diff --git a/.claude/agents/bbb-warden.md b/.claude/agents/bbb-warden.md index 5a105106d..b79acedf4 100644 --- a/.claude/agents/bbb-warden.md +++ b/.claude/agents/bbb-warden.md @@ -1,21 +1,29 @@ --- name: bbb-warden description: > - Guards the T2/T3 membrane — the blood-brain barrier between the selection - tier (`Mask × WideFieldMask → Mask`, the ABI exports, `where`/`hop`) and the - intent tier (the Java facade, R2IL, low-code). Fires BEFORE merging any PR - that adds or changes a PUBLIC Java signature, an ABI symbol Java calls, or a - consumer-facing surface in any language. The rule: what crosses the wall is a - NAME (handle, classid, field name, version), never a BYTE POSITION (offset, - stride, slot index, carving width, raw register). Sibling of - `kernel-membrane-warden` (T1/T2) one tier below. + Guards the T2/T3 membrane — the blood-brain barrier between the behavior + tier (the ABI exports, `where`/`hop`/`plan_eval`, `Mask × FieldMask → Mask`) + and the intent tier (the Java facade, R2IL, low-code). T2 names BOTH T1 + algebras (`D-BBB-NARS-1`, 2026-09-07): the **population** one (mask, ternlog, + popcount) and the **epistemic** one (`TruthU8`, revision, deduction, + abduction), so a truth surface is inside this card's competence. Fires BEFORE + merging any PR that adds or changes a PUBLIC Java signature, an ABI symbol + Java calls, a truth/NARS surface reachable from T3, or a consumer-facing + surface in any language. The rule: what crosses the wall is a NAME (handle, + classid, field name, version, operation name), never a BYTE POSITION (offset, + stride, slot index, carving width, raw register) and never an ARITHMETIC + IMPLEMENTATION SURFACE. Sibling of `kernel-membrane-warden` (T1/T2) one tier + below. tools: Read, Glob, Grep, Bash model: opus --- You are the BBB_WARDEN — the blood-brain barrier between substrate and intent. Your entire competence is the vocabulary of the two tiers you separate — -**T2 selection** and **T3 intent** — and nothing else. You do not reason about +**T2 behavior** and **T3 intent** — and nothing else. T2 was renamed from +"selection" on 2026-09-07 (`D-BBB-NARS-1`): it names BOTH T1 algebras, the +population one and the epistemic one, so truth vocabulary is inside your +competence, not outside it. You do not reason about which mask primitive is fastest (that is `kernel-membrane-warden`, below you). You judge exactly one thing: **does a byte position cross the wall?** @@ -33,6 +41,33 @@ enough: a `long[]` of row ids is a materialised population; an `int[]` of slot positions is a materialised carving. Both are the substrate crossing the wall wearing a collection. +**⊕ 2026-09-07 (operator ruling `D-BBB-NARS-1`) — the rule has a second column.** +T1 holds two sibling algebras, *population* and *epistemic* (`membrane-tiers.md` +§ "T1 has TWO sibling algebras"), and everything above applies unchanged to the +second. **The axis is syntax vs execution, never selection vs scoring.** So: + +- a truth **LITERAL** — `TruthLiteral(192, 217)` — MAY cross. It is meaning the + caller supplies; it is syntax, and syntax is T3's to state. +- a truth **POPULATION** — `[TruthU8; 65536]`, or any array/collection of them — + NEVER crosses. It becomes `TruthLaneId(u64)`, an opaque descriptor. This is the + identical rule to `long[]`-of-row-ids, applied to the epistemic column. +- an **operation NAME** — `Truth.Revision(lhs_handle, rhs_handle)` — MAY cross. + How revision works may not. T2 resolves the name, T1 executes, T0 owns the + result. +- **`lgj_score_*` and any sibling verb family is REJECTED by ruling**, not by + taste: it grows a second semantic API beside `plan_eval` and ends as + `where()/hop()/score()/nars_revision()/…`, with the membrane growing little + computational fingers. NARS is a named `plan_eval` operation or it is nothing. + The ruling is not the only thing standing in the way, and citing only the + ruling understates the case: lgj's own `abi-membrane-warden` already rejects + ABI growth MECHANICALLY (`.claude/agents/abi-membrane-warden.md:5-7`, and + `:30-31` pins `exports.rs` to the symbol count in `abi.md` §7 absent a spec + amendment). Cite the gate, not just the ruling. +- **The G11 fence widens by one scalpel cut, never the cupboard.** Do not admit + `lance_graph_contract::nars` because it exists; if it carries arithmetic beside + POD types, a syntax/vocabulary contract is split out FIRST and only that is + admitted — in one commit, in all three places `ALLOWED` is spelled. + ## The verdicts - **HANDLE-CLEAN** — every public signature carries only names/handles/counts/ @@ -50,6 +85,15 @@ wearing a collection. a name that says so at the call site: `materialize*` (row ids out, O(n) stated), `import*` (external rows in). An unnamed materialiser is a block even if everything it returns is otherwise clean. +- **ARITHMETIC-SURFACE** (added 2026-09-07 with `D-BBB-NARS-1`) — the signature + lets T3 *implement, inspect, iterate, or reconstruct* a T1 algebra rather than + NAME it. A `TruthU8[]` return, a getter that walks a truth lane element-wise, a + contract module admitted through G11 that carries a function computing a truth + FROM truths — each is the epistemic twin of a Java compute path, and each is a + block. Falsifier to reason against: **`F-BBB-NARS-1` — fail if Java can + implement, inspect, iterate, or reconstruct NARS truth arithmetic without + invoking the substrate, or if a truth population crosses G11/Panama other than + as an opaque handle.** ## Method @@ -62,7 +106,36 @@ wearing a collection. slot/offset (position)? Read the javadoc and the call site. Ambiguous → treat as BYTE-POSITION and require a typed wrapper or a doc line pinning it as a name. -4. Append every leak to the entropy ledger in `membrane-tiers.md`'s T2→T3 +4. **The implementation audit — signatures are not enough** (added 2026-09-07 + with `D-BBB-NARS-1`; Codex P2 on #1222 caught that steps 1-3 classify only + parameter and return SHAPES, so a public helper with a perfectly legal + `TruthLiteral` signature that computes revision in its BODY passes every + earlier step while doing exactly what `F-BBB-NARS-1` forbids). Two reads + that steps 1-3 do not perform: + - **Bodies.** For every T3 method touching a T1 algebra's vocabulary, read + the body. Arithmetic over `frequency`/`confidence`, a loop over a lane, a + local recombination of a handle's parts — ARITHMETIC-SURFACE, even when + every signature is clean, and even when the diff changes ONLY the body of + a method that already existed. + - **Imports.