Merge pull request #627 from AdaWorldAPI/claude/v3-substrate-migration-review-o0yoxv

Classid canon:custom flip TRIGGERED — migration plan v1, operator ruling recorded, q2 gate waived, osint issues resolved

Author: AdaWorldAPI

.claude/board/EPIPHANIES.md

@@ -1,3 +1,35 @@
+## 2026-07-02 — E-CLASSID-CANON-HIGH-TRIGGERED — the operator pulled the flip trigger: canon (domain:appid) moves to the HIGH half, `0x1000` was a temporary reminder, OSINT low byte = appid space, q2 gate waived
+
+**Status:** DOCTRINE (operator ruling, verbatim anchors in the plan §0).
+
+**Four rulings in one message arc (2026-07-02):**
+1. **OSINT semantics:** "OSINT Person was a hallucination." `0x07` = OSINT
+   domain; low byte applied **domain-wise as APPID** (`00` = the domain
+   itself; `01` = **q2, our consumer**). OSINT contributes ZERO vocabulary
+   rows — OGAR PR #146 removed both #145 mints (count 67→65; the COUNT_FUSE
+   balances with zero mirror changes; `ISS-OSINT-SYSTEM-ROOT-SLOT-VIOLATION`
+   dissolves — sharper than either of its recorded Options A/B). FMA anatomy
+   = own domain (`0x0A`, separate from Health `0x09`) under q2; CPIC = own
+   Genetics domain (`0x0E`) under q2 (⇒ its q2 class normalizes `:00`→`:01`).
+2. **The marker was temporary:** `0x1000` was "just a temporary V3 substrate
+   marker as a hard reminder for V3 substrate migration" — a sticky note,
+   not a format bit. Retirement is a planned operator checkpoint (plan §4 P4).
+3. **The flip is TRIGGERED:** "now is the right time for the migration."
+   Target stored form `0x0701_1000` — canon (`domain:appid`) HIGH, custom
+   (marker/render) LOW; human-readable `0x07:01::1000`. This IS the
+   `soa-value-tenant-migration-v2` §2.3 atomic Canon:Custom flip, now ACTIVE
+   as `.claude/plans/classid-canon-custom-flip-v1.md` (one flippable
+   compose/split definition, `flip(flip(x))==x` probed, mint-forward with an
+   I-LEGACY version boundary — never a blanket reinterpretation of legacy
+   classids). `E-CLASSID-HUMANREADABLE-REORDER-DEFERRED` is hereby
+   superseded-by-trigger (entry preserved, per append-only).
+4. **q2 push gate WAIVED:** "it was a temporary precaution to not break the
+   cockpit while working on so many different domains — you can unarm that."
+   D-VCW-3 (P7 render probe), D-VCW-5 (cascade3 nibble falsifier), and the
+   q2 phases of the flip (P3) are unblocked.
+
+---
+
 ## 2026-07-01 — E-RUNG-LADDER-IS-DISPATCH-POLICY-OVER-CERTIFIED-MASKS — rung elevation needs zero new math; and there is ONE ladder with TWO signal sources (gate streaks + felt-parse delta)
 
 **Status:** FINDING (shipped: `RungLevel::{from_u8, elevate, de_elevate,

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,7 @@
+## 2026-07-02 — classid-canon-custom-flip (TRIGGERED — the §2.3 atomic flip is live)
+
+Plan: `.claude/plans/classid-canon-custom-flip-v1.md`. **Operator pulled the trigger** ("now is the right time for the migration — document it accordingly"): canon (`domain:appid`) moves to the classid's HIGH u16, custom (the temporary `0x1000` V3 marker, later the render/dynamic-classview space) to the LOW — stored `0x0701_1000`, human-readable `0x07:01::1000`. Grounded in the same ruling: OSINT low byte = APPID space domain-wise (q2=`0x01`; zero vocabulary rows — OGAR PR #146), FMA/CPIC own domains under q2 (CPIC normalizes `:00`→`:01`), q2 push gate WAIVED. Mechanism: ONE flippable `compose_classid/split_classid/CLASSID_CANON_HIGH` in the contract (per `E-CLASSID-SPLIT-ORDER-IS-A-FLIP`), `flip(flip(x))==x` probed, **mint-forward with an I-LEGACY version boundary** (legacy `0x0000_XXXX` classids never blanket-reinterpreted). Phases: P0 route-through (zero behavior) → P1 flip+coexist → P2 OGAR#95 hi-u16 app-prefix reconciliation (operator checkpoint) → P3 q2 re-mints (dissolves `ISS-Q2-CPIC-MIRROR…`) → P4 `0x1000` retirement (operator checkpoint). Supersedes-by-trigger `E-CLASSID-HUMANREADABLE-REORDER-DEFERRED`; executes `soa-value-tenant-migration-v2` §2.3. ACTIVE.
+
 ## 2026-07-01 — v3-convergence-wiring (wire, don't invent — every layer already contains its own solution)
 
