Drei gestrandete Linien landen — und die vierte bleibt draußen, weil sie angehalten wurde

.claude/board/ISSUES.md

@@ -1,5 +1,42 @@
 # Issues Log — Open + Resolved (double-entry, append-only)
 
+## ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS (2026-08-22) — OPEN
+
+`crates/causal-edge` is workspace-EXCLUDED but a path-dep of `lance-graph`,
+`lance-graph-planner`, `cognitive-shader-driver` and `sigma-tier-router`, so
+its LIB compiles inside gated builds while its TESTS ran nowhere but on a
+developer machine. #981 landed a `#[test]` there and #982 lands two
+falsifiers there; none of them could ever have gone red in CI.
+
+**Fixed in the same PR that files this:** a `cargo test --manifest-path
+crates/causal-edge/Cargo.toml` step in `rust-test.yml` (75 green, measured on
+the pinned 1.97.1) and a `cargo fmt … -- --check` step in `style.yml` (clean
+today).
+
+**Deliberately NOT gated: clippy.** `cargo clippy --manifest-path
+crates/causal-edge/Cargo.toml --all-targets -- -D warnings` returns **7
+errors**, all pre-existing and none in the file #982 touches:
+
+```
+src/edge.rs:118, :120, :200, :685, :743, :748, :835
+src/tables.rs:37
+src/v2_layout_tests.rs:20
+```
+
+(identical-if-blocks ×1, too-many-arguments ×2, wildcard-covers-any ×1,
+collapsible-if ×2, doc-list-item-without-indentation ×1)
+
+Gating them in this PR would fail it for defects it did not introduce. They
+need their own pass. Until then this crate has a test gate and a format gate
+but no lint gate, and that asymmetry is deliberate and recorded here rather
+than left to be rediscovered.
+
+Context: `EPIPHANIES.md`
+`E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1` — no workflow
+runs `--workspace`, so every gate is a hand-maintained allowlist; nine
+workspace members plus this excluded crate were reached by nothing.
+
+
 ## ISS-HYDRATE-ENV-READER-IS-A-SECOND-COPY-OF-DEV-S3-ENV (2026-08-17) — OPEN, deliberate-with-a-named-exit
 
