Merge pull request #365 from AdaWorldAPI/claude/lance-datafusion-integration-gv0BF

specs(sprint-5-6): 13-worker parallel batch + Opus meta review (governance only)

Author: AdaWorldAPI

.claude/board/AGENT_ORCHESTRATION_LOG.md

@@ -1045,3 +1045,29 @@ Test coverage is strong on the new behavior with two known dead-effect spots: tr
 - Wave 1: 4 agents, average 1.7x (2.0x median). Two silent overshoots (cert-officer 2.3x, spo-promote 2.0x). META-NUDGE-3 fired post-hoc.
 - Wave 2: 4 agents, average 2.4x (2.0x median, 3.7x outlier on context-id). META-NUDGE-3 bypassed by doc-density rationalization. META-NUDGE-5/6 fired pre-Wave-3.
 - Wave 3: 4 agents, average 1.7x BUT three of four under 1.5x (object-view 1.12x, cascade-cols 1.41x, probes 1.39x); the 4th (mysql-transcode 3.0x) hit a structural floor and was main-thread arbitrated. cascade-cols self-corrected from 1.87x to 1.41x via the BLOCKER-and-resolve protocol. **The trend reversed in Wave 3.**
+2026-05-13 W10 sprint-log-5-6: wrote .claude/specs/pr-g1-manifest-modules.md (~10 KB) — Pattern E manifest-modules spec with YAML format justification, build.rs algorithm, dependency-cycle fix (inventory::submit!), 6 initial module manifests, 5 tests, DELTA table vs compile-time-consumer-binding-v1.md §2.1.
+2026-05-13 W5 sprint-log-5-6 DONE: wrote .claude/specs/sprint-5-pr-graph.md (16285 bytes) — sprint-5 PR dep graph (#364+MR#112+SO#31+ndarray#142), retrospective (compressed 4-PR vs planned 11-PR), and sprint-6 handover (E1/E2/E3/F1/G1/G2 unblocked; E4/E5 blocked on new repo creation).
+2026-05-13 W3 sprint-log-5-6: wrote .claude/specs/pr-d4-family-hydration.md (16145 bytes) — FAMILY_TO_SUPER_DOMAIN TTL hydration spec; plans cited: super-domain-rbac-tenancy-v1.md §3.4/§8/§9.1; delta: TTL-over-TOML, OnceLock<Arc<RwLock<FamilyTableInner>>>, hot-reload opt-in, try_resolve() shim
+2026-05-13 W2 sprint-log-5-6: pr-d3b-jsonl-and-verify.md filed (27 KB) — JsonlAuditSink + CompositeSink + verify-jsonl/verify-lance/cross-verify CLI; owl_identity=hex, u64=decimal-strings, exit-codes 0/1/2/3; extends td-sdr-audit-persist.md; OQ-4 (u64 JSONL format) open.
+
+## 2026-05-13 — sprint-log-5-6 W6 (PR-E1 MedCare super-domain spec)
+
+W6 delivered `.claude/specs/pr-e1-medcare-super-domain.md` (~10 KB). Gap analysis from §14 super-domain-rbac-tenancy-v1.md vs MedCare-rs#112 substrate: 6 finalisation items (E1-1 through E1-6), ~900 LOC total, 35 tests. Hard dependency on W3 `pr-d4-family-hydration.md` (FAMILY_TO_SUPER_DOMAIN all-Unknown blocks E1-2/E1-4). 4 open questions captured (TTL namespace shape, SGB V/BMV-Ä mapping, researcher DP epsilon, Role vs RoleGroup dual-type). Delta classification: 2 items extend §13.8 D-SDRs (E1-4/E1-5), 2 extend in widened scope (E1-1/E1-3), 2 are new (E1-2/E1-6).
+2026-05-13 W11 sprint-log-5-6 DONE: .claude/specs/pr-g2-ractor-supervisor.md (555 lines, ~25 KB) — CallcenterSupervisor ractor actor tree spec; one-for-one supervision, typed ConsumerEnvelope, bounded mailboxes, lifecycle audit via SuperDomain::System, ractor 0.14, I-2 via clippy disallowed-types, 820 LOC estimate, DELTA vs compile-time-consumer-binding-v1 Pattern F + pr-f-1 sprint-3 spec.
