fix(sprint-13/codex-p2): D-CSV-14 gen=0 + D-CSV-16 cam_pq_search semantics

Two codex P2 findings on the merged sprint-13 W-I2 / W-I3 PRs (#395, #396).
Both bugs are silent semantic regressions; both fixes are surgical.

## #395 / D-CSV-14 — splat_ops::splat_gaussian deprecated shim, gen=0 case

Old free fn wrote `SplatField::generation = generation` verbatim. The
deprecation shim seeds `Think::from_field(field, generation.saturating_sub(1))`
then calls `splat_gaussian`, which advances cycle and writes
`generation = self.cycle`. For `generation >= 1` this matches v1; for
`generation == 0` the saturating sub stays at 0 and the post-advance
cycle becomes 1, producing `generation = 1` instead of 0.

Fix: after the delegated call, walk `think.splat_field` and overwrite
the touched splat (matched by `mean`) with the caller-supplied
`generation`. Both push-new and merge-existing paths are covered.

Test: `deprecated_splat_gaussian_preserves_generation_zero` asserts
verbatim preservation for both push and merge paths.

## #396 / D-CSV-16 — WitnessCorpus::cam_pq_search exact-match semantics

Old (sprint-12) `cam_pq_search` was exact SPO top-k via HashMap. W-I3's
patch added a `#[cfg(feature = "with-cam-pq")]` early-return that routed
through `WitnessIndexCamPq::cam_pq_search`, which is distance-ranked ANN
over the whole corpus. Two semantic regressions follow when CAM-PQ is
enabled:
- Missing SPO: v1 returns empty; v2 returns k unrelated neighbours.
- Existing SPO with <k entries: v1 returns just the matches; v2 pads
  with unrelated nearest neighbours.

The distance-ranked API was already added as `query_similar` (returns
`Option<Vec<(&WitnessEntry, f32)>>`), so callers wanting ANN have it.
`cam_pq_search` should keep its exact-match contract.

Fix: remove the `with-cam-pq` early-return block; the HashMap path
(always present) handles both feature states identically.

Test: `cam_pq_search_exact_match_when_cam_pq_enabled` (cfg with-cam-pq)
asserts a missing SPO returns empty and an existing SPO returns only
its own entries — never unrelated neighbours.

## Validation

- `cargo test --manifest-path crates/thinking-engine/Cargo.toml splat_ops`
  → 5/5 pass (including new gen=0 test)
- `cargo check -p lance-graph --features with-cam-pq --tests` → clean
- `cargo check -p lance-graph --tests` (feature OFF) → clean
- `cargo test -p lance-graph --features with-cam-pq` linking fails with
  `ld terminated with signal 7 [Bus error]` — environmental linker
  constraint, same one W-I3 originally hit; not a code defect.

https://claude.ai/code/session_01UwJuKqP828qyX1VkLgGJFS

Author: claude

crates/lance-graph/src/graph/arigraph/witness_corpus.rs

@@ -409,20 +409,12 @@ impl WitnessCorpus {
         evicted
     }
 
-    /// Top-k query by SPO.
+    /// Exact-match top-k query by SPO.
     ///
-    /// With `with-cam-pq` ON and cam_pq_state Some: distance-ranked via CAM-PQ ADC.
-    /// Otherwise: HashMap chain-order fallback.
+    /// Always returns entries whose `spo` exactly equals the query; never
+    /// returns unrelated neighbours. For distance-ranked nearest-neighbour
+    /// search, use `query_similar` (feature `with-cam-pq`).
     pub fn cam_pq_search(&self, spo: u64, k: usize) -> Vec<&WitnessEntry> {
-        #[cfg(feature = "with-cam-pq")]
-        if let Some(state) = self.cam_pq_state.as_ref() {
-            return state
-                .index
-                .cam_pq_search(spo, k)
-                .into_iter()
-                .filter_map(|(pos, _dist)| self.entries.get(pos))
-                .collect();
-        }
         self.cam_pq_index
             .lookup(spo)
             .iter()
@@ -979,6 +971,39 @@ mod tests {
         assert_eq!(idx.len(), 0);
     }
 
