feat: 4-task unblock-cascade — NiblePath::from_guid_prefix + MailboxSoaOwner cherry-pick + LanceVersionScheduler + SurrealMailboxView (D-PG-6)

Lands four tasks from the shortest-unblocking-path list surfaced after
PR #497-#501 + the AdaWorldAPI/surrealdb fork bump (lance/lance-index =7.0.0,
lancedb =0.30.0, ndarray exact-rev). All four meet at the single contract
trait `MailboxSoaView`, closing the cascade in one commit (E-UNBLOCK-CASCADE-1).

## Task 3 — `NiblePath::{from_guid_prefix, prefix}` (zero-dep, foundational)

Ontology-side keystone follow-up of PR #498's `classid → ReadMode` LE contract.
The 20-nibble `classid(8) | HEEL(4) | HIP(4) | TWIG(4)` prefix overflows the
16-nibble MAX_DEPTH: the deterministic fold drops the canon-reserved high u16
of classid (root-first pack: `classid_lo(4) | HEEL(4) | HIP(4) | TWIG(4)`),
returning None when the fold would be lossy. `prefix(d)` is the O(1) ancestor
view; `prefix(d).is_ancestor_of(self)` holds for every d ≤ self.depth (the
routing-cache view of a deeper class path).

  +7 tests in `hhtl::tests`; contract lib 619 → 632 green.

## Task 2 — `impl MailboxSoaView + MailboxSoaOwner for MailboxSoA<N>`

Cherry-pick of jolly-cori-clnf9 commit 463d71b (integrated-cognitive-planner-v1
§2 Seam #3, +149 LOC). Adds `pub phase: KanbanColumn` field + zero-copy
repr(transparent) slice impls (edges_raw, meta_raw) + the in-RAM Rubicon
driving-loop test (`test_in_ram_driving_loop_walks_rubicon_to_commit`). The
contract spine (#437/#439) now drives an actual loop end-to-end — no surreal,
no ractor bus needed for the in-process case.

  +1 driving-loop test; cognitive-shader-driver lib 85 → 86 green.

## Task 1 — `LanceVersionScheduler` over `VersionedGraph::versions()`

D-MBX-9-IN core impl (the CI-gated twin of the contract slice shipped 2026-05-31).
Lives in `crates/lance-graph/src/graph/scheduler.rs`. Wraps a `VersionedGraph` +
inner `VersionScheduler<S = NextPhaseScheduler>` and exposes:

- `drive_once(view, exec)`           — read current Lance version, lower to a move
- `drive_at_latest(view, exec)`      — fold `versions().last()` into a move
- `current_dataset_version()`        — typed `DatasetVersion` over nodes head

Closes `E-SUBSTRATE-IS-THE-SCHEDULER`'s OUT-direction end-to-end. The OUT
direction stays propose-not-dispose (R1): returned `KanbanMove` is for the
caller's `MailboxSoaOwner::try_advance_phase` to apply.

  +5 tests with real on-disk tempdir Lance (no mocks).

## Task 4 — `SurrealMailboxView<'a>` (D-PG-6 contract slice)

Read-only `MailboxSoaView` adapter the SurrealQL projection populates via
`from_columns(...)` — pure zero-copy borrow over the kv-lance scan's byte
buffers. Imports `MailboxSoaView` but NOT `MailboxSoaOwner` (compile-time
enforcement of `kanban.rs:1-21` "surreal=project-read-only, callcenter=commit").

`read_via_kv_lance()` returns the new typed `SurrealContainerError::BlockedColdBuild`
until the surrealdb fork dep in `Cargo.toml` is uncommented — kept off by default
to avoid the ~10 min cold surrealdb build for contributors who don't need it.
The contract surface is available today; the integration is one Cargo.toml edit
+ a SurrealQL projection body in `view.rs`.

  +4 tests; new `lance-graph-contract` dep in surreal_container/Cargo.toml;
  BLOCKED(C) marker flipped to RESOLVED.

