fix(#498 review): version-gate value-slab offset shift + Signed360 sign-partition

Two codex P2s on #498:
- ENVELOPE_LAYOUT_VERSION 1→2 — the HelixResidue 48→6 B right-size shifted every
  downstream value-tenant offset; bump gates it so a v1 blob refuses to decode
  rather than read tenants from the wrong bytes (safe: nothing persisted under
  v1, FULL is POC-only).
- Signed360: encode |y| in 7 bits + sign in the partition (Pos⇒[128,255],
  Neg⇒[0,127]) so a near-rim negative lift (|y|≈0) can't round to 128 and read
  back as Pos. Regression test signed360_neg_sign_survives_near_rim_at_high_total.

Also adds the #498 PR_ARC_INVENTORY entry (CodeRabbit mis-attributed this PR's
helix/keystone/OCR/causal-edge work to #496 — corrected: it's #498's).

contract 623 lib, helix 73 lib + 7 doc green; clippy -D warnings + fmt clean.

https://claude.ai/code/session_01D2WSmezQBNC3bUdHuGfGmo

Author: claude

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,20 @@
 
 ---
 
+## #498 GUID decode→read-mode keystone + helix Signed360 right-size + OCR→NodeRow transcode
+
+**Status:** OPEN 2026-06-15 (branch `claude/wonderful-hawking-lodtql`, 8 commits post-#496). In review (CodeRabbit + codex). **NOTE:** this entry documents the helix / keystone / OCR / causal-edge work that CodeRabbit on PR #498 mis-attributed to #496 — those changes are **#498's, not #496's**. #496 shipped only ValueSchema presets + the reference plan (its immutable entry below correctly shows the pre-right-size 154/98 B budgets).
+
+**Added:** (1) **Keystone** `canonical_node::{GuidParts, ReadMode, classid_read_mode}` + `NodeGuid::{heel/hip/twig, decode()→GuidParts, read_mode()}` — read-the-GUID-as-a-GUID decode + a `LazyLock<HashMap>` classid→read-mode registry (the single source consumer + OGAR inherit); `ReadMode` bundles the two existing axes (`ValueSchema` + `EdgeCodecFlavor`), no new property. (2) `helix::{Sign, Signed360}` + `HemispherePoint::signed_lift` + `ResidueEncoder::encode_signed` — signed full-sphere codec; **`HelixResidue` value-tenant right-sized 48 B → 6 B** (bits→bytes slip fix) → downstream offsets shifted (Turbovec 160→118, Energy 176→134, …), budgets re-locked (Full 154→112, Compressed 98→56), value carve now `[32,144)`. (3) `ocr::{BlockKind::entity_type, LayoutBlock::to_node_row}` + `ValueTenant::{value_offset, byte_len}` — OCR-engine-agnostic transcode. (4) causal-edge `test_build_fast` boundary `<`→`<=` (standing red on main fixed). (5) **`ENVELOPE_LAYOUT_VERSION` 1→2** — gates the value-slab offset shift (codex P2). Tests: contract 623 lib, helix 73 lib + 7 doc, causal-edge green.
+
+**Locked:** (1) **one `NodeGuid` only** — the #490-retired `identity::NodeGuid` (UUIDv8) stays retired; the keystone extends the canon `canonical_node::NodeGuid`. (2) `ReadMode::DEFAULT = {Full, CoarseOnly}` mirrors the ClassView POC default; both flip back to Bootstrap together (guard `read_mode_default_is_full_poc`). (3) **`Signed360` sign-partition** — `|y|`-in-7-bits + sign in the partition (Pos ⇒ polar [128,255], Neg ⇒ [0,127]); sign is exact at `|y|≈0` at the rim (codex P2 fix, regression test `signed360_neg_sign_survives_near_rim_at_high_total`). (4) text/bbox never bundled into the node — content store keyed by identity (I-VSA-IDENTITIES). (5) a value-slab offset shift is **version-gated, not reserved-gap** — safe pre-persistence (FULL is POC-only; codex P2 disposition).
+
+**Deferred:** ontology-side `NiblePath::from_guid_prefix` (the keystone's other half); pure-Rust OCR via `ocrs`/`rten` (the tesseract-rs C-wrapper POC was reverted — wrong direction). `TD-VALUESCHEMA-FULL-POC-DEFAULT` paired-revert note updated (ReadMode::DEFAULT pairs with ClassView).
+
+**Docs:** board `LATEST_STATE` + `TECH_DEBT` updated; this entry.
+
+**Confidence (2026-06-15):** open — both codex P2s dispositioned (ENVELOPE_LAYOUT_VERSION bump for the offset shift; Signed360 sign-partition fix + regression test); CodeRabbit's #496-vs-#498 misattribution corrected here.
+
 ## #496 integrated-cognitive-planner reference map + ValueSchema presets + FULL POC default
 
