feat(contract): ClassView::compute_dag + ComputeEdge + acyclic gate (probe Inc 0)

Inc 0 of probe-excel-compute-dag-v1 — lands the one named Core gap
(ClassView::compute_dag), the recompute-dispatch home every computed-field
AR consumer needs (Odoo @api.depends / medcare / woa / q2, all reduce to a
sheet) and the NNUE-incremental existence-proof shape.

- ComputeEdge {target: u8, inputs: &'static [u8]}: harvest-sourced recompute
  edge (emitted_by target <- depends_on inputs), const-constructible like
  MethodSig/ActionDef. Field positions index the class FieldMask.
- ClassView::compute_dag(class) -> &[ComputeEdge]: default &[] (zero-fallback);
  layout-preserving default-method (mirrors value_schema), stores nothing on
  the row, zero NODE_ROW_STRIDE/ENVELOPE_LAYOUT_VERSION impact.
- compute_dag_is_acyclic: the registry-build gate -- a cyclic recompute DAG
  (formula loop / @api.depends cycle / self-loop) is rejected at build (Kahn
  over <=64 positions, allocation-free; out-of-range ignored, no panic).

+4 tests (default-empty, acyclic-chain, 2/self/3-cycle rejected, out-of-range
ignored); 10/10 class_view; clippy -D warnings + fmt clean. Board:
LATEST_STATE Contract Inventory prepended.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CcpLeEC3XK8Eye53GKBVvi

Author: claude

.claude/board/LATEST_STATE.md

@@ -89,6 +89,8 @@
 
 ## Current Contract Inventory (lance-graph-contract)
 
+> **2026-06-18 — ADDED (probe-excel-compute-dag-v1 Inc 0, the `compute_dag` Core gap)**: `lance_graph_contract::class_view::{ComputeEdge, compute_dag_is_acyclic}` + `ClassView::compute_dag(class) -> &[ComputeEdge]` (default `&[]`, zero-fallback). `ComputeEdge {target: u8, inputs: &'static [u8]}` is the harvest-sourced recompute edge (`emitted_by` target ← `depends_on` inputs; field positions index the class `FieldMask`), `const`-constructible like `MethodSig`/`ActionDef` (the harvest IS the manifest). `compute_dag_is_acyclic` is the **registry-build gate** — a cyclic recompute DAG (formula loop / `@api.depends` cycle / self-loop) is rejected at build (Kahn over ≤64 positions, allocation-free; out-of-range positions ignored, no panic, mirrors `FieldMask::from_positions`). This is the Core home for computed-field recompute *dispatch* that EVERY computed-field AR consumer needs (Odoo `@api.depends`, Excel formulas, medcare lab-trends, woa calc, q2 cells — they reduce to a sheet; `E-EXCEL-SHADER-PROJECTION`) and the NNUE-incremental existence-proof shape (`E-CHESS-TENSOR-PROVEN`). **Layout-preserving**: a default trait method + a free fn, resolution metadata ABOVE the SoA, stores nothing on the row, zero `NODE_ROW_STRIDE`/`ENVELOPE_LAYOUT_VERSION` impact (core-gap-auditor's EXTEND-CORE, never an adapter-state hack). The instance recompute that consumes it is gated per-cell by the cycle-aware `write_row` (`E-SOA-CYCLE-OWNERSHIP`). Additive, zero-dep; +4 tests (default-empty, acyclic-chain, cycle/self-loop/3-cycle rejected, out-of-range ignored); 10/10 class_view, clippy/fmt clean. Sibling `ClassView::constraints` (`validation_kind`-sourced) deferred to Inc-follow-up. Plan: `.claude/plans/probe-excel-compute-dag-v1.md`. Branch `claude/particle-wave-click-epiphany`.
+
 > **2026-06-18 — ADDED (D-DO-ARM-1, the OGAR DO arm)**: `lance_graph_contract::action::{ActionState, StateGuard, ActionDef, ClassActions, actions_for, effective_actions, ActionInvocation}` — the Perdurant DO arm completing the OGAR IR (the action-axis sibling of `codegen_manifest`'s `MethodSig`/THINK). Both the 4-agent `sale_order` AR→DO probe (runtime-archaeologist) AND the merged cross-repo PR survey (ruff/OGAR/lance-graph/openproject/tesseract) agreed this was the ONE missing wire: the THINK arm (`classid → ClassView`, `has_function → MethodSig`) is converged + merged; the DO-arm `ActionInvocation`/`ActionDef` type was ABSENT. **`ActionDef`** (static, `const`-constructible, all `&'static`/`Copy`): `predicate` (= harvested `has_function` method), `object_class` (classid), `exec` (`ExecTarget` incl `SurrealQl`), `guard` (`StateGuard` = KausalSpec field==value), `required_role` (RBAC), `overrides` (OGAR `classid→ClassView` inheritance). **`ClassActions`+`actions_for`** (zero-fallback) mirror `ClassMethods`/`methods_for`. **`effective_actions(parent, child)`** = OGAR inheritance on the action axis (child overrides parent by predicate). **`ActionInvocation`** (dynamic, `Copy`): lifecycle `ActionState{Pending→Committed|Failed|Cancelled}` (sticky terminals), S2.5 `cycle` stamp, idempotency/trace keys, HLC `emitted_at_millis`. **`ActionInvocation::commit(def, actor, impact, now)`** is the gated egress — RBAC FIRST (`auth::ActorContext` must hold `required_role` or be admin → else `Failed`), THEN MUL impact (`mul::GateDecision`: `Flow→Committed`+stamped, `Hold→`Pending/escalate, `Block→Cancelled`). This IS "commit to the external consumer (odoo/openproject/woa/tesseract) after the cycle decides sound." Dispatched via `UnifiedStep`/`ExecTarget`, NOT a per-crate endpoint. Additive, zero-dep. +5 tests green. Consumer reference: `docs/OGAR_CONSUMER_API.md`. Branch `claude/soa-write-deinterlace-inc2`.
 
