docs(canon): E-FUNCTION-CATALOG + E-ACCIDENTAL-IMPERATIVE + F17

Records the function-catalog arc with the operator's corrections.

E-FUNCTION-CATALOG: the catalog is of CRITERIA over SHIPPED deterministic verbs
(filter=query engine / project=compute DAG / map=deterministic lookup /
reduce=semirings). A consumer function = (verb, criteria), criteria extracted not
authored, keyed by canonical concept id, lands on lance-graph-contract::action +
ogar-render-askama + ogar-vocab. Correction 1: map != CAM-PQ (Kontenerkennung is
deterministic relational rule + precedent; Test-0 register, not ANN).
Correction 2: CRUD is generic lifecycle + extracted criteria, not hand-rolled.

E-ACCIDENTAL-IMPERATIVE: the residue = accidentally-imperative (AR verbs on AR
targets, written imperatively only because the source had no declarative form --
Odoo @api.depends vs Rails before_save{sum} proves it's source-expressiveness,
not complexity; recoverable) UNION essentially-foreign (the only true escape).
The body pass TRIAGES to (target classid, verb-class, order-signature) -- not
decompile; lands at a coarse catalog tier + point-to-body (lossless-DO §1).
"random orders" = the round-trip-order-free recover/preserve gate. Three tiers:
clean / coarse / foreign.

F17 (PROBE-OGAR-BODY-TRIAGE): triage hooks -> round-trip-order-free each coarse
group; PASS-rate = the accidentally-imperative ratio. Gated on a ruff extension
(capture writes/calls per function). DISCOVERY-MAP D-FUNCTION-CATALOG +
D-ACCIDENTAL-IMPERATIVE rows added.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.claude/board/EPIPHANIES.md

