feat(contract): kanban×Rubicon SoA value tenant + per-tenant counters (capstone S1)

Operator-greenlit canon-additive change: make the Rubicon kanban phase a per-node
SoA value tenant rather than an envelope field — pinning SoA↔kanban in the LE blob
and subsuming the envelope-pointer plan (G1).

- ValueTenant::Kanban = 9 at value-slab [112,120) (8 B: phase|exec|reserved|cycle),
  U64 descriptor @ row_offset 144; added to ValueSchema::{Cognitive,Full}.
  Reserve-don't-reclaim, layout-preserving: Full 112→120 B, NODE_ROW_STRIDE 512
  untouched, no ENVELOPE_LAYOUT_VERSION bump.
- KanbanTenant Copy view (phase: KanbanColumn, exec: ExecTarget, cycle: u32) +
  from_bytes/to_bytes (LE) + NodeRow::{kanban, set_kanban}. set_kanban is
  owner-only by convention (MailboxSoaOwner/View split); surreal reads, never
  writes (Rubicon). KanbanColumn::from_u8 + ExecTarget::from_u8.
- tenant_counter module + feature `tenant-counters` (default OFF; zero-cost no-op
  via compile-time dispatch when off, one relaxed atomic per tenant write when
  on) — the capstone NaN-census / cascade-wiring instrument. set_kanban bumps the
  Kanban counter as the first wired cascade point.
- Updated the 3 byte-budget LOCK tests to the deliberate new layout (Cognitive
  58→66, Full 112→120, contiguous carve 112→120) + added Kanban to full-covers;
  new field-isolation matrix test + schema-membership test.

Decisions kept (I-VSA-IDENTITIES register-laziness + AGI-glove): thinking-style
is ClassView + the Meta tenant, NOT a new 128-bit tenant (the 48+80 flat split
was rejected — duplicates Plasticity/Meta/Qualia); plan-shape stays
ClassView-derived; the MUL flow-vs-mismatch trigger is a function over
Qualia/Meta/Plasticity → GateDecision → advance phase, not a stored tenant.

Verified: contract lib 714 (default) / 715 (tenant-counters) / 720 (guid-v2-tail);
clippy -D warnings --all-targets clean all three; fmt clean; Full-carve math 120 B
ends row 152 ≤ 512; no downstream crate hardcodes the old tenant count/budget.
(cargo-machete not installed in sandbox; the only Cargo.toml change is a dep-less
feature, so nothing to flag.) Capstone S1 → green (CONJECTURE→FINDING).

Board: AGENT_LOG (cont.17), LATEST_STATE IN-PR entry, EPIPHANIES
E-KANBAN-IS-A-VALUE-TENANT-SUBSUMES-G1, plan capstone S1 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CcpLeEC3XK8Eye53GKBVvi

Author: claude

.claude/board/AGENT_LOG.md

@@ -1,3 +1,13 @@
+## 2026-06-20 (cont.¹⁷) — kanban×Rubicon SoA tenant + per-tenant counters (capstone S1 green)
+
+**Main thread (Opus), autoattended.** Operator go on the canon-locked change ("first the kanban X Rubicon wired inside the SoA" + "add counters for each tenant"). Confirmed aiwar/OSINT/mixin-family on main first (q2 can test: `contract::aiwar` + `soa_graph::project_snapshot(&OSINT_GOTHAM)` → GraphSnapshot, family nodes = categories, cross-category edges → out_family `references` slots = the O(1) mixin model; example `aiwar_family_poc`). Built:
+- **`ValueTenant::Kanban = 9`** at value-slab `[112,120)` (8 B, U64 descriptor @ row_offset 144), added to `ValueSchema::{Cognitive,Full}`. Reserve-don't-reclaim, layout-preserving (Full 112→120, stride 512 untouched, no version bump).
+- **`KanbanTenant`** Copy view (phase/exec/cycle) + `from_bytes`/`to_bytes` (LE) + `NodeRow::{kanban,set_kanban}`; `KanbanColumn::from_u8` + `ExecTarget::from_u8`. Exported `KanbanTenant` from lib.rs.
+- **`tenant_counter`** module + feature `tenant-counters` (default OFF, zero-cost no-op; one relaxed atomic/tenant-write when on) — the capstone NaN-census instrument; `set_kanban` bumps the Kanban counter.
+- Updated the 3 byte-budget LOCK tests (their job: catch deliberate layout change) — Cognitive 58→66, Full 112→120, contiguous carve 112→120; added Kanban to the full-covers list. Field-isolation matrix test + schema-membership test added.
+Verified: contract lib **714** default / **715** tenant-counters / **720** guid-v2-tail; clippy `-D warnings --all-targets` clean all three; fmt clean; Full-carve math 120 ends row 152. `cargo-machete` not installed in sandbox (only Cargo.toml change is a dep-less feature → nothing to flag). No downstream crate hardcodes the old tenant count/budget (grep clean). **Capstone S1 → green** (CONJECTURE→FINDING). EPIPHANY E-KANBAN-IS-A-VALUE-TENANT-SUBSUMES-G1.
+**Deferred (named, NOT this PR):** the Singleton/BindSpace→MailboxSoA rewire (cognitive-shader-driver, W3/W4a `mailbox-thoughtspace` arc); BF16 perturbation-shader cascade (perturbation-sim, excluded crate); capstone Wave-0 NaN baseline.
+
 ## 2026-06-20 (cont.¹⁶) — capstone validation plan: cognitive-loop wiring + NaN-census
 
