plan: MUL ↔ EWA trust propagation (measure-before-carve)

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,25 @@
+## 2026-08-28 — PROPOSED (unbuilt, measure-before-carve): MUL ↔ EWA trust propagation, `.claude/plans/mul-ewa-trust-propagation-v1.md`
+
+Operator: *"check epistemic potholes > revision in kanban y rubicon model"* +
+*"check for synergies MUL <> EWA."* Session-verified state: MUL is scalar and
+point-wise (`MulAssessment`, zero variance/propagation surface); jc's EWA
+sandwich (Pillars 6/7, certified) is the workspace's lawful uncertainty
+propagation operator; `KanbanColumn::Plan = 4` (re-enter Planning carrying
+the witness) is the revision exit the propagated number would calibrate; the
+composition-legality question is ALREADY owned by jirak/pearl/ewa_sandwich
+(EPIPHANIES:12867, deferred). The plan: W0 parity-anchor an inlined 2×2
+sandwich against jc's certified output (jc stays zero-dep; probe lives in
+deepnsm-v2); W1 STOP-gate — do sandwich-propagated and naive-scalar suspicion
+rankings of real multi-hop derived beliefs DIVERGE (ρ < 0.95) and does the
+sandwich predict S4-guarded error signals better (never the
+TD-NARS-REVISION-UNGUARDED confidences — fence, not target); W2 optional
+DTO-only `Option<TrustSigma>` (no tenant carve, no layout bump, only if W1
+forces it); W3 the Commit→Plan flip-rate probe on `advance_on_gate` (the
+epistemic-pothole detector quantified, two-sided: flips concentrate on
+flagged chains AND clean chains stay silent); W4 explicit BUY / NO-BUY.
+Feeds `mul-calibration-not-verdict-v1`'s thesis with calibration data;
+renames nothing (F-MUL-6 block respected). D-MEP-0..4 on STATUS_BOARD.
+
 ## 2026-08-28 — PROPOSED (unbuilt, measure-before-carve): a token value tenant inside the 40,767-triple stream, `.claude/plans/token-value-tenant-v1.md`
 
