plan: the Waben fold execution loop — four seams, and attestation that has an author

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,41 @@
+## 2026-09-19 (1) — waben-fold-execution-loop-v1 — from the merged folds to one addressed execution loop → `.claude/plans/waben-fold-execution-loop-v1.md`
+
+**Status:** PROPOSAL. No code authorized; this is the grounded implementation
+plan for the operator-supplied Waben fold architecture, written against
+`main` `25988f3c` and ndarray `40a71ad`. The loop it sequences: project bytes
+through a named lens → fold to an address/range/runs/bounded mask → propagate
+locally on a declared six-neighbour Wabe → let the result produce the next
+focus → publish only novel alpha effects through the existing owner.
+
+Three seams, in dependency order. **A** — `Planes` (`mask-risc/src/ir.rs:50`)
+carries no version, lens or order identity, so a witnessed bound indexes a row
+order the executor never attested (`ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER`).
+**B** — `exec.rs:566` requires every scratch plane to be `words_for(n_rows)`
+and `exec.rs:540` hands that plane to `mask_set_range`, which paints the whole
+destination by contract (`simd_masking_ops.rs:1587-1588`); a range therefore
+cannot stay a range anywhere inside the IR. The tax is already measured under
+another name — D-DMD-P2's "old whole-lane buffer" control arm (34 → 4,620 ns)
+IS the production executor's behaviour. **C** (newly named) — `AlphaOverlay`
+is hash-and-row shaped (`claimed: Vec<NodeRow>`, 512 B/claim; `at:
+HashMap<NodeGuid, usize>`), so publication round-trips ordinal → GUID → hash →
+ordinal → full mask at the far end of the same loop.
+
+Dominant census finding: the loop's parts almost all exist, are tested and are
+doc-honest, and are **never assembled** — `wave_dispatch::dispatch_thought`,
+`AlphaFocus`, `StepMask`, `BatchWriter::cast` → `LanceCycleWriter`,
+`CallcenterSupervisor` and `quack::Filter::prefix_facet` each have no live
+caller outside tests. The deliverable is an ASSEMBLY, not a construction.
+
+Resolved with no new storage: **rung** = `TemporalPov.rung` (a reader's
+coordinate); **track (≤64)** = the 6-bit W-slot palette
+(`AttentionMaskEntry.w_slot`); **the six-neighbour tenant** = the second
+facet's `6 × (u8:u8)` rail plane, already in the locked LE catalogue (§3) and
+already used in that exact shape by ndarray's `hex_tenant_mq_probe`.
+
+D-ids `D-WFL-1..7`. Explicitly NOT authorized: a new carrier enum, registry or
+slab; a moving Morton aperture before a closed tile is exact; G8 (named in
+three ndarray docs, built in none); any `KanbanActor`-shaped per-cell message.
+
 ## 2026-09-18 (1) — d-diamond-1-dual-fold-substrate-v1 — can one 8×2×8-shaped carrier carry both point-peek and population-mask traversal → `.claude/plans/d-diamond-1-dual-fold-substrate-v1.md`
 