 **Main thread (Opus), autoattended.** Rebased jirak onto main (98c0cf2a = #564 merged: lance-graph-ogar + node_rows_from_le_bytes). Resolved a stop-hook false-positive (98c0cf2a is GitHub's web-flow merge commit, GitHub-verified; fast-forwarded origin/jirak to it, no rewrite). Operator asked whether the kanban/MUL/orchestration wiring deserves a capstone VALIDATION plan that MEASURES the actual wiring ("99% there unused, 28% wiring gaps, 72% NaN"). Agreed — it's mandated by the measurement-before-synthesis + probe-first iron rules. Wrote `.claude/plans/capstone-cognitive-loop-wiring-nan-census-v1.md`: treats the operator's estimate as THREE orthogonal measured quantities (piece-presence% / seam-wiring% / run-NaN%); 7 seams S1..S7 each a CONJECTURE-until-probe-green (S1 kanban tenant, S2 MUL→phase, S3 version→move, S4 envelope route via BridgeSlot, S5 batch push [measured GAP: pull-only], S6 timeline zero-copy [GAP: val is opaque Binary], S7 SoA self-NaN-census = the "Orchestration meta-awareness"); Wave 0 = measure baseline on shipped code (the honest number behind 72% NaN). Overclaim-guard: AGI-adjacency is the IF the census TESTS, never the asserted THEN. Decided (I-VSA-IDENTITIES register-laziness + AGI-glove): thinking-style is ClassView+Meta, NOT a new 128-bit tenant; the 48+80 flat split was rejected (duplicates Plasticity/Meta/Qualia). Kanban tenant stays 8 B; still gated on operator go for the canon-locked region. Plan committed to jirak; INTEGRATION_PLANS prepended.

.claude/board/EPIPHANIES.md

@@ -1,3 +1,17 @@
+## 2026-06-20 — E-KANBAN-IS-A-VALUE-TENANT-SUBSUMES-G1 — making kanban×Rubicon a per-node SoA value tenant (`ValueTenant::Kanban`, 8 B at value-slab [112,120)) pins SoA↔kanban in the 512-byte LE blob and dissolves the envelope-pointer gap (G1): the node carries its OWN phase+cycle, so no `UnifiedStep` field is needed
+
+**Status:** FINDING (operator "brutal version" lock, 2026-06-20; shipped, capstone S1 green).
+
+The kanban phase was going to be carried by a new `UnifiedStep` pointer field (G1). Putting it IN the SoA instead is cleaner and subsumes G1:
+- `ValueTenant::Kanban = 9` at row_offset 144 (value-slab `[112,120)`), 8 B: `phase(KanbanColumn u8) | exec(ExecTarget u8) | reserved(u16) | cycle(u32)`. Reserve-don't-reclaim (368 B were free), **layout-preserving** — Full 112→120 ≤ 480, stride still 512, no `ENVELOPE_LAYOUT_VERSION` bump. Field-isolation matrix test mandatory (I-LEGACY) — green.
+- **Pins SoA↔kanban in the LE contract**: kanban is now a fixed byte range in the 512-byte blob → a `FixedSizeBinary(512)` store (surrealdb second brain) reads the kanban state zero-copy at any Lance version; the kanbanview = mailbox rows projected by the tenant's `phase`.
+- **Owner-gated write / Rubicon read-only**: `NodeRow::set_kanban` is owner-only by convention (the `MailboxSoaOwner`/`View` split); surreal reads, never writes.
+- **Decisions kept (I-VSA-IDENTITIES register-laziness + AGI-glove):** thinking-style is ClassView + the `Meta` tenant, NOT a new 128-bit tenant (the 48+80 flat split was rejected — duplicates Plasticity/Meta/Qualia). plan-shape stays ClassView-derived. The MUL flow-vs-mismatch trigger is a FUNCTION over Qualia/Meta/Plasticity → GateDecision → advance phase, not a stored tenant.
+
+Companion: `tenant_counter` (feature `tenant-counters`, default OFF, zero-cost no-op when off; one relaxed atomic per tenant write when on) — the per-tenant update-counter instrument the capstone NaN-census reads. `set_kanban` bumps the `Kanban` counter as the first wired cascade point.
+
+Verified: contract lib 714 (default) / 715 (tenant-counters) / 720 (guid-v2-tail), clippy `-D warnings` clean all three, fmt clean; Full carve math 120 B ends row 152 ≤ 512. Cross-ref: capstone plan S1; `E-SURREALDB-SECOND-BRAIN-IS-ZERO-COPY-IFF-FIXEDSIZEBINARY`; AGENT_LOG 2026-06-20 (cont.¹⁷).
+
 ## 2026-06-20 — E-SURREALDB-SECOND-BRAIN-IS-ZERO-COPY-IFF-FIXEDSIZEBINARY — surrealdb (kv-lance) can become a zero-copy "second brain" inside lance-graph ONLY if it stores each node as an uncompressed `FixedSizeBinary(512)` LE blob; the contract a store satisfies is `node_rows_from_le_bytes(&[u8]) -> Option<&[NodeRow]>` (the inverse of `NodeRowPacket::as_le_bytes`), and a variable-length `Binary` column does NOT qualify
 
