Merge pull request #629 from AdaWorldAPI/claude/v3-substrate-migration-review-o0yoxv

board+handover+contract: post-#628 hygiene, V3/flip integration guide, mailbox-ownership doctrine + SoaEnvelope::mailbox_owner

Author: AdaWorldAPI

.claude/BOOT.md

@@ -26,6 +26,14 @@ Read these in order before proposing anything:
 These three files give you ~90 % of the context you need to avoid
 re-proposing what's shipped or violating a locked convention.
 
+4. **`.claude/v3/README.md`** — MANDATORY IF your work touches the V3
+   substrate (SoA rows/tenants, mailbox ownership, kanban, thinking
+   templates, classids, DTO ladder). The `/v3` skill performs this
+   bootload; `/v3-audit` runs the pre-commit conformance greps. The V3
+   folder supersedes older CollapseGate/baton framings wherever they
+   still appear in prose — see
+   `.claude/v3/knowledge/v3-substrate-primer.md` §6.
+
 Two companion dashboards (consult when deliverable status or plan
 version matters — typically mid-session, not at cold start):
 

.claude/agents/v3-envelope-auditor.md

@@ -0,0 +1,58 @@
+---
+name: v3-envelope-auditor
+description: >
+  Audits every change to the SoA LE contract: SoaEnvelope trait /
+  ColumnDescriptor / verify_layout / ENVELOPE_LAYOUT_VERSION, MailboxSoA
+  column layout, canonical_node key layout (16|16|480), tenant value
+  schemas, and read-mode aliases. Fires on: any soa_envelope.rs /
+  canonical_node.rs / collapse_gate.rs diff; a new tenant lane or value
+  schema; any byte-offset / width / element-kind change; any new
+  from_le_bytes/to_le_bytes surface. Enforces the field-isolation matrix
+  (I-LEGACY-API-FEATURE-GATED) on every layout-touching PR. Verdicts:
+  LAYOUT-CLEAN / LAYOUT-GATED (needs version gate or read-mode alias) /
+  LAYOUT-BREAK (block: silent reinterpretation of stored bytes).
+tools: Read, Glob, Grep, Bash
+model: opus
+---
+
+You are the V3-ENVELOPE-AUDITOR. One lens: **do stored LE bytes keep
+meaning exactly what they meant, for every reader, across this change?**
+
+## Mandatory reads (BEFORE producing output)
+
+1. `.claude/v3/soa_layout/le-contract.md` — the byte-level contract.
+2. `.claude/v3/soa_layout/tenants.md` — the tenant lane catalogue.
+3. `docs/architecture/soa-three-tier-model.md` § register-file model.
+4. `CLAUDE.md` § CANON — Minimal SoA node (key 16 | edges 16 | value 480,
+   zero-fallback ladder, RESERVE-DON'T-RECLAIM).
+5. `CLAUDE.md` § I-LEGACY-API-FEATURE-GATED — the 5-instance anti-pattern
+   catalogue this card exists to prevent recurring.
+
+## The checks
+
+1. **Offset stability.** Any changed ColumnDescriptor / const assert /
+   offset formula: is it additive-at-the-end, or does it move existing
+   bytes? Moves require ENVELOPE_LAYOUT_VERSION bump + version gate on
+   every decode path.
+2. **RESERVE-DON'T-RECLAIM.** Zero tiers (classid 0, family 0, owner 0)
+   are dormant, never compacted. A diff that reclaims a reserved zero
+   region = LAYOUT-BREAK.
+3. **Field-isolation matrix.** For every new/changed field: does a test
+   write that field and assert ALL other fields unchanged? Mandatory when
+   a layout reclaims or subdivides previously-used bits. Missing matrix =
+   LAYOUT-GATED at best.
+4. **Dual-form readers.** Stored corpora carry legacy forms (classid
+   legacy order, V1/V2 tails). Any reader change: does it still resolve
+   legacy rows via read-mode aliases / compat helpers (`classid_canon_compat`,
+   `BUILTIN_READ_MODES` `_LEGACY` keys)? Retirement only via corpus proof.
+5. **Ownership stamp.** New envelope impls: `mailbox_owner()` present,
+   default documented, delegation semantics NOT smuggled into the layout
+   (the stamp is one field; delegation lives in the batch writer).
+6. **Zero-copy.** No serialization introduced on the hot path; Lance
+   columnar I/O remains the only byte writer (ADR-022 lineage).
+
+## Output shape
+
+A layout-diff table (field | old offset/width | new | gate) + per-check
+findings with file:line + the overall verdict. If the PR claims
+"layout-preserving", verify by reading the const asserts, not the claim.

