D-ALPHA-G-0 + D-WA-0: WorldG from the Alpha route; Witness × Angle as a declared local source

.claude/board/ISSUES.md

@@ -1,6 +1,6 @@
 ## ISS-MAILBOX-ROUTES-WITNESS-WITHOUT-GRAPH — `MailboxSoA` accepts same-slot edges from any graph (2026-10-06)
 
-**Status:** OPEN. **Basis:** TEST-PINNED in `cognitive-shader-driver/examples/spog_witness_probe.rs`
+**Status:** RESOLVED 2026-10-06 as not a `MailboxSoA` defect (D-ALPHA-G-0, `alpha_world_provenance_probe`): the cross-graph delivery is constructed by bypassing the Alpha split tunnel. The world is selected upstream by `SpogTenants` (route to `graph_of(addr)`, `NoTenant` for an undeclared world); `MailboxSoA` works inside an already-selected world and stays graph-blind; `apply_edges` has no production caller. Neither closing option below is taken, and no G check goes into `apply_edges`. The residue moves upstream: the attention-to-edge join does not exist yet, and when it is built it must feed mailboxes from the tunnel's per-world output, as the probe does (OPEN in the D-ALPHA-G-0 entry). The bullets below record the issue as filed. **Basis:** TEST-PINNED in `cognitive-shader-driver/examples/spog_witness_probe.rs`
 (`across_graphs_routing_diverges_from_the_spog_reading`). `MailboxSoA::apply_edges`
 compares only `edge.w_slot()` with the mailbox's slot and reads no classid.
 

