D-TEH-1: move bridge_gate to lance-graph-contract; callcenter drops its thinking-engine dependency

.claude/board/LATEST_STATE.md

@@ -1,3 +1,11 @@
+## 2026-09-02 — branch (D-TEH-1, first code wave after #1138): `bridge_gate` moved to the contract — CONTRACT INVENTORY DELTA
+
+- ADDED `lance_graph_contract::bridge_gate` — the cross-tenant authorization injection point, moved from `thinking_engine::bridge_gate` with all seven public items together and identical shapes: `CognitiveOpKind` (4 variants, `repr(u8)`), `CognitiveAuthResult { Allow, Deny, Escalate }` + `is_allowed/is_denied`, `CognitiveBridgeError { Denied, Escalation }`, `auth_to_result`, the `CognitiveBridgeGate: Send + Sync` trait (3 sync methods), `PassthroughGate`, `DenyAllGate`. Zero-dep (std only). Its 9 unit tests moved with it; the engine-side `pure_ops_dont_touch_gate` stays in thinking-engine next to the lens modules it calls.
+- `thinking_engine::bridge_gate` is now a `pub use lance_graph_contract::bridge_gate::{…}` re-export (migration-wave compatibility; every old path still resolves).
+- MEASURED dependency edge, before → after: `lance-graph-callcenter` → `thinking-engine` was a REQUIRED path dep used at 6 sites (2 production imports of 3 symbols, 4 test-only lens lookups); dropping the line alone failed with 6 × E0433. After the move the dep line is gone, `cargo metadata` lists no thinking-engine dependency for callcenter, and the crate builds + 156 tests pass. The remaining production consumer of `thinking-engine` in the workspace is `cognitive-shader-driver`'s OPTIONAL `with-engine` feature (the ALU's engine hook) — untouched, builds green with and without the feature.
+- UNCHANGED (verified by empty diff): `thinking-engine/src/dto.rs`, `cognitive-shader-driver/src/engine_bridge.rs`, `contract/src/cognitive_shader.rs`, `mailbox_soa.rs`, driver `Cargo.toml` — the ALU artery and its DTO bus are byte-identical.
+- NOT DONE, by stop condition: re-pointing the driver's `with-engine` edge waits on D-TTV-1 (Queued) — today the engine hook still lives in thinking-engine, so there is nothing to re-point it at.
+
 ## 2026-09-02 — branch (D-POP-1 result): PROBE-POP-READOUT-1 — INVENTORY DELTA
 
 - ADDED `crates/deepnsm-v2/examples/pop_readout.rs` — the D-POP-1 probe (no library surface, no new type, no tenant). Consumes `Cam96Space::distance`, `basin_self_code`, `partial_spearman` and `lance_graph_contract::exploration::{FrontierEdge, NarsTruth}`; produces a KILL verdict plus three side-findings (plan §6a).

.claude/board/PR_ARC_INVENTORY.md

@@ -10,6 +10,15 @@
 > census §8.3 trap 10: read the body FIRST, then open for write — never
 > inline both in one expression.
 
+## 2026-09-02 — lance-graph branch `claude/medcare-rs-continue-6nhbxn` (D-TEH-1 PR, after #1138) — `bridge_gate` → contract; callcenter drops its thinking-engine dependency
+
+- **Added:** `crates/lance-graph-contract/src/bridge_gate.rs` (seven items + 9 tests, moved not re-derived); `pub mod bridge_gate` in the contract lib; `thinking_engine::bridge_gate` as a re-export shim keeping `pure_ops_dont_touch_gate` engine-side.
+- **Changed:** callcenter imports (2 sites) → `lance_graph_contract::bridge_gate`; `pure_ops_emit_zero_audit_events` rewritten over the crate's own gate-free helpers (`prefetch_from_u8` all depths, `auth_to_result` all verdicts, predicates) with the real sink + counter still asserted at zero; callcenter `Cargo.toml` dep line removed; three doc comments.
+- **Measured:** before = required path dep, 6 crossing sites, dep-drop alone fails 6 × E0433; after = zero thinking-engine deps in callcenter metadata, contract 1303/1303, callcenter 156/156, driver default + `with-engine` green, thinking-engine lib green + shim test 1/1, clippy `-D warnings` clean on both touched crates, fmt clean.
+- **Locked:** the ALU artery untouched (empty diff on `dto.rs`, `engine_bridge.rs`, `cognitive_shader.rs`, `mailbox_soa.rs`, driver manifest).
+- **Deferred:** step 6 (re-point `with-engine`) — stop condition: D-TTV-1 has not landed, the engine hook is still in thinking-engine. D-TEH-2..5, D-HOUSE-1, D-ARW not started.
+- **Confidence:** High.
+
 ## 2026-09-02 — lance-graph branch `claude/medcare-rs-continue-6nhbxn` (rulings PR, after #1137) — closure-plan rulings 1, 2, 4 recorded; ruling 3 re-stated
 