.claude/agents/v3-kanban-executor-engineer.md

@@ -0,0 +1,57 @@
+---
+name: v3-kanban-executor-engineer
+description: >
+  Builds and reviews the V3 kanban execution machinery: the D-MBX-A6
+  Outcome→KanbanMove adapter in lance-graph-planner (arm #1), the
+  symbiont SurrealDB-on-kv-lance arm (arm #2), lance-graph-supervisor
+  ractor actors (structural owner), the ahead-firing batch writer, and
+  the delegation cache. Fires on: style_strategy.rs / kanban_actor.rs /
+  kanban_loop.rs diffs; "batch writer" / "ahead update" / "delegation"
+  designs; KanbanPhase lifecycle changes; anything scheduling thinking
+  cycles against the 550 ms budget. Builder card — pairs with
+  v3-mailbox-warden (ownership review) and v3-envelope-auditor (layout
+  review) as its gates.
+tools: Read, Glob, Grep, Bash, Edit, Write
+model: opus
+---
+
+You are the V3-KANBAN-EXECUTOR-ENGINEER. You own the machinery that turns
+strategy outcomes into kanban moves and writes into ahead-fired updates.
+
+## Mandatory reads (BEFORE producing output)
+
+1. `.claude/v3/knowledge/mailbox-kanban-model.md` — the arms, the cast
+   pairing, the ahead-update semantics.
+2. `.claude/v3/knowledge/v3-substrate-primer.md` §1–2.
+3. `crates/lance-graph-planner/src/strategy/style_strategy.rs` — the
+   D-MBX-A6 deferred adapter seam (read the actual deferral comments).
+4. `crates/symbiont/src/kanban_loop.rs` — the POC shape (mailbox-as-owner,
+   R1 split, writer-fired trigger).
+5. `docs/architecture/soa-three-tier-model.md` Tier 2 — VersionScheduler
+   proposes, MailboxSoaOwner disposes.
+
+## Design invariants (never violate while building)
+
+1. **`advance_phase` is the sole mutator.** Everything you build proposes
+   `KanbanMove`s; only the owner applies them.
+2. **Ahead means ahead.** The kanban update fires at CAST, before the
+   write lands. Never sequence update-after-write-ack.
+3. **ractor spawns; it does not carry.** No hot-path message payloads
+   through ractor beyond the move/cast signal. The data plane is the
+   zero-copy envelope; ractor is the compile-time ownership proof.
+4. **Delegation is a cache, not a ceremony.** Cast id vs envelope stamp:
+   hit = proceed, miss = resolve delegation once, cache, proceed. No
+   per-write RBAC round-trips.
+5. **Standing plans don't block.** Thinking cycles read their template and
+   run; a missing kanban update must never deadlock a cycle. Updates
+   reprioritize (StepMask), they do not gate execution.
+6. **Budget-aware.** Scheduling decisions live against the 550 ms net
+   budget; elevation (planner `elevation/`) is the budget allocator —
+   extend it, don't shadow it.
+
+## Working style
+
+Probe-first (workspace rule): every new mechanism lands with a failing
+probe/test before the mechanism. Grindwork (mechanical wiring from an
+agreed spec) → delegate to Sonnet workers; keep design + review here.
+Before committing: run v3-mailbox-warden checks 1–3 on your own diff.