## What this unblocks

- **D-MBX-9-IN-impl** — SHIPPED (the contract trait now has a Lance-backed implementor).
- **D-MBX-A6-P3** — still queued, BUT Seam #3 (the in-RAM loop) is now in-tree;
  a downstream session can wire the emit-side without depending on the unmerged
  jolly branch.
- **D-PG-6 (Rubicon kanban VIEW)** — contract slice SHIPPED; impl-side gated on
  `BlockedColdBuild` flip-on (one Cargo.toml uncomment + projection body).
- **Identity-architecture v1 §3 P-SCOPE-CLASSIFY** — solved (the bijection-width
  fix is deterministic + ancestor-preserving + falsifiable by tests).

## Tests + clippy

- lance-graph-contract:   **632** (+7 hhtl)
- cognitive-shader-driver: **86** (+1 driving-loop)
- lance-graph::scheduler:  **5** (new module, real Lance tempdir)
- surreal_container::view: **4** (new module)

All clippy `-D warnings` clean on the new files. Pre-existing lints in
lance-graph-ontology / lance-graph-planner / ndarray_bridge.rs are out of
session scope.

## Board hygiene (mandatory rule)

- LATEST_STATE.md — Contract Inventory PREPEND for the new types.
- EPIPHANIES.md — E-UNBLOCK-CASCADE-1: three independent landings converge on
  one trait surface, closing four queued deliverables in one commit.
- AGENT_LOG.md — task-by-task summary with test counts.

https://claude.ai/code/session_01Xzyc27Nx3f8WC5KzwfWfjx

Author: claude

.claude/board/AGENT_LOG.md

@@ -1,3 +1,27 @@
+## 2026-06-16 — 4-task unblock-cascade landing: NiblePath::from_guid_prefix + MailboxSoaOwner cherry-pick + LanceVersionScheduler + SurrealMailboxView (D-PG-6 contract slice)
+
+**Main thread (Opus 4.7) — single agent**, four ordered tasks responding to the user's "1 2 3 and 4" go-ahead on the shortest-unblocking-path list surfaced after #497-#501 + the surrealdb fork bump (`AdaWorldAPI/surrealdb` PR #34/#35/#36/#37 → main at `3aa6ab9` with `lance=7.0.0`/`lancedb=0.30.0`). All four committed together on `claude/odoo-savant-reasoners`, branch fast-forwarded through `cb14704`.
+
+**Tasks shipped (in dep order, smaller → larger):**
+
+1. **(3) `lance_graph_contract::hhtl::NiblePath::{from_guid_prefix, prefix}`** — the ontology-side keystone follow-up of #498 (`classid → ReadMode`). Deterministic 20→16 nibble fold of `classid_lo(4) | HEEL(4) | HIP(4) | TWIG(4)` (root-first), returns `None` when the canon-reserved high `u16` of classid is in use (refuses the lossy fold). `prefix(d)` is the O(1) single-shot ancestor view that satisfies `prefix(d).is_ancestor_of(self)` for every `d ≤ self.depth`. Zero-dep. +7 tests in `hhtl::tests` (612 → 619 → 632 contract lib green; clippy/fmt clean).
+
+2. **(2) `impl MailboxSoaView + MailboxSoaOwner for MailboxSoA<N>`** — cherry-pick of commit `463d71b` (jolly-cori-clnf9, the +149 LOC the integrated-cognitive-planner-v1 §2 named as Seam #3). Adds `pub phase: KanbanColumn` field + zero-copy `repr(transparent)` slice impls (`edges_raw` / `meta_raw`) + the in-RAM Rubicon driving loop. The contract spine (#437/#439) now drives an actual loop — no surreal, no ractor bus needed for the in-process case. +1 driving-loop test (`test_in_ram_driving_loop_walks_rubicon_to_commit`, walks Planning → CognitiveWork → Evaluation → Commit with the −550 µs Libet anchor). 86 driver lib tests green.