 > **2026-06-18 — ADDED (D-UNICHARSET-KEYSTONE, classid → ClassView → adapter wiring)**: `lance_graph_contract::unicharset_adapter::{UniCharSetStore, UniCharCall, UniCharOut, DispatchError, invoke_unicharset}` — steps 2–3 of `PROBE-OGAR-ADAPTER-UNICHARSET`, the keystone composing the proven `UniCharSet` adapter through the OGAR Core's three movable parts. `invoke_unicharset(registry, store, classid, call)`: (1) **ClassView composition gate** — `codegen_manifest::methods_for(registry, classid)` must list the call's method (the harvested `has_function` manifest), else `MethodNotComposed` (zero-fallback: an unconfigured classid composes nothing); (2) **content-store tier** — `UniCharSetStore::unicharset(classid)`, a consumer-provided trait (dependency-inverted like `ClassView`/`PlannerContract`; the adapter holds NO state — `I-VSA-IDENTITIES`); (3) **adapter leaf** — routes to `UniCharSet::{id_to_unichar, unichar_to_id}`. DO-in (`UniCharCall`) / DO-out (`UniCharOut`, zero-copy borrow). **Byte-parity inherited** from `UniCharSet` (112/112); the keystone proves the dispatch path is faithful (the `NULL`→space edge survives it), the gate works, and there is **no Core gap** (the doctrine's iron guard holds — the variable-length bijection rides the content tier cleanly). NOT routed through the heavy `OrchestrationBridge` (cross-subsystem router); this is the adapter-invocation primitive a `UnifiedStep` calls. Additive, zero-dep. +5 tests; clippy `--all-targets -D warnings` + fmt clean. Completes the core-first doctrine END-TO-END for the unicharset leaf (`E-CPP-KEYSTONE-1`).