 **Status:** FINDING (brutal feasibility pass, 2026-06-20; contract primitive shipped, surrealdb side planned).

.claude/board/LATEST_STATE.md

@@ -16,6 +16,8 @@
 
 ---
 
+> **2026-06-20 — IN PR (`claude/jirak-math-theorems-harvest-rfii13`)** — **kanban×Rubicon SoA value tenant + per-tenant counters (capstone S1 green).** NEW `ValueTenant::Kanban = 9` at value-slab `[112,120)` (8 B: `phase|exec|reserved|cycle`), added to `ValueSchema::{Cognitive,Full}` — reserve-don't-reclaim, **layout-preserving** (Full 112→120 B, stride 512 untouched, no version bump). `KanbanTenant` Copy view + `NodeRow::{kanban,set_kanban}` (owner-gated write / surreal read-only / Rubicon); `KanbanColumn`/`ExecTarget` `from_u8`. **Subsumes the envelope-pointer G1** — the node carries its own phase+cycle, pinning SoA↔kanban in the LE blob (a `FixedSizeBinary(512)` store reads kanban zero-copy at any version). NEW `tenant_counter` module + feature `tenant-counters` (default OFF, zero-cost no-op; one relaxed atomic/tenant-write when on) — the capstone NaN-census instrument; `set_kanban` is the first wired cascade point. Decisions kept (I-VSA-IDENTITIES + AGI-glove): thinking-style is ClassView+`Meta`, NOT a 128-bit tenant; plan-shape ClassView-derived; MUL flow-trigger is a function, not a tenant. Contract lib **714**/715(tenant-counters)/720(guid-v2-tail), clippy `-D warnings` + fmt clean all three. Refs: AGENT_LOG (cont.¹⁷), EPIPHANIES `E-KANBAN-IS-A-VALUE-TENANT-SUBSUMES-G1`, plan `capstone-cognitive-loop-wiring-nan-census-v1` (S1 green).
+>
 > **2026-06-20 — IN PR (`claude/jirak-math-theorems-harvest-rfii13`)** — **Zero-copy SoA read contract: `node_rows_from_le_bytes` (the surrealdb "second brain" primitive).** The inverse of `NodeRowPacket::as_le_bytes` (WRITE) — `canonical_node::node_rows_from_le_bytes(&[u8]) -> Option<&[NodeRow]>`, a CHECKED zero-copy cast (`len % 512 == 0` AND `ptr % 64 == 0`, else `None` → caller copies, no UB; empty→Some(empty)). This IS the LE contract a backing store satisfies so its bytes ARE the SoA the cognitive shader reads in place. **Brutal verdict:** lance-graph side now zero-copy-ready end-to-end; surrealdb's kv-lance does NOT qualify as scaffolded (`val: DataType::Binary` variable-length → needs `FixedSizeBinary(512)`), and value zero-copy holds only if stored UNcompressed (key/address always zero-copy). 712 contract lib green, clippy `-D warnings` both configs + fmt clean. Refs: AGENT_LOG 2026-06-20 (cont.¹⁴), EPIPHANIES `E-SURREALDB-SECOND-BRAIN-IS-ZERO-COPY-IFF-FIXEDSIZEBINARY`.
 >
 > **2026-06-20 — IN PR (`claude/jirak-math-theorems-harvest-rfii13`)** — **Clean separation: NEW `lance-graph-ogar` activation crate (OGAR Active-Record surface).** The OGAR half of `ontology=OGIT / ogar=OGAR`. OGAR is the AR Core and ALREADY `impl`s the contract: `ogar-class-view::OgarClassView impl lance_graph_contract::ClassView` (32 concepts), `ogar-vocab::Class` = AR shape, `canonical_concept_id == ClassId`. NEW `crates/lance-graph-ogar` (EXCLUDED, own `[workspace]`, git-deps OGAR@main + lance-graph-contract@main = ONE source, no `[patch]`) re-exports the full AR surface (ogar-vocab + ogar-class-view + ogar-ontology + ogar-adapter-surrealql) + a **parity-guard** (`assert_codebook_parity`: bijective `ogar_codebook::CODEBOOK ⇄ ogar_vocab::class_ids::ALL` + domain agreement, FAILS build on drift). Features: `default` (light, emit-only), `surrealql-parser` (parser half), `serde`. **Auto-activation = Cargo presence**: pull the crate → real OGAR AR + drift fuse; don't → contract's zero-dep mirror + bare ClassView trait (OGAR stays headless). `cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml` **3/3** green, clippy + fmt clean, contract = ONE source (git main #ff1a3452). Refs: AGENT_LOG 2026-06-20 (cont.¹³), EPIPHANIES `E-OGAR-IS-AR-CORE-AUTOACTIVATED-BY-CARGO-PRESENCE`, plan D-OVC-5. **(#563 D-OVC contract realign now MERGED to main.)**