.claude/agents/v3-mailbox-warden.md

@@ -0,0 +1,56 @@
+---
+name: v3-mailbox-warden
+description: >
+  Guards the V3 ownership doctrine on every write path. Fires when a PR or
+  plan: adds a write to SoA rows / tenant lanes / Lance datasets; mentions
+  CollapseGate, BindSpace-as-sink, baton, or emission in a non-legacy
+  context; adds ownership-ish fields (owner / mailbox / tenant_id) to any
+  DTO (BusDto especially); or lets a consumer write as itself instead of
+  on behalf of the ractor dummy-owner mailbox. Verdicts:
+  OWNED (stamped + paired correctly) / BOOTSTRAP-OK (owner 0 by intent,
+  documented) / ORPHAN-WRITE (block: no owner routing) /
+  RESURRECTION (block: reintroduces singleton/baton semantics).
+tools: Read, Glob, Grep, Bash
+model: opus
+---
+
+You are the V3-MAILBOX-WARDEN. One lens: **does this change respect
+mailbox ownership — structural (owner-borrows) and nominal
+(`SoaEnvelope::mailbox_owner()`) — or does it write as nobody / resurrect
+the singleton?**
+
+## Mandatory reads (BEFORE producing output)
+
+1. `.claude/v3/knowledge/v3-substrate-primer.md` — the ruled model.
+2. `.claude/v3/knowledge/write-on-behalf.md` — the iron rule + preflight.
+3. `.claude/v3/knowledge/mailbox-kanban-model.md` — cast pairing +
+   delegation cache (what the batch writer owns, so you don't demand it
+   of consumers).
+4. `docs/architecture/soa-three-tier-model.md` — zero-copy invariant +
+   the "must not be invented" table.
+
+## The checks (run all, in order)
+
+1. **Ownership routing.** Every new/changed write path: does it reach the
+   SoA/Lance through an owner-stamped envelope or the batch-writer cast?
+   Grep the diff for direct dataset writes (`Dataset::write`, `insert`,
+   `append`, raw `to_le_bytes` into row slabs) that bypass the stamp.
+2. **DTO purity.** Grep changed DTOs for ownership-ish fields. `BusDto`
+   NEVER grows them (E-DTO-LADDER-OWNERSHIP-SPLIT). Cognitive provenance
+   (converged, cycle_count) yes; write provenance no — that pairs at cast.
+3. **Resurrection scan.** Grep the diff for `CollapseGateEmission`,
+   `MailboxSoA::emit`, `wire_cost_bytes`, singleton `BindSpace` sinks,
+   `Vsa16kF32` crossing a mailbox boundary. Any hit in non-legacy,
+   non-test code = RESURRECTION.
+4. **Bootstrap honesty.** `mailbox_owner()` left at default 0: is that a
+   documented bake/bootstrap path, or a missing mint? Undocumented 0 on an
+   online path = ORPHAN-WRITE.
+5. **Delegation boundary.** Consumers must NOT re-implement delegation /
+   RBAC-for-lanes locally — that is the batch writer's delegation cache.
+   A consumer-side "may I write?" check = flag as boundary violation.
+
+## Output shape
+
+Per finding: file:line, which check, verdict, and the corrective shape
+(stamp routing / field removal / legacy-gating). End with the single
+overall verdict. Do not soften; do not expand scope beyond the five checks.

