contract+rbac+ogar: mint-forward compat reader — the P0 sweep missed rbac.rs

Follow-up on the CanonHigh flip: three sites derived classid halves outside
the one flippable composition and surfaced only when the flip landed —

- contract rbac.rs ClassGrant::permits used 'class as u16' (the codex-P2
  collapse pattern). Now routes classid_canon_compat.
- lance-graph-rbac AuthProvider::classid() hand-widened u32::from(concept).
  Now routes contract render_classid(0x0000, concept) -> 0x0B01_0000-form.
- lance-graph-ogar AUTH_*_CID / test ENCOUNTER literals in the pre-flip
  0x0000_DDCC form. Now const-composed via contract render_classid.

New: ogar_codebook::classid_canon_compat — the mint-forward CANON reader
for surfaces serving BOTH stored forms (RBAC grants, un-re-baked corpora):
active canon when plausible (>= 0x0100 && != 0x1000), legacy-order
fallback otherwise; the canon slot exactly 0x1000 (domain-0x10 root) stays
reserved-unusable until marker retirement (P4). RBAC authorizes pre-flip
persisted rows without re-bake; both-forms grant test added.

Board: EPIPHANIES E-CLASSID-COMPAT-READER (same commit).

Gates: contract 774 (guid-v3-tail), rbac 30, ogar 81; clippy; fmt.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.claude/board/EPIPHANIES.md

@@ -1,3 +1,29 @@
+## 2026-07-02 — E-CLASSID-COMPAT-READER — the P0 sweep missed rbac.rs: `class as u16` in ClassGrant::permits; fixed via a mint-forward compat reader
+
+**Status:** SHIPPED (follow-up on the P1 flip commit, PR #628 arc).
+
+**Correction:** the D-CCF-0 route-through sweep covered ogar_codebook /
+hhtl / canonical_node but NOT `rbac.rs` — `ClassGrant::permits` derived its
+class discriminator via `class as u16` (the exact codex-P2 collapse
+pattern), and `lance-graph-rbac AuthProvider::classid()` hand-widened
+`u32::from(class_id)`, and `lance-graph-ogar` carried `0x0000_0B01`-form
+literals. All three surfaced only when the flip landed.
+
+**Mechanism added:** `ogar_codebook::classid_canon_compat` — the
+mint-forward CANON reader for surfaces that must serve BOTH stored forms
+(RBAC grant matching, reads over un-re-baked corpora): active canon when
+plausible (`>= 0x0100 && != 0x1000`), legacy-order fallback otherwise.
+Sound because real render prefixes are §2-allocated (`0x0000..0x0007`) and
+the marker is `0x1000`; documented limitation — the future canon slot
+exactly `0x1000` (domain-0x10 root) stays reserved-unusable until marker
+retirement (P4). RBAC now authorizes pre-flip persisted rows without
+re-bake (fails OPEN-to-correct-concept, never collapses classes).
+
+**Lesson (Rule-7 adjacent):** a route-through sweep's own coverage claim
+needs the same exhaustive-grep declaration as a negative-existence claim —
+"all sites routed" was asserted from the plan's §2 inventory, not from a
+whole-crate `as u16`/`u32::from` sweep.
+
 ## 2026-07-02 — E-CLASSID-FLIP-P1-LANDED — CanonHigh is live: canon HIGH / custom LOW, legacy aliases resolve persisted rows, OGAR#95 reconciled as the custom-half render catalogue
 
 **Status:** SHIPPED (PR #628 arc; P0 route-through fd9bf6b → P1 flip this commit).

crates/lance-graph-contract/src/ogar_codebook.rs

@@ -358,6 +358,34 @@ pub const fn classid_custom(classid: u32) -> u16 {
     split_classid(classid).1
 }
 