 **Status:** MERGED 2026-06-15 (merge commit `2e58e034`), branch `claude/wonderful-hawking-lodtql`. CI 5/5 green (format/clippy/linux-build/test/test-with-coverage). CodeRabbit 2 threads resolved; codex 2×P2 dispositioned (FULL-default intentional; CoarseResidue tracked as TD).

crates/helix/src/residue.rs

@@ -64,8 +64,9 @@ impl ResidueEdge {
 /// to 48 bit (6 bytes)**. Maps a signed magnitude to the FULL sphere: the
 /// unsigned hemisphere `rim` edge (rim radius + place anchor via the existing
 /// pipeline), the signed `polar` byte (the equal-area lift `y = sign·√(1 − u)`
-/// quantised, centred at 128 — `> 128` upper hemisphere, `< 128` lower, so the
-/// hemisphere sign is recoverable), and the 16-bit `azimuth` (`n·φ` wrapped to
+/// quantised as `|y|`-in-7-bits with the sign in the partition — `≥ 128` upper
+/// hemisphere, `< 128` lower, so the hemisphere sign is recoverable even at the
+/// rim where `|y| ≈ 0`), and the 16-bit `azimuth` (`n·φ` wrapped to
 /// `[0, 2π)` over the full **360°**). Wire layout (LE):
 /// `[rim.start, rim.end, rim.floor_version, polar, azimuth_lo, azimuth_hi]`.
 ///
@@ -76,8 +77,10 @@ impl ResidueEdge {
 pub struct Signed360 {
     /// Unsigned hemisphere edge (rim radius + place anchor). 3 bytes.
     pub rim: ResidueEdge,
-    /// Signed equal-area lift `y` quantised, centred at 128 (128 = equator,
-    /// `> 128` = upper hemisphere, `< 128` = lower). 1 byte.
+    /// Signed equal-area lift `y` quantised: `|y|` in 7 bits, sign in the
+    /// partition — `[128, 255]` = upper hemisphere ([`Sign::Pos`]), `[0, 127]` =
+    /// lower ([`Sign::Neg`]). The partition (not a centred-at-128 round) keeps
+    /// the sign exact even when `|y| ≈ 0` at the rim. 1 byte.
     pub polar: u8,
     /// Golden azimuth `n·φ mod 2π` mapped to `[0, 65536)` over the full 360°. 2 bytes.
     pub azimuth: u16,
@@ -173,14 +176,23 @@ impl ResidueEncoder {
     /// full-sphere residue (the doubled-hemisphere companion to
     /// [`encode`](Self::encode)). The `rim` reuses the unsigned hemisphere
     /// pipeline; `polar` carries the signed equal-area lift `y = sign·√(1 − u)`
-    /// (centred at 128, so the hemisphere sign is recoverable via
-    /// [`Signed360::sign`]); `azimuth` is the golden angle `n·φ` over the full 360°.
+    /// (`|y|`-in-7-bits + sign-partition, so the hemisphere sign is recoverable
+    /// via [`Signed360::sign`] even at the rim); `azimuth` is the golden angle
+    /// `n·φ` over the full 360°.
     pub fn encode_signed(&self, place: u64, n: usize, sign: Sign) -> Signed360 {
         let n = n.min(self.total - 1);
         let rim = self.encode(place, n);
-        // Signed equal-area lift y ∈ [−1, 1] → byte centred at 128.
+        // Signed equal-area lift y ∈ [−1, 1]. Encode |y| in 7 bits and the sign
+        // in the PARTITION (Pos ⇒ [128, 255], Neg ⇒ [0, 127]) so the hemisphere
+        // sign survives even when |y| ≈ 0 near the rim. A naive `128 + y·127`
+        // rounds a tiny negative lift up to 128, which `sign()` reads as Pos
+        // (codex P2 on #498). The partition makes the sign exact at every magnitude.
         let p = HemispherePoint::signed_lift(n, self.total, sign);
-        let polar = (128.0 + p.y * 127.0).round().clamp(0.0, 255.0) as u8;
+        let mag = (p.y.abs() * 127.0).round().clamp(0.0, 127.0) as u8;
+        let polar = match sign {
+            Sign::Pos => 128 + mag,
+            Sign::Neg => 127 - mag,
+        };
         // Golden azimuth n·φ wrapped to [0, 2π) → u16 over the full 360°.
         let az = (n as f64 * GOLDEN_RATIO).rem_euclid(core::f64::consts::TAU);
         let azimuth = ((az / core::f64::consts::TAU) * 65536.0) as u16;
@@ -347,4 +359,26 @@ mod tests {
             enc.encode_signed(0x99, 2000, Sign::Neg)
         );
     }
+
+    #[test]
+    fn signed360_neg_sign_survives_near_rim_at_high_total() {
+        // Regression for codex P2 (#498): near the rim √(1−u) → 0, so |y| ≈ 0.
+        // A centred-at-128 round mapped a negative lift to polar 128, which
+        // `sign()` reads as Pos — losing the sign. The |y|-in-7-bits + partition
+        // encoding makes Neg ⇒ polar ∈ [0, 127] for EVERY magnitude, so the sign
+        // is exact even when the lift vanishes. Large total ⇒ rim n has tiny |y|.
+        let enc = ResidueEncoder::new(65_536);
+        for n in [65_530usize, 65_534, 65_535] {
+            let neg = enc.encode_signed(0x55, n, Sign::Neg);
+            assert_eq!(
+                neg.sign(),
+                Sign::Neg,
+                "Neg must survive at the rim (n={n}, polar={})",
+                neg.polar
+            );
+            assert!(neg.polar < 128, "Neg ⇒ polar < 128 even at |y| ≈ 0");
+            // And the Pos companion stays in the upper partition.
+            assert!(enc.encode_signed(0x55, n, Sign::Pos).polar >= 128);
+        }
+    }
 }