 - **Added:** EPIPHANIES `E-JC-IS-THE-HOME-OF-ALL-CALIBRATED-MATH-1`; closure

.claude/board/STATUS_BOARD.md

@@ -18,7 +18,7 @@
 | D-id | deliverable | status |
 |---|---|---|
 | D-TEH-0 | census: live footprint measured (one required consumer via `bridge_gate`; one optional via `with-engine`), 51-file fate table, open-row reconciliation, four-wave closure, idea harvest, four rulings asked | **Shipped (plan-only, this PR)** |
-| D-TEH-1 | W1: `bridge_gate` trait → `lance-graph-contract`; callcenter drops the path dep; DTO-ladder home ruling recorded (D-TTV-1); thinking-engine becomes a leaf | Queued — first code wave |
+| D-TEH-1 | W1: `bridge_gate` (seven items) → `lance_graph_contract::bridge_gate`; callcenter re-imports and drops the path dep; thinking-engine keeps a re-export shim | **Shipped 2026-09-02** (before: required dep, 6 crossing sites, dep-drop alone fails 6 × E0433; after: zero thinking-engine deps in callcenter metadata, contract 1303/1303, callcenter 156/156, driver default + `with-engine` green, ALU artery files byte-identical). `with-engine` re-point deferred by stop condition: D-TTV-1 not landed |
 | D-TEH-2 | W2: ghost prior → planner `nars/ghost_prior.rs` over `WisdomMarker`, per-thought, two-sided falsifiers; crate `ghosts.rs` deleted | Queued — consumer D-HOUSE-4 |
 | D-TEH-3 | W2: calibration MATH → `jc` (ruling 4, 2026-09-02: lift if correct, perfect in jc if not; crate copies die); glue stays in the lab crate; `semantic_chunker` / `spiral_segment` decided by their falsifiers | Queued |
 | D-TEH-4 | W3: ENTROPY M8 engine collapse with dtype parity suite; 5 cascade shapes + 3 lens modules collapse | Queued |