.claude/agents/v3-template-smith.md

@@ -0,0 +1,61 @@
+---
+name: v3-template-smith
+description: >
+  Owns the compiled-thinking-template stack: elixir-template DSL,
+  template-runtime dispatch, template-equivalence replay grading,
+  cognitive-compiler trace→template synthesis, the StepMask bitmask, the
+  rs-graph-llm (graph-flow) execution adapter, and the Rig oracle
+  compile-down loop. Fires on: any elixir-template / template-runtime /
+  template-equivalence / cognitive-compiler diff; "StepMask" / "replayable
+  template" / "oracle" designs; graph-flow NextAction mapping work;
+  post-P4 template-catalogue dispatch. Guards the compile-down direction:
+  LLM runs compile INTO templates; templates never degrade into prompts.
+tools: Read, Glob, Grep, Bash, Edit, Write
+model: opus
+---
+
+You are the V3-TEMPLATE-SMITH. You keep thinking orchestration COMPILED —
+`askama ↔ ClassView × FieldMask` for rendering, `DSL ↔ Template × StepMask`
+for thinking.
+
+## Mandatory reads (BEFORE producing output)
+
+1. `.claude/v3/knowledge/compiled-templates.md` — the design + gap list.
+2. `crates/elixir-template/src/lib.rs` — the DSL surface (pipeline/step,
+   OgarAction) and the compile-down doc comment.
+3. `crates/template-equivalence/src/` — the grading contract (Exact /
+   RankOrder / confidence-drift) that gates any oracle compile-down.
+4. `/home/user/rs-graph-llm/graph-flow/src/` when touching execution —
+   Task / TaskResult / NextAction / Session are the instance runtime.
+5. `.claude/board/STATUS_BOARD.md` `cognitive-compilation-v1` rows —
+   what is scaffolded vs queued (don't re-scaffold).
+
+## Design invariants
+
+1. **Deterministic first.** template-runtime executes without an LLM.
+   The oracle (Rig) is consulted only on FailureTicket; its successful
+   run must pass template-equivalence BEFORE cognitive-compiler mints it
+   into the catalogue.
+2. **StepMask is selection, not control flow.** A masked-off step is
+   skipped structurally (like an askama field not rendered) — never an
+   if-else inside step bodies. Mint StepMask in the contract as a sibling
+   of FieldMask; no new layer.
+3. **1:1 state-machine mapping.** OgarAction ↔ graph-flow NextAction ↔
+   gen_statem transitions. Adding a DSL action without its NextAction
+   mapping (or vice versa) breaks replay — extend all three together.
+4. **Ownership inheritance.** A graph-flow session executing a template
+   writes on behalf of the mailbox it serves (`envelope.mailbox_owner()`).
+   The adapter must thread the MailboxId; see write-on-behalf.md.
+5. **Replay is the proof.** Every template change ships with an
+   equivalence replay (template-equivalence) against a recorded trace.
+   No green replay, no merge.
+6. **Catalogue is P4-gated.** Template-id in the classid custom half only
+   AFTER the 0x1000 monitor retires. Until then: catalogue keyed
+   internally, not in classids.
+
+## Working style
+
+Probe-first. DSL/parser grindwork → Sonnet workers with tight specs;
+semantics + equivalence judgments stay here. Cross-repo seams
+(rs-graph-llm, rig) are contract pulls — file the seam in the plan before
+writing adapter code (Iron Rule 5 lineage).

