board: §F corrected a third time (ten LANES over one reservation) + D-ARW tracking restored

.claude/board/EPIPHANIES.md

@@ -1,3 +1,67 @@
+## 2026-08-31 — E-A-CORRECTION-CAN-SUBSTITUTE-ONE-WRONG-NOUN-FOR-ANOTHER-1 — three readings of one mechanism, and the source named itself the whole time
+
+**Status:** FINDING (verified against source at `cc0046f8`; every claim carries
+`file:line`).
+**Confidence:** High — the mechanism is in-tree and self-describing.
+**Corrects:** `.claude/plans/rubicon-loco-rung-cognitive-fabric-v1.md` §F.1
+(see §F.6 there for the full account).
+
+**The shape of the failure.** One mechanism, three readings by this session,
+two of them wrong — and the second wrong one was produced *by the correction
+of the first*:
+
+| reading | verdict |
+|---|---|
+| ten residual deltas sharing a 480-byte value slab | wrong — withdrawn |
+| ten rows / ten tables at one address | **wrong — corrected here** |
+| ten lanes over ONE `AlphaAllocation` | correct (`contract/src/alpha_tunnel.rs:73-89`) |
+
+`AlphaTunnel` holds `lanes: Vec<AlphaOverlay<'a>>` and constructs them by
+mapping `(0..LEVELS)` over a single borrowed allocation; `LEVELS = 10`
+(`contract/src/rung_schedule.rs:59`). One lane costs one empty `Vec`
+(`alpha_tunnel.rs:25-27`). The module states the prohibition outright: ten
+lanes must not mean ten address sets, because reserving is defined as costing
+zero rows and ten copies of the address set would make "reserve" cost ten
+times nothing (`:22-24`, restated from the allocation's side at
+`alpha.rs:454-456`).
+
+**"Split tunnel" was never a budget or a table count.** It names a *read/write
+path split*: reads go to the baked spine, shared across all ten lanes without
+a lock because `&[NodeRow]` may be shared; writes go to the overlay at the
+same addresses, and that direction is a compile-time property rather than a
+runtime check (`alpha_tunnel.rs:12-18`). Neither earlier reading contained
+this at all, though it is what the two words literally say.
+
+**Two things checked rather than assumed, both of which cut against the
+convenient conclusion:**
+
+1. **The persistence half did not migrate.** `alpha.rs:1-5` records that the
+   Arrow/Lance storage glue deliberately stayed with the storage crate; what
+   moved is the pure overlay algebra over contract types. So `lance-graph` can
+   now *express* a rung stamp and still cannot *persist* one — the prior
+   entry's persistence table remains accurate as a statement about this repo.
+2. **`D-ACR-3`'s blocker survives.** A landed write path looks like it should
+   unblock it. `mailbox_owner()` still has zero callers outside its own
+   module; the only occurrence elsewhere in `crates/` is a doc-comment mention
+   at `alpha_tunnel.rs:33`. The tunnel enforces one-writer *structurally* via
+   per-lane `&mut` (`:29-38`), not through the mailbox-ownership machinery
+   `D-ACR-3` exists to test.
+
+**The rule, which is what outlives the specific mistake.** A correction that
+swaps one English noun for another has not necessarily moved closer to the
+truth — it has produced a second guess with the authority of a correction.
+Both wrong readings here described a *shape* ("deltas", "rows") without ever
+naming the *type*. The mechanism had a name, a definition, and a module doc
+arguing its own design, and none of the three was cited until the third pass.
+**When correcting a claim about a mechanism, cite the type's definition; do
+not re-describe its shape.** Fence: `F-RLR-12` in the plan.
+
+**Timeline worth keeping**, because it shows the audit was load-bearing rather
+than academic: the sibling-repo implementation was found 2026-08-29
+(`E-A-RUNG-WRITE-PATH-ALREADY-SHIPPED-IN-A-SIBLING-REPO-1`, below); #1112
+migrated it into the contract on 2026-08-31 as the substrate default. The
+audit's own second correction was published one day before the thing it
+described moved.
 ## 2026-09-03 — E-THE-ENTROPY-HOME-WAS-RULED-AND-LEFT-EMPTY-1 — the D-DCR-4 gate measured seven entropy surfaces: the consolidation target already exists by operator ruling, has zero consumers, and is NOT a drop-in for the caller nearest to it
 
 **Status:** FINDING (measured, `lance-graph-planner/examples/entropy_surface_census.rs`, two disable-runs red-then-green). **Confidence:** High for the three measured claims; the six transcribed forms are only as current as their cited `file:line`.

