[ragnorc]

Summary

Adds docs/rfcs/2026-10-31-gq-3-programme.md (draft, maintainer track) and its registry row: the top-level document for the GQ revision. It owns an order and a map, no grammar and no semantics:

• The sequence. Break first (the grammar RFC, PR rfc: the GQ 3 grammar, one break and the slots it freezes #1202), then additive stages on the final grammar in dependency order: S catalogue, N agent interaction, P paging, F function registry, C closure, L lexical, R retrieve semantics, W1/W2 writes; I + Poly on the storage-upgrade clock; A permissions after C; Fed after Poly and C. Three tracks (compiler, planner/engine, server/schema/policy).
• Who owns which slot. The grammar RFC's freeze list read by stage, so a stage RFC can be checked for claiming exactly its slots.
• Verdicts on every open language, search and permissions RFC (rfc: search contracts on the shared expression model (RFC 0048) #793, rfc: analyzed lexical search on the shared expression model #792, rfc: add RFC 0056, one language for every graph operation #670, rfc: polymorphic types with interfaces, unions and polymorphic edges #884, rfc: schema namespaces and multi-file schemas #1015, rfc: request-aware plan cost #996, rfc: incremental index reconciliation #1156, rfc: granular permissioning #951, rfc: query contracts and Cedar grants for agents #1197, rfc: access authority as views and reach #1210, rfc: narrow graph access to client contracts #1149, rfc: branch operations v2 #677 and the ones outside the programme), and the missing RFCs to write (closure, batch, paging, writes, federation; editions folded into B).
• Rules every stage RFC answers: no new grammar rule after B (a rule-set pin test), one spelling per meaning, enabler before consumer, measure at every stage, cases first, storage on its own clock, the catalogue as the interface between tracks.

Evidence is the committed evaluation (§10.7 verdicts, §11 staging), which this RFC links and whose header now names both RFCs.

Stacked on #1202. This branch includes the grammar RFC's commits; the diff shrinks to the programme RFC, the registry row and the evaluation's header once #1202 merges. Review the programme RFC file only.

[ragnorc]

Recommendation: revise.

This RFC can own the order of GQ 3. The slot table and several verdicts do not match the grammar RFC, the open RFCs, or Lance 13.0.0. A stage RFC written from this map will claim a form another document already owns, or it will wait on the wrong enabler.

Why

GQ has many open language and search drafts, and each one can schedule its own break. One order, one owner per reserved form, and one ruling per draft stop that. This document is that order. It is useful only while it matches the grammar RFC's freeze list and the texts it rules on.

What this RFC decides

Break once, in the grammar RFC (PR 1202). Then fill reserved forms in stages S, N, P, F, C, L, R, W1, W2, I + Poly, A, and Fed. The grammar RFC owns the break. Each stage RFC owns its semantics. This RFC owns the sequence, the owner of each slot, and the ruling on the other drafts.

That split is the right one. A readable copy of the freeze list is the wrong way to keep it. The list already differs from the grammar RFC.

What matches the code and the drafts

These claims match the documents I checked.

• The registry row is in date order. The frontmatter matches the RFC template. discussion is PR 1213.
• Break-first matches the grammar RFC. PR 606 closed on 2026-09-28. The alternatives row is right to reject one combined RFC.
• GQ_LANGUAGE_VERSION is (2, 3) in crates/omnigraph-compiler/src/lib.rs. PR 805 still schedules (3, 0) and then (4, 0). PR 792 removes search, match_text, and fuzzy at the next major. PR 793 removes positional k at the next major. Those are the three breaks. The 792 and 793 rulings replace those schedules. The 805 ruling does not name the versions.
• PR 884 blocks on 2026-10-12-integer-node-identity. Integer identity blocks on 2026-10-12-distributed-sequence. I before Poly matches the first of those edges.
• PR 677 defers remotes. Putting that replication form on Fed is a coherent ruling.
• No closure, paging, batch, writes, or federation RFC is in docs/rfcs/ besides this map. The "missing" rows match the tree.
• Lance 13.0.0 still defaults max_token_length to Some(40) in lance-index tokenizer.rs. That part of PR 792's profile fact still holds.

Blocking

1. The slot table is not the grammar freeze list, and several forms have two owners

blocked_on says this document does not restate the freeze list. The section "Who owns which slot" says the table is that list, read by stage. The two sentences cannot both be true. The table already disagrees with docs/rfcs/2026-10-28-gq-3-grammar.md, section "The freeze list", and with query.pest on main.

