docs(v3): fold #629 review sharpenings — LE byte-order caveat, 3-shape legacy scan, ractor control-plane wording

Accepts the three review findings: (1) domain range-scans hold over the
DECODED classid u32 (or order-preserving BE keys), never raw LE key-byte
prefixes (NodeGuid stores classid to_le_bytes — raw prefixes order by
the custom byte first); (2) the corpus-proof scanner must count ALL
THREE legacy shapes incl. 0xAAAA_DDCC render-prefix-high — exactly the
classid_canon_compat CanonLow set; (3) ractor 'ownership dummy' scopes
the data plane — the actor mailbox remains the runtime serialized
single-writer control path (the codex #578 atomicity mechanism).
routing.md §1/§5 + mailbox-kanban-model.md + INTEGRATION-PLAN W6a +
appended board correction entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MLBnPuScZy6w9di2QEjsXM

Author: claude

.claude/board/EPIPHANIES.md

@@ -9777,3 +9777,10 @@ Cross-ref: W2's sprint-2 deliverable (Tier-0 "what's shipped" index); `.claude/p
 **Practical consequence (do not let this drift back):** `surreal_container` (BLOCKED A/B/C/D — fork dep + Lance 6 pin) is **optional**, not on the critical path for D-MBX-6. D-MBX-6's hot/cold transparent view uses the LanceDB cold tier directly; the SurrealDB kanban is a *second* view over the same LanceDB rows.
 
 **Cross-ref:** `E-RUBICON-RACTOR` (current ruling), `E-MAILBOX-IS-BINDSPACE` (§2.7 of the plan it gates), `E-BATON-1` (the LE-contract anchor), `.claude/plans/causaledge64-mailbox-rename-soa-v1` (driver plan that subsumes the surreal POC), `.claude/handovers/2026-05-28-1200-pr-418-419-surreal-mailbox-baton-plan-map.md` §5 (the audit source for this entry).
+
+## 2026-07-02 — CORRECTION-OF 2026-07-02 (review #629 sharpenings: LE byte-order, legacy scan shapes, ractor wording)
+**Status:** FINDING
+
+Three review findings on the #629 doc arc, accepted and folded into the V3 docs (routing.md §1/§5, mailbox-kanban-model.md, INTEGRATION-PLAN W6a): (1) **Clustered-index caveat** — `NodeGuid` stores classid via `to_le_bytes`, so RAW key-byte prefixes order by the custom byte first; domain range-scans hold over the DECODED u32 (or an order-preserving big-endian rendering), never raw LE byte prefixes/tries (E-CLASSID-CANON-HIGH-IS-A-CLUSTERED-INDEX reads with this caveat). (2) **Corpus-proof scanner scope** — "old-form" = ALL THREE legacy shapes: `0x0000_DDCC`, `0x1000_DDCC`, AND `0xAAAA_DDCC` (legacy app/render prefix high, e.g. `0x0005_0901`) — exactly the set `classid_canon_compat` routes CanonLow; scanning only the first two can falsely prove the corpus clean (E-V3-MARKER-IS-A-MONITOR reads with this scope). (3) **ractor wording sharpened** — "compile-time ownership dummy / never a hot-path bus" scopes the DATA plane; the actor mailbox remains the runtime serialized single-writer CONTROL path (one-message Advance/MulAdvance serialization = the codex #578 atomicity mechanism). The operator ruling's meaning is unchanged; the wording now says both halves.
+
+Cross-ref: PR #629 review threads (2 codex P2 + 1 coderabbit); E-MAILBOX-KANBAN-NO-COLLAPSEGATE.

.claude/v3/INTEGRATION-PLAN.md

@@ -106,7 +106,7 @@ Gate: replay equivalence green on every template change (template-smith rule).
 
 | D-id | Deliverable | Notes |
 |---|---|---|
-| D-V3-W6a | **Adoption/corpus scanner**: ONE two-metric range-count tool (canon-high adoption % + old-form row count) over Lance datasets | canon-high = clustered index → both metrics are key-range counts |
+| D-V3-W6a | **Adoption/corpus scanner**: ONE two-metric range-count tool (canon-high adoption % + old-form row count) over Lance datasets | metrics are range counts over the DECODED classid u32 (or an order-preserving BE key) — never raw LE key-byte prefixes; old-form = ALL THREE legacy shapes incl. `0xAAAA_DDCC` render-prefix-high (codex #629 sharpenings; routing.md §1/§5) |
 | D-CCF-4 | `0x1000` marker retirement (P4) — trigger DEFINED: adoption reads 100% | **operator checkpoint** |
 | D-V3-W6b | Legacy alias retirement (`CLASSID_*_LEGACY`, compat reader narrowing) | corpus proof = zero old-form rows; never before |
 | D-V3-W6c | Custom half opens: 64k ClassView render catalogue + template catalogue dispatch (completes W3d/F2) | post-P4 only |

