--- + +## 2026-08-20 — I-STRINGS-ARE-CAM-INDEX-ONLY-1 — strings in the hot path resolve through a codebook; the ONLY string home is the CAM index codebook; NEVER in any SoA + +**Status:** OPERATOR RULING (verbatim: *"All strings in hot path are mandatory to +use codebooks, the only occurrence of strings is in content addressable memory +index codebook / Never in any SoA"*; sharpened same message: *"In hot path, only +patient data or KV Side Car table"*). **Confidence:** High — iron rule. + +**The rule.** In the hot path a semantic identity is an ORDINAL. A `String` may +exist in exactly two places: (a) the **CAM index codebook** — the +content-addressed cold store / family codebook that maps bytes or a label to its +ordinal; (b) a **KV side-car table** or patient data. A string may NEVER live in +an SoA row, a value tenant, an overlay, or any reasoning-path struct. + +**The sanctioned homes already exist — this rule is not a request for new +machinery, it is a demand to stop bypassing what is built:** +- `content_store.rs` — content-addressed cold text/blob store, `ContentAddress` + = fnv1a-64 of the stored bytes, write side membrane-only. This IS the CAM index. +- `codebook.rs` — `family -> Codebook`, <=255 entries, 1-byte in-family index, + index 0 reserved as the `EdgeBlock` empty-slot sentinel; a family that + outgrows 255 SPLITS rather than widening the byte. + +**Measured compliance in this repo (2026-08-20 audit).** + +COMPLIANT, do not touch: `nars/belief.rs` carries ZERO strings — `CStmt { s: u16, +cop: Copula, p: u16 }`, `Copula::Rel(u16)`; `stance.rs:51 Interner +{ map: HashMap, names: Vec }` is the correct string->ordinal +membrane feeding it; `recipes.rs` `code`/`name`/`substrate` are `&'static str` +catalogue metadata reached by `id: u8`, never used for dispatch or equality. + +VIOLATIONS: +- `literal_graph.rs:72` `label_codebook: Vec` — an ad-hoc codebook + duplicating `codebook::Codebook`'s exact shape. Worse: `ensure_label` COMPUTES + the ordinal on every `add_node`/`add_edge` and then DISCARDS it, keeping only + the `String` on the node/edge. +- `literal_graph.rs:21,25,39,41,43` — `id`/`label`/`source`/`target` as `String` + IDENTITY, plus three `HashMap` adjacency indices. +- `exploration.rs:140-142` `FrontierEdge.source/target/label: String` — the LIVE + ranking substrate (`curiosity()` + MUL-weighted next-edge choice). +- `exploration.rs:309-311` `ExplorationResult.confirmed/denied: + Vec<(String,String,String,NarsTruth)>` — an SPO triple driving NARS revision + as three heap Strings, in a repo whose NARS statement type is three `u16`s. +- Additional interners beside the sanctioned two: `deepnsm/vocabulary.rs:82` + `forms: HashMap`; `lance-graph-cognitive/fabric/gel.rs:97` + `labels: HashMap`. + +**Predicate ordinals are TWO bytes, not one.** `ogar-loco/src/lib.rs:347` sets +`DOMAIN_FLOOR = 0x90`: `0x00..=0x8F` is universal ABI forever, `0x90..=0xFF` is +DOMAIN-LOCAL. `ogar-dismech` mints `0x90..=0xA2` (19, test-pinned) and `ogar-ro` +mints `0x90..=0xA5` (22) — the SAME range. A bare `FnIndex` is therefore +ambiguous; predicate identity is `(vocabulary, FnIndex)`, or the vocabulary is +implied by the lane's classid exactly as `ogar-obo` already does it. + +**Correction recorded with the rule:** an audit pass this session reported +`ClassRowSchema`/`RowField`/`ValueSchema` as ABSENT. They exist — +`ogar-obo/src/layout.rs:36,61` and `lance_graph_contract::canonical_node::ValueSchema`. +What IS absent is narrower: a slot->ROLE mapping (subject/predicate/mediator). +`ClassRowSchema` carves FIELDS (`entity_type`, `edge_lanes`), not roles. + +**Consequence for the reasoning overlay.** An overlay stores an ordinal, a slot +position and state bits — never a label, a relation name, or a path. Slot +position and schema ARE information; re-encoding them as prose is the redundancy +this rule exists to kill. + +--- + +## 2026-08-20 — E-S3-0-NEEDED-NO-NEW-ADDRESS-1 — the Stage-3 "S3.0 address" slot is closed as NOT-NEEDED; `IdentityQuad` already carries an exact four-component identity, at u24, inside the sanctioned V3 facet + +**Status:** FINDING (operator-directed audit; measured against merged code). +**Confidence:** High — every claim below is a read of shipped source or a +merged measurement, not a derivation. + +**The question that closes it** (operator's rule, stated during this session): +*"WHAT EXACT INFORMATION CANNOT BE EXPRESSED BY THE ADDRESSING THAT ALREADY +EXISTS?"* — and if there is no concrete falsifier showing existing addressing +insufficient, **no new absolute-address type is minted.** + +**Answer: nothing that could be demonstrated.** `identity_quad::IdentityQuad` +(operator-RATIFIED 2026-08-17, `ISS-IDENTITY-QUAD-WIDE-CARVING-HOME`) already +materializes **four external identity spaces as `4 × u24` contiguous in ONE +96-bit V3 facet payload** behind a `classid(4)`, via +`LegacyOutlier::WideTriple`. It refuses rather than truncates +(`QuadError::OrdinalTooLarge`, `MAX_ORDINAL = 2^24 − 2`); its codebooks refuse +rather than saturate (`CodebookError::TooLarge`). Its stated purpose is to +resolve a crosswalk ONCE at bake time so a read becomes a fixed-offset register +read — no join, no crosswalk walk. + +**A proposed `4 × u16` literal type was WITHDRAWN, on two independent grounds:** + +1. **`u16` cannot hold a real ontology identity.** MedCare-rs + `docs/ONTOLOGY_BAKE_STATE.md`:182 states it directly — *"real OBO ids run + past `u16` (MONDO:0700092 = 700,092) and one V3 field cannot hold that."* + The substrate already solved this with the V3 rail + (`family:identity = (num >> 16, num & 0xFFFF)`, read via + `obo_store::row_addr`). A u16 subject would have silently mis-addressed the + largest ontology in the bake. Calling such a tuple "absolute identity" was + an overclaim. +2. **`CausalLiteral` was the wrong universality.** Its own test asserted + `TREATED_WITH` — proving the structure is GENERIC. `ASSOCIATED_WITH` / + `TREATED_WITH` / `CAUSES` / `MEDIATES` / `PART_OF` are exact predicate + identities over one generic literal substrate. **Causality is a predicate + family / qualification, never universal identity.** Had a primitive been + needed it would have been `ExactLiteralAddr(D,S,P,O)` — but per the rule + above, none was. + +**Sibling absolute-address surfaces already merged**, for a future session's +map: `ogar_elk::ClassAddr` (`classid: u32 + identity: u32`, explicitly a +pre-bake **join key**, *"not an ABI address, and deliberately not documented as +one"*), `canonical_node::NodeGuid` + the HHTL cascade, and the V3 rail above. + +**The genuinely open addressing gap is a DIFFERENT one, and is not fixed by a +literal type:** `ClassId = u16` (`class_view.rs:54`) is near-exhausted for +RELATIONS — MedCare-rs `CLAUDE.md` commitment #10: *"cannot address a relation +— 11 prefixes, 8 of 280 ids over the ceiling"*, echoed in +`RAIL_OFFENE_POSTEN.md`. That is a **classid-mint capacity** question owned by +OGAR/lance-graph, to be raised with the operator in session. + +**What the ladder says the real work is** (operator-requested matrix): + +| | ADDRESS | HYDRATED SoA | TRAVERSAL | +|---|---|---|---| +| Bible / Rosetta | yes | **NO** | partial / context | +| OSM | yes | yes | overlay / junction | +| MedCare ontology | yes | yes | **YES, Stage 1** | +| DisMech oracle | source | structured | causal oracle | + +**The empty column is not ADDRESS.** The missing work is *hydrate epistemic / +causal nodes → reason over them → think about the reasoning*. Next target is +the DisMech oracle experiment: hide known mechanism intermediates, hydrate the +addressed ontology neighbourhood, let NARS/recipes recover candidates, compare +against DisMech truth (`dismech-rs` `graph::build_causal_graph`, falsified at +1,995 diseases / 33,458 edges; 1,903 committed `pathographs/MONDO_*.json` as +ground truth). + +**Also withdrawn with the type: `routing_prefix()`.** Concatenating D/S/P/O +nibbles into a `NiblePath` yields deterministic **lexicographic** prefixes. It +was labelled an "HHTL locality / cohort projection" with no consumer and no +measurement establishing that it preserves HHTL *semantic* locality — +`NiblePath` is built for the `subClassOf` Abstammung tree, where a prefix is an +ancestry claim; a lexicographic prefix over concatenated ordinals carries no +such guarantee. If it returns it needs a real consumer and a measurement first. + +**Cross-ref:** `E-NIBLEPATH-DEPTH-IS-NOT-HHTL-DIMENSIONALITY-1` (below), +`E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1` (below), PR #973 +(closed unmerged), `.claude/handovers/2026-08-20-s3-0-cold-start-recovery-audit.md`. + +--- + +## 2026-08-20 — E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1 — #875 measured a taxonomy-informed HHTL *search prior*; it did NOT prove an injective WordNet address, and a session citing it as one was corrected + +**Status:** CORRECTION (operator-caught, 2026-08-20). **Confidence:** High — +#875's own W5 numbers settle it. + +**The overclaim.** A recovery session (this one) cited +`E-WORDNET-MAKES-THE-4-ARY-ADDRESS-SEMANTIC-1` as proving *"a full-width 4-ary +HHTL fold of real WordNet ancestry is an EXACT structural encoding"*, and used +that as a counterexample licensing exact HHTL literal identity. **False.** + +**#875's own W5 gate says so:** *256/256 cells used, occupancy min 29 / median +255 / max 1270* over **65,292 addressed leaves**. That is ~255 leaves per cell. +The fold is **many-to-one by a factor of hundreds** — not injective, not an +identity encoding, and never claimed to be one in #875's own text. + +**What #875 DID measure**, and it is a strong result on its own terms: a +**deterministic, taxonomy-informed HHTL locality / search prior.** +corr(shared address levels, LCA depth) **+0.494** real vs **−0.036** shuffled; +out-of-cell band recall **0.763 vs 0.031 random = 24.71×**; a **2.47-hop** +sub-nibble distinction the 16-ary router cannot address. Explicitly a +*discriminating* prior that does NOT cover everything — #875 dropped its own +cover guard as inert for exactly that reason, and its Boundaries section +already warns that *"a concept with two genuine parents is representable at +only one address"* (first-`@`-parent tree projection of a DAG). + +**Therefore the Bible/Rosetta + WordNet composition reads:** +`frozen verse identity × quasi-absolute taxonomy-informed semantic coordinate × +witness / qualia planes` — **not** "256 HHTL cells uniquely identify a lexicon." + +**The transferable lesson, and it is the same shape as the one below.** The +retraction of #973 was correct; the replacement reached for the nearest +merged-and-measured result to license the opposite conclusion and **inflated +what that result said** in the process. A counterexample cited past its own +measured Boundaries section is not a counterexample — it is the original +failure mode with the sign flipped. Read the gate table, not the headline. + +**Cross-ref:** `E-WORDNET-MAKES-THE-4-ARY-ADDRESS-SEMANTIC-1` (unchanged; its +own Boundaries section was always correct), `E-S3-0-NEEDED-NO-NEW-ADDRESS-1`. + +--- + +## 2026-08-20 — E-NIBLEPATH-DEPTH-IS-NOT-HHTL-DIMENSIONALITY-1 — retracts #973's `E-THE-LITERAL-CANNOT-LIVE-IN-THE-PATH-IT-ROOTS-1` + +**Status:** FINDING (retraction; PR #973 closed unmerged, so the retracted +entry never landed on `main` — recorded here so the reasoning is not repeated). +**Confidence:** High. + +**The retracted claim.** #973 measured, correctly, that a +`domain·subject·predicate·object` at `u16` each is exactly 16 nibbles — the +entire budget of `hhtl::NiblePath`, a single sequential `u64`-backed router +path built for the `subClassOf` Abstammung tree. From that true LOCAL fact it +concluded, under a title that reads as a global claim, that exact identity +cannot live in HHTL addressing and evidence must **ref-escape** out of address +space into a structurally separate mechanism. + +**Why the inference is not licensed.** `MAX_DEPTH` is a property of ONE +depth-limited single-path router, not of HHTL addressing as a concept. The +substrate carries other HHTL-adjacent shapes that are not sequential descent: +`facet::FacetCascade` is a fixed 16-byte register supporting SEVERAL +SIMULTANEOUS ClassView-selected readings of the same bytes +(`G3D4`/`G4D3`/`G6D2`/`24×i4`), with `tekamolo_facet` as the shipped instance — +four orthogonal 256:256:256 lanes over one register, not nested depth. And +`E-ANAPHORA-BEYOND-I4-IS-A-BASIN-EDGE-1` (7,657 real German relative clauses, +88.01% in-window) is the general pattern: a local representation exhausting +cleanly marks a TYPE boundary — switch to another sanctioned reading of the +same address, never widen the pointer or declare the substrate exhausted. + +**What survives.** The arithmetic, scoped: `4 × u16 == 16 nibbles == +NiblePath::MAX_DEPTH`, and such a path is `is_full()` for that router. + +**What does NOT follow from it**, and was separately settled by +`E-S3-0-NEEDED-NO-NEW-ADDRESS-1` above: that a new address type was needed at +all. It was not. + +--- + +## 2026-08-20 — E-A-LOCAL-DERIVATION-CANNOT-OVERRULE-A-MEASURED-COUNTEREXAMPLE-1 — and its twin: a counterexample cited past its own Boundaries section is the same failure with the sign flipped + +**Status:** RULING (operator, cold-start recovery session after #973's +closure). **Confidence:** High — process rule, with two instances measured in +ONE session. + +**Instance 1 (#973).** A locally correct derivation about one representation +(`NiblePath`'s 16-nibble ceiling) was promoted, via a dramatic finding title, +into an implied GLOBAL substrate conclusion — while three already-measured +counterexamples in the same repository showed the opposite pattern working. +None were consulted before the finding was written. + +**Instance 2 (the recovery PR itself, caught by the operator).** The session +correcting instance 1 then (a) cited #875 as proving an *exact* WordNet +encoding when its own W5 gate reports ~255 leaves per cell, (b) called a +`4 × u16` tuple "absolute identity" when a merged doc states plainly that real +OBO ids exceed `u16`, (c) named a generic `(D,S,P,O)` structure `CausalLiteral` +while its own test used `TREATED_WITH`, and (d) called a lexicographic prefix an +"HHTL locality projection" with no consumer and no measurement. **Four unearned +claims inside the PR whose entire purpose was retracting one.** + +**The rules that follow, for this and every future session:** + +1. Before declaring the substrate "cannot" do something architectural, search + `EPIPHANIES.md` and the relevant `.claude/knowledge/` / `docs/` for existing + measurements FIRST. A local proof whose premise omits established substrate + behaviour is not a discovery. +2. **A counterexample must be read to its Boundaries section, not its + headline.** Citing a measured result past what it measured is the same + error, inverted — and it is *easier* to commit while correcting someone + else, because the counterexample feels like it is on your side. +3. Before minting any new absolute-address type, answer in writing: *what exact + information cannot be expressed by the addressing that already exists?* No + concrete falsifier ⇒ no new type. A slot in a plan is not a falsifier. +4. Name a type for what it structurally IS, not for the first use case that + motivated it. If a test can substitute a non-causal predicate and the type + still works, "Causal" does not belong in the name. +5. Use explicit `[MERGED]` / `[MEASURED]` / `[RULING]` / `[PROPOSED]` / + `[REJECTED]` labels, and never blur "true of one type" into "true of the + substrate" without saying so in the same sentence. + +**Cross-ref:** `E-S3-0-NEEDED-NO-NEW-ADDRESS-1`, +`E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1`, +`E-NIBLEPATH-DEPTH-IS-NOT-HHTL-DIMENSIONALITY-1`, PR #973 (closed unmerged), +`.claude/handovers/2026-08-20-s3-0-cold-start-recovery-audit.md`. + +--- + +## 2026-08-20 — E-THE-COMPAT-ENUM-WAS-EATING-HALF-THE-REGISTER-1 + +**Status:** FINDING (measured + fixed, PR #971). `CausalEdgeV3::rehydrate` +routed the stored 4-bit signed inference mantissa through +`InferenceType::from_mantissa(...) → pack(...) → to_mantissa()`. That enum is a +**lossy compatibility projection** — 8 mantissa states onto 16 — so the round +trip silently rewrote **8 of the 16 states**: + +| m | old rehydrate gave | m | old rehydrate gave | +|---|---|---|---| +| −8 | +1 | −3 | −1 | +| −7 | +7 | −2 | −1 | +| −5 | +5 | **0** | **+1** | +| −4 | +4 | +3 | +5 | + +`0 → +1` is the one that matters most: **every `pack_v2` edge defaults to +mantissa 0**, so the neutral/identity state was being rewritten to Deduction on +any lift-and-rehydrate. Fixed by carrying the RAW nibble — +`set_inference_mantissa(m)` after `pack`, with the `InferenceType` argument +demoted to a throwaway placeholder. + +**Why it hid, and the reason is the generalisable half.** *Exactly half* the +states survive the projection (−6, −1, +1, +2, +4, +5, +6, +7). A projection +that failed on everything would have been caught by the first test written; one +that is right half the time looks like a working codec until someone sweeps it. +And the sweep that would have caught it was structurally impossible where the +type is actually exercised: the Stage-2.6a planner parity harness only ever +carries `InferenceType::Deduction` (mantissa +1) — **a surviving state** — so a +harness that is correct, green, and genuinely load-bearing was blind to this by +construction. *A parity harness proves the two legs agree; it says nothing about +whether the conversion under them is total.* Conversion correctness needs its +own low-level exhaustive suite, and now has one +(`causal-edge::edge_v3::tests`, 11 tests, 5 disable-runs verified red). + +**Same pass, the other half of the leak: three CE64-v2 fields were being +dropped entirely** — `w_slot` (6 bits), the truth/topology register (2), the +spare/`ReasoningBand` register (3) — all of which became meaningful state with +#970. They now land in V3's dormant reserved bytes (`[8]` = `w_slot(6) | +truth(2)<<6`, `[9]` = `spare(3)`), preserved as **RAW ORDINALS**: copying +ordinal `01` across means "ordinal 01 preserved", never "`IndirectKnown` is now +source-authoritative". Under v2 the 64 bits are fully partitioned, so +`CausalEdge64 → V3 → CausalEdge64` with the same resupplied SPO is now +**bit-identical** — asserted as whole-register equality, which is what catches a +field a future session forgets to enumerate. + +**The two exclusions are principled, not residue.** (1) The 24-bit in-edge SPO +— intentionally deduplicated into the target node's CAM-PQ facet. (2) The +deprecated v2 `temporal` — *not valid CE64-v2 state at all* (bits 52..63 are the +reclaim zone), so it is NOT mapped into V3's TE; TE stays an independent +producer-set signed chain offset. + +**A method note worth keeping.** One of the five disable-runs used a malformed +`sed` pattern that matched nothing, and the resulting green read exactly like +"this carry is not load-bearing." It was re-run with an exact-string edit that +*asserts the anchor exists* before removing it, and went red immediately. This +is `E-ANTI-EIGENVALUE…`'s twin at the tooling layer: **a disable that does not +disable is indistinguishable from a guard that does not guard**, and only the +anchor assertion tells them apart. Cf. tesseract-rs's "turning a knob that does +not bind is not a disable." + +--- + +## 2026-08-20 — E-CAPABILITY-IS-NOT-REACHABILITY-1 + +**Status:** FINDING (measured; codex review on PR #971, third pass). The same +lesson a **third** time, one rung finer each round: + +| round | the predicate that looked right | why it was not | +|---|---|---| +| 1 | *(none — no filter at all)* | context-blind watchers counted as agreement | +| 2 | `maturity().is_production()` | `Operational` is a DISJUNCTION; 31 admitted, only 14 can move `delta_conf` | +| 3 | `moves_confidence()` | capability on SOME input ≠ reachability in THIS dispatched context | + +**The measurement.** `Mcp` (recipe 10) declares `moves_confidence() == true` +and that declaration is *true* — its branch needs +`confidence > 0.7 && free_energy > 0.5`. But `thought_ctx_from` starts at +`ThoughtCtx::new`'s `free_energy = 0.5`, and **exactly one** of the 34 kernels +writes that field at all (`Rte`, id 1), which only decays it. Swept over all +36 styles × 5 rungs: `free_energy` **never exceeds 0.5**, and `Mcp` moves +confidence in **0 of 180** cells. It is admitted by the filter and is +guaranteed silent. + +**Deliberately NOT fixed, and the reason is not laziness.** + +1. **A reachability filter is close to circular for the budget argument.** + Deciding whether watcher `W` can move the answer in context `C` essentially + requires evaluating `W` in `C` — which is what sampling it already does. The + slot is not saved. What a reachability notion would genuinely buy is a + refusal to count a *structural* silence as agreement — which is a change to + what **dissent means**, not a filter tweak. +2. **That is Stage-3's decision**, alongside the other half of the same + question (the 17 Operational-but-mute kernels), and making it here would + move the Stage-2.5 baseline the operator has just frozen as authoritative. + +**What generalises past this instance.** Each round the predicate was a true +statement about the *producer* and a wrong statement about what the *consumer* +observes. That is the same shape as `E-THE-RECIPE-SURFACE-IS-CAUSALLY-BLIND-1` +(substrate the projection does not carry in) and the 17 mute kernels (effects +the projection does not carry out). **Three independent measurements, one +underlying fact: `ThoughtCtx` is a lossy projection and every predicate written +against the producer side will keep being wrong about the consumer side until +that projection is made explicit.** Tracked in +`TD-THOUGHTCTX-IS-A-LOSSY-PROJECTION`. + +**Two comparator hardenings landed in the same pass** (both codex, both real): +the Stage-2.6a resolver now goes through the V3 edge's OWN `target()` instead +of a side channel — a regressed `from_v1`/`target()` would previously have been +invisible because both arms resolved the expected SPO from the spec; and the +corruption falsifier now requires the **weight-side** leg to fail on a +*composition* invariant, because the input-side assertion alone let the weight +rehydration be replaced with the direct edge and bypass V3 unnoticed. +Disable-verified: that bypass now fails, and previously passed. + +--- + +## 2026-08-20 — E-THE-RECIPE-SURFACE-IS-CAUSALLY-BLIND-1 + +**Status:** FINDING (Stage 2.6b — recorded, deliberately NOT patched; operator- +ruled scope). Falsifies the premise of the original Stage-2.6 brief, which +assumed an `CE64 → recipe/runbook/planner` path. + +**That path does not exist.** Three independent checks: + +| check | result | +|---|---| +| `lance-graph-contract` (owns `recipe_kernels`, `recipes`, `recipe_dispatch`, `materialize`) depends on `causal-edge`? | **No dependency.** It cannot name the type; the two textual hits are prose inside doc-comments. | +| `style_strategy` — the Stage-2 planner surface — touches a causal edge? | **None.** Its one `causal_*` import is `causal_witness`, an unrelated contract type. | +| What produces the `ThoughtCtx` the 34 recipes reason over? | `thought_ctx_from(&PlanContext)` — exactly two scalars: `free_will_modifier` → temperature, `features.estimated_complexity` → one candidate. `nars_hint` and `witness` are NOT read by it. | + +So **recipe/runbook reasoning is causally blind with respect to CE64/V3.** + +**Why this is recorded rather than fixed.** A V3 entrance in front of that +surface would rehydrate an edge nothing downstream reads, and the invariance +test would return `discordance = 0` for an entirely trivial reason — a green +result that means nothing. That is the same failure +`E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1` had just corrected, hours +earlier, in the same PR. **This is NOT a V3 migration defect**; it is a Stage-3 +substrate-wiring question, and stuffing CE64 fields into `ThoughtCtx` now would +be adding semantic information the recipes do not have today — which Stage 3 +explicitly reserves. + +**The sharper statement the finding generalises to.** `ThoughtCtx` is not "the +reasoning state"; it is a **lossy projection of the reasoning substrate**, and +two independent measurements this session show the cost of that projection from +opposite sides: + +- **Input side (this entry):** the causal/NARS/witness substrate exists and the + projection does not carry it in. +- **Output side (`E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1`):** 17 of + 34 kernels are `Operational` and confidence-MUTE — they write `candidates` / + `rung` / `temperature` / `beliefs`, and the dissent consumer observes only + `confidence`, so their real effects are invisible to it. + +**The 17 are not stubs, and must not be "fixed" by making them move +confidence.** Their silence means *the consumer projection is narrower than the +producer effects*, and rewriting them to move confidence would destroy exactly +the distinction this audit discovered. Stage 3 decides whether dissent becomes +(A) a multidimensional comparison over declared `writes()`, (B) per-capability +watchers, (C) a projection into a common epistemic space, or a measured +combination. **Not decided here.** + +**Consequence for Stage 3's handoff — two distinct wiring problems, and keeping +them distinct is load-bearing:** + +1. **Edge semantics.** `CausalEdgeV3` (addressed, semantic, durable) + + `CausalEdge64` (hot compact NARS projection); the planner's `nars_engine` + leg is now proven representation-invariant (Stage 2.6a). +2. **Program/recipe semantics.** 34 recipes × 36 styles operate on a narrower + `ThoughtCtx` projection; the 17 mute kernels are the measured cost. How + causal/NARS/V3/witness information enters the program surface **without + turning every effect into confidence** is the open question. + +Cross-ref: `TD-THOUGHTCTX-IS-A-LOSSY-PROJECTION`. + +--- + +## 2026-08-20 — E-V3-IS-REPRESENTATION-INVARIANT-ON-THE-PLANNER-CE64-LEG-1 + +**Status:** FINDING (Stage 2.6a; `cache/stage26_v3_parity.rs`, artifact +`docs/probes/stage26-v3-planner-parity-discordance.csv`). + +The existing compare-thinking work proved V3 thinking-preserving at +`causal-edge`'s own `syllogize` and on `cognitive-shader-driver`'s real emission +path. The **planner's** `CausalEdge64` leg — `cache/nars_engine.rs`: +`SpoHead ↔ CausalEdge64` via `to_causal_edge` / `from_causal_edge`, and +`forward_edge` over the compose tables — was the uncovered third leg. It is now +covered. + +**Result: planner V3 representation discordance = 0**, by exact equality across +13 invariants per leg — the rehydrated `CausalEdge64` itself, SPO after +resolution, NARS frequency/confidence, causal mask, inference class, the +`SpoHead` round-trip, the `forward_edge` conclusion, that conclusion's +`SpoHead`, the `syllogize` conclusion edge, and the derived truth/expectation. +Representation-specific fields (V3 Lokal target, TE, payload width) are +deliberately NOT compared — asserting on those would be asserting that V3 *is* +CE64. + +**One reasoning implementation.** The V3 arm computes nothing: it drops the +in-edge SPO, resolves it back from the target node's facet, rehydrates a +`CausalEdge64`, and hands it to the *same* `NarsEngine` methods. No V3-native +NARS exists. + +**The falsifier is what makes the zero mean anything.** Equivalence is +conditional on `resolved node facet SPO == the original edge's SPO`, so the +harness corrupts ONE facet binding and requires the comparator to go red — +and requires it to stay LOCALISED (fewer than all legs discordant, and the +SPO-shaped invariants specifically the ones that fire). Verified: bypassing +`rehydrate` entirely leaves the primary test green and fails **only** the +falsifier, which is precisely the vacuity the falsifier exists to catch. + +**A disable-run corrected one of my own claims.** The degeneracy guard first +asserted "`forward_edge` changed the edge on some leg", documented as proving +the compose tables are not inert. Measured: making every table the identity +left that assertion **green**, because `forward` also composes the NARS truth. +The discriminating form is SPO-specific (`spo_of(fwd) != spo_of(input)`), which +does fail under that disable. The weak form is kept alongside it, with the +measurement written next to both. + +**JC's role, and where it stops.** Every quantity at this seam is exact — `u8` +palette indices, `u8` truth bytes, a `u64` register — so **there is no naturally +continuous quantity here for a correlation to characterise, and none was +manufactured**. `jc::stats::binary_association` summarises the syllogism-presence +cross-tab: both categories occur across the sweep, so κ is **defined** and equals +1.0 — a real statement rather than the degenerate constant-column case. Exact +discordance remains the contract. + +--- + +## 2026-08-20 — E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1 + +**Status:** FINDING (measured; corrects `E-A-WATCHER-THAT-CANNOT-DISSENT-IS-NOT-A-WATCHER-1` +and **⊘ STORNOES the headline of** `E-THE-COVERAGE-FIX-IS-REAL-AND-ASYMMETRIC-1`, +both written earlier the same day on this branch). Origin: codex review on +PR #971, against the first version of `StyleStrategy::watcher_can_dissent`. + +**The claim that was wrong.** Both entries above reported that the consumer +filter changes which watchers are sampled but changes **no verdict** — 0 of +5,760 paired configurations, on both channels, κ = 1.000000. The measurement +was sound. The predicate it measured was not. + +`watcher_can_dissent` filtered on `maturity().is_production()`. But +`Operational` is a **disjunction** — `maturity_operational_implies_an_effect` +requires *mutates some `ThoughtCtx` field* **OR** *moves confidence* — while +both dissent channels compare exactly one quantity, `tc.confidence`. Measured +over the 34 kernels: + +| | count | +|---|---| +| `Operational` | **31** | +| can move `delta_conf` | **14** | +| declare `ThoughtField::Confidence` in `writes()` | **0** | + +So the filter removed 3 mute watchers and admitted **17 more that were equally +mute** — it *preserved the exact budget loss it was introduced to remove*. The +sharpest cases are `Cas` and `Etd`, both carved to production in this same +arc: both rewrite `candidates`, both return `0.0` forever. + +**The fix, and why it needed a new contract method.** Capability is not +derivable from anything the trait previously exposed: `writes()` is the census +of `&mut ThoughtCtx` mutations, and `delta_conf` is applied by `run()` +*afterwards* — deliberately a separate effect, which is why +`no_kernel_writes_outside_its_declared_mask` calls `apply` directly. So +`Tactic::moves_confidence()` was added: non-defaulted like `requires` and +`maturity`, declared per kernel, and pinned **two-sided** against the probe +matrix (`moves_confidence_matches_observation` — over- and under-declaring both +fail) plus a subsumption pin (`moves_confidence` ⇒ `Operational`, checked +rather than commented, so the consumer can filter on capability alone without a +redundant maturity conjunct). + +**The corrected result inverts the headline.