 `crates/lance-graph-hydrate/src/env.rs` reproduces

.claude/board/STATUS_BOARD.md

@@ -57,7 +57,7 @@ the rest.
 | D-ACR-0 | Audit `attention_mask.rs`/`attention_mask_actor.rs`: residue carrier, or a name collision? Report only | **Shipped** 2026-08-21 — `.claude/ATTENTION_MASK_AUDIT_2026_08_21.md`. Verdict **EXISTS-UNCALLED** + a name collision: the shipped type is a *rename register file* (`causaledge64-mailbox-rename-soa-v1.md` §4), not a residue carrier | recorded EXISTS-UNCALLED (0 callers workspace-wide + 3 sibling repos); piece E regraded — not a basis for D-ACR-1 |
 | D-ACR-1 | `RowFocusMask` — the one missing primitive (S3.1b names it; no crate contains it) | **Shipped** 2026-08-21 — `contract::attention_facet`. Basis: **reuse** `FacetCascade` + `CascadeShape::G6D2`, zero new bytes; `FocusAxis` is content-blind (`Axis0..Axis5`), composition is **prefix containment**, never bit-OR; explicit `depth` outside the 12 bytes (`NiblePath` precedent) | can-fire AND can-stay-silent on non-trivial input — **both green**, plus a not-a-blind-OR negative and a 1000-entry container (no `FieldMask` 64 / `WideFieldMask` 256 cap inherited) |
 | D-ACR-7 | The 59..63 reading contract (§3b): name per `(classid, rail)` which lens applies and which witness carrier discriminates evidence-kind. Acceptance: tactic sampling filters on `delta_conf` capability (14/34), never on `maturity().is_production()` (31/34) | **Shipped** 2026-08-21 — `contract::band_reading` + `ClassView::band_reading` + the G10b gate test in `causal-edge`. Spec RATIFIED same day via 5+3 council (`.claude/plans/dacr7-band-reading-contract-v1.md`; **3×BLOCK(P0) raised, 3 resolved in Phase 4, none argued away**). Scope covers BOTH carriers (CE64 bits 59-63 + `CausalEdgeV3` bytes [8]/[9]); `EdgeProvenance::V3Register` is a caller ASSERTION because `from_v1` drops provenance — unstated ⇒ `Unknown` ⇒ refuse. L1 split shipped: declaration lookup TOTAL, raw-bit projection FALLIBLE | G1 (1207, +13), G2, G3′, G4′, G5a, G5b, G6 (14 admitted / 20 rejected against the real `all_kernels()`, ≠ the 31 production count), G7′, G8, G9, G10b — all green |
-| D-ACR-3 | The one-way invariant as a test: no ontology-owned write traces to a patient-tagged read through ANY call path (corrected from write-authorization-only after CodeRabbit found a session-derived value can flow to the ontology owner via a shared parameter/return, then be written as the owner's own act) | Queued — gates on D-ACR-1 | a write whose call graph includes a session-tagged read is the bug, even if the write itself is authored by the ontology owner |
+| D-ACR-3 | The one-way invariant as a test: no ontology-owned write traces to a patient-tagged read through ANY call path (corrected from write-authorization-only after CodeRabbit found a session-derived value can flow to the ontology owner via a shared parameter/return, then be written as the owner's own act) | **Queued — the D-ACR-1 gate cleared, but a SECOND blocker was found 2026-08-21: the write path it must guard does not exist.** `SoaEnvelope` has ONE production implementor (`NodeRowPacket`, `canonical_node.rs:1540`; the other two are test types) and `mailbox_owner()` has **zero callers outside its own module**. There is no ontology-owned write to trace TO and no session-tagged read to trace FROM, so the test would assert something no code can violate — the exact shape the falsifiability rule forbids (*"what input would make this fail? If none exists, delete or rewrite it"*). Same finding shape as D-ACR-0's EXISTS-UNCALLED. Gates on a real write path, not on D-ACR-1 | a write whose call graph includes a session-tagged read is the bug, even if the write itself is authored by the ontology owner |
 | D-ACR-2 | Mint the Rung-ladder rail | Queued — gates on operator mint decision (HTT §8 Q3) | `rail_carving` gains its first non-default consumer |
 | D-ACR-4 | Second-order row at the same address, separate table | Queued | a rung-2 read reconstructs where rung-1 looked, on a fixture with an independent answer |
 | D-ACR-5 | 64k lowering | **BLOCKED** — dialectic V4's own gate (V0–V3 green at small scale) | — |

.github/workflows/rust-test.yml

@@ -165,6 +165,24 @@ jobs:
       # what this step ran before, so it cannot lose coverage.
       - name: Run supervisor tests (W2b real-owner probes + #879 cycle driver)
         run: cargo test --manifest-path crates/lance-graph-supervisor/Cargo.toml --features supervisor,cycle-driver
+      # causal-edge: workspace-EXCLUDED, but a path-dep of lance-graph,
+      # lance-graph-planner, cognitive-shader-driver and sigma-tier-router — so
+      # its LIB already compiles inside gated builds while its TESTS ran
+      # nowhere but on a developer machine. #981 landed a #[test] here and this
+      # PR lands two falsifiers here; none of them could ever have gone red in
+      # CI. Same "blind gate" closed above for deepnsm / supervisor /
+      # bgz-tensor, one crate at a time.
+      #
+      # Verified locally before landing: 75 passed, 0 failed.
+      #
+      # Deliberately TESTS ONLY. A `clippy -D warnings` step would be red on
+      # arrival: the crate carries 7 pre-existing findings, all in edge.rs /
+      # tables.rs / v2_layout_tests.rs and NONE in the edge_v3.rs this PR
+      # touches. Gating them here would fail this PR for defects it did not
+      # introduce; they are recorded in ISSUES
+      # ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS instead.
+      - name: Run causal-edge tests (workspace-excluded, previously ungated)
+        run: cargo test --manifest-path crates/causal-edge/Cargo.toml
       # bgz-tensor: workspace-EXCLUDED metric-algebraic codec crate (deps the
       # ndarray sibling checked out above + in-repo holograph). None of the
       # steps above reach it, so its 207 lib tests — including the V3