.claude/v3/knowledge/mailbox-kanban-model.md

@@ -27,7 +27,7 @@ proposes; the owner disposes.
 |---|---|---|
 | **Arm #1 — planner** | `lance-graph-planner/src/strategy/style_strategy.rs` | The D-MBX-A6 seam: the deferred `Outcome → Candidate/KanbanMove` adapter. Strategy outcomes (converged, cycle_count, gate verdicts) become kanban moves. |
 | **Arm #2 — symbiont** | `crates/symbiont` (`kanban_loop.rs` = POC) | SurrealDB-on-kv-lance executor: kanban updates as KV transactions on the same Lance substrate. Gated on the AdaWorldAPI surrealdb fork `kv-lance` feature. |
-| **Structural owner** | `lance-graph-supervisor/kanban_actor.rs` | ractor actor per mailbox. **ractor is a compile-time ownership dummy** — it spawns and proves single-ownership via move semantics; it is NOT a hot-path bus (ractor itself is too slow; it just spawns). |
+| **Structural owner** | `lance-graph-supervisor/kanban_actor.rs` | ractor actor per mailbox. **ractor is a compile-time ownership dummy** — it spawns and proves single-ownership via move semantics; it is NOT a data-plane bus (payloads never flow through it; ractor itself is too slow; it just spawns). **Sharpening (review #629):** the actor mailbox IS still the runtime serialized single-writer CONTROL path — Advance/MulAdvance/Tick serialize through one actor message, which is exactly what the codex #578 atomicity fix relies on. "Dummy" scopes the data plane, not the control serialization. |
 
 ## The ahead-firing batch writer
 

.claude/v3/soa_layout/routing.md

@@ -25,7 +25,7 @@ Routing consequences, in prefix order:
 
 | Prefix consumed | Routes to | Mechanism |
 |---|---|---|
-| canon hi-u16 | domain + app (`ConceptDomain` = `canon >> 8`) | range predicate — canon-high IS a clustered index (E-CLASSID-CANON-HIGH-IS-A-CLUSTERED-INDEX) |
+| canon hi-u16 | domain + app (`ConceptDomain` = `canon >> 8`) | range predicate over the **DECODED u32** — canon-high clusters by domain in VALUE order (E-CLASSID-CANON-HIGH-IS-A-CLUSTERED-INDEX). **Byte-order caveat (codex #629):** `NodeGuid` stores classid LE, so RAW key-byte prefixes order by the custom byte first — a byte-trie/raw-prefix scan does NOT walk domain-first; decode the u32 or use an order-preserving big-endian rendering for range keys |
 | custom lo-u16 | render skin / (post-P4) template lens; `0x1000` = V3-adoption monitor | catalogue dispatch; monitor is a marker, never a semantic |
 | classid (full) | `ClassView` + `classid_read_mode(c).value_schema` (tenant schema) | O(1) codebook; longest-prefix codebook binding (OGAR tier rule) |
 | HEEL/HIP/TWIG | cascade position | shift/mask only (`tier = level >> 2`); tier distance = 3 table lookups |
@@ -95,9 +95,14 @@ key-range counts over the same index — ONE two-metric scanner (W6a):
 
 - **adoption%** = rows whose custom half carries `0x1000` (V3 substrate)
   vs total, per domain;
-- **corpus proof** = count of old-form rows (legacy order / legacy tails);
-  zero ⇒ alias retirement unlocks; adoption 100% ⇒ P4 trigger (operator
-  checkpoint) ⇒ marker deprecates ⇒ custom half opens for the
+- **corpus proof** = count of old-form rows — ALL THREE legacy shapes
+  (codex #629): `0x0000_DDCC` (zero-prefix), `0x1000_DDCC` (pre-flip V3
+  marker high), AND `0xAAAA_DDCC` (legacy app/render prefix high, e.g.
+  `0x0005_0901`) — i.e. exactly the set `classid_canon_compat` routes
+  through the CanonLow fallback. Scanning only the first two can falsely
+  prove the corpus clean while un-rebaked render rows remain. Zero across
+  all three ⇒ alias retirement unlocks; adoption 100% ⇒ P4 trigger
+  (operator checkpoint) ⇒ marker deprecates ⇒ custom half opens for the
   render/template catalogue.
 
 Cross-ref: `le-contract.md` (bytes), `tenants.md` (what the value lanes