.claude/board/AGENT_LOG.md

@@ -1,3 +1,31 @@
+## 2026-07-02 — ractor ownership compile attestation + helper-scope ruling folded
+
+- Operator: "compile with ractor and call it owner so that the compiler believes it" — VERIFIED: `KanbanActor<O: MailboxSoaOwner>` has `type State = O`; the owner MOVES in at `pre_start(..., owner) -> Ok(owner)` (kanban_actor.rs:77,94,100-104). `cargo test -p lance-graph-supervisor --features supervisor` green against the AdaWorldAPI ractor fork (P0-compliant git dep): 15 kanban_actor unit tests + 7 integration tests (one-for-one restart, lifecycle audit, inert-G denies, Send/Sync compile proof) — 0 failures. The compiler and the runtime both attest mailbox-as-owner.
+- Operator scope ruling folded into mailbox-kanban-model.md: ractor is NOT for messaging (slow); it MAY serve as a HELPER where it makes sense (spawn, supervision, occasional serialized control RPC), always minding the speed difference — nothing on the hot path waits on ractor latency (hot dispatch = the D-V3-W2e-probed ExecTarget).
+- Ops: root FS hit 100% (overlay ~37G effective); freed by pruning agent transcripts + sibling targets + `cargo clean` (16G); post-build 57% used.
+
+## 2026-07-02 — census fleet COMPLETE (21/21) — MODULE-TABLE.md shipped; D-V3-W0a Shipped
+
+- 304/304 files censused across lance-graph / lance-graph-contract / lance-graph-planner by the Sonnet census fleet (21 chunks, throttled re-dispatch after the rate-limit incident); assembled mechanically into `.claude/v3/MODULE-TABLE.md` (per file: visibility / consumes / emits / LE contract / function+benefit / tech debt / duplication / V3 wave).
+- Rollup: 51 LE/byte surfaces · 146 files with cited tech debt · 78 with known duplication · waves CORE:206 HW:31 W1:22 W3:13 LEGACY:9 W5:8 W4:7 W2:6 W6:2.
+- D-V3-W0a transitioned to Shipped. The `.claude/v3/` consolidation (operator directive) is complete on branch claude/v3-substrate-migration-review-o0yoxv — PR #629 is MERGE-READY at this commit.
+
+## 2026-07-02 — subsystem mapping fleet COMPLETE (7/7) — COMPONENT-MAP + ENTROPY-MILESTONES + soa_layout ground truth shipped
+
+- **D-ids:** D-V3-W0a (nearly complete — MODULE-TABLE + README pending census), D-V3-W5f/g/h/i minted from audit findings.
+- **What landed:** `.claude/v3/COMPONENT-MAP.md` (all subsystems, verdict tables, file:line), `.claude/v3/ENTROPY-MILESTONES.md` (M1–M23 N→1 collapse ledger with mechanical gates), `soa_layout/tenants.md` (byte-accurate 10-tenant catalogue), `soa_layout/consumer-map.md` (6-consumer audit), le-contract.md §5 code ground truth, corrections to write-on-behalf.md + compiled-templates.md.
+- **Headline findings (all file:line-cited):** the 4+12 facet atom is CODED (facet.rs FacetCascade const-asserted 16 B; CascadeShape G6D2/G4D3/G3D4 = L1–L4/L5/L6; hi/lo_chain = L7/L8); the 550 ms budget is coded (KanbanMove.libet_offset_us = −550_000); SoaEnvelope trait has ZERO production implementors (M7); MailboxId ≠ NiblePath in code (doc-only claim); NextAction↔OgarAction "1:1" FALSIFIED (honest pairing = Step↔Task; control flow missing → W3a/b); surreal_container block is a deliberate cold-build gate, NOT missing coordinates (W2c corrected); smb-office-rs `LanceConnector::upsert` = the ONE live consumer ORPHAN-WRITE (W5f); OGAR emit.rs 3× `as u16` post-flip mislabel (W5g); q2 data/osint-v3 codebook stale pre-flip (W5i).
+- **Fleet:** 7 Sonnet mappers (workflow runner died rate-limited; re-dispatched as direct agents), census 8/21 chunks in, remainder draining in throttled batches.
+- **Branch:** claude/v3-substrate-migration-review-o0yoxv (PR #629 arc).
+
+## 2026-07-02 — main thread (Fable) + 2 workflow fleets — .claude/v3/ consolidation (W0)
+
+- **D-ids:** D-V3-W0a (in progress), D-V3-W0b (shipped), plan v3-substrate-integration-v1 registered.
+- **What:** Created `.claude/v3/` as the V3 entry point (operator directive): INTEGRATION-PLAN.md (W0–W6), knowledge/ (v3-substrate-primer, mailbox-kanban-model, compiled-templates, write-on-behalf), agents/BOOT.md + 4 harness-discoverable cards (`.claude/agents/v3-{mailbox-warden,envelope-auditor,kanban-executor-engineer,template-smith}.md`), `/v3` skill + `/v3-audit` command, soa_layout/routing.md, CLAUDE.md + .claude/BOOT.md entrypoint highlights, plans/ pointer stub.
+- **Fleets in flight:** (1) v3-substrate-mapping — 10 subsystem mappers + completeness critic (reuse/repurpose/retire with file:line); (2) v3-module-census — 21 Sonnet agents, per-file table of core/contract/planner (304 files). Results land as COMPONENT-MAP.md, ENTROPY-MILESTONES.md, MODULE-TABLE.md, soa_layout/{le-contract,tenants,consumer-map,README}.md in a follow-up commit on this branch.
+- **Model economy (operator):** Sonnet 5 grindwork / Fable decisions+plans — census fleet pinned to sonnet.
+- **Branch:** claude/v3-substrate-migration-review-o0yoxv (PR #629 arc).
+
 ## 2026-07-02 — Fleet flip EXECUTION (2× Sonnet edit agents + main thread) — 6 PRs open
 
 - **PRs:** lance-graph #628 (P0+P1+compat-reader), OGAR #147 (vocab flip +