** + +| channel | sample changed | mean Jaccard dist | retention | **verdict change** | κ (fired) | +|---|---|---|---|---|---| +| same-family | 4080/5760 (70.8%) | 0.5306 | 0.4958 | **1098/5760** | 0.6307 | +| cross-family | 4224/5760 (73.3%) | 0.5269 | 0.5681 | **384/5760** | 0.8098 | + +**And it has a direction, which is the part worth keeping.** On the same-family +channel `n10 = 0` **exactly**: no configuration that dissented with the filter +OFF goes silent with it ON. That is the coverage argument turned into a +measurement — removing only structurally-mute watchers cannot remove an +objection, because a mute watcher could not have raised one. Dissent rises +2514 → 3612 (+43.7 %). + +Cross-family is *almost* one-way: 366 gained against **18 lost**, and the 18 +are the SAMPLER, not the filter. `peripheral_sample_where` strides `k` picks +over the eligible list, so shrinking that list changes *which* capable watchers +are picked; a capable dissenter selected under OFF can fall off the stride +under ON. Pinned exactly rather than rounded to "one-way". + +**Three process findings, each independent of the numbers.** + +1. **A green census is not a correct census.** The Stage-2.5 harness measured + the filter faithfully and reported zero — because it was pointed at a + predicate that could not matter. Nothing in the suite could have caught + that; it took a reader who asked what `Operational` actually guarantees. + The census *did* earn its keep the moment the predicate changed: it went red + on the first run and named the number. +2. **The report hardcoded its own conclusion.** `render_report` wrote + `**Verdict change: 0/{n}.**` as a literal in the format string — so it + would have printed zero regardless of what was measured, and did, for one + revision after the correction landed. A report that *states* its result + instead of deriving it is not a measurement. Now computed from + `binary_association`, and the test is what caught it. +3. **A coarse label can certify something it never looked at.** The + cross-family verdict is `(RungLevel, Mechanism)`; the census reduced it to + the rung, so a swap to a different mechanism at the same rung would have + counted as agreement while the report claimed the mechanism agreed exactly. + Both components are now encoded into one nominal label (`cross_label`). + (Also codex, PR #971.) + +**Bound reporting, made reproducible** (CodeRabbit, PR #971). The zero-event +Clopper-Pearson limit `1 − α^(1/n)` is now stated with **α = 0.05 (95 % +one-sided)**, and it is repointed at the surface that IS still zero — the +same-family `n10`. Each rung of the clustering ladder names its independent +unit: one `(style, rung, k, tol)` cell (5760, optimistic); one `(style, rung)` +cell (144, `k`/`tol` as within-cell repeats); one style (36, a 160-cell block +as one observation); one style cluster (6, styles sharing a `Mechanism` — the +most conservative unit the design offers). + +--- + +## 2026-08-20 — E-THE-COVERAGE-FIX-IS-REAL-AND-ASYMMETRIC-1 + +**Status:** ⊘ HEADLINE SUPERSEDED same-day by +`E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1` — the watcher-sample +numbers below stand, the `0/5,760` verdict claim does NOT. FINDING (measured; `strategy/stage25_census.rs`, artifacts at +`docs/probes/stage25-consumer-filter-census.{md,csv}`). Quantifies +`E-A-WATCHER-THAT-CANNOT-DISSENT-IS-NOT-A-WATCHER-1`, which recorded the same +result qualitatively and could not say how large it was. + +The Stage-2 consumer filter was documented as "a coverage fix, not a behaviour +change" on the strength of one sentence — *changes which watchers are sampled, +changed no verdict*. Stage 2.5 measured both halves with `jc::stats` over the +same exhaustive 5,760-cell paired design, and **the two channels are not the +same size of effect**: + +| channel | configs changed | mean Jaccard distance | mean retention | max sym-diff | verdict change | +|---|---|---|---|---|---| +| same-family (`peripheral_dissent`) | 1440/5760 (25.0%) | 0.1265 | 0.9028 | 6 | **0/5760** | +| cross-family (`cross_family_dissent`) | 2400/5760 (41.7%) | 0.2599 | 0.7993 | 12 | **0/5760** | + +**Pooling them was the first thing that had to go.** The pooled mean is 0.1932, +which fell just under a 0.20 cutoff and produced the single word "weakly" for +two channels differing by a factor of two. That is a threshold artifact of the +kind this workspace's own falsifiability rule warns about — the report now +grades per channel against a stated rule (`≥ 0.20` mean Jaccard distance OR +`≥ ⅓` of configurations changed ⇒ *materially*), so the word is checkable +rather than editorial. **Cross-family is material; same-family is weak.** + +**Where the effect lives.** Concentrated exactly where the silent watchers do: +`Surface`/`Shallow` carry all three (`ARE` 19, `ZCF` 24, `HKF` 34), and the +peak cell replaces **more than half** the sample (cross-family +`Surface`/`k=3`: Jaccard distance **0.5667**). It falls to exactly 0.0000 at +`Contextual`/`Analogical` for several budgets. Descriptive η² over the design: +same-family is dominated by **style** (0.2761) then `k` (0.1987); cross-family +by **rung** (0.2543) then `k` (0.1795). Style stayed a stratum even though the +Stage-2 verdict surface is inert to it — and it turned out to be the +*largest* factor on one channel, which is the reason to keep an inert-looking +stratum rather than drop it. + +**The verdict half, exactly rather than smoothed.** 0 discordant of 5,760 on +BOTH channels, on the FINE label (the elevation `RungLevel` — which watcher +objected — not merely fired/not-fired). Cohen's κ = 1.000000 and, importantly, +**defined**: both outcome categories occur (n11=2514/n00=3246 and +n11=4290/n00=1470), so the perfect agreement is a real measurement and not the +degenerate constant-column case `jc::stats::cohen_kappa` refuses to score. +**McNemar is deliberately NOT reported** — it is a test on the discordant +cells and there are none, so the statistic is degenerate, not significant. + +**The bound is a ladder, not a number.** With zero events the exact +one-sided Clopper-Pearson limit is `1 − α^(1/n)`; the 5,760 rows are repeated +measures (one style contributes 160), so quoting `5.2e-4` would assume an +independence the design does not have. Reported at every clustering +assumption — cell `5.2e-4` · style×rung `2.1e-2` · style `8.0e-2` · cluster +`3.9e-1` — with the instruction to quote the one whose independence you are +willing to defend. + +**A methodological note that generalises past this measurement.** No +inferential test is run over the census, and the report says so in its own +header: the enumeration is exhaustive and deterministic, so there is no +sampling distribution for a p-value to describe. `jc`'s `t_test_*` / +`anova_one_way` p-values are therefore not reported; what IS used is +cross-tabulation, variance decomposition, and rank association — the things a +census can honestly support. The one exception is the zero-event bound, which +is a statement about an unobserved population and is exactly where inference +belongs. + +Also recorded: `multiple_r_squared`'s joint figure is **smaller** than the +largest single η² on one channel (0.0545 vs 0.2761), and that is not a +contradiction — it fits the factors as LINEAR predictors over integer codes +while η² groups them nominally, so a factor whose effect is non-monotone in +its code (style, whose code is an enum position) is largely invisible to the +linear fit. Read as *"how much a linear read of the design explains"*, never +as a ceiling. + +--- + +## 2026-08-20 — E-THE-AUDIT-GATE-WAS-PINNING-THE-BUG-1 + +**Status:** FINDING (measured; `examples/recipe_claim_audit.rs`, branch +`claude/carve-nars-kernels`). Sibling to +`E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1` — a *new* failure shape, not a +restatement. + +Four of the 34 NARS recipe kernels were carved from non-production to +production (CAS 8, ETD 22, ICR 31, SDD 32). The moment they were, the repo's +own census example went **RED** — and the gate it failed was `G2 recipe-weak +set is exactly {CAS,ETD}+{ARE,ZCF,ICR,HKF}`. + +**The audit's arms were written to confirm the defect, not to detect it.** +`8 =>` asserted `unchanged` (candidates, rung and Δconf all untouched) and +reported *"abstraction level computed then discarded — no observable +effect"*. That is a correct description of a bug, encoded as an expectation, +behind an equality gate. Fixing the bug is what breaks the suite. + +This is NOT the vacuous-assertion failure (a test that cannot fail). Every +arm here CAN fail and did. It is the inverse: **an assertion that is real, +two-sided, and pointed at the wrong side of the finding.** A census that +pins "the weak set is exactly W" is only a census while W is a measurement; +the day someone shrinks W, the pin argues against them. + +**What generalises.** A test that records a defect must say, in the test, that +it is recording a defect and what its removal should look like — the +`f_ord_real_defect_pin_*` convention (`E-…-FALSIFIER`) does exactly this and +is the shape to copy. The four arms are now re-pinned to the CLAIMED +POST-CONDITION instead (`realize(c1.candidates == vec![0.0, 1.0] …)`), so a +regression to compute-then-discard fails them again — the pin now points the +other way and the equality in G2 was kept deliberately (`n_inert == 0 && +n_constant == 3`), so a NEW inert kernel is a review, not an absorption. + +**Second, smaller finding in the same arm.** ICR sat in the shared +`19 | 24 | 31 | 34` "input-independent" arm, which varies only `candidates`. +ICR now reads `free_energy`, which that probe never varies — so it would have +reported CONSTANT forever while the kernel discriminated. *The fixture's +shape is part of the coverage*, again, and this time on a probe rather than a +test. + +--- + +## 2026-08-20 — E-A-WATCHER-THAT-CANNOT-DISSENT-IS-NOT-A-WATCHER-1 + +**Status:** ⊘ CORRECTED same-day by +`E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1` — the MECHANISM below is +right and is why the arc exists; the "measured null" is an artifact of +filtering on the wrong predicate and is retracted. FINDING for the mechanism; +~~**MEASURED NULL** for its present effect~~. Both halves recorded, because the second is what stops the first +being overclaimed. + +`StyleStrategy::{peripheral_dissent, cross_family_dissent}` sample `k` +peripheral tactics as observers and elevate the rung if one of them moves the +score. Their eligibility predicate filtered on `Mechanism` only. But a +`Demonstration` kernel lands **no effect by construction** — enforced, in the +contract crate, by `non_operational_kernels_land_no_effect` — so sampling one +spends a `k` slot on an observer that *structurally cannot dissent*, and its +guaranteed silence is then counted as agreement. + +That is `E-ANTI-EIGENVALUE-MACHINERY-CAN-ITSELF-BECOME-THE-EIGENVALUE-1` +inverted. The can-fire / can-stay-silent pair asks whether a guard +discriminates; this asks something prior — **whether the instrument is +connected at all**. A watchdog that can never bark reports the same silence +as one with nothing to bark at, and only the first is a lie. + +Measured periphery before the fix: `Surface`/`Shallow` carry 3 silent +watchers of 30 (ARE 19, ZCF 24, HKF 34); `Contextual`/`Analogical` carry 1 of +23 and 1 of 10. + +**The null, stated plainly.** Adding the maturity clause visibly changes WHICH +watchers are sampled (the eligible list shrinks, so the stride moves — e.g. +`Surface`/`StructuralDivergence`/same/`k=8` goes `[4,6,9,13,23,28,31,34]` → +`[4,6,9,13,23,28,31]`), but across the full **5,760-cell** sweep of +style × rung × `k` ∈ {1,2,3,4,8} × `tol` ∈ {0, .001, .005, .01, .02, .05, .1, +.2} it changed **no verdict on either channel**. It is a COVERAGE fix, not a +behaviour change, and it is documented at the call site as exactly that. + +**Why the null is not a reason to drop it, and how it is kept falsifiable.** +The channel is emphatically not inert — suppressing the watcher run outright +moves **4,830 of those same 5,760 cells** — so the instrument matters; what +does not currently matter is *which* of the surviving instruments is picked. +A guard with no falsifier would be the anti-pattern, so the falsifier was +written at the level the change actually operates: every watcher the shipped +predicate samples can dissent, **plus** the anti-vacuity half proving the +mechanism clause alone would have sampled one that cannot. Both halves are +disable-verified red. + +**A structural note worth keeping.** The reason the identity of the watcher +does not move the verdict is that `|tc.confidence − admitted|` is dominated by +a term independent of the watcher: `tc` runs the admitted set *and* the +watcher, while `admitted` comes from `reliability_at`, so any admitted-set +effect cancels and any constant offset between the two paths crosses `tol` +regardless of who observes. That is worth measuring before anyone tunes `tol` +against this channel — recorded here rather than acted on, since it is +outside this PR's scope. + +--- + +## 2026-08-19 — E-THE-OU-COLUMN-EXISTS-AND-NOTHING-WRITES-IT-1 + +**Status:** FINDING (six-agent read-only sweep across lance-graph, ndarray, +lance-graph-java, OGAR, MedCare-rs, the DisMech corpus; operator rulings of +the same day). Deliverable: +`docs/architecture/ARC-B-OWNERSHIP-AND-ADDRESSING-REASSESSMENT.md`. + +**The finding:** HHTL is already the FIRST canonical tenant of every +512-byte row (`key(16) | edges(16) | value(480)`, `canonical_node.rs:706-730`, +independently restated at `OGAR/crates/ogar-obo/src/lib.rs:22-35`) — and it +is **zero on every baked row in both production bakes**. `ogar-obo` +(`lib.rs:344-353`, `EDGE-LANES.md:44-51`): *"The bake has no basin: +HEEL/HIP/TWIG and leaf are zero on all 68,797 rows."* MedCare +(`join-map.md:103`): *"HHTL is dormant on every baked row (heel/hip/twig/ +leaf all 0 across 68797 rows)."* Every real HHTL reader either mints its own +keys, recomputes tiers in RAM at load, or asserts null — **none reads the +key of a baked artifact.** + +So the addressing gap is not storage, layout, or a missing carrier. The OU +column exists in every object and nothing writes or reads it. The measured +consequence: **five structurally distinct hand-rolled ancestor mechanisms in +ONE repository** (LIFO+bitset closure; stack+HashSet with its own cycle +guard; a load-time chosen-minimal-parent chain; a per-query re-climb; and a +Kahn longest-path fallback), each with its own dedup and its own semantics. + +**The operationally load-bearing half:** two of those five **disagree by +design** — `atlas.rs:465,898-904` measures **58.2% agreement** between the +rail-register depth and the Kahn longest-path depth, because spanning-tree +depth and DAG longest path are different quantities on a multi-parent DAG. +"Just use the rails" is therefore a **semantic** change, not merely a faster +one, and any migration owes a written ruling on which quantity is canonical. + +**The highest-value single change follows directly:** `obo_store::compute_cascade` +(`:690-760`) already derives HEEL/HIP/TWIG in RAM at load — it is the mint, +misplaced. Moving that derivation into the bake populates the key with what +the system already computes, using bytes that are reserved and zeroed today. + +Cross-ref: E-TWO-WITNESS-SHAPES-CONTEST-ONE-LANDING-ZONE-1 (the witness seam +and this gap are the same problem — `Locus::BasinAnchor` points at the same +unwritten `part_of:is_a` rail). + +## 2026-08-19 — E-THE-CANONICAL-ROW-WAS-READ-OFF-A-FIXTURE-1 + +**Status:** CORRECTION (operator ruling + sweep evidence). Affects +`.claude/plans/hhtl-thinking-tables-le-contract-v1.md` F1, corrected in +place. + +**What happened:** ARC-B's F1 froze *"ONE canonical substrate: the 32×(4+12) +facet register"* and cited `lance-graph-java/native/lgj-abi/src/abi.rs:173-175` +as its shipped shape. That citation is a **fixture, and it says so itself** — +`rowstore.rs:5-8,33-39`: *"The Java side may lay its view out differently… +The 64-byte-aligned guarantee arrives with the real `NodeRow` +(`#[repr(C, align(64))]`) wiring, not here."* Grep confirms **zero import of +`NodeRow`/`EdgeBlock`/`NodeGuid`** anywhere in that code path; the only +`canonical_node` import is `EdgeCodecFlavor`, for a trait-default test. +Meanwhile `docs/abi.md:433-438` §10 already names the real target — +*"`NodeRow`'s `16|16|480` … is already a legal lane description"* — but §11 +(2026-08-17) and §12 (2026-08-18) shipped the homogeneous 32-lane fixture +and §10 was never revised, so the doc contradicts itself in reading order. + +**The lesson, generalizable:** a *conformance target* was mistaken for a +*source of truth* because it was the shape that had shipped most recently +and was easiest to grep. Canon lives in the contract crate; a consumer's +current geometry is evidence about the consumer, never about canon. The same +inversion is what put integration ownership inside the DisMech oracle +(see the PR #7 ownership correction). + +**Also corrected the same day:** an earlier session claim that `ogar-elk` is +*"structurally prevented from producing an entailment"* is **false**. It +computes real EL-subsumption closure in-repo, in pure Rust +(`OGAR/crates/ogar-elk/src/lib.rs:163-166,239-367` — `entails`, +`equivalence_cycles`, `merge`; R1/R2/R3 only, existentials and role +composition deliberately excluded at `:70-81`). What it forbids is +*serializing* the verdict — *"An observer that could serialize its verdict +would invite someone to ship the verdict as if it were substrate"* +(`:42-45`). Entailment production is local and real; persistence as +substrate is what is banned. + +## 2026-08-19 — E-TWO-WITNESS-SHAPES-CONTEST-ONE-LANDING-ZONE-1 + +**Status:** FINDING (CE64/EW64/dismech investigation + V3 migration-plan +audit, operator-directed). Plan: `.claude/plans/ew64-witness-unification-v1.md`. + +**The finding:** the EpisodicWitness64→V3 migration has no plan because its +landing zone is already occupied by a different shape with experimental +status. Tenant 14 `CausalWitness` (`.claude/v3/soa_layout/tenants.md`, 16 B +facet at row [204,220), G24N4 = 24 signed-i4 ±8-window context pointers, +"EXPERIMENTAL — not in the operator-locked §3 catalogue") and the queued +`EpisodicWitness64` (4-slot recency MRU of `EdgeRef{family,local}`, +`episodic_edges.rs` Phase A shipped #446–#448) are two witness shapes that +never reference each other (grep-verified both directions), while tenant 2 +`MaterializedEdges` (4 out-of-family CausalEdge64) is a third adjacent edge +carrier. Four W1 scaffolds each self-document the missing seam +(`witness_table.rs` "scaffold-only", `soa_view.rs:257-277` deferred +accessor, `markov_soa.rs` "truly-correct home is still inside the +EW64-in-SoA seam"). Candidate resolution (NOT banked — operator decision): +the two are two RUNGS of one witness ladder — positional stream context vs +episodic reference — and EW64's sub-byte packing lands as a `U64 × 1` LANE +(Qualia/Kanban precedent), never a §3 byte-axis carving. Companion +correction: the EW64-prefetch spec's "three open decisions" are TWO — +`RawEdge(i8)` mantissa-only is SHIPPED (`counterfactual.rs:456/472-479`); +only the `impl EpisodicEdge for CausalEdge64` bridge location remains open. + +Refs: `.claude/specs/episodic-witness64-ce64-prefetch.md`, tenants.md § +tenant 14, MODULE-TABLE rows 48/167/227/243, E-EW64-IS-PREDICTIVE-PREFETCH. + +## 2026-08-19 — E-CONTRACT-INFERENCETYPE-INVERTS-THE-COUNTERFACTUAL-1 + +**Status:** FINDING (rung-3 runtime audit; sharpened during plan authoring). +Plan: `.claude/plans/counterfactual-rung3-closure-v1.md`. + +**The finding:** rung-3 (counterfactual) is fully specified in the substrate +and fully absent — and mis-decoded — at runtime, because the canonical +contract enum is two variants narrower than the causal-edge enum. +`contract::nars::InferenceType` has 5 variants; `causal_edge` has 8, and +the missing pair (Intervention=+6, Counterfactual=−6) is exactly Pearl +rung 3, so the semantics cannot cross the contract boundary. Every dispatch +degrades: `nars/inference.rs:72` + `orchestration_impl.rs:207` map +Counterfactual ⇒ Abduction ("follow-up PR" comments); no +abduce→intervene→predict chain runs anywhere. **Worse than a lossy +narrowing:** `contract::nars::from_mantissa(−6)` decodes to `Synthesis` +(own mantissa **+5**) — a silent DIRECTION INVERSION (a backward-chain +counterfactual read back as forward-chain synthesis). And enum widening +alone cannot surface the fix sites: the three rung-3 routing points +(`orchestration_impl.rs:144/149/176`) are `_ =>` wildcards that silently +absorb new variants. Adjacent fragmentation, same audit: three multi-hop +truth paths share no code (`belief.rs:279` close_transitive is real; +`truth_propagation.rs` is a no-op; `network.rs` forward_chain declares +NarsTables and never reads it); ≥3 reimplementations of the revision +formula across 19 `fn revise` sites; and "Pearl 2³" names three distinct +structures (CausalMask powerset / CausalAmbiguity permutations / +SEE-DO-IMAGINE). Doc-drift note owed to +`triangle-tenants-gestalt-separation-v1.md` §2a: it cites +`world/counterfactual.rs::intervene()` — no such function exists. + +Refs: `layout.rs:16-32` (signed mantissa), M20 / le-contract "let go of the +cramped 64-bit register" (the fix is enum + round-trip, never new CE64 bits), +D-TRI-6 (the plane half is already wired and probe-green). + +## 2026-08-19 — E-THE-STRONG-HIERARCHY-EXISTS-AS-FIVE-DISCONNECTED-ISLANDS-1 + +**Status:** FINDING (ARC A′ five-sweep source audit, operator correction of the +weak "computed view" decode). Deliverable: +`docs/architecture/ARC-A2-STRONG-HIERARCHY-RECONCILIATION.md`. + +**The finding:** every major mechanism of the operator's strong hierarchy model +is ALREADY IMPLEMENTED in this workspace, correctly and with tests — and none of +the implementations are connected to each other. The gap is not invention; it is +that no SHARED SHAPE exists, so each island grew its own vocabulary. + +- Two independent rails, one leaf, no identity duplication → + `rail_geometry::{RailAxis::Taxonomy,::Mereology,RailPath}` (shipped + 2026-08-13) with its own disable-test `the_pair_axes_are_two_separate_bytes`. + Sole caller: a `ClassView::rail_carving` default. **But + `NiblePath::from_guid_prefix_v3` FUSES both bytes into one route, has no + per-axis constructor, and the two modules never cross-reference.** +- Shared ancestry walked once, not copied (the DN-tree) → + `deepnsm-v2::ancestry::FamilyTrie`, whose `dn()` is literally the + distinguished-name walk. Private `u16` id space, zero tie to + `NodeGuid`/`NiblePath`, no crate depends on it. +- The intended end-state (`is_a` = prefix containment / zero storage; `part_of` + = explicit edges) → already written down UNPROMPTED in `soa_bake/mod.rs`, + self-marked "⚠ TYPE SCAFFOLDING, not a working bake". +- Second-order referencing (record → record of its own kind, NO homunculus) → + `witness_fabric::resolve_chain`, real multi-hop with horizon+budget + escalation. Bounded ±8, one locus dimension, facet flagged experimental. +- Grouping → stable addressable coordinate → `wikidata_hhtl` DOLCE basin, + shipped and tested. **Type-A only; no Type-B (discovered) analogue exists + anywhere in the workspace.** + +**The naming failure is measured, not hypothetical:** the word "basin" already +carries FIVE distinct mechanisms (AriGraph discovered cluster · +`Locus::BasinAnchor` pointer slot · `EpisodicEdges64` class-family · +`NodeGuid` `family` tier · Wikidata/DOLCE category) — four Type-A, one Type-B, +sharing a word and nothing else. This is exactly the throwaway-naming failure +the operator's "reusable agnostic shape" ruling exists to prevent, already +present in the tree. + +**The sharpest single instance of the gap:** `nars/meta_basin.rs` performs real +higher-order structural analysis today (basin clustering over causal +trajectories, outlier suggestion with evidence) and its own doc states +"Nothing here prunes, commits, or scores." Computed, then discarded, every +cycle. Meta-awareness is therefore PRESENT-BUT-UNMATERIALIZED, not future — a +different and more actionable condition than the ARC A draft claimed. + +**Correctly absent, and worth recording as correct:** there is no reasoner in +lance-graph. The OWL hydrators intern IRIs and discard the triples; +`ontology_warrant.rs` names OGAR's `ogar-elk` as the external factfinder and is +structurally prevented from producing an entailment ("deliberately no method +that turns a `NarsTruth` back into an entailment"). The operator's +HHTL-exposes-structure / RO-decides-transfer boundary is already drawn in the +code — merely unwired. And NO live conflation of structural ancestry with +semantic inheritance was found; `ontology_warrant.rs` is evidence of the +opposite discipline, built after a measured incident where treating ontology +SILENCE as DISSENT inverted a finding (~50% apparent disagreement vs a true +99.8% agreement). + +**Cross-refs:** `E-HIERARCHY-NODE-IS-ALGEBRA-NEVER-A-CROSSWALK-1` (the earlier, +WEAKER decode — this entry supersedes its generality: a computed projection is +one case, not the definition); `E-ARIGRAPH-IS-AN-ISLAND` (independently +reconfirmed still current); `E-FAMILY-NODE-IS-META-AWARENESS`. + +## 2026-08-19 — E-A7A-STORNO-THE-EXCLAMATION-WAS-NOT-A-NAME-1 + +**Status:** CORRECTION (storno of the entry below, +`E-A7A-IS-THE-NAME-NOT-LITERALLY-DUMB-1`). + +**What happened:** the session misread the operator's message "A7A" as a +naming ruling and minted it as the substrate's handle in two doc reading +notes and the entry below. The operator's next message: "No A7A ia Arabic +for WTF" — it was an exclamation, not a name. The handle is scrubbed from +the two reading notes (charter header + ARC A header, same commit as this +entry); the erroneous entry below is regraded via its Status line, not +deleted (append-only). + +**What stands:** everything except the handle. The reading remains the +operator's own formulation, used descriptively with NO acronym: the +**agnostically-encoded hierarchical pattern** for separation of concerns — +dependency-free mask-based addressing + parent-node HHTL for the +CLAM/CHAODA trie; a reusable, reliable storage concern (answers +"where"/"which references", never "what"), the floor reused unchanged by +Java ABI / Panama / Valhalla, Ontology, and OSM — structural referencing +as a globally available pattern. "Dumb storage" in historical text stays +as posture-shorthand, unscrubbed. + +**Process lesson (real, kept):** do not mint an acronym, handle, or type +name from a terse operator message without an explicit naming statement — +this is the naming-side twin of "no metaphor becomes a type name without +council approval" (lotus charter). A name enters canon when the operator +names, not when the session abbreviates. + +## 2026-08-19 — E-A7A-IS-THE-NAME-NOT-LITERALLY-DUMB-1 + +**Status:** ⊘ STORNO'd (same hour, by the entry above) — the "handle +A7A" half was a MISREAD: the operator's "A7A" was an exclamation (Arabic +slang for roughly "WTF"), not a naming ruling. The "not literally dumb, +not literally replace" half of this entry stands and is restated above. + +**The ruling:** "dumb storage" was a posture-shorthand, never the +concept's name — and the correction is NOT a mechanical terminology sweep +(a literal find-and-replace/file-rename was started and REVERTED before +commit; no historical text was edited, no file moved). The concept's name +going forward is **A7A**: the **agnostically-encoded hierarchical +pattern** for separation of concerns — dependency-free mask-based +addressing + parent-node HHTL for the CLAM/CHAODA trie. A reusable, +reliable STORAGE CONCERN: it answers "where"/"which references", never +"what". Built as the floor that arbitrarily sophisticated follow-up +patterns reuse unchanged — Java ABI / Panama / Valhalla, Ontology, +OpenStreetMap alike — with structural referencing as a globally +available pattern. + +**Mechanics:** interpretive READING NOTES added to the charter header +(`docs/architecture/DUMB-STORAGE-RESET-CHARTER.md` — path unchanged, +verbatim block byte-identical) and to ARC A's header +(`docs/architecture/ARC-A-SOURCE-ARCHAEOLOGY.md`). Prior entries naming +"dumb storage" (E-ARCHITECTURE-RESET-DUMB-STORAGE-HHTL-EPISTEMIC-1, +below) stay as written per append-only discipline and are read through +this entry. Forward vocabulary in new docs/specs/PRs: A7A. + +**Cross-refs:** `E-HIERARCHY-NODE-IS-ALGEBRA-NEVER-A-CROSSWALK-1` (the +Valhalla/Panama-cheap computed-view correction — A7A's door-B mechanism); +the charter §0 canonical decomposition (unchanged in substance; renamed +in reading). + +## 2026-08-19 — E-HIERARCHY-NODE-IS-ALGEBRA-NEVER-A-CROSSWALK-1 + +**Status:** RULING `[operator]`, correction applied in place to +`docs/architecture/ARC-A-SOURCE-ARCHAEOLOGY.md` §3/§7/§9/§10 (⊘-marked, +original text retained, not deleted). + +**The correction, in one line:** `parent_ref`, `child_or_ref_set`, +`projection_mask`, `version` must never be co-located as stored fields on +a materialized hierarchy node. Each is a cheap, register-width AND/XOR +read over an EXISTING shipped primitive — `NiblePath::parent`/`child` +(already O(1) bit-shift), a `ClassView`-projected child-position mask +ANDed against a `WideFieldMask` presence read (the same intersection +primitive `standing_mask.rs::fires()` already exercises), and a +caller-supplied `DatasetVersion`/`QueryReference` (never copied onto a +node). The "hierarchy node" at any address is a COMPUTED VIEW over +`(NiblePath, ClassView, WideFieldMask, DatasetVersion)`, evaluated fresh +each time — never a persisted crosswalk table. + +**The named analogy, load-bearing:** this is exactly how Valhalla value +classes get structural operations (equality, hashCode, field access) with +zero object header and zero indirection — flat bytes, computed directly, +no materialized identity — and exactly how Panama's `MemorySegment` gives +zero-copy VIEWS into native memory with zero Java-object materialization. +The prior ARC A draft proposed a new type carrying all four fields, +reasoning "no existing type carries all four, therefore mint one" — that +reasoning was the error. Absence of a four-field type is not evidence one +is needed; per this ruling it is evidence none should exist. + +**Consequence:** ARC A's §7 "proposed new types" list is now EMPTY — zero +new types across the entire dumb-storage substrate. At most one small free +function (composing `NiblePath::child` + a `ClassView`-projected mask + +plain AND) is proposed, and even its placement (beside `ClassView`, +beside `RailGraph`, or pure call-site composition) is left as a narrowed +ratification question, not a design decision made here. + +**Cross-refs:** `docs/architecture/DUMB-STORAGE-RESET-CHARTER.md` §1 +(the substrate must know only references/hierarchy/ClassView/ +WideFieldMask/DatasetVersion — this ruling is that principle applied to +the ONE gap ARC A found); `E-ARCHITECTURE-RESET-DUMB-STORAGE-HHTL- +EPISTEMIC-1` (the parent ruling this session). + +## 2026-08-19 — E-ARCHITECTURE-RESET-DUMB-STORAGE-HHTL-EPISTEMIC-1 + +**Status:** RULING `[operator]`, verbatim charter at +`docs/architecture/DUMB-STORAGE-RESET-CHARTER.md`. + +**The reset, in one line:** the substrate must know only references, +hierarchical locality (HHTL trie AND explicit reference nodes — kept as +two separate doors), ClassView, WideFieldMask-as-fovea, DatasetVersion, +and temporal coordinates; it must NOT know ontology, causality, rung, +known-unknowns, awareness, or orchestration policy — those are +interpretations layered ABOVE storage. No freeze, no batch wall, no +"persistence lag is permission to think." Epistemic PARTICIPATION +(admissibility to a current-horizon quorum) is explicitly NOT execution +PERMISSION — a stale-horizon producer keeps computing; only its evidence +is marked inadmissible until it catches up. + +**Immediate consequence:** the freeze/seal-centered implementation just +ratified in PR #968 (merged `66fec27`, minutes before this ruling) is +STOPPED. Task #25 (W1 descriptor purity → W2 digest seam → W3 FNV +deletion) does not launch on the #968 merge. The seal spec, its 5+3 +council hardening, and its falsifier corpus are preserved as research +history by exact reference (PR_ARC entry above) — not deleted, not +implemented as production architecture. + +**Deliverable order (charter §19), gated no-code-before-map (§20):** +ARC A source archaeology (lance-graph + lance-graph-java, file:line +capability matrix) → ARC B minimal dumb-storage contract → ARC C Java +mechanical integration + ontology/OSM genericity proof → ARC D +episodic/epistemic model (deferred) → ARC E orchestration meta-awareness +(deferred). 