+
+3. **(1) `lance_graph::graph::scheduler::LanceVersionScheduler`** — D-MBX-9-IN core impl (the CI-gated twin of the contract slice D-MBX-9-IN shipped 2026-05-31). Wraps a `VersionedGraph` + inner `VersionScheduler<S = NextPhaseScheduler>` and lowers a Lance `versions()` tick into the next legal `KanbanMove` via `drive_once` / `drive_at_latest` / `current_dataset_version`. Closes `E-SUBSTRATE-IS-THE-SCHEDULER`'s OUT-direction end-to-end. +5 tests, real on-disk tempdir Lance (no mocks). New module wired in `crates/lance-graph/src/graph/mod.rs`.
+
+4. **(4) `surreal_container::view::SurrealMailboxView`** — D-PG-6 contract slice (polyglot-container-query-membrane-v1 §D-PG-6). Read-only `MailboxSoaView` adapter that a SurrealQL projection over kv-lance populates via `from_columns(...)` — pure zero-copy borrow, no SurrealQL types cross the cognitive-side seam. Module imports `MailboxSoaView` but NOT `MailboxSoaOwner` (compile-time enforcement of the "surreal=project-read-only" ruling, `kanban.rs:1-21`). `read_via_kv_lance()` returns the new typed `SurrealContainerError::BlockedColdBuild` until the surrealdb fork dep in `Cargo.toml` is uncommented (kept off by default to avoid the cold-build cost on contributors who don't need it). +4 tests. New `lance-graph-contract` dep added to `surreal_container/Cargo.toml`; `BLOCKED(C)` note updated to RESOLVED.
+
+**Test summary (this session):** lance-graph-contract **632** (+7) · cognitive-shader-driver **86** (+1) · lance-graph::graph::scheduler **5** (new) · surreal_container::view **4** (new). All clippy `-D warnings` clean on my files (pre-existing lints in `lance-graph-ontology`/`lance-graph-planner`/`ndarray_bridge.rs` ignored — out of session scope).
+
+**Cross-PR unblocks closed by this commit:**
+- D-MBX-9-IN-impl → SHIPPED (the contract trait now has a real Lance-backed implementor).
+- D-MBX-A6-P3 (planner emit KanbanMove) → still queued, BUT Seams #3 (the loop) is now in-tree, so a downstream session can wire the emit-side without depending on the unmerged jolly branch.
+- D-PG-6 (Rubicon kanban VIEW over surrealdb) → contract slice SHIPPED (typed `MailboxSoaView` impl); impl-side gated on `BlockedColdBuild` flip-on.
+- Identity-architecture v1 §3 P-SCOPE-CLASSIFY blocker → solved (`from_guid_prefix` is deterministic + bijective + ancestor-preserving).
+
+**Discipline:** PR_ARC entry deferred until merge commit; board hygiene (LATEST_STATE Contract Inventory + EPIPHANIES E-UNBLOCK-CASCADE-1) landed in the SAME commit per the mandatory rule.
+
 ## 2026-06-16 — 5-specialist framing of #497 OCR-transcode plans → plans rebaselined to #498 + probes spec'd
 
