Zero-copy joins: relations are lanes, a side is an index map $i (mork-pathmap-probe, crepe-plan-probe)

.claude/agents/hypothesis-atomizer.md

@@ -0,0 +1,72 @@
+---
+name: hypothesis-atomizer
+description: >
+  Gate before ANY verdict on someone's hypothesis, plan, proposal, PR or
+  board post. Splits a compound claim into atomic hypotheses (one subject,
+  one predicate, one condition), anchors each to the proposer's own words
+  with its qualifiers, and forbids a bundle verdict. Blocks attribute
+  substitution (answering an easier question), qualifier dropping, straw
+  men, conjunction errors and own-work anchoring. Sibling of
+  premise-auditor (which audits the QUESTION; this audits the VERDICT).
+  Verdicts: ATOMIZED-CLEAN / BUNDLED (block: re-answer per atom) /
+  SUBSTITUTED (block: evidence answers a different question) /
+  QUALIFIER-DROPPED (block: refutation ignores a stated scope) /
+  STRAWMAN (block: atom not in the source) / POOLED (block: a verdict
+  that reverses in some stratum — Simpson's paradox, G11).
+model: opus
+tools: Read, Glob, Grep
+---
+
+# hypothesis-atomizer — one claim, one verdict
+
+**Load first:** `.claude/knowledge/hypothesis-atomization-guardrails.md`
+(G1-G11, the 2026-10-21 incident, the output contract).
+
+## When this card fires
+
+- Before posting a verdict, review, finding or decision on another
+  session's or the operator's idea: EXO board posts, PR reviews, plan reviews,
+  "is this hypothesis right?".
+- Whenever the question contains two or more mechanisms joined by *and /
+  with / through / without / via / so that*.
+- When the draft verdict contains *partly, mostly, yes for … no for …, in
+  principle, it depends*. Those words mean a bundle verdict is being written.
+
+## Procedure
+
+1. Read the proposer's source in full (`FIRST-HAND-SOURCE-LAW`). Search
+   finds candidates; reading decides.
+2. Build the atom table (G1, G2, G3). Every atom gets a verbatim quote, its
+   location, and its qualifiers copied word for word.
+3. For each atom, write the steelman (G4), then the evidence, each with the
+   one-line question it actually answers (G5).
+4. Assign a verdict from `SUPPORTED-IN-CODE / REFUTED / OPEN /
+   NOT-PROPOSED` (G6). Refutations need cited evidence against the
+   qualified atom (G8).
+5. Declare dependencies and propagate only along them (G7).
+6. Run the own-work check (G9) and the reread pass (G10).
+
+## Blocking checks on a draft verdict
+
+| check | blocks with |
+|---|---|
+| any verdict sentence covering more than one atom | `BUNDLED` |
+| evidence whose stated question is not the atom's | `SUBSTITUTED` |
+| a refutation that fails under the atom's verbatim qualifier | `QUALIFIER-DROPPED` |
+| an atom with no quote from the proposer, used to judge the proposer | `STRAWMAN` |
+| a verdict pooled over strata that behave differently (carrier readings, relation law, axis, focus size, consumer, measurement arm); any `S/O`, "mostly" or "depends" cell | `POOLED` (block: one verdict per stratum, G11) |
+| the verdict-writer's own artifact used as the yardstick, with no unanchored verdict alongside | `OWN-WORK` (warning, must be resolved) |
+
+## Output contract
+
+Atom table → per-atom steelman, evidence and verdict → `MINE` block → the
+verdict tuple → the deciding probe for every `OPEN`. No prose summary over
+the bundle.
+
+## Discipline
+
+- The gate must be able to stay silent: a one-predicate question passes in
+  one line.
+- It never decides whether an atom is *worth doing*; that is a separate atom
+  the operator may raise.
+- Runs once per verdict, not on its own output.

.claude/agents/premise-auditor.md

@@ -20,6 +20,8 @@ tools: Read, Glob, Grep
 **READ BY:** the main thread before writing a 5+3 spec, a coresearch brief,
 or an escalation with options; both council harnesses call this card as a
 gate. Loads `.claude/knowledge/reference-frame-vs-motion.md` first.
+Sibling: `hypothesis-atomizer` audits the VERDICT the same way this card
+audits the QUESTION (one claim, one verdict, qualifiers kept).
 