15 falsifiers pre-registered (charter §18: F-HIERARCHY-NOT- +AUTHORITY, F-TRIE-VS-NODE, F-WFM-FOVEA, F-SPARSE-INHERITANCE, +F-CONTEXT-DELTA, F-ONTOLOGY-READONLY, F-NO-FREEZE, +F-NO-BACKPRESSURE-AUTHORITY, F-EPISTEMIC-PARTICIPATION, +F-STRICT-HINDSIGHT, F-KNOWN-UNKNOWN, F-META-SECOND-ORDER, F-JAVA-PARITY, +F-DOMAIN-GENERICITY, F-NO-64K-JAVA-OBJECTS). + +**Cross-refs:** `E-CROSS-VERSION-IDENTITY-MIGRATES-BLIND-SO-IT-FAILS- +CLOSED-1` and `E-LOTUS-IS-A-REGISTER-GRID-NOT-A-BYTE-GRID-1` remain valid +findings about the STOPPED design, cited as prior art if any future arc +revisits sealed-batch identity — not superseded on their own merits, only +mooted as production direction. + +## 2026-08-19 — E-CROSS-VERSION-IDENTITY-MIGRATES-BLIND-SO-IT-FAILS-CLOSED-1 + +**Status:** FINDING (5+3 council on the cascade-seal spec, ratified v3 at +`.claude/plans/cascade-seal-register-grid-v1.md`; novel content only per +the G9 rule — petal-16 / identity-split / twice / FNV-deletion are in the +two entries below and are cited, not restated). + +**The finding:** when the durable batch identity changes hash algorithm +(FNV → the accumulated root, behind the new `seal_version` Arrow column +on `cycle_store_schema`), a cross-version fence-mismatch is +**undecidable by construction**: same-content and divergent-content +resubmissions are indistinguishable across algorithms without reading +payload bytes, and NO reconcile-adjacent path loads them — +`find_frame` projects `["batch_hash"]` only (cycle_sink.rs:577) and +`scan_sealed` mints `payload: Vec::new()` (cycle_sink.rs:1045). Adding a +read to decide it would be a post-finalization FULL-CYCLE payload rescan, +forbidden verbatim by seal req 1. Therefore the only sound rule is +**fail closed**: same-version compares exactly as today; cross-version → +`CommitError::Ambiguous` (its own doc: "may or may not be durable") → +Escalate. Gate G7(e) pins "zero payload dereferences on any reconcile +path" with an instrumented counter. + +**How it was found — the maxim worked twice on one rule:** the council +killed two successive W3 designs. v1's reconcile-by-fence-chain-alone +failed OPEN (silent accept of genuine divergence — found independently +by two savants). v2's recompute-and-compare replaced it and was then +killed from opposite ends by two reviewers: its "rows already loaded" +premise was false at the cited comparison site (hash-only projection) +AND false on the restart path (empty payload mint), while the spec's own +restatement of req 1 had dropped the load-bearing "full-cycle" qualifier +that made the conflict visible. Both withdrawals are retained in the +plan's ledger (L6, L23), not deleted. + +**Cross-refs:** the two entries below (register grid; accumulated seal); +`seal-vs-temporal-ordering-information.md` (G1's tie-density scope, +PROBE-SEAL-TIE-DENSITY now a W4 arm); I-LEGACY-API-FEATURE-GATED (the +`seal_version` gate mirrors `ENVELOPE_LAYOUT_VERSION`). + +## 2026-08-19 — E-LOTUS-IS-A-REGISTER-GRID-NOT-A-BYTE-GRID-1 + +**Status:** RULING `[operator]` (correction to the #968 seal map) + +archaeology verdict. + +**The correction, in one line:** Morton orders ADDRESSES, not payload; +Lotus closes REGISTERS, not byte buffers. The cascade holds canonical +locus + pointer/descriptor into the SoA backing store + resolved/present +state + phase + tiny digest state — never copied 512-B rows, never +materialized 8-KiB petals, never a 32-MiB image. A petal = 16 register +positions + resolved mask + pointers + digest state. Phase + canonical +register position CONSTRUCT the ordering (no sort step). The digest seam +is the ONE unavoidable flush dereference: the same hot read feeds the +Lance serializer AND the leaf digest — the checksum is parasitic on the +byte stream that must cross the membrane anyway. Identity splits +ContentRoot (final referenced content at canonical loci — superseded +bytes deliberately NOT hashed) / ControlRoot (tiny trajectory metadata) / +DatasetVersion (publication coordinate); +BatchIdentity = H(cycle ‖ base_version ‖ ControlRoot ‖ ContentRoot). +Seam A/B in the prior map was the wrong question — cast stays +content-blind (descriptor purity), freeze freezes registers not bytes. +Payload is touched exactly TWICE ever: production + the flush +dereference. Full text verbatim in CASCADE-ACCUMULATED-SEAL-SPEC.md. + +**Archaeology verdict (mandated before ratification): the substrate +EXISTS, operator-ruled, UNWIRED.** `NodeRowPacket` (canonical_node.rs:1511) +is the zero-copy SoaEnvelope over `&[NodeRow]` — deliberately NOT +Clone/Copy so a borrow cannot escape its mailbox; batch_writer.rs +Addendum-6 rules P = descriptor with flush-time `as_le_bytes`; SweepSlot +.payload's own doc says "a NodeRowPacket slice in production; bytes +here". But `as_le_bytes` has NO live caller (only the deprecated symbiont +bridge + tests) and `cast()` has zero production call sites — the +`BatchWriter>` + byte-cloning freeze path my map documented is +confirmed interim wiring. **Consequence: the seal work WIRES the declared +contract to persistence; it creates no payload Morton tree.** Map §6 +carries the full seven-question table. + +## 2026-08-19 — E-SEAL-IS-ACCUMULATED-ON-THE-HOT-PATH-NOT-A-PASS-1 + +**Status:** RULING `[operator]` (STORNO of "replace FNV with a faster +whole-cycle seal hash") + source-anchored map delivered, implementation +HELD per the STOP. + +**The ruling:** ZERO dedicated post-finalization payload pass. The +Morton/cascade working image is resident while being resolved; integrity +is accumulated ON THAT HOT PATH: petal digest while bytes are hot → +parent reduction over child digests only → cycle root ready before the +ONE Lance append → root associated with the RETURNED DatasetVersion in +the durable receipt (never a pre-write hash input). Content/cascade root += prepared-content identity; DatasetVersion = durable publication +coordinate — two concepts, kept distinct. NO whole-cycle FNV, NO +replacement whole-cycle hash, NO reread/reload, NO encryption, NO second +32 MiB image, NO Morton-order reconstruction at persist. Leaf granularity +(row 512 B vs petal 8 KiB) NOT frozen — measured at the seam. Digest +primitive benchmarked ONLY inside the architecture. X-C2-1's +locus/version findings remain constraints; X-C2-3 ECC never dictates the +hot-path checksum geometry. Full text: +`docs/lotus/CASCADE-ACCUMULATED-SEAL-SPEC.md`. + +**The map (delivered, `docs/lotus/SEAL-FINALIZATION-MAP.md`):** row +finality = freeze's per-row fold (persist_sink.rs:381-383), nothing +earlier; FNV at :402-428 called from freeze :384; FNV uniquely binds the +frame identity (cycle + base_version = A_last), the FULL landing sequence +incl. superseded intermediates, and the kanban control plane — none of +which an image-only root carries; candidate seams = cast-time (bytes +hottest; cast order IS canonical order, stream_position = base + CastId) +or fused into freeze's existing fold walk; **idempotency audit: YES — the +(cycle, batch_hash) contract can consume +H(cycle ‖ base_version ‖ landing_chain_digest ‖ image_root) directly, all +parts accumulated hot, FNV deleted entirely, no second hash, no second +pass (falsifier: payload bytes digested == produced, exactly once)**. +Honest boundary: NO 4096→…→1 cascade, NO 16-row petal, NO 64K grid exists +in the writer source today — the seal INTRODUCES the cascade over the +cycle's witness set; that is why granularity must be measured, not +assumed. OLD path touches payload ~5×(incl. the FNV rescan); TARGET ~3× +with zero hashing passes. Pre-STOP probe scaffold held uncommitted until +this map is ratified. + +## 2026-08-19 — E-E2-REVERIFIED-SCATTER-CONTESTED-PMU-ABSENT-1 + +**Status:** FINDING (independent re-verification of E2, Tier 0). + +E2's benches were standalone `rustc -O` programs (no cargo — the brief's +letter held); sources now committed under +`crates/rp-seal-t0-probe/standalone/` with `run.sh`. Independent fresh +compile + min-of-3 warm runs: + +**CONFIRMED:** FNV seal invariance (41.5/41.4/41.2 ms at b=1/4/64 — +does not amortize, forbids incremental; decision stands); b+1 byte +amplification (arithmetic + source-anchored, unchanged); the durable +boundary orders (small fsync ~0.2-0.3 ms, 32 MiB ~285 ms, per-petal +4096-file cycle ~1.5 s — non-viable, stands). + +**NOISY:** the arrow-column timing at b=64 spans 17.6-206 ms across +runs — quote the bytes formula, never this timing. + +**CONTESTED:** E2's self-disproof "random placement is FREE at 32 MiB +(0.97x)" does NOT reproduce — this run: 2.66x/2.91x/3.83x at +32/128/512 MiB (gradient reproduces, absolute does not). Resolution = +E2's own multi-machine bench3 sweep. Nothing rests on it: placement is +optional economics per §0 either way. + +**Cache-miss metric STRUCK for container probes, on measurement:** this +VM exposes NO cpu PMU (`/sys/bus/event_source/devices/` = software/ +tracepoint/breakpoint/msr/power only) — hardware counters are +impossible here, not merely unwired. Bare-metal follow-on recorded. +Discharges M13's "wire perf-event or strike the metric". + +**Tier 0 state:** T0.1-T0.3 + X-C2-1 + E2-reverify + PMU decision all +landed. E3's locality-debt metric rides the optional-economics track +(non-gating per §0) as that track's opener if placement work is ever +wanted. + +## 2026-08-19 — E-XC21-HARNESS-CONFIRMS-C2-AND-FINDS-DEAD-CODE-1 + +**Status:** FINDING (measured), X-C2-1 landed. + +**The harness** (`crates/rp-seal-t0-probe`, excluded, own workspace): +injections I1–I9 (I9 at all six cascade-congruent strides) over a +synthetic cycle, ground truth = the injection record, schemes S1U +(locus-unbound content digest — the shipped `ndarray::hpc::seal` shape) +and S6 (locus+version-bound — C2's recommendation, hash half). S2–S5 +plug into the same `Scheme` trait in X-C2-3. Zero wall-clock anywhere +(T0.3 discipline). + +**Anti-vacuity gate PASSED against REAL code, with one upgrade and one +downgrade of C2's record:** +- Control (a) reproduced on live `ndarray::hpc::merkle_tree`: corruption + at meta words 50/70/200 → `hamming == 0`. The blind zone is WIDER than + C2 recorded — words 48..56 and 64..96 are unhashed too, not just + 112..256 (BRANCH_REGIONS covers {0..48, 56..64, 96..112} only). +- Control (d) reproduced on live `ndarray::hpc::seal::Plane`: identical + content at another slot verifies `Wisdom` against the stored root — + the unbound-digest wrong-slot FA, exactly "certain for + identical/default content". +- Controls (b)/(c) — firefly `verify_ecc` (every branch returns + `Some`; literally cannot reject) and the container XOR parity — are + **unreachable by construction: the `wip` feature they live behind + fails to compile (104 errors, measured)**. M11's severity for B3/B2's + wip halves downgrades from "live defect" to "dead code wearing a + strong name"; the fault CLASSES are proven on the fold algebra + (paired-flip cancellation + permutation invariance) as harness + self-controls. + +**The measured matrix confirms C2's truth table empirically at the hash +tier:** S1U false-accepts EXACTLY the substitution class — I4 wrong-slot, +I5 stale, I6 duplicate (1/1 each, the seal travelling with the chunk) — +and nothing else; S6 has ZERO false accepts and zero false alarms across +all of I1–I9; null control 10⁶ distinct clean chunks per scheme, 0 +spurious; full-size 32 MiB pass green. The S6 kill floor (I1–I3 at +multiplicity 1) holds. Numbers dated in the probe README. + +## 2026-08-19 — E-TIER0-CANONICAL-REPLAY-LANDED-DV-IS-EPISTEMIC-1 + +**Status:** FINDING + RULING `[operator T0.3 amendment]`, all landed +red-then-green. + +**T0.1 F-PHYS-ORDER (landed, fixed).** Proven RED on the old code two ways, +compaction-free: a semantically legitimate one-lap cyclic chain sealed with +scrambled physical row order made `recover_and_apply` FAIL outright +(`StalePhase` — legitimate sealed content unrecoverable purely because of +physical placement), and the watermark was LAST-seen not MAX-seen (physical +order [2,0,1] → watermark 1 with position 2 already consumed → the next +pass re-admits it: a silent double-apply exposure SHARPER than D2's L2 +table). Fix: `recover_and_apply` sorts the owner's landings by their own +durable canonical coordinates `(cycle, stream_position)` before walking — +restart-path only, hot path untouched; the write-side ordering remains a +layout courtesy, no longer the correctness carrier. `scan_sealed` stays a +raw physical read (the canonical projection is at REPLAY — visibility is a +projection, per §0). Both falsifiers disable-verified (sort removed → red). + +**T0.2 F-QREF-STRICT (landed, pinned two-sided).** The existing test pinned +the default's VALUES; the new falsifier pins the CONSEQUENCE: under +`QueryReference::default()` — Strict in name — a future row classifies +`Contemporary` (the u64::MAX sentinel is an UNBOUNDED observer, zero +hindsight protection; documented on `default()` with the migration pointer), +while the SAME row under `at(head, 0)` is `Anachronistic` and in-horizon +rows stay admitted (the guard discriminates). Disable-verified (classify's +rejection branch removed → red). Sentinel-removal-at-construction stays the +registered Tier-1 follow-on; silently changing `default()` would be the +I-LEGACY trap. + +**T0.3 F-AWARENESS-LAG (operator amendment, landed).** The ruling, recorded: +ΔV = W_write − A_last is the primary cognitive quantity — an EPISTEMIC +metric (durable-history distance: "how far the world moved while I was +thinking"), NOT wall-clock (Δt is an economics metric). STORE COORDINATES, +DERIVE DISTANCE; no awareness_delay_ms / elapsed_time / persisted ΔV. +ΔV does not replace HLC (one version history vs cross-writer causality). +No hard replay threshold from ΔV yet — measure its distribution first +(hot-wavefront mode legitimately lands ΔV > 1; dense mode pins ΔV = 1). +**Audit result (the amendment's mandated first question): BOTH coordinates +are ALREADY durably reconstructible — no schema field added.** A_last = +`FrameMeta.base_version` (per cycle, restart-readable via `timeline()`, +hash-bound into the batch identity). W_write derives with no field: the +FENCE invariant forces `base_version(N+1) == publication_version(N)` in the +one-writer chain, so the durable timeline reconstructs every interior +cycle's W_write and the head covers the newest; store-side the Lance sink +independently has one DatasetVersion per commit + per-row +`created_at_version` (RP-SEAL A1). Falsifier proves restart recovery of +both exact coordinates + order-independent ΔV derivation by canonical +keying. `QueryReference::ref_version` documented as the reader-side A_last. + +**Gate:** planner 357/357 + fmt + CI-form clippy clean in-crate (the 5 +residual warnings are pre-existing jc/shader-driver noise, on main too). +Next per the ruled order: X-C2-1 injection harness, then E2 re-verify + +perf economics. + +## 2026-08-19 — E-REPLAY-IS-CANONICAL-COMPACTION-IS-ECONOMICS-1 + +**Status:** RULING `[operator]` (STORNO of pass-1 consolidation framing). + +**STORNO'd:** the RP-SEAL consolidation's framing that physical-layout +work gates the cognitive/meta arc. Compaction is NOT required for the +target architecture. The D2 defect, restated narrower and more serious: +**PHYSICAL ITERATION ORDER MUST NOT DEFINE SEMANTIC REPLAY ORDER.** Fix +by canonical replay coordinates/order — never by physical reordering or +compaction. Separately: permanent temporal replay requires a +retention/tombstone policy under which historical knowledge states +remain reconstructible indefinitely. + +**The desired model (verbatim):** physical placement may remain +arbitrary · physical fragmentation may remain arbitrary · tombstoned +state remains historically addressable · semantic replay order is +canonical · current visibility is a projection · historical visibility +is a QueryReference projection. Compaction, if ever enabled, is only +optional storage economics — neither semantic repair nor a prerequisite +for cognition. + +**Applied:** consolidation doc §0 (`docs/lotus/RP-SEAL-CONSOLIDATION- +PASS1.md`) with ⊘-marked in-place corrections; Tier 1 reordered +(canonical coordinates №1, retention/tombstone №2, QueryReference +projection fixes №3); all layout/compaction items reclassified optional +economics; F-NOCOMPACT promoted from soak test to the default operating +description. Corrects the gating framing in +`E-RP-SEAL-PASS1-THE-MAXIM-WORKED-1` (its findings stand; their +consequence inverts — M2/M12 are reasons compaction stays off). + +## 2026-08-19 — E-RP-SEAL-PASS1-THE-MAXIM-WORKED-1 + +**Status:** FINDING (consolidated), first independent pass complete. + +**The event.** The RP-SEAL 15-researcher independent pass (run +`wf_ca974718-1b4`, 15/15 cells, 0 errors, no cross-talk, blind to boards) +completed and was consolidated per charter §12–§13: +`docs/lotus/RP-SEAL-CONSOLIDATION-PASS1.md`, with all 15 reports + the +orchestrator pre-pass committed as Appendix H under `docs/lotus/rp-seal-v1/`. + +**What died (charter §17 executed):** the phase/comma coefficient schedule +(C2 adversary: 0/6 conditions, syndrome separation impossible under +permutation; C1+C3 independently bound cascades ≥33% overhead / priced in +distance — three disjoint routes, one kill); unconditional Morton/SFC +default (B2 measured + B3 literature: identical page partition to Hilbert +at 4^j pages, 20–45× quantizer hot-spots, three proven negative results); +"compaction = one manifest publication" (reserve_fragment_ids is itself a +commit); the naive query+repair one-grouping hope (Morton locality +MANUFACTURES the correlated failure that kills locality-aligned parity). + +**What was found:** the coalescing path writes MORE bytes than no +coalescing — physical amplification = b+1 (65× at b=64) from 512 B null +padding per landing row, and 52% of seal CPU is a non-amortizing FNV hash +(E2); 11 arrival/physical-order leaks into durable coordinates, worst +L2: durable semantic replay order IS Lance physical scan order, so +compaction here MUTATES semantics (D2) — this gates all layout work; +five shipped seal paths with defective/false-accept behavior wearing +strong names (C2 §B1–B5, firefly independently by C3); Lance 9.0.0 +already ships the whole compaction/remap/stable-row-id/per-row-version +apparatus unused by our append-only path (5 cells concordant). + +**What survived, sharpened:** boring hash + row/column P+Q over the native +64×64 (6.25%, 63× repair amplification vs flat-RS 4095×) as the seal +baseline; the caller-supplied compaction-rewrite ordering key as the ONE +open precedented upstream seam (in-repo R-tree Hilbert leaves + Delta +Z-order as precedent; IndexRemapper usable today); two genuine +NOVEL-CANDIDATES with no prior art found by independent searches — the +joint query-scatter × repair-scatter address-order question (refined by +C2's anti-synergy into "query-aligned order, ANTI-aligned parity groups") +and the STRICT/AWARE/RETRO reader-rung admission tier (D3: no literature +counterpart; D1: currently inert in code, T_now missing as a type, +hlc_tick not actually HLC). + +**Scope-pivot filter:** PASSED — zero findings sourced from rustynum or +symbiont; the two mentions cite the exclusion ruling, and D1 converts it +into a finding (the version→kanban OUT-bridge lost its only caller). + +**Tier 0 before anything else:** pin D2's leaks (F-PHYS-ORDER first), +re-verify E2, X-C2-1 injection harness over the five seal paths, E3's +locality-debt trigger metric, perf-event or strike the cache-miss metric. +Full matrix M1–M15 + tiering in the consolidation doc. + +## 2026-08-18 — E-PIN-LANCE9-LANCEDB033-DF541-ARROW58-NO-DF53-1 + +**Status:** RULING `[operator]` + same-day discharge, measured. + +**The ruling.** lance 9 / lancedb 0.33 / datafusion 54.1 (**no DF 53**) / +arrow 58 are ALWAYS pinned across AdaWorldAPI forks, usually consumed via +`[patch]` of the upstream repository git. DF 53 existed only for older syntax +in an out-of-scope research crate; all of lance-graph is DF-54-certified, +and single-major DF 54.1 is the discipline ("without DF 53/54 parallelism +it's much better, easier, faster to handle"). + +**Measured before acting:** the lock carried datafusion 53.1.0 AND 54.1.0; +the ONLY DF-53 source was `deltalake 0.32.4` (`^53.1.0`) behind the `delta` +feature — which was already NON-default and documented BROKEN (0.32 removed +`DeltaTableProvider::try_new`; the reader was never refactored). Checked the +registry: deltalake-core tops out at 0.32.4 / DF ^53.1.0 — no DF-54 deltalake +exists, so a bump could not discharge the ruling; removal could. + +**Discharged:** `delta` feature + `deltalake`/`url` optional deps + +`DeltaTableReader` removed (Cargo.toml carries the dated removal note; a +future Delta reader returns only with a DF-54-compatible deltalake, as its +own deliberate PR). `DataSourceFormat::Delta` (a catalog metadata tag) stays. +**Post-removal lock: exactly ONE datafusion = 54.1.0; zero deltalake +entries.** `cargo check -p lance-graph` green (needed `protobuf-compiler` +installed in-sandbox — lance's prost build; the Dockerfiles already install +it). Docker pins surveyed on request: root + avx512 Dockerfiles = Rust +1.97.1 + protobuf-compiler/cmake, no feature references to delta, versions +purely from Cargo.lock — removal is docker-safe. The symbiont +Dockerfile's stale `rust:1.95` pin is MOOT: **symbiont is DEPRECATED** +(operator, same day — superseded by the supervisor/persistence arc, +PRs #879/#911/#912/#913) and is not live surface. + +**Same-day scope pivot (operator, BINDING for RP-SEAL):** rustynum is NOT a +source of truth — "no rustynum, everything ndarray"; it is the historical +donor already ported into AdaWorldAPI/ndarray. The RP-SEAL workflow script +was corrected in place (source map + the two cell briefs naming rustynum); +the in-flight independent pass could not be force-stopped in this harness +build, so the ruling additionally binds consolidation as a hard filter +(re-anchor or surgically re-run any finding citing rustynum/symbiont). +Deltalake removal ratified in the same exchange ("we don't need deltalake"). + +**Drift cleanup executed (same day, on the operator's "absolute no-go"):** +audit result — A1's research report: 0 citations (clean); the Java/Panama +arc: zero involvement (ndarray::simd enforced throughout); merged docs +carried exactly one live symbiont citation (the lotus audit §3 candidate +row, now ⊘-struck) + CLAUDE.md's two symbiont-as-binding-consumer lines +(now ⊘-annotated). Live-code drift found and FIXED: +`lance-graph-cognitive`'s `rustynum_accel` shim was name-only (zero +rustynum dependency — it delegated to `ndarray::hpc::bitwise`); renamed +`simd_accel` (module + file + 11 call sites) and rerouted through the +sanctioned `ndarray::simd::hamming_distance_raw` re-export. Default +compile green; the `wip` feature's pre-existing not-yet-compiling state +carries zero errors naming the rename. Historical provenance comments +("replacing rustynum as of 2026-03-22", ndarray's port-history docs) kept +— the no-go bans USE, not history. Board history entries citing symbiont +stay append-only, superseded by this entry. + +**Same-day factual correction (operator-pointed, verified at source):** the +"no DF-54 deltalake exists" premise holds only for crates.io RELEASES +(deltalake-core <= 0.32.4 / DF ^53). delta-io/delta-rs **main** already pins +`datafusion = 54.0.0` + `arrow = 58` (workspace Cargo.toml, fetched +2026-08-18) — so restoration is available NOW via the house mechanism (git +dep on the upstream repository, pinned rev) + a `DeltaTableReader` refactor +to the current builder API. The removal stands on the NEED ruling, not on +availability; the in-repo notes were corrected so no future session treats +restoration as blocked on a registry release. + +**Second discharge — the lotus BLOCKER:** the [patch → upstream-git] +mechanism sanctioned consulting the upstream lance repository as source; the +exact v9.0.0 tag is cloned (`/tmp/sources/lance-9`, matching the Cargo.lock +checksum) plus current upstream (`/tmp/sources/lance-main`) for the RP-SEAL +two-column discipline. D-LOTUS-6's "lance source absent" BLOCKER is LIFTED; +capability findings deliberately enter through the RP-SEAL Domain-A +independent passes, not this entry (independence rule). + +**Supersedes in place:** CLAUDE.md's "BOTH MAJORS ARE REQUIRED — do NOT fix +Cargo.lock to one" datafusion note (written when `delta` was default and +load-bearing) — corrected in the same commit. + +## 2026-08-18 — E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1 + +**Status:** FINDING (VERIFIED at file:line) + pre-registered falsifier landed +(LOTUS research charter Phase 0/1; docs: `docs/lotus/LOTUS-FRONTIER-AUDIT.md` ++ `docs/lotus/F-ORD-REAL-FALSIFIER.md`). + +**The defect chain.** `BatchWriter::cast` mints `CastId` at ARRIVAL +(`batch_writer.rs:132-138`) → `collect_casts` derives `stream_position = +position_base + cast.0` (`cycle_driver.rs:385`) → `freeze` stable-sorts by it +(`persist_sink.rs:378` — storage ORDER is safe) → **`content_hash` folds the +`stream_position` VALUES into `batch_hash`** (`persist_sink.rs:414`). The +publication identity — the durable `(cycle, batch_hash)` idempotency key — +therefore depends on producer completion order. The struct's own doc +(`persist_sink.rs:359-362`, "Identical completed sets yield identical hashes +regardless of worker completion order") is FALSE today. The row-keyed `image` +leg HOLDS (identity-derived `row_of(owner)`); the restart leg was already +answered (durable `position_base`, falsifier at `cycle_driver.rs:1460`). + +**Landed with this entry:** the GREEN two-sided defect pin +(`f_ord_real_defect_pin_arrival_order_leaks_into_batch_hash` — anti-vacuity: +perturbation provably reaches the key mint; semantic set + image asserted +arrival-INDEPENDENT; hash asserted arrival-DEPENDENT) and the `#[ignore]`d +RED falsifier (`f_ord_real_publication_identity_is_arrival_order_independent` +— red under `--ignored`, hashes 2604999916736672513 vs 4858955943411201665 on +the real chain). Fix mechanism deliberately unprescribed (four candidates in +the falsifier doc, per-workload per the linear-vs-tile split below). + +**Three adjacent verified tensions recorded in the audit, not fixed here:** +(1) `SweepSlot::stream_position`'s contract says "the caller's EXISTING +canonical (textual/stream) order key… NOT a new coordinate" +(`persist_sink.rs:168-183`) while `collect_casts` MINTS it — for linear/text +workloads the fix is carrying the true semantic position (then hashing it is +CORRECT); for tile workloads identity-derived placement; per-class resolution, +never one global rule (operator: "texts are organized linearly; GridLake +tiles would make it contradictory"). (2) The descriptor doctrine +(`batch_writer.rs:30-39`, "P is a DESCRIPTOR — never owned delta bytes") is +unrealized: the only production-shaped instantiation is `BatchWriter>` +→ batch resident up to 3× at seal (staging + image clone + retry clone). +(3) The seal is O(batch bytes) ×3 passes (repair sort + clone + byte-wise +FNV) — `order_cycle_stably`'s own doc already concedes the constructive +scatter alternative (`persist_sink.rs:126-129`). + +**Session BLOCKER, flagged loud:** the lance crate source is ABSENT from this +sandbox (zero `lance*` under the registry; family pinned `=9.0.0`) — the +prepared-artifact capability audit (fragments/Transaction/cleanup/blob) is +UNVERIFIABLE from source this session; Phase 6 of the charter is gated on a +`cargo fetch` or operator-sanctioned source consult. Also owed: the +`temporal.rs:396`/`:410` doc-drift (cites the RETIRED `DurableWitness` / +`DurableCoordinate` as production implementor) — correction folded into the +next phase PR. + +## 2026-08-18 — E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1 + +**Status:** FINDING + fix (cross-session: found by the lance-graph-java +session, verified independently by the ruff/R2IL session at `db488f5`, +ownership handed to lance-graph-java's session; this is that sync). + +**The drift.** `lance_graph_contract::ogar_codebook` documents itself as a +wire-compatible mirror of OGAR `ogar_vocab::ConceptDomain` under an +explicit both-sides-update-together drift guard — yet its enum ended at +`Geo` (0x0F) while OGAR carries `Ontology` (0x03, POPULATED since the +DisMech 0x0333 mints, OGAR #275), `Blocks` (0x17, since 2026-08-04), and +the C-band `JavaRuntime`/`Analytics`/`BinaryLifting` (0xC0/0xC1/0xC4, +OGAR #276+#277 — the altitude ruling: the domain byte is stratified by +layer; 0xC0 is **Panama FFM alone**, Valhalla being a property of the C0 +vocabulary, not an addressable concept). + +**Why the guard never fired — the real lesson.