.claude/board/STATUS_BOARD.md

@@ -36,7 +36,9 @@ Plan: `.claude/plans/2026-10-06-global-sudoku-replayable-orchestration-v1.md`. O
 | **D-GSO-7** | P7: reasoning-band earning and downgrade | Shipped (#1360) | `cognitive-shader-driver/examples/reasoning_band_probe.rs`: `ReasoningBand` (bits 61..63) read only via `band_reading::project_band`; earned one rung per executed passing proof under the shipped Pearl `CausalMask` (SO majority → Association, PO intervention trial passed → Causal, SPO removal attack passed → Counterfactual), outcomes executed from trial data and never supplied, no skipping, `NotRun` never raises; failed test, contradicting `Quorum` (minority caps at Association, majority drops to Surface) and `simpsons_paradox_risk` lower it; replay gives the same edge bits; unreadable provenance / undeclared / band-absent refuse; ladder and thresholds are policy pins; 7 tests, 10 disable runs red |
 | **D-GSO-7a** | P7a: the reasoning band as a relational certification (supersedes the meaning of D-GSO-7's rungs; #1360 unchanged) | Shipped (#1369) | `cognitive-shader-driver/examples/relational_certification_probe.rs`: a reading declared per class over bits 61..63 (`0 Open, 1 Associated, 2 Related, 3 Contributes, 4 CausalCandidate, 5 Causes`, 6..7 refuse; a class declared under the historical reading refuses the same bits); contracts are integer folds over unit masks + `causal_audit::SupportLedger` (2 distinct sources; the robustness mask only refutes; `Causes` = 2 distinct `InterventionBacked` sources + executed randomized arms); `entails` is an explicit table equal to `code >=` on 0..=5 only; repetition, observational effect size, the inference mantissa and confounded observational data never raise or demote past their contract; exhaustive 2,500-model family: 0 chain violations with scoped association, 10 with marginal (Simpson); sibling specificity and removal (overdetermination) are shown not to be rungs; only receipts recorded at or before the model's seal count, so a later receipt cannot change an earlier seal's replay; 13 tests, 12 disable runs red |
 | **D-GSO-AFF-0** | Affordance measurement: `CausalEdge64 × RecipeLaw[0..63] → EligibleRecipes: u64` | Shipped (#1370) | `cognitive-shader-driver/examples/affordance_measurement_probe.rs`: bits 59..63 read as one EpistemicState5 code (`spare() << 2 \| truth_raw()`, 10 declared codes, non-monotone, 22 refuse) + Pearl3; 7 recipes as `requires`/`forbids` facts + Pearl planes, compiled at build time to `[u64; 32]` × `[u64; 8]`; measure = 2 lookups + AND, 0 allocations; F1 determinism and law-generation dependence, F2 relevant factor flips its bit, F3 S/P/O/F/C/43..45/mantissa/plasticity/witness swept with no change, F4/F5 tables agree bit-for-bit with an independent rule re-derivation that names every refusal, F6/F7 preference only clears, half-field writes to 59..60 yield refusing codes; v1 / unknown provenance refuses (a v1 row with temporal 128 would read as `Causes`); no scheduler/task/capability object; 9 tests, 8 disable runs red |
-| **D-SPOG-W-0** | Witness slot as a SPOG sub-context under classid-G | In PR | `cognitive-shader-driver/examples/spog_witness_probe.rs`: SPOG view = (S/P/O blind bytes, G = `graph_of(classid)`, sub = `w_slot()` under a per-class declared reading, slot 0 = no anchor); undeclared class, another slot reading and v1 / unknown provenance refuse; G never moves with the slot; real `MailboxSoA::apply_edges` routing agrees with the reading on all 64 × 64 slot pairs within one graph and diverges across graphs (routing reads no classid; `ISS-MAILBOX-ROUTES-WITNESS-WITHOUT-GRAPH`); 0 allocations; 7 tests, 6 disable runs red |
+| **D-SPOG-W-0** | Witness slot as a SPOG sub-context under classid-G | Shipped (#1371) | `cognitive-shader-driver/examples/spog_witness_probe.rs`: SPOG view = (S/P/O blind bytes, G = `graph_of(classid)`, sub = `w_slot()` under a per-class declared reading, slot 0 = no anchor); undeclared class, another slot reading and v1 / unknown provenance refuse; G never moves with the slot; real `MailboxSoA::apply_edges` routing agrees with the reading on all 64 × 64 slot pairs within one graph and diverges across graphs (routing reads no classid; `ISS-MAILBOX-ROUTES-WITNESS-WITHOUT-GRAPH`, since resolved as a false positive by D-ALPHA-G-0: the cross-graph case bypasses the Alpha split tunnel); 0 allocations; 7 tests, 6 disable runs red |
+| **D-ALPHA-G-0** | WorldG as Alpha-route provenance, not a CE64 field | In PR | `cognitive-shader-driver/examples/alpha_world_provenance_probe.rs`: event = (Alpha-attended address, CE64); WorldG = `graph_of(addr)`, order = `SpogTenants` route (`merge_in_claim_order`); same CE64 bits in two worlds = two events; replay of the same claims recovers the world sequence with all-zero edges; changing CE64 fields never moves the world while the events change; fed from the tunnel's per-world shadows each `MailboxSoA` holds only its own deliveries through the unchanged `apply_edges`; an undeclared world is refused at the tunnel (`NoTenant`). No production caller of `apply_edges` exists, so "no mixing" is absence of a path; 5 tests, 5 disable runs red |
+| **D-WA-0** | Witness × Angle as a declared sparse local source coordinate | In PR | `cognitive-shader-driver/examples/witness_angle_probe.rs`: `(class, generation, w_slot, direction bits 43..45) → SourceCoord` under a probe-local sparse law (6 entries); same bits mean different sources in another class of the same world, in another world and in another generation; undeclared class, a class reading the bits as pathology triad or cohort `WitnessTable`, an undeclared generation, Witness 0 and v1/unknown provenance refuse; other CE64 fields never move the coordinate; world from the attended key, never the edge; 0 allocations; 7 tests, 8 disable runs red |
 | **D-GSO-8** | P8: seal boundary | Shipped (#1363) | `lance-graph-planner/examples/seal_boundary_probe.rs`: internal events change only working rows; a declared `Boundary` event freezes the changed rows with the shipped `DetachedCycleBatch::freeze` into a local ledger (no `WalSink`); an unchanged boundary writes nothing; replaying the persisted events from each prior seal reproduces the next seal exactly (frame, landings, image, hash); wrong base, dropped event and swapped order each change the seal; tie limit handled by plan option 1: the key is the event's own durable unique `seq`, a tied batch is refused, and a test shows on the real `freeze` that tied keys make the seal arrival-dependent; 6 tests, 5 disable runs red. Follow-up: `apply` refuses a `seq` not greater than the last (a reuse on one row or across seals escaped `first_tie`), `resume_after` restores the top persisted key; 7 tests, 2 more disable runs red |
 