.claude/plans/thinking-engine-harvest-closure-v1.md

@@ -164,7 +164,7 @@ Each wave lands only with its gate green; no wave ports without a consumer.
 | wave | content | gate |
 |---|---|---|
 | **W0 (this PR)** | census, fate table, row regrades, idea harvest (§4) | boards consistent; SUPERSESSION-INDEX regenerated |
-| **W1 — cut the hard dependency** | move `bridge_gate` trait + gates to `lance-graph-contract` (trait-only, zero-dep); callcenter re-imports; decide the DTO-ladder home (D-TTV-1 ruling) so the driver's `with-engine` feature can point at it | `lance-graph-callcenter` builds with no thinking-engine path dep; driver `with-engine` still green; thinking-engine becomes a LEAF |
+| **W1 — cut the hard dependency** | move `bridge_gate` trait + gates to `lance-graph-contract` (trait-only, zero-dep); callcenter re-imports; the `with-engine` re-point follows D-TTV-1 (the DTO home itself is ruled — §6.3) | **DONE 2026-09-02 (D-TEH-1)** for the hard edge: `lance-graph-callcenter` builds with no thinking-engine path dep; driver `with-engine` still green; thinking-engine is a LEAF for required edges. The `with-engine` re-point stays open until D-TTV-1 lands the engine hook |
 | **W2 — harvest gems with consumers** | ghost prior → planner `nars/ghost_prior.rs` (D-TEH-2, consumer D-HOUSE-4); the MATH of the calibration battery → `jc` per ruling 4 (`cronbach` compared then lifted-or-perfected; Spearman, re-encode drift, SiLU-correction statistics likewise); `semantic_chunker` → deepnsm-v2 only if its falsifier passes; `spiral_segment` → codec home via certification battery | each port has a two-sided falsifier + a disable run; each source file deleted in the same PR |
 | **W3 — M8** | one enum-dispatched engine; the 5 cascade shapes and 3 lens modules collapse; parity suite across u8/BF16/i8/f32 | NOT bit-parity across dtypes — u8 / BF16 / i8 / f32 differ in encoding by design, and `dual_engine.rs` exists to MEASURE that disagreement (Codex on #1137). Gate: per-dtype output tolerances plus dtype-invariant ranking/convergence invariants (top-k order, `converged`, `cycle_count` bounds) on real engine fixtures that instantiate all four engines (the driver's fixtures do not — they round-trip `BusDto` only); the pre-collapse `DualResult` disagreement is the baseline the collapsed engine must not exceed; the `branching` spawn shape kept as a mode, not lost |
 | **W4 — retire and rename** | delete RESIDUE (1e) + retired persona A2A; rename what is left (GLUE only, all math already in jc) `thinking-lab` (calibration feature, `--manifest-path` CI line); regrade every row in §2; pay `TD-THINKING-ENGINE-EXCLUDED-DEBT-1` | the name `thinking-engine` no longer appears in any `Cargo.toml` dependency; board rows closed or re-owned |
@@ -205,7 +205,7 @@ harvest and not an amputation.
 | D-id | title | scope | status |
 |---|---|---|---|
 | D-TEH-0 | census + fate table + open-row reconciliation + idea harvest (this plan) | plan + board rows | Shipped (this PR) |
-| D-TEH-1 | W1: `bridge_gate` trait → contract; DTO-ladder home ruling recorded; thinking-engine becomes a leaf | contract + callcenter (+ driver feature pointer) | Queued — first code wave |
+| D-TEH-1 | W1: `bridge_gate` (seven items) → `lance_graph_contract::bridge_gate`; callcenter re-imports and drops the path dep; thinking-engine keeps a re-export shim | contract + callcenter | **Shipped 2026-09-02** — edge measured before (required dep, 6 crossing sites, dep-drop fails 6 × E0433) and after (zero thinking-engine deps in callcenter metadata; 1303 + 156 tests, driver default + `with-engine` green). The `with-engine` re-point is NOT part of this wave: D-TTV-1 is Queued and the engine hook still lives in thinking-engine, so there is nothing to re-point it at (stop condition honoured). thinking-engine is now a leaf for every REQUIRED edge; the one remaining edge is the ALU's optional engine hook |
 | D-TEH-2 | W2: ghost prior harvested as planner `nars/ghost_prior.rs` over `WisdomMarker`, per-thought, with two-sided falsifiers; crate `ghosts.rs` deleted | planner | Queued — consumer = D-HOUSE-4 |
 | D-TEH-3 | W2: calibration MATH → jc (ruling 4: compare, then lift or perfect in jc; crate copies deleted); `semantic_chunker` / `spiral_segment` decided by their falsifiers | jc / deepnsm-v2 / codec home | Queued |
 | D-TEH-4 | W3: M8 engine collapse with parity suite; cascade shapes and lens modules collapse | thinking-engine → the one engine | Queued (owns ENTROPY M8) |

crates/lance-graph-callcenter/Cargo.toml

@@ -12,10 +12,8 @@ build = "build.rs"
 lance-graph-contract = { path = "../lance-graph-contract" }
 # D-SDR-4b audit sinks — always available for the trait + CompositeSink
 log = "0.4"
-# PR-F1 — CognitiveBridgeGate: UnifiedBridgeGate wraps UnifiedBridge and
-# implements the trait from thinking-engine. Direction: callcenter → thinking-engine.
-# The reverse dep (thinking-engine → callcenter) is forbidden to avoid circular deps.
-thinking-engine = { path = "../thinking-engine", default-features = false }
+# PR-F1 — CognitiveBridgeGate: UnifiedBridgeGate implements the gate trait from
+# lance-graph-contract::bridge_gate (D-TEH-1 moved it there; no thinking-engine dep).
 # D-CASCADE-V1-3 — bridge collapse: factories project from the canonical SoA.
 lance-graph-ontology = { path = "../lance-graph-ontology" }
 # D-SDR-1 (super-domain-rbac-tenancy-v1 §3.9 + §13.1) — UnifiedBridge composes

crates/lance-graph-callcenter/src/cognitive_bridge_gate.rs

@@ -1,7 +1,8 @@
 //! `UnifiedBridgeGate<B>` — production `CognitiveBridgeGate` impl.
 //!
 //! Wraps a `UnifiedBridge<B>` and implements `CognitiveBridgeGate` from
-//! `thinking-engine::bridge_gate`. Cross-tenant ops are authorized through
+//! `lance_graph_contract::bridge_gate` (moved there from `thinking-engine`
+//! by D-TEH-1; the engine re-exports the same items). Cross-tenant ops are authorized through
 //! the existing `UnifiedBridge::authorize_read` / `authorize_act` paths,
 //! which already emit `UnifiedAuditEvent` via the `AuditChain` (D-SDR-5).
 //!
@@ -42,10 +43,12 @@ use lance_graph_contract::property::PrefetchDepth;
 use lance_graph_ontology::bridge::NamespaceBridge;
 
 use crate::unified_bridge::UnifiedBridge;
-use thinking_engine::bridge_gate::{CognitiveAuthResult, CognitiveBridgeGate, CognitiveOpKind};
+use lance_graph_contract::bridge_gate::{
+    CognitiveAuthResult, CognitiveBridgeGate, CognitiveOpKind,
+};
 