crates/lance-graph-contract/src/class_view.rs

@@ -138,6 +138,79 @@ impl FieldMask {
     }
 }
 
+/// One recompute edge in a class's **compute DAG**: field position `target` is
+/// (re)computed from the field positions in `inputs`.
+///
+/// Harvest-sourced — `target` is the `emitted_by` field, `inputs` are its
+/// `depends_on` precedents (Odoo `@api.depends`, an Excel formula's referenced
+/// cells, a chess-eval feature's inputs). All fields are `&'static` so a
+/// generated `const DAG: &[ComputeEdge] = &[..]` compiles (the harvest IS the
+/// manifest — mirrors [`crate::codegen_manifest::MethodSig`] /
+/// [`crate::action::ActionDef`]). Positions index the class's [`FieldMask`]
+/// (0..[`FieldMask::MAX_FIELDS`]), matching [`ClassView::fields`].
+///
+/// This is the Core home for recompute *dispatch* (`E-EXCEL-SHADER-PROJECTION` /
+/// `probe-excel-compute-dag-v1`): the manifest lives ABOVE the SoA (resolution
+/// metadata, stores nothing on the row); no adapter carries its own `@api.depends`
+/// table (`core-first-transcode-doctrine` — that would be the Adapter-State-Leak).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ComputeEdge {
+    /// Field position this edge recomputes (the `emitted_by` target).
+    pub target: u8,
+    /// Field positions this target reads (its `depends_on` precedents).
+    pub inputs: &'static [u8],
+}
+
+/// Whether a class's `compute_dag` is **acyclic** — the registry-build gate.
+///
+/// A cyclic recompute DAG (a formula loop `A=B+1, B=A+1`, or a `@api.depends`
+/// cycle) MUST be rejected at registry-build: it has no topological order and
+/// would never converge. Returns `false` on any cycle (incl. a self-loop
+/// `target ∈ inputs`). Considers only positions `< FieldMask::MAX_FIELDS`;
+/// out-of-range targets/inputs are ignored (no panic, mirrors
+/// [`FieldMask::from_positions`]). Allocation-free (≤ 64 positions).
+#[must_use]
+pub fn compute_dag_is_acyclic(edges: &[ComputeEdge]) -> bool {
+    const N: usize = FieldMask::MAX_FIELDS as usize; // 64
+                                                     // deps[t] = bitmask of in-range positions that target `t` depends on.
+    let mut deps = [0u64; N];
+    let mut is_target = 0u64;
+    for e in edges {
+        if (e.target as usize) >= N {
+            continue;
+        }
+        is_target |= 1u64 << e.target;
+        for &inp in e.inputs {
+            if (inp as usize) < N {
+                deps[e.target as usize] |= 1u64 << inp;
+            }
+        }
+    }
+    // Kahn: leaves (non-targets) are resolved; peel any target whose deps are all
+    // resolved. If a round makes no progress with targets remaining → cycle.
+    let mut resolved = !is_target;
+    let mut remaining = is_target;
+    loop {
+        if remaining == 0 {
+            return true;
+        }
+        let mut progressed = false;
+        let mut r = remaining;
+        while r != 0 {
+            let t = r.trailing_zeros();
+            r &= r - 1;
+            if deps[t as usize] & !resolved == 0 {
+                resolved |= 1u64 << t;
+                remaining &= !(1u64 << t);
+                progressed = true;
+            }
+        }
+        if !progressed {
+            return false; // stuck with targets remaining → cycle
+        }
+    }
+}
+
 /// The class as a **meta lookup that flies above the SoA** — the resolver trait.
 ///
 /// An implementor (in `lance-graph-ontology`, over the OGIT cache) is the
@@ -246,6 +319,24 @@ pub trait ClassView {
         // signed / fingerprint / …), it adds no new property.
         crate::canonical_node::ValueSchema::Full
     }
+
+    /// The class's **recompute DAG** — the topological manifest of which fields
+    /// recompute from which (the `emitted_by` + `depends_on` harvest), the Core
+    /// home for computed-field dispatch (Odoo `@api.depends`, Excel formulas,
+    /// chess-eval features; `probe-excel-compute-dag-v1`).
+    ///
+    /// Default `&[]` — the zero-fallback: an unconfigured class has no computed
+    /// fields (mirrors `compute_dag`'s no-panic siblings). An implementor returns
+    /// a generated `const &[ComputeEdge]`; the registry MUST validate it with
+    /// [`compute_dag_is_acyclic`] at build (a cyclic DAG is rejected, never
+    /// recomputed). Layout-preserving: resolution metadata above the SoA, stores
+    /// nothing on the row, never a `NODE_ROW_STRIDE`/`ENVELOPE_LAYOUT_VERSION`
+    /// change. The instance recompute that consumes this is gated per-cell by the
+    /// cycle-aware `write_row` (`E-SOA-CYCLE-OWNERSHIP`).
+    #[inline]
+    fn compute_dag(&self, _class: ClassId) -> &[ComputeEdge] {
+        &[]
+    }
 }
 