+    // Codex P2 (PR #396): cam_pq_search must remain exact-match even when
+    // CAM-PQ is enabled. ANN search lives on query_similar. Asserts that a
+    // missing SPO yields an empty result (not k unrelated neighbours) and
+    // that an existing SPO yields only its own entries.
+    #[cfg(feature = "with-cam-pq")]
+    #[test]
+    fn cam_pq_search_exact_match_when_cam_pq_enabled() {
+        let mut corpus = WitnessCorpus::new();
+        let spo_a = 0xAAAA_u64;
+        let spo_b = 0xBBBB_u64;
+        for ts in [100u64, 200, 300] {
+            corpus.insert(make_entry(spo_a, ts));
+        }
+        for ts in [10u64, 20, 30] {
+            corpus.insert(make_entry(spo_b, ts));
+        }
+        corpus.enable_cam_pq(tiny_codebook(), 0xCAFE_BABE);
+
+        let hits_a = corpus.cam_pq_search(spo_a, 5);
+        assert_eq!(hits_a.len(), 3, "must return exactly the 3 spo_a entries");
+        assert!(
+            hits_a.iter().all(|e| e.spo == spo_a),
+            "no unrelated neighbours allowed"
+        );
+
+        let missing = corpus.cam_pq_search(0xCCCC_u64, 5);
+        assert!(
+            missing.is_empty(),
+            "missing SPO must return empty, not k nearest neighbours; got {} entries",
+            missing.len()
+        );
+    }
+
     // T12: feature OFF smoke — WitnessCorpus::new() and query() work.
     // (Compiles and runs under both feature flags; tests only HashMap path.)
     #[test]

crates/thinking-engine/src/splat_ops.rs

@@ -53,6 +53,15 @@ pub fn splat_gaussian(
 ) {
     let mut think = Think::from_field(std::mem::take(field), generation.saturating_sub(1));
     think.splat_gaussian(mean, variance, energy);
+    // For generation == 0, saturating_sub(1) underflows to 0 and the method's
+    // advance_cycle() then writes generation=1, diverging from v1 verbatim
+    // semantics. Restore by overwriting the touched splat (matched by `mean`).
+    for s in think.splat_field.iter_mut() {
+        if s.mean == mean {
+            s.generation = generation;
+            break;
+        }
+    }
     *field = think.splat_field;
 }
 
@@ -169,6 +178,28 @@ mod tests {
         assert_eq!(field_shim[0].generation, think.splat_field[0].generation);
     }
 
+    #[test]
+    #[allow(deprecated)]
+    fn deprecated_splat_gaussian_preserves_generation_zero() {
+        // Codex P2 (PR #395): caller passing generation=0 must see the v1
+        // verbatim semantics (stored generation == 0), not the off-by-one
+        // produced by Think::splat_gaussian advancing cycle from 0 → 1.
+        let mut field_push: Vec<SplatField> = Vec::new();
+        splat_gaussian(&mut field_push, 7, 1.0, 1.0, 0);
+        assert_eq!(field_push.len(), 1);
+        assert_eq!(field_push[0].generation, 0, "push path: gen=0 verbatim");
+
+        let mut field_merge: Vec<SplatField> = vec![SplatField {
+            mean: 9,
+            variance: 1.0,
+            energy: 2.0,
+            generation: 42,
+        }];
+        splat_gaussian(&mut field_merge, 9, 1.0, 3.0, 0);
+        assert_eq!(field_merge.len(), 1);
+        assert_eq!(field_merge[0].generation, 0, "merge path: gen=0 verbatim");
+    }
+
     #[test]
     #[allow(deprecated)]
     fn deprecated_score_hole_closure_forwards_to_method() {