** For every module newly admitted through G11, read what it + EXPORTS, not what the diff spells: a POD type is syntax; a function that + computes a truth FROM truths is an implementation surface, and admitting + the module admits it. One scalpel cut, never the cupboard. + The falsifier is the test to reason against, not the signature list: + *can Java implement, inspect, iterate, or reconstruct the arithmetic + without invoking the substrate?* If yes, ARITHMETIC-SURFACE regardless of + which step surfaced it. + - **And the silence half — this step must NOT fire on everything.** A guard + that flags every method touching truth vocabulary carries exactly as much + information as one that never fires. The sanctioned shape, which stays + HANDLE-CLEAN, is a bare delegation: + `TruthLiteral revise(TruthLiteral a, TruthLiteral b) { return NativeBridge.truthRevise(a, b); }` + — one FFI hop, no local arithmetic, no loop over a lane, no recombination + of a handle's parts. That is precisely the doctrine's own lowering ("T3 + may name the operation; it may not know how revision works"), so naming + `revision` is not the offence — *computing* it is. Flagging that method + is a false positive and is itself a finding against the warden. +5. Append every leak to the entropy ledger in `membrane-tiers.md`'s T2→T3 table (one row: leak → the T2 name that replaces it → gate that will reject the old spelling). Write your OWN tag-file; the orchestrator consolidates into the doc. Never write a shared board file directly. diff --git a/.claude/agents/kernel-membrane-warden.md b/.claude/agents/kernel-membrane-warden.md index a719cc7a8..8e886ba88 100644 --- a/.claude/agents/kernel-membrane-warden.md +++ b/.claude/agents/kernel-membrane-warden.md @@ -1,19 +1,25 @@ --- name: kernel-membrane-warden description: > - Guards the T1/T2 membrane — the line between the primitive tier - (`ndarray::simd` facade, `lgj-abi/kernels.rs`: `mask_*`, `eq_*_to_mask`, - `ternlog`) and the selection tier that composes them (`lgj_hop`, `where`, - `plan_eval`, the ABI exports). Fires BEFORE merging any PR that adds or - edits an ABI kernel, a `lgj_op_*`/`lgj_hop`-shaped export, or any T2 code - that composes mask primitives; use PRE-SPAWN before briefing a worker that - will touch exports/kernels. Sibling of `simd-savant` (T0/T1) one tier up. + Guards the T1/T2 membrane — the line between the primitive tier and the + behavior tier that composes it. T1 holds TWO SIBLING ALGEBRAS and this card + covers BOTH (`D-BBB-NARS-1`, 2026-09-07): **population** (`ndarray::simd` + facade, `lgj-abi/kernels.rs`: `mask_*`, `eq_*_to_mask`, `ternlog`, + `popcount`) and **epistemic** (`TruthU8`, revision, deduction, abduction, + induction — the NARS truth arithmetic). T2 is `lgj_hop`, `where`, + `plan_eval`, the ABI exports, and any named `Truth(…)` plan operation. Fires + BEFORE merging any PR that adds or edits an ABI kernel, a + `lgj_op_*`/`lgj_hop`-shaped export, a truth primitive, or any T2 code that + composes mask OR truth primitives; use PRE-SPAWN before briefing a worker + that will touch exports/kernels. Sibling of `simd-savant` (T0/T1) one tier + up. tools: Read, Glob, Grep, Bash model: opus --- You are the KERNEL_MEMBRANE_WARDEN. Your entire competence is the vocabulary -of the two tiers you separate — **T1 primitive** and **T2 selection** — and +of the two tiers you separate — **T1 primitive** and **T2 behavior** (renamed +from "selection" 2026-09-07, `D-BBB-NARS-1`; T2 names BOTH T1 algebras) — and nothing else. You do not reason about intrinsics (that is `simd-savant`, the T0/T1 membrane below you) and you do not reason about names crossing to Java (that is `bbb-warden`, the T2/T3 membrane above you). Reach past your two @@ -54,6 +60,18 @@ tiers up. Two consecutive `mask_*_assign` on the same accumulator = HAND-COMPOSED until proven otherwise (check `simd::ternlog`'s named immediates — the op probably already exists). +2b. **The epistemic sibling, same question** (added 2026-09-07 with + `D-BBB-NARS-1` — this step exists because the doctrine claimed the card + covered truth composition while trigger and method were mask-only; Codex + P2 on #1222 caught it). For every truth operation in T2 code, ask: is this + ONE named T1 call? T2 arithmetic over `frequency`/`confidence` — a + multiply, a `w/(w+1)` evidence discount, a min/max over two truths, a + hand-rolled revision from `and`/`or` of components — is HAND-COMPOSED, + identically to two `mask_and`s spelling `AND3`. The named op is + `revision`/`deduction`/`abduction`; if it does not exist at T1, it lands + at T1 first (never proposed FROM T2, per "What you never do"). A T2 that + reads a `TruthU8`'s two bytes apart to recombine them is also + GEOMETRY-LEAK: the byte split is T0's. 3. For every byte offset in T2 code, ask: did T2 compute this, or read it from a `_lane`/`LgjLaneDesc` accessor? Computed = GEOMETRY-LEAK. 4. Enforce the import fence (abi.md §8, G11): T2 (`exports.rs`) imports SIMD diff --git a/.claude/board/AGENT_LOG.md b/.claude/board/AGENT_LOG.md index 919209739..946cb54a8 100644 --- a/.claude/board/AGENT_LOG.md +++ b/.claude/board/AGENT_LOG.md @@ -1,3 +1,16 @@ +## 2026-09-10 — 5+3 council on #1222 (D-BBB-NARS-1): compliance audit of an operator ruling, 5 savants → draft v2 → 3 reviewers → v3 + +- **Why a council, and its one framing constraint:** #1222 lands a BINDING operator ruling into `EPIPHANIES` + the doctrine + two gate cards — canon-adjacent, silently corrupting downstream sessions if wrong, so council-grade under `.claude/agents/5plus3-council.md`. But that same card bars re-litigating a ruling: the spec froze D-BBB-NARS-1 as **not open**, and `VIOLATES` required file:line evidence that the LANDED TEXT CONTRADICTS the ruling, never a differing opinion. No savant or reviewer found such a contradiction. **The ruling is unchanged.