 ## D-PLX — Population-law cross-check (2026-10-03)

.claude/board/entries/2026-10-06-alpha-world-provenance-and-witness-angle.md

@@ -0,0 +1,71 @@
+# 2026-10-06 — D-ALPHA-G-0 + D-WA-0: WorldG from the Alpha route; Witness × Angle as a declared local source
+
+## VERIFIED-IN-CODE — inventory (main @ 705509fe)
+
+1. **Where WorldG is selected.** `lance_graph_contract::spog_tenants`:
+   `graph_of(addr) = classid >> 16` (`spog_tenants.rs:41`) and
+   `SpogTenants::claim` (`:167`), which routes an attended address to the tenant
+   of its world and returns `TenantClaim::NoTenant` for an undeclared one.
+   `AlphaTunnel` (`alpha_tunnel.rs`) is the same split tunnel keyed by rung, not
+   by world.
+2. **What preserves G across the saccade.** Every claimed row keeps the base
+   row's `NodeGuid` byte-for-byte (`alpha.rs` `claim`), so the world is in the
+   attention record. `SpogTenants::route` records the world of each fresh claim;
+   `merge_in_claim_order` replays the saccade in time.
+3. **Can two worlds feed one `MailboxSoA` in production?** No path exists:
+   `MailboxSoA::apply_edges` has no production caller (only its own tests and
+   the probes). The driver's mailbox backing expects at most one designated
+   mailbox (`debug_assert` under `mailbox-thoughtspace`, `driver.rs:208`;
+   multi-mailbox routing is the unbuilt W5). Nothing connects `SpogTenants` or
+   `AlphaTunnel` to a mailbox.
+4. **#1371's divergence** is constructible only, by handing a foreign-world edge
+   to `apply_edges` directly.
+5. **Where the split tunnel is tested.** `alpha_tunnel.rs` (parallel ==
+   sequential, byte-identical; cross-rung revisit counting) and
+   `spog_tenants.rs` (tenant isolation, claim-order replay).
+6. **Saccade provenance exists:** `AlphaStamp` (cycle, seq, rung, visits) plus
+   `SpogTenants::route`.
+7. **G recoverable on replay without CE64:** yes, from the attended key and the
+   route.
+8. **16-byte hosts for an explicit row-local SPOG later:** `Register128`
+   (classid-free, meaning from the resolved SPOG context), the 4 + 12
+   `FacetCascade` (also the edge block), `Quad8`. None carries a LocalG today.
+9. **Odoo/ERP LocalG:** none at runtime. `company_id` exists only as a
+   blueprint field (`odoo_blueprint/l3.rs`); the Odoo hydrator keys an OWL
+   context bundle by namespace.
+10. **Witness (53..58) and bits 43..45** are disjoint and readable together
+    without moving bits. Both already have shipped readings that must refuse a
+    new one: bits 43..45 = pathology triad (`direction()`), bits 53..58 =
+    cohort `WitnessTable` index (`witness_table.rs`, not wired).
+
+## MEASURED
+
+- `alpha_world_provenance_probe.rs`: 5 tests, 5 disable runs red (world read
+  from the edge, grouped merge instead of the route, all deliveries to one
+  mailbox, a mixed received count, `NoTenant` accepted). The first mailbox
+  disable came back green; the test now reads each mailbox's own
+  `plasticity_at` counts. After review (#1372) the mailbox deliveries are built
+  from the tunnel's per-world shadows (`tenant(w).scanpath()`), not routed by
+  the test; feeding both mailboxes from one shadow fails it.
+- `witness_angle_probe.rs`: 7 tests, 8 disable runs red (law ignores class,
+  ignores generation, reading check off, generation check off, Witness 0
+  accepted, v1 accepted, Angle read from other bits, law keyed by world instead
+  of class); 0 allocations. The world-keyed disable needed a second
+  source-coordinate class in the same world, added after review (#1372).
+
+## RESOLVED
+
+`ISS-MAILBOX-ROUTES-WITNESS-WITHOUT-GRAPH`: not a `MailboxSoA` defect.
+`MailboxSoA` stays graph-blind; no G check in `apply_edges`. The residue is the
+unbuilt join below.
+
+## OPEN
+
+- Where production will join an attended address to the CE64 it produced: no
+  caller does this yet, so the event pairing exists only in the probe. When
+  built, it must feed mailboxes from the tunnel's per-world output (the probe's
+  `tenant(w).scanpath()` shape), never by re-deriving the world itself.
+- Whether `graph_of` is the right WorldG granularity for every consumer.
+- Whether the Witness × Angle declaration (and the D-SPOG-W-0 one) becomes a
+  contract declaration beside `band_reading`.
+- LocalG (row-local SPOG G in a 16-byte register): not modelled.