** `lance-graph-ogar`'s +`domains_agree` + `assert_codebook_parity` only walk ids that carry +CONCEPT ROWS. A reserved-EMPTY domain added to one enum but not the other +is invisible to a codebook-content walk — the exact class of drift a +DOMAIN mirror exists to catch. Proven live: the first disable-run +(dropping the new `BinaryLifting` pair from `domains_agree`) stayed GREEN +— the pairing was vacuously guarded until this PR added +`reserved_empty_domains_agree_across_the_mirror`, which pins one id per +new/reserved domain, the populated 0x0333, the deliberate 0xC2–0xC3 gap, +the band edges, and the 0x0C/0xC0 digit-swap two-sided. Both disable-runs +(bridge pair dropped; contract arm dropped) now go red on exactly that +test; the contract's own `domain_routes_on_high_byte` independently +catches the arm removal. + +**Scope, stated:** DOMAIN-level sync only. Codebook CONTENT parity was +re-run and is green (`assert_codebook_parity`); the R2IL container-concept +mints under 0xC4 arrive with the ruff arc's PR3 and will rebase trivially +on this. Pre-existing `lance-graph-ogar` clippy warnings (11, measured +identical with this diff stashed) left untouched. + +## 2026-08-17 — E-IDENTITY-QUAD-4X24-RATIFIED-PERMANENT-1 + +**Status:** RULING `[operator]` — explicit, in-session decision, not a +code-derived inference. Closes `ISS-IDENTITY-QUAD-WIDE-CARVING-HOME`. + +**Operator:** *"the 4x24 layout was already sanctioned and added as canonical +in lance-graph, look for quad 4x24"* — answering the three-option question +`ISS-IDENTITY-QUAD-WIDE-CARVING-HOME` raised (2026-08-06): ratify the +carving as permanent (option 1), mint a new sanctioned layout and migrate +(option 2), or reject it (option 3). The ruling is option 1. + +**What changed.** `lance_graph_contract::identity_quad`'s 4×24 contiguous +payload — read/written through `legacy_outliers::LegacyOutlier::WideTriple` +(G2) — is now the **permanent, canonical home** for this identity tenant, not +a V1-migration waiting-room resident awaiting promotion. The module doc's own +"whether the carving deserves promotion … is an operator question, not one to +settle in code" sentence is now stale and has been replaced with the +ratification. `le-contract.md` §3a (which discourages G1–G3 wide carvings in +general, and says new classes must not be born into them) gained a one-line +cross-reference naming this tenant as the sanctioned exception, so a future +reader of §3a does not read the general discouragement as covering it. +`ISS-IDENTITY-QUAD-WIDE-CARVING-HOME` is closed with the same reasoning +inline. + +**What did NOT change.** Option 2 (mint an L9-class layout, move the bit +primitives out of `legacy_outliers` into their own module) was explicitly not +taken — the code stays exactly where it was. The honest-cost accounting the +module doc already carried (no byte axis, not shift-addressable, `group_of` +does not apply) is unchanged: ratifying the carving as permanent settles +*where* it lives, not what it costs. `ISS-IDENTITY-CODEBOOK-ORDINAL-STABILITY` +and the Amendment's pinned-join-key-slot requirement are also unaffected in +substance — the join-key invariant now resolves *within* `identity_quad` +rather than in a hypothetical new layout module, since option 2 did not land. + +**Also settled this session, recorded for completeness:** a separate question +about a term `WideClassView` (zero occurrences anywhere in this repo) was +raised and the operator's answer was that it was a typo with no referent — +dropped entirely, nothing to scope or build. + +**What this unblocks.** A downstream consumer's identity-tenant work — the +join-key-slot pin specifically — was explicitly waiting on this ruling before +proceeding (per the Amendment in `ISS-IDENTITY-QUAD-WIDE-CARVING-HOME`, which +named the carving-home question as a precondition for pinning the join key). +That work is unblocked as of this entry. + +## 2026-08-13 — E-A-FIGURE-YOU-TALLIED-YOURSELF-IS-A-DERIVED-FIGURE-1 + +**Status:** FINDING `[G]` — corrects two figures in +`E-THE-REAL-GATE-RAN-AND-QUALIFIED-NOT-RETRACTED-THE-CLAIM-1` (below) and in +PR #950's plan/board/PR-body text. **Confidence:** High. Append-only +correction; the wrong entry is left standing beneath this one, per the +storno rule. + +**The wrong figures.** `D-WXS-8`'s bar-B7 tallies were written as +*control 16/16 PASS, primary 10/16 PASS (6 FAIL)*. Counted from the committed +`probes/weather-p1/fixture/fidelity_probe_results.json`: + +| | written | **actual** | +|---|---|---| +| B7 control (per-variable floor must LOSE) | 16/16 | **19/19** | +| B7 primary (ρ_shared ≥ 0.9996) | 10/16 (63 %) | **9/19 (47 %)** | +| per season (primary) | — | winter **2/9**, spring **4/5**, summer **3/5** | + +There are **19** cross-unit pairs, not 16 (winter 9 + spring 5 + summer 5); +the same-unit pairs (K×K, m/s×m/s) are informational and correctly excluded +from the bar, and I dropped them from the denominator inconsistently. + +**Why the direction matters, not just the arithmetic.** 10/16 reads as +*"mostly passing, six close misses."* 9/19 reads as *"the strict bar fails on +a **majority** of cross-unit pairs."* Both describe the same measurements — +the per-pair ρ values were all carried correctly — but only the second is +what the data says. The KILL-gated control is unaffected and in fact better +(19/19), so **no conclusion reverses**; what changes is that the primary bar's +shortfall was under-reported. + +**The precise diagnosis, and it is narrower than "check your figures".** +Every number the program *computed and printed* — 56 verdicts, 42 pass / +14 fail, every individual ρ — was carried into the writeup correctly. The +**only** two wrong numbers are the ones I produced by **counting rows in +terminal output by eye**. The pipeline was sound; the tally was not. + +> **A figure you tallied yourself is a DERIVED figure, and a derived figure +> needs the artifact exactly as much as a measured one does.** "The audit must +> terminate at an artifact" is usually applied to *citing* a number. This is +> its narrower and easier-to-miss form: **producing** a number by counting, +> summing, or eyeballing a listing is itself an unverified derivation, even +> when every input to it is verified. + +**Mechanical fix, now in use:** any count, rate, or ratio that appears in a +writeup is computed from the committed artifact in the same command that +prints it — never transcribed from a previous run's stdout, and never +tallied by reading a list. + +**Reach.** The error reached `main` through PR #950 in four places: the plan's +W3 RUN section, the `STATUS_BOARD` `D-WXS-8` row, the epiphany below, and the +PR body. The first three are corrected (in-place for the plan and board, which +are not append-only ledgers; by this prepended entry for `EPIPHANIES`). **The +merged PR body cannot be corrected** — treat #950's body as carrying the +superseded figures and this entry as authoritative. + +**Cross-ref:** `E-THE-REAL-GATE-RAN-AND-QUALIFIED-NOT-RETRACTED-THE-CLAIM-1` +(the entry corrected), `E-A-FIGURE-CITED-TWICE-IS-NOT-CONFIRMED-ONCE-1` (the +citing form of the same rule), `E-A-DISABLE-PROBE-CAN-ITSELF-BE-VACUOUS-1` +(same session, the verification layer), `.claude/plans/weather-soa-bake-v1.md` +W3 RUN (the corrected block, carrying the same ⊘ note). + +--- + +## 2026-08-13 — E-THE-REAL-GATE-RAN-AND-QUALIFIED-NOT-RETRACTED-THE-CLAIM-1 + +**Status:** FINDING `[G]` — measured, real live-fetched grid data, 3 seasons, +`jc::reliability::spearman`, disable-sanity-checked. **Confidence:** High. + +**What ran.** `D-WXS-7`/`D-WXS-8` — the gate this arc had been treating as +blocked behind the classid mint for four consecutive statements +(`E-...` — see the same-day correction entry above this one) turned out to +need none of it. Once corrected, it ran the same day: real ARCO-ERA5 fetch +(public HTTPS, 404=NaN=valid-missing-chunk semantics), 3 real calendar +seasons found by a live availability sweep (not assumed — a first attempt at +4 fixed 2021 anchors found only 3 variables present at ALL of them), +200,000-pair sampling at the exact `floor.rs` quantisation, scored with +`jc::reliability::spearman` (added to `weather-poc` as a **dev-dependency +only** — the default `[lib]` build stays zero-dep). + +**Two results, and they cut in different directions on the SAME underlying +claim — recorded together because reading either alone would mislead.** + +1. **`D-WXS-7` (bar B6): the K×K pair does NOT replicate an earlier + near-miss.** The plan's own §0.3 cites a smaller-scale measurement — + K×K = 0.999556, below the 0.9996 bar — as the reason the bar "can fire" at + all. At real grid scale, 3 real seasons, computed with `jc` not `scipy`: + 0.999909 / 0.999895 / 0.999684. Clears the bar with margin, every time. + The earlier number is not wrong or retracted — it was a real measurement + on a real, smaller fixture — but it no longer licenses "the substrate's + fidelity is marginal" as a grid-scale conclusion. + +2. **`D-WXS-8` (bar B7): the core claim holds; two literal thresholds do + not.** The KILL-gated control — per-variable floors must LOSE on every + cross-unit pair — passed **16/16**, by a wide margin (0.245–0.939 vs + 0.9987–0.9999). The KILL did not fire; the shared-floor design is not + refuted. But the PRIMARY bar (ρ≥0.9996 exactly) missed on 6/16 pairs + (close misses, 0.9987–0.9996, skewed toward wind/pressure), and the + stay-silent twin's **"zero empty buckets"** half — carried verbatim from + a 1-timestep/3-variable fixture — failed at **all three** real seasons + (38–45 of 256 empty). Read plainly: a percentile-trimmed window pooled + across more variables at real grid scale necessarily leaves some slack + for any one variable's narrower distribution. Unsurprising in direction; + simply never re-verified at scale before this run. + +**The reusable shape: a KILL clause and a PRIMARY/twin bar are not the same +severity, and a report that collapses them loses the finding.** This run had +three tiers of outcome on ONE deliverable — a KILL that did not fire (nothing +retracted), a strict numeric bar that partly missed (a real gap, reported), +and an EARLIER measurement that did not replicate at the new scale (a +correction, not a failure). Flattening any two of those into one sentence — +"D-WXS-8 failed" or "D-WXS-8 passed" — would have been wrong either way. The +discipline that produced a correct report here: apply every pre-registered +verdict literally, print every one including the FAILs, and only THEN decide +what the KILL clause specifically licenses. + +**Sanity check before trusting any ρ:** the shuffled-decode arm was verified +to be a genuinely different array from the unshuffled one (range `[0, 4.92]` +vs `[0, 202]`, not a copy or a stub) before its collapsed ρ (0.02–0.024) was +read as a real result rather than a pipeline artifact. + +**Cross-ref:** the same-day correction above (`D-WXS-7` was never blocked); +`.claude/plans/weather-soa-bake-v1.md` sec 4 W3 (bars B6/B7, verbatim); +`probes/weather-p1/p2_probe.py` (the fixture-scale predecessor); `E-A-DISABLE- +PROBE-CAN-ITSELF-BE-VACUOUS-1` (the same session's sibling method finding). + +--- + +## 2026-08-13 — E-A-TOTAL-FUNCTION-THAT-CANNOT-REFUSE-IS-A-CORRUPTION-PATH-1 + +**Status:** FINDING `[G]` — two measured instances, one crate, one hour. +Found by codex review on PR #948; the second by following the first to its +class. **Confidence:** High. Mechanism measured, not inferred. + +**The shape.** `CalibratedFloor::quantize(f64) -> u8` is **total**: every input +returns a valid-looking bucket. It has no way to say *"that was not a +measurement."* Measured behaviour on non-finite input: + +| input | bucket | why | +|---|---|---| +| `NaN` | **0** | `f64::clamp` **propagates** `NaN` rather than clamping it, then Rust's float→int cast saturates and sends `NaN` to zero | +| `-inf` | **0** | clamps to the low rim | +| `+inf` | **255** | clamps to the high rim | + +Every one of those is a **legitimate** bucket. `0` and `255` are the ordinary +saturation values; `bucket_center(0)` is a real number near `lo`. Nothing +downstream can distinguish the result from a genuine reading. + +**Why this was live and not theoretical.** ARCO-ERA5 is sparse *by design*: +`probes/weather-p1/README.md` §1 records `fill_value: NaN`, that several +variables 404 at the arc's **own fixture timestep**, and that in Zarr v2 a +missing chunk means all-`fill_value` — so **a 404 is valid store semantics, not +a fetch failure**, and *"any ingest must treat 404 as data."* The 404-ing list +at that timestep includes five variables the W1 field set actually packs. + +**Instance 1 — the store path** (`lane.rs::pack_facet`, codex P1). An absent +field would have been written as plausible low-bucket measurements and read +back through `bucket_center` as ordinary numbers. This is the reserved-slot +rule — *"a reserved slot must not read back as a plausible number"* — defeated +one level deeper, where the existing guard could not see it. + +**Instance 2 — the INSTRUMENT path, and it is worse** +(`floor.rs::saturation_of`). That function scores *"an ARBITRARY external +population"* by counting rim buckets — and non-finite input lands **on the +rim**. An all-`NaN` population would have scored `1.0`: **"completely +saturated" when the truth is "no data at all."** Those are opposite findings +and the bare fraction could not tell them apart. It is bar B2's instrument, so +the corruption would have propagated into a *measurement* rather than a stored +value. + +> **The sharpening worth keeping: a corrupted stored value is bad; a corrupted +> INSTRUMENT is worse.** A bad value is one wrong row. A bad instrument is +> every conclusion drawn with it, each of which looks sound and carries no +> trace of the defect. When a finding lands on a total function, check its +> *measurement* call sites before its storage call sites. + +**The other half of the same mistake — do not silently drop.** Skipping +non-finite values without reporting them is equally wrong: the caller never +learns the population was partly or wholly absent. The fix therefore +**reports**: `saturation_of` returns `SaturationScore { fraction, finite, +non_finite }`, matching this crate's standing shape (`calibrate` and `decode` +return `None` on a degenerate case rather than inventing a number) and the +`D-WXS-12` rule that *the degenerate case must be reported, never folded as +`0.0`*. + +**Where the guard belongs.** At the boundary where an external value enters +the register — not inside the hot primitive. `quantize` keeps its signature +(changing it ripples through every call site); `pack_facet` refuses, and +`saturation_of` excludes-and-counts. `calibrate` was checked and is **clean** +— it already filters `is_finite`, so the hole never reached calibration. Every +`quantize` call site in the crate is now either guarded or provably finite. + +**Generalizable check, cheap to run:** for every total function that maps a +wider domain onto a narrower one — quantisers, clamps, `as` casts, +`unwrap_or`, saturating arithmetic — ask *what does an invalid input return, +and is that return distinguishable from a valid one?* If the answer is "a +valid-looking value", the function cannot refuse, and every call site is a +corruption path until one of them does. + +**Cross-ref:** `E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1`; +`E-A-DISABLE-PROBE-CAN-ITSELF-BE-VACUOUS-1` (same session, the verification +layer); `.claude/plans/weather-soa-bake-v1.md` §4 bar B2 (the instrument); +`probes/weather-p1/README.md` §1 (the store semantics); PR #948. + +--- + +## 2026-08-13 — E-A-DISABLE-PROBE-CAN-ITSELF-BE-VACUOUS-1 + +**Status:** FINDING `[G]` — three measured instances in one session, all mine. +**Confidence:** High. Method-level; no code claim. + +**The known rule it extends.** This workspace already holds *"an assertion +implied by the code it tests is not a test"* (`CLAUDE.md` § falsifiability rule) +and, in the sibling repo's words, *"turning a knob that does not bind is not a +disable."* Both are stated about **tests**. This entry records that the same +failure applies one level up — to the **verification probe** that is supposed to +prove a test can fail — and that it is harder to spot there, because a broken +probe and a passing suite look identical. + +**The three instances, same session, gating `crates/weather-poc`.** + +1. **Wrong symbol name.** A probe searched for `ManifestError::DuplicateSlot`; + the real variant is `SlotCollision`. The substitution script aborted, the + test run afterwards executed **unmodified code**, and reported `25 passed`. + Read casually, that is a passing disable-verification of a guard that was + never touched. +2. **Dead code.** A probe inserted an `if` block computing `lo`/`hi` and + discarding both (`let _ = (lo, hi);`). It applied cleanly and changed + nothing. `25 passed` again. +3. **Wrong target.** A probe changed `raw` to `raw.max(1)` intending to make + reserved slots decode — but the unpack loop only visits **manifest-resolved** + slots, so the edit could never reach a reserved one. `33 passed`. + +Instance 1 is the dangerous one: 2 and 3 at least ran, while 1 silently did not. + +**The signature that separates the two causes.** A disable run that stays green +has two possible explanations — *the guard is absent* or *the probe never +touched it* — and greenness alone does not distinguish them. What does: a +correct disable kills **at least one** test, and usually a small, nameable set. + +> **A disable that kills ZERO tests is more likely a broken probe than a missing +> guard.** Treat zero as "re-check the probe", never as "verified". + +Corollary, the mechanical fix now in use: **the probe must assert that it +applied.** Every substitution asserts its pattern was found and the file +actually changed, and fails loudly otherwise — so instance 1 becomes an error +instead of a green run. + +**Why this is worth a board entry rather than a shrug.** The whole +disable-the-fix discipline exists because a passing test proves nothing about +whether it *could* fail. If the probe that establishes that is itself unchecked, +the discipline has an unverified root and inherits exactly the confidence it was +built to withdraw. Three instances in one session, by an operator applying the +rule deliberately, is the measured argument that the root needs checking too. + +**Cross-ref:** `E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1`, +`E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1`, +`E-ANTI-EIGENVALUE-MACHINERY-CAN-ITSELF-BECOME-THE-EIGENVALUE-1` (the same +one-level-up move, applied there to guards rather than probes); +`CLAUDE.md` § The falsifiability rule. + +--- + +## 2026-08-12 — E-THE-REGIME-LADDER-MEASURED-RANGE-NOT-TURBULENCE-1 + +**Status:** FINDING `[G]` — measured, same run, found by an operator +question rather than by any gate. Qualifies +`E-THE-HYPOTHESIS-REFUTED-CLEANLY-AND-REVERSED-1`, written one commit +earlier, whose *stronger* half it withdraws. + +**The operator asked: do we have a storm-modelling problem, since we do +not actively model vortices?** Checked, and the answer is yes, twice over. + +**First, the plain fact.** `substrate_comfort_d_cz_2_7.py` loads **only** +`mean_sea_level_pressure`. No wind, no vorticity, no rotation enters any +bar. D-CZ-0/1 fetched 10 m winds solely to *report* `spd_sigma`; nothing +consumed them. R4 "STORM" is a **scalar pressure-gradient** regime, and +the hypothesis it was built to test was about *"high velocity differences +/ turbulence"* — a dynamical property that appears nowhere in the +measurement. + +**Second, the confound that follows.** Chasing the question produced two +measurements that qualify the previous entry: + +| relationship | statistic | +|---|---| +| `L` vs the cell's `saturation` | Pearson **+0.917** (n=8) | +| `L̄[T]` vs the regime's own value range | **Spearman +1.000 — perfect** | + +`L` is essentially *how much of the target falls outside the donor's +codebook range*. A regime's own range determines how hard it is to cover +— R4's is ~**18×** R1's. So C3's monotone rise **restates the width +ordering**, which the `|∇p|` ladder itself produced (deeper low ⇒ steeper +gradient ⇒ wider range). Width is not the whole story — `R3 → R2` has a +*wider* donor yet 0.949 saturation, because the boxes sit at different +absolute pressure levels — so the real driver is **coverage** (width AND +offset), which `saturation` captures directly. + +C4 is inflated the same way: `Δ` was amended to RMSE **in Pa**, and RMSE +scales with range, so an absolute-Pa margin cannot be compared across +regimes differing 18×. Normalised as a ratio it reads **3.96 / 1.85 / +1.14 / 2.35** — not monotone, and R1 is the extreme, not R4. + +**What survives / what is withdrawn:** + +- **SURVIVES:** the hypothesis is **NOT SUPPORTED**. No sign flip in + either measure, normalised or not; `CAL-ABS` wins its own diagonal in + all four regimes. Unaffected by the confound. +- **WITHDRAWN:** *"cleanly reversed, monotonic"* and *"storms are LESS + forgiving of bad calibration."* As measured that says **wide-range + boxes are harder to cover with a foreign codebook** — arithmetic. + +**Why no gate caught this.** C1c *did* pass, and it was the right gate to +have — but it measured the structure of the **`|∇p|` field** (decay +length, Gini, tail ratio), not rotational structure, and the confound is +between the ladder's own discriminator and the codebook's coverage, not +between two regimes. A gate cannot catch a confound that lives *inside* +the variable it was told to trust. **The operator's question was the +instrument here; nothing in the apparatus was positioned to ask it.** + +**The transferable rule.** *When a regime axis is built from a scalar +derived from the same field the codec quantises, the axis and the codec's +difficulty are not independent.* Before reading a cross-regime encoding +result as physics, check whether the regime discriminator predicts the +encoding's own failure mode — here, `|∇p|` predicts range, and range +predicts saturation, and saturation IS `L`. A dynamical hypothesis needs +a **dynamical** discriminator (ζ = ∂v/∂x − ∂u/∂y, Okubo–Weiss) and a +**range-normalised** transfer metric, or coverage will masquerade as the +finding every time. + +**Filed as D-CZ-8**, the pre-condition for re-asking C3/C4 as a turbulence +question rather than a width question. + +## 2026-08-12 — E-THE-HYPOTHESIS-REFUTED-CLEANLY-AND-REVERSED-1 + +**Status:** FINDING `[G]` — measured, both pre-registered bars, one run. +`probes/weather-p1/substrate_comfort_d_cz_2_7.json`, plan §7. + +**The hypothesis this whole plan existed to test is refuted, and refuted +in the SHARPEST available form: not "no effect", but a clean monotonic +reversal.** The operator's hypothesis — *a badly-calibrated substrate +that maps dynamically preserves MORE structure in strong storms than a +well-calibrated absolute one* — was tested two ways, pre-registered, on +an equal-budget cross-swap over four regimes (calm → ocean → active → +storm): + +- **C3 (transfer loss)** required `L̄[R4] < L̄[R1]`. Measured: + `L̄` = **0.011 → 0.309 → 0.671 → 0.690**, R1→R4 — a **62× increase**, + monotonic across all four tiers. Storms are *less* forgiving of a + foreign absolute calibration, not more. +- **C4 (the crossover)** required a sign flip against the diagonal — + absolute winning in calm, dynamic winning in storm. Measured: absolute + wins its own diagonal in **all four** regimes, and its margin **grows** + from ~1 Pa (R1/R2) to **10.78 Pa** (R4) — the opposite of a crossover. + +Both measures point the same direction. This is not two noisy nulls; it +is one coherent, reversed relationship measured twice by independent +instruments (`ρ` on rank vs RMSE on the diagonal). + +**A real construction bug was found and fixed en route, via the gate +designed to catch exactly this class of defect.** C0 — *"both controls +must be WORSE than every real arm in every regime; if either matches a +real arm anywhere, that cell measures nothing"* — failed on its first run +in R1 and R4: `GEO-DEGENERATE` was built from `truth[:len//64]`, the +first slice of an array already shuffled by `rng.choice` for equal +budget. A random subsample of a flat array is not reliably narrower in +range than the whole array; that is a materially different construction +from D-CZ-1's correct one (`p[si,sj][:n_i,:n_i]`, a genuine 2-D corner). +Fixed by carrying each regime's full 2-D box alongside the flat +evaluation sample and building the degenerate donor from a real spatial +corner. **Disable-verified**: reverting to the flat-slice construction +reproduces the exact original failure; the fix reproduces the identical +real-arm numbers (C2–C6 unchanged) while making C0 pass cleanly in all +four regimes. The bug lived entirely in the control; nothing about the +real arms was ever wrong. Recorded because it is this arc's C0 gate doing +precisely the job it was built for — catching a defect in the apparatus +before it could contaminate a verdict — on the very first probe that +tried to use it for something other than a smoke test. + +**And it contradicts an earlier exploratory hint, on purpose, stated +plainly rather than averaged away.** §6.6 measured, *within R4 only*, a +single arm's saturation correlating with storm `\|∇p\|` at ρ = +0.444 +(p = 0.058, explicitly labelled not significant, not a result). That +correlation's *direction* matched the hypothesis. The properly-powered, +pre-registered, cross-regime test says the opposite. Where an +unpre-registered n=19 single-regime correlation and a pre-registered +cross-swap disagree, **the pre-registered result governs** — and this +entry exists so a later read of the plan does not quietly split the +difference between "p=0.058, direction matches" and "reversed, +monotonic, two independent measures" into a false middle. + +**C1c passed and licensed the whole exercise** — the regimes measurably +differ in correlation structure (decay length, Gini, tail ratio of +`|∇p|`), not merely in gradient magnitude, so the refutation above is a +finding about calibration under real structural variation, not an +artifact of four copies of one condition. + +**What is NOT concluded.** One box size (16°, 4225 cells), one variable +(MSLP), three timesteps plus 19 storms. C5 — the *other* half of "good +geometry vs badly calibrated" — was never run: the golden index floor +(N ≥ 2,550,409) is three orders of magnitude above what a box this size +can hold, so `GEO-GOLDEN-HI` has no admissible construction at this +scale. The geometry axis of the operator's original framing remains +completely untested. + +**Cross-ref:** `E-A-HORSE-RACE-IS-NOT-A-CROSS-SWAP-1` (the instrument +this run finally exercised); `E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1` +(the exact defect class C0 caught here); `E-A-FIGURE-CITED-TWICE-IS-NOT- +CONFIRMED-ONCE-1` (why §6.6's direction is not treated as confirmed by +this section merely because it was written down once already). + +## 2026-08-12 — E-A-FIGURE-CITED-TWICE-IS-NOT-CONFIRMED-ONCE-1 + +**Status:** FINDING `[G]` — measured. Probe +`probes/weather-p1/substrate_comfort_d_cz_0_1.py` + `.json`, one run, +committed with the artifact this entry is about. + +**The defect.** `substrate-comfort-zones-v1` §1's nine-row regime preflight +was marked **DONE** on `STATUS_BOARD.md`, quoted in the `PR_ARC_INVENTORY` +entry, quoted again in the `LATEST_STATE` row, and its headline (a 9.3× +dynamic range across four regimes) was carried into three PR bodies. **No +script and no JSON producing any of those figures had ever been committed.** + +**The part that makes it worth an entry rather than a fix.** On #945 I ran +an explicit self-audit *specifically because* this arc keeps shipping +summary claims that do not survive checking — and reported the regime-ladder +figures as verified. What that audit actually did was confirm the arc entry +matched the PLAN. Both are prose. Neither is a measurement. **A figure cited +in two documents has been cited twice, not confirmed once** — and an audit +that compares two documents to each other measures their consistency, which +is not the property anyone cares about. + +**The rule.** An audit must terminate at an ARTIFACT — a committed script, a +committed JSON, a re-run — or it is a spell-check. Concretely: when a +board row says DONE, the check is *"name the file that produced it"*, not +*"does the summary match the plan"*. + +**What the reproduction then found**, none of which was visible from the +prose: + +1. **Only 4 of 9 rows are reproducible at all.** R1/R2/R3 centres are in the + plan and R4's come from committed `comet_tail_f14.json` (the qualifying + filter — `status == "OK"` AND `displacement_km ≥ 250` — itself had to be + *recovered* by reproducing the stored `n_qualifying = 19`, and is now + asserted in code). The five EXCLUDED land candidates carry measured + figures whose **box centres were never written down anywhere**. They are + unreproducible as committed. No coordinates were invented to fake them. +2. **The `|∇p|` definition was never committed either — only values.** Four + candidates were computed and the winner decided from the data: the + recorded figures are **Pa per grid cell with NO cos(lat) metric** + (max deviation 0.069; the next-best candidate is off by 0.398). It is a + plain `np.gradient` over the raw lat/lon array. +3. **Consequence, bounded:** ignoring cos(lat) understates the ZONAL + gradient by `1/cos(lat)`, so R3 at 60 N is ~40 % low. Metric-corrected + the ladder reads 10.3 / 15.5 / 61.2 / 100.9 — the **ORDER survives** and + the dynamic range **widens** 9.3× → ≈9.8×. The regime axis stands; the + recorded magnitudes do not. Reported as a correction, not as a collapse. +4. **A defect in the reproduction itself, caught by its own guard.** The + first pass measured all 19 storm boxes at the *preflight* timestep rather + than at each storm's own `t0` — "the places where storms once were, at an + unrelated hour". That inverted R3/R4 (220 vs 208) and would have read as + the regime ladder failing C1. Fetching per storm (19 extra chunks) + restores 37 / 56 / 220 / 363. Separately, a seam assertion fired on a + real storm centred at 353.4 E: a plain longitude slice there yields a + one-column box and a plausible, meaningless number. **Both were caught + because the probe asserted rather than assumed.** + +--- + +## 2026-08-12 — E-THE-METRIC-THAT-SEPARATES-ONE-COMPARISON-IS-BLIND-TO-ANOTHER-1 + +**Status:** FINDING `[G]` — measured, same run. + +**`ρ` is saturated on the diagonal and enormous off it.** Measured over four +regimes at 256 palette levels on MSLP: + +| comparison | `ρ` separation | +|---|---| +| real arm vs real arm (`CAL-ABS` vs `CAL-RANK`, both own-calibration) | **3×10⁻⁶ … 4.7×10⁻⁵** | +| real vs degraded (`CAL-SHUFFLE` 0.003–0.159, `GEO-DEGENERATE` 0.29–0.48) | **~0.5 … ~1.0** | + +Both real arms reconstruct the ordering essentially perfectly (ρ > 0.99996), +because 256 levels on a smooth pressure field is a very fine quantization. +So `ρ` has **four orders of magnitude of range for transfer loss `L`** (an +off-diagonal quantity) and **none at all for C4** (which compares two real +arms on their own diagonals). RMSE, which the same rewrite had just demoted, +*does* separate the real arms: ratios 3.96 / 1.85 / 1.14 / 1.49. + +**The rule: a metric is not good or bad, it is good or bad FOR A GIVEN +CONTRAST.** Choosing one for a plan as a whole — as the cross-swap rewrite +did, elevating `ρ` and demoting RMSE in one move — is a category error the +moment the plan contains two contrasts with different dynamic ranges. The +resolution here is not to revert: `L` keeps `ρ`, C4 moves to RMSE in Pa with +`ρ` as a floor check (< 0.999 = broken, not merely lost). + +**Why amending after data is legitimate here, and when it stops being.