board: crumb BC-13, goldstaub G-5, ten fruits from session inventory, T-CLOSURE refinement

.claude/board/BREADCRUMBS.md

@@ -41,6 +41,25 @@ Coordination happens in Linear (`CC: Thread` label `Breadcrumb`, milestone
 
 ## Crumbs
 
+### BC-2026-10-23-13 — a replay receipt is sealed before landing, and its witness is issued only by the write path
+**Observation:** D-TGB-4's receipt is built and sealed at stage time; a
+landing is accepted only with a `CommitWitness` that `VersionStore::commit_cycle`
+alone produces, and its absence refuses with `Refusal::NoCommitWitness`. The
+module states that the receipt proves replay equals the original run, not that
+the derivation is admissible; that promotion is D-TGB-7's. Same three parts as
+trail T-ADMISSION: built before (sealed receipt), witness with an issuer
+(the cycle commit), refused promotion (replay → proof).
+**Receipt:** `crates/thought-git-probe/src/receipt.rs` on main `8f610a85`
+(module doc, `pub struct CommitWitness`, `Refusal::NoCommitWitness`); lance-graph #1674, #1684; GPT /05 three-artifact
+note (EXO-50, `session_019fbZ92dFKQ5BJHrA3YcH9A/007`).
+**Rhymes-with:** BC-2026-10-23-8, BC-2026-10-23-9 (draft #1730)
+**Cluster:** RHYME (trail T-ADMISSION, Linear EXO-135)
+**Correction (2026-10-23, operator):** the witness is not issued by the write
+path. It is the lane dimension: identical NodeGuids across lanes give a
+vertical read of which thoughts wrote a node. The probe's `CommitWitness`
+restates that read as a lab stand-in. The issuer question raised on EXO-135
+(component or version) is answered: neither, it is the lane.
+
 ### Trail T-ADMISSION — what may be built before execution, under what witness, and what may never be promoted from it?
 Six crumbs (BC-2026-10-23-7 … -12) from six sources: a decision record, two
 probe reviews, a co-research map and two plan rows.
@@ -179,3 +198,17 @@ under every operation it assumes; otherwise snap (lossy, P-S2), extend the
 carrier (K3, Bag multiplicity) or refuse (`Complement` under K3,
 `BagNeedsMultiplicity`). Scope limiter from BC-2026-10-23-6: closure decides
 correctness, not cost. Proposed regrade RHYME → NAMED left to the trail owner.
+
+
+**Evidence appended 2026-10-23 (session_019fbZ92dFKQ5BJHrA3YcH9A):** BC-4 is
+a near-counterexample to the word "closed". A Distinct carrier IS closed under
+join (a set joined with a set is a set), yet the Bag answer is wrong; K3 is the
+same: {T, F} is closed under ∧ ∨ ¬, the failure is that NULL has no image in
+it. Candidate refinement, HYPOTHESIS, not adopted: the condition is that the
+map from the true domain into the carrier commutes with the operation and with
+the measure read at the end (`h(a ⊕ b) = h(a) ⊕' h(b)`, abstract-interpretation
+soundness); closure of the carrier is necessary, not sufficient. Cheap test it
+implies: the one-step commutation defect rate (P-S2: 100% / 88.9% of bound
+pairs outside support) should predict k-step agreement without running k hops.
+**Kill for the refinement:** a case where the map commutes at one step and the
+k-step composition still fails.

.claude/board/FRUITS.md

@@ -4,7 +4,7 @@ Generated by `.claude/tools/fruits_index.py --write`. Do not hand-edit:
 add or change a `**Fruit:**` line on the ledger row and regenerate.
 CI fails when this file is stale.
 
-Open: 14. Closed: 0.
+Open: 21. Closed: 0.
 