@@ -7,6 +7,50 @@
 
 ---
 
+## 2026-06-30 — E-ACCIDENTAL-IMPERATIVE — the hand-rolled residue = accidentally-imperative (AR verbs on AR targets, no declarative home) ∪ essentially-foreign; the body pass TRIAGES, it does not decompile
+
+**Status:** CONJECTURE (`[H]` — the split is operator-reasoned + grounded in the Odoo↔Rails asymmetry; the ratio is unmeasured pending the body pass). Operator-directed 2026-06-30. Builds on E-FUNCTION-CATALOG.
+
+**Scope:** the "hand-rolled hook bodies" residue that E-RECIPE-BITMASK / E-FUNCTION-CATALOG leave. Why it is smaller than it looks, and the bounded thing ruff can actually do about it.
+
+**The split (operator).** A hook's TARGET is AR-shaped — the body sets a field / CRUDs an association / computes from relations, i.e. the SAME verbs (filter/map/project/reduce/CRUD) on AR targets. So the residue is two populations:
+- **accidentally-imperative** (the big chunk): AR verbs on AR targets, written imperatively ONLY because the source had no declarative form. Proof = the Odoo↔Rails asymmetry: `total` recompute is DECLARATIVE in Odoo (`@api.depends`) and HAND-ROLLED in Rails (`before_save { total = lines.sum }`) — identical semantics, identical AR target; the imperative-ness is a property of source *expressiveness*, not logic complexity. Recoverable to `(verb, criteria)`.
+- **essentially-foreign** (the small chunk): real algorithms / external / ledger semantics. The only true escape.
+
+So the residue is bounded below by essentially-foreign; population 1 re-declarativizes. **OGAR is the "ontology to call" those developers lacked** — forward it prevents the accidental hand-rolling; backward it re-recognizes it.
+
+**The body pass TRIAGES — it does not decompile (operator).** ruff cannot normalize arbitrary imperative bodies. The most it recovers is `(target classid, verb-class, order-signature)` — "something that calls an update on X, in some order" — grouped by target. So the residue becomes LEGIBLE ("47 hooks that all update WorkPackage") instead of opaque, and lands at a COARSE catalog tier: `ActionDef` keyed on `(target classid, verb-class)` + point-to-body (lossless-DO §1, the precise body preserved).
+
+**"random orders" is the recover/preserve GATE, not noise.** Incidental order (operations commute) → declarative form round-trips → RECOVER. Significant order (app depends on the sequence) → PRESERVE (sequenced/foreign body). Arbiter = the **round-trip-order-free parity check**: does the order-free `(verb,criteria)` reproduce the source output? Yes → order was random → recover. No → order mattered → preserve (+ RFC if behaviour diverges — "runs" can hide ordering/side-effect quirks the app now depends on; behaviour-preserving discipline, never silently "fix").
+
+**Three landing tiers** (a body drops only as far as its deformity forces): clean `(verb,criteria)` → declarative emit · coarse `(target,verb-class)` + point-to-body, order-sig gates recover/preserve · foreign → full escape.
+
+**Falsifier (F17 / `PROBE-OGAR-BODY-TRIAGE`):** body pass → `(target, verb-class, order-sig)` per hook → round-trip-order-free each coarse group → PASS-rate = the real "how many were accidentally-imperative" number; FAIL-rate = the order-dependent/foreign tail. **Gated on a ruff extension:** capture **writes/calls** per function (today ruff captures reads/raises/traverses — NOT writes), so "calls update on X" is extractable.
+
+**Cross-ref:** E-FUNCTION-CATALOG, E-RECIPE-BITMASK, E-RECIPE-LABEL-DTO; lossless-DO §1 (point-to-body); the consumer behaviour-preserving / RFC discipline; F17; `openproject-nexgen-rs/.claude/knowledge/RAILS-COVERAGE-KIT.md` §6.
+
+---
+
+## 2026-06-30 — E-FUNCTION-CATALOG — the catalog is of CRITERIA over SHIPPED deterministic verbs (filter/project/map/reduce already coded); a consumer function = `(verb, criteria)` keyed canonically
+
+**Status:** CONJECTURE (`[H]` — the verbs are `[G]`/CODED; the criteria-catalog + the round-trip gate are the to-wire). Operator-directed 2026-06-30. Extends E-RECIPE-LABEL-DTO; records two operator corrections of an over-scoping.
+
+**Scope:** "a catalog of AR-shaped functions landing on OGIT/Auth + a DTO-guided landing zone." What it actually is.
+
+**The verbs are SHIPPED, deterministic — nothing to build:** **filter** = the query/predicate engine (Cypher WHERE → DataFusion predicate, SigmaBandScan); **project** = the compute/recompute DAG + formula eval (`KausalSpec::Depends`); **map** = a deterministic table/lookup; **reduce** = the 15 semirings / GraphBLAS.
+
+**So the "catalog" is a catalog of CRITERIA, not functions.** Entry = `(verb: canonical concept id, criteria: { selection-condition + params })`, params grounded on a DOMAIN ontology (SKR / tax / Auth / OGIT / the class schema). Verb = the shipped op; criteria = EXTRACTED from source (deterministic, not authored). The DTO-guided landing zone = a criteria DTO selecting + parameterizing a shipped verb. Existing surfaces it lands on: `lance-graph-contract::action` (`actions_for`/`ClassActions`/`OgarResolver`/`ClassResolver`/`ExecutorRegistry`/`RunnerKind`), `ogar-render-askama` artifact_kinds (`html_list`/`detail`/`form` = the view landing zone), `ogar-vocab` (`canonical_concept_id`, `auth_store`, `ConceptDomain`).
+
+**CORRECTION 1 — map ≠ CAM-PQ (Test-0 register laziness).** Kontenerkennung (account determination) is a DETERMINISTIC relational rule resolution, NOT a similarity search: product/category default account → fiscal-position remap (contract/partner) → precedent (`reduce(filter(prior_bookings, partner×product), most-recent/modal account)`), with a priority/fallback. Natural keys ⇒ use the register (relational lookup + history query), per `I-VSA-IDENTITIES` Test 0. CAM-PQ enters ONLY for fuzzy suggestion on unseen combinations — a separate opt-in layer, never Kontenerkennung itself.
+
+**CORRECTION 2 — CRUD is generic, not hand-rolled.** create/update = the generic AR lifecycle (defaults → validate → hooks → persist → journal); per-class criteria = the recipe (validations/callbacks/defaults/associations) + the permission (RBAC) + the writable-field set; the controller action is a HandlerKind (`create/update-for-tenant`). Zero hand-rolled — only a genuinely non-standard hook BODY escapes (→ E-ACCIDENTAL-IMPERATIVE).
+
+**The only gate:** the extracted criterion must ROUND-TRIP (the parameterized verb reproduces the source output); a `map`/`project` claim that doesn't reproduce isn't one — it escapes.
+
+**Cross-ref:** E-RECIPE-LABEL-DTO (verbs + params are canonical concept ids + label DTOs), E-ACCIDENTAL-IMPERATIVE (the residue), E-RECIPE-BITMASK; `lance-graph-contract::action`, `ogar-render-askama`, `ogar-vocab`; `I-VSA-IDENTITIES` Test 0; `RAILS-COVERAGE-KIT.md` §6.
+
+---
+
 ## 2026-06-30 — E-RECIPE-LABEL-DTO — recipe labels are content-addressable concept ids on ONE generic ontology + per-language label DTOs; NOT a per-consumer enum zoo
 