+W12 | S6-W10 | 2026-05-13 | COMPLETE | .claude/specs/sprint-6-conformance-test.md (26 KB): 10 assertions A1-A10, generic harness assert_consumer_conformance<B: NamespaceBridge>, separate crate lance-graph-consumer-conformance, E1/E2/E3 active+blocking/E4/E5 #[ignore], CI slot after callcenter+ontology in rust-test.yml, DELTA vs foundry-consumer-parity-v1.md in §8.
+W9 | sprint-log-5-6 | S6-W7 | 2026-05-13 | DONE | .claude/specs/pr-f1-thinking-engine-wire.md (~316 LOC estimate, day-scale, CognitiveBridgeGate trait + PassthroughGate + UnifiedBridgeGate, 3 cross-tenant op categories, 5 BindSpace columns governed, new P-auth phase vs jc-pillars P0-P6)
+
+## 2026-05-13 — W7 (sprint-log-5-6) — PR-E2 smb-office retrofit spec COMPLETE
+
+**Agent:** W7 (claude-sonnet-4-6) | **Sprint:** S6-W3 | **Deliverable:** `.claude/specs/pr-e2-smb-retrofit.md`
+**Outcome:** Spec written (~11 KB, 12 sections). 5 bypass sites mapped; 3-batch incremental plan; audit emission table; 10 acceptance criteria. Blockers: §8.1 (WorkOrderBilling+Networking discriminants unassigned), §8.2 (smb.ttl absent), §8.3 (pr-d4-family-hydration spec not yet written). Batches A+B unblocked immediately.
+
+## W4 — 2026-05-13 — sprint-5-ci-matrix spec complete
+
+**Worker:** W4 (S5-W11) | **Spec:** `.claude/specs/sprint-5-ci-matrix.md` (21 KB, 12 sections) | **Status:** DONE. Defines 6 blocking gates (GG-1 to GG-6), feature matrix FC-1 to FC-CC, hardware R-HW-1 to R-HW-4 (ndarray#142 VBMI SIGILL mitigation), coverage floors per crate, audit-sink integration job, consumer-conformance gate aligned with W12 (GG-6, `--test-threads=1`). Delta: `rust-test.yml` adds 2 jobs + coverage flag; `build.yml` adds beta toolchain advisory entry. No new workflow files.
+
+## W1 / sprint-log-5-6 / 2026-05-13
+Agent W1 delivered `.claude/specs/pr-d3a-lance-audit-sink.md` (~27 KB, 515 lines): Arrow schema (12 columns, FixedSizeBinary(3) owl_identity aligned with W2 §1.5), super_domain x date partitioning with §13.4 hard-lock justification, LanceAuditSink write path (emit/flush/checkpoint + fsync contract), cross-verify alignment with W2's three verify subcommands, failure modes (partial write / partition skew / schema migration), LOC estimate ~550, and DELTA closing anatomy-realtime-v1.md §step-8 aspirational gap.
+2026-05-13 W8 sprint-log-5-6 S6-W4: wrote .claude/specs/pr-e3-woa-rs-extract.md (~950 LOC woa-rs 3-subcrate spec: woa-rbac/woa-realtime/woa-analytics, WorkOrderBilling super-domain, SOX §404 tests, UnifiedBridge<WoaBridge> wiring, migration path from smb-office-rs customer-woa-bin)
+2026-05-13 META AGENT (Opus 4.7) sprint-log-5-6 DONE: .claude/board/sprint-log-5-6/meta-review.md (~24 KB) — combined M1 per-worker + M2 cross-spec synthesis across 12 specs. Verdict 3A/7B/2C/0D/0F. Top contradictions: CC-2 AuthOp lifecycle (W11×W2), CC-3 SuperDomain::System (W11×W6/W12), CC-7 phf zero-dep (W10 internal). Top user OQs: W3 parser extension (pick c), W10 phf→sorted-slice, W6 RoleGroup migration. Sequencing: D3A+D3B combined; E1/E2/E3 separate; G1→G2 sequential; F1 standalone. Coverage gaps PR-D5/E4/E5/H5/HSM deferred to sprint-7+.
+W13 | 2026-05-13 | pr-ogit-ttl-smb-hydration.md | DONE | 35009 bytes | §E: (1) ogit.SMB.bson: sub-namespace, (2) per-property annotations via ogit:marking, (3) existing SemanticType variants | sequencing: after W7 Batch B

