S3.0 — the exact HHTL causal-literal address

.claude/board/EPIPHANIES.md

@@ -1,3 +1,90 @@
+## 2026-08-20 — E-THE-LITERAL-CANNOT-LIVE-IN-THE-PATH-IT-ROOTS-1
+
+**Status:** FINDING (measured, S3.0 / PR arc). The Stage-3 brief asks for an
+exact HHTL causal-literal address AND (its §4) an evidence subtree hanging
+beneath it — `/causality/A/causes/B/{observed,interventional,counterfactual,…}`.
+**Those two requirements cannot both be met by one `NiblePath`, and the
+arithmetic says so exactly, with zero slack:**
+
+| component | width | nibbles |
+|---|---|---|
+| domain / ClassView `u16` | 16 bit | 4 |
+| canonical subject `u16` | 16 bit | 4 |
+| canonical predicate `u16` | 16 bit | 4 |
+| canonical object `u16` | 16 bit | 4 |
+| **total** | **64 bit** | **16 = `hhtl::MAX_DEPTH`** |
+
+`NiblePath` is a `u64` of 16 nibbles. A `domain·S·P·O` address consumes it
+**entirely** — remaining depth for the evidence subtree: **0**. And this is not
+a soft limit: `NiblePath`'s own docs record that descending past `MAX_DEPTH` is
+a *silent no-op which collides distinct deeper paths*, which is why
+`is_full`/`try_child` exist at all. A literal that spent the whole budget could
+never carry its own evidence tree in the same nibble space, and would fail
+silently rather than loudly.
+
+**So identity and routing are split, which is the canon's own ref-escape rule**
+(*"grows unbounded → path/ref"*): identity is the component tuple (`CausalLiteral`,
+8 bytes of pure address, `const _`-asserted); routing is a deliberately LOSSY
+prefix projection used for locality and cohort slicing (brief §29) and never for
+equality.
+
+**The load-bearing test is the one that proves the projection LOSSY.**
+`routing_prefix_is_not_identity` asserts that two genuinely different
+propositions — same domain, subject and predicate, different object — **share**
+their 12-nibble prefix, with a paired half proving full depth still separates
+them. Without it, "prefix ≠ identity" is a doc claim, and Stage-3 falsifiers #3
+(CAM-PQ as identity) and #19 (a local target read as absolute identity) are the
+same mistake this projection invites. Cf. the can-it-STAY-SILENT twin: a guard
+that fires on everything carries as much information as one that never fires.
+
+**Corollary that keeps S3.0 inside operator ruling E.** Ruling E
+(`ARC-B-OWNERSHIP-AND-ADDRESSING-REASSESSMENT.md` §4) gates every new tenant
+behind *"genuinely missing canonical information, or a container minted to avoid
+completing the address transition?"* — and answers, for the EW64 case, that the
+missing canonical reference "is the prerequisite" and that the tenant gap and
+the addressing gap "are the same problem wearing two hats". The causal literal
+**is** that prerequisite: it adds no bits to `CausalEdge64`, no slot to any
+tenant, and no packed layout. It is the address the ruling said had to come
+first.
+
+---
+
+## 2026-08-20 — E-A-DISABLE-THAT-DOES-NOT-BIND-IS-NOT-A-DISABLE-2
+
+**Status:** FINDING (second instance in two PRs; the first was
+`E-THE-COMPAT-ENUM-WAS-EATING-HALF-THE-REGISTER-1`'s method note). Same lesson,
+sharper failure, and this time the disable was **syntactically applied** — the
+anchor assertion I added after the last instance fired correctly and reported
+`[anchor found + replaced]`. It still proved nothing.
+
+**What happened.** To falsify `routing_prefix_is_not_identity` I made
+`routing_prefix` fold all four components together:
+`packed ^ (packed>>16) ^ (packed>>32) ^ (packed>>48)`. The test stayed GREEN,
+which reads exactly like *"this test does not actually check anything."*
+
+**It was the disable that was inert.** All three shifts move bits *right*, so
+the object (bits 15..0) never reaches the first 12 nibbles the test inspects —
+`folded[63..16]` is identical for the two fixtures by construction. Verified
+arithmetically before touching the file again: old fold → both `111133330000`;
+`packed ^ (packed<<48)` → `555522223333` vs `444422223333`. With the binding
+fold the test goes red on its exact message.
+
+**The generalisable rule, now with two independent instances.** A disable is
+only evidence if the perturbation reaches the quantity the assertion reads.
+Three ways to get this wrong, all seen in this workspace:
+
+1. the edit does not apply (malformed pattern) — fixed by asserting the anchor;
+2. the edit applies but the perturbed quantity cannot pass the relaxed test by
+   another route (tesseract-rs: zeroing a constant a negative value still fails);
+3. **the edit applies and perturbs the right function, but not the bits under
+   test** — this instance.
+
+The anchor assertion catches (1) only. For (3) the check is arithmetic: compute,
+before running, that the disabled version differs *at the position the assertion
+reads*. Two lines of Python beat one misread green.
+
+---
+
 ## 2026-08-20 — E-THE-COMPAT-ENUM-WAS-EATING-HALF-THE-REGISTER-1
 