 ## discovery torque
 
@@ -16,13 +16,17 @@ Open: 14. Closed: 0.
 
 | tier | row | status | ledger |
 |---|---|---|---|
+| High-signal | 2026-10-23 — One replay that checks proof, receipt and commit witness together | Open. | `IDEAS.md` |
+| High-signal | 2026-10-23 — OGAR #357's first kill test (TLAC-P01) is now buildable from real guards | Open. | `IDEAS.md` |
 | High-signal | 2026-10-23 — The five unrun D-DRMC probes: X6, X7, X8, X16, X18 | Open | `IDEAS.md` |
+| Low-hanging | 2026-10-23 — The MeTTa four-binding case can run against the D-MPS-9 oracle | Open. | `IDEAS.md` |
 | Heavy | 2026-10-23 — A certified-compiler boundary for DR64: typed relational statements, egglog laws with checked proofs, a lowering check | Open | `IDEAS.md` |
 
 ## engineering debt
 
 | tier | row | status | ledger |
 |---|---|---|---|
+| Low-hanging | TD-CE64-W-SLOT-DOC-SAYS-NO-ANCHOR — `edge.rs` still documents W = 0 as "no corpus anchor" (2026-10-23) — OPEN | OPEN. **Basis:** VERIFIED-IN-CODE (`edge.rs:944` on main `8f610a85`). | `TECH_DEBT.md` |
 | Low-hanging | TD-STATUS-BOARD-ROWS-MISSING-FOR-OCT-PLANS-1 (2026-10-23) — OPEN | — | `TECH_DEBT.md` |
 
 ## blocker
@@ -36,6 +40,9 @@ Open: 14. Closed: 0.
 | High-signal | ISS-D-CGW-4-PROMOTION-GATE — the counterfactual verdict is computed but promotes nothing (2026-10-23) | OPEN. **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-planner/src/pearl.rs:259-263` `counterfactual_verdict` calls `Reaction::verdict`; callers found only in `pearl.rs` tests `:747-815`; STATUS_BOARD row D-CGW-4 Queued). | `ISSUES.md` |
 | High-signal | ISS-DURABLEREF-THOUGHTCOMMITID — the two identity types four plans depend on do not exist (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`DurableRef` and `ThoughtCommitId` appear in `crates/` only in doc comments, `mork-pathmap-probe/src/rmap.rs:70` and `:690`). | `ISSUES.md` |
 | High-signal | ISS-BF16-POLYFILL-PER-ELEMENT-ALLOC — ndarray's BF16 16×16 polyfill allocates per output element (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`ndarray/src/simd_ops.rs`, `bf16_tile_gemm_16x16`) and MEASURED (D-RMAP-2 §5a: a 256 × 256 `A·A` takes about 19 ms, about 0.9 GMAC/s, on an AVX-512 host without AMX or `avx512_bf16`). | `ISSUES.md` |
+| Low-hanging | ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS (2026-08-22) — OPEN | — | `ISSUES.md` |
+| Heavy | ISS-ORDER-AND-CODEBOOK-WITNESS-HAS-NO-CONTRACT-TYPE — seven open items wait on one witness nobody owns (2026-10-23) — OPEN | OPEN (reframed, see correction). **Basis:** VERIFIED-IN-CODE | `ISSUES.md` |
+| Heavy | ISS-ADMISSION-B-CALL-SITE-CLASSIFICATION-NOT-STARTED — Semijoin, EqU32Via and Gather are unclassified, and no owner is named (2026-10-23) — OPEN | OPEN (operator decision on ownership). **Basis:** VERIFIED-IN-CODE | `ISSUES.md` |
 | Heavy | ISS-RECURSION-DRIVER — no lawful (co-addressed, non-gather) recursion driver exists (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`STATUS_BOARD.md` D-RA-4 row: "VIOLATION — GATHER. DO NOT BUILD"). | `ISSUES.md` |
 | Heavy | ISS-RETRACTION-PROVENANCE — per-derived-cell provenance for selective retraction is undecided (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (no source bitset or read-provenance plane in `crates/`). | `ISSUES.md` |
 | Heavy | ISS-GATHER-HOP-1616 — the merged `OutgoingHop` reads positions taken from another lane's values (2026-10-19) | BLOCKED (quarantined). GATHER-DECISION recorded 2026-10-20 (`entries/2026-10-20-six-decisions.md` §1): `OutgoingHop` stays quarantined; it closes only by a rewrite as a co-addressed read. Was: BLOCKED (quarantined; waits on GATHER-DECISION). **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-mask-risc/src/graph_hop.rs`: two `MaskOp::Gather` over `frontier[sources[i]]` and `visible[targets[i]]`, then `ScatterOrU32` by `targets[i]`). | `ISSUES.md` |