** +D-CZ-1's *stated purpose* is to test the apparatus before the expensive +cells, and **no C4 cell has been scored** — a metric found blind in +preflight is exactly what preflight is for. It becomes illegitimate the +instant one C4 measurement exists. Recorded as an amendment carrying its +trigger (`§6.4`), never edited into the bar silently. + +**Cross-ref:** this is the same shape as #926's Fisher-z result (8.3× better +in the storm tail on the raw field, 4.7× worse on ring means — one encoding, +opposite verdicts by what it represents), which §0 already cites as a +founding motivation for this plan. The plan's own primary metric turned out +to be another instance of the phenomenon the plan was built to map. + +## 2026-08-12 — E-A-HORSE-RACE-IS-NOT-A-CROSS-SWAP-1 + +**Status:** FINDING `[H]` — methodological, operator-ruled. Caught on +`substrate-comfort-zones-v1` BEFORE any bar ran, so nothing measured had to +be reinterpreted. Grade is `[H]` because the reasoning is airtight given the +premise but the premise itself ("the model captures the phenomenon") is an +assumption this plan does not test. + +**The defect, in one line: when the premise is *the model captures the +phenomenon but is not calibrated*, an error metric measured under a +deliberately wrong calibration is bad BY DEFINITION, so scoring it answers +nothing.** The first draft of that plan compared four calibration arms on +reconstruction RMSE — a horse race. But `CAL-ABS-FOREIGN` is not a +competitor that might lose; it is the measurement CONDITION the whole +hypothesis is about. Racing it guarantees the answer and measures the +tautology. + +**What the design must be instead.** Miscalibration is a *transfer* +question, so the instrument is a transfer matrix, not a ranking: `M[D][T]` = +read regime `T`'s field through a codebook derived from regime `D`. The +diagonal is own-calibration; every off-diagonal cell is a swap. The primary +metric becomes **structure preservation** (Spearman `ρ` of reconstructed vs +true), and the quantity the hypothesis actually concerns is the derived +**transfer loss** `L[D][T] = ρ[T][T] − ρ[D][T]` — how much ordering survives +being read through the wrong calibration. Absolute error is retained as +*evidence that the swap genuinely hurt*, never as the verdict. + +**The sharp consequence that only appears in the matrix framing.** A +window-local encoding (rank-normalised, Fisher-z) has **no donor at all**, +so its matrix row is flat and `L ≡ 0` **by construction**. That is not an +artifact to hide — it IS the property under test: a substrate that carries +no absolute anchor cannot have that anchor be wrong. Which reframes the +whole comparison. The question stops being "which formula wins" and becomes +"in which regime does the anchor-free encoding's own-window `ρ` exceed the +absolute encoding's, measured against the DIAGONAL (its own calibration, +the hardest available opponent) rather than against the swapped cell (which +it beats almost by definition)." + +**And the degeneracy must be VERIFIED both ways** — this is the +`E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1` lesson in its can-it-DIFFER +form, which W5 already paid for once. A flat row is only evidence if the +identical code path is proven able to produce a NON-flat one (the absolute +arm must show real off-diagonal degradation). Otherwise "flat" means the +harness cannot vary anything, and the encoding was never tested. + +**Second half of the ruling, on the regime ladder itself.** The operator's +framing: *in science you hold variables constant to test the others; +constancy is relative, so the design deliberately manufactures strong +correlation differences — on the assumption that those differences are fit +to evaluate the hypothesis.* Three things follow, and the plan had only the +first: + +1. **The 9.3× `|∇p|` spread across the four regimes is the design's PURPOSE, + not a by-product of box selection.** At small spread every effect is in + the noise; at large spread it is legible or it does not exist. +2. **"Constant" is relative, so it is MEASURED** — within-box spread of the + discriminator must be small relative to the between-box spread + (`separation ≥ 3`). Below that, "held constant" is a label on a box, not + a condition, and the caveat must ride every downstream number. +3. **"Fit to evaluate the hypothesis" is an ASSUMPTION and therefore needs a + falsifier.** The ladder is built on a pressure-gradient discriminator but + the hypothesis is about correlation STRUCTURE. If two regimes are + indistinguishable in autocorrelation decay and rank-distribution shape, + they are ONE condition for this question however far apart their + gradients sit — and the ladder would be measuring four copies of the same + thing. A null there VOIDS the reading rather than weakening it: it would + mean the spread was manufactured on the wrong axis. + +**The defect is STICKY — it survived the rewrite built to remove it, and a +REVIEWER caught it, not the author (CodeRabbit on #944, same day).** §2.3's +summary passage still named the *foreign-donor* comparison as "the +operator's hypothesis" while C4, `STATUS_BOARD` and the `INTEGRATION_PLANS` +entry all correctly scored against the diagonal. Mechanism: §2.3 was written +before C4 was sharpened, and the sharpening was not propagated backwards. +Left standing, the plan would have carried **two incompatible verdict +criteria with the weaker one holding the headline** — the swapped cell +establishing merit, i.e. the exact tautology the rewrite existed to delete. + +That makes this the **fifth** instance in this arc of a claim that is +internally consistent with its own operands but inconsistent with a SIBLING +claim (#930's fused relation, #927's decimal claim, #928's audit figures, +#941's dropped qualifier, now this). The generalization is sharper than the +individual fixes: **when a design is revised, the summary sentences are the +last thing to be updated and the first thing a reader believes.** A revision +is not complete when the new machinery is right; it is complete when every +sentence that *names the conclusion* has been re-derived from the new +machinery. Self-review kept missing it because the author re-reads the part +that changed, not the part that merely still sounds right. + +**The transferable rule.** Before scoring arms against each other, ask which +of them is a *competitor* and which is a *condition*. A condition put on the +starting line will always lose, and its loss carries no information. Score +conditions by what SURVIVES them, not by how much they cost. + +**Cross-ref:** `.claude/plans/substrate-comfort-zones-v1.md` §2 (the rebuilt +instrument, with v1's framing preserved in place as a correction note rather +than deleted) and §3 C1b/C1c/C2/C3/C4; `STATUS_BOARD.md` D-CZ-* (rows re-cut +while still Queued, with the old→new mapping recorded); +`E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1`; +`E-R²-IS-NEAR-BLIND` (why the physical unit is retained alongside `ρ`). + +## 2026-08-12 — E-THE-DISPLACEMENT-FILTER-ATE-THE-STRANDED-STRATUM-1 + +**Status:** FINDING `[G]` — W6 RUN (`comet_tail_w6.py`/`.json`), audited +(raw predictors committed per storm after a self-caught gap), both a +sample-composition finding and a genuine model-level negative result. + +**The mechanism-level result, stated first because it is the load-bearing +one.** Report §10.2's dipole vector-sum model (`D = c_geo·P_geo + +c_bow·P_bow`, a background-high neighbor predictor plus a relative-motion +bow-wave predictor) was fit on CT-F14's 19 stored storms and **VOIDED by its +own pre-registered anti-vacuity control**: single-geo R²=−0.104 (worse than +predicting the mean); the permuted-P_bow control R²=−0.071 and the +rotated-90° control R²=−0.062 BOTH exceed `single-geo + 0.03 = −0.074` — two +deliberately wrong references score as well as or better than the real +predictor. This is not a marginal miss — it is the anti-vacuity control +doing exactly its job: rejecting a fit that has nothing to identify. + +**Checked before concluding it was a clean negative, per the standing +measurement-skeptic discipline: no implementation bug found in the FIT +itself, but a sign convention AND a units error were found in the +NARRATIVE around it (codex + CodeRabbit P2/Major on PR #940, both real, +fixed before merge).** One storm was independently re-fetched and hand- +audited; extended to the full sample by committing the raw +`D`/`P_geo`/`P_bow`/`A_H`/`d_H`/`v_rel_ms` per storm. Every value is +physically sane (`A_H > 0` always, `d_H` inside the 600–2500 km annulus +always, `v_rel` 2.8–27.9 m/s). + +**Sign:** `spine()`'s raw fit coefficient points toward the storm's HIGH +side (the gradient of increasing residual pressure), while `P_geo`/`P_bow` +both point toward the LOW side by construction — the exact convention +`low_pole_bearing()` makes explicit via its own `(ph + π) % (2π)` flip. `D` +is correctly `−spine(...)`; the first draft used the unflipped `coef`. +Corrected: **`c_geo = +0.407` (the physically predicted positive sign — +CORRECT)**, `c_bow = −0.0006` km⁻¹ (predicted positive — **wrong sign, but +small**). Verified algebraically and numerically that this flip changes +NOTHING about R² or the B0/B1 VOID verdicts (OLS is odd-symmetric in the +fit target) — only the coefficient signs and the sentence describing them. + +**Units:** `D`/`P_geo` are [Pa/km]; `P_bow` is [Pa] — `c_geo` is +dimensionless, `c_bow` carries km⁻¹, and OLS coefficients rescale inversely +under column rescaling while R²/fitted-values stay fixed. **Raw `|c_bow|` +was never valid evidence of "no measurable weight"**, and comparing +`|P_bow|` to `|D|` directly (147×, as first reported) compounded the same +mistake — Pa is not comparable to Pa/km at all. The dimensionally valid +measure is the fitted CONTRIBUTION `|c_bow·P_bow|` against `|D|`, both in +Pa/km: mean `|D|`=0.745, mean `|c_geo·P_geo|`=0.186 (25 % of `|D|`), mean +`|c_bow·P_bow|`=0.068 (9 % of `|D|`) — the geo contribution is ~2.7× the +bow contribution, MODEST rather than "no weight," and both remain +consistent with the R²<0 finding that neither predictor meaningfully +explains `D`'s variance. + +**The finding that generalizes past this one probe: an anti-vacuity control +can be voided by SAMPLE COMPOSITION, and the reason is arithmetic, not +physics.** B3's stranded-vs-moving stratification (`|v_storm| < 8 m/s`, +the report's own named test of the "stranded-rescue" reading) came back +**n=0 for the stranded stratum** — every one of the 19 storms has +`|v_storm| ≥ 12.54 m/s`. This is not a null result about storm motion; it is +a DIRECT ARITHMETIC CONSEQUENCE of CT-F14's own qualifying filter +(`displacement_km ≥ 250` over the 6 h window): `250 km / 6 h = 11.574 m/s`, +a hard floor on `|v_storm|` for ANY storm admitted to the sample. **A filter +built to select clearly-moving storms for a displacement-scoring test +silently and permanently excludes the storms a LATER, differently-motivated +test (stranded-rescue) needs to see.** The stranded-rescue claim is +therefore **UNTESTABLE on this sample, not refuted** — the untestability was +knowable from the filter's own arithmetic before a single storm was fetched, +and wasn't checked until B3 came back empty. + +**Consequence, stated as a reusable rule:** before scoring ANY new +hypothesis against an EXISTING filtered sample, check whether the sample's +own selection criterion is compatible with the new hypothesis's own +discriminating variable — arithmetically, not by running the probe and +discovering an empty stratum after the fact. A filter selected for one +purpose (fast, clearly-displaced storms, easy to center-find and score +against displacement) is not neutral with respect to every future question; +it is a specific cut through the underlying population, and every later +probe inherits that cut whether or not it is the cut that probe needs. + +**Consequence for the report and for CT-F17.** The report's §10.2 vector-sum +model, AS SPECIFIED, is disconfirmed on this sample — not "unproven," not +"needs more data" in the ordinary sense, but VOID by its own control. CT-F17 +(the fresh-sample verdict, gated on W6's result + an independent adversarial +audit) is now moot **for this form of the model** — a fresh-sample test of a +model that already fails identifiability on the stored sample is not the +next useful step. Any REVISED form of the vector-sum model (multiple +neighbors, a nonlinear bow term, per-storm coefficients) would need its own +W6-shaped mechanistic test before earning a CT-F17 slot; a genuine +stranded-rescue test needs a sample built without (or explicitly retaining +slow storms despite) a displacement floor. + +## 2026-08-12 — E-ON-A-GOLDEN-LATTICE-LOCALITY-IS-FIBONACCI-MEMBERSHIP-1 + +**Status:** FINDING `[G]` — W5 RUN (`spiral_adi_probe.py`/`.json`) + a +targeted verification measurement, both committed. + +> **⊘ CORRECTION (2026-08-12, codex review on PR #936, same day) — the +> HEADLINE 0.9996 anisotropy ratio this finding cites is retracted; the +> MECHANISM below it is not.** The headline run's control was subsampled +> at 250k points/band against ~956k-point headline bands — ~74 % of +> sources got no real KD-tree and silently self-linked — so 0.9996 mostly +> measured self-links, not the control, and cannot by itself establish +> anything. **The 99.38 %-Fibonacci-offset verification measurement below +> is UNAFFECTED**: it ran at N=62 208, with per-band populations +> (~7 776 points) far under the 250k cap, so no subsampling occurred +> there — the mechanism claim (locality ⟺ Fibonacci membership via the +> three-distance theorem) still rests on a real, unsampled measurement. +> Fixed same day (`106ca605`): `build_control_links` is now full-band, no +> cap; a v2 headline rerun is in flight. Once it lands, this note gets a +> sibling recording the corrected headline ratio — append-only, this +> paragraph is not edited further. + +> **⊘ SECOND CORRECTION (2026-08-12, codex P2 on PR #937) — "does not +> exist" overclaims what 99.38 % actually showed.** The claim below reads +> as a universal non-existence proof; the evidence is a 99.38 % rate at +> ONE N (62 208) with ONE control construction (distance-matched among 8 +> real nearest neighbours) — not 100 %, and not a sweep across constructions +> or scales. **What is actually proven, exactly:** the three-distance +> theorem is a real theorem — a point's near neighbours on this lattice +> ARE at convergent-denominator (Fibonacci) index offsets, as a matter of +> number theory, not measurement. **What is empirical and should be read +> as strong CORROBORATION, not proof of universal impossibility:** 99.38 % +> of the measured control links landed on a Fibonacci offset, with the +> ~0.62 % remainder consistent with the independently-measured ~1–2 % +> structural boundary effect (points whose own forward Fibonacci partner +> falls outside band range, counted separately in the same session) rather +> than evidence of a working non-Fibonacci alternative. The claim below is +> RESTATED, not deleted, to match this scope: read "does not exist" as +> "the three-distance theorem predicts it cannot, and 99.38 % measured +> confirmation at one tested N/construction is consistent with that" — a +> sweep across N and control constructions would be needed to call the +> universal form settled. + +> **★ THIRD UPDATE (2026-08-12, v2 headline RUN landed) — STRENGTHENED, at +> the real scale, on the full uncapped population, AND now on BOTH link +> families.** The v2 rerun (`106ca605`, no subsampling cap) measured the +> actual headline population directly: **99.68 % of the qualifying-band +> population's family-A control links (n_qualifying=4 782 017) land on a +> pure Fibonacci offset** — 99.95 % of the moved links specifically — +> dominated by offset 2584=F(18) itself (4 745 846 of 4 769 097 moved +> links), with the small remainder at 6765=F(20), 10946=F(21), and +> 13530=2·F(20) (a Fibonacci harmonic, not a counterexample). +> +> **⊘ THIRD-UPDATE CORRECTION (2026-08-12, codex P2 on PR #938, same day) +> — two overclaims in the paragraph above, both fixed.** (1) The 99.68 % +> figure covered only family A — `build_control_links`'s histogram was +> computed `if fam == 0` only, so family B (the OTHER stride direction, +> used every ADI iteration alongside family A) was never measured; +> generalizing to "the qualifying population's control links" from +> family-A-only data overclaimed. Fixed: the function now histograms both +> families. **Family B independently measured at 99.56 %** Fibonacci-offset +> rate, dominated by offset 4181=F(19) — the OTHER member of the discovered +> pair `[2584, 4181]`, exactly as the mechanism predicts (each family's +> characteristic near-neighbour scale IS that family's own discovered +> stride). Two families, two Fibonacci offsets, both >99.5 %. (2) "four +> orders of magnitude apart" for the two tested N was an arithmetic error +> — `4 782 017 / 62 208 ≈ 76.9×`, i.e. **~1.9 orders of magnitude**, not +> four. **Second correction's caveat stands as written** (one construction +> family at a time, now two scales AND two families, still not a sweep +> across fundamentally different control constructions — the "does not +> exist" phrasing remains restated, not un-restated) — the evidentiary +> base is nonetheless materially stronger: two independent N ~1.9 orders +> of magnitude apart, both link families, all landing within roughly half +> a percentage point of each other. +> +> **And a genuinely new, larger result rode along in the same run: B2 now +> FAILS.** v1's B2 PASS (anisotropy 1.2134) is now understood to have been +> an artifact of the SAME kind of confound this epiphany already +> catalogued for B3 — an inert operator (8 fixed iterations added ~0.003 % +> variance) inherited its apparent "isotropy" from a mask sitting only +> 1.72σ from the bump, whose own truncation analytically predicts a 1.208 +> ratio, matching v1's number almost exactly. v2 fixed the mask clearance +> (3.35σ; baseline through it now measures an essentially clean 1.0046) +> AND scaled the iterations to a real physical diffusion target — and with +> both confounds gone, the ADI operator's own anisotropy is revealed for +> the first time: **1.5251, a genuine ~0.52 anisotropy contribution from +> the operator itself**, failing the 1.25 bar. Full detail: +> `weather-w-probes-v1.md` §1's v2 RUN section. Not filed as a separate +> epiphany — it is the SAME lesson (a control/baseline that cannot +> discriminate carries zero information when it "passes") applied to B2 +> instead of B3, discovered by the same v2 fix that was built for B3. + +**The claim, AS ORIGINALLY WRITTEN below (kept for the record; read through +both corrections above).** On a Vogel/golden lattice, a *local* +non-Fibonacci control for stride-structure experiments **does not exist** +— not "is hard to build," does not exist. Locality and Fibonacci-family +membership are the same property, by the three-distance theorem: a point's +near neighbours in +physical space are exactly the points at convergent-denominator index +offsets, and for the golden angle the convergent denominators ARE the +Fibonacci numbers. + +**How three successive control designs discovered this by failing +differently.** W5's B3 control went through three generations, each +correcting the last: (1) strides 12/18 — wrong SCALE (connects points +nowhere near each other); (2) strides 1500/2600 — magnitude-matched but +still wrong scale in disguise (angular residues 0.05/0.11 vs the true +pair's 0.00028/0.00017 — two to three orders larger); (3) the +distance-matched shuffled-neighbour control — picks, per point, the REAL +nearest lattice neighbour closest in physical distance to the true partner, +excluding that partner. Generation 3 is the strongest possible local +control — and the RUN shows it changes nothing: anisotropy ratio +control/fib = **0.9996** (B3 bar: ≥1.5 → **VOID** by its own +pre-registered rule). + +**The diagnosis, then the verification — in that order.** The suspicion: +generation 3's "non-Fibonacci" partners are themselves Fibonacci-offset +points, because on this lattice there is nothing else nearby to pick. +Measured directly (N=62 208, family-A control links): **99.38 % of the +control's links have a Fibonacci |Δk|** — top offsets 233, 987, 610 +(all Fibonacci) and 1220 (= 2·610). The control never left the family. +The three-generation arc is therefore not a story of bad control design +but a **constructive proof sketch of the impossibility**: wrong-arithmetic +⟹ wrong-scale on a golden lattice, in both directions, because the +three-distance theorem couples the two. + +**Consequences.** +- **W5's B3 question ("does the smoothing depend on the strides being + Fibonacci?") is unanswerable BY A LOCAL CONTROL on this lattice** — and + that is the honest verdict, not a probe defect. What CAN be said: the + ADI smoothing quality is governed by local step geometry, and on a + golden lattice, having correct local step geometry and being + Fibonacci-linked are the same thing. +- **Companion to `E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1` (below, + same day): that entry's failure mode is a control that cannot LOSE; + this one's is a control that cannot DIFFER.** Both carry zero + information when they "work" — and both were caught only because the + runs happened and the results were interrogated instead of banked. +- A genuine falsifier for the Fibonacci-dependence question would have to + leave locality: e.g. compare against a DIFFERENT lattice (jittered + grid, Halton) with its own natural neighbour structure under the same + stencil — deferred, scoped as a different experiment, not a fourth + control generation on the same lattice. + +**The positive results this run also delivered (recorded here since B3's +VOID would otherwise overshadow them):** **B2 PASS** at the headline +N=7 651 227 — iso-fit error **0.00053** against the 0.15 bar (≈280× +margin), anisotropy 1.213 vs the 1.25 bar: two Fibonacci-stride +tridiagonal sweeps DO approximate an isotropic 2D diffusion, which is the +load-bearing half for the domino.rs spiral-ADI design. **B4**: smooth +monotone improvement across the floor sweep (iso 0.44 → 0.0001 from n=8 +to n=19, N=52.4M), **no knee at n=17** — on this metric the operator's +17/21 floor reads as a comfortable safety margin, per the pre-registered +two-sided reading. Honest residual: the anisotropy asymptotes at **~1.213 +across three decades of N** (1.28/1.22/1.213/1.213 at n=12/14/17/19) — +an N-independent, structural ~21 % second-moment anisotropy of the +operator/geometry itself (band-restricted chains on polar geometry), not +a resolution artifact; it passes the 1.25 bar but does not tend to 1.0, +and any future tightening of that bar below ~1.22 would need this +mechanism addressed first. + +## 2026-08-12 — E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1 + +**Status:** FINDING `[G]` — both instances measured this session, committed +scripts + JSONs (`sunflower_pairing_probe`, `golden_vs_tempered_probe`). + +**The claim.** The falsifiability rule's can-it-fire / can-it-stay-silent +doctrine applies to CONTROLS with exactly the same force as to guards: **a +control arm that cannot lose by construction carries zero information when +it wins** — and this session produced the shape twice in one afternoon, in +two independent probes, caught two different ways. + +**Instance 1 — the symmetric-grid control (W2s-a, caught by a smoke test +BEFORE the full run).** The pre-registered G2 bar expected golden's +nearest-pair-distance CV to beat an axis-aligned-grid control's. Measured: +grid CV ≈ **1.6e-12** vs golden's 0.368 — twelve orders of magnitude, at +every N in the sweep, invariant under four different center offsets (0 to +300 km, checked in a 50k-point smoke test before committing to the full +2.55M run). Mechanism, not mystery: the brief specified TWO IDENTICALLY +CONSTRUCTED grids differing only by a pure translation — and two identical +periodic tilings offset by a fixed vector are, by lattice symmetry, +**translation-invariant in their cross-nearest-neighbour distance**. Every +point sees the same local geometry; the CV is floating-point noise. **The +control cannot lose ANY evenness comparison against ANY irregular +construction — so G2's FAIL verdict is a fact about the control, not about +the golden lattice.** Reported as FAIL + diagnosis rather than silently +redesigning the control to force the pre-registered answer (the run was +committed as-specified after the smoke test flagged it, deliberately, so +the record shows the specified control failing rather than a quiet swap). + +**Instance 2 — the first-crossing m* (golden-vs-tempered T1, caught by +external review of the RUN's own result, codex P1 on #935).** The +crossover point "where golden permanently overtakes tempered" was computed +as a FIRST crossing — but golden's raw discrepancy sequence is +non-monotonic (only its `O(log m/m)` ENVELOPE is a bound), so a first dip +below the ceiling can reverse. Reproduced exactly: q=17 reported m*=21; +D*(22)=0.081 sits back ABOVE the frozen ceiling 0.059. The "permanent" +claim had no machinery that could catch a reversal — **an implicit +control (nothing rose back above) that was never actually checked**. +Fixed: `verified_permanent_crossover` checks a sampled suffix (every +integer for 50 steps + geometric points to the 200q horizon) and REPORTS +THE CHECKPOINT COUNT beside every m*, so the verification scope is stated +rather than implied exhaustive. The verified m* moved from ~1.0–1.4×q to +**~1.9–2.7×q** — the number's THIRD revision, each widening, each from a +methodological gap the previous pass could not see. + +**The rule, in one line each:** +- *A control must be able to lose.* Before pre-registering a control arm, + ask what result would make the control WIN unfairly — symmetry, + degeneracy, and construction-identity are the usual culprits (two + identical tilings, a rotated referent with the same marginals, a + permutation that preserves the tested statistic). +- *"Permanently" is a claim about a suffix, not a point.* Any + "stays/never/always thereafter" assertion over a non-monotonic sequence + needs suffix verification with a STATED scope (checkpoint count), never + a first-hit search. +- *Smoke-test the control's losability cheaply before paying for the full + run* — instance 1 cost 0.1 s at N=50k to diagnose what would otherwise + have surfaced only as a confusing FAIL after the 2.55M-point run. + +**Cross-refs.** The falsifiability rule (CLAUDE.md P0) — this extends its +guard-doctrine to control arms. `E-THE-CONTROL-SCORED-THE-HEADLINE-1` — the +complementary failure (a control that scored AS WELL as the signal, +exposing the instrument); today's is the inverse (a control that cannot +lose, exposing nothing). W5's B3 control history — three successive control +designs (12/18 wrong-scale, 1500/2600 wrong-scale-in-disguise, +distance-matched-neighbour) are the same lesson approached from the +wrong-scale side. Plan homes: `weather-w-probes-v1.md` §2 RUN note, +`golden-vs-tempered-stride-v1.md` T1 correction notes. + +## 2026-08-12 — E-THE-GOLDEN-STEP-IS-THE-WRONG-STEP-AT-SMALL-Q-1 + +**Status:** FINDING `[G]` — arithmetic, fully reproducible, no fetch. Operator +ruling + three measurements run this session. + +**The ruling (operator, three messages, paraphrased):** golden-ratio +structure counts only from convergent index ~17–21 upward, below that it is +unusable · the preferred small-q combination is modulus 17 with stride 4 · +the stride-11 alternative is explicitly not a golden-section step. + +**Measured, and it splits into two regimes with two different generators.** + +1. **The index floor is real and my specs were below it.** `F(n+1)/F(n)` is a + RATIONAL of period `F(n)`; convergent error n=10 → **1.5e-4**, n=13 → + 8.2e-6, **n=17 → 1.8e-7**, n=21 → **3.7e-9**. Below the floor the ratio + *resonates* — the exact moiré the golden construction exists to prevent, so + a sub-floor lattice demonstrates the OPPOSITE of the property. The emergent + parastichy pair of an N-point Vogel lattice sits at `≈ √N`, so index ≥17 + needs **N ≳ F(17)² = 2 550 409**. **W5 was specced at N=4096 (emergent pair + F(10)/F(11)) and its discovery step searched `j ∈ {1..60}` — structurally + incapable of returning anything above F(10). The sub-floor answer was + hardcoded and every bar would have been measured on it.** W2s-a likewise at + N=2048. Both corrected; both now carry an N-sweep so the floor is measured, + not inherited. +2. **The angle is NOT what the floor binds.** `2π(1−1/φ)` in f64 is irrational + to ~1e-16 at any N. What the floor binds is the *addressable stride family*. + Keeping these apart is load-bearing: "fix the angle" would be the wrong + repair. +3. **Below the floor, do not approximate φ at all — ENUMERATE.** This is the + payload. `helix/KNOWLEDGE.md:320` labels `(i·11)%17` the **"golden-step"** + because `17/φ = 10.51 → 11`. Enumerating all 16 strides mod 17, prefix + star-discrepancy at m = 5/9/13: + + | stride | m=5 | m=9 | m=13 | | + |---|---|---|---|---| + | **4** | **0.2000** | **0.1111** | **0.0769** | shipped `CurveRuler`, D-QUANTGATE | + | 11 | 0.2000 | 0.1503 | 0.0905 | the "golden-step" | + + **Stride 4 is never worse than 11 and strictly better at m=9 and m=13.** + And `17/11 = 1.5455` is **7.3e-2** from φ — an order of magnitude worse + than `13/8` (7.0e-3). At q=17 there is no irrational to approximate, and + the φ-derived selector picks the measurably worse integer. *(Honest + caveat: under worst-case-over-all-m, strides 10–15 tie at 0.5000 and + stride 4 reads 0.7647 — that metric is dominated by m=2 where every stride + is degenerate. The useful-prefix reading is reported as the one that + matters, and the other is stated rather than hidden.)* + +4. **The MECHANISM below the floor is TEMPERAMENT, not approximation** + (operator framing: the stride-11-region walk behaves like a 5/3 + circle-of-fifths with a distributed Pythagorean-style comma — not a + genuine golden step, yet it does not collapse; and that last property is + the whole theory). A coprime stride `s` over `q` is + structurally a **circle of fifths**: it does not *approximate* the + irrational target, it **closes the cycle exactly** (coprimality → full + permutation) and **distributes the incommensurability error — the comma — + uniformly around the cycle** instead of letting it accumulate at a seam. + Measured: 12 pure fifths miss closure by the Pythagorean comma + **+23.46 ct**; 17-TET's fifth (stride 10) closes **exactly by + construction** with **+3.93 ct/fifth** spread around the circle. That + distributed comma is precisely the deterministic **anti-moiré dither** + D-QUANTGATE names. So the survival property below the floor is + **CLOSURE, not GOLDENNESS** — which is why the shipped integer walk was + always right even while its "golden-step" rationale was wrong. + - **The operator's tentative 5/3 identification resolves exactly:** the + 5/3 major sixth (884.36 ct) lands on **stride 13** (917.65 ct, +33.3 ct) + — and **13 ≡ −4 (mod 17)**: `4·13 ≡ 1`, they are inverses. **Stride 4 IS + the descending-5/3-sixth circle.