 Plan: `.claude/plans/v3-convergence-wiring-v1.md`. **Operator all-in ("I'm all in for your ideas — document and PR so other sessions converge"); model split Sonnet-grindwork/Fable-decisions.** The organizing finding (`E-V3-TENANTS-ALREADY-EXIST-WIRE-DONT-INVENT`): the V3 substrate's gaps are unwired seams, not missing machinery — every deliverable is a probe or a wiring of EXISTING types, §0 anti-invention throughout. **Seam list:** D1a `RungLevel::{from_u8,elevate,de_elevate,pearl_level,causal_mask_bits}` + `RungElevator` (zero-dep "elevates on sustained BLOCK" as a pure policy over `GateDecision` + the P2/P3-certified mask algebra; converged with `escalation::rung_delta` via `apply_delta` — one ladder, two signal sources: gate streaks = System-2, felt-parse = System-1) — SHIPPED; D1b driver wiring (replace `ctx.rung = 1` proxy, dedup wire/grpc u8→rung matches) — Sonnet in flight; D2 P6 wave-convergence probe (markov_soa's injected distance = the SAME certified 256×256 palette read as P1–P3; the table is the join object) — SHIPPED (2 tests, 6/6 module green); D3 P7 render probe spec (ClassView bitmask → askama; rendered fields == masked tenants; q2-side, push-gated, spec ready §3); D4 one-row registry (codebook row seeds `{tail, value_schema, edge_codec, bitmask, template}`; read-mode parity fuse sibling of COUNT_FUSE; Phase B gated on operator + osint decision); D5 nibble-hierarchy falsifier (FNV `cascade3` bytes have no nibble ancestry → HHTL on bake mints is tier-granular; `ISS-Q2-CASCADE3-NIBBLE-ANCESTRY`); D6 negative-existence-claims worker rule (knowledge doc Rule 7) — SHIPPED; D7 rig/rs-graph-llm FailureTicket loop — deferred frontier (first place determinism ends). **Doctrine (no code):** the two SoA worlds stay two — Lance columnar I/O is the reconciler; consumers write against per-row accessors; column borrows are the owner's privilege. ACTIVE.

.claude/board/ISSUES.md

@@ -2,7 +2,7 @@
 
 ## 2026-07-01 — ISS-Q2-CASCADE3-NIBBLE-ANCESTRY — q2 `cascade3` FNV bytes are byte-hierarchical but NOT nibble-hierarchical; HHTL routing over bake mints is sound only at whole-tier granularity
 
-**Status:** OPEN (falsifier specified, not yet run — q2 is push-gated). Owner:
+**Status:** OPEN (falsifier specified, not yet run — q2 push gate WAIVED 2026-07-02, "temporary precaution … you can unarm that"; runnable now, D-VCW-5). Owner:
 q2 `cpic/src/lib.rs::cascade3` (+ any bake reusing it) vs the OGAR canon's
 256=4⁴ hierarchical-codebook condition. Plan: `v3-convergence-wiring-v1.md` §5.
 
@@ -26,8 +26,7 @@ assume sub-byte ancestry on these mints until this runs.
 
