D-TGB-4: thought-git receipt and deterministic replay (lab, thought-git-probe)

.claude/board/STATUS_BOARD.md

@@ -389,7 +389,7 @@ Plan: `.claude/plans/ce64-hypothesis-layers-v1.md`. Plateau: `.claude/knowledge/
 | **D-TGB-1** | slot pool, autonomous: taken by `branch`, freed by `squash`/`discard`/`land` (the write is the Rubicon decision, 2026-10-20) | Shipped (lab, #1630/#1631; `crates/thought-git-probe/src/slots.rs`). Slot pool only: no production land, rebase or persistence (D-TGB-2..5 Queued) | at 63 taken `branch` picks a FIFO or least-used candidate, squashes it along its dependency chain if it has one, else evicts it (DECISIONS 2026-10-20; was: squash unremarkable first, else refuse); stale handles refused; 6 tests |
 | **D-TGB-2** | `w_slot` lane labels (W = thought layer, not a pointer) qualified by base version / slot generation | Queued (lab) | no live cell carries a landed slot; old-generation edge refused |
 | **D-TGB-3** | `Commit` lands one sparse batch through `LanceCycleWriter`; `DurableRef` = dataset + `Ref::Version(branch, version)` | Queued (lab) | empty cycle writes nothing; re-submit reconciles; two branches at version 7 told apart |
-| **D-TGB-4** | receipt (base ref, program id, seeds, slot generation) instead of history | Queued (lab) | replay from receipt reproduces writes cell for cell |
+| **D-TGB-4** | receipt (base ref, program id, seeds, slot generation) instead of history | In PR (lab, `thought-git-probe/src/receipt.rs`, entry 2026-10-21-d-tgb-4-receipt-replay; 10 tests, 10 disables red) | replay from receipt reproduces writes cell for cell |
 | **D-TGB-5** | reads as resident folds: `checkout`/`log`/`diff`/`blame` | Queued (lab) | equal the oracle; durable `diff` equals Lance `delta()` |
 | **D-TGB-7** | reusable git API: verb trait + types in the contract, one implementation crate; phase-1 driver `ogar-loco` / `ActionDef`, ACT-R in phase 2; first runs may call the engine crates directly; stack below: datafrog > mask-risc > relalg > r2il | Queued (lab) | driver independence: two drivers with the same decisions give byte-identical cells, receipts, metadata rows |
 | **D-TGB-8** | abstraction API: Datalog rules over the metadata table on `datafrog`; ACT-R `Candidate` / intent as the decision vocabulary | Queued (lab, after D-TGB-7) | rule answers == direct scan; recorded intents replayed as verbs reproduce the run byte for byte |