+/// **Mint-forward CANON reader** for surfaces that must serve BOTH stored
+/// forms — RBAC grant matching, read paths over corpora not yet re-baked to
+/// the post-flip order. Strict new-form-only surfaces use [`classid_canon`].
+///
+/// Returns the canon half under the active order when it is a *plausible*
+/// canon — a `0xDDCC` codebook id has domain byte `>= 0x01`, and the canon
+/// half never carries the `0x1000` V3 marker — otherwise re-reads the id
+/// under the legacy [`CanonLow`](ClassidOrder::CanonLow) order (where every
+/// pre-flip form keeps its canon in the LOW half: core `0x0000_0901`, render
+/// `0x0005_0901`, V3 `0x1000_0700` all resolve their true canon).
+///
+/// Documented limitation: a future canon exactly equal to `0x1000` (the
+/// domain-root slot of the currently-Unassigned domain `0x10`) would be
+/// indistinguishable from the V3 marker under this heuristic — that slot is
+/// reserved-unusable until the marker retires (plan §4 P4).
+#[inline]
+#[must_use]
+pub const fn classid_canon_compat(classid: u32) -> u16 {
+    let (canon, custom) = split_classid(classid);
+    if canon >= 0x0100 && canon != 0x1000 {
+        canon
+    } else if custom != 0 {
+        split_classid_with(ClassidOrder::CanonLow, classid).0
+    } else {
+        canon
+    }
+}
+
 /// Recompose a classid under the OTHER order — the flip itself. Involutive:
 /// `flip_classid(flip_classid(x)) == x` (probed below).
 #[inline]
@@ -832,6 +860,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn classid_canon_compat_reads_both_stored_forms() {
+        // New-form ids: compat == strict canon.
+        for id in [0x0901_0005u32, 0x0701_1000, 0x0102_0001, 0x0700_0000] {
+            assert_eq!(classid_canon_compat(id), classid_canon(id));
+        }
+        // Persisted pre-flip forms resolve their true canon via the legacy
+        // fallback: core, render, and V3-marked shapes.
+        assert_eq!(classid_canon_compat(0x0000_0901), 0x0901); // legacy core
+        assert_eq!(classid_canon_compat(0x0005_0901), 0x0901); // legacy render
+        assert_eq!(classid_canon_compat(0x1000_0700), 0x0700); // legacy V3
+        assert_eq!(classid_canon_compat(0x0000_0000), 0x0000); // default class
+    }
+
     #[test]
     fn no_class_collapse_under_canon_high() {
         // codex P2 (#627): post-flip, a naive `as u16` reads the CUSTOM half —

crates/lance-graph-contract/src/rbac.rs

@@ -96,7 +96,8 @@ impl ScopeSpec {
 }
 
 /// The codebook class identity an authorization targets — the
-/// [`NodeGuid`](crate::NodeGuid) `classid` (or its low-`u16` codebook id widened).
+/// [`NodeGuid`](crate::NodeGuid) `classid` (its canon half is the codebook id;
+/// compose via [`render_classid`](crate::ogar_codebook::render_classid)).
 /// Opaque to the kernel: it is compared and looked up, never decoded (the kernel
 /// "never touches a token" — only resolved keys go inward).
 pub type ClassId = u32;
@@ -244,12 +245,13 @@ impl OpMask {
 /// text` blob (keystone §6 / I-K0 registry axiom: "decisions key on `classid`,
 /// not on text"). A role's `granted` value-tenant is a `&[ClassGrant]`.
 ///
-/// `target_classid` is the **low `u16` codebook id** (the shared-concept half of
-/// a [`NodeGuid`](crate::NodeGuid)'s `classid`) — the RBAC + ontology identity,
-/// app-render-skin-independent (the hi `u16` chooses render, never grants).
+/// `target_classid` is the **CANON `u16` codebook id** (the shared-concept half
+/// of a [`NodeGuid`](crate::NodeGuid)'s `classid` — the HIGH u16 since the
+/// 2026-07-02 half-order flip) — the RBAC + ontology identity,
+/// app-render-skin-independent (the custom half chooses render, never grants).
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default, PartialOrd, Ord, Hash)]
 pub struct ClassGrant {
-    /// The class this grant targets (low-`u16` codebook id).
+    /// The class this grant targets (canon-`u16` codebook id).
     pub target_classid: u16,
     /// The verbs this grant permits on that class.
     pub op_mask: OpMask,
@@ -266,14 +268,19 @@ impl ClassGrant {
         }
     }
 