.claude/board/LATEST_STATE.md

@@ -2,7 +2,7 @@
 
 > **Auto-injected at session start via SessionStart hook.**
 > Updated after every merged PR.
-> **Last updated:** 2026-05-07 (PR #354 merged: governance close-out for #353; cross-repo coordinated landing complete with OGIT#2 + woa-rs#2 + MedCare-rs#109). Prior: 2026-05-07 (PR #353 merged). Prior: 2026-05-07 (PR #352 merged). Prior: 2026-05-06 (splat-osint-ingestion-v1 PR 1+2 of 6 in flight). Prior: 2026-04-21 post PR #243.
+> **Last updated:** 2026-05-13 (sprint-5 cross-repo landing complete: lance-graph PR #364 + MedCare-rs#112 + smb-office-rs#31 + ndarray#142 all merged the same day. lance-graph #364 ships D-SDR-3/4/5 + sprint-log-4 governance + sprint-5-9 roadmap + codex P1/P2 surgical fixes (OwlIdentity 3-byte canonical, UnifiedAuditEvent 26 bytes, OgitFamilyTable sparse `HashMap<u16, FamilyEntry>`, audit super_domain via AuditChain). MedCare-rs#112 (PR-B) wires `UnifiedBridge<MedcareBridge>` + medcare-rbac + medcare-realtime substrate (+2963 LOC, 17 files, §73 SGB V + BMV-Ä §57 + BtM regulatory tests). smb-office-rs#31 (PR-C) wires `UnifiedBridge<OgitBridge>` (+111 LOC). ndarray#142 ships VBMI gate for `permute_bytes` (P0 SIGILL fix on Skylake-X / Cascade Lake / Ice Lake-SP) + Inf clamp for `simd_exp_f32`. D-SDR-5 `UnifiedBridge` surface is now consumed end-to-end across MedCare + smb-office. Prior: 2026-05-07 (PR #354). Prior: 2026-05-07 (PR #353). Prior: 2026-05-07 (PR #352). Prior: 2026-05-06 (splat-osint-ingestion-v1 PR 1+2 of 6 in flight). Prior: 2026-04-21 post PR #243.
 >
 > Purpose: prevent new sessions from hallucinating structure that
 > already exists or proposing features already shipped. Read this
@@ -14,6 +14,7 @@
 