.claude/board/STATUS_BOARD.md

@@ -32,6 +32,26 @@
 | D-POP-1 | PROBE-POP-READOUT-1: composed population readout (Cam96 centroid distance → Fisher-z → occupancy bucket) vs `curiosity` / `curiosity_gestalt` at predicting later-confirmed frontier edges on the KJV stream; size-preserving shuffle null; PASS/KILL pre-registered in plan §6 | **Shipped — VERDICT KILL** (`pop_readout.rs`, 2026-09-02; `E-QUALIA-IS-RANK-INERT-AT-THE-FRONTIER-AND-POPULATION-LOSES-TO-COUNTING-1`, plan §6a). Population readout degrades frontier p@10 0.289 -> 0.011, below its own shuffle null; real partial rho 0.090 vs null p95 0.020 (weak but non-null global trend). Side-findings: `curiosity_gestalt` is rank-inert (rho = 1.000000 vs `curiosity` over 227,261 candidates, two assessments); plain frequency p@10 = 0.756 beats every cognitive arm; helix (Fisher-z / RollingFloor) is not reachable from deepnsm-v2, so those legs are NOT RUN |
 | D-POP-2 | contradiction write-back producer (`elect_peers` → `WitnessLens::write_register`) — the one cheap gap that unblocks the contradiction-driven-revision molecule (plan §4) | **Shipped (#1145, merged `2bf8b290` 2026-09-03)** — `witness_fabric::{elect_and_bind, ElectionReport, WitnessLens::bind_election}`, 6 falsifiers / 3 disable-verified; D-POP-1 reported KILL 2026-09-02, so the gate was open. See `E-A-PRODUCER-IS-A-PURE-FUNCTION-OF-THE-CONTENT-LOCI-1` |
 
+## alpha-reason-witness-cognitive-fabric-v1 — D-ARW tracking (RESTORED 2026-08-31)
+
+Plan: `.claude/plans/alpha-reason-witness-cognitive-fabric-v1.md` (merged #1078).
+
+**Scope here is deliberately narrow, and the narrowness is the point.** This
+section tracks ONLY D-ARW work with a merged artifact on `main`. An earlier
+board enumeration of the full `D-ARW-0..8` set (#1090) was reverted with its
+whole arc by #1093, and #1096 rules those commits non-citable and that D-ARW
+returns "only as fresh operator-gated work". The remaining ids defined in plan
+#1078 are therefore **intentionally absent** pending that gate — their absence
+is a scope decision, not a second hygiene gap. Every row below was derived
+from the merge commits and the files they added, never from the reverted
+enumeration. `F-ARW-TARGET-1` is a falsifier rather than a deliverable; it
+earns a row because it has a merged artifact of its own.
+
+| D-id | deliverable | status |
+|---|---|---|
+| D-ARW-0 | Shader-field lineage archaeology — separate current executable source, historical source, operator-recovered intent and hypotheses; authorize no new DTO, address space, rung tenant, provenance bit, scheduler or controller | **Shipped** 2026-08-31 — #1094 (`e61d25a1`), one file added: `.claude/knowledge/shader-field-lineage-audit-2026-08-30.md` (443 lines), carrying a six-label evidence scheme (`[S]` source fact / `[HS]` historical / `[OR]` operator-recovered / `[BW]` broken wire / `[MD]` modern descendant / `[H]` hypothesis). Verdict §12: **BUY the archaeology, not the restoration** |
+| F-ARW-TARGET-1 | D-ARW-0's first falsifier — one source BindSpace row whose P64 cascade returns ≥2 distinct `target` archetypes under one predicate layer at equal distance; observe the emitted CE64s. Emitted edges that remain distinguishable ⇒ finding false ⇒ **NO BUY** | **Run, shipped** 2026-08-31 — #1095 (`e4db066c`), one file added: `crates/cognitive-shader-driver/tests/p64_target_identity_probe.rs`. Declares itself a characterisation probe, not a behaviour contract, and carries an upstream anti-vacuity guard (`CognitiveShader::cascade` must expose >1 distinct `CascadeHit.target`, else the probe proves nothing). Reformatted post-merge by `8143387b` (rustfmt only; that commit's own message records the assertion's logic and inputs as unchanged) |
+
 ## dismech-causal-replay-v1
 
 | D-id | deliverable | status |

.claude/plans/rubicon-loco-rung-cognitive-fabric-v1.md

@@ -346,6 +346,108 @@ session's own scope that plausibly contains the thing — a sibling repo
 already cloned to local disk, with its `CLAUDE.md` already loaded into this
 session's context, is not an exotic place to have to look.
 