 **Status:** CONJECTURE (`[H]` — the doctrine is operator-directed; the recipe-concept codebook is to-mint, the class-concept codebook + `canonical_concept_id`/`name` it extends are `[G]`/CODED). Operator-directed 2026-06-30. Extends E-RECIPE-BITMASK / E-RECIPE-BITMASK-CHAIN.

docs/DISCOVERY-MAP.md

@@ -223,6 +223,8 @@ two halves of a cell. ADR‑026 names the cascade that ties them.
 | D‑NSM | 4096‑dim Deep‑NSM encoder (Wierzbicka primes, `NUM_PRIMES=63`) calibration | H | IDEA | RDF‑OWL §4.10 | D‑CAM, `[per rt]` |
 | D‑RECIPE‑BITMASK | OGAR = Open Graph **Active Record**: the canonical recipe IS the AR lifecycle protocol; a class stores it once + a per‑class override **bitmask** (set=override, clear=inherited default, fall‑through per the zero‑fallback ladder) + the genuine deltas → thins the "impossible 15%" behavioural leftover toward ~7% for best‑shaped (AR‑canonical) consumers. Guards: zero per‑class payload (recipe IS the spec); computes: shape + `Depends.paths` delta. Guards: bitmask=register not VSA (`I‑VSA‑IDENTITIES` T0); redundant = content‑hash‑equal‑to‑default (lossless‑DO §1); slots RESERVE‑DON'T‑RECLAIM (`I‑LEGACY‑API‑FEATURE‑GATED`). Odoo (Python, UPPER bound) RUN: guard arm 47→1 full‑collapse, compute arm 101 distinct of 141 resolved, **45.7% collapse / 54.3% leftover** — REFUTES "Odoo→7%", CONFIRMS the Rails‑AR scoping | H | EPIPHANY | E‑RECIPE‑BITMASK · F15 · `odoo-rs tests/recipe_redundancy_probe.rs` | D‑VOCAB, D‑HIRO‑DO, D‑ACTION |
 | D‑RECIPE‑BITMASK‑CHAIN | the **inheritance axis** of the recipe‑bitmask: a derived ClassView is built by chaining its base `LazyLock<ClassView>` constants + its own delta (`classid → ClassView` compositional; chain = MRO; #533 `resolve_overrides` = order). Fixes two things — "out‑of‑slice" dissolves (the base is a registry constant, not a slice dep) and "redundant = content‑hash‑equal" becomes **referential identity** (the inherited part IS the shared cached constant, pointer‑identical, no copy to drift). Orthogonal to the 3×4 carving (value/registry‑side vs address/centroid‑side) → **3×4 stands, no re‑carve**. Chain‑order falsifier = F1; acyclic (DAG, topo order). MEASURED (full manifest, 388 classes / 166 edges / 3328 methods): naive 4215 vs chained 3328 → **21.0% collapse / 22.7% behavioural**; STACKS with the within‑class 54.3%; lower bound (shallow mixin harvest) | G (measured) / H (LazyLock impl) | EPIPHANY | E‑RECIPE‑BITMASK‑CHAIN · F16 · `odoo-rs tests/recipe_chaining_collapse.rs` | D‑RECIPE‑BITMASK, D‑VOCAB, F1 |
+| D‑FUNCTION‑CATALOG | a consumer function = `(verb, criteria)`: the verbs (filter=query engine · project=compute/recompute DAG · map=deterministic lookup · reduce=semirings) are SHIPPED/`[G]`; the "catalog" is of CRITERIA (selection-condition + params, grounded on a domain ontology), EXTRACTED not authored, keyed by canonical concept id (E‑RECIPE‑LABEL‑DTO). DTO-guided landing zone = a criteria DTO selecting+parameterizing a shipped verb; lands on `lance-graph-contract::action` (actions_for/OgarResolver) + `ogar-render-askama` artifact_kinds + `ogar-vocab`. **map ≠ CAM‑PQ** (Kontenerkennung = relational rule + precedent; Test‑0 register, not ANN); **CRUD = generic lifecycle + extracted criteria**, not hand-rolled. Gate: extracted criterion must round‑trip | H | EPIPHANY | E‑FUNCTION‑CATALOG · F17 | D‑VOCAB, D‑ACTIONHANDLER‑RESOLVER, D‑RECIPE‑BITMASK |
+| D‑ACCIDENTAL‑IMPERATIVE | the hand-rolled residue = **accidentally-imperative** (AR verbs on AR targets, no declarative home — recoverable; Odoo `@api.depends` vs Rails `before_save{lines.sum}` proves it is source-*expressiveness* not logic complexity) ∪ **essentially-foreign** (the only true escape). The body pass **TRIAGES** to `(target classid, verb-class, order-signature)` — NOT decompile; residue becomes legible; lands at a coarse catalog tier + point-to-body (lossless-DO §1). "random orders" = the **round-trip-order-free** recover/preserve gate. Three tiers: clean `(verb,criteria)` · coarse `(target,verb-class)` · foreign | H | EPIPHANY | E‑ACCIDENTAL‑IMPERATIVE · F17 · ruff writes/calls capture (gated) | D‑FUNCTION‑CATALOG, D‑HIRO‑DO |
 