 ## 2026-07-01 — ISS-Q2-CPIC-MIRROR-DIVERGES-FROM-CPIC-V3-REGISTRY — q2's local `cpic::NodeGuid` mirror is V1-layout-parity-true but diverges from the registered CPIC-V3 read-mode on BOTH domain and tail shape
 
-**Status:** OPEN (record-only; resolve WITH the operator — q2 is push-gated and
-cross-repo blockers are never silently fixed). Owner: q2 `cpic/src/lib.rs` +
+**Status:** RESOLUTION RULED 2026-07-02 (execution queued as flip P3 / D-CCF-3) — the operator ruling ("Same for cpic also under q2, which has a different domain for separation") + the triggered canon:custom flip settle this as shape (a) below, with the target classid updated by the flip: q2's CPIC class = Genetics:q2 = `0x0E:01::…` (post-flip stored `0x0E01_1000`; the pre-flip root `0x1000_0E00` normalizes `:00`→`:01`). q2 push gate WAIVED. cpic re-mints by PULLING the contract (`mint_for(classid_read_mode(…).tail_variant, …)`), retiring the local mirror + the `0x0C` domain. See `classid-canon-custom-flip-v1.md` §2/§4. Owner: q2 `cpic/src/lib.rs` +
 `lance-graph-contract::canonical_node` (CPIC-V3 registry). Surfaced 2026-07-01
 by a verify-the-mirror read after the V3 tenant-carve certification.
 
@@ -80,7 +79,7 @@ declared registry-exempt (bake-only) and its parity comment is scoped to
 
 ## 2026-07-01 — ISS-OSINT-SYSTEM-ROOT-SLOT-VIOLATION — OGAR shipped `osint_system` at the reserved `0x0700` root slot; the lance-graph mirror canon forbids it (`CC==0x00` = domain root, reserved) — the parallel-mirror is BLOCKED on a remap decision
 
-**Status:** OPEN · **BLOCKS `ISS-OGAR-OSINT-MIRROR-PENDING`.** Owner: OGAR `ogar-vocab` (merged, needs follow-up) + `lance-graph-contract::ogar_codebook` mirror + q2 `osint_classview`. Surfaced 2026-07-01 when the merged OGAR #145 + lance-graph #624 met and I ran `cargo test -p lance-graph-contract`.
+**Status:** RESOLVED 2026-07-02 (operator ruling, executed in OGAR PR #146) — and the resolution is SHARPER than either recorded option: "OSINT Person was a hallucination"; within the OSINT domain the low byte is APPID space applied domain-wise (`00` = the domain itself, `01` = q2 the consumer), so OSINT contributes **zero vocabulary rows**. OGAR #146 removed BOTH #145 mints (`osint_system@0x0700` AND `osint_person@0x0701`); count 67 → 65 == the mirror's 65 — the COUNT_FUSE balances with ZERO mirror-side changes, and the zero-slot invariant is untouched. Options A and B below are preserved as history; neither was taken (B came closest — its addendum's two-id-spaces reading is confirmed, but even the `0x0701` "concept" was a mislabel on q2's appid slot). See `E-CLASSID-CANON-HIGH-TRIGGERED` + `.claude/plans/classid-canon-custom-flip-v1.md` §0 for the full ruling (which also triggers the canon:custom flip).
 
 **The violation.** The shared codebook canon (documented in `ogar_codebook.rs` module header: *"`CC == 0x00` = the domain root, reserved"*) requires every concept id `0xDDCC` to have `CC ≥ 0x01`; `0x__00` is the domain-root/default, NOT a concrete concept. OGAR main ships **`("osint_system", 0x0700)`** — `CC == 0x00`, the reserved root. `("osint_person", 0x0701)` is valid (`CC==01`, operator-frozen). The lance-graph mirror enforces the canon via the workspace-member test `codebook_has_no_duplicate_ids_or_zero_concept_slot` (`assert_ne!(id & 0x00FF, 0x00)`), so **mirroring `0x0700` fails lance-graph's own default CI** (748 pass, 1 fail). The `COUNT_FUSE` (in the *excluded* `lance-graph-ogar`) is a separate, downstream break; this one is in-tree.
 
@@ -109,7 +108,7 @@ Option B resolves it without deleting the idea or moving any id.
 