-    /// Whether this grant permits `op` on `class`. Matches on the **low `u16`**
-    /// of `class` (the codebook id), so a grant authored against the shared
-    /// concept applies regardless of which app's render-skin (hi `u16`) the
-    /// `ClassId` carries.
+    /// Whether this grant permits `op` on `class`. Matches on the **CANON
+    /// half** of `class` (the codebook id) via the mint-forward compat reader
+    /// [`classid_canon_compat`](crate::ogar_codebook::classid_canon_compat) —
+    /// a grant authored against the shared concept applies regardless of
+    /// which app's render-skin (custom half) the `ClassId` carries, AND
+    /// regardless of whether the id is a post-flip (canon HIGH) or persisted
+    /// pre-flip (canon LOW) stored form. Never `class as u16` — post-flip
+    /// that reads the custom half and collapses every class (codex P2 #627).
     #[inline]
     #[must_use]
     pub fn permits(&self, class: ClassId, op: &Operation<'_>) -> bool {
-        self.target_classid == (class as u16) && self.op_mask.permits(op)
+        self.target_classid == crate::ogar_codebook::classid_canon_compat(class)
+            && self.op_mask.permits(op)
     }
 }
 
@@ -344,21 +351,27 @@ mod tests {
     }
 
     #[test]
-    fn class_grant_matches_on_low_u16_codebook_id() {
+    fn class_grant_matches_on_canon_codebook_id() {
         let grant = ClassGrant::new(0x0901, OpMask::READ.union(OpMask::ACT));
-        // Same concept, different app render-skin (hi u16) → still permitted:
-        // the grant keys on the shared-concept low u16, never the render half.
-        let app_a: ClassId = 0x0000_0901;
-        let app_b: ClassId = 0xAB12_0901;
         let read = Operation::Read {
             depth: PrefetchDepth::Identity,
         };
-        assert!(grant.permits(app_a, &read));
-        assert!(grant.permits(app_b, &read));
-        // Wrong concept → denied even with the verb.
+        // Same concept, different app render-skin (custom half) → still
+        // permitted: the grant keys on the shared-concept CANON half, never
+        // the render half. Post-flip forms: concept HIGH, any prefix LOW.
+        assert!(grant.permits(0x0901_0000, &read)); // core lens
+        assert!(grant.permits(0x0901_0005, &read)); // Healthcare lens
+        assert!(grant.permits(0x0901_AB12, &read)); // arbitrary custom half
+                                                    // Mint-forward: persisted PRE-flip forms (canon LOW, §2-allocated
+                                                    // prefixes < 0x0100 or the 0x1000 V3 marker) still match through the
+                                                    // compat reader — a re-bake is never required for authorization.
+        assert!(grant.permits(0x0000_0901, &read)); // legacy core
+        assert!(grant.permits(0x0005_0901, &read)); // legacy Healthcare render
+                                                    // Wrong concept → denied even with the verb (both forms).
+        assert!(!grant.permits(0x0902_0000, &read));
         assert!(!grant.permits(0x0000_0902, &read));
         // Right concept, ungranted verb → denied.
-        assert!(!grant.permits(app_a, &Operation::Write { predicate: "due" }));
+        assert!(!grant.permits(0x0901_0000, &Operation::Write { predicate: "due" }));
     }
 
     /// A typed [`ClassRbac`] impl whose `grant_permits` body IS [`grants_permit`]

crates/lance-graph-ogar/src/actions.rs

@@ -107,16 +107,19 @@ const AUTH_ZITADEL_ACTIONS: &[ActionDef] = &[
     },
 ];
 