crates/helix/tests/probe_mantissa_fill.rs

@@ -124,7 +124,11 @@ fn random_disk_points(k: usize, seed: u64) -> Vec<(f64, f64)> {
 fn probe_mantissa_fill_golden_beats_uniform_random() {
     // Three independent baseline seeds — golden must beat ALL of them on
     // BOTH metrics at BOTH sample counts; no cherry-picking.
-    const SEEDS: [u64; 3] = [0x9E37_79B9_7F4A_7C15, 0xD1B5_4A32_D192_ED03, 0x2545_F491_4F6C_DD1D];
+    const SEEDS: [u64; 3] = [
+        0x9E37_79B9_7F4A_7C15,
+        0xD1B5_4A32_D192_ED03,
+        0x2545_F491_4F6C_DD1D,
+    ];
 
     for &k in &[256usize, 1024] {
         let (g_occ, g_max) = fill_metrics(golden_points(k).into_iter());
@@ -189,7 +193,11 @@ fn probe_phase1_curve_ruler_regeneration_is_bit_exact() {
         for depth in [0u8, 1, 7, 16] {
             let a = CurveRuler::from_hhtl(path, depth);
             let b = CurveRuler::from_hhtl(path, depth);
-            assert_eq!(a.arc(), b.arc(), "regeneration drift at ({path:#x},{depth})");
+            assert_eq!(
+                a.arc(),
+                b.arc(),
+                "regeneration drift at ({path:#x},{depth})"
+            );
         }
     }
 }
@@ -207,6 +215,9 @@ fn probe_phase1_full_permutation_for_every_offset() {
             assert!(!seen[v as usize], "residue {v} repeated at place {place}");
             seen[v as usize] = true;
         }
-        assert!(seen.iter().all(|&s| s), "incomplete permutation at place {place}");
+        assert!(
+            seen.iter().all(|&s| s),
+            "incomplete permutation at place {place}"
+        );
     }
 }

crates/lance-graph-contract/src/soa_envelope.rs

@@ -44,7 +44,14 @@
 /// changes. A reader MUST refuse to decode a packet whose stamped version it
 /// does not understand (per `I-LEGACY-API-FEATURE-GATED`: layout reclaim is
 /// paired with a version gate on the serialization path).
-pub const ENVELOPE_LAYOUT_VERSION: u8 = 1;
+///
+/// - **v1** — initial canonical `NodeRow` value carve.
+/// - **v2** — `HelixResidue` value-tenant right-sized 48 B → 6 B (a bits→bytes
+///   slip fix), which shifted every downstream tenant offset (`TurbovecResidue`
+///   160→118, `Energy` 176→134, …). The offsets moved, so the version gates it:
+///   a v1 blob now refuses to decode rather than read tenants from the wrong
+///   bytes. Safe because nothing persisted under v1 (FULL is POC-only).
+pub const ENVELOPE_LAYOUT_VERSION: u8 = 2;
 
 /// The little-endian element type of one column.
 ///