 ## 2026-07-01 — ISS-OGAR-OSINT-MIRROR-PENDING — OGAR #145's OSINT mint (+2 to `class_ids::ALL`) breaks the contract-mirror `COUNT_FUSE` on merge; the paired lance-graph mirror rows must land in the same arc
 
-**Status:** OPEN (tracked) · **Resolution path RULED by operator 2026-07-01: keep the fuse (it IS the dependency contract enforcing OGAR↔lance-graph parallel movement); do NOT pin to a rev — "option 1" is REJECTED. Land the 2 mirror rows + `domains_agree` arm in parallel with OGAR #145 (option 2 / coordinated merge; brief transient red is acceptable — "the fuse is okay for now"). See `E-OGAR-LANCEGRAPH-MOVE-IN-PARALLEL`.** · Owner: OGAR `ogar-vocab` (PR #145) + `lance-graph-contract::ogar_codebook` mirror + `lance-graph-ogar::parity::domains_agree`. Surfaced 2026-07-01 while self-reviewing PR #624 / #145. Same cross-repo-arc shape as `ISS-OGAR-AUTH-MIRROR-DRIFT` (which took medcare CI red) and `ISS-OGAR-GENETICS-MIRROR-PENDING`; cited by `E-CODEBOOK-MINT-IS-A-CROSS-REPO-ARC`.
+**Status:** RESOLVED 2026-07-02 — dissolved by the same operator ruling as `ISS-OSINT-SYSTEM-ROOT-SLOT-VIOLATION`: OGAR PR #146 removes both #145 OSINT mints (67 → 65), so the fuse balances with NO mirror rows to land; the "2 mirror rows in parallel" path below is moot (preserved as history). The fuse itself stays, per the earlier ruling ("keep the fuse — it IS the dependency contract"). · Original: **Resolution path RULED by operator 2026-07-01: keep the fuse (it IS the dependency contract enforcing OGAR↔lance-graph parallel movement); do NOT pin to a rev — "option 1" is REJECTED. Land the 2 mirror rows + `domains_agree` arm in parallel with OGAR #145 (option 2 / coordinated merge; brief transient red is acceptable — "the fuse is okay for now"). See `E-OGAR-LANCEGRAPH-MOVE-IN-PARALLEL`.** · Owner: OGAR `ogar-vocab` (PR #145) + `lance-graph-contract::ogar_codebook` mirror + `lance-graph-ogar::parity::domains_agree`. Surfaced 2026-07-01 while self-reviewing PR #624 / #145. Same cross-repo-arc shape as `ISS-OGAR-AUTH-MIRROR-DRIFT` (which took medcare CI red) and `ISS-OGAR-GENETICS-MIRROR-PENDING`; cited by `E-CODEBOOK-MINT-IS-A-CROSS-REPO-ARC`.
 
 **READY PATCH (apply to lance-graph the moment OGAR #145 is on OGAR main; NOT to #624 while OGAR main is still 65 — that breaks #624's own fuse):** in `crates/lance-graph-contract/src/ogar_codebook.rs` add the two rows `("osint_system", 0x0700), ("osint_person", 0x0701)` to `mirror::CODEBOOK` (65 → 67); add the `(O::Osint, C::Osint)` arm to `lance-graph-ogar::parity::domains_agree` (the `ConceptDomain::Osint` enum + `0x07 => Osint` route already exist). Then `mirror::CODEBOOK.len() == ogar_vocab::class_ids::ALL.len()` (67 == 67) restored.
 

.claude/board/LATEST_STATE.md

@@ -100,6 +100,7 @@ Membrane consumers can now pull BOTH halves of a render `classid` BBB-safely fro
 