• having over a retrieval is given to C. Stage B also ships having. The grammar RFC's freeze row gives having to itself. Its retrieve section ships having { $d.vec < 0.6 } in the break.
• @distance and @score are given to R. The freeze row says they are the typed fields of a retrieve arm in the edition-3 release. Stage R also says the clause shipped in B.
• retrievals.recall_achieved is not in the grammar RFC's envelope row. It is in the evaluation's §11.6 freeze list, which also keeps contract and an HTTP contract bump. The decision log says the table was read from the grammar RFC.
• is and unions are given to Poly as slots reserved in B. The freeze list does not reserve them. In query.pest, is occurs only in null_test (is null / is not null). PR 884 specifies $x is T and $x: A | B. PR 1015 specifies the same forms and says both RFCs share one qualified_type_name rule. Those are the two drafts on one grammar position. The map gives the position to Poly only.
• Infix + is not in query.pest. The grammar RFC does not reserve it. PR 805 leaves arithmetic out of scope. Stage W2 writes set { visits: visits + 1 }. Rule 1 then forbids W2, unless the freeze list gains the operator or the write is a call such as add(visits, 1).
• "Registry rows beyond today's functions" and "positional-or-named argument forms" are given to F as slots. The grammar RFC says the call form works in the break, and that a new registry row is not a slot.
• Branch and Commit are slots in the freeze row. The branch-statements RFC owns binding. The verdict row says the typed parameters ship in B. A form that ships in B has no later owner.

Rows that do match the freeze list, and should stay: view, $x: Name(args), optional, block aggregates, batch, the five reserved annotations, continuation, returning, @valid, @analyzed, terms, match_terms, @type_id, the seven catalogue names, ns::Type, and the graph segment of graph_commits.

The evidence section asks scripts/check-docs.py to require each freeze-list slot once in this table. That check is the right single owner. It is not in this PR. The table would fail it today. Until the check exists, the grammar RFC's table is the list, and this RFC should link each row.

2. The sequence does not encode the dependencies the prose and the RFCs already have

The picture says the stages run in parallel except where an arrow says otherwise. The next sentences depend on C after S, L after F, W2 after W1, A after C, and Fed after Poly and C. Those edges are parentheses, not arrows. W2's edge from W1 is only in the prose. The user-behavior list then calls "F, then C, L, R, W1, W2" dependency order. C does not depend on F. The compatibility section says a stage can move without touching another stage, because the slots are independent. That sentence erases the edges above.

These edges are wrong or missing against the drafts and the pinned substrate.

• L waits on F "for named options". The grammar RFC ships name(positional, option: value) in the break. Named options are not F's. New rows are additive. If one stage must own every new row, say that, and apply it to L and R together.
• R's ship gate is "the discovery task answered by rrf over interface arms". $x: Interface is a Poly slot. The same paragraph says language stages never wait on Poly. PR 884 blocks the whole polymorphic RFC, including bindings, on integer identity. The unresolved question asks whether C ships the binding before "Poly's storage change". PR 884 says it changes no storage. The storage change is integer identity. C does not ship $x: Interface before I.
• The storage clock is drawn as I then Poly. Integer identity blocks on the distributed-sequence RFC in the same PR 884. That RFC stores its frontier outside __manifest. The programme does not name it. The stage that adds it has to answer invariants 2 and 12.
• Fed waits on Poly and C. It also waits on PR 1015. PR 1015 treats acme::crm as one flat namespace. The grammar RFC's outermost graph segment reuses that same :: chain. "Reserved outside it" is not yet a rule 1015's paths obey. Shipping 1015 as written consumes the segment Fed needs. That is a second break, which rule 1 forbids.
• Stage M0 says its corpus is the grammar RFC's first blocked_on gate. The grammar RFC's gate is narrower: first-try validity at or above 37 of 45, and 45 of 45 after one repair, on a parser-only edition-3 build. This RFC's own blocked_on waits for the grammar RFC to be accepted and for the larger corpus. Rollout step 1 accepts the grammar RFC and then runs M0. Those are three orders.

3. Stage S's search gate contradicts the accepted catalogue contract

The engine catalogue RFC says writes, loads, and text or rank search over catalogue types are refused, and catalogue access never calls Lance. Stage S's gate requires a GQT case that searches @Type.instruction. The owner line calls this an amendment and does not say the amendment lifts that sentence. A search that opens a Lance dataset for catalogue rows is a second store beside the derived catalogue. Invariant 12 forbids that. The gate can require joins from catalogue rows to user rows. Rank search stays refused until the amendment names a mechanism that does not call Lance.