 **Status:** ACTIVE (operator-directed 2026-09-18; one probe arc; verdict fixed in

.claude/board/ISSUES.md

@@ -1,3 +1,132 @@
+## ISS-DISMECH-SEAM-INVERTED-BOTH-WAYS — the MedCare-rs bank, read (2026-09-19)
+
+The two entries below map the lance-graph and OGAR banks; this reads the
+domain consumer itself (MedCare-rs `90eb1f9`). Architecture only — no cohort
+content, no codebook, nothing private crosses into this public board.
+
+**Finding: MedCare-rs is already on the correct side of the seam in code, with
+ONE pending edge pointed at the contaminated mirror.**
+
+| edge | state | reading |
+|---|---|---|
+| `medcare-cohorts` → `ogar_dismech::{RELATIONS, CAUSES}` (`provenance.rs:357,390`; Cargo dep `ogar-dismech` from OGAR `main`) | LIVE | the falsifier is written against the REAL mint, and its own doc comment says why: a mirror could drift, the table cannot. Its `Cargo.toml:71` states the rule outright — *lance-graph stays concept-blind*. This is the direction the ruling wants, already practised |
+| `medcare-dismech` (offline bake tool, 4,074 lines) → lance-graph / OGAR | **NONE** | deps are `serde`, `serde_yaml`, `serde_json`, `flate2` only; zero consumers outside itself; five standalone binaries. It does not touch the inversion |
+| `medcare-dismech/src/bin/freeze.rs:66-70` → `lance_graph_contract::dismech_evidence::DismechTopology::from_source` | **PENDING, documented as a "known follow-up"** blocked only by a lock bump | ⊘ this would be the FIRST real consumer of the contract mirror from a domain repo — it deepens the inversion from the consumer bank the moment the lock moves. **Redirect:** the typed parse of a DisMech source token is DisMech knowledge; it belongs in `ogar-dismech`, which today exports the vocabulary (`RELATIONS`, `CAUSES`, `by_index`, `DisMechVocabulary`, `plug_into`, the search ops) but **no `from_source` typed parse** — that capability exists only in the mirror. Moving it is part of the cut, not a separate task |
+| `docs/CAUSALITY_V3_DISMECH_CONTRACT.md` | prose | already commits to the right shape: vocab in `ogar-dismech` (§7.1, :155, :440), corpus as a data artifact never compiled in, lance-graph's role limited to generic `NodeRow` / bake precedents (:932-959). It names `lance-graph-contract` as the *type* provider, not the *vocabulary* provider — consistent with the ruling |
+
+**Consequence for the resolution shape:** the cut has a third acceptance
+condition beyond the two negative/positive tests — **no consumer repo may
+acquire an edge to the mirror while it still exists.** The MedCare follow-up is
+the one known candidate; it is redirected to `ogar-dismech` (which grows the
+typed parse) rather than waiting for the mirror to vanish under it. `dismech-rs`
+itself is not a local checkout here and was not read; MedCare's plans describe
+it as the public oracle that stays boring and as the origin of `graph.rs`'s
+port — the domain bank below `ogar-dismech`, exactly where the direction puts it.
+
+## ISS-DISMECH-SEAM-INVERTED-BOTH-WAYS — resolution shape CORRECTED (2026-09-19)
+
+⊘ The entry below proposes, as step (1), *"rename the generic 80 % domain-neutral
+… plus a `pub use` shim"*. **Withdrawn.** A rename leaves the inversion
+structurally intact under a new spelling, and a `cfg`/feature flag would leave
+it intact and asleep. Neither cuts the strip. The dependency direction is the
+whole repair:
+
+```
+lance-graph      generic substrate ONLY — replay / counterfactual / mask / evidence mechanics
+     ▲  reused by
+ogar-dismech     (exists: OGAR/crates/ogar-dismech) — DisMech vocabulary, bindings, adapters
+     ▲  activated only when composed with
+dismech-rs       the disease / mechanism domain
+```
+
+**The salvage is asymmetric, per line of code:** genuinely generic → EXTRACT
+into domain-neutral lance-graph machinery (a real home, not a renamed file);
+knows anything DisMech-specific → MOVE to `ogar-dismech`; exists only because
+the two were entangled → DELETE. `lance-graph` neither knows DisMech exists nor
+carries a dormant mirror.
+
+**Measured edges, all read from the tree:** the only consumer of
+`lance_graph_contract::dismech_evidence` outside itself is
+`lance-graph-ogar/src/lib.rs:228,320,342`, which imports it *as `mirror`* to
+assert parity against `ogar_dismech::RELATIONS` — i.e. the mirror's sole
+purpose is to be compared with the thing it mirrors. That is the "just in case"
+copy, and it goes. The three planner modules have zero production consumers