.claude/board/GOLDSTAUB.md

@@ -30,6 +30,20 @@ Each entry: `**Claim:**`, `**Receipt:**`, `**Scope:**`, `**Date:**`.
 
 ## Entries
 
+### G-2026-10-23-5 — a stacked PR is finished only when its commits are on main
+**Claim:** When PR B is based on PR A's branch and A merges first, merging B
+lands B into A's dead branch, not into main. GitHub shows B as "merged" either
+way. After merging any stacked PR, check `git log origin/main..origin/<base>`
+is empty, or retarget B to main before merging it.
+**Receipt:** lance-graph twice in two days: #1694/#1695 merged into a stage
+branch and needed #1696 ("land #1694/#1695 catalogue and heritage stages on
+main"); #1701-#1704 merged into stage branches and needed #1708 ("land the
+stranded D-DRMC stack"). Earlier receipt: lance-graph-java
+`ISS-LGJ-STACK-TAIL-STRANDED-MINOR-8` (2026-08-25), where the rule already sits
+in that repo's `CLAUDE.md` iron rules.
+**Scope:** every stacked PR in every AdaWorldAPI repo.
+**Date:** 2026-10-23
+
 ### G-2026-10-23-4 — count invocation and allocation boundaries before optimizing a fold
 **Claim:** The mask work inside a fold costs a few nanoseconds; a slow fold
 usually measures how often execution crosses a boundary per answer (an

.claude/board/IDEAS.md

@@ -87,6 +87,62 @@ Agents filter by `@`-mention or domain to see what's theirs.
 
 (Prepend new ideas here with today's date. Format:)
 
+## 2026-10-23 — One replay that checks proof, receipt and commit witness together
+
+`[P1 @thought-struct-scribe @truth-architect domain:thought-git D-TGB-7 D-RFT-5 D-DRMC]`
+
+Three artifacts now exist separately (GPT /05 on EXO-50): the Math Foundry
+`ReplayCapsule` / DRMC `RecipeCertificate` (a checkable derivation, #1696,
+#1708), the D-TGB-4 receipt (#1674) and the `CommitWitness` (#1684). If
+`Receipt.program` carried the capsule's program fingerprint, one replay could
+check all three: the derivation is certified, the replay equals the original
+run, and the landed version contains the thought. **Next probe:** a lab test
+in `thought-git-probe` that lands a certified recipe and replays it, with
+three disables (wrong fingerprint, stale receipt, missing witness), each
+refusing with its own error. **Kill:** the capsule fingerprint cannot be made
+stable across a replay without depending on the commit itself. D-RFT-5 is on
+hold until the D-RFT ID table is adopted, so this stays lab-only.
+
+**Correction (2026-10-23, operator):** the "commit witness" here is the CE64
+lane dimension, not the probe's `CommitWitness` struct: NodeGuids are
+identical across lanes, so a vertical read of the thought's NodeGuids shows
+which lanes wrote them. The probe's third disable becomes "the vertical read
+shows a lane other than the thought's own and lane 0".
+
+**Fruit:** High-signal
+**Status:** Open.
+
+## 2026-10-23 — OGAR #357's first kill test (TLAC-P01) is now buildable from real guards
+
+`[P1 @layer-boundary-warden @falsifier-auditor domain:iam D-CMR-3 D-TLAC]`
+
+The test: one `A & !B & C` shape, compiled from IAM, HubSPO and Rubicon
+guards, must not conflate class, universe, tenant, generation or authority.
+In October all three sources gained real code: OGAR `GroupRolePolicy` (#355),
+`SubjectRoles` (#356), D-IAM-3 (#358), and lance-graph's DR256 IAM register
+(#1666) plus the shared Kleene model (#1668, #1682, #1687). 0 hits for
+`TLAC` in lance-graph crates on main `8f610a85`. **Next probe:** route the
+three guards through the contract set algebra (needs D-CMR-3 for the Quack
+side, or start with the two that already decide through `set_rules`) and
+assert that equal normalized shapes keep distinct bindings. **Kill:** two of
+the three guards cannot be expressed in one normalized shape at all.
+
+**Fruit:** High-signal
+**Status:** Open.
+
+## 2026-10-23 — The MeTTa four-binding case can run against the D-MPS-9 oracle
+
+`[P2 @falsifier-auditor domain:mork D-MTP-1 D-MPS-9]`
+
+#1498 asked for a probe of the four-result nondeterministic binding; none
+exists (no hit for it in `crates/`). #1690 added a general MORK `query_multi`
+oracle (D-MPS-9, MEASURED). **Next probe:** one test comparing the four
+bindings, by fold, against that oracle. **Kill:** the oracle returns a
+deduplicated set where MeTTa returns a bag.
+
+**Fruit:** Low-hanging
+**Status:** Open.
+
 ## 2026-10-23 — A certified-compiler boundary for DR64: typed relational statements, egglog laws with checked proofs, a lowering check
 