+
+### §F.6 ⊘ CORRECTED (2026-08-31) — the substrate landed, and "ten rows" was still the wrong noun
+
+The mechanism this section has now been wrong about twice **exists in this
+repo as of #1112** (merged 2026-08-31). It is no longer a design to infer from
+plan prose; it is source, and the source names itself precisely. Every claim
+below is `file:line` against the tree at `cc0046f8`.
+
+**What landed.** `alpha`, `alpha_tunnel` and `rung_schedule` migrated into
+`lance-graph-contract`; `rung_horizon` is new in `lance-graph-planner`.
+
+| module | lines | what it is |
+|---|---:|---|
+| `contract/src/alpha.rs` | 938 | the overlay algebra — `AlphaStamp{cycle,seq,rung,visits}` (`:109`), `AlphaAllocation` (`:339`), `AlphaOverlay` (`:443`), `AlphaMask` (`:224`) |
+| `contract/src/alpha_tunnel.rs` | 402 | `AlphaTunnel` (`:73`) — the split tunnel |
+| `contract/src/rung_schedule.rs` | 372 | dependency-wave scheduler; `LEVELS = 10` (`:59`) |
+| `planner/src/rung_horizon.rs` | 213 | per-rung readers + `claim_admitted` (`:59`) |
+
+#### The correction: ten LANES over ONE reservation, not ten rows
+
+§F.1 closes with *"ten rungs = ten rows, sparsely occupied, at one address."*
+**The noun is wrong.** `AlphaTunnel` holds `lanes: Vec<AlphaOverlay<'a>>`
+(`alpha_tunnel.rs:73-76`), and its constructor maps `(0..LEVELS)` over
+**one** borrowed allocation:
+
+```rust
+// alpha_tunnel.rs:82-89
+pub fn over(alloc: &'a AlphaAllocation<'a>, cycle: u32) -> Self {
+    Self {
+        lanes: (0..LEVELS)
+            .map(|_| AlphaOverlay::over_shared(alloc, cycle))
+            .collect(),
+        cycle,
+    }
+}
+```
+
+`LEVELS = 10` (`rung_schedule.rs:59`). One `AlphaAllocation`, ten borrows.
+The module states the per-lane cost as one empty `Vec` (`:25-27`), and states
+the prohibition directly: ten lanes must **not** mean ten address sets,
+because reserving is defined as costing zero rows, and ten copies of the
+address set would make "reserve" cost ten times nothing (`:22-24`; the same
+argument from the allocation's side at `alpha.rs:454-456`).
+
+So all three readings this plan has carried are now settled against source:
+
+| reading | verdict |
+|---|---|
+| ten deltas sharing a 480 B value slab (§F original) | wrong — withdrawn in §F.1 |
+| ten rows / ten tables (§F.1) | **wrong — the noun is `lane`, and the reservation is ONE** |
+| ten lanes over one `AlphaAllocation` | correct (`alpha_tunnel.rs:73-89`) |
+
+#### "Split tunnel" names the read/write path split — not a budget, not a table count
+
+Neither prior reading had this at all. The module's own heading (`:12-18`)
+states that reading and writing take different paths: reads go to the baked
+spine, shared by all ten lanes without a lock because `&[NodeRow]` may be
+shared; writes go to the overlay at the same addresses, and `alpha` makes that
+direction a compile-time property rather than a runtime check. **That
+asymmetry is what the words "split tunnel" denote.**
+
+#### §F.2 needs refinement, NOT reversal — the persistence half did not migrate
+
+§F.2's heading (*"How rung levels are written TODAY: they are not"*) reads as
+superseded, and is not. `alpha.rs:1-5` records that the Arrow/Lance storage
+glue (`to_batch`, `key_bytes_at`, the `lance` feature module) **deliberately
+stayed with the storage crate**; what migrated is the pure overlay algebra
+over contract types. So:
+
+> `lance-graph` can now **express** a rung stamp. It still does not
+> **persist** one. The Arrow/Lance write path remains in the consumer.
+
+§F.2's table is therefore still accurate as a statement about *persistence in
+this repo*, and its heading should be read as scoped to that.
+
+#### `D-ACR-3`'s blocker SURVIVES #1112 — checked, not assumed
+
+The tempting inference is that a landed write path unblocks `D-ACR-3`. It does
+not. `mailbox_owner()` still has **zero callers outside its own module**; the
+only occurrence anywhere else in `crates/` is a doc-comment mention at
+`alpha_tunnel.rs:33`. The tunnel enforces one-writer **structurally** — each
+lane owns its own `&mut`, so parallelism needs no lock (`:29-38`) — rather
+than through the mailbox-ownership machinery `D-ACR-3` exists to test. The
+`D-RLR-5` board row's HELD reason stands unchanged.
+
+#### The temporal-isolation mechanism, for the record
+
+`rung_horizon::claim_admitted` (`:59`) classifies **before** claiming, and the
+ordering is load-bearing: `classify` → `reader.mode.admits(status)` → only
+then `lane.claim` (`:66-73`). A refused row therefore leaves no trace in the
+lane — *not even a `visits` bump* (`:56-58`), pinned by an assertion that the
+refused row reads back as `None` (`:168-173`). Note this is the same `visits`
+counter §F.5 identified in the consumer-side original; it now carries a
+second duty.
+
+**`F-RLR-12` (STOP, new):** correcting a claim about a mechanism by
+substituting a different English noun for it, when the mechanism exists in
+source and names its own type. This section replaced "deltas" with "rows" and
+was still wrong, because neither word was read off `AlphaTunnel`. A correction
+must cite the type's definition, not re-describe its shape.
+
+
 ## §G Kanban / Rubicon verdict
 
 - **Internal string paths: NONE.** No `from_str`, no `as_str`, no column-name