+(one doc comment `cache/nars_engine.rs:490`, one example
+`examples/house_differential.rs:164`). Origin: `.claude/plans/dismech-causal-replay-v1.md`
+(D-DCR-1), which must be re-scoped or archived with the same PR.
+
+**Two acceptance tests, in this order:**
+1. **Negative:** `lance-graph` compiles, tests, documents and explains every
+   public concept with no `dismech` token in any crate under `crates/` except
+   `lance-graph-ogar` (which is the seam and may name the OGAR crate). A grep is
+   the finder; the fence test is the decider.
+2. **Positive:** `ogar-dismech` + `dismech-rs` bind onto the generic mechanics
+   **without modifying lance-graph.** If a binding needs a lance-graph change,
+   that change is a generic capability with a generic name — or the binding is
+   wrong.
+
+Generic concepts a contract MAY expose because they are lance-graph's own:
+vocabulary id, predicate ordinal, evidence stance, replay step, `CausalTopology`.
+Concepts it MUST NOT: `DISMECH_PREDICATES`, `DismechTopology`, `dismech:{name}`,
+corpus counts, `Supports` semantics — all `ogar-dismech`'s to supply.
+
+## ISS-DISMECH-SEAM-INVERTED-BOTH-WAYS
+
+**Status:** OPEN. **Filed:** 2026-09-19. **Severity:** high — a live
+bidirectional domain inversion in the thinking substrate, measured, not fixed.
+
+Present on this branch: `lance-graph-planner/src/{dismech_candidates,
+dismech_counterfactual, dismech_replay}.rs` (1,941 lines) and
+`lance-graph-contract/src/dismech_evidence.rs`. Per #1224's own measurement
+(closed, unmerged), 80 % of the planner lines are generic counterfactual-replay
+algebra under a domain filename; `dismech_candidates.rs` (394 lines, 21 domain
+refs) is genuinely domain-bound. Both directions of the inversion are therefore
+still in the tree.
+
+**Resolution shape (not yet scheduled):** (1) re-home the generic 80 % under
+domain-neutral names in the planner with no behaviour change — a rename plus a
+`pub use` shim under I-LEGACY-API-FEATURE-GATED; (2) move `dismech_candidates`
+and the evidence vocabulary to the MedCare-rs / `ogar-dismech` adapter side of
+the loco seam; (3) a fence test: no `dismech` token in `lance-graph-planner` or
+`lance-graph-contract` sources afterwards. `nan-ci-mode-v1.md` depends on the
+generic half only (its own count: zero references to `dismech_candidates`), so
+(1) must land before or with any work on that plan. **Not a #1224 revival** —
+#1224 added domain semantics; this removes them.
+
+## ISS-TWO-THINGS-ARE-NAMED-R2IL-AT-OPPOSITE-ENDS-OF-THE-LADDER
+
+**Status:** OPEN. **Filed:** 2026-09-19. **Severity:** high — this is the exact
+shape that flattened T1 and T2 earlier the same day.
+
+Two distinct things carry the name **R2IL**:
+
+1. **T3 R2IL** — `.claude/knowledge/membrane-tiers.md:24-25`: *"R2IL | emits T3
+   artifacts | T3's vocabulary (names, outcomes) | an outcome | its ceiling IS
+   T3's; door-knocker test (layer-boundary-warden)"*, listed beside the Java
+   facade, OGAR `ActionDef` and low-code. An INTENT surface.
+2. **Microcode R2IL** — `r2sleigh/crates/r2il` (a strongly-typed Ghidra-P-code
+   IL: sized varnodes, explicit address spaces, serde) and its proxy
+   `OGAR/crates/ogar-r2il` (that opcode set as an `ogar_loco::Vocabulary`, 82
+   arities, drift-tested, no `r2sleigh` dep). BEHAVIORAL microcode, far below
+   T3 — `ogar-loco/src/basin.rs:94-98` calls it "the thinking IR".
+
+Verified at OGAR `5055b06`, r2sleigh `99d2553`.
+
+**Why it must be resolved before either is built against:** a session reading
+`membrane-tiers.md` will place *any* R2IL at T3 and apply the door-knocker test
+to behavioral microcode that belongs several tiers down — or, inversely, read
+the OGAR vocabulary seam as licence for an intent surface to carry opcodes. The
+identical collision (a name used at two tiers) produced
+`E-DO-NOT-BACK-DATE-A-NEW-LAW-ONTO-AN-OLD-DOCTRINE-1`'s T1/T2 flattening hours
+earlier in this arc.
+
+**Not resolved here** — renaming either is an operator call, and both names are
+load-bearing in their own repos. What this issue does is record that the two
+exist, that they are NOT the same thing, and that any plan naming "R2IL" must
+say which one it means until one is renamed.
+
+Cross-ref: `E-A-VARNODE-IS-NOT-A-BUFFER-R2IL-IS-MICROCODE-FOR-MASKED-THINKING-1`.
+
 ## ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER (2026-09-18) — OPEN (D-DIAMOND-1, found in review of #1250)
 