.github/workflows/style.yml

@@ -148,6 +148,12 @@ jobs:
           components: rustfmt
       - name: Check formatting (lance-graph)
         run: cargo fmt --manifest-path crates/lance-graph/Cargo.toml -- --check
+      # causal-edge: workspace-excluded, so `cargo fmt --all` never reaches it.
+      # It is rustfmt-clean today (verified before adding this step); the check
+      # keeps it that way. Its clippy debt is NOT gated here — see the
+      # rust-test.yml step for why.
+      - name: Rustfmt causal-edge (workspace-excluded, previously ungated)
+        run: cargo fmt --manifest-path crates/causal-edge/Cargo.toml -- --check
       # deepnsm is a standalone, workspace-excluded codec crate, so
       # `cargo fmt --all` never reaches it. It was brought to a rustfmt-clean
       # baseline in this PR; check it explicitly so it can't silently drift.

crates/causal-edge/src/edge_v3.rs

@@ -114,6 +114,11 @@ impl CausalEdgeV3 {
     ///
     /// **Not lifted:** the deprecated v2 `temporal` (not valid CE64-v2 state;
     /// V3's TE is an independent producer-set offset).
+    ///
+    /// **Provenance:** copying the v2 tail (`w_slot`/`truth`/`spare`) ASSERTS
+    /// that its producer stamped it deliberately. When you do not know that,
+    /// use [`Self::from_v1_tail_unstated`] — see its doc for why the signature
+    /// alone cannot tell the two cases apart (D-ACR-7 BLOCK-1).
     pub fn from_v1(e: CausalEdge64, target: u16) -> Self {
         let mut p = [0u8; 12];
         p[0] = e.frequency_u8();
@@ -140,6 +145,42 @@ impl CausalEdgeV3 {
         Self { payload: p }
     }
 