 ## Why this card exists
 

.claude/board/entries/2026-10-21-classview-dr-iam.md

@@ -0,0 +1,56 @@
+# 2026-10-21 — ClassView × DR, IAM: a behavior compiled from what the class knows
+
+**Status:** MEASURED (lab, `crates/dir-rmap-probe`). **Basis:** operator
+kickoff "Quack Binding | ClassView | DR" and its add-on "compile behavior
+through relationship mapping" (2026-10-21). No new relationship,
+association, method-descriptor or planner type.
+
+## What runs
+
+- The user class declares, through the existing `ClassView::compute_dag`,
+  that `effective_roles` (position 1) is computed from `member_of`
+  (position 0).
+- A direct-routing table maps position 1 to the existing compiled closure
+  fold `Compiled::roles_of`.
+- `tests/classview_dr.rs`: the routed behavior equals dir-sim's own walk and
+  the crepe oracle for every user; a doubly supported role survives losing
+  one support; a class that does not declare the behavior computes nothing.
+  Disable runs: a wrong route fails two tests, ignoring the declaration
+  fails the silence test.
+
+## Measured (`examples/classview_dr_cost.rs`, 8,000 users, 1,495 groups)
+
+Per user, every answer checked equal to the direct path first:
+
+| route | ns |
+|---|---|
+| direct dir-sim walk (existing path, negative control) | ~450,000 |
+| direct prepared CSR walk | ~190 |
+| compiled fold, called directly | ~13–19 |
+| ClassView × DR via `execute_compute_dag` per row | ~100 |
+| ClassView × DR, declaration resolved once per class | ~13–19 (±0.4 over the fold) |
+
+Preparation (`prepare` + `compile`, once per version): FAILED GATE
+(millisecond scale), the same preparation D-RMAP-DIR-1 already carries.
+
+## Findings, per stratum
+
+- **Correctness:** equal to dir-sim and the oracle (test-pinned).
+- **Dispatch:** `execute_compute_dag` recomputes the topological order and
+  allocates on every call (~85 ns per row). Resolving the declaration once
+  per class removes it. ClassView decides once; only the routed fold runs
+  per row.
+- **Binding legality:** group slots are dir-sim ordinals of one snapshot
+  version; the probe's `Witness` is lab-local. The contract-level
+  frozen-codebook witness is still missing (shared with D-CMR-5, D-RU-6).
+- **SAP (bypass):** `BAPI_ORDINALS` is already a position map over
+  `CatsSchema`'s ClassView basis; existing tests (`edges.rs`
+  `bapi_order_is_a_permutation_over_canonical_field_identity`, byte pins)
+  pass. KEEP_DIRECT: no DR table, no new code.
+
+## Open
+
+- Whether to add a once-per-class resolution helper next to
+  `execute_compute_dag` in the contract (the measured dispatch cost).
+- The Odoo method case and relalg as a routed method are not run yet.
+- Preparation fails the gate.