 Operator directive: *"you might need a token value tenant inside the 40k."*

.claude/board/ISSUES.md

@@ -1,3 +1,101 @@
+## ISS-SUPERSESSION-GENERATOR-DID-RANGE-NARROW — the coverage generator reads `D-XXX-0..4` as one D-id (2026-08-28)
+
+`.claude/tools/supersession_index.py` extracts only the FIRST id from a
+plan's `D-XXX-0..N` range notation (so `D-MEP-0..4` counts as `D-MEP-0`
+alone), and its board input set excludes `.claude/board/STATUS_BOARD.md` —
+where the per-deliverable rows actually live. Net effect: a plan that writes
+its D-ids as a range gets a coverage number that cannot reflect its
+deliverables. Found by CodeRabbit on #1074.
+
+**Deliberately NOT fixed in #1074, and the reasoning is the tracked part:**
+the generator is shared by every plan in the repo and its output is CI-gated
+(`regenerate-and-diff`). Changing range expansion or the board-input set
+re-scopes EVERY other plan's coverage number in the same commit — a
+repo-wide governance change riding inside a plan-only PR, which is the
+drive-by this board's hygiene rule exists to prevent. CodeRabbit agreed with
+the scope call and recorded it as a review learning.
+
+**The fix, when it lands, needs its own PR carrying the complete before/after
+coverage diff across all plans**, so the re-scoping is visible and
+reviewable rather than a side effect. Affects every plan using range
+notation, not just `mul-ewa-trust-propagation-v1`.
+
+## ISS-TOKEN-TENANT-16-COLLIDES-WITH-HOLEV3 — `token-value-tenant-v1` (merged #1072) assigns an ordinal already reserved (2026-08-28)
+
+**BLOCKS D-TVT-2.** `.claude/plans/token-value-tenant-v1.md` §2 assigns
+`ValueTenant::Token = 16` and re-bases only `BoardAggregates` to 17. But
+`INTEGRATION_PLANS.md:653` already records **`HoleV3 = ValueTenant 16` as a
+hard blocker**, and `:726` repeats it. Two tenants claim discriminant 16 on
+`main` today. Found by a CodeRabbit review that landed AFTER #1072 merged.
+
+**Do not implement D-TVT-2 until the reservation is adjudicated.** Either
+`HoleV3` rebases, or `Token` takes the next free ordinal and
+`BoardAggregates` rebases accordingly — an operator/board call, not a
+plan-local one. Whichever way it goes, the descriptor's offset stays DERIVED
+(`value_offset()`), never a literal.
+
+**Root cause, recorded because it generalizes:** the plan verified that
+`BoardAggregates` re-bases (the *documented* reservation adjacent to the
+tenant list) and stopped there — it never swept `INTEGRATION_PLANS.md` for
+OTHER pending ordinal claims. A discriminant assignment must grep the whole
+board for the target ordinal, not just read the enum's own neighbourhood.
+
+## ISS-TVT-3-DISABLE-RUN-IS-VACUOUS — `token-value-tenant-v1`'s F-TVT-3 gate cannot fail (2026-08-28)
+
+F-TVT-3's disable-run reads: "remove the `VALUE_TENANTS` descriptor →
+`verify_layout` goes red." Measured by a codex review (post-merge):
+`NodeRowPacket::verify_layout()` inspects only the three fixed
+`NODE_ROW_COLUMNS` entries (key, edges, the whole 480-byte value slab) — it
+never walks the nested tenant descriptors, so removing one cannot turn it
+red. **The prescribed falsifier is vacuous** — the exact defect class this
+repo's own falsifiability rule exists to catch, shipped inside a plan that
+invokes that rule.
+
+Replacement when D-TVT-2 runs: assert `VALUE_TENANTS` contiguity +
+discriminant ordering + the `Full` mask directly, and disable-verify THAT.
+
+## ISS-TVT-HYDRATION-REGION-CLAIM-WRONG — the plan contradicts the code it cites (2026-08-28)
+
+`token-value-tenant-v1` W0 states `HydrationSource::from_env()` returns a
+hard `None` on a missing var and lists `AWS_DEFAULT_REGION` among the five
+required. Actual (`lance-graph-hydrate/src/env.rs:56-59`):
+`env("AWS_DEFAULT_REGION").unwrap_or_else(|| "auto".into())` — the region is
+OPTIONAL with an `"auto"` default; only key/secret/endpoint/bucket are
+required. A W0 implementation written from the plan's text would reject a
+configuration the shared hydration API intentionally supports.
+
+Also open on that plan, same review batch, lower severity: candidate B's
+continuation contract is undefined (identity, link fields, ordering,
+termination, chain-length budget); W1/W4 name no numeric thresholds; and W3's
+`mint_for` step contradicts §5's "No V1 mints, anywhere."
+
+## ISS-KANBAN-PLAN-EXIT-HAS-NO-NAMED-ROUTE — `KanbanColumn::Plan` is legal in the DAG but no routing primitive emits it (2026-08-28)
+
+Surfaced by a codex P1 on #1074 and confirmed by reading
+`contract/src/kanban.rs` at HEAD. `advance()` is documented as "the first
+non-`Prune` successor"; `Evaluation::next_phases()` is `[Commit, Plan,
+Prune]`, so `advance()` returns **`Commit`, always**. `veto()` returns
+`Prune`. `Hold` returns `None`. Therefore, **starting from `Evaluation`**,
+`advance_on_gate`'s reachable set is exactly `{Commit, Prune, None}` (from
+other phases `Flow` yields that phase's own first non-`Prune` successor —
+`Planning → CognitiveWork`, `CognitiveWork → Evaluation`, `Plan → Planning`;
+`Evaluation` is the only phase whose successors include `Plan` at all). So
+**`Plan = 4` — "re-enter Planning carrying the witness", the revision exit —
+is emitted by no named primitive**; only a caller hand-walking
+`next_phases()` can reach it.
+
+**Open question, for the operator, not for a plan to settle:** is this
+intentional Rubicon discipline (revision is a deliberate act, never a gate's
+automatic output) or an omission (`revise()` missing beside `advance()` /
+`veto()`)? Either answer is defensible; the current state is that the
+transition the kanban×Rubicon model names as its re-plan exit has no ergonomic
+route, while `Prune` — its sibling terminal — got one in D-MCAL-4.
+
+**Consequence already absorbed:** `mul-ewa-trust-propagation-v1` W3 was
+re-scoped from a "Commit→Plan flip rate" (unmeasurable) to a
+"Commit→{Hold,Prune} flip rate" before any work started. No code depends on
+this issue's resolution today.
+
 # Issues Log — Open + Resolved (double-entry, append-only)
 