 | PR | Merged | Title | What it added |
 |---|---|---|---|
+| **#364** | 2026-05-13 | D-SDR-3/4/5 + sprint-log-4 governance + sprint 5-9 roadmap + codex P1/P2 | Tier-A substrate close: **D-SDR-3** OgitFamilyTable + FamilyEntry codebook (~300 LOC), **D-SDR-4** merkle-chained UnifiedAuditEvent (~460 LOC, AuditMerkleRoot = u64 FNV-1a), **D-SDR-5** authorize_* through Policy::evaluate with audit emission (~300 LOC). **Codex P1 fix** (`3208743`): OwlIdentity widened u8→u16 slot → 3-byte canonical `[family, slot_lo, slot_hi]`; OgitFamilyTable → sparse `HashMap<u16, FamilyEntry>`; UnifiedAuditEvent canonical_bytes 25→26. **Codex P2 fix** (`e23ce89`): emit_audit uses AuditChain.super_domain() instead of static FAMILY_TO_SUPER_DOMAIN. **CI fix** (`a3c753f`): ndarray/hpc-extras opt-in for blake3. Sprint-log-4 governance corpus (12 worker specs + 2 meta reviews) + sprint-5-through-9 roadmap (70 agents = 60W + 10M across 5 sprints, mandatory 12-step plan-read-order in worker prompts). 97/97 callcenter lib tests pass. All 5 CI checks green on `c8176cb`. Adjacent: ndarray#142 (VBMI gate + Inf clamp) merged same day. |
 | **#354** | 2026-05-07 | gov: #353 post-merge + cross-repo adjacent-landings | Pure governance close-out. PR_ARC entry for #353 + LATEST_STATE row. Documents the 5-PR coordinated landing across 4 repos: lance-graph #352/#353/#354 + OGIT #2 (woa+medcare bridges unblocked for OGIT-O(1)) + woa-rs #2 (cross-repo `--features ontology` integration) + MedCare-rs #109 (`?source=lance` exercising Zone 2 → Zone 3 rewriter chain). Locks: append-only board hygiene durability across 4 sequential prepends; cross-repo coordinated-landing recipe. |
 | **#353** | 2026-05-07 | plan: palantir-parity-cascade v2 + SoA DTO entropy ledger + #352 post-merge governance | Three artifacts. **v2 capstone** (262 lines): integrates 4 prior Foundry parity docs. Pillar 0 carry-forward: Foundry parity IS SoA-as-canon parity. Column H (PR #272 SHIPPED) is already the Foundry Object Type bridge. 15 D-PARITY-V2 deliverables. **SoA DTO entropy ledger** (210 lines, append-only knowledge): 22 DTOs classified across 4 tiers (sensor → engine → contract → callcenter). Buckets: 9 bare-metal / 7 SoA-glue / 6 bridge-projection (3 OPEN). `ResonanceDto` IS the SoA. Codec cascade columns all OPEN today. **#352 post-merge governance**: PR_ARC + LATEST_STATE updates. |
 | **#352** | 2026-05-07 | plan: lance-graph-ontology v5 + ogit-cascade v1 | Two-plan PR. **v5** (177 lines): 15 deliverables for ontology crate post-merge follow-on (D-1 dcterms:source, D-2 SpoBridge::promote_to_spo, D-9 ontology-aware MUL thresholds). 4 ratifications (smb-ontology export-only, D-9 above D-2, MulThresholdProfile in lance-graph-contract, OGIT-fork upstream non-PR). **v1 cascade** (209 lines): 15 D-CASCADE deliverables for SoA-as-canon + Zone 1/2/3 + BioPortal arsenal + bridge collapse. **Pillar 0**: OntologyRegistry IS the SoA, schema IS the DTO + name→row index. **Codec cascade per row** (target state, NOT YET WIRED — D-CASCADE-V1-7): identity Vsa16kF32 → CAM-PQ 6 B → Base17 34 B → palette key 4 B → Scent 1 B + qualia 18×f32 + meta 8 B + edge 8 B, every step O(1). |