 | PR | Merged | Title | What it added |
 |---|---|---|---|
+| **#626** | 2026-07-02 | V3 convergence wiring: tenant-carve certification, RungElevator, P6 wave probe, seam-list plan | "Wire, don't invent": `RungLevel::{from_u8,elevate,de_elevate,pearl_level,causal_mask_bits}` + `RungElevator` (sustained-BLOCK policy over P2/P3-certified masks; converged with `escalation::rung_delta` via `apply_delta` — one ladder, two signal sources) wired through the driver (persistent elevator, `ctx.rung=1` proxy retired, grpc rung saturates-never-wraps per codex P2); BOTH V3 tenant carves matrix-certified (Cognitive + Compressed); P6 probe (wave dist == certified palette read, markov_soa verified); `[patch.crates-io] ndarray` → local sibling path (fetch deadlock gone; first in-sandbox core build, 925/925). Plan `v3-convergence-wiring-v1.md`; worker Rule 7. Branch `claude/v3-substrate-migration-review-o0yoxv`, merge `5aaee33`. |
 | **#542** | 2026-06-18 | E-OGAR-IS-FOUNDRY capstone + 5+3 council + the key→row baton | Foundry/Gotham = "write the OGAR class schema + inheritance"; everything else is generic machinery over it (ontology=`classid→ClassView`+inheritance, AR=DO/THINK, pipelines=`compute_dag`, apps=Jinja-over-classes, query=Cypher⇄SurrealQL one IR). Added `MailboxSoaView::row_for_local_key -> Option<usize>` (default `None`, deferred-binding — the key→row baton for a future `Backend::MailboxSoa` router). Epiphanies `E-OGAR-IS-FOUNDRY`/`E-CYPHER-IS-THE-KANBAN-AST`/`E-GUID-IS-THE-GRAPH`; plan `cypher-kanban-ast-unification-v1`. Council corrections: `from_guid_prefix` is on `NiblePath` not `NodeGuid`; "odoo proof" = CONJECTURE; `ogar-adapter-surrealql` not a crate. Branch `claude/q2-substrate-grounding`, merge `faca377f`. |
 | **#540** | 2026-06-18 | `lite-unified` additive default-OFF coexistence feature gate | **+35/-5, 2 files.** `lite-unified = []` in `crates/lance-graph/Cargo.toml` (empty until SurrealQL-on-lance lowering lands). **datafusion stays DEFAULT — NOT deprecated, NOT made optional.** Process, not switch; promoted per query-shape once OQ-LU-2a is green. Zero behavior change at default features. Branch `claude/lite-unified-gate`, merge `ef7e97ef`. |
 | **#539** | 2026-06-18 | particle/wave click → `ClassView::compute_dag` (the one Core gap) + electricity-cascade join | **+570, 6 files, additive to `lance-graph-contract` only.** `class_view::{ComputeEdge, compute_dag_is_acyclic, compute_dag_topo_order}` + `ClassView::compute_dag` default (zero-fallback). `compute_dag_topo_order -> Option<Vec<u8>>` = the recompute ORDER (Kahn; `None` on cycle; leaves excluded). 4+1 epiphanies (`E-OGAR-ROUTER-ENCODER` = router+encoder, physics-duality stripped; `E-EXCEL`, `E-CHESS` = NNUE-proven shape, `E-PERTURBATION` = the cascade IS compute_dag, Weyl bound certifies incrementality; folded `E-AR-DO-WIRING`). Doc-join `crates/perturbation-sim/COMPUTE_DAG_MAPPING.md` (perturbation-sim stays zero-dep). **⚠ tracked: `ClassView::value_schema` default = `ValueSchema::Full` is a TEMPORARY POC — revert to `Bootstrap` + its test when the consumer-transcode phase ends (type-level default stays `Bootstrap`).** 13/13 class_view, clippy/fmt clean. Branch `claude/particle-wave-click-epiphany`, merge `b0255499`. |