 `[P2 domain:dr-math D-DRMC]`

.claude/board/ISSUES.md

@@ -1,3 +1,69 @@
+## ISS-ORDER-AND-CODEBOOK-WITNESS-HAS-NO-CONTRACT-TYPE — seven open items wait on one witness nobody owns (2026-10-23) — OPEN
+
+ADMISSION B (`entries/2026-10-20-six-decisions.md` §1, ruled in
+`ISS-ADMISSION-PREP-BINDING`) admits a frozen-codebook lookup or a
+version-witnessed key-range seek in preparation, "under the attestation the
+plan defines". No contract type carries that attestation. `OrderedLaneWitness`
+(contract `ordered_lane.rs`) covers sealed facet lanes only.
+
+Items that stop at it, each read on main `8f610a85`:
+- D-CMR-5: STATUS_BOARD row "BLOCKED: lawful design proposed", a
+  version-witnessed projection with frozen-codebook endpoints;
+- D-RU-6: "slot assignment must be argued as an attested frozen-codebook
+  lookup under ADMISSION = B";
+- `ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER` (D-DIAMOND-1);
+- #1659's failed gate (lanes sealed in key order);
+- the DR256 IAM register's codebook witness (#1666, listed open);
+- the D-QR plans in #1661/#1662;
+- the DRMC frame seal (who issues it, G1) and the Palette256 "attest the
+  codebook at bind" follow-up.
+
+Open question: one witness type with two kinds (frozen codebook, sorted key
+per sealed version), or two types. See Linear EXO-114 and BREADCRUMBS trail
+T-ADMISSION (crumb BC-2026-10-23-13 asks the same question from the issuer
+side).
+
+**Correction (2026-10-23, operator on this session's question):** "no
+contract type" is the wrong frame. The witness is the lane dimension of
+CE64 (W, bits 53..58): NodeGuids are identical across lanes, so one address
+read down through the lanes shows which thoughts wrote to it. A codebook
+sealed on main is frozen for a reader when, for every one of its NodeGuids,
+only lane 0 holds a value in that reader's merge set; an untouched key range
+keeps main's sealed order the same way. That is a fold over existing presence
+bits, not a new type. Still open: (a) whether a projection built in
+preparation (D-CMR-5) must repeat the vertical read at use time, or pin its
+merge set; (b) whether #1659's ordered-lane gate is the same property.
+
+**Correction (2026-10-23, same day, from EXO-114):** the vertical read covers
+the frozen codebook fully, but a sorted key only halfway. It shows the rows
+are untouched since sealing; it cannot show they were sealed in key order.
+Lance keeps no physical order (fragments in write order, `order_by` is
+scan-time), so a seek or range still needs the order attest EXO-114 describes:
+O(1) or an O(n) check minted once per sealed version. Sorted key = vertical