.claude/board/entries/2026-10-21-coresearch-classview-algebra-polyfill.md

@@ -0,0 +1,147 @@
+# Co-research: what classes can do, and an algebra polyfill on ClassView — exploration map (2026-10-21)
+
+**Status:** OPEN — exploration map; ratifies nothing. Question (operator, 2026-10-21):
+"Was können Klassen und wo sind Potentiale und Synergien — besonders für Polyfill auf
+Algebra." Harness: `.claude/agents/coresearch-council.md`.
+
+**Premise gate (PREMISE-SPLIT).** "Realization selected per class" mixed two lifetimes:
+- (a) what a class DECLARES: its law and the properties that law satisfies (per class);
+- (b) which realization is CHOSEN for a binding instance (per class × binding state: focus
+  size, version, witness availability, answer type).
+
+**Anchors held:**
+- A1: ClassView decides, DR maps; no new Association, RelationshipShape, Through,
+  MethodDescriptor or planner type without a proven gap.
+- A2: D-RA-2 — the contract owns the laws, consumers own execution.
+- A3: ADMISSION B.
+- A4: no ms; mask-risc is the reference fold.
+- A5: SIMD via ndarray.
+- A6: G1–G11, one verdict per atom and stratum.
+
+## Council
+
+**Scouts:**
+- code cartographer;
+- internal prior art;
+- literature: Green–Karvounarakis–Tannen 2007, FAQ, GraphBLAS math, TACO format
+  abstraction, Halide, tagless-final, egg (all SECTION-READ);
+- systems: PostgreSQL operator classes and families, SuiteSparse:GraphBLAS, MLIR linalg,
+  Soufflé, DuckDB, Odoo ORM;
+- concepts: typeclass coherence, institutions, provenance semirings, Galois connections,
+  Kleene K3, OWL 2, FCA, binding-time analysis.
+
+**Co-architects:** bridge, firewall/fit, falsifier. The crosswalk has 33 rows (X1–X22 from
+outside, U1–U11 from the operator's reflection); raw output is banked in the session
+scratchpad.
+
+## What the outside world agrees on
+
+1. **The law is bound at declaration or bind time, never per row.** Every system and paper
+   does this (PG opclass lookup, GraphBLAS factory/JIT kernels, Halide schedules, TACO
+   codegen, tagless-final). This matches the IAM measurement: resolving the class once
+   costs ±0.4 ns over the fold, while `execute_compute_dag` per row costs ~85 ns
+   (entry 2026-10-21-classview-dr-iam).
+2. **A cheaper route is licensed by a law PROPERTY:**
+   - annihilator 0 → absent elements may be skipped;
+   - associativity → reordering or parallelism;
+   - semiring homomorphism → a result may be translated (positive RA only);
+   - commuting aggregates → variables may be reordered.
+3. **Nobody checks that a realization satisfies its law.** PostgreSQL says so explicitly
+   for families, and DuckDB's lossy casts change the law silently. The common gap is a
+   conformance gate.
+
+## Corrections the co-architects made to the crosswalk
+
+- **M1.** `Activation::register_law_for` returns `register128::RegisterLaw`
+  (RelativeOffset / AxisPosition / Support), which is a register byte law, not an algebra
+  law. The per-operation algebra carrier is `set_rules::Semantics`. X2 stays PARTIAL on
+  that basis alone.
+- **M2.** `execute_compute_dag` owns sequencing only (topo order plus abort). Each target's
+  value is a consumer closure called per call, so "dependency → recompute" is PARTIAL, not
+  ALREADY-HAVE.
+- **M3 (soundness gap).** The production `normalize`/`simplify` (`set_algebra.rs:164-215`)
+  is two-valued and applies complement rules unconditionally. The Kleene oracle exists only
+  under `#[cfg(test)]` (`set_rules.rs:609+`). Any lane that can carry NULL is normalized
+  under two-valued laws today.
+- **M4.** "compute_dag → executed fold" holds in the IAM probe path only. The contract
+  executor is the per-target closure route, so the contract-level grade is PARTIAL.
+- **M5.** "why-provenance = union of input masks" holds for monotone queries only; under
+  minus/NOT it over-reports.
+
+## The operator's reflection, per atom (no bundle verdict)
+
+| atom | verdict | evidence |
+|---|---|---|
+| class = signature (T,F,R,M,G) | PARTIAL | T, F, R reachable on ClassView. M (MethodSig / MethodTable) and G (ActionDef guard) sit on other surfaces, which OGAR doctrine wants. |
+| A relations → relalg | single table: SUPPORTED · join / composition / closure: OPEN | relalg lacks D-RA-3/4 |