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,24 @@
 
 ---
 
+## #626 lance-graph: V3 convergence wiring — tenant-carve certification, RungElevator, P6 wave probe, seam-list plan
+
+**Status:** MERGED 2026-07-02 (merge commit `5aaee33`), branch `claude/v3-substrate-migration-review-o0yoxv`. The "wire, don't invent" arc: every deliverable a probe or a wiring of EXISTING types (`E-V3-TENANTS-ALREADY-EXIST-WIRE-DONT-INVENT`); operator all-in, Sonnet-grindwork/Fable-decisions model split.
+
+**Added:** contract — `RungLevel::{from_u8, elevate, de_elevate, pearl_level, causal_mask_bits}` + `RungElevator{new, on_gate, apply_delta, causal_mask_bits}` (zero-dep sustained-BLOCK policy, converged with `escalation::rung_delta` — one ladder, two signal sources) + the two V3 tenant-carve field-isolation matrices (`osint_v3_cognitive…` / `fma_cpic_v3_compressed…`, shared `assert_value_lane_isolation`); driver — persistent `RwLock<RungElevator>` on `ShaderDriver` (base-change reset, gate fed post-decision), `materialize_provenance(…, rung)` retires the `ctx.rung = 1` proxy, `rung_from_wire_u32` grpc saturation (codex P2) + wire/grpc `from_u8` dedup + lab-feature compile repair (Pillar-7 initializer fields, `ContextChain::new()`); core — P6 `p6_palette_join` tests (wave dist == certified palette read), `markov_soa` STATUS verified; build — `[patch.crates-io] ndarray` git-URL → local sibling path (burn submodule out of repo scope; patch was `[[patch.unused]]` either way). Plan `.claude/plans/v3-convergence-wiring-v1.md` + knowledge worker Rule 7 (negative-existence claims need exhaustive-search declaration).
+
+**Locked:** rung→Pearl mapping (0–2 observe L1, 3–5 intervene L2 → `PO=0b011` P3-certified, 6–9 counterfactual L3 → `SPO=0b111` P3-certified; L1→`O=0b001` labeled convention pending probe; `Counterfactual = 6` IS the boundary); elevator homeostasis (sustained BLOCK up, sustained FLOW down to dispatched base, HOLD resets streaks; threshold 2 hand-tuned, disclosed); two-SoA-worlds doctrine (Lance columnar I/O is the reconciler; consumers write against per-row accessors; `&[T]` borrows are the owner's privilege); grpc wire rung saturates-never-wraps; board files are append-only ledgers (CodeRabbit learning recorded org-side).
+
+**Deferred:** D-VCW-3 P7 render probe + D-VCW-5 cascade3 nibble falsifier (q2 push-gated, specs ready); D-VCW-4 one-row registry Phase B (OGAR, operator-gated); D-VCW-7 rig/rs-graph-llm FailureTicket loop; osint `0x0700` reconciliation (Options A/B + two-id-spaces addendum strengthening B — operator's); classid human-readable reorder (DEFERRED-by-design).
+
+**Docs/board:** EPIPHANIES `E-V3-TENANTS-ALREADY-EXIST-WIRE-DONT-INVENT` + `E-RUNG-LADDER-IS-DISPATCH-POLICY-OVER-CERTIFIED-MASKS`; ISSUES `ISS-Q2-CPIC-MIRROR-DIVERGES-FROM-CPIC-V3-REGISTRY` (+ dated truncated-grep correction) + `ISS-Q2-CASCADE3-NIBBLE-ANCESTRY`; TECH_DEBT `TD-DEPRECATED-ACCESSORS-BLOCK-DEP-CLIPPY`; STATUS_BOARD D-VCW rows; INTEGRATION_PLANS prepend; AGENT_LOG ×3.
+
+**Confidence (2026-07-02):** HIGH — contract 763 (v2+v3 features)/755 default, core 925 (arigraph 124, markov_soa 6), driver 100 default/186 lab-feature, planner 204; fmt clean; codex P2 fixed+tested; CodeRabbit 5/5 pre-merge, 1 finding fixed + 1 withdrawn (append-only-ledger learning recorded). First session where lance-graph CORE builds+tests in-sandbox (crates.io noProxy + local ndarray path patch + protoc).
+
+**Cross-ref:** plan `v3-convergence-wiring-v1.md`; #624 (P1–P5 probe arc this extends); #496/#500 (tenant-lane layout + no-new-variant guardrail); #618 (V3 identity classes); OGAR #128 (envelope parser, the ReadMode third axis).
+
+---
+
 ## #592 lance-graph: `contract::ogar_codebook` APP-prefix (hi-u16) mirror — closes ISS-CONTRACT-APP-PREFIX-MIRROR
 
 **Status:** MERGED 2026-06-22 (merge commit `48794eaf`), branch `claude/contract-app-prefix-mirror`. Closes the Core gap the #591 consumer spellbook surfaced: `contract::ogar_codebook` mirrored the lo-u16 concept pull but not OGAR#97's hi-u16 render composition, so membrane consumers had to hand-stamp `0x000N`.