 **Main thread (Opus 4.8 1M) + 5 Opus specialists in parallel** (cascade-architect / family-codec-smith / palette-engineer / dto-soa-savant / truth-architect), each read the 7 merged #497 plans + post-#498 source in full (Rule 7 — read, don't grep-judge). Operator: *"review the plans against your awareness of the new architecture incl. the last 15 PR arc (Morton Cascade + Helix 48 + turbovec residue) — send 5 specialist framing it."* See `EPIPHANIES.md` E-OCR-PLAN-DRIFT-1 for the consolidated framing.

.claude/board/EPIPHANIES.md

@@ -1,3 +1,31 @@
+## 2026-06-16 — E-UNBLOCK-CASCADE-1 — three independent fork/contract landings collapsed onto the same `MailboxSoaView` seam, closing four queued deliverables in one commit
+
+**Status:** FINDING.
+**Confidence:** High — every claim is grounded in shipped code (`hhtl::from_guid_prefix`, `MailboxSoaOwner for MailboxSoA<N>`, `LanceVersionScheduler`, `SurrealMailboxView`) and a single-pass `cargo test` sweep (632 + 86 + 5 + 4 green).
+
+**Context.** Three landings hit the workspace within ~24 h:
+- PR #498 (`feat(contract): GUID decode→read-mode keystone + helix Signed360 right-size + OCR→NodeRow transcode`) — surfaced `NodeGuid::decode() → GuidParts` + `classid_read_mode`.
+- `AdaWorldAPI/surrealdb` PR #34/#35/#36/#37 → main at `3aa6ab9` (lance/lancedb/object_store pins reconciled) — closed the `BLOCKED(C)` on `surreal_container`.
+- The cherry-pick of `jolly-cori-clnf9` commit `463d71b` (the +149 LOC `MailboxSoaOwner` impl for `MailboxSoA<N>`) had been the integrated-cognitive-planner-v1 Seam #3.
+
+**The find.** All three meet at exactly **one trait surface**: `lance_graph_contract::soa_view::MailboxSoaView`. Each landing made a DIFFERENT impl viable on the same boundary:
+- **`MailboxSoA<N>` (cognitive)** — the in-process owner+view, so the Rubicon loop runs in-RAM (was only on `jolly`).
+- **`SurrealMailboxView<'a>` (surreal-side view)** — D-PG-6's read glove, now buildable end-to-end via the fork's `kv-lance` backend.
+- **`NiblePath::from_guid_prefix`** — the ontology-side keystone follow-up of #498's `classid → ReadMode` LazyLock: a deterministic 20→16 nibble fold that satisfies the routing-prefix `is_ancestor_of` invariant the LE contract names.
+
+`LanceVersionScheduler` (D-MBX-9-IN core impl) sits one layer up and consumes ANY `V: MailboxSoaView` — so a single OUT-direction wrapper drives all three impls without case-splitting. The trait's read-only-by-design (`MailboxSoaView` has no mutator method) is the structural enforcement of `kanban.rs:1-21`'s "surreal=project-read-only, callcenter=commit" ruling; the SurrealQL adapter NOT importing `MailboxSoaOwner` is the compile-time tripwire if a future drift tries to mutate through the projection.
+
+**Why this matters.** Four "still BLOCKED" rows from the most recent unblock-list synthesis (last sync turn) all collapse onto a SINGLE commit, because the substrate already had the shape — only three independent dep/code landings had to converge. The pattern:
+- Substrate trait designed once + multiple implementors (no `Box<dyn>` in hot paths — generic `V: MailboxSoaView` everywhere).
+- Read-only-by-trait-design = compile-time enforcement of the architectural ruling (no need for a runtime "you can't write through this" guard).
+- A typed `BlockedColdBuild` error variant lets a heavy dep wire-up (surrealdb cold build) be deferred without breaking the contract-side adapter — the surface ships, the integrator flips it on in their branch.
+
+**Lesson.** When three plans cite the same trait surface as their unblock dependency, the first session that lands ANY one of the implementors should ALSO ship the trait-impl shape for the others (even as a stub returning a typed error). This collapses N independent post-unblock follow-ups into 1 commit's worth of trait engineering. The cost is ~50 LOC of stub + a typed error variant; the benefit is N − 1 fewer post-merge commits per queued plan.
+
+**Cross-ref.** Identity-architecture v1 §3 (the bijection-width problem); polyglot-container-query-membrane-v1 §D-PG-6 (the Rubicon kanban VIEW); integrated-cognitive-planner-v1 §2 (Seams #1–#6, the additive-only convergence); `E-SUBSTRATE-IS-THE-SCHEDULER` (the bidirectional kanban subscription); `kanban.rs:1-21` (the read-only ruling the trait shape enforces).
+
+---
+
 ## 2026-06-16 — E-OCR-PLAN-DRIFT-1 — the #497 OCR-transcode plans drifted from the substrate in 6 ways; 2 were showstoppers
 
 **Status:** FINDING (5-specialist framing — cascade-architect / family-codec-smith / palette-engineer / dto-soa-savant / truth-architect, each read the merged plans + source in full).