4. Several verdicts do not match the open text or Lance 13.0.0

• PR 996 prices plan choices in request waves. It chooses Expand mode and id_lookup versus hash_join. It does not define the envelope field estimate or the annotation @budget. Sequencing it as N's source for those two forms sends the agent-interaction RFC to the wrong document. The grammar freeze row gives the five annotations to RFC 0048 and the agent-first batch.
• PR 1149 is "Graph access and client contracts". It specifies the cluster serving model and client connection contracts. It is not a fourth permissions authority. The open authority drafts are PR 951, PR 1197, and PR 1210. The count of four, and the instruction to reconcile 1149 into A, include the wrong RFC.
• PR 1197's initial fragment is one concrete binding, scalar filters, projections, and optional group, count, order, and a literal limit. It refuses joins, traversals, negation, search, Blob, arithmetic, and mutations. "The kernel minus retrieval" keeps traversals and joins. That is a larger language than the draft.
• PR 884 does not leave cross-member bm25 as a bare refusal. Its 2026-10-17 decision admits it under one corpus contract, and only after a public scanner option exists. In Lance 13.0.0, Scanner::full_text_search takes a FullTextSearchQuery and no scorer. SharedFtsScorer and MatchQueryExec::with_overlay_block are pub(crate) in lance src/io/exec/fts.rs. MatchQueryExec::with_base_scorer is public, and 884 refuses to build that plan in the engine because it would copy the scanner. rrf over member arms can ship on this Lance without that option. The verdict should say it retires the corpus contract. "Instead of refusing" describes an older rule.
• Stage L's gate cites "three Lance guards". PR 792 names four, and its code references are Lance 11.0.0. I did not re-run those guards on Lance 13.0.0. The 40-byte token default still matches. The guard count and the substrate of the evidence do not. L's ship gate has to name the four guards and a re-qualification on the pinned Lance.
• PR 805's phase 5 sets GQ_LANGUAGE_VERSION to (3, 0). Phase 6 sets (4, 0). The grammar RFC uses (3, 0) for the one break. The verdict "operator-vocabulary amendment" does not name PR 805 or withdraw those two versions. The one-break order stays open until it does.

Optional

• The evaluation header this PR adds says §12 to §14 are folded into both RFCs. §12 is the TypeDB comparison. This RFC does not contain it. The same header says §11 is the sequence. §11.6 still shows the arrow rewrite, the contract declaration, and an HTTP bump. The grammar RFC removed those. Point the header at this RFC for the order, and at the grammar RFC for the freeze list.
• The invariants paragraph says 3, 4, 5, 7, and 11 are untouched, and names W1, A, and I. P and N pin one snapshot, so they answer invariant 3. L and R answer invariant 7, because a missing index must not change rows. A answers invariant 10. Integer identity changes __id from text to UInt64, which is invariant 6. The sequence RFC answers invariants 2 and 12.
• The server track does not list N or P. Both add envelope fields, and P adds a CLI flag and an HTTP field. L's query forms are on no track. Only L's SchemaIR features are listed.
• Rule 2 names queries fmt. QueriesCommand in crates/omnigraph-cli/src/commands/control/args.rs is validate and list. The formatter needs an owner, or the rule should name the command the grammar RFC already specifies.
• The outside-programme row cites remote optimize as PRs 1186 and 1203. PR 1203 reverts that RFC. The file on main is docs/rfcs/2026-10-29-remote-optimize-through-the-serving-owner.md, and its discussion is merged PR 1190.
• @approximate is owned by N, with recall semantics owned by R. Name one owner for the annotation and one for the envelope number.
• "The programme is a document and two tests." This PR adds the document. The pin and the slot check are specified and absent.

Liability

The observable contract here is the order and the owner of each form. Later stage RFCs are the mechanism. This file is the interface they share.

Copying the freeze list makes one page easier to read. It spends the property the RFC exists to protect. The copy has already drifted, before any stage has shipped. Five stage RFCs written from it would add a grammar rule for +, |, or type-test is, would search the catalogue through Lance, and would treat PR 996 and PR 1149 as owners of N and A. Each of those is a second source of truth. Invariant 12, applied to the map, says the grammar RFC owns the list and a check owns the link.

The break-first order reduces liability. One spelling, one edition window, and slots that parse and refuse are a smaller surface than the additive-first plan in evaluation §11.1 to §11.5. That gain survives only if this document stops restating the list.

No new runtime API, storage format, or deny-list mechanism is added. The maintenance cost is the table, the verdict rows, and the two tests. The tests are the part that keeps the cost from growing. Land the slot check with the table, or delete the restatement.

How to revise

Keep the order as a list of edges. Make the picture, the user-behavior list, the rollout, and the compatibility section use those edges.