.claude/board/entries/2026-10-21-d-tgb-4-receipt-replay.md

@@ -0,0 +1,35 @@
+# 2026-10-21 — D-TGB-4: a receipt instead of history (lab)
+
+**Status:** TEST-PINNED (lab probe `crates/thought-git-probe`, `src/receipt.rs`, `tests/receipt.rs`; 10 tests, 10 disable runs red). Not wired into `cycle_driver`, `LanceCycleWriter`, the supervisor or CE64. Claim: EXO-50 `session_019fbZ92dFKQ5BJHrA3YcH9A/003`; issue EXO-58.
+
+## What landed
+
+- `Receipt`: base ref (dataset, branch, version), program id with its template version, program inputs as two lanes (sources, targets) read at one position, seed, execution config, the live slot and generation (provenance only), a fold over the values read, provenance roots, a fold over the writes, and the outcome.
+- `replay(receipt, store, config)` recomputes from the receipt alone; it takes no slot pool. It refuses on a missing seed, a changed config, an unknown base, changed sources (the source fold) or a different output (the output fold). Comparison is by folds; the writes are not kept in the receipt.
+- `replay_live` and `MetadataTable::stage` check that the slot still holds the thought under the same generation.
+- `MetadataTable`: landed receipts keyed by (dataset, data version, thought id). `stage` refuses before the data version is sealed (data first, then metadata) and on a key naming another thought. `seal` writes a fold over every field last. `landed` / `replay_landed` accept only a sealed row whose seal still matches and whose data version exists.
+- `Replayed` carries the receipt's roots as inherited and 0 independent roots.
+- CI: `.github/workflows/thought-git-probe.yml`. Before this, no workflow ran the crate.
+
+## Falsifiers (each with its disable, all verified red 2026-10-21)
+
+| test | disable |
+|---|---|
+| a released thought (Commit, Plan, Prune), its slot freed and reused, replays cell for cell | — (replay takes no pool, by signature) |
+| a receipt without its seed refuses | default the seed to 0 |
+| a different seed is an output mismatch (seeds shown to give different writes first) | skip the output check |
+| a different execution config refuses | skip the config check |
+| a changed source refuses; a change to a non-source cell does not | skip the source fold |
+| a freed, reused or ABA-reused slot (same thought id, new generation) fails closed | ignore the slot generation |
+| contradictions and roots keep their meaning under replay (equal `next_version`, one contradiction) | report receipt roots as independent |
+| a replay earns no new certification; a genuinely new root does (Gadamer) | report receipt roots as independent |
+| an unsealed, torn, missing or data-less metadata row is not a landing | accept unsealed rows; skip the seal comparison; stage before the data version |
+| the same plan in two slots has one identity; a different seed changes it | put the slot into the identity |
+
+## Measured vs not measured
+
+- Measured: the 10 tests and the 10 disable runs above, on the fixture address space (12 rows × 4 lanes), one program (`DERIVE`).
+- Not measured: timing (none taken); Lance-backed metadata (the store and table are in-memory stand-ins); atomicity of the two Lance versions (still OPEN in thought-git-basics item 8); programs other than `DERIVE`; receipts across a rebase.
+- Fold collisions: the folds are 64-bit witnesses, not proofs.
+
+OPEN: `BaseRef` stands in for D-CPG's `DurableRef`, which has no contract type; the plan places receipt, slot and `DurableRef` in `lance-graph-contract` at D-TGB-7. D-RFT-5 can now reference this receipt shape.

.claude/board/entries/README.md

@@ -25,7 +25,7 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-420 entries, 2026-08-06 .. 2026-10-21.
+421 entries, 2026-08-06 .. 2026-10-21.
 
 | date | entry id | finding | file |
 |---|---|---|---|
@@ -37,6 +37,7 @@ exactly one of them, never both.
 | 2026-10-21 | `pg-classview-polyfill-map` |  | [2026-10-21-pg-classview-polyfill-map.md](2026-10-21-pg-classview-polyfill-map.md) |
 | 2026-10-21 | `eval-egglog-datafrog-ascent` |  | [2026-10-21-eval-egglog-datafrog-ascent.md](2026-10-21-eval-egglog-datafrog-ascent.md) |
 | 2026-10-21 | `dr256-iam-nested-groups` |  | [2026-10-21-dr256-iam-nested-groups.md](2026-10-21-dr256-iam-nested-groups.md) |
+| 2026-10-21 | `D-TGB-4` |  | [2026-10-21-d-tgb-4-receipt-replay.md](2026-10-21-d-tgb-4-receipt-replay.md) |
 | 2026-10-21 | `D-RU-6-LAB-1` |  | [2026-10-21-d-ru-6-tile-walk-probe.md](2026-10-21-d-ru-6-tile-walk-probe.md) |
 | 2026-10-21 | `D-RU-6-LAB-2` |  | [2026-10-21-d-ru-6-sparse-compute.md](2026-10-21-d-ru-6-sparse-compute.md) |
 | 2026-10-21 | `D-RU-6-LAB-3` |  | [2026-10-21-d-ru-6-dirty-frontier.md](2026-10-21-d-ru-6-dirty-frontier.md) |