+| B computed properties → fold | IAM stratum (Boolean, one relation): SUPPORTED-IN-CODE · other strata: OPEN | `dir-rmap-probe/tests/classview_dr.rs` |
+| C polymorphism = masked dispatch by ClassId | OPEN | `ternlog_dispatch` precedent; probe P1 |
+| D guards as Boolean masks | PARTIAL | computing a mask never authorizes (`ActionInvocation::commit`) |
+| E NARS reasoning | as finisher: SUPPORTED (D-CMH-1 `NarsRevision`) · as semiring: OPEN | two scouts independently say not shown; probe P6 |
+| CSE | SUPPORTED-IN-CODE | `SetProgram` lets / share |
+| fusion | OPEN | D-CMH-1 fused multi-sink folds |
+| incremental | OPEN | `execute_compute_dag` recomputes every target |
+| law table: Boolean / bag / topological | SUPPORTED-IN-CODE | `Semantics.truth`, `Semantics.population`, `compute_dag_topo_order` |
+| law table: sum | PARTIAL | `Semantics.arith` modes |
+| law table: min-plus | OPEN | probe P2 tests whether it lowers onto Boolean frontier folds |
+| law table: NARS | finisher only | |
+| biggest lever: compute_dag → RISC fold | IAM: SUPPORTED · elsewhere: OPEN | |
+
+## Exploration map
+
+**ADOPT-NOW** (test-only or a defaulted method; nothing changes behaviour):
+- **X9 / M3:** extend the `set_rules` rewrite-equality loop to `Truth::ThreeValued` against
+  the Kleene oracle (~20 lines). Either `NotTwoValued` refuses every complement rule, or the
+  loop prints a counterexample against `normalize`.
+- **X10:** a conformance helper generalized from `classview_dr.rs::check()` (~30 lines).
+  Every declared realization must match the mask-risc reference fold, per stratum.
+
+**PROBE** (each pre-registered by the falsifier with assertion, disable and silent twin):
+- **P1 (X17+U4):** polymorphism as a classid-mask partition plus already compiled folds.
+  Two classes, two `compute_dag`s, resolved once. Equals per-row dispatch on every row,
+  with timing in ns/row. Green means virtual dispatch is a fold primitive.
+- **P2 (X13+U10):** min-plus hop distance from iterated Boolean frontier masks, against
+  BFS on the dir-sim nest. Green means `ComputeEdge` needs no aggregate field.
+- **P3 (X4):** law-property flags derived from the `Refusal` catalogue
+  (`fn licensed(&Semantics)`, ~15 lines). Predicted admit/refuse must equal actual for every
+  Rule × Semantics pair.
+- **P4 (X6+X8):** `Count > 0 ⇔ Any` on positive programs; at least one counterexample
+  under minus/NOT.
+- **P5 (X15/U9):** incremental recompute via forward reachability from a dirty
+  `WideFieldMask` (`execute_compute_dag_dirty`, ~25 lines). Equals the full recompute.
+- **P6 (U6):** NARS revision associativity and distributivity on a quantized grid. The
+  semiring claim needs 0 violations.
+- **P7 (X18/X19/X20):** a ClassView law suite plus a cross-provider coherence diff. Assert
+  that the providers' classid overlap is non-empty first.
+- **P8 (X11):** frozen codebook: Eq always holds; Lt only when order-preserving.
+
+**PARK:**
+- X3: candidate realizations stay consumer-side (the IAM `DR` array) per A2, until a
+  second stratum needs them in the contract.
+- X5: blocked on the frozen-codebook witness.
+- X12: Soufflé `eqrel` closure (D-RU-6 Lab).
+- X13: no aggregate field until P2 decides.
+- X22: FCA.
+- U8: fused folds, owned by D-CMH-1.
+
+**SKIP:**
+- X14: egg on the bind path breaks A1 (cost extraction is a planner). Offline normal-form
+  generation only, never per binding.
+- Any per-row realization choice.
+
+**Smallest contract bridge, OPEN for the operator:** a defaulted
+`ClassView::semantics(&self, ClassId) -> Option<set_rules::Semantics>` returning `None`
+(~10 lines), fail-closed like `epistemic_reading`. The class never sets `universe`, which is
+bind-time. This makes the law reachable per class from an existing type, with no new type.
+
+## Not searched
+
+- worst-case-optimal joins; FAQ §5–8 (representation and tractability);
+- algebraic specification / initial algebras;
+- the PG GiST internals beyond the opclass chapter;
+- the NarsTruth source;
+- whether mask-risc `differential.rs` already covers P4.
+
+## Closeout
+
+`STATUS: open | OUTCOME: exploration map, 2 adopt-now test probes, 8 probes, 1 contract bridge proposal; one soundness gap named (M3) | OPEN: operator picks which to take forward`