** +- **Phase 0 — SPEC v1 (main thread, 228 lines, before any agent):** 7 PR claims pre-verified so the council could not spend findings re-checking them, including a fresh clone of `lance-graph-java` @ `8720d1d` (`exports.rs:1816` is the single fused `simd_mask_ternlog_assign::`; `three-truths.md:186` reads "Flattening stops at an 8-byte payload" verbatim; `g11_contract_import_fence.rs:44` `ALLOWED` excludes `nars`, and `:31`/`:262` show the fence PARSES and equality-checks all three spellings — stronger than the doctrine claimed). All 3 board gates re-measured locally rather than trusted from the PR body. 4 defects pre-found (F-A misquote-as-verbatim; F-B `translator.rs:25` still carrying the deprecated wording uncited; F-C an `arithmetic half` that does not exist; F-D `TruthLaneId` written present-tense at 0 code sites) and 2 non-defects measured out of scope so nobody wasted a finding (the missing blank line before a `##` is the pattern in 110 of 991 entries). +- **Phase 1 — the 5, parallel, read-only, each with its own question set (Opus for prior-art across 991 entries; Sonnet for the rest); one declared panel swap:** gate-efficacy replaced creative-exploration, because the PR's own thesis is *"a doctrine sentence that names a gate must cite the step that makes it true"* and open-ended expansion is barred by the frozen ruling anyway. Lenses: prior-art / iron-rules / code-truth (runtime-archaeologist charter) / cascade-impact / gate-efficacy (falsifier charter). +- **What the 5 found — one disease, six sites, three savants converging independently:** the PR widened the doctrine's CONTENT and left every INDEX of it stale — both cards' *constitutional* competence sentence, `bbb-warden`'s firing `description`, the T2 row's `May know` cell, the agent→membrane verdict map, and the entropy ledger. Plus: the epistemic column has **no structural gate**, against the doctrine's own *"a membrane without a gate is prose"*; three sentences state aspiration in the grammar of fact (epistemic ops coded only in `nars_engine.rs:194-207` and ABSENT at lgj-abi; `TruthU8` ruled canonical while four truth types coexist and the executing engine uses `ndarray::hpc::nars::NarsTruth`; the `Plan` tree illustrative while `LgjOpDesc` is a flat AND/OR with two opcodes); and a second factual error in a row the PR rewrote (`WideFieldMask` claimed where `FieldMask` is wired). **Savant 4 caught a defect in the SPEC itself** — G7's `cargo clippy -p` cannot resolve a workspace-EXCLUDED crate; amended to `--manifest-path`. +- **Phase 2 — consolidate FIRST (orchestrator, before any reviewer existed):** draft v2 = spec + change ledger, findings grouped by disease rather than by author, 9 cleared risks recorded so they are not re-audited, and one conflicting verdict-GROUND amended while its VERDICT stood (the competence-sentence miss is the `I-LEGACY-API-FEATURE-GATED` shape — a term whose referent widened with no gate or alias — not an axis contradiction). Raw savant output banked in the session scratchpad, never forwarded. +- **Phase 3 — the 3 on draft v2 ONLY (overclaim / dilution-collapse / firewall), and they caught the council:** **BLOCK(P0) ×2** from the firewall — the draft had imported a verbatim quotation from a PRIVATE repository as review grounds, and resolution R5 would have carried it into a PUBLIC commit; **FIX(P1)** from the overclaim auditor — the draft cited the verdict-map row **one line off** and stamped it "orchestrator-verified", so the fix would have added the new verdict to the wrong warden; **FIX(P2) ×3** from the sentinel, the sharpest being that merging six sites into "one disease" diluted the severity of the one site that governs whether a card FIRES AT ALL. Both BLOCKs were **resolved, not argued away**: the private-repo citation is gone entirely (the finding survives generically — *a doc asserting the WIDE variant of a type while the code wires the NARROW one is invisible to every test*), and the D-BBB-NARS-2 scope correction quotes its own losing text as a dated ⊘ rather than mutating it. +- **Phase 5 — landed (v3):** doctrine gains § "What is ruled vs what is coded" (the no-structural-gate statement, the four-truth-type table, the not-at-T1 hedge) + ledger row **L8 marked OPEN, not CLOSED**; `ARITHMETIC-SURFACE` added to the verdict map at the CORRECT row; both competence sentences and `bbb-warden`'s description widened; `Mask × WideFieldMask → Mask` → the shipped `FieldMask` (two sites); the F-A quotation restored verbatim; three missing citations added (lgj `abi.md` §6 twice, `abi-membrane-warden` once); step 4 gained its **silence half** on the card instead of merely derivable; **new D-BBB-NARS-4** (truth-type convergence, *do not pre-build*). +- **Gates:** `append_only_gate.py origin/main` OK · `citation_decay.py --since origin/main` no new decay · supersession index regenerated **LAST** · G9 (every B1 site fixed or named a control case) met — `EPIPHANIES.md:53` is the recorded control case, correct in past tense, deliberately untouched. +- **The one `.rs` touch, verified by running rather than by assertion:** `translator.rs` (R16) is a doc-comment-only change (confirmed by diff: every changed line is a `///`). It was initially UNVERIFIABLE here — the crate path-deps `/home/user/ndarray`, absent from the container, so clippy died at dependency resolution and the limitation was recorded as such. The operator then supplied the sibling; cloned to the path the path-dep expects (`b9afcb9`, 121 MB) and re-run: **`cargo clippy --manifest-path … --all-targets -- -D warnings` exit 0 (8.85 s, 26 packages), `cargo test --manifest-path …` 42/42, 0 failed suites, doctests included.** `CARGO_PROFILE_DEV_DEBUG=0 CARGO_INCREMENTAL=0` throughout; disk unchanged at 17 G. +- **One gate leg still red, and deliberately left red:** `cargo fmt --check` on that crate fails on **pre-existing** debt — 33 sites across 8 files. The single `translator.rs` hit is at the shifted line 234, byte-identical to `HEAD`, i.e. not mine; reformatting 8 unrelated files would balloon a doctrine PR well past its scope. The crate is workspace-EXCLUDED with **zero CI coverage**, so no pipeline lints it either way — which is why B6 amended G7's invocation to `--manifest-path` in the first place. Nothing was merged; a human merges. + ## 2026-09-07 — D-SPG-1: one Sonnet worker from a 60-line spec, orchestrator-gated (contract `AlphaMask::{words, from_words}`) - **Worker (Sonnet, `general-purpose`, edit-only, guardrails §1 verbatim, one file `crates/lance-graph-contract/src/alpha.rs`):** two methods after `materialize_ordinals`, three tests in the existing module; reported its own unverified items honestly ("not compiled, not run — orchestrator gates"; `PartialEq` presence checked by reading the derive). diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md index 2df8d855f..81540dc05 100644 --- a/.claude/board/EPIPHANIES.md +++ b/.claude/board/EPIPHANIES.md @@ -1,3 +1,119 @@ +## 2026-09-07 — E-T1-HAS-TWO-SIBLING-ALGEBRAS-THE-AXIS-IS-SYNTAX-VS-EXECUTION-1 — the membrane is a behavior membrane, not a selection pipeline + +**Status:** OPERATOR RULING, BINDING (2026-09-07). Ruled after a three-agent audit of the +T2/T3 barrier (`membrane-tiers.md`, the two warden cards, `lance-graph-java` @ `8720d1d`, +`r2sleigh` @ `99d2553`) reported NARS truth arithmetic as absent from the Java side — +not exported, not imported, not present — and drew the wrong conclusion from a correct +measurement. +**Confidence:** High. The measurement is exhaustive (repo-wide grep of lgj: 3 hits, all +prose, all in one unshipped plan); the ruling is the operator's, and it is a ruling, not +a finding. + +**The audit's conclusion, verbatim, and why it is wrong.** *"NARS is off the ladder +entirely; the ladder is selection-shaped and has no tier for scoring."* Descriptively +true at today's HEAD. Architecturally wrong twice over: + +1. **The axis is wrong.** The distinction that matters is not *selection vs scoring* — + it is **syntax vs execution**, which is the axis every other tier here is already + built on. `where()` is T2 because Java owns the NAME and T1 owns the op; nothing + about that reasoning is specific to populations. +2. **The remedy was wrong.** The audit proposed a new bulk verb family (`lgj_score_*`) + returning a lane instead of a mask. **Rejected.** It grows a second semantic API + beside `plan_eval`, and the end state is predictable — `where()`, `hop()`, + `score()`, `nars_revision()`, `nars_deduction()`, … with Java knowing progressively + more about the behavior graph. *The membrane starts growing little computational + fingers.* + +**The ruling.** The ladder does not need a sixth tier; **T1 was described too narrowly.** +It holds TWO SIBLING PRIMITIVE ALGEBRAS — *population* (`mask`, `ternlog`, `eq → mask`, +`popcount`) and *epistemic* (`TruthU8`, revision, deduction, abduction). Both are +primitive behavior. **T2 may name either; T2 may not hand-compose either; T3 may express +intent in either.** Every existing rule applies unchanged to the second column — +`kernel-membrane-warden`'s HAND-COMPOSED verdict covers a T2 spelling `revision` out of +smaller truth ops exactly as it covers the two-AND spelling of `AND3`. + +NARS lowers through the membrane that already exists — as a TARGET ROUTE, not an +available one. ⊘ **Corrected pre-merge 2026-09-10** (CodeRabbit, Major); the sentence +first read *"T3 names `Truth.Revision(...)` … T2's `plan_eval` resolves the name; T1 +executes; T0 owns every resulting `TruthU8`"*, present tense, which published an +unavailable capability as a working route and contradicted this entry's own ⊕ addendum +below. The route is: T3 will name `Truth.Revision(lhs_handle, rhs_handle)` and will not +know how revision works; **once the structural gate exists and `plan_eval` carries a +Truth opcode** — neither does today, and both gate on D-BBB-NARS-2/-3 — T2's `plan_eval` +will resolve the name, T1 will execute, and T0 will own every resulting `TruthU8`. The +membrane it lowers through is real and shipped; what is not yet built is the Truth +operation that would travel it. **Extend the plan language, not the ABI surface** — +`lgj_plan_eval` exists precisely so a whole behavioral expression crosses once. + +**A wording correction the ruling forces.** `TruthU8` had been called "the canonical wire +form." Two different claims were being conflated: it is the canonical **substrate** +representation (T0). What crosses is decided separately and by SHAPE — a truth LITERAL +(`TruthLiteral(192, 217)`) is syntax the caller supplies and may cross; a truth +POPULATION (`[TruthU8; 65536]`) never crosses, it becomes `TruthLaneId(u64)`. Same rule +`bbb-warden` already applies to masks, second column. It lands on the measured Valhalla +cliff exactly: flattening stops at an **8-byte payload** (VM-confirmed, +`valhalla-lab/docs/three-truths.md`), so the handle flattens and the array could never. +**Valhalla carries the noun; Panama carries the verb; lance-graph owns the reality.** + +**Consequences, each with its site.** `D-BBB-NARS-1` + falsifier `F-BBB-NARS-1` +(STATUS_BOARD, and quoted in `membrane-tiers.md` § "T1 has TWO sibling algebras"); the +T1 row and the T2 row (renamed *selection* → *behavior*) rewritten in the doctrine table; +`bbb-warden` gains the syntax/execution test and the G11 scalpel-cut rule. **The G11 +fence must NOT be widened to `lance_graph_contract::nars` merely because that module +exists** — if it carries arithmetic beside POD types, split a syntax/vocabulary contract +out first and admit only that. One scalpel cut, never the cupboard. + +**What does NOT change: the BBB does not move.** T3 intent/names above; T2 opaque bulk +behavior handles below; T1 algebra (population ‖ epistemic); T0 state. No VSA internals, +no RoleKey, no NARS arithmetic, no byte positions, no truth arrays, no Java compute path. +Only names and capabilities. The widening makes the doctrine MORE general, not more +permissive. + +**⊕ 2026-09-10 — hardened by a 5+3 council before merge (5 savants → draft → 3 reviewers).** +The ruling is unchanged; the council was a compliance audit, not a re-litigation, and it +found no contradiction of the ruling. What it found was that this entry and its doctrine +widened the CONTENT and left every INDEX of it stale, and that three sentences stated +aspiration in the grammar of fact. Corrected in the same commit: + +1. **The rename was never propagated.** Both warden cards' *constitutional* sentence + ("your entire competence is the vocabulary of the two tiers you separate … and nothing + else") still named `T2 selection`, and `bbb-warden`'s frontmatter `description` — the + text that decides whether the card FIRES AT ALL — was never widened to name the + epistemic algebra, though its sibling's was. A non-firing trigger is a strictly worse + failure than a card that misdescribes itself after firing; both are fixed. + `membrane-tiers.md`'s agent→membrane map also still listed three `bbb-warden` verdicts, + so the doctrine did not know about the fourth verdict this arc added. +2. **The epistemic column has no STRUCTURAL gate**, only review notes — and the doctrine's + own test is *"a membrane without a gate is prose."* `F-BBB-NARS-1` cannot be exercised + today either (zero Java-side truth surface). Now stated plainly, with the gate that will + hold it named and its dependency recorded, plus ledger row **L8**, marked OPEN rather + than CLOSED. The two new card steps ARE real and discriminating — each catches a body + every signature-shaped step passes, and each has a sanctioned silent case — but a review + note is not a fence. +3. **`TruthU8` is the ruled TARGET, not the current state.** Four truth types coexist, and + the engine that actually executes revision/deduction/abduction uses a different one + (`ndarray::hpc::nars::NarsTruth`, aliased `Truth`); `TruthU8` occurs outside its own + crate in exactly one file, a test, with no conversion path. The ruling stands; its + migration is now visible as **D-BBB-NARS-4** instead of implied. Likewise the named + epistemic primitives are coded only in `lance-graph-planner`'s `nars_engine.rs` and are + ABSENT at the lgj-abi T1 membrane, and the `Plan` tree is illustrative — `plan_eval` + takes a flat AND/OR `LgjOpDesc` with two opcodes and no Truth opcode. +4. **Two factual errors were carried past in a row this arc rewrote**: `Mask × WideFieldMask + → Mask` — the shipped type is plain `FieldMask`, the wide one does not cross the ABI — + and a `bbb-warden` sentence presented in quotation marks that was a paraphrase, not the + source string. Both corrected. The first is a **recurring workspace defect shape** worth + naming in the abstract: a doc asserting the WIDE variant of a type while the code wires + the NARROW one is invisible to every test, because on today's data the two agree. + +**`E-NXG-8` is not regraded** — its claim is scoped *"a complete cognitive ISA **over +masks**"*, so the two-algebras doctrine BOUNDS it to the population column rather than +contradicting it. + +**The council's own artifact carried the same defect it was auditing:** the consolidated +draft cited the verdict-map row one line off and stamped it "orchestrator-verified", which +would have added the new verdict to the wrong warden. The overclaim reviewer caught it. +That is the argument for the reviewer phase being non-optional, recorded because the next +session will be tempted to skip it. ## 2026-09-07 — E-A-DYNAMIC-DOMAIN-MASK-IS-A-SECOND-WITNESS-AND-ITS-ALIGNMENT-IS-CALIBRATION-1 — the "horseshoe" was a category error; the equality I called a coincidence is a known-answer target **Status:** OPERATOR RULING (2026-09-07, two messages: *"horseshoe mask is a diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index 03bdd150b..281da6395 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -1,3 +1,17 @@ +## bbb-nars-lowering (D-id minted 2026-09-07 with the operator ruling) + +`.claude/knowledge/membrane-tiers.md` § "T1 has TWO sibling algebras"; board +`E-T1-HAS-TWO-SIBLING-ALGEBRAS-THE-AXIS-IS-SYNTAX-VS-EXECUTION-1`. The axis is +syntax vs execution, not selection vs scoring; T1 holds two sibling algebras and +NARS lowers through the `plan_eval` membrane that already exists. + +| D-id | scope | status | gate / falsifier | +|---|---|---|---| +| D-BBB-NARS-1 | NARS truth arithmetic remains substrate-owned. G11/T3 may carry only typed NARS **syntax** and **opaque substrate handles**. NARS execution lowers through the existing bulk plan-evaluation membrane; no Java-side arithmetic and no materialized truth population crosses Panama. `TruthU8` is the canonical SUBSTRATE representation; cross-membrane results are handles (`TruthLaneId(u64)`). Any required G11 expansion SHALL expose syntax/vocabulary only, never an arithmetic implementation surface — one scalpel cut, never the cupboard | **Ruled 2026-09-07** (operator). Doctrine landed; no code. `lgj_score_*` explicitly REJECTED — extend the plan language, not the ABI surface | **F-BBB-NARS-1:** fail if Java can implement, inspect, iterate, or reconstruct NARS truth arithmetic without invoking the substrate, OR if a truth population crosses G11/Panama other than as an opaque handle | +| D-BBB-NARS-2 | The syntax/vocabulary contract the G11 fence would admit, **if one turns out to be needed at all**. ⊘ **Scope corrected pre-merge by the 5+3 council, 2026-09-10** — the original read *"split the POD/vocabulary half of `lance_graph_contract::nars` from its arithmetic half"*, which presumes an arithmetic half that **does not exist**: measured, `crates/lance-graph-contract/src/nars.rs` exports three POD enums (`InferenceType`, `QueryStrategy`, `SemiringChoice`) plus `InferenceType::default_strategy()` (enum→enum), `InferenceType::from_mantissa(i8)` (decode) and one `From` impl — no function computes a truth FROM truths, and the arithmetic (`arm_to_truth_u8`) lives in a different crate. So the first step is an AUDIT, not a split: re-measure, and if the module is still arithmetic-free, the fence may be widenable as-is | Queued — gates on a consumer actually needing it; **do not pre-build** | the admitted module contains no arithmetic (a function that computes a truth from truths); `ALLOWED` grows in all three spellings in ONE commit | +| D-BBB-NARS-4 | **Truth-type LADDER — one canonical per tier, named lifts, no casts.** ⊘ **Reframed pre-merge 2026-09-10** (operator question: are these distinct truths, or one truth at several precisions?); the row first read *"four truth types coexist … Converge them onto the ruled canonical type"* — the count was wrong and the verb was wrong. Measured: **five** NARS `(frequency, confidence)` types, and every one carries the SAME two axes — `lance-graph-contract/src/exploration.rs:89` (f32×2), `lance-graph-planner/src/nars/truth.rs:10` (f32×2, the belief-arena type), `ndarray::hpc::nars::NarsTruth` (f32×2, aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` — what `nars_engine.rs` executes against), `holograph/src/width_16k/schema.rs:104` (u16×2 packed), `lance-graph-arm-discovery/src/translator.rs:28` (`TruthU8`, u8×2, ruled canonical at T0). Same axes ⇒ these are ONE kind of truth over **three scalar widths** — u8 (register), u16 (storage), f32 (compute; three of the five types share it) — so **five representations, three widths, not five kinds**. ⊘ 2026-09-10, same day (CodeRabbit, Major): this sentence first said *"four precisions"* — a leftover from the four-type count — and the falsifier below first promised a *"lossless-upward lift per tier boundary"* while prescribing `f32 → u16`/`u8` packing, which is downward quantization and lossy; both corrected, losing text kept here. The genuinely distinct truths (grammatical validity, causal-trajectory provenance) are NOT on this ladder and enter it only by a named constructor — the precedent is tesseract-rs `sentence_nars_truth`. **Same axes does NOT prove same semantics:** ndarray clamps confidence to `[0, 0.9999]`; the u16 and u8 mappings have not been read side by side. So step 1 is an AUDIT of the five mappings, never a merge | Queued — discovered by the 5+3 council on #1222, reframed on operator question; **do not pre-build**, it gates on a consumer needing a cross-tier bridge | one NAMED conversion per direction per boundary, each carrying its own honesty grade: **widening** `u8 → f32` / `u16 → f32` is round-trip-exact (the integer is recovered) but the f32 is a rounded rational (`x/255` is not representable), so it is never called lossless; **packing** `f32 → u16` / `f32 → u8` is a named quantizer and lossy by construction; **dequantizing** `u16 → f32` is the named inverse of the pack, not an identity. *Lossless* is claimed for no mapping until the audit proves that specific one. Zero bare `as` casts between any two of the five, **or** the doctrine states why a given tier legitimately holds two. A bare cast, or an unaudited *lossless*, is an automatic fail | +| D-BBB-NARS-3 | `Truth(…)` as a named `plan_eval` operation (Revision / Deduction / Abduction / …), returning `TruthLaneId`, never an array | Queued — gates on D-BBB-NARS-2 | one crossing per behavioral expression regardless of operand count (the bulk-or-lifecycle law, lgj `docs/abi.md` §6); a `[TruthU8]` return is an automatic fail | + ## spog-alpha-channel-v1 (D-ids minted 2026-09-07 with the spec) `.claude/plans/spog-alpha-channel-v1.md`. The SPOG alpha channel in MedCare-rs: domain = a mask over the combined `all-lanes.soa` image (never a per-domain file), cycle = one sealed `FixedSizeBinary(512)` append per Lance version (no row ids, no delete), rung byte = the attention rung only (`domain_rung` retired as a writer), the rung × tenant cross via `mask_ternlog` one crate out of the zero-dep contract. Operator mandate 2026-09-07 ("probe autoattended … until you get MedCare-rs SPOG alpha channel to work"). Order: 0 → 1 → 2 → 4 → 3 → 5 → 6 → 7/8. @@ -14,6 +28,7 @@ | D-SPG-7 | ogar-r2il consumer (`RANK` + `TERNLOG 0x86`) via `lance-graph-ogar` | Queued — gates on D-SPG-4 | lifted program survivor mask == hand chain bit-for-bit | | D-SPG-8 | DataFusion containment (`with_row_id`/`with_row_addr` OFF + red-if-flipped test) | ~~Queued~~ **Shipped 2026-09-07** — MedCare-rs #621 merged (`9f9b7be`). Production registers `LanceTableProvider::new(ds, /* with_row_id */ false, /* with_row_addr */ false)` (`medcare-server/src/state.rs:945`), and the red-if-flipped test OBSERVES that call site instead of building its own provider: `row_identity_columns_are_absent_from_the_registered_provider` (`:1264`) reads the schema of the table `AppState::build_session_context` actually registered, and asserts a hand-built identity-on provider over the SAME dataset carries exactly two more columns — two-sided, so the silent half is a measurement and not a statement about an empty schema. Its own doc records that an earlier draft hardcoded the flags in the test and stayed GREEN when production was flipped; the disable run is what caught it. The pre-existing grep fence `row_identity_containment::no_lance_row_identity_consumer_exists` (`:1609`) stays sharp because the test deliberately never spells either column name in code. **Gate met:** the scan schema carries neither identity column, and a flip is detectable. | scan schema carries neither `_rowid` nor `_rowaddr` | + ## lance-convergence-staged-migration-v1 (D-ids minted 2026-09-05 with the plan) `.claude/plans/lance-convergence-staged-migration-v1.md`. The staged lance diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index b4e1be668..5b20a7067 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -19,8 +19,8 @@ substrate beneath them is T0. | Tier | What it is | May know | Crosses UP as | The membrane (gate) | |---|---|---|---|---| | **T0 substrate** | bytes, lanes, Lance columns, SoA v3 rows; `simd_{avx512,avx2,neon,scalar}.rs` | strides, offsets, carvings, intrinsics, alignment | — | none; T0 is where truth lives | -| **T1 primitive** | `ndarray::simd` facade; `lgj-abi/kernels.rs`; `mask_*`, `eq_*_to_mask`, `ternlog` | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM` | a mask, a count, a lane descriptor | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | -| **T2 selection** | ABI exports; `where`/`hop`/`plan_eval`; `Mask × WideFieldMask → Mask` | handles, `classid`, `FieldMask` (fields by NAME), version | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | +| **T1 primitive** | TWO SIBLING ALGEBRAS (2026-09-07, below): **population** — `ndarray::simd` facade, `lgj-abi/kernels.rs`, `mask_*`, `eq_*_to_mask`, `ternlog`, `popcount`; **epistemic** — `TruthU8`, revision, deduction, abduction, … *(RULED, NOT YET RESIDENT — see § "What is ruled vs what is coded" below: these four are coded only in `lance-graph-planner`'s `nars_engine.rs`, and are ABSENT at the lgj-abi T1 membrane)* | `&[u64]`, `&[u8]`+`(offset,stride)`, `IMM`, `TruthU8` | a mask, a count, a lane descriptor, **a truth lane DESCRIPTOR (the `TruthLaneId` shape D-BBB-NARS-3 would mint — prescriptive, 0 code sites today) — never the population** | **polyfill rule** (simd-savant): no intrinsic, no `#[cfg(target_arch)]` above this line | +| **T2 behavior** (was "selection") | ABI exports; `where`/`hop`/`plan_eval`; `Mask × FieldMask → Mask` *(the shipped type; `WideFieldMask` does not cross the ABI — lgj `fixture.rs:1-6` calls wiring it "a later slice", and `class_view_provider.rs:64,235` wires plain `FieldMask`)*; **and the epistemic siblings, named through the same `plan_eval`** | handles, `classid`, `FieldMask` (fields by NAME), version, **a truth LITERAL (`TruthLiteral`) — never a truth population** | a handle, a count, a status | **no hand-composed T1 op, no computed geometry** (kernel-membrane-warden) | | **T3 intent** | Java facade; R2IL / OGAR `ActionDef`; low-code | names: class, edge, field, version | an outcome | **no byte position** (bbb-warden + ApiSurfaceTest) | | **R2IL** | emits T3 artifacts | T3's vocabulary (names, outcomes) | an outcome | its ceiling IS T3's; door-knocker test (layer-boundary-warden) | @@ -36,6 +36,214 @@ hand-writes a compare-and-pack loop has punched T1 — the violation `simd-savant` exists to catch. lgj-abi stacks the same shape at T1/T2: `exports.rs` names `kernels::ternlog::AND3`, never `ndarray::simd` directly. +## T1 has TWO sibling algebras — the doctrine is a behavior membrane, not a selection pipeline + +**Operator ruling, 2026-09-07.** An audit found NARS truth arithmetic nowhere on +the Java side of the membrane — not exported, not imported, not present — and +concluded from that: *"NARS is off the ladder entirely; the ladder has no tier +for scoring."* **The conclusion was wrong and the diagnosis was the wrong axis.** +The distinction that matters is not *selection vs scoring*. It is **syntax vs +execution** — which is the distinction every other tier here is already built on. + +The ladder does not need a sixth tier. **T1 was described too narrowly.** It +contains two sibling primitive algebras: + +``` +T1 +├── population algebra └── epistemic algebra +│ mask TruthU8 +│ ternlog revision +│ eq → mask deduction +│ popcount abduction +``` + +Both are primitive behavior. **T2 may name either. T2 may not hand-compose +either. T3 may express intent in either.** Every rule already written applies +unchanged to the second column — `kernel-membrane-warden`'s HAND-COMPOSED +verdict covers a T2 that spells `revision` out of smaller truth ops exactly as +it covers a T2 that spells `AND3` as two `mask_and`s. + +**That claim was FALSE when first written, and is true only because the same +commit made it true.** `kernel-membrane-warden`'s trigger and its method named +masks only; a T2 hand-composing `revision` would have walked straight through +the gate this paragraph invoked. Codex caught it on #1222 (P2), and the card +now carries the epistemic algebra in its trigger and **method step 2b**. Two +sibling gaps of the same shape were closed with it: the T1 row above said a +truth LANE crosses up while the shape table below says a population never does +(now: the DESCRIPTOR, never the population), and `bbb-warden`'s method +classified only signature shapes, so a public helper with a legal +`TruthLiteral` signature computing revision in its BODY passed every step while +doing exactly what `F-BBB-NARS-1` forbids (now: method step 4, an explicit +body-and-import audit). **A doctrine sentence that names a gate must cite the +step that makes it true** — the same defect as the G11 fence being prose until +2026-09-03, found three times in one commit and fixed in the same one. + +### The lowering, end to end + +``` +T3 Java / R2IL / low-code + │ NARS operation NAME + opaque handles + ▼ +T2 plan_eval — the behavior membrane + │ resolved bulk operation + ▼ +T1 epistemic primitives (beside the population primitives) + │ substrate-native execution + ▼ +T0 TruthU8 lanes / rows / history / state +``` + +**Target route, not an available one.** T3 will say +`Truth.Revision(lhs_handle, rhs_handle)`, and **will not know how revision +works** — that part is the ruling and is permanent. The rest is not yet built: +once the structural gate exists and `plan_eval` carries a Truth opcode (it +carries `{EQ_U32, GT_I32}` today and no Truth opcode; both gate on +D-BBB-NARS-2/-3), T2 will resolve the name, T1 will execute the arithmetic, and +T0 will own every resulting `TruthU8`. The membrane above is shipped; the +operation that would travel it is not. See § "What is ruled vs what is coded". + +### Extend the plan language, NOT the ABI surface + +The tempting fork — mint `lgj_score_*` beside `lgj_hop` — is rejected. It grows +a second semantic API next to `plan_eval`, and the end state is predictable: +`where()`, `hop()`, `score()`, `nars_revision()`, `nars_deduction()`, … with +Java knowing progressively more about the behavior graph. **The membrane starts +growing little computational fingers.** + +`lgj_plan_eval` exists precisely so a whole behavioral expression crosses ONCE. +(That rule is not new here — it restates lgj `docs/abi.md` §6, which already says the +fused-plan call exists "precisely so that `.where(...).where(...).count()` is **one** +crossing regardless of how many predicates or rows." What is new is extending it to +the epistemic column.) +NARS becomes another named plan operation, not another export: + +``` +Plan ← ILLUSTRATIVE. Not a type that exists today. + ├── Select(…) + ├── Hop(…) + ├── Ternlog(…) + └── Truth(…) + ├── Revision + ├── Deduction + ├── Abduction + └── … +``` + +**Read that as the shape `D-BBB-NARS-3` would mint, not as a description of the +code.** Measured 2026-09-10 across both checkouts: `enum Plan` / `Plan::Select` / +`Plan::Hop` / `Plan::Ternlog` / `Plan::Truth` have **zero hits**; `lgj_hop` +(`exports.rs:1703`) is an ABI function, not a tree variant. `lgj_plan_eval` IS +shipped and tested (`exports.rs:1421,1522,1547`; `abi.rs:246-251,337`), but its +`LgjOpDesc` is a **flat array with a combined AND/OR — not a tree** — and its +opcode set is exactly `{LGJ_OP_EQ_U32 = 1, LGJ_OP_GT_I32 = 2}` (`abi.rs:250,252`), +with **no Truth/Revision opcode**. So "a whole behavioral expression crosses ONCE" +is CODED for population predicates and RULED-BUT-UNBUILT for the epistemic side. + +### `TruthU8` is the canonical SUBSTRATE representation — not automatically the wire form + +These are two different claims and the workspace had been conflating them. +`TruthU8 { frequency: u8, confidence: u8 }` +(`lance-graph-arm-discovery/src/translator.rs:25-33`) is canonical **at T0**. +What crosses is decided separately, and by shape: + +| shape | crosses? | as | +|---|---|---| +| a truth LITERAL, `TruthLiteral(192, 217)` | **yes** — it is meaning supplied by the caller, syntax, T3's to state | itself | +| a truth POPULATION, `[TruthU8; 65536]` | **never** | `TruthLaneId(u64)` — an opaque 8-byte descriptor | + +This is the same rule `bbb-warden` already enforces for masks (*"a `long[]` of row ids is a +materialised population"*, `bbb-warden.md:32`), applied to the epistemic +column — and it lands exactly on the measured Valhalla cliff: **flattening stops +at an 8-byte payload** (VM-confirmed, `valhalla-lab/docs/three-truths.md`), so a +`TruthLaneId(u64)` flattens and a truth array could never. The JVM agrees with +the membrane about where the wall is. **Valhalla carries the noun; Panama +carries the verb; lance-graph owns the reality.** + +### The G11 widening rule: one scalpel cut, never the cupboard + +Do **not** import `lance_graph_contract::nars` through the G11 fence merely +because it exists. If that module carries arithmetic semantics together with POD +types, **split out a tiny syntax/vocabulary contract first** and admit only that. +The fence widens by one deliberate module, in one commit, in all three places +its allowlist is spelled (`tests/g11_contract_import_fence.rs`'s `ALLOWED`, +lgj `CLAUDE.md § Enforcement`, `Cargo.toml`'s comment) — the shape lgj already +requires, and the reason its own history records the fence being prose until +2026-09-03 (`ISS-LGJ-G11-FENCE-WAS-PROSE`). + +### What is ruled vs what is coded (measured 2026-09-10 by the 5+3 council) + +The ruling above is binding. Most of what it rules is **not yet resident**, and this +section exists so no future session mistakes a decision for an accomplished fact. +The doctrine's own test is three sections down: *"A membrane without a gate is prose."* + +**1. The epistemic column has NO structural gate — yet.** Each membrane is held by a +structural gate: T0/T1 by the simd-savant grep + the `ndarray::simd` re-export, T1/T2 +by the G11 import fence + `kernels.rs` as sole ndarray importer, T2/T3 by +`ApiSurfaceTest`'s forbidden-type list + the array-return naming rule. **The epistemic +column adds none of these.** What it adds — `bbb-warden` step 4, `kernel-membrane-warden` +step 2b — are *review notes*, which property 1 below explicitly distinguishes from gates. +Both steps are real and discriminating (each catches a body that every signature-shaped +step passes, and each has a sanctioned silent case), but a review note is not a fence. +`F-BBB-NARS-1` likewise cannot be exercised today: grep across lgj@`8720d1d` `native/` +and `java/` for `TruthU8`/`revision`/`deduction`/`abduction`/`induction` returns **zero +hits**, so there is no Java surface to run it against. **The gate that will hold this +column is `ApiSurfaceTest`'s forbidden-type list plus a G11 allowlist entry, and it is +gated on D-BBB-NARS-2/-3** — which are Queued and marked *do not pre-build*. Until then +this half of the membrane is enforced by review, and saying otherwise would be the exact +defect this arc keeps finding. + +**2. The named epistemic primitives are not at T1.** `revision`/`deduction`/`abduction`/ +`induction` are CODED, but only inside `crates/lance-graph-planner/src/cache/nars_engine.rs:194-207` +(`Inference::{Deduction,Induction,Abduction,Revision}`) — a planner-internal dispatch, +**not** a T1 primitive callable from T2 — and are ABSENT at the lgj-abi membrane +entirely. `kernel-membrane-warden` step 2b already states the consequence correctly +("if it does not exist at T1, it lands at T1 first"); the T1 row above now carries the +same hedge, which it did not when first written. + +**3. `TruthU8` is the RULED TARGET, and it has three incumbents.** The ruling makes +`TruthU8` canonical at T0. Measured, four truth types coexist today, each self-described +as canonical in some register: + +| type | shape | site | +|---|---|---| +| `exploration::NarsTruth` | `f32 × 2` | `lance-graph-contract/src/exploration.rs:89` | +| `holograph::width_16k::schema::NarsTruth` | `u16 × 2`, packed | `holograph/src/width_16k/schema.rs:104` | +| `ndarray::hpc::nars::NarsTruth` | — | aliased `Truth` at `lance-graph-planner/src/cache/triple_model.rs:42` | +| `arm-discovery::TruthU8` | `u8 × 2` | `lance-graph-arm-discovery/src/translator.rs:28` | + +**The engine that actually executes revision/deduction/abduction uses the third**, via +that alias. `TruthU8` occurs outside its own crate in exactly one file, a test. No +conversion path bridges them. So "T0 owns every resulting `TruthU8`" is the direction of +travel, not the current state — the convergence is tracked as **D-BBB-NARS-4**. + +### The ruling and its falsifier + +> **D-BBB-NARS-1.** NARS truth arithmetic remains substrate-owned. G11/T3 may +> carry only typed NARS **syntax** and **opaque substrate handles**. NARS +> execution is lowered through the existing bulk plan-evaluation membrane; no +> Java-side arithmetic and no materialized truth population crosses Panama. +> `TruthU8` is the canonical substrate representation, while cross-membrane +> results are handles. Any required G11 expansion SHALL expose +> syntax/vocabulary only, never an arithmetic implementation surface. + +> **F-BBB-NARS-1.** Fail if Java can implement, inspect, iterate, or reconstruct +> NARS truth arithmetic without invoking the substrate, or if a truth population +> crosses G11/Panama other than as an opaque handle. + +The BBB does not move. It stays exactly where it is: + +``` + BBB +T3 intent / names ───────────── +T2 opaque bulk behavior handles + ↓ +T1 algebra (population ‖ epistemic) +T0 state +``` + +No VSA internals. No RoleKey. No NARS arithmetic. No byte positions. No truth +arrays. No Java compute path. **Only names and capabilities.** + ## The compile-through rule (the Entropy half) **Old code is not deleted; it is re-admitted only by compiling THROUGH the @@ -71,7 +279,7 @@ catchable half. The warden proves the rest. |---|---|---|---| | T0/T1 | `simd-savant` | sonnet | POLYFILL-CLEAN / RAW-INTRINSIC / SHADOW-KERNEL | | T1/T2 | `kernel-membrane-warden` | opus | NAMED / HAND-COMPOSED / GEOMETRY-LEAK | -| T2/T3 | `bbb-warden` | opus | HANDLE-CLEAN / BYTE-POSITION / UNNAMED-BREACH | +| T2/T3 | `bbb-warden` | opus | HANDLE-CLEAN / BYTE-POSITION / UNNAMED-BREACH / ARITHMETIC-SURFACE | | T3/R2IL | `layer-boundary-warden` | opus | COMPILE-TIME-CLEAN / DOOR-KNOCKER / WRONG-SHELF | All membrane wardens above T0/T1 are Opus: leak detection is accumulation @@ -99,6 +307,7 @@ reject the old spelling once closed. `[OPEN]` until the gate rejects it. | L5 | `Engine.LaneWindow.setU64` — raw word write | `importRows` (named breach) is the only sanctioned writer | ApiSurfaceTest (internal.ffm already fenced from public) | CLOSED | | L6 | any future `byte[]` / `[u8;12]` rail array in a public signature | a named `Reading` value type OGAR emits per ClassView (Valhalla), read zero-copy | ApiSurfaceTest byte[]-fence (this PR) | CLOSED (forward guard) | | L7 | any future array return not named `materialize*`/`import*` | a named terminal | ApiSurfaceTest array-return naming rule (this PR) | CLOSED (forward guard) | +| L8 | any future truth POPULATION in a public signature — `TruthU8[]`, a truth lane, a collection of them — or any T3 body that computes a truth FROM truths | the `TruthLaneId(u64)` opaque descriptor for the population; a named `Truth(…)` `plan_eval` operation for the arithmetic | **OPEN — review-note only** (`bbb-warden` step 4 + ARITHMETIC-SURFACE). The structural gate (ApiSurfaceTest forbidden-type entry + G11 allowlist) is gated on D-BBB-NARS-2/-3 | OPEN (forward guard, ungated) | Provenance: the two fixes that produced this doctrine — the 7.5→1.1 ms `lgj_hop` (T1 doing T0's job badly: gathered a contiguous lane; fixed inside diff --git a/crates/lance-graph-arm-discovery/src/translator.rs b/crates/lance-graph-arm-discovery/src/translator.rs index 1ffe803dd..09738a6ad 100644 --- a/crates/lance-graph-arm-discovery/src/translator.rs +++ b/crates/lance-graph-arm-discovery/src/translator.rs @@ -22,8 +22,15 @@ use crate::rule::{CandidateRule, Item}; /// needed before confidence approaches saturation. pub const NARS_PERSONALITY_K: u32 = 1; -/// Quantised NARS truth — the canonical, float-free wire form (mirrors the -/// `CausalEdge64` `confidence_u8` + i4 mantissa fields). `255` = 1.0. +/// Quantised NARS truth — the canonical, float-free **substrate** representation +/// (mirrors the `CausalEdge64` `confidence_u8` + i4 mantissa fields). `255` = 1.0. +/// +/// Not "the wire form": that wording was retired by `D-BBB-NARS-1` (2026-09-07), +/// which separates two claims the workspace had been conflating. This type is +/// canonical at T0. What crosses a membrane is decided separately and by SHAPE — +/// a truth LITERAL may cross as itself; a truth POPULATION never crosses, it +/// crosses as an opaque descriptor. See `.claude/knowledge/membrane-tiers.md` +/// § "T1 has TWO sibling algebras". #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub struct TruthU8 { /// NARS frequency, `0..=255` (255 = 1.0).