+read (untouched) + per-version order attest (sorted when sealed). (b) above is
+that second half.
+
+**Fruit:** Heavy
+**Status:** OPEN (reframed, see correction). **Basis:** VERIFIED-IN-CODE
+(STATUS_BOARD rows D-CMR-5, D-RU-6; `ordered_lane.rs`); witness reading per
+`entries/2026-10-20-d-tga-slot-axis-witness-pointer.md`.
+
+## ISS-ADMISSION-B-CALL-SITE-CLASSIFICATION-NOT-STARTED — Semijoin, EqU32Via and Gather are unclassified, and no owner is named (2026-10-23) — OPEN
+
+#1640 ruled ADMISSION B but nothing classified the call sites it governs.
+On main `8f610a85`: `Filter::Semijoin` is defined in
+`crates/lance-graph-quack/src/lib.rs:387`; `EqU32Via` appears in
+`crepe-plan-probe/src/{native,mork_api}.rs` and
+`r2il-mask-abi-probe/tests/row_bridge.rs`; the gather hop sits behind an
+opt-in feature (6791e4ac). STATUS_BOARD carries 0 rows for ADMISSION,
+ACTION-GATE, FLOAT-REFS, WIRE-50 or O30. NOT IN subqueries, anti-joins and any
+gather in the DR math stack wait on the classification. Who owns it is an
+operator decision (raised on EXO-50 by session 01G22 /036).
+
+**Fruit:** Heavy
+**Status:** OPEN (operator decision on ownership). **Basis:** VERIFIED-IN-CODE
+(paths above); STATUS_BOARD census.
+
 ## ISS-SIX-DECISIONS-NOT-EXECUTED-ACTION-GATE — `commit` still fails open where the decision says fail closed (2026-10-23)
 
 **Status:** OPEN. **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-contract/src/action.rs:266` `pub fn commit`, `:328` `pub fn commit_via`; read at `main` `19c1324a`).
@@ -2637,6 +2703,8 @@ workspace job that runs on every PR. (a) is preferable: it closes two issues
 with one edge instead of adding a gate around an unused artifact.
 ## ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS (2026-08-22) — OPEN
 
+**Fruit:** Low-hanging
+
 `crates/causal-edge` is workspace-EXCLUDED but a path-dep of `lance-graph`,
 `lance-graph-planner`, `cognitive-shader-driver` and `sigma-tier-router`, so
 its LIB compiles inside gated builds while its TESTS ran nowhere but on a

.claude/board/TECH_DEBT.md

@@ -1,3 +1,13 @@
+## TD-CE64-W-SLOT-DOC-SAYS-NO-ANCHOR — `edge.rs` still documents W = 0 as "no corpus anchor" (2026-10-23) — OPEN
+
+`crates/causal-edge/src/edge.rs:944`: "Witness corpus root handle (6-bit,
+0..=63). 0 = no corpus anchor." The 2026-10-21 decision (#1597) reads W = 0 as
+main and 1..63 as a thought-git slot, which is why `execute` writing W = 0 is
+correct. The doc contradicts the decision. Linear EXO-65.
+
+**Fruit:** Low-hanging
+**Status:** OPEN. **Basis:** VERIFIED-IN-CODE (`edge.rs:944` on main `8f610a85`).
+
 ## TD-STATUS-BOARD-ROWS-MISSING-FOR-OCT-PLANS-1 (2026-10-23) — OPEN
 
 **Fruit:** Low-hanging