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,44 @@
 
 ---
 
+## #364 — D-SDR-3/4/5 + sprint-log-4 governance + sprint 5-9 roadmap + codex P1/P2 fixes (merged 2026-05-13)
+
+**Confidence (2026-05-13):** merged clean, all 5 CI checks green on `c8176cb`. Codex review threads auto-marked Outdated by GitHub after the surgical fixes shipped pre-merge. **Status:** Merged to `main`. **Adjacent landings (2026-05-13):** MedCare-rs#112 (PR-B, UnifiedBridge<MedcareBridge> + medcare-rbac + medcare-realtime substrate, +2963 LOC across 17 files) and smb-office-rs#31 (PR-C, UnifiedBridge<OgitBridge> wiring, +111 LOC) both **merged** the same day, closing the sprint-5 cross-repo coordinated landing for D-SDR-5's `UnifiedBridge` surface. Substrate this PR shipped is now consumed end-to-end by both MedCare and smb-office.
+
+**Added:**
+- **D-SDR-3** (`2c3e87d`, ~300 LOC): `OgitFamilyTable` + `FamilyEntry` per-family codebook (inline label + schema + verbs per `super-domain-rbac-tenancy-v1.md §3.3`).
+- **D-SDR-4** (`1d0157f`, ~460 LOC): merkle-chained `UnifiedAuditEvent` log for `UnifiedBridge`. `AuditMerkleRoot = u64` FNV-1a.
+- **D-SDR-5** (`dc9e081`, ~300 LOC): wire `authorize_*` through `Policy::evaluate` chain with audit emission on every decision.
+- **Codex P1 surgical fix** (`3208743`): widen `OwlIdentity` slot u8 → u16. Layout becomes `{ family: u8, slot: u16 }` = 3 bytes on-wire. `OgitFamilyTable` migrates from `[Option<FamilyEntry>; 256]` to sparse `HashMap<u16, FamilyEntry>`. `UnifiedAuditEvent::canonical_bytes` grows 25 → 26 bytes (`owl` slice [13..16); op/decision/role_hash offsets shift by 1). New test `slot_keyspace_distinguishes_high_ids` locks the invariant. `to_canonical_bytes() -> [u8; 3]` replaces `raw()`.
+- **Codex P2 surgical fix** (`e23ce89`): `emit_audit` stamps `super_domain` from `self.audit_chain.super_domain()` instead of the all-`Unknown` static `FAMILY_TO_SUPER_DOMAIN` lookup.
+- **CI build fix** (`a3c753f`): enable `ndarray/hpc-extras` feature so `blake3` resolves in the workspace build.
+- **Sprint-log-4** governance corpus (~280 KB): 12 worker specs at `.claude/specs/`, 2 meta reviews at `.claude/board/sprint-log-4/meta-{1,2}-review.md`, sprint summary + per-worker scratchpads.
+- **Sprint-5-through-9 roadmap** at `.claude/plans/sprint-5-through-9-roadmap-v1.md` (70 agents = 60 workers + 10 meta across 5 sprints).
+- `Cargo.lock` updated post hpc-extras opt-in (`c8176cb`).
+
+**Locked:**
+- **OwlIdentity canonical wire form = 3 bytes** `[family, slot_lo, slot_hi]`. Any cross-language emitter (Rust / C#) MUST use `OwlIdentity::to_canonical_bytes()`. The old 2-byte packed `u16` layout is gone; no compat shim because no on-disk audit log exists outside test fixtures at this commit.
+- **`UnifiedAuditEvent::canonical_bytes` is 26 bytes**, owl at `[13..16)`. Wire-format breaking for any persisted audit log.
+- **`OgitFamilyTable` is sparse** (`HashMap<u16, FamilyEntry>`); the "256-slot dense array" framing in prior doc comments is replaced by "sparse map".
+- **Audit events take super_domain from the configured `AuditChain.super_domain()`**, not from a static family→domain table. `FAMILY_TO_SUPER_DOMAIN`'s purpose narrows to a fallback / future hydration mechanism.
+- **Sprint-5+ worker prompts have a mandatory 12-step `.claude/plans/` read-order** as hard precondition (per sprint-4 retrospective: worker specs duplicated existing plan corpus when read-order was advisory).
+
+**Deferred:**
+- TTL namespaces, full compliance certification, federation Phase 2, drift bridge LanceProbe M5/M6 — owned by sprints 6/8 per roadmap.
+- **PR-B medcare-rs UnifiedBridge wiring**: commits exist locally on `claude/lance-datafusion-integration-gv0BF` in `MedCare-rs` repo (already pushed to remote integration branch, no PR opened yet).
+- **PR-C smb-office-rs UnifiedBridge wiring**: same shape, commits already on remote integration branch in `smb-office-rs`, no PR opened yet.
+- **Per-namespace u8 slot allocation in `RegistryState::append`**: declined this session — widening to u16 carrier in `3208743` is the chosen fix path. Per-namespace allocation would require widening `BindSpace.entity_type` from bare u16 to carry `(namespace_id, entity_type_id)` and rewriting `enumerate_first_with_entity_type_id` (currently relies on global uniqueness, breaks silently under per-namespace allocation — two known callers in `cascade_cols_test.rs:80` + `cognitive-shader-driver/src/driver.rs:312`). Tracked in TECH_DEBT.
+
+**Docs:**
+- `.claude/plans/sprint-5-through-9-roadmap-v1.md` (the 60-worker + 10-meta map).
+- `.claude/board/sprint-log-4/` (full sprint corpus).
+- `.claude/specs/` (12 PR-scoped specs for sprint-5 deliverables).
+- `EPIPHANIES.md` 2026-05-13 entries (sprint-4 duplication-audit, 14+ FINDING/CORRECTION/CONJECTURE entries on OGIT axes, super-domain subcrates, API drift, FMA convergence).
+
+**Correction (2026-05-13):** Sprint-4 specs partially duplicated existing `.claude/plans/` content despite the advisory read-order — see EPIPHANIES 2026-05-13 duplication-audit. Sprint-5+ enforces the read-order as a hard precondition in the worker-prompt template.
+
+---
+
 ## #354 — gov: #353 post-merge + adjacent-landings (#109, OGIT#2, woa-rs#2) (merged 2026-05-07)
 
 **Confidence (2026-05-07):** governance-only PR, no plan / knowledge / code changes. Append-only board hygiene confirmed working — merged cleanly, no past entries edited. **Status:** Merged to `main` as `a6797ad`.