.claude/board/entries/README.md

@@ -25,7 +25,7 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-232 entries, 2026-08-06 .. 2026-10-06.
+233 entries, 2026-08-06 .. 2026-10-06.
 
 | date | entry id | finding | file |
 |---|---|---|---|
@@ -41,6 +41,7 @@ exactly one of them, never both.
 | 2026-10-06 | `diff-plateau-as-expression-round5` |  | [2026-10-06-diff-plateau-as-expression-round5.md](2026-10-06-diff-plateau-as-expression-round5.md) |
 | 2026-10-06 | `dav-resident-reading-round2` |  | [2026-10-06-dav-resident-reading-round2.md](2026-10-06-dav-resident-reading-round2.md) |
 | 2026-10-06 | `dav-carrier-invariance-quack` |  | [2026-10-06-dav-carrier-invariance-quack.md](2026-10-06-dav-carrier-invariance-quack.md) |
+| 2026-10-06 | `D-ALPHA-G-0` |  | [2026-10-06-alpha-world-provenance-and-witness-angle.md](2026-10-06-alpha-world-provenance-and-witness-angle.md) |
 | 2026-10-06 | `D-GSO-AFF-0` |  | [2026-10-06-affordance-measurement.md](2026-10-06-affordance-measurement.md) |
 | 2026-10-05 | `text-to-numeric-boundary-inventory` |  | [2026-10-05-text-to-numeric-boundary-inventory.md](2026-10-05-text-to-numeric-boundary-inventory.md) |
 | 2026-10-05 | `report-pair-key-and-stack-recon` |  | [2026-10-05-report-pair-key-and-stack-recon.md](2026-10-05-report-pair-key-and-stack-recon.md) |

crates/cognitive-shader-driver/Cargo.toml

@@ -112,6 +112,16 @@ test = true
 name = "spog_witness_probe"
 test = true
 
+# D-ALPHA-G-0 WorldG-as-Alpha-route provenance probe; tests run under `cargo test`.
+[[example]]
+name = "alpha_world_provenance_probe"
+test = true
+
+# D-WA-0 Witness x Angle declared local source coordinate probe; tests run under `cargo test`.
+[[example]]
+name = "witness_angle_probe"
+test = true
+
 [dependencies]
 lance-graph-contract = { path = "../lance-graph-contract" }
 # Read-only ontology registry (Phase 7, v4 plan). default-features = false so the

crates/cognitive-shader-driver/examples/README.md

@@ -222,12 +222,42 @@ inside G only for classes that declare that reading (slot 0 = no anchor), and
 S/P/O passed through as blind bytes. Undeclared classes, another reading of the
 slot, and v1 / unknown provenance refuse. Compared with the real
 `MailboxSoA::apply_edges` routing: they agree on all 64 × 64 slot pairs within
-one graph and diverge across graphs, because routing reads no classid.
+one graph and diverge across graphs, because routing reads no classid. That
+cross-graph case bypasses the Alpha split tunnel and is not a production path
+(D-ALPHA-G-0 below).
 
 ```bash
 cargo run -p cognitive-shader-driver --example spog_witness_probe
 ```
 
+## alpha_world_provenance_probe.rs
+
+D-ALPHA-G-0. WorldG is attention provenance carried by the Alpha route, not a
+CausalEdge64 field. An event is (Alpha-attended address, edge); WorldG is
+`graph_of(addr)` and the order of worlds is the `SpogTenants` route. The same
+edge bits in two worlds are two events; replaying the same claims recovers the
+world sequence with all-zero edges; changing edge fields never moves the world.
+Partitioned by recovered world, each `MailboxSoA` receives only its own
+deliveries through the unchanged `apply_edges`; an undeclared world is refused
+at the tunnel.
+
+```bash
+cargo run -p cognitive-shader-driver --example alpha_world_provenance_probe
+```
+
+## witness_angle_probe.rs
+
+D-WA-0. Witness (`w_slot`) × Angle (bits 43..45) as a declared, sparse local
+source coordinate under a per-class, versioned probe law. The same raw pair
+means different sources in another class and another generation; classes
+reading those bits as the pathology triad or a cohort `WitnessTable` refuse, as
+do undeclared classes and generations, Witness 0 and v1 / unknown provenance.
+The world comes from the attended key, never from the edge.
+
+```bash
+cargo run -p cognitive-shader-driver --example witness_angle_probe
+```
+
 ## ewa_anisotropic_probe.rs
 
 D-CTX-3. Anisotropic EWA: the footprint is each virtual surfel's normalised