** Stride 11 sits at 776.5 ct ≈ 8/5, the + neighbouring sixth — the hedge was right, and the measured answer is + 13 = −4, i.e. the operator's own stride 4 read backwards. + - Interval map for the record (17-TET step vs just, cents; SIGN + CORRECTED 2026-08-12, codex P2 on PR #932 — the first version used + `just − TET` for four of five entries and `TET − just` for the fifth, + an internal contradiction against the "+3.93 ct/fifth" line above it; + the fixed convention is `TET − just` throughout): stride 3 ≈ 9/8 + (+7.9 ct), 7 ≈ 4/3 (−3.9 ct), **10 ≈ 3/2 (+3.9 ct, the fifth — now + consistent with the "+3.93 ct/fifth" line above)**, **4 ≈ 7/6 + (+15.5 ct)**, **13 ≈ 5/3 (+33.3 ct)**. + - The two-regime table thus gets its mechanism column: **continuum** = + equidistribution by irrationality (φ, needs the index floor); + **quantized** = temperament — exact closure + distributed comma + (coprime walk, needs no φ at all). + +**Why this is the same defect as two others found this week — third instance +of one shape.** A rule true in its asymptotic home, applied where it does not +hold: **R² "structurally near-blind to encoder bias"** (true at +1.59 Pa → +6th decimal, false at +92.76 Pa → 3rd); **"zero removed lines proves a pure +prepend"** (proves *additive*; an end-append also deletes nothing); and now +**"the golden step is the best step"** (true as N→∞, false at q=17). **The +repair is identical each time: measure/enumerate in the regime you are +actually in, instead of inheriting the asymptotic label.** Corollary for this +workspace: a name carrying a theory ("golden-step", "lossless", "pure +prepend") is a claim, and claims get falsifiers — the label is not the +evidence. *(And the temperament frame shows the deeper reason the label was +seductive: the walk really does share φ's PURPOSE — even coverage without +collapse — it just achieves it by closure + distributed comma rather than by +irrationality. Same goal, different mechanism, wrong name.)* + +**Consequences.** Report §10.5 carries the two-regime table + the +addressing note (a `u8` rail holds 256 < F(17)=1597, so the continuum side +must read tier-then-member — while the quantized side never has the problem, +since the 17-alphabet fits a byte fifteen times over). `weather-w-probes-v1` +§0 carries the enumerate-don't-approximate rule so every worker inherits it. +`helix/KNOWLEDGE.md:320`'s "golden-step" label is filed in `ISSUES.md` as +misleading-but-not-wrong-code — the walk it names is fine, the *reason given +for choosing it* is not, and a future session picking a stride by that +rationale would pick 11. + +## 2026-08-12 — E-THE-CONTROL-SCORED-THE-HEADLINE-1 + +**Status:** FINDING `[G]` — `comet_tail_f16.py` / `.json`, bars committed +BEFORE the run (`05f09005`); report §5.12. EXPLORATORY, not an EV. + +**The arc's leading rescue was measured and it failed — and the anti-vacuity +control accidentally calibrated the instrument that had been judging it.** + +CT-F16 swapped ONE variable: the dipole's motion reference, from 6h surface +displacement to the 500/600/700 hPa steering flow, on CT-F14's OWN 19 storms +(paired; stored centres reused, so selection and disk geometry cannot move). +Report §9.2 had named this *"the single most promising fix"*. Measured: +**sign consistency 0.579 against a 0.70 bar** (worse than surface's 0.684), +**residual sd 68.29° → 87.71°, 28.4 % WIDER** where a ≥10 % tightening was +predicted, and a level sweep improving **monotonically toward the SURFACE** — +best at 850 hPa, outside the 400–650 hPa band the height ladder predicted, +converging exactly on the surface-displacement figure. There is no +mid-tropospheric optimum on this sample. + +**The control is the larger finding.** F16c scored two deliberately WRONG +references through the identical pipeline. The **90°-rotated** steering +reference returned **13/19 = 0.684, p=0.0835** — *numerically identical to +CT-F14's headline*, the number this arc has carried as "suggestive" since +§5.11 (a different set of 13 storms, so the count coincides, not the +identity). At n=19 the one-sided ladder is 11→p=0.324, 13→p=0.0835, +**14→p=0.0318**. So **CT-F14 was never one storm short of significance; it was +one storm short of distinguishability from an answer built to be wrong.** + +**Rule: an anti-vacuity control does not only guard the test it is attached to +— it measures the RESOLVING POWER of the instrument.** This one was written to +protect CT-F16 and instead retro-calibrated CT-F14. Attach a +deliberately-wrong reference to any claim whose headline is a rate, and read +the control's score as the floor that headline must clear. Had F16c existed at +§5.11, "0.684, suggestive" would have been reported as "0.684, indistinguishable +from a rotated control". + +**Second finding, independent of the first: the sign test conflates a +SYSTEMATIC ROTATION with a correct prediction.** Stratified by steering +strength — weak flow (<10 m/s, n=6) **sign 0.833 / median |err| 103°**; strong +flow (≥10 m/s, n=13) **sign 0.462 / median |err| 55°**; `corr(speed,|err|) = +−0.407`. The prediction gets **more accurate in magnitude** as steering +strengthens, exactly as the physics expects, while sign consistency moves the +**opposite** way. High sign consistency in the weak subset is errors clustered +near −103°: a systematic rotation, which a sign test reports as success. **A +one-sided sign test on a distribution not centred at zero measures which SIDE +the bias falls on, not whether the prediction holds** — and this arc has used +it as the primary instrument since §4. The apparatus story told since §5.9 +(*slow storms have noisy bearings → filter on displacement*) is not what these +data show: the well-steered storms are the ones whose signs split at chance +while their magnitudes are best. + +**What is NOT falsified.** The height ladder (§5.2/5.8) decomposed the FIELD at +each level about that level's own centre; CT-F16 keeps the SURFACE dipole and +swaps the FLOW reference. Different quantities — the ladder stands as a +measurement (n=2, unreplicated), and what died is the operational reading §9.2 +built on it. The structural claim (§9.1: ring profile, wn-1 dominance, the +12-byte carrier) is untouched; nothing in CT-F16 touches it. + +**Cross-ref:** `E-ZERO-FOR-ELEVEN-THE-AUTHOR-CANNOT-AUDIT-HIS-OWN-FALSIFIERS-1` +(the author is the wrong person to find a spec's vacuous pass routes — here a +control found a *live* one, in a number already published); +`E-THE-HEADLINE-NUMBER-MEASURED-A-MODEL-NOBODY-CLAIMED-1` (the other time this +arc's headline described something other than what was claimed). + +## 2026-08-11 — E-THE-BYTE-WAS-ONLY-THE-SELECTOR-THE-PAIR-IS-THE-CARRIER-1 + +**Status:** FINDING `[H]` — operator correction + `l4_rail_probe.py` (commit +96e86b90); report §6.1. EXPLORATORY, not an EV. + +**Operator:** *"was ist mit 6× Palette256:Palette256 centroid, was ja die +Verteilung anzeigen soll — palette256 alleine ist ja nur 'attention header'"*. + +**Every encoding in this arc treated "one scalar → one byte" as the unit. The +shipped carrier is a PAIR.** le-contract §3 row L4 is `6 × (8:8)`, +`palette256²` — "each byte pair indexes the 256×256 palette distance/compose +tables; similarity = ONE table read". The single byte is the **selector**; the +**pair** is a cell in the centroid tile, and the tile is where the +distribution lives. I had built one rail and called it the carrier — the +rolling-floor cascade is the sanctioned §3 "area : location in stacked +exactness" reading, but of ONE rail out of six. + +**Measured: the 12-byte facet is LOSSLESS against the f64 spine.** Carve D +(dipole rail + 10 ring bytes *spread over the full radius*, missing rings +interpolated) reproduces the f64 constrained spine to four decimals on both +storms — R² 0.9434 / 0.9090, |D − f64| = 0.0000. R² is demonstrably sensitive +(carve B, the same budget spent on 12 rings with no dipole rail, collapses to +0.635 / 0.294), so this is recovery, not insensitivity. + +**Two of four pre-registered bars FAILED as written, and both failures taught +more than the pass.** + +1. **L1 failed** (0.0222 vs a 0.02 bar) and the decomposition names the cause + exactly: **quantization +0.0000, dropped rings +0.0222**. *The carrier's + PRECISION is free; its CAPACITY was the entire miss.* Spending the same 12 + bytes across the full radius erases it. Generalizable: when a byte-budget + fit misses, decompose before widening — the two costs point at opposite + fixes (a bigger codebook vs a better carve), and here the codebook was + already perfect. + +2. **L3 failed, and so did my proposed rescue** — the more useful half. + Fisher-z centroid axes are **5× WORSE** than uniform on the ring means + (18.07 vs 3.84 Pa). I hypothesised the population was wrong (ranks against + the 24 encoded values rather than the field) and measured that too: **19.00 + Pa, no rescue.** So the mechanism is not population size but *what the read + is for*: ring means are a smooth NARROW-BAND quantity sitting + mid-distribution, and a rim-stretch spends levels in tails where no ring + mean lives. + +**The demarcation this forces, which is the entry's real content:** it does +NOT contradict `three_register_probe`'s R4, where Fisher-z is **8.3× TIGHTER** +than plain rank in the storm tail (24.74 vs 204.54 Pa) on the raw field. Same +substrate, opposite verdicts. **Fisher-z wins a RANK/TAIL read and loses an +INTERPOLATE/LEVEL read.** Which is exactly why le-contract says a ClassView +**MAY** declare an analytic codebook — per class, by measurement, not as a +default. This corrects my own over-generalization, made earlier the same +session, that Fisher-z is *the* L4 codebook axis. + +**A ninth vacuous falsifier, and the mechanism is worth naming.** L4x +(shared-vs-per-storm codebook) passed on its first run **comparing an array +against itself**: a uniform codebook is fixed by its population's min/max +alone, so because storm 1's profile range strictly CONTAINS storm 2's, storm +1's "own" codebook IS the pooled codebook. It looked like a real comparison +only because an earlier variant (fisherz, which depends on the whole rank +distribution rather than the endpoints) had produced *differing* numbers — +**switching to the codebook the previous bar had just NAMED AS BEST is what +made the test vacuous.** Degeneracy flags now report both directions; the +informative one gives **620.79 Pa vs 4.48 Pa, a 139× penalty**, strong +evidence the codebook must be global — the "one table read" property the +carrier exists for. + +**Rule:** *when a bar's inputs are derived from the same population, check +they are not the same OBJECT before reading its verdict.* Equal numbers on +both sides of a comparison are the signature, and "it passed" is the least +informative way to find out. + +## 2026-08-11 — E-THE-HEADLINE-NUMBER-MEASURED-A-MODEL-NOBODY-CLAIMED-1 + +**Status:** FINDING `[G]` — external review of PR #926 (14 CodeRabbit + 2 Codex +findings); re-measured and corrected in `comet_tail_probe.py` and +`COMET_TAIL_REPORT.md` §1 / §8b (commit 5302828e). + +**The arc's most-repeated number was measured on a model the arc never +claimed.** The compression headline — "center + ~12 ring means + ONE dipole +(2 values) = 93–97 % of in-disk variance" — came from a `decompose()` that +fits `a1[b]`, `b1[b]` **per ring**: 12 rings × 2 = **24** free dipole +parameters, so the published 0.972/0.926 belongs to a **36-parameter** model, +not the **14-value** one the storage claim describes. Measured properly, the +constrained 2-parameter dipole (one amplitude slope + one bearing — the +linear-background form the report's own §2 derives) gives **0.943 / 0.909**. +Corrected headline: **90.9–94.3 %, not 93–97 %.** + +The finding SURVIVES — 14 values still lift a storm from 29–63 % to 91–94 % — +but claim and measurement had drifted apart by ~2.5× in parameter count across +six probes and several report rewrites, and nobody in-session noticed. **The +tell was available the whole time:** the report described the representation +in one place ("2 values") and the code produced another ("per-ring"), and no +test tied the two together. + +**Two review findings IMPROVED results rather than damaging them**, which is +the argument for external review as more than ceremony: (a) sunflower E2 was +handing the grid arm up to 25 % more samples than the spiral (every in-disk +lattice point instead of exactly n) — with equal budgets enforced the **spiral +now wins at every N**, where the arc had recorded "parity"; the original result +was PESSIMISTIC. (b) The voxel-chess palette arm compared palette-derived +geostrophic winds against RAW observations, because `geo_corr` closed over +module-level `u`/`v` — a hybrid, not the pre-registered palette result. + +**A fourth vacuous assertion, in this arc's own documented house style:** E6's +`rises_then_decays` required only an interior maximum plus a lower final +value, so it accepted a profile that DECREASED before rising to the peak — and +the committed run did exactly that (12.190 → 12.163 m/s before the 525 km +peak) while reporting `true`. Found by a reviewer, not by the author, which is +the same asymmetry `E-ZERO-FOR-ELEVEN-...` already recorded. + +**Rule:** *a number that appears in a headline must be produced by code whose +parameter count matches the headline's own description of the object.* Where +prose says "N values", the probe should EMIT N and the report should print it +— which `comet_tail_probe.py` now does +(`n_params_profile_wn1_constrained`), so the two cannot silently drift again. + +## 2026-08-11 — E-SPINE-FOUND-MODERATORS-MISSING-1 + +**Status:** OPERATOR RULING (framing) + FINDING `[H]` — report §9, commit +paired with the PR opening. Reframes the whole comet-tail chain's verdict. + +**Operator:** *"Wir haben ein Spine gefunden — die Stellschrauben müssen noch +mit den Variablen der bekannten Modelle moduliert werden. Uns fehlen die +Moderatoren; aber wir haben bereits das Gerüst, um das Zentrum und die +Dynamik zu modellieren. Außerdem haben wir Feuchtigkeit und Abregnen im +Aufwind an der Kollision zwischen den Gebieten nicht modelliert — das ist +eine Art Entropie bei Verdunstung und Abregnen."* + +**Why this reading is defensible — stated at the strength the evidence +actually supports:** a 0.68–0.73 directional main effect whose residual were +random would be a dying claim — but this chain's residual runs MONOTONICALLY +with a measured variable (the 92–102° height ladder, 3–5× apparatus noise). +*Main effect + structured residual + identified covariate* is **consistent +with a missing moderator and requires independent validation**. It does NOT by +itself exclude model misspecification, centre/label error, selection effects, +or chance. + +> **Correction (CodeRabbit on PR #926, 2026-08-11).** This paragraph +> originally read "is the signature of a missing moderator, NOT of a null. A +> null does not produce a ladder." That overstated what a monotonic residual +> can establish — it supports the hypothesis, it does not discriminate it from +> the alternatives above. Corrected in place per the append-only rule's +> allowance for regrading; the directional predictor stays SUGGESTIVE and +> unpromoted either way, which is what the PR objective already said. + +**The three-part decomposition now on record (report §9):** +1. **Spine `[G]`** — center + ~12 ring means + 1 wn-1 dipole = **90.9–94.3 %** + of in-disk variance, unshaken across 3 independent samples / 41+ storms / + 1980–2021. **~14 logical model values** (12 ring means + a 2-value + dipole) plus a center address. *(Corrected 2026-08-12, CodeRabbit PR #926: + this read "~14 bytes + an address", conflating the MODEL size with a + CARRIER budget. The measured encoding is a 12-byte `6×(8:8)` L4 facet — + see report §6.1; the byte budget belongs in the encoding section, not + in the spine statement.)* *(Regraded in place per the same + allowance used at line 67 above: this line printed 93–97 %, which + `E-THE-HEADLINE-NUMBER-MEASURED-A-MODEL-NOBODY-CLAIMED-1` — the entry + directly above — corrects to the 14-value model's real figure. Flagged by + CodeRabbit on PR #926 as an internal inconsistency with that entry, and it + was one.)* +2. **Dry moderators `[H]`** — measured in this chain, not yet wired: + steering level (THE ladder; CT-F16 = score the dipole against + steering-level motion instead of 6h surface displacement), displacement/ + label noise, friction/surface type, latitude/regime. +3. **Moist sector `[S]`** — not modeled at all, and "entropy" is technically + the right word: rain-out in the collision-zone updraft is irreversible + moist entropy production (θe the state variable, precipitation the sink — + Emanuel/Pauluis frame). Tractable NOW: the WB2 store carries + specific_humidity/temperature (θe), TCWV, total_precipitation_6hr, + vertical_velocity — and θe/TCWV are scalar fields, so the SAME ring/wn-1 + decomposition applies verbatim. CT-M1..M3 named as falsifiers; the July + failures (wn1_frac 0.19–0.36) are plausibly the diabatically-dominated + storms, making diabatic dominance itself a computable intake gate. + +**The brutal step (operator-directed, `[S]`):** learn the moderator matrix on +the substrate's own proven machinery — the spine as board state, moderators +as `W` in domino.rs' symbiont `C = A·W` tile-GEMM (stencil-as-GEMM already +byte-proven on real WB2 in ndarray `geostrophic_stencil.rs`), recurrence over +6h spine states via the workspace's byte-parity int8 LSTM (E-OCR-LSTM-1). +Explicit physics as spine, learned weights as moderators — the NeuralGCM- +shaped hybrid at 512 B/storm, gated by disjoint-decade train/test + the +plan-§8 audit. + +## 2026-08-11 — E-MY-OWN-PRE-REGISTRATION-HAD-A-GAP-AND-I-NAMED-IT-1 + +**Status:** FINDING `[G]` — CT-F14, `comet_tail_f14.py` / `.json`, report +§5.11. Direct follow-up to E-THE-RESCUE-THAT-WEAKENED-ITSELF... below; this +entry is about a defect in *my own pre-registration design*, caught and +corrected by the same discipline it should have applied from the start. + +**CT-F14 was pre-registered and committed to git BEFORE it ran** (`4f1a1b4f`) +— fixed dates, fixed bar (n≥20, ≥0.70), and a fixed interpretation table for +a "combined 3-sample" figure, all decided before any output existed. Run: 19 +of 85 mechanically-generated candidates qualified (one short of the n=20 +floor) → correctly **NO-VERDICT by the pre-registered rule.** The pooled +3-sample figure (n=26, 19/26=0.731) crossed the pre-committed p<0.05 +"established" threshold (p=0.0145). + +**By the letter of my own pre-registration, this should have been reported +as "established, ready for the audit-gate queue."** It was not, because a +sensitivity check — run precisely because the last entry demands applying +scrutiny to results that help as readily as to ones that hurt — found +something the pre-registration never anticipated: **CT-F14's own qualifying +subset, taken alone, sits at 0.684 (13/19), BELOW the 0.70 bar, p=0.0835 — +not significant.** The single test this whole probe existed to produce does +not independently support the claim it was built to test. The "established" +pooled figure is being carried by two small prior fragments (n=4 at 0.75, +n=3 at 1.00) blended with a properly-powered new sample that came in lower. +Dropping just the smallest fragment (n=3, fully saturated) still barely +clears p<0.05 (0.0466) — so the pooled crossing is not purely an artifact of +one tiny subsample, but the component that mattered most (the large, careful +new test) disagrees with the pooled verdict on its own terms. + +**The gap, named plainly: my pre-registration specified thresholds for a +pooled figure without specifying what to do if the new, properly-powered +sample and the pooled figure disagreed.** I did not write a rule for this +exact configuration because I did not anticipate it — I expected CT-F14 to +either clearly pass or clearly fail on its own, not to fall one storm short +of its power floor while *also* landing under the bar. Finding that gap +after the fact and exploiting it silently (reporting only the pooled +"established" number, which the letter of my pre-registration technically +licensed) would have been exactly the failure mode this arc's discipline +exists to prevent — just moved one level up, from cherry-picking a result to +cherry-picking which of two valid readings of a pre-committed rule to report. +**Named instead: graded the verdict down to "still suggestive," and +recorded the pre-registration gap itself as the finding**, alongside a +second, smaller walk-back (§5.10's striking monsoon-band exclusion pattern, +4/5 in the small sample, thinned to 2/21 at 4× the exclusion count in this +larger one — the small-n-looked-like-a-pattern theme recurring one level +down from the main directional claim). + +**The reusable lesson, sharper than the previous entry's:** *pre-registration +protects against post-hoc rationalization of the DATA. It does not +automatically protect against post-hoc selection among several VALID readings +of the rule itself, when the rule turns out to admit more than one — that +requires the same discipline applied one level up, at read time, not just at +design time.* After four probes, three independent samples, and 41 total +storms, the honest position is: structural claim solid throughout, directional +claim genuinely undetermined — not because no test was run, but because the +one test built to settle it came back below its own bar. + +## 2026-08-11 — E-THE-RESCUE-THAT-WEAKENED-ITSELF-UNDER-SCRUTINY-1 + +**Status:** FINDING `[G]` — CT-F10/F11/F13, `comet_tail_f10_f11.py` / `.json`, +report §5.10. Direct follow-up to E-N-EQUALS-TWO-... below; the discipline +this entry demonstrates is the point as much as the numbers. + +**A second, fully independent blind sample REVERSED the previous sample's +verdict on its own bar — 8/10 = 0.80 (vs the first sample's 6/10 = 0.60) on +15 mechanically-generated candidate dates (fixed start + fixed 411-day +stride, chosen before any code ran, landing entirely in 1980–1995, zero +overlap with the 2015–2021 sample).** This is exactly the moment a session is +tempted to declare victory. Instead: proper statistics first. Neither sample +clears a conventional two-sided 0.05 alone (sample 1 p=0.754; sample 2 +p=0.109). **Pooled across both fully independent samples: 14/20 = 0.70, +one-sided p≈0.058 — landing almost exactly on the pre-set 0.70 bar by +coincidence, and still short of significance.** The reversal is real, but it +does not resolve anything on its own; it converts a FAIL into a +STILL-BORDERLINE with a doubled sample size. + +**Then the two competing explanations from the previous entry were BOTH +checked against the new evidence — and the answer inverted which one looked +better supported.** §5.9 (previous) favored regime-contamination (a monsoon +low corrupting one sample) as the likely driver of the sign-consistency gap. +Checked directly: retroactively applying the wn1_frac≥0.40 regime filter to +**sample 1's own data** removes its two lowest-structure storms +(2020-07-20, 2019-10-25) — and **both were negative-signed, agreeing with +the prediction.** Removing two hits, not two misses, drops sample 1 from +6/10 (0.60) to **4/8 = exactly 0.500.** The regime explanation does not +survive contact with its own predicted mechanism — checked, not assumed, and +reported as a weakening even though it was MY preferred explanation from the +prior entry. + +**Meanwhile the apparatus explanation (motion-bearing noise on slow storms) +strengthened under the same treatment.** Pooling the displacement≥250km/6h +subset from BOTH independent samples (n=4+3=7, spanning two decades) gives +**6/7 = 0.857, one-sided p≈0.0625** — the single most consistent number in +the entire chain, though n=7 keeps it suggestive rather than decisive, and +this pooling was not itself pre-registered before either sample ran (stated +plainly). An unplanned bonus: 4 of 5 storms excluded from the second sample +by the pre-existing trackability gate cluster at 26–33°N/67–134°E in +June–September — the exact monsoon-season geography flagged as +contamination-prone twice before (§5.7's blind land storm, §5.9's worst +storm) — showing the trackability gate is already doing real filtering work +for free, on a completely different axis than the wn1_frac regime filter. + +**The reusable lesson, and why this entry exists separately from the last +one:** *when a follow-up result HELPS your preferred story, run the same +scrutiny you'd run if it hurt it — apply the retroactive check, do the +statistics, report the weakening if the mechanism doesn't survive contact +with its own prediction.* This session's regime-contamination hypothesis was +mine, felt right after §5.9, and did not survive being checked against the +data that was supposed to support it. The number that DID hold up (apparatus, +6/7) is not the flashier "we found the real mechanism" story — it is the +more mundane "the label itself is noisy when storms move slowly" story, and +it earned its position by surviving a check the flashier story failed. +CT-F14 (a single properly-powered displacement-filtered sample, n≥25–30) is +now the correctly-scoped next step — not a third exploratory rerun of a +sample that already ran twice. + +## 2026-08-11 — E-N-EQUALS-TWO-LOOKED-LIKE-PHYSICS-AND-WAS-HALF-COIN-FLIP-1 + +**Status:** FINDING `[G]` — CT-F5 + CT-N, `comet_tail_f5_n10.py` / `.json`, +report §5.8–5.9. Closes the arc's own standing item ("n ≥ 10 storms before +any constant"); supersedes nothing, differentiates everything. + +**CT-F5 (small, closes a named defect):** the walking-center fix (search near +the *previous* level, not always the surface, 250 km/step) corrects storm 2's +CT-F1 saturation defect. Its winning level (500 hPa, −4.5°) is reached by a +**0.0 km step**, so the pass is untouched by the saturation that appears one +step later, outside the tested band. Storm 2 goes from NO-VERDICT to a clean +pass; storm 1 reproduces bit-identically (verified post-hoc — the F5c field +was pre-registered but never coded, a gap admitted rather than smoothed over). + +**CT-N (the headline): a blind 10-storm sample split the comet-tail claim into +two claims with DIFFERENT truth values, and only one of them survives.** +wn1-dominance and explanatory power (E1/E4) replicate cleanly at scale +(median wn1_frac 0.72, median R² 0.90, both clear their bars) — **the signed +left-of-motion prediction that made storms 1–2 exciting does not** (6/10 = +0.60 same-sign, against a 0.70 bar; a naive p=0.5 null already gives +P(≥6/10)≈0.38, i.e. statistically unremarkable). What looked like 2/2 at +p=0.0625 was, on independent storms, close to a coin flip. CT-N5 (does a +wind-based center generalize the way it did for storm 2 alone?) also fails +at 6/10; CT-F9 (does land-fraction asymmetry correlate with the unexplained +residual, testing candidate 2's real mechanism) returns a clean non-support +(corr = −0.30). + +**Two post-hoc leads, explicitly NOT used to rescue the FAIL:** restricting to +the 4 storms with displacement ≥ 250 km/6h (closer to storms 1–2's own +regime) lifts sign-consistency to 3/4 = 0.75; dropping only the single most +extreme low-displacement/near-polar outlier lifts it to 6/9 = 0.667. Both +point at plausible, testable confounds — motion-bearing noise at small +displacement, and storm-type contamination in a purely blind sample (one +selected storm at 32°N in July is very plausibly a monsoon low, not a +baroclinic system, and has the sample's worst wn1/R²). Filed as CT-F10 +(pre-registered displacement filter) and CT-F11 (pre-registered regime +filter) — a properly designed rerun, not a re-scoring of this one. + +**The reusable lesson, stated once so it doesn't need re-deriving:** a probe +result at n=2 can be right about STRUCTURE (a real, dominant, well-explained +mode) while being wrong about GENERALITY (whether its sign/direction is a +rule or a coincidence of which two examples were picked) — and only a genuine +n≥10 blind sample separates the two. Every earlier gate in this chain (F3's +apparatus check, F4's independent-definition check, F7's blind land-storm +selection) was local to storms 1–2; CT-N is the first gate that tests whether +storms 1–2 were representative at all, and the honest answer is "partially." + +## 2026-08-11 — E-A-JITTER-AMPLITUDE-YOU-CHOSE-IS-NOT-AN-UNCERTAINTY-YOU-MEASURED-1 + +**Status:** FINDING `[G]` — CT-F4 + CT-F7, `comet_tail_f4_f7.py` / `.json`, +report §5.6–5.7. Amends E-THE-OFFSET-WAS-THE-APPARATUS-... below, which stands +as written (it was correct for the amplitude it tested). + +**My apparatus test condemned a number using a sensitivity amplitude I picked +out of the air.** CT-F3 jittered the storm center by ±100 km and found the +alignment error moved 29.4° — so the −40° offset was declared unmeasurable. +But ±100 km was never *measured*; it was a plausible-sounding round number. +The non-circular question is **how far apart independent center definitions +actually land**, and that is the uncertainty. Four definitions across three +physical fields (sub-grid MSLP min; ∇²p centroid; **10m vorticity** centroid; +sub-grid z850 min) agree to **20 km** / **73 km**, and the answers they give +span **2.3°** / **6.5°** — so the real apparatus noise is ≈ ±3–7° and the +offset **is** measurable. F3 was not wrong; its amplitude was unjustified. + +**Two structural lessons, both reusable:** +1. *Prefer a measured disagreement to a chosen perturbation.* Independent + method variants are a free, non-arbitrary uncertainty estimate — and where + both exist, the isotropic jitter was a 2× **over**estimate, because real + variants cluster along a preferred axis rather than scattering evenly. +2. *An anti-vacuity guard must be allowed to refuse a PASS you want.* Storm 1 + scored a 2.3° spread — but its four centers agreed to 20 km, below the + 31.9 km grid diagonal, so the pre-registered CT-F4c guard returned + NO-VERDICT rather than banking a free pass. Storm 2, whose definitions + genuinely disagreed (73 km = 2.4× the diagonal), is the one that carries + the result. The guard cost me the tidier of the two numbers, which is + what tells me it was real. + +**Also, the friction candidate was partly MIS-SPECIFIED and the data said so +before I did.** CT-F7 measured cross-isobar inflow over land (blind storm +selection): **+34.2° land vs +20.5° ocean inside the same disk** — a paired +contrast that controls for depth/latitude/curvature, textbook magnitudes, both +bars passed. But F2/F7 bound the rotation of the **wind** relative to the +isobars, whereas the CT-E3 offset is a rotation of the **pressure dipole**; +friction does not rotate the pressure field except at second order. And an +unplanned pairing already in the F2 output points the wrong way for it: storm 1 +is 1 % land (+14.7° inflow), storm 2 is 46 % land (+22.0°), yet their offsets +are −42.0° and −40.2° — **the more frictional storm has the smaller offset.