.github/workflows/thought-git-probe.yml

@@ -0,0 +1,39 @@
+name: Thought-git probe
+# `crates/thought-git-probe` (D-TGB-0/1/4) is excluded from the workspace and
+# has its own [workspace], so no workspace job builds it. It path-deps only
+# lance-graph-contract, which has no dependencies, so no sibling checkout is
+# needed.
+on:
+  pull_request:
+    paths:
+      - 'crates/thought-git-probe/**'
+      - 'crates/lance-graph-contract/**'
+      - '.github/workflows/thought-git-probe.yml'
+      - 'rust-toolchain.toml'
+  push:
+    branches: [main]
+    paths:
+      - 'crates/thought-git-probe/**'
+      - 'crates/lance-graph-contract/**'
+      - '.github/workflows/thought-git-probe.yml'
+      - 'rust-toolchain.toml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: crates/thought-git-probe
+    env:
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo test

crates/thought-git-probe/PREREGISTRATION.md

@@ -40,7 +40,7 @@ on the real `lance-graph-contract` code (`tests/signals.rs`):
 | D-TGB-2 lane labels | after `Commit` no live edge carries the landed slot; an edge from a recycled slot's old generation is refused | read W of a sealed row as meaningful (proposed here; the plan names none) | `rubicon_outcomes` (the Commit thought) |
 | D-TGB-3 landing | equals `next_version` on every fixture; an empty cycle writes nothing; two thoughts in one cycle give one version; a re-submitted batch reconciles; a missing metadata row is detected at replay | one batch per thought (second `Commit` in a cycle must hit `HashConflict`) | all fixtures, landed together and one per version |
 | D-TGB-3 write into 59..63 | landing the same thought twice leaves 59..63 unchanged; a thought supported only by replayed material lands with certification unchanged; `Block` leaves the version count unchanged; `pearl::hydrate` never changes certification, `pearl::revise` never changes topology | let `revise` lower a certification; let `hydrate` move certification | the Gadamer cases in `tests/signals.rs`, as edges (needs `lance-graph-planner`, added when D-TGB-3 starts) |
-| D-TGB-4 receipt | replaying a landed or discarded thought from its receipt reproduces its writes cell for cell | drop the seeds from the receipt | `rubicon_outcomes` (Plan and Prune thoughts are the discarded ones) |
+| D-TGB-4 receipt (built, `src/receipt.rs`) | replaying a landed or discarded thought from its receipt reproduces its writes cell for cell; missing or changed seed, changed config, changed source, stale/ABA slot, unsealed or torn metadata row all refuse | drop the seeds from the receipt (verified 2026-10-21, with nine further disables in `tests/receipt.rs`) | `rubicon_outcomes` cells (Plan and Prune thoughts are the discarded ones) |
 | D-TGB-5 resident folds | `checkout`, `log`, `diff`, `blame` equal the oracle; `diff` across two versions equals Lance's `delta()` | read Lance on the hot path | `consecutive_versions_replace_without_divergence` shape |
 | D-TGB-6 MemWAL arm | same answers as D-TGB-3 behind the switch | enable below the measured crossover | as D-TGB-3 |
 | D-TGB-7 API + driver | two drivers making the same decisions give byte-identical cells, receipts, metadata rows | let the implementation read a `KanbanColumn` to decide a squash | all fixtures |

crates/thought-git-probe/src/fixtures.rs

@@ -27,7 +27,7 @@ pub const fn cell(row: u32, lane: u8) -> Cell {
 }
 
 /// How a thought's write intention ends on the Rubicon lifecycle.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Outcome {
     /// `Planning → CognitiveWork → Evaluation → Commit`: the result lands.
     Commit,

crates/thought-git-probe/src/lib.rs

@@ -25,4 +25,5 @@
 
 pub mod fixtures;
 pub mod oracle;
+pub mod receipt;
 pub mod slots;