.claude/board/LATEST_STATE.md

@@ -68,6 +68,8 @@
 
 ## Current Contract Inventory (lance-graph-contract)
 
+> **2026-06-16 — ADDED (4-task unblock-cascade)**: `lance_graph_contract::hhtl::NiblePath::{from_guid_prefix(&NodeGuid) -> Option<NiblePath>, prefix(depth: u8) -> Option<NiblePath>}` — the ontology-side keystone follow-up of #498's `classid → ReadMode` LE contract. The 20-nibble `classid · HEEL · HIP · TWIG` prefix is deterministically folded to 16 (the canon-reserved high `u16` of classid drops); returns `None` when the fold would be lossy (callers don't get silent collisions). `prefix(d)` is the O(1) single-shot ancestor view that satisfies `prefix(d).is_ancestor_of(self)` for every `d ≤ self.depth` — the routing-cache view of a deeper class path. **One layer up** in `cognitive-shader-driver::MailboxSoA<N>`: `impl MailboxSoaView + MailboxSoaOwner` (cherry-pick of `jolly-cori-clnf9::463d71b`) + the `pub phase: KanbanColumn` field — the in-RAM Rubicon owner the contract's `MailboxSoaOwner` had no real implementor for (integrated-cognitive-planner-v1 §2 Seam #3 closed). In `lance_graph::graph::scheduler`: `LanceVersionScheduler<S = NextPhaseScheduler>` — D-MBX-9-IN core impl over `VersionedGraph::versions()`, generic over the inner `VersionScheduler` policy (closes `E-SUBSTRATE-IS-THE-SCHEDULER`'s OUT-direction). In `surreal_container::view`: `SurrealMailboxView<'a>` + `read_via_kv_lance()` (D-PG-6 contract slice) — the SurrealQL read-glove the integrator wires once the cold-build of the surrealdb fork is taken; the contract surface is available today. Plus `SurrealContainerError::BlockedColdBuild` — typed signal for callers to pattern-match the cold-build gate (distinct from the pre-existing `Blocked` variant which signals coordinate/API gaps). Zero-dep contract additions (+7 hhtl tests, 632 lib green); cognitive-shader-driver +1 driving-loop test (86 lib green); lance-graph::scheduler new module (+5 tests, real tempdir Lance); surreal_container::view new module (+4 tests). All four green; clippy `-D warnings` clean on the new files. EPIPHANIES `E-UNBLOCK-CASCADE-1` records the convergence of three independent landings onto the single `MailboxSoaView` trait surface.
+
 > **2026-06-09 — ADDED (D-IDENTITY-1, Phase A of identity-architecture)**: `lance_graph_contract::identity::{NodeGuid([u8;16]), IDENTITY_LAYOUT_VERSION}` — the workspace's first **stable binary instance identity**: a structured 128-bit UUIDv8 (RFC 9562) = the HHTL nibble-address **formalized + namespaced**. **Composed from existing committed scalars, never re-invented** (Agent A sweep confirmed the 128-bit id space was empty): octets carry `namespace:u8 | entity_type:u16 | kind:u8` (the `SchemaPtr.packed` convention) ⊕ a truncated `NiblePath` routing prefix (`PREFIX_NIBBLES=4`) ⊕ a 22-bit `shape_hash` (truncated `StructuralSignature`) ⊕ a 24-bit `local`, with UUIDv8 version(=8)/variant(=0b10) at their RFC-fixed positions + an `IDENTITY_LAYOUT_VERSION` stamp. **Eineindeutigkeit**: `entity_type` is the canonical exact class identity; the `NiblePath` prefix is the bijective DERIVED view (a *truncated* prefix can't be the identity — deep classes collide past it; the prefix `is_ancestor_of` the full path). Five readings: resolve (`entity_type`) / route (`niblepath`) / witness (frozen bytes + merkle) / ground-truth (`shape_hash` drift) / dispatch-to-store (`as_bytes` → `EntityKey`). Also added `hhtl::NiblePath::from_packed` (inverse of `packed`). Zero-dep; 599 contract lib tests (+15: field-isolation matrix, UUIDv8 gates, ancestor-prefix invariant, Display=canonical-UUID); clippy `-D warnings` clean; fmt clean. Plans: `identity-architecture-exists-vs-needs-v1.md` (exists-vs-needs map + phases A→H), `cognitive-write-roundtrip-substrate-v1.md`. Epiphany: E-IDENTITY-WHITEBOX-1.
 
 > **2026-05-31 — ADDED (D-EW64-1 + D-VIEW-1, episodic-RISC-spine)**: `episodic_edges::{EpisodicEdges64(u64), EdgeRef{family:u8,local:u16}}` — AriGraph episodic edges, 4x[4-bit family | 12-bit local]: family 0 = intra-basin (inherited, ~98.6% per #444), 1..=15 = cross-family index into the OGIT-class-inherited palette (~1.4%; identities inherited, never on the edge — I-VSA-IDENTITIES). Plus `view_angle::ViewAngle` (4-bit view-schema selector; presence bitmask doubles as attention mask, inherited). Zero-dep; 527 contract lib tests; clippy pedantic+nursery clean. Plan: episodic-risc-spine-v1.md.