.claude/plans/capstone-cognitive-loop-wiring-nan-census-v1.md

@@ -57,7 +57,7 @@ SoA node (Kanban tenant: phase)                         ── S1
 
 | Seam | Claim | Probe (pass/fail) | KILL condition | Status |
 |---|---|---|---|---|
-| **S1** kanban tenant | `ValueTenant::Kanban` at `[144,152)` carries phase+cycle+exec, layout-preserving | field-isolation matrix: write each tenant, assert all others unchanged; `NodeRowPacket` round-trips kanban byte-exact | stride ≠ 512, or any other tenant perturbed | CONJECTURE |
+| **S1** kanban tenant | `ValueTenant::Kanban` at `[144,152)` carries phase+cycle+exec, layout-preserving | field-isolation matrix: write each tenant, assert all others unchanged; `NodeRowPacket` round-trips kanban byte-exact | stride ≠ 512, or any other tenant perturbed | ✅ **FINDING (green 2026-06-20)** — shipped `ValueTenant::Kanban`/`KanbanTenant`/`NodeRow::{kanban,set_kanban}`; field-isolation + schema-membership tests pass; Full 112→120 ≤ 480, stride 512. + `tenant_counter` instrument. |
 | **S2** MUL→phase | `MUL::GateDecision(Qualia,Meta,Plasticity)` mismatch ⇒ owner advances phase | feed a known flow-vs-mismatch qualia vector; assert the gate returns the expected `KanbanMove` (or HOLD) | gate ignores qualia (constant output), or reads uninitialized → NaN | CONJECTURE |
 | **S3** version→move | `VersionScheduler::on_version` lowers a real Lance version to the next legal `KanbanMove` | drive a 2-version dataset; assert the forward-arc move emitted | no move on a legal transition, or illegal edge emitted | CONJECTURE (type exists, unwired) |
 | **S4** envelope route | a kanban `UnifiedStep` reaches the present `BridgeSlot` (surreal plan engaged by Cargo presence) | register a surreal slot; route a `step_type:"kanban.*"`; assert it lands; with slot absent assert graceful unhandled (not panic) | routes to wrong domain, or panics when slot absent | CONJECTURE (UnifiedStep has no SoA pointer — G1) |

crates/lance-graph-contract/Cargo.toml

@@ -42,3 +42,9 @@ trajectory-audit = []
 # (`leaf`/`*_v2`) coexist with v1 until cutover (D-GV2-5). Layout reclaim →
 # I-LEGACY-API-FEATURE-GATED (field-isolation matrix + version gate).
 guid-v2-tail = []
+
+# tenant-counters — per-ValueTenant update counters for debug instrumentation of
+# the SoA write cascade (the capstone NaN-census / seam-wiring measurement). OFF
+# by default: `tenant_counter::tenant_update` is a zero-cost no-op unless enabled
+# (compile-time dispatch). On: one relaxed atomic increment per tenant write.
+tenant-counters = []