-// The auth-family codebook ids (keystone §7 `0x0B` core domain). Written as
-// literals — NOT `ogar_vocab::class_ids::AUTH_STORE` — so this DO-arm provider is
-// strictly `lance_graph_contract`-dependent and does not couple to whichever
-// `ogar-vocab` git ref this crate pins (the action manifest is a contract-shaped
-// artifact, exactly as `contract::action::ClassActions` documents — "generated
-// downstream; the Core provides the type"). They MUST equal
-// `ogar_vocab::class_ids::{AUTH_STORE, AUTH_ZITADEL}`; the lib's `parity` guard is
-// what binds the codebook itself.
-const AUTH_STORE_CID: u32 = 0x0000_0B01;
-const AUTH_ZITADEL_CID: u32 = 0x0000_0B02;
+// The auth-family codebook ids (keystone §7 `0x0B` core domain). Concept
+// slots are literals — NOT `ogar_vocab::class_ids::AUTH_STORE` — so this
+// DO-arm provider is strictly `lance_graph_contract`-dependent and does not
+// couple to whichever `ogar-vocab` git ref this crate pins (the action
+// manifest is a contract-shaped artifact, exactly as
+// `contract::action::ClassActions` documents — "generated downstream; the
+// Core provides the type"). They MUST equal
+// `ogar_vocab::class_ids::{AUTH_STORE, AUTH_ZITADEL}`; the lib's `parity`
+// guard is what binds the codebook itself. The FULL-classid widening routes
+// through the contract's one flippable composition (core render lens,
+// prefix 0x0000) — canon HIGH since the 2026-07-02 half-order flip.
+const AUTH_STORE_CID: u32 = contract::render_classid(0x0000, 0x0B01);
+const AUTH_ZITADEL_CID: u32 = contract::render_classid(0x0000, 0x0B02);
 
 /// The registry: one [`ClassActions`] row per class with a DO surface. Seeded
 /// with the auth family (the worked hardcoded-RBAC example); other domains append

crates/lance-graph-ogar/src/rbac_impl.rs

@@ -86,7 +86,9 @@ mod tests {
         }
     }
 
-    const ENCOUNTER: ClassId = 0x0000_0901;
+    // Full classid via the contract's flippable core-render composition
+    // (canon 0x0901 HIGH since the 2026-07-02 flip).
+    const ENCOUNTER: ClassId = lance_graph_contract::render_classid(0x0000, 0x0901);
 
     fn fixture() -> OgarRbac<FixtureGrants> {
         OgarRbac::new(FixtureGrants {

crates/lance-graph-rbac/src/auth.rs

@@ -84,13 +84,15 @@ impl AuthProvider {
             .find(|p| p.class_id() == id)
     }
 
-    /// As a full 32-bit `ClassId` (hi-`u16` core prefix `0x0000`, lo-`u16`
-    /// concept) — the form [`authorize`](crate::authorize::authorize) and the
-    /// `NodeGuid` classid take. Auth concepts are core (cross-app), so the
-    /// render prefix is `0x0000`.
+    /// As a full 32-bit `ClassId` under the core render lens (concept in the
+    /// CANON high `u16` since the 2026-07-02 half-order flip, prefix `0x0000`
+    /// in the custom low half) — the form
+    /// [`authorize`](crate::authorize::authorize) and the `NodeGuid` classid
+    /// take. Auth concepts are core (cross-app). Routed through the
+    /// contract's one flippable composition — never a local widening.
     #[must_use]
     pub fn classid(self) -> ClassId {
-        u32::from(self.class_id())
+        lance_graph_contract::render_classid(0x0000, self.class_id())
     }
 
     /// The claim-key grammar for this provider — which claim names carry the
@@ -204,8 +206,9 @@ mod tests {
         assert_eq!(AuthProvider::Zitadel.class_id(), 0x0B02);
         assert_eq!(AuthProvider::Zanzibar.class_id(), 0x0B03);
         assert_eq!(AuthProvider::OryKeto.class_id(), 0x0B04);
-        // Full classid is core-prefixed (hi u16 = 0x0000 — auth is cross-app).
-        assert_eq!(AuthProvider::Store.classid(), 0x0000_0B01);
+        // Full classid under the core lens: concept in the CANON high u16
+        // (post-flip form), custom prefix 0x0000 — auth is cross-app.
+        assert_eq!(AuthProvider::Store.classid(), 0x0B01_0000);
         // Round-trips.
         for p in [
             AuthProvider::Store,
@@ -244,7 +247,7 @@ mod tests {
         assert!(id.has_role("physician"));
         assert!(!id.has_role("admin"));
         assert_eq!(id.tenant.as_deref(), Some("clinic-7"));
-        assert_eq!(id.auth_classid(), 0x0000_0B02);
+        assert_eq!(id.auth_classid(), 0x0B02_0000);
     }
 
     #[test]