 **What it is.** `Filter::prefix_facet`'s `Bound` lowering emits `Cmp::Range { lo, hi }`

.claude/board/LATEST_STATE.md

@@ -1,3 +1,23 @@
+## 2026-09-19 (1) — PRs #1249 (`bb988363`) and #1250 (`25988f3c`) merged; `main` is `25988f3c`
+
+- **#1250 — D-DIAMOND-1, verdict BOUNDED.** Ships `ordered_lane`
+  (`OrderedLaneWitness` / `SealedFacetLane` / `WitnessError`), `SemanticLens` +
+  `SemanticPrefix`, `FacetCascade::{semantic_tiles, from_semantic_tiles,
+  cmp_numeric_projection, semantic_u64_halves}`, `quack::{Cmp::Range,
+  PrefixLowering, Filter::prefix_facet}`, and the `d-diamond-1-probe` crate.
+  Contract inventory grows by the `ordered_lane` module and the two `facet`
+  types above. Full record: `PR_ARC_INVENTORY.md` 2026-09-19 #1250.
+- **#1249** was board hygiene only and is discharged by the entries it wrote
+  (CLAUDE.md § Termination clause) — no arc entry, no `LATEST_STATE` row of its
+  own beyond this line.
+- **Open, by design:** `ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER`.
+  `PrefixLowering::Bound` carries `lane_version` + `lane_digest` and nothing
+  compares them to the executed `Planes`, which carry no order identity at all.
+  Closing it is `D-WFL-1`.
+- **Queued:** the `D-WFL` arc (plan `.claude/plans/waben-fold-execution-loop-v1.md`,
+  PROPOSAL) — the assembly sequence from the merged folds to one addressed
+  execution loop.
+
 ## 2026-09-18 (3) — PR #1248 merged (`a2a51012`): `NodeRow::edges` is `EdgeFacet([u8; 16])` on `main` — no field of the 512-byte row is a native-endian integer
 
 The entry below dated 2026-09-18 (2) describes what is now on `main`, not

.claude/board/PR_ARC_INVENTORY.md

@@ -1,3 +1,38 @@
+## 2026-09-19 — lance-graph PR #1250 (merged `25988f3c`, branch `claude/d-diamond-1`) — D-DIAMOND-1: the dual fold substrate, verdict BOUNDED
+
+- **Added:** `lance_graph_contract::ordered_lane` (`OrderedLaneWitness`,
+  `SealedFacetLane`, `WitnessError`, `digest_of`, `first_inversion`);
+  `SemanticLens` + `SemanticPrefix` and `FacetCascade::{semantic_tiles,
+  from_semantic_tiles, cmp_numeric_projection, semantic_u64_halves}`;
+  `quack::{Cmp::Range, PrefixLowering, Filter::prefix_facet}`; the
+  `d-diamond-1-probe` crate (P1–P4 arms, nine falsifiers, `seal_cost` example).
+- **Corrected in-arc:** R1 — the whole-facet `shared_prefix_tiles` lens counted
+  `APP_PREFIX` before the concept, because the canon-high image stores `custom`
+  at bytes 0..2. Fixed by rotating the projection; the stored image is
+  untouched (`ISS-SHARED-PREFIX-TILES-CLASSID-INVERSION`).
+- **Measured:** P1 1.7–4.2 ns across all three whole-facet arms — #1245's
+  ~1.72 ns six-tier axis chain does NOT transfer to the 8-tile cell. P2 bound
+  ~250 ns at 1M; `touched_write` flat 20.5–23.1 ns across N=1K→4M **and**
+  across positions 500→3,999,900 at fixed width, against 34→4,620 ns for a
+  whole-lane-sized destination; 119×–707× bound+write vs sweep. P3 8,135×–8,376×
+  including `materialize_rows` (the comparable terminal), CONDITIONAL on a
+  61.2 ms/1M `JointIndex`, equal depths, `JOINT_MAX_DEPTH = 4`. P4 no reader
+  perturbation under an open writer. Seal priced: sort-from-shuffled 98.28 ms,
+  already-ordered 4.29 ms, `first_inversion` 4.45 ms, `digest_of` 19.17 ms,
+  `validate` 0.00004 ms, `verify` 23.64 ms at 1M.
+- **Locked:** storage is a content-blind ORDINAL, not an order — one physical
+  sequence is monotone under one `SemanticLens` at a time, so every order claim
+  names its lens and a lowering pairs prefix with witness only when the lenses
+  agree.
+- **Deferred:** `ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER` left OPEN by
+  design — closing it needs a substrate change (either `seal` exposes its
+  permutation, or the execution surface gains a row-order identity) in its own
+  PR. Three seal proposals (drop `digest_of` from `attest_sorted`; make
+  `attest_sorted` the documented producer path; probe a Lance-maintained
+  projection order) specified with measurements, not started.
+- **Confidence:** high on the measured region; the verdict is BOUNDED and its
+  edges are named, not hedged.
+
 ## 2026-09-18 — lance-graph PR #1248 (merged `a2a51012`, branch `claude/great-pascal-k96kok`) — `NodeRow::edges` is byte-backed: bytes are stored, integers are projected
 
 - **Added:** `lance_graph_contract::canonical_node::EdgeFacet` —