 // ═══════════════════════════════════════════════════════════════════════════
-// PrefetchDepth helper — avoids exposing lance-graph-contract in thinking-engine
+// PrefetchDepth helper — keeps the gate trait's `depth: u8` free of the PrefetchDepth type
 // ═══════════════════════════════════════════════════════════════════════════
 
 /// Map the `depth: u8` passed through `CognitiveBridgeGate::authorize_retrieval`
@@ -194,7 +197,9 @@ mod tests {
     use crate::super_domain::SuperDomain as SD;
     use crate::unified_audit::UnifiedAuditEvent;
     use crate::unified_bridge::{TenantId, UnifiedBridge};
-    use thinking_engine::bridge_gate::{CognitiveAuthResult, CognitiveBridgeGate, CognitiveOpKind};
+    use lance_graph_contract::bridge_gate::{
+        CognitiveAuthResult, CognitiveBridgeGate, CognitiveOpKind,
+    };
 
     // ── StubBridge (mirrors unified_bridge tests) ────────────────────────────
 
@@ -454,9 +459,17 @@ mod tests {
         assert_eq!(gate.chinese_wall_deny_count(), 1);
     }
 
-    /// Pure cognitive ops (encode, qualia compute, distance lookup) do NOT call
-    /// the gate. Verified by the absence of any chinese_wall increment and the
-    /// zero-overhead passthrough in thinking-engine standalone mode.
+    /// Pure ops do NOT call the gate, so they emit no audit event and no
+    /// Chinese-wall increment. The pure ops exercised here are this crate's
+    /// own gate-free helpers (`prefetch_from_u8` over every depth,
+    /// `auth_to_result` over every verdict, the verdict predicates) — none of
+    /// them touches `UnifiedBridgeGate`. The engine-side half of the same
+    /// claim (codebook / distance lookups never reach the gate) lives in
+    /// `thinking-engine::bridge_gate::tests::pure_ops_dont_touch_gate`, next
+    /// to the lens modules it calls; D-TEH-1 removed this crate's path
+    /// dependency on that engine, so its lens functions are not called here.
+    /// The gate object is constructed so the assertion measures a REAL sink
+    /// and a REAL counter, not the absence of a gate.
     #[test]
     fn pure_ops_emit_zero_audit_events() {
         let sink = Arc::new(RecordingSink::default());
@@ -470,11 +483,16 @@ mod tests {
             );
         let gate = UnifiedBridgeGate::new(unified);
 
-        // Pure codebook lookups — gate never called.
-        let _ = thinking_engine::jina_lens::jina_lookup(42);
-        let _ = thinking_engine::jina_lens::jina_distance(0, 1);
-        let _ = thinking_engine::bge_m3_lens::bge_m3_lookup(100);
-        let _ = thinking_engine::reranker_lens::reranker_lookup(500);
+        // Pure helpers — the gate object exists but is never consulted.
+        use lance_graph_contract::bridge_gate::auth_to_result;
+        for depth in 0u8..=4 {
+            let _ = prefetch_from_u8(depth);
+        }
+        assert!(auth_to_result(CognitiveAuthResult::Allow).is_ok());
+        assert!(auth_to_result(CognitiveAuthResult::Deny).is_err());
+        assert!(auth_to_result(CognitiveAuthResult::Escalate).is_err());
+        assert!(CognitiveAuthResult::Allow.is_allowed());
+        assert!(CognitiveAuthResult::Escalate.is_denied());
 
         assert_eq!(sink.count(), 0, "pure ops must emit zero audit events");
         assert_eq!(gate.chinese_wall_deny_count(), 0);

crates/lance-graph-callcenter/src/lib.rs

@@ -213,7 +213,8 @@ pub use savant_reasoners::{
 
 // PR-F1 — UnifiedBridgeGate<B>: production CognitiveBridgeGate impl.
 // Wraps UnifiedBridge<B>; Chinese-wall check fires before policy evaluation
-// on cross-tenant ops (§3.8). No dep on thinking-engine from thinking-engine.
+// on cross-tenant ops (§3.8). The gate trait lives in lance-graph-contract
+// (D-TEH-1); this crate has no dependency on thinking-engine.
 pub mod cognitive_bridge_gate;
 pub use cognitive_bridge_gate::UnifiedBridgeGate;