 /// One populated field to render — the late-resolved `label` + its `predicate` key.
@@ -319,6 +410,99 @@ mod tests {
         }
     }
 
+    // ── compute_dag (probe-excel-compute-dag-v1, Inc 0) ──────────────────────
+
+    /// Default `compute_dag` is the zero-fallback empty manifest (no computed
+    /// fields for an unconfigured class).
+    #[test]
+    fn compute_dag_default_is_empty() {
+        let c = FakeClasses { invoice: vec![] };
+        assert!(c.compute_dag(7).is_empty());
+        assert!(c.compute_dag(0).is_empty());
+    }
+
+    /// `const`-constructible manifest — the exact shape a generated
+    /// `const DAG: &[ComputeEdge]` emits (a chain: f2 = g(f1), f1 = h(f0)).
+    const SAMPLE_DAG: &[ComputeEdge] = &[
+        ComputeEdge {
+            target: 1,
+            inputs: &[0],
+        },
+        ComputeEdge {
+            target: 2,
+            inputs: &[1],
+        },
+    ];
+
+    #[test]
+    fn compute_dag_acyclic_chain_passes() {
+        assert!(
+            compute_dag_is_acyclic(SAMPLE_DAG),
+            "a dependency chain f0→f1→f2 is acyclic"
+        );
+        assert!(compute_dag_is_acyclic(&[]), "empty dag is acyclic");
+        // a target reading a non-computed leaf is fine
+        assert!(compute_dag_is_acyclic(&[ComputeEdge {
+            target: 5,
+            inputs: &[3, 4]
+        }]));
+    }
+
+    #[test]
+    fn compute_dag_cycle_is_rejected() {
+        // f0 = g(f1), f1 = h(f0) — a 2-cycle, no topological order.
+        let two_cycle = &[
+            ComputeEdge {
+                target: 0,
+                inputs: &[1],
+            },
+            ComputeEdge {
+                target: 1,
+                inputs: &[0],
+            },
+        ];
+        assert!(
+            !compute_dag_is_acyclic(two_cycle),
+            "a formula loop must be rejected at registry-build"
+        );
+        // self-loop f0 = g(f0)
+        assert!(!compute_dag_is_acyclic(&[ComputeEdge {
+            target: 0,
+            inputs: &[0]
+        }]));
+        // 3-cycle f0→f1→f2→f0
+        assert!(!compute_dag_is_acyclic(&[
+            ComputeEdge {
+                target: 1,
+                inputs: &[0]
+            },
+            ComputeEdge {
+                target: 2,
+                inputs: &[1]
+            },
+            ComputeEdge {
+                target: 0,
+                inputs: &[2]
+            },
+        ]));
+    }
+
+    #[test]
+    fn compute_dag_out_of_range_positions_ignored() {
+        // target/inputs >= MAX_FIELDS (64) are ignored, never folded → no panic,
+        // no false cycle (mirrors FieldMask::from_positions).
+        assert!(compute_dag_is_acyclic(&[
+            ComputeEdge {
+                target: 64,
+                inputs: &[0]
+            }, // ignored target
+            ComputeEdge {
+                target: 5,
+                inputs: &[200]
+            }, // input ignored → leaf-only target
+        ]));
+    }
+
     #[test]
     fn field_mask_is_presence_bits() {
         let m = FieldMask::from_positions(&[0, 2]); // amount + partner populated, tax absent