D-GSO-7a: the reasoning band as a relational certification (P7a probe)

.claude/board/STATUS_BOARD.md

@@ -34,6 +34,7 @@ Plan: `.claude/plans/2026-10-06-global-sudoku-replayable-orchestration-v1.md`. O
 | **D-GSO-5** | P5: first recipe quartet over existing primitives | Shipped (#1355) | `cognitive-shader-driver/examples/recipe_quartet_probe.rs`: four `match`-arm recipes over `Quorum::observe`, `Quad8::fold_product`, `Morton8x8` + `PalettePerturbation::hop`, `GadamerRevision::revise` (verdict left `NotRun`: removing the new roots is tautological, so the counterfactual moves to P7); a thread-local counting allocator shows zero allocations per recipe (no instruction vector); `ProbeRecipe` is its own type, not a shipped `recipes` ID; ordinal meanings not canonized; no Pearl projection (P7) and no selector (P6); 7 tests, 6 disable runs red |
 | **D-GSO-6** | P6: deterministic, versioned recipe selector | Shipped (#1358, #1362, #1365); `observations_pending` + `frontier_bounded` wired, `new_encounter` → `revision_pending`: In PR | `cognitive-shader-driver/examples/recipe_selector_probe.rs`: `SelectorPolicy::select(state)` is a pure `const fn` over a declared 4-fact `EpistemicState`; V1 = §11 order (fold, bound, local, revise), rests only on the settled state; V2 swaps two steps (differs on 2 of 16 states); a recorded `Selection` (policy + state) replays under its own policy; every cycle rests in one step per open condition and replays identically; the version covers selection only, not recipe implementations (§13 digest open); 5 tests, 5 disable runs red. Follow-up: `new_encounter` is derived from the world (revising would still change a horizon mask; equals `revise` changing it on a 2-bit universe; rootless revisions included) and the `Revision` recipe writes `GadamerRevision`'s `delta.resulting`; dropping that write never rests; `unresolved_tension` cannot drive `local_disagreement` (never cleared); the other three facts are still stand-ins; 14 tests, 10 disable runs red. Follow-up 2: `local_disagreement` = `unresolved_tension \ interrogated`, where `interrogated` is the coverage `MooreInterrogation` writes (tension itself never cleared); a revision adding a new contradiction reopens it; dropping the interrogation write never rests; `observations_pending` and `frontier_bounded` remain stand-ins; 17 tests, 15 disable runs red. Follow-up 3: `new_encounter` renamed `revision_pending` (revising would change the horizon); `observations_pending` = arrived verdicts > verdicts the `Quorum` counted (silence included; `speaking()` would never rest on a silent source); dropping the fold write never rests; coverage stays per tension bit (new evidence on a covered bit does not reopen); `frontier_bounded` = a recorded `Quad8::fold_product` frontier exists for the current candidate space (a changed space reopens it; an empty frontier is bounded); no stand-in fact remains in the wired cycle; 25 tests, 25 disable runs red |
 | **D-GSO-7** | P7: reasoning-band earning and downgrade | Shipped (#1360) | `cognitive-shader-driver/examples/reasoning_band_probe.rs`: `ReasoningBand` (bits 61..63) read only via `band_reading::project_band`; earned one rung per executed passing proof under the shipped Pearl `CausalMask` (SO majority → Association, PO intervention trial passed → Causal, SPO removal attack passed → Counterfactual), outcomes executed from trial data and never supplied, no skipping, `NotRun` never raises; failed test, contradicting `Quorum` (minority caps at Association, majority drops to Surface) and `simpsons_paradox_risk` lower it; replay gives the same edge bits; unreadable provenance / undeclared / band-absent refuse; ladder and thresholds are policy pins; 7 tests, 10 disable runs red |
+| **D-GSO-7a** | P7a: the reasoning band as a relational certification (supersedes the meaning of D-GSO-7's rungs; #1360 unchanged) | In PR | `cognitive-shader-driver/examples/relational_certification_probe.rs`: a reading declared per class over bits 61..63 (`0 Open, 1 Associated, 2 Related, 3 Contributes, 4 CausalCandidate, 5 Causes`, 6..7 refuse; a class declared under the historical reading refuses the same bits); contracts are integer folds over unit masks + `causal_audit::SupportLedger` (2 distinct sources; the robustness mask only refutes; `Causes` = 2 distinct `InterventionBacked` sources + executed randomized arms); `entails` is an explicit table equal to `code >=` on 0..=5 only; repetition, observational effect size, the inference mantissa and confounded observational data never raise or demote past their contract; exhaustive 2,500-model family: 0 chain violations with scoped association, 10 with marginal (Simpson); sibling specificity and removal (overdetermination) are shown not to be rungs; only receipts recorded at or before the model's seal count, so a later receipt cannot change an earlier seal's replay; 13 tests, 12 disable runs red |
 | **D-GSO-8** | P8: seal boundary | Shipped (#1363) | `lance-graph-planner/examples/seal_boundary_probe.rs`: internal events change only working rows; a declared `Boundary` event freezes the changed rows with the shipped `DetachedCycleBatch::freeze` into a local ledger (no `WalSink`); an unchanged boundary writes nothing; replaying the persisted events from each prior seal reproduces the next seal exactly (frame, landings, image, hash); wrong base, dropped event and swapped order each change the seal; tie limit handled by plan option 1: the key is the event's own durable unique `seq`, a tied batch is refused, and a test shows on the real `freeze` that tied keys make the seal arrival-dependent; 6 tests, 5 disable runs red. Follow-up: `apply` refuses a `seq` not greater than the last (a reuse on one row or across seals escaped `first_tie`), `resume_after` restores the top persisted key; 7 tests, 2 more disable runs red |
 