** +`[S]`, n=2, undesigned, recorded as suggestive. + +Net: candidate 1 (baroclinic tilt) leading and near-unopposed; candidate 3 +(center bias) bounded at ≈±5°; candidate 2 re-scoped, with CT-F9 written to +test the mechanism it *should* have been about (Ekman pumping vs land-fraction +**asymmetry** across the disk, not mean land fraction). Binding constraint is +now n ≥ 10 storms, not the apparatus. + +## 2026-08-11 — E-THE-OFFSET-WAS-THE-APPARATUS-THE-LADDER-WAS-THE-PHYSICS-1 + +**Status:** FINDING `[G]` — CT-F1/F2/F3 run, `comet_tail_followup.py` / `.json`, +report §5. Follow-up to E-CYCLONE-ASYMMETRY-IS-ONE-DIPOLE-1 below. + +**I ran my own apparatus gate first and it FAILED, which killed the number I +was about to explain.** The −42°/−40° common offset moves by up to **29.4°** +under a ±100 km center jitter — comparable to the offset itself. So the offset +magnitude is inside the apparatus noise and no constant may be fitted from it; +CT-E3 is re-graded in place (the ±45° left-of-motion HIT stands, the magnitude +does not). + +**But the mechanism test found a much bigger signal than the thing it was sent +to explain.** Sweeping geopotential over all 13 levels (one chunk, so the +yes/no became a ladder): the alignment error climbs **monotonically** from +≈ −40° at 1000 hPa through zero in the mid-troposphere (≈600–650 hPa storm 1, +≈400–500 hPa storm 2), spread 101.8°/91.6° — **3–5× the apparatus noise**, and +exactly the baroclinic-tilt/steering-level prediction. Friction was +independently bounded: measured 10m cross-isobar inflow +14.7°/+13.0° over +ocean (right sign, textbook magnitude), so it owns ≈⅓ of the offset at most. + +**Three transferable rules, each earned here:** +1. *Apparatus before mechanism, and mean it.* Had F3 run second, both F1 and F2 + would have been written up as explanations of a number that isn't there. +2. *A failed gate generates the next probe, not an exemption.* The 3–5× size + comparison is recorded as a post-hoc observation and routes to CT-F4 + (sub-grid center fit) — NOT used to override the failed bar. That override + is the "indictment fired → post-hoc rescue" anti-pattern already on this + arc's open-P1 list. +3. *Add diagnostics, never bars, after a run.* A diagnostic added post-run-1 + caught F1's own defect — its center finder **saturating at the 600 km search + radius** on storm 2's upper levels (it locked onto a different system), which + had produced a physically absurd "best level = 100 hPa". Verdict corrected to + NO-VERDICT on that path rather than reported as a refutation. + +The headline claim is untouched: wn-1 dominance, the R² lift, and +left-of-motion never depended on the offset. What died is the constant I would +otherwise have shipped. + +## 2026-08-11 — E-CYCLONE-ASYMMETRY-IS-ONE-DIPOLE-1 + +**Status:** FINDING `[G]` for the measurements (n=2, pre-registered, committed +unmodified, `db57aac0`); `[H]` for generalization; the −40° offset mechanism +and the encoding consequence are `[S]`. Full documentation: +`probes/weather-p1/COMET_TAIL_REPORT.md`. + +**The non-axisymmetric residual of a translating extratropical low is almost +entirely wavenumber-1, and the dipole's orientation is predicted by the +storm's own motion vector.** Measured on two real storms (WB2 ERA5 MSLP, +2021-06-15 12Z→18Z): wn-1 carries 0.924 / 0.895 of the azimuthal residual; +ring-profile + one dipole lifts in-disk R² from 0.635/0.294 to +**0.972/0.926**; low pole lands left-of-motion (NH geostrophic prediction) +within ±45° on 2/2 (null 0.0625), with a *common* −42°/−40° offset — +steering-level/baroclinic-tilt rotation is the prime `[S]` candidate, Ekman +friction second, center-finder bias to be excluded first (CT-F1..F3 +pre-registered in the report, not run). + +**Why it matters here:** (a) it RESOLVES the sunflower probe's axisymmetry +FAIL — the missing third of the storm WAS the tail, one mode, not many; (b) +the compact form `center + ~12 ring means + ONE dipole ≈ 93–97 %` fits the +highheelbgz (start, stride, length) address shape, and the dipole encodes the +motion — a single-frame motion predictor is the named next falsifier, gated +behind the plan-§8 adversarial audit per E-ZERO-FOR-ELEVEN below. + +> **Regraded 2026-08-11 (CodeRabbit, PR #926).** Two claims in this entry are +> superseded by later entries and are corrected here rather than left to +> mislead: (a) **`≈ 93–97 %` → `90.9–94.3 %`** — that figure was a +> 36-parameter per-ring fit, not the 14-value form this sentence describes +> (`E-THE-HEADLINE-NUMBER-MEASURED-A-MODEL-NOBODY-CLAIMED-1`); (b) **"the +> dipole encodes the motion" is NOT established** — the falsifier named here +> was subsequently run four times over three independent samples (n=41), and +> the largest and best-powered of them (CT-F14, n=19) gives 0.684 at p=0.0835. +> The directional claim stays SUGGESTIVE. The structural half of this entry +> (wn-1 dominance, the axisymmetry resolution) is untouched. + +## 2026-08-11 — E-ZERO-FOR-ELEVEN-THE-AUTHOR-CANNOT-AUDIT-HIS-OWN-FALSIFIERS-1 + +**Status:** FINDING `[G]` — measured by the 13-agent verify/attack pass on +`weather-substrate-evaluation-v1.md` (run `wf_99d677e6-b45`; plan §8 is the +full record). + +**Every one of the eleven EV test specs failed adversarial pre-registration +audit** — 10 VACUOUS, 1 UNDERSPECIFIED, zero SOUND — despite being written by +an author who had *just* been corrected through seven sections +(§12.10–§12.17) for exactly these failure modes and cited the falsifiability +rule inside the specs themselves. Meanwhile the same pass CONFIRMED 22 of 24 +KNOWN-ledger claims outright (2 PARTIAL: a file path; "whole-field shift" +overstating a sprite translate). + +**The asymmetry is the finding:** the author was reliable about what IS +(evidence-backed claims, 22/24) and near-uniformly unreliable about what WOULD +FALSIFY (0/11). Specimen defects, each a house classic reborn: a silence half +that was an identity comparison (calm tiles, where the shift rounds to 0); a +silence half that was an arithmetic tautology (`circular == linear` for +`|a−b| ≤ 128` — the 90° sector spans 64); `count > 0` implied by the sampling +design (`elimination_rate()` verbatim); a vacuity guard pre-satisfied by +committed data; "monotone" satisfiable by a dead knob; a fixture that 404s at +the pinned timestep feeding a pipeline whose anomaly step destroys the very +bound-mass under test; an "exact to 1e-4" gate over 3-sig-fig prose constants +AND Monte-Carlo statistics; a claim naming top-k with no criterion touching +top-k; a stale-fixture route where a "winter" run re-measures summer bytes; +`cos(lat)` missing from the one formula that fires where winds are strong. + +**Rule:** *pre-registration review by independent adversarial readers is +load-bearing, not ceremony.* Naming a discipline is not applying it, and the +spec's author is structurally the wrong person to find its vacuous pass +routes — same-author review already failed measurably ONCE this arc (§12.10 +announced the right frame and shipped the wrong one). Route every probe spec +through an attack pass BEFORE its first run; the attack is cheap relative to a +probe that cannot fail. + +## 2026-08-11 — E-THE-FRAME-WAS-ALREADY-SHIPPED-FOUR-TIMES-1 + +**Status:** FINDING `[G]` — read in source this session. + +**The `mu + kσ` calibrate → band → roll-on-drift frame exists FOUR times in this +workspace, and I hand-wrote a fifth in Python after being corrected into it.** + +| instance | metered quantity | +|---|---| +| `ndarray::hpc::cascade::Cascade` — `expose()` → `Band`, `observe`/`recalibrate` | Hamming distance | +| `perturbation_sim::rolling_floor::RollingFloor` — `threshold()` = *"the **confidence-interval** floor"*, `z()` = *"the **Jirak-honest** noise-floor units; significance via `n^(p/2−1)`, not IID"*, `band()` → Stable…Alarm, `preheat()` | mode instability | +| `helix::quantize::RollingFloor` — `quantize`/`bucket_center`/`observe`/`roll` | palette `[a,b]` | +| `thinking-engine::domino` — *"3σ top-K focus"* | table attention | +| **`probes/weather-p1/p1_ci_vs_floor.py` — MINE** | ERA5 bucket CI | + +`perturbation_sim::RollingFloor` **is** the "corrected evaluation frame" that +took three correction sections (§12.10–§12.12) and an operator intervention to +reach — including the Jirak citation, in the doc comment. + +**Also found in the same sweep, all `[G]`:** + +- **`crates/perturbation-sim` is the applied instance of the whole stack** — + `splat.rs` (Gaussian-splat **magnitude** side) + `sketch.rs` (Walsh/XOR **sign** + side) is *literally* OGAR's two-algebra rule; `cascade_key.rs::morton48` is the + OGAR production HHTL address; `hhtl.rs` derives `(HEEL,HIP,TWIG)` by **Cheeger + bisection of the Laplacian**. +- **64×64 "Stockfish ergonomics" is an exact identity:** `64×64 = 4096 cells = + 4096 bit = 512 byte = 64 × u64` = **the CANON node stride**. A node's bits ARE a + bitboard; `masked_popcount_batch(words, mask)` IS `popcount(attacks & targets)`; + magic bitboards are the same LUT amortization as the `[a,b]` floor. +- **`symbiont/src/domino.rs` already proves the AMX path** — 4×4 Morton BF16 + tiles, **16 SoA boards per AMX 16×16 tile GEMM**, cascade feedback, real + `TDPBF16PS` on Emerald Rapids. + +**Rule:** **before writing a frame, grep the workspace for the frame.** The +`Consult, don't guess` ladder (card → knowledge doc → board → source) has no rung +for *"search the sibling crates for the thing you are about to build"* — four +misses in one document say it needs one. A measured number computed twice is not +a wrong number; it is a wasted one, and it hides the fact that the first +implementation already carried the caveats you were about to rediscover. + +## 2026-08-11 — E-TOPOLOGY-PICKS-THE-TABLE-NOT-THE-DOMAIN-1 + +**Status:** FINDING `[G]` — `DistanceLut::circular()` proven a metric +EXHAUSTIVELY over all 256³ = 16 777 216 triples (`distance.rs`, 3 tests). + +**Supersedes both `E-THE-REUSE-IS-THE-PROCESS-…-1` and +`E-JUDGE-THE-FIELD-NOT-THE-ELEMENT-1`.** Operator: *"distance.rs is normalized +[a,b] amortizing in LUT."* + +**The LUT is the AMORTIZATION POINT, not merely a metric or a cache.** +`quantize()` normalizes `[a,b]` once per element at ingest; `from_floor()` folds +the *same* normalization into the table. Afterwards: no bounds, no division, no +per-element normalization — a pure index lookup, in **unit-free** units, which is +exactly what licenses cross-variable comparison. O(256²) once, not O(N²). + +**Consequence:** if the LUT amortizes *any* bounded `[a,b]`, a **circular** range +is just another bounded range with a different formula. Built and proven: +`circular()` = `min(|a−b|, 256−|a−b|)`, the cycle-graph geodesic on `Z_256` — +**0 violations / 16 777 216 triples**, symmetric, identity, positive. Falsifier: +`d_circ(255,0) = 1` vs `d_linear(255,0) = 255`. + +**So the crate's *"raw-azimuth is NOT a metric (the 2π wrap)"* is about the +FORMULA, not about angles.** `linear()` is the wrong table for a ring; +`distance_heuristic` uses no table at all. A wrapping quantity in the 256-palette +with the circular table is metric-safe and stays in the index domain. + +| azimuth as | resolution | metric? | field shape | +|---|---|---|---| +| u16 raw + `linear()` | 0.0055° | **no** | not tileable | +| **u8 palette + `circular()`** | **0.352° mean** | **yes** | `&[u8]` · 128 KB L1 · `U8x64` · AMX | +| nearest-`n` | 0.972° mean | yes | single index | + +The palette azimuth beats nearest-`n` **and** keeps the field ergonomics. The +previous entry was right about the ergonomics and wrong to treat them as +disqualifying: the fix was never "abandon the direct path", it was **give the +wrapping lane its own table**. + +**Rule:** **a bounded quantity's TOPOLOGY selects its table formula; it never +decides whether the quantity belongs in the palette domain.** Amortization, L1 +residency, `U8x64` lane and AMX plane are identical either way — that is what +makes the substrate general rather than per-quantity. + +## 2026-08-11 — E-JUDGE-THE-FIELD-NOT-THE-ELEMENT-1 + +**Status:** FINDING `[G]` (crate-stated: `distance.rs:8-12`; `ndarray` +`int8_tile_gemm::int8_gemm_amx_tiled(a_u8, b_i8, …) -> [i32]`). + +**Corrects `E-THE-REUSE-IS-THE-PROCESS-AND-IT-EXPOSED-A-FIT-PROBLEM-1` (below): +its 10× measurement stands, its VERDICT is inverted.** + +**Operator:** *"you didn't factor in that due to normalized values the field has +different ergonomics than the single value — meaning AMX matmul, tile ops etc."* + +**A normalized representation must be judged by what its FIELD does, not by what +one element decodes to.** The 10× scored **angular reconstruction error** — the +operation the substrate exists to avoid, and the exact metric this workspace +already ruled out for scoring a one-way address over a retained original. Third +instance of that error in one arc; this one landed three sections after the rule +was written down. + +At field scale the ergonomics run the other way: + +| | nearest-`n` | direct `(polar, azimuth)` | +|---|---|---| +| direction collapses to | **ONE index**, 256-palette domain | 3 lanes, one 16-bit **circular** | +| compare | 2 × `DistanceLut` u8 lookups — **L1 metric**, CAKES/CLAM-safe | **not a metric** — `distance.rs:8-10`, the 2π wrap "must never feed CAKES bounds" | +| LUT | 128 KB, L1/L2-resident, **`U8x64`-friendly** | 65536² is not a table | +| tile shape | a `&[u8]` plane → `int8_gemm_amx_tiled` **directly** | none | +| decode to compare? | **no** | **yes** | +| per-point error | 0.972° | 0.097° | + +**Resolution — split by OPERATION, not a winner.** Compare/search/correlate a +field → the single-index path (this is what *"pay the inbound tax once"* buys, +and why palette256 is the same pattern one rank down). Materialize one bearing → +the direct path, 10× finer, but *"never reconstruct per element when the +representation is normalized"* makes that the rare path, not the design centre. + +**Rule:** a per-element accuracy number is the round-trip metric wearing a +different hat. A representation can win it and simultaneously destroy the +index-domain comparison, the metric guarantee, and the tile shape that made the +substrate worth building. **Ask what the field does under the ops you actually +run — LUT, SIMD lane, tile/AMX — before ranking encodes.** + +## 2026-08-11 — E-THE-REUSE-IS-THE-PROCESS-AND-IT-EXPOSED-A-FIT-PROBLEM-1 + +**Status:** FINDING `[G]` on the measurement (`crates/helix/tests/bearing_encode_paths.rs`, +N=65536); `[S]` on the API shape, which is an operator call. + +**Operator correction:** *"the reuse of the above for the wind was always part of +the process (what you call invention)."* A prior entry +(`E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1`) filed the missing +bearing-encode under *invention* and declined to build it. **That was an +over-correction** — generalizing "don't invent structure the code already +determines" into "don't implement the intended reuse." + +**The line, drawn properly:** INVENTION = asserting structure the code already +answers (a bit budget, a lane reading, a `Pair48`, a round-trip API the crate +disclaims). REUSE = applying the shipped, proven codec to a new domain — which +is what a normalized substrate is *for*. **A missing entry point for a designed +reuse is a plumbing gap, not a design refusal.** + +**And the reuse immediately earned its keep.** `encode_signed` derives all three +direction-bearing fields from `n` alone (`residue.rs:182-204`). The knowledge doc +`helix-cartesian-vs-fisher2z.md` prescribes *nearest spherical-Fibonacci +`(n, sign)`* for encoding a direction. **Measured, that prescription does not fit +weather:** + +| horizontal bearing | nearest-`n` (prescribed) | direct `(polar, azimuth)` | +|---|---|---| +| 0° / 90° / 270° | 1.933° / 2.706° / 1.897° | **0.000°** each | +| mean, 24 bearing×elevation cases | **0.972°** | **0.097°** — 10× | + +**Mechanism:** the golden spiral couples latitude and azimuth through ONE index. +Reaching `y ≈ 0` needs `n ≈ N−1`, and those few `n` have azimuth already fixed at +`n·φ` — **a bearing at the horizon cannot be chosen independently.** The lattice +is equal-area on the **disk**, so its latitude density is ∝ `sin(2·lat)`: +sparsest exactly at the equator. Surface normals (the case the doc was written +for) spread over the sphere and never hit this; wind clusters at the horizon and +always does. + +**Rule extracted:** *a doctrine written for one domain is not automatically +right for the next one that reuses it.* The doc's prescription is correct for +normals and should be labelled with its case rather than read as universal. The +direct write is licensed by the doc's own split — rim = metric carrier, +`(polar, azimuth)` = direction, *"direction is place-INDEPENDENT"* — at the +stated cost that the two halves no longer share one `n`. + +**Corrects:** `E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1` (its "the real +gap… deliberately not built" framing). What that entry got right and keeps: the +`Signed360`-is-complete finding, the `Pair48` withdrawal, and the mandatory +`READ BY:` rule. + +## 2026-08-11 — E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1 + +**Status:** FINDING `[G]` (operator-directed; authority is +`.claude/knowledge/helix-cartesian-vs-fisher2z.md`, in this repo, with a +`READ BY:` header naming this exact kind of session). + +**Corrects E-A-CORRECTION-IS-A-CLAIM-AND-CARRIES-A-CLAIM-S-BURDEN-1 (below) — +the third link in that same chain, and the entry it corrects is its own rule +firing again.** The `Pair48` successor shape that entry recommends is +**WITHDRAWN, not deferred.** Full regrade: +`.claude/knowledge/weather-normalized-substrate.md` §12.12. + +**The doctrine doc for orientation codecs exists in `.claude/knowledge/`, its +`READ BY:` header says *"ANY session that encodes/decodes/renders an +orientation, normal, or direction"*, and the entire helix arc never opened it** — +not before the design, not during the envelope audit, not through four +successive corrections. Reading the primary source (`crates/helix/src/*.rs`) was +mistaken for reading the doctrine. `residue.rs` states the byte layout +truthfully; it does **not** say which field is metric and which is render, nor +that the sign already completes the sphere. That is precisely what the knowledge +doc carries, and what a `READ BY:` header is *for*. `CLAUDE.md` § *Consult, +don't guess* already orders it: card → **knowledge doc** → board → *then* source. + +**What the doc settles, against the audit's inferences (the FACTS all stood; the +INFERENCES were wrong):** + +1. **`Signed360` alone is a COMPLETE full-sphere direction** — *"you do NOT need + a second 'pos' helix to complete it"* (`helix-cartesian-vs-fisher2z.md:77-82`); + the sign partition is what makes it whole. Hence no pair lane, hence the + withdrawal. +2. **`ResidueEdge` / `rim` is the METRIC carrier, not a render input** — *"never + run the rim's atanh/tanh to recover a direction"* (`:83-86`). Direction lives + in `(polar, azimuth)`. The operator said this first: *"ResidueEdge is + turbovec, nobody was asking you to use turbovec."* +3. **The crate's *"no free 2-DOF direction codec"* means no *helper*, not no + *capacity*.** `azimuth` is *"`n·φ mod 2π` mapped to `[0, 65536)` over the + full 360°"* (`residue.rs:85`). What is genuinely absent is `from_normal`; + encoding is a **nearest spherical-Fibonacci search** with a worked reference + pair (`:90-93`, q2 `scratch-fma/helixbake`). +4. **The metric hazard I "found" is crate-documented, not a discovery** — + `distance_heuristic` names its own failure mode as *"the raw-azimuth 2π + wrap"* and forbids it for CAKES bounds (`residue.rs:52-59`). The real shape + is a **split, not a defect**: rim = L1-metric (`DistanceLut`, triangle + inequality); azimuth = circular render carrier, deliberately not L1. My error + was routing a bearing through the *metric* field, then reporting the + consequence as a property of the codec. + +**Also settled — the name.** `helix360` **does not exist and never did** +`[G-absence]`: pickaxe over full history (all refs + unreachable objects) returns +12 blobs, all authored by that session, **zero deletions, zero blast radius**; +ndarray and the `lance-graph2` backup carry none. The symbol is **`Signed360`**. +A hunt for a deleted artifact that was only ever a mis-remembered name. + +**What still stands from the entry below:** the no-per-value-lane-reading-selector +finding (`[G-absence]`, 15 hits / zero writers / zero decoders), the +`Signed360::sign()` all-zero dormant-lane defect (still filed, still unfixed), +and — sharpened by this entry — its own **rule**. + +**Rule (unchanged, now three links deep):** a correction is a claim and carries a +claim's burden. **Extension:** before correcting a domain claim, check whether +the domain already has a `READ BY:` doc. If it does, that doc is a **mandatory +read, not a suggestion** — four corrections written without it were four +corrections written blind. + +## 2026-08-11 — E-THE-TRANSFORM-MUST-MATCH-THE-DISTRIBUTION-SHAPE-1 + +**Status:** FINDING `[H]` (measured on real ERA5, one timestep — re-runnable at +`probes/weather-p1/`; needs a second variable + season before `[G]`). + +**Fisher-Z DEGRADES a weather-anomaly palette.** Real ERA5 `2m_temperature`, +1,038,240 gridpoints, both paths into the same 256 buckets over the same +0.4–99.6 percentile window: **linear MAE 0.0684 K, 0 empty buckets, 115.7 +effective buckets** vs **Fisher-Z MAE 0.2168 K, 76 empty buckets, 28.1 effective +buckets** — 3.2× worse error, 228 of 256 buckets burned. + +**Mechanism, measured on this sample:** `arctanh` is ≈identity near 0 and +explodes near ±1, so it moves resolution *toward the bounds*. The tested ERA5 +`2m_temperature` anomaly (one timestep, 2021-06-15 12:00 UTC) has 77 % of mass +inside |s|<0.25 (**excess** kurtosis +3.30, mass in the MIDDLE); a +correlation-like control `tanh(N(0,1.5))` has 32.7 % beyond 0.9 (mass at the +BOUNDS). **CONJECTURE `[S]`, generalizing beyond the tested sample: the +transform must match the input distribution's shape.** The *measured* claim is +narrower — for THIS field at THIS timestep, Fisher-Z costs address economy. +Promotion to a general rule needs the second variable and season named below. + +**Terms:** *effective buckets* = `exp(Shannon entropy)` of the 256-bin occupancy +histogram (how many addresses actually carry data); *drift score* = `max|occ−μ|/σ` +under a multinomial null, exactly as `crates/helix/src/quantize.rs:119-146`. Fisher-Z is right for correlation-like inputs and for +helix's own `r = √u` (equal-area placement concentrates toward the rim BY +CONSTRUCTION) — nothing about the helix crate is impugned. What is falsified is +generalizing its transform to bell-shaped geophysical fields, which is exactly +what `weather-normalized-substrate.md` §1.2 did. "One shared transform ⇒ one +comparable substrate" does not survive; the shared palette + LUT may. + +Also measured: ARCO-ERA5 has **no `wind_speed` variable** (exhaustive, all 52 +arrays), so §6.5's Jensen-gap measurement cannot have come from the Phase-A +store; blosc is variable-dependent — **1.794×** (`2m_temperature`), **1.771×** +(`2m_dewpoint_temperature`), **1.248×** (`10m_u_component_of_wind`), each one +chunk `[1,721,1440]` at t=547476, blosc/lz4 as stored — not one 1.27×; +the BF16 anomaly gain reproduces in DIRECTION only (74.9× under a zonal-mean +climatology proxy vs the doc's unreproduced 97×). + +## 2026-08-11 — E-A-CORRECTION-IS-A-CLAIM-AND-CARRIES-A-CLAIM-S-BURDEN-1 + +**Status:** FINDING `[G]` on the code facts and on its own rule; **its `Pair48` +successor recommendation is WITHDRAWN and several of its INFERENCES are +regraded** — see `E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1` (top of +file) and `weather-normalized-substrate.md` §12.12. Read that first. + +**A correction written in the same breath as the error it replaces has had no +independent gate — and one of ours was wrong.** The helix arc's ledger entry C2 +recorded rejecting a 12-byte `FacetSchema::Pair48` for wind from/to, on the +ground that "the 6 B `HelixResidue` lane is already 2×24 in/out by +construction", citing `canonical_node.rs:963`. That line is a **comment** +stating a **width identity (48 = 2×24) plus coverage**, never a structural +in/out claim. **The rejected 12-byte `Pair48` was the structurally correct +answer** — C2 replaced a right answer with a wrong one and banked the wrong one +as a lesson, i.e. the failure mode compounding inside the ledger built to catch +it. + +The audit falsified the whole premise: `Signed360` is ONE signed orientation +(`rim(3)+polar(1)+azimuth(2)`, `residue.rs:76-116`); `ResidueEdge` **cannot carry +a hemisphere sign at all** (`sprite_replay.rs:56-63` — `Sign::Neg` reconstructs +as `Sign::Pos`, *"a real, measurable structural error"*); it has **no azimuth**, +the only angular field in the lane; and the crate states twice, unprompted, that +**no 2-DOF direction codec exists** (`sprite_replay.rs:47`, +`continuous_field.rs:31-43`) and that inventing one is the "invented round-trip +API" it warns against. Also: `end_idx` is monotone in `n` (`residue.rs:258-266`, the +`end_idx_monotonic_in_n` test) ⇒ **non-circular**, so a wrapped bearing puts +359° and 1° at maximum L1 distance; `DistanceLut`'s triangle-inequality +guarantee (`distance.rs:22-33`, regression `:87-105`) is about a **linear** +index order and does not survive being re-purposed as an angular one +(`residue.rs:53-55` names this failure mode for `distance_heuristic`). + +**Structural finding worth keeping regardless of weather:** there is **no +per-value-lane reading selector in the contract at all** — `ReadMode` has three +axes (tail / value_schema / edge_codec), none of which selects a *reading* of a +value lane; `EdgeCodecFlavor` covers `EdgeBlock`, a different region. Exhaustive +grep (`HelixResidue`, all `**/*.rs`, unbounded): 15 hits, **zero writers, zero +decoders**. Correct successor shape if a pair is needed: a NEW 16-byte facet +lane read as `Pair48 = [Signed360; 2]`, codec in `crates/helix`, lane in the +zero-dep contract, discriminant **16** — `15` is reserved for `BoardAggregates`. + +**Pre-existing defect found in passing:** `Signed360::sign()` decodes an +all-zero, never-written lane as a definite `Sign::Neg` (`residue.rs:109-115`), +where sibling lanes `Tekamolo` / `CausalWitness` explicitly define all-zero as +*unaddressed* / *unbound*. Violates the CANON zero-fallback ladder. Filed, not +fixed. + +**Rule:** route corrections through the same gate as originals. "I was wrong +before" is not evidence the new version is right. + +## 2026-08-11 — E-HELIX360-IS-THE-NORMALIZED-SUBSTRATE-NOT-A-BIT-BUDGET-1 + +**Status:** FINDING `[G]` for every code fact (file:line in the doc); the weather +mapping is `[H]`; the floor policy is `[S]` pending probes. **⊘ Two corrections: +"helix360" is this session's coinage — the symbol is `Signed360`, no `helix360` +exists in any repo `[G-absence]`; and the "2×24 = from AND to" reading below is +FALSE — one `Signed360` is already a complete full-sphere direction. See +`E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1` (top of file).** + +**The finding, in one line:** helix360 is a Fisher-2z-hydratable golden-spiral +projection — two 24-bit equal-area hemispheres glued at the equator (Poincaré +rim densification via `arctanh`), stored as the existing 6-byte content-blind +`ValueTenant::HelixResidue` lane (`U8×6 @ row_offset 112`) whose 2×24 reading IS +"wind coming from AND going to" — and palette256 is the same mechanism one rank +down (fisher **z** → u8 → 256×256 LUT = the cosine replacement). The z-form is +kept **normalized, not materialized**: variance stabilization puts unlike +variables on one scale, which is what makes cross-variable correlation a +legitimate LUT operation ("correlate what normally can't be correlated") and +what makes 8 bits sufficient per scalar. `hyperbolic_depth` being exposed but +never called in the encode path is the DESIGN, not an unwired seam. + +**The one real open decision found by reading `quantize.rs`/`distance.rs`:** +`RollingFloor` is per-instance and `quantize` is linear over `[lo,hi]`, so +cross-variable code comparability is a calibration POLICY (shared canonical +z-floor vs per-variable floors vs hybrid) the weather ingest must set +explicitly, stamped via `floor_version` and proposed to align with Lance +dataset versions. Probes P1–P6 queued. + +**The correction arc (operator-caught, five instances, one species):** an +invented 48-bit budget where `Signed360` already existed; a 12-byte `Pair48` +proposal for a lane already 2× by construction; "unwired 2z" where +not-materializing is the point; "scalar similarity" where the value is the +normalization; plus the earlier bearing-snapping/wind-speed measurement +inversions. Meta-rule: *consult-don't-guess applies to one's own prior +in-session statements* — they carry no evidentiary weight until checked +against the tree. + +**Doc:** `.claude/knowledge/weather-normalized-substrate.md` (full detail: +projection, wire shapes incl. the #498 sign-partition regression, floor +mechanics + loss accounting, measured-evidence ledger with conditions, ingest +spec with the corrected ARCO-ERA5 object name, verification battery, probe +queue, correction ledger). Companion plan §0 gains ⊘ C3 (wrong Zarr object +name) in the same commit. + +## 2026-08-10 — E-CLAUDE-MD-KEY-DEPENDENCIES-WENT-STALE-AND-PROPAGATED-A-WRONG-PIN-INTO-A-PLAN-1 + +**Status:** FINDING `[G]` (verified against `Cargo.lock` + every crate manifest). + +`CLAUDE.md` § Key Dependencies — **the mandatory first read for every session** — +carried four stale pins, dated *"Verified against Cargo.lock 2026-06-14"*, which +pre-dates the lance-9 sweep (`b2b08b07`, 2026-08-05): + +| CLAUDE.md said | tree actually has | +|---|---| +| `lance = "=7.0.0"` | **`=9.0.0`** | +| `lance-linalg = "=7.0.0"` | **`=9.0.0`** | +| `lancedb = "=0.30.0"` | **`=0.33.0`** | +| `datafusion = "53"` | **`54`** | + +**The propagation is the finding, not the staleness.** The wrong `datafusion 53` +travelled: stale `CLAUDE.md` → restated in-session → written into +`weather-substrate-poc-v2.md` §6 (PR #915, merged) → *and* mischaracterized there, +because `datafusion 54.1.0` in `Cargo.lock` was filed as suspicious drift when 54 is +in fact our correct, deliberate, **MEASURED** direct pin +(`.claude/plans/lance9-datafusion54-upgrade-probe-v1.md`, 2026-08-05). **A POC +session trusting either document would have pinned lance 7 against a lance-9 tree +and failed to build.** + +**⊘ Self-correction, same hour (operator-caught).** The first version of THIS entry +then called `datafusion 53.1.0` a *"residual transitive."