.claude/board/entries/2026-10-21-zero-copy-join-index-map.md

@@ -0,0 +1,19 @@
+# 2026-10-21 — Zero-copy joins: the index map `$i` over lanes
+
+**Status:** OPEN (one failed gate, below). Lab only (mork-pathmap-probe, crepe-plan-probe).
+
+## What changed
+
+- A relation is two lanes (`ScalarBuffer<u32>`, shared with Lance's column buffers, no copy). A join side is an index map only: presence plane, per-slot offsets, and row positions into the lanes. Values are read in place (`lane[pos[k]]`), with a one-slot prefetch lookahead.
+- Answers are folds: counts read offsets, a pinned pattern inverts to one slot, enumeration reads `JoinRow` in place. The upstream MORK/PathMap row sets are only outside comparators.
+- The domain (global id → local slot) is a presence mask with a running count per word when the ids are dense (slot = rank + popcount, value order kept); a sparse id set keeps the sorted list.
+- A restriction is one `eq_u32_to_mask` over the lane; semijoin centers are a domain probed per row. The index map walks the kept bits. Nothing trims or copies rows.
+
+## Measured (crepe-plan-probe `examples/measure.rs`, release, loaded 4-core host)
+
+- With pushdown and semijoin (36 rows prepared), prepare is µs at every n up to 50 000; mask and terminal stay ns / low µs. Parity ok against every oracle.
+
+## Failed gate (OPEN)
+
+- The ablation arms without pruning (`no-semijoin`, `none`) at n = 50 000 index 56 k and 119 k rows and leave the µs budget. Cause: building `$i` from unordered lanes is a counting sort whose count and scatter passes cost about 10 ns per row here. A rank-free dense counting sort was tried and did not help (bound by the random writes).
+- Candidate fix, not decided: lanes sealed in key order at write time (the `OrderedLaneWitness` path `addressed.rs` already attests), so `$i` is run offsets and the scatter disappears. A relation keyed by two columns needs two orders or keeps a permutation. Write-path decision; the operator chooses.

.claude/board/entries/README.md

@@ -25,10 +25,11 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-410 entries, 2026-08-06 .. 2026-10-21.
+413 entries, 2026-08-06 .. 2026-10-21.
 
 | date | entry id | finding | file |
 |---|---|---|---|
+| 2026-10-21 | `zero-copy-join-index-map` |  | [2026-10-21-zero-copy-join-index-map.md](2026-10-21-zero-copy-join-index-map.md) |
 | 2026-10-21 | `D-RU-4` |  | [2026-10-21-u4-coaddressed-join.md](2026-10-21-u4-coaddressed-join.md) |
 | 2026-10-21 | `D-RU-3` |  | [2026-10-21-u3-cross-rule-cse.md](2026-10-21-u3-cross-rule-cse.md) |
 | 2026-10-21 | `D-RU-2` |  | [2026-10-21-u2-let-planes.md](2026-10-21-u2-let-planes.md) |
@@ -42,6 +43,8 @@ exactly one of them, never both.
 | 2026-10-21 | `D-CMR-2b` |  | [2026-10-21-d-cmr-2b-scratch-probe.md](2026-10-21-d-cmr-2b-scratch-probe.md) |
 | 2026-10-21 | `D-CMR-2` |  | [2026-10-21-d-cmr-2-lowering.md](2026-10-21-d-cmr-2-lowering.md) |
 | 2026-10-21 | `D-RU-6` |  | [2026-10-21-coresearch-ms-vs-ns-folding.md](2026-10-21-coresearch-ms-vs-ns-folding.md) |
+| 2026-10-21 | `coresearch-classview-algebra-polyfill` |  | [2026-10-21-coresearch-classview-algebra-polyfill.md](2026-10-21-coresearch-classview-algebra-polyfill.md) |
+| 2026-10-21 | `classview-dr-iam` |  | [2026-10-21-classview-dr-iam.md](2026-10-21-classview-dr-iam.md) |
 | 2026-10-20 | `D-RU-1` |  | [2026-10-20-u1-jc-batch.md](2026-10-20-u1-jc-batch.md) |
 | 2026-10-20 | `thought-git-replay-api-write-rubicon` |  | [2026-10-20-thought-git-replay-api-write-rubicon.md](2026-10-20-thought-git-replay-api-write-rubicon.md) |
 | 2026-10-20 | `ADR-2026-10-20-SIX` |  | [2026-10-20-six-decisions.md](2026-10-20-six-decisions.md) |