 ## D-PLX — Population-law cross-check (2026-10-03)

.claude/board/entries/2026-10-06-reasoning-band-as-relational-certification.md

@@ -0,0 +1,44 @@
+# 2026-10-06 — D-GSO-7a: the reasoning band as a relational certification
+
+## MEASURED
+
+`crates/cognitive-shader-driver/examples/relational_certification_probe.rs`:
+13 tests, 12 disable runs red. Supersedes the **meaning** of D-GSO-7's rungs;
+`#1360`'s probe and its board row are unchanged.
+
+- **Inventory before the change.** `ReasoningBand` has no production writer
+  (`with_reasoning_band` is called only in tests and examples). No class
+  outside examples declares `BandPresence::Present`, so every production read
+  refuses. The one library reader, `dismech_counterfactual::EdgeRole`, copies
+  the band without deciding on it. The one raw ordinal comparison is
+  `reasoning_band_probe.rs`'s `cap()`, which ranks `Perspective` / `Meta` /
+  `Transcendent` above `Counterfactual`.
+- **Reading, declared per class.** Bits 61..63 =
+  `0 Open, 1 Associated, 2 Related, 3 Contributes, 4 CausalCandidate, 5 Causes`;
+  6 and 7 refuse. `ReasoningBand` is used only as the 3-bit carrier. A class
+  declared under the historical reading refuses the same bits. Working names.
+- **Order.** `entails` is an explicit table and equals `code >=` on 0..=5.
+  Historical `Meta` (6) and `Transcendent` (7) do not satisfy `Causes`.
+- **Chain vs partial order.** Exhaustive family of 2,500 two-stratum models:
+  0 implication violations with `Associated` existential over the declared
+  populations; 10 with marginal association (Contributes without it; Simpson).
+  Certified per code `[1100, 144, 610, 259, 387, 0]`.
+- `Causes` holds against a confounded observational population when the
+  randomized arms certify it, and entails the lower contracts in the trial
+  population. #1360's confounding cap would demote it.
+- Sibling specificity is not a rung: A and an equally effective sibling give
+  `Causes` while A is not discriminative against the sibling.
+- Only receipts recorded at or before the model's seal count, so a later
+  receipt cannot change what an earlier seal replays to (codex review).
+- Removal is not the causal test: under Y = A or B, removing A from a unit with
+  B leaves Y while the population trial certifies `Causes`.
+
+## OPEN
+
+- Whether the reading becomes a `band_reading` lens (contract change), and the
+  final names.
+- `CausalCandidate` carries ordering only.
+- Scoped association is only sound if strata are declared before the data
+  are read; nothing enforces that yet.
+- The robustness mask is an input; no CLAM/CHAODA mask has been run on real data.
+- Sibling and overdetermination tests are existence witnesses, not guards.