.claude/board/sprint-log-5-6/SPRINT_LOG.md

@@ -0,0 +1,24 @@
+# sprint-log-5-6 — parallel sprint-5 spec close-out + sprint-6 spec kick-off
+
+> **Started:** 2026-05-13 | **Branch:** claude/lance-datafusion-integration-gv0BF
+> **Substrate shipped:** lance-graph #364 + MedCare-rs#112 + smb-office-rs#31 + ndarray#142 (all 2026-05-13)
+> **Worker fleet:** 12 Sonnet workers + 1 Opus meta. CCA2A: each worker tee -a's to .claude/board/sprint-log-5-6/agents/agent-W{N}.md and prepends to .claude/board/AGENT_ORCHESTRATION_LOG.md.
+> **Spec output:** 1 file per worker under .claude/specs/.
+> **Scope:** sprint-5 W7-W12 (specs only, substrate already shipped pre-merge) + sprint-6 W2-W4, W7-W10 (Tier-2 wiring specs).
+
+| W | Sprint | Spec | Status |
+|---|---|---|---|
+| 1 | S5-W7 | .claude/specs/pr-d3a-lance-audit-sink.md | pending |
+| 2 | S5-W8 | .claude/specs/pr-d3b-jsonl-and-verify.md | pending |
+| 3 | S5-W9 | .claude/specs/pr-d4-family-hydration.md | pending |
+| 4 | S5-W11 | .claude/specs/sprint-5-ci-matrix.md | pending |
+| 5 | S5-W12 | .claude/specs/sprint-5-pr-graph.md | pending |
+| 6 | S6-W2 | .claude/specs/pr-e1-medcare-super-domain.md | pending |
+| 7 | S6-W3 | .claude/specs/pr-e2-smb-retrofit.md | pending |
+| 8 | S6-W4 | .claude/specs/pr-e3-woa-rs-extract.md | pending |
+| 9 | S6-W7 | .claude/specs/pr-f1-thinking-engine-wire.md | pending |
+| 10 | S6-W8 | .claude/specs/pr-g1-manifest-modules.md | pending |
+| 11 | S6-W9 | .claude/specs/pr-g2-ractor-supervisor.md | pending |
+| 12 | S6-W10 | .claude/specs/sprint-6-conformance-test.md | pending |
+| M | both | .claude/board/sprint-log-5-6/meta-review.md | pending (post-workers) |
+

.claude/board/sprint-log-5-6/agents/.gitkeep

@@ -0,0 +1,25 @@
+# agent-META — sprint-log-5-6 scratchpad
+
+## 2026-05-13 — META AGENT (Opus 4.7) DONE
+
+**Deliverable:** `.claude/board/sprint-log-5-6/meta-review.md` (~24 KB)
+
+**Reviewed:** 12 worker specs (W1-W12) in `.claude/specs/`.
+
+**Verdict:** 3 A-grade (W2, W5, W12) / 7 B-grade (W1, W3, W4, W6, W7, W8, W9) / 2 C-grade (W10, W11). No D or F.
+
+**Top 3 cross-spec contradictions identified:**
+1. CC-2: W11 extends `AuthOp` with lifecycle variants; W2 verify CLI decodes 0..2 only. Recommendation: separate `LifecycleAuditEvent` type.
+2. CC-3: W11 introduces `SuperDomain::System`; W6/W12 don't anticipate it (hard-lock matrix, conformance fixtures).
+3. CC-7: W10 zero-dep invariant internal contradiction (phf in §3.4/§4.3 vs sorted-slice recommendation in OQ-1).
+
+**Top 5 user-decision-required OQs:**
+- W3 OQ-1 parser extension boundary (pick option c)
+- W10 phf vs sorted slice (lock zero-dep invariant)
+- W6 OQ-4 RoleGroup migration vs bridge
+- CC-2 AuthOp lifecycle scope
+- CC-3 SuperDomain::System hard-lock exemption
+
+**Sequencing:** D3A+D3B combined; E1+E2+E3 separate; G1+G2 separate; F1 standalone after W3+W11.
+
+**Coverage gaps:** PR-D5 compat shim, PR-E4/E5 scaffolds, PR-H5 SIMD retrofit, HSM salt rotation — all defer to sprint-7+.