+    /// Lift a [`CausalEdge64`] whose v2 tail is **UNSTATED** — bytes `[8]`/`[9]`
+    /// are zeroed instead of copied.
+    ///
+    /// # Why this exists (D-ACR-7 BLOCK-1)
+    ///
+    /// [`Self::from_v1`] copies `w_slot`/`truth`/`spare` raw. Under the **v1**
+    /// layout that is provably safe: those accessors are documented zero stubs
+    /// (`edge.rs`, `truth_raw` and `spare` return `0`), so the copy writes
+    /// zeros anyway. Under **v2** they read real bits — and nothing in the
+    /// signature says whether a producer deliberately stamped them or whether
+    /// they are residue from a source that never meant anything by them.
+    ///
+    /// The reading contract that consumes these bits
+    /// (`lance_graph_contract::band_reading`) resolves that gap by making
+    /// provenance a **caller assertion**: unstated means refuse. This
+    /// constructor is that assertion's honest half on the WRITE side — a lift
+    /// that declines to claim the tail. A consumer then reads the zero-fallback
+    /// (`Trust` / band `Absent`) rather than a plausible wrong ordinal.
+    ///
+    /// **Pick by what you know**, not by convenience:
+    ///
+    /// | you know | use |
+    /// |---|---|
+    /// | the producer stamped the tail | [`Self::from_v1`] |
+    /// | you do not know, or the source predates the stamp | **this** |
+    ///
+    /// Every other field is lifted exactly as [`Self::from_v1`] lifts it.
+    /// Note that [`Self::rehydrate`] on the result is therefore **not** a
+    /// bit-exact round trip of the source: the tail was deliberately dropped.
+    pub fn from_v1_tail_unstated(e: CausalEdge64, target: u16) -> Self {
+        let mut v3 = Self::from_v1(e, target);
+        v3.payload[8] = 0;
+        v3.payload[9] = 0;
+        v3
+    }
+
     /// NARS frequency (u8, `f = val/255`) — byte 0.
     pub fn frequency(&self) -> u8 {
         self.payload[0]
@@ -757,4 +798,76 @@ mod tests {
         assert_eq!(vz.truth_raw(), 0);
         assert_eq!(vz.spare_raw(), 0);
     }
+
+    /// D-ACR-7 BLOCK-1, write side: the unstated lift DROPS the tail while the
+    /// plain lift CLAIMS it. Two-sided by construction — a constructor that
+    /// zeroed unconditionally, or one that never differed from `from_v1`,
+    /// would carry exactly as much information as no constructor at all.
+    #[cfg(feature = "causal-edge-v2-layout")]
+    #[test]
+    fn from_v1_tail_unstated_drops_what_from_v1_claims() {
+        use crate::layout::{CausalTopology, ReasoningBand};
+
+        // A source whose tail is NON-ZERO — without this the two lifts agree
+        // trivially and the test proves nothing.
+        let e = sample_edges()[0]
+            .with_w_slot(0x2A)
+            .with_topology(CausalTopology::Unknown)
+            .with_reasoning_band(ReasoningBand::Transcendent);
+        assert_ne!(
+            (e.truth_raw(), e.spare()),
+            (0, 0),
+            "fixture must have a tail"
+        );
+
+        let claimed = CausalEdgeV3::from_v1(e, 7);
+        let unstated = CausalEdgeV3::from_v1_tail_unstated(e, 7);
+
+        // CLAIMS: the tail survives, ordinal for ordinal.
+        assert_eq!(claimed.truth_raw(), e.truth_raw());
+        assert_eq!(claimed.spare_raw(), e.spare());
+        assert_eq!(claimed.w_slot(), e.w_slot() & 0x3F);
+
+        // DECLINES: the tail is zero, so a consumer reads the zero-fallback
+        // rather than an ordinal nobody vouched for.
+        assert_eq!(
+            unstated.truth_raw(),
+            0,
+            "unstated lift must not claim truth"
+        );
+        assert_eq!(
+            unstated.spare_raw(),
+            0,
+            "unstated lift must not claim a band"
+        );
+        assert_eq!(unstated.w_slot(), 0, "the whole tail is dropped, not half");
+
+        // And ONLY the tail differs — every other lifted field is identical.
+        let (a, b) = (claimed.to_le_bytes(), unstated.to_le_bytes());
+        assert_eq!(a[..8], b[..8], "bytes 0..8 must be untouched by the choice");
+        assert_eq!(
+            a[10..],
+            b[10..],
+            "bytes 10.. must be untouched by the choice"
+        );
+        assert_ne!(
+            a[8..10],
+            b[8..10],
+            "and the tail bytes must be what differs"
+        );
+    }
+
+    /// The can-stay-silent half: on a source whose tail is ALREADY zero the two
+    /// lifts are byte-identical. The constructor is a declaration about
+    /// provenance, never an unconditional mutation.
+    #[cfg(feature = "causal-edge-v2-layout")]
+    #[test]
+    fn on_a_zero_tail_the_two_lifts_agree() {
+        let z = sample_edges()[1];
+        assert_eq!((z.truth_raw(), z.spare()), (0, 0));
+        assert_eq!(
+            CausalEdgeV3::from_v1(z, 7).to_le_bytes(),
+            CausalEdgeV3::from_v1_tail_unstated(z, 7).to_le_bytes(),
+        );
+    }
 }