.claude/board/entries/README.md

@@ -25,7 +25,7 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-229 entries, 2026-08-06 .. 2026-10-06.
+230 entries, 2026-08-06 .. 2026-10-06.
 
 | date | entry id | finding | file |
 |---|---|---|---|
@@ -34,6 +34,7 @@ exactly one of them, never both.
 | 2026-10-06 | `D-GSO-6` |  | [2026-10-06-selector-revision-wired.md](2026-10-06-selector-revision-wired.md) |
 | 2026-10-06 | `selector-observations-wired` |  | [2026-10-06-selector-observations-wired.md](2026-10-06-selector-observations-wired.md) |
 | 2026-10-06 | `selector-local-disagreement-wired` |  | [2026-10-06-selector-local-disagreement-wired.md](2026-10-06-selector-local-disagreement-wired.md) |
+| 2026-10-06 | `D-GSO-7a` |  | [2026-10-06-reasoning-band-as-relational-certification.md](2026-10-06-reasoning-band-as-relational-certification.md) |
 | 2026-10-06 | `quack-r2il-one-evaluator-round4` |  | [2026-10-06-quack-r2il-one-evaluator-round4.md](2026-10-06-quack-r2il-one-evaluator-round4.md) |
 | 2026-10-06 | `D-MORTON-0` |  | [2026-10-06-morton8x8-checked-address.md](2026-10-06-morton8x8-checked-address.md) |
 | 2026-10-06 | `diff-plateau-as-expression-round5` |  | [2026-10-06-diff-plateau-as-expression-round5.md](2026-10-06-diff-plateau-as-expression-round5.md) |

crates/cognitive-shader-driver/Cargo.toml

@@ -97,6 +97,11 @@ test = true
 name = "reasoning_band_probe"
 test = true
 
+# D-GSO-7a relational-certification probe; tests run under `cargo test`.
+[[example]]
+name = "relational_certification_probe"
+test = true
+
 [dependencies]
 lance-graph-contract = { path = "../lance-graph-contract" }
 # Read-only ontology registry (Phase 7, v4 plan). default-features = false so the

crates/cognitive-shader-driver/examples/README.md

@@ -177,6 +177,27 @@ events replay to the same edge bits. The ladder and thresholds are policy pins.
 cargo run -p cognitive-shader-driver --example reasoning_band_probe
 ```
 
+## relational_certification_probe.rs
+
+D-GSO-7a (P7a). Replaces the meaning of the band rungs from `reasoning_band_probe`
+(#1360, which stays as shipped). Under a reading declared per class, bits 61..63
+hold the strongest relational statement the sealed model may assert:
+`0 Open, 1 Associated, 2 Related, 3 Contributes, 4 CausalCandidate, 5 Causes`;
+6 and 7 are reserved and refuse. Each contract is an integer fold over unit
+masks and a `SupportLedger`: association needs two distinct sources, the
+robustness mask can only refute, `Contributes` is a stable effect in every
+declared stratum, and `Causes` needs two distinct `InterventionBacked` sources
+plus executed randomized arms. No observational effect reaches `Causes`, the
+inference mantissa does not move the band, and the historical `Meta` /
+`Transcendent` codes do not satisfy `Causes`. An exhaustive family of 2,500
+small models shows the chain is monotone when association is scoped to the
+declared populations, and not when it is marginal (Simpson). Names and
+thresholds are policy pins.
+
+```bash
+cargo run -p cognitive-shader-driver --example relational_certification_probe
+```
+
 ## ewa_anisotropic_probe.rs
 
 D-CTX-3. Anisotropic EWA: the footprint is each virtual surfel's normalised