 ### 2.9 Domain instances (universality witnesses)
 

docs/INTEGRATION-MAP.md

@@ -395,6 +395,7 @@ R2 — not D.)
 | F14 | **Wide-model render** | render `account.move` through `ClassView` with full presence (**>64 is the load-bearing bound; 109 declarations counted** in account_move.py, Odoo 17) | **gated: cannot RUN until Phase B** wires the field-enum into `RegistryClassView`; once runnable, fails by construction (FieldMask u64, L0b) until presence exceeds u64 — **Track X7 is the named path** |
 | F15 | **AR-recipe collapse** (`PROBE-OGAR-AR-RECIPE-COLLAPSE`) | measure how much of a consumer's lifted behavioural arm folds to the shared ActiveRecord-lifecycle recipe + per-class override bitmask vs genuine per-class leftover. **Odoo upper-bound RUN** (`odoo-rs tests/recipe_redundancy_probe.rs`, default build, slice_2): guard arm 47→1 full-collapse, compute arm 101 distinct of 141 resolved, **45.7% collapse / 54.3% leftover**; clean run is Rails/OpenProject where `ruff_ruby_spo` captures `callbacks` as first-class `Model` data | D‑RECIPE‑BITMASK `[H]→[G]` when the Rails-AR clean run lands near the ~7% leftover target; the Odoo bound already refutes the strong "Odoo→7%" reading |
 | F16 | **Constructor-chaining collapse** (`PROBE-OGAR-CHAINING-COLLAPSE`) | the inheritance axis: naive flatten (own + inherited copies) vs chained (stored once at the base `LazyLock<ClassView>` constant) over a consumer's `inherits_from` DAG. **Odoo RUN** (`odoo-rs tests/recipe_chaining_collapse.rs`, full manifest, 388 classes / 166 edges / 3328 methods): naive 4215 vs chained 3328 → **21.0% collapse / 22.7% behavioural**; top base `mail_activity_mixin` (324 copies). Chain-order correctness = F1; acyclic DAG | D‑RECIPE‑BITMASK‑CHAIN `[H]→[G]` (measured); confirms chaining resolves F15's "out-of-slice" upper bound — the real leftover sits below it; orthogonal to F15, stacks. Rails leg (concerns captured) should exceed Odoo's collapse |
+| F17 | **Body-triage / accidentally-imperative ratio** (`PROBE-OGAR-BODY-TRIAGE`) | run the body pass over real hooks → `(target classid, verb-class, order-signature)` per hook → **round-trip-order-free** each coarse group (does the order-free `(verb,criteria)` reproduce the source output?). PASS-rate = the accidentally-imperative (recoverable) fraction; FAIL-rate = the order-dependent / essentially-foreign (preserve/escape) tail. Control = Odoo `_compute_*` (already declarative); test = Rails `before_*`/`after_*` | D‑ACCIDENTAL‑IMPERATIVE / D‑FUNCTION‑CATALOG `[H]→[G]`. **Gated on a ruff extension:** capture writes/calls per function (today: reads/raises/traverses only) so "calls update on X" is extractable |
 
 (F3 already carries the D‑QUANTGATE pre/post-quantization contrast.
 F10–F13 restore the DISCOVERY-MAP §4.2 jc×hpc floor that v1.0 omitted —