Make the slot table a projection of the grammar freeze list, one owner per row. Add is, unions, and arithmetic to that freeze list with one owner, or remove them from this table. Point having, @distance, and @score at the grammar RFC for the break. Delete retrievals.recall_achieved until the grammar RFC reserves it.

Name the distributed-sequence RFC on the storage clock. Say PR 805's (3, 0) and (4, 0) are withdrawn. Say rrf retires 884's corpus contract on Lance 13.0.0. Remove PR 1149 from the permissions set. Point N's estimate and @budget at the agent-batch RFC, and leave PR 996 on the planner. State the catalogue amendment's Lance boundary in stage S's gate. Cite four Lance guards, qualified on Lance 13.0.0.

Validation

Head reviewed: 2298f1e8f02bc368190c32c5c5c0a5cd003989f4. State: open. Rechecked immediately before this review. Reviews and inline comments on this PR: none. PR 1202's two issue comments are the grammar review. This review does not repeat them.

Scope is the diff against PR 1202's head 7c44b23d683921d7ed84104615f3525d0d33b441: docs/rfcs/2026-10-31-gq-3-programme.md, the registry row in docs/rfcs/README.md, and the evaluation header. .typos.toml does not change in that diff. Its EDN and FO lines are in PR 1202, commit f67be6be.

GQT regression proof does not apply. This pull request changes documentation only. It changes no query result, error, or plan.

• Exact-commit CI on 2298f1e8 is green, including CI Gate, PR Title, Check AGENTS.md Links, Test Workspace, Lint, and the GQT jobs. Devin Review skipped for credits. I used that as CI evidence, not as a substitute for the document check.
• Local, in a detached checkout of this head: python3 scripts/check-docs.py prints Documentation OK (437 Markdown files checked).
• Local: typos 1.50.1 on the programme RFC, the registry, the evaluation asset, and .typos.toml exits 0.
• Local: scripts/check-pr-title.py accepts the title.
• Local: git diff --check from PR 1202's head to this head exits 0.
• Code inspection on workspace main 7f32f83d for query.pest, GQ_LANGUAGE_VERSION, QueriesCommand, and the catalogue RFC. Lance inspection is the unmodified 13.0.0 crates in the cargo registry, files cited above. Open RFC texts are the PR heads listed in the findings.

Limits: I did not re-run PR 792's Lance guards on 13.0.0. I did not re-read every accepted RFC named in the verdict table. I did not run the workspace test graph. The 37 of 45 figure is the grammar RFC's citation of RFC 0047. I did not re-run that instrument.

Inline comments

docs/rfcs/2026-10-31-gq-3-programme.md:110 — The dependencies on C, L, W2, A, and Fed are parentheses, not arrows. L does not need F for named options. R's interface-arm gate waits on Poly. The storage clock omits the distributed-sequence RFC. Fed needs PR 1015 to leave the outermost :: segment free.

docs/rfcs/2026-10-31-gq-3-programme.md:127 — M0 is not the grammar RFC's first gate. That gate is 37 of 45 and 45 of 45 after one repair. This RFC, the grammar RFC, and rollout step 1 state three orders.

docs/rfcs/2026-10-31-gq-3-programme.md:129 — Searching @Type.instruction contradicts the accepted catalogue rule that rank search is refused and catalogue access never calls Lance.

docs/rfcs/2026-10-31-gq-3-programme.md:134 — PR 792 names four Lance guards, evidenced on Lance 11.0.0. queries fmt is not a CLI command.

docs/rfcs/2026-10-31-gq-3-programme.md:144 — The slot table is not the freeze list. having, @distance, @score, recall_achieved, is, unions, +, new registry rows, and Branch and Commit are mis-assigned.

docs/rfcs/2026-10-31-gq-3-programme.md:181 — PR 884 admits cross-member bm25 under a corpus contract that waits on a scanner option Lance 13.0.0 does not publish. Say rrf retires that contract. Name the distributed-sequence RFC.

docs/rfcs/2026-10-31-gq-3-programme.md:183 — PR 996 does not define estimate or @budget.

docs/rfcs/2026-10-31-gq-3-programme.md:186 — PR 1197's fragment is one concrete binding and scalar filters. It is not the kernel minus retrieval.

docs/rfcs/2026-10-31-gq-3-programme.md:187 — PR 1149 is not a permissions draft. PR 805's (3, 0) and (4, 0) are not withdrawn.

docs/rfcs/assets/2026-10-28-gq-3-grammar-evaluation.md:18 — §12 is not in the programme RFC. §11.6 still contains the arrow rewrite, contract, and the HTTP bump.