 ## ISS-F-MUL-6-HALF-BUILT (2026-08-27) — OPEN

.claude/board/STATUS_BOARD.md

@@ -1,3 +1,16 @@
+## mul-ewa-trust-propagation-v1 — PROPOSED 2026-08-28 (measure-before-carve)
+
+Plan: `.claude/plans/mul-ewa-trust-propagation-v1.md`. PLAN/BOARD ONLY. W1
+is the STOP gate; NO-BUY is a valid exit at every gate.
+
+| D-id | Deliverable | Status |
+|---|---|---|
+| D-MEP-0 | jc Pillar-6/7 provers green in-checkout + inlined-sandwich parity gate (F-MEP-0 disable-verified) | Queued |
+| D-MEP-1 | information probe over real chains: scalar vs sandwich suspicion rankings, divergence + S4-guarded error prediction + shuffle null (F-MEP-1/2/3) | Queued |
+| D-MEP-2 | `Option<TrustSigma>` DTO (ONLY if W1 forces it; no tenant carve; F-MEP-4 consumer-build gate) | Queued |
+| D-MEP-3 | `advance_on_gate` Commit→{Hold,Prune} flip-rate probe, two-sided (F-MEP-5) | Queued |
+| D-MEP-4 | verdict: BUY / NO-BUY, numbers banked either way | Queued |
+
 ## token-value-tenant-v1 — PROPOSED 2026-08-28 (measure-before-carve)
 
 Plan: `.claude/plans/token-value-tenant-v1.md`. PLAN/BOARD ONLY. W1 is the

.claude/board/SUPERSESSION-INDEX.md

@@ -56,15 +56,15 @@ coverage instead.
 | `persist_cycle` | BLOCKED | — | 10 | 6 | 5 |
 | `CognitiveMarkers` | REPURPOSE | `Commit` | 2 | 0 | 0 |
 | `DominoCascade` | REPURPOSE | `Commit` | 8 | 0 | 0 |
-| `GateDecision` | REPURPOSE | — | 25 | 26 | 23 |
+| `GateDecision` | REPURPOSE | — | 25 | 27 | 24 |
 | `GateState` | REPURPOSE | — | 14 | 1 | 1 |
 | `MergeMode` | REPURPOSE | — | 8 | 12 | 11 |
 | `ResonanceDto` | REPURPOSE | `PerturbationDto` | 2 | 6 | 5 |
 | `BindSpace` | RETIRE | — | 67 | 41 | 40 |
 | `CollapseGateEmission` | RETIRE | — | 5 | 12 | 12 |
 | `ThinkingStyle` | RETIRE-toward-contract | — | 51 | 27 | 24 |
 
-## Table 2 — plans naming a ruled symbol without citing the ruling (69)
+## Table 2 — plans naming a ruled symbol without citing the ruling (70)
 
 Route is **mechanical triage, not a verdict**: `ARCHIVE?` = the plan's own status says
 it shipped; `RESCOPE` = it targets a symbol marked RETIRE; `READ` = neither signal fires
@@ -89,6 +89,7 @@ a licence to act on it.
 | **READ** | `mul-calibration-not-verdict-v1` | `GateDecision` | PROPOSAL (unbuilt) — 2026-08-26. PLAN/BOARD  | 6/12 |
 | **READ** | `mul-consumer-build-gate-v1` | `GateDecision` | GATE RUN — 2026-08-27. Discharges D-MCAL-6 a | 3/7 |
 | **READ** | `mul-consumer-census-v1` | `GateDecision` | MEASUREMENT COMPLETE — 2026-08-27. Measureme | 1/2 |
+| **READ** | `mul-ewa-trust-propagation-v1` | `GateDecision` | PROPOSED — PLAN/BOARD ONLY. Measure-before-c | 1/3 |
 | **READ** | `persistence-artifact-backed-commit-v1` | `persist_cycle` | RATIFIED (operator ruling 2026-08-09). Phase | 0/0 |
 | **READ** | `r2il-bpe-typed-genetic-recombination-v1` | `GateDecision` | PROPOSAL, §7's three falsifiers now RUN (see | 1/1 |
 | **READ** | `scientific-kg-substrate-v1` | `GateDecision` | PROPOSED — **scoping doc**, no code. Records | 8/9 |
@@ -151,5 +152,5 @@ a licence to act on it.
 
 - **ARCHIVE?**: 0
 - **RESCOPE**: 54
-- **READ**: 15
+- **READ**: 16
 - ruled symbols tracked: 14