* Wrong, and more dangerous +than the original error: it frames a required dependency as cruft, inviting a future +session to collapse `Cargo.lock` to a single major and silently break the `delta` +feature. **Both majors are REQUIRED and the dual state is documented upstream:** +`deltalake-core 0.32.4` pins `datafusion 53.1.0` (+ `datafusion-datasource`, +`datafusion-physical-expr-adapter` at 53.1.0); the lance family pins 54. Cargo +permits the coexistence precisely because they are different semver majors. It +resolves only when deltalake moves to DF 54 — not by any action here. + +**The meta-lesson:** "this version looks unexpected" has three possible causes — +*stale doc*, *real drift*, and **legitimate multi-major coexistence**. I reached for +the first two and skipped the third, twice in opposite directions. Before labelling +a version anomalous, read *who requires it*; a lockfile entry with a live requirer +is a constraint, never a leftover. + +The lockstep discipline itself was never violated: every manifest carries exact +`=9.0.0` / `=0.33.0`. **Only the docs lagged** — which is the more dangerous +failure, because the code compiles and the doc is what a new session reads first. + +**Rule:** a version block asserting *"verified against Cargo.lock "* is a +claim with an expiry. When a dependency sweep lands, the sweep's PR must update +every doc that restates its pins — the same-commit board-hygiene rule, applied to +version facts. Grep for the old version string across `.claude/` and `CLAUDE.md` +before closing a bump. + +Corrected in this PR: `CLAUDE.md` (all four, + `lance-index`, + a `rust` line +pointing at `rust-toolchain.toml` as authoritative), the plan's §6 with a dated +`⊘ CORRECTION` block (append-only, not a silent edit). + +## 2026-08-10 — E-A-COMMENT-THAT-RESTATES-A-PINNED-VALUE-GOES-STALE-EVERY-BUMP-1 + +**Status:** FINDING `[G]` (two recurrences in the same file, both in git history). + +`rust-toolchain.toml`'s comment restated the pinned version in prose. It has +therefore been **wrong twice**: + +1. said `1.94.1` after a bump → fixed by `10f87fb6` + (*"docs(toolchain): fix stale 1.94.1 comment"*); +2. said `1.95.0` after the bump to `1.97.1` (`b2b08b07`) — **the identical failure, + ~3 months later**, because the earlier fix corrected the *value* and left the + *structure* that guarantees the value goes stale. + +A bump edits `channel = "…"` and nobody re-reads the paragraph below it. The +one-off correction resets the clock; it does not stop it. + +**Structural fix (this PR):** the comment **no longer restates the version at all** +— it points at the `channel` line as authoritative — and carries an **append-only +bump log** instead, one line per bump with its commit/PR and reason. Appending +cannot contradict; re-narrating always can. + +**Generalizes beyond this file:** any prose that duplicates a machine-readable +value has a half-life. Either derive it, or make the duplicate append-only. (Same +shape as `E-CLAUDE-MD-KEY-DEPENDENCIES-WENT-STALE-…-1` above, found the same hour — +one is a config comment, the other a doc table, both duplicated a pin and both went +wrong.) + +## 2026-08-10 — E-JC-AND-NDARRAY-BOTH-SHIP-A-RELIABILITY-BATTERY-WITH-DIFFERENT-DEGENERATE-CONTRACTS-1 + +**Status:** FINDING `[G]` (source-verified 2026-08-10, both files read). + +`pearson` / `spearman` / `cronbach_alpha` / `icc` exist in **BOTH** +`jc::reliability` (`crates/jc/src/reliability.rs`) and `ndarray::hpc::reliability` +(`ndarray/src/hpc/reliability.rs`) — with **different degenerate-input contracts**: + +| | `jc` | `ndarray::hpc` | +|---|---|---| +| signature | `-> Option` | `-> f64` | +| degenerate (n<2 / zero variance) | `None` | **`0.0`** | +| icc | `icc(ratings, IccForm)` | `icc_a1(ratings)` | +| cronbach input | `&[Vec]` | `&[&[f64]]` | + +**Why this matters and is not cosmetic:** ρ = 0.0 is *also a legitimate measured +value*. The ndarray form therefore cannot distinguish "no correlation" from +"undefined" — a zero-variance window (entirely possible in a real field: a constant +patch, a saturated code lane) silently enters an aggregate as a real 0.0 and drags +the mean down, where `jc` would have returned `None` and forced the caller to decide. +This is the same shape as the vacuous-assertion family: a value that cannot fail +loudly. + +**Ruling:** `jc` is the authority (operator-named "the lance-graph JC crate"); the +ndarray copy is the SIMD-side mirror. **Every reliability number in the weather POC +is computed with `jc`.** Their agreement over identical non-degenerate inputs is +itself a probe (plan `weather-substrate-poc-v2.md`, D-WXB-4), paired with an +assertion that the degenerate case is *reported*, never folded. + +Cross-ref: `.claude/plans/weather-substrate-poc-v2.md` §3; `jc` = "Jirak-Cartan: +five-pillar proof-in-code" (zero external deps; Pillar 11 `hambly_lyons` is +sigker-gated); `E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1`. + +## 2026-08-10 — E-THE-DOCUMENTED-PROXY-BYPASS-IS-FOR-PUSH-DENIALS-NOT-CLONE-AUTH-1 + +**Status:** FINDING `[G]` (reproduced and resolved in-session). + +Cloning `AdaWorldAPI/{ecmwf-opendata,weatherbench2,arco-era5}` failed with +`fatal: could not read Username for 'https://github.com'` — which reads exactly like +a repo-scope denial, and two independent signals reinforced that misreading: + +1. `mcp__claude-code-remote__{list_repos,add_repo}` genuinely are **not exposed** in + this session (confirmed with two different ToolSearch queries), so "the repo is + out of scope" was the available hypothesis; and +2. this workspace's own documented lesson (tesseract-rs `CLAUDE.md`, GitHub access + matrix) says *"a 403 here is USUALLY THE PROXY — retest with the proxy bypassed"*, + which sent the diagnosis further the wrong way. Bypassing the proxy failed too. + +**Root cause: self-inflicted.** The agent proxy **already injects credentials** for +these repos. Passing an explicit `-c http.extraHeader="Authorization: Bearer $TOKEN"` +**overrode** the proxy's injected credential with a form GitHub's git endpoint +rejects. Plain `git clone`, proxy ON, **no explicit header**, works for all three. + +**What broke the tie:** a REST probe — `HTTP 200` on all four repos +(`lance-graph` + the three new) proved the token had access, so the failure had to be +the *method*, not the scope. + +**Rule:** the documented "bypass the proxy" reflex is for **push denials**; for +**clone auth**, adding an explicit `Authorization` header is the bug. Never hand-roll +credentials for a transport that already carries them. (Token discipline held +throughout — expanded inline via `${GH_TOKEN//\"/}`, never printed, and +`.git/config` verified free of credentials after cloning.) + +Cross-ref: tesseract-rs `CLAUDE.md` § GitHub access matrix (the push-side half, which +remains correct). + +## 2026-08-08 — E-THREE-NAMED-PROBES-ARE-ONE-MEASUREMENT — F-1, helix's unrun fidelity gate, and the weather-encoder question are the SAME probe + +**Status:** FINDING `[G]` on the identity (three docs, one measurement shape), `[H]` on the outcome (unrun). Surfaced by the 5-agent recon behind `.claude/plans/weather-substrate-poc-v1.md`. + +Three probes have been carried independently, in three places, each named as blocking: + +1. **F-1 (codebook fidelity)** — `substrate-unification-thesis.md` §4.1: does hierarchical-4⁴ (a byte's nibbles = its centroid's ancestry) preserve rank-distance vs flat k-means-256? Named in the OGAR canon, **un-run**. Its KILL: if it fails, "prefix-is-ancestry" degrades from *code* to *router* and a large fraction of the `[H]`/`[S]` map collapses at once. +2. **helix's own gate** — `crates/helix/KNOWLEDGE.md:338-343`: fidelity vs certified `Base17Fz` is **CONJECTURE, probe NOT RUN**, gate ≥0.9980 Pearson. +3. **The weather-encoder question** — does a 48-bit `Signed360` preserve *synoptic* distance? (the gate the whole retrieval/analogue lane stands on). + +**They are one measurement:** *does a quantized hierarchical code rank like the continuous quantity it encodes?* Only the dataset differs. And `bgz17` already ships **both arms** — `Palette` (flat k-means 256, `palette.rs:112`) and `HierarchicalPalette` (16 coarse × 16 leaves with `coarse_is_ancestor_of`, `palette.rs:214,451-493`) — plus measured anchors on other data (`PaletteResolution`: Full256 ρ=0.992 / Half128 ρ=0.965 / Quarter64 ρ=0.738, `palette.rs:543-582`). So the *instrument* has been sitting in-tree, built, the entire time; what was missing was a dataset whose ground truth the workspace did not author. + +**Why weather is the right dataset for it, not merely a convenient one.** Every prior corroboration in this arc has been internal — four sessions converging, probes designed by the same people holding the thesis (thesis §5 warns explicitly that convergence can be shared blind spots as easily as shared truth). Weather supplies a **physical** ground-truth distance (field RMSE) that no one here chose, at a scale (10⁶ points) that exercises the hierarchy rather than a toy. Running the bake-off on weather answers all three questions with one number — and a **negative is thesis-relevant, not weather-relevant**: it would demote prefix-ancestry workspace-wide, which is precisely why it must be run before more is built on top. + +**Consequence for planning:** do not schedule these as three separate probes in three repos. One bake-off (`D-WX-5`), arms C vs D carrying F-1, arms A/B carrying helix's gate, all under Jirak-bounded significance (`I-NOISE-FLOOR-JIRAK` — grid fields are weakly dependent by construction; classical Berry-Esseen is wrong here). Mandatory anti-vacuity per `E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1`: include a shuffled-codebook encoder that **must** fail — a bake-off where every arm passes has measured nothing. > **Entries from 2026-08-06 onward live in `entries/` — one file each.** > See `entries/README.md` for the index. This file is the archive of everything > before that date, plus two bare-date group headers that need a boundary diff --git a/.claude/plans/r2il-machine-semantic-contract-v1.md b/.claude/plans/r2il-machine-semantic-contract-v1.md index b7bf9dfa6..c89758e2b 100644 --- a/.claude/plans/r2il-machine-semantic-contract-v1.md +++ b/.claude/plans/r2il-machine-semantic-contract-v1.md @@ -515,6 +515,199 @@ MedCare-rs: owns corpus, bake state, withheld mapping lists, receipts starts specifying ontology ingestion, bake artifacts, or concrete crosswalk lists, the clean cut has failed — move that text to the consumer repo and leave a pointer. + +### 7.7 ADDENDUM 2026-08-26 — no executive chooser; the two materials are COUPLED, not controller-and-controlled + +> Register: PLAN + vocabulary correction. Operator-ruled. Scoped to this +> plan's own boundary (§7.6): the FORM of the mechanism and its topology +> falsifier. The consumer-side half — expected-vs-observed firing over a +> real corpus, focus dynamics, candidate pruning — belongs to MedCare-rs +> and is recorded there, not here. + +**The rejected formulation, recorded because it is the tempting one.** A +session proposed closing the activation loop with + +``` +chooser(spine, alpha) -> next_address +``` + +— an executive selector holding both planes and deciding. **Rejected.** +It reintroduces a scheduler layer the architecture does not have, and it +makes the transition an act of selection rather than a consequence of +substrate state. The wording never reached a document; it is written down +here so it is not re-proposed as an obvious move. + +**The corrected mechanism — two materials running simultaneously:** + +``` +COLD readonly ontology/SoA + baked executable routes + → where activation is EXPECTED to conduct +HOT local reaction field: activation · focus · signed conductance + → where it ACTUALLY conducts, and where resolution is concentrated + +cold route fires → hot field reacts → hot field changes local conductance + → another cold route fires → repeat +``` + +Neither material controls the other. The next firing is a consequence of +the coupled state. This is a strictly stronger claim than the open-loop +diagnosis it replaces, and a strictly weaker one than a chooser: it must +be shown that the coupling *alone* produces a transition. + +**The local field carries TWO readings, not one.** Activation (which +material is firing) and focus (where gain/resolution is concentrated) are +co-located at the same coordinate. Focus is **not** a selector — it is +modulation, `effective ≈ activation × focus`, so a wide region may be +active while attention occupies one aperture. A saccade is then the +movement of the focus field over the active field, never a pick from a +candidate list. **Do not hard-code this as an ABI struct**; the +requirement is semantic co-location at one address, and §7.2's verdict +that the geometry itself is unearned is untouched by it. + +**Signed learned conductance is a hypothesis with a separation +requirement.** Token/macro identity stays a stable id; the *contextual* +contribution may be a signed `i8` (positive retain, near-zero dormant, +negative suppress-from-frontier). Suppression removes a candidate from +the current frontier and **never** deletes its canonical identity. The +ordering that follows — **prune before hydration**: compact weights → +mask/threshold/top-k → hydrate only survivors — is an efficiency claim +and owes the null in `F-HOT-6` (recorded consumer-side). + +**Unchanged and re-affirmed:** `R2IL carries fidelity, BPE carries +repetition` — `expand(macro)` must be byte/operation-identical to the +underlying sequence (B4). Hot learned wiring is **not** a world-causal +claim: it may never create or mutate a CE64 edge, and the promotion +ladder of §7.3/§7.4 (with its demotion half and hysteresis) governs any +crystallization back into cold material. Frequency is not truth. + +**Topology falsifier, extending §7.2's control set:** + +``` +F-HOT-9 Replace the local geometry with random-6 / square-4 / square-8 / + k-NN under an otherwise identical coupled loop. + If behaviour is unchanged, the GEOMETRY is rejected while the + hot-field abstraction survives. +``` + +That split is the point: this addendum increases what the hot field is +asked to *do* without granting the honeycomb one inch of unearned lease. + +### 7.8 ADDENDUM 2026-08-26 — V4 = V3 + executable content; the three-tier JIT; OWL lowered to IR + +Operator-ruled, same day as §7.7. Three sentences of doctrine, then the +architecture they imply. All CONJECTURE-graded until the probes at the end +run; the doctrine sentences themselves are operator rulings, not findings. + +**The doctrine (pin verbatim):** + +1. **V4 = V3 + executable content.** Nothing about the bytes moves — same + 4+12 facet, same 512-byte stride, same `ENVELOPE_LAYOUT_VERSION`. What + changes is what a classid can RESOLVE to: a ClassView whose content tier + holds executable R2IL. A V4 row IS a V3 row; a V3 reader just doesn't + know it can run. The "version" lives in the resolver's capability — + exactly where I-LEGACY-API-FEATURE-GATED wants it. No migration, no + layout gate, no bit reclaim. +2. **The learned encoding is an INDEX, never the AUTHORITY.** The hexagon + substrate's measured 99.6% op-decode (3 training programs, muscle-memory + arc) is a recall number, and execution cannot ride on recall — a + mis-decoded op that executes is silent corruption. Two-tier decode: + hexagon PROPOSES (associative, ~always right), the exact ogar-r2il + tables (ARITY/MNEMONICS, O(1)) VERIFY. Agree → execute. Differ → table + wins, the disagreement becomes a training example. The 0.4% tail fails + LOUD into the slow lane and teaches; it never mis-executes. Same + relationship CAM-PQ has to the full fingerprint (search tier vs truth + tier, I-VSA-IDENTITIES). +3. **Execution is population-masked, never per-row.** The interpreter's + unit of work is (program, mask), not (program, row). One instruction, + N lanes: the varnode read/write is an ndarray SIMD sweep over the + facet-register columns; dispatch amortizes over the mask's popcount. + Divergence = split the mask, run both arms masked, re-join (an + `and_not`, not an architecture). The interpreter never sees a `long[]` + of rows — mask-native law applied to interpretation. + +**The three-tier JIT (the operator's Cranelift framing, grounded):** + +| tier | engine | trigger | status | +|---|---|---|---| +| 0 — decode | hexagon recall + exact-table verify | every op | hexagon measured 99.6%; verify tables SHIPPED (ogar-r2il) | +| 1 — interpret | vectorized r2sym (r2sleigh × ndarray masks) | every (program, mask) | r2sym exists row-at-a-time; vectorization is the build | +| 2 — native | `ndarray::hpc::jitson_cranelift` via `lance-graph-contract::jit::JitCompiler` | HOT programs | Cranelift engine SHIPPED behind `jit-native`; trait SHIPPED | + +**The profiler already exists and it is the alpha channel.** Tier-up needs +a hotness counter; `AlphaStamp{cycle, seq, visits}` IS one. A program body +whose alpha visit count crosses threshold gets handed to jitson; +`KernelHandle` caches it. The meta-awareness concern and profile-guided +optimization are the SAME mechanism read at two rungs — the open-loop +activation plane (§7.7's hot material) doubles as the JIT profile with +zero new machinery. This is the strongest structural argument yet that +alpha belongs in the contract tier (beside `attention_facet`), consumed by +whatever hosts the interpreter. + +**OWL/RDF lowered to IR — the scope fence that keeps it honest:** + +The lowering target is **OWL RL** (the forward-chaining rule profile), +NOT full OWL DL. OWL RL rules compile to R2IL naturally: a SubClassOf +axiom = a masked facet check + mask union; a property chain = a masked +hop sequence; materialization = run rules to fixpoint, where the fixpoint +test is FREE in mask algebra (the delta mask is empty). Full DL needs +tableau reasoning — do not promise it, do not build it. + +This completes the compiler picture with the tier the stack already has: + +- **AOT** = the ontology BAKE (MedCare's closure tables — `is_a` rails, + ancestor closures). What is known at bake time is compiled ahead. +- **Interpreter** = R2IL over masks, for rules that arrive AFTER the bake + (dynamic axioms, per-tenant rules) — no re-bake needed. +- **JIT** = jitson for the dynamic rules that alpha proves hot. + +So "lower OWL into IR like Cranelift" is not a metaphor: bake/interpret/ +tier-up is literally the JVM/V8 model with the alpha plane as the +profiler and the ontology bake as AOT. + +**Space binding + write-back (from the same-day co-architecting, so it +doesn't dilute):** R2IL `register` space = the node's own 12-byte facet +register; `ram` = classid-prefixed SoA lanes (the GUID is the pointer); +`unique` = never-persisted scratch. `machine_memory_map` (0xC604) is the +per-class binding table — which rails a program may read/write: +ClassView for behavior. The interpreter's `Store` never writes through; +it emits into the open cycle image (mailbox-owned) — R2IL executes hot, +lands cold, one writer preserved. + +**Probes, in dependency order (each independent; 1–2 need no ndarray +wiring):** + +- **PROBE-R2IL-DECODE-AUTHORITY** — hexagon-proposes/table-verifies over + the trained corpus: the 0.4% must be CAUGHT (disagreement detected), + zero silent mis-executes. The safety case for everything above. +- **PROBE-R2IL-LIVE-REGFILE** — one harvested 6502 routine, N=1, + facet-register byte-parity vs a reference emulator after N instructions. + Proves the space binding. +- **PROBE-R2IL-LANES** — same routine, N=64K masked lanes through the + ndarray sweep. The throughput number that makes "realtime" credible. +- **PROBE-OWL-RL-FIXPOINT** — one OWL RL rule set lowered to R2IL, run to + fixpoint over a baked population; inferred-mask parity vs the bake's own + closure for the axioms both know. Gates the AOT/interpreter seam. + +**Java/Valhalla arm, settled:** a Java interpreter (even value-class +flattened) ends where lance-graph-java's own law points — compute lands +through Panama into ndarray kernels anyway, so it buys a second +interpreter that drifts. Java STEERS (which mask, which program address, +when): one ABI call `(program_ref, mask_handle) → mask_handle`, bulk and +lifecycle-clean. Rust EXECUTES. One interpreter, two front-ends. + +**§7.8 grading note (same day, measurement-skeptic pass):** the 99.6% +hexagon decode figure is **operator-reported; the artifact is NOT located +in this workspace.** Grep over this board + plan finds no such +measurement, and §7.2's own honest gate (2026-08-25) states the learned +hex-topology layer "does not exist" here. So either the measurement lives +in another session/repo (to be linked when named), or it is remembered +imprecisely. Either way the doctrine is UNCHANGED — sentence (2) is +precisely the rule that makes the architecture safe under an unverified +recall number: the exact tables are the authority regardless of what the +proposer's true recall is. Consequence for sequencing: +PROBE-R2IL-DECODE-AUTHORITY's *verify seam* is buildable now against a +pluggable proposer; the hexagon plugs in when its artifact is located. +PROBE-R2IL-LIVE-REGFILE needs no proposer at all and is buildable today. --- ## §8 — The plasticity falsifier ladder (operator brief merged, 2026-08-26): one queue, pre-registered first experiment @@ -842,3 +1035,174 @@ saturates and inverts**, so C3 binds and BPE is unranked. Full reading, the post-hoc density sweep, and the follow-up a valid comparison needs: `E-Q7-FREQUENCY-SIZING-RESCUES-THE-LEARNING-GATE-BUT-NOT-THE-INTERFERENCE-CLAIM-AND-THE-2-BYTE-RAILS-ARE-COMPLEMENTARY-NOT-COMPETING-1`. Instrument reverted; board-only outcome. + +**§7.8 continuation (operator-ruled, same day) — RDF intake IS the V4 +program source; the lowering is a PROJECTION, not a compilation:** + +The lance-graph-ontology RDF intake arm produces V3 (baked axiom rows). +**Treated as V4, the SAME rows are the execution projection + behavior +learning** — no second pipeline, no emitted artifact: + +- The predicate classid SELECTS an R2IL template; the row's own facet + bytes ARE the operands. `SubClassOf` → masked-check-and-union; + property chain → masked hop sequence. The program is a ClassView-style + projection over rows that already exist — the zero-copy law extended + one rung (*the array is a projection* → *the program is a projection*). + Re-bake and the "code" updates for free; there is no second artifact + to drift. +- This is the shape `lance-graph-contract::jit` already has: + `JitCompiler::compile(&JitTemplate)` — **one template per RULE KIND, + never per axiom**; instances are rows. The template seam was pre-built. +- Consequence for the earlier open question (content-tier vs ActionDef + field): it only ever applied to the HARVEST arm. Two program sources, + one interpreter: **projected** (ontology rules — stored nowhere) and + **stored** (harvested imperative bodies — content tier, keyed by + action address). The intake pipeline changes not at all; V4 costs the + bake nothing. +- **"Behavior learning" defined:** execution of projected rules deposits + alpha (visits per template × population); hot templates tier up + through jitson; the decode-disagreement stream trains the learned + overlay. The substrate learns WHICH OF ITS OWN AXIOMS IT USES and gets + faster at exactly those. The ontology stays declarative cold truth + (CE64-fenced per §7.7 — learned wiring never creates/mutates an edge); + what is learned is the conduction pattern over it (hot). Coupled + materials and the JIT are one mechanism. + +PROBE-OWL-RL-FIXPOINT is unchanged in intent but sharpened in form: it +runs the PROJECTED reading (template × axiom-row operands) against the +bake's own closure — proving the lens, not a compiler. + +**§7.8 second continuation (operator-compressed, same day) — the zipper +isomorphism: R2IL is stacked masks over codebooks, and a masked rail +zipper is the same object (pure fragment only):** + +The operator's compression: *"R2IL is a bunch of stacked masks of +codebooks; if you stack masked rail as a zipper it might work +similarly."* Named mechanism, not rhyme: both are **prefix-scoped +codebook selection**. An R2IL opcode is a codebook index that scopes how +the following slots decode; a rail byte-pair is a codebook index whose +codebook the prefix selected (longest-prefix binding, OGAR canon). SLEIGH +decode is the same automaton (bit prefix → constructor table → operand +fields). Consequences: + +- **Tier-0 decode is ONE mechanism** — `decode(prefix_state, bytes) → + (op, state)` serves the 6502 stream, the GUID rails, and the R2IL + stream. The muscle-memory training trains one learned object: the + prefix-scoped codebook family. Address recall and op recall are the + same skill. +- **An address IS a program.** One zipper descent step = one + op-application = the hop law `Mask × ClassView → Mask`. A rail path is + a maximally compressed straight-line program (the level implies the + operation; the per-level op vocabulary is the ClassView carving). + Navigation needs no special case in the interpreter. +- **A baked ancestor closure IS a JIT-compiled navigation program** — + the composed mask of a hot descent, precomputed. §7.8's "bake = AOT" + is literal under this reading, with rail paths as the source language. + +**THE FENCE (load-bearing):** the isomorphism holds for the PURE fragment +only — selection, load, mask algebra. Rail descent has no `Store`; R2IL +does. Addresses are pure straight-line programs; the effectful fragment +(stores → open cycle image) is R2IL-only. Without this fence, "an address +with side effects" is the SURREAL-AST trap in a new coat — behavior +riding the address, T2 violated. + +**PROBE-ZIPPER-HOP-PARITY (new, and the CHEAPEST in the queue — run it +first):** take one real rail path, replay it as explicit R2IL ops through +the masked interpreter, and require the resulting mask to be +BIT-IDENTICAL to the native hop path's mask over the same population. +Green → navigation and execution are one algebra, proven. Red → the +zipper reading is demoted to poetry before anything is built on it. +Needs only existing pieces (masks, ClassView carving, ogar-r2il tables) — +no r2sleigh, no hexagon, no emulator. + +**PROBE-ZIPPER-HOP-PARITY: RUN, GREEN (2026-08-26 — OGAR +`crates/ogar-r2il/tests/zipper_hop_parity.rs`, commit 66946e8, PR #286).** +The zipper isomorphism's pure fragment is promoted **CONJECTURE → +FINDING**: a 3-level rail descent over a 197-row `FacetCascade` slab, +answered as (a) one fused u128 prefix compare (the compiled/closure +shape) and (b) an op-at-a-time interpretation of a straight-line +`Load`/`IntEqual`/`BoolAnd` program dispatched through the real `R2ILFn` +table, is **bit-identical** — with a trap population making per-level, +per-byte, in-order matching load-bearing (rows for AND→OR, lo-byte-only +compare, skipped level, out-of-order pairs, half-pair), all five disable +runs red-then-green. The fence is executable: `Store` is refused by the +pure-fragment interpreter; a core byte below the domain floor is refused +by the table. Zero-copy end to end (reinterpret views, in-place register +reads, unique-space scratch, masks both sides) per the operator nudge: +*V3 and V4 are both zero-copy — serialization exists only in the intake +arm; after that it is codebook-index masking algebra.* Scope honesty: +proven for the PURE fragment at depth ≤ 3 over a synthetic slab; the +effectful fragment and real baked populations remain with +LIVE-REGFILE / LANES / OWL-RL-FIXPOINT. + +**§7.8 third continuation (operator paradox + census, 2026-08-26) — the +Valhalla/Panama paradox resolves; r2sleigh has NO zero-copy executor yet +but its IR is already zero-copy-shaped; freeze/thaw are the zipper's two +directions:** + +Operator: *"it might be faster to use Java Panama Valhalla as a C64 +emulator than running it in JITson, because Valhalla knows ABI-shaped +masking and Panama knows zero copy… JITson on the other hand becomes +materialization."* + +**Census (r2sleigh fork, measured):** `Varnode {space, offset, size}` is +LITERALLY a MemorySegment slice descriptor — the IR was born zero-copy. +The ONLY executor is `r2sym`, and it materializes everywhere BY DESIGN +(string-keyed `HashMap` register file; `HashMap` per-byte +memory; `Clone` values boxing Z3 ASTs; `step → Vec` whole-state +forks). Correct for symbolic path exploration; structurally the opposite +of realtime execution. **No concrete interpreter exists in the fork.** + +**Paradox resolution:** Java would be fast there because Panama (state = +slab addressed by offset/size, never a keyed map) + Valhalla (values +scalarized, never reified) + HotSpot PGO accidentally implement the +three properties this arc already ruled: zero-copy slabs, masked value +flow, alpha-profiled tier-up. Rust provides the first two DELIBERATELY +(`&mut [u8]` per space; `Copy` + monomorphization — Rust has had +Valhalla since 1.0) and the third is the alpha/jitson tier. **Verdict: +no JVM; build the concrete slab executor in the fork** — an `r2conc`- +shaped crate beside r2sym, sharing the IR: `SlabState` (one flat slab +per space: register = the facet register slab, ram = the lane slab, +unique = scratch) + `step(&mut self, op: &R2ILOp)` over the concrete +subset. This is LIVE-REGFILE's prerequisite and its natural first +deliverable. + +**"jitson becomes materialization" — affirmed, precisely:** a compiled +kernel is a materialized second projection of behavior, legitimate ONLY +as an ELEVATED cache (profile-derived, `KernelHandle`-held, discardable, +regenerable), never authority. Index-never-authority applies at tier 2 +identically: the IR / axiom rows stay truth; the kernel is a cache entry +with a demotion path. + +**"Can behavior with R2IL and hexagon become frozen and learned?" — +YES, and the zipper FINDING makes it well-defined:** +- LEARNED (soft) = hexagon decode recall + alpha's conduction pattern, + grown in production from the disagreement stream. +- FROZEN (crystallized) = a hot behavior compressed into its composed + form. Three freeze targets, ascending: a composed MASK (result + frozen, the baked-closure shape) · a jitson KERNEL (execution frozen) + · a new straight-line R2IL BODY (trace-JIT: the hot path through + branches frozen branchless). +- **Freeze = program → address; thaw/learn = address → program** — the + two directions of the zipper isomorphism, whose pure-fragment round + trip PROBE-ZIPPER-HOP-PARITY just proved exact. +- Gates already shipped: §7.3 crystallization admission + DEMOTION gate, + §7.4 reversible trust. A frozen artifact that disagrees with the + interpreted authority under sampled differential execution is demoted + (re-thawed) — the tier-0 propose/verify structure applied at tier 2. + +**r2conc SHIPPED (2026-08-26 — r2sleigh PR #5, branch +claude/c64-6502-falsifier-shztkk restarted from master per merged-PR +rule).** The concrete slab executor the §7.8 census called for: +`SlabState` borrows `register`/`ram` (`&mut [u8]` — machine state lives +with the caller), owns `unique` scratch, registers `Custom(n)` slabs +explicitly (the 6502's case-sensitive `RAM` alias → `UnknownSpace` when +forgotten, never conjured). Transient LE u64 values, nothing reified; +semantics anchored to r2sym for differential runs (carry-out, sign-fill +ashr, byte-offset subpiece with OOR as refusal, trunc-toward-zero sdiv); +direct branch targets = varnode OFFSET (p-code), indirect = value; +everything outside the concrete subset fails LOUD. 12 falsifiers, 6 +disable runs red-then-green (logged in the module doc), clippy/fmt/ +workspace-check green. PROBE-R2IL-LIVE-REGFILE is now unblocked: lift a +6502 routine → run through SlabState → register-file byte parity vs a +reference emulator.