 **Status:** FINDING (measured + fixed, PR #971). `CausalEdgeV3::rehydrate`

.claude/board/LATEST_STATE.md

@@ -1,3 +1,57 @@
+## 2026-08-20 — branch `claude/s3-0-causal-literal` — S3.0: the exact HHTL causal-literal address
+
+### Current Contract Inventory — 1 new zero-dep type, no packed tenant
+
+- **`lance_graph_contract::causal_literal`** (new module):
+  - **`CausalLiteral { domain, subject, predicate, object }`** — four `u16`
+    canonical ordinals, **8 bytes of pure address**, `const _`-asserted at 8.
+    That assert is the structural guard behind the headline claim: identity
+    cannot depend on evidence count, NARS `f`/`c`, a source id, a CAM-PQ
+    assignment or a Lance version, because there is **nowhere to put them** —
+    adding such a field is a compile error, not a review catch.
+  - `new` / `domain` / `subject` / `predicate` / `object` / `is_fully_bound`
+  - `as_u64` / `from_u64` / `to_le_bytes` / `from_le_bytes` — the exact,
+    reversible, persisted identity (canonical ordinals, never runtime strings)
+  - `routing_prefix(depth)` / `full_path()` — the **lossy** HHTL cohort
+    projection, proven lossy by test, never identity
+  - `ConceptId` / `DomainId` / `UNBOUND` / `NIBBLES_PER_COMPONENT` /
+    `LITERAL_PATH_NIBBLES` (`const _`-asserted `== hhtl::MAX_DEPTH`)
+- **No `ValueTenant`, no CE64 bit added, no V3 reserved byte spent, no
+  `ENVELOPE_LAYOUT_VERSION` bump.** Ruling E's gate is answered in the module
+  doc rather than assumed.
+- **Deliberately absent:** `is_transitive`, relation class, composition policy.
+  Predicate *meaning* resolves through domain → codebook → `ResolvedPredicate`
+  and fails CLOSED on unknown — that is S3.3 and lives elsewhere. HHTL supplies
+  hierarchy, locality and exact addressing; it does not decide what `CAUSES`
+  means.
+
+### The measured constraint that decided the shape
+
+`domain+S+P+O` at `u16` each is **exactly 64 bits = exactly `MAX_DEPTH`**, so a
+literal expressed as one `NiblePath` leaves **zero** depth for the §4 evidence
+subtree — and `NiblePath` collides silently past the ceiling. Identity is
+therefore the tuple; the evidence tree ref-escapes. Full reasoning:
+`E-THE-LITERAL-CANNOT-LIVE-IN-THE-PATH-IT-ROOTS-1`.
+
+### Gates
+
+`lance-graph-contract` **1180/1180** (9 new) + every example suite green; fmt
+clean; clippy `--all-targets --no-deps -D warnings` clean; downstream
+`lance-graph-planner` Stage-2.6a harness still 4/4. **Four disable-runs,
+each verified red-then-green** — and a fifth attempt that came back green was
+diagnosed as an *inert disable* (arithmetically proven not to perturb the bits
+under test) and re-run correctly, recorded as
+`E-A-DISABLE-THAT-DOES-NOT-BIND-IS-NOT-A-DISABLE-2`.
+
+### Not in this PR (the brief's own order)
+
+S3.1 Meta tree · S3.2 V3 local proxy bridge · S3.3 `ResolvedPredicate` ·
+S3.4 DisMech · S3.5 NARS evidence mass · S3.6 JC measurement · S3.7 semantic
+recipe projection · S3.8 potholes/backcast · S3.9 Pearl validation.
+Stage-2/2.5/2.6 remain the frozen baseline — untouched here.
+
+---
+
 ## 2026-08-20 — branch `claude/carve-nars-kernels` — CE64 ⇄ V3 conversion losslessness (Stage-3 handoff gate)
 
 ### Current Contract Inventory — 8 new read accessors on `CausalEdgeV3`, no layout change

.claude/board/STATUS_BOARD.md

@@ -1,3 +1,28 @@
+## stage-3 — exact causal literals + amortized epistemic trees (operator brief, 2026-08-20)
+
+Delivery order is the brief's own §38; **not** to be attempted in one PR.
+Stage-2/2.5/2.6 (PR #971) is the frozen substrate baseline: representation
+totality and reasoning parity are two SEPARATE proofs and neither is reopened
+without a real falsifier.
+
+| D-id | Deliverable | Status |
+|---|---|---|
+| S3.0 | exact HHTL causal-literal address (`contract::causal_literal`) | **In PR** |
+| S3.1 | `CausalMeta` + `EpistemicMeta` tree contract; rebuild-from-leaves | Queued |
+| S3.2 | V3 local-proxy bridge (absolute identity survives local indirection) | Queued |
+| S3.3 | `ResolvedPredicate`; unknown fails CLOSED; explicit composition | Queued |
+| S3.4 | DisMech adapter — map sources onto EXISTING literals, never mint per source | Queued |
+| S3.5 | NARS evidence mass: raw/source/HEEL/effective, deterministic W+/W− | Queued |
+| S3.6 | JC measurement per predicate × cohort × horizon × instrument | Queued |
+| S3.7 | `ReasoningSituation` → ThoughtCtx projection; measure the 17 mute kernels | Queued |
+| S3.8 | potholes, first_possible vs first_derived, strict historical replay | Queued |
+| S3.9 | Pearl validation — earn the SPO 2³ projections empirically | Queued |
+
+20 hard falsifiers are listed in the brief's §39. The ones S3.0 answers now:
+**#1** (same canonical tuple → same literal), **#2** (distinct predicates never
+collide), **#3** (CAM-PQ is not identity) and **#19** (a local target is not
+absolute identity) — the last two via the *proven-lossy* routing projection.
+
 ## preparation-arc plan wave — 2026-08-19 (operator: "integration plans for all open arcs")
